Comment # 11 on bug 1203481 from Johannes Segitz

Yes, that would be easiest way. I really don't want to have this as a package
in the official builds, even if it's not included/installed by default. It's
just one channel change away from being included in a product without us
noticing.

AFAIK we don't have a mechanism for what you describe unfortunately.

What I would also find acceptable if the PAM module is restricted to limited
capabilities. The half that basically means root should not be available. Then
I would have far lesser issues with this being included again.