> Ограничение для пользователя слабо помогает, когда есть сервисы, работающие под рутом.
> Как их через limits.conf ограничить?

LIMITED(8)              System Administration Utilities             LIMITED(8)
NAME
       limited - run program with limited resources
SYNOPSIS
       limited [options] [--] [command [arg]...]
DESCRIPTION
       limited - run program with limited resources.
OPTIONS
       -n, --name=NAME
              apply limits configured for this program name;
       -V, --version
              print program version and exit;
       -h, --help
              show this text and exit.
FILES
       /etc/sysconfig/limits  - systemwide limits for all programs; uses shell
       syntax.
       /etc/sysconfig/limits.d/NAME
              - limits for NAME  program,  override  systemwide  limits;  uses
              shell syntax.
AUTHOR
       Written by Alexey Gladkov <legion@altlinux.org>
REPORTING BUGS
       Report bugs to http://bugzilla.altlinux.org/
COPYRIGHT
       Copyright © 2008-2009  Alexey Gladkov <legion@altlinux.org>
       Copyright © 2008  Dmitry V. Levin <ldv@altlinux.org>
       This is free software; see the source for copying conditions.  There is
       NO warranty; not even for MERCHANTABILITY or FITNESS FOR  A  PARTICULAR
       PURPOSE.
SEE ALSO
       nice(1), ionice(1), getrlimit(2).
service 0.5.26                  September 2014                      LIMITED(8)

http://git.altlinux.org/gears/s/service.git?p=service.git;a=...