I ran dovecot-core 1:2.2.9-1ubuntu2.1 with apparmor-profiles 2.8.95~2430-0ubuntu5.3 and didn't get any errors in mail.log or complaints from apparmor.
$ sudo aa-status apparmor module is loaded. 49 profiles are loaded. 16 profiles are in enforce mode. /sbin/dhclient /usr/bin/evince /usr/bin/evince-previewer /usr/bin/evince-previewer//sanitized_helper /usr/bin/evince-thumbnailer /usr/bin/evince-thumbnailer//sanitized_helper /usr/bin/evince//sanitized_helper /usr/lib/NetworkManager/nm-dhcp-client.action /usr/lib/chromium-browser/chromium-browser//browser_java /usr/lib/chromium-browser/chromium-browser//browser_openjdk /usr/lib/chromium-browser/chromium-browser//sanitized_helper /usr/lib/connman/scripts/dhclient-script /usr/lib/lightdm/lightdm-guest-session /usr/lib/lightdm/lightdm-guest-session//chromium /usr/sbin/rsyslogd /usr/sbin/tcpdump 33 profiles are in complain mode. /sbin/klogd /sbin/syslog-ng /sbin/syslogd /usr/lib/chromium-browser/chromium-browser /usr/lib/chromium-browser/chromium-browser//chromium_browser_sandbox /usr/lib/chromium-browser/chromium-browser//lsb_release /usr/lib/chromium-browser/chromium-browser//xdgsettings /usr/lib/dovecot/anvil /usr/lib/dovecot/auth /usr/lib/dovecot/config /usr/lib/dovecot/deliver /usr/lib/dovecot/dict /usr/lib/dovecot/dovecot-auth /usr/lib/dovecot/dovecot-lda /usr/lib/dovecot/imap /usr/lib/dovecot/imap-login /usr/lib/dovecot/lmtp /usr/lib/dovecot/log /usr/lib/dovecot/managesieve /usr/lib/dovecot/managesieve-login /usr/lib/dovecot/pop3 /usr/lib/dovecot/pop3-login /usr/lib/dovecot/ssl-params /usr/sbin/avahi-daemon /usr/sbin/dnsmasq /usr/sbin/dovecot /usr/sbin/identd /usr/sbin/mdnsd /usr/sbin/nmbd /usr/sbin/nscd /usr/sbin/smbd /usr/{sbin/traceroute,bin/traceroute.db} /{usr/,}bin/ping 9 processes have profiles defined. 2 processes are in enforce mode. /sbin/dhclient (30347) /usr/sbin/rsyslogd (421) 7 processes are in complain mode. /usr/lib/dovecot/anvil (23852) /usr/lib/dovecot/config (23855) /usr/lib/dovecot/log (23853) /usr/sbin/avahi-daemon (594) /usr/sbin/avahi-daemon (595) /usr/sbin/dnsmasq (1583) /usr/sbin/dovecot (23851) 0 processes are unconfined but have a profile defined.
I ran dovecot-core 1:2.2.9-1ubuntu2.1 with apparmor-profiles 2.8.95~ 2430-0ubuntu5. 3 and didn't get any errors in mail.log or complaints from apparmor.
$ sudo aa-status bin/evince- previewer bin/evince- previewer/ /sanitized_ helper bin/evince- thumbnailer bin/evince- thumbnailer/ /sanitized_ helper bin/evince/ /sanitized_ helper lib/NetworkMana ger/nm- dhcp-client. action lib/chromium- browser/ chromium- browser/ /browser_ java lib/chromium- browser/ chromium- browser/ /browser_ openjdk lib/chromium- browser/ chromium- browser/ /sanitized_ helper lib/connman/ scripts/ dhclient- script lib/lightdm/ lightdm- guest-session lib/lightdm/ lightdm- guest-session/ /chromium sbin/rsyslogd sbin/tcpdump lib/chromium- browser/ chromium- browser lib/chromium- browser/ chromium- browser/ /chromium_ browser_ sandbox lib/chromium- browser/ chromium- browser/ /lsb_release lib/chromium- browser/ chromium- browser/ /xdgsettings lib/dovecot/ anvil lib/dovecot/ auth lib/dovecot/ config lib/dovecot/ deliver lib/dovecot/ dict lib/dovecot/ dovecot- auth lib/dovecot/ dovecot- lda lib/dovecot/ imap lib/dovecot/ imap-login lib/dovecot/ lmtp lib/dovecot/ log lib/dovecot/ managesieve lib/dovecot/ managesieve- login lib/dovecot/ pop3 lib/dovecot/ pop3-login lib/dovecot/ ssl-params sbin/avahi- daemon sbin/dnsmasq sbin/dovecot {sbin/tracerout e,bin/tracerout e.db} sbin/rsyslogd (421) lib/dovecot/ anvil (23852) lib/dovecot/ config (23855) lib/dovecot/ log (23853) sbin/avahi- daemon (594) sbin/avahi- daemon (595) sbin/dnsmasq (1583) sbin/dovecot (23851)
apparmor module is loaded.
49 profiles are loaded.
16 profiles are in enforce mode.
/sbin/dhclient
/usr/bin/evince
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
33 profiles are in complain mode.
/sbin/klogd
/sbin/syslog-ng
/sbin/syslogd
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/sbin/identd
/usr/sbin/mdnsd
/usr/sbin/nmbd
/usr/sbin/nscd
/usr/sbin/smbd
/usr/
/{usr/,}bin/ping
9 processes have profiles defined.
2 processes are in enforce mode.
/sbin/dhclient (30347)
/usr/
7 processes are in complain mode.
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
0 processes are unconfined but have a profile defined.