There could be other places, but specifically some of the org.jboss.as.test.integration.ws.wsse.trust test cases use a permissions.xml which is some fairly broad permissions. This should be reviewed to ensure it's correct. The main concern I have is the <<ALL FILES>> permissions.