Merge "Do not allow untrusted apps any access to kernel configuration" into oc-dev