[DO NOT MERGE] Don't drop restricted permissions on upgrade am: 0b41c8940a
am: 29adaea681

Change-Id: If715fa7f4debfbd804f7bf28a87cd59712e5cce7