Why do I need an 'execute' bit in file mode on Unix file systems?

Solution 1:

I'm surprised nobody has mentioned binaries that run with special privileges. Wireshark comes with a real-world use case here: one of its main functions is capturing network traffic, something that normally only root can do. It makes sense that you might want to allow certain users to capture traffic with Wireshark without having to give them full root access, so Wireshark comes with a binary called dumpcap that has the necessary capabilities (CAP_NET_RAW and CAP_NET_ADMIN) enabled. This binary is 0754 (rwxr-xr--) and its associated GID is a special group that Wireshark installs. This way, any user in the group can run the binary (generally through Wireshark) to capture traffic, and it will run with the necessary privileges to do so, but a user not in that group won't be able to because they wouldn't have execute permission. They could still copy it to their home directory, but then their copy wouldn't have the necessary capabilities set, so it couldn't actually capture any traffic.

Solution 2:

Because *nix isn't brain-damaged enough to make a file "binary executable" if you happen to name it ".exe" or "script executable" if you happen to name it ".bat".

In Linux, the name of the file doesn't matter.

And the permissions you give a file do matter.

Which kind of makes sense. IMHO...

Solution 3:

The execute bit is somewhat confused between being a permission and an object type identifier.

And, no you cannot "always copy" the file to your home directory: only if it is readable to you.

Files can be executable to you, but not readable.

You're right in that if a file is readable to you but not executable to you, you can copy it and flip the execute bit and use it. Maybe. But it might not work. The executable may be sensitive to where it is installed. Or the file may depend on its setuid root bit.

I wouldn't design a permission system that way starting from a clean slate; it doesn't entirely make sense. The permission to execute would be separate from an executable type attribute, and execute permission would not be overloaded with search permission (even if it was stored that way; the API would not reveal it at the bitmask level).

Solution 4:

Thats a good point, and I think I see where you're heading with this.

To reinterpret your question : Is the following claim true - "Setting a executable to non-executable mode for a user does not limit the user's capabilities".

I think its true.

1. Copy the file to some other directory.
2. Change exec perms.
3. Run from whichever pwd (in particular, the original directory) by giving full path to the new copy of the executable, with any command line args.

I don't think there's anything else missing, which you would have by having the original file's exec perm set on.

By pwd I mean present working directory.