Include crosvm and secure_env in the debian package

base/cvd/build_external/crosvm/BUILD.bazel

@@ -1,3 +1,18 @@
+load("//build_external/crosvm:transition_opt.bzl", "build_in_opt")
+
 exports_files([
     "crosvm.config.toml",
 ])
+
+# Build crosvm as if bazel was invoked with `-c opt`. Without this, observed
+# some errors that looked like
+# ```
+# fatal runtime error: IO Safety violation: owned file descriptor already closed
+# ```
+# Additionally, crosvm optimization affects VM performance more noticeably
+# than other executables involved in running Cuttlefish devices.
+build_in_opt(
+    name = "crosvm_bin_opt",
+    actual = "@crosvm_bin//:crosvm__crosvm",
+    visibility = ["//visibility:public"],
+)

base/cvd/build_external/crosvm/transition_opt.bzl

@@ -0,0 +1,41 @@
+def _file_from_label(l):
+    files = l.files.to_list()
+    if len(files) != 1:
+        fail(msg = "Unexpected number of files in target {}: {}".format(l, len(files)))
+    return files[0]
+
+def _build_in_opt_transition_impl(settings, attr):
+    return {"//command_line_option:compilation_mode": "opt"}
+
+# https://bazel.build/rules/lib/builtins/transition#transition
+build_in_opt_transition = transition(
+    implementation = _build_in_opt_transition_impl,
+    inputs = [],
+    outputs = ["//command_line_option:compilation_mode"],
+)
+
+def _build_in_opt_rule_impl(ctx):
+    input_file = _file_from_label(ctx.attr.actual)
+    output = ctx.actions.declare_file(ctx.attr.name)
+    ctx.actions.run_shell(
+        mnemonic = "CopyOutput",
+        inputs = [input_file],
+        outputs = [output],
+        command = " ".join(["cp", input_file.path, output.path])
+    )
+    return [
+        DefaultInfo(
+            executable = output,
+            files = depset([output])
+        ),
+    ]
+
+# https://bazel.build/extending/config#attaching-transitions
+build_in_opt = rule(
+    attrs = {
+        "actual": attr.label(),
+    },
+    implementation = _build_in_opt_rule_impl,
+    cfg = build_in_opt_transition,
+    executable = True,
+)

base/cvd/cuttlefish/host/libs/vm_manager/crosvm_manager.cpp

@@ -28,6 +28,7 @@
 #include <utility>
 #include <vector>
 
+#include "absl/log/log.h"
 #include "absl/strings/str_join.h"
 #include "android-base/file.h"
 #include "json/json.h"
@@ -751,13 +752,12 @@ Result<std::vector<MonitorCommand>> CrosvmManager::StartCommands(
     const bool seccomp_exists = DirectoryExists(instance.seccomp_policy_dir());
     const std::string& var_empty_dir = kCrosvmVarEmptyDir;
     const bool var_empty_available = DirectoryExists(var_empty_dir);
-    CF_EXPECT(var_empty_available && seccomp_exists,
-              var_empty_dir << " is not an existing, empty directory."
-                            << "seccomp-policy-dir, "
-                            << instance.seccomp_policy_dir()
-                            << " does not exist");
-    crosvm_cmd.Cmd().AddParameter("--seccomp-policy-dir=",
-                                  instance.seccomp_policy_dir());
+    if (seccomp_exists && var_empty_available) {
+      crosvm_cmd.Cmd().AddParameter("--seccomp-policy-dir=",
+                                    instance.seccomp_policy_dir());
+    } else {
+      VLOG(0) << "Relying on crosvm built-in sandboxing";
+    }
   } else {
     crosvm_cmd.Cmd().AddParameter("--disable-sandbox");
   }

