Until now, SecureAction was synchronizing the framework for certain operations in order to reduce the amount of objects it created. Furthermore, the synchronization was carried out whether security was enabled or not. We now use a threadlocal to avoid synchronization all together at the expense of only a few more objects.
incubator/felix/trunk/framework/src/main/java/org/apache/felix/framework/util/SecureAction.java