--- old/src/share/classes/java/util/logging/ConsoleHandler.java	2013-12-14 18:14:17.466838806 +0100
+++ new/src/share/classes/java/util/logging/ConsoleHandler.java	2013-12-14 18:14:17.344840959 +0100
@@ -26,6 +26,9 @@
 
 package java.util.logging;
 
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
 /**
  * This <tt>Handler</tt> publishes log records to <tt>System.err</tt>.
  * By default the <tt>SimpleFormatter</tt> is used to generate brief summaries.
@@ -66,25 +69,30 @@
  * @since 1.4
  */
 public class ConsoleHandler extends StreamHandler {
-    // Private method to configure a ConsoleHandler from LogManager
+    // Private PrivilegedAction to configure a ConsoleHandler from LogManager
     // properties and/or default values as specified in the class
     // javadoc.
-    private void configure() {
-        LogManager manager = LogManager.getLogManager();
-        String cname = getClass().getName();
-
-        setLevel(manager.getLevelProperty(cname +".level", Level.INFO));
-        setFilter(manager.getFilterProperty(cname +".filter", null));
-        setFormatter(manager.getFormatterProperty(cname +".formatter", new SimpleFormatter()));
-        try {
-            setEncoding(manager.getStringProperty(cname +".encoding", null));
-        } catch (Exception ex) {
+    private class ConfigureAction implements PrivilegedAction<Void> {
+        @Override
+        public Void run() {
+            LogManager manager = LogManager.getLogManager();
+            String cname = ConsoleHandler.this.getClass().getName();
+
+            setLevel(manager.getLevelProperty(cname +".level", Level.INFO));
+            setFilter(manager.getFilterProperty(cname +".filter", null));
+            setFormatter(manager.getFormatterProperty(cname +".formatter", new SimpleFormatter()));
             try {
-                setEncoding(null);
-            } catch (Exception ex2) {
-                // doing a setEncoding with null should always work.
-                // assert false;
+                setEncoding(manager.getStringProperty(cname +".encoding", null));
+            } catch (Exception ex) {
+                try {
+                    setEncoding(null);
+                } catch (Exception ex2) {
+                    // doing a setEncoding with null should always work.
+                    // assert false;
+                }
             }
+            setOutputStream(System.err);
+            return null;
         }
     }
 
@@ -96,10 +104,8 @@
      *
      */
     public ConsoleHandler() {
-        sealed = false;
-        configure();
-        setOutputStream(System.err);
-        sealed = true;
+        AccessController.doPrivileged(new ConfigureAction(),
+                                      null, LogManager.controlPermission);
     }
 
     /**
--- old/src/share/classes/java/util/logging/Handler.java	2013-12-14 18:14:17.764833547 +0100
+++ new/src/share/classes/java/util/logging/Handler.java	2013-12-14 18:14:17.650835559 +0100
@@ -27,6 +27,7 @@
 package java.util.logging;
 
 import java.io.UnsupportedEncodingException;
+
 /**
  * A <tt>Handler</tt> object takes log messages from a <tt>Logger</tt> and
  * exports them.  It might for example, write them to a console
@@ -62,10 +63,6 @@
     private volatile ErrorManager errorManager = new ErrorManager();
     private volatile String encoding;
 
-    // Package private support for security checking.  When sealed
-    // is true, we access check updates to the class.
-    boolean sealed = true;
-
     /**
      * Default constructor.  The resulting <tt>Handler</tt> has a log
      * level of <tt>Level.ALL</tt>, no <tt>Formatter</tt>, and no
@@ -302,12 +299,9 @@
     }
 
     // Package-private support method for security checks.
-    // If "sealed" is true, we check that the caller has
-    // appropriate security privileges to update Handler
-    // state and if not throw a SecurityException.
+    // We check that the caller has appropriate security privileges
+    // to update Handler state and if not throw a SecurityException.
     void checkPermission() throws SecurityException {
-        if (sealed) {
-            manager.checkPermission();
-        }
+        manager.checkPermission();
     }
 }
--- old/src/share/classes/java/util/logging/LogManager.java	2013-12-14 18:14:18.068828181 +0100
+++ new/src/share/classes/java/util/logging/LogManager.java	2013-12-14 18:14:17.951830246 +0100
@@ -1557,7 +1557,7 @@
         loadLoggerHandlers(rootLogger, null, "handlers");
     }
 
