Allow device to be unprovisioned

bug: 12247651
Change-Id: Ie2e77566d2c65925091296da5bcbec327985c946
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index d7aea39..0074635 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -2811,7 +2811,13 @@
          @hide This is not a third-party API (intended for system apps). -->
     <permission android:name="android.permission.READ_INSTALL_SESSIONS"
         android:label="@string/permlab_readInstallSessions"
-        android:description="@string/permdesc_readInstallSessions"
+        android:description="@string/permdesc_readInstallSessions" />
+
+    <!-- @SystemApi Allows an application to remove DRM certificates
+         @hide This is not a third-party API (intended for system apps). -->
+    <permission android:name="android.permission.REMOVE_DRM_CERTIFICATES"
+        android:label="@string/permlab_removeDrmCertificates"
+        android:description="@string/permdesc_removeDrmCertificates"
         android:protectionLevel="signature|system" />
 
     <!-- The system process is explicitly the only one allowed to launch the