Esta não é uma resposta que explique ou corrija o problema de permissão, mas acho que você deve usar apenas a opção systemds RuntimeDirectory. Citando a página de manual :
RuntimeDirectory=, RuntimeDirectoryMode=
Takes a list of directory names. If set, one or more directories by
the specified names will be created below /run (for system
services) or below $XDG_RUNTIME_DIR (for user services) when the
unit is started, and removed when the unit is stopped. The
directories will have the access mode specified in
RuntimeDirectoryMode=, and will be owned by the user and group
specified in User= and Group=. Use this to manage one or more
runtime directories of the unit and bind their lifetime to the
daemon runtime. The specified directory names must be relative, and
may not include a "/", i.e. must refer to simple directories to
create or remove. This is particularly useful for unprivileged
daemons that cannot create runtime directories in /run due to lack
of privileges, and to make sure the runtime directory is cleaned up
automatically after use. For runtime directories that require more
complex or different configuration or lifetime guarantees, please
consider using tmpfiles.d(5).
Então, tudo o que você precisa fazer é alterar seu arquivo de serviço para:
[Unit]
Description=control FOO daemon
After=syslog.target network.target
[Service]
Type=forking
User=FOOd
Group=FOO
RuntimeDirectory=FOOd
RuntimeDirectoryMode=$some-mode
ExecStart=/usr/local/bin/FOOd -P /run/FOOd/FOOd.pid
PIDFile=/run/FOOd/FOOd.pid
[Install]
WantedBy=multi-user.target