Apache, mpm-itk and Single Entry?

Question

Apache HTTP Server

Here is such a hemorrhoid fell on my head: there is a server with Apache and mpm-itk. Each user has a cozy directory where he is the owner of all folders/files, i.e. vasya:vasya. Apache responds to his domains via mpm-itk and works in the same way as vasya:vasya.
There is a file manager that has a single entry point and has mpm-itk set to www-data:www-data.
Problem: a person through a file manager, having access to his directory, cannot change / create anything without 666 rights for files / folders with the owner vasya:vasya, since the file manager works from under www-data:www-data. The right to exhibit is not a panacea ...
How to be? How to solve the problem with the owner, gentlemen?

Answer 1

Lots of file managers? fm.vasya.com; fm.vova.com, etc

Answer 2

And the option to add the www-data user to the vasya group is not an option?

Answer 3

So in your case there are 2 options for development:
1. Change the rights of the files.
2. Change the rights of the owner of the process.
You do not want to follow the second path for your own reasons, although this, IMHO, is the most logical and safe path.
And if you want to go the first way, then you create a potential security hole when any user of the file manager has access not only to their own files, but also to others. However, in addition to the mentioned possibility to add the www-data user to a bunch of groups and change the umask in the web server and something else has access to the files being processed, there is acl. You can use them.

Answer 4

use mod_alias:
Alias ​​/filemanager/ "/usr/share/filemanager/"
and put the script there.
physically it will be one copy, but users will not have write permissions or ftp access to it.
Apache rights will be set as needed, depending on the host.