permissions-20181116-lp151.4.15.1 4>$  Ap^k/=„.ɜOWK[ΑECf%XLXd:XUͣjYhJ|,]&.w)l6o[ *.\Ȧ'L[y.33B:#fPh19_9nw*f(ZiӇaJL>`Ԅ .q~[Xyb(XnH%VхLj^w@5;Bb{% Үӡo2CP3Pۭ3a8b6123521fe580f1399609f9a8d2b3eac69263ac3871a83f864ee8e11fef814ad6583c4766303fbf0c4df4b784804ac315092b^k/=„Q5n43bJdnq i.iJr'] `T+XLl!)6rX#3V OGz*GT;i]Yƴ(4\f3g %zhALJ$~ݭ"i piP2=FFN1jyIfZ A2_]5AFi ։ ^z9 A)L%ǂn nWV6;/X p^Β^ Ʉn>p@0L?0<d $ C #,5 Nd0 T  f  x        A n   P ( 8 -9 -:[->+ F+G+( H+L I+p X+|Y+\+ ]+ ^,b,c-d.e.f.!l.#u.8 v.\w/| x/ y/z////08Cpermissions20181116lp151.4.15.1SUSE Linux Default PermissionsPermission settings of files and directories depending on the local security settings. The local security setting (easy, secure, or paranoid) can be configured in /etc/sysconfig/security.^kgoat05dopenSUSE Leap 15.1openSUSEGPL-2.0+http://bugs.opensuse.orgProductivity/Securityhttp://github.com/openSUSE/permissionslinuxx86_64 PNAME=security SUBPNAME= SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi # apply all potentially changed permissions /usr/bin/chkstat --system0S1V]j9;@큤^k^k^k^k^k^k^k^k^k695fe6b30c6f66604218b2ebf6101892df83b7d9d43f77e36962e21814c56c65854b361db3a04c90fcc8adb1dfb5ce5031d7556bf56963170a9d8e658189fe50254ecad52808937c3153a81d50810ee7e689d78dfc2cf8aac67cf179a2fdbf3b39e94dcde81ae340fab79fb4f5d9476e05ad986384daf5a01a61e23bbbd8246b09fde96a9a16a68edf21f1ad146bafb8e067b761ad520191e21ac9e864439691d8cbea76c2e0287c7066e989b292ab99ff974e562487d800937d0c11024fb7e435eca1eb5762d2b602f4b5114a54eb6e6815d26f10b5dab00cda67f2860ca4a32dcb772c1e9949198bc7695bd25c20cd21aea565905b0975de2edeafb31d8202acbebeb00ef9fccc619e66ad50b5c31ac346b2e06ec7d429ec8d2181bc5bd2f1rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootpermissions-20181116-lp151.4.15.1.src.rpmaaa_base:/etc/permissionsconfig(permissions)permissionspermissions(x86-64)@@@@@@    /bin/shconfig(permissions)coreutilsdiffutilsfillupgrepgroup(trusted)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libcap.so.2()(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)20181116-lp151.4.15.13.0.4-14.6.0-14.0-15.2-14.14.1^y@^U @^:@^4^*@]@]@]@]@]:\8\b@[@[z@ZiZ\Z%8ZZ@Z@Z@ZNY|Y@Y˒Y@YY@Y7Y2Y1S@W"W@W@WBWBVV@VV2 @V +V +UuT~@TZ@jsegitz@suse.commalte.kraus@suse.commatthias.gerstner@suse.comMalte Kraus Johannes Segitz Malte Kraus Malte Kraus Malte Kraus Johannes Segitz Malte Kraus