I try to use logback in a portlet app with the Liferay portal, whose new version (6.2.0) let administrators set up the java security management dynamically.

When the portlet app starts up (in the Liferay environment), the property "java.security.policy" is always null, and System.getSecurityManager() returns the current manager (null if no set, not null if set).

Logback always breaks in PackagingDataCalculator.getCodeLocation(Class) and PackagingDataCalculator.populateFrameStack(StackTraceElementProxy[]) because it calls Class<T>.getProtectionDomain() and Class<T>.getClassLoader().