Jini client inside Tomcat - FilePermission required to unmarshall a service item

Hi,
I found the archives of JINI-USERS really helpful but now I'm struggling with a problem I 
couldn't find a solution for.
(Just as a side note - forgive me my English - it's not my mother tongue).
The problem:
I have a web application running in Tomcat 6.0.14 that acts as a Jini service client. It looks up 
some services using a LookupCache created by ServiceDiscoveryManager.
Service interface is packaged in a jar file in WEB-INF/lib.
Starter kit libraries (jsk-platform, jsk-lib, jsk-resources) are added to the system classpath so 
that PreferredClassProvider is visible to RMI runtime.
Lookup services are available and usable to the ServiceDiscoveryManager.
But the service proxy cannot be unmarshalled by the Reggie proxy (service interface class 
cannot be found). After some investigation it appears that when PreferredClassLoader tries to 
load proxy interfaces and - since they are not preferred - delegates to it's parent loader 
(which is Tomcat's WebappClassLoader) some FilePermissions are checked (namely 
permissions to read from various directories containing web application classes eg. 
WEB-INF/classes). So if reggie proxy does not have appropriate permissions the check fails.
Running with -Djava.security.debug I got the following stacktrace:
access: access denied 
(java.io.FilePermission /home/mkleczek/apps/apache-tomcat-6.0.14/webapps/irepas/WEB-INF/classes/biz/xpro/meetings/IrepasMeetingsServi
java.lang.Exception: Stack trace
        at java.lang.Thread.dumpStack(Thread.java:1206)
        at 
java.security.AccessControlContext.checkPermission(AccessControlContext.java:313)
        at java.security.AccessController.checkPermission(AccessController.java:546)
        at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
        at java.lang.SecurityManager.checkRead(SecurityManager.java:871)
        at java.io.File.exists(File.java:731)
        at org.apache.naming.resources.FileDirContext.file(FileDirContext.java:822)
        at org.apache.naming.resources.FileDirContext.lookup(FileDirContext.java:205)
        at org.apache.naming.resources.ProxyDirContext.lookup(ProxyDirContext.java:294)
        at 
org.apache.catalina.loader.WebappClassLoader.findResourceInternal(WebappClassLoader.java:1889)
        at 
org.apache.catalina.loader.WebappClassLoader.findClassInternal(WebappClassLoader.java:1757)
        at 
org.apache.catalina.loader.WebappClassLoader.findClass(WebappClassLoader.java:872)
        at 
org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1325)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:299)
        at net.jini.loader.pref.PreferredClassLoader.loadClass(PreferredClassLoader.java:922)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
        at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:319)
        at java.lang.Class.forName0(Native Method)
        at java.lang.Class.forName(Class.java:247)
        at 
net.jini.loader.pref.PreferredClassProvider.loadProxyInterfaces(PreferredClassProvider.java:1360)
        at 
net.jini.loader.pref.PreferredClassProvider.loadProxyClass(PreferredClassProvider.java:1241)
        at 
net.jini.loader.pref.PreferredClassProvider.loadProxyClass(PreferredClassProvider.java:1145)
        at java.rmi.server.RMIClassLoader.loadProxyClass(RMIClassLoader.java:294)
        at net.jini.loader.ClassLoading.loadProxyClass(ClassLoading.java:240)
        at net.jini.io.MarshalInputStream.resolveProxyClass(MarshalInputStream.java:373)
        at java.io.ObjectInputStream.readProxyDesc(ObjectInputStream.java:1531)
        at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1493)
        at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1732)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1329)
        at java.io.ObjectInputStream.readObject(ObjectInputStream.java:351)
        at net.jini.io.MarshalledInstance.get(MarshalledInstance.java:358)
        at net.jini.io.MarshalledInstance.get(MarshalledInstance.java:287)
        at com.sun.jini.proxy.MarshalledWrapper.get(MarshalledWrapper.java:127)
        at com.sun.jini.reggie.Item.get(Item.java:141)
        at com.sun.jini.reggie.Item.toServiceItem(Item.java:177)
        at com.sun.jini.reggie.Matches.get(Matches.java:62)
        at com.sun.jini.reggie.RegistrarProxy.lookup(RegistrarProxy.java:128)
        at 
net.jini.lookup.ServiceDiscoveryManager$LookupCacheImpl$LookupTask.run(ServiceDiscoveryManager.java:929)
        at 
net.jini.lookup.ServiceDiscoveryManager$LookupCacheImpl$RegisterListenerTask.run(ServiceDiscoveryManager.java:901)
        at com.sun.jini.thread.TaskManager$TaskThread.run(TaskManager.java:331)


Everything works fine when I have:
grant {
  java.security.AllPermission;
}
in my policy file.

I don't know how to solve it but shouldn't PreferredClassProvider load classes and proxy 
classess inside AccessController.doPrivileged() ?
I don't think it is WebappClassloader bug - it has to check permissions so that it is impossible 
for one web application to load classes from another web application.

What do you think?
Thanks in advance,
Michal

--------------------------------------------------------------------------
Getting Started:     http://www.jini.org/wiki/Category:Getting_Started
Community Web Site:  http://jini.org
jini-users Archive:  http://archives.java.sun.com/archives/jini-users.html
Unsubscribing:       email "signoff JINI-USERS"  to [email protected]