-    private final Permission controlPermission = new LoggingPermission("control", null);
+    static final Permission controlPermission = new LoggingPermission("control", null);
 
     void checkPermission() {
         SecurityManager sm = System.getSecurityManager();
--- old/src/share/classes/java/util/logging/MemoryHandler.java	2013-12-14 18:14:18.415822057 +0100
+++ new/src/share/classes/java/util/logging/MemoryHandler.java	2013-12-14 18:14:18.293824210 +0100
@@ -25,6 +25,9 @@
 
 package java.util.logging;
 
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
 /**
  * <tt>Handler</tt> that buffers requests in a circular buffer in memory.
  * <p>
@@ -94,21 +97,25 @@
     private LogRecord buffer[];
     int start, count;
 
-    // Private method to configure a MemoryHandler from LogManager
+    // Private PrivilegedAction to configure a MemoryHandler from LogManager
     // properties and/or default values as specified in the class
     // javadoc.
-    private void configure() {
-        LogManager manager = LogManager.getLogManager();
-        String cname = getClass().getName();
-
-        pushLevel = manager.getLevelProperty(cname +".push", Level.SEVERE);
-        size = manager.getIntProperty(cname + ".size", DEFAULT_SIZE);
-        if (size <= 0) {
-            size = DEFAULT_SIZE;
+    private class ConfigureAction implements PrivilegedAction<Void> {
+        @Override
+        public Void run() {
+            LogManager manager = LogManager.getLogManager();
+            String cname = MemoryHandler.this.getClass().getName();
+
+            pushLevel = manager.getLevelProperty(cname +".push", Level.SEVERE);
+            size = manager.getIntProperty(cname + ".size", DEFAULT_SIZE);
+            if (size <= 0) {
+                size = DEFAULT_SIZE;
+            }
+            setLevel(manager.getLevelProperty(cname +".level", Level.ALL));
+            setFilter(manager.getFilterProperty(cname +".filter", null));
+            setFormatter(manager.getFormatterProperty(cname +".formatter", new SimpleFormatter()));
+            return null;
         }
-        setLevel(manager.getLevelProperty(cname +".level", Level.ALL));
-        setFilter(manager.getFilterProperty(cname +".filter", null));
-        setFormatter(manager.getFormatterProperty(cname +".formatter", new SimpleFormatter()));
     }
 
     /**
@@ -116,10 +123,8 @@
      * <tt>LogManager</tt> configuration properties.
      */
     public MemoryHandler() {
-        sealed = false;
-        configure();
-        sealed = true;
-
+        AccessController.doPrivileged(new ConfigureAction(),
+                                      null, LogManager.controlPermission);
         LogManager manager = LogManager.getLogManager();
         String handlerName = getClass().getName();
         String targetName = manager.getProperty(handlerName+".target");
@@ -164,9 +169,8 @@
         if (size <= 0) {
             throw new IllegalArgumentException();
         }
-        sealed = false;
-        configure();
-        sealed = true;
+        AccessController.doPrivileged(new ConfigureAction(),
+                                      null, LogManager.controlPermission);
         this.target = target;
         this.pushLevel = pushLevel;
         this.size = size;
--- old/src/share/classes/java/util/logging/SocketHandler.java	2013-12-14 18:14:18.737816374 +0100
+++ new/src/share/classes/java/util/logging/SocketHandler.java	2013-12-14 18:14:18.615818527 +0100
@@ -28,6 +28,8 @@
 
 import java.io.*;
 import java.net.*;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 
 /**
  * Simple network logging <tt>Handler</tt>.
@@ -83,30 +85,76 @@
     private String host;
     private int port;
 