jsegitz@suse.comjsegitz@suse.comopensuse-packaging@opensuse.orgmatthias.gerstner@suse.commeissner@suse.comkrahmer@suse.comkukuk@suse.commpluskal@suse.comastieger@suse.comrbrown@suse.comkrahmer@suse.comeeich@suse.comjsegitz@suse.comastieger@suse.compgajdos@suse.comastieger@suse.comastieger@suse.comopensuse-packaging@opensuse.orgdimstar@opensuse.orgmeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comkrahmer@suse.comdimstar@opensuse.orgmeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comkrahmer@suse.commeissner@suse.com- whitelist s390-tools setgid bit on log directory (bsc#1167163)- do not follow symlinks that are the final path element (CVE-2020-8013, bsc#1163922) - fix handling of relative directory symlinks in chkstatSync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore remove all of the following patches which are now included in the tarball: - 0001-whitelisting-update-virtualbox.patch - 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch - 0004-var-cache-man.patch - 0005-singularity-starter-suid.patch - 0006-bsc1110797_amanda.patch - 0007-chkstat-fix-privesc-CVE-2019-3690.patch - 0008-squid-pinger-owner-fix-CVE-2019-3688.patch - 0009-chkstat-handle-missing-proc.patch - 0010-chkstat-capabilities-implicit-changes.patch - 0009-dumpcap-limit-to-group-CVE-2019-3687.patch Because of inconsistencies between the upstream branch and the package state the following previously missing changes are introduced by this update: - Update to version 20181117: * removed old entry for rmtab * Fixed typo in icinga2 whitelist entry- fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch) - fix capability handling when doing multiple permission changes at once (bsc#1161779, 0010-chkstat-capabilities-implicit-changes.patch)- Limit execution of dumpcap to users in group wireshark. Added 0009-dumpcap-limit-to-group-CVE-2019-3687.patch (bsc#1148788, CVE-2019-3687)- fix invalid free() when permfiles points to argv (bsc#1157198, changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414, CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)- fix privilege escalation through untrusted symlinks (bsc#1150734, CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch (bsc#1110797)- Added ./0005-singularity-starter-suid.patch (bsc#1128598) New whitelisting for /usr/lib/singularity/bin/starter-suid- Added 0004-var-cache-man.patch. Removed entry for /var/cache/man. Conflicts with packaging and man:man is the better setting anyway (bsc#1133678)- Added 0001-whitelisting-update-virtualbox.patch (bsc#1120650) New whitelisting for /usr/lib/virtualbox/VirtualBoxVM and removed stale entries for VirtualBox - Added 0002-consistency-between-profiles.patch Ensure consistency of entries, otherwise switching between settings becomes problematic - Added 0003-var-run-postgresql.patch (bsc#1123886) Whitelist for postgresql. Currently the checker doesn't complain because the directories aren't packaged, but that might change and/or our checkers might improve- Update to version 20181116: * zypper-plugin: new plugin to fix bsc#1114383 * singularity: remove dropped -suid binaries (bsc#1028304) * capability whitelisting: allow cap_net_bind_service for ns-slapd from 389-ds * setuid whitelisting: add fusermount3 (bsc#1111230) * setuid whitelisting: add authbind binary (bsc#1111251) * setuid whitelisting: add firejail binary (bsc#1059013) * setuid whitelisting: add lxc-user-nic (bsc#988348) * whitelisting: add smc-tools LD_PRELOAD library (bsc#1102956) * whitelisting: add spice-gtk usb helper setuid binary (bnc#1101420) * Fix wrong file path in help string * Capabilities for usage of Wireshark for non-root - remove 0001-whitelisting-add-spice-gtk-usb-helper-setuid-binary-.patch: is now contained in tarball.- 0001-whitelisting-add-spice-gtk-usb-helper-setuid-binary-.patch: add whitelisting for the spice-gtk setuid binary (bsc#1101420) for improved usability.- Update to version 20180125: * the eror should be reported for permfiles[i], not argv[i], as these are not the same files. (bsc#1047247) * make btmp root:utmp (bsc#1050467)- Update to version 20180115: * - polkit-default-privs: usbauth (bsc#1066877)- fillup is required for post, not pre installation- Cleanup spec file with spec-cleaner - Drop conditions/definitions related to old distros- Update to version 20171129: * permissions: adding gvfs (bsc#1065864) * Allow setgid incingacmd on directory /run/icinga2/cmd bsc#1069410 * Allow fping cap_net_raw (bsc#1047921)- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- Update to version 20171121: * - permissions: adding kwayland (bsc#1062182)- Update to version 20171106: * Allow setuid root for singularity (group only) bsc#1028304- Update to version 20171025: * Stricter permissions on cron directories (paranoid) and stricter permissions on sshd_config (secure/paranoid)- Update to version 20170928: * Fix