Lighttpd

/bin/sh is used to split/parse

myfcgi -b "/tmp/a b c.sock" 

into pieces for execv like

myfcgi
-b
/tmp/a b c.sock

someone has to write code to do this job in the place of /bin/sh

Related to what I suggested on the forum, wouldn't it be a reasonable interim compromise to neither parse the string nor pass it to /bin/sh for parsing? If someone wants a fastcgi server command that takes arguments, they can put it in a shell script that calls /bin/sh (or possibly, another more secure/less featureful shell), and choose to stick /bin/sh in their chroot.

A real fix would be to do the parsing internally, but this approach would still allow the user to choose to avoid /bin/sh, and also remove an undocumented dependency.

how about taking just argv and passing it to execvep?

if current version takes -f as argument for spawned program
leave the program and it's args as last.

spawn-fcgi -C 32 -f "/usr/bin/php.fcgi -c /etc/php/php-fcgi.ini" 

would became:

spawn-fcgi -C 32 -- /usr/bin/php.fcgi -c /etc/php/php-fcgi.ini

and in case you need not to pass any args to php.fcgi:

spawn-fcgi -C 32 /usr/bin/php.fcgi

I don't think you read the description of how the patch changes behavior correctly.

If you wish to avoid having /bin/sh in the chroot, you must also replace '-f "and args"' with ' -- and args' at the end of the invocation of spawn-fcgi. I have tested it (patched against 1.4.18) after making that change, and I can confirm it works fine. If you made no modifications to /etc/init.d/lighttpd, it will continue to cause the old behavior and require /bin/sh in the chroot.

O right sorry apologize for the false reopening , tested with -- file at the end of the command line and was fixed , thanks for the hint :)