Still WIP but some progress...
When moving a shell to a cgroup not associated with a session,
then subsequent calls to pam_systemd or pam_elogind create
a new session, and a new cgroup for that session, so that the
cgroup of the calling process is not used (this is a problem
with both systemd and elogind). For systemd, the problem can be
solved by passing --slice <user slice> to systemd-run. For elogind,
we need to first move the shell to a non session cgroup, then run
sudo so that a new session is created, then pass the cpuset to that
session's cgroup. Hopefully, if neither systemd nor elgind is used,
then the former solution should work (to be tested!!!).