invalid syntax bsc#1048645 bsc#1060738- Update to version 20170927: * fix typos in manpages- Update to version 20170922: * Allow setuid root for singularity (group only) bsc#1028304- Update to version 20170913: * Allow setuid for shadow newuidmap, newgidmap bsc#979282, bsc#1048645)- Update to version 20170906: * permissions - copy dbus-daemon-launch-helper from / to /usr - bsc#1056764 * permissions: Adding suid bit for VBoxNetNAT (bsc#1033425)- BuildIgnore group(trusted): we don't really care for this group in the buildroot and do not want to get system-users into the bootstrap cycle as we can avoid it.- Require: group(trusted), as we are handing it out to some unsuspecting binaries and it is no longer default. (bsc#1041159 for fuse, also cronie, etc)- Update to version 20170602: * make /etc/ppp owned by root:root. The group dialout usage is no longer used- Update to version 20160807: * suexec2 is a symlink, no need for permissions handling- Update to version 20160802: * list the newuidmap and newgidmap, currently 0755 until review is done (bsc#979282) * root:shadow 0755 for newuidmap/newgidmap- adding qemu-bridge-helper mode 04750 (bsc#988279)- Introduce _service to easier update the package. For simplicity, change the version from yyyy.mm.dd to yyyymmdd (which is eactly %cd in the _service defintion). Upgrading is no problem.- chage only needs read rights to /etc/shadow, so setgid shadow is sufficient (bsc#975352)- permissions: adding gstreamer ptp file caps (bsc#960173)- the apache folks renamed suexec2 to suexec with symlink. adjust both (bsc#962060)- pinger needs to be squid:root, not root:squid (there is no squid group) bsc#961363- add suexec with 0755 to all standard profiles. this can and should be overridden in permissions.local if you need it setuid root. bsc#951765 bsc#263789 - added missing / to the squid specific directories (bsc#950557)- adjusted radosgw to root:www mode 0750 (bsc#943471)- radosgw can get capability cap_bind_net_service (bsc#943471)- remove /usr/bin/get_printing_ticket; (bnc#906336)- Added iouyap capabilities (bnc#904060)- %{_bindir}/get_printing_ticket turned to mode 700, setuid root no longer needed (bnc#685093) - permissions: incorporating squid changes from bnc#891268 - hint that chkstat --system --set needs to be run after editing bnc#895647/bin/shgoat05 1585671159 