stack/erp5: create a mariadb user with PROCESS privileges

Since ERP5 commit d4eda7ea (CMFActivity: show InnoDB history list
length in console watcher, 2020-09-15), the wrapper script no longer work
because accessing history list length require PROCESS privileges.

In the case of ERP5, mariadb database is dedicated for ERP5, so we can
grant the PROCESS privilege also to erp5 default user, which is used in
the wrapper script.

We don't grant the permission to test users because they don't need it.

software/erp5/test/test/test_erp5.py

@@ -30,7 +30,10 @@ from __future__ import absolute_import
 import glob
 import json
 import os
+import shutil
 import socket
+import subprocess
+import tempfile
 
 import psutil
 import requests
@@ -388,3 +391,46 @@ class TestZopeNodeParameterOverride(ERP5InstanceTestCase, TestPublishedURLIsReac
         }, {
           "cache-size": None,
         })
+
+
+class TestWatchActivities(ERP5InstanceTestCase):
+  """Tests for bin/watch_activities scripts in zope partitions.
+  """
+  __partition_reference__ = 'wa'
+
+  def test(self):
+    # "watch_activites" scripts use watch command. We'll fake a watch command
+    # that executes the actual command only once to check the output.
+    tmpdir = tempfile.mkdtemp()
+    self.addCleanup(shutil.rmtree, tmpdir)
+    with open(os.path.join(tmpdir, 'watch'), 'w') as f:
+      f.write("""#!/bin/sh
+
+      if [ "$1" != "-n" ] || [ "$2" != "5" ]
+      then
+        echo unexpected arguments: "$1" "$2"
+        exit 1
+      fi
+      shift
+      shift
+
+      exec bash -c "$@"
+      """)
+      os.fchmod(f.fileno(), 0o700)
+    try:
+      output = subprocess.check_output(
+          [
+              os.path.join(
+                  self.getComputerPartitionPath('zope-1'),
+                  'bin',
+                  'watch_activities',
+              )
+          ],
+          env=dict(os.environ,
+                   PATH=os.pathsep.join([tmpdir, os.environ['PATH']])),
+          stderr=subprocess.STDOUT,
+          universal_newlines=True,
+      )
+    except subprocess.CalledProcessError as e:
+      self.fail(e.output)
+    self.assertIn(' dict ', output)

stack/erp5/buildout.hash.cfg

@@ -26,7 +26,7 @@ md5sum = d10b8e35b02b5391cf46bf0c7dbb1196
 
 [template-mariadb]
 filename = instance-mariadb.cfg.in
-md5sum = c82ea00c4514b72fb97a6fa7ac36ec52
+md5sum = f553aa7d6596dcf98e7e61bfb6bd81c7
 
 [template-kumofs]
 filename = instance-kumofs.cfg.in
@@ -46,7 +46,7 @@ md5sum = 1de449e8c0c4a85c5ce2b447785b7654
 
 [template-mariadb-initial-setup]
 filename = mariadb_initial_setup.sql.in
-md5sum = 1102c3e37a5a2e8aa2d8a2607ab633c8
+md5sum = f928b9dc99f7f970caadfe7dd6f95d34
 
 [template-postfix]
 filename = instance-postfix.cfg.in

stack/erp5/instance-mariadb.cfg.in

 {% set part_list = [] -%}
 {% macro section(name) %}{% do part_list.append(name) %}{{ name }}{% endmacro -%}
 {% set use_ipv6 = slapparameter_dict.get('use-ipv6', False) -%}
-{% set database_list = slapparameter_dict.get('database-list', [{'name': 'erp5', 'user': 'user', 'password': 'insecure'}]) -%}
+{% set database_list = slapparameter_dict.get('database-list', [{'name': 'erp5', 'user': 'user', 'password': 'insecure', 'with-process-privilege': True}]) -%}
 {% set test_database_list = [] %}
 {% for database_count in range(slapparameter_dict.get('test-database-amount', 1)) -%}
 {%   do test_database_list.append({'name': 'erp5_test_' ~ database_count, 'user': 'testuser_' ~ database_count, 'password': 'testpassword' ~ database_count}) -%}

stack/erp5/mariadb_initial_setup.sql.in

@@ -4,16 +4,19 @@ USE mysql;
 SOURCE {{ parameter_dict['mroonga-mariadb-install-sql'] }};
 {% endif %}
 DROP FUNCTION IF EXISTS sphinx_snippets;
-#CREATE FUNCTION sphinx_snippets RETURNS STRING SONAME 'ha_sphinx.so';
 
-{% macro database(name, user, password) -%}
+{% macro database(name, user, password, with_process_privilege) -%}
 CREATE DATABASE IF NOT EXISTS `{{ name }}`;
 {% if user -%}
 GRANT ALL PRIVILEGES ON `{{ name }}`.* TO `{{ user }}`@`%` IDENTIFIED BY '{{ password }}';
 GRANT ALL PRIVILEGES ON `{{ name }}`.* TO `{{ user }}`@localhost IDENTIFIED BY '{{ password }}';
+{%   if with_process_privilege %}
+GRANT PROCESS ON *.* TO `{{ user }}`@`%` IDENTIFIED BY '{{ password }}';
+GRANT PROCESS ON *.* TO `{{ user }}`@localhost IDENTIFIED BY '{{ password }}';
+{%-   endif %}
 {%- endif %}
 {% endmacro -%}
 
 {% for entry in parameter_dict['database-list'] -%}
-{{   database(entry['name'], entry.get('user'), entry.get('password')) }}
+{{   database(entry['name'], entry.get('user'), entry.get('password'), entry.get('with-process-privilege')) }}
 {% endfor -%}