coreutils/su.pamd

#%PAM-1.0
auth     sufficient     pam_rootok.so
auth     include        common-auth
account  sufficient     pam_rootok.so
account  include        common-account
password include        common-password
session  include        common-session
session  optional       pam_xauth.so
session  [default=1 success=ignore] pam_succeed_if.so quiet uid > 999
session  required       pam_loginuid.so
session  required       pam_systemd.so kill-exclude-users=0