pam_faillock.so loading concerns
CCE-86931-3 (The pam_faillock.so module must be loaded in preauth in /etc/pam.d/password-auth.) comes up when using Ubi 8.
a similar CCE requiring this as preauth in preauth in /etc/pam.d/system-auth seems to be handled already. Can the above security concern also be addressed in base ubi-8?