title: NullPointerException with Java Security Manager in Tomcat
body: <p>I have a Jersey REST application, running on a Tomcat server. When enabling the Java Security Manager in Tomcat, I needed to grant several permissions related to hk2. </p>
  
  <pre><code>grant {
      permission java.util.PropertyPermission "org.glassfish.jersey.hk2.injection.manager.strategy", "read";
      permission java.util.PropertyPermission "org.jvnet.hk2.properties.debug.service.locator.lifecycle", "read";
      permission java.util.PropertyPermission "org.jvnet.hk2.properties.bind.tracing.pattern", "read";
      permission java.util.PropertyPermission "org.jvnet.hk2.properties.bind.tracing.stacks", "read";
      permission java.util.PropertyPermission "org.jvnet.hk2.properties.useSoftReference", "read";
      permission java.util.PropertyPermission "org.jvnet.hk2.logger.debugToStdout", "read";
      permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
      permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.webresources";
  };
  </code></pre>
  
  <p>But I still get the following NullPointerException:</p>
  
  <pre><code>CRITICAL: Servlet [Jersey REST Service] in web application [/app] threw load() exception
  java.lang.NullPointerException
      at org.glassfish.hk2.utilities.ServiceLocatorUtilities.addClasses(ServiceLocatorUtilities.java:411)
      at org.glassfish.hk2.utilities.ServiceLocatorUtilities.enablePerThreadScope(ServiceLocatorUtilities.java:83)
      at org.glassfish.jersey.inject.hk2.AbstractHk2InjectionManager.createLocator(AbstractHk2InjectionManager.java:92)
      at org.glassfish.jersey.inject.hk2.AbstractHk2InjectionManager.&lt;init&gt;(AbstractHk2InjectionManager.java:62)
      at org.glassfish.jersey.inject.hk2.ImmediateHk2InjectionManager.&lt;init&gt;(ImmediateHk2InjectionManager.java:38)
      at org.glassfish.jersey.inject.hk2.Hk2InjectionManagerFactory$Hk2InjectionManagerStrategy$1.createInjectionManager(Hk2InjectionManagerFactory.java:55)
      at org.glassfish.jersey.inject.hk2.Hk2InjectionManagerFactory.create(Hk2InjectionManagerFactory.java:73)
      at org.glassfish.jersey.internal.inject.Injections.createInjectionManager(Injections.java:69)
      at org.glassfish.jersey.server.ApplicationHandler.&lt;init&gt;(ApplicationHandler.java:259)
      at org.glassfish.jersey.servlet.WebComponent.&lt;init&gt;(WebComponent.java:311)
      at org.glassfish.jersey.servlet.ServletContainer.init(ServletContainer.java:154)
      at org.glassfish.jersey.servlet.ServletContainer.init(ServletContainer.java:347)
      at javax.servlet.GenericServlet.init(GenericServlet.java:158)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:498)
      at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282)
      at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279)
      at java.security.AccessController.doPrivileged(Native Method)
      at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
      at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314)
      at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170)
      at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123)
      at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1112)
      at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1079)
      at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:971)
      at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4829)
      at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5143)
      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1429)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1419)
      at java.util.concurrent.FutureTask.run(FutureTask.java:266)
      at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)
      at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:134)
      at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:944)
      at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:839)
      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1429)
      at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1419)
      at java.util.concurrent.FutureTask.run(FutureTask.java:266)
      at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)
      at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:134)
      at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:944)
      at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:261)
      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
      at org.apache.catalina.core.StandardService.startInternal(StandardService.java:422)
      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
      at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:770)
      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
      at org.apache.catalina.startup.Catalina.start(Catalina.java:682)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:498)
      at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:350)
      at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:492)
  </code></pre>
  
  <p>(I am using Jersey 2.30.1, which includes hk2 2.6.1)</p>
  
  <p>Am I missing any permissions that should be granted?</p>