[DO NOT MERGE] Don't drop restricted permissions on upgrade am: 0b41c8940a
am: 29adaea681

Change-Id: I1e8f24222a6c67f9e838b6e3d96fcf1280019cb2