# store the test application system-property.war into /tmp folder # run server with security manager ./standalone.sh -secmgr # deploy the test application ./jboss-cli.sh -c "deploy /tmp/system-property.war" # open http: //localhost:8080/system-property/ and check if there is a AccessControlException stack trace # it's expected state, because the app has no permissions.xml # add AllPermission to deployment permissions minimum-set ./jboss-cli.sh -c << EOT /subsystem=security-manager/deployment-permissions= default /minimum-set= default :add /subsystem=security-manager/deployment-permissions= default /minimum-set= default /permission=test:add(class=java.security.AllPermission) EOT # from the server response you can see the server reload is not required # open http: //localhost:8080/system-property/ and check if you see the JRE path in the response - expected behavior # Instead of the expected state the AccessControlException is still present => BUG! # reload server ./jboss-cli.sh -c reload # open http: //localhost:8080/system-property/ and check if you see the JRE path in the response - Yes! it works now.