[DO NOT MERGE] Don't drop restricted permissions on upgrade am: 0b41c8940a
am: 29adaea681

Change-Id: Ibc476348e75b18b3deddb746d33e676d257c7d6c