su does not change everything to other user (cgroups) - ssh

Question

If I run this command:
su -l otheruser -c 'strace /usr/lib/systemd/systemd --user 2> /tmp/su.err'
It fails:
Failed to create root cgroup hierarchy: Permission denied
Failed to allocate manager object: Permission denied
I see in the strace output that starting systemd as user failed here:
mkdir("/sys/fs/cgroup/systemd/user/root/754/systemd-3893", 0755) = -1
EACCES (Permission denied)
Where does /sys/fs/cgroup/systemd/user/root/ come from?
If I run the same command via ssh to localhost it works:
ssh otheruser#localhost 'strace /usr/lib/systemd/systemd --user 2> /tmp/ssh.err'
Here, the right directory gets used:
mkdir("/sys/fs/cgroup/systemd/user/modwork_gew_dfj/825/systemd-4272", 0755) = 0
Why does it work via ssh, but not via su?
Version: su (GNU coreutils) 8.17
Update
Here you can see that the cgroup does not get changed by my version of su:
host:~ # su -l otheruser
otheruser#host:~$ cat /proc/$PPID/cgroup
10:hugetlb:/
9:perf_event:/
8:blkio:/
7:net_cls:/
6:freezer:/
5:devices:/
4:memory:/
3:cpuacct,cpu:/
2:cpuset:/
1:name=systemd:/user/root/5913 <################ root
Via ssh:
host:~ # ssh otheruser#host
otheruser#host:~$ cat /proc/$PPID/cgroup
10:hugetlb:/
9:perf_event:/
8:blkio:/
7:net_cls:/
6:freezer:/
5:devices:/
4:memory:/
3:cpuacct,cpu:/
2:cpuset:/
1:name=systemd:/user/otheruser/5919 <################ otheruser
Update2
My version of su does not change the cgroup (See the link in the answer of user "ax."). Is there a way to change the cgroup (before or after) calling su?
Update3
This version does not have this issue: su util-linux 2.25

Answer 1

su inherits its cgroup from the originating session, not from the user passed to su. So when you call su -l otheruser -c systemd ... as root, systemd tries to use the root cgroup (/sys/fs/cgroup/systemd/user/root/...) as otheruser and fails.
With ssh otheruser#localhost ..., both user and cgroup are otheruser, and everything works as expected.

Answer 2

as guettli pointed out su don't work anymore.
in centos7.2 as root I tried this seems to work for cgroup by uid:
Assume you have uid=1000 that is a high cpu share user and uid=1001 that is a low cpu share user, (I am guessing by default every new user is getting a share of 1024 which will be the case for root user (uid=0))
in centos7.2 as root I tried this seems to work for cgroup:
systemd-run --uid=1000 --slice=user-1000.slice do_uid_1000_work_commands
systemd-run --uid=1001 --slice=user-1001.slice do_uid_1001_work_commands
the above will create two adhoc services with the corresponding user-slice config under /run/systemd/system/:
/run/systemd/system/*10345*
/run/systemd/system/run-10345.service
/run/systemd/system/run-10345.service.d:
50-Description.conf 50-ExecStart.conf 50-Slice.conf 50-User.conf
Here are the rest of my configurations:
--> /etc/systemd/system/user-1000.slice.d/50-CPUShares.conf
[Slice]
CPUShares=4096
--> /etc/systemd/system/user-1001.slice.d/50-CPUShares.conf
[Slice]
CPUShares=1024
--> /usr/lib/systemd/system/user-1001.slice
[Unit]
Description=User and Session Slice for uid = 1001 (low cpu share user)
Documentation=man:systemd.special(7)
Before=slices.target
[Service]
Slice=user-1001
CPUShares=1024
--> /usr/lib/systemd/system/user-1000.slice
[Unit]
Description=User and Session Slice for uid = 1000 (high cpu share user)
Documentation=man:systemd.special(7)
Before=slices.target
[Service]
Slice=user-1000
CPUShares=4096