20181116-lp151.4.15.120181116-lp151.4.15.120181116-lp151.4.15.1permissionspermissions.easypermissions.localpermissions.paranoidpermissions.securechkstatsysconfig.securitypermissions.5.gzchkstat.8.gz/etc//usr/bin//usr/share/fillup-templates//usr/share/man/man5//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:12232/openSUSE_Leap_15.1_Update/abcc98ea93506fdd3f014046216fed62-permissions.openSUSE_Leap_15.1_Updatecpioxz5x86_64-suse-linuxASCII textELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/l, BuildID[sha1]=1d8c3c01510c5de9e8df597e80ef80cb5b820994, for GNU/Linux 3.2.0, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)R RR R R RkBM3utf-8a45393157e7a2f643744c7a5c6583b98b6ea76832699b3eca37df89d55e65bc1?7zXZ !t/V] crv(vX0E/ لb'}%Q,<̮'hY:(]VU`'Q凪pZޱXP[GH6/;3O-pw]E{]cK)D[^V (_j:O ܎LSo'1 38HL=VWOAu,h>(0ԫ>\2Osř1D㄄w *P+&rN: |]FSķ7~^CvGkJ6iư`od]_]^&>DoֵsiP<'סюB^袹vǟ FwJȈTԠ-YKҌul{\ܮ$ Qk / mեtcQmɝiG!SzNx&k^q傭{ı8Yaxn0ԚlPCܽyK3dU|4;TEN~0@){J'S_9a9j̙v;捏!Ȕ6DɑfϏ' @rg'Qbkf^}~GɮF O<"{^{fc7N \x{;2}3Au][=d=+9 u 5]}`q;DG|A#0{LF8@o, i6%.Q.u]gQ< f#!C|覱XuZ1~ihk*ū11CS&i-D` &l/˄ ̚Ł%Nb%e\YĮD@FJ"Mr} A8^7'unoc^2[cqogcDz /5J:عI# h>;'s)#Wx 0V;u;f J͝(i)p0s1܆"eDd􅽕İNj̯Zo^|3kI4 NMQI-k/! | >`Z  < +jJ&,M1D^*O}R14X8Mڻ C3{OK5gr^o)Ds!AS;3v! G'C=T"n G{vL3y?7ԺF8))>|Bõ&ʳ>/`CVt'S8xNȑ]._ǖdFA0 QTR%#D/.SncA(8B{ǟ-4vvJqΓZ,に_,ffi(p˟P[ "*2PAؒRI~ f.3 ]6|f{#IT&քu-!CQ]lO@R$ 6G$Ć \lU L7"|a~H zC9/ђ| Eކ~z4^~0y:}URdHћTքF+]i=dFc/N./ qDɖg2TЭRkgMݫJ|+9}.gLf3c b݄h½5~^U}3S24(y JjOƊ\],{4[H-=v)]5PȨЏJ ŭ.RHZOZHnz(d6y 2jeE)ȩhZO cop"5]̦Y~ۙY*QSBA#K3= # `B1%8mtqVM>c?­rP/&6PJ++nid<-]sAKE.hx6 ^-~ UrK}@Xe haPEDBP6f`X-nKh!ŀYI.$Pm[Ԑ/3=XK 6iz Π&l>:|d~|?Wk i#tj^B&Cx4mOF`zsZ l!_ؚ@FlBAn3ؘo"=4 ܵPU#JTP(.,5>uUIdP8 __TikB`=r()Qt%@USQ -)2q^- O0fD;8,GQf4qMߞ-d&5.fu4D&;%CdP;2caF39MMrxLST~_f}4hP2ur7b{qV牊tUłBg'ː=V-_s*P~bK_461aiZm wwӎmdޡGUoDQv'kJQR/ `ilʊ;[ }LLx6]~m\o{lP^3®d\7\,r+ 0V'z>>t_O;>O֔K24GVY=Qd,~} xH`Ft2-oI${NYP҆@>$SU!˥|C d ߙHvmFFHbcD$]vdo;t8/r\'ZoZ`Q+i i¤44k~@g)JCmro>-{i353(Gx(Ekj(·k b4/xf1L\$8v)1q.5Ũձ^2f7Y,i0+樌O & m! RV'pJ/UXGfe?#T2셇ڝfh8wKX/H#I*5 r6]/n7J"VC*L'/]wz8#caӷ)y 7MΊ-sy_1׊yMO"4!Wv= f1c_Q)7,I]Yus;C?v_bY]od t@v̴WgMv;/)w I)0f~cq:1<ΤMzUNQyGC k@(zx-FDj< Bj͈0`V;E=ݮ#_+C^%x-ˮقE^߂`r+LYqup.CpO٥Vc7h9%?ёz5>s5dbK"} N|3`y65 )o4n#|6BȾς! U`2Q9S%:) $VI hS ygtbUAO㕋9 Άc^#{Jw7͵|c@AFZKT$vPD?vK~<৸u =<9[EGFz),C\.a~8 ֗W7פ4M kH"Չհ^{wWяuV5N Hj(@Fԃګ# I8kA\vI fT:S~X= 5VsUBge0;<3JIo=v5.Á)T°pàeZ8s$? =zD [_1W^qCV i笣ڍүֹyH/5wY2"u tSn-m788:nS0Fޙ BEZcCDYR3o!hD$q-\H% 7|,WBA7 0Ƿ 9.