[DO NOT MERGE] Don't drop restricted permissions on upgrade am: 0b41c8940a am: 29adaea681
am: 6145571f9e

Change-Id: I2369838898911d91db767cad65c9b527169672b3