Use Linux' capability system to run as a sort of "lesser root"; we drop nearly
all root privilegies except the ability to setuid. An attacker capable of injecting
code will still be able to run as any (normal) user on the system, but at least
he/she cannot directly load kernel code etc.

Index: httpd-2.4.1/server/mpm/config2.m4
===================================================================
--- httpd-2.4.1.orig/server/mpm/config2.m4
+++ httpd-2.4.1/server/mpm/config2.m4
@@ -66,6 +66,9 @@ for i in $ap_enabled_mpms; do
     else
         AC_MSG_ERROR([MPM $i is not supported on this platform.])
     fi
+    if test "$i" = "itk" ; then
+        AC_CHECK_LIB(cap, cap_init)
+    fi
 done
 
 if test $mpm_build = "shared"; then
Index: httpd-2.4.1/server/mpm/itk/itk.c
===================================================================
--- httpd-2.4.1.orig/server/mpm/itk/itk.c
+++ httpd-2.4.1/server/mpm/itk/itk.c
@@ -66,6 +66,10 @@
 #include <sys/processor.h> /* for bindprocessor() */
 #endif
 
+#if HAVE_LIBCAP
+#include <sys/capability.h>
+#endif
+
 #include <signal.h>
 #include <sys/times.h>
 
@@ -522,6 +526,15 @@ static void child_main(int child_num_arg
     int last_poll_idx = 0;
     const char *lockfile;
 
+#if HAVE_LIBCAP
+    cap_t caps;
+    cap_value_t suidcaps[] = {
+        CAP_SETUID,
+        CAP_SETGID,
+        CAP_DAC_READ_SEARCH,
+    };
+#endif    
+
     mpm_state = AP_MPMQ_STARTING; /* for benefit of any hooks that run as this
                                    * child initializes
                                    */
@@ -596,6 +609,22 @@ static void child_main(int child_num_arg
         lr->accept_func = ap_unixd_accept;
     }
 
+#if HAVE_LIBCAP
+    /* Drop as many privileges as we can. We'll still
+     * access files with uid=0, and we can setuid() to anything, but
+     * at least there's tons of other evilness (like loading kernel
+     * modules) we can't do directly.  (The setuid() capability will
+     * go away automatically when we setuid() or exec() -- the former
+     * is likely to come first.)
+     */
+    caps = cap_init();
+    cap_clear(caps);
+    cap_set_flag(caps, CAP_PERMITTED, sizeof(suidcaps)/sizeof(cap_value_t), suidcaps, CAP_SET);
+    cap_set_flag(caps, CAP_EFFECTIVE, sizeof(suidcaps)/sizeof(cap_value_t), suidcaps, CAP_SET);
+    cap_set_proc(caps);
+    cap_free(caps);
+#endif    
+
     mpm_state = AP_MPMQ_RUNNING;
 
     bucket_alloc = apr_bucket_alloc_create(pchild);