There are several classes in com.sun.security.auth with @jdk.Exported(false) need to be re-examined:

com.sun.security.auth.PolicyFile
com.sun.security.auth.SolarisNumericGroupPrincipal
com.sun.security.auth.SolarisNumericUserPrincipal
com.sun.security.auth.SolarisPrincipal
com.sun.security.auth.X500Principal
com.sun.security.auth.module.SolarisLoginModule
com.sun.security.auth.module.SolarisSystem

The granularity of exports with the module system is at the level of packages. If a package is exported then all public types in that package are accessible.

We should decide if the above classes are supported or not. If not supported then they should be removed, at least changed to be non-public.