"david.lloyd(a)jboss.com" wrote : Sorry if this is an ignorant question but - won't most (all?) of the early-boot JARs just get AllPermission anyway? Alternate approach of security.xml, the security manager gets installed in the stage after classloading.xml has been bootstrapped. So initialize.xml, classloading.xml went through an open door. That is what I am enquiring about. For VFS, it depends on the VFSURLConnection. https://jira.jboss.org/jira/browse/JBVFS-71 View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4188248#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...