`5.6 | Ensure access to the su command is restricted` tasks do not account for lines commented out in pam.d about ubuntu18-cis HOT 2 CLOSED

FYI here is an example from the GSA how they handle this criteria in their role using lineinfile:
https://github.com/GSA/ansible-os-ubuntu18/blob/master/tasks/section5.yml#L809

- name: "SCORED | 5.6 | PATCH | Ensure access to the su command is restricted"
  lineinfile:
      state: present
      dest: /etc/pam.d/su
      regexp: '^(#)?auth\s+required\s+pam_wheel\.so'
      line: "auth           required        pam_wheel.so use_uid"
  when:
      - ubuntu1804cis_rule_5_6
  tags:
      - level1
      - patch
      - rule_5.6
      - scored

from ubuntu18-cis.

Hello,
Thanks for raising the issue. I have added a little more robust regex to control a bit more of what it is looking for. One issue I discovered is if there are no existing or commented out instances where do we put the line. With that I noticed that there was an error in the task where it was always going at the bottom of the file, which is the wrong place for that required pam_wheel element. Since rootok should generally be there I have it inserting below that if there are no instances of auth required pam_wheel. Thanks for raising the issue and I will close this ticket once I get it into devel. Thanks again

George

from ubuntu18-cis.