etc/pam.d/su

   1 #%PAM-1.0
   2 auth            sufficient      pam_rootok.so
   3 # Uncomment the following line to implicitly trust users in the "wheel" group.
   4 #auth           sufficient      pam_wheel.so trust use_uid
   5 # Uncomment the following line to require a user to be in the "wheel" group.
   6 auth            required        pam_wheel.so use_uid
   7 auth            include         system-auth
   8 account         include         system-auth
   9 password        include         system-auth
  10 session         required        pam_selinux.so close
  11 session         include         system-auth
  12 session         required        pam_selinux.so open multiple
  13 session         optional        pam_xauth.so