The only 2 methods I'm aware of where you can set this up so that Apache can see X number of users' content, but these same users are blind to each others' content is to use a separate Unix group for each user, that Apache is a member of as well or through ACLs.
Method #1 - using groups
Simply put each user into their own unique group (group1, group2, etc.). Then add Apache to each of these groups. This can be done using
chmod to give the directories and files the appropriate groups + permissions. You'll likely want to set the GUID bit on these directories as well, so that any new files that are added have the appropriate group assigned automatically.
NOTE: This method can be broken by the users fairly easily, not irrevocably broken, just broken so that their files can no longer be seen by Apache. I'd suggest providing them with a few aliases or scripts to help maintain their directories.
Method #2 - using ACLs
You can add Apache's group ID to each user's directories of content like so.
saml wheel wireshark
setup a directory with perms + ownerships
$ sudo mkdir --mode=u+rwx,g+rs,g-w,o-rwx somedir
$ sudo chown saml.apache somedir
$ ll -d somedir/
drwxr-s---. 2 saml apache 4096 Feb 17 20:10 somedir/
$ ll -d somedir
drwxr-s---. 2 saml apache 4096 Feb 17 20:46 somedir
$ sudo setfacl -Rdm g:apache:rx somedir
$ ll -d somedir/
drwxr-s---+ 2 saml apache 4096 Feb 17 20:46 somedir/
+ at the end, that means this directory has ACLs applied to it.
$ getfacl somedir
# file: somedir
# owner: saml
# group: apache
# flags: -s-
$ touch somedir/afile
$ ll somedir/afile
-rw-r-----+ 1 saml apache 0 Feb 17 21:27 somedir/afile
Notice with the default permissions (
setfacl -Rdm) set so that the permissions are (
r-x) by default (
g:apache:rx). This forces any new files to only have their
r bit enabled.