diff --git a/core/res/Android.bp b/core/res/Android.bp
index 3dc74f827be4b..b365de4f4630d 100644
--- a/core/res/Android.bp
+++ b/core/res/Android.bp
@@ -54,3 +54,22 @@ filegroup {
         "res/**/*",
     ],
 }
+
+// Generate a text file containing a list of permissions that non-system apps
+// are allowed to obtain.
+genrule {
+  name: "permission-list-normal",
+  out: ["permission-list-normal.txt"],
+  srcs: ["AndroidManifest.xml"],
+  cmd: "cat $(in) " +
+       // xmllint has trouble accessing attributes under the android namespace.
+       // Strip these prefixes prior to processing with xmllint.
+       " | sed -r 's/android:(name|protectionLevel)/\\1/g' " +
+       " | $(location xmllint) /dev/stdin --xpath " +
+       " '//permission[not(contains(@protectionLevel, \"signature\"))]/@name'" +
+       // The result of xmllint is name="value" pairs. Format these to just the
+       // permission name, one per-line.
+       " | sed -r 's/\\s*name=\\s*//g' | tr -d '\"'" +
+       " > $(out)",
+  tools: ["xmllint"]
+}