I need to set up PAM to behave in such way: when user id meets some condition it should be chroot'ed to some directory.
I tried this:
but it simply does not allow to login

when I change requisite to required it chroot's everyone.

Any suggestions.

P.S. (This may help) There is PAM new syntax, but it does something strange for me

Prolly stupid questions, but:
- is your /etc/security/chroot.conf populated properly,
- does the system really contain UIDs over 5K,
- are you sure you can use succeed_if in session directives (instead of auth and account: see the doc), and
- did you try other constructions like "ingroup somegroup"?

- when chroot_dir prameter is specified there is no need in chroot.conf, but I tried using configuration file instead of parameter - the same behaviour.
- yes. I made them for testing this authentication. When I solve this problem there will be more such users.
- problem is not in condition construction. Problem is in PAM:
when specified requisite - it fails for users below 50000 and when specified anything else - it chroots everybody

problem is not in condition construction.
First things first. I haven't seen if_succeed in session config *anywhere* and the doc doesn't suggest it either. If I set it up as part of session then my logs show "module unknown" and "unable to resolve symbol: pam_sm_{open,close}_session" (sm for Session Management I guess). If I it set up as part of auth however it works OK showing "pam_succeed_if: requirement "uid > 10000" not met by user x".

* If you're convinced it works for you anyway I'd be interested to see the loglines PAM spits out, preferably one time tested with "requisite" and one time with "required".

It does not work. That's why I wrote here this question.

You are right. It doesn't work in session section.

Probably i'll simply add that users to some group and configure pam_chroot to chroot only that group.