With modules, we can automatically derive the list of restricted packages from the JDK module definitions, and restrict these packages by default instead of relying on the package.access and package.definition properties. This would avoid having to manually maintain these properties and make the behavior more consistent with the access controls of the module system.

The solution for this enhancement consists of 3 main parts:

1. Remove almost all of the current packages from the package.access and package.definition Security Properties. Two exceptions will remain: sun.misc and sun.reflect. These are internal packages that are currently exported by the jdk.unsupported module. They must remain on the package.access list since they contain unsafe APIs that can be used maliciously.
 
2. Loosen the definition of the SecurityManager::checkPackageAccess and checkPackageDefinition APIs to allow the list of restricted packages to be augmented by an implementation. Also, add a missing @throws NPE to the checkPackageDefinition API.
 
3. Change the implementation of the SecurityManager::checkPackageAccess and checkPackageDefinition methods to restrict the packages of all non-exported packages of JDK modules loaded by the platform class loader or its ancestors. These packages will not be listed in the package.access and package.definition properties -- instead they are automatically determined at runtime by using new JDK 9 module APIs. The non-exported packages include all packages 
that are either not exported at all by its containing module or are exported in a qualified fashion by its containing module.