I confirm this issue on bullseye. There is also a similar one with clamav-daemon:
# systemctl status clamav-daemon ● clamav-daemon.service - Clam AntiVirus userspace daemon Loaded: loaded (/lib/systemd/system/clamav-daemon.service; enabled; vendor preset: enabled) Drop-In: /etc/systemd/system/clamav-daemon.service.d └─extend.conf Active: failed (Result: exit-code) since Tue 2020-10-27 09:15:31 CET; 1s ago Docs: man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/ Process: 1452534 ExecStartPre=/bin/mkdir -p /run/clamav (code=exited, status=0/SUCCESS) Process: 1452542 ExecStartPre=/bin/chown clamav /run/clamav (code=exited, status=0/SUCCESS) Process: 1452550 ExecStart=/usr/sbin/clamd --foreground=true (code=exited, status=1/FAILURE) Main PID: 1452550 (code=exited, status=1/FAILURE) Oct 27 09:15:31 hostname systemd[1]: Starting Clam AntiVirus userspace daemon... Oct 27 09:15:31 hostname systemd[1]: Started Clam AntiVirus userspace daemon. Oct 27 09:15:31 hostname clamd[1452550]: ERROR: lchown to user 'clamav' failed on Oct 27 09:15:31 hostname clamd[1452550]: log file '/var/log/clamav/clamav.log'. Oct 27 09:15:31 hostname clamd[1452550]: Error was 'Operation not permitted' Oct 27 09:15:31 hostname clamd[1452550]: Tue Oct 27 09:15:31 2020 -> ^lchown to user 'clamav' failed on log file '/var/log/clamav/clamav.log'. Error > Oct 27 09:15:31 hostname systemd[1]: clamav-daemon.service: Main process exited, code=exited, status=1/FAILURE Oct 27 09:15:31 hostname systemd[1]: clamav-daemon.service: Failed with result 'exit-code'. -- Jean-Christophe