the supplied /etc/security/console.perms does not include
<console> 0600 /dev/console 0600 root.root
which is required to change console owenership for
users who log in without using xdm.
Otherwise programs like xconsole won't work.
The current pam_console module has
<xconsole> 0600 /dev/console 0600 root.root
so that this only gets applied for X logins, which
is the correct behaviour.
The current pam_console also has a fix that makes xconsole be
recognized; the original pam_console only allowed you to be
in one console group at a time because the utility of subsets
had not yet been recognized when it was first created.