We've got a few smart developers who work on separate proprietary projects. We use mostly PHP to do ad-hoc analysis and make a bunch of PHP web tools to help us visualize things internally.

The directory structure looks like:

* /var/www/
	+ / anton /
	+ / mary /
	+ / shared scripts /

Anton should not be able to view Mary's scripts, and vice versa. 

I can envision changing the Linux folder permissions, so that Anton can only have read/write/execute his folder, and not even read Mary's folder.

However, in that case, what is to prevent Anton from the following:

* writing a PHP script in his own folder that runs an 'exec' command to 'cat' the source code from Mary's folder?
* run the script as www-data which is the default Apache user, and therefore has access to all folders, including Mary's?

Generally, if you want to run multiple proprietary projects on a single server, how would you go about it?

(Please note that I'm not interested in code obfuscation/encryption. Legal remedies are also an option that we already have in place. I'd be very interested in solutions beyond the legal realm though.)