Merge "Make redacted access checks consistent for file open via FUSE and API" into tm-mainline-prod