diff --git a/framework/src/main/java/org/apache/felix/framework/BundleProtectionDomain.java b/framework/src/main/java/org/apache/felix/framework/BundleProtectionDomain.java
index 9cf0b1f..11ceb6a 100644
--- a/framework/src/main/java/org/apache/felix/framework/BundleProtectionDomain.java
+++ b/framework/src/main/java/org/apache/felix/framework/BundleProtectionDomain.java
@@ -18,17 +18,24 @@
  */
 package org.apache.felix.framework;
 
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.security.CodeSource;
 import java.security.Permission;
 import java.security.ProtectionDomain;
+import java.security.cert.Certificate;
 
 public class BundleProtectionDomain extends ProtectionDomain
 {
     private final Felix m_felix;
     private final FelixBundle m_bundle;
 
-    public BundleProtectionDomain(Felix felix, FelixBundle bundle)
+    public BundleProtectionDomain(Felix felix, FelixBundle bundle) 
+        throws MalformedURLException
     {
-        super(null, null);
+        super(new CodeSource(new URL(new URL(null, "location:", 
+            new FakeURLStreamHandler()), felix.getBundleLocation(bundle), 
+            new FakeURLStreamHandler()), (Certificate[]) null), null);
         m_felix = felix;
         m_bundle = bundle;
     }
@@ -61,7 +68,7 @@
         }
         return m_bundle == ((BundleProtectionDomain) other).m_bundle;
     }
-    
+
     public String toString()
     {
         return "[" + m_bundle + "]";
diff --git a/framework/src/main/java/org/apache/felix/framework/Felix.java b/framework/src/main/java/org/apache/felix/framework/Felix.java
index 7793b36..a9bdd5d 100644
--- a/framework/src/main/java/org/apache/felix/framework/Felix.java
+++ b/framework/src/main/java/org/apache/felix/framework/Felix.java
@@ -3402,6 +3402,10 @@
         {
             return m_securityProvider.hasBundlePermission(bundleProtectionDomain, permission, direct);
         }
+        else if ((bundleProtectionDomain.getBundle() != this) && (System.getSecurityManager() != null))
+        {
+            return m_secureAction.getPolicy().implies(bundleProtectionDomain, permission);
+        }
         return true;
     }