hardlinking passwd into jail

[kiesa]

Hi,

I'm wondering how i should let users to change their passwords when they're
logged in with ssh and then jailed. I know i shouldn't link anything outside
of jail and no suid bits .. but i can't think of any other way than hardlinking
passwd command into chroot (or maybe pam-mysql would work too but it
also needs suid). This has two big disadvantages.. suid bit and it's
outside jail.
Would this even work?

I think jail is better even if there's flaw like this than no jail at all .. what
you guys think?