Backport overlay security fix am: bb1948fe1a
am: 5bfd33d39f  -s ours

Change-Id: If9ab3556158edbb0b49c34b250e47405db7faf3c