I am kind of curious, how does a hosting server support multiple users with php but keep each user away from the other code? The 'easy' solution i thought were file permissions. So every user can have www-data belong to their group and the server would have executing access but the users cant access the others file.

But then i realize the user running the php would be www-data who has permission to read everyones data. So how does a shared host prevent this from happening?

PS: I personally use nginx (with fastcgi php). But i am somewhat familiar on how apache works.