Comment # 1 on bug 1117844 from Tristan Miller

On further testing, this appears to be the same issue described for Debian at
<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903161>.  That is, Dovecot
has made a change that no longer allows doveadm to be run by regular users;
they must be in the dovecot group.  I can confirm that adding myself to the
dovecot group fixes the issue.

So this isn't an issue with AppArmor.  It might help to document the new
permission requirement (for example, in a dedicated README file), as proposed
in the Debian bug.  I'll leave this bug report open in case anyone wants to
implement that solution; if not, then this can be closed as RESOLVED/INVALID.