Java stack traces give you the Class file, line and number where an exception is throw, together with the message of that exception. If the exception message is not explicit enough as to specify the files/paths it failed to access, then it’s fault of the particular dev, not the language itself 
Back to the problem… Looking at the Apache FOP code around this configuration (xmlgraphics-fop/fop-core/src/main/java/org/apache/fop/fonts/FontManagerConfigurator.java at bd7d5048785c691e6e3e152af10805f3127b760d · apache/xmlgraphics-fop · GitHub), I see 2 options:
- Disable font cache completely (
<use-cache>false</use-cache>) to avoid any attempts of writing to a cache folder - Leave caching enabled, but make sure to use a correct
URIfor the folder resource on your machine. File URIs are in the formfile://, followed by the path on your machine (which also starts with one/on linux). That would mean<cache-file>file:///tmp/fop-fonts.cache</cache-file>
Looking more at the FOP code that works with font cache xmlgraphics-fop/fop-core/src/main/java/org/apache/fop/fonts/FontCache.java at 48dc3b2dafd481af00f5cc9ee706115216c4e85a · apache/xmlgraphics-fop · GitHub (yes, I got here from the java stack trace! ) and the actual exception FileNotFoundException: .fop (Permission denied), it means that getDefaultCacheFile(true) resolves the generic .fop directory (line xmlgraphics-fop/fop-core/src/main/java/org/apache/fop/fonts/FontCache.java at 48dc3b2dafd481af00f5cc9ee706115216c4e85a · apache/xmlgraphics-fop · GitHub) which is an absolute fallback because the user home directory was not usable (i.e. userHome was null and this if failed to enter xmlgraphics-fop/fop-core/src/main/java/org/apache/fop/fonts/FontCache.java at 48dc3b2dafd481af00f5cc9ee706115216c4e85a · apache/xmlgraphics-fop · GitHub because getUserHome() returned null). I am deducing this, because, otherwise, your exception should have looked more like FileNotFoundException: /home/tomcat/.fop (Permission denied) or FileNotFoundException: /tmp/.fop (Permission denied). It should actually include the font cache file itself as well, e.g. /home/tomcat/.fop/fop-fonts.cache… you get the picture.
So the root of the problem seems to be an issue with the running java environment in figuring out the home folder of the user executing it. In lack of a user home to prefix the path, simply .fop would resolve to a subfolder of the current working folder (i.e. the value of the system property “user.dir” of the running java environment; i.e. the place where the command to start the tomcat instance was executed from). You could try to debug the “current folder of the running instance” by executing this quick script in one of your XWiki test pages:
{{groovy}}
System.getProperty("user.dir")
{{/groovy}}
(hint: you can do the same for the user.home property as well to actually debug the running instance’s setup. To get all properties, use System.getProperties() instead and find the interesting property values there.)
You might get some good debugging info (but from outside the running instance) by executing sudo -u tomcat java -XshowSettings:properties -version. It should print out useful information (would be useful to share it here as well), specifically at the end, the value of user.home. Make sure to specify the actual user that is running your tomcat instance (you seem to have mentioned your user is called _tomcat and not tomcat).
If you that does not help, your backup is to force the value of the user.home in your java environment by tinkering with the tomcat initialization scripts (well documented online, either setenv.sh or directly catalina.sh, don’t remember exactly) and add the system property -Duser.home=/home/_tomcat (or whatever you prefer), just note that there might be other things (not only FOP) relying on that system property and you might affect them as well.
This should be enough to help you figure out what is wrong in your setup… either with the user that is running the java env, either with the java env itself or with rights in your system. Finally, you have 2 ways of overriding the settings (in the fop-config file or with the java user.home system property).
Not more I can do from here at this point. Hope you come back with a positive outcome.