Index: maven.xml
===================================================================
--- maven.xml	(revision 675668)
+++ maven.xml	(working copy)
@@ -124,6 +124,12 @@
         <j:set var="true" value="true"/>
         <j:set var="false" value="false"/>
 
+        <j:if test="${jdo.tck.security}">
+            <echo>Running with Java security manager.</echo>
+            <j:set var="jdo.tck.security.jvmargs" 
+                value="-Djava.security.manager -Djava.security.policy=${basedir}/src/conf/security.policy"/>
+        </j:if>
+
         <j:set var="cfglist" value="${jdo.tck.cfglist}"/>
         <j:if test="${cfglist == null}">
             <u:properties file="${basedir}/src/conf/configurations.list"/>
@@ -451,6 +457,7 @@
         </j:if>
         
         <echo>Starting configuration="${jdo.tck.cfg}" with database="${jdo.tck.database}" identitytype="${jdo.tck.identitytype}" mapping="${jdo.tck.mapping}".</echo>
+<echo message="security settings: ${jdo.tck.security.jvmargs}"/>
         <java fork="yes" dir="${jdo.tck.testdir}"
                classname="${jdo.tck.testrunnerclass}">
             <classpath refid="this.jdori.classpath"/>
@@ -488,10 +495,19 @@
                          value="${jdo.tck.closePMFAfterEachTest}"/>
             <sysproperty key="jdo.tck.signaturefile"
                          value="${jdo.tck.signaturefile}"/>
+            <sysproperty key="jdo.tck.junit.jarfile"
+                         value="${junit.jarfile}"/>
+            <sysproperty key="jdo.tck.testclasses.dir"
+                         value="${jdo.tck.testclasses.dir}"/>
+            <sysproperty key="jdo.api.jarfile"
+                         value="${jdo.api.jarfile}"/>
+            <sysproperty key="jdo.tck.testdir"
+                         value="${jdo.tck.testdir}"/>
                          
             <jvmarg line="${database.runtck.sysproperties}"/>
             <jvmarg line="${jdori.runtck.sysproperties}"/>
             <jvmarg line="${jdo.tck.debug.jvmargs}"/>
+            <jvmarg line="${jdo.tck.security.jvmargs}"/>
             
             <arg line="${jdo.tck.classes}"/>
         </java>
Index: src/conf/security.policy
===================================================================
--- src/conf/security.policy	(revision 0)
+++ src/conf/security.policy	(revision 0)
@@ -0,0 +1,25 @@
+// JUnit code base
+grant codeBase "file://${jdo.tck.junit.jarfile}" {
+    permission java.io.FilePermission "${user.home}/junit.properties", "read";
+    permission java.io.FilePermission "${jdo.tck.log.directory}/-", "write";
+    permission java.io.FilePermission "${jdo.tck.testclasses.dir}/*", "read";
+};
+
+// TCK test classes
+grant codeBase "file://${jdo.tck.testclasses.dir}" {
+    permission java.io.FilePermission "${jdo.tck.log.directory}/-", "read, write";
+    permission java.io.FilePermission "${jdo.tck.testclasses.dir}/*", "read";
+};
+
+// JDO API code base
+grant codeBase "file://${jdo.api.jarfile}" {
+    permission javax.jdo.spi.JDOPermission "getMetadata";
+};
+
+// All classes in the classpath
+grant {
+// c3p0 seems to require PropertyPermission of write (don't know why)
+    permission java.util.PropertyPermission "*", "read, write";
+    permission java.io.FilePermission "${user.home}/.maven/repository/-", "read";
+    permission java.io.FilePermission "${jdo.tck.testdir}/-", "read, write";
+};