If you ever get "Permission denied" there's something wrong with ownership/permissions of your slapd setup or slapcat process. You should immediately fix it.
Yes, slapd runs under user "ldap" and I used slapcat as root, but slapcat shouldn't change permissions or write any things? If so, there should an explicit note in the manual page appended to the sentence "..It is always safe to run slapcat with the slapd-bdb(5).." ?
Kindly regards
Meike