diff -ruN linux-2.4.26.trustee/Documentation/Configure.help linux-2.4.26/Documentation/Configure.help
--- linux-2.4.26.trustee/Documentation/Configure.help	2004-04-15 13:52:41.000000000 +0200
+++ linux-2.4.26/Documentation/Configure.help	2004-04-15 14:07:46.000000000 +0200
@@ -13749,6 +13749,22 @@
   need this functionality say Y here. Note that you will need latest
   quota utilities for new quota format with this kernel.
 
+VFS /deleted support
+CONFIG_DELETED
+  Move deleted files to /deleted directory on each mounted filesystem
+  instead of unlinking. Deleted files are grouped by N hours to separate
+  directories.
+  
+  If you want use this feature for getting ability to undelete files
+  you need answer Y here and create directory 'deleted' accessible only
+  for user 'root' on root directory of every mounted filesystem which you
+  want to have undelete ability.
+  
+  You also need user space utility for undeleting files and user space
+  daemon which periodically checks free space on mounted filesystems and
+  if needed remove older files from 'deleted' directory. Those utilities
+  can be found at <http://project.terminus.sk/dare/>.
+
 Memory Technology Device (MTD) support
 CONFIG_MTD
   Memory Technology Devices are flash, RAM and similar chips, often
diff -ruN linux-2.4.26.trustee/fs/Config.in linux-2.4.26/fs/Config.in
--- linux-2.4.26.trustee/fs/Config.in	2004-04-15 13:52:40.000000000 +0200
+++ linux-2.4.26/fs/Config.in	2004-04-15 14:07:46.000000000 +0200
@@ -7,6 +7,13 @@
 bool 'Quota support' CONFIG_QUOTA
 dep_tristate '  VFS v0 quota format support' CONFIG_QFMT_V2 $CONFIG_QUOTA
 
+if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
+	bool 'VFS /deleted support' CONFIG_DELETED
+	if [ "$CONFIG_DELETED" = "y" ] ; then
+	   int 'Gruping deleted files by N hours' CONFIG_DELETED_HOURS 1
+	fi
+fi
+
 tristate 'Kernel automounter support' CONFIG_AUTOFS_FS
 tristate 'Kernel automounter version 4 support (also supports v3)' CONFIG_AUTOFS4_FS
 bool ' Linux trustees (ACL) support ' CONFIG_TRUSTEES  
diff -ruN linux-2.4.26.trustee/fs/Makefile linux-2.4.26/fs/Makefile
--- linux-2.4.26.trustee/fs/Makefile	2004-04-15 13:59:00.000000000 +0200
+++ linux-2.4.26/fs/Makefile	2004-04-15 14:07:46.000000000 +0200
@@ -14,6 +14,7 @@
 		super.o block_dev.o char_dev.o stat.o exec.o pipe.o namei.o \
 		fcntl.o ioctl.o readdir.o select.o fifo.o locks.o \
 		dcache.o inode.o attr.o bad_inode.o file.o iobuf.o dnotify.o \
+		evocate_mnt.o deleted.o \
 		filesystems.o namespace.o seq_file.o xattr.o quota.o
 
