To clarify: an alarm() in the parent doesn't necessarily affect a child process since the child doesn't have to honor it. When the alarm occurs, you need to hunt down the children and kill them off. The problem with qx, system, and backtics is that you don't get the pid, so it is almost never a good idea to use alarm with them.

I can't think of a clean way to write timeout() so that it is ignorant of the code it is calling. It seems to me that it needs to spawn/kill the children itself, or the caller needs to do this when the timeout occurs (e.g. with a callback).