Thanks. I have been experimenting with the permissions, and found errors in sieve.log which said that the user "vmail" needs access to that sieve. And it needs write access to the directory /maildisk/sieve/ so it can create temporary files.
I don't know what that user is for, but following permissions seem to work:
getfacl /maildisk/sieve/dovecot.sieve
getfacl: Removing leading '/' from absolute path names
# file: maildisk/sieve/dovecot.sieve
# owner: vmail
# group: vmail
user::r-x
group::r-x
other::r-x
root@mx1:~# getfacl /maildisk/sieve/
getfacl: Removing leading '/' from absolute path names
# file: maildisk/sieve/
# owner: vmail
# group: vmail
user::rwx
group::rwx
other::--x
Like this I could now see in the sieve.log no a message routed to the Junk folder, for the first time.
Not sure if the permissions I set are really what is needed. If you have the precise data on what should be there, it would be nice to have this published.
<Wish>Or even better, to have this set as an option in the admin panel?</Wish>