When I add "java.awt" to the set of allowed packages, ModSecMan would return without exception. So the AWT permission must be explicitely revoked. All except the one (instance!) for copy&paste support. I agree that it should be enough to allow the engine code to use that.