Is it a request for Tumbleweed only, or should it be done for Leap 15 & SLE 15 as well? And additional question: pam files are %config(noreplace). The default behavior of rpm: If the file is not changed, use the new copy. If the file was changed, save new copy as foo.rpmnew and keep the old instance active. If you want to force the line into user customized pam files, you would need a special %post hacks.