 <p>When a servlet runs, the user from an operating system perspective is the user that the Servlet Container (Jetty, Tomcat, Glassfish, etc) is running as. It is the rights of that user that are being checked by the operating system. The owner of the JSP file is irrelevant. Well, to be precise the JSP file has to be readable by the user that the Servlet Container is running as otherwise it can't be executed but in terms of OS permissions for the actions defined by that JSP, the only thing that matters is the user the Servlet Container is running as.</p>