grant codeBase "${codebase.preallocate}" {
  // for registering native methods
  permission java.lang.RuntimePermission "accessDeclaredMembers";
  // for accessing the file descriptor field in FileChannel
  permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
};