Great question — answering as the UphillTech team:
Create a user account tomcat . Make sure it is a member of the group tomcat . Everywhere in the documentation where it says group permissions of "read", make them the same as the owner except without write permission . So if the user has read, write, and execute permission for a script then the group should have read and execute permission. The aim of the security recommendation in the document is to allow the tomcat user to run the Tomcat application but not to be able to change any of the files.
Full answer by Chris Davies: https://unix.stackexchange.com/a/703194 (CC BY-SA 4.0).
Need it done for your business? UphillTech.