What you're asking is difficult if not impossible. Even if you did restrict the application of
chmod to files under a specific directory, someone could still pass a symbolic link and so affect files anywhere they like.
Fortunately, it's highly likely that what you're attempting to do is just not the right solution to your actual problem, and there is another method that works.
Usually, users who need additional permissions to create and modify files under
/var/www are added to a group (often
www-data, or you may have different groups for different parts of the site). You can use group ownership and setgid directories:
chgrp www-data /var/www/html; chmod g+ws /var/www/html allows everyone in the
www-data group to write to the
/var/www/html directory, and files created in that directory will be owned by the
www-data group instead of the primary group of the user who created the file. However, this is not very flexible.
What you probably should do is set up access control lists for files under
/var/www. First, make sure that ACLs are enabled: the filesystem that
/var/www is on must be mounted with the
acl option. See Make all new files in a directory accessible to a group for help on that. Also install the ACL utilities (
setfacl). Then give extra permissions to the tree under
/var/www/html to the users who should have them. You can set per-user ACLs, but it's often easier to put users who should have the same rights on a part of the filesystem in a group and set ACLs for that group. For example, if the users in the group
html-writers should have read-write access to the tree under
setfacl -d -m group:html-writers:rwx /var/www/html
setfacl -m group:html-writers:rwx /var/www/html
www-datagroup eliminating the need to
chown. Apart from that I see no reason why
chmodhas to be run as root.