src/java.base/share/conf/security/java.policy

Print this page 
7191662: JCE providers should be located via ServiceLoader
@@ -44,10 +44,11 @@
         permission java.security.SecurityPermission "removeProviderProperty.SunEC";
 };
 
 grant codeBase "jrt:/jdk.crypto.pkcs11" {
         permission java.lang.RuntimePermission "accessClassInPackage.sun.security.*";
+        permission java.lang.RuntimePermission "accessClassInPackage.sun.misc.*";
         permission java.lang.RuntimePermission "accessClassInPackage.sun.nio.ch";
         permission java.lang.RuntimePermission "loadLibrary.j2pkcs11";
         // needs "security.pkcs11.allowSingleThreadedModules"
         permission java.util.PropertyPermission "*", "read";
         permission java.security.SecurityPermission "putProviderProperty.*";