Implement per-user subdirectories in Trash Can to separate user files. The directory name should be the UID of the inode being deleted, not the UID of the process doing the deletion. The per-user directory should have inode->i_uid = UID and mode 0700 so that it can only be accessed by the user. The GID and PROJID should be taken from the configured mdd..trash_can_gid and mdd..trash_can_projid.