[DO NOT MERGE] Don't drop restricted permissions on upgrade am: 0b41c8940a am: 29adaea681
am: ebb807d6f6

Change-Id: I0063da9c85696a48b1d82e91186b2b5c29fa26aa