How to allow passwd in chroot

I have a multi-user server, which puts a subset of the users in a chroot. I want to allow all users to call passwd in order to change their respective password. Everything else I can think of is either overkill or likely to compromise system-security.

I build my chroot with makejail using the following configuration.

chroot="/var/chroot/sshd"

cleanJailFirst=1
# these are binds to the actual location, hence, we don't want makejail to be tinkering with those.
preserve=["/home","/etc/passwd","/etc/group","/srv"]

testCommandsInsideJail=["bash","sh","ls","pwd","stat","whoami","svnserve -t","locale","localedef","man ssh","man scp","cat","nano","vim","ssh","scp","passwd"]
testCommandsOutsideJail=[]

packages=["coreutils"]

# speed up things a bit
sleepAfterStartCommand=0.8
sleepAfterTest=0.8

As you can see, in testCommandsInsideJail, I listed passwd, but if I login as my testuser (who is inside that chroot), I get:

$ passwd
Changing password for test.
(current) UNIX password: 
passwd: Authentication token manipulation error
passwd: password unchanged

which I don't understand unfortunately (before you ask, yes, I am sure the password I entered is correct). I have found some sites via g, which help me as little as the actual error message.
To my understanding, I am missing some pam module, but I don't know how to add it to the python script that builds the jail.

I am running Ubuntu Server 10.04.

EDIT

I have the actual /etc/passwd bound (via /etc/fstab) to the location of the chroot passwd, which is in /var/chroot/sshd/etc/passwd, so modifications inside the chroot are seen from the outside. I have now also done the same with /etc/shadow, which for some reason I forgot before. So instead of

preserve=["/home","/etc/passwd","/etc/group","/srv"]

I have now

preserve=["/home","/etc/passwd","/etc/shadow","/etc/group","/srv"]

and an additional bind:

# chroot binds
/home       /var/chroot/sshd/home       none    bind    0   0
/etc/passwd /var/chroot/sshd/etc/passwd none    bind    0   0
/etc/shadow /var/chroot/sshd/etc/shadow none    bind    0   0
/etc/group  /var/chroot/sshd/etc/group  none    bind    0   0
/srv        /var/chroot/sshd/srv        none    bind    0   0

If I try to change the password now, I get

$ passwd
Changing password for test.
(current) UNIX password: 
Enter new UNIX password: 
Retype new UNIX password: 
passwd: Authentication token manipulation error
passwd: password unchanged

So, passwd manages to check the current password, but dies when it comes to setting it.