Package: winbind Version: 2:4.22.10+dfsg-0+deb13u2 Severity: wishlist Tags: patch X-Debbugs-Cc: [email protected]
One of our students (hats off to him!) managed to get winbindd killed by the OOM-Killer. --- oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=winbind.service,mems_allowed=0,global_oom,task_memcg=/system.slice/winbind.service,task=winbindd,pid=2363,uid=0 Out of memory (oom_kill_allocating_task): Killed process 2363 (winbindd) total-vm:90840kB, anon-rss:1676kB, file-rss:10700kB, shmem-rss:0kB, UID:0 pgtables:172kB oom_score_adj:0 tuned invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0 CPU: 3 UID: 0 PID: 2769 Comm: tuned Not tainted 6.12.100+deb13-cloud-amd64 #1 Debian 6.12.100-1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 --- As a result, this took down the PAM authentication we use in conjunction with the libpam_winbind, so nobody except the administrators could log into the system anymore. Hence I'm proposing the following patch based on the idea that setting OOMScoreAdjust in the systemd.unit file winbind.service to a negative value: <https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#OOMScoreAdjust=> that should prevent the OOM-Killer from reaping the process in the future. (I used -1000 since other important services like sshd have that value, and based on the documentation, it "should" disable the OOM-killer, But I'm fine with probably any negative value - not sure about nmbd or smbd would they benefit from the same?). --- --- a/debian/winbind.service 2026-08-05 09:23:43.789559990 +0200 +++ b/debian/winbind.service 2026-08-05 09:23:48.737014505 +0200 @@ -13,6 +13,7 @@ ExecStart=/usr/sbin/winbindd --foregroun ExecReload=/bin/kill -HUP $MAINPID LimitCORE=infinity ExecCondition=/usr/share/samba/is-configured winbind +OOMScoreAdjust=-1000 [Install] WantedBy=multi-user.target --- Best Regards, Christian Lamparter -- Package-specific info: * /etc/samba/smb.conf present, but not attached -- System Information: Debian Release: 13.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.12.100+deb13-cloud-amd64 (SMP w/64 CPU threads; PREEMPT) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages winbind depends on: ii init-system-helpers 1.69~deb13u1 ii libbsd0 0.12.2-2 ii libc6 2.41-12+deb13u3 ii libgnutls30t64 3.8.9-3+deb13u4 ii libldap2 2.6.10+dfsg-1 ii libldb2 2:2.11.0+samba4.22.10+dfsg-0+deb13u2 pn libndr6 <none> ii libpopt0 1.19+dfsg-2 ii libtalloc2 2:2.4.3+samba4.22.10+dfsg-0+deb13u2 ii libtdb1 2:1.4.13+samba4.22.10+dfsg-0+deb13u2 ii libtevent0t64 2:0.16.2+samba4.22.10+dfsg-0+deb13u2 ii libwbclient0 2:4.22.10+dfsg-0+deb13u2 ii passwd 1:4.17.4-2 ii samba-common 2:4.22.10+dfsg-0+deb13u2 ii samba-common-bin 2:4.22.10+dfsg-0+deb13u2 ii samba-libs [libsmbldap2] 2:4.22.10+dfsg-0+deb13u2 winbind recommends no packages. Versions of packages winbind suggests: ii libnss-winbind 2:4.22.10+dfsg-0+deb13u2 ii libpam-winbind 2:4.22.10+dfsg-0+deb13u2 -- no debconf information
--- a/debian/winbind.service 2026-08-05 09:23:43.789559990 +0200 +++ b/debian/winbind.service 2026-08-05 09:23:48.737014505 +0200 @@ -13,6 +13,7 @@ ExecStart=/usr/sbin/winbindd --foregroun ExecReload=/bin/kill -HUP $MAINPID LimitCORE=infinity ExecCondition=/usr/share/samba/is-configured winbind +OOMScoreAdjust=-1000 [Install] WantedBy=multi-user.target
