fixed with:
security-manager-enabled=true
security-manager-get-bean-property[portal]=\
com.liferay.portal.kernel.audit.AuditMessageFactoryUtil,com.liferay.portal.kernel.audit.AuditRouterUtil,com.liferay.portal.kernel.json.JSONFactoryUtil,com.liferay.portal.kernel.language.LanguageUtil,com.liferay.portal.kernel.language.UnicodeLanguageUtil,com.liferay.portal.kernel.servlet.BrowserSnifferUtil,com.liferay.portal.kernel.util.CalendarFactoryUtil,com.liferay.portal.kernel.util.FastDateFormatFactoryUtil,com.liferay.portal.kernel.util.HtmlUtil,com.liferay.portal.kernel.util.HttpUtil,com.liferay.portal.kernel.util.LocaleUtil,com.liferay.portal.kernel.util.PrefsPropsUtil,com.liferay.portal.kernel.util.PropsUtil,com.liferay.portal.service.permission.AccountPermissionUtil,com.liferay.portal.service.permission.CommonPermissionUtil,com.liferay.portal.service.permission.GroupPermissionUtil,com.liferay.portal.service.permission.LayoutPermissionUtil,com.liferay.portal.service.permission.OrganizationPermissionUtil,com.liferay.portal.service.permission.PasswordPolicyPermissionUtil,com.liferay.portal.service.permission.PortalPermissionUtil,com.liferay.portal.service.permission.PortletPermissionUtil,com.liferay.portal.service.permission.RolePermissionUtil,com.liferay.portal.service.permission.UserGroupPermissionUtil,com.liferay.portal.service.permission.UserPermissionUtil,com.liferay.portal.util.PortalUtil,com.liferay.portal.webserver.WebServerServletTokenUtil,com.liferay.portlet.PortletURLFactoryUtil,com.liferay.portlet.documentlibrary.util.DLUtil,com.liferay.portlet.dynamicdatamapping.util.DDMUtil,com.liferay.portlet.journalcontent.util.JournalContentUtil
security-manager-properties-read=\
java.version,line.separator,log4j.configDebug,log4j.configuration,log4j.configuratorClass,log4j.debug,log4j.defaultInitOverride,log4j.ignoreTCL
