tl;dr
Why do many of Laravel's framework files install with default permissions granting execute privileges to all users?
The default permissions on my Laravel framework files in a fresh install are scattered between two flavors: -rw-rw-r-- and -rwxr-xr-x.
$ php artisan -V
Laravel Framework 8.40.0
$ ls -Al vendor/laravel/framework/src/Illuminate/Support/Facades/
(sample lines grabbed from middle of output)
-rwxr-xr-x 1 me me 2805 Apr 28 10:38 File.php
-rw-rw-r-- 1 me me 1713 Apr 28 10:38 Gate.php
-rwxr-xr-x 1 me me 585 Apr 28 10:38 Hash.php
-rw-rw-r-- 1 me me 3782 Apr 28 10:38 Http.php
-rwxr-xr-x 1 me me 786 Apr 28 10:38 Lang.php
-rwxr-xr-x 1 me me 1210 Apr 28 10:38 Log.php
The 664 permissions (-rw-rw-r--) make sense to me and are something I would expect. The 755 permissions (-rwxr-xr-x) are very much not expected. It removes write permissions from the group and gives execute permissions to everyone.
I can find these permissions scattered throughout the framework. 227 files in 49 directories.
$ find vendor/laravel -type f -perm 755 | wc -l
227
$ find vendor/laravel -type f -perm 755 | sed -r 's|/[^/]+$||' |sort |uniq | wc -l
49
I can see no pattern. ViewFinderInterface has execute permissions but not ViewException. ServiceProvider but not ProcessUtils. Facades/Password but not Facades/Gate.
I checked Laravel 7.30.4 and 6.20.26 and the same files were getting either 755 or 664 permissions consistently across the different versions.
I apply a set of project wide permissions after installs and updates, so I would not normally notice this. But I found it because I wanted to demystify some of the facade magic in a fresh install. The default permissions confuse me.
Why are some framework files installing with execute permissions for all users? And why are the permissions different between files that would appear to perform similar roles in the framework, such as various facades? It seems very arbitrary.