diff --git a/framework/src/main/java/org/apache/felix/framework/StatefulResolver.java b/framework/src/main/java/org/apache/felix/framework/StatefulResolver.java
index a398d9e..90a4ea4 100644
--- a/framework/src/main/java/org/apache/felix/framework/StatefulResolver.java
+++ b/framework/src/main/java/org/apache/felix/framework/StatefulResolver.java
@@ -60,6 +60,7 @@
 
 class StatefulResolver
 {
+    private final Logger m_logger;
     private final Felix m_felix;
     private final Resolver m_resolver;
     private final ResolverStateImpl m_resolverState;
@@ -70,8 +71,9 @@
     StatefulResolver(Felix felix)
     {
         m_felix = felix;
-        m_resolver = new ResolverImpl(m_felix.getLogger());
-        m_resolverState = new ResolverStateImpl(m_felix.getLogger(),
+        m_logger = m_felix.getLogger();
+        m_resolver = new ResolverImpl(m_logger);
+        m_resolverState = new ResolverStateImpl(
             (String) m_felix.getConfig().get(Constants.FRAMEWORK_EXECUTIONENVIRONMENT));
     }
 
@@ -141,10 +143,16 @@
                     {
                         try
                         {
-                            ResolverHook hook = m_felix.getService(m_felix, ref).begin(triggers);
-                            if (hook != null)
+                            ResolverHookFactory rhf = m_felix.getService(m_felix, ref);
+                            if (rhf != null)
                             {
-                                m_hooks.add(hook);
+                                ResolverHook hook =
+                                    Felix.m_secureAction
+                                        .invokeResolverHookFactory(rhf, triggers);
+                                if (hook != null)
+                                {
+                                    m_hooks.add(hook);
+                                }
                             }
                         }
                         catch (Throwable ex)
@@ -165,7 +173,8 @@
                     {
                         try
                         {
-                            hook.filterResolvable(m_whitelist);
+                            Felix.m_secureAction
+                                .invokeResolverHookResolvable(hook, m_whitelist);
                         }
                         catch (Throwable ex)
                         {
@@ -214,7 +223,15 @@
 // TODO: OSGi R4.3/RESOLVER HOOK - We likely need to put these hooks into a map
 //       to their svc ref since we aren't supposed to call end() on unregistered
 //       but currently we call end() on all.
-                        hook.end();
+                        try
+                        {
+                            Felix.m_secureAction.invokeResolverHookEnd(hook);
+                        }
+                        catch (Throwable th)
+                        {
+                            m_logger.log(
+                                Logger.LOG_WARNING, "Resolver hook exception.", th);
+                        }
                     }
                     // Verify that all hook service references are still valid
                     // and unget all resolver hook factories.
@@ -311,10 +328,12 @@
                 {
                     try
                     {
-                        ResolverHookFactory factory = m_felix.getService(m_felix, ref);
-                        if (factory != null)
+                        ResolverHookFactory rhf = m_felix.getService(m_felix, ref);
+                        if (rhf != null)
                         {
-                            ResolverHook hook = factory.begin(triggers);
+                            ResolverHook hook =
+                                Felix.m_secureAction
+                                    .invokeResolverHookFactory(rhf, triggers);
                             if (hook != null)
                             {
                                 m_hooks.add(hook);
@@ -339,7 +358,8 @@
                 {
                     try
                     {
-                        hook.filterResolvable(m_whitelist);
+                        Felix.m_secureAction
+                            .invokeResolverHookResolvable(hook, m_whitelist);
                     }
                     catch (Throwable ex)
                     {
@@ -393,7 +413,15 @@
 // TODO: OSGi R4.3/RESOLVER HOOK - We likely need to put these hooks into a map
 //       to their svc ref since we aren't supposed to call end() on unregistered
 //       but currently we call end() on all.
-                    hook.end();
+                    try
+                    {
+                        Felix.m_secureAction.invokeResolverHookEnd(hook);
+                    }
+                    catch (Throwable th)
+                    {
+                        m_logger.log(
+                            Logger.LOG_WARNING, "Resolver hook exception.", th);
+                    }
                 }
                 // Verify that all hook service references are still valid
                 // and unget all resolver hook factories.
@@ -493,10 +521,16 @@
                         {
                             try
                             {
-                                ResolverHook hook = m_felix.getService(m_felix, ref).begin(triggers);
-                                if (hook != null)
+                                ResolverHookFactory rhf = m_felix.getService(m_felix, ref);
+                                if (rhf != null)
                                 {
-                                    m_hooks.add(hook);
+                                    ResolverHook hook =
+                                        Felix.m_secureAction
+                                            .invokeResolverHookFactory(rhf, triggers);
+                                    if (hook != null)
+                                    {
+                                        m_hooks.add(hook);
+                                    }
                                 }
                             }
                             catch (Throwable ex)
@@ -517,7 +551,8 @@
                         {
                             try
                             {
-                                hook.filterResolvable(m_whitelist);
+                                Felix.m_secureAction
+                                    .invokeResolverHookResolvable(hook, m_whitelist);
                             }
                             catch (Throwable ex)
                             {
@@ -563,7 +598,15 @@
 // TODO: OSGi R4.3/RESOLVER HOOK - We likely need to put these hooks into a map
 //       to their svc ref since we aren't supposed to call end() on unregistered
 //       but currently we call end() on all.
-                            hook.end();
+                            try
+                            {
+                                Felix.m_secureAction.invokeResolverHookEnd(hook);
+                            }
+                            catch (Throwable th)
+                            {
+                                m_logger.log(
+                                    Logger.LOG_WARNING, "Resolver hook exception.", th);
+                            }
                         }
                         // Verify that all hook service references are still valid
                         // and unget all resolver hook factories.
@@ -1027,7 +1070,6 @@
 
