selinux-policy-devel-3.13.1-229.el7_6.12> H HtxHF\d ?*}})sPr^/W {665 zZ98bf494a58fd0fde1e51bedf6bbd35bd41135015H#xXAu1kF\d ?*}}؁٩uI 3%G7y,rZߨZe6Mr>: U$? Ud + @pt LNN ! N +N @N N NHNNTN   ( 89$:%> m;G mDNH |NI NX Y \ N] TN^ # b d e f l t Nu Nv )4 w *Nx ?N UCselinux-policy-devel3.13.1229.el7_6.12SELinux policy develSELinux policy development and man page package\Wsl7.fnal.govoSScientific LinuxScientific LinuxGPLv2+Scientific LinuxSystem Environment/Basehttp://oss.tresys.com/repos/refpolicy/linuxnoarchselinuxenabled && /usr/bin/sepolgen-ifgen 2>/dev/null exit 0p `R^q'"-%$#5-3z+*I[+b$"""/H(7?#3J2*G"&'KH>()O63>)j&0h&H// =/:*8"-%FX n'4$7-#3jMw0>w09!B4%48*K66m3-4('<W -* .&.z.^-2.&3&l!*%Q$$FA":4955K*)-:pP9o/UG6.@)>-(252215<$?R.@C.;E&7e+4 7Fl%4^1a.OH$.>6 7=b,t2615w5O4 ?;5RQ#/@~!8}$q06(4N6j4 "-&h7%=$6zLa,I,g#1/(076E+~47,8JC95F%3 Q%!-S;Q5'-&5%8,+7.ahA;HBjHS6,1o"40)/`5Q 9?i6./&95754,!1}'$4.38A-()+CG%0./-4>679,C:p/#0r" J> +w$2; E{*yF`*c/0v>7l)4QQ+01 0)-y8.' 0Y8e>g';6(:60+(yBG".')\.k=6@,6_a).I947Gn*I}/2')q!{2 &&.*.LN(C$#-3U)I*A19="69<7 28BF/<260'(#@_-.K:`6&SW.&,9! &3XP0@z;1E31d$)00313|01(12RV'&6^.'0'22D"2D)f2D)f2!(+J-=C7..*h0xI!& ./.'[EE>h0(-&'W/.U;0AG0J,$/b=8Ez2 M)B'(7$6<=677\6S6SS''g37K)&0hN3!Y1I_ /(()4& $p%/BQ58f'$#!r#BZ--I0;;0TBM)H#0& $%./KJ+6J2r.- 4.2-03-Ah55.1.5-7.]/7j$S5i6,549q,,X-J*,+=F0="274:..BCr>*A25G?//-18N%0i'2u(-*(})+!+y() +%$\%B=BW#-'8?9.$:04490#"M.^(Fy27.'q)IIK S =s + *U/V("3^w-:q6A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤\Wt\V\V\V\V\Wt\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\Wr\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\Wr\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\W\W\W\W\W\W\W\W\W\W\V\V\V\V\W\W\W\W\W\W\W\W\W\W \W \W \W \W \W \W \W \W \W \W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\Wr\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W \W \W \Wt\W \W \W \W \W \W \W \W \W \W \W \W \W \W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\Ws\W\W\W \W \W \W \W \W!\W!\W!\W!\W!\W"\W"\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W\W&\W&\W&\W&\W&\W'\W'\W'\W'\W'\W(\W(\W(\W(\W(\W(\W)\W)\W)\W)\W)\W*\W*\W*\W*\W*\W*\W+\W+\W+\W+\W+\W,\W,\W,\Ws\W,\W"\W"\W"\W"\W#\W#\W#\W#\W#\W$\W$\W$\W$\W$\W%\W%\W%\W%\W%\W&\W/\W/\W/\W0\W0\W0\W0\W0\W0\W1\W1\W1\W1\W1\W2\W2\W2\W2\W2\W2\W3\W3\W3\W3\W3\W4\W4\W4\W4\W4\W5\W5\W5\W5\W5\W6\W6\W6\W6\W6\W7\W7\W7\W7\W7\W7\W8\W8\W8\W8\W8\W8\W9\W9\W9\W9\W9\W9\W:\W:\W:\W:\W:\W;\W;\W;\W;\W;\W<\W<\W<\W<\W<\W=\W=\W=\W=\W=\W=\W>\W>\W>\W>\W>\W>\W,\W,\W-\W-\W-\W-\W-\W-\W.\W.\W.\W.\W.\W.\W.\W/\W/\WV\WV\WV\WV\WV\WW\WW\WW\WW\WW\WW\WX\WX\WX\WX\WX\WY\WY\WY\WY\WY\WZ\WZ\WZ\WZ\WZ\WZ\W[\W[\W[\W[\W[\W\\W\\W\\W\\W\\W\\W]\W]\W?\W?\W?\W?\W?\W@\W@\W@\W@\W@\W@\WA\WA\WA\WA\WA\WA\WB\WB\WB\WB\Ws\WB\WB\WC\WC\WC\WC\WC\WD\WD\WD\WD\WD\WD\WD\WE\WE\WE\WE\WE\WF\WF\WF\WF\WF\WF\WG\WG\WG\WG\WG\WH\WH\WH\WH\WH\WH\WI\WI\WI\WI\WI\WJ\WJ\WJ\WJ\WJ\WK\WK\WK\WK\WK\WK\WL\WL\WL\WL\WL\WM\Ws\WM\WM\WM\WM\WM\WN\WN\WN\WN\WN\Wt\WN\WO\WO\WO\WO\WO\WO\WP\WP\WP\WP\WP\Ws\WQ\WQ\WQ\WQ\WQ\WQ\WQ\WR\WR\WR\WR\WR\WS\WS\WS\WS\WS\WT\WT\WT\WT\WT\WT\WU\WU\WU\WU\WU\Wb\Wb\Wb\Wb\Wc\Wc\Wc\Wc\Wc\Wc\Wd\Wd\Wd\Wd\Wd\We\We\We\We\We\We\Wf\Wf\Wf\Wf\Wf\Wg\W]\W]\W]\W^\Wt\W^\W^\W^\W^\W^\W_\W_\W_\W_\W_\W_\Wt\W`\W`\W`\W`\W`\W`\Wa\Wa\Wa\Wa\Wa\Wa\Wb\Wi\Wi\Wi\Wi\Wi\Wj\Wj\Wj\Wj\Wj\Wk\Wk\Wk\Wk\Wk\Wl\Wl\Wl\Wl\Wl\Wl\Wm\Wg\Wg\Wg\Wg\Wt\Wh\Wh\Wh\Wh\Wh\Wh\Wi\Wn\Wn\Wn\Wn\Wn\Wo\Wt\Wo\Wo\Wo\Wm\Wm\Wm\Wm\Wo\Wp\Wp\Wp\Wp\Wp\Wp\Wq\Wq\Wq\Wq\Wq\Wr\Wr\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\Wx\V\V\V\V\V\V\V\V\V\V\V\Wx\Wx\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\V\Wxcd065e896d7eb11e238a05b9102359ea370ec75b27785a81935c985899ed2df6846bbdba1149ef9edd39c6f18d37f29e5ed9cb3670521f142ed6d7d2bf9f2b8342d2c3aa4d008aad3243fd00e4723033e27e253289356cdf2cf9ec46135a8327bceb4f36b0f077b7a232a94e214b3b0a5a85152e4d89c193f92ddaba3ede1ad603eb42c63b96de5559574629517e0a13b8d557a0b4d0825c3e5c67c822b1b1eb3ee870ee3862437d7025813a7c09fc311781c869fc030b7a1b2c0143e6d674e9acea42e9521ef2c3538381efe460de4cf23a2e2f27bfaeb2d2a8234a2f8f212b5655fd9fc4f2b66c1c615700d7a5fb056d2b923259567f4e6afd6092c4d6c05d814087c66b795995a3432261e008c3f4f9c11918d808a765eb4a136e55f5061a34c889870f2361e027660f4022869c55d24ee96377250f49f2e893c5bcdb0ff168a4e8b23e8bb82f299e96ebfe31178b197e003c416768771bf589a88b7812a6283cc58eb3715e5dac73930541ebca994b064b1aa476885d31999e4a23865959883d2073153aa5404f65433d8afbda8221a13d1009863f32760feac46a820522611cdfe49de4ade68bb5225bef6213a74ee548c2f8a2ebb74fce0699ad1b0befa35fbbb16b58774b4825ac5d043bcc3198543b50dd41d586999f26a671cc39c74c444392b9d5f19c8e343cd7b7b884986dd80ad4c214ba925117f9de35343349abcd145a0a17b62fa1df6af77c995f0940732f885d121f05635fda8bb57933c858df1a725916fb7ed633cfa5f64390df34a983a9b26cc268756e03e905cc5c7e8aa6cb3baa966b99103a284d20dad0a4084403beea41d9f300972d4618589d88cccecf84f49890a55da2b9905cc6ac32765670aa3cdb91090d12ad7eda0ef37990677a4e5a5e09bb9ead3e4254323657be9e1c8e00ce33f27a402a803cb4d519fb01fc503f8e37f3ea271fd8051223b1fcf1f466e62194a2d76150a832d791d7effde4ba8f836301856bd9809505906b7cd2c260813f7b03ff3d7cd2aff6d2fdf3dc5381864a84e394fc1b35824af106b0b91c6fd186b6c17b07e3907fdaaf94f68d81dd783fe69f62fbad4ac3e5efaa9bea9155372a0f31bb9ac311c9897e069da863d5ede650c96a740f5f9f0dd39d078afd6e9fa5bf52805280ee84b70539a845d6960c45bb46bd88ea697ea3541fd14cf70ced7a180f6ce519f74cf4f93a4649996e970bba4176f613b7b3637ebf9d642ee2a2d676a5f898646bb06925b8f37454f0dbccf001c7d8ed45ccac91d7c694fe4a65acc7cadfb5d115cd7af89b3c5ff641bd345f32bf35eda94d68c0d3f699a7e9de010ea6f7e30863c3ca193fdf2c8308e34e49475487a8360ccdb0fe46ed9c47d9a869ef5fefe7fb2079937e92d43413e53021af92aff8d98f2d262e341fda23b6d5ea69096ae7f6cedf3abe3fc0a43c120d9ebcd7e791434c51dd3fa473eb4a5f61b5b916e9b79ab1a0e58e23bb57703dd9258063ed5af9ea447c15cccb3734f2a74ab87f02306ee411ce30a5517b7b9b8ccbb4618d73e91fbe32b7fe0cab4b00da3e0f60f3a038587946219db05f12bae5c1ffba41083c8ccdb56c65b0a6ff792a761aecc9945964249eda646055970aac4354724b2b1182b5a8300dc5fda562c1af864d58000a77843710d19cf9ecc13d817fa5ce4a85caf5b4fa76b2201443f5269a32e254dbe296e92df2bec9375c3eb08e70cf519b14776c372c6de48cce10d22fa7ca7d3b00b339be6aa6c4c0dc49fb7f5cdd1931407b765c96c8bae24c1f492fa1ab1e2fc673e3389f6db5b719134181da92e0f3cc1e7fea285bcb9ce0b4d4cfc3072b83815116d06cd07fc7509f998b71a051792dc0c9a8fa98e493b7f9a00b55c345e49cfa1605950054371ea539a7f28458aa9cf882c4e56725d0671e6b2097eca07ddd314a1d42eb79b77a366b686fa8d8cb682e7f9ef76d2c0f750d84896774666ec7b62bb97fd5a6b98e8f8e3f587777051a6b5461f213841b44c46d3dce24dbec859422b79274ae90883731c8b72ce9144c29980e5867d7e8b101b74f27dd0e052f486c9955dbd5a22317fcec8b5394f3f74e2f205cef88a3db5718292bc04361b31095f8a041a8b57b378536a49eb6d8af9a81059648a6f7961a0d6b7c32dc62987a091c0502d8068b2e3f2768cd588b27cf5095c4b05640d1fee745ded0df26cc3431f28a2de38cad1f7a67cb48843e372c9720b44b1e6a4bb88ba52532b7395baea47da3d979f31be622d3f0e97c4c56c46b69421c01e8ccfa6eb9f7f732f95b625e1258b4e6a35e384d91c30224af67fb54c189a068f24402b883506f164a9bb897364a4f283d3cc2fc1815a9f7ed715a7a3cdb1e7b985f3c927f1035953072e6e15039d1a5e101cf72fd4fc9f8734e294e34d1c6281bf2edeb4561431818f4a4d8d8603e075ba8c77a2039ff14ee576a5587845ab0c653362fe41ac6b5bf11a0e531683015c2b53463e5f09472c2b34cd486107189064de8a59fd3b2ba7f422631910fdfa1c008cdc260f914b9fd4933dad47ed92d3d1d8fd8d46b530a4efe2783fb84ea9506e019cc88ad5db0a0f6c6f5ab28f5a904fa2e107a88d5c2d58f2376fb05b2afde68edd6a1babadd658c766cc652a3460c22a5b95c940328af5f75004c8475ee8d8d3e95700cc1ce9c773a8e7279a22c7646e2a707946fa8e58b8394f6129ae5a5f5f77d697489d7cd1adf4249ed19822e0cfb78b87e16ebfa566eda1d5354b8a216624c4a4036972fdd103c0a32f9ed374605e03325def261cb80636a88b97364162729198313320aaf03622fc23b7d2773c0b1522323cdddf3de3510dcc7878da1a84381c8b0736842097dafd5c3fae7fb9e173700e0fc5afcbb302ca1d330140b76812c6f40c48f7827273ed419b67166db5b1ae8a88ebe201da0727640c0544f0efeb8d0682b4bbbd98966c2811b0c62cf0c505b4da6ae66bf838a71f3c0afae14c6e2f2ef35126ab47e74c5c72741388399313105448db7b476c40f333ddc0583cad5809e79ea82b0f21d162eeb3888fa06e074e86a8c6b489c955567d8100bcf970701593c6f2b00712a111c177adf92f85a2ea667123bed74aefaf81c92511e515946fca9f3bcb8ba311457cb68b944983943de737c546dbdd2f3521876e6f7c38d4c356249c1715c506a4646bece378f4e18e149fe60f111d2803f5309852a91f33bb6ea546c47b62f837552b8f38184f4e1eddef38aca54ee4afb214c504ade9f20dfd3edba880585bab79c5b4d1e854fad88c7b5828141a1d8b50f435585c0dfde1722407783f697da97cd1549c3dc0ba534cf9e6d062e94b893736842801b247d463311025b9a04bfe923d6460386db0875c95242eec3161445bd7bb626865f5eb47d91493be66a8160af705e6a0886849701b24fe5b1f51d7303e90b7bbb5a23ba32464124aede54eb25cfa669adcfc2b03eb32aa4a2896255df0a128ab966ba24560635cf1093aad310ca805fff0b86e9242d9ff9600ecd00ae1261b15f60f1e0d0e0d6347d7ded57ddb9b85b99db5ce08b5b19b8f0c12206454d7a80ff1e45a543ba50f016460d875287b1a4e2a858d635995035206fddb2e970c2ad9b6488f876a6dafa84b673efc3b4ba4211d75df821b839d00ed1cac7da622054aaca67964ec5d24918e1480300f5a0601b55cd8c943c8550699ed6fff094b8eab1b2c33b7a89be762840d9aaf66862ad78952ccafc89cc7233b9b0983471d00ef27679bba8a71ef1031028ae004a14bd2e0e01eefcb81bbd96572f7f18bda53921806162305ff64ebfbaebd749d068846c608ac31b01b8101620985909d2bf8cc3704e66b95c59a7c65b018d74757048745372af497723aeab8384f515611e7d443be9a5c3e2b881edc1acfc36859ea7b127b56058f9a83b854029a7092671fccd216306fb0c1fee34f4808d06d97a8987234c7102d320548e593f2fe4e96d1ba46aea89ffee5d59f2ea16ff074044c0b365e3fff6e5c837d17f512072eb11ef52e89b630497e24fb4c448dea40068e0a42d8c23e3d54592506097cf3ff1eca87a95cfd267253929f24966a751a8c25edf3d4f13c92cffda51e0efefffdbc5c3a943d3e69b4bc432f08e8c76a0a9d1076419bbbb5566faede02049693f261e288f5b378b2a8b04d863bf7c49855f45f792be88fabb7d413f347029a04ae5f93ad51c97fcd5e7d5bd163ccf9976c72339183688819393592241e5b04ee45d56647ed45cd1c127e3c44fdf37c346daed288a172123a32ed7122f753d8e6fe7525a98856bffc92dbec095bfb28feefc80076dfb4eb2565708c37bbddda720c732824c39eb36c91580a58e6a974a41b291c3e02e2b4d21f67e95eae8419c3254cbaafe01e51b1a87880b69ea7c8ed96dc52dcf09adf17b1fb7320d5586eb4ed383fec694766b96a9a1b8a76f126c3ffa5c1a539cbc28f8a6a9b4700570ee98359e110776b6495dca6a83509880a040d834aebc9f7ff145e988ced3496b3a218119f74d4d69cc82e05156cf9a016e77c87b4d2fdbe18488878a2147f7009dbee2ab8dc28d29c2f90929fea6d9ccfbf602bffc004670ff904d1a0803baeb1870758e0c133a3db3c72ca44c9af04eea488aa1885d43b23ed6d0f03842b7eb6c95bf6dc94c5916111c0299e6cfedb3968eb6d52d5ebb6e1cef2968a059ed739a52bd7cfeb99dcc552eabc0313dd54ae4216e08cc04aa9ea67b8c18c531932930123b4c282a518a2a06631bf9ac2312714037c9aa000c618755bea65ccfd2c07fbe710bb3fa0835ba6a9745beb4230dd61cbe97f133a8ee6d3aa4ca8c20601e413e977566209759316d2c56205e31b8eef3bc0db2ab5e3054d09ef2cb646ef92d46e9d1f0a31e9826376a6ce2ad7684168d0b4b90c98906cf7d6db0cdfee0f42f5dc2ad955c4c42279ab903625b91480d82be671f8dcfc47b9a3897b5f91dcd7e9e0fdfadedd8e3d0b9c93feafcebe12eb592f9dc7e20d5c1de7683e11e21002f35f0a66441e1fca5315d8244d8ed3b58e714921f22f1db8057cfb233d19ec207a2676228954e338a30886ca15cc525f7f5cfe64721a55129ef1e6fe6858aa321c70fbab60fd7dcac2c75cb153f8487f5c0391e52e3337aba5448475f631093435239ad06bbe0527d4225d861ad86cfe5b972864e075dbe120d128227b388da5c3704baae48c1faa34ca9c587bc215dbf16b29c7e5bfd3c1b040a2d84f6841df9081c37e1cc973786cf9e364052fa38bf3cf7a660d9bc6627753ce6c0b059f17a10c380cee96652b7cfafceb9d331b623e94f64a0d1016790ac04d99eb2d49b3aef1cd3dbb3cbcdd08240c400437fda80f39ce394262e698613de61d501364597d1931577bbcc78498c53272bd6655ff89da695df67b2ef7581f2937d57c7b411e833c45e45ee52c899b60dd4a212c2d2a73e9968ecc1c81f3ec8b0b225a248c75f80c9389402f826a6a75fa7a09c05801950b1a3ec6c1bee011c32211333cf45165a37ba9a08b5cc1c146b970dc4a47bfbb612e0d2fc3e424a96afc7f5cbaf8b6c0020f455282d6f79fa84ebab565fadb43dd74cc167ca181c473fc5264b3f58914542862607391b5402f8f18287560ddd3a4a1a33dda493dc1aa5f4f157bfb9306d78a3c97eb90a487929753fb38a0b30265767ae397a26dd3f7d50958498aa1dee514c7300a18b6639354b574bcba95cd499cfb246f0732bc6ef2f3fe5bb8a1f2dd4b780f85775a61b5b849d593986f7247cfe31cf17b2ce989dcbc9d8e3766622a1e9561ee122200cc58dec756e5e9f63117305a3786226bf2dad52a9d9337f276eaebed52f936d7da63751c526eb642a8388232f99802074146b31319b50433f0c82ad92dace88d363b5a6967e843d91a5fd413741505a525be69b6259f90efe84caf5d5834ed1f659cfe768e6bc6784f23f48c60364dbe72ee2c4a936c4b8536967ea89f0189a3d776a3c31b775d4704bdd75da341a5b673db1f674ac66f48551b9010fad2a06bc7d763bf37996e15c281fc0872c72f3e418e65fc21751469996b17866b4d24514b0b779c9726116b8ddbc874505187cda41a10563dc97a6a0d849e14d631caa037c7c5f3dee62cd1b2fccd37b9f4e7c432ff8fa9e5d96acc39316d755cec8ec82cf7df58309e88ac1db12b4664d03635ea95419efb459f4c7e0f6127ccabb3616a62c1936b74678d1067f0869fc1a27fcc3971d3112921276b804f2d7ed3618187aad121c0f0dde964aa9ee9af842e9125805b6a00cd46fe7f05fa731e1b634cabf2d166fa121effa71f8396db65f7ebdf63a1c0a53d2b063a8d72abd9c84ea51bfaf31e4610ff2cac68e9b15fe4522c42ebf22c1fd36e6b494abe8f3b6692a24067f90e47994b25876c27a4cc5f3d2dc22c7ba0c6ef78e128274725080c9babc074e8ab4c9db8bb599ed0ab7d8a1c1420c2ce2c038a2435f720a94afe9fc38c80b273996bb9cd602c658b3bd5af05fe5c6cbcbfb3ded5ee8b5f9cc0d00a5574c73acd6c3b6b960693502d2d0852d4aaa2fd507c4a353dce6a8288fb3d812244a035edaec68c272c9d868c1110423607bbb22522c988ab827d7cff7443c847cdfac10894843a4f17053718aad811bc1a61613fe592ffcb703ea6b9710e518d3aa3572975a51fccb094608f6eb8c09558fe95ca8dd2233b331619ce0d9da908662b526f849f9bc38048fac7a2e9aba9bebc6d89e7fbf52edf10e3b732db79d41caf761f9adea98e0fe6da153849f7f0a645c7b0a10bae668937c73be38cbdb42dc764e5658dc2a6fe4788db4fd262b42321c9f3348afc144c633a336394ab89725ea9e13256e20abea068c1832abdb02b813edf8992831fea3705b9cc17e0374e9d8346ff7ef6f49a2a87df16aa6a104caff572e62e32cab8dcd60d94a4242390418123372afe7ba96c5dbb7581b0701b3312d15abc896c8ed95e8d1494c58db1052437ff7852ac05f4df2a53a0658a47cdb889b388f4662a770bbf7527c54b8e7130f9c4e42d3ad470a1080b272c0f6625b535299050685504bc8547a34dd58f49bd62f2f8033a87e70c70efff17097c0258962aae5d6fbe7e8f5f248b2c7764bfb9780b40bc9c000cd1f88cdfdf79eec27cfdb4c33ac3f1836d0b70eb278a36591324e8b669d56d41c39bd351f7eb6df742b1f81b9f85eab1c18fc22452fd8d4c3373cece8902675ea3c031bdf92da1ca9616e213dc22c78365abfe0ef1fb0da473df09f5a516b9243e824a7d454cffe7f9f9ca3a5e0712e1ac49933bac0ddf879fdf08f5289853c8eb51b490eecc93ba6f90d8326ea2cba934636a5244e9eeb603ce7edb9ab6cb424caa66a20d8d790fea77188bdbfa2485ce255b825c4889604c63574817e574418268a38d17c702c83a88666826760e26095334ad3394303696f080f1b8a9975d38314e9943c57e088dd6ad281d3c18ffef5a622ac84df1b4968c3040f0dfba694a07993e5adaa80f9e79dc0ed334c05ef609370d7608b7ea0b8f93041a2fc260898954e58b22bff038dd4d4a05eac616f9e4823ad62991448d5fbc420b94811bacf48b0ac4128c92c1d614c4e883e75800c784b2ffebc4e3fed4164dbee66bcb053e8fe36ef70863923dbc4861840191a7210650b57695510141b9fab47f9cd0f8359ccc79a256b52005b0d352555d549e4f92569dd85ab8c631b0005eb879fb592eda39b1b2541c6013e6576daf5dfa147aa42a78f3798e4b9300f42657211fe515560a6220997e2e743b8bce69317db2cbd672efc3a632be8c3f5181c5bfe8f8e328db47e8e66201d1395f0b06b9a1557b47e51252cb840f255f93aa480b3cd9812e6f576a407ac6042cc2b23a7d90b24be93c4b191a92a2a4d6eeda3e1cc158674c3d03aa82fdd3c762284ef01e8f43cd44c798f37ebaeecddbdc1659c13b782ad29185e5efe4410e285ab893b66fdbaa2ccc9ec4cea885a0d699531fa7bd1979970fbd2d941e99c6c1a5a1943df85f3bc500060a9b05f878f14bb441d313f70058c825defeec45d1cbac1f0c2f08e8969cfcb90dbceb77623d343e861333c5ea7a3e0b43d888ac6b521ac6daa676b923cad02adef260108d0cb55543142a3f609d53703d21a135157e4ba5cc70da3172d9e187b050503f7e570d724b82f4843b41063a357696cfaec692dbf155604efe20288105a8d9fc6e25fc18e05aeac473572ec25cb54a72ed3e29567bb68b6618eaeed67c723bd8f349f380f6209656bacd1ba14407ffb18a3a3fa40bba24e38d55401d21db8f048ebeeab5540ee7e6f4bd14b5597e4680ca372e2afac1e6be279780a02ed59a1dac5114772792004d2b9075d6a5a348cba8df9338bb928ccd7604f7f78972f82ca663551ad6fdec071e04bb1c4fde76fc8e66e27bc2f92b4d6fa88f32891ad946a876e4b0b6e79f4eedd2bb6fe3d3f59358685d92bd4afbfdfcc4cba5fff7e2e3fcc1410d63c28bb35a2b34e6560494eefad38dac7f0bc14398a886d9f46d5f5c95a0f62b2bd694b66b6d7a30b515ad8fecf7c36074d12181580087cfecd9a0caa522b508a7e4905d6be6e782e1814c8b7569a2fe483440e591d5549f621de309410add773c29fa140e3b87776c63f28371abe64d8fb0bf4b47068ad0db91f3c083c461f73bab12445c12a9c4fe9397703ee76c3896dbbe350d90bbe8cfcb001d825b01cf7ff2d0ef38715140a1885649b9ca587b39bd50d625a026822bb39e60aa35bf3845a975e741009b47f52aad3e57a35b26518e0be7168a89dd7bb7b3dec2c9431a065e14a8299ce5b2660ac271458552b67d41f53731a7b103220cb2b98fba3b561603b4c20a4ed0501bca0a435d37414d01c263916d1c66da70caba96f5f3f58cecdd5fe1bdb3251dd2b55332204cf3546d48c7434d74121df31776c0ac88abc5a55124694ea4fb086ba6a9e4c63adac844904e45119efbfbaa9fd39447a5f0fb498d1f590ca5ace0602e3367f23ad80bef6a8b7209428e60cdd29d8d19e0cc64cd4ba41e32463d1ae7eaf844baa08dae679522d22316b5ee2bb3634c0011786e9ffe91e92c1383e62373de39052d7a02db58469fb39120041691fc8aa69517cb44bbcba2f47bea65554419d10879fb871b1f7511a101f8bdceb4ef77780acf40f43b86d061cb894f234c7f034223128404a5634869e361d29f9d3ff3710398419a102ddc701489ec38da582c5235e9f54f66da55411cf8d1edb9fc32453c7f5178bdfadf1572ee88b357d70a09aacdf39c59379053f267738ec00b311c46004ecc6081cb54cef45567a76617a18d9c33dedc39250028ec8c2cb412dd072d185b0b3e56b19c9ca1a9a498cfb7ee80468937a623540e7caae1f3914494470c803305e6b4a7b5c194ecb498b301ffec2affc98492f357f2a0c8c336f1422b839dfd31a376cd9d69bb90b051bccba21c35f88fe6969c1a5d13f025f93394348b753da9f3293e201eef371cc4a2b43f9af6ebb54e5cf33193129d5898cec1dc2ebc846e9b67709f48976201f65d32e86f98fa7f795cde80190cf642e9e85d86d808c5cd73c1089e3889b6d89715ee4533ca311afd52ec5dc6d63678222ea1a7ebb43ef1bf17c7b7f7932140b36b868c028610906f52b79906b8036eaad9e881ecc3621f914016e0685c48bd38f805c261a78a7fc82a3c1d9b5bf532814cd36909b18d87f99905eb628039ac46cafbbf9c28cd208b03bcaee9e26553e456139e48034238d72fb384a025212eb3f1b993bfdbe11612e40431cda5f72dcaeb41e52b8a301fcca1f7b966a4955d53f62458fe01b9596d739fcf01709acbfd429fe608fcb64294723473b976734b89fbb6fdfe17c6b18a15dfb1e1374de7bd6f12b9c01afb157bcef5f7fabf86b2c6c7120c2a9b607a5f3f07e7aeba930f99e735d1e3d0ffacd91093f57d8bd1f76ded05dbbdeb46526185a6b2b1c284374849265e6db54e2ae62cac981f9b9c3eb57b48dffa2963cb1bea8db796cd179cefb0d61f268b2937f87bf11bae2f3979d0a89b90cd59be489ce9d8ad843ff00199675fcbc9157a9db03a35cd7c2e5c9ed96f03570dbd415dacf0bf030a3ab6a8df28accac25b3145ef3bcaf049d9e781e75c983f4bcac28f4ed66c4a1e83f5af5e7346daf689759f95e08e9c34a33039be6d5cfd439e051f2faf17b000392e038cd5e4fefd1bf88974f436a8b0be74dd7667fb69f1c46014205a3f81634ca47c750322294ec991e426e761f9c792a7debd2ba59f47716bcdb33510986b28dcb207dc8e7208250728ed1f4846ddd63fb71ec8466c5ccd2665446871287a3bcb170c0937d4156b05f3942121c3fa4d1a3084e907a5b85963ff7208a41b245c61f31b5c4bf04d2bdb379d38401263c2a56f59b6a1808eb870e2aad121d4fc88dd564042211af05b1132926d94551aacb4e862fa81a8771f5a4d42406f6d1afd001081d53ddbd36b0413f57ecfd3601e5eb37844bebc3023ffdbb6dd908167ca331592093465df3411330cd4055a67da5d5f72022d74b8cb87da07dfc07061559dda6cb846d92aef08769263fc58353ea459c13ab561d8e2c66403b2e42b946549c31753a9113faaa6e383226055ee17758ce09edfaaa7220f612ad3d21fb4e25aaa136954de7c7b8cccaf2766ce206c1b7a6fdf5ef8f025601e91b54d36b1e194a9312c5a3600554ee205c1a42c726486144a208e4ac0a23ca1a9d4ae194e64fa7156972570a8bb45990ff11d79d56692db2dc5572e513f4e30c9cd412cdc70739e56708177a617d73317db660b796287ecd4a096a670f9cddb5efa4c13b577260d02f583edb7c24e1f90a70451abdc8812cf765f1da738cc7b4c9fec52a61604b81fad9f9d237b4ceedb93332c2babb306deb93f04b6693bc4c0631fdeb094bda677d694a9e934cb7175141790ebc3f43562cbc35240af4d45281e00eac1bbfe316fd79f17810d3138068b75169fa3bf1176497c4629e41ada37402b68abd31f005fff1ef5e92879286f4b9fa609451fc59be2197f547cb6ff76a04fd800cd88afe74f7d6ec393de833218513f58200185bc652d617d7433fe2b32dfec1145ab534be337b8f8b327c70077520884e42389f47bab8fec6b04a8aab766e99918032bf5f52c59f612debef8ab4843e7e72a970dbc5543770334e0ea88024b9c8c96586f226a0e1d080c764d63878e5d3090fbd8723e0db2a5749277995c40bec54adfcd44ff3fd2d407b00546c5c2e955339427b3519ea2653ebbc1db15cfe17f317689c38bee187893c5d892ac97678bc7f81ad568001fb2433f7e5c8f971f974ad46572c0a3ea274099d6276dfdc574b9a80365777619412494e7777891982e80618554fbbb94b245e9d17b55d7f9d2988a7539d1fab83939dcdb8aade43d7ccdf2ea51947b73efc156cdef0960ba2c80eb633beb5075746ec9b34acd8e8c7b5fa6410f9b64d8a3ac98c5fb31142f00479a794f74f3d84db1cb5cf9c3338c421ae6e297aff83f5c3e188391c41f2855ca84aedf3bc8a22e7593a3b992c88dcdeaf6625aff956b6fdb22e24f6ab44238b9c41a0b5582614d553a0c407fd3653eec386a625e7b0384dff0ce1182ad8f84b185b3b2cbf2fc1f00a4d82bc5523be31beb91cd5bad8989fef5651ffab904fedb15f10ed599b97d72cde5848e12cbcdc8b31568d6115245ef4ea61bcacfc08d9b38854c7f6c094602829b7cce6df6507c439b739a1b180049ba271af8c6adfcd40a76fe8439241c93334c4a4e5b421a3196e64cd7be6b843abd18b8be5535926951e77f919f5c623c98cd390bf586b6b9636b656d1bcaef22f41aa298ac6c470db7894e83baaef095b222d9a3efdd72588372282a90c3cec687624f95e1fc5f1b668a3109c91315134e88cef21efccf4d808a7e93a576039dce2272e818d9f2140754cfaf851ff802890902e99d1ec4d684e1d6f9780212561ba688f245a07ac800df3db2d3860c8389f20c70470a3b0a9ff625569452f916eefad7d3665e96326e2a6e1dabad9ac11a51f0a49fea56a553ddeb59718693c1b43cf114853bb271c42e5816a5c777fe1f5797912014a5e93a25405341d6bd50de8e97c0a996ab1c18995949845153f46784d9b9c2844e05cb764b8eed252cf4e079df6a9273cb019126d60747f80178424d5d8421a8f94be540416353e9dd4cdc56db91b7a8d832ca12427a4910e24a638d451fde320a331bed979b5d4efcd319c58da9ae455b10cccc4abd01337fdbd84efce9f34e7c5c0679b036360e814d22d88ef3e50b2d26714e9421259a5cb9478cb8f83c9cf223eff780bfdf3625e19ecd883191a2f07994e6c7b53798cbe45ae1113e94d306935f7580197cae9826efaf4c93faa7c5a69090cc0208957bb20535366db2d57798ddb16a46281d68c6a53e9329ae661cb89c36aeff3ce0866c1c12b9347a5911743b4503cc9e8021339a6379d7110002ae5f2131fd64868bc2c7e0dba75e3fbef2110141e9cdd26ee93257a0ace8457fa1b7bdefb16faa5515d814595c70242cf25ae5c9ca7bf781a3fe05a55714d7de39bfabad61de1a211d91204d7b33166299a27312d2cf5398ef73292ef18e172c5d58bf71322e7fca41638ac5289fccbb9f152d775f8c2e88312c3dc3d03c912fc17820902065af3456a02647d35ad0cea538b489a6095834d807f3894a2cc6aba6ee1e676fbb1a32f7c3d01542ac4a6b1552670e244fac1873907c8083ef59ebcad323c05a4896074c4d3aa7285a42488c1e36fa16f74187cb6478dbf39b2f4dd7f2a36c096208ce3a7b36f2e2772f6f90c2456131cbded80cec46eb64f9dd0a5b7774738845ae44c80c9404078120b8d275e480dbc5a943d1bb88f6cf470cd288bd7c7389b7ad392a37900daa2abe517b4550efe94397fd9638b60a0293e8d06a106ca8d5c7614b3b33521a2c6a5d1127c4d4a2279e1aa149cf4a912ca98c3be9cc5368e1aae50d2516bbeb8e02a32eef9484f547223e062d8543455c48004285cee8b0b0d44dbc1c870a07dc59c512e94370b71ef59399360ac347be44fc3731b643c9ecd43b1947a7040d96972fe0e093317ed2eba1f5bda4d66f301a1e3e73aea7a773afbc0bf52108ef4f296a9437d18b853ab19873e903f6ecf420c91c3b93ee10111954f1c48b237e80137eda3e8244e757553256631c3a6ccc98f9fd321473ee5021121d5302f197165b30b33a87abe4f3bc3023b0fe8594324ac818c5369869404ee89d20a548533b7985f9e58882008bab5a640fd7342746f05d760235e907b56ed374bdf7fc0e2555940f2c6e6c1ae456a6d69b7725a7bdf296866d951c6ef91ec080e4d0e5c7f307a1ac07acc8ae8a91dbaccd2ca772881fb747203f0117806f94408d5e7c69714fa55a0a96d05a13ddbed4940f4deb4d92503da10099234598c8604ab264b86df10e7f23b5c7526d1baba727283eccd229b5c820d158249f30bceb5cd5cd28a650a590debebff1c75902407b800444d32039d138edbc44cb69038257e8c345f8fb95ce73f36854cba29558c343ec01db812e57f0fa02a225b8721a829fba2b2d3c3043d37775038bbfff5579ff5ec8e59576be9a23d850563ac2c9a9d9f3a12c107c06d992e467a85af9ebf0577f1adde833ca9af74e0528e6f4afcb0a51d5ffa8bba01c22ec6ac51824f910ecb8930582bf7a7d3cfb203cbfbf9c37a75db79c2663ccf0ae1701d7b385da3b5fc8aef68cf54ea2f8870ea2dd7d227d044bbfa511ff475adbacc71c07ee932170d819f74bc27b7f45e5333e442cd1eea0ec6115873a4ac15f2dbb1c60e92e64ca47b784229cdbcdb9a00cc364d74ade8ec537157b492147149619577681c3b7ab66f24b6c10daf494fdc6f84916315939db7b8e4e6a806e0893084f325b857b74dd9c808b27a314a5e97552b6688ba1800e9663da0a0dcd414cee8d094ed3640443329a5c33bd09e51dfc1edaf96ecec548cf0612f901c96e4d2f36dde0a97d53bea65ea93591a1b014764003f85d7f3ce04fdaffa61efe79ed1886c6b77930c7cb2a8f1f0380f58587bab92f7ac97d871568e49ab800fcce743627047bbd2a782df8b417ff216ec94c00499d5a5735bb2156f4471345dcfca0faafaee4badd4231b5b465b2cf8d0dccd145b2869f0cf43e29927a6db0fd43cdc01dcd7db0d2b604bd5f7acb90e87f781ba3318b29a9e047e1f4bde734d136f65d9f8c7faa0c6f4f796510555c13fb4e1a96745172582cc78d47469c08ee23d696bae2a49e80f88cbe6d009d9b04cea6a9440198aa0583565416e3bf4fa46e7118dc69a114861ab279d0bc4533cad9150cf750920d603ec1db0f3153e2253ff1557b8ea494912f979bdff552618c1997f7ef9d6eaacc5f64c564f3088c83c44736c0e3100687dfcb4c3b31e8f5595f0530edecd740fc781346cc2dc3064f6fff80427b54ede4c039a5ea9a5572ed1ab58d989973f99e12f1d13c36946a83292e64667b33a115a5bd854f2d3f219a229dfb5019187a6714972b681633924ff3804a462c5b3a0d885bbe8faf01b46d6eead66d61bd70520bc59d3894243efa1cb0b5cd5149ed223fc7488e8b6f77ada94234ad510a1119a71730d817213b88c9a7e1f226b6a5e451f46c7853312b8d543b5fd8b4d880a56084a4eb4f262900a87bf840e605b0081cc8de7159a138c7c397f42b893bfe31901908e8753d3efa1b9dd487fb9d8af7df174ea221bdde75aca1c51a163b6bf74314eacf53d132b8beb49d0060d097c6d2cdffc903e1d449f479e6c7cf04d72fabf0651ac959c0121dcb07c8507f5c980b241bdd154ae2cbadb2d5a625bda87d1eda5d7fbbcfbef40d2fa81ac8fbccb9551d8fa00cc25807abe852a850907fa0bbca44b4577712d4595723cebc9fced4f8b2e2c6a987f92366d142428e29edf41d95a241cdaee2c8045cd6dd9339bd17dcf7e65a9bf36dcdad4656e64886d5036d9e23e7e4533a9768ca9c82725b9aaf4fffefcd9f70c2a93ad605abe03b91f8e9fb234194d2ba8b8f412da641b8c520cd3fea7fcf2b7ad12aa8c027f147e7710f848f4cc52621c1deeb0f3af5f47110699692ba365192c2184fa5ea3df4fe311394a797e772677bf5bc7806de65cd90b751c42116208f419c8addd3ad66c6c5a2818059dc19a12b030df7df8c8ba2bd283430daa2e9869c709d19e650bc062a8f49d43aff01814e52e7ab0fe80e51e1d088c5cf5be39b8c92d869098ca0ba78bbc584c7c6155568b9d2e6095d7960fcacb55319310e4951d118a17a87e28f1ee1cd038f430f26597fa7c689af01c6350ec5d95b41f5683339588056e22e389408d0c5b08c4b7f5a73ae72ebf889d2793d9ebf020c1438ecdec341e3c2029c3749a7aa7c53c84f4208a67483bb0b4d61894f0ea87969f3b40b77ea34a64e08806e9d85feb068a42db137039db4fe6bfb1b960778bea6db2b8133e328a6346a146f50125d788e0829c25bce898ffc959418c40b99a209a9034a85e330eaa6a189792f644055fd0975b11bf805d0dbd03ef122b0914698e4ec18e5756b4f4d8d893e2254559d716b8ad929bb26b0a5d52c41e264b1001bea88e12ea8c49a6a3b1653665b1a1f242f3da517dcd25c07762d34a3dbf617ded730407cbc6a94767a354f2fab16db1d49d93fd1574096accad9ce19ea5b5015d461336bb002edb66e8349d75505f05b6cb98a0d6c6b92d222ed05746da5a05705f5c8ed5711f4b24a7fb2c9e2e1cd170849d9b25d0d93d4a5ee1e88d7f58b0fe123b8f941774c1ff4d49fa9d53c0a6bea33a20dd024b883f69c7f8f26a87fb1241a2d17a277ee577f4967a264d7f8bea7b7077b63d906a5fcd5cbf4a7c297f7c6423a12fc36476713eaee82631b5d765b2fb9c9a664c020ffb7d009f99a6785d117b517dec7a11430fdf94eab924f46459f633b9dc89ad5ef407843642d3f7ea57b74ed047a31d578f3b04be15c0f1f8bd294bfb57facd02b1ed4a1226a4a17f9c2f4e1e66c5d6071335a1a8db824a5efb91340da9dff44e4fbc4ede8daeb446f91c43fe26d2e36e3e62acecd814a9a22e78db7feea60c4ab2f68e86c67eaab90621fe657a5e3f9c58ed13c6193eaadf0058cc9377636a284a9a2cf6634145d7a3300bea34995d6ccec0fbe342ac1324eb2990024fa7e4272581ff18b7050d25902270a7519044a42906a40228d87cc982bf5c1098a406aed2a06f3238b2477eb9c3e5259141564720432b4e8d453c928602b5a8217cbdd31b59618da34a01fffcddb9bd90d1cb9faa577cb0b2ab903d5e42d29bd19029cc71a3e603cde76260e7f4b1426b817b30d6477085e9ffe6a47291ca74656d53825ad0e27f6e3b9141118e6ea297add8a7913aac5a334ec2035c46ec501cdf273e8e0d82cfb8e52fc48782527c02857564d8f6063875606b6242cd170704991b6c312974888a312452358ca528efd956683ba52974ff5b41b048da3c11179dd20ade0f07a7072149db8fa02fe5ebece10974f1063725ac062d0ddf58bd0910741b091da250cf782f0f95de4e85916ce885db3fc5795d2d3eec62c0520f8bf602f4c6b2e2907b9b535d603fd955b9a338cf583a4ee88450293695bd62b7c8e3d50aaf4461c18e41ae8a9eaee14abfdf70d004596205f991b4cf3dd50ab6d0ac87249220c9f9227b9980af50f86e534bbc6374205507d226dc97aebe22291c6009e916e17177d4a07f65c2c93ad115b0ed8020376ae86192c327adae6442169652b3a51d25c72155b1f6384ea4508858f39c4a1dd521ce0d585fa190fe30f521f663d4a3425a08f26753c236aa31a5967303c9c24224afe18c78e144e7948cd24377e759c0e446869d3bf0796c49b6b98aff9f29cd794dcc9a8a31f1e3f700e214494a4ecbe1ddc9dbe5e291d126714b3c3f5ac05eae0a8c08f0b4ef741da4784cdaad0012626a08542693717ed1e2be9c1738b0fdbb87ab83d3b3347113474140ef5d5b210d2a23678de20fdfff31945311e638168c9a00c4bf3d61ea1d61ad18939ebbe77e714ec53864cd20782b0ba02406af82bed261b05db46b4f4baa708bf776c925cd12b417a0000c9d6734051d659f8c4ed867cbbd5bf568bf9d623de25c7a1d6974f8da5fd1c8a48b71c7292751ce63a8ed24724471bfac0619fe4bf9e3fa18f00bc4a883b0f5c1bef1c5bf7eb03931c55a9cd20bee8819d8a23c7a47f56f96eca6531e34d2f0385a846fa81e76ef83d639210d6c1a54d01e8835c18b9ac7a3ab6aae03c697d9007f0a1a3f16ea3f828fafdc491c23aaf0e81db85d87199dd2431b53d9cca2b33de0ef5a586176972db791b021b0719dca2bd56fec3669eeff21832baae8332db3b28e3912a51a68185c5dff37ba809fd8a4c3f74d506aaf9f446995d3eb3b654f2726e01b4a5e330f07bbe918851fb305bdc9e5719ae84fc3e744b6e502e8fa476c144bf9545fd3ebbc5c66dc2019b586e75a04781f04a6ef7a1343f3953a0917a07431e06c9c0e227ce94ecad7356b9c434f7792599c1f29de3f9911013d1f7c0ec5c86913b7f008c7999764bcd503d0e0329b599ca2af6c4a0948b2890e5640848694c78c78c515ea3bb91d32613af3d70ea2e2341d1b92fc0c879d044a05775ce0e177fdc372c0758240424957ab2120158feeda5666df2f234fd61b3d5c5dd2b4734976a4b36f6ba0fc547d31a24eac8c27d57c7ec51fa53708c5799a594a80d1fddd0b1af24a33893e32e875ff339adc876b0ae34e43a0e3071f2df6e282cc462926c3935684336caa32d8958d070b8e43e1a7f0be03a7c950c7a64e3f3e4197c3404e3a017a82120334c40e3308bb7cbe1cc3670af82adae679ef2cbd503ef6c946d0eac4222ef7391c5266eb204e4064df4752ce941640a7acef8c9f9b96d0c3f9d8917a0c528fa96ab884a158b27eb6d765686948dcbf020ed4eb8ee8681dd6f9c56d2384829191844b60d1109915951a7837db4fd24aeb68cb419de60aa08e5d83776be9657ebe1bfc7b1cc99f3f8bb89d9720b079bf62f992ca0aecc646d3a4ae32259cb2a5c5fd437c19a5158d96a396b827b9b370627b2ae1db18d88eca20395ddf55f7a617781e01b8f79a15e84e256badac58e87506e03a0f2705446b9e0ce00690079fb4c83e425a630a1f62fd30644e89d6e35229c7a83b4b3e127848f637073bb6fc6c9e4650b21d8d420c47e6412e9fdd9a2ed8911b16a0dc4ec71ee169a7dd2b1e4b5d765328492b1c74435458bfb1829eaddc433adecf9f941a7083ff489f7f3e43ac26c1503c7b18319f7ae42f762e3a0706798b57b858dbbbb0cc89ab2a56c68dfa7493758268fe62d1350141b8070b778103fac081dd78cc4d785986f9ebcc3d41f639dc13a153373847012750af05dfc0b68dcc48658cd410ffa9c518125f12e8f247bc7c7b1f72611adfe7e81b3037140103bef3c5486beafeb36e6afdb79f3a5c221e03a1327332041f1ced3e88e9f2d8c534bf7c9360f6519b355b7fd30ce7e096c967d4bc5703b543e622fb32032c4d352c81cc0c5850dce951b77e9222c634df20bca38d4938b9e145231436bf69a7482b6d82c6d35f491d35d660c45ff8472a4a8f1fe9f9e9a320a25bd35aa5acfcd8b79a1a9a2860e33cde23c0d76c20705d3edcabdcf26e9ea47e8217d80acf04325c3625f3d803fda36e9a3f4bdc34edfec99f71ee0846fc8b78163d31669383a3801e8e498f9737b40363554130715db27557f0b94a09fd7c7391d7d2a821d84250a85ba503d5725852fe28c4927e61336346ab21387a36a10907e57185ad82dbd0e8deb6ed6dbd97eecea58f8826d2e6936176e7560013a5834ce95eb118630ef96388e24425e743fa876534b1beaa82989f08dceefe39c0913aa36a3d2c994a2466f5e9a880087160161ed612a1c93fbb98935c1cb7eccbd57df7ffa386c11e6102e87580c7b1a2499dc754f4750fb6b09977722b93d3681ec3e0f10ccc162d759a6976d1ea6dc91078cdb8c6c1f3ef688241372a07159bc3e9bc5128ceb971bcf23a90069577beb4f36abaa65b0a677dee90b08c4acc2be05e3a4252777a683764923c13da602503b1f83c90430afb475eace1296ee670a3f34f6726a9a575e46af2c21fbf2bdec5d4e0abc43acebe18821457cf28a8ef3c2d65574fc1c86a2da7b608443c7a7351f95a40f28e16e5be0e137e66d172a5c514b10dcd2792397ed5c3638a17956d72bbaf160156247354c98adb42cac653105a9f51e301231c88001c321582b95bc721f7cf95f751e0007acd7346a06d03e2fa40eeb19f17fff117b34f5122aca7cfe9d561897516e262fe50c629f3dda7622f250247881acfd01ff50c6150349c55139dc69f4bdbde06150ccd85486ae31e5dd4e0da2e0702d58db8dbb6f5c4b3e35e593895f201b1c2a14d245b0b9bf97a579267d3e0cbaee2146256e5e2cbbdf55c60bd5cb61ae0f914073479cb7404a4acc4978de00429ea3e1d1159cee7b1a9009e9f384aec953c42850366cbb839da76bc4ffbfe2566a77e0fc06482d0ca7d1fa845060e8c9e3ef4e30f9c7f6727533cd0d7fbbe34aa7c7a08247424e80d2f468500a8fb1f08f9d78c60341486ff2b07670cc9cf601df3048fd3e60e14c2cf6faa44fa392093c79fd74dc9f5aeaa148750b475c2188580ae28faaef8e4d1e64344ee4620cbd993980c9ff1d24ca40380ef885273fd237509933728a2b82e258bde0f0c82f93e55bc6231e2dcea95a3ec71b285cfca927197f52a982061073f8ecb873954678e3435b329b3e69f5aea00e4b0c26d23414e40e1fa1c73c326811dd1822618fea68c3623e420938333e13a5f83e47d7d3cd245233eddb5356cec43c3ccce52b2855ca33a4e81b265570685c042a73296b19c8498701549a52774548eff5b160fd2d6a1611d031a99b1dd10b8c68c7a0b3352a96b4f97b55e5964476f87e3cd4b1f7f5d0abb1116680fdfb493dd985ff3cfb67707ca4ef741cdc79fbdc4a608db9d22a21a4342047fe8a6e97a3bc29773d214a9512830ff7bc266d3569c1a900b213ed9e9fbfb69e5a3647dbe13ba691ee8465cda0fe5788965a75e551a5431364d369422cdbc5ddc9211dbecdeb883b43cd655e7ab3b0b46c3b0b308b68a98892d4e6677872534319182d5b7535271cd905f25921c3e752dccf0c8b2d8bf1723a9e4930540b416460b3124bf6960968e861d2fdaa2ec4ba8fac522c9cccf5064078d61471421d257afc0447cb9353fefeb2b76e74afd4eadd00c1d3079b2f85bee226ea103d9cf1591922390528d7e7034ad0b0cd277549abc97361195d9e371c6640c65b67f4cc32204a72dfddc95ba8a3c89c8562fb286127c2cf77b2c76b74c1e845f37916fac55de8d66c9cb0434da7ce2b4280959ddb2ffea669c7949b28119c0efc4a56c5c415259fa440c8d46ddb71b96b42b6f7200c58f21b7fe0ceae0e3a472f30555d60c2f6bd6f5b094e211d89fcf56233895b3fd237076106d7cdb615b504c9843fd558f1a4cdc140c73d940ead368a8065ec24ffce30c5afa60bb36af615f198043091d8a464275d5c67c547ea1322b3a547b3d667f4d1b575533ff8e5573391485d7223bca1be960940a0a47118af6cf1f382cdb2dbd89bc5e443ae01653b470f5993cf518768442e6f54dab9f67b03dd9b989202ebaaaddca6a0536970b4fd4a5906562dbd79a4021b0047d8fb166da52d7c2a7faf635279dacea4eb335083aa343646569ec9af9290427ad9e76ec32589dc3368697929adb4b44961f13ec3197412398a695d112b27e206f25081a6d0f6ed82c8440c950da64f180a0985ee34b5362812694680dc577c611ff1e9d007cc02c6ed52a117cbfa6e968993be4dcd5eb25be525bf2518754d533170779028f6d56e4aa6f0835d4f7a677cf0992d862c357729451f51cf42a0c0b6c8232a6078a8eb5b7b9e192a07c1cec5a1cc69b5ce2d85a17504d45574105a2dcd8220f66ba872669749ad8e3a6a53a914d8e529545b8dde2a8283b9cc43360a062ad6580f1a1c7ed60382ac2dc39b994d2e3f4e66590b8c2acfbac36dd69cabc3b404052ada8eb506aea67913823c0b5c790fa54e3a6167adfa184e48c21a97a1a9dda398bc94f8ba0997d0891d770f5bec5a1f0ac02e1f119bc076cf733289d906789aecc2a390a4be1c9be0571efa2c0b682cad9b16a8ddfa3528d70cc81a4a65fc1bcbd0b49a12a8ae6f9ffc5c8d36dbb996d361ff44276ab3580561b28ddac641a8886ee7b66d0fc209cf5b64f89ca7f1be8a8c4afb7fdbc462adaf0beb186b098ef87fbe6c80f08fcbc1d6546cbfcd5de71e8b7b03e346769d92abffadbd7b37369c06c189a2744d40cbd8e55712d5adba302c03b93dbe253d4e251f469fa1369b9b658b326cb962489b69305577c32d5acae30fa549f862fe0bab9d426a3be1dab798d45d6af726a9adeab8034182b739eecd1f9d2c31e9aa0b61419508072dd793e105a34c8c18f0f1233629b5a680c3a0d1aa580830b31aaf6970b8c31b6228998765251a1fbf58772d81d9bc0d77818a283452ad314a213e2440144bbd136a13ba40e662d6163e423d9253b18005ba133e65168b4ec3d0846d95d2ba90d1b2e5673f1633c81e79c495f5363c87ae50ab5156641e5c2541db31216f5c57dee8630f3632eaa842597ce051f792095bc38c4ab68872d04b125122b940d22fa66d04300a780b7897c5f29afa7ae83dde885deaa0745fff9d5868faa6bdb40a7a9ecd51fc3c047d74bf6db3a67087c7e2427ccec60a1d7a3b2aa6fd421e338a21b48f8dfe5d45a44e4cd5f6fcf43a861e2c3874e37f69ba37bdd30a79b815456bea4336ad94847dec6093b8b18f0fe150efb97c32a97933951580d1b404196e535575a5f8a170fd5d57989034884b4d9ad7c01c81ca6c274381067df5af63901c13a25a2f4a5823e235c12c362ea22df0e4107ff3a04ea320392c9eec005b979650ce5d9d88532fb500a4c1dd22d1998bcbeaedc13e81cf6b49abeaeb251723f8b3790a725d1d60d2c91dccb7183d2201de0507e3e26f7060394d50b52a98991fa139576e2a6def5deae6430aefad7d3e35ab0772445dcd2373fa2ff56bf513f8b5320b185245f9bd5981d04893c3750ba7ba4df6b0d1a19b1148cf7e341982bc05baf579aaa6deb3227e6772d62f76680bbe0f25f1c0ea5c109dd723e3489c601002704e224531cb57ba92ff3031e7debfb67c96f753f20770166a2e8775e66474de39bb3502e7dd39c6f5aafeb73502640adc9cb2f6fe28f9240b799dad31f9f885348c0af9e863283b51e324d3725418aa334ae47729321ca18138c52f1225960651662c1c5ce15138802cea899d09a6c77feccb6d6a201ff82efbad1d7002086fb1b66ec226a7215430842584be154acd3508a4e90b4ff3ef5aca37088c13987be810cb8bf5228ea1bb85055c4c011bcecc73567ea6b1f155a53ec9b67296f115f17c2a9fb688e55c2cdeff67c0a9a5b5d99701745cd3ea6f3332c380386483a5b57c73a28a3479ea5dd792809d5fdd3a3949c8a889f7adebd9d59906220849584fd4a555f817904a503e66677f83142e5ffae2f21fb90290e79756e50da54a918363ebfaf55191153f34f9c6ffe32c4e54e113ac017a5016c9a52d93909c8eaa90b54551a8dccb7c3bb96ae03194e5bf92b843b5aa396b5763ff473ffe2799bee642a9df83bd1a2600ddd84a03dc9a65867a8e58b964e8f73a9aab69737bd497fa1b3c017edd0a05279f0e4c0ac2fe4ba2e89364db76ac7a361b2a80c9d2d8943ce0c465e1aaa7ad3055c58f511bfd5d8606b8133722cb5e6a3c8484cd051157adec0e20db8d0a6767277f31891ce327b8b8f29ce7a6c8c45e9bef0dab2cf1e8d9aef20e8d7af7c1ce6662c99944806e53a241e271027bdc12e891bca6054daf2de8e5354dda6c77c2b2e32a7c14efba26eccd620d1977cd872f800ba950ac6fd46d7133c82bdf737506b24d9b691af12e4de67cdacccb6db6c4bf18e324b533696142667d04d2add12d358a247f664b628c32e5c454ee6b9f367379be087ae2625e65431ece2ddc86dd2085cacfed5f388b51f11b1c1998ff25582dea23e733433e3c26297938134884d30c186c4ea1e5d749e7e7ed7a466bd637e3c14c4dd7c15b9ce860737c3998aca6f58bb38923b5e9ea8dc651beea4e7f8df9ba43973416113257f339542f4afa7fa19325a9dd0f7f8c1f324ea44ba29ff01565442afc5cf65f18b9d4785333c0710fc1b9f8bf4852d6f1d933a19a55be5e0234939336ab2799f8b0fc61c270980da8204a1e5d862f835ed12b474f0d20ae52d7c902cf07dfb286271b5a61849f237d16a993ac809ed1ae7c3ae65e187c0b3d6f38e39cd4e9b5fa37b2cbea2db1ff2fce841f06c0642ba88327a38ac5cb5d8e612f96ae92d1d8279b88bb44d5abc1e73260efc6c539da333cdae1f529a7e6d6f1c2d15c812552faae4b5b010d26b75596f84c272ff80f82d607bdb9e1fe94324db074a9de85e87d049b8d08c68ff06efed3323c9f9182a2575ea9a2f8d54fd68150b7df1293203c2b196baca21d302ab0b79593d4b5220b307225fd03eb38d16d901aaf4f5836aae51b484b5d86aed938f6346f611c481dcbacaf1aa83e385ec69c949280db7ed706cc9e111fc6fe7bfcd061e66633f90f78a8214ccd5eb1995f86f1e02a615081a7675d9dd78d3e1ec05bd39905c1c9f4ddee7475d2da197daec387175119bf42125f38166219052fa5c48d57b00047a3d0bda541303e031655c90b9051449fb2aab0ca1eccc6a0ea83a4b103a33983e9b7df7a25babafe6d49a202b02cb057794b6cdac0dd1cc59e2c665ab989921785e721eb87b5f27cb1c88365e576bdc55bf92d453a35afc75674f93d977dd0d76fac365a0ab9b6bc4300b4a9e75a3aa1d57a7582178f712581263112484bb91b010165851c1e36c28f616dabd342ff3a1071978c5a7804d5b3f858debea31ef6a795015d8f7881aa517320ec9af8a2c9e14ef8c467e63a0ba6c6fd0aecd14f7c28e0ee35d3ca485f5cbfa6d902ae3e26b60c39f999da78f87de916652b7f7c7a79ef6f3b8cd202a33f3a21da8a8d06d231cb67f71954fdb380dfdf2fc4bb0f53cb7137b49c9647d41148d9321e5cbf0b9d060d05029053483cfa5132e6642b0e21521c5d05cbcfee18c8456327df9bcfaf4454ea0c1d8eb541574182897265964d0d465566ccf6ffb1e6f11cdc091b422786580c028f4866f52582d7a8d2a01ef48af154401a7101bba04d52cbd5c73a774bbec86b9f1bdf305c39438ccc94e64e5d2f10c09e665cc00c2f5fda87c81bc5f2f087d6a304eb9ce9f4993d04e3cfaf33d4667c8022ccb7f428bfd910bbece94f50174b7c72eceee797f3ffbda67940ff801d2fe8838017061e052c338456cab36aabf44dc54635a47b48ca6252e87486dac3961a0e47c512010c7d972c25c8473fc32c6e06fa54b1dd95995c3bc96a72d4b39f874077d501aced3f3319417256e201224f428a008900dc9e3ca27b6a607b5f0050517bfe6b4571b1aa88c65bfafc6d4e1849288cc4a5f9cc91581c71b0be987d00116c9b74142ef1aaa222baf9177d7275ea647345a2a9c1387526ae2679d314ef8f01588df12b7be0e3480ffc4d82b3c14b23837309e35af4369147606668457f0db530e96887a6c375760f4dcb62514945c31fb5d62725ba9416aa14243290d32f2e2e3ae0b8da80916166db66bcfae906c0d9488319dc8f71c51bfc06c686c8575554e323d92cd9b97d087724d41e5ec73243b9eb9ae1403b4624994ee9c3d9b9fc80265aa84170e3e2e4e3df82ec22a666cdc95bd95e051b0035cae6eabacabfd2dfd964dcff09b41e222d37d524085563e26eefb7aa0e885ba71ffa129e2d065789e7f8542aa281bb59728f6c56c0113c383841b3db89bbf9445dd366b1d3fc81dc9b95eec7ae86f8ff27a0064f299a3cee2638e72c0e9c1299b5e287f249dbe08bc571b896baf946b7affab7773690ffe08517405ee6192a6614401216258b8ba24432a1ef5f74179d3114aed7eaf371850d88af941d0b73308ed698b4cfc3dfc2a0729d5a5a09467f9c7c7bec961d4071bb22f632d8a679cb61e9d032392273d485ee2b8132a9f06b14444a20d2c766e0140a66328ab17b0b007ede874f4d37b9f1cd771ef3b06a980cbd8d4a1b2a23b41056ef161b37bede9f937a24d724f3e6d315180f3417484450a5da305eb9c06224caf9c0831289ea8bf175efa9b33209ed710218fc06f3c6499fb984bfe05538dcd7a274743794a06f7f35354faf3eadf0b461a70f73774c1e461430765fb99c219a14388f1def7c4705f5549ec8a9df56a590ba68b6bc72d79ff81aad9fcafdb7b713d0a77b0ea28d5d31b8c16e4c22fa8c4d6f04789086954dc2231e6bec0e54d266d572332bf22e421bb94e6b30c94742a41b894eb5f2bd3f1c3f34db7bd6a6deba28afd4e7e9790e423e3851c30a543bc0dad6597ab2502cf7a3b71d3226e9fd71d26a91636ac5dd35e353ec8d0cf7e783a31cb43f746fd8d6b00acbc1ae2f6838634cc2bd0913087da0e0bfdf9e42cccf6a330705195302b5b12618741c2fc67679845632a47c93a3317186a2bb2c8d53a8e8c7d8ed350619393e5b9acb45cce1c7c35739400c695f8d60280b57dd29799ca4e1fa8d143d3e75a78ea958732ccdc1caced4ae3d32b5058df4c0c54d2183e2c670752ecd6aa30c51beffab68609097ef2dca77cfe8bfda33aa1816eac295ec3a235aa11642d510a3241d95db87642a05ad07bceddf8f26b48029a2ac1542e4331feccc1d37ca8f413b2ce96a44caa353c25b995364d73df7e98ec04be68261846fad912887f343860f7c5f47faf2defe9bb121fcd721d1ef9ab4914f4dec680f6b51187bae8defdc750e4b284981c4e39b75b55025f27818fb12ed639cedff7f7743e1a18037f0696aa171089decec7487f4052bdbd20f2e996fb1a56a509cac94d1ee251b466f6d27ce46c0c0d429bd2752fa415140c3729fefbc2d6ef5cdc867f3c27e8e1f9c21cba15d9028a1ec5ce67bfcbe7997078c4213d44f7dd4b59b73dfb01adfb01f892546872e22757415357f243989b0fce8627aed9d8d9a087286be9565fee8572cbe338d4d1e5bc720b60869ffb82c32005bef5138fda5f2e2beea8817317287f692181762ba0efcb95a427aefe93b7177b6d9f6ffdb04ca7ba1d34cbea0f83c4130fdf10ea7c3a0dbfcf7917a59d489b052b1893a5eefe3874e6c3e26a93e247c3022e5b78caf79f8069fc239dba9bb92844c96f234ad4498b7fb595f16bf0d5bc3e89529910fde4feb8680b88f1d1fa9b21b137ae95605cdb64f3dc74fac7efdfab5e46d5644f27b0865828c774297838c63c43de478cce5c8339dbce93732124a0f0ec0dae900369a14ac8991f6a87f3fdee230dd468ccb4cabdbb7ce31da3c6f56e32ca5e064f3b13bda4d709d9a91c2f809bbcf2ace1ed92237f03929cb32cde7012ebef44397a0cb7d946c7809887b26bcda4e5623fd14b85dbb0512f96e79f5e21a437927d127834962ace50aa96eb2a41c11087a295c8d4f59e5246b7e831d08141b0df7db6366137b91588c3634efe60cdf85d1926b3c2a63ea8a4e631bb26863b9168ba9d6a30686d1010e7b0f170b0ab4aaa87e8d84c3253b71570b7b30c131ce398fbe4f49d2afe049677dd59d76abd2a2caf4c7895a9706079592f52cd1264bec096c81b483875b8dddd837aa94d53c49f71bdbabad011712515e2d1ee2b2aaff90a0c5fc4c13eddd579cdde795e072ba7b0825c0ab9c9b6a2950047aee6584b5b648dfb8922ad34ef162ac64228b20d82f73b9025101c70ae3e77aa006ddc8926625443bb2272933d6b95baff9c5401a50b9abb1b19596144af1bec69688d07e32012bf63b961e9531806d81d02018a1812935712689ac16f00eb4517387e6023e49a534d8f3ed762d639277b52a58817c36a5236686d620a1e97afcd2736638cc23245246a4bd42fb2ecf5512e23788c8f13933b3e1f606e810429976c938c7eeb51a8bc30790b20278cc468edaf998b689f77bf70f7d63fc7adc15ffff5d662a4a79cb0c5fd4500af3ba421addab53717e5417a8f90558ad68a0569dd47f551928ed3bdf34e06bce0bf9268f445927a1ea2b6bbd42a728abc508e896179494dc513d3e1cc5bd057d77c34062d77a6aa3c7b2a8ae71d0c80fe550177cac8c229188592e00883807b7975241278c8e1e25df67118888ee69091851e72a486f74bb4acd63cbde7b249fb9a044e380b0f22f45066e503f68727b1c9f2f5a09ca16754b613c22a73a71e34f7c25453e09bdf19115fe6999efb677d98473fa09a0d942a1f973cd462f8d78044170d7013d89c44b50c2db37b74710408d30d583f6ff08a73398ff0c59b072aab9c7575d19d7324a2d469f4c4b593d19d01f343af591e4929f12f8bb385e7023c1e7717ca100b9189b589e95ac5f0c5ebd44cb298e2e2716a58d9fb8938c0acdff447249e2517a60df672ba17fca36d3af4b23cf6af8a7e55c3532ee13260d080a8b09242b7116c14338c0ce02301d4463b2a40f884661925b3c2e2162925533aa538d35360f50ab8b2e729cffea37ee63e4ef47f53b7a8fd4fcf8c6499cc7c4cebfe57825c753d633e9e4ffc1f31ef1d963e14ccc02b323099ec479968eae7185c67cf3f92f7bf7c28e4468c464a7c3ebcba19aa5db38e492a08e396480e67dbbfea4576bbd2eba2cbd56571ad65d949ebdef3ff0eac5eeab01189cf92ad2536fa691de444aeb953d11a247d2b55d60a8acefbedc49b0d82b1ba90736e38a5c9b0ffd206ba38369e19883f18761f6c122c09c0b8ce81aed675556130d32b31a4500f8276326de0d4433c5cc736c988004c29f512a8eb8271b2677dbd058b4fc604562b2f7e552a1ec93333fb9bc84c3653b83f6ab15e2519eab86379e5911b27a3182e38b71a655838c4a9eb61768ad13a8651ca6dc3f82bde0bb18ccb0ab65f4f61dc7c72b2c7f994a18487f54fa8b82c04d27a2d5811eed8f6265976f394e3e7812d84e079c6cb797a52721e05983070c6c881acd7b80a237db72228b4ee4c8874c109ba7df3851f4688817249f3dc4925e1b820c718ddf445e7d718f7bce9a2b3edf34472ee2ada91708471b0398c3ebbe14c32f9f5ebf4446159b1e6b1b773de66260dac69e628b1a62369c7e9fca2c958437ef80dfedfc86757995e090d3f1c48b08a2dbfbedeffa369308524d8b4b220c1993061c61a04aca641f0e3d382df6f9f927a15e38b24d427ff86552d9e3c568eeb54b7092e280fcc0bb354b62a3a61c69e0cd30c1218cd1d8cf18f4bfc31c3d7cb1ea873d956c92387322d46e1cbd95583dccbd2bb652c1bd2db07ec91a4c78279fefa807a02ff72ec30bfb1d4cbfbd68bd3379186c0d9eb4c6643b6242ade70dddc262fe62a6165d2764b13c2705c9bef149ea7dd9f13a10c339ea0a216f92a8673924bfa3511c34379fdb0b5f9a8e79e5b1225fbe667e696e84895a63f7aea0cc846d377b555b00fd2a2b1987e7f7d9615f57e98a671d4a3f0c1340fa7b83db6134151afd94bbb713e0ecc178fd82e2427ed725347447a7181f028dbc453b97283a2eb40d0f6886ec9053597c48ed82456039c192f06c17d236aaa1d92591fee0880059e62e99ccf3e8e621431445c04d008baf22a0198d0637b5ed9cd66dd56245a92e329ee59af71d029111bb36cf42393249c1fa15f3801028381b3786ff40ffed64a39719357fb9bb27ff1e3c731fc049850e1bf1625f8463a73bdc2d0b3ee60e0741bd22b00587cca140066dc06fbfadb132f54df25a0166f214497e3dd4f273dac7d1fedb53eb50557eddf859a750bb84184b209e8fa0eded051abc19a0d99b67aa165147e5ebec0db61940f8cfb8c4a147ecd886f7968bd972c02209d4f0bc12be658319d2e11690ccc80437d6b4cc55a7d91c1fdaeeb736b8b260dda08ff5d350108a61b47c1ed6a7e0676531b7ec1db899fcd649c6404f4ab3306747ef80814b0c89aeed9ae996cc48d84f6a6d6b1ee7206357e23c9b4384da962271f31f638e27cb0cbd9feff8aed43f7064b54890dda5fd1d0c37bfa897c2a2bca157bf99bb4770a3b8a3c646732659510d599223c1ef370a9c36dd5170f311e94fe6dbbb604333134ae853ca05ce3c5e0a6969738cd92c9778028fc747c4d7194fecc0ccfa1d9d595ccfe943b1e773e3114a2806440d0e5ee01990a5955a9bec3e82bca608d92c4a12cfbceb52a51844290c64c5bdef58bc6f3e6b214949a91b5fbba4e2c06e8e48e98d5b12a5be0dd9b6edf022dd011170135f6f55247292d29f1236882345fcad012aca9540385dafb74676025e2e126463f6186bef5caea4d873fa6f21d025a86cc5bfbc0a0071a77e6e5838e312d884a51dd3b43487edb5d71b01dc42f6e7db79b741ae9a49d493afe398d515152542f43f7b40802de6bc695610a78475685eb0088b8c1d1ac4453e4b959a2b29bd7b0f29dec83e30749ed852d478de7c8ade283ea75c022e2e3a614b10e95d246c2807a8d2e740896c40d717f936379e8433a1a4f1ea1b2037981376b84509b415614806c761e995aab9e8c6dd7625c8fd438cdd19bef60279baa23153c33af0c31045370379a3952cffc276dd72d6ca788321eac5ab6ef04b7db6f63bbd9aa8d500e880b228986f67efcc50de595a42e55d12c62451d327ed5c4912b56a3ecd7c652c642ea18dd6dd092727faf8c3f626fae278b70b0ced81dba2d385d7d14c471c088755363ad5350ee1dc9b645577dc727ce60a470175841bdbae6be42cead79348bcfb84e6a2b462f2aeb891294ad019521c0e9de755cf193f6e8bcaadba1642ecdaa17e738448fefd9f8d94306f501841a2b0d0d3815ed0175c99881183f68a43caad3ccd9de68f7bd3cd9269260673e667301f09465a8c1f915769c99bf390931d968d011cffe750a36de9cfdfdf3c7964a4dedd6d09278d18487cab3ff65a8aac7c93e9d65412218fb0c139d7b1e24b305f8f470755d6142e1246755abc4fc0d4fbb2b4ec5a726a896b387def1e7f4f8a104d909a578abf87b13f16ed24705f725aee793399205c7a706851843d87a96bd084c7770221151825a8e155779b708376766aca6a7ecaaafda685aed2a965322c5da2f49bef47b909989fd0e9071aab23f9b20487ca54b5cecea9eafec1bc8aae847f80321e7d18c10a17bb644a00fa4cf2d79853b33d22fdea0a9ffd2ed2497eaf2e8f69125531e7d83130216db1df73cc404b1c297157e2fdb97b275a23c4f3cd8b09737cdc402c7e550fab360b16e3cf82391ff7b44c1a66e3a406eada613dc7089058adc33db17d8ebd4e427c21a6cc820260d19d5d8b00831fbd6ffc7a3defdbd50050bfed8fa5045a83f0608fdd2fff6db94097ea86e39d45138ea288bd22f83711364ce1899ad0846c45d7b12a6d91a854d5ac635d2bf65e3e3c6d89b7e0f367f32a7bd2a13935bcc7308e404fc525f53000a644e7ce801bbad1f25821d2689e9b54d40f9e4596efd3e23bf8ed2fb929d8d864ebc483cde0dea83d25dc847e6f9fab983c844f23d49a322e56418a7d214d23940d7da5a90af3c6c1b2cb59062d9d76051cbbfe1ce46d7c8a5cd9a187c4393438f37d6ebc6acfb792d81478462e13b76757c2217d80857a172c880390b44864c7fa20c955f4477ebfa755cceb5ae94c1e5fc8718532e2e57add6fc002466612b10a765b6d5beab87d0d0ac788d94df94bbe5b597d26b35682fd7dac2a3f14e6777a6053e8849e115261e495a41e275129bfa6ed808d0b721c96d9092dbf5ac322615bc3ab3458a3a0ee664830d44b2584313550d7de5f0ae5264b26bfa4b026ca90e7b3856b9e53f463290eafda1ed6414711205bff6a1fe20262e36894342a42ae5e7d1dba0740cb1feee2839b5ec05b7d81abc5fed83fd0359ec96cf0d460de1e64d33f0cf03926906986a996622ed7493b65b246698adc68051fb1427210828d07296a41222067baa81a41b35ed6e3c4a613c172aa794c6bbfd039abc87754702a3a91014a9f4c657a10979a9962974ff46a0e6a43f4c7d570c62f3171bf3375e94a4373e1b1b70e01822f4e4123c4580aa7808103389ab5cf096cc8ea88f308292f62119749abc122b495919c1d74b3d6c31f877598921f999625decd25661795abf9d4f76f6f7c3de8202b36a78d163d6c8db7794a5412d6413f05a9f0b81a12773397d83b485eb01ec5b1cd65e51e9ab9ef64b4500efcd576d7b573706ae5fefe42972fc2080ebbb68c268387f888e8dfe35c44d19b9913f7d30a08c0bd7a9062f34e218385909b245f2f62c107a5deef1704978bb913093687126ffeda822d793bbe256cb7a13a043194b2151ce8dd44aaa7627d82607267eaa766de91a98f0c157e317173a929e8882cf32d964767ffdbb1942e1abf35181e848e603d31231eec70a7bee4ea276f3a564c9eb443aed8b81c1736c8edfbf544b38b8c2a29908fdbf410fabede803492735207bca5829b30dfcf7975316387e85e64a730b7d7da95ac8e52f4cde6cbdaafeb5901057a6cd13746e75cd0f71d678ffd52c7c70684b840e15b40f38ac8e42c959024e79bced6afb9ef84bd5d57f79daa5885d76400c53ec45cb89cc7c05597fe150206f98ebcbc221320eb72a1daa77d313c70ae8f23ab055276df94ac8cf99a82b47b93e1b1a0279dd882b4fff4d99e905494cb85f86d1b8e101ed322649229e1aa6c4c07d947f873fa680c12dae9f0b9d4411903f5f92759b27baa65b10469b18268e6ef9c9f8f264754c086701ac4ca47448bee8f12f7e4b7f917a8f8c4685944b6d62b654eb4a6b937da4f7dbd6a8abcd4d212cb6053878444cac0d3e687f5080f3545fd31532185254ae32f6b5a8b03510bf3e4f1a40bced5ba4d583de81c433947e46534617834b784f2069eafbdc3d70d680752292925d40bb8149230dea40086ff24cb6a05eab49c6cf5bdc7f426e6dba86eee8ac88ff98364c6b4b74ad74cd002d579fc135192af6ab469f28e861a8c88500ca650ce0e50e987f37ededc414bee4dc3645b924b51c36c3dd1c7f7cad1bedea6ba79c138f89d2d7ab736b4503c082800c93a471b35d908798480d6cf74874de1e4cc47100c2db6c7e1a3ef9a91561f8213f629f3779b86e96456747ea12741a9844f313d60a73e2eca63080a73bc31b31dfb211ceee9dcb157679abd82ede88f606149ee3c27193872180983ba697739aadbf5ddfa4a3ea96104d81a792d04f8f8a31cf507fb62d432e3d66db9f26f3a2a23ffe1d3149a5bbb7dd166abc0f7882b69a9c9bbd130f7b3509642c70e8328fc382158deb86041358db40d518fdd9d603e9724c7dd84a2fa2d0393c4993a0275c9fcf4e0a024bed1753ac31e8cc32891cfd351045ee6cf9fe0f8c4993b98d21460b7c516fc1d04facf20c9ed46d7dfb9761f2132fcfb93b4323182670b11025864daabfc515df52cf6bbd7cbc95c82749635821e0407b7010f82087451436845afce7ee80911e6f0a16e0886079cd97fea2e7ebb259f56097bae6ceba5b814eb58cc6c2bbe1b9430f0a685304c3b39cfbc170b74d41b9c32d3b04d1a893d931e71872e3fb0429fd73c034f84b48728adbed04b3bb9c624b0402d095db08f35a5b04ec1749391c69132e8d1794544943d22a0615009c384ba572e1b8534569b7a478d27e76b9dcf4c9e1a605991cd5930d02f852ac41c574a57fe06636d36004e48a0e6453a824161f1f516c98598f8353e4be6da53debced6e5565cfca0acbf9997f66fdfd426c219f0ef0e003c62075123befa2ff8161ab324d4436795179bf90afba28e5c61f68d4f387ae9ff932901e988dc0519e694eee07818fb7a046e786f31041d4ae20ddefd07beb97915e216a9e42e1e9803200429310a0fbfb8260bc36c827ebcf983b00d6aa5c9a8c4dcafb5fc14affb3b622998dcb71238249f08ef261762f7947dad0e044be5f9c82232482e09af02f6b1c92bd09ffe1323d0a7e15007c983ba6c63b91636ab1c4890893c363c918c3dc73fc4c8446c369ffb30972d5a4fab83d46da3321498487945f6b3d857fe9815487fe64251d9e8ccbc448e02f8452dbe2e090ed657edf2145bf3e740251516c8f915bf81f4be93cbdf21a35ed1ad59231f8c9a25ed4df619d56e0ec56404e539faee299d4cdc37995d12311ab283bea3df436e00da872c2cb7571d23851c2586329e32935b44eb03bb9ed4b631e5a5ce2ed566bfaf17c0b0b2eed377a590881b3995f039570485c1d859e6091eefbe241264617bc585a1fbf7a4343ad64ac2780c56fe95818f1b71eaae8f3c70e3fff917ea225074ac20876db2bb007bae2bde665e9379909bcee99ddbdff596ca80700941051b526b4fd1fc7158c2a909b9e0640e645f874ae5801999a99912bd5d7def554685197142d9ab8f299814f2de81ce9e365f8b8fdd02e200534ba7aa3130df196119823aec9979a57878f42c4ce02507b422c7603efd66fc965cc2bb5bc9370a866bac7f0715102a08a0b0fa4384de965e7b2cf82ec73ec6f5c6ae032407d4cabb5bc0475d540c0360d643abf2fd0b876f3adccb318c019dd2d2e5af0019875a04cf8736e0fe7301c21c1eeaed60916ae6f6ade765ed10a94bb904a60fb0fe65781c6467003f10689d22ed6c225942ec335dc572eb48cdb670e9e1bc13c65c1b0216c576fbfca67f76987919d1aed2313506d618610f4f3a18cff7c2894ca48a3c1ed30b7a577303e26aa9efa10151c4a09f7e98234597665de27b4a2360acd8ea37e79bb64dc974697d58fbdd5dd4bbf3bab98ca3f175a9d9ac80f2c7cefff896e13085dcbddbf7302bd31f03e166fbfee2912e046ccc1ea6c035f6b4d496932cb1cdfd63c8b733ae5981076736d2a972b775def6847117b0625e5d5386d449f1a22449a5557b79efab7f531e095bd5ad6fd952aa67efeccaeb9d43587afa849b6fe2664a1bd1e2e3b9e18520dc4284485276efd7d7930cd2bf751b573d4a66581780bec59e54e069b6a70ab14267c11d6b6db127d938a4dd608195b3eeea353fd98777c11675fd9593ca1d9374cc4fb8e4152effcf821461e43bfc669d5302da585a48bd99b2ad460ac6c4a3c440ebf54c8501371a14803e515ce76ed5910f29d66cd6f5c16e05a35701a09d5a64e438be283bb5c0f049b46642e19ba25869862abbb527fceb3152817b4201d75127ba996035e0d98b0dd74ff6267ddd05d8d62de43abe096b9b399d6be5503954aa8007223676530ab877e228f543bacd9c51bae55216ca3b3ddff5f49b8564a72cc40a9244dee0933e91f3d9a40fb4dbe3956e0fcfe4ce21c84f024104e6cd831491a2bfed878f95bda05589c47332d5fa0cc54011e024740efbfdf20ae73c2a3bc9d4f2dea356a88e7a50d476f2651b9e4a57f50eb5e9b6c91a12c692ed18610159fae56caddcc4d8b161496392eb6408ff90ae91aaf35911cbf8b3742863b3a4a7a874e627d95030cb37c4ff4a7f04864b87390b077792d0cc588a348f27a8201102b5c67e18fb0ea1db2674aab204d9d745ff310344cd6d4e7cef9a855a2d4f432471009f941a1aba988391da8939be4c95e670168abd656c25445886e2b1f1b654447fe536187748c929031571056fac7eab38611c9128a13835608da0d175916e7f4d02be2e6ae70786a51a3b3e4657091dfe7e22f053614166c6dfbe268d20bacb61f84d7fdcb13e041aad36a9973f918ed78ba8b0e7600a02f44aa28f435933166aca2908266def35ee6013ce7da9c9a3a31cc877a68104b3d91424331c7e60b6deb814b87bf1c70a48ed1b2a9b18ab189c5107d8739ba7a56503b48caa843552b67c485c2b989c5a837a7ccf66bedf82321ca3c613c1ce14916bd5494afdc517fd2a4e9473055f097425e7784ea9aa98db49ad0086123ef1ac9cb3da1a513e57c072c215c8fe1ac87e1b50be85135a048f09f17bbc937e10c2f7d95469ab603f93d974373c5d5128576a88deb610f72198785d7224d564d38433e7d7d51331b89ef89f9ee9b9aa50f723968c69f269ac3052a1c0c58b5e4942051f365a30a0387afa46bb1a4a30998bcf1ca751dc6b284dde9f053440b60f67bbeb769067b68ec0009f4bcaff2bf0e94a7aaf06eefdb693a5180cef3c65e6a79c8cd5c5ac25464b5bc98d76185f1c1355799110502784d2f098aeb3e88c61afbd6982790e05a6fcb973d10a9c8d694a4eac49a36eb28a82c90ca5df14a25ef487a3431f06a97401a0bc2fa3d0f134c17d299302003f0151878c24eb6eca1e9c8c08f87c21a12218c583643e3e3318923d28361740d9879e4b3af8721e285ea35e63accbac03bef362305e5add5e4444506a20e996d0196344ae2a95cd6148a8989478376ea5318df5a0a5dad6f396e884d4a27733ecdbdce6a8f3900f31ddea5b34b1775126efe281b00a8274ce3186edc7f71af77004d23f39be1fe1d44aa360cb8446e314b8ac670502904f70e5c0d4d157dcde8e7d6b3b19815a109833cb3d36033c8cd4fe93ee8326a7f331ce7335c38287dd1b6d6de75a1ae5e31fb67172d4236e94f079e823cb4be7679971ba9124b9729436df32fc1408e4b229a37db18a0e93d0ef84886979d2ce5d17bc8235fb8863a054d2a40ab984e7dfc6165b4e3ccec0c99a23f600f16288c7d353c1553db4799a03ba1f84a9988bb42e8491c76cfd3b5194603c6b1289304a88496e28ed35951a496898e3d6cb0009921c56838f451be80b13f1d4649e211fb21a9b8204dc113a0550d94295af6d5dfb1a0cee1d985d850f38ffc95878db843df0a8b50205d9adcdea8ddb616ba4948031df5ab1e17cefabf9471b5ea3d56d34c2fcb42a09f2b438bafc087d038261a46b2ac9615477f1e95c64a18fc7a70fcc39167a21301def7abb46fa907d6cde7a6fa8866e3939f2d69c46dce488ecad8feaa29b2db24fc7dfad734445333b97f815dc492f853f1ef08664d066f63f398b33cbc0755106f61fd675d7f598f7bbcb9e527cecc59c3a68e3338ee560528603a98cc377e2fa6537cd8bda722bcd1e71cb0fe2c265fbe53d673de766f9221f5b10f11438974f9b07cb1d8a365c51b1aff86560ab535f3d3efea0b4dc763e2555d9912319454ab32a25280a9e63f9a4ddd1061cb5f296cee549ca8e076a71902829adbc402b4d1d6a7ee83216742b7e662660cb0592746fc4509052bdea8a93e5fdc7aeed66957e916ab71ba1158b852f16c0c8dc9badf1df0f67f3d90339bcfb14f23c8afe954b4005d9b8357bc893b01079089bb272871dfb6bb680c624d981b39b1b88ce4b0cab2c4fc9dc90e4c9bba4b1004356bc5f110edcd3647815d06f85a9a3e2d12f1d377ecf1b024efe98eca9adb3b27ecfbb42bd3ffcae594918d9fd72edaa46892588dcb03b497638df42e0c3076aa7723c21001a8a38ac531649b9bcfa67a936aff15581d48be282f13240a20dff74521b54895258d46bbd3dd0f687a21bcb6f2f6abf1142ed245bf7a1b06d3c84e17f19a53911d143bb59e2cac7ff493eeff7949fee2388279d8528ac00798f8a5d812b37213ad251df2ceff105580b9b325c2b7054d74380181b2d7fbeec0560ed9a86b3b6a40d0d7c385e4fa515d3f284491ccc56eeee6cace151f137f83f3a7a6cee16005c20e506eac871d070ce4fb3e8cf70eafe43d7154a36fed74c4750c38e3336fccd95dd6a6f0bde593e4c28fe69fe09f2566d4deedfa866da5e1190527569706516af5388863697a2d73bc16f5a9f65512a053c2534470f9325b2c0d41a85a8055af26fed9c1071ba8baaa23678a1b3ff35ca1b24d65083268e822b908614e664903aa53156b8107ab11f5ade7c4a5451226bfa5bd556726699bf0257eb83fb5b97b8da6f36ddbd1659ff8b657750d77d50acaea89f7098aca823c09b9697bc3e0dff7e65ae9a1397e356323f6ed8e75d3f623f9996f05e819f0145af3db62e12bb1dcfa03875c05b92563f996269cf96636831327ae8ca86910a4111c8adf5f53f5c70eff5a69f3ef5c173c749f502e29a863228a03ad49afa84a7bad6b818d741dabb8279ceeeff46a66cdf2dd4c06970a1910ba0f2163a45bca5ed954b03b86ada9d114df5adbd67a24bd25d42ddb8e6b21c820786b6a3e836c8e11880096c88a76e6b3465b2d61fb111456da58dcbccf7b19b300c88db34699a9ca265599305c22a780e0e1bed18fec6aa777cbd0e9969533401615f79cacfe402f11629b8122175a8367c1d105de7f6a1cb88225f778cb322e41f990c6409fe24b6ef4b37780c99d8068089bb3a4b778ec63c80f6f8d03343ef3770f288c724cbb375f1269b1c06cc3fb0b9a69c43ee05525c8e2cae1c326fa4713c68d2cfc23641507addd49be3af9d557b0be1597fcb7a681dd73bafa132de4a34ca6486127234bd0ab6c050df98cf6b0f111f7500652ca14cab4a41fa2d18f1c664626ba70f874a8365ea64d1e1e8a257a1d313a6b652cf6db617dcd22d74378159ef1ce25258c76e1e676aad0722a01e30db706e67788d558e44bd0fb600b177d88096f96dacfd78b5a7997b9a3ae5a4edb6a36cb3618a4cd76d2647302681fdc242673350f2f044f4cdef91c7a5b0091ee7c195e0268af5ef300a5c9fe1406579ecdcb0915397d14f82ed2bc55f8de4e5abcecdfbc41f9e80a83a072d01418a2a544f718ec3d4f6332d1bb2aebb00c6ca66b9999e6bd2bc490523859f0db1dea63779b9f1f84d52cbf3e7dcede8214080c6b54916f512426bc9447266897ad4078118867e0d6746cd99378ff539066b246ecd123bcb3597c4acc172ea13c1e260468fe12b1696ba737e1984e9b593f774c3db1696be6964319b9f9388707bae3ee0858528e3658741dc271e80974045f3ccdcf5c271fa4458e81023f42761c5eb37375dea4e4d4d8b1de0b4724631cb35b0043e7ac67c4edf767115670eaf50370af4cd2637de6c760e5750b8bda3c5351c16a9a5ebc02e2ea24cd10e9fe31deaf0e250d869f933642bcb9da2dd7ae6d92e3c3242c2ca4908bb60f19d68897616973b67dd1f1b037c460f7181782191858f2003a4146daa41901058972d7baf5088dd5f89f294ddf5d0b6af191f36df14250213469c2735942e825ae6d36406817d2ec872e739cc1cb9f0bee817e95e37bb38c24b9bab958654afa1a38dc4c3155c37d1310f014a5860de0637d0a48d23331bf8afc9f5cef164c130ca4a472b360b92d4552f083d6ffc381f8b033bcc0550c42ea706ca15026f0d4171c06e6e3ed636e2d7cfa92856ef967342076d612e419457b0667c8087f01ebfea10184cb54e7c6df803d8878fc04ec7e45e1705072d1a554a5ead50980fc7dc0443a2f51f64bb73fa10f183be1e8c4368441ddb9cc5c47845c02ab67194a7f27a109036ef7c44c33ea236f799350705cf63fa5a8ed6d8075b8d483c41a589c4ef7efb716cf495f839a1f22ae433f35d4c5abbe7bbcec3a78ad021babf3e0b9ff84130557125622e93b0795670617a426fa536430d1dc22c79ef99b0474f5fc4a7812efe5c9e2e9f1a23edfed2340ce460b118525836600127c410d977d7f2e9a89a6b571289479ee50ec969a026d8054077f783ac7038fc45f1d7972c01d4ff6811fb44dbad8a5de90b39b8a8c055e25ba81b4839725ae5f33875d468fa381a5866ebfa41f21cf2bcd32c0a3e171ca4cd5ee36fda6a7de9f0c630430e796fcae444eddb481d8c61f7c1c1a6b6b6df269eb1c69ddb5d6e2c4bde345e22546ca393c69f48b4d52019f1cd025393fb97d193b53654aa6bf784c660040145a5d5da90092751a9294b526d087323a04313b76cbe6447ab73707f48abe7628a2d8e2b0a5de8dc8e7d4baf10cf6fb714170a8d0e808f9b00d1e3796967ea69bbf899bb84605751b423872250ad5e61d0162613a0876f1c0aa27c7c9dc629bc9ef8fdbcd6abcd26fcdf55e0bb080028cb3de1e3785a3320ee1652bc1a553fde8f73da96ace4c55e5d140bc4211918ed8694dcc5d974ff47276c8c157260e9099cb8042fc9f9a258a6a107023ad1f91a1cef61a74521564bee71c2c055606b183fb3e5f02c21d21f45d8c3dceb63edb8779d4e54668ea48b3d283b141db2e76e2cd4f4f609d47125519bb969771a27a129d82b326cce960126a21be34bcc01bbbda81dbdfc70e2cf40f79d3c7da6f29603a5e52e7f968c8bfc4709adfad10b5d2901740c54625168f306997e9ff6a4dd6b3089030fea08c28cf13a58a35e43883a9feaa5b6552041142f20a916a2b4bb0c0892a4ccf1a8707b3bd537b359cd86f831c655102f69601746ba8a29cd9a089cc3796df03360f77c6727dfe70cf7bd1ee97bd070a1b8ff7798ba8dc2e1ca6f09c1ac987da350d1929136cd346b5347b4aa00aa08b1707ffd7ed550b167233ae883db4791025d4d3f0893cae53d0ee29569290f29b0f73b691f05895c9a2c40357ea89b2fdebe78c41e14f014919d17cbe67b0fe6fa854d65c7a2fa0804dd88d8638caa595e49d2bcb1eb6bb45aa447c4f6ff29d308b7785fa01213a796bf7f61237c38b7d6fa76cb760315659cb37e2c88a9cfa7d48353a5e160709aa599f17ab5076cf9010a1aff139e7d908e73c96c1eeda61568730981f77f749455f6d4efa787d9fd40630cae5ce4d302f7cb502afb8a092b1a0447db8c42d95be45ad25ca5db36cd0f24768173e21b968e7f38503c70bfe56101b8152b3e1a32d922a58fe48f8fa01802d578ffce70178b29fcd877d58d2062a166933fc33d52c611c44d98beefc7a2ddfab7b17a455cabf8acab61554a4c1e649c4d228fea931d30314849cb63eea6684d5410dc66d24fa96739949aa615777b13a0849df0f9b95023bfb065c29379f515d4eb24965f0da79ebfa7af2b3852ee22611953769bc08b0df17def102abf69d9e9d2ab0854760e6ee324c6d35d804f0069d65636227f3004c20e2b74a1666b877e0701f933590c14a0693251fb7588d16d011de7e13d98b07a9935ef81774938d1f8dfb137ef0804e32d54efb3566ef86664a6b8d78d19ff938ca4e067e6c9bd56a635ba2884c97a074fd7e5d32a98c6ac2563323e1d7b40da5cc1f7a66385ef4badc4fb28ea729d6a406b13db81f59251659084f059081828fbc0a287f21a7481d8dbacdb4cd8714741779ce7f0b10d23bffed168fe6f15298797240be1ab25efd139f8f6663e275121659798aa25963f01fb9366b0eea86b68b02f48c74ddfd8f7d326a5bcdd419a78d76dc27507ab0aa42971abb2fb8f1b624d62e13980139cfdec46acd5a48fcfc5b86a5e940a9849b14c16368fbd87c5fb40b8f410d515fd63ddfc55c529e5871a4988f6b1478222f54769ccbe8ee2f3b735fa774ab209ee535a968e7f5c73ae0b5de7c384522f475b368931a1de116ed780a373343da60ddf436d33d075b54dc44383d1b526a931061cebb55f946b2b415547f11343fb2be1233678bcf7d349560ff71b11f5ea8eef27435e40088394228db93f8063dea3693be95fa1569f3b3c91b8b67f0b77d4a7523cf67d842d97ff491ac1842f40f10eacde168aec22d2d14732daa332ab4a4c30248538e83dd7afd1ee5d712876feaf7825829e2e7eedfa51679ab1d7c340f9d40420378b49fc3fc42f72a9a0ef50bf647469bdcf7149a89c14818c0ea9b5fee05682c065ca8a9032bb556e10a0a2e7d508f1d60276b6a8186759960374cfed62f261cbbe8b3e77cb01b01c412d961c16cbbff5ec6c655a18f3d99b0b8ba2b4aa9480d626d4534cf488116b5b194add0074a593366f9f4c8ab554393017f7dbcff227adc4f71578342e2d84814a1c949f6d51703ab19ba4460a1548b29a5b52b5214a1bed29e9cc43e8b0590aa3070424a755fbeff2c6ce21c722042d196d7192681845c6f898923b56e5f3a7370eaa6dde6d978e89f788d512a80fc498c33ff338ec7f0c3c600de2bb10c1afe00f096a9ae8df2b5e49cab7828c8b23e925e8b46f8ae63e024d51c5cce6b972e070373aad3419669fce258a3be7b3bbeee648a0c7caae41e311bdc63f25a49691a192ed222014d0071e3d7c64e3592feb0806efb75f5e4af2e6fed4d7d0bd43c4a7c60c815cd80ea50fcf42c7e4f1db51cf0abc3e13f4bf91a41a4fc3dc846fd52471628de83030a44e40e76462c6e3bc2cc3561cfc80134e7d03d955e9d64080cb8010b54d350db79d3f32b95068a570ea03232c72c60631d150f317724b11b487dc910d98e2cb9460ddd235a8dc716278e888689c0d5f78ab3b58c904794b17c4bb64d3d6f28dac34b8a9ee8a1dc6f6bfd1c2e413e4b24ccd3543f6eb8e1b962cf0657bead354f86f08fb83acf0f2d15cdb76cebfbe9efddee249045cc81f0360110d2c9c77265cacf1808e1c01c426620d8e9353ff01078bb31d4e49983b38764b57ede033442be57fe2e7eddbafccba9c67435feef3aa6476bb9f59c22a7186659791f24ea5aa27ff0350e301a756fec499d85eb9faf9d230b40f3982dce8192896f6fae40e80b9e7ea12c5f4d0a31070bfca4ab36898d33f2d5f351ce8cf7e17db47b09b29b6646db4334883c7dead3bc7d0ee01dcae538c3d49b1714f3c113d06102aef49d645173306c4f207ec6eac2475bc8fa26926eaab8daa466e6c34ab10668fa741b86b382e92b2214397f748cd625ba2b58e697d0180c69fda71d034cc0670d4abb988426bd872fd41b642ecbfb6be68dfa4f340707a6b6409871faa6e3067219f101d3cb77ddfff917e482730104661cceb733c1c8990e16b5508a890bb1f9e8d2487295eee1701bcac5abc493de597d5d9cba5cd5af580949919869f4f652c32fabbfa516fd7e11158d2757bcdf0f755df173d3f8a550f91664ee1fbfd1fe2e59ae2715ff9aeea4f6e5041aa73aea79be007519d9e80f3fc68f329869d7f478fe0119f2111f54df2cf7b560fb1b47165ffc114f5cbe2c2859c07c3564d638cf9c85c5b84afdc9e5adc2978b62752b13878a63ee99c68d6b79db08bcbe71bd7d43beac5e3096a2c6a472c0df4bce2087fe04ae6fc39eff4ea505292100fa2e449a20358a447dac2e932e04d7d18ffdbd3f64116e120f3aae0392e635702f6ab8282c7bedeee6904bc2880bd57531f848c8fa136e125585af