Allow overiding FORCE_PERMISSIVE_TO_UNCONFINED

It's beneficial to be able to overide this in a device makefile
if you need to get the domains into an unconfined state to keep
the logs from filling up on kernel entries without having to add
rules into device specific policy.

Change-Id: I7778be01256ac601f247e4d6e12573d0d23d12a1

Android.mk

@@ -11,11 +11,11 @@ include $(CLEAR_VARS)
 # is frozen, we should flip this to true. This forces any currently
 # permissive domains into unconfined+enforcing.
 #
-FORCE_PERMISSIVE_TO_UNCONFINED:=false
+FORCE_PERMISSIVE_TO_UNCONFINED ?= false
 
 ifeq ($(TARGET_BUILD_VARIANT),user)
   # User builds are always forced unconfined+enforcing
-  FORCE_PERMISSIVE_TO_UNCONFINED:=true
+  FORCE_PERMISSIVE_TO_UNCONFINED := true
 endif
 
 # SELinux policy version.