     class ResolverStateImpl implements Resolver.ResolverState
     {
-        private final Logger m_logger;
         // Set of all revisions.
         private final Set<BundleRevision> m_revisions;
         // Set of all fragments.
@@ -1049,9 +1091,8 @@
 //        }
 //    }
 
-        ResolverStateImpl(Logger logger, String fwkExecEnvStr)
+        ResolverStateImpl(String fwkExecEnvStr)
         {
-            m_logger = logger;
             m_revisions = new HashSet<BundleRevision>();
             m_fragments = new HashSet<BundleRevision>();
             m_capSets = new HashMap<String, CapabilitySet>();
@@ -1281,7 +1322,15 @@
                     new ShrinkableCollection<BundleCapability>(result);
                 for (ResolverHook hook : m_hooks)
                 {
-                    hook.filterMatches(req, shrinkable);
+                    try
+                    {
+                        Felix.m_secureAction
+                            .invokeResolverHookMatches(hook, req, shrinkable);
+                    }
+                    catch (Throwable th)
+                    {
+                        m_logger.log(Logger.LOG_WARNING, "Resolver hook exception.", th);
+                    }
                 }
             }
 
diff --git a/framework/src/main/java/org/apache/felix/framework/util/SecureAction.java b/framework/src/main/java/org/apache/felix/framework/util/SecureAction.java
index 191879f..ead1ad9 100644
--- a/framework/src/main/java/org/apache/felix/framework/util/SecureAction.java
+++ b/framework/src/main/java/org/apache/felix/framework/util/SecureAction.java
@@ -33,7 +33,11 @@
 import org.osgi.framework.BundleEvent;
 import org.osgi.framework.ServiceEvent;
 import org.osgi.framework.ServiceReference;
+import org.osgi.framework.hooks.resolver.ResolverHook;
 import org.osgi.framework.hooks.service.ListenerHook;
+import org.osgi.framework.wiring.BundleCapability;
+import org.osgi.framework.wiring.BundleRequirement;
+import org.osgi.framework.wiring.BundleRevision;
 
