-- Use security manager (can't see error on compiler.xml yet)

KTI-2206
diff --git a/compiler/cli/cli-base/src/org/jetbrains/kotlin/cli/jvm/compiler/compat.kt b/compiler/cli/cli-base/src/org/jetbrains/kotlin/cli/jvm/compiler/compat.kt
index b37be22..b6dde52 100644
--- a/compiler/cli/cli-base/src/org/jetbrains/kotlin/cli/jvm/compiler/compat.kt
+++ b/compiler/cli/cli-base/src/org/jetbrains/kotlin/cli/jvm/compiler/compat.kt
@@ -16,19 +16,19 @@
     fun doSetup() {
         checkInHeadlessMode()
 
-        System.getProperties().setProperty("project.structure.add.tools.jar.to.new.jdk", "false")
-        System.getProperties().setProperty("psi.track.invalidation", "true")
-        System.getProperties().setProperty("psi.incremental.reparse.depth.limit", "1000")
-        System.getProperties().setProperty("psi.sleep.in.validity.check", "false")
-        System.getProperties().setProperty("ide.hide.excluded.files", "false")
-        System.getProperties().setProperty("ast.loading.filter", "false")
-        System.getProperties().setProperty("idea.ignore.disabled.plugins", "true")
-        System.getProperties().setProperty("platform.random.idempotence.check.rate", "1000")
+        System.setProperty("project.structure.add.tools.jar.to.new.jdk", "false")
+        System.setProperty("psi.track.invalidation", "true")
+        System.setProperty("psi.incremental.reparse.depth.limit", "1000")
+        System.setProperty("psi.sleep.in.validity.check", "false")
+        System.setProperty("ide.hide.excluded.files", "false")
+        System.setProperty("ast.loading.filter", "false")
+        System.setProperty("idea.ignore.disabled.plugins", "true")
+        System.setProperty("platform.random.idempotence.check.rate", "1000")
         workaroundEarlyAccessRegistryQueryProblem()
         // Setting the build number explicitly avoids the command-line compiler
         // reading /tmp/build.txt in an attempt to get a build number from there.
         // See intellij platform PluginManagerCore.getBuildNumber.
-        System.getProperties().setProperty("idea.plugins.compatible.build", FALLBACK_IDEA_BUILD_NUMBER)
+        System.setProperty("idea.plugins.compatible.build", FALLBACK_IDEA_BUILD_NUMBER)
     }
 
     /**
diff --git a/repo/gradle-build-conventions/buildsrc-compat/src/main/kotlin/tasks.kt b/repo/gradle-build-conventions/buildsrc-compat/src/main/kotlin/tasks.kt
index bc3d689..1243fdc 100644
--- a/repo/gradle-build-conventions/buildsrc-compat/src/main/kotlin/tasks.kt
+++ b/repo/gradle-build-conventions/buildsrc-compat/src/main/kotlin/tasks.kt
@@ -276,7 +276,7 @@
                         )
                         .replace(
                             "{{jdk}}",
-                            """permission java.io.FilePermission "${javaLauncher.orNull?.executablePath ?: error("No java launcher")}-", "read";"""
+                            """permission java.io.FilePermission "${javaLauncher.orNull?.executablePath?.asFile?.parentFile?.parentFile?.absolutePath ?: error("No java launcher")}/-", "read";"""
                         )
                         .replace("{{inputs}}", inputPermissions.joinToString("\n    "))
                         .replace("{{additional_permissions}}", additionalPermissions.joinToString("\n    "))
diff --git a/tests-permissions.template.policy b/tests-permissions.template.policy
index 13fe4fc..a9f663e 100644
--- a/tests-permissions.template.policy
+++ b/tests-permissions.template.policy
@@ -23,11 +23,23 @@
     // org.jetbrains.kotlin.cli.common.environment.UtilKt.setIdeaIoUseFallback
     permission java.util.PropertyPermission "idea.io.use.nio2", "write";
 
+    // org.jetbrains.kotlin.cli.jvm.compiler.IdeaStandaloneExecutionSetup.doSetup()
+    permission java.util.PropertyPermission "project.structure.add.tools.jar.to.new.jdk", "write";
+    permission java.util.PropertyPermission "psi.track.invalidation", "write";
+    permission java.util.PropertyPermission "psi.incremental.reparse.depth.limit", "write";
+    permission java.util.PropertyPermission "psi.sleep.in.validity.check", "write";
+    permission java.util.PropertyPermission "ide.hide.excluded.files", "write";
+    permission java.util.PropertyPermission "ast.loading.filter", "write";
+    permission java.util.PropertyPermission "idea.ignore.disabled.plugins", "write";
+    permission java.util.PropertyPermission "platform.random.idempotence.check.rate", "write";
+    permission java.util.PropertyPermission "idea.plugins.compatible.build", "write";
+
     // Needed for copying files (strange, but deal with this later)
     permission java.lang.RuntimePermission "accessUserInformation";
 
     // org.jetbrains.kotlin.cli.jvm.plugins.PluginCliParser.createClassLoader
     permission java.lang.RuntimePermission "createClassLoader";
+    permission java.lang.RuntimePermission "closeClassLoader";
 
     // Add JUnit/testing framework permissions
     permission java.lang.reflect.ReflectPermission "suppressAccessChecks";