Spring Boot 1.3.1.and spring 4.2.4.java.lang.RuntimePermission accessClassInPackage.sun.reflect.annotation - spring

Question

I have upgraded spring boot to 1.3.1.RELEASE and spring framework 4.2.4.RELEASE and i am running into issues. I wasn't given security permission for sun.reflect.annotation in tomcat catalina policy.
Can anyone tell why is spring framework trying scan system jar file/classes for web servlet annotations ? Is there a way in spring boot not to scan system file/classes ?
22-Dec-2015 14:15:41.523 SEVERE [localhost-startStop-1] org.apache.catalina.core.ContainerBase.addChildInternal ContainerBase.addChild: start:
org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/hccore]]
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:154)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:725)
at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:131)
at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:153)
at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:143)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:699)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:717)
at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:945)
at org.apache.catalina.startup.HostConfig$DeployWar.run(HostConfig.java:1798)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessClassInPackage.sun.reflect.annotation")
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
at java.security.AccessController.checkPermission(AccessController.java:884)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
at java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1564)
at sun.reflect.misc.ReflectUtil.checkPackageAccess(ReflectUtil.java:188)
at sun.reflect.misc.ReflectUtil.checkPackageAccess(ReflectUtil.java:164)
at java.lang.reflect.Proxy.getInvocationHandler(Proxy.java:827)
at org.springframework.core.annotation.AnnotationUtils.synthesizeAnnotation(AnnotationUtils.java:1364)
at org.springframework.core.annotation.AnnotationUtils.findAnnotation(AnnotationUtils.java:685)
at org.springframework.core.annotation.AnnotationUtils.findAnnotation(AnnotationUtils.java:660)
at org.springframework.core.annotation.OrderUtils.getOrder(OrderUtils.java:67)
at org.springframework.core.annotation.OrderUtils.getOrder(OrderUtils.java:56)
at org.springframework.core.annotation.AnnotationAwareOrderComparator.findOrder(AnnotationAwareOrderComparator.java:84)
at org.springframework.core.OrderComparator.getOrder(OrderComparator.java:127)
at org.springframework.core.OrderComparator.getOrder(OrderComparator.java:116)
at org.springframework.core.OrderComparator.doCompare(OrderComparator.java:87)
at org.springframework.core.OrderComparator.compare(OrderComparator.java:73)
at java.util.TimSort.countRunAndMakeAscending(TimSort.java:355)
at java.util.TimSort.sort(TimSort.java:220)
at java.util.Arrays.sort(Arrays.java:1438)
at java.util.List.sort(List.java:478)
at java.util.Collections.sort(Collections.java:175)
at org.springframework.core.annotation.AnnotationAwareOrderComparator.sort(AnnotationAwareOrderComparator.java:116)
at org.springframework.web.SpringServletContainerInitializer.onStartup(SpringServletContainerInitializer.java:171)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5170)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
... 14 more

Answer 1

This is probably related to your tomcat policy file. You can find a description of a similar issue and the solution here. Try to check that you have something like this in your tomcat policy file:
permission java.lang.RuntimePermission "accessClassInPackage.sun.reflect.annotation";
permission java.lang.RuntimePermission "accessClassInPackage.sun.reflect.annotation.*";
permission java.lang.RuntimePermission "accessDeclaredMembers";