I have been asked to set up a shared webspace on our department webserver that may be accessed by multiple people and which might be running CGI or PHP scripts. The people maintaining the webspace might decide to use it for file submissions, which would mean that they'd need access to any files created by the scripts. We're running Apache on Scientific Linux 6.
Because multiple people need write access to the webspace, our standard approach is to create a group to which all of the relevant people belong and then set the permissions on the directories in the webspace to
g+ws. suexec is unhappy with the files being group-writable and refuses to run them.
How can we set this up and make sure that any scripts are run under an account that is different from the main apache account (and is different from any of the users who are not in the group for the webspace)? For accountability (and other) reasons, I'd prefer not to have to make a shared account that the various people would have to use to maintain this webspace.
For a little more context, here's how we're currently set up: We have users whose home directories are on NFS and automounted as needed. Most people just use their personal webspace accessed via mod_userdir. We've fielded several requests for shared webspace in the past by creating additional automounted directories on the NFS server that are not tied to particular accounts, but which have group ownership set up to facilitate access by multiple accounts. Up to now, these shared spaces have only contained static content (and we've trusted the people involved not to run scripts from them), so we've never had to address any suexec-related issues for these sorts of spaces before.
Edit: Note that the users might need access to files created by the scripts.