I created a system user ("wikidata") in the www-data group.

In a first step, this user's crontab now monitors if pollForChanges is running at all and if not it starts it as the wikidata user.

I refuse to put the sgid bit on everything in /var/www because of security risks. Using the suid bit just on pollForChanges does not work on a php script.

Question back to the developers: Can you specify the uid or user name under which the script is running directly *in* the script? (On dev this would be "wikidata", uid=115, gid=33.)

If you are root, you can "become" another user from inside php: http://php.net/manual/en/function.posix-setuid.php

However, beware the consequences. For instance, if the pid file was written as root, it may not be readable once the script runs as ordinary user.

But...

• why is it not sufficient to just call the script as a different user?
• Why do you thing SGID is a security risk? SUID is, but SGID should be safe enough: http://www.library.yale.edu/wsg/docs/permissions/sgid.htm
• SUID does not work on script files at all.
• You should probably add www-data to the wikidata group (and/or vice versa?)