I'm not sure I understood correctly. Is the local web app on the same LAN as the users or on the same computer?
If it is on the same computer, you need to protect your filesystem using chmod/chown and protect your web server. However, this way of doing is particularly unsafe. This is already tricky with unprivileged user, but if your users have admin rights, changing read/write/execute permission won't prevent them from looking at your script and alter it if they want. You can do nothing against that: they have all powers, just like you.
If it is on the same LAN, you don't have to worry about who can see what on the server hard disk (well, at least not that much :)). If user A could access and modify script S when logged-in locally, he cannot modify S through the web server. If he can (or if anyone can do it remotely), then your web server is not configured correctly. This is not a matter of filesystem permission, it's a matter of web server configuration.
The only way to hide stuff from the other admins are:
- Encrypting your files
- Tweak the OS to hide them
The corresponding problems are:
- Encrypted files can't be executed as they are. They have to be decrypted before execution. Which means that your PHP script have to be in clear text somewhere. Which means that a curious admin can do whatever he wants with it.
- There are ways to hide files under Windows using some specific registry tweaks (the way some viruses use to hide themselves). As well, one could alter Linux kernel to do the same thing. But, once again, a curious/motivated admin can revert back these changes or find a workaround. And, guess what, you still have to make your script visible to the webserver user: as an admin, it's so easy to impersonate such a user (trivial workaround found)...
Conclusion, as I previously said, what you need is a computer where the other users have no rights... Or even better, a computer where they can't log in!