Liferay 6.2: ClassNotFoundException: javax.faces.webapp.FacesServlet when PACL is enabled - liferay

Question

I develop a portlet application which enables the security manager in liferay-plugin-package.properties:
security-manager-enabled=true
When the application starts, we get the stacktrace below in liferay 6.2 EE and 6.2.1 CE logs (Tomcat 7 bundle). It happens only once and it does not look to break anything, despite of this message the portlet works finely. If we disable the security manager in liferay-plugin-package.properties of the portlet, then this exception does not happen. This class "javax.faces.webapp.FacesServlet" is not in the .WAR of the portlet, and it is not used in the code (at least it is not used directly, may be a dependency). The portlet includes these portal dependencies, not sure if it could be related:
portal-dependency-jars=jstl-api.jar,jstl-impl.jar
Please has someone else experienced this issue? Any idea to workaround it?
20:23:06,406 ERROR [localhost-startStop-1][BasePortalLifecycle:94] java.lang.ClassNotFoundException: javax.faces.webapp.FacesServlet
java.lang.ClassNotFoundException: javax.faces.webapp.FacesServlet
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1714)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1559)
at com.liferay.portal.kernel.util.InstanceFactory.newInstance(InstanceFactory.java:52)
at com.liferay.portal.kernel.util.InstanceFactory.newInstance(InstanceFactory.java:27)
at com.liferay.portal.kernel.servlet.SecureServlet.doPortalInit(SecureServlet.java:101)
at com.liferay.portal.kernel.util.BasePortalLifecycle.portalInit(BasePortalLifecycle.java:44)
at com.liferay.portal.kernel.util.PortalLifecycleUtil.register(PortalLifecycleUtil.java:64)
at com.liferay.portal.kernel.util.PortalLifecycleUtil.register(PortalLifecycleUtil.java:56)
at com.liferay.portal.kernel.util.BasePortalLifecycle.registerPortalLifecycle(BasePortalLifecycle.java:54)
at com.liferay.portal.kernel.servlet.SecureServlet.init(SecureServlet.java:76)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:536)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:169)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123)
at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1268)
at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1193)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1088)
at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5176)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5460)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)
at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156)
at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:875)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:633)
at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1113)
at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1671)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
at java.util.concurrent.FutureTask.run(FutureTask.java:166)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:724)

Answer 1

It appears Maven had automatically generated these entries in web.xml, probably due to a wrong handling on my side: Javax faces is included in pom.xml as a test dependency only, may be we made once a scope mistake or something like that.
After removing these lines everything works perfectly. Thanks!
1 <context-param>
2 <param-name>javax.faces.PROJECT_STAGE</param-name>
3 <param-value>Development</param-value>
4 </context-param>
5 <servlet>
6 <servlet-name>Faces Servlet</servlet-name>
7 <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
8 <load-on-startup>1</load-on-startup>
9 </servlet>
10 <servlet-mapping>
11 <servlet-name>Faces Servlet</servlet-name>
12 <url-pattern>/faces/*</url-pattern>
13 </servlet-mapping>