When you list files in the nfs directory on the nfs client, you see all the files owned by nobody. NFS ID mapping is not working. System is nearly unusable when home directories on nfs without switching to permissive mode.

You can see these logs:

AVC avc:  denied  { search } for  
pid=... comm="nfsidmap" name="sss" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=dir permissive=1

AVC avc:  denied  { read } for  pid=... comm="nfsidmap" name="passwd" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=1

AVC avc:  denied  { open } for  pid=... comm="nfsidmap" path="/var/lib/sss/mc/passwd" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=1

AVC avc:  denied  { getattr } for  pid=... comm="nfsidmap" path="/var/lib/sss/mc/passwd" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=1

AVC avc:  denied  { map } for  pid=... comm="nfsidmap" path="/var/lib/sss/mc/passwd" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=1

AVC avc:  denied  { write } for  pid=... comm="nfsidmap" name="nss" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=sock_file permissive=1

AVC avc:  denied  { connectto } for  pid=... comm="nfsidmap" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=unix_stream_socket permissive=1




Reproducible: Always

Steps to Reproduce:
1. Configure nfs client.
2. List directories on nfs share.
3. Files are displayed as owned by nobody.
Actual Results:  
Files are displayed as owned by nobody.

Expected Results:  
Correct file ownership displayed.