Background:
We are setting up Drupal in a University environment. This means we cannot just rely on everyone playing nice.
As such, our web servers are set up so that different organization's sites run as separate users. On our legacy systems, this is done with a customized version of cgiwrap. For our new Drupal system, we are using suphp. And while we could just turn on suphp, hand out the Drupal source, and tell user to have fun, we would like to instead hand out running Drupal installs ready for them to customize. But if we are going to be supporting several dozen subsites, we would prefer to have one set of code to update, and to be able to offer "blessed" modules as globally available, including for some modules (e.g. LDAP) pre-installed and configured before we turn over the site.
That would point us in the direction of multi-site. But standard multi-site Drupal just uses symlinks to the Drupal root for subsites, which means all the php code is owned by one user, so that would not work with suphp, which runs php files as the file owner.
This is our attempt to have our cake, and eat it too. It seems to work in our test environment, but we are not Drupal experts; we only started learning Drupal last month. If you can pick flaws in this, please do! We'd rather learn about problems now than later.
The How-To: