su: user->root ok, user1->user2 ok, root->user NOK

[Andreas Hasenack <andreas conectiva com br>]

Hi, I'm having a trouble with su and pam-0.75 (with absolutely
no patches, just the original tarball).

As a regular user, I can su to root as usual, just giving
root's password. I can also su from a regular user to another
one without problems.

BUT, as root, I cannot su at all, getting this prmission denied error:

[andreas@pandora Linux-PAM]$ su
Password: 
[root@pandora Linux-PAM]# su andreas
su: Permission denied
[root@pandora Linux-PAM]# 

/etc/pam.d/su is quite normal:
#%PAM-1.0
auth       required	/lib/security/pam_unix.so shadow nullok
account    required	/lib/security/pam_unix.so
password   required	/lib/security/pam_cracklib.so
password   required	/lib/security/pam_unix.so shadow use_authtok nullok
session    required	/lib/security/pam_unix.so
session    optional     /lib/security/pam_xauth.so

The logs:
Jan  4 13:57:38 pandora su(pam_unix)[1669]: session opened for user root by andreas(uid=681)
Jan  4 13:57:40 pandora su(pam_unix)[1671]: session opened for user andreas by andreas(uid=0)
Jan  4 13:57:40 pandora su(pam_unix)[1671]: session closed for user andreas

Note that the session was opened, but closed right away. Any clues?
I also tried a CVS copy, same problem.