One of our students (hats off to him!) managed to get winbindd killed by the OOM-Killer.

As a result, this took down the PAM authentication we use in conjunction with the libpam_winbind,
so nobody except the administrators could log into the system anymore.

Hence I'm proposing the following patch based on the idea that setting OOMScoreAdjust in
the systemd.unit file winbind.service to a negative value:
<https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#OOMScoreAdjust=>

that should prevent the OOM-Killer from reaping the process in the future.

(I used -1000 since other important services like sshd have that value,
and based on the documentation, it "should" disable the OOM-killer,
But I'm fine with probably any negative value - not sure about nmbd or smbd
would they benefit from the same?).
---
--- a/debian/winbind.service    2026-08-05 09:23:43.789559990 +0200
+++ b/debian/winbind.service    2026-08-05 09:23:48.737014505 +0200
@@ -13,6 +13,7 @@ ExecStart=/usr/sbin/winbindd --foregroun
 ExecReload=/bin/kill -HUP $MAINPID
 LimitCORE=infinity
 ExecCondition=/usr/share/samba/is-configured winbind
+OOMScoreAdjust=-1000

 [Install]
 WantedBy=multi-user.target
---

Best Regards,
Christian Lamparter