Hmm... ok. I just upgraded my TW with the latest snapshot and rebooted. I've double checked everything was still ok: /etc/apparmor.d/usr.lib.dovecot.stats was still there, and the contents of /etc/apparmor.d/local/usr.sbin.dovecot was ok. And, just to be sure, I reloaded apparmor and restarted dovecot :-) $ sudo aa-unconfined |grep -i dovec 6113 /usr/sbin/dovecot confined by '/usr/sbin/dovecot (enforce)' Also, aa-status includes: 1 profiles are in complain mode. /usr/lib/dovecot/stats I still don't see any 'denied', but let's see what happens.