[DO NOT MERGE] Don't drop restricted permissions on upgrade am: 0b41c8940a
am: 09658011eb

Change-Id: Ia86eb8a2c8f8f3cbf432818f194f9c34135f5878