-    // Private method to configure a SocketHandler from LogManager
-    // properties and/or default values as specified in the class
+    // Private PrivilegedAction to configure a SocketHandler from constructor parameters,
+    // LogManager properties and/or default values as specified in the class
     // javadoc.
-    private void configure() {
-        LogManager manager = LogManager.getLogManager();
-        String cname = getClass().getName();
-
-        setLevel(manager.getLevelProperty(cname +".level", Level.ALL));
-        setFilter(manager.getFilterProperty(cname +".filter", null));
-        setFormatter(manager.getFormatterProperty(cname +".formatter", new XMLFormatter()));
-        try {
-            setEncoding(manager.getStringProperty(cname +".encoding", null));
-        } catch (Exception ex) {
+    private class ConfigureAction implements PrivilegedAction<Void> {
+        private final String host;
+        private final int port;
+        private final boolean hostAndPortSet;
+
+        ConfigureAction() {
+            this.host = null;
+            this.port = 0;
+            this.hostAndPortSet = false;
+        }
+
+        ConfigureAction(String host, int port) {
+            this.host = host;
+            this.port = port;
+            this.hostAndPortSet = true;
+        }
+
+        @Override
+        public Void run() {
+            LogManager manager = LogManager.getLogManager();
+            String cname = SocketHandler.this.getClass().getName();
+
+            setLevel(manager.getLevelProperty(cname +".level", Level.ALL));
+            setFilter(manager.getFilterProperty(cname +".filter", null));
+            setFormatter(manager.getFormatterProperty(cname +".formatter", new XMLFormatter()));
             try {
-                setEncoding(null);
-            } catch (Exception ex2) {
-                // doing a setEncoding with null should always work.
-                // assert false;
+                setEncoding(manager.getStringProperty(cname +".encoding", null));
+            } catch (Exception ex) {
+                try {
+                    setEncoding(null);
+                } catch (Exception ex2) {
+                    // doing a setEncoding with null should always work.
+                    // assert false;
+                }
             }
+            if (hostAndPortSet) {
+                SocketHandler.this.port = port;
+                SocketHandler.this.host = host;
+            } else {
+                SocketHandler.this.port = manager.getIntProperty(cname + ".port", 0);
+                SocketHandler.this.host = manager.getStringProperty(cname + ".host", null);
+            }
+            // Check host and port are valid.
+            if (port == 0) {
+                throw new IllegalArgumentException("Bad port: " + port);
+            }
+            if (host == null) {
+                throw new IllegalArgumentException("Null host name: " + host);
+            }
+            return null;
         }
-        port = manager.getIntProperty(cname + ".port", 0);
-        host = manager.getStringProperty(cname + ".host", null);
     }
 
+    // Private PrivilegedAction to set outputStream from given constructor parameter.
+    private class SetOutputStreamAction implements PrivilegedAction<Void> {
+        private final OutputStream outputStream;
+
+        SetOutputStreamAction(OutputStream outputStream) {
+            this.outputStream = outputStream;
+        }
+
+        @Override
+        public Void run() {
+            setOutputStream(outputStream);
+            return null;
+        }
+    }
 
     /**
      * Create a <tt>SocketHandler</tt>, using only <tt>LogManager</tt> properties
@@ -118,16 +166,17 @@
      */
     public SocketHandler() throws IOException {
         // We are going to use the logging defaults.
-        sealed = false;
-        configure();
-
+        AccessController.doPrivileged(new ConfigureAction(),
+                                      null, LogManager.controlPermission);
+        final OutputStream outputStream;
         try {
-            connect();
-        } catch (IOException ix) {
+            outputStream = connect();
+        } catch (IOException e) {
             System.err.println("SocketHandler: connect failed to " + host + ":" + port);
-            throw ix;
+            throw e;
         }
-        sealed = true;
+        AccessController.doPrivileged(new SetOutputStreamAction(outputStream),
+                                      null, LogManager.controlPermission);
     }
 
     /**
@@ -146,28 +195,16 @@
      *         host and port.
      */
     public SocketHandler(String host, int port) throws IOException {
-        sealed = false;
-        configure();
-        sealed = true;
-        this.port = port;
-        this.host = host;
-        connect();
+        AccessController.doPrivileged(new ConfigureAction(host, port),
+                                      null, LogManager.controlPermission);
+        setOutputStream(connect());
     }
 
