CGIwrap faz muito do material que o suEXEC faz (executa o script sob permissões alternativas), mas também permite que você defina recursos limites:
--with-rlimit-cpu=SECONDS
limit cpu time with setrlimit
--with-rlimit-vmem=BYTES
limit total virtual memory with setrlimit
--with-rlimit-as=BYTES
limit total available memory with setrlimit
--with-rlimit-fsize=BYTES
limit writable file size with setrlimit
--with-rlimit-data=BYTES
limit data segment size with setrlimit
--with-rlimit-stack=BYTES
limit stack segment size with setrlimit
--with-rlimit-core=BYTES
limit core file size with setrlimit
--with-rlimit-rss=BYTES
limit resident set size with setrlimit
--with-rlimit-nproc=COUNT
limit number of processes with setrlimit
--with-rlimit-nofile=COUNT
limit number of open files with setrlimit
--with-rlimit-memlock=BYTES
limit lockable memory with setrlimit