Just a guess: Is your dovecot-lda running as root? Because:
this could mean it tries to become 8(mail) to be able to deliver, and it's not allowed to?Operation not permitted (Thisbinary should probably be called with process group set to 8(mail) instead of 1000(cryptodan))
MJ
