Merge "Only revoke ownerless grants when unprivileged." into lmp-dev