DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 33ABF385800A
To: cygwin@cygwin.com
References: <003401d70864$cd3b3400$67b19c00$@gmail.com>
 <CAJ1FpuMbx1pyOqoRSwgieQbGPgcXOOiUusFtsmqKWoyJdzF0pg@mail.gmail.com>
 <306dd40d-666d-4a27-0a2c-dc03053d2f8c@SystematicSw.ab.ca>
 <e4540cda-2874-71e4-fc56-9a53a7d8e5ee@t-online.de>
From: Brian Inglis <Brian.Inglis@SystematicSw.ab.ca>
Organization: Systematic Software
Subject: Re: CRITICAL ls MEMORY LEAK
Message-ID: <1ca42c00-db0a-4999-11e1-a82828a5e074@SystematicSw.ab.ca>
Date: Mon, 22 Feb 2021 16:47:02 -0700
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.7.1
MIME-Version: 1.0
In-Reply-To: <e4540cda-2874-71e4-fc56-9a53a7d8e5ee@t-online.de>
Content-Language: en-CA
Precedence: list
Reply-To: cygwin@cygwin.com
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Errors-To: cygwin-bounces@cygwin.com
Sender: "Cygwin" <cygwin-bounces@cygwin.com>
Content-Transfer-Encoding: 8bit

On 2021-02-22 14:50, Hans-Bernhard Bröker wrote:
> Am 22.02.2021 um 21:30 schrieb Brian Inglis:
> 
>> I've often wondered if the heavy activity is due to Windows' defaults to 
>> writing files with F+RX perms which triggers executable virus scans?
> 
> That could only be the case if Windows actually had an 'x' permission bit.

Strictly speaking, I am not sure if *Unix* has an 'x' permission bit, but most 
filesystems do provide such a facility (V/FAT e.g. some /boot/ do not), as do 
POSIX/Solaris ACLs, and Windows NTFS, whose ACLs have execute permissions:

$ icacls /? | egrep exec\|X
                 RX - read and execute access
                 GE - generic execute
                 X - execute/traverse

GE grants FILE_EXECUTE and STANDARD_RIGHTS_EXECUTE access rights.

Access Mask Format:
|31|30|29|28|27|26|25|24|23|22|21|20|19|18|17|16|15|14|13|12|11|10|9|8|7|6|5|4|3|2|1|0|
|GR|GW|GE|GA|27|26|25|AS|23|22|21|20|19|18|17|16|15|14|13|12|11|10|9|8|7|6|5|4|3|2|1|0|
|..generic..|reserved|..|.......standard........|...........object.specific...........|

GR GENERIC_READ
GW GENERIC_WRITE
GE GENERIC_EXECUTE
GA GENERIC_ALL
AS ACCESS_SYSTEM_SECURITY access Security ACL in object security descriptor

Windows also supports ACLs on system objects, and there may be similar features 
on SELinux.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.
[Data in binary units and prefixes, physical quantities in SI.]
--
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple