[Pkg-samba-maint] Bug#1143629: winbind: login with libpam_winbind fails if OOM-Killer killed winbind

[Christian Lamparter]

Package: winbind
Version: 2:4.22.10+dfsg-0+deb13u2
Severity: wishlist
Tags: patch
X-Debbugs-Cc: christian.lamparter at isd.uni-stuttgart.de

One of our students (hats off to him!) managed to get winbindd killed by the OOM-Killer.

---
oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=winbind.service,mems_allowed=0,global_oom,task_memcg=/system.slice/winbind.service,task=winbindd,pid=2363,uid=0
Out of memory (oom_kill_allocating_task): Killed process 2363 (winbindd) total-vm:90840kB, anon-rss:1676kB, file-rss:10700kB, shmem-rss:0kB, UID:0 pgtables:172kB oom_score_adj:0
tuned invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0
CPU: 3 UID: 0 PID: 2769 Comm: tuned Not tainted 6.12.100+deb13-cloud-amd64 #1  Debian 6.12.100-1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
---

As a result, this took down the PAM authentication we use in conjunction with the libpam_winbind,
so nobody except the administrators could log into the system anymore.

Hence I'm proposing the following patch based on the idea that setting OOMScoreAdjust in
the systemd.unit file winbind.service to a negative value:
<https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#OOMScoreAdjust=>

that should prevent the OOM-Killer from reaping the process in the future.

(I used -1000 since other important services like sshd have that value,
and based on the documentation, it "should" disable the OOM-killer,
But I'm fine with probably any negative value - not sure about nmbd or smbd
would they benefit from the same?).
---
--- a/debian/winbind.service    2026-08-05 09:23:43.789559990 +0200
+++ b/debian/winbind.service    2026-08-05 09:23:48.737014505 +0200
@@ -13,6 +13,7 @@ ExecStart=/usr/sbin/winbindd --foregroun
 ExecReload=/bin/kill -HUP $MAINPID
 LimitCORE=infinity
 ExecCondition=/usr/share/samba/is-configured winbind
+OOMScoreAdjust=-1000

 [Install]
 WantedBy=multi-user.target
---

Best Regards,
Christian Lamparter

-- Package-specific info:
* /etc/samba/smb.conf present, but not attached

-- System Information:
Debian Release: 13.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.12.100+deb13-cloud-amd64 (SMP w/64 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages winbind depends on:
ii  init-system-helpers       1.69~deb13u1
ii  libbsd0                   0.12.2-2
ii  libc6                     2.41-12+deb13u3
ii  libgnutls30t64            3.8.9-3+deb13u4
ii  libldap2                  2.6.10+dfsg-1
ii  libldb2                   2:2.11.0+samba4.22.10+dfsg-0+deb13u2
pn  libndr6                   <none>
ii  libpopt0                  1.19+dfsg-2
ii  libtalloc2                2:2.4.3+samba4.22.10+dfsg-0+deb13u2
ii  libtdb1                   2:1.4.13+samba4.22.10+dfsg-0+deb13u2
ii  libtevent0t64             2:0.16.2+samba4.22.10+dfsg-0+deb13u2
ii  libwbclient0              2:4.22.10+dfsg-0+deb13u2
ii  passwd                    1:4.17.4-2
ii  samba-common              2:4.22.10+dfsg-0+deb13u2
ii  samba-common-bin          2:4.22.10+dfsg-0+deb13u2
ii  samba-libs [libsmbldap2]  2:4.22.10+dfsg-0+deb13u2

winbind recommends no packages.

Versions of packages winbind suggests:
ii  libnss-winbind  2:4.22.10+dfsg-0+deb13u2
ii  libpam-winbind  2:4.22.10+dfsg-0+deb13u2

-- no debconf information
-------------- next part --------------
--- a/debian/winbind.service	2026-08-05 09:23:43.789559990 +0200
+++ b/debian/winbind.service	2026-08-05 09:23:48.737014505 +0200
@@ -13,6 +13,7 @@ ExecStart=/usr/sbin/winbindd --foregroun
 ExecReload=/bin/kill -HUP $MAINPID
 LimitCORE=infinity
 ExecCondition=/usr/share/samba/is-configured winbind
+OOMScoreAdjust=-1000
 
 [Install]
 WantedBy=multi-user.target