I use /etc/ssh/wrapper.sh script, like in tutorial, that filters which commands are allowed to be run via ssh and logs them.
Currently when internal-sftp is required, I use /usr/lib/sftp-server.
Is there a way I could run internal-sftp of ssh binary, maybe even with chroot, instead of /usr/lib/sftp-server? (e.g. via some ssh command line flags)
No. internal-sftp is evaluated inside of sshd server. If you use wrapper script as ForceCommand already, you can't go back. Even if you could, in chroot you don't have the sshd binary either.
Unfortunately, ForceCommand different from internal-sftp blocks even the sftp subsystem (subsystem is internally handled as a command).
Only way to do that is to copy sftp-server into chroot and run it from there (again with all dependent shared objects and so).