4a7a7f206ae99a126a67330b01e99d67b16e0f0f06f556418d3eaebac9ecaf854ac4e450620e22a388b25ae4efdcae411eda11fb962a74e49e12de23e88b8e6e8c72121502ca28ab80ec0a5022692b0cc5062a8d2bf2cfc2be101cb922d31a3bb9f5171d85a0a03cc4c51d0a2ce10fea4c1355bb710ada6ec0f11b69a74187f2b1c63f9ba776ee670eedb92f052f1e90992332cd3d3da29b248ecc997d73887e3ff12e12feb5b1939f61c73c0709582ba97883728722837edd1db6f102788d29df604047d15a1852a5dd7fc7c74f30d392c0a8534255713cca7653257ce25fdeced943975bb6ba8593235be0f4f199d174f7843c720ccc6baf0215e17be990c8d2c9236224392020c2760c7d5610f539f02f2d083e892d69f78c18e755a0f356d6c90a8306674d83c32907c66a654183ed03d261ae20ddc26354f38aa3bdf0760380fc09bd7f12b225901dcc213c71318e05bbebd80f524cf5061ec623cf5bc895b4a6077976a7ddfb9c0cd3fa783259354b6a2d9f284552ed221b78d0b55e8eae65c02003e58fb60c50bff4d44d5bbf786a3f5cbd49c3cc914fc3c602d082d7557c3f7ab7ace38536e001bcf52eb0ef80154322b310e2ea795fe7333d0ba333dc1a7a853d0b9825e34ff5cc055917311b257cf36bf141a2decab2f2adcb50466bd0432e09ff47d854ff60e1443cc6d6dacc027bc112c705ab3b6d6c3de3ef5ce27d4d129fdb066237160be102dc61a8690c459a52b319c974404180caf42f8620ff20f9681d46a8953f4291f3de9ff279d00cb82789f9f3390a83d0f9d38050aec674c5c92bff62cf37d43b50905fbfac7db15ec9b8771850627e1f9e770c312d2138fe017e607b8c1642c6193e31f193b69ffac55c595da60862d4d14c2cfe9a6558b3398ed59bc10b4a1822dd6fb02884f6d44ccefd2acae2137921c5c0e61af9b6845095b45d27820b326e1306ee3ae43d05624e3e2bb39362187700f383b59c51594cb7ae9af7a6e004d2ae29e9ed089968a55efcaa2f352623448f5c54666a6b57111956291dcd7f5a4d181bca27e3145020dc777335c5250af53f8800e58796c059c6977c4f1b8cef9b12103cf9c39370af2ebd9ad11b66de9ec2d3451247e2f3f3002408fb776a822a58c313e8616d49869e70d2e7926ab78c4f2c95e286db19b74770a15064005f43ccac5d10198033f1a16ef1b73e2fd166acebec28a489847a9ec8537747b5c83997872a38527282e648560e37180d3acab42a72ecac8dc39a281f1c19b64c8c71eb8535c29c8f8b60a4aaad677de1e20a0f21a524e0bb3e1e91926c4021f3070eb5de9d98a8df57c41452f66e5ce73d7900307c01ee5e45201abbbf8f49bfeafe78720bb61856e7752389ff5d32b760488343be6f700a1c9e55fd535ec4584387630c08a2a48f89f1e7efab7c9de516fa1771def7e4dbac84f8db1de0015aafbd1f2d74e64e65fe58fc43a361506578af56139aefcae540f5ff015076b7336d5ef721d339c3edb3f54a0bac0f82e63cf9c1121397fb5abb17febc0e3c0acb838d464681e2ffd6d72819fba2d563207621ce08ee5421e74da75fed5eb0c36720ac7bf257418746f2b2c0c9be338ced8a733833fbeee05906259c4d26b6769ed477ba6133cee26d58d44738fbdaeb8df99a70d00195f6aa67023b00fa611d4d09cabe9af0010edd6aab27dc4e4815cdd63292e5edb1a572dbf1c307cc0127d6ae1a2edfd548dfbcf3360079f6cb5de7778ead94d8ea779f40a51468df59c9f68f9b642929d27db1b62b28faa2f28889ef015c1b547c2a7fa8b98ceff4c4e721b8d7caac45aec0866c1e62eda03a822517e99d42a6a679d36aea470b4ae2a2f97fef10c28943ea9861b09ba728bb660b6bbe5b2f052c88b744bf24caaae05561feb1a5735f213b9bd71892f0188050dd475e72c9740ae547d17dba345b4fafa7aa952bd9e0639a2d3566ee4e9ad19515d523d2e4f36d26ff1e7ef1b609eb3b126823314ba667be6d09e7c435b4d6e68e5a8f1345e55f2a71d50b8b8b105b87c9be2458431d77b36ccd6f89235c8512dbb2d57f8c59f560879332543b473d0d19165422d731c2350156be4658e3d17ab99a5e2816e0bfeb8868a7cb38627522e5d2d86b7307a41f3ad81341c03ca0d7e571b4dbebf47d47a90638207314b6b00686d4427b56330750f0121d400e9d590df382d206d0d812187260693fd726374ab708767b3ff731a9774e56647d00e850b4e31e47f422588d47691d26fae2c91a9cec647376c3061b1a41f12ad3ea960b18424e474d5462a6b43b3b083d7b8eb3cd3e3fb8ad176138ee32c53af44e90cf24ac6d1b3f3a0fc446c2b2d7211c2136b646c59ef7a8ac5a4faf92f201651879cab5905e6c5ad9b39ee8b357259ac5051ca342f48cb3b5f641e6cd4b740095645d8343e36752b1b57a0f6e303a6a7cf32fc24a3870bc0e3897e96712d82a1225701f8be67aac7299b091e2048947f23a93c985b761fb16454f89dd5cc893f1fa3aa7bd95015c9da68d57bcc35ea31bf25d69551683c6931093b2aadd0f37ed9acf6a408ed91f11101f562a2e2c5f16fdecc66dda489676775b1a2d62b09fe66ff297ccccf99f5aaf8488601f66f11b9cfdd0d91241fed97d3c0088963cfbe070f039e5fcac771780e6b2b245be54f17cfe37e425c0de47acc34e25519300a8afff1f835d63680fd56064190b99b6b0c723e7411d0b183ec38d0aae036bab9785586d3d50a0d062a3038681769da5820da23528c36df7f3c9a828fb0adb085adbe1892570135b9fcb61d795502f612507a641afe9b2b2b93310408eab6a1a581f107de5cf9998413d3c68d6243afa58f2dff4bbb6a97c5c6cfb5f9dc23aa7393ff18ceadaf4bbc3deb8791ab6744ce12d16f90fff60c7d88ad8a30b82042edb1fb6c6411d873e295d3e86ff5ccb94ca3ae8bd5f6b6f6baef56ff9d9f00356a9eaabc41f2f05d94fb7ec0f69329e3ec74e0900a2d326d76e99ea7707e1ce2b7c9e6a3f47ee0d8ab2d7f8cc651eb5cbaa2c6b617062a51b3ac075fadbea8b53d0b781e9091901c608a42fa6a2fb46fa13663a7273defe1808c6027a20202a7fecf228e09b6dc2cc97221bfd0ac131d90c33861c5b993c7248555c7a15c9d90fe9a3214a0d3d43efaf8cff196df2dd4d116b18330f422f44364c29c0198437378bdc402c079cf7f67027fa945b4782c2a06ec557cc466964d2bf2cf0ec14ebdfe615cfb1133491ccc415e202f1ab98e3c738ea119238f3ccc569ff46181e0b82c4db4e1d997566979b1005abebc940acb548ae12b96ad19af931e1cad7869c80dd8228e000126b3b93d629afb1aa9f487a25701d6ee99e4cf2f5b9f207f73e11763352830ec4e195996180fc56c5d84d0615352894cf5b67f2b1e91974da5e501a8b09f090edde5e77c5366c947b3a2746ce229b5754f6427e403fcb271e487fccf3d74e0fe67009ce4d32c4fc1808882f1d4b65436887c30ac2a06f8c8c8f48d1dc75e1446f6e02f13305f0ac1c859912dab3370f14e7959902351550bd14b3d5b84eacd3998c630db20e49958f0d8366044fc900284d5e8db58504fbd6975535a2ee1ead79b6cc88bc6831f661b1fee9d97dcd7f598338c12befa546a75c7bc86c784b367da4df13f70a59c5bf9933e95654b7701b41963d33993a9e0f46e7281411e4e7a3b97906fca7bb82652c94025930124c911c6dd1333e8f7340448aa6fbaa75ba9380a049b41bb86262d4921453133dcce9bd98da9878ff74c6a6ae2b40dd06c1d8a963ad52aef1b26f73e9c57fd52286f2bc6ce8df8781d3c4c68912a05deaf4ef510089374b5a3ea63672190ae97c9a0c79dbd339b36ca5abfece9fbcffc1a6564735f8e5b7ea9ee50b7aa3feee252816e206a7ce1ba545a90f74a20711c831a4554a7c53288733fecbbbf9f48d272d6b65926e6491c7204b34f76048735d6256dc1a9ed16a62193ef707a785456133801b11691fdd576103235c6ba2978ab05ae19878ccadc36f9574c97ce3a5bc3aab4ed3070dbb7ebfae002d7ea4c48794deab0502b6dbe03c1a49ee52728fd3ec92389993e7464e8d8040e60b211d75bcec5adb4a19ca20af1f2232c652fc25159e12e858f3d07f08910093953401a8f70c11236df7992bc2e113e51b20b22a2296639fa6133b6015f802d66852bb2b4b698f1e8a81a76e67687d0b8508a371a3cfb18254265d57413dd9aaae3742eaa265f3456bf9dbdfb08fdf6b477a6a10fdad90e7a3355697aec35bf22a8f84b655ed7fb307d0489142c045faaa914e81c608e59c6f88b82749d9567c46aca74b4e1978b741a44795d277cf7243127e1597f2e5a3ae676b42c162909e2acf12f010fb756d886355f41a24888a64d5dd10af3515f3001e6911908bc84e293c988afbdabb7d440a2ec3de96ec06b56b4b9701e95e5ca10b6589c2733c81269da2cfc17b3d47fa89dd30503200099ee675147c9e6f97da5e3a7856a4decc4b8c165c4ef804f41c533835ac27e46741496675a2431086b71971f0d40370dbbb119242adaf4e729ddf8d1e04b69a669486aff6a0ee039a66c9961c66e0d6d5f78f3a1fff5432c41265936aea1995776862f892861c937f5904d376a339dbf99a02cc9cff84c27f206c5afe488c953a574c797e99f22b5c917e5fd1a90f3c17a4868d0688696a13dc911ff02f1ad4b6203e9d92f77bbe78470dca7c72009d61b3df1e7871b60921a0d54a6ebcaa148260672a3aedff2f9764f8197d9a0b6c934cceb6820a41476eb1b6a9110af53bb182dbf95046145f6bdf102b1cfa86a5afa8b08e603fc927f0460fa9563545c88d7ca5916dfdb5c9b6c767d520679e66bf673ec64502185615b13d9a131fa4651e5c8b40eaa278c771c4fef3acc35ef76d167f79eb68279911984ac9da9e54eb431dd2340ca6c72e04c2da65412db02aaa3246250c507eb8ff42c1d25b629f9340317ce8b71eee0aa0c015b2b905cfa739bcb9db63c6779cbf2a576a132b4028bf070686f89adfaa5ca91fade9b6f6b4df65a63848c502d2d24b94201e4713ecd2aafce1b7eb28ae4f96ab46476eefc5392d6ba2fe7220eb3458363b121c138d122a188c3dc60454f7ef6fbe7479cf56d1a20347d7960a7330ee392fbb02e0d5b59f7881035d8439568b8f438c0d91f38b1467eb4194f28f7a1558882f831aa7bf0679b0059c10180c66abaff9d238887a05ff23493cb18235efb163adc0a06a2c8099bbda391161ad30f52ab2c7627ab44e1ec88fcbfa08277e4418a7a2286601e56877d6269595c4885c64ea809e9c121caa5532d4aaeadb9e9e6651be49f25470bb0dee83448cd59ad75f4cdcdf2d6c3346d6065ca27b286622eb28fee3ce4399894dfbd1846725fad67fa2b818870e0aad72f9499e1fc776431e6fa6a6858f5c6f1f0b56126e8f912a126053d445f27429a596842da82b1c3b8308ffab9ca5d5c88a2d39b0f44968b0ab67222c6b93f8cafda69183c62918e96bd5d949173c140d1f7d0d256ab50c9fcdc61c725a4a1e1f4639c8363ea53abc87a8b8696a1b8dfd51814f19a6bbc18f5c567ee8d89e0a85879c50fc1ac149cba1e9453d5d262d272c3a76a0e254872e1f54e8fa6da6c8d2220605305dc398214609f1e31edd55c8185c46fc00880f28beba2b50b042b26b20d8fd7f26fd662142b0440addcbd3a64e6ee99bb583676f96927d779481a0647ae6a8cc059d35daea794868326bdb485de1940b2a0c5b90489666a5ad85e2a4c336c730d0cc6280111fd237f90c67e4f6815889ffd803bd9cce441ac59e2aadd6e546f9ac17507798d056b2a421d381866b954c30d33a932a629b67e2745913efa188f9bbce163bb69ed44d12c9167c406883793d6e073e31f74637aa4a17c5c1e67bc663294b8f573ebade9b593b1f720c74cc001f07f29d1168caf61ed84f913f70cfa5c6ebbade99e2d4a5a9b2a872a1b1fc75c65337ddb01ea09c027bb0ab8c5bb00cfe363edbbcaaccd3b997cf926dd2ccdc64d98cdaa4389d8e3c46a789810929302c1e8d10c233932e1144928018bde47eaef06a82746533c7a4b9f1b8253c9bdc89e63f7feb3bc7ccc9aee795df2fafc139fc21ea9013ba3a3c248747fa68bb7210b8557073f3fd7cfbcb3a57eab551aead27af9f716c1d528efcf4723c5755ddd767ba5543f9a7b1c112d10174ee53670c3efa51b94b73a0922dd298c2ae4bc7585bafc8404413f0042165cdf82fc68e9466646ef85d2a9b52bf523fe8094b7dd275c84288aa10f6fe14c5dd5f3e8b2e30e2f182083b5a1f4b0072bb58e0004fb9868578a1e1fcb8be370bfec6c5b2d0318eef1e9bb50ab89fd834ab0e625af5527a5e6f82f8a3a405eff949692ed2338cb902ca715293b77dadec10b53bf024f432daa9e080dd7f2810c25b850e8c2e0b405d1375275fa5e832390fdc7373e6977f682b358897fdf88ccd4f323356b80cc556eba9346d54c0472b377c06d453348058467141f388a523f6ee723496005e37bbb98d321df49a1884bc3561c19198cc35f2ff429ea6efe3161f569f92e1da035ff641f28c04a0a8052136df82f8b0447529ae3e27f8a58912e545514146409666760f5425a3225a4c26c143794808a9cba3f10821c3a9a6a419e06c57f5a6dff47370620808ab3cfdb8f2aeaa4c2eeb90405d1ac832bcc1a55bbffa814c3471d27765a5ed6edb3566edd96e20e6f108402df41b49faf48b75484ce9d37936b2f26672e80731901740049f18de88bd5eb2f58dc4afdd7a8f9198992edbed64c2602373c57e2c06bfddc03177ac292e562cbab5e054acd21318a4a10a4805330476c9099e3d7660d79a3b2b8be3c14d05fe246eb1c9964761289d097f71472a6beaa0127023697956632f8ba77250559a15ce9e7f270e6eb1edb62586cfc31cd4fcbed345891201cb9f2834761f84bd88f6ab147e6b3f1ff90139f9c6c4fcca9dca67f6f4474b102eb1d4765f13ddda3746d54e44bdd32806a9a8a179baf0f8d75593777e79ad9eb9a370db4ce21cf5fc496d6e521ddd7f2e86d2fce6bcd92f1dd8028592154f1a8734fedac7795d4c039d5ebd66d4ac8475a137ed935f20c7fad6ec11db1f86058949a36165489f84d9cda1b1bc1d4e247187d32e953e61716bb585c1d0454f7b965292fae8b22536dd70cab60356d1dbd744f7011c840ea57f5b80a17340138bbef39b38a34631fcb4ae8d262656ab1557b3d74e09da980adc68b54c5eb56ba9716374b1522367425691f578ca5d4cfdf22220b7694610d9eff4fad493158fdef22d1c936252b49153004e8c5ae8b53fc55dfc7aee6769d559dc6d0a439d4d709b116e3abb4ead94bc8cda7b0bd12c0a96a151ff242377453f06983beb82d144028101cfc7cb7b12abe9a1ce9de7f714f1c7c24357c98d11145b5a768f01b6e6f2bfa3da6a825728ec4d1186fb56378be287c83bb728ac1f2e844241a0d5cc98b9aab6996b7ecc14b7b499624b294b767111b76681e3bd0002113c7e3206caed1bbaadf9f536c32c97ba20607bd2711ce7fad2a83149529b060620ac3c8be317fcc60c721d23665f16c9e7eb87b8e591da318ca5d60a8cd6c7acc1d3c2d7a06e4483f0186f62e2ba305649189c5e53605892ca44ea79e249bc821f3e82e1c1583e7aadb19f0c574c2e138adaa6efbd425980613fbab36ff49733b6179e15246bc89971830913c0c225e6fd33bab45f351768e60d9016b5dbe6c9f4cce77d160878dc2a27e19edca99840bc821a66df08234e37b482e1cae6644af512098d2495c11ecb228a57c43ec86768f732eaa843d810a0faa286e1fbe63bdc46bf9e852e349d15c0a170c8fffabd3dc7839f6a8190b7184ec66bf453b4eb894885d61e9e21438073e1729f784790935607c7cfded186c2a6b134916d591421f72aef18288cd68f97f0998c659a81d73526766309ac0300415da7b642dfe8ba7e3c9c37af67b4893f119f69985e1e16f4bfc24a1dbb04462575658584d7a752252839e0787f818f41901f5080e1d52f35e165003d5c0f8281cca9a45dc44769f5665d33df75ff7ed753aecec1308e456ddfee4dfb559bb6fb36cfa647b5777228cee24821962f8350ed090a538f12a50724188e273c645315f4da6267f040104edf9029bbb4da1884407f8437f5d1665d870885f1bfcc6b28d3f367465ef32dae8fdb43ffbdeaee77e4193482563fcd3d841e2003850e5a4adfab4a1dab93d42a9d707cc91f5b78382bd068555baee3664a461831989b94c420c1bfc0b53e8e4a1b26a67764ff9d721bd676265bfd2d76548d3ee2aff5fa8c6f28673111195dd8108568c5baeb5928123cc3c1b07c07cfdfb5d1b71a90bc96b083b75ada40678238949c508ba6ce3af28e601b3ff5c087f63876b575fd2eb7323053775f5487a6dabf336946eda37230d3afe6a75e16af37a9193bf5ed51d5efbe577c4527d4cf0d0b8fa8a5f15c3a0c86b2984c2fa556522afdc5cf3989be38b3f1489a775cc80126f4d1a8441834285954db30d2035e886940aa2254c6a7fa3587c874574b47e8979ae0986eb3088e01a1a670b2d7b5f7f042960fea80d5a4b7db00cdcb715765d11897aac6584687657e883a35e36f6bb2e461ef2ffbb4694e11a41c08e8059b623f10c48f63c62fb5a371680dbcbaefc2f43d32e52de3db301729a1b604cf905eaf28e369efd2b04c8a6bb11d60be37de8897e2fd350db4d073e1e0ecdc8d430eadbcce1c2f9483546647d3dbd75abeb905506182853505c63ed3e3fc8bb6c544a55ec2358f987e91434db7b3b17e514d2f48f7319c7ef30eff72cab9a0852645eadbe45f34bd141f5de7b6dd367854ba7fd6658e0ab2ee66dd20f2bbf921f3cc5a0563ec062df41b6c9a4aadd81c262a9683ed1f5beed2cb04acb8ed18581103daeee290630e04d67226f6ac86d5c680cd7cf4c79256d383aad62adb72a01eec6d9f098d5ce17185b645b64c52293358623fcb8c77479dceacd1f35821b2e43b825223eadade6c6fb97aa9226edb450e9c188133f2b5ab21b3600f488f34a18db510c4fb0c894345fc280833c53bb2bcc559bc70effc2b5eca18b6d2a609fba4f8f44f77c93b8ef7d642011a633d790ec454d67642a944ad1d2aa5e96bc51819452dbfd7177f3dd9e1579be6ac226caa88435614d0c29b519def4c5f36f85425bdaf8dbf6e858cd02aca16c6c9d82a0f18c5090080164047f2e975e9ffeac708d3a2b8be97695b2736897676ed49b9dfda9c890da00b0cb6da8a832264cdb48d8779e719246a6a830fd4033094135fd6b9e636240a4e0349526f4536b5bd4b736cdfcd46a88de2344fa8db7a39fceb5b724a9376f7e51aa417f1a10baf63cf530a4e759c4be80b251ee82cb392bbd7183039d952a0d4d1ed64f506d9efe23b37f970187481518b39553343e89b89c2f6dcce66804b8d45e1d55ec1dc36cc679e462ef0170344a83a53bc23044a873d608da8320ac65e235db368ec238efc73a0203508252577fec225b42f66ed7935d065051184cc0371494b774893d57f30bcfbd03c7ab000091123fb60fa23dc7977917000d8e9ddab549cbf957485e17c342807ad67edd3919d1d5c4c847c8eb7c6fb1b6b756bbcaac63bd1cdc9f8d96cc9f91fdca6af5f66e6ddb2355d6387d4229529bedffda6fe0a77c0907cdfcf445c8c720eff421ee021081d34d0b73b54b3d84781a1ada9dc628a4b59f6253f1a3cff7e82c31014abdfb9015711302df5363c688e3232679cfe23c0b273f68c0e161f6548b405e8177ccef5ee92b215d98cc128ec7997bc8f7197c143accb3c720c1f4ed2e331130e4a70df1d89d4ac6bfc50c642cc8cc1b05040cae31594015470b104163e85a9f519ec28427b47a3a8a0b92dac1276436acbb54bac573e9b83af6955baa5e254871e2e681ac5f42219834da9a5411d59f497c6df3a89b46399e8060121f44b73ac189060dcfdc7e66f426462aeb94eb0d7a16135d140ece4e04fab9f317cd83c2da92777bb26d75957c8d170caff2d1572dee417551be25c2b0446cb6bbccead36a25e3a2f523bc9b6fe3537b3fe0aa0918ff2e90d41ab5d8203c9701bc04cc8b426fbb2b25601df442b472e6b5d3c2dde368e1329c36b3915b82af2137dbe48a5ab8cf13af4b255dbd31ea11473575a63c08ff3d36ed69a0982b7e2faf71b27cc091d7944b25c30144c6f1e98e0ff646ca67f3c1eab89ff4d3cfbdcf15e475bdc50b64f802fd83ffc56f99177e399c256d93b6fe616073e922ccea2b52b84eb6e9ed064f7acaa2bf7fec7dd2bee3d796bc0744082041a06cf8f1e45dd44b8bfc02b1a584fd52817f2c16f6d26828f8fe32f5863cd938c5d2c7cab425f6c614225dbc671e97634e210c017fa39c3f630c22a6c1ac6673903e55c2f09c09aad4dabb76072ce6ae8beaf03e48c627465dda54afd436d47f007c5b1c7b52cf55830d6a3dbcd561bac52be9e131182f46854ba40f55c86c7935413f3c9ebaed553f9b9fafb964f0c5a03ee454b8a21bcef78881b1dcd9e4f0944f5e0dee6770f7d32e058739d6a63eb6e264ada03dc9a30d0b1db52bb8d96dc1f7c6265fd93ec0da79c5898fbf9ebb3dc1bb2ffe8ad5eb8ab90e70f448d5fe3fad48c56d1bfcd93dd5b11f413eaeb15c0056ce58e6652cffa6da783774a82e27db165d9d836346f72747d8c8d85f9487e22f9fdd22afb05e33f35a5cf7168954bcfb11617d30de40fa8ad3c2f8f52d1728c2fcf55f6d1ebbd74086b553b14dd513b6350e3a768b8678ca52b18189a5b85564134db150477a016b7824e73e59449451b33fddc3fca5183dc7d9a198d69544c402d09a96e837c02247e4a6130d6eed2a9f2b30c3f738c35d70c85248c3b057359ed5ea1cd52b3d75eb9d54174e6a28ee2c6111a86baa9775f96a245abd0122b84590b748d11e36778668804478853cc95a6b177be3e89ad0d4dd55cf07353cb8977d3bd98060e117840d167f0db84d406970401cb2938b18074c16b36f9fd560d2658a28f3aee83ffb01f39fd96972dbcddd32018d34891143f8288664e979993eba480034fdab02115f30ad476c5814c52236c0351dce3f0dadbe16ad102d558e58e46f4de316d601f1eb8559fd6e7fa0da2edaa56f5a01fe1666e4700cbc5dc1ef9f7674f1fa53a82de533f9084a762ef55562b17634c10f12f1430c0c7be8aa9798546cd20c5eff8408a3cb350afaddd7ee636cd8ec151e393db773f5bbd9e176a34373d86ef942dd0d79b9e271371ed04fc6bee281bbcbc2cb0964bfde1e396a4c18625e8e24c29951cbdc14718e6d5109b0c08565d7735b9bca70a223539dda13c5e09eedc6ac0cfbf99a4807070785cf8dcebbab95d7a05ef72583571f7cf3444111c2d7cf6631862d9975944aad75d7121705fae35559fcc29c10be0ef7945100115b9f3c54195f6ba9878e79c64132a7fe77767413faf8cbbecf2ff69e85ec340b5692343cbd35c12b18aabc308b5d49214f95c8abe9237658b6f43919438f0789c7154d639c21103181eb034aea16574d9b6b961ebaa798d75ac2904f37e5a683dbb687f10e0818620bbadd332c64b26e0a1f4c6f64cfe00b35e9c5c8265032b1bb6ba5b13d924d0d200a10249cf5b69919d56f2f8ee7d0400c4ebf7153181646511f2519b3bca740aec21d724ced7aa4b820ab901cdfea9c89112d9e50021c63c6707ad027f5ca0be19cb4de574ebbafd938b3e9570d8be400d97da0ee86ba610153c7075ffa8b175ef3946454d98d904b82ce7ca96ff4cbac78721ac8c31f05fbb8e42c55b32556888450385e3540e73d58af2f6078582f2e941d213a237de856139ef5954f8af94fa85a9ece6f4b649d63fb0284a9c4fd576ad72a86371c8e8b2f43c27ce93027d0c7593926a6d69e87ea5795b61888c1aa80f605d1ba68fb1af27697f8a409f800b9405fc44a2b70c283d640d237b73b444da8326e7171c2f699e87c63a02d79cc10e62da48ed2f97597ab3c57c2944b11186e1df36974cc03a7c87606755b499406d36a35de4966e5a983e8cf04168af815d21fe1af84864fdbc6fc0b1a881b7f266d8cf96c7b67bd124bb3c785236d119466f2ff51edef931037f4fda1951cc8518579c4fd97d9e6e43c8848d5ec133e47a9aa5bc6f49295e63884fcb22e77fc54e4941241b888a31aa59e107b714f37d474deb8b9a62bd3a6e3867e6b8a972ffcbdd03d0c48345a50b025da83de2dd8136643c674915030edcdde1db0742a3f69d8dcbe5f87362de6cad7bb3b395799a1c98d7ab4b909d19699256f2e028fa054ce49aa8645a150c2dcf0ebbabd87f87c14285b7475ea9fb1a2b772092d94e4a2332122b14c958c48dc2d147d4f797e5cbb1ade04c953f37555803900b7091ad9c274db66dba1ad056534beb09ff8030ec81d88848d7089d787aaaf897a74f9f91692557e5b306cbc359b986356bdfe5682a624c554dc42f3e521c76711beaa01733ba252670a55910720d4e62e0d294f49c7a5be941ab31619b07f28784a8196105c38585c29fbdfdf32b29c9dff18edb10cd5d176199bbec3d9c4b2eb6a5ee2867b255ad92ba3774d2356ce55e4ffee3c5cf8fceed59dda03fa9cda4bd1fc8f7005e2d9b67b2b729af552856a2d69a43380d8e3582bf5a0844ad15b75115a79b3c343c898164ca54480b7c4111b33949585bd30e2e660344012ad27a9e85fdf6ce509e07ea1ad1d81816db8e485d029101155c57641e2839a65c77e5eb43ccd16f81f626bd74c084bacde9e7716266b39a463ab4a1f2055fbdc00c20ea10db76139a5b90e106bfa4a51f41d475c303d094b6aa0303775b834388fee4d6677e18deecb5eaf8c3d591d3cb4c956ae34c7c60fe071f5d3f19cab9a59dd9423c6e88af1fa1223501da07cc214b18724ec1c587951ba0b1dc970bda7dc0ef804fdefebadee0965e023312ab274d01ff551753dc0b7afc85e10b68a9f56428cc2267fab541213b3fbf509cab4daefa4c984e8b1480724e2e399e42086c67fecda7789d5c380e0f257e6e475c63c832aa4b17c31f83ba5d7ca5db9fdc57d4dbc9e8affaad3b65d1b3c4bf0b75df9f602ac32d1ea696219afb6952a294f4b540cce84a33242e065c609afa4e97d83aed8fbc70e410bb4ac1e64656c713f72378bfbae088c13d3e8e1fadbd2f5cfa1718d26c9376cb66449aecd642d476cdd411ab79511ea6608cfc1686b83d4ea4a0f8f197a759b62753860ab0c47b8caa719338d29ee89c6953ed4beebf5685b8b2ba9eb59fcefa66329670c5fe2ca4435c41b5ec4bddd9a69aa5727f8c7026cc337e7f5ea2b85d3e6eadf65d1da59921e9601684cbd6db98176793a8a778e4f97171b0a271463c772de46a0436964b32a57a00ff7e9b78ca13c743767b460bedf3a1d701196e2a87424a7fcdfaf115afcf9476b7992addc11bf5dd4485153818ddfe711c3fc14fb30aa9336100044e5a37d30d6d246459a6c6c38a28b0ee36c5f4ded811a115f23d4853e71cfbc48617fc8d469baeafc65234b2284f93d2a41953de6549f9c41b571867bbb6ff418332d3cbcc109f85d59203bc4d222a70ef70373f65e9cf0780289af7a3d8d168265f3864c5d2e933bacfa2424be11948b89596109584ca6e8ee0144c3d99a82cfab8846844f118601ab906b0b44730d79c9169db3822060b3fe635b51c060ba336c774dd1a5612319c004cd5a626743a468607a7cce9fd29ece8b85e868444b17ce733e80d2eae2e43585ed707a50ce1b2a2173dceff5f35b4dfeb79a69e18ae83d3f8445f0dd7f896096bd7e10383a59f95db4cd85ed6e54ca1cf899e13cd8fcf8d894fdde52f8598fb1581db8f2da9bd57d644127db11aec8803135259c6cad21a3a8cb51b86f5832f74d2d7da4c00ad6e04975e7986d4d7f5182ad6ac51225ea5bf595012f4da7a714ff27a654cbc5614843c848aaa8d1e71be240742e0225408d964430303d332924cf588f4c0bfb75f32c2907095476f00465ce5377a0864ea08f2916a2194b915e61d9829ba0af574d7d8d4fc61be6557c49d9b1893796a674dcd4a2d0ab1540da21721f9ba2889d40d11d15a03f47fb9b4758fb5d396fc3ef09dd2eb17340651bbd4d4d302171b64a5d134a14c2f5761d69baf6e087645f1569ae3c9430bd62569a771c3c9d386357852630d14d59bccaae73e88e79fd335da885dbc26e317a560e886b46237a9bf974c90f17e8d1a3193eb8f6a8a4085fe6afcfc6625155f230cf95e28b02b2aa25a07dd2b9402a7e11a026050b95f200b7f559706d39de6ea5c6a3290939e06c2dca3293634d1380cbea8776653dcd705517ec2d729f81f6402d57a065a801fad2f4c318f858e12657835c6477ac3168ca4094abd3e684a49eecb3f72361e2950d32c7279a81d3d6a36479bb03f1ac6bfca0e129b096f3fc11b1a31322a3603bdbcf5f25ef6983aabfde61dbbfb31aebf6a6438c0de64b0fb58146993c8339ed1575816a6db7850ad758ee3d1b493442e12deb80ae936380c081a69dfbe7b86cbb28d5c225733e9c7e7674418cc7696f6bc482688210a51cea3c76ba11c21c21d75191c1f92f2834c1a9f9c6d1be9ad98508e7b4876621c126d0a3b9432e15f6aef3241bebfc3cb8f2dab4b96f97a61ee2e7312845d3614d817793f6c40190d7b17ef2b7bfc8ce665fc927dfd178722fa98d37e58d5c3ea763893f1f46390b9e412bb7b986e6f26e6b4998a7b7252bee2a919d92a4f63bcbccf52f7a4236cac4964dce74ba8572e8481de412bb53a0ec1667d3f64526bce5b1d39b5a49449f20a6d274d55e60b0c722a8c3606a1aed9a73738d634bd51a4b4be81283351fabfe38d8bc07b96495b56be9c69adf49958224936770455c97be2e895476df55af2d69e308a5b1f898d2d60896055b8f95f99cda6c961be77245025b3aae7411644fea5d5ed7c0f9fb6a9d48af4287b4be060236cee349ec67d4e94f6da473e30d4d406d95c62c1e7814aafe12b62e4ebfa9b4421b156a67e6743bb98d4bd17da6eec1e5a6591e5b6215675d6704257ca0cd1f71717e12fb61f365c8309df3e3e7646cf2ca5bf8fbb0e602e769c5510b11bbf114744ee38b80e0200a059a64daa7b699ea04851f976a7ac131cc0e2da1375524def3476375b4c4fc0e8e9e114f8873394b2ae418d4bff3bb202b523d2b7c897bbbac4f2af74dd5887ca6f5bfdc6a379332dd8f0a6a3b5792c1f1921642c1498dc23802f39f4e43e8f51f3415daa93f1985ad00c9e8768cad571d2016f57b05337882a38ad9f4470d205b1eb895de995fe90369bf0b6c0d73c5923465938cf6750d0a46ef63875d8eb0958c48459bae7ed3d0e6f1a4ff0c876e86f23f199e98d6fc6810cc76de5161e8c5d2e502ef34cdae2115a05ce7760248fbf9d29f89d80de97a7c4ce37d6999ed4c65057c55aa5b6295e0897474a4abd86b58a630b5519e24a96a9c36481adf71ef824507f25f9c01a6e39074e0f00dafdb7da29b02548c129eed0f20b79b112a64e73ea9f6beecbfbdac88cac419f91c685e36f599e7419d1b68ee540daf765f2281a336d8d5994334420ccf21ac60cde19a49d0df073a40445ecdd194aecde7a0c42d2d896a031477712bf49b2967b5d1a24f133bb7553be28f71887bbc6f8b5359c45887ca6a95b586a04bae80994c31d39264e90306f73714ccddc98ab09f33d46be27789f44508d7a4e0294ddb7a972022adef1feb4bbf80b6acb41388b29f99d86196551e89be73d3fda6fbd1cca14dcc0044a97c9e1430600238a4ed27cb144440da1d6273ec8750b8d8035c7924a123c47777a396502a8ab6b7b98c93fe28a08d8377a606e099c8ad9f42dcac63554b356a129a9e9573fcfb207b27baa436c6d4ddb4f8580d914a1263461e304db5e0815f7dd9b755db529032597b77050aa6c653afe3f7d7eac9e3df2d52b926639aa3f51d8cd5471da36ecf408bd859ce900e439901bd20c3c1bf000f6e62cd234e5fa295118a5b5f55100702fdafd43a7398894f4a3dd4f74889d27294143d5f3609d97ac3323c6f3d6ecbe990dcb5d975358f54153f286e78c8cfbc76cf3e2540614252d267ac9327d13fde8abc4b282014be61a11450aa26626c478ccab01c380f39cea9dc5d67501ab68b06bdcd6440d7ece6f784539530afbb27edb7b1a83bf6576ec304ad3538edd4a02e1fe9ff821eda6d9c8f6eb4ebad0d80fc45576ab4426f0b390ce9fb42312c23430d040d85efa8cde8e1a3c47a082d33cbea897edf90b00820032156816c8cc1218b9cbc41108f910a9a072afb6d94c20b5daa083a8c6f1e49570a82b779b06e91e01eeec67ad5fcc586401c91030a8300014a92973e2b4653816cfd1866ebe6a07b7b9050176f3f0fd7deb7094b96dca67a7fab85f80275b5616414ba3d11bed295420cb62860d5a01fe557eba85cab0dfbdd4ed1d7f30cdc0540690d7bfc99ff1e5915e91fd99a5b94d2d26eaabe72c2e727cb88748e83899ee6f2f6efac8eb7d66b7578fa17671b4b70ebdf40a36ec697ece2a6d2b170bd083c0efd515b81acdf56c750064571d635ad50165f1e98519b12655820ef9393b33d71e037d8ae46f6e9ac84b732b21008111b16796ea62181f264aaa19c362b426516c97bbdbbf0b0da0e47f805847067261b62d7d699124645c6a6a983565815e6de4fbc31263380b6dc811fa9d4c1ed15690b2dc7c1afa5a4a810ee69bb8759c898287630273ba24ee35f314790e09d865d2e82dcacb1ed2ef7614e2bd9aaaf2c7b1fd1cac6b3b56058d33a13e5d998b5cec54b5968271a32ce79f80118678f2978011bbaa86de2c5579e966ae17c6dd435279303fcb2d1cfdffafded27c921d1feea042f83e96f01bff7fc98215044eff87f28e65559c9b030a0676eac25552b5961084f162e8bb638d52c81b091ddbdaaf684c6f1cce30ff4c8c60f55148aed8bc5894c22114a2f37c483bd9d9eb809a483f918cd901f9c48251f8dcb19f35d61bf1105ec96e66f22601575a5abeedfd08dc5ec6669790c3b47e557d391adfb259ee0c86566ea1c4a93ad18003cb35a752e91df73a688cd65b92b754071ce3f6328f76c6d6f455eae1c4cd80e2b05cc183e1dadcd83deab48dcf62d191e0f69e1ea30f050b80640b70c4fd455fbd6649d36f54adb32a85ed69d81552ddf2e2878f85120b57279c645236986f1affba9e034017145436f7519e5681fa5b9940890979fb54be43bbfb05f37c2013b88ab65e52dd207b02230e112b4e44d70557befcc749e00d1667db05f37c2013b88ab65e52dd207b02230e112b4e44d70557befcc749e00d1667d3edab1ff7eb6bf33f108e9ac1a08eb16c954b88a844e3119adf5950b44014eb611cb6f5cf19bc18ac0560bff08c21e5a715d9e488ed7b90715ddbb518fd57060e234489f88176e66bd858291d9de7054c6bdcedbb9f19ebedfab02d238b3dad79ac6a853e324ff7c5e92f5e9bbbfcda63466ec3e8a17fd9b3247f183465e93ca372fd5afc77f0d7f38658bb86153e8c7472376a5d735412237aea47881eb714ad1ffba188101427d74509d8786310f1e0793a251f31819283664626cbb6286bcdd109bc3de5bef59a8492c6f849e7cf1c2a665d6b5844e749d36a714fc4eb8f652fe79b889ef808d2d515a143bd50327674d18780056158238e627e37eaf784b4505976a7c3561f4c11d3d6507b4c18b802110be70e1266ecd65aa25fca9510137f5d6822f4308c7525d307bc5aa18c4a8cd6450e22a5d3ff8ec4fd0e0db96029b188fe909be6889a961ab6d53b11520bc8ef965b7387b554bd7c482b02b0f4f80d00110a008aff7aed1c6d66dfb2edfa2605d155c2d97a1c2877fd1bf4d770e6708988dc83ba66d6a40a20293dfee564ed40c41d5e541c2997e512019841b0b19fb878199014dea84874d11e319609135d4251944a93718a1549871f86355fe0d12397a1e4e4db62d46514798e653a11b107fa6d6cbd7c1d4a8795f849809cbf723c6b3654d1ff2ac20fe4e91db0ffb8387d06864cabae9e45d13b197ef3dcccc6b0296da09999c1156c66710e48fad121d7a7eb3f20a9281c83c7715e7f759dd2b11d8da24b078973a81d23f56a3cd370391c47ad7ea923f5233254b2c62a41ea39a3c45f364074338dbc792fc2c11e46cd8506f84eec2d00b8b7cd076d84a54a4e74dfb2af63dad0b61ff21f4f95994201c284fe8f586948c544ff57e966e81d01c4e3d56cb060111b09771b67ad0ce7c76f75907623f84b05a05d45611f5bc55eab02c151e601843afc2885ab9824b294c7d32e6352066793e8ccf6663071d70e16fed8696139a12f8dc737261cc47235f1f6043d92c85ee5f87b03e8429e9657bb9f64a21db6c7e0cca7c1f3ff6a65af73bbecb35b1a93de7ddc539df9a5eb5dc9143c8d61b9b80d5cf522b829938f539a301cd22e79e52f6213df15534953e17076aff00521a5402e73915fd843905ff5a92e6db5564e3ddd38febf2dc5e8b6c7840d556c9d7eed953dea0cf43b01fecc45edfa2a8e9b2cfb89d9914c4b70c4fd455fbd6649d36f54adb32a85ed69d81552ddf2e2878f85120b57279c6e7c423abe1e9634d96700d7f81f819054be5d0517297a93f66600582fe3e512e@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootselinux-policy-3.13.1-229.el7_6.12.src.rpmselinux-policy-devel       /bin/sh/usr/bin/makecheckpolicym4policycoreutils-develrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PartialHardlinkSets)rpmlib(PayloadFilesHavePrefix)selinux-policyrpmlib(PayloadIsXz)2.5-82.5-243.0.4-14.6.0-14.0.4-14.0-13.13.1-229.el7_6.125.2-14.11.3\@\@\\@n@\aT6xT6xT@S@SSDSg}@SB@S>S;S:@S9XS5d@S4S2@S0@S,)S*@S)S)S&S&S"@S!S L@SSS@SSc@SSnS @S SK@RRR@RRJ@Ra@RRR&R&RRR=RʚRR@R@R@Rv@Rv@R@RR@R R@R@R|@Rz/@Rz/@RsRpRnQRi RfhR_@R_@R[R[RSRNRNRL RIgRB@RB@R:@R1R-@R-@R(r@R' R%@R7RRNRR@Q@QQdQQ@QQޞ@Q@QکQکQ@QzQQ4Q@@Q@QKQQ@Q@Q@Q@QQ@QQQQ@Q@QQQ@Qzl@Qw@QvwQo@Qo@QnQm=@QkQfQb@Q`@Q^QZ@QQQIQGQ@j@Q9Q8@Q4Q0@Q-@Q& @Q$QQ@QQ@Q @Qh@QsPP@P@PP@P[PP!@P8@PO@P @Pf@PPqP @PP7@P@PPPYP@P@PPPM@PPd@P@PoP{@P{@P@PP5@P@P~P}L@Px@PvPvPuc@Puc@Pr@Pmz@Pmz@Pmz@Pj@Pd?Pd?Pb@PaPaP[@PXb@PWPS@PQPO'PM@PIP@@P>@P8@P7lP2&P2&P,P,P*=P(@P#@P#@P!@P!@P@PkPw@Pw@PP