 obj-$(CONFIG_QUOTA)		+= dquot.o quota_v1.o
diff -ruN linux-2.4.26.trustee/fs/deleted.c linux-2.4.26/fs/deleted.c
--- linux-2.4.26.trustee/fs/deleted.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.4.26/fs/deleted.c	2004-04-15 14:07:46.000000000 +0200
@@ -0,0 +1,320 @@
+
+#define DELETED_DIR	"deleted"
+// #define	CONFIG_DELETED_HOURS	1
+
+#include <linux/config.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/fs.h>
+#include <linux/quotaops.h>
+#include <linux/string.h>
+#include <linux/mm.h>
+#include <linux/utime.h>
+#include <linux/file.h>
+#include <linux/smp_lock.h>
+#include <linux/dnotify.h>
+#include <asm/uaccess.h>
+
+static DECLARE_MUTEX(deleted_mutex);
+
+struct vfsmount * vfs_evocate_mnt(struct dentry *dentry);
+
+static int is_offspring( struct dentry * dir, struct dentry * offspring )
+{
+	/* FIXME: do locking */
+	/* maybe add some depth limitation eg. /deleted/xxx/yyy */
+	while( offspring->d_parent!=NULL && offspring->d_parent!=offspring )
+	{
+		if( offspring->d_parent==dir )
+			return(1);
+		offspring=offspring->d_parent;
+	}
+	return(0);
+}
+
+struct proc_priv {
+	uid_t fsuid;
+	gid_t fsgid;
+	kernel_cap_t cap_effective;
+};
+
+static void save_proc_priv( struct proc_priv *p )
+{
+	p->fsuid=current->fsuid;
+	p->fsgid=current->fsgid;
+	cap_t(p->cap_effective) = cap_t(current->cap_effective);
+}
+
+static void restore_proc_priv( struct proc_priv *p )
+{
+	current->fsuid=p->fsuid;
+	current->fsgid=p->fsgid;
+	cap_t(current->cap_effective) = cap_t(p->cap_effective);
+}
+
+static void set_proc_priv( void )
+{
+	current->fsuid=0;
+	current->fsgid=0;
+	cap_t(current->cap_effective) = to_cap_t(CAP_FS_MASK);
+}
+
+static int write_to_file( struct file *file, char *buf, int len )
+{ int r;
+  mm_segment_t fs;
+
+	if( buf==NULL )
+		return(0);
+	if( locks_verify_area(FLOCK_VERIFY_WRITE,file->f_dentry->d_inode,file,file->f_pos,len)!=0 )
+		return(-1);
+	fs = get_fs(); set_fs(KERNEL_DS);
+	r=file->f_op->write(file,buf,len,&file->f_pos);
+	set_fs(fs);
+	if( r>0 )
+		dnotify_parent(file->f_dentry, DN_MODIFY);
+	return(r);
+}
+
+static int write_path_to_file( struct file *file, struct dentry *dentry, struct vfsmount *mnt )
+{ char *fn;
+  char *page = (char *) __get_free_page(GFP_USER);
+  struct dentry *root;
+
+	if( page!=NULL )
+	{
+		root = dget(dentry->d_sb->s_root);
+		spin_lock(&dcache_lock);
+		fn=__d_path(dentry,mnt,root,mnt,page,PAGE_SIZE);
+		spin_unlock(&dcache_lock);
+		if( fn!=NULL )
+			write_to_file(file,fn,strlen(fn));
+		dput(root);
+		free_page((unsigned long) page);
+		return(0);
+	}
+	return(0);
+}
+
+int deleted_move( struct inode *dir, struct dentry * dentry )
+{
+	struct dentry *deldir;
+	struct proc_priv proc_priv;
+	struct timeval now;
+	int num;
+	char buf[64];
+	struct dentry *d,*f;
+	struct iattr newattrs;
+	struct file *file;
+	struct vfsmount *mnt;
+	unsigned long ino;
+	int ret = -1;
+
+	/* We move only a valid dentry */
+
+	if( !dentry->d_inode )
+		return(ret);
+
+
+	/* Save current process privileges and set root privileges */
+
+	save_proc_priv(&proc_priv);
+	set_proc_priv();
+
+
+	/* search for /deleted directory */
+
+	deldir=lookup_one_len(DELETED_DIR,dentry->d_sb->s_root,strlen(DELETED_DIR));
+	if( IS_ERR(deldir) )
+	{
+		printk("deleted_move: Error 1 (%d) [patent inode %ld]\n",(int)(deldir),dentry->d_sb->s_root->d_inode->i_ino);
+		goto Out0;
+	}
+	if( !deldir->d_inode )
+	{	
+		/* /deleted does not exist */
+		goto Out;
+	}
+	if( !S_ISDIR(deldir->d_inode->i_mode) )
+	{
+		/* /deleted is not a directory! */
+/*		printk("deleted_move: /deleted is not a directory!\n");	*/
+		goto Out;
+	}
+	if( is_offspring(deldir,dentry) )
