<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>

<p dir="auto">selinux</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.4.0.0
  config file = /home/bert/.ansible.cfg
  configured module search path = [u'/home/bert/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.13 (default, May 10 2017, 20:04:28) [GCC 6.3.1 20161221 (Red Hat 6.3.1-1)]"><pre class="notranslate"><code class="notranslate">ansible 2.4.0.0
  config file = /home/bert/.ansible.cfg
  configured module search path = [u'/home/bert/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.13 (default, May 10 2017, 20:04:28) [GCC 6.3.1 20161221 (Red Hat 6.3.1-1)]
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="CACHE_PLUGIN(/home/bert/.ansible.cfg) = redis
COMMAND_WARNINGS(/home/bert/.ansible.cfg) = True
DEFAULT_CALLBACK_PLUGIN_PATH(/home/bert/.ansible.cfg) = [u'/home/bert/.ansible/plugins/callback_plugi
DEFAULT_GATHERING(/home/bert/.ansible.cfg) = smart
DEFAULT_LOAD_CALLBACK_PLUGINS(/home/bert/.ansible.cfg) = True
DEFAULT_MANAGED_STR(/home/bert/.ansible.cfg) = Ansible managed: {file} modified on %Y-%m-%d %H:%M:%S 
DEFAULT_ROLES_PATH(/home/bert/.ansible.cfg) = [u'/home/bert/.ansible/roles']
RETRY_FILES_ENABLED(/home/bert/.ansible.cfg) = False"><pre class="notranslate"><code class="notranslate">CACHE_PLUGIN(/home/bert/.ansible.cfg) = redis
COMMAND_WARNINGS(/home/bert/.ansible.cfg) = True
DEFAULT_CALLBACK_PLUGIN_PATH(/home/bert/.ansible.cfg) = [u'/home/bert/.ansible/plugins/callback_plugi
DEFAULT_GATHERING(/home/bert/.ansible.cfg) = smart
DEFAULT_LOAD_CALLBACK_PLUGINS(/home/bert/.ansible.cfg) = True
DEFAULT_MANAGED_STR(/home/bert/.ansible.cfg) = Ansible managed: {file} modified on %Y-%m-%d %H:%M:%S 
DEFAULT_ROLES_PATH(/home/bert/.ansible.cfg) = [u'/home/bert/.ansible/roles']
RETRY_FILES_ENABLED(/home/bert/.ansible.cfg) = False
</code></pre></div>
<h5 dir="auto">OS / ENVIRONMENT</h5>

<ul dir="auto">
<li>Management node: Fedora 25</li>
<li>Target machine: CentOS 7.4</li>
</ul>
<h5 dir="auto">SUMMARY</h5>

<p dir="auto">After running a playbook with the SELinux module, the <code class="notranslate">/etc/selinux/config</code> file no longer has line endings. Parsing the config file on subsequent runs of the playbook will fail, as will the <code class="notranslate">sestatus</code> command.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>


<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="---
- hosts: srv001
  become: true
  tasks:
    - name: Ensure SELinux is enforcing
      selinux:
        policy: targeted
        state: enforcing"><pre class="notranslate">---
- <span class="pl-ent">hosts</span>: <span class="pl-s">srv001</span>
  <span class="pl-ent">become</span>: <span class="pl-c1">true</span>
  <span class="pl-ent">tasks</span>:
    - <span class="pl-ent">name</span>: <span class="pl-s">Ensure SELinux is enforcing</span>
      <span class="pl-ent">selinux</span>:
        <span class="pl-ent">policy</span>: <span class="pl-s">targeted</span>
        <span class="pl-ent">state</span>: <span class="pl-s">enforcing</span></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>

<p dir="auto">SELinux config file should contain:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ cat /etc/selinux/config 
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted "><pre class="notranslate"><code class="notranslate">$ cat /etc/selinux/config 
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted 
</code></pre></div>
<h5 dir="auto">ACTUAL RESULTS</h5>


