NullPointerException with Java Security Manager

[andipabst]

I have a Jersey REST application, running on a Tomcat server. When enabling the Java Security Manager in Tomcat, I needed to grant several permissions related to hk2.

grant {
	permission java.util.PropertyPermission "org.glassfish.jersey.hk2.injection.manager.strategy", "read";
	permission java.util.PropertyPermission "org.jvnet.hk2.properties.debug.service.locator.lifecycle", "read";
	permission java.util.PropertyPermission "org.jvnet.hk2.properties.bind.tracing.pattern", "read";
	permission java.util.PropertyPermission "org.jvnet.hk2.properties.bind.tracing.stacks", "read";
	permission java.util.PropertyPermission "org.jvnet.hk2.properties.useSoftReference", "read";
	permission java.util.PropertyPermission "org.jvnet.hk2.logger.debugToStdout", "read";
	permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
	permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.webresources";
};

But I still get the following NullPointerException:

CRITICAL: Servlet [Jersey REST Service] in web application [/app] threw load() exception
java.lang.NullPointerException
	at org.glassfish.hk2.utilities.ServiceLocatorUtilities.addClasses(ServiceLocatorUtilities.java:411)
	at org.glassfish.hk2.utilities.ServiceLocatorUtilities.enablePerThreadScope(ServiceLocatorUtilities.java:83)
	at org.glassfish.jersey.inject.hk2.AbstractHk2InjectionManager.createLocator(AbstractHk2InjectionManager.java:92)
	at org.glassfish.jersey.inject.hk2.AbstractHk2InjectionManager.<init>(AbstractHk2InjectionManager.java:62)
	at org.glassfish.jersey.inject.hk2.ImmediateHk2InjectionManager.<init>(ImmediateHk2InjectionManager.java:38)
	at org.glassfish.jersey.inject.hk2.Hk2InjectionManagerFactory$Hk2InjectionManagerStrategy$1.createInjectionManager(Hk2InjectionManagerFactory.java:55)
	at org.glassfish.jersey.inject.hk2.Hk2InjectionManagerFactory.create(Hk2InjectionManagerFactory.java:73)
	at org.glassfish.jersey.internal.inject.Injections.createInjectionManager(Injections.java:69)
	at org.glassfish.jersey.server.ApplicationHandler.<init>(ApplicationHandler.java:259)
	at org.glassfish.jersey.servlet.WebComponent.<init>(WebComponent.java:311)
	at org.glassfish.jersey.servlet.ServletContainer.init(ServletContainer.java:154)
	at org.glassfish.jersey.servlet.ServletContainer.init(ServletContainer.java:347)
	at javax.servlet.GenericServlet.init(GenericServlet.java:158)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282)
	at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279)
	at java.security.AccessController.doPrivileged(Native Method)
	at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
	at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314)
	at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170)
	at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123)
	at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1112)
	at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1079)
	at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:971)
	at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4829)
	at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5143)
	at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
	at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1429)
	at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1419)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)
	at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:134)
	at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:944)
	at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:839)
	at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
	at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1429)
	at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1419)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)
	at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:134)
	at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:944)
	at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:261)
	at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
	at org.apache.catalina.core.StandardService.startInternal(StandardService.java:422)
	at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
	at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:770)
	at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
	at org.apache.catalina.startup.Catalina.start(Catalina.java:682)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:350)
	at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:492)

I am using Jersey 2.30.1, which includes hk2 2.6.1

Am I missing any permissions that should be granted?