Browsing through logs, I'm seeing that DUTs in the Autotest Lab
accumulate a lot of crash dumps with the name "selinux_violation"
embedded in them.  To see it, I'm running commands like this:

$ dut-status -f -b elm -p bvt -d 8 | grep provision | sed 's=.*\(results/.*\)=gsutil cat gs://chromeos-autotest-\1*/status.log=' | sh | grep crashdump

That produces lots of lines like this:
INFO	----	----	timestamp=1528206633	localtime=Jun 05 06:50:33	Host crashdump exists: /var/spool/crash/selinux_violation.20180605.064858.0.log

I've seen the problem for various boards, including nyan_big,
kevin, elm, and caroline.  However, checking peach_pit, I found
no instances.  I kind of suspect the problem is ARC++ related, but
I don't know enough to say definitively.

I haven't checked how far back in time the problem goes, but there
was at least one mention of it early last week when I was deputy.