Helo!
What you want is possible. I've never tryed it with Apache, but I suppose is the same.
Basically, you need to use a few tools:The idea is to provide the user only what he needs, so that he can be jailed with chroot.
First, you need to create your chroot jail. To achieve this, you must create a directory structure on each user home as if it was "/". If you choose /home/user for "user" chroot jail, you will need to create inside, at least:
dev/
usr/
usr/bin
usr/lib
var/
etc/
sbin/

After that, you have to copy there the tools and libs the user is going to use. You could use "ldd" to guess which libs each binary needs, and copy them to its appropriate directory. You may want to copy a shell, and some basic commands (cat, grep, more, etc) with the libraries they need to run.
For example, in my AIX box:

Code:

$cp /usr/bin/ksh /home/user/usr/bin/ksh
$ldd /usr/bin/ksh 
/usr/bin/ksh needs:
         /usr/lib/libc.a(shr.o)
         /unix
         /usr/lib/libcrypt.a(shr.o)
$cp /usr/lib/libc.a /home/user/usr/lib
$cp /usr/lib/libcrypt.a /home/user/usr/lib

Perhaps you would need to create some device files in /home/user/dev. Do not use cp for this, instead, use the appropriate command. In may case (AIX), "mknod".

You will also need to create an etc/passwd and an etc/group in your chroot.

Now you need a "special shell" which put the user into the jail when he/she logs in.
For instance, create a /bin/chroot_shell.sh like this:

Code:

if [ "$1" = "-c" ]; then
        sudo /usr/sbin/chroot /home/$USER /bin/su - $USER $*
else
        sudo /usr/sbin/chroot /home/$USER /bin/su - $USER
fi

As you can see you will need to configure "sudo" for this to work. Use "visudo" to add a line like this:

Code:

user ALL=NOPASSWD:/usr/sbin/chroot /home/user /bin/su - user*

Next, change "user"'s shell into /bin/chroot_shell.sh in /etc/passwd

After that, And add a line in /home/user/etc/passwd like:

Code:

user:!:203:1::/:/usr/bin/ksh

NOTICE, you must have copyed /usr/bin/ksh to /home/user/usr/bin/ksh along with every lib ksh needs.

Well, these are, more or less, the steps you should follow, but most probably I forgot something or made a mistake... I've written this by heart

I hope it helps.