Correctly handle wheel group authentication (#19091).

1 files changed, 1 insertions, 1 deletions

diff --git a/src/msec/libmsec.py b/src/msec/libmsec.py
index b32d5b4..ae04f74 100755
--- a/src/msec/libmsec.py
+++ b/src/msec/libmsec.py
@@ -1162,7 +1162,7 @@ class MSEC:
                 if su.exists():
                     (su.replace_line_matching('^[#\s]*auth\s+required\s+(?:/lib/security/)?pam_wheel.so\s+use_uid\s*$',
                                                           'auth       required     pam_wheel.so use_uid') or \
-                                 su.insert_after('^auth\s+required', 'auth       required     pam_wheel.so use_uid'))
+                                 su.insert_before('^auth\s+include', 'auth       required     pam_wheel.so use_uid'))
         else:
             if val:
                 self.log.info(_('Allowing su for all'))