limits.conf ulimits not being applied to chrooted processes

Question

We allow users to execute scripts on our servers. Our security model involves chrooting them. We want to be able to apply ulimit restrictions to them, and the best way to do it would seem to be in /etc/security/limits.conf

But, it doesn't seem to work. Here's what we set in limits.conf:

@registered_users    -    priority   7
@registered_users    -    nice       7
*                    -    priority   9
*                    -    nice       9

And it works in some cases:

sudo -u testuser python

Will give a python process with niceness 9 (not 7, annoyingly)

BUT

sudo chroot --userspec=testuser:registered_users python

gives a python process with niceness 0.

any clues?

We've tried adding session required pam_limits.so to /etc/pam.d/common-session, to no avail.