I think in case of PAM, FAILLOG_ENAB is NOT SUPPORTED,
but "login" is using /var/log/faillog when system is up.
When turn to init=1, /var can't unmount.
Any definition of FAILLOG_ENAB make errors.
/var/log/faillog is opend and in use every time.
Close /var/log/faillog when autherntication is finished
OR not use /var/log/faillog.
Checked sys-apps/shadow-18.104.22.168 and sys-apps/shadow-22.214.171.124
*** Bug 250479 has been marked as a duplicate of this bug. ***