I'm writing a program (in Python) that needs to modify a system file, /etc/aliases in this case. The software is a web application that typically will run under a dedicated web user, ie "www", "www-data", "apache" or similar.
How should I set up access control (file permissions, file ownership and groups) to enable the program to modify /etc/aliases without opening permissions too much?