-    private void connect() throws IOException {
-        // Check the arguments are valid.
-        if (port == 0) {
-            throw new IllegalArgumentException("Bad port: " + port);
-        }
-        if (host == null) {
-            throw new IllegalArgumentException("Null host name: " + host);
-        }
-
+    private OutputStream connect() throws IOException {
         // Try to open a new socket.
         sock = new Socket(host, port);
         OutputStream out = sock.getOutputStream();
-        BufferedOutputStream bout = new BufferedOutputStream(out);
-        setOutputStream(bout);
+        return new BufferedOutputStream(out);
     }
 
     /**
--- old/src/share/classes/java/util/logging/StreamHandler.java	2013-12-14 18:14:19.056810744 +0100
+++ new/src/share/classes/java/util/logging/StreamHandler.java	2013-12-14 18:14:18.935812880 +0100
@@ -27,6 +27,8 @@
 package java.util.logging;
 
 import java.io.*;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 
 /**
  * Stream based logging <tt>Handler</tt>.
@@ -77,25 +79,50 @@
     private boolean doneHeader;
     private volatile Writer writer;
 
-    // Private method to configure a StreamHandler from LogManager
-    // properties and/or default values as specified in the class
+    // Private PrivilegedAction to configure a StreamHandler from constructor parameters,
+    // LogManager properties and/or default values as specified in the class
     // javadoc.
-    private void configure() {
-        LogManager manager = LogManager.getLogManager();
-        String cname = getClass().getName();
-
-        setLevel(manager.getLevelProperty(cname +".level", Level.INFO));
-        setFilter(manager.getFilterProperty(cname +".filter", null));
-        setFormatter(manager.getFormatterProperty(cname +".formatter", new SimpleFormatter()));
-        try {
-            setEncoding(manager.getStringProperty(cname +".encoding", null));
-        } catch (Exception ex) {
+    private class ConfigureAction implements PrivilegedAction<Void> {
+        private final OutputStream out;
+        private final Formatter formatter;
+
+        ConfigureAction() {
+            this.out = null;
+            this.formatter = null;
+        }
+
+        ConfigureAction(OutputStream out, Formatter formatter) {
+            if (out == null || formatter == null) {
+                throw new NullPointerException();
+            }
+            this.out = out;
+            this.formatter = formatter;
+        }
+
+        @Override
+        public Void run() {
+            LogManager manager = LogManager.getLogManager();
+            String cname = StreamHandler.this.getClass().getName();
+
+            setLevel(manager.getLevelProperty(cname +".level", Level.INFO));
+            setFilter(manager.getFilterProperty(cname +".filter", null));
+            setFormatter(formatter == null // use configured formatter if null
+                         ? manager.getFormatterProperty(cname +".formatter", new SimpleFormatter())
+                         : formatter);
             try {
-                setEncoding(null);
-            } catch (Exception ex2) {
-                // doing a setEncoding with null should always work.
-                // assert false;
+                setEncoding(manager.getStringProperty(cname +".encoding", null));
+            } catch (Exception ex) {
+                try {
+                    setEncoding(null);
+                } catch (Exception ex2) {
+                    // doing a setEncoding with null should always work.
+                    // assert false;
+                }
+            }
+            if (out != null) { // don't set output stream if null
+                setOutputStream(out);
             }
+            return null;
         }
     }
 
@@ -103,9 +130,8 @@
      * Create a <tt>StreamHandler</tt>, with no current output stream.
      */
     public StreamHandler() {
-        sealed = false;
-        configure();
-        sealed = true;
+        AccessController.doPrivileged(new ConfigureAction(),
+                                      null, LogManager.controlPermission);
     }
 
     /**
@@ -116,11 +142,8 @@
      * @param formatter   Formatter to be used to format output
      */
     public StreamHandler(OutputStream out, Formatter formatter) {
-        sealed = false;
-        configure();
-        setFormatter(formatter);
-        setOutputStream(out);
-        sealed = true;
+        AccessController.doPrivileged(new ConfigureAction(out, formatter),
+                                      null, LogManager.controlPermission);
     }
 
     /**