limits files are utilized by
PAM. The stock
suexec provided by apache still does not recognize or utilize
PAM. Patches exist. And you can modify the source directly to invoke
setrlimit (it looks pretty easy - see the
setlimit(2) man page.) But as is,
suexec will not recognize anything you do with
You can still set ulimits from within apache, but I think this is undesirable, especially in the pre-fork model, because then you limit the load your http server can handle. Further, I'm not sure if limits will carry over to the
suexec environment because I'm not sure how
suexec does its job.
CPUShares won't help you here is because your fork bomb is a resource hog, but the resources aren't really in the userland CPU cycles. By the time CPU accounting becomes involved, it's too late: your system has no free memory or process slots to try to run the program.
You might try
prlimit, part of
util-linux so it should be standard with your installation. If you do this:
$ prlimit --nproc=1 bash -c bash -c id
bash: fork: retry: No child processes
So the little 2-fork process failed.
Unfortunately, I don't see a sound way you can get prlimit involved in the execution chain. Apache has screwed themselves and all of us by providing a deprecated
suexec module that isn't flexible enough to meet the basic demand, and is straight-jacketed enough that any real solution requires blasting a hole through security.