diff --git a/packages/CMSettingsProvider/res/values/defaults.xml b/packages/CMSettingsProvider/res/values/defaults.xml
index 79f1b78..a503e5b 100644
--- a/packages/CMSettingsProvider/res/values/defaults.xml
+++ b/packages/CMSettingsProvider/res/values/defaults.xml
@@ -87,6 +87,10 @@
     <bool name="def_notification_pulse_custom_enable">false</bool>
     <string name="def_notification_pulse_custom_value"></string>
 
+    <!-- Default value for swapping volume keys on rotation -->
     <bool name="def_swap_volume_keys_on_rotation">false</bool>
 
+    <!-- Default values for protected component managers -->
+    <string name="def_protected_component_managers" translatable="false">com.android.settings|com.android.launcher3|com.cyanogenmod.trebuchet</string>
+
 </resources>
diff --git a/packages/CMSettingsProvider/src/org/cyanogenmod/cmsettings/CMDatabaseHelper.java b/packages/CMSettingsProvider/src/org/cyanogenmod/cmsettings/CMDatabaseHelper.java
index 713cad3..f7795d1 100644
--- a/packages/CMSettingsProvider/src/org/cyanogenmod/cmsettings/CMDatabaseHelper.java
+++ b/packages/CMSettingsProvider/src/org/cyanogenmod/cmsettings/CMDatabaseHelper.java
@@ -46,7 +46,7 @@ public class CMDatabaseHelper extends SQLiteOpenHelper{
     private static final boolean LOCAL_LOGV = false;
 
     private static final String DATABASE_NAME = "cmsettings.db";
-    private static final int DATABASE_VERSION = 2;
+    private static final int DATABASE_VERSION = 3;
 
     static class CMTableNames {
         static final String TABLE_SYSTEM = "system";
@@ -168,6 +168,22 @@ public class CMDatabaseHelper extends SQLiteOpenHelper{
             }
         }
 
+        if (upgradeVersion < 3) {
+            db.beginTransaction();
+            SQLiteStatement stmt = null;
+            try {
+                stmt = db.compileStatement("INSERT INTO secure(name,value)"
+                        + " VALUES(?,?);");
+                loadStringSetting(stmt, CMSettings.Secure.PROTECTED_COMPONENT_MANAGERS,
+                        R.string.def_protected_component_managers);
+                db.setTransactionSuccessful();
+            } finally {
+                if (stmt != null) stmt.close();
+                db.endTransaction();
+            }
+            upgradeVersion = 3;
+        }
+
         // *** Remember to update DATABASE_VERSION above!
 
         if (upgradeVersion < newVersion) {
@@ -239,6 +255,10 @@ public class CMDatabaseHelper extends SQLiteOpenHelper{
 
         loadBooleanSetting(db, CMTableNames.TABLE_SECURE,
                 CMSettings.Secure.LOCKSCREEN_VISUALIZER_ENABLED, R.bool.def_lockscreen_visualizer);
+
+        loadStringSetting(db, CMTableNames.TABLE_SECURE,
+                CMSettings.Secure.PROTECTED_COMPONENT_MANAGERS,
+                R.string.def_protected_component_managers);
     }
 
     private void loadSystemSettings(SQLiteDatabase db) {
@@ -384,4 +404,14 @@ public class CMDatabaseHelper extends SQLiteOpenHelper{
 
         db.insertWithOnConflict(tableName, null, contentValues, SQLiteDatabase.CONFLICT_IGNORE);
     }
+
+    private void loadSetting(SQLiteStatement stmt, String key, Object value) {
+        stmt.bindString(1, key);
+        stmt.bindString(2, value.toString());
+        stmt.execute();
+    }
+
+    private void loadStringSetting(SQLiteStatement stmt, String key, int resid) {
+        loadSetting(stmt, key, mContext.getResources().getString(resid));
+    }
 }
diff --git a/src/java/cyanogenmod/providers/CMSettings.java b/src/java/cyanogenmod/providers/CMSettings.java
index ad9264d..f9aabc9 100644
--- a/src/java/cyanogenmod/providers/CMSettings.java
+++ b/src/java/cyanogenmod/providers/CMSettings.java
@@ -2578,6 +2578,12 @@ public final class CMSettings {
          */
         public static final String LOCKSCREEN_INTERNALLY_ENABLED = "lockscreen_internally_enabled";
 
+        /**
+         * Delimited list of packages allowed to manage/launch protected apps (used for filtering)
+         * @hide
+         */
+        public static final String PROTECTED_COMPONENT_MANAGERS = "protected_component_managers";
+
         // endregion
 
         /**
@@ -2653,6 +2659,26 @@ public final class CMSettings {
             }
         };
 
+        /**
+         * @hide
+         */
+        public static final Validator PROTECTED_COMPONENTS_MANAGER_VALIDATOR = new Validator() {
+            private final String mDelimiter = "|";
+
+            @Override
+            public boolean validate(String value) {
+                if (!TextUtils.isEmpty(value)) {
+                    final String[] array = TextUtils.split(value, Pattern.quote(mDelimiter));
+                    for (String item : array) {
+                        if (TextUtils.isEmpty(item)) {
+                            return false; // Empty components not allowed
+                        }
+                    }
+                }
+                return true;  // Empty list is allowed though.
+            }
+        };
+
         /**
          * Mapping of validators for all secure settings.  This map is used to validate both valid
          * keys as well as validating the values for those keys.
@@ -2666,6 +2692,7 @@ public final class CMSettings {
                 new ArrayMap<String, Validator>();
         static {
             VALIDATORS.put(PROTECTED_COMPONENTS, PROTECTED_COMPONENTS_VALIDATOR);
+            VALIDATORS.put(PROTECTED_COMPONENT_MANAGERS, PROTECTED_COMPONENTS_MANAGER_VALIDATOR);
         }
 
         /**