The new version of LIDS 2.2 will remove the origninal xattr support, but will use the inode labeling concept to enhance the acl search/labeling performance.

The new version compatible with old version of LIDS, the only difference is after all the lidsconf acl, user need to do a

#lidsconf -C

to compile the acl into a binary file..kernel will read this binary file to parse it. The benifit is now kernel only need to read one file and will not do all the atoi() etc..and will make it more secure.

The new version make the lidsconf do more job and let the kernel do less job. Now not only the process have the object list (a simple one, only contain a sid and oid and a inherit ) and the object also have a list showing which program have what kind of permisson on it. In this way, process will do all the inherit merging staff and checking its acl with the object inode's peromssion bits.

Another enhancement is when fetching an inodes' acl, if it is not attached, will go to check its parent dir until found an acl. once found, the acl will attached to it and all the parent directory. In this way, the next time, when the same inode being accessed, it will get the acl right away, even if the file is not the same, but in the same directory, it will only go up once to its direct parent and get the inode. This way will accelate the performance when doing acl comparision/checking.