<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ cat /etc/selinux/config 
# This file controls the state of SELinux on the system.# SELINUX= can take one of these three values:#     enforcing - SELinux security policy is enforced.#     permissive - SELinux prints warnings instead of enforcing.#     disabled - No SELinux policy is loaded.SELINUX=enforcing# SELINUXTYPE= can take one of three two values:#     targeted - Targeted processes are protected,#     minimum - Modification of targeted policy. Only selected processes are protected. #     mls - Multi Level Security protection.SELINUXTYPE=targeted"><pre class="notranslate"><code class="notranslate">$ cat /etc/selinux/config 
# This file controls the state of SELinux on the system.# SELINUX= can take one of these three values:#     enforcing - SELinux security policy is enforced.#     permissive - SELinux prints warnings instead of enforcing.#     disabled - No SELinux policy is loaded.SELINUX=enforcing# SELINUXTYPE= can take one of three two values:#     targeted - Targeted processes are protected,#     minimum - Modification of targeted policy. Only selected processes are protected. #     mls - Multi Level Security protection.SELINUXTYPE=targeted
</code></pre></div>
<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">selinux</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.4.0.0"><pre class="notranslate"><code class="notranslate">ansible 2.4.0.0
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ANSIBLE_SSH_PIPELINING(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = True
CACHE_PLUGIN(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = jsonfile
CACHE_PLUGIN_CONNECTION(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = facts
CACHE_PLUGIN_TIMEOUT(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = 600
DEFAULT_GATHERING(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = smart
DEFAULT_HOST_LIST(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = [u'/Users/mwillsher/src/cloud-deployment/ansible-playbooks/inventory/aws']
DEFAULT_ROLES_PATH(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = [u'/Users/mwillsher/src/cloud-deployment/ansible-playbooks/roles', u'/Users/mwillsher/sr
DISPLAY_SKIPPED_HOSTS(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = False
HOST_KEY_CHECKING(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = False"><pre class="notranslate"><code class="notranslate">ANSIBLE_SSH_PIPELINING(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = True
CACHE_PLUGIN(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = jsonfile
CACHE_PLUGIN_CONNECTION(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = facts
CACHE_PLUGIN_TIMEOUT(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = 600
DEFAULT_GATHERING(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = smart
DEFAULT_HOST_LIST(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = [u'/Users/mwillsher/src/cloud-deployment/ansible-playbooks/inventory/aws']
DEFAULT_ROLES_PATH(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = [u'/Users/mwillsher/src/cloud-deployment/ansible-playbooks/roles', u'/Users/mwillsher/sr
DISPLAY_SKIPPED_HOSTS(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = False
HOST_KEY_CHECKING(/Users/mwillsher/src/cloud-deployment/ansible-playbooks/ansible.cfg) = False
</code></pre></div>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">MacOS running Ansible<br>
CentOS 6 target</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">selinux module strips newlines from /etc/sysconfig/selinux</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">Before</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="[root@ip-10-100-151-172 ~]# more /etc/sysconfig/selinux
~
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted"><pre class="notranslate"><code class="notranslate">[root@ip-10-100-151-172 ~]# more /etc/sysconfig/selinux
~
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted
</code></pre></div>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible -m selinux -a &quot;state=disabled&quot; IP -vvv -u root -i inventory/aws/ec2.py"><pre class="notranslate"><code class="notranslate">ansible -m selinux -a "state=disabled" IP -vvv -u root -i inventory/aws/ec2.py
</code></pre></div>
<p dir="auto">After</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# This file controls the state of SELinux on the system.# SELINUX= can take one of these three values:#     enforcing - SELinux security policy is enforced.#     permissive - SELinux prints warnings instead of enforcing.#     disabled - No SELinux policy is loaded.SELINUX=disabled# SELINUXTYPE= can take one of these two values:#     targeted - Targeted processes are protected,#     mls - Multi Level Security protection.SELINUXTYPE=targeted"><pre class="notranslate"><code class="notranslate"># This file controls the state of SELinux on the system.# SELINUX= can take one of these three values:#     enforcing - SELinux security policy is enforced.#     permissive - SELinux prints warnings instead of enforcing.#     disabled - No SELinux policy is loaded.SELINUX=disabled# SELINUXTYPE= can take one of these two values:#     targeted - Targeted processes are protected,#     mls - Multi Level Security protection.SELINUXTYPE=targeted
</code></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">Valuse changed in file and EOL chars left intact.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">New lines removed, file invalid.</p>