My production server runs Linux using System V style init scripts.
Tomcat is brought up by running service tomcat6 start as root user (service
On CentOS 6, the Tomcat init.d script launches tomcat by means of this line:
$SU - $TOMCAT_USER -c "${TOMCAT_SCRIPT} start-security"
$SU is either /bin/runuser or /bin/su, $TOMCAT_USER is normally "tomcat", and $TOMCAT_SCRIPT is normally "/usr/sbin/tomcat6". "su -" or "runuser -" runs its command as the specified user, from the specified user's home directory. So this command will change to the "tomcat" user's ID and home directory, then run /usr/sbin/tomcat6. The tomcat6 script eventually launches tomcat itself.
The tomcat user's home directory should be the same as CATALINA_BASE. In short, the "su" or "runuser" command here is what sets the current working directory to CATALINA_BASE.
The init.d script isn't formally part of tomcat; it's supplied by the package maintainer, and it can be different from one system to another. On my Ubuntu 13 system, /etc/init.d/tomcat6 contains a command to cd to $CATALINA_BASE.
Tomcat's own startup scripts (bin/startup.sh and so on) don't set a working directory. When I launch tomcat 6 or tomcat 7 directly using its own startup script, it just inherits the working directory that I ran it from.
Remember that on Linux, you can see any process's actual current directory by checking /proc/.