+	{	
+		/* Deleting inside /deleted */
+		/* printk("deleted_move: Deleting inside /deleted\n"); */
+		goto Out;
+	}
+
+
+	/* search for /deleted/<time> directory */
+	
+	do_gettimeofday(&now);
+	num=now.tv_sec / (3600*CONFIG_DELETED_HOURS);
+	num*= (3600*CONFIG_DELETED_HOURS);
+	sprintf(buf,"%d",num);
+	d=lookup_one_len(buf,deldir,strlen(buf));
+	if( IS_ERR(d) )
+	{
+		printk("deleted_move: Error during lookuping /deleted/<time>\n");
+		goto Out;
+	}
+	if( !d->d_inode )
+	{	vfs_mkdir(deldir->d_inode,d,0700);
+	}
+	if( !S_ISDIR(deldir->d_inode->i_mode) )
+	{
+		printk("deleted_move: /deleted/<time> is not a directory\n");
+		goto Out2;
+	}
+
+
+	/* search for /deleted/<time>.inf file */
+
+	sprintf(buf,"%d.inf",num);
+	down(&deleted_mutex);
+
+	down(&deldir->d_inode->i_sem);
+	f=lookup_one_len(buf,deldir,strlen(buf));
+	if( IS_ERR(f) )
+	{
+		printk("deleted_move: Error during lookuping /deleted/<time>.inf\n");
+		up(&deldir->d_inode->i_sem);
+Out2u:		
+		up(&deleted_mutex);
+		goto Out2;
+	}
+	if( !f->d_inode )
+	{
+		if( vfs_create(deldir->d_inode,f,0600) )
+		{	dput(f);
+			printk("deleted_move: Cannot create /deleted/<time>.inf file\n");
+			up(&deldir->d_inode->i_sem);
+			goto Out2u;
+		}
+	}
+	if( !S_ISREG(f->d_inode->i_mode) )
+	{
+		dput(f);
+		printk("deleted_move: /deleted/<time>.inf is not a regular file\n");
+		up(&deldir->d_inode->i_sem);
+		goto Out2u;
+	}
+	up(&deldir->d_inode->i_sem);
+
+	if( get_lease(f->d_inode,(O_WRONLY|O_APPEND)+1) )
+	{
+		dput(f);
+		printk("deleted_move: Error during get_lease()\n");
+		goto Out2u;
+	}
+	DQUOT_INIT(f->d_inode);
+
+	mnt=vfs_evocate_mnt(f);
+	mntget(mnt);
+	file = dentry_open(f,mnt,O_WRONLY|O_APPEND);
+	if( IS_ERR(file) )
+	{	mntput(mnt);
+		mntput(mnt);
+		dput(f);
+		printk("deleted_move: Error opening .inf file\n");
+		goto Out2u;
+	}
+	if( file->f_op->llseek!=NULL )
+	{
+		lock_kernel();
+		file->f_op->llseek(file,0,2);
+		unlock_kernel();
+	}
+
+	/* if not regular file or symlink with nlink==1 ->ino=0 ->do not move */
+	
+	if( !(S_ISREG(dentry->d_inode->i_mode) || S_ISLNK(dentry->d_inode->i_mode)) || dentry->d_inode->i_nlink!=1 )
+		ino=0;
+	else
+		ino=dentry->d_inode->i_ino;
+
+	if( file->f_op->write!=NULL )
+	{
+#ifdef CONFIG_MEDUSA
+		sprintf(buf,"%lu:%lu:%d:%d:%06o:%d,%d,%d:",ino,(unsigned long)(now.tv_sec),dentry->d_inode->i_uid,dentry->d_inode->i_gid,dentry->d_inode->i_mode,proc_priv.fsuid,current->uid,current->med.luid);
+#else
+		sprintf(buf,"%lu:%lu:%d:%d:%06o:%d,%d:",ino,(unsigned long)(now.tv_sec),dentry->d_inode->i_uid,dentry->d_inode->i_gid,dentry->d_inode->i_mode,proc_priv.fsuid,current->uid);
+#endif
+		write_to_file(file,buf,strlen(buf));
+		write_path_to_file(file,dentry,mnt);
+		buf[0]='\n';
+		write_to_file(file,buf,1);
+	}
+	else	printk("deleted_move: can't write to .inf file\n");
+	filp_close(file,NULL);
+	mntput(mnt);
+	up(&deleted_mutex);
+
+
+	/* if ino==0 -> do not move */
+	
+	if( ino==0 )
+		goto Out2;
+
+
+	/* move deleted file to /deleted/<time>/ */
+
+	sprintf(buf,"%lu",ino);
+	f=lookup_one_len(buf,d,strlen(buf));
+	if( IS_ERR(f) )
+	{
+		printk("deleted_move: Error during lookuping /deleted/<time>/<ino>\n");
+		goto Out2;
+	}
+	if( !f->d_inode )
+	{	lock_kernel();
+		if( vfs_rename(dir,dentry,d->d_inode,f)!=0 )
+		{
+			unlock_kernel();
+			printk("deleted_move: Cannot move file to /deleted/<time>/<ino>\n");
+			goto Out3;
+		}
+		unlock_kernel();
+		ret=0;
+	}
+	else	ret= -1;
+	dput(f);
+
+	/* And now we set uid, gig, and mode becaude quota, etc... */
+
+	f=lookup_one_len(buf,d,strlen(buf));
+	if( IS_ERR(f) )
+	{
+		printk("deleted_move: Error2 during lookuping /deleted/<time>/<ino>\n");
