Issue 1:
ISSUE TYPE

Bug Report

ANSIBLE VERSION

ansible 2.1.0.0
config file = /etc/ansible/ansible.cfg
configured module search path = Default w/o overrides

CONFIGURATION

Bone stock

OS / ENVIRONMENT

CentOS 7

SUMMARY

When lineinfile with regexp finds a match, it substitutes properly. When it doesn't find a match (say, on subsequent runs), it just dumps the specified line at the bottom of the file as if you hadn't specified a regexp. Needless to say, this breaks idempotence.

STEPS TO REPRODUCE

Take a look at a file.

Run lineinfile with regexp that matches a line

See that your line was in fact replaced.

Run lineinfile again.

See that the specified replacement line is now duplicated at the bottom of the file.

- name: Add ops scripts to sudo secure_path
lineinfile:
dest: /etc/sudoers
regexp: >
^Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin$
line: 'Defaults secure_path = /opt/d7/bin:/sbin:/bin:/usr/sbin:/usr/bin'
validate: visudo -cf %s

EXPECTED RESULTS

Idempotent line replacement after a second run

# Refuse to run if unable to disable echo on the tty.
Defaults !visiblepw

#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults always_set_home

Defaults env_reset
Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults env_keep += "HOME"

Defaults secure_path = /opt/d7/bin:/sbin:/bin:/usr/sbin:/usr/bin

## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## user MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root ALL=(ALL) ALL

## Allows people in group wheel to run all commands without a password
%wheel ALL=(ALL) NOPASSWD: ALL

ACTUAL RESULTS

Potentially show-stopping garbage at the bottom of a file

# Refuse to run if unable to disable echo on the tty.
Defaults !visiblepw

#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults always_set_home

Defaults env_reset
Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults env_keep += "HOME"

Defaults secure_path = /opt/d7/bin:/sbin:/bin:/usr/sbin:/usr/bin

## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## user MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root ALL=(ALL) ALL

## Allows people in group wheel to run all commands without a password
%wheel ALL=(ALL) NOPASSWD: ALL
Defaults secure_path = /opt/d7/bin:/sbin:/bin:/usr/sbin:/usr/bin

Issue 2:
ISSUE TYPE

Bug Report

ANSIBLE VERSION

ansible 2.1.0.0
config file = /home/remedy/scenter-playbooks/ansible.cfg
configured module search path = Default w/o overrides

CONFIGURATION

[defaults]
ask_vault_pass=False

OS / ENVIRONMENT

N/A

SUMMARY

lineinfile module creates duplicate lines on the second and subsequent runs if its regexp arg contains quantifiers (+, * etc.)

STEPS TO REPRODUCE

On the first run this task replaces SELINUX= # with SELINUX=enforcing

- lineinfile: dest=/etc/selinux/config regexp='^SELINUX=\s+#' line=SELINUX=enforcing

On the subsequent runs this task creates duplicate lines SELINUX=enforcing

EXPECTED RESULTS

SELINUX=enforcing

ACTUAL RESULTS

SELINUX=enforcing
SELINUX=enforcing
...