It was tricky, as it wasn’t clear on how to tell procmail where to get its configuration and the processed files. First, the Courier Documentation clearly says how to do this with non-virtual mailboxes. In the /etc/courier/courierd configuration file, change the line

 DEFAULTDELIVERY=./Maildir 

to

 DEFAULTDELIVERY="| /usr/bin/preline /usr/bin/procmail" 

But this in itself doesn’t work – because procmail tries to process mail for the virtual mailman account (vmailman). The home directory for vmailmain is /var/mail, so it looks for /var/mail/.procmailrc. But procmail complains because of the permissions on that directory, and I really don’t want to change them anyway. And even if I change them, I won’t be able to distinguish the various virtual users (which each have directories under /var/mail).

In the end things were simple, because courier conveniently calls procmail in the virtual user’s home directory (e.g. /var/mail/user1. procmail takes a configuration file as an argument, so the following line in /etc/courier/courierd does the trick:

 DEFAULTDELIVERY="| /usr/bin/preline /usr/bin/procmail ./.procmailrc" 

I still need a custom .procmailrc file in each virtual user directory (because procmail needs absolute paths), but that’s something I can live with.