DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:date:message-id:references
	:in-reply-to:content-type:content-id:content-transfer-encoding
	:mime-version; q=dns; s=default; b=JI9azI8McVjNR9MmdLn57vbWyS/GO
	MzFt4E71C+PyV9l3gwKSVt58Uchh5xNaiwclBoNf7Gcwcjq3/XSdTI3I3VEc5vpx
	SAJEgiOQAGLLpBQuD/99z4zpxMVzgVk0cL/Gpg28VbVjGzF+UbvIapZj3T7jiTtq
	Usp/wv82p7b0wM=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
From: Ken Brown <kbrown@cornell.edu>
To: "cygwin@cygwin.com" <cygwin@cygwin.com>
Subject: Re: Empty file without "x" permission is successfully executable on Cygwin
Date: Tue, 6 Aug 2019 19:35:43 +0000
Message-ID: <310d0110-506f-37c0-e694-84d8bc7ee32e@cornell.edu>
References: <BL0PR0901MB430826D79AF2771A6A5C2A99A5D50@BL0PR0901MB4308.namprd09.prod.outlook.com>
In-Reply-To: <BL0PR0901MB430826D79AF2771A6A5C2A99A5D50@BL0PR0901MB4308.namprd09.prod.outlook.com>
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0
received-spf: None (protection.outlook.com: cornell.edu does not designate permitted sender hosts)
Content-Type: text/plain; charset="utf-8"
Content-ID: <FDB5BD1FEAB0824B8B620E89F814493C@namprd04.prod.outlook.com>
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-userprincipalname: ksb2@cornell.edu
X-IsSubscribed: yes
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by delorie.com id x76JaaE5028166

On 8/6/2019 3:09 PM, Lavrentiev, Anton (NIH/NLM/NCBI) [C] via cygwin wrote:
>> zero-sized? Irrelevant.
> 
> It is actually very relevant.  Because executing an empty script results in "success" (exit code 0) -- that creates a false-positive.

You were absolutely right on your first complaint, that Cygwin allows a script 
without execute permission to be executed.  Corinna has already fixed that:

 
https://cygwin.com/git/gitweb.cgi?p=newlib-cygwin.git;a=commit;h=98669a24760a84bfef498fedeef7fa7ecc518e6c

But what's your basis for saying that an empty script shouldn't be executable? 
As long as it has execute permission, you're asking the shell to do nothing.  It 
happily does nothing and reports success.

It works that way on Linux also:

$ touch dummy

$ chmod +x dummy

$ ./dummy

$ echo $?
0

Ken

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple