Merge "Fix side channel disclosure via add or remove permission api"