base/cvd/cuttlefish/package/BUILD.bazel

@@ -39,6 +39,7 @@ package_files(
         "lib64/vulkan.lvp.so": "bin/libvk_lavapipe.so",
         "lib64/vulkan.pastel.so": "bin/libvk_swiftshader.so",
         "bin/prebuilts/libgfxstream_backend.so": "bin/libgfxstream_backend.so",
+        "bin/prebuilts/crosvm": "bin/crosvm",
     },
     package_file_to_src = {
         "bin/adb": "//adb:adb",
@@ -51,7 +52,9 @@ package_files(
         "bin/console_forwarder": "//cuttlefish/host/commands/console_forwarder",
         "bin/control_env_proxy_server": "//cuttlefish/host/commands/control_env_proxy_server",
         "bin/cpio": "@libarchive//cpio:cpio",
+        "bin/crosvm": "//build_external/crosvm:crosvm_bin_opt",
         "bin/cuttlefish_example_action_server": "//cuttlefish/host/example_custom_actions:cuttlefish_example_action_server",
+        "bin/cvd": "//cuttlefish/host/commands/cvd",
         "bin/cvd_import_locations": "//cuttlefish/host/commands/cvd_import_locations",
         "bin/cvd_internal_display": "//cuttlefish/host/commands/display:cvd_internal_display",
         "bin/cvd_internal_env": "//cuttlefish/host/commands/cvd_env:cvd_internal_env",
@@ -64,7 +67,6 @@ package_files(
         "bin/cvd_send_sms": "//cuttlefish/host/commands/cvd_send_sms",
         "bin/cvd_update_location": "//cuttlefish/host/commands/cvd_update_location",
         "bin/cvd_update_security_algorithm": "//cuttlefish/host/commands/cvd_update_security_algorithm",
-        "bin/cvd": "//cuttlefish/host/commands/cvd",
         "bin/cvdalloc": "//cuttlefish/host/commands/cvdalloc",
         "bin/e2fsck": "@e2fsprogs//:e2fsck",
         "bin/e2fsdroid": "@e2fsprogs//:e2fsdroid",
@@ -113,7 +115,7 @@ package_files(
         "bin/rootcanal": "@rootcanal",
         "bin/run_cvd": "//cuttlefish/host/commands/run_cvd",
         "bin/screen_recording_server": "//cuttlefish/host/commands/screen_recording_server",
-        # "bin/secure_env": "//cuttlefish/host/commands/secure_env", # TODO: schuffelen - make this more complete
+        "bin/secure_env": "//cuttlefish/host/commands/secure_env",  # TODO: schuffelen - make this more complete
         "bin/sefcontext_compile": "@selinux//:sefcontext_compile",
         "bin/sensors_simulator": "//cuttlefish/host/commands/sensors_simulator",
         "bin/simg2img": "@android_system_core//:simg2img",
@@ -158,8 +160,6 @@ package_files(
         "etc/modem_simulator/files/iccprofile_for_sim1_for_CtsCarrierApiTestCases.xml": "//cuttlefish/host/commands/modem_simulator:etc/files/iccprofile_for_sim1_for_CtsCarrierApiTestCases.xml",
         "etc/modem_simulator/files/iccprofile_for_sim1.xml": "//cuttlefish/host/commands/modem_simulator:etc/files/iccprofile_for_sim1.xml",
         "etc/modem_simulator/files/numeric_operator.xml": "//cuttlefish/host/commands/modem_simulator:etc/files/numeric_operator.xml",
-        # "bin/crosvm": "@crosvm_bin//:crosvm__crosvm", # TODO: b/402274999 - currently requires --enable_sandbox=false
-        "bin/prebuilts/crosvm": "@crosvm_bin//:crosvm__crosvm",  # TODO: b/402274999 - keep in bin and symlink to prebuilts
         "usr/share/webrtc/assets/client.html": "//cuttlefish/host/frontend/webrtc/html_client:client.html",
         "usr/share/webrtc/assets/controls.css": "//cuttlefish/host/frontend/webrtc/html_client:controls.css",
         "usr/share/webrtc/assets/custom.css": "//cuttlefish/host/frontend/webrtc/html_client:custom.css",