+		goto Out2;
+	}
+	if( !f->d_inode )
+	{
+		printk("deleted_move: Somebody delete our file!\n");
+		goto Out3;
+	}
+
+	if( f->d_inode->i_nlink==1 )
+	{
+		newattrs.ia_mode = (0600 & S_IALLUGO) | (f->d_inode->i_mode & ~S_IALLUGO);
+		newattrs.ia_uid = 0;
+		newattrs.ia_gid = 0;
+		newattrs.ia_valid = ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_CTIME ;
+		notify_change(f, &newattrs);
+	}
+Out3:
+	dput(f);
+Out2:
+	dput(d);
+Out:
+	dput(deldir);
+Out0:
+	/* restore current process privileges */
+
+	restore_proc_priv(&proc_priv);
+
+	return(ret);
+}
+
diff -ruN linux-2.4.26.trustee/fs/evocate_mnt.c linux-2.4.26/fs/evocate_mnt.c
--- linux-2.4.26.trustee/fs/evocate_mnt.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.4.26/fs/evocate_mnt.c	2004-04-15 14:07:46.000000000 +0200
@@ -0,0 +1,91 @@
+/* (C) 2002 Milan Pikula for Medusa DS9 Security System */
+
+#include <linux/fs.h>
+#include <linux/dcache.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+
+/**
+ * vfs_evocate_mnt - original: medusa_evocate_mnt - find the uppermost struct vfsmount for given dentry/inode.
+ * @dentry: dentry to perform lookup on.
+ *
+ * This is a helper routine for file_kobj_validate_dentry. It does the black
+ * magic to get the needed information, and owes for its existence to
+ * the dirty design of VFS, where some parts of information are just missing.
+ * From all possible vfsmounts, we must return the uppermost one to get
+ * it right; and we try to avoid recursion 'cause we value the stack.
+ */
+
+struct vfsmount * vfs_evocate_mnt(struct dentry *dentry)
+{
+	int depth, last_depth, maxdepth, can_nest;
+	struct vfsmount * p;
+	int count = 0;
+
+	/* get the local root */
+	spin_lock(&dcache_lock);
+	while (!IS_ROOT(dentry))
+		dentry = dentry->d_parent;
+	dget(dentry);
+	spin_unlock(&dcache_lock);
+
+	maxdepth = 0;
+	do {
+		can_nest = 0;
+		last_depth = -1; depth = 0;
+
+		/* hope that init isn't chrooted; get "global" root */
+		read_lock(&init_task.fs->lock);
+		p = init_task.fs->rootmnt;
+		while (p->mnt_parent != p->mnt_parent->mnt_parent)
+			p = p->mnt_parent;
+		mntget(p);
+		read_unlock(&init_task.fs->lock);
+
+		spin_lock(&dcache_lock);
+		do {
+			count++;
+			if (depth == maxdepth) {
+				if (p->mnt_root == dentry) {
+					spin_unlock(&dcache_lock);
+					dput(dentry);
+					return p;
+				}
+				can_nest = can_nest || !list_empty(&(p->mnt_mounts));
+			}
+			if ((depth < maxdepth) && (last_depth <= depth) && !list_empty(&(p->mnt_mounts))) {
+
+				mntput(p);
+				p = mntget(list_entry((p->mnt_mounts.next), struct vfsmount, mnt_child));
+				last_depth = depth++;
+				continue;
+
+			}
+			if (!list_empty(&(p->mnt_child)) && list_entry((p->mnt_child.next), struct vfsmount, mnt_mounts) != p->mnt_parent) {
+
+				mntput(p);
+				p = mntget(list_entry((p->mnt_child.next), struct vfsmount, mnt_child));
+				last_depth = depth;
+				continue;
+
+			}
+
+			mntput(p);
+			p = mntget(p->mnt_parent);
+			last_depth = depth--;
+
+		} while (depth >= 0);
+		spin_unlock(&dcache_lock);
+		mntput(p);
+		maxdepth++;
+	} while (can_nest);
+
+	dput(dentry);
+
+	/* Don't panic. It is a fatal error, but it occurs without harm.
+	   We rather do not report it. ;-) 
+		printk("Fatal error: too drunk to evocate mnt. Returning init's mnt instead.\n");
+	*/
+	return mntget(init_task.fs->rootmnt);
+}
+
diff -ruN linux-2.4.26.trustee/fs/namei.c linux-2.4.26/fs/namei.c
--- linux-2.4.26.trustee/fs/namei.c	2004-04-15 14:06:44.000000000 +0200
+++ linux-2.4.26/fs/namei.c	2004-04-15 14:10:26.000000000 +0200
@@ -15,6 +15,7 @@
 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
  */
 
