processing an XSL-FO file with FOP in eXist-db exits with "permission denied" (only on Linux)

I'll start by stating the context this question is based on: I'm running eXist-4.7.1 in a Tomcat container, and am trying to specify fonts in a configuration file for a PDF transformation using FOP (eXist-4.7.1 ships with FOP version 2.3).

The good news: it seems that some progress has been made since earlier reports on font configuration on the eXist-open mailing list (https://markmail.org/message/so43jgratswpu4dz), and I'm now able to load fonts via the http:// protocol. Here is a self-contained XQuery example (which can be stored in and run from the db):

xquery version "3.1";

import module namespace xslfo="http://exist-db.org/xquery/xslfo";

let $fo :=
<fo:root xmlns:fo="http://www.w3.org/1999/XSL/Format">
 <fo:layout-master-set>
  <fo:simple-page-master master-name="my_page" margin="0.5in">
   <fo:region-body/>
  </fo:simple-page-master>
 </fo:layout-master-set>
 <fo:page-sequence master-reference="my_page">
  <fo:flow flow-name="xsl-region-body">
   <fo:block font-family="urbanist">Hello world!</fo:block>
  </fo:flow>
 </fo:page-sequence>
</fo:root>

let $fop.config :=
<fop version="1.0"> 
  <use-cache>false</use-cache>
  <renderers>
    <renderer mime="application/pdf">
      <fonts>
        <font kerning="yes" embed-url="https://github.com/coreywho/Urbanist/raw/master/fonts/static/Urbanist-Black.ttf">
          <font-triplet name="urbanist" style="normal" weight="normal"/>
        </font>
      </fonts>
    </renderer>   
  </renderers>
</fop>

let $pdf := xslfo:render($fo, "application/pdf", (), ($fop.config))
return response:stream-binary($pdf, "application/pdf", "output.pdf")

The even better news: this is working without problems on my Windows box, where it produces a PDF document looking as follows (with the right font):

The bad news: when running the exact same XQuery example in exactly the same Tomcat setup on my Linux production server, the xslfo:render() call exits with an error:

<exception>
  <path>/db/apps/test-fop-fonts/test-fop-fonts.xq</path>
  <message>exerr:ERROR .fop (Permission denied) [at line 40, column 13]</message>
</exception>

Unfortunately, this is about everything that's being logged. Clearly, something is going wrong on the Linux box, but I have no clue what it could be. Apart from this glitch, eXist is operating perfectly in my Linux Tomcat, so I'm quite confident file permissions should be OK.

Has anyone else encountered this "permission denied" error?

Best,

Ron

Apparently, it turned out to be a lower-level OS problem: the problem disappeared when starting Tomcat as root user, after which eXist could happily create the PDF file.

After some more digging, it appeared that FOP caches files in home directory of the user running it, which was lacking for my non-privileged Tomcat user.... and that the problem could be fixed by just creating a home directory for this user, or providing the path to a writable folder for that user in the Tomcat startup script, e.g. -Duser.home=$CATALINA_TMPDIR!

If anyone else should bump into this, I've found the solution here: https://forum.xwiki.org/t/pdf-export-issue-with-file-permissions/4933/11. (phew!)