 /**
  * <p>
@@ -1243,6 +1247,127 @@
         }
     }
 
+    public ResolverHook invokeResolverHookFactory(
+        org.osgi.framework.hooks.resolver.ResolverHookFactory rhf,
+        Collection<BundleRevision> triggers)
+        throws Exception
+    {
+        if (System.getSecurityManager() != null)
+        {
+            Actions actions = (Actions) m_actions.get();
+            actions.set(Actions.INVOKE_RESOLVER_HOOK_FACTORY, rhf, triggers);
+            try
+            {
+                return (ResolverHook) AccessController.doPrivileged(actions, m_acc);
+            }
+            catch (PrivilegedActionException e)
+            {
+                throw e.getException();
+            }
+        }
+        else
+        {
+            return rhf.begin(triggers);
+        }
+    }
+
+    public void invokeResolverHookResolvable(
+        org.osgi.framework.hooks.resolver.ResolverHook rh,
+        Collection<BundleRevision> candidates)
+        throws Exception
+    {
+        if (System.getSecurityManager() != null)
+        {
+            Actions actions = (Actions) m_actions.get();
+            actions.set(Actions.INVOKE_RESOLVER_HOOK_RESOLVABLE, rh, candidates);
+            try
+            {
+                AccessController.doPrivileged(actions, m_acc);
+            }
+            catch (PrivilegedActionException e)
+            {
+                throw e.getException();
+            }
+        }
+        else
+        {
+            rh.filterResolvable(candidates);
+        }
+    }
+
+    public void invokeResolverHookSingleton(
+        org.osgi.framework.hooks.resolver.ResolverHook rh,
+        BundleCapability singleton,
+        Collection<BundleCapability> collisions)
+        throws Exception
+    {
+        if (System.getSecurityManager() != null)
+        {
+            Actions actions = (Actions) m_actions.get();
+            actions.set(Actions.INVOKE_RESOLVER_HOOK_SINGLETON, rh, singleton, collisions);
+            try
+            {
+                AccessController.doPrivileged(actions, m_acc);
+            }
+            catch (PrivilegedActionException e)
+            {
+                throw e.getException();
+            }
+        }
+        else
+        {
+            rh.filterSingletonCollisions(singleton, collisions);
+        }
+    }
+
+    public void invokeResolverHookMatches(
+        org.osgi.framework.hooks.resolver.ResolverHook rh,
+        BundleRequirement req,
+        Collection<BundleCapability> candidates)
+        throws Exception
+    {
+        if (System.getSecurityManager() != null)
+        {
+            Actions actions = (Actions) m_actions.get();
+            actions.set(Actions.INVOKE_RESOLVER_HOOK_MATCHES, rh, req, candidates);
+            try
+            {
+                AccessController.doPrivileged(actions, m_acc);
+            }
+            catch (PrivilegedActionException e)
+            {
+                throw e.getException();
+            }
+        }
+        else
+        {
+            rh.filterMatches(req, candidates);
+        }
+    }
+
+    public void invokeResolverHookEnd(
+        org.osgi.framework.hooks.resolver.ResolverHook rh)
+        throws Exception
+    {
+        if (System.getSecurityManager() != null)
+        {
+            Actions actions = (Actions) m_actions.get();
+            actions.set(Actions.INVOKE_RESOLVER_HOOK_END, rh);
+            try
+            {
+                AccessController.doPrivileged(actions, m_acc);
+            }
+            catch (PrivilegedActionException e)
+            {
+                throw e.getException();
+            }
+        }
+        else
+        {
+            rh.end();
+        }
+    }
+
     private static class Actions implements PrivilegedExceptionAction
     {
         public static final int INITIALIZE_CONTEXT_ACTION = 0;
@@ -1293,6 +1418,11 @@
         public static final int INVOKE_SERVICE_LISTENER_HOOK_ADDED = 45;
         public static final int INVOKE_SERVICE_LISTENER_HOOK_REMOVED = 46;
         public static final int INVOKE_SERVICE_EVENT_LISTENER_HOOK = 47;
+        public static final int INVOKE_RESOLVER_HOOK_FACTORY = 48;
+        public static final int INVOKE_RESOLVER_HOOK_RESOLVABLE = 49;
+        public static final int INVOKE_RESOLVER_HOOK_SINGLETON = 50;
+        public static final int INVOKE_RESOLVER_HOOK_MATCHES = 51;
+        public static final int INVOKE_RESOLVER_HOOK_END = 52;
 
         private int m_action = -1;
         private Object m_arg1 = null;
@@ -1516,6 +1646,27 @@
                         (ServiceEvent) arg2,
                         (Map<BundleContext, Collection<ListenerHook.ListenerInfo>>) arg3);
                     return null;
+                case INVOKE_RESOLVER_HOOK_FACTORY:
+                    return ((org.osgi.framework.hooks.resolver.ResolverHookFactory) arg1).begin(
+                        (Collection<BundleRevision>) arg2);
+                case INVOKE_RESOLVER_HOOK_RESOLVABLE:
+                    ((org.osgi.framework.hooks.resolver.ResolverHook) arg1).filterResolvable(
+                        (Collection<BundleRevision>) arg2);
+                    return null;
+                case INVOKE_RESOLVER_HOOK_SINGLETON:
+                    ((org.osgi.framework.hooks.resolver.ResolverHook) arg1)
+                        .filterSingletonCollisions(
+                            (BundleCapability) arg2,
+                            (Collection<BundleCapability>) arg3);
+                    return null;
+                case INVOKE_RESOLVER_HOOK_MATCHES:
+                    ((org.osgi.framework.hooks.resolver.ResolverHook) arg1).filterMatches(
+                        (BundleRequirement) arg2,
+                        (Collection<BundleCapability>) arg3);
+                    return null;
+                case INVOKE_RESOLVER_HOOK_END:
+                    ((org.osgi.framework.hooks.resolver.ResolverHook) arg1).end();
+                    return null;
             }
 
             return null;