I'm pretty new at this. So I figured out that apache2 starts processes as www-data user. Suppose this user then starts untrusted code. What if I wanted to disallow this user to read any files (like /etc/fstab for example). How would I go about this? Ubuntu 11.04 by the way.
You could deny by chmoding those files so that www-data user can't read them.
One of tricks you could use would be to change group of those files to www-data group and set mod so that group can't read the files.
$ chgrp www-data /etc/fstab $ chmod g-rwx /etc/fstab
From php side you can use open_basedir which would in some cases prevent reading files outside path set as open_basedir
Are there secrets in /etc/fstab you don't want users reading?
In general, you'd remove r access for others on the files, but fstab contain no secrets so you just likely to break things.
Specifically with Apache, you probably have the option to run it in a chroot, so it can't read outside of /var/www or where ever your httpd lives.