Issue 1:
ISSUE TYPE

Bug Report

COMPONENT NAME

retries ... until

ANSIBLE VERSION

2.2.0.0

CONFIGURATION

default

OS / ENVIRONMENT

Ubuntu 16.04

SUMMARY

In my playbooks, I often use a variable in 'retries' in order to be able to adjust this value.

When I want do disable the 'retries' with 0, 'until' expression is not evaluated, which results in a different behavior than when I use 'retries' > 0.

STEPS TO REPRODUCE

Use this playbook:

- hosts: all
gather_facts: false
tasks:
- command: "echo this is an error"
retries: "{{ nb_retries }}"
delay: 1
register: result
until: '"error" not in result.stdout'

If I use nb_retries = 1, task fails (expected behavior) :

ansible-playbook -c local -i "localhost," site.yml -e nb_retries=1

If I use nb_retries = 0, task succeeded :

ansible-playbook -c local -i "localhost," site.yml -e nb_retries=0

To fix that, I need to overwrite 'failed_when' expression which makes an inverted duplicate of 'until' :

- hosts: all
gather_facts: false
tasks:
- command: "echo this is an error"
retries: "{{ nb_retries }}"
delay: 1
register: result
failed_when: '"error" in result.stdout'
until: '"error" not in result.stdout'

EXPECTED RESULTS

Both commands fails (with retries=0 or retries=1)

ACTUAL RESULTS

$ ansible-playbook -c local -i "localhost," site.yml -e nb_retries=0
PLAY [all] *********************************************************************

TASK [command] *****************************************************************
changed: [localhost]

PLAY RECAP *********************************************************************
localhost : ok=1 changed=1 unreachable=0 failed=0

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

/usr/lib/python2.7/site-packages/ansible/modules/system/pamd.py

ANSIBLE VERSION

# ansible --version
ansible 2.3.0.0
config file = /etc/ansible/ansible.cfg
configured module search path = Default w/o overrides
python version = 2.7.5 (default, Aug 29 2016, 10:12:21) [GCC 4.8.5 20150623 (Red Hat 4.8.5-4)]

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

The last pamd.py update has a bug, after/before state duplicate lines, is not idempotent. I took the library from pamd-fixes (#25817).

STEPS TO REPRODUCE

---
- hosts: lab
gather_facts: yes
remote_user: gnfux
become: yes
become_method: sudo
tasks:
- name: "Ensure cryptographic hash and rember last 6 pwd /etc/pam.d/system-auth"
become: yes
pamdl:
path: /etc/pam.d/
name: system-auth
type: password
control: requisite
module_path: pam_cracklib.so
new_type: password
new_control: sufficient
new_module_path: pam_unix.so
module_arguments: 'remember=6 sha512 shadow nullok try_first_pass use_authtok'
state: after

EXPECTED RESULTS

/etc/pam.d/system-auth
auth	required	pam_env.so
auth	required	pam_tally2.so deny=5 onerr=fail
auth	sufficient	pam_unix.so nullok try_first_pass
auth	requisite	pam_succeed_if.so uid >= 1000 quiet_success
auth	required	pam_deny.so

password	requisite	pam_cracklib.so retry=5 minlen=6 dcredit=-1 ucredit=0 lcredit=-1 ocredit=0 reject_username
password	sufficient	pam_unix.so remember=6 sha512 shadow nullok try_first_pass use_authtok
password	sufficient	pam_sss.so use_authtok
password	required	pam_deny.so

ACTUAL RESULTS

/etc/pam.d/system-auth

auth	required	pam_env.so
auth	required	pam_tally2.so deny=5 onerr=fail
auth	sufficient	pam_unix.so nullok try_first_pass
auth	requisite	pam_succeed_if.so uid >= 1000 quiet_success
auth	required	pam_deny.so

password	requisite	pam_cracklib.so retry=5 minlen=6 dcredit=-1 ucredit=0 lcredit=-1 ocredit=0 reject_username
password	sufficient	pam_unix.so remember=6 sha512 shadow nullok try_first_pass use_authtok
password	sufficient	pam_unix.so remember=6 sha512 shadow nullok try_first_pass use_authtok
password	sufficient	pam_sss.so use_authtok
password	required	pam_deny.so