Set up dedicated users for each daemon

debian/dovecot-keylookupd.postinst

+#!/bin/sh
+
+set -e
+
+case "$1" in
+configure)
+    addgroup --system --quiet dovecot-keylookupd
+    adduser --system --no-create-home --home /run/dovecot-keylookupd \
+      --disabled-password --disabled-login \
+      --quiet --ingroup dovecot-keylookupd dovecot-keylookupd
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0

debian/dovecot-keylookupd.service

@@ -6,7 +6,7 @@ Requires=dovecot-keylookupd.socket
 Type=notify
 ExecStart=/usr/bin/dovecot-keylookupd --systemd-socket
 Restart=on-failure
-User=dovecot
+User=dovecot-keylookupd
 
 [Install]
 WantedBy=multi-user.target

debian/dovecot-keylookupd.socket

@@ -5,7 +5,7 @@ Description=Dovecot keylookupd socket
 ListenStream=/run/dovecot-keylookupd/socket
 SocketMode=660
 DirectoryMode=755
-SocketUser=dovecot
-SocketGroup=dovecot
+SocketUser=dovecot-keylookupd
+SocketGroup=dovecot-keylookupd
 Accept=false