@NNU@NNl@N@N@NåN@NNNN@NNN@N@NGNGNGN@N@NNS@NS@N^N^N @N @NNj@Nj@NN$@NN@N/N@N@NFNFN@NNN@N@N@N]Ni@Ni@Ni@N|tNyNx@Ns:@NoENoENiNf @N^"@N\N[@NTNS@NS@NC@NBrN:N98@N7N6@N2N.@N*N)f@N(N%qN$ @N@N7@N e@NpNpM@M@Md@Md@MM{@M@M۝M@M@M‘@M@M@M@My@My@M3@M@M@MMM@MMMMTMx@Mx@Mv@MlMbSM[@MRMQ0@MQ0@MJMGMGMA^@M>@M9u@M6@M5M4/@M4/@M0:M,F@M$]@M@M9MMMMM\@M M M@L!L!L@LL@L@L@LOLOL[@L@L@Lr@L L,@L,@Lډ@L7LLLNL@LΫLeL|L@LB@LB@LB@L@LMLL@LdLL{L*@L@L5LLA@LLLL@LcL@L@L@LzL)@L|L|L|L{@LvW@LvW@Ls@Ls@LrbLrbLmLk@LjyLe3Lc@La?@LZLYV@LXLN@LN@LMxLMxLI@LH2LF@LEL=L=L=L;L7@L LT@L@LL@L@L0LLGL@K^K^KKKj@K$@KKK@K@KK@K]K޺K@KtK#@KKՀ@K:@KK͗@KŮ@K\K\K @KKKKK9@KK@KK@K@KKKKrKK~@K,K,K,K@KK8@KKK@KK@KqKqK}+K{@K{@KuBKs@KqN@KjKie@Kf@Ka|@K`*K]KXAKTM@KPXKEKEKEKD{@KC)KA@K;@K2@K0K/c@K+nK*@K(K"4@KK>K>K>JJęJH@JH@JJJ_@J@JjJjJ@Jv@Jv@Jv@Jv@J$J@JJ0@J@J@JG@JG@J@JJ@J@J@JJJ#J@JJJ@J:J@JJQJ@J J J|@JzJyt@Jyt@Jx"JrJrJq@Jn@Jn@JmJhPJeJ\s@JW-@JT@JS8JKOJI@JCfJCfJB@J@J@J?r@J<@J;}J:,@J7@J67J2C@J0J/@J,@J%@JJB@JJMJ J dJ@J@JJ@J*@J*@II@IIA@IIII@I@IIIX@IX@IX@II@I@IcIIo@Io@IzI)@I@IܑI@@II@I@I@IԨIд@I̿In@I3I3I@II@I@IV@IIaIIm@I@I'@II2III@IIIIIIII@III@I1I@III~@I}Iy@Ix_Iw@IuItk@Itk@Io%@Ik0IeIcGIa@I`IVIO@IJ;@IHIAI>]I= @I7@I6tI3I-I@III9@I9@II IP@I@IIg@Ig@HHH@HrH~@H,H@HCHHH @H @Hf@Hf@H@H+H@H׈H׈H7@HBH@HǶH@HH|@HHH@H{@H)HHL@H@H@H@HnH}H|@Ht@HsVHr@Hl@HkmHgy@HcH`H_@H^>HRa@HQHQHO@HFHFH$@DX@DU@DN@DN@DLDH@DGwDGwDDD@@D?D?D;@D;@D:HD:HD2_D1@D1@D-D+@D+@D'D!<@D!<@D!<@DDD@D@D@DDDDDD@D@D@D@D uD $@D D @D @DDDFC@C@C@C@CCCCCR@CCCCC@Ci@CC@C@CtC@C@CC:@CECCC @C @CعCعCعCعCC@C-C-C-C@C@CCǖ@C@CáCáCP@CP@C[C @C @CCg@Cg@CCC!@C~@C,C@CCCCC@CC@C@C@CZCZC @C @CCCf@Cf@Cf@CC@CqCqC @C @C @CCC}@C7@C7@C7@CBCBCYC@C@CC}@CqCqLukas Vrabec - 3.13.1-229.12Lukas Vrabec - 3.13.1-229.11Lukas Vrabec - 3.13.1-229.10Lukas Vrabec - 3.13.1-229.9Lukas Vrabec - 3.13.1-229.8Lukas Vrabec - 3.13.1-229.7Lukas Vrabec - 3.13.1-229.6Lukas Vrabec - 3.13.1-229.5Lukas Vrabec - 3.13.1-229.4Lukas Vrabec - 3.13.1-229.3Lukas Vrabec - 3.13.1-229.2Lukas Vrabec - 3.13.1-229.1Lukas Vrabec - 3.13.1-229Lukas Vrabec - 3.13.1-228Lukas Vrabec - 3.13.1-227Lukas Vrabec - 3.13.1-226Lukas Vrabec - 3.13.1-225Lukas Vrabec - 3.13.1-224Lukas Vrabec - 3.13.1-223Lukas Vrabec - 3.13.1-222Lukas Vrabec - 3.13.1-221Lukas Vrabec - 3.13.1-220Lukas Vrabec - 3.13.1-219Lukas Vrabec - 3.13.1-218Lukas Vrabec - 3.13.1-217Lukas Vrabec - 3.13.1-216Lukas Vrabec - 3.13.1-215Lukas Vrabec - 3.13.1-214Lukas Vrabec - 3.13.1-213Lukas Vrabec - 3.13.1-212Lukas Vrabec - 3.13.1-211Lukas Vrabec - 3.13.1-210Lukas Vrabec - 3.13.1-209Lukas Vrabec - 3.13.1-208Lukas Vrabec - 3.13.1-207Lukas Vrabec - 3.13.1-206Lukas Vrabec - 3.13.1-205Lukas Vrabec - 3.13.1-204Lukas Vrabec - 3.13.1-203Lukas Vrabec - 3.13.1-202Lukas Vrabec - 3.13.1-201Lukas Vrabec - 3.13.1-200Lukas Vrabec - 3.13.1-199Lukas Vrabec - 3.13.1-198Lukas Vrabec - 3.13.1-197Lukas Vrabec - 3.13.1-196Lukas Vrabec - 3.13.1-195Lukas Vrabec - 3.13.1-194Lukas Vrabec - 3.13.1-193Lukas Vrabec - 3.13.1-192Lukas Vrabec - 3.13.1-191Lukas Vrabec - 3.13.1-190Lukas Vrabec - 3.13.1-189Lukas Vrabec - 3.13.1-188Lukas Vrabec - 3.13.1-187Lukas Vrabec - 3.13.1-186Lukas Vrabec - 3.13.1-185Lukas Vrabec - 3.13.1-184Lukas Vrabec - 3.13.1-183Lukas Vrabec - 3.13.1-182Lukas Vrabec - 3.13.1-181Lukas Vrabec - 3.13.1-180Lukas Vrabec - 3.13.1-179Lukas Vrabec - 3.13.1-178Lukas Vrabec - 3.13.1-177Lukas Vrabec - 3.13.1-176Lukas Vrabec - 3.13.1-175Lukas Vrabec - 3.13.1-174Lukas Vrabec - 3.13.1-173Lukas Vrabec - 3.13.1-172Lukas Vrabec - 3.13.1-171Lukas Vrabec - 3.13.1-170Lukas Vrabec - 3.13.1-169Lukas Vrabec - 3.13.1-168Lukas Vrabec - 3.13.1-167Lukas Vrabec - 3.13.1-166Lukas Vrabec - 3.13.1-165Lukas Vrabec - 3.13.1-164Lukas Vrabec - 3.13.1-163Lukas Vrabec - 3.13.1-162Lukas Vrabec - 3.13.1-161Lukas Vrabec - 3.13.1-160Lukas Vrabec - 3.13.1-159Lukas Vrabec - 3.13.1-158Lukas Vrabec - 3.13.1-157Lukas Vrabec - 3.13.1-156Lukas Vrabec - 3.13.1-155Lukas Vrabec - 3.13.1-154Lukas Vrabec - 3.13.1-153Lukas Vrabec - 3.13.1-152Lukas Vrabec - 3.13.1-151Lukas Vrabec - 3.13.1-150Lukas Vrabec - 3.13.1-149Lukas Vrabec - 3.13.1-148Lukas Vrabec - 3.13.1-147Lukas Vrabec - 3.13.1-146Lukas Vrabec - 3.13.1-145Lukas Vrabec - 3.13.1-144Lukas Vrabec - 3.13.1-143Lukas Vrabec - 3.13.1-142Lukas Vrabec - 3.13.1-141Lukas Vrabec - 3.13.1-140Lukas Vrabec - 3.13.1-139Lukas Vrabec - 3.13.1-138Lukas Vrabec - 3.13.1-137Lukas Vrabec - 3.13.1-136Lukas Vrabec - 3.13.1-135Lukas Vrabec - 3.13.1-134Lukas Vrabec - 3.13.1-133Lukas Vrabec - 3.13.1-132Lukas Vrabec - 3.13.1-131Lukas Vrabec - 3.13.1-130Lukas Vrabec - 3.13.1-129Lukas Vrabec - 3.13.1-128Lukas Vrabec - 3.13.1-127Lukas Vrabec - 3.13.1-126Lukas Vrabec - 3.13.1-125Lukas Vrabec - 3.13.1-124Lukas Vrabec - 3.13.1-123Lukas Vrabec - 3.13.1-122Lukas Vrabec - 3.13.1-120Lukas Vrabec - 3.13.1-119Lukas Vrabec - 3.13.1-118Lukas Vrabec - 3.13.1-117Lukas Vrabec - 3.13.1-116Lukas Vrabec - 3.13.1-115Lukas Vrabec - 3.13.1-114Lukas Vrabec - 3.13.1-113Lukas Vrabec - 3.13.1-112Lukas Vrabec - 3.13.1-111Lukas Vrabec - 3.13.1-110Lukas Vrabec - 3.13.1-109Lukas Vrabec - 3.13.1-108Lukas Vrabec - 3.13.1-107Lukas Vrabec - 3.13.1-106Miroslav Grepl - 3.13.1-105Lukas Vrabec - 3.13.1-104Lukas Vrabec - 3.13.1-103Dan Walsh - 3.13.1-102Lukas Vrabec - 3.13.1-101Lukas Vrabec - 3.13.1-100Lukas Vrabec - 3.13.1-99Lukas Vrabec - 3.13.1-98Lukas Vrabec - 3.13.1-97Lukas Vrabec - 3.13.1-96Lukas Vrabec - 3.13.1-95Lukas Vrabec - 3.13.1-94Lukas Vrabec - 3.13.1-93Lukas Vrabec - 3.13.1-92Lukas Vrabec - 3.13.1-91Lukas Vrabec - 3.13.1-90Lukas Vrabec - 3.13.1-89Lukas Vrabec - 3.13.1-88Lukas Vrabec - 3.13.1-87Lukas Vrabec - 3.13.1-86Lukas Vrabec - 3.13.1-85Lukas Vrabec - 3.13.1-84Lukas Vrabec - 3.13.1-83Lukas Vrabec - 3.13.1-82Lukas Vrabec - 3.13.1-81Lukas Vrabec - 3.13.1-80Petr Lautrbach - 3.13.1-79Lukas Vrabec - 3.13.1-78Lukas Vrabec - 3.13.1-77Lukas Vrabec - 3.13.1-76Lukas Vrabec - 3.13.1-75Lukas Vrabec - 3.13.1-74Lukas Vrabec - 3.13.1-73Lukas Vrabec - 3.13.1-72Lukas Vrabec - 3.13.1-71Lukas Vrabec - 3.13.1-70Lukas Vrabec - 3.13.1-69Lukas Vrabec - 3.13.1-68Lukas Vrabec - 3.13.1-67Petr Lautrbach - 3.13.1-66Lukas Vrabec 3.13.1-65Lukas Vrabec 3.13.1-64Lukas Vrabec 3.13.1-63Lukas Vrabec 3.13.1-62Lukas Vrabec 3.13.1-61Miroslav Grepl 3.13.1-60Miroslav Grepl 3.13.1-59Lukas Vrabec 3.13.1-58Lukas Vrabec 3.13.1-57Miroslav Grepl 3.13.1-56Lukas Vrabec 3.13.1-55Lukas Vrabec 3.13.1-54Lukas Vrabec 3.13.1-53Lukas Vrabec 3.13.1-52Miroslav Grepl 3.13.1-51Lukas Vrabec 3.13.1-50Lukas Vrabec 3.13.1-49Lukas Vrabec 3.13.1-48Lukas Vrabec 3.13.1-47Lukas Vrabec 3.13.1-46Lukas Vrabec 3.13.1-45Lukas Vrabec 3.13.1-44Lukas Vrabec 3.13.1-43Lukas Vrabec 3.13.1-42Lukas Vrabec 3.13.1-41Lukas Vrabec 3.13.1-40Miroslav Grepl 3.13.1-39Lukas Vrabec 3.13.1-38Lukas Vrabec 3.13.1-37Lukas Vrabec 3.13.1-36Lukas Vrabec 3.13.1-35Lukas Vrabec 3.13.1-34Lukas Vrabec 3.13.1-33Lukas Vrabec 3.13.1-32Miroslav Grepl 3.13.1-31Miroslav Grepl 3.13.1-30Miroslav Grepl 3.13.1-29Miroslav Grepl 3.13.1-28Miroslav Grepl 3.13.1-27Miroslav Grepl 3.13.1-26Miroslav Grepl 3.13.1-25Miroslav Grepl 3.13.1-24Miroslav Grepl 3.13.1-23Miroslav Grepl 3.13.1-22Miroslav Grepl 3.13.1-21Miroslav Grepl 3.13.1-20Miroslav Grepl 3.13.1-19Miroslav Grepl 3.13.1-18Miroslav Grepl 3.13.1-17Miroslav Grepl 3.13.1-16Miroslav Grepl 3.13.1-15Miroslav Grepl 3.13.1-14Miroslav Grepl 3.13.1-13Miroslav Grepl 3.13.1-12Miroslav Grepl 3.13.1-11Miroslav Grepl 3.13.1-10Miroslav Grepl 3.13.1-9Miroslav Grepl 3.13.1-8Miroslav Grepl 3.13.1-7Miroslav Grepl 3.13.1-6Miroslav Grepl 3.13.1-5Miroslav Grepl 3.13.1-4Miroslav Grepl 3.13.1-3Miroslav Grepl 3.13.1-2Miroslav Grepl 3.13.1-1Miroslav Grepl 3.12.1-156Miroslav Grepl 3.12.1-155Miroslav Grepl 3.12.1-154Miroslav Grepl 3.12.1-153Miroslav Grepl 3.12.1-152Miroslav Grepl 3.12.1-151Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-148Miroslav Grepl 3.12.1-147Miroslav Grepl 3.12.1-146Miroslav Grepl 3.12.1-145Miroslav Grepl 3.12.1-144Lukas Vrabec 3.12.1-143Miroslav Grepl 3.12.1-142Miroslav Grepl 3.12.1-141Miroslav Grepl 3.12.1-140Miroslav Grepl 3.12.1-139Lukas Vrabec 3.12.1-138Miroslav Grepl 3.12.1-137Miroslav Grepl 3.12.1-136Miroslav Grepl 3.12.1-135Miroslav Grepl 3.12.1-134Miroslav Grepl 3.12.1-133Miroslav Grepl 3.12.1-132Miroslav Grepl 3.12.1-131Miroslav Grepl 3.12.1-130Miroslav Grepl 3.12.1-129Miroslav Grepl 3.12.1-128Miroslav Grepl 3.12.1-127Miroslav Grepl 3.12.1-126Miroslav Grepl 3.12.1-125Miroslav Grepl 3.12.1-124Miroslav Grepl 3.12.1-123Miroslav Grepl 3.12.1-122Miroslav Grepl 3.12.1-121Miroslav Grepl 3.12.1-120Miroslav Grepl 3.12.1-119Miroslav Grepl 3.12.1-118Miroslav Grepl 3.12.1-117Miroslav Grepl 3.12.1-116Miroslav Grepl 3.12.1-115Miroslav Grepl 3.12.1-114Miroslav Grepl 3.12.1-113Miroslav Grepl 3.12.1-112Miroslav Grepl 3.12.1-111Miroslav Grepl 3.12.1-110Miroslav Grepl 3.12.1-109Miroslav Grepl 3.12.1-108Miroslav Grepl 3.12.1-107Dan Walsh 3.12.1-106Miroslav Grepl 3.12.1-105Miroslav Grepl 3.12.1-104Miroslav Grepl 3.12.1-103Miroslav Grepl 3.12.1-102Miroslav Grepl 3.12.1-101Miroslav Grepl 3.12.1-100Miroslav Grepl 3.12.1-99Miroslav Grepl 3.12.1-98Miroslav Grepl 3.12.1-97Miroslav Grepl 3.12.1-96Miroslav Grepl 3.12.1-95Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-93Miroslav Grepl 3.12.1-92Miroslav Grepl 3.12.1-91Miroslav Grepl 3.12.1-90Miroslav Grepl 3.12.1-89Miroslav Grepl 3.12.1-88Miroslav Grepl 3.12.1-87Miroslav Grepl 3.12.1-86Miroslav Grepl 3.12.1-85Miroslav Grepl 3.12.1-84Miroslav Grepl 3.12.1-83Miroslav Grepl 3.12.1-82Miroslav Grepl 3.12.1-81Miroslav Grepl 3.12.1-80Miroslav Grepl 3.12.1-79Miroslav Grepl 3.12.1-78Miroslav Grepl 3.12.1-77Miroslav Grepl 3.12.1-76Miroslav Grepl 3.12.1-75Miroslav Grepl 3.12.1-74Miroslav Grepl 3.12.1-73Miroslav Grepl 3.12.1-72Miroslav Grepl 3.12.1-71Miroslav Grepl 3.12.1-70Miroslav Grepl 3.12.1-69Miroslav Grepl 3.12.1-68Miroslav Grepl 3.12.1-67Miroslav Grepl 3.12.1-66Miroslav Grepl 3.12.1-65Miroslav Grepl 3.12.1-64Miroslav Grepl 3.12.1-63Miroslav Grepl 3.12.1-62Miroslav Grepl 3.12.1-61Miroslav Grepl 3.12.1-60Miroslav Grepl 3.12.1-59Miroslav Grepl 3.12.1-58Miroslav Grepl 3.12.1-57Miroslav Grepl 3.12.1-56Miroslav Grepl 3.12.1-55Miroslav Grepl 3.12.1-54Miroslav Grepl 3.12.1-53Miroslav Grepl 3.12.1-52Miroslav Grepl 3.12.1-51Miroslav Grepl 3.12.1-50Miroslav Grepl 3.12.1-49Miroslav Grepl 3.12.1-48Miroslav Grepl 3.12.1-47Miroslav Grepl 3.12.1-46Miroslav Grepl 3.12.1-45Miroslav Grepl 3.12.1-44Miroslav Grepl 3.12.1-43Miroslav Grepl 3.12.1-42Miroslav Grepl 3.12.1-41Miroslav Grepl 3.12.1-40Miroslav Grepl 3.12.1-39Miroslav Grepl 3.12.1-38Miroslav Grepl 3.12.1-37Miroslav Grepl 3.12.1-36Miroslav Grepl 3.12.1-35Miroslav Grepl 3.12.1-34Miroslav Grepl 3.12.1-33Miroslav Grepl 3.12.1-32Miroslav Grepl 3.12.1-31Miroslav Grepl 3.12.1-30Miroslav Grepl 3.12.1-29Dan Walsh 3.12.1-28Dan Walsh 3.12.1-27Miroslav Grepl 3.12.1-26Miroslav Grepl 3.12.1-25Miroslav Grepl 3.12.1-24Miroslav Grepl 3.12.1-23Miroslav Grepl 3.12.1-22Miroslav Grepl 3.12.1-21Miroslav Grepl 3.12.1-20Miroslav Grepl 3.12.1-19Miroslav Grepl 3.12.1-18Miroslav Grepl 3.12.1-17Miroslav Grepl 3.12.1-16Miroslav Grepl 3.12.1-15Miroslav Grepl 3.12.1-14Miroslav Grepl 3.12.1-13Miroslav Grepl 3.12.1-12Miroslav Grepl 3.12.1-11Miroslav Grepl 3.12.1-10Miroslav Grepl 3.12.1-9Miroslav Grepl 3.12.1-8Miroslav Grepl 3.12.1-7Miroslav Grepl 3.12.1-6Miroslav Grepl 3.12.1-5Miroslav Grepl 3.12.1-4Miroslav Grepl 3.12.1-3Miroslav Grepl 3.12.1-2Miroslav Grepl 3.12.1-1Dan Walsh 3.11.1-69.1Miroslav Grepl 3.11.1-69Miroslav Grepl 3.11.1-68Miroslav Grepl 3.11.1-67Miroslav Grepl 3.11.1-66Miroslav Grepl 3.11.1-65Miroslav Grepl 3.11.1-64Miroslav Grepl 3.11.1-63Miroslav Grepl 3.11.1-62Miroslav Grepl 3.11.1-61Miroslav Grepl 3.11.1-60Miroslav Grepl 3.11.1-59Miroslav Grepl 3.11.1-58Miroslav Grepl 3.11.1-57Miroslav Grepl 3.11.1-56Miroslav Grepl 3.11.1-55Miroslav Grepl 3.11.1-54Miroslav Grepl 3.11.1-53Miroslav Grepl 3.11.1-52Miroslav Grepl 3.11.1-51Miroslav Grepl 3.11.1-50Miroslav Grepl 3.11.1-49Miroslav Grepl 3.11.1-48Miroslav Grepl 3.11.1-47Miroslav Grepl 3.11.1-46Miroslav Grepl 3.11.1-45Miroslav Grepl 3.11.1-44Miroslav Grepl 3.11.1-43Miroslav Grepl 3.11.1-42Miroslav Grepl 3.11.1-41Miroslav Grepl 3.11.1-40Miroslav Grepl 3.11.1-39Miroslav Grepl 3.11.1-38Miroslav Grepl 3.11.1-37Miroslav Grepl 3.11.1-36Miroslav Grepl 3.11.1-35Miroslav Grepl 3.11.1-34Miroslav Grepl 3.11.1-33Miroslav Grepl 3.11.1-32Miroslav Grepl 3.11.1-31Miroslav Grepl 3.11.1-30Miroslav Grepl 3.11.1-29Miroslav Grepl 3.11.1-28Miroslav Grepl 3.11.1-27Miroslav Grepl 3.11.1-26Miroslav Grepl 3.11.1-25Miroslav Grepl 3.11.1-24Miroslav Grepl 3.11.1-23Miroslav Grepl 3.11.1-22Miroslav Grepl 3.11.1-21Miroslav Grepl 3.11.1-20Miroslav Grepl 3.11.1-19Miroslav Grepl 3.11.1-18Miroslav Grepl 3.11.1-17Miroslav Grepl 3.11.1-16Dan Walsh 3.11.1-15Miroslav Grepl 3.11.1-14Dan Walsh 3.11.1-13Miroslav Grepl 3.11.1-12Miroslav Grepl 3.11.1-11Miroslav Grepl 3.11.1-10Dan Walsh 3.11.1-9Dan Walsh 3.11.1-8Dan Walsh 3.11.1-7Dan Walsh 3.11.1-6Miroslav Grepl 3.11.1-5Miroslav Grepl 3.11.1-4Miroslav Grepl 3.11.1-3Miroslav Grepl 3.11.1-2Miroslav Grepl 3.11.1-1Miroslav Grepl 3.11.1-0Miroslav Grepl 3.11.0-15Miroslav Grepl 3.11.0-14Miroslav Grepl 3.11.0-13Miroslav Grepl 3.11.0-12Fedora Release Engineering - 3.11.0-11Miroslav Grepl 3.11.0-10Miroslav Grepl 3.11.0-9Miroslav Grepl 3.11.0-8Miroslav Grepl 3.11.0-7Miroslav Grepl 3.11.0-6Miroslav Grepl 3.11.0-5Miroslav Grepl 3.11.0-4Miroslav Grepl 3.11.0-3Miroslav Grepl 3.11.0-2Miroslav Grepl 3.11.0-1Miroslav Grepl 3.10.0-128Miroslav Grepl 3.10.0-127Miroslav Grepl 3.10.0-126Miroslav Grepl 3.10.0-125Miroslav Grepl 3.10.0-124Miroslav Grepl 3.10.0-123Miroslav Grepl 3.10.0-122Miroslav Grepl 3.10.0-121Miroslav Grepl 3.10.0-120Miroslav Grepl 3.10.0-119Miroslav Grepl 3.10.0-118Miroslav Grepl 3.10.0-117Miroslav Grepl 3.10.0-116Miroslav Grepl 3.10.0-115Miroslav Grepl 3.10.0-114Miroslav Grepl 3.10.0-113Miroslav Grepl 3.10.0-112Miroslav Grepl 3.10.0-111Miroslav Grepl 3.10.0-110Miroslav Grepl 3.10.0-109Miroslav Grepl 3.10.0-108Miroslav Grepl 3.10.0-107Miroslav Grepl 3.10.0-106Miroslav Grepl 3.10.0-105Miroslav Grepl 3.10.0-104Miroslav Grepl 3.10.0-103Miroslav Grepl 3.10.0-102Miroslav Grepl 3.10.0-101Miroslav Grepl 3.10.0-100Miroslav Grepl 3.10.0-99Miroslav Grepl 3.10.0-98Miroslav Grepl 3.10.0-97Miroslav Grepl 3.10.0-96Miroslav Grepl 3.10.0-95Miroslav Grepl 3.10.0-94Miroslav Grepl 3.10.0-93Miroslav Grepl 3.10.0-92Miroslav Grepl 3.10.0-91Miroslav Grepl 3.10.0-90Miroslav Grepl 3.10.0-89Miroslav Grepl 3.10.0-88Miroslav Grepl 3.10.0-87Miroslav Grepl 3.10.0-86Miroslav Grepl 3.10.0-85Miroslav Grepl 3.10.0-84Miroslav Grepl 3.10.0-83Miroslav Grepl 3.10.0-82Dan Walsh 3.10.0-81.2Miroslav Grepl 3.10.0-81Miroslav Grepl 3.10.0-80Miroslav Grepl 3.10.0-79Miroslav Grepl 3.10.0-78Miroslav Grepl 3.10.0-77Miroslav Grepl 3.10.0-76Miroslav Grepl 3.10.0-75Dan Walsh 3.10.0-74.2Miroslav Grepl 3.10.0-74Miroslav Grepl 3.10.0-73Miroslav Grepl 3.10.0-72Miroslav Grepl 3.10.0-71Miroslav Grepl 3.10.0-70Miroslav Grepl 3.10.0-69Miroslav Grepl 3.10.0-68Miroslav Grepl 3.10.0-67Miroslav Grepl 3.10.0-66Miroslav Grepl 3.10.0-65Miroslav Grepl 3.10.0-64Miroslav Grepl 3.10.0-63Miroslav Grepl 3.10.0-59Miroslav Grepl 3.10.0-58Dan Walsh 3.10.0-57Dan Walsh 3.10.0-56Dan Walsh 3.10.0-55.2Dan Walsh 3.10.0-55.1Miroslav Grepl 3.10.0-55Dan Walsh 3.10.0-54.1Miroslav Grepl 3.10.0-54Dan Walsh 3.10.0-53.1Miroslav Grepl 3.10.0-53Miroslav Grepl 3.10.0-52Miroslav Grepl 3.10.0-51Dan Walsh 3.10.0-50.2Dan Walsh 3.10.0-50.1Miroslav Grepl 3.10.0-50Miroslav Grepl 3.10.0-49Miroslav Grepl 3.10.0-48Miroslav Grepl 3.10.0-47Dan Walsh 3.10.0-46.1Miroslav Grepl 3.10.0-46Dan Walsh 3.10.0-45.1Miroslav Grepl 3.10.0-45Miroslav Grepl 3.10.0-43Miroslav Grepl 3.10.0-42Miroslav Grepl 3.10.0-41Dan Walsh 3.10.0-40.2Miroslav Grepl 3.10.0-40Dan Walsh 3.10.0-39.3Dan Walsh 3.10.0-39.2Dan Walsh 3.10.0-39.1Miroslav Grepl 3.10.0-39Dan Walsh 3.10.0-38.1Miroslav Grepl 3.10.0-38Miroslav Grepl 3.10.0-37Dan Walsh 3.10.0-36.1Miroslav Grepl 3.10.0-36Dan Walsh 3.10.0-35Dan Walsh 3.10.0-34.7Dan Walsh 3.10.0-34.6Dan Walsh 3.10.0-34.4Miroslav Grepl 3.10.0-34.3Dan Walsh 3.10.0-34.2Dan Walsh 3.10.0-34.1Miroslav Grepl 3.10.0-34Miroslav Grepl 3.10.0-33Dan Walsh 3.10.0-31.1Miroslav Grepl 3.10.0-31Miroslav Grepl 3.10.0-29Miroslav Grepl 3.10.0-28Miroslav Grepl 3.10.0-27Miroslav Grepl 3.10.0-26Miroslav Grepl 3.10.0-25Miroslav Grepl 3.10.0-24Miroslav Grepl 3.10.0-23Miroslav Grepl 3.10.0-22Miroslav Grepl 3.10.0-21Dan Walsh 3.10.0-20Miroslav Grepl 3.10.0-19Miroslav Grepl 3.10.0-18Miroslav Grepl 3.10.0-17Miroslav Grepl 3.10.0-16Miroslav Grepl 3.10.0-14Miroslav Grepl 3.10.0-13Miroslav Grepl 3.10.0-12Miroslav Grepl 3.10.0-11Miroslav Grepl 3.10.0-10Miroslav Grepl 3.10.0-9Miroslav Grepl 3.10.0-8Miroslav Grepl 3.10.0-7Miroslav Grepl 3.10.0-6Miroslav Grepl 3.10.0-5Miroslav Grepl 3.10.0-4Miroslav Grepl 3.10.0-3Miroslav Grepl 3.10.0-2Miroslav Grepl 3.10.0-1Miroslav Grepl 3.9.16-30Dan Walsh 3.9.16-29.1Miroslav Grepl 3.9.16-29Dan Walsh 3.9.16-28.1Miroslav Grepl 3.9.16-27Miroslav Grepl 3.9.16-26Miroslav Grepl 3.9.16-25Miroslav Grepl 3.9.16-24Miroslav Grepl 3.9.16-23Miroslav Grepl 3.9.16-22Miroslav Grepl 3.9.16-21Miroslav Grepl 3.9.16-20Miroslav Grepl 3.9.16-19Miroslav Grepl 3.9.16-18Miroslav Grepl 3.9.16-17Dan Walsh 3.9.16-16.1Miroslav Grepl 3.9.16-16Miroslav Grepl 3.9.16-15Miroslav Grepl 3.9.16-14Miroslav Grepl 3.9.16-13Miroslav Grepl 3.9.16-12Miroslav Grepl 3.9.16-11Miroslav Grepl 3.9.16-10Miroslav Grepl 3.9.16-7Miroslav Grepl 3.9.16-6Miroslav Grepl 3.9.16-5Miroslav Grepl 3.9.16-4Miroslav Grepl 3.9.16-3Miroslav Grepl 3.9.16-2Miroslav Grepl 3.9.16-1Miroslav Grepl 3.9.15-5Miroslav Grepl 3.9.15-2Miroslav Grepl 3.9.15-1Fedora Release Engineering - 3.9.14-2Dan Walsh 3.9.14-1Miroslav Grepl 3.9.13-10Miroslav Grepl 3.9.13-9Dan Walsh 3.9.13-8Miroslav Grepl 3.9.13-7Miroslav Grepl 3.9.13-6Miroslav Grepl 3.9.13-5Miroslav Grepl 3.9.13-4Miroslav Grepl 3.9.13-3Miroslav Grepl 3.9.13-2Miroslav Grepl 3.9.13-1Miroslav Grepl 3.9.12-8Miroslav Grepl 3.9.12-7Miroslav Grepl 3.9.12-6Miroslav Grepl 3.9.12-5Dan Walsh 3.9.12-4Dan Walsh 3.9.12-3Dan Walsh 3.9.12-2Miroslav Grepl 3.9.12-1Dan Walsh 3.9.11-2Miroslav Grepl 3.9.11-1Miroslav Grepl 3.9.10-13Dan Walsh 3.9.10-12Miroslav Grepl 3.9.10-11Miroslav Grepl 3.9.10-10Miroslav Grepl 3.9.10-9Miroslav Grepl 3.9.10-8Miroslav Grepl 3.9.10-7Miroslav Grepl 3.9.10-6Miroslav Grepl 3.9.10-5Dan Walsh 3.9.10-4Miroslav Grepl 3.9.10-3Miroslav Grepl 3.9.10-2Miroslav Grepl 3.9.10-1Miroslav Grepl 3.9.9-4Dan Walsh 3.9.9-3Miroslav Grepl 3.9.9-2Miroslav Grepl 3.9.9-1Miroslav Grepl 3.9.8-7Dan Walsh 3.9.8-6Miroslav Grepl 3.9.8-5Miroslav Grepl 3.9.8-4Dan Walsh 3.9.8-3Dan Walsh 3.9.8-2Dan Walsh 3.9.8-1Dan Walsh 3.9.7-10Dan Walsh 3.9.7-9Dan Walsh 3.9.7-8Dan Walsh 3.9.7-7Dan Walsh 3.9.7-6Dan Walsh 3.9.7-5Dan Walsh 3.9.7-4Dan Walsh 3.9.7-3Dan Walsh 3.9.7-2Dan Walsh 3.9.7-1Dan Walsh 3.9.6-3Dan Walsh 3.9.6-2Dan Walsh 3.9.6-1Dan Walsh 3.9.5-11Dan Walsh 3.9.5-10Dan Walsh 3.9.5-9Dan Walsh 3.9.5-8Dan Walsh 3.9.5-7Dan Walsh 3.9.5-6Dan Walsh 3.9.5-5Dan Walsh 3.9.5-4Dan Walsh 3.9.5-3Dan Walsh 3.9.5-2Dan Walsh 3.9.5-1Dan Walsh 3.9.4-3Dan Walsh 3.9.4-2Dan Walsh 3.9.4-1Dan Walsh 3.9.3-4Dan Walsh 3.9.3-3Dan Walsh 3.9.3-2Dan Walsh 3.9.3-1Dan Walsh 3.9.2-1Dan Walsh 3.9.1-3Dan Walsh 3.9.1-2Dan Walsh 3.9.1-1Dan Walsh 3.9.0-2Dan Walsh 3.9.0-1Dan Walsh 3.8.8-21Dan Walsh 3.8.8-20Dan Walsh 3.8.8-19Dan Walsh 3.8.8-18Dan Walsh 3.8.8-17Dan Walsh 3.8.8-16Dan Walsh 3.8.8-15Dan Walsh 3.8.8-14Dan Walsh 3.8.8-13Dan Walsh 3.8.8-12Dan Walsh 3.8.8-11Dan Walsh 3.8.8-10Dan Walsh 3.8.8-9Dan Walsh 3.8.8-8Dan Walsh 3.8.8-7Dan Walsh 3.8.8-6Dan Walsh 3.8.8-5Dan Walsh 3.8.8-4Dan Walsh 3.8.8-3Dan Walsh 3.8.8-2Dan Walsh 3.8.8-1Dan Walsh 3.8.7-3Dan Walsh 3.8.7-2Dan Walsh 3.8.7-1Dan Walsh 3.8.6-3Miroslav Grepl 3.8.6-2Dan Walsh 3.8.6-1Dan Walsh 3.8.5-1Dan Walsh 3.8.4-1Dan Walsh 3.8.3-4Dan Walsh 3.8.3-3Dan Walsh 3.8.3-2Dan Walsh 3.8.3-1Dan Walsh 3.8.2-1Dan Walsh 3.8.1-5Dan Walsh 3.8.1-4Dan Walsh 3.8.1-3Dan Walsh 3.8.1-2Dan Walsh 3.8.1-1Dan Walsh 3.7.19-22Dan Walsh 3.7.19-21Dan Walsh 3.7.19-20Dan Walsh 3.7.19-19Dan Walsh 3.7.19-17Dan Walsh 3.7.19-16Dan Walsh 3.7.19-15Dan Walsh 3.7.19-14Dan Walsh 3.7.19-13Dan Walsh 3.7.19-12Dan Walsh 3.7.19-11Dan Walsh 3.7.19-10Dan Walsh 3.7.19-9Dan Walsh 3.7.19-8Dan Walsh 3.7.19-7Dan Walsh 3.7.19-6Dan Walsh 3.7.19-5Dan Walsh 3.7.19-4Dan Walsh 3.7.19-3Dan Walsh 3.7.19-2Dan Walsh 3.7.19-1Dan Walsh 3.7.18-3Dan Walsh 3.7.18-2Dan Walsh 3.7.18-1Dan Walsh 3.7.17-6Dan Walsh 3.7.17-5Dan Walsh 3.7.17-4Dan Walsh 3.7.17-3Dan Walsh 3.7.17-2Dan Walsh 3.7.17-1Dan Walsh 3.7.16-2Dan Walsh 3.7.16-1Dan Walsh 3.7.15-4Dan Walsh 3.7.15-3Dan Walsh 3.7.15-2Dan Walsh 3.7.15-1Dan Walsh 3.7.14-5Dan Walsh 3.7.14-4Dan Walsh 3.7.14-3Dan Walsh 3.7.14-2Dan Walsh 3.7.14-1Dan Walsh 3.7.13-4Dan Walsh 3.7.13-3Dan Walsh 3.7.13-2Dan Walsh 3.7.13-1Dan Walsh 3.7.12-1Dan Walsh 3.7.11-1Dan Walsh 3.7.10-5Dan Walsh 3.7.10-4Dan Walsh 3.7.10-3Dan Walsh 3.7.10-2Dan Walsh 3.7.10-1Dan Walsh 3.7.9-4Dan Walsh 3.7.9-3Dan Walsh 3.7.9-2Dan Walsh 3.7.9-1Dan Walsh 3.7.8-11Dan Walsh 3.7.8-9Dan Walsh 3.7.8-8Dan Walsh 3.7.8-7Dan Walsh 3.7.8-6Dan Walsh 3.7.8-5Dan Walsh 3.7.8-4Dan Walsh 3.7.8-3Dan Walsh 3.7.8-2Dan Walsh 3.7.8-1Dan Walsh 3.7.7-3Dan Walsh 3.7.7-2Dan Walsh 3.7.7-1Dan Walsh 3.7.6-1Dan Walsh 3.7.5-8Dan Walsh 3.7.5-7Dan Walsh 3.7.5-6Dan Walsh 3.7.5-5Dan Walsh 3.7.5-4Dan Walsh 3.7.5-3Dan Walsh 3.7.5-2Dan Walsh 3.7.5-1Dan Walsh 3.7.4-4Dan Walsh 3.7.4-3Dan Walsh 3.7.4-2Dan Walsh 3.7.4-1Dan Walsh 3.7.3-1Dan Walsh 3.7.1-1Dan Walsh 3.6.33-2Dan Walsh 3.6.33-1Dan Walsh 3.6.32-17Dan Walsh 3.6.32-16Dan Walsh 3.6.32-15Dan Walsh 3.6.32-13Dan Walsh 3.6.32-12Dan Walsh 3.6.32-11Dan Walsh 3.6.32-10Dan Walsh 3.6.32-9Dan Walsh 3.6.32-8Dan Walsh 3.6.32-7Dan Walsh 3.6.32-6Dan Walsh 3.6.32-5Dan Walsh 3.6.32-4Dan Walsh 3.6.32-3Dan Walsh 3.6.32-2Dan Walsh 3.6.32-1Dan Walsh 3.6.31-5Dan Walsh 3.6.31-4Dan Walsh 3.6.31-3Dan Walsh 3.6.31-2Dan Walsh 3.6.30-6Dan Walsh 3.6.30-5Dan Walsh 3.6.30-4Dan Walsh 3.6.30-3Dan Walsh 3.6.30-2Dan Walsh 3.6.30-1Dan Walsh 3.6.29-2Dan Walsh 3.6.29-1Dan Walsh 3.6.28-9Dan Walsh 3.6.28-8Dan Walsh 3.6.28-7Dan Walsh 3.6.28-6Dan Walsh 3.6.28-5Dan Walsh 3.6.28-4Dan Walsh 3.6.28-3Dan Walsh 3.6.28-2Dan Walsh 3.6.28-1Dan Walsh 3.6.27-1Dan Walsh 3.6.26-11Dan Walsh 3.6.26-10Dan Walsh 3.6.26-9Bill Nottingham 3.6.26-8Dan Walsh 3.6.26-7Dan Walsh 3.6.26-6Dan Walsh 3.6.26-5Dan Walsh 3.6.26-4Dan Walsh 3.6.26-3Dan Walsh 3.6.26-2Dan Walsh 3.6.26-1Dan Walsh 3.6.25-1Dan Walsh 3.6.24-1Dan Walsh 3.6.23-2Dan Walsh 3.6.23-1Dan Walsh 3.6.22-3Dan Walsh 3.6.22-1Dan Walsh 3.6.21-4Dan Walsh 3.6.21-3Tom "spot" Callaway 3.6.21-2Dan Walsh 3.6.21-1Dan Walsh 3.6.20-2Dan Walsh 3.6.20-1Dan Walsh 3.6.19-5Dan Walsh 3.6.19-4Dan Walsh 3.6.19-3Dan Walsh 3.6.19-2Dan Walsh 3.6.19-1Dan Walsh 3.6.18-1Dan Walsh 3.6.17-1Dan Walsh 3.6.16-4Dan Walsh 3.6.16-3Dan Walsh 3.6.16-2Dan Walsh 3.6.16-1Dan Walsh 3.6.14-3Dan Walsh 3.6.14-2Dan Walsh 3.6.14-1Dan Walsh 3.6.13-3Dan Walsh 3.6.13-2Dan Walsh 3.6.13-1Dan Walsh 3.6.12-39Dan Walsh 3.6.12-38Dan Walsh 3.6.12-37Dan Walsh 3.6.12-36Dan Walsh 3.6.12-35Dan Walsh 3.6.12-34Dan Walsh 3.6.12-33Dan Walsh 3.6.12-31Dan Walsh 3.6.12-30Dan Walsh 3.6.12-29Dan Walsh 3.6.12-28Dan Walsh 3.6.12-27Dan Walsh 3.6.12-26Dan Walsh 3.6.12-25Dan Walsh 3.6.12-24Dan Walsh 3.6.12-23Dan Walsh 3.6.12-22Dan Walsh 3.6.12-21Dan Walsh 3.6.12-20Dan Walsh 3.6.12-19Dan Walsh 3.6.12-16Dan Walsh 3.6.12-15Dan Walsh 3.6.12-14Dan Walsh 3.6.12-13Dan Walsh 3.6.12-12Dan Walsh 3.6.12-11Dan Walsh 3.6.12-10Dan Walsh 3.6.12-9Dan Walsh 3.6.12-8Dan Walsh 3.6.12-7Dan Walsh 3.6.12-6Dan Walsh 3.6.12-5Dan Walsh 3.6.12-4Dan Walsh 3.6.12-3Dan Walsh 3.6.12-2Dan Walsh 3.6.12-1Dan Walsh 3.6.11-1Dan Walsh 3.6.10-9Dan Walsh 3.6.10-8Dan Walsh 3.6.10-7Dan Walsh 3.6.10-6Dan Walsh 3.6.10-5Dan Walsh 3.6.10-4Dan Walsh 3.6.10-3Dan Walsh 3.6.10-2Dan Walsh 3.6.10-1Dan Walsh 3.6.9-4Dan Walsh 3.6.9-3Dan Walsh 3.6.9-2Dan Walsh 3.6.9-1Dan Walsh 3.6.8-4Dan Walsh 3.6.8-3Dan Walsh 3.6.8-2Dan Walsh 3.6.8-1Dan Walsh 3.6.7-2Dan Walsh 3.6.7-1Dan Walsh 3.6.6-9Dan Walsh 3.6.6-8Fedora Release Engineering - 3.6.6-7Dan Walsh 3.6.6-6Dan Walsh 3.6.6-5Dan Walsh 3.6.6-4Dan Walsh 3.6.6-3Dan Walsh 3.6.6-2Dan Walsh 3.6.6-1Dan Walsh 3.6.5-3Dan Walsh 3.6.5-1Dan Walsh 3.6.4-6Dan Walsh 3.6.4-5Dan Walsh 3.6.4-4Dan Walsh 3.6.4-3Dan Walsh 3.6.4-2Dan Walsh 3.6.4-1Dan Walsh 3.6.3-13Dan Walsh 3.6.3-12Dan Walsh 3.6.3-11Dan Walsh 3.6.3-10Dan Walsh 3.6.3-9Dan Walsh 3.6.3-8Dan Walsh 3.6.3-7Dan Walsh 3.6.3-6Dan Walsh 3.6.3-3Dan Walsh 3.6.3-2Dan Walsh 3.6.3-1Dan Walsh 3.6.2-5Dan Walsh 3.6.2-4Dan Walsh 3.6.2-3Dan Walsh 3.6.2-2Dan Walsh 3.6.2-1Dan Walsh 3.6.1-15Dan Walsh 3.6.1-14Dan Walsh 3.6.1-13Dan Walsh 3.6.1-12Dan Walsh 3.6.1-11Dan Walsh 3.6.1-10Dan Walsh 3.6.1-9Dan Walsh 3.6.1-8Dan Walsh 3.6.1-7Dan Walsh 3.6.1-4Ignacio Vazquez-Abrams - 3.6.1-2Dan Walsh 3.5.13-19Dan Walsh 3.5.13-18Dan Walsh 3.5.13-17Dan Walsh 3.5.13-16Dan Walsh 3.5.13-15Dan Walsh 3.5.13-14Dan Walsh 3.5.13-13Dan Walsh 3.5.13-12Dan Walsh 3.5.13-11Dan Walsh 3.5.13-9Dan Walsh 3.5.13-8Dan Walsh 3.5.13-7Dan Walsh 3.5.13-6Dan Walsh 3.5.13-5Dan Walsh 3.5.13-4Dan Walsh 3.5.13-3Dan Walsh 3.5.13-2Dan Walsh 3.5.13-1Dan Walsh 3.5.12-3Dan Walsh 3.5.12-2Dan Walsh 3.5.12-1Dan Walsh 3.5.11-1Dan Walsh 3.5.10-3Dan Walsh 3.5.10-2Dan Walsh 3.5.10-1Dan Walsh 3.5.9-4Dan Walsh 3.5.9-3Dan Walsh 3.5.9-2Dan Walsh 3.5.9-1Dan Walsh 3.5.8-7Dan Walsh 3.5.8-6Dan Walsh 3.5.8-5Dan Walsh 3.5.8-4Dan Walsh 3.5.8-3Dan Walsh 3.5.8-1Dan Walsh 3.5.7-2Dan Walsh 3.5.7-1Dan Walsh 3.5.6-2Dan Walsh 3.5.6-1Dan Walsh 3.5.5-4Dan Walsh 3.5.5-3Dan Walsh 3.5.5-2Dan Walsh 3.5.4-2Dan Walsh 3.5.4-1Dan Walsh 3.5.3-1Dan Walsh 3.5.2-2Dan Walsh 3.5.1-5Dan Walsh 3.5.1-4Dan Walsh 3.5.1-3Dan Walsh 3.5.1-2Dan Walsh 3.5.1-1Dan Walsh 3.5.0-1Dan Walsh 3.4.2-14Dan Walsh 3.4.2-13Dan Walsh 3.4.2-12Dan Walsh 3.4.2-11Dan Walsh 3.4.2-10Dan Walsh 3.4.2-9Dan Walsh 3.4.2-8Dan Walsh 3.4.2-7Dan Walsh 3.4.2-6Dan Walsh 3.4.2-5Dan Walsh 3.4.2-4Dan Walsh 3.4.2-3Dan Walsh 3.4.2-2Dan Walsh 3.4.2-1Dan Walsh 3.4.1-5Dan Walsh 3.4.1-3Dan Walsh 3.4.1-2Dan Walsh 3.4.1-1Dan Walsh 3.3.1-48Dan Walsh 3.3.1-47Dan Walsh 3.3.1-46Dan Walsh 3.3.1-45Dan Walsh 3.3.1-44Dan Walsh 3.3.1-43Dan Walsh 3.3.1-42Dan Walsh 3.3.1-41Dan Walsh 3.3.1-39Dan Walsh 3.3.1-37Dan Walsh 3.3.1-36Dan Walsh 3.3.1-33Dan Walsh 3.3.1-32Dan Walsh 3.3.1-31Dan Walsh 3.3.1-30Dan Walsh 3.3.1-29Dan Walsh 3.3.1-28Dan Walsh 3.3.1-27Dan Walsh 3.3.1-26Dan Walsh 3.3.1-25Dan Walsh 3.3.1-24Dan Walsh 3.3.1-23Dan Walsh 3.3.1-22Dan Walsh 3.3.1-21Dan Walsh 3.3.1-20Dan Walsh 3.3.1-19Dan Walsh 3.3.1-18Dan Walsh 3.3.1-17Dan Walsh 3.3.1-16Dan Walsh 3.3.1-15Bill Nottingham 3.3.1-14Dan Walsh 3.3.1-13Dan Walsh 3.3.1-12Dan Walsh 3.3.1-11Dan Walsh 3.3.1-10Dan Walsh 3.3.1-9Dan Walsh 3.3.1-8Dan Walsh 3.3.1-6Dan Walsh 3.3.1-5Dan Walsh 3.3.1-4Dan Walsh 3.3.1-2Dan Walsh 3.3.1-1Dan Walsh 3.3.0-2Dan Walsh 3.3.0-1Dan Walsh 3.2.9-2Dan Walsh 3.2.9-1Dan Walsh 3.2.8-2Dan Walsh 3.2.8-1Dan Walsh 3.2.7-6Dan Walsh 3.2.7-5Dan Walsh 3.2.7-3Dan Walsh 3.2.7-2Dan Walsh 3.2.7-1Dan Walsh 3.2.6-7Dan Walsh 3.2.6-6Dan Walsh 3.2.6-5Dan Walsh 3.2.6-4Dan Walsh 3.2.6-3Dan Walsh 3.2.6-2Dan Walsh 3.2.6-1Dan Walsh 3.2.5-25Dan Walsh 3.2.5-24Dan Walsh 3.2.5-22Dan Walsh 3.2.5-21Dan Walsh 3.2.5-20Dan Walsh 3.2.5-19Dan Walsh 3.2.5-18Dan Walsh 3.2.5-17Dan Walsh 3.2.5-16Dan Walsh 3.2.5-15Dan Walsh 3.2.5-14Dan Walsh 3.2.5-13Dan Walsh 3.2.5-12Dan Walsh 3.2.5-11Dan Walsh 3.2.5-10Dan Walsh 3.2.5-9Dan Walsh 3.2.5-8Dan Walsh 3.2.5-7Dan Walsh 3.2.5-6Dan Walsh 3.2.5-5Dan Walsh 3.2.5-4Dan Walsh 3.2.5-3Dan Walsh 3.2.5-2Dan Walsh 3.2.5-1Dan Walsh 3.2.4-5Dan Walsh 3.2.4-4Dan Walsh 3.2.4-3Dan Walsh 3.2.4-1Dan Walsh 3.2.4-1Dan Walsh 3.2.3-2Dan Walsh 3.2.3-1Dan Walsh 3.2.2-1Dan Walsh 3.2.1-3Dan Walsh 3.2.1-1Dan Walsh 3.1.2-2Dan Walsh 3.1.2-1Dan Walsh 3.1.1-1Dan Walsh 3.1.0-1Dan Walsh 3.0.8-30Dan Walsh 3.0.8-28Dan Walsh 3.0.8-27Dan Walsh 3.0.8-26Dan Walsh 3.0.8-25Dan Walsh 3.0.8-24Dan Walsh 3.0.8-23Dan Walsh 3.0.8-22Dan Walsh 3.0.8-21Dan Walsh 3.0.8-20Dan Walsh 3.0.8-19Dan Walsh 3.0.8-18Dan Walsh 3.0.8-17Dan Walsh 3.0.8-16Dan Walsh 3.0.8-15Dan Walsh 3.0.8-14Dan Walsh 3.0.8-13Dan Walsh 3.0.8-12Dan Walsh 3.0.8-11Dan Walsh 3.0.8-10Dan Walsh 3.0.8-9Dan Walsh 3.0.8-8Dan Walsh 3.0.8-7Dan Walsh 3.0.8-5Dan Walsh 3.0.8-4Dan Walsh 3.0.8-3Dan Walsh 3.0.8-2Dan Walsh 3.0.8-1Dan Walsh 3.0.7-10Dan Walsh 3.0.7-9Dan Walsh 3.0.7-8Dan Walsh 3.0.7-7Dan Walsh 3.0.7-6Dan Walsh 3.0.7-5Dan Walsh 3.0.7-4Dan Walsh 3.0.7-3Dan Walsh 3.0.7-2Dan Walsh 3.0.7-1Dan Walsh 3.0.6-3Dan Walsh 3.0.6-2Dan Walsh 3.0.6-1Dan Walsh 3.0.5-11Dan Walsh 3.0.5-10Dan Walsh 3.0.5-9Dan Walsh 3.0.5-8Dan Walsh 3.0.5-7Dan Walsh 3.0.5-6Dan Walsh 3.0.5-5Dan Walsh 3.0.5-4Dan Walsh 3.0.5-3Dan Walsh 3.0.5-2Dan Walsh 3.0.5-1Dan Walsh 3.0.4-6Dan Walsh 3.0.4-5Dan Walsh 3.0.4-4Dan Walsh 3.0.4-3Dan Walsh 3.0.4-2Dan Walsh 3.0.4-1Dan Walsh 3.0.3-6Dan Walsh 3.0.3-5Dan Walsh 3.0.3-4Dan Walsh 3.0.3-3Dan Walsh 3.0.3-2Dan Walsh 3.0.3-1Dan Walsh 3.0.2-9Dan Walsh 3.0.2-8Dan Walsh 3.0.2-7Dan Walsh 3.0.2-5Dan Walsh 3.0.2-4Dan Walsh 3.0.2-3Dan Walsh 3.0.2-2Dan Walsh 3.0.1-5Dan Walsh 3.0.1-4Dan Walsh 3.0.1-3Dan Walsh 3.0.1-2Dan Walsh 3.0.1-1Dan Walsh 2.6.5-3Dan Walsh 2.6.5-2Dan Walsh 2.6.4-7Dan Walsh 2.6.4-6Dan Walsh 2.6.4-5Dan Walsh 2.6.4-2Dan Walsh 2.6.4-1Dan Walsh 2.6.3-1Dan Walsh 2.6.2-1Dan Walsh 2.6.1-4Dan Walsh 2.6.1-2Dan Walsh 2.6.1-1Dan Walsh 2.5.12-12Dan Walsh 2.5.12-11Dan Walsh 2.5.12-10Dan Walsh 2.5.12-8Dan Walsh 2.5.12-5Dan Walsh 2.5.12-4Dan Walsh 2.5.12-3Dan Walsh 2.5.12-2Dan Walsh 2.5.12-1Dan Walsh 2.5.11-8Dan Walsh 2.5.11-7Dan Walsh 2.5.11-6Dan Walsh 2.5.11-5Dan Walsh 2.5.11-4Dan Walsh 2.5.11-3Dan Walsh 2.5.11-2Dan Walsh 2.5.11-1Dan Walsh 2.5.10-2Dan Walsh 2.5.10-1Dan Walsh 2.5.9-6Dan Walsh 2.5.9-5Dan Walsh 2.5.9-4Dan Walsh 2.5.9-3Dan Walsh 2.5.9-2Dan Walsh 2.5.8-8Dan Walsh 2.5.8-7Dan Walsh 2.5.8-6Dan Walsh 2.5.8-5Dan Walsh 2.5.8-4Dan Walsh 2.5.8-3Dan Walsh 2.5.8-2Dan Walsh 2.5.8-1Dan Walsh 2.5.7-1Dan Walsh 2.5.6-1Dan Walsh 2.5.5-2Dan Walsh 2.5.5-1Dan Walsh 2.5.4-2Dan Walsh 2.5.4-1Dan Walsh 2.5.3-3Dan Walsh 2.5.3-2Dan Walsh 2.5.3-1Dan Walsh 2.5.2-6Dan Walsh 2.5.2-5Dan Walsh 2.5.2-4Dan Walsh 2.5.2-3Dan Walsh 2.5.2-2Dan Walsh 2.5.2-1Dan Walsh 2.5.1-5Dan Walsh 2.5.1-4Dan Walsh 2.5.1-2Dan Walsh 2.5.1-1Dan Walsh 2.4.6-20Dan Walsh 2.4.6-19Dan Walsh 2.4.6-18Dan Walsh 2.4.6-17Dan Walsh 2.4.6-16Dan Walsh 2.4.6-15Dan Walsh 2.4.6-14Dan Walsh 2.4.6-13Dan Walsh 2.4.6-12Dan Walsh 2.4.6-11Dan Walsh 2.4.6-10Dan Walsh 2.4.6-9Dan Walsh 2.4.6-8Dan Walsh 2.4.6-7Dan Walsh 2.4.6-6Dan Walsh 2.4.6-5Dan Walsh 2.4.6-4Dan Walsh 2.4.6-3Dan Walsh 2.4.6-1Dan Walsh 2.4.5-4Dan Walsh 2.4.5-3Dan Walsh 2.4.5-2Dan Walsh 2.4.5-1Dan Walsh 2.4.4-2Dan Walsh 2.4.4-2Dan Walsh 2.4.4-1Dan Walsh 2.4.3-13Dan Walsh 2.4.3-12Dan Walsh 2.4.3-11Dan Walsh 2.4.3-10Dan Walsh 2.4.3-9Dan Walsh 2.4.3-8Dan Walsh 2.4.3-7Dan Walsh 2.4.3-6Dan Walsh 2.4.3-5Dan Walsh 2.4.3-4Dan Walsh 2.4.3-3Dan Walsh 2.4.3-2Dan Walsh 2.4.3-1Dan Walsh 2.4.2-8Dan Walsh 2.4.2-7James Antill 2.4.2-6Dan Walsh 2.4.2-5Dan Walsh 2.4.2-4Dan Walsh 2.4.2-3Dan Walsh 2.4.2-2Dan Walsh 2.4.2-1Dan Walsh 2.4.1-5Dan Walsh 2.4.1-4Dan Walsh 2.4.1-3Dan Walsh 2.4.1-2Dan Walsh 2.4-4Dan Walsh 2.4-3Dan Walsh 2.4-2Dan Walsh 2.4-1Dan Walsh 2.3.19-4Dan Walsh 2.3.19-3Dan Walsh 2.3.19-2Dan Walsh 2.3.19-1James Antill 2.3.18-10James Antill 2.3.18-9Dan Walsh 2.3.18-8Dan Walsh 2.3.18-7Dan Walsh 2.3.18-6Dan Walsh 2.3.18-5Dan Walsh 2.3.18-4Dan Walsh 2.3.18-3Dan Walsh 2.3.18-2Dan Walsh 2.3.18-1Dan Walsh 2.3.17-2Dan Walsh 2.3.17-1Dan Walsh 2.3.16-9Dan Walsh 2.3.16-8Dan Walsh 2.3.16-7Dan Walsh 2.3.16-6Dan Walsh 2.3.16-5Dan Walsh 2.3.16-4Dan Walsh 2.3.16-2Dan Walsh 2.3.16-1Dan Walsh 2.3.15-2Dan Walsh 2.3.15-1Dan Walsh 2.3.14-8Dan Walsh 2.3.14-7Dan Walsh 2.3.14-6Dan Walsh 2.3.14-4Dan Walsh 2.3.14-3Dan Walsh 2.3.14-2Dan Walsh 2.3.14-1Dan Walsh 2.3.13-6Dan Walsh 2.3.13-5Dan Walsh 2.3.13-4Dan Walsh 2.3.13-3Dan Walsh 2.3.13-2Dan Walsh 2.3.13-1Dan Walsh 2.3.12-2Dan Walsh 2.3.12-1Dan Walsh 2.3.11-1Dan Walsh 2.3.10-7Dan Walsh 2.3.10-6Dan Walsh 2.3.10-3Dan Walsh 2.3.10-1Dan Walsh 2.3.9-6Dan Walsh 2.3.9-5Dan Walsh 2.3.9-4Dan Walsh 2.3.9-3Dan Walsh 2.3.9-2Dan Walsh 2.3.9-1Dan Walsh 2.3.8-2Dan Walsh 2.3.7-1Dan Walsh 2.3.6-4Dan Walsh 2.3.6-3Dan Walsh 2.3.6-2Dan Walsh 2.3.6-1Dan Walsh 2.3.5-1Dan Walsh 2.3.4-1Dan Walsh 2.3.3-20Dan Walsh 2.3.3-19Dan Walsh 2.3.3-18Dan Walsh 2.3.3-17Dan Walsh 2.3.3-16Dan Walsh 2.3.3-15Dan Walsh 2.3.3-14Dan Walsh 2.3.3-13Dan Walsh 2.3.3-12Dan Walsh 2.3.3-11Dan Walsh 2.3.3-10Dan Walsh 2.3.3-9Dan Walsh 2.3.3-8Dan Walsh 2.3.3-7Dan Walsh 2.3.3-6Dan Walsh 2.3.3-5Dan Walsh 2.3.3-4Dan Walsh 2.3.3-3Dan Walsh 2.3.3-2Dan Walsh 2.3.3-1Dan Walsh 2.3.2-4Dan Walsh 2.3.2-3Dan Walsh 2.3.2-2Dan Walsh 2.3.2-1Dan Walsh 2.3.1-1Dan Walsh 2.2.49-1Dan Walsh 2.2.48-1Dan Walsh 2.2.47-5Dan Walsh 2.2.47-4Dan Walsh 2.2.47-3Dan Walsh 2.2.47-1Dan Walsh 2.2.46-2Dan Walsh 2.2.46-1Dan Walsh 2.2.45-3Dan Walsh 2.2.45-2Dan Walsh 2.2.45-1Dan Walsh 2.2.44-1Dan Walsh 2.2.43-4Dan Walsh 2.2.43-3Dan Walsh 2.2.43-2Dan Walsh 2.2.43-1Dan Walsh 2.2.42-4Dan Walsh 2.2.42-3Dan Walsh 2.2.42-2Dan Walsh 2.2.42-1Dan Walsh 2.2.41-1Dan Walsh 2.2.40-2Dan Walsh 2.2.40-1Dan Walsh 2.2.39-2Dan Walsh 2.2.39-1Dan Walsh 2.2.38-6Dan Walsh 2.2.38-5Dan Walsh 2.2.38-4Dan Walsh 2.2.38-3Dan Walsh 2.2.38-2Dan Walsh 2.2.38-1Dan Walsh 2.2.37-1Dan Walsh 2.2.36-2Dan Walsh 2.2.36-1James Antill 2.2.35-2Dan Walsh 2.2.35-1Dan Walsh 2.2.34-3Dan Walsh 2.2.34-2Dan Walsh 2.2.34-1Dan Walsh 2.2.33-1Dan Walsh 2.2.32-2Dan Walsh 2.2.32-1Dan Walsh 2.2.31-1Dan Walsh 2.2.30-2Dan Walsh 2.2.30-1Dan Walsh 2.2.29-6Russell Coker 2.2.29-5Dan Walsh 2.2.29-4Dan Walsh 2.2.29-3Dan Walsh 2.2.29-2Dan Walsh 2.2.29-1Dan Walsh 2.2.28-3Dan Walsh 2.2.28-2Dan Walsh 2.2.28-1Dan Walsh 2.2.27-1Dan Walsh 2.2.25-3Dan Walsh 2.2.25-2Dan Walsh 2.2.24-1Dan Walsh 2.2.23-19Dan Walsh 2.2.23-18Dan Walsh 2.2.23-17Karsten Hopp 2.2.23-16Dan Walsh 2.2.23-15Dan Walsh 2.2.23-14Dan Walsh 2.2.23-13Dan Walsh 2.2.23-12Jeremy Katz - 2.2.23-11Jeremy Katz - 2.2.23-10Dan Walsh 2.2.23-9Dan Walsh 2.2.23-8Dan Walsh 2.2.23-7Dan Walsh 2.2.23-5Dan Walsh 2.2.23-4Dan Walsh 2.2.23-3Dan Walsh 2.2.23-2Dan Walsh 2.2.23-1Dan Walsh 2.2.22-2Dan Walsh 2.2.22-1Dan Walsh 2.2.21-9Dan Walsh 2.2.21-8Dan Walsh 2.2.21-7Dan Walsh 2.2.21-6Dan Walsh 2.2.21-5Dan Walsh 2.2.21-4Dan Walsh 2.2.21-3Dan Walsh 2.2.21-2Dan Walsh 2.2.21-1Dan Walsh 2.2.20-1Dan Walsh 2.2.19-2Dan Walsh 2.2.19-1Dan Walsh 2.2.18-2Dan Walsh 2.2.18-1Dan Walsh 2.2.17-2Dan Walsh 2.2.16-1Dan Walsh 2.2.15-4Dan Walsh 2.2.15-3Dan Walsh 2.2.15-1Dan Walsh 2.2.14-2Dan Walsh 2.2.14-1Dan Walsh 2.2.13-1Dan Walsh 2.2.12-1Dan Walsh 2.2.11-2Dan Walsh 2.2.11-1Dan Walsh 2.2.10-1Dan Walsh 2.2.9-2Dan Walsh 2.2.9-1Dan Walsh 2.2.8-2Dan Walsh 2.2.7-1Dan Walsh 2.2.6-3Dan Walsh 2.2.6-2Dan Walsh 2.2.6-1Dan Walsh 2.2.5-1Dan Walsh 2.2.4-1Dan Walsh 2.2.3-1Dan Walsh 2.2.2-1Dan Walsh 2.2.1-1Dan Walsh 2.1.13-1Dan Walsh 2.1.12-3Dan Walsh 2.1.11-1Dan Walsh 2.1.10-1Jeremy Katz - 2.1.9-2Dan Walsh 2.1.9-1Dan Walsh 2.1.8-3Dan Walsh 2.1.8-2Dan Walsh 2.1.8-1Dan Walsh 2.1.7-4Dan Walsh 2.1.7-3Dan Walsh 2.1.7-2Dan Walsh 2.1.7-1Dan Walsh 2.1.6-24Dan Walsh 2.1.6-23Dan Walsh 2.1.6-22Dan Walsh 2.1.6-21Dan Walsh 2.1.6-20Dan Walsh 2.1.6-18Dan Walsh 2.1.6-17Dan Walsh 2.1.6-16Dan Walsh 2.1.6-15Dan Walsh 2.1.6-14Dan Walsh 2.1.6-13Dan Walsh 2.1.6-11Dan Walsh 2.1.6-10Dan Walsh 2.1.6-9Dan Walsh 2.1.6-8Dan Walsh 2.1.6-5Dan Walsh 2.1.6-4Dan Walsh 2.1.6-3Dan Walsh 2.1.6-2Dan Walsh 2.1.6-1Dan Walsh 2.1.4-2Dan Walsh 2.1.4-1Dan Walsh 2.1.3-1Jeremy Katz - 2.1.2-3Dan Walsh 2.1.2-2Dan Walsh 2.1.2-1Dan Walsh 2.1.1-3Dan Walsh 2.1.1-2Dan Walsh 2.1.1-1Dan Walsh 2.1.0-3Dan Walsh 2.1.0-2.Dan Walsh 2.1.0-1.Dan Walsh 2.0.11-2.Dan Walsh 2.0.11-1.Dan Walsh 2.0.9-1.Dan Walsh 2.0.8-1.Dan Walsh 2.0.7-3Dan Walsh 2.0.7-2Dan Walsh 2.0.6-2Dan Walsh 2.0.5-4Dan Walsh 2.0.5-1Dan Walsh 2.0.4-1Dan Walsh 2.0.2-2Dan Walsh 2.0.2-1Dan Walsh 2.0.1-2Dan Walsh 2.0.1-1- Allow modemmanager_t domain to write to raw_ip file labeled as sysfs_t Resolves: rhbz#1697868- Update nagios_run_sudo boolean with few allow rules related to accessing sssd Resolves: rhbz#1692893- Allow sudodomains to write to systemd_logind_sessions_t pipes. Resolves: rhbz#1688224- Allow gssd_t domain to manage kernel keyrings of every domain. Resolves: rhbz#1665815 - Add new interface domain_manage_all_domains_keyrings() Resolves: rhbz#1665815- Add interface domain_rw_all_domains_keyrings() Resolves: rhbz#1665815 - Allow gssd_t domain to read/write kernel keyrings of every domain. Resolves: rhbz#1665815- Update snapperd policy to allow snapperd manage all non security dirs. Resolves: rhbz#1661158- Allow nova_t domain to use pam Resolves: rhbz:#1645270 - sysstat: grant sysstat_t the search_dir_perms set Resolves: rhbz#1645271- Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module Resolves: rhbz#1638257- Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging' Resolves: rhbz#1638427- Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t Resolves: rhbz#1638257- Fix missing patch in spec file Resolves: rhbz#1635704- Allow cinder_volume_t domain to dbus chat with systemd_logind_t domain Resolves: rhbz#1635704- Allow neutron domain to read/write /var/run/utmp Resolves: rhbz#1630318- Allow tomcat_domain to read /dev/random Resolves: rhbz#1631666 - Allow neutron_t domain to use pam Resolves: rhbz#1630318- Add interface apache_read_tmp_dirs() - Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs Resolves: rhbz#1622602- Allow tomcat servers to manage usr_t files Resolves: rhbz#1625678 - Dontaudit tomcat serves to append to /dev/random device Resolves: rhbz#1625678 - Allow sys_nice capability to mysqld_t domain - Allow dirsrvadmin_script_t domain to read httpd tmp files Resolves: rhbz#1622602 - Allow syslogd_t domain to manage cert_t files Resolves: rhbz#1615995- Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs Resolves: rhbz#1627114 - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t Resolves: rhbz#1567753- Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs. Resolves: rhbz#1625678 - Allow chronyd_t domain to read virt_var_lib_t files - Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333) Resolves: rhbz#1625613 - Allow tomcat services create link file in /tmp Resolves: rhbz#1624289 - Add boolean: domain_can_mmap_files. Resolves: rhbz#1460322- Make working SELinux sandbox with Wayland. Resolves: rhbz#1624308 - Allow svirt_t domain to mmap svirt_image_t block files Resolves: rhbz#1624224 - Add caps dac_read_search and dav_override to pesign_t domain - Allow iscsid_t domain to mmap userio chr files Resolves: rhbz#1623589 - Add boolean: domain_can_mmap_files. Resolves: rhbz#1460322 - Add execute_no_trans permission to mmap_exec_file_perms pattern - Allow sudodomain to search caller domain proc info - Allow xdm_t domain to mmap and read cert_t files - Replace optional policy blocks to make dbus interfaces effective Resolves: rhbz#1624414 - Add interface dev_map_userio_dev()- Allow readhead_t domain to mmap own pid files Resolves: rhbz#1614169- Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket - Allow httpd_t domain to mmap tmp files Resolves: rhbz#1608355 - Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files - Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks - Label /dev/tpmrm[0-9]* as tpm_device_t - Allow semanage_t domain mmap usr_t files Resolves: rhbz#1622607 - Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t- Allow nagios_script_t domain to mmap nagios_log_t files Resolves: rhbz#1620013 - Allow nagios_script_t domain to mmap nagios_spool_t files Resolves: rhbz#1620013 - Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctl Resolves: rhbz#1622197 - Update selinux_validate_context() interface to allow caller domain to mmap security_t files Resolves: rhbz#1622061- Allow virtd_t domain to create netlink_socket - Allow rpm_t domain to write to audit - Allow rpm domain to mmap rpm_var_lib_t files Resolves: rhbz#1619785 - Allow nagios_script_t domain to mmap nagios_etc_t files Resolves: rhbz#1620013 - Update nscd_socket_use() to allow caller domain to stream connect to nscd_t Resolves: rhbz#1460715 - Allow secadm_t domain to mmap audit config and log files - Allow insmod_t domain to read iptables pid files - Allow systemd to mounton /etc Resolves: rhbz#1619785- Allow kdumpctl_t domain to getattr fixed disk device in mls Resolves: rhbz#1615342 - Allow initrc_domain to mmap all binaries labeled as systemprocess_entry Resolves: rhbz#1615342- Allow virtlogd to execute itself Resolves: rhbz#1598392- Allow kdumpctl_t domain to manage kdumpctl_tmp_t fifo files Resolves: rhbz#1615342 - Allow kdumpctl to write to files on all levels Resolves: rhbz#1615342 - Fix typo in radius policy Resolves: rhbz#1619197 - Allow httpd_t domain to mmap httpd_config_t files Resolves: rhbz#1615894 - Add interface dbus_acquire_svc_system_dbusd() - Allow sanlock_t domain to connectto to unix_stream_socket Resolves: rhbz#1614965 - Update nfsd_t policy because of ganesha features Resolves: rhbz#1511489 - Allow conman to getattr devpts_t Resolves: rhbz#1377915 - Allow tomcat_domain to connect to smtp ports Resolves: rhbz#1253502 - Allow tomcat_t domain to mmap tomcat_var_lib_t files Resolves: rhbz#1618519 - Allow slapd_t domain to mmap slapd_var_run_t files Resolves: rhbz#1615319 - Allow nagios_t domain to mmap nagios_log_t files Resolves: rhbz#1618675 - Allow nagios to exec itself and mmap nagios spool files BZ(1559683) - Allow nagios to mmap nagios config files BZ(1559683) - Allow kpropd_t domain to mmap krb5kdc_principal_t files Resolves: rhbz#1619252 - Update syslogd policy to make working elasticsearch - Label tcp and udp ports 9200 as wap_wsp_port - Allow few domains to rw inherited kdumpctl tmp pipes Resolves: rhbz#1615342- Allow systemd_dbusd_t domain read/write to nvme devices Resolves: rhbz#1614236 - Allow mysqld_safe_t do execute itself - Allow smbd_t domain to chat via dbus with avahi daemon Resolves: rhbz#1600157 - cupsd_t domain will create /etc/cupsd/ppd as cupsd_etc_rw_t Resolves: rhbz#1452595 - Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645) Resolves: rhbz#1452444 - Update screen_role_template to allow caller domain to have screen_exec_t as entrypoint do new domain Resolves: rhbz#1384769 - Add alias httpd__script_t to _script_t to make sepolicy generate working Resolves: rhbz#1271324 - Allow kprop_t domain to read network state Resolves: rhbz#1600705 - Allow sysadm_t domain to accept socket Resolves: rhbz#1557299 - Allow sshd_t domain to mmap user_tmp_t files Resolves: rhbz#1613437- Allow sshd_t domain to mmap user_tmp_t files Resolves: rhbz#1613437- Allow kprop_t domain to read network state Resolves: rhbz#1600705- Allow kpropd domain to exec itself Resolves: rhbz#1600705 - Allow ipmievd_t to mmap kernel modules BZ(1552535) - Allow hsqldb_t domain to mmap own temp files Resolves: rhbz#1612143 - Allow hsqldb_t domain to read cgroup files Resolves: rhbz#1612143 - Allow rngd_t domain to read generic certs Resolves: rhbz#1612456 - Allow innd_t domain to mmap own var_lib_t files Resolves: rhbz#1600591 - Update screen_role_temaplate interface Resolves: rhbz#1384769 - Allow cupsd_t to create cupsd_etc_t dirs Resolves: rhbz#1452595 - Allow chronyd_t domain to mmap own tmpfs files Resolves: rhbz#1596563 - Allow cyrus domain to mmap own var_lib_t and var_run files Resolves: rhbz#1610374 - Allow sysadm_t domain to create rawip sockets Resolves: rhbz#1571591 - Allow sysadm_t domain to listen on socket Resolves: rhbz#1557299 - Update sudo_role_template() to allow caller domain also setattr generic ptys Resolves: rhbz#1564470 - Allow netutils_t domain to create bluetooth sockets Resolves: rhbz#1600586- Allow innd_t domain to mmap own var_lib_t files Resolves: rhbz#1600591 - Update screen_role_temaplate interface Resolves: rhbz#1384769 - Allow cupsd_t to create cupsd_etc_t dirs Resolves: rhbz#1452595 - Allow chronyd_t domain to mmap own tmpfs files Resolves: rhbz#1596563 - Allow cyrus domain to mmap own var_lib_t and var_run files Resolves: rhbz#1610374 - Allow sysadm_t domain to create rawip sockets Resolves: rhbz#1571591 - Allow sysadm_t domain to listen on socket Resolves: rhbz#1557299 - Update sudo_role_template() to allow caller domain also setattr generic ptys Resolves: rhbz#1564470 - Allow netutils_t domain to create bluetooth sockets Resolves: rhbz#1600586- Allow virtlogd_t domain to chat via dbus with systemd_logind Resolves: rhbz#1593740- Allow sblim_sfcbd_t domain to mmap own tmpfs files Resolves: rhbz#1609384 - Update logging_manage_all_logs() interface to allow caller domain map all logfiles Resolves: rhbz#1592028- Dontaudit oracleasm_t domain to request sys_admin capability - Allow iscsid_t domain to load kernel module Resolves: rhbz#1589295 - Update rhcs contexts to reflects the latest fenced changes - Allow httpd_t domain to rw user_tmp_t files Resolves: rhbz#1608355 - /usr/libexec/udisks2/udisksd should be labeled as devicekit_disk_exec_t Resolves: rhbz#1521063 - Allow tangd_t dac_read_search Resolves: rhbz#1607810 - Allow glusterd_t domain to mmap user_tmp_t files - Allow mongodb_t domain to mmap own var_lib_t files Resolves: rhbz#1607729 - Allow iscsid_t domain to mmap sysfs_t files Resolves: rhbz#1602508 - Allow tomcat_domain to search cgroup dirs Resolves: rhbz#1600188 - Allow httpd_t domain to mmap own cache files Resolves: rhbz#1603505 - Allow cupsd_t domain to mmap cupsd_etc_t files Resolves: rhbz#1599694 - Allow kadmind_t domain to mmap krb5kdc_principal_t Resolves: rhbz#1601004 - Allow virtlogd_t domain to read virt_etc_t link files Resolves: rhbz#1598593 - Allow dirsrv_t domain to read crack db Resolves: rhbz#1599726 - Dontaudit pegasus_t to require sys_admin capability Resolves: rhbz#1374570 - Allow mysqld_t domain to exec mysqld_exec_t binary files - Allow abrt_t odmain to read rhsmcertd lib files Resolves: rhbz#1601389 - Allow winbind_t domain to request kernel module loads Resolves: rhbz#1599236 - Allow gpsd_t domain to getsession and mmap own tmpfs files Resolves: rhbz#1598388 - Allow smbd_t send to nmbd_t via dgram sockets BZ(1563791) Resolves: rhbz#1600157 - Allow tomcat_domain to read cgroup_t files Resolves: rhbz#1601151 - Allow varnishlog_t domain to mmap varnishd_var_lib_t files Resolves: rhbz#1600704 - Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415) Resolves: rhbz#1600692 - Fix ntp SELinux module - Allow innd_t domain to mmap news_spool_t files Resolves: rhbz#1600591 - Allow haproxy daemon to reexec itself. BZ(1447800) Resolves: rhbz#1600578 - Label HOME_DIR/mozilla.pdf file as mozilla_home_t instead of user_home_t Resolves: rhbz#1559859 - Allow pkcs_slotd_t domain to mmap own tmpfs files Resolves: rhbz#1600434 - Allow fenced_t domain to reboot Resolves: rhbz#1293384 - Allow bluetooth_t domain listen on bluetooth sockets BZ(1549247) Resolves: rhbz#1557299 - Allow lircd to use nsswitch. BZ(1401375) - Allow targetd_t domain mmap lvm config files Resolves: rhbz#1546671 - Allow amanda_t domain to read network system state Resolves: rhbz#1452444 - Allow abrt_t domain to read rhsmcertd logs Resolves: rhbz#1492059 - Allow application_domain_type also mmap inherited user temp files BZ(1552765) Resolves: rhbz#1608421 - Allow ipsec_t domain to read l2tpd pid files Resolves: rhbz#1607994 - Allow systemd_tmpfiles_t do mmap system db files - Improve domain_transition_pattern to allow mmap entrypoint bin file. Resolves: rhbz#1460322 - Allow nsswitch_domain to mmap passwd_file_t files BZ(1518655) Resolves: rhbz#1600528 - Dontaudit syslogd to watching top llevel dirs when imfile module is enabled Resolves: rhbz#1601928 - Allow ipsec_t can exec ipsec_exec_t Resolves: rhbz#1600684 - Allow netutils_t domain to mmap usmmon device Resolves: rhbz#1600586 - Allow netlabel_mgmt_t domain to read sssd public files, stream connect to sssd_t BZ(1483655) - Allow userdomain sudo domains to use generic ptys Resolves: rhbz#1564470 - Allow traceroute to create icmp packets Resolves: rhbz#1548350 - Allow systemd domain to mmap lvm config files BZ(1594584) - Add new interface lvm_map_config - refpolicy: Update for kernel sctp support Resolves: rhbz#1597111 Add additional entries to support the kernel SCTP implementation introduced in kernel 4.16- Update oddjob_domtrans_mkhomedir() interface to allow caller domain also mmap oddjob_mkhomedir_exec_t files Resolves: rhbz#1596306 - Update rhcs_rw_cluster_tmpfs() interface to allow caller domain to mmap cluster_tmpfs_t files Resolves: rhbz#1589257 - Allow radiusd_t domain to read network sysctls Resolves: rhbz#1516233 - Allow chronyc_t domain to use nscd shm Resolves: rhbz#1596563 - Label /var/lib/tomcats dir as tomcat_var_lib_t Resolves: rhbz#1596367 - Allow lsmd_t domain to mmap lsmd_plugin_exec_t files Resolves: rhbz#bea0c8174 - Label /usr/sbin/rhn_check-[0-9]+.[0-9]+ as rpm_exec_t Resolves: rhbz#1596509 - Update seutil_exec_loadpolicy() interface to allow caller domain to mmap load_policy_exec_t files Resolves: rhbz#1596072 - Allow xdm_t to read systemd hwdb Resolves: rhbz#1596720 - Allow dhcpc_t domain to mmap files labeled as ping_exec_t Resolves: rhbz#1596065- Allow tangd_t domain to create tcp sockets Resolves: rhbz#1595775 - Update postfix policy to allow postfix_master_t domain to mmap all postfix* binaries Resolves: rhbz#1595328 - Allow amanda_t domain to have setgid capability Resolves: rhbz#1452444 - Update usermanage_domtrans_useradd() to allow caller domain to mmap useradd_exec_t files Resolves: rhbz#1595667- Allow abrt_watch_log_t domain to mmap binaries with label abrt_dump_oops_exec_t Resolves: rhbz#1591191 - Update cups_filetrans_named_content() to allow caller domain create ppd directory with cupsd_etc_rw_t label Resolves: rhbz#1452595 - Allow abrt_t domain to write to rhsmcertd pid files Resolves: rhbz#1492059 - Allow pegasus_t domain to eexec lvm binaries and allow read/write access to lvm control Resolves: rhbz#1463470 - Add vhostmd_t domain to read/write to svirt images Resolves: rhbz#1465276 - Dontaudit action when abrt-hook-ccpp is writing to nscd sockets Resolves: rhbz#1460715 - Update openvswitch policy Resolves: rhbz#1594729 - Update kdump_manage_kdumpctl_tmp_files() interface to allow caller domain also mmap kdumpctl_tmp_t files Resolves: rhbz#1583084 - Allow sssd_t and slpad_t domains to mmap generic certs Resolves: rhbz#1592016 Resolves: rhbz#1592019 - Allow oddjob_t domain to mmap binary files as oddjob_mkhomedir_exec_t files Resolves: rhbz#1592022 - Update dbus_system_domain() interface to allow system_dbusd_t domain to mmap binary file from second parameter Resolves: rhbz#1583080 - Allow chronyc_t domain use inherited user ttys Resolves: rhbz#1593267 - Allow stapserver_t domain to mmap own tmp files Resolves: rhbz#1593122 - Allow sssd_t domain to mmap files labeled as sssd_selinux_manager_exec_t Resolves: rhbz#1592026 - Update policy for ypserv_t domain Resolves: rhbz#1592032 - Allow abrt_dump_oops_t domain to mmap all non security files Resolves: rhbz#1593728 - Allow svirt_t domain mmap svirt_image_t files Resolves: rhbz#1592688 - Allow virtlogd_t domain to write inhibit systemd pipes. Resolves: rhbz#1593740 - Allow sysadm_t and staff_t domains to use sudo io logging Resolves: rhbz#1564470 - Allow sysadm_t domain create sctp sockets Resolves: rhbz#1571591 - Update mount_domtrans() interface to allow caller domain mmap mount_exec_t Resolves: rhbz#1592025 - Allow dhcpc_t to mmap all binaries with label hostname_exec_t, ifconfig_exec_t and netutils_exec_t Resolves: rhbz#1594661- Fix typo in logwatch interface file - Allow spamd_t to manage logwatch_cache_t files/dirs - Allow dnsmasw_t domain to create own tmp files and manage mnt files - Allow fail2ban_client_t to inherit rlimit information from parent process Resolves: rhbz#1513100 - Allow nscd_t to read kernel sysctls Resolves: rhbz#1512852 - Label /var/log/conman.d as conman_log_t Resolves: rhbz#1538363 - Add dac_override capability to tor_t domain Resolves: rhbz#1540711 - Allow certmonger_t to readwrite to user_tmp_t dirs Resolves: rhbz#1543382 - Allow abrt_upload_watch_t domain to read general certs Resolves: rhbz#1545098 - Update postfix_domtrans_master() interface to allow caller domain also mmap postfix_master_exec_t binary Resolves: rhbz#1583087 - Allow postfix_domain to mmap postfix_qmgr_exec_t binaries Resolves: rhbz#1583088 - Allow postfix_domain to mmap postfix_pickup_exec_t binaries Resolves: rhbz#1583091 - Allow chornyd_t read phc2sys_t shared memory Resolves: rhbz#1578883 - Allow virt_qemu_ga_t read utmp Resolves: rhbz#1571202 - Add several allow rules for pesign policy: Resolves: rhbz#1468744 - Allow pesign domain to read /dev/random - Allow pesign domain to create netlink_kobject_uevent_t sockets - Allow pesign domain create own tmp files - Add setgid and setuid capabilities to mysqlfd_safe_t domain Resolves: rhbz#1474440 - Add tomcat_can_network_connect_db boolean Resolves: rhbz#1477948 - Update virt_use_sanlock() boolean to read sanlock state Resolves: rhbz#1448799 - Add sanlock_read_state() interface - Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026) Resolves: rhbz#1563423 - Update abrt_domtrans and abrt_exec() interfaces to allow caller domain to mmap binary file Resolves:rhbz#1583080 - Update nscd_domtrans and nscd_exec interfaces to allow caller domain also mmap nscd binaries Resolves: rhbz#1583086 - Update snapperd_domtrans() interface to allow caller domain to mmap snapperd_exec_t file Resolves: rhbz#1583802 - Allow zoneminder_t to getattr of fs_t Resolves: rhbz#1585328 - Fix denials during ipa-server-install process on F27+ Resolves: rhbz#1586029 - Allow ipa_dnskey_t to exec ipa_dnskey_exec_t files Resolves: rhbz#1586033 - Allow rhsmcertd_t domain to send signull to postgresql_t domain Resolves: rhbz#1588119 - Allow policykit_t domain to dbus chat with dhcpc_t Resolves: rhbz#1364513 - Adding new boolean keepalived_connect_any() Resolves: rhbz#1443473 - Allow amanda to create own amanda_tmpfs_t files Resolves: rhbz#1452444 - Add amanda_tmpfs_t label. BZ(1243752) - Allow gdomap_t domain to connect to qdomap_port_t Resolves: rhbz#1551944 - Fix typos in sge - Fix typo in openvswitch policy - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type - Allow sshd_keygen_t to execute plymouthd Resolves: rhbz#1583531 - Update seutil_domtrans_setfiles() interface to allow caller domain to do mmap on setfiles_exec_t binary Resolves: rhbz#1583090 - Allow systemd_networkd_t create and relabel tun sockets Resolves: rhbz#1583830 - Allow map audisp_exec_t files fordomains executing this binary Resolves: rhbz#1586042 - Add new interface postgresql_signull() - Add fs_read_xenfs_files() interface.- /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type - Allow dac override capability to mandb_t domain BZ(1529399) Resolves: rhbz#1423361 - Allow inetd_child process to chat via dbus with abrt Resolves: rhbz#1428805 - Allow zabbix_agent_t domain to connect to redis_port_t Resolves: rhbz#1418860 - Allow rhsmcertd_t domain to read xenfs_t files Resolves: rhbz#1405870 - Allow zabbix_agent_t to run zabbix scripts Resolves: rhbz#1380697 - Allow rabbitmq_t domain to create own tmp files/dirs Resolves: rhbz#1546897 - Allow policykit_t mmap policykit_auth_exec_t files Resolves: rhbz#1583082 - Allow ipmievd_t domain to read general certs Resolves: rhbz#1514591 - Add sys_ptrace capability to pcp_pmie_t domain - Allow squid domain to exec ldconfig Resolves: rhbz#1532017 - Make working gpg agent in gpg_agent_t domain Resolves: rhbz#1535109 - Update gpg SELinux policy module - Allow kexec to read kernel module files in /usr/lib/modules. Resolves: rhbz#1536690 - Allow mailman_domain to read system network state Resolves: rhbz#1413510 - Allow mailman_mail_t domain to search for apache configs Resolves: rhbz#1413510 - Allow openvswitch_t domain to read neutron state and read/write fixed disk devices Resolves: rhbz#1499208 - Allow antivirus_domain to read all domain system state Resolves: rhbz#1560986 - Allow targetd_t domain to red gconf_home_t files/dirs Resolves: rhbz#1546671 - Allow freeipmi domain to map sysfs_t files Resolves: rhbz#1575918 - Label /usr/libexec/bluetooth/obexd as obexd_exec_t Resolves: rhbz#1351750 - Update rhcs SELinux module Resolves: rhbz#1589257 - Allow iscsid_t domain mmap kernel modules Resolves: rhbz#1589295 - Allow iscsid_t domain mmap own tmp files Resolves: rhbz#1589295 - Update iscsid_domtrans() interface to allow mmap iscsid_exec_t binary Resolves: rhbz#1589295 - Update nscd_socket_use interface to allow caller domain also mmap nscd_var_run_t files. Resolves: rhbz#1589271 - Allow nscd_t domain to mmap system_db_t files Resolves: rhbz#1589271 - Add interface nagios_unconfined_signull() - Allow lircd_t domain read sssd public files Add setgid capability to lircd_t domain Resolves: rhbz#1550700 - Add missing requires - Allow tomcat domain sends email Resolves: rhbz#1585184 - Allow memcached_t domain nnp_transition becuase of systemd security features BZ(1514867) Resolves: rhbz#1585714 - Allow kdump_t domain to map /boot files Resolves: rhbz#1588884 - Fix typo in netutils policy - Allow confined users get AFS tokens Resolves: rhbz#1417671 - Allow sysadm_t domain to chat via dbus Resolves: rhbz#1582146 - Associate sysctl_kernel_t type with filesystem attribute - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets Resolves: rhbz#1557299 - Allow user_t and staff_t domains create netlink tcpdiag sockets Resolves: rhbz#1557281 - Add interface dev_map_sysfs - Allow xdm_t domain to execute xdm_var_lib_t files Resolves: rhbz#1589139 - Allow syslogd_t domain to send signull to nagios_unconfined_plugin_t Resolves: rhbz#1569344 - Label /dev/vhost-vsock char device as vhost_device_t - Add files_map_boot_files() interface Resolves: rhbz#1588884 - Update traceroute_t domain to allow create dccp sockets Resolves: rhbz#1548350- Update ctdb domain to support gNFS setup Resolves: rhbz#1576818 - Allow authconfig_t dbus chat with policykit Resolves: rhbz#1551241 - Allow lircd_t domain to read passwd_file_t Resolves: rhbz:#1550700 - Allow lircd_t domain to read system state Resolves: rhbz#1550700 - Allow smbcontrol_t to mmap samba_var_t files and allow winbind create sockets BZ(1559795) Resolves: rhbz#1574521 - Allow tangd_t domain read certs Resolves: rhbz#1509055 - Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db is turned on Resolves: rhbz:#1579219 - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp Resolves: rhbz#1574418 - Allow ctdb_t domain modify ctdb_exec_t files Resolves: rhbz#1572584 - Allow chrome_sandbox_t to mmap tmp files Resolves: rhbz#1574392 - Allow ulogd_t to create netlink_netfilter sockets. Resolves: rhbz#1575924 - Update ulogd SELinux security policy - Allow rhsmcertd_t domain send signull to apache processes Resolves: rhbz#1576555 - Allow freeipmi domain to read sysfs_t files Resolves: rhbz#1575918 - Allow smbcontrol_t to create dirs with samba_var_t label Resolves: rhbz#1574521 - Allow swnserve_t domain to stream connect to sasl domain Resolves: rhbz#1574537 - Allow SELinux users (except guest and xguest) to using bluetooth sockets Resolves: rhbz#1557299 - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets Resolves: rhbz#1557299 - Fix broken sysadm SELinux module Resolves: rhbz#1557311 - Allow user_t and staff_t domains create netlink tcpdiag sockets Resolves: rhbz#1557281 - Update ssh_domtrans_keygen interface to allow mmap ssh_keygen_exec_t binary file Resolves: rhbz#1583089 - Allow systemd_networkd_t to read/write tun tap devices Resolves: rhbz#1583830 - Add bridge_socket, dccp_socket, ib_socket and mpls_socket to socket_class_set Resolves: rhbz#1583771 - Allow audisp_t domain to mmap audisp_exec_t binary Resolves: rhbz#1583551 - Fix duplicates in sysadm.te file Resolves: rhbz#1307183 - Allow sysadm_u use xdm Resolves: rhbz#1307183 - Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Fix duplicates in sysadm.te file Resolves: rhbz#1307183- Allow sysadm_u use xdm Resolves: rhbz#1307183- Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db is turned on Resolves: rhbz:#1579219 - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp Resolves: rhbz#1574418 - Allow chrome_sandbox_t to mmap tmp files Resolves: rhbz#1574392 - Allow ulogd_t to create netlink_netfilter sockets. Resolves: rhbz#1575924 - Update ulogd SELinux security policy - Allow rhsmcertd_t domain send signull to apache processes Resolves: rhbz#1576555 - Allow freeipmi domain to read sysfs_t files Resolves: rhbz#1575918 - Allow smbcontrol_t to create dirs with samba_var_t label Resolves: rhbz#1574521 - Allow swnserve_t domain to stream connect to sasl domain Resolves: rhbz#1574537 - Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Improve procmail_domtrans() to allow mmaping procmail_exec_t - Allow hypervvssd_t domain to read fixed disk devices Resolves: rhbz#1581225 - Improve modutils_domtrans_insmod() interface to mmap insmod_exec_t binaries Resolves: rhbz#1581551 - Improve iptables_domtrans() interface to allow mmaping iptables_exec_t binary Resolves: rhbz#1581551 - Improve auth_domtrans_login_programinterface to allow also mmap login_exec_t binaries Resolves: rhbz#1581551 - Improve auth_domtrans_chk_passwd() interface to allow also mmaping chkpwd_exec_t binaries. Resolves: rhbz#1581551 - Allow mmap dhcpc_exec_t binaries in sysnet_domtrans_dhcpc interface- Add dbus_stream_connect_system_dbusd() interface. - Allow pegasus_t domain to mount tracefs_t filesystem Resolves:rhbz#1374570 - Allow psad_t domain to read all domains state Resolves: rhbz#1558439 - Add net_raw capability to named_t domain BZ(1545586) - Allow tomcat_t domain to connect to mongod_t tcp port Resolves:rhbz#1539748 - Allow dovecot and postfix to connect to systemd stream sockets Resolves: rhbz#1368642 - Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t Resolves:rhbz#1351750 - Rename tang policy to tangd - Add interface systemd_rfkill_domtrans() - Allow users staff and sysadm to run wireshark on own domain Resolves:rhbz#1546362 - Allow systemd-bootchart to create own tmpfs files Resolves:rhbz#1510412- Rename tang policy to tangd - Allow virtd_t domain to relabel virt_var_lib_t files Resolves: rhbz#1558121 - Allow logrotate_t domain to stop services via systemd Resolves: rhbz#1527522 - Add tang policy Resolves: rhbz#1509055 - Allow mozilla_plugin_t to create mozilla.pdf file in user homedir with label mozilla_home_t Resolves: rhbz#1559859 - Improve snapperd SELinux policy Resolves: rhbz#1365555 - Allow snapperd_t daemon to create unlabeled dirs. Resolves: rhbz#1365555 - We have inconsistency in cgi templates with upstream, we use _content_t, but refpolicy use httpd__content_t. Created aliasses to make it consistence Resolves: rhbz#1271324 - Allow Openvswitch adding netdev bridge ovs 2.7.2.10 FDP Resolves: rhbz#1503835 - Add new Boolean tomcat_use_execmem Resolves: rhbz#1565226 - Allow domain transition from logrotate_t to chronyc_t Resolves: rhbz#1568281 - Allow nfsd_t domain to read/write sysctl fs files Resolves: rhbz#1516593 - Allow conman to read system state Resolves: rhbz#1377915 - Allow lircd_t to exec shell and add capabilities dac_read_search and dac_override Resolves: rhbz#1550700 - Allow usbmuxd to access /run/udev/data/+usb:*. Resolves: rhbz#1521054 - Allow abrt_t domain to manage kdump crash files Resolves: rhbz#1491585 - Allow systemd to use virtio console Resolves: rhbz#1558121 - Allow transition from sysadm role into mdadm_t domain. Resolves: rhbz#1551568 - Label /dev/op_panel and /dev/opal-prd as opal_device_t Resolves: rhbz#1537618 - Label /run/ebtables.lock as iptables_var_run_t Resolves: rhbz#1511437 - Allow udev_t domain to manage udev_rules_t char files. Resolves: rhbz#1545094 - Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin. Resolves: rhbz#1567753 - Fix filesystem inteface file, we don't have nsfs_fs_t type, just nsfs_t Resolves: rhbz#1547700 - Allow iptables_t domain to create dirs in etc_t with system_conf_t labels- Add new boolean redis_enable_notify() Resolves: rhbz#1421326 - Label /var/log/shibboleth-www(/.*) as httpd_sys_rw_content_t Resolves: rhbz#1549514 - Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/ Resolves: rbhz#1463593 - Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_t Resolves: rbhz#1463593- Backport several changes for snapperdfrom Fedora Rawhide Resolves: rhbz#1556798 - Allow snapperd_t to set priority for kernel processes Resolves: rhbz#1556798 - Make ganesha nfs server. Resolves: rhbz#1511489 - Allow vxfs filesystem to use SELinux labels Resolves: rhbz#1482880 - Add map permission to selinux-policy Resolves: rhbz#1460322- Label /usr/libexec/dbus-1/dbus-daemon-launch-helper as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled. Resolves: rhbz#1546721- Allow openvswitch_t stream connect svirt_t Resolves: rhbz#1540702- Allow openvswitch domain to manage svirt_tmp_t sock files Resolves: rhbz#1540702 - Fix broken systemd_tmpfiles_run() interface- Allow dirsrv_t domain to create tmp link files Resolves: rhbz#1536011 - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t Resolves: rhbz#1428568 - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries - Allow ipsec_mgmt_t nnp domain transition to ifconfig_t Resolves: rhbz#1539416- Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t Resolves: rhbz#1540702 - Allow keepalived_t domain getattr proc filesystem Resolves: rhbz#1477542 - Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t Resolves: rhbz#1538544 - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t Resolves: rhbz:#1539416 - Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t Resolves: rhbz#1479350- Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets Resolves: rhbz#1535196 - Add new interface ppp_filetrans_named_content() Resolves: rhbz#1530601 - Allow keepalived_t read sysctl_net_t files Resolves: rhbz#1477542 - Allow puppetmaster_t domtran to puppetagent_t Resolves: rhbz#1376893 - Allow kdump_t domain to read kernel ring buffer Resolves: rhbz#1540004 - Allow ipsec_t domain to exec ifconfig_exec_t binaries. Resolves: rhbz#1539416 - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock Resolves: rhbz#1530601 - Allow updpwd_t domain to create files in /etc with shadow_t label Resolves: rhbz#1412838 - Allow iptables sysctl load list support with SELinux enforced Resolves: rhbz#1535572- Allow virt_domains to acces infiniband pkeys. Resolves: rhbz#1533183 - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t Resolves: rhbz#1535133 - Allow audisp_remote_t domain write to files on all levels Resolves: rhbz#1534924- Allow vmtools_t domain creating vmware_log_t files Resolves: rhbz#1507048 - Allow openvswitch_t domain to acces infiniband devices Resolves: rhbz#1532705- Allow chronyc_t domain to manage chronyd_keys_t files. Resolves: rhbz#1530525 - Make virtlog_t domain system dbus client Resolves: rhbz#1481109 - Update openvswitch SELinux module Resolves: rhbz#1482682 - Allow virtd_t to create also sock_files with label virt_var_run_t Resolves: rhbz#1484075- Allow domains that manage logfiles to man logdirs Resolves: rhbz#1523811- Label /dev/drm_dp_aux* as xserver_misc_device_t Resolves: rhbz#1520897 - Allow sysadm_t to run puppet_exec_t binaries as puppet_t Resolves: rhbz#1255745- Allow tomcat_t to manage pki_tomcat pid files Resolves: rhbz#1478371 - networkmanager: allow talking to openvswitch Resolves: rhbz#1517247 - Allow networkmanager_t and opensm_t to manage subned endports for IPoIB VLANs Resolves: rhbz#1517895 - Allow domains networkmanager_t and opensm_t to control IPoIB VLANs Resolves: rhbz#1517744 - Fix typo in guest interface file Resolves: rhbz#1468254 - Allow isnsd_t domain to accept tcp connections. Resolves: rhbz#1390208- Allow getty to use usbttys Resolves: rhbz#1514235- Allow ldap_t domain to manage also slapd_tmp_t lnk files Resolves: rhbz#1510883 - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t Resolves: rhbz:#1508360 - Add dac_read_search and dac_override capabilities to ganesha Resolves: rhbz#1483451- Add dependency for policycoreutils-2.5.18 becuase of new cgroup_seclabel policy capability Resolves: rhbz#1510145- Allow jabber domains to connect to postgresql ports Resolves: rhbz#1438489 - Dontaudit accountsd domain creating dirs in /root Resolves: rhbz#1456760 - Dontaudit slapd_t to block suspend system Resolves: rhbz: #1479759 - Allow spamc_t to stream connect to cyrus. Resolves: rhbz#1382955 - allow imapd to read /proc/net/unix file Resolves: rhbz#1393030 - Allow passenger to connect to mysqld_port_t Resolves: rhbz#1433464- Allow chronyc_t domain to use user_ptys Resolves: rhbz#1470150 - allow ptp4l to read /proc/net/unix file - Allow conmand to use usb ttys. Resolves: rhbz#1505121 - Label all files /var/log/opensm.