ԘEHh@6eMN(όXAs{r2v74)ʰshLUE;X$;+$)urKdI)UihV]0@象K(ZI!TGct/Dh[biQT{7qE"툆rQ% 4 @jFt x4^.x;\Hˣ5@ xܗɔ@)yC!-mW5y$ ?||Mk?>=a# /Lsk,M58$WĜjmp%l;4-遮I͏(<~zuIUSIjUBsĊ|t:&پ9Q@a `G6 "P{M]ܡ!c?Piu !tq}p{t^SV\4<WdeoK #(gkF`v$6wDk$q.rI&:a6Wt-;7qYE^je hdtV UW7 a?hD⛂nq&QGhF*$)@w$7֡z d%ui}K>+M(E[e`Lj`RۡNx ji3rV|wE'k8 ǣH؂ =&GPX/#J!Rb::%΅}#WT&WXqtrp];U/蝱 O#Jvூ 7Z yfqxSa yeXت;WWݛ6KT҄i+7şgI3 }CC*q"`X/Zfrn${]rl& w,yɪ_/iFP&Ram@ }gj_ Gf*qc]6 O6蒟Np|jkB Д-@lw4?=nHfzxu[Fzy#fi~>Ɯ"AqG'AVLj* !3߁Zu?_&AE{9eO4r@OlgdY`wPgg/F^BThvKt+э1QDɽo!Z ߇A@?;1X1h:sksCG|-D5$iCRi ZnWG#"ݳrP!}՞j<@ d?@0}A@ DG쇉jO/ <_4LnvN^8}-b{!xĵ$l|'Z O/]iuE[5F: 4%i&5`r3ErNkN^k˚hjevx H6 sxHډ 39T=8EV/*\kf;)P]JmM~m t?}}4r{BM׎*Wl4NXUv)ܨ/m7Ms 50Ԕc[+,~R_df_'>td-r[)Qđ{$ LLehq/_ F#BwĘ׆Гவ1W৕؄~cB4M('y4"`J hKvo&=:QЪL(kn!K$=%C;iV Rb<5E@z4kS24bKagn\h2lJ9B}81K/h8=0,~B$ZBñcAv~܇S|q<#Hݿ57BOִã?H$krH#Rx(@5=DlYΜ[ؗ61(L޾ bRNc`j0K76?er 3>x%y BBHS͈}\G]wG2.I*U%LГXkj SS/[ ?V:޸*-N)gbmRzC:υ[A\}hc`#ʸ.>%ȝ~0B +G`G|Ց;|x03 [̦4~GjE5BxsC-s :OYU*@ohuW:a䦁l0olPaVaDHϔ4c{A UWeţRn 2LwaR(ȏeTuif PQaRB XA '%4+ 3,C$n#K>95B,_S;-ekJ,ÆkTEb_p*nAwdS4uADm{TɎס{f VKΌއ.kx忨щ&x[iϳtwp.].ݨk]Ɇ&sPLf, Vm VDxK4BX3uq#߹W{ s&4*}Im.1k#[^,RzY][Nߑd/bM_E$1 t6hvrkSxZq䷉{’w#P0LꇷٷHIL|7p*TRN&p-=P\ RQ 4]&겯!kUcC'T%q߭4f;/J N 4lm1orL 9*׮mt`>[: HГZZ1PhDjՠnbJ=t,Z"4v:EĢ\Eͮ(^[fdKWf1UDfDP 뷕AEλצ&k3-p ݒvoRyۆZwq>\z2HOm])O䮯)3Yp+ )((C߻;)aPa-=7Sj 痻8o#D+{!гLL P|ixNeҨsLBȨ-xLLV-x FD.w_Ͽh{@&?fй%@U ̻,.xddhᝂE[e*JIVЄ1c>`ތFZնWΓƸ_V!]|h 0&c|}G#";-&|zq`becy^/\J鱍!Yyx?xCT%='Q/V+[(w3`@/kP }$R%1Z uBQsHEFnq<̎6J8cb (4=5x,:αP{`DiOcOҵݞ&WȉBe';z(*:%cb-tԉi~ n:튡qDf-4$]KCjUsN@&='ʻ |PAa]z[?7HLw$[Բr L}nK ,ev=+G5v͕Tf&B ^֥͙_J? +U { [|2cϤיlk̈́rA pn^i(K0sqJ!3n   eXY%`e^OKgC_۩ ;Is `"Hur_IHPC9'Ga>WߝwG.kKRV3iCho{2g]39_ܺ'sڠEXY'ŠMZŏu>o5 ѧS@h'_" RF, /5[ϲa2 p#DOF͊lCլ!U\a-4>eoe q6EPӍY5e3}%'?%-YzuNOϰxdaķY13{ PS(c6v>HWu`Hi̷¿5C"pʻC[d'# 6uȞvҞf`hӥgvɓ[porյZeey1 -$yMZSl4lE0N3 #.LmF=l \ASIysd?H]HA2D9sR=E">JX.%A? ΖӑR0گ8\FyWKq'f @tz8=l`,ir`zdF,z{ ]f6}`U=JJcwdCWރ# W3RM\aeۼ\S3QXkU6? )>pzc`'q@g&$~)B ט)., /T 2=^2{`^&[̫k$^G~4w_[lvw-uM-u.b;,m%*l~Ff!hC+hdl ;MI?8&ܡ"vgrAv[g>5pL=ɼ'IZa6RG/Fέ @JfsTC9qمXy9cY4[7 >1]HR?\ %tB Xx+fYO쯷@_IlB Nj Q~^h&\}K@#Ck&6UnT=-{k3bَM4VEq6C!dkX%r Lo} HC%7TБaF` mb%ݕdv׮a)EoLfd8 /Kg#'Ǽ4m>^CժZDZ}pg@QEb+qo#tNV]b4xD i=#&wKZ-3us A8>]k▅*04͝jR܃#`P]YU jx/ sGZM Zh~j+ 0Мźe Ijټ([Ϡ-Q4 ]F,j iUUξtߗb`^/Ғ8h.%Y: W+@juF >RJ>V3ba_bA>-@~SA5]zEBd5C3ͬ&)MQ’S@k^cdSPIP:d3+ (fBx(R `^ lȪoVpKACepVf&0(-ÛTotPgzL V`[JUDH!97Xp> Q׍^'\B2fh &0قAB'HrE=p|ëgOȧbtgMsdNŏ̢;ؾڮyf#:1eM-[l?y+^: L:34t;L9zE-CkbXoUp8L:lA -ř?azԲY\lI!