Problem running WebWork in Tomcat with SecurityManager

I'm trying to use WebWork in a webapp that's running in a secure Tomcat instance (i.e. with an active SecurityManager).  I've figured out most of the problems, but the one thing I can't figure out is how to grant permission to access files in a jar.

The problem I'm trying to fix is:
[code]
Caught exception while loading file webwork-default.xml - include - file:/D:/bin/tomcat-5.5.20/webapps/ROOT/WEB-INF/classes/xwork.xml:6:40
	at com.opensymphony.xwork.config.providers.XmlConfigurationProvider.loadConfigurationFile(XmlConfigurationProvider.java:652)
	at com.opensymphony.xwork.config.providers.XmlConfigurationProvider.loadConfigurationFile(XmlConfigurationProvider.java:679)
	at com.opensymphony.xwork.config.providers.XmlConfigurationProvider.init(XmlConfigurationProvider.java:91)
	at com.opensymphony.xwork.config.impl.DefaultConfiguration.reload(DefaultConfiguration.java:85)
	at com.opensymphony.xwork.config.ConfigurationManager.getConfiguration(ConfigurationManager.java:54)
	at com.opensymphony.xwork.DefaultActionProxy.<init>(DefaultActionProxy.java:57)
	at com.opensymphony.xwork.DefaultActionProxyFactory.createActionProxy(DefaultActionProxyFactory.java:46)
	at com.opensymphony.webwork.dispatcher.DispatcherUtils.serviceAction(DispatcherUtils.java:216)
        ...
Caused by: java.security.AccessControlException: access denied (java.io.FilePermission file:\D:\bin\tomcat-5.5.20\webapps\ROOT\WEB-INF\lib\webwork.jar!\webwork-default.xml read)
	at java.security.AccessControlContext.checkPermission(AccessControlContext.java:264)
	at java.security.AccessController.checkPermission(AccessController.java:427)
	at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
	at java.lang.SecurityManager.checkRead(SecurityManager.java:871)
	at java.io.File.exists(File.java:700)
	at com.opensymphony.util.FileManager.loadFile(FileManager.java:89)
	at com.opensymphony.xwork.config.providers.XmlConfigurationProvider.getInputStream(XmlConfigurationProvider.java:119)
	at com.opensymphony.xwork.config.providers.XmlConfigurationProvider.loadConfigurationFile(XmlConfigurationProvider.java:626)
	... 34 more
[/code]


I know it's a FilePermission that's required because using
[code]
grant {
  permission java.io.FilePermission "<<ALL FILES>>", "read";
};[/code]
works, but I can't do it because it defeats the whole idea of using the SecurityManager.

Has anyone had any experience with this?  I'm at my wit's end trying to figure out how to get this damn thing to work.

The only place I've seen any acknowledgement of this issue is at http://confluence.atlassian.com/display/DOC/Java+Policy+Security+with+Confluence and even using all the permission grants there I still can't get it to work.

Any help would be greatly appreciated.

Thanks!
---------------------------------------------------------------------
Posted via Jive Forums
http://forums.opensymphony.com/thread.jspa?threadID=55090&messageID=110004#110004