RHEL-07-010320 and RHEL-07-010330: module arguments not updating? about rhel7-stig HOT 3 CLOSED

- block:
      - name: |
              "MEDIUM | RHEL-07-010320 | PATCH | Accounts subject to three unsuccessful login attempts within 15 minutes must be locked for the maximum configurable period (add modules)."
              "MEDIUM | RHEL-07-010330 | PATCH | If three unsuccessful logon attempts within 15 minutes occur the associated account must be locked (add modules)."
        pamd:
            name: "{{ item.name }}"
            state: "{{ item.state }}"
            type: "{{ item.type }}"
            control: "{{ item.control }}"
            module_path: pam_unix.so
            new_type: "{{ item.type }}"
            new_control: "{{ item.new_control }}"
            new_module_path: pam_faillock.so
            module_arguments: "{{ item.args }}"
        with_items:
            - { name: "system-auth", state: "before", type: "auth", control: "sufficient", new_control: "required", args: "preauth silent {{ faillock_args }}" }
            - { name: "password-auth", state: "before", type: "auth", control: "sufficient", new_control: "required", args: "preauth silent {{ faillock_args }}" }
            - { name: "system-auth", state: "after", type: "auth", control: "sufficient", new_control: "[default=die]", args: "authfail {{ faillock_args }}" }
            - { name: "password-auth", state: "after", type: "auth", control: "sufficient", new_control: "[default=die]", args: "authfail {{ faillock_args }}" }
            - { name: "system-auth", state: "before", type: "account", control: "required", new_control: "required", args: ""}
            - { name: "password-auth", state: "before", type: "account", control: "required", new_control: "required", args: ""}

      - name: |
              "MEDIUM | RHEL-07-010320 | PATCH | Accounts subject to three unsuccessful login attempts within 15 minutes must be locked for the maximum configurable period (update modules)."
              "MEDIUM | RHEL-07-010330 | PATCH | If three unsuccessful logon attempts within 15 minutes occur the associated account must be locked (update modules)."
        pamd:
            name: "{{ item.name }}"
            state: updated
            type: auth
            control: "{{ item.control }}"
            module_path: pam_faillock.so
            module_arguments: "{{ item.args }}"
        with_items:
            - { name: "system-auth", control: "required", args: "preauth silent {{ faillock_args }}" }
            - { name: "password-auth", control: "required", args: "preauth silent {{ faillock_args }}" }
            - { name: "system-auth", control: "[default=die]", args: "authfail {{ faillock_args }}" }
            - { name: "password-auth", control: "[default=die]", args: "authfail {{ faillock_args }}" }

        vars:
            faillock_args: "audit deny={{ rhel7stig_pam_faillock.attempts }}{{ (rhel7stig_pam_faillock.fail_for_root) | ternary(' even_deny_root ',' ') }}fail_interval={{ rhel7stig_pam_faillock.interval }} unlock_time={{ rhel7stig_pam_faillock.unlock_time }}"
            
  when: rhel_07_010320 or rhel_07_010330
  tags:
      - RHEL-07-010320
      - RHEL-07-010330
      - pamd