The javafx.* modules are now loaded by the application class loader and no longer have permissions by default. In order for applications to run with a security manager, it is necessary to grant AllPermission to the javafx.* modules.

This is a natural consequence of the fact that the javafx.* modules are no longer part of the JDK.

Specifically, the following will fail:

java -Djava.security.manager --module-path javafx-sdk-11/lib --add-modules javafx.graphics hello.HelloRectangle

Exception in thread "main" java.lang.ExceptionInInitializerError
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at java.base/sun.launcher.LauncherHelper$FXHelper.main(LauncherHelper.java:1051)
Caused by: java.security.AccessControlException: access denied ("java.util.PropertyPermission" "javafx.verbose" "read")
at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
at java.base/java.security.AccessController.checkPermission(AccessController.java:895)
at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:322)
at java.base/java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1066)
at java.base/java.lang.System.getProperty(System.java:810)
at java.base/java.lang.Boolean.getBoolean(Boolean.java:265)
at javafx.graphics/com.sun.javafx.application.LauncherImpl.lambda$static$0(LauncherImpl.java:122)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at javafx.graphics/com.sun.javafx.application.LauncherImpl.<clinit>(LauncherImpl.java:121)
... 5 more

This used to work in Oracle's JDK 10, which included javafx modules in the JDK runtime image.