* as opensm_log_t because opensm creating new log files with name opensm-subnet.lst Resolves: rhbz#1505845 - Allow chronyd daemon to execute chronyc. Resolves: rhbz#1508486 - Allow firewalld exec ldconfig. Resolves: rhbz#1375576 - Allow mozilla_plugin_t domain to dbus chat with devicekit Resolves: rhbz#1460477 - Dontaudit leaked logwatch pipes Resolves: rhbz#1450119 - Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon. Resolves: rhbz#1507048 - Allow httpd_t domain to execute hugetlbfs_t files Resolves: rhbz#1507682 - Allow nfsd_t domain to read configfs_t files/dirs Resolves: rhbz#1439442 - Hide all allow rules with ptrace inside deny_ptrace boolean Resolves: rhbz#1421075 - Allow tgtd_t domain to read generic certs Resolves: rhbz#1438532 - Allow ptp4l to send msgs via dgram socket to unprivileged user domains Resolves: rhbz#1429853 - Allow dirsrv_snmp_t to use inherited user ptys and read system state Resolves: rhbz#1428568 - Allow glusterd_t domain to create own tmpfs dirs/files Resolves: rhbz#1411310 - Allow keepalived stream connect to snmp Resolves: rhbz#1401556 - After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy Resolves: rhbz#1507089- Allow pegasus_openlmi_services_t to read generic certs Resolves: rhbz#1462292 - Allow ganesha_t domain to read random device Resolves: rhbz#1494382 - Allow zabbix_t domain to change its resource limits Resolves: rhbz:#1504074 - Add new boolean nagios_use_nfs Resolves: rhbz#1504826 - Allow system_mail_t to search network sysctls Resolves: rhbz#1505779 - Add samba_manage_var_dirs() interface - Fix typo bug in virt filecontext file - Allow nagios_script_t to read nagios_spool_t files Resolves: rhbz#1426824 - Allow samba to manage var dirs/files Resolves: rhbz#1415088 - Allow sbd_t to create own sbd_tmpfs_t dirs/files Resolves: rhbz#1380795 - Allow firewalld and networkmanager to chat with hypervkvp via dbus Resolves: rhbz#1377276 - Allow dmidecode to read rhsmcert_log_t files Resolves: rhbz#1300799 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow pegasus_openlmi_services_t to read generic certs Resolves: rhbz#1462292 - Allow ganesha_t domain to read random device Resolves: rhbz#1494382 - Allow zabbix_t domain to change its resource limits Resolves: rhbz:#1504074 - Add new boolean nagios_use_nfs Resolves: rhbz#1504826 - Allow system_mail_t to search network sysctls Resolves: rhbz#1505779 - Add samba_manage_var_dirs() interface - Fix typo bug in virt filecontext file - Allow nagios_script_t to read nagios_spool_t files Resolves: rhbz#1426824 - Allow samba to manage var dirs/files Resolves: rhbz#1415088 - Allow sbd_t to create own sbd_tmpfs_t dirs/files Resolves: rhbz#1380795 - Allow firewalld and networkmanager to chat with hypervkvp via dbus Resolves: rhbz#1377276 - Allow dmidecode to read rhsmcert_log_t files Resolves: rhbz#1300799 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow chronyd_t do request kernel module and block_suspend capability Resolves: rhbz#1350765 - Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label Resolves: rhbz#1447278 - Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables Resolves: rhbz#1491994 - Allow svnserve to use kerberos Resolves: rhbz#1475271 - Allow conman to use ptmx. Add conman_use_nfs boolean Resolves: rhbz#1377915 - Add nnp transition for services using: NoNewPrivileges systemd security feature Resolves: rhbz#1311430 - Add SELinux support for chronyc Resolves: rhbz#1470150 - Add dac_read_search capability to openvswitch_t domain Resolves: rhbz#1501336 - Allow svnserve to manage own svnserve_log_t files/dirs Resolves: rhbz#1480741 - Allow keepalived_t to search network sysctls Resolves: rhbz#1477542 - Allow puppetagent_t domain dbus chat with rhsmcertd_t domain Resolves: rhbz#1446777 - Add dccp_socket into socker_class_set subset Resolves: rhbz#1459941 - Allow iptables_t to run setfiles to restore context on system Resolves: rhbz#1489118 - Label 20514 tcp/udp ports as syslogd_port_t Label 10514 tcp/udp portas as syslog_tls_port_t Resolves: rhbz:#1411400 - Make nnp transition Active Resolves: rhbz#1480518 - Label tcp 51954 as isns_port_t Resolves: rhbz#1390208 - Add dac_read_search capability chkpwd_t Resolves: rhbz#1376991 - Add support for running certbot(letsencrypt) in crontab Resolves: rhbz#1447278 - Add init_nnp_daemon_domain interface - Allow xdm_t to gettattr /dev/loop-control device Resolves: rhbz#1462925 - Allow nnp trasintion for unconfined_service_t Resolves: rhbz#1311430 - Allow unpriv user domains and unconfined_service_t to use chronyc Resolves: rhbz#1470150 - Allow iptables to exec plymouth. Resolves: rhbz#1480374 - Fix typo in fs_unmount_tracefs interface. Resolves: rhbz#1371057 - Label postgresql-check-db-dir as postgresql_exec_t Resolves: rhbz#1490956- We should not ship selinux-policy with permissivedomains enabled. Resolves: rhbz#1494172 - Fix order of installing selinux-policy-sandbox, because of depedencied in sandbox module, selinux-policy-targeted needs to be installed before selinux-policy-sandbox Resolves: rhbz#1492606- Allow tomcat to setsched Resolves: rhbz#1492730 - Fix rules blocking ipa-server upgrade process Resolves: rhbz#1478371 - Add new boolean tomcat_read_rpm_db() Resolves: rhbz#1477887 - Allow tomcat to connect on mysqld tcp ports - Add ctdbd_t domain sys_source capability and allow setrlimit Resolves: rhbz#1491235 - Fix keepalived SELinux module - Allow automount domain to manage mount pid files Resolves: rhbz#1482381 - Allow stunnel_t domain setsched Resolves: rhbz#1479383 - Add keepalived domain setpgid capability Resolves: rhbz#1486638 - Allow tomcat domain to connect to mssql port Resolves: rhbz#1484572 - Remove snapperd_t from unconfined domaines Resolves: rhbz#1365555 - Fix typo bug in apache module Resolves: rhbz#1397311 - Dontaudit that system_mail_t is trying to read /root/ files Resolves: rhbz#1147945 - Make working webadm_t userdomain Resolves: rhbz#1323792 - Allow redis domain to execute shell scripts. Resolves: rhbz#1421326 - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t Resolves: rhbz#1473303 - Add couple capabilities to keepalived domain and allow get attributes of all domains Resolves: rhbz#1429327 - Allow dmidecode read rhsmcertd lock files Resolves: rhbz#1300799 - Add new interface rhsmcertd_rw_lock_files() Resolves: rhbz#1300799 - Label all plymouthd archives as plymouthd_var_log_t Resolves: rhbz#1478323 - Allow cloud_init_t to dbus chat with systemd_timedated_t Resolves: rhbz#1440730 - Allow logrotate_t to write to kmsg Resolves: rhbz#1397744 - Add capability kill to rhsmcertd_t Resolves: rhbz#1398338 - Disable mysqld_safe_t secure mode environment cleansing. Resolves: rhbz#1464063 - Allow winbind to manage smbd_tmp_t files Resolves: rhbz#1475566 - Dontaudit that system_mail_t is trying to read /root/ files Resolves: rhbz#1147945 - Make working webadm_t userdomain Resolves: rhbz#1323792 - Allow redis domain to execute shell scripts. Resolves: rhbz#1421326 - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t Resolves: rhbz#1473303 - Add couple capabilities to keepalived domain and allow get attributes of all domains Resolves: rhbz#1429327 - Allow dmidecode read rhsmcertd lock files Resolves: rhbz#1300799 - Add new interface rhsmcertd_rw_lock_files() Resolves: rhbz#1300799 - Label all plymouthd archives as plymouthd_var_log_t Resolves: rhbz#1478323 - Allow cloud_init_t to dbus chat with systemd_timedated_t Resolves: rhbz#1440730 - Allow logrotate_t to write to kmsg Resolves: rhbz#1397744 - Add capability kill to rhsmcertd_t Resolves: rhbz#1398338 - Disable mysqld_safe_t secure mode environment cleansing. Resolves: rhbz#1464063 - Allow winbind to manage smbd_tmp_t files Resolves: rhbz#1475566 - Add interface systemd_tmpfiles_run - End of file cannot be in comment - Allow systemd-logind to use ypbind Resolves: rhbz#1479350 - Add creating opasswd file with shadow_t SELinux label in auth_manage_shadow() interface Resolves: rhbz#1412838 - Allow sysctl_irq_t assciate with proc_t Resolves: rhbz#1485909 - Enable cgourp sec labeling Resolves: rhbz#1485947 - Add cgroup_seclabel policycap. Resolves: rhbz#1485947 - Allow sshd_t domain to send signull to xdm_t processes Resolves: rhbz#1448959 - Allow updpwd_t domain auth file name trans Resolves: rhbz#1412838 - Allow sysadm user to run systemd-tmpfiles Resolves: rbhz#1325364 - Add support labeling for vmci and vsock device Resolves: rhbz#1451358 - Add userdom_dontaudit_manage_admin_files() interface Resolves: rhbz#1323792 - Allow iptables_t domain to read files with modules_conf_t label Resolves: rhbz#1373220 - init: Add NoNewPerms support for systemd. Resolves: rhbz#1480518 - Add nnp_nosuid_transition policycap and related class/perm definitions. Resolves: rhbz#1480518 - refpolicy: Infiniband pkeys and endports Resolves: rhbz#1464484- Allow certmonger using systemctl on pki_tomcat unit files Resolves: rhbz#1481388- Allow targetd_t to create own tmp files. - Dontaudit targetd_t to exec rpm binary file. Resolves: rhbz#1373860 Resolves: rhbz#1424621- Add few rules to make working targetd daemon with SELinux Resolves: rhbz#1373860 - Allow ipmievd_t domain to load kernel modules Resolves: rhbz#1441081 - Allow logrotate to reload transient systemd unit Resolves: rhbz#1440515 - Add certwatch_t domain dac_override and dac_read_search capabilities Resolves: rhbz#1422000 - Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain Resolves: rhbz#1412072 - Allow nscd_t domain to search network sysctls Resolves: rhbz#1432361 - Allow iscsid_t domain to read mount pid files Resolves: rhbz#1482097 - Allow ksmtuned_t domain manage sysfs_t files/dirs Resolves: rhbz#1413865 - Allow keepalived_t domain domtrans into iptables_t Resolves: rhbz#1477719 - Allow rshd_t domain reads net sysctls Resolves: rhbz#1477908 - Add interface seutil_dontaudit_read_module_store() - Update interface lvm_rw_pipes() by adding also open permission - Label /dev/clp device as vfio_device_t Resolves: rhbz#1477624 - Allow ifconfig_t domain unmount fs_t Resolves: rhbz#1477445 - Label /dev/gpiochip* devices as gpio_device_t Resolves: rhbz#1477618 - Add interface dev_manage_sysfs() Resolves: rhbz#1474989- Label /usr/libexec/sudo/sesh as shell_exec_t Resolves: rhbz#1480791- Allow tomcat_t domain couple capabilities to make working tomcat-jsvc Resolves: rhbz#1470735- Allow llpdad send dgram to libvirt Resolves: rhbz#1472722- Add new boolean gluster_use_execmem Resolves: rhbz#1469027 - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service Resolves: rhbz#1468581- Dontaudit staff_t user read admin_home_t files. Resolves: rhbz#1290633- Allow couple rules needed to start targetd daemon with SELinux in enforcing mode Resolves: rhbz#1424621 - Add interface lvm_manage_metadata Resolves: rhbz#1424621- Allow sssd_t to read realmd lib files. Resolves: rhbz#1436689 - Add permission open to files_read_inherited_tmp_files() interface Resolves: rhbz#1290633 Resolves: rhbz#1457106- Allow unconfined_t user all user namespace capabilties. Resolves: rhbz#1461488- Allow httpd_t to read realmd_var_lib_t files Resolves: rhbz#1436689- Allow named_t to bind on udp 4321 port Resolves: rhbz#1312972 - Allow systemd-sysctl cap. sys_ptrace Resolves: rhbz#1458999- Allow pki_tomcat_t execute ldconfig. Resolves: rhbz#1436689- Allow iscsi domain load kernel module. Resolves: rhbz#1457874 - Allow keepalived domain connect to squid tcp port Resolves: rhbz#1457455 - Allow krb5kdc_t domain read realmd lib files. Resolves: rhbz#1436689 - xdm_t should view kernel keys Resolves: rhbz#1432645- Allow tomcat to connect on all unreserved ports - Allow ganesha to connect to all rpc ports Resolves: rhbz#1448090 - Update ganesha with another fixes. Resolves: rhbz#1448090 - Update rpc_read_nfs_state_data() interface to allow read also lnk_files. Resolves: rhbz#1448090 - virt_use_glusterd boolean should be in optional block Update ganesha module to allow create tmp files Resolves: rhbz#1448090 - Hide broken symptoms when machine is configured with network bounding.- Add new boolean virt_use_glusterd Resolves: rhbz#1455994 - Add capability sys_boot for sbd_t domain - Allow sbd_t domain to create rpc sysctls. Resolves: rhbz#1455631 - Allow ganesha_t domain to manage glusterd_var_run_t pid files. Resolves: rhbz#1448090- Create new interface: glusterd_read_lib_files() - Allow ganesha read glusterd lib files. - Allow ganesha read network sysctls Resolves: rhbz#1448090- Add few allow rules to ganesha module Resolves: rhbz#1448090 - Allow condor_master_t to read sysctls. Resolves: rhbz#1277506 - Add dac_override cap to ctdbd_t domain Resolves: rhbz#1435708 - Label 8750 tcp/udp port as dey_keyneg_port_t Resolves: rhbz#1448090- Add ganesha_use_fusefs boolean. Resolves: rhbz#1448090- Allow httpd_t reading kerberos kdc config files Resolves: rhbz#1452215 - Allow tomcat_t domain connect to ibm_dt_2 tcp port. Resolves: rhbz#1447436 - Allow stream connect to initrc_t domains Resolves: rhbz#1447436 - Allow dnsmasq_t domain to read systemd-resolved pid files. Resolves: rhbz#1453114 - Allow tomcat domain name_bind on tcp bctp_port_t Resolves: rhbz#1451757 - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process. Resolves: rhbz#1447669 - Allow condor_master_t write to sysctl_net_t Resolves: rhbz#1277506 - Allow nagios check disk plugin read /sys/kernel/config/ Resolves: rhbz#1277718 - Allow pcp_pmie_t domain execute systemctl binary Resolves: rhbz#1271998 - Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl Resolves: rhbz#1247635 - Label tcp/udp port 1792 as ibm_dt_2_port_t Resolves: rhbz#1447436 - Add interface fs_read_configfs_dirs() - Add interface fs_read_configfs_files() - Fix systemd_resolved_read_pid interface - Add interface systemd_resolved_read_pid() Resolves: rhbz#1453114 - Allow sshd_net_t domain read/write into crypto devices Resolves: rhbz#1452759 - Label 8999 tcp/udp as bctp_port_t Resolves: rhbz#1451757- nmbd_t needs net_admin capability like smbd Resolves: rhbz#1431859 - Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t Resolves: rhbz#1431859 - Allow rngd domain read sysfs_t Resolves: rhbz#1451735 - Add interface pki_manage_common_files() Resolves: rhbz#1447436 - Allow tomcat_t domain to manage pki_common_t files and dirs Resolves: rhbz#1447436 - Use stricter fc rules for sssd sockets in /var/run Resolves: rhbz#1448060 - Allow certmonger reads httpd_config_t files Resolves: rhbz#1436689 - Allow keepalived_t domain creating netlink_netfilter_socket. Resolves: rhbz#1451684 - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files. Resolves: rhbz#1451318 - Make able deply overcloud via neutron_t to label nsfs as fs_t Resolves: rhbz#1373321- Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files. Resolves: rhbz#1451318 - Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/ Resolves: rhbz#1448056 Resolves: rhbz#1448060 - Allow tomcat_domain connect to * postgresql_port_t * amqp_port_t Allow tomcat_domain read network sysctls Resolves: rhbz#1450819 - Make able deply overcloud via neutron_t to label nsfs as fs_t Resolves: rhbz#1373321 - Allow netutils setpcap capability Resolves:1444438- Update targetd policy to accommodate changes in the service Resolves: rhbz#1424621 - Allow tomcat_domain connect to * postgresql_port_t * amqp_port_t Allow tomcat_domain read network sysctls Resolves: rhbz#1450819 - Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options. Resolves: rhbz#1415841 - Allow radius domain stream connec to postgresql Resolves: rhbz#1446145 - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit Resolves: rhbz#1449977 - Allow glusterd_t domain start ganesha service Resolves: rhbz#1448090 - Made few cosmetic changes in sssd SELinux module Resolves: rhbz#1448060 - sssd-kcm should not run as unconfined_service_t BZ(1447411) Resolves: rhbz#1448060 - Add sssd_secrets labeling Also add named_filetrans interface to make sure all labels are correct Resolves: rhbz#1448056 - Allow keepalived_t domain read usermodehelper_t Resolves: rhbz#1449769 - Allow tomcat_t domain read pki_common_t files Resolves: rhbz#1447436 - Add interface pki_read_common_files() Resolves: rhbz#1447436- Allow hypervkvp_t domain execute hostname Resolves: rhbz#1449064 - Dontaudit sssd_selinux_manager_t use of net_admin capability Resolves: rhbz#1444955 - Allow tomcat_t stream connect to pki_common_t Resolves: rhbz#1447436 - Dontaudit xguest_t's attempts to listen to its tcp_socket - Allow sssd_selinux_manager_t to ioctl init_t sockets Resolves: rhbz#1436689 - Allow _su_t to create netlink_selinux_socket Resolves rhbz#1146987 - Allow unconfined_t to module_load any file Resolves rhbz#1442994- Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type. Resolves: rhbz#1436689- Allow pki_tomcat_t domain read /etc/passwd. Resolves: rhbz#1436689 - Allow tomcat_t domain read ipa_tmp_t files Resolves: rhbz#1436689 - Label new path for ipa-otpd Resolves: rhbz#1446353 - Allow radiusd_t domain stream connect to postgresql_t Resolves: rhbz#1446145 - Allow rhsmcertd_t to execute hostname_exec_t binaries. Resolves: rhbz#1445494 - Allow virtlogd to append nfs_t files when virt_use_nfs=1 Resolves: rhbz#1402561- Update tomcat policy to adjust for removing unconfined_domain attr. Resolves: rhbz#1432083 - Allow httpd_t domain read also httpd_user_content_type lnk_files. Resolves: rhbz#1383621 - Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t Resolves: rhbz#1436689 - Dontaudit _gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t Resolves: rhbz#1425530 - Add interface ipa_filetrans_named_content() Resolves: rhbz#1432115 - Allow tomcat use nsswitch Resolves: rhbz#1436689 - Allow certmonger_t start/status generic services Resolves: rhbz#1436689 - Allow dirsrv read cgroup files. Resolves: rhbz#1436689 - Allow ganesha_t domain read/write infiniband devices. Resolves: rhbz#1383784 - Allow sendmail_t domain sysctl_net_t files Resolves: rhbz#1369376 - Allow targetd_t domain read network state and getattr on loop_control_device_t Resolves: rhbz#1373860 - Allow condor_schedd_t domain send mails. Resolves: rhbz#1277506 - Alow certmonger to create own systemd unit files. Resolves: rhbz#1436689 - Allow staff to systemctl virt server when staff_use_svirt=1 Resolves: rhbz#1415841 - Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context Resolves: rhbz#1432115 - Label /sysroot/ostree/deploy/rhel-atomic-host/* as root_t Resolves: rhbz#1428112- Alow certmonger to create own systemd unit files. Resolves: rhbz#1436689- Hide broken symptoms when using kernel 3.10.0-514+ with network bonding. Postfix_picup_t domain requires NET_ADMIN capability which is not really needed. Resolves: rhbz#1431859 - Fix policy to reflect all changes in new IPA release Resolves: rhbz#1432115 Resolves: rhbz#1436689- Allow sbd_t to read/write fixed disk devices Resolves: rhbz#1440165 - Add sys_ptrace capability to radiusd_t domain Resolves: rhbz#1426641 - Allow cockpit_session_t domain connects to ssh tcp ports. Resolves: rhbz#1413509- Update tomcat policy to make working ipa install process Resolves: rhbz#1436689- Allow pcp_pmcd_t net_admin capability. - Allow pcp_pmcd_t read net sysctls - Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t Resolves: rhbz#1336211- Fix all AVC denials during pkispawn of CA Resolves: rhbz#1436383 - Update pki interfaces and tomcat module Resolves: rhbz#1436689- Update pki interfaces and tomcat module Resolves: rhbz#1436689- Dontaudit firewalld wants write to /root Resolves: rhbz#1438708 - Dontaudit firewalld to create dirs in /root/ Resolves: rhbz#1438708 - Allow sendmail to search network sysctls Resolves: rhbz#1369376 - Add interface gssd_noatsecure() Resolves: rhbz#1438036 - Add interface gssproxy_noatsecure() Resolves: rhbz#1438036 - Dontaudit pcp_pmlogger_t search for xserver logs. Allow pcp_pmlogger_t to send signals to unconfined doamins Allow pcp_pmlogger_t to send logs to journals Resolves: rhbz#1379371 - Allow chronyd_t net_admin capability to allow support HW timestamping. Resolves: rhbz#1416015 - Update tomcat policy Resolves: rhbz#1436689 Resolves: rhbz#1436383 - Allow certmonger to start haproxy service Resolves: rhbz#1349394 - Allow init noatsecure for gssd and gssproxy Resolves: rhbz#1438036- geoclue wants to dbus chat with avahi Resolves: rhbz#1434286 - Allow iptables get list of kernel modules Resolves: rhbz#1367520 - Allow unconfined_domain_type to enable/disable transient unit Resolves: rhbz#1337041 - Add interfaces init_enable_transient_unit() and init_disable_transient_unit - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd" Resolves: rhbz#1435264 - Label sysroot dir under ostree as root_t Resolves: rhbz#1428112- Remove ganesha_t domain from permissive domains. Resolves: rhbz#1436988- Allow named_t domain bind on several udp ports Resolves: rhbz#1312972 - Update nscd_use() interface Resolves: rhbz#1281716 - Allow radius_t domain ptrace Resolves: rhbz#1426641 - Update nagios to allos exec systemctl Resolves: rhbz#1247635 - Update pcp SELinux module to reflect all pcp changes Resolves: rhbz#1271998 - Label /var/lib/ssl_db as squid_cache_t Label /etc/squid/ssl_db as squid_cache_t Resolves: rhbz#1325527 - Allow pcp_pmcd_t domain search for network sysctl Allow pcp_pmcd_t domain sys_ptrace capability Resolves: rhbz#1336211- Allow drbd load modules Resolves: rhbz#1134883 - Revert "Add sys_module capability for drbd Resolves: rhbz#1134883" - Allow stapserver list kernel modules Resolves: rhbz#1325976 - Update targetd policy Resolves: rhbz#1373860 - Add sys_admin capability to amanda Resolves: rhbz#1371561 - Allow hypervvssd_t to read all dirs. Resolves: rhbz#1331309 - Label /run/haproxy.sock socket as haproxy_var_run_t Resolves: rhbz#1386233 - Allow oddjob_mkhomedir_t to mamange autofs_t dirs. Resolves: rhbz#1408819 - Allow tomcat to connect on http_cache_port_t Resolves: rhbz#1432083 - Allow geoclue to send msgs to syslog. Resolves: rhbz#1434286 - Allow condor_master_t domain capability chown. Resolves: rhbz#1277506 - Update mta_filetrans_named_content() interface to allow calling domain create files labeled as etc_aliases_t in dir labeled as etc_mail_t. Resolves: rhbz#1167468 - Allow nova domain search for httpd configuration. Resolves: rhbz#1190761 - Add sys_module capability for drbd Resolves: rhbz#1134883 - Allow user_u users stream connect to dirsrv, Allow sysadm_u and staff_u users to manage dirsrv files Resolves: rhbz#1286474 - Allow systemd_networkd_t communicate with systemd_networkd_t via dbus Resolves: rhbz#1278010- Add haproxy_t domain fowner capability Resolves: rhbz#1386233 - Allow domain transition from ntpd_t to hwclock_t domains Resolves: rhbz#1375624 - Allow cockpit_session_t setrlimit and sys_resource Resolves: rhbz#1402316 - Dontaudit svirt_t read state of libvirtd domain Resolves: rhbz#1426106 - Update httpd and gssproxy modules to reflects latest changes in freeipa Resolves: rhbz#1432115 - Allow iptables read modules_conf_t Resolves: rhbz#1367520- Remove tomcat_t domain from unconfined domains Resolves: rhbz#1432083 - Create new boolean: sanlock_enable_home_dirs() Resolves: rhbz#1432783 - Allow mdadm_t domain to read/write nvme_device_t Resolves: rhbz#1431617 - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content Resolves: rhbz#1383621 - Dontaudit domain to create any file in /proc. This is kernel bug. Resolves: rhbz#1412679 - Add interface dev_rw_nvme Resolves: rhbz#1431617- Allow gssproxy to get attributes on all filesystem object types. Resolves: rhbz#1430295 - Allow ganesha to chat with unconfined domains via dbus Resolves: rhbz#1426554 - add the policy required for nextcloud Resolves: rhbz#1425530 - Add nmbd_t capability2 block_suspend Resolves: rhbz#1425357 - Label /var/run/chrony as chronyd_var_run_t Resolves: rhbz#1416015 - Add domain transition from sosreport_t to iptables_t Resolves: rhbz#1359789 - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd Resolves: rhbz:#1332803- Update rpm macros Resolves: rhbz#1380854- Add handling booleans via selinux-policy macros in custom policy spec files. Resolves: rhbz#1380854- Allow openvswitch to load kernel modules Resolves: rhbz#1405479- Allow openvswitch read script state. Resolves: rhbz#1405479- Update ganesha policy Resolves: rhbz#1426554 Resolves: rhbz#1383784 - Allow chronyd to read adjtime Resolves: rhbz#1416015 - Fixes for chrony version 2.2 Resolves: rhbz#1416015 - Add interface virt_rw_stream_sockets_svirt() Resolves: rhbz#1415841 - Label /dev/ss0 as gpfs_device_t Resolves: rhbz#1383784 - Allow staff to rw svirt unix stream sockets. Resolves: rhbz#1415841 - Label /rhev/data-center/mnt as mnt_t Resolves: rhbz#1408275 - Associate sysctl_rpc_t with proc filesystems Resolves: rhbz#1350927 - Add new boolean: domain_can_write_kmsg Resolves: rhbz#1415715- Allow rhsmcertd_t dbus chat with system_cronjob_t Resolves: rhbz#1405341 - Allow openvswitch exec hostname and readinitrc_t files Resolves: rhbz#1405479 - Improve SELinux context for mysql_db_t objects. Resolves: rhbz#1391521 - Allow postfix_postdrop to communicate with postfix_master via pipe. Resolves: rhbz#1379736 - Add radius_use_jit boolean Resolves: rhbz#1426205 - Label /var/lock/subsys/iptables as iptables_lock_t Resolves: rhbz#1405441 - Label /usr/lib64/erlang/erts-5.10.4/bin/epmd as lib_t Resolves: rhbz#1332803 - Allow can_load_kernmodule to load kernel modules. Resolves: rhbz#1423427 Resolves: rhbz#1424621- Allow nfsd_t domain to create sysctls_rpc_t files Resolves: rhbz#1405304 - Allow openvswitch to create netlink generic sockets. Resolves: rhbz#1397974 - Create kernel_create_rpc_sysctls() interface Resolves: rhbz#1405304- Allow nfsd_t domain rw sysctl_rpc_t dirs Resolves: rhbz#1405304 - Allow cgdcbxd_t to manage cgroup files. Resolves: rhbz#1358493 - Allow cmirrord_t domain to create netlink_connector sockets Resolves: rhbz#1412670 - Allow fcoemon to create netlink scsitransport sockets Resolves: rhbz#1362496 - Allow quota_nld_t create netlink_generic sockets Resolves: rhbz#1358679 - Allow cgred_t create netlink_connector sockets Resolves: rhbz#1376357 - Add dhcpd_t domain fowner capability Resolves: rhbz#1358485 - Allow acpid to attempt to connect to the Linux kernel via generic netlink socket. Resolves: rhbz#1358478 - Rename docker module to container module Resolves: rhbz#1386916 - Allow setflies to mount tracefs Resolves: rhbz#1376357 - Allow iptables to read nsfs files. Resolves: rhbz#1411316 - Allow systemd_bootchart_t domain create dgram sockets. Resolves: rhbz#1365953 - Rename docker interfaces to container Resolves: rhbz#1386916- Allow initrc_t domain to run rhel-autorelabel script properly during boot process Resolves: rhbz#1379722 - Allow systemd_initctl_t to create and connect unix_dgram sockets Resolves: rhbz#1365947 - Allow ifconfig_t to mount/unmount nsfs_t filesystem Resolves: rhbz#1349814 - Add interfaces allowing mount/unmount nsfs_t filesystem Resolves: rhbz#1349814- Add interface init_stream_connectto() Resolves:rhbz#1365947 - Allow rhsmcertd domain signull kernel. Resolves: rhbz#1379781 - Allow kdumpgui domain to read nvme device - Allow insmod_t to load kernel modules Resolves: rhbz#1421598 - Add interface files_load_kernel_modules() Resolves: rhbz#1421598 - Add SELinux support for systemd-initctl daemon Resolves:rhbz#1365947 - Add SELinux support for systemd-bootchart Resolves: rhbz#1365953- Allow firewalld to getattr open search read modules_object_t:dir Resolves: rhbz#1418391 - Fix label for nagios plugins in nagios file conxtext file Resolves: rhbz#1277718 - Add sys_ptrace capability to pegasus domain Resolves: rhbz#1381238 - Allow sssd_t domain setpgid Resolves:rhbz#1416780 - After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk. Resolves: rhbz#1350927 - Allow kdumpgui domain to read nvme device Resolves: rhbz#1415084 - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization. Resolves: rhbz#1146987 - Add user namespace capability object classes. Resolves: rhbz#1368057 - Add module_load permission to class system Resolves:rhbz#1368057 - Add the validate_trans access vector to the security class Resolves: rhbz#1368057 - Add "binder" security class and access vectors Resolves: rhbz#1368057 - Allow ifconfig_t domain read nsfs_t Resolves: rhbz#1349814 - Allow ping_t domain to load kernel modules. Resolves: rhbz#1388363- Allow systemd container to read/write usermodehelperstate Resolves: rhbz#1403254 - Label udp ports in range 24007-24027 as gluster_port_t Resolves: rhbz#1404152- Allow glusterd_t to bind on glusterd_port_t udp ports. Resolves: rhbz#1404152 - Revert: Allow glusterd_t to bind on med_tlp port.- Allow glusterd_t to bind on med_tlp port. Resolves: rhbz#1404152 - Update ctdbd_t policy to reflect all changes. Resolves: rhbz#1402451 - Label tcp port 24009 as med_tlp_port_t Resolves: rhbz#1404152 - Issue appears during update directly from RHEL-7.0 to RHEL-7.3 or above. Modules pkcsslotd and vbetools missing in selinux-policy package for RHEL-7.3 which causing warnings during SELinux policy store migration process. Following patch fixes issue by skipping pkcsslotd and vbetools modules migration.