1. Don't. Just include the correct configuration as part of the OS.
2. For a configuration file use a group for passing out write access to users on the system.
3. Have a daemon which handles updating configuration files based off some central source of truth which pushes changes to a fleet of servers. Programs could directly communicate with this daemon to get their configuration.
