[20.10 backport] [Windows]] cmd/dockerd: create panic.log file without readonly flag

[thaJeztah]

backport of #42984

fixes / addresses:

• Crash while switching from Linux to Windows containers docker/for-win#11899
• Docker Desktop on Windows crashes when Switching from Linux to Windows platforms (timeout) docker/for-win#11901
• Docker Engine failed to start after upgraded Docker Desktop to 3.6.0 docker/for-win#11912
• System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed. docker/for-win#11915
• Docker freezes when trying to switch to Windows Containers docker/for-win#11925
• Error While Switching to windows docker/for-win#11933
• Timeout crash at startup docker/for-win#11934
• Cant switch to Windows containers in Windows 10 docker/for-win#11935
• Not able to switch over to Windows Containers docker/for-win#11943
• Docker unable to switch from linux to windows container docker/for-win#11945
• Docker desktop 3.6.0 crashes switching to windows containers docker/for-win#11954
• Docker Desktop crashes when using Windows Containers docker/for-win#11968
• Docker Desktop crashes when switching to Windows images docker/for-win#11976
• Crash when switching to Windows containers docker/for-win#11977
• Crash when switching to Windows containers docker/for-win#11978
• switching to windows containers crashes docker desktop docker/for-win#11981
• Docker crashing after Windows update docker/for-win#11987
• failed to start docker/for-win#12001
• Docker crashes when switching to Windows containers docker/for-win#12003
• Crash when I switch to Windows Containers docker/for-win#12008
• Docker Error from switching Linux to windows  docker/for-win#12016
• Panic.log is read only after rebooting the VM (Windows Server 2022) docker/for-win#12358

- What I did
Create panic.log on Windows without the Read-only attribute

- How I did it
Set the bit 0o200 (owner write permission):
os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o200)

- How to verify it
ReadOnly should not be set:

PS > (Get-Item C:\ProgramData\docker\panic.log).Attributes
Archive, NotContentIndexed

- Description for the changelog

After docker EE bump to version 20.10.8, docker service doesn't start properly after reboot with error:
fatal: open C:\ProgramData\docker\panic.log: Access is denied.

Docker 20.10.7 and Go version go1.13.15:

PS > docker version
Server: Mirantis Container Runtime
 Engine:
  Version:          20.10.7
  API version:      1.41 (minimum version 1.24)
  Go version:       go1.13.15
  Git commit:       e1bf5b9c13
  Built:            08/19/2021 18:53:20
  OS/Arch:          windows/amd64
  Experimental:     false

Docker 20.10.8 and Go version go1.16.7m5:

PS > docker version
Server: Mirantis Container Runtime
 Engine:
  Version:          20.10.8
  API version:      1.41 (minimum version 1.24)
  Go version:       go1.16.7m5
  Git commit:       785245d4b8
  Built:            10/28/2021 16:06:43
  OS/Arch:          windows/amd64
  Experimental:     false

After version of Go runtime bumped above 1.13 the behavior of OpenFile API is changed (https://golang.org/doc/go1.14#windows):

Windows
Go binaries on Windows now have DEP (Data Execution Prevention) enabled.

On Windows, creating a file via os.OpenFile with the os.O_CREATE flag, or via syscall.Open with the syscall.O_CREAT flag, will now create the file as read-only if the bit 0o200 (owner write permission) is not set in the permission argument. This makes the behavior on Windows more like that on Unix systems.

For example:

package main

import (
	"log"
	"os"
)

func main() {
	f, err := os.OpenFile("panic.log", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0)
	if err != nil {
		log.Fatal(err)
	}
	if err := f.Close(); err != nil {
		log.Fatal(err)
	}
}

Go 1.13.15:

PS > C:\go1.13.15.windows-amd64\go\bin\go.exe run .\create_file.go
PS > (Get-Item .\panic.log).Attributes
Archive, NotContentIndexed


Desired Access:	Append Data/Add Subdirectory/Create Pipe Instance, Read Attributes, Synchronize
Disposition:	OpenIf
Options:	Synchronous IO Non-Alert, Non-Directory File
Attributes:	N
ShareMode:	Read, Write
AllocationSize:	0
OpenResult:	Created

Go 1.16.7:

PS > C:\go1.16.7.windows-amd64\go\bin\go.exe run .\create_file.go
PS > (Get-Item .\panic.log).Attributes
ReadOnly, Archive, NotContentIndexed

Desired Access:	Append Data/Add Subdirectory/Create Pipe Instance, Read Attributes, Synchronize
Disposition:	OpenIf
Options:	Synchronous IO Non-Alert, Non-Directory File
Attributes:	R
ShareMode:	Read, Write
AllocationSize:	0
OpenResult:	Created

- A picture of a cute animal (not mandatory but encouraged)

[tianon]

Unable to delete '/home/ubuntu/workspace/moby_PR-42987'. Tried 3 times (of a maximum of 3) waiting 0.1 sec between attempts. (Discarded 9 additional exceptions)

[thaJeztah]

Unable to delete '/home/ubuntu/workspace/moby_PR-42987'. Tried 3 times (of a maximum of 3) waiting 0.1 sec between attempts. (Discarded 9 additional exceptions)

For those reading along; that one is tracked through #42974, and I was trying to debug in #42995

[soroshsabz]

fixes docker/for-win#12066
fixes docker/for-win#12270
fixes docker/for-win#12158