There is a simple solution. Have the httpd run under a second
userid/groupid.
Permission could be given to read the configuration
file, but since the daemon executes under another account
it would not have permission by default to destroy the files.
In this situation one must be careful to give appropriate
permission to directories and files for public read and execute
permission only as needed. One must exercize caution in giving write
privilages.
Gerald Edgar
"My opinions"