It would be great to be able to say that a certain vhost can only use X amount of memory, cpu, open files, threads, processes, etc - currently there isnt a great way to do this that I know of - not even PAM can really do it since PAM requires interactive shell to limit.

it would be great if ASL could have something like this where you can set it globally as well as set exlcusions for vhosts, sub domains, etc, or perhaps only set the limits on specific vhosts that are causing problems.

Added to feature queue for further research (may be outside the scope of what we can do in ASL, but we're looking into it).

any word on this feature?
We are currently using cloud linux with mod_hostinglimits which means that we cant use your kernel and have to pay for a 2nd solution - if you guys could come up with a way to incorporate the same user limits and restrictions on cpu, memory, io, processes, cron tasks, etc that would be ideal as then we get everything from one vendor, and are able to utilize everythign in your security package

Yeah actually we've been working on getting LVE directly into the kernel. Its something I had to bump post 3.0 release though. I'm absolutely on board with supporting LVE and its associated modules & kernel patches in ASL.