Rebuild all content node access permissions in an update hook

mymodule.install

/**
 * Rebuild node access permissions.
 * node_access_rebuild(TRUE) claims to be able to do this in batch mode but all it does is set a
 * batch. There is no way to process the batch from within an update hook. You could do it using
 * a separate drush command but if you only have access to run updb on your production env
 * then you need to do all the processing from within the update hook. This gem allows complete
 * safe permission rebuild, batched, from within a single update hook.
 */
function mymodule_update_7001(&$sandbox) {
  _node_access_rebuild_batch_operation($sandbox);

  $sandbox['#finished'] = $sandbox['sandbox']['progress'] >= $sandbox['sandbox']['max'];

  if ($sandbox['#finished']) {
    node_access_needs_rebuild(FALSE);
  }
}

This is a helpful example. I modified it a bit and used it in https://www.drupal.org/project/hook_update_deploy_tools#rebuild-node-access
When called in a hook_updated_N it runs the batch and reports on the progress as it goes.