- Allow ctdbd_t domain transition to rpcd_t Resolves:rhbz#1402451- Fixes for containers Allow containers to attempt to write to unix_sysctls. Allow cotainers to use the FD's leaked to them from parent processes. Resolves: rhbz#1403254- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t Resolves: rhbz#1404152 - Allow systemd to stop glusterd_t domains. Resolves: rhbz#1400493- Make working CTDB:NFS: CTDB failover from selinux-policy POV Resolves: rhbz#1402451- Add kdump_t domain sys_admin capability Resolves: rhbz#1375963- Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access. Resolves: rhbz#1399250- Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning "Access Denied" errors to DBus clients Resolves: rhbz#1393505- Allow cluster_t communicate to fprintd_t via dbus Resolves: rhbz#1349798- Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package Resolves: rhbz#1392010- Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device. Resolves: rhbz#1384488 - Allow glusterd to get attributes on /sys/kernel/config directory. Resolves: rhbz#1384483- Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros - Add selinux-policy-migrate-local-changes service Resolves: rhbz#1381588- Allow sssd_selinux_manager_t to manage also dir class. Resolves: rhbz#1368097 - Add interface seutil_manage_default_contexts_dirs() Resolves: rhbz#1368097- Add virt_sandbox_use_nfs -> virt_use_nfs boolean substitution. Resolves: rhbz#1355783- Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t Resolves: rhbz#1309883- Allow ftp daemon to manage apache_user_content Resolves: rhbz#1097775 - Label /etc/sysconfig/oracleasm as oracleasm_conf_t Resolves: rhbz#1331383 - Allow oracleasm to rw inherited fixed disk device Resolves: rhbz#1331383 - Allow collectd to connect on unix_stream_socket Resolves: rhbz#1377259- Allow iscsid create netlink iscsid sockets. Resolves: rhbz#1358266 - Improve regexp for power_unit_file_t files. To catch just systemd power unit files. Resolves: rhbz#1375462- Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain. Resolves: rhbz#1331383 - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service Resolves: rhbz#1206525- Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm Resolves: rhbz#1331383 - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t Resolves: rhbz#1206525 - Allow mdadm_t to getattr all device nodes Resolves: rhbz#1365171 - Add interface dbus_dontaudit_stream_connect_system_dbusd() Resolves:rhbz#1052880 - Add virt_stub_* interfaces for docker policy which is no longer a part of our base policy. Resolves: rhbz#1372705 - Allow guest-set-user-passwd to set users password. Resolves: rhbz#1369693 - Allow samdbox domains to use msg class Resolves: rhbz#1372677 - Allow domains using kerberos to read also kerberos config dirs Resolves: rhbz#1368492 - Allow svirt_sandbox_domains to r/w onload sockets Resolves: rhbz#1342930 - Add interface fs_manage_oracleasm() Resolves: rhbz#1331383 - Label /dev/kfd as hsa_device_t Resolves: rhbz#1373488 - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs Resolves: rhbz#1368097 - Add interface to write to nsfs inodes Resolves: rhbz#1372705 - Allow systemd services to use PrivateNetwork feature Resolves: rhbz#1372705 - Add a type and genfscon for nsfs. Resolves: rhbz#1372705 - Allow run sulogin_t in range mls_systemlow-mls_systemhigh. Resolves: rhbz#1290400- Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261 - Fix file context for /etc/pki/pki-tomcat/ca/ - new interface oddjob_mkhomedir_entrypoint() - Move label for /var/lib/docker/vfs/ to proper SELinux module - Allow mdadm to get attributes from all devices. - Label /etc/puppetlabs as puppet_etc_t. - Allow systemd-machined to communicate to lxc container using dbus - Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579 - Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579 - Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579 - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t - Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383- Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t Resolves:rhbz#1366915 - Allow certmonger to manage all systemd unit files Resolves:rhbz#1366915 - Grant certmonger "chown" capability Resolves:rhbz#1366915 - Allow ipa_helper_t stream connect to dirsrv_t domain Resolves: rhbz#1368418 - Update oracleasm SELinux module Resolves: rhbz#1331383 - label /var/lib/kubelet as svirt_sandbox_file_t Resolves: rhbz#1369159 - Add few interfaces to cloudform.if file Resolves: rhbz#1367834 - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module Resolves: rhbz#1347514 - Allow krb5kdc_t to read krb4kdc_conf_t dirs. Resolves: rhbz#1368492 - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run. Resolves: rhbz#1365653 - Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together. Resolves: rhbz#1365653 - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type Resolves: rhbz#1331383 - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init. Resolves: rhbz#1367834 - Allow iptables to creating netlink generic sockets. Resolves: rhbz#1364359- Allow ipmievd domain to create lock files in /var/lock/subsys/ Resolves:rhbz#1349058 - Update policy for ipmievd daemon. Resolves:rhbz#1349058 - Dontaudit hyperkvp to getattr on non security files. Resolves: rhbz#1349356 - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t Resolves: rhbz#1347514 - Fixed lsm SELinux module - Add sys_admin capability to sbd domain Resolves: rhbz#1322725 - Allow vdagent to comunnicate with systemd-logind via dbus Resolves: rhbz#1366731 - Allow lsmd_plugin_t domain to create fixed_disk device. Resolves: rhbz#1238066 - Allow opendnssec domain to create and manage own tmp dirs/files Resolves: rhbz#1366649 - Allow opendnssec domain to read system state Resolves: rhbz#1366649 - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs Resolves: rhbz#1366649 - Allow rasdaemon to mount/unmount tracefs filesystem. Resolves: rhbz#1364380 - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/ Resolves: rhbz#1367520 - Modify interface den_read_nvme() to allow also read nvme_device_t block files. Resolves: rhbz#1362564 - Label /var/run/storaged as lvm_var_run_t. Resolves: rhbz#1264390 - Allow unconfineduser to run ipa_helper_t. Resolves: rhbz#1361636- Dontaudit mock to write to generic certs. Resolves: rhbz#1271209 - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t Resolves: rhbz#1347514 - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain" - Allow modemmanager to write to systemd inhibit pipes Resolves: rhbz#1365214 - Label corosync-qnetd and corosync-qdevice as corosync_t domain Resolves: rhbz#1347514 - Allow ipa_helper to read network state Resolves: rhbz#1361636 - Label oddjob_reqiest as oddjob_exec_t Resolves: rhbz#1361636 - Add interface oddjob_run() Resolves: rhbz#1361636 - Allow modemmanager chat with systemd_logind via dbus Resolves: rhbz#1362273 - Allow NetworkManager chat with puppetagent via dbus Resolves: rhbz#1363989 - Allow NetworkManager chat with kdumpctl via dbus Resolves: rhbz#1363977 - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls. Resolves: rhbz#1322725 - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t Resolves: rhbz#1349058 - Allow rasdaemon to use tracefs filesystem. Resolves: rhbz#1364380 - Fix typo bug in dirsrv policy - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd. Resolves: rhbz#1283134 - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t Resolves: rhbz#1362688 - Allow dirsrv to read dirsrv_share_t content Resolves: rhbz#1363662 - Allow virtlogd_t to append svirt_image_t files. Resolves: rhbz#1358140 - Allow hypervkvp domain to read hugetlbfs dir/files. Resolves: rhbz#1349356 - Allow mdadm daemon to read nvme_device_t blk files Resolves: rhbz#1362564 - Allow selinuxusers and unconfineduser to run oddjob_request Resolves: rhbz#1361636 - Allow sshd server to acces to Crypto Express 4 (CEX4) devices. Resolves: rhbz#1362539 - Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-* changed to /usr/lib/systemd/rhel-*. Resolves: rhbz#1363769 - Fix typo in device interfaces Resolves: rhbz#1349058 - Add interfaces for managing ipmi devices Resolves: rhbz#1349058 - Add interfaces to allow mounting/umounting tracefs filesystem Resolves: rhbz#1364380 - Add interfaces to allow rw tracefs filesystem Resolves: rhbz#1364380 - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices. Resolves: rhbz#1362564 - Label /sys/kernel/debug/tracing filesystem Resolves: rhbz#1364380 - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1357857- Dontaudit mock_build_t can list all ptys. Resolves: rhbz#1271209 - Allow ftpd_t to mamange userhome data without any boolean. Resolves: rhbz#1097775 - Add logrotate permissions for creating netlink selinux sockets. Resolves: rhbz#1283134 - Allow lsmd_plugin_t to exec ldconfig. Resolves: rhbz#1238066 - Allow vnstatd domain to read /sys/class/net/ files Resolves: rhbz#1358243 - Remove duplicate allow rules in spamassassin SELinux module Resolves:rhbz#1358175 - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs Resolves:rhbz#1358175 - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1357857 - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data. Resolves: rhbz#1330464 - Allow gnome-keyring also manage user_tmp_t sockets. Resolves: rhbz#1257057 - corecmd: Remove fcontext for /etc/sysconfig/libvirtd Resolves:rhbz#1351382- Allow ipa_dnskey domain to search cache dirs Resolves: rhbz#1350957- Allow ipa-dnskey read system state. Reasolves: rhbz#1350957 - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file Resolves: rhbz#1350957- Allow firewalld to manage net_conf_t files. Resolves:rhbz#1304723 - Allow logrotate read logs inside containers. Resolves: rhbz#1303514 - Allow sssd to getattr on fs_t Resolves: rhbz#1356082 - Allow opendnssec domain to manage bind chace files Resolves: rhbz#1350957 - Fix typo in rhsmcertd policy module Resolves: rhbz#1329475 - Allow systemd to get status of systemd-logind daemon Resolves: rhbz#1356141 - Label more ndctl devices not just ndctl0 Resolves: rhbz#1355809- Allow rhsmcertd to copy certs into /etc/docker/cert.d - Add interface docker_rw_config() Resolves: rhbz#1344500 - Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t Resolves: rhbz#1355632 - Allow rhsmcertd to read network sysctls Resolves: rhbz#1329475 - Label /var/log/graphite-web dir as httpd_log_t Resolves: rhbz#1310898 - Allow mock to use generic ptys Resolves: rhbz#1271209 - Allow adcli running as sssd_t to write krb5.keytab file. Resolves: rhbz#1356082 - Allow openvswitch connect to openvswitch_port_t type. Resolves: rhbz#1335024 - Add SELinux policy for opendnssec service. Resolves: rhbz#1350957 - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd Resolves: rhbz#1350957 - label /dev/ndctl0 device as nvram_device_t Resolves: rhbz#1355809- Allow lttng tools to block suspending Resolves: rhbz#1256374 - Allow creation of vpnaas in openstack Resolves: rhbz#1352710 - virt: add strict policy for virtlogd daemon Resolves:rhbz#1311606 - Update makefile to support snapperd_contexts file Resolves: rhbz#1352681- Allow udev to manage systemd-hwdb files - Add interface systemd_hwdb_manage_config() Resolves: rhbz#1350756 - Fix paths to infiniband devices. This allows use more then two infiniband interfaces. Resolves: rhbz#1210263- Allow virtual machines to rw infiniband devices. Resolves: rhbz#1210263 - Allow opensm daemon to rw infiniband_mgmt_device_t Resolves: rhbz#1210263 - Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file. Resolves: rhbz#1350756 - Make label for new infiniband_mgmt deivices Resolves: rhbz#1210263- Fix typo in brltty SELinux module - Add new SELinux module sbd Resolves: rhbz#1322725 - Allow pcp dmcache metrics collection Resolves: rhbz#1309883 - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t Resolves: rhbz#1350782 - Allow openvpn to create sock files labeled as openvpn_var_run_t Resolves: rhbz#1328246 - Allow hypervkvp daemon to getattr on all filesystem types. Resolves: rhbz#1349356 - Allow firewalld to create net_conf_t files Resolves: rhbz#1304723 - Allow mock to use lvm Resolves: rhbz#1271209 - Allow keepalived to create netlink generic sockets. Resolves: rhbz#1349809 - Allow mirromanager creating log files in /tmp Resolves:rhbz#1328818 - Rename few modules to make it consistent with source files Resolves: rhbz#1351445 - Allow vmtools_t to transition to rpm_script domain Resolves: rhbz#1342119 - Allow nsd daemon to manage nsd_conf_t dirs and files Resolves: rhbz#1349791 - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t Resolves: rhbz#1346900 - Allow sssd read also sssd_conf_t dirs Resolves: rhbz#1350535 - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl Resolves: rhbz#1086240 - Add interface lvm_getattr_exec_files() Resolves: rhbz#1271209 - Fix typo Compliling vs. Compiling Resolves: rhbz#1351445- Allow krb5kdc_t to communicate with sssd Resolves: rhbz#1319933 - Allow prosody to bind on prosody ports Resolves: rhbz#1304664 - Add dac_override caps for fail2ban-client Resolves: rhbz#1316678 - dontaudit read access for svirt_t on the file /var/db/nscd/group Resolves: rhbz#1301637 - Allow inetd child process to communicate via dbus with systemd-logind Resolves: rhbz#1333726 - Add label for brltty log file Resolves: rhbz#1328818 - Allow dspam to read the passwd file Resolves: rhbz#1286020 - Allow snort_t to communicate with sssd Resolves: rhbz#1284908 - svirt_sandbox_domains need to be able to execmod for badly built libraries. Resolves: rhbz#1206339 - Add policy for lttng-tools package. Resolves: rhbz#1256374 - Make mirrormanager as application domain. Resolves: rhbz#1328234 - Add support for the default lttng-sessiond port - tcp/5345. This port is used by LTTng 2.x central tracing registry session daemon. - Add prosody ports Resolves: rhbz#1304664 - Allow sssd read also sssd_conf_t dirs Resolves: rhbz#1350535- Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs. Resolves:rhbz#1331315 - Label named-pkcs11 binary as named_exec_t. Resolves: rhbz#1331315 - Allow glusterd daemon to get systemd status Resolves: rhbz#1321785 - Allow logrotate dbus-chat with system_logind daemon Resolves: rhbz#1283134 - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files Resolves: rhbz#1336211 - Add interface cron_read_pid_files() Resolves: rhbz#1336211 - Allow pcp_pmlogger to create unix dgram sockets Resolves: rhbz#1336211 - Add hwloc-dump-hwdata SELinux policy Resolves: rhbz#1344054 - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t. Resolves: rhbz#1121171 - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd() Resolves: rhbz#1259764 - Create label for openhpid log files. esolves: rhbz#1259764 - Label /var/lib/ganglia as httpd_var_lib_t Resolves: rhbz#1260536 - Allow firewalld_t to create entries in net_conf_t dirs. Resolves: rhbz#1304723 - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals Resolves: rhbz#1288255 - Include patch from distgit repo: policy-RHEL-7.1-flask.patch. Resolves: rhbz#1329560 - Update refpolicy to handle hwloc Resolves: rhbz#1344054 - Label /etc/dhcp/scripts dir as bin_t - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals. Resolves: rhbz#1288255- Allow firewalld_t to create entries in net_conf_t dirs. Resolves: rhbz#1304723 - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals Resolves: rhbz#1288255 - Allow mongod log to syslog. Resolves: rhbz#1306995 - Allow rhsmcertd connect to port tcp 9090 Resolves: rhbz#1337319 - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove. Resolves: rhbz#1262483 Resolves: rhbz#1277506 - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t. Resolves: rhbz#1301516 - Add new boolean spamd_update_can_network. Resolves: rhbz#1305469 - Allow rhsmcertd connect to tcp netport_port_t Resolves: rhbz#1329475 - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t. Resolves: rhbz#1328234 - Allow prosody to bind to fac_restore tcp port. Resolves: rhbz#1321787 - Allow ninfod to read raw packets Resolves: rhbz#1317964 - Allow pegasus get attributes from qemu binary files. Resolves: rhbz#1260835 - Allow pegasus get attributes from qemu binary files. Resolves: rhbz#1271159 - Allow tuned to use policykit. This change is required by cockpit. Resolves: rhbz#1346464 - Allow conman_t to read dir with conman_unconfined_script_t binary files. Resolves: rhbz#1297323 - Allow pegasus to read /proc/sysinfo. Resolves: rhbz#1265883 - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals. Resolves: rhbz#1288255 - Label tcp ports:16379, 26379 as redis_port_t Resolves: rhbz#1348471 - Allow systemd to relabel /var and /var/lib directories during boot. - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces. - Add files_relabelto_var_lib_dirs() interface. - Label tcp port 2004 as mailbox_port_t. Resolves: rhbz#1332843 - Label tcp and udp port 5582 as fac_restore_port_t Resolves: rhbz#1321787 - Allow sysadm_t user to run postgresql-setup. Resolves: rhbz#1282543 - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script. Resolves: rhbz#1297480 - Update netlink socket classes.- Allow conman to kill conman_unconfined_script. Resolves: rhbz#1297323 - Make conman_unconfined_script_t as init_system_domain. Resolves:rhbz#1297323 - Allow init dbus chat with apmd. Resolves:rhbz#995898 - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t. Resolves: rhbz#1233252 - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Add mediawiki rules to proper scope Resolves: rhbz#1301186 - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Allow mysqld_safe to inherit rlimit information from mysqld Resolves: rhbz#1323673 - Allow collectd_t to stream connect to postgresql. Resolves: rhbz#1344056 - Allow mediawiki-script to read /etc/passwd file. Resolves: rhbz#1301186 - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc. Resolves: rhbz#1344505 - Add labels for mediawiki123 Resolves: rhbz#1293872 - Fix label for all fence_scsi_check scripts - Allow ip netns to mounton root fs and unmount proc_t fs. Resolves: rhbz#1343776 Resolves: rhbz#1286851 - Allow sysadm_t to run newaliases command. Resolves: rhbz#1344828 - Add interface sysnet_filetrans_named_net_conf() Resolves: rhbz#1344505- Fix several issues related to the SELinux Userspace changes- Allow glusterd domain read krb5_keytab_t files. Resolves: rhbz#1343929 - Fix typo in files_setattr_non_security_dirs. Resolves: rhbz#1115987- Allow tmpreaper_t to read/setattr all non_security_file_type dirs Resolves: rhbz#1115987 - Allow firewalld to create firewalld_var_run_t directory. Resolves: rhbz#1304723 - Add interface firewalld_read_pid_files() Resolves: rhbz#1304723 - Label /usr/libexec/rpm-ostreed as rpm_exec_t. Resolves: rhbz#1340542 - Allow sanlock service to read/write cephfs_t files. Resolves: rhbz#1315332 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added missing docker interfaces: - docker_typebounds - docker_entrypoint Resolves: rhbz#1236580 - Add interface files_setattr_non_security_dirs() Resolves: rhbz#1115987 - Add support for onloadfs - Allow iptables to read firewalld pid files. Resolves: rhbz#1304723 - Add SELinux support for ceph filesystem. Resolves: rhbz#1315332 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) Resolves: rhbz#1236580- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added missing docker interfaces: - docker_typebounds - docker_entrypoint Resolves: rhbz#1236580 - New interfaces needed for systemd-machinectl Resolves: rhbz#1236580 - New interfaces needed by systemd-machine Resolves: rhbz#1236580 - Add interface allowing sending and receiving messages from virt over dbus. Resolves: rhbz#1236580 - Backport docker policy from Fedora. Related: #1303123 Resolves: #1341257 - Allow NetworkManager_t and policykit_t read access to systemd-machined pid files. Resolves: rhbz#1236580 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added interfaces needed by new docker policy. Related: rhbz#1303123 - Add support for systemd-machined daemon Resolves: rhbz#1236580 - Allow rpm-ostree domain transition to install_t domain from init_t. Resolves: rhbz#1340542- dnsmasq: allow NetworkManager to control dnsmasq via D-Bus Resolves: rhbz#1336722 - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te Resolves: rhbz#1333198 - sftpd_* booleans are functionless these days. Resolves: rhbz#1335656 - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t. Resolves: rhbz#1335828 - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus. Resolves: rhbz#1336760 - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t. Resolves: rhbz#1336737 - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain. Resolves: rhbz#1264390 - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t. Resolves: rhbz#1337061 - Revert "Allow all domains some process flags." Resolves: rhbz#1303644 - Revert "Remove setrlimit to all domains." Resolves: rhbz#1303644 - Label /usr/sbin/xrdp* files as bin_t Resolves: rhbz#1276777 - Add mls support for some db classes Resolves: rhbz#1303651 - Allow systemd_resolved_t to check if ipv6 is disabled. Resolves: rhbz#1236579 - Allow systemd_resolved to read systemd_networkd run files. Resolves: rhbz#1236579- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus. Resolves: rhbz#1336760 - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t. Resolves: rhbz#1336737- Allow logwatch to domtrans to postqueue Resolves: rhbz#1331542 - Label /var/log/ganesha.log as gluster_log_t - Allow glusterd_t domain to create glusterd_log_t files. - Label /var/run/ganesha.pid as gluster_var_run_t. Resolves: rhbz#1335828 - Allow zabbix to connect to postgresql port Resolves: rhbz#1330479 - Add userdom_destroy_unpriv_user_shared_mem() interface. Related: rhbz#1306403 - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments. Resolves: rhbz#1306403- We need to restore contexts on /etc/passwd*,/etc/group*,/etc/*shadow* during install phase to get proper labeling for these files until selinux-policy pkgs are installed. Resolves: rhbz#1333952- Add interface glusterd_dontaudit_read_lib_dirs() Resolves: rhbz#1295680 - Dontaudit Occasionally observing AVC's while running geo-rep automation Resolves: rhbz#1295680 - Allow glusterd to manage socket files labeled as glusterd_brick_t. Resolves: rhbz#1331561 - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content Resolves: rhbz#1246522 - Allow stunnel create log files. Resolves: rhbz#1296851 - Label tcp port 8181 as intermapper_port_t. Resolves: rhbz#1334783 - Label tcp/udp port 2024 as xinuexpansion4_port_t Resolves: rhbz#1334783 - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t Resolves: rhbz#1334783 - Dontaudit ldconfig read gluster lib files. Resolves: rhbz#1295680 - Add interface auth_use_nsswitch() to systemd_domain_template. Resolves: rhbz#1236579- Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs. Resolves: rhbz#1312809 Resolves: rhbz#1323947 - Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144 - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t. Resolves: rhbz#1324144 - Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports. Resolves: rhbz#1324144 - Allow prosody to listen on port 5000 for mod_proxy65. Resolves: rhbz#1316918 - Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled. Resolves: rhbz#1309454- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs. Resolves: rhbz#1319442 - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap. Resolves: rhbz#1296640 - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits. Resolves: rhbz#1097775 - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution. If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t. Resolves: rhbz#1262483 - Allow nsd daemon to create log file in /var/log as nsd_log_t Resolves: rhbz#1293140 - Sanlock policy update. - New sub-domain for sanlk-reset daemon Resolves: rhbz#1212324 - Label all run tgtd files, not just socket files Resolves: rhbz#1280280 - Label all run tgtd files, not just socket files. Resolves: rhbz#1280280 - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody. Resolves: rhbz#1321049 - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets. Resolves: rhbz#1318224 - Allow prosody to listen on port 5000 for mod_proxy65. Resolves: rhbz#1316918 - Allow targetd to read/write to /dev/mapper/control device. Resolves: rhbz#1063714 - Allow KDM to get status about power services. This change allow kdm to be able do shutdown. Resolves: rhbz#1316724 - Allow systemd-resolved daemon creating netlink_route sockets. Resolves:rhbz#1236579 - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used Resolves: rhbz#1065362 - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t Resolves: rhbz#1321943 - Label all nvidia binaries as xserver_exec_t Resolves: rhbz#1322283- Create new permissivedomains CIL module and make it active. Resolves: rhbz#1320451 - Add support for new mock location - /usr/libexec/mock/mock. Resolves: rhbz#1271209 - Allow bitlee to create bitlee_var_t dirs. Resolves: rhbz#1268651 - Allow CIM provider to read sssd public files. Resolves: rhbz#1263339 - Fix some broken interfaces in distro policy. Resolves: rhbz#1121171 - Allow power button to shutdown the laptop. Resolves: rhbz#995898 - Allow lsm plugins to create named fixed disks. Resolves: rhbz#1238066 - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777 - Allow hyperv domains to rw hyperv devices. Resolves: rhbz#1309361 - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780 - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/ Resolves: rhbz#1297323 - Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib. - Add support for /dev/mptctl device used to check RAID status. Resolves: rhbz#1258029 - Create hyperv* devices and create rw interfaces for this devices. Resolves: rhbz#1309361 - Add fixes for selinux userspace moving the policy store to /var/lib/selinux. - Remove optional else block for dhcp ping- Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks. Resolves: rhbz#1263770 - Fix context of "/usr/share/nginx/html". Resolves: rhbz#1261857 - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics Resolves: rhbz#1270344 - Allow pmlogger to create pmlogger.primary.socket link file. Resolves: rhbz#1270344 - Label nagios scripts as httpd_sys_script_exec_t. Resolves: rhbz#1260306 - Add dontaudit interface for kdumpctl_tmp_t Resolves: rhbz#1156442 - Allow mdadm read files in EFI partition. Resolves: rhbz#1291801 - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid. Resolves: rhbz#1293140 - Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs Resolves: rhbz#1293140 - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface. Resolves: rhbz#1265102 - Add missing labeling for /usr/libexec/abrt-hook-ccpp. Resolves: rhbz#1213409 - Allow pcp_pmie and pcp_pmlogger to read all domains state. Resolves: rhbz#1206525 - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port. Resolves: rhbz#1275246 - cockpit has grown content in /var/run directory Resolves: rhbz#1279429 - Allow collectd setgid capability Resolves:#1310898 - Remove declaration of empty booleans in virt policy. Resolves: rhbz#1103153 - Fix typo in drbd policy - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp. Resolves: rhbz#1134883 - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files. Resolves: rhbz#1293788 - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern. Resolves: rhbz#1254188 - Allow abrt_t to read sysctl_net_t files. Resolves: rhbz#1254188 - The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system. - Allow abrt-hook-ccpp to getattr on all executables. - Allow setuid/setgid capabilities for abrt-hook-ccpp. Resolves: rhbz#1254188 - abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling. Resolves: rhbz#1254188 - Allow abrt-hook-ccpp to change SELinux user identity for created objects. Resolves: rhbz#1254188 - Dontaudit write access to inherited kdumpctl tmp files. Resolves: rbhz#1156442 - Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables) Resolves: rhbz#1291801 - Label 8952 tcp port as nsd_control. Resolves: rhbz#1293140 - Allow ipsec to use pam. Resolves: rhbz#1315700 - Allow to log out to gdm after screen was resized in session via vdagent. Resolves: rhbz#1249020 - Allow setrans daemon to read /proc/meminfo. Resolves: rhbz#1316804 - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg Resolves: rhbz#1298151 - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution Resolves: rhbz#1236579 - Add new selinux policy for systemd-resolved dawmon. Resolves: rhbz#1236579 - Add interface ssh_getattr_server_keys() interface. Resolves: rhbz#1306197 - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106 Resolves: rhbz#1306197 - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used. Resolves: rhbz#1309417 - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t. Resolves: rhbz#1293788- Prepare selinux-policy package for userspace release 2016-02-23. Resolves: rhbz#1305982- Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902 - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols. Resolves: rhbz#1242506 - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba. Resolves: rhbz#1284972 - Add support for systemd-hwdb daemon. Resolves: rhbz#1257940 - Add interface fs_setattr_cifs_dirs(). Resolves: rhbz#1284972- Add new SELinux policy fo targetd daemon. Resolves: rhbz#1063714 - Add new SELinux policy fo ipmievd daemon. Resolves: rhbz#1083031 - Add new SELinux policy fo hsqldb daemon. Resolves: rhbz#1083171 - Add new SELinux policy for blkmapd daemon. Resolves: rhbz#1072997 - Allow p11-child to connect to apache ports. - Label /usr/sbin/lvmlockd binary file as lvm_exec_t. Resolves: rhbz#1278028 - Add interface "lvm_manage_lock" to lvm policy. Resolves: rhbz#1063714- Allow openvswitch domain capability sys_rawio. Resolves: rhbz#1278495- Allow openvswitch to manage hugetlfs files and dirs. Resolves: rhbz#1278495 - Add fs_manage_hugetlbfs_files() interface. Resolves: rhbz#1278495- Allow smbcontrol domain to send sigchld to ctdbd domain. Resolves: #1293784 - Allow openvswitch read/write hugetlb filesystem. Resolves: #1278495Allow hypervvssd to list all mountpoints to have VSS live backup working correctly. Resolves:#1247880- Revert Add missing labeling for /usr/libexec/abrt-hook-ccpp patch Resolves: #1254188- Allow search dirs in sysfs types in kernel_read_security_state. Resolves: #1254188 - Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs. Resolves: #1254188- Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs Resolves: #1254188 - We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes. Resolves:#1261938- Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t. - Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions. Resolves:#1266928- We need to require sandbox_web_type attribute in sandbox_x_domain_template(). Resolves: #1261938 - ipsec: The NM helper needs to read the SAs Resolves: #1259786 - ipsec: Allow ipsec management to create ptys Resolves: #1259786- Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type. Resolves:#1261938 - Allow abrt_t domain to write to kernel msg device. Resolves: #1257828 - Allow rpcbind_t domain to change file owner and group Resolves: #1265266- Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. Resolves: #1256459- Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it. Resolves: #1230300 - Allow qpid daemon to connect on amqp tcp port. Resolves: #1261805- Label /etc/ipa/nssdb dir as cert_t Resolves:#1262718 - Do not provide docker policy files which is shipped by docker-selinux.rpm Resolves:#1262812- Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager Resolves: #1192338 - Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem. Resolves: #1238079 - Allow rhsmcertd_t send signull to unconfined_service_t domains. Resolves: #1176078 - Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t. - Allow openhpid_t daemon to manage snmp files and dirs. Resolves: #1243902 - Allow mdadm_t domain read/write to general ptys and unallocated ttys. Resolves: #1073314 - Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t Resolves: #1176078- Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. Resolves:#1250456- Fix labeling for fence_scsi_check script Resolves: #1255020 - Allow openhpid to read system state Allow openhpid to connect to tcp http port. Resolves: #1244248 - Allow openhpid to read snmp var lib files. Resolves: #1243902 - Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe - Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t Resolves: #1243403 - Remove bin_t label for /usr/share/cluster/fence_scsi_check\.pl Resolves: #1255020- Fix regexp in chronyd.fc file Resolves: #1243764 - Allow passenger to getattr filesystem xattr Resolves: #1196555 - Label mdadm.conf.anackbak as mdadm_conf_t file. Resolves: #1088904 - Revert "Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc." - Allow watchdog execute fenced python script. Resolves: #1255020 - Added inferface watchdog_unconfined_exec_read_lnk_files() - Remove labeling for /var/db/.*\.db as etc_t to label db files as system_db_t. Resolves: #1230877- Allow watchdog execute fenced python script. Resolves: #1255020 - Added inferface watchdog_unconfined_exec_read_lnk_files() - Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764 - Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764- Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file. Resolves: #1252442- Allow exec pidof under hypervkvp domain. Resolves: #1254870 - Allow hypervkvp daemon create connection to the system DBUS Resolves: #1254870- Allow openhpid_t to read system state. Resolves: #1244248 - Added labels for files provided by rh-nginx18 collection Resolves: #1249945 - Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db. Resolves: #1252968 - Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution. Resolves: #1243431 - Allow abrt_dump_oops_t to read proc_security_t files. - Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains - Add interface abrt_dump_oops_domtrans() - Add mountpoint dontaudit access check in rhsmcertd policy. Resolves: #1243431 - Allow samba_net_t to manage samba_var_t sock files. Resolves: #1252937 - Allow chrome setcap to itself. Resolves: #1251996 - Allow httpd daemon to manage httpd_var_lib_t lnk_files. Resolves: #1253706 - Allow chronyd exec systemctl Resolves: #1243764 - Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t. Resolves: #1243764 - Added interface fs_dontaudit_write_configfs_dirs - Add label for kernel module dep files in /usr/lib/modules Resolves:#916635 - Allow kernel_t domtrans to abrt_dump_oops_t - Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override. - Allow systemd-networkd to send logs to systemd-journald. Resolves: #1236616- Fix label on /var/tmp/kiprop_0 Resolves:#1220763 - Allow lldpad_t to getattr tmpfs_t. Resolves: #1246220 - Label /dev/shm/lldpad.* as lldapd_tmpfs_t Resolves: #1246220 - Allow audisp client to read system state.- Allow pcp_domain to manage pcp_var_lib_t lnk_files. Resolves: #1252341 - Label /var/run/xtables.* as iptables_var_run_t Resolves: #1243403- Add interface to read/write watchdog device - Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde Resolves:#1210237 - Allow apcupsd_t to read /sys/devices Resolves:#1189185 - Allow logrotate to reload services. Resolves: #1242453 - Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device) Resolves: #1244260 - Allow openhpid liboa_soap plugin to read generic certs. Resolves: #1244248 - Allow openhpid liboa_soap plugin to read resolv.conf file. Resolves: #1244248 - Label /usr/libexec/chrony-helper as chronyd_exec_t - Allow chronyd_t to read dhcpc state. - Allow chronyd to execute mkdir command.- Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t. Resolves:#1073314 - Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if 'dracut -fv' is executed in MLS. - Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if 'dracut -vf' is executed. We allow it for other SELinux users. - Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode. - Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling. Resolves:#1183503 - Add support for /etc/sanlock which is writable by sanlock daemon. Resolves:#1231377 - Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet. Resolves:#1243775 - Allow snapperd to pass data (one way only) via pipe negotiated over dbus Resolves:#1250550 - Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.- Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files). Resolves: #1243902 - Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device Resolves: #1238079 - Allow lsm_plugin_t to rw raw_fixed_disk. Resolves:#1238079 - Allow rhsmcertd to send signull to unconfined_service.- Allow httpd_suexec_t to read and write Apache stream sockets Resolves: #1243569 - Allow qpid to create lnk_files in qpid_var_lib_t Resolves: #1247279- Allow drbd to get attributes from filesystems. - Allow redis to read kernel parameters. Resolves: #1209518 - Allow virt_qemu_ga_t domtrans to passwd_t - Allow audisp_remote_t to start power unit files domain to allow halt system. Resolves: #1186780 - Allow audisp_remote_t to read/write user domain pty. Resolves: #1186780 - Label /usr/sbin/chpasswd as passwd_exec_t. - Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds). Resolves:#1221121- gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te - Allow pcp_pmcd daemon to read postfix config files. - Allow pcp_pmcd daemon to search postfix spool dirs. Resolves: #1213740 - Added Booleans: pcp_read_generic_logs. Resolves: #1213740 - Allow drbd to read configuration options used when loading modules. Resolves: #1134883 - Allow glusterd to manage nfsd and rpcd services. - Allow glusterd to communicate with cluster domains over stream socket. - glusterd call pcs utility which calls find for cib.* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.- Allow glusterd to manage nfsd and rpcd services. - Allow networkmanager to communicate via dbus with systemd_hostanmed. Resolves: #1234954 - Allow stream connect logrotate to prosody. - Add prosody_stream_connect() interface. - httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t. - Allow prosody to create own tmp files/dirs. Resolves:#1212498- Allow networkmanager read rfcomm port. Resolves:#1212498 - Remove non exists label. - Fix *_admin intefaces where body is not consistent with header. - Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config - Remove non exits nfsd_ro_t label. - Make all interfaces related to openshift_cache_t as deprecated. - Add rpm_var_run_t label to rpm_admin header - Add jabberd_lock_t label to jabberd_admin header. - Add samba_unconfined_script_exec_t to samba_admin header. - inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t - Fix ctdb policy - Add samba_signull_winbind() - Add samba_signull_unconfined_net() - Allow ctdbd_t send signull to samba_unconfined_net_t. - Allow openshift_initrc_t to communicate with firewalld over dbus Resolves:#1221326- Allow gluster to connect to all ports. It is required by random services executed by gluster. - Add interfaces winbind_signull(), samba_unconfined_net_signull(). - Dontaudit smbd_t block_suspend capability. This is kernel bug. - Allow ctdbd sending signull to process winbind, samba_unconfined_net, to checking if processes exists. - Add tmpreaper booleans to use nfs_t and samba_share_t. - Fix path from /usr/sbin/redis-server to /usr/bin/redis-server - Allow connect ypserv to portmap_port_t - Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files - Add support for openstack-nova-* packages - Allow NetworkManager_t send signull to dnssec_trigger_t. - Allow glusterd to execute showmount in the showmount domain. - Label swift-container-reconciler binary as swift_t. - Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files. - Add cobbler_var_lib_t to "/var/lib/tftpboot/boot(/.*)?" Resolves:#1213540 - Merge all nova_* labels under one nova_t.- Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins Resolves:#1233550 - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/ - Add support for oddjob based helper in FreeIPA. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add nagios_domtrans_unconfined_plugins() interface. - Update mta_filetrans_named_content() interface to cover more db files. Resolves:#1167468 - Add back ftpd_use_passive_mode boolean with fixed description. - Allow pmcd daemon stream connect to mysqld. - Allow pcp domains to connect to own process using unix_stream_socket. Resolves:#1213709 - Allow abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add support for oddjob based helper in FreeIPA. - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/- Allow iptables to read ctdbd lib files. Resolves:#1224879 - Add systemd_networkd_t to nsswitch domains. - Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization. Resolves:#1130675 - Allow NetworkManager write to sysfs. - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission. - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types. - Allow NetworkManager write to sysfs. - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. - Dontaudit apache to manage snmpd_var_lib_t files/dirs. - Add interface snmp_dontaudit_manage_snmp_var_lib_files(). - Dontaudit mozilla_plugin_t cap. sys_ptrace. - Rename xodbc-connect port to xodbc_connect - Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports. - Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot. - Dontaudit chrome to read passwd file. - nrpe needs kill capability to make gluster moniterd nodes working. Resolves:#1235587- We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem. - Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so. - Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password. - Label gluster python hooks also as bin_t. - Allow glusterd to interact with gluster tools running in a user domain - Add glusterd_manage_lib_files() interface. - ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid. - Allow samba_t net_admin capability to make CIFS mount working. - S30samba-start gluster hooks wants to search audit logs. Dontaudit it. Resolves:#1224879- Allow glusterd to send generic signals to systemd_passwd_agent processes. - Allow glusterd to access init scripts/units without defined policy - Allow glusterd to run init scripts. - Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain. Resolves:#1224879- Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block. - Allow samba-net to access /var/lib/ctdbd dirs/files. - Allow glusterd to send a signal to smbd. - Make ctdbd as home manager to access also FUSE. - Allow glusterd to use geo-replication gluster tool. - Allow glusterd to execute ssh-keygen. - Allow glusterd to interact with cluster services. - Allow glusterd to connect to the system DBUS for service (acquire_svc). - Label /dev/log correctly. Resolves:#1230932- Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs - Add cgdcbxd policy Resolves:#1072493 - Fix ftp_homedir boolean Resolve:#1097775 - Dontaudit ifconfig writing inhertited /var/log/pluto.log. - Allow cluster domain to dbus chat with systemd-logind. Resolves:#1145215 - Dontaudit write access to inherited kdumpctl tmp files Resolves:#1156442 - Allow isnsd_t to communicate with sssd Resolves:#1167702 - Allow rwho_t to communicate with sssd Resolves:#1167718 - Allow sblim_gatherd_t to communicate with sssd Resolves:#1167732 - Allow pkcs_slotd_t to communicate with sssd Resolves:#1167737 - Allow openvswitch_t to communicate with sssd Resolves:#1167816 - Allow mysqld_safe_t to communicate with sssd Resolves:#1167832 - Allow sshd_keygen_t to communicate with sssd Resolves:#1167840 - Add support for iprdbg logging files in /var/log. Resolves:#1174363 - Allow tmpreaper_t to manage ntp log content Resolves:#1176965 - Allow gssd_t to manage ssh keyring Resolves:#1184791 - Allow httpd_sys_script_t to send system log messages Resolves:#1185231 - Allow apcupsd_t to read /sys/devices Resolves:#1189185 - Allow dovecot_t sys_resource capability Resolves:#1191143 - Add support for mongod/mongos systemd unit files. Resolves:#1197038 - Add bacula fixes - Added label mysqld_etc_t for /etc/my.cnf.d/ dir. Resolves:#1203991- Label /usr/libexec/postgresql-ctl as postgresql_exec_t. - Add more restriction on entrypoint for unconfined domains. - Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface - Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default. - Update policy/mls for sockets related to access perm. Rules were contradictory. - Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow r un sudo from NRPE utils scripts and allow run nagios in conjunction w ith PNP4Nagios. Resolves:#1201054 - Don't use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead. - Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type - Label /var/lib/tftpboot/aarch64(/.*)? and /var/lib/tftpboot/images2(/.*)? - Add support for iprdbg logging files in /var/log. - Add fixes to rhsmcertd_t - Allow puppetagent_t to transfer firewalld messages over dbus - Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script. - Added label mysqld_etc_t for /etc/my.cnf.d/ dir. - Add support for mongod/mongos systemd unit files. - cloudinit and rhsmcertd need to communicate with dbus - Allow dovecot_t sys_resource capability- ALlow mongod execmem by default. - Update policy/mls for sockets. Rules were contradictory. Resolves:#1207133 - Allow a user to login with different security level via ssh.- Update seutil_manage_config() interface. Resolves:#1185962 - Allow pki-tomcat relabel pki_tomcat_etc_rw_t. - Turn on docker_transition_unconfined by default- Allow virtd to list all mountpoints. Resolves:#1180713- pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t. - Allow fowner capability for sssd because of selinux_child handling. - ALlow bind to read/write inherited ipsec pipes - Allow hypervkvp to read /dev/urandom and read addition states/config files. - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd. - Add glusterd_filetrans_named_pid() interface - Allow radiusd to connect to radsec ports. - Allow setuid/setgid for selinux_child - Allow lsmd plugin to connect to tcp/5988 by default. - Allow lsmd plugin to connect to tcp/5989 by default. - Update ipsec_manage_pid() interface. Resolves:#1184978- Update ipsec_manage_pid() interface. Resolves:#1184978- Allow ntlm_auth running in winbind_helper_t to access /dev/urandom.- Add auditing support for ipsec. Resolves:#1182524 - Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t - Allow netutils chown capability to make tcpdump working with -w- Allow ipsec to execute _updown.netkey script to run unbound-control. - Allow neutron to read rpm DB. - Add additional fixes for hyperkvp * creates new ifcfg-{name} file * Runs hv_set_ifconfig.sh, which does the following * Copies ifcfg-{name} to /etc/sysconfig/network-scripts - Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t - Add labeling for pacemaker.log. - Allow radius to connect/bind radsec ports. - Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log - Allow virt_qemu_ga to dbus chat with rpm. - Update virt_read_content() interface to allow read also char devices. - Allow glance-registry to connect to keystone port. Resolves:#1181818- Allow sssd to send dbus all user domains. Resolves:#1172291 - Allow lsm plugin to read certificates. - Fix labeling for keystone CGI scripts. - Make snapperd back as unconfined domain.- Fix bugs in interfaces discovered by sepolicy. - Allow slapd to read /usr/share/cracklib/pw_dict.hwm. - Allow lsm plugins to connect to tcp/18700 by default. - Allow brltty mknod capability to allow create /var/run/brltty/vcsa. - Fix pcp_domain_template() interface. - Fix conman.te. - Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc - Allow glance-scrubber to connect tcp/9191. - Add missing setuid capability for sblim-sfcbd. - Allow pegasus ioctl() on providers. - Add conman_can_network. - Allow chronyd to read chrony conf files located in /run/timemaster/. - Allow radius to bind on tcp/1813 port. - dontaudit block suspend access for openvpn_t - Allow conman to create files/dirs in /tmp. - Update xserver_rw_xdm_keys() interface to have 'setattr'. Resolves:#1172291 - Allow sulogin to read /dev/urandom and /dev/random. - Update radius port definition to have also tcp/18121 - Label prandom as random_device_t. - Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.- Allow virt_qemu_ga_t to execute kmod. - Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean. - Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs. Resolves:#1113725 - Enable OpenStack cinder policy - Add support for /usr/share/vdsm/daemonAdapter - Add support for /var/run/gluster- Remove old pkcsslotd.pp from minimum package - Allow rlogind to use also rlogin ports. - Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t. - Allow bacula to connect also to postgresql. - Label /usr/libexec/tomcat/server as tomcat_exec_t - Add support for /usr/sbin/ctdbd_wrapper - Add support for /usr/libexec/ppc64-diag/rtas_errd - Allow rpm_script_roles to access system_mail_t - Allow brltty to create /var/run/brltty - Allow lsmd plugin to access netlink_route_socket - Allow smbcontrol to read passwd - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it Resolves:#1140106 - Allow osad to execute rhn_check - Allow load_policy to rw inherited sssd pipes because of selinux_child - Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS - Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly - Add additional booleans substitions- Add seutil_dontaudit_access_check_semanage_module_store() interface Resolves:#1140106 - Update to have all _systemctl() interface also init_reload_services(). - Dontaudit access check on SELinux module store for sssd. - Add labeling for /sbin/iw. - Allow named_filetrans_domain to create ibus directory with correct labeling.- Allow radius to bind tcp/1812 radius port. - Dontaudit list user_tmp files for system_mail_t. - Label virt-who as virtd_exec_t. - Allow rhsmcertd to send a null signal to virt-who running as virtd_t. - Add missing alias for _content_rw_t. Resolves:#1089177 - Allow spamd to access razor-agent.log. - Add fixes for sfcb from libvirt-cim TestOnly bug. - Allow NetworkManager stream connect on openvpn. - Make /usr/bin/vncserver running as unconfined_service_t. - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain. - Label /etc/docker/certs.d as cert_t.- Label /etc/strongimcv as ipsec_conf_file_t. - Add support for /usr/bin/start-puppet-ca helper script Resolves:#1160727 - Allow rpm scripts to enable/disable transient systemd units. Resolves:#1154613 - Make kpropdas nsswitch domain Resolves:#1153561 - Make all glance domain as nsswitch domains Resolves:#1113281 - Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active - Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t Resolves:#1140106- Dontaudit access check on setfiles/load_policy for sssd_t. Resolves:#1140106 - Add kdump_rw_inherited_kdumpctl_tmp_pipes() Resolves:#1156442 - Make linuxptp services as unconfined. - Added new policy linuxptp. Resolves:#1149693 - Label keystone cgi files as keystone_cgi_script_exec_t. Resolves:#1138424 - Make tuned as unconfined domain- Allow guest to connect to libvirt using unix_stream_socket. - Allow all bus client domains to dbus chat with unconfined_service_t. - Allow inetd service without own policy to run in inetd_child_t which is unconfined domain. - Make opensm as nsswitch domain to make it working with sssd. - Allow brctl to read meminfo. - Allow winbind-helper to execute ntlm_auth in the caller domain. Resolves:#1160339 - Make plymouthd as nsswitch domain to make it working with sssd. Resolves:#1160196 - Make drbd as nsswitch domain to make it working with sssd. - Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working. - Add support for /var/lib/sntp directory. - Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc - Allow winbind to read usermodehelper - Allow telepathy domains to execute shells and bin_t - Allow gpgdomains to create netlink_kobject_uevent_sockets - Allow mongodb to bind to the mongo port and mongos to run as mongod_t - Allow abrt to read software raid state. - Allow nslcd to execute netstat. - Allow dovecot to create user's home directory when they log into IMAP. - Allow login domains to create kernel keyring with different level.- Allow modemmanger to connectto itself Resolves:#1120152 - Allow pki_tomcat to create link files in /var/lib/pki-ca. Resolves:#1121744 - varnishd needs to have fsetid capability Resolves:#1125165 - Allow snapperd to dbus chat with system cron jobs. Resolves:#1152447 - Allow dovecot to create user's home directory when they log into IMAP Resolves:#1152773 - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t. - ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. - Allow nslcd to execute netstat. - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability. - Allow nslcd to read /dev/urandom.- Add back kill permisiion for system class Resolves:#1150011- Add back kill permisiion for service class Resolves:#1150011 - Make rhsmcertd_t also as dbus domain. - Allow named to create DNS_25 with correct labeling. - Add cloudform_dontaudit_write_cloud_log() - Call auth_use_nsswitch to apache to read/write cloud-init keys. - Allow cloud-init to dbus chat with certmonger. - Fix path to mon_statd_initrc_t script. - Allow all RHCS services to read system state. - Allow dnssec_trigger_t to execute unbound-control in own domain. - kernel_read_system_state needs to be called with type. Moved it to antivirus.if. - Added policy for mon_statd and mon_procd services. BZ (1077821) - Allow opensm_t to read/write /dev/infiniband/umad1. - Allow mongodb to manage own log files. - Allow neutron connections to system dbus. - Add support for /var/lib/swiftdirectory. - Allow nova-scheduler to read certs. - Allow openvpn to access /sys/fs/cgroup dir. - Allow openvpn to execute systemd-passwd-agent in systemd_passwd_agent_t to make openvpn working with systemd. - Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files. - Add auth_use_nsswitch for portreserve to make it working with sssd. - automount policy is non-base module so it needs to be called in optional block. - ALlow sensord to getattr on sysfs. - Label /usr/share/corosync/corosync as cluster_exec_t. - Allow lmsd_plugin to read passwd file. BZ(1093733) - Allow read antivirus domain all kernel sysctls. - Allow mandb to getattr on file systems - Allow nova-console to connect to mem_cache port. - Make sosreport as unconfined domain. - Allow mondogdb to 'accept' accesses on the tcp_socket port. - ALlow sanlock to send a signal to virtd_t.- Build also MLS policy Resolves:#1138424- Add back kill permisiion for system class - Allow iptables read fail2ban logs. - Fix radius labeled ports - Add userdom_manage_user_tmpfs_files interface - Allow libreswan to connect to VPN via NM-libreswan. - Label 4101 tcp port as brlp port - fix dev_getattr_generic_usb_dev interface - Allow all domains to read fonts - Make sure /run/systemd/generator and system is labeled correctly on creation. - Dontaudit aicuu to search home config dir. - Make keystone_cgi_script_t domain. Resolves:#1138424 - Fix bug in drbd policy, - Added support for cpuplug. - ALlow sanlock_t to read sysfs_t. - Added sendmail_domtrans_unconfined interface - Fix broken interfaces - radiusd wants to write own log files. - Label /usr/libexec/rhsmd as rhsmcertd_exec_t - Allow rhsmcertd send signull to setroubleshoot. - Allow rhsmcertd manage rpm db. - Added policy for blrtty. - Fix keepalived policy - Allow rhev-agentd dbus chat with systemd-logind. - Allow keepalived manage snmp var lib sock files. - Add support for /var/lib/graphite-web - Allow NetworkManager to create Bluetooth SDP sockets - It's going to do the the discovery for DUN service for modems with Bluez 5. - Allow swift to connect to all ephemeral ports by default. - Allow sssd to read selinux config to add SELinux user mapping. - Allow lsmd to search own plguins. - Allow abrt to read /dev/memto generate an unique machine_id and uses sosuploader's algorithm based off dmidecode[1] fields. - ALlow zebra for user/group look-ups. - Allow nova domains to getattr on all filesystems. - Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes. - Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket. - Allow rhnsd_t to manage also rhnsd config symlinks. - ALlow user mail domains to create dead.letter. - Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. - Allow pki-tomcat to change SELinux object identity. - Allow radious to connect to apache ports to do OCSP check - Allow git cgi scripts to create content in /tmp - Allow cockpit-session to do GSSAPI logins. - Allow sensord read in /proc - Additional access required by usbmuxd- Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems - Label /usr/lib/erlang/erts.*/bin files as bin_t - Add files_dontaudit_access_check_home_dir() inteface. - Allow udev_t mounton udev_var_run_t dirs #(1128618) - Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it. - Add init_dontaudit_read_state() interface. - Add label for ~/.local/share/fonts - Allow unconfined_r to access unconfined_service_t. - Allow init to read all config files - Add new interface to allow creation of file with lib_t type - Assign rabbitmq port. - Allow unconfined_service_t to dbus chat with all dbus domains - Add new interfaces to access users keys. - Allow domains to are allowed to mounton proc to mount on files as well as dirs - Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories. - Add a port definition for shellinaboxd - Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t - Allow userdomains to stream connect to pcscd for smart cards - Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix) - Update to rawhide-contrib changes Resolves:#1123844- Rebase to 3.13.1 which we have in Fedora21 Resolves:#1128284- Back port fixes from Fedora. Mainly OpenStack and Docker fixes- Add policy-rhel-7.1-{base,contrib} patches- Add support for us_cli ports - Fix labeling for /var/run/user//gvfs - add support for tcp/9697 - Additional rules required by openstack, needs backport to F20 and RHEL7 - Additional access required by docker - ALlow motion to use tcp/8082 port - Allow init_t to setattr/relabelfrom dhcp state files - Dontaudit antivirus domains read access on all security files by default - Add missing alias for old amavis_etc_t type - Allow block_suspend cap for haproxy - Additional fixes for instack overcloud - Allow OpenStack to read mysqld_db links and connect to MySQL - Remove dup filename rules in gnome.te - Allow sys_chroot cap for httpd_t and setattr on httpd_log_t - Allow iscsid to handle own unit files - Add iscsi_systemctl() - Allow mongod to create also sock_files in /run with correct labeling - Allow httpd to send signull to apache script domains and don't audit leaks - Allow rabbitmq_beam to connect to httpd port - Allow aiccu stream connect to pcscd - Allow dmesg to read hwdata and memory dev - Allow all freeipmi domains to read/write ipmi devices - Allow sblim_sfcbd to use also pegasus-https port - Allow rabbitmq_epmd to manage rabbit_var_log_t files - Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input - Allow docker to status any unit file and allow it to start generic unit files- Change hsperfdata_root to have as user_tmp_t Resolves:#1076523- Fix Multiple same specifications for /var/named/chroot/dev/zero - Add labels for /var/named/chroot_sdb/dev devices - Add support for strongimcv - Use kerberos_keytab_domains in auth_use_nsswitch - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to - Allow net_raw cap for neutron_t and send sigkill to dnsmasq - Fix ntp_filetrans_named_content for sntp-kod file - Add httpd_dbus_sssd boolean - Dontaudit exec insmod in boinc policy - Rename kerberos_keytab_domain to kerberos_keytab_domains - Add kerberos_keytab_domain() - Fix kerberos_keytab_template() - Make all domains which use kerberos as kerberos_keytab_domain Resolves:#1083670 - Allow kill capability to winbind_t- varnishd wants chown capability - update ntp_filetrans_named_content() interface - Add additional fixes for neutron_t. #1083335 - Dontaudit getattr on proc_kcore_t - Allow pki_tomcat_t to read ipa lib files - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign - Allow init_t run /sbin/augenrules - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces - Allow unpriv SELinux user to use sandbox - Add default label for /tmp/hsperfdata_root- Add file subs also for /var/home- Allow xauth_t to read user_home_dir_t lnk_file - Add labeling for lightdm-data - Allow certmonger to manage ipa lib files - Add support for /var/lib/ipa - Allow pegasus to getattr virt_content - Added some new rules to pcp policy - Allow chrome_sandbox to execute config_home_t - Add support for ABRT FAF- Allow kdm to send signull to remote_login_t process - Add gear policy - Turn on gear_port_t - Allow cgit to read gitosis lib files by default - Allow vdagent to read xdm state - Allow NM and fcoeadm to talk together over unix_dgram_socket- Back port fixes for pegasus_openlmi_admin_t from rawhide Resolves:#1080973 - Add labels for ostree - Add SELinux awareness for NM - Label /usr/sbin/pwhistory_helper as updpwd_exec_t- add gnome_append_home_config() - Allow thumb to append GNOME config home files - Allow rasdaemon to rw /dev/cpu//msr - fix /var/log/pki file spec - make bacula_t as auth_nsswitch domain - Identify pki_tomcat_cert_t as a cert_type - Define speech-dispater_exec_t as an application executable - Add a new file context for /var/named/chroot/run directory - update storage_filetrans_all_named_dev for sg* devices - Allow auditctl_t to getattr on all removeable devices - Allow nsswitch_domains to stream connect to nmbd - Allow unprivusers to connect to memcached - label /var/lib/dirsrv/scripts-INSTANCE as bin_t- Allow also unpriv user to run vmtools - Allow secadm to read /dev/urandom and meminfo Resolves:#1079250 - Add booleans to allow docker processes to use nfs and samba - Add mdadm_tmpfs support - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t - Allow vmware-user-sui to use user ttys - Allow talk 2 users logged via console too - Allow ftp services to manage xferlog_t - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies - allow anaconda to dbus chat with systemd-localed- allow anaconda to dbus chat with systemd-localed - Add fixes for haproxy based on bperkins@redhat.com - Allow cmirrord to make dmsetup working - Allow NM to execute arping - Allow users to send messages through talk - Add userdom_tmp_role for secadm_t- Add additional fixes for rtas_errd - Fix transitions for tmp/tmpfs in rtas.te - Allow rtas_errd to readl all sysctls- Add support for /var/spool/rhsm/debug - Make virt_sandbox_use_audit as True by default - Allow svirt_sandbox_domains to ptrace themselves- Allow docker containers to manage /var/lib/docker content- Allow docker to read tmpfs_t symlinks - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets- Allow collectd to talk to libvirt - Allow chrome_sandbox to use leaked unix_stream_sockets - Dontaudit leaks of sockets into chrome_sandbox_t - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t - Run vmtools as unconfined domains - Allow snort to manage its log files - Allow systemd_cronjob_t to be entered via bin_t - Allow procman to list doveconf_etc_t - allow keyring daemon to create content in tmpfs directories - Add proper labelling for icedtea-web - vpnc is creating content in networkmanager var run directory - Label sddm as xdm_exec_t to make KDE working again - Allow postgresql to read network state - Allow java running as pki_tomcat to read network sysctls - Fix cgroup.te to allow cgred to read cgconfig_etc_t - Allow beam.smp to use ephemeral ports - Allow winbind to use the nis to authenticate passwords- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least. - Allow net_admin cap for fence_virtd running as fenced_t - Make abrt-java-connector working - Make cimtest script 03_defineVS.py of ComputerSystem group working - Fix git_system_enable_homedirs boolean - Allow munin mail plugins to read network systcl- Allow vmtools_helper_t to execute bin_t - Add support for /usr/share/joomla - /var/lib/containers should be labeled as openshift content for now - Allow docker domains to talk to the login programs, to allow a process to login into the container - Allow install_t do dbus chat with NM - Fix interface names in anaconda.if - Add install_t for anaconda. A new type is a part of anaconda policy - sshd to read network sysctls- Allow zabbix to send system log msgs - Allow init_t to stream connect to ipsec Resolves:#1060775- Add docker_connect_any boolean- Allow unpriv SELinux users to dbus chat with firewalld - Add lvm_write_metadata() - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type - Allow pegasus_openlmi_storage_t to write lvm metadata - Add hide_broken_symptoms for kdumpgui because of systemd bug - Make kdumpgui_t as unconfined domain Resolves:#1044299 - Allow docker to connect to tcp/5000- Allow numad to write scan_sleep_millisecs - Turn on entropyd_use_audio boolean by default - