added a mechanism to exclude certain packages for all the plugins.

This is primarily to mask JavaEE API classes. Mask-Classes itself is insufficient as I described in the comment

core/src/main/java/hudson/ClassicPluginStrategy.java

@@ -79,6 +79,11 @@ public class ClassicPluginStrategy implements PluginStrategy {
 
     private PluginManager pluginManager;
 
+    /**
+     * All the plugins eventually delegate this classloader to load core, servlet APIs, and SE runtime.
+     */
+    private final MaskingClassLoader coreClassLoader = new MaskingClassLoader(getClass().getClassLoader());
+
     public ClassicPluginStrategy(PluginManager pluginManager) {
         this.pluginManager = pluginManager;
     }
@@ -175,7 +180,16 @@ public class ClassicPluginStrategy implements PluginStrategy {
         for (DetachedPlugin detached : DETACHED_LIST)
             detached.fix(atts,optionalDependencies);
 
-        ClassLoader dependencyLoader = new DependencyClassLoader(getClass().getClassLoader(), archive, Util.join(dependencies,optionalDependencies));
+        // Register global classpath mask. This is useful for hiding JavaEE APIs that you might see from the container,
+        // such as database plugin for JPA support. The Mask-Classes attribute is insufficient because those classes
+        // also need to be masked by all the other plugins that depend on the database plugin.
+        String masked = atts.getValue("Global-Mask-Classes");
+        if(masked!=null) {
+            for (String pkg : masked.trim().split("[ \t\r\n]+"))
+                coreClassLoader.add(pkg);
+        }
+
+        ClassLoader dependencyLoader = new DependencyClassLoader(coreClassLoader, archive, Util.join(dependencies,optionalDependencies));
         dependencyLoader = getBaseClassLoader(atts, dependencyLoader);
 
         return new PluginWrapper(pluginManager, archive, manifest, baseResourceURL,