Do the users of these multiple sites trust each other? If so, it's pretty easy for users to deal with this themselves. All the user should need to do is make the appropriate directory world-accessible/writable with
chmod o+wx dir
chmod o+w dir/files_webserver_should_edit*
If the user wants to be sure to have access to the files created in that directory, the user could also run
chmod g+s dir
so that the files created by the webserver are owned by nobody but are in the user's group (though the PHP script will need to be sure to create files with group access). o+s
would make files owned by the user, but that might deny the webserver access to files it created if the file's permissions aren't right. If some files are not supposed to be writable by the webserver, you can go a step further and
chmod o+t dir
chmod g-w dir/files_not_to_be_altered*
If a user has write access to a directory but not to a file in that directory, they can delete the file from the directory and create a new one that they DO have write access to. The sticky bit (o+t) prevents a user from removing a file they don't own from a directory. With these combined, a PHP script can create new files and update and delete the files they create (since they will be owned by "nobody") but can't edit "files_not_to_be_altered" and can't erase them since they're owned by "user").
This gives the user control over which directories are actually writable by the webserver, and doesn't require root access since it isn't changing ownership.
If the users don't trust each other, then you'll need a little root intervention. Each website's directory structure will need to be tweaked once to convert its ownership:
Note: these instructions assume that nobody's group is also nobody, but some systems use nogroup
chown -R user:nobody /some/website
chmod -R g+rX,o-rwx /some/website
(capital X adds x access to directories)
This will make the directory tree accessable to user and nobody and remove everyone else's access. Users can proceed from there on their own, granting g+w
access where they please, however they will have to use u+s
instead of g+s
to ensure they have access to the files created by the webserver. o+t
will work as intended.
As an aside, you may have other servers using nobody/nogroup... to minimize alternate attack methods (an exploit in some other service running as nobody giving an attacker the ability to write in these websites) most systems have a dedicated webserver user/group that only the webserver runs as.