* B͕Zge(Y@QOyޯev*K I@Wfl=9zS 0!pƄ=]UGd|̯騽H2?Xoc3mQ+XxĘz^K;F!MoqBz} 4+Tj]Q(̧U*Rm9{&"O!$mJJacA!^Q FڄTK0=ӭ#?T=gU+Y2J냨km=FsVK12GXXŌpit'9=!ăb¨d^)ߋ3p8fdM(:P#AsECKuIHͥURi$$ٛb{q";Y&t]oٷEL(CWOrfug2xA'/eGN_ 1NeHQ>\x9g)zn[i'X X &[dn泱gsDvCٙ_ӗL)lx~8rrSj(JW2f >zJ+$gZvv(.(.wA'$ D%%>yiԖMvVX:(n^bc+yewϏ\=5 ض> 7PA'+KLytA!fʏ#/-]胳MroK.1 YxĿ+!ݢE$K0{CEn̕\ӜμӬr}e_J/HYf&y'̟](]N0VW& أ"!-mLr}UiEAӎ _IőYr RZ9 pҽj~Vr5-oPԻ #yž''r~ɺ]e_HxLP!}|LK_GF8;cBg''xc9od DO-j.Y4G rαh񮅐MȠO]Fb4qcO"3-#V-xbi7)_~ZP{q;} ڋUQjY&_W!6I\QDWX -"^>syW1Kb`9F;o\Yci)@gF)[*U^:7x7ۡj,"|5|`iI h@Eh+tػE8t4B8UlJy%D<<e&쾬jE'LgH= f.' LjKgNnRG\-yO iPI@;L?\C 5Le&mY4Ej7'>i%yDc9z4 6fuɾV$Vb9p-GLk웺($H] 6E2\H?*4 Ʌ*{f KBx`hߴxc+xxd럸󅲽 2mV,n_i/*axچ{dbg39Zd Тgi!]!3En&Zbku2m¶%aj4R"vnT`Ӟ!j6Ǎ®@Gaao/~`p ks*}5S+%+n}4b'jt Ž=j?B@5ZG4N٥:"hM#'pޞ!A|"`k77!br+07ﾣKp&OLd[3Gh9ڼ4O+,ƔM~wSv5y>Zٮ6+%=Wò?i^P3uXt5&+Y=F+WЂVw+mOx! 8PP+ZQTH ;R0G8Gմ=VXSmߧ #PoS}M'w(yT90 ԓ'NH4Q%鿑;3wFKm,#/'ba+ )/ }mT踆U] x@;HW$:\1VbY @l2_+mm=k)+(bOO G$u4~B,=~Tv&|!޽ELP[-l5[:\KI͌y>zhW;F쯎eI;VtsrULCJJVyH4ԋQR((7Uyd4+ȑ+qw*1IoIr7'1= +S06=PvhѶ6J!H*G,mo*{P6heaIqXP帪RWj)JYRMtd5P*8<&P,%J?16VhtZwyƐؿQ:TtshRq>v鳂%WE'|{1qJ !<!vşX?w^E%#&>Csj4zC{I .%&wioL,}ƭx4=Tzr*BK"cj\]Ix.%_ 켑?W#*)GjȬu".mN [5F_eC7rKvEH?GHzxW0l vpa>i߱9%}L9­'>`s̨"Wͭ,/7,[u?ѪI<"O7/HL-mQTJۯIjͭ=N8mP-5'`e<4  'RGA0< U5hv]rɋ_UtM^;Vhņ㋂#$n9 UB7Ζg#3Hh%I?c!K>ucLіxtbAc|5_it^l$Ùp7|q \Ahւer7h"EHP F_X 2o*hDJƷ4 G0J)9%~ˡW=л;QSP8ɪZ+dQ2(e]jTFVϕhfVuâPIOWݾߚUz! brC/-$*/U䓪7q.h[YU?{z>.V$ FX/rPhy3A 0ZEa2JN/ht8MċOo%Qg[q8wZ2Rou߄WD7>s!iq /bD,esj;wQ)6(n F^ܫ(&؉8 j|Mg#rj'G"QEi2VR/ MKڻ-' 5px yȥ5spL)2M Jw3Ǵ8OH{\Vcl?8$ ?r/k+<2XcQ86鼮icJEV)FR YC{yn^ Q99~RO%Y?PAkLf̾+Y/s: [ Eݱ>J _J҂;D}Y}.m5\aK{ 2ܰM۵<()ܿv'b؋/25m0 efð}K݄S(f| of6@Ū~1u$^~JDUrlTyLwcX#l C VPvnh&HNyllM0%@b}L ֣RsnjV ?f.Q 6 4X4{ X Ox:1wsָ`Tfgwȍlz9}?_/ЯL!BN"AvUnݷf%+vvjJ HchW~ND8#n_edfɭ3t)-fP־L'!I)m)qࢍ:hXa:+|;P$|HuoU@FU;ŔWW4eO$-hJ]^ea[ΫqS,gPڄ_~ z34y+djɬ&Lrv5y427@˜{]1>Ӥ %﮾oR gAL^Dpwrn)W:!&h"aw΢YP6Ͻ ^:n pIR7}L\yoy,'&zS(0xO$c'}?8 EnKo`I`͸N8+Z~T`QV-zvCRӖmMixƹ-J b`kbq=hlU1Npu4o@zâ$JMP6$_)y!{B毇h69HfCDKQ-+_\Ybt،%@=UJK4\O&ϬeHU?(m8V߀ma'p=3BQ]i*}6xY8DA5&x- AҵF0 ‹nAI&/,6ƺ+kdOv>67 g% _4cv#~1?GrN]1CQ()+*'*;qC*Z`ˇɗ@X@r2;XKdNj|MQxk+ٛsF2'k cEs(dE'v1/<xvFHvV9:|,cŵ|س8g@NV .`e`7ΐ 7rҍjYQ5]]n9ء3Y=eMrKڧZ2οٲy-Az0+ \ax,2'.ʃ!3ITsJpX[T3R_Q#2ᄽiy W wwy}QT;36$Ȓ6>%t+fǔ*)'+#{+TaBgbD79*>FKJ )nTEN<iMTѽ+US^e h%wS\(UMZJy4 H#!.j\TŒu5"\,/,S *+Q@uWb~Ҏ &K]_}w@#'/8yKI$s~2}S_ךNP"Y"@xg>oϊnދ&×ulIN.&ݫ<TfdPmJqpɇ"OA3 hB8*}zedl$!ʙۥ!W3y. Ι-y ;