Steps to reproduce:

/etc/init.d/zabbix-agent stop

Result:

[....] Stopping Zabbix agent: zabbix_agentdstart-stop-daemon: matching only on non-root pidfile /var/run/zabbix/zabbix_agentd.pid is insecure

Same with server and probably with proxy too.

Expected:

[ ok ] zabbix_agentd stopping...done.

Now it is not possible to stop agent/server/... or package update (there is stop action too). From dpkg manpage:

Warning: using this match option with a world-writable pidfile or using it alone with a daemon that writes the pidfile as an unprivileged (non-root) user will be refused with an error (since version 1.19.3) as this is a security risk, because either any user can write to it, or if the daemon gets compromised, the contents of the pidfile cannot be trusted, and then a privileged runner (such as an init script executed as root) would end up acting on any system process. Using /dev/null is exempt from these checks.

Fix: include "--user zabbix" in init script. Patch of agent init script:

48c48
<     start-stop-daemon --oknodo --stop --pidfile $PID --retry $RETRY
—
>     start-stop-daemon --oknodo --stop --pidfile $PID --user zabbix --retry $RETRY