Sun documentation describes precisely how the URLs in the policy codebase works. Especially the file URLs recusivity: http://java.sun.com/javase/6/docs/technotes/guides/security/PolicyFiles.html http://java.sun.com/j2se/1.5.0/docs/api/java/security/CodeSource.html#implies%28java.security.CodeSource%29 Currently the GnuClasspath implementation doesn't work the same way.
Created attachment 20506 [details] file URL check correction It is not optimal in performance but fixes the problem
Created attachment 20754 [details] patch correcting the bug Only the trailing "-" or "*" shouldn't be included when matching the urls.