+#include <linux/config.h>
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/fs.h>
@@ -32,6 +33,10 @@
 #endif
   
 
+#ifdef CONFIG_DELETED
+int deleted_move( struct inode *dir, struct dentry * dentry );
+#endif /* CONFIG_DELETED */
+
 #define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
 
 /* [Feb-1997 T. Schoebel-Theuer]
@@ -1403,6 +1408,9 @@
 {
 	int error;
 
+#ifdef CONFIG_DELETED
+delete_retry:
+#endif /* CONFIG_DELETED */
 	error = may_delete(dir, dentry, 1, 1);
 	if (error)
 		return error;
@@ -1412,6 +1420,15 @@
 
 	DQUOT_INIT(dir);
 
+#ifdef CONFIG_DELETED
+	if( state==0 && !d_mountpoint(dentry) )
+	{
+		if( deleted_move(dir,dentry)==0 )
+			return 0;
+		state=1;
+		goto delete_retry;
+	}
+#endif /* CONFIG_DELETED */
 	double_down(&dir->i_zombie, &dentry->d_inode->i_zombie);
 	d_unhash(dentry);
 	if (d_mountpoint(dentry))
@@ -1477,7 +1494,13 @@
 int vfs_unlink(struct inode *dir, struct dentry *dentry)
 {
 	int error;
-
+#ifdef CONFIG_DELETED
+	int state=0;
+#endif /* CONFIG_DELETED */
+
+#ifdef CONFIG_DELETED
+delete_retry:
+#endif /* CONFIG_DELETED */
 	down(&dir->i_zombie);
 	error = may_delete(dir, dentry, 0, 1);
 	if (!error) {
@@ -1487,6 +1510,15 @@
 			if (d_mountpoint(dentry))
 				error = -EBUSY;
 			else {
+#ifdef CONFIG_DELETED
+				if( state==0 )
+				{	up(&dir->i_zombie);
+					if( deleted_move(dir,dentry)==0 )
+						return 0;
+					state=1;
+					goto delete_retry;
+				}
+#endif /* CONFIG_DELETED */
 				lock_kernel();
 				error = dir->i_op->unlink(dir, dentry);
 				unlock_kernel();
@@ -1546,6 +1578,9 @@
 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
 {
 	int error;
+#ifdef CONFIG_DELETED
+	int state=0;
+#endif /* CONFIG_DELETED */
 
 	down(&dir->i_zombie);
 	error = may_create(dir, dentry);
@@ -1823,7 +1858,27 @@
 	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
 		error = -EBUSY;
 	else
+#ifdef CONFIG_DELETED
+	{	if( new_dentry->d_inode!=NULL )
+		{
+			double_up(&old_dir->i_zombie, &new_dir->i_zombie);
+			unlock_kernel();
+			double_up(&new_dir->i_sem, &old_dir->i_sem);
+			if( deleted_move(new_dir,new_dentry)==0 )
+			{
+				double_down(&new_dir->i_sem, &old_dir->i_sem);
+				lock_kernel();
+				return -ERESTARTSYS;
+			}
+			double_down(&new_dir->i_sem, &old_dir->i_sem);
+			lock_kernel();
+			double_down(&old_dir->i_zombie, &new_dir->i_zombie);
+		}
+#endif /* CONFIG_DELETED */
 		error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
+#ifdef CONFIG_DELETED
+	}
+#endif /* CONFIG_DELETED */
 	double_up(&old_dir->i_zombie, &new_dir->i_zombie);
 	if (error)
 		return error;
@@ -1934,7 +1989,19 @@
 	to = getname(newname);
 	error = PTR_ERR(to);
 	if (!IS_ERR(to)) {
+#ifdef CONFIG_DELETED
+		int state=0;
+		while( state<2 )
+		{
+#endif /* CONFIG_DELETED */
 		error = do_rename(from,to);
+#ifdef CONFIG_DELETED
+			if( error == -ERESTARTSYS )
+				state++;
+			else
+				break;
+		}
+#endif /* CONFIG_DELETED */
 		putname(to);
 	}
 	putname(from);