Dovecot – Fatal: execv(/usr/lib/dovecot/imap-login) failed: Permission denied

I'm in the process of trying to set my own mail server reasonably closely following this guide:
http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/

I've just started to test the configuration and I can't seem to get an ssl connection.

When I run this command:

openssl s_client -prexit -state -debug -connect localhost:993

It says the "SSL handshake has read 0 bytes and written 298 bytes", examining /var/log/dovecot.log reveals:

Fatal: execv(/usr/lib/dovecot/imap-login) failed: Permission denied

Which is odd because ls -lL /usr/lib/dovecot | grep imap-login renders:

drwxrwxrwx 2 mail dovecot 4096 Jul 8 12:25 imap-login

and http://wiki.dovecot.org/UserIds seems to indicate that those permisions should be sufficient.

Since I really don't have any idea what's going on here is dovecot -n:

# 2.1.7: /etc/dovecot/dovecot.conf
# OS: Linux 4.0.4-x86_64-linode57 x86_64 Debian 7.8 
auth_debug = yes
auth_mechanisms = plain login
first_valid_uid = 0
log_path = /var/log/dovecot.log
mail_location = mbox:~/mail:INBOX=/decrypted-mail/%d/%n
mail_privileged_group = mail
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
}
passdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
plugin {
  sieve = ~/.dovecot.sieve
  sieve_dir = ~/sieve
}
protocols = imap pop3 lmtp
service auth-worker {
  user = mail
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
  unix_listener auth-userdb {
    mode = 0600
    user = mail
  }
  user = dovecot
}
service imap-login {
  inet_listener imap {
    port = 0
  }
}
service lmtp {
  unix_listener lmtp {
    group = postfix
    mode = 0666
    user = postfix
  }
  user = mail
}
service pop3-login {
  inet_listener pop3 {
    port = 0
  }
}
ssl = required
ssl_cert = </etc/ssl/certs/dovecot.pem
ssl_key = </etc/ssl/private/dovecot.pem
userdb {
  args = uid=mail gid=mail home=/decrypted-mail/%d/%n
  driver = static
}
userdb {
  args = uid=5000 gid=5000 home=/var/vmail/%d/%n allow_all_users=yes
  driver = static
}

What have I got wrong?