Fix WCOW COPY --from failure in multistage builds on Windows

Fixes: moby#5193

Signed-off-by: Billy Owire <[email protected]>

cache/contenthash/checksum.go

@@ -834,7 +834,7 @@ func (cc *cacheContext) scanChecksum(ctx context.Context, m *mount, p string, fo
 		return nil, err
 	}
 	if scan {
-		if err := cc.scanPath(ctx, m, p, followTrailing); err != nil {
+		if err := cc.scanPathWrapper(ctx, m, p, followTrailing); err != nil {
 			return nil, err
 		}
 	}
@@ -996,13 +996,6 @@ func (cc *cacheContext) needsScan(root *iradix.Node[*CacheRecord], path string,
 	return cr == nil && !hasParentInTree, nil
 }
 
-// Only used by TestNeedScanChecksumRegression to make sure scanPath is not
-// called for paths we have already scanned.
-var (
-	scanCounterEnable bool
-	scanCounter       atomic.Uint64
-)
-
 func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, followTrailing bool) (retErr error) {
 	p = path.Join("/", p)
 
@@ -1074,6 +1067,7 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, follow
 		}
 		return nil
 	})
+
 	if err != nil {
 		return err
 	}
@@ -1082,6 +1076,13 @@ func (cc *cacheContext) scanPath(ctx context.Context, m *mount, p string, follow
 	return nil
 }
 
+// Only used by TestNeedScanChecksumRegression to make sure scanPath is not
+// called for paths we have already scanned.
+var (
+	scanCounterEnable bool
+	scanCounter       atomic.Uint64
+)
+
 // followLinksCallback is called after we try to resolve each element. If the
 // path was not found, cr is nil.
 type followLinksCallback func(path string, cr *CacheRecord) error

cache/contenthash/checksum_unix.go

@@ -0,0 +1,8 @@
+//go:build !windows
+// +build !windows
+
+package contenthash
+
+func (cc *cacheContext) scanPathWrapper(ctx context.Context, m *mount, p string, trailing bool) error {
+	return cc.scanPath(ctx, m, p, trailing)
+}

cache/contenthash/checksum_windows.go

@@ -0,0 +1,13 @@
+package contenthash
+
+import (
+	"context"
+	"github.com/Microsoft/go-winio"
+)
+
+func (cc *cacheContext) scanPathWrapper(ctx context.Context, m *mount, p string, trailing bool) error {
+	privileges := []string{winio.SeBackupPrivilege}
+	return winio.RunWithPrivileges(privileges, func() error {
+		return cc.scanPath(ctx, m, p, trailing)
+	})
+}