The function access is the underlying Linux/Posix/C function to test whether we can execute. Not as in if the bit is set, but whether we might execute or not (effective vs real permissions). I don’t think there are situations where the distinction matters for the tester, and I am not sure how to achieve equivalent in Rust.
About my earlier comments about 0o111 I thought mistakenly that, that was RWX and not XXX for each user, group, other. I recall another person had issue in C# when checking 0o111 and changed to only checking whether User Execute and User Read was set: Problem locating unix executables #MG5 - #10 by salmon-571 . So I think your check here is working.
I see @andy1li replicated the issue.
As for the exact conditions I cannot explain. But consider this: You check whether you find the executable (using whatever condition) and get the path: let Some(executable) = externals.get(cmd). Then shortly after you do let result = match Command::new(cmd).args(args).output() {. So cmd=ls and executable=/usr/bin/ls or something like that. But what you pass to Command::new is not the path but just ls. I can’t fathom why, but seems to me it finds a different executable than the expected one and runs.