Backport overlay security fix
am: bb1948fe1a

Change-Id: I6d46dffe0fe60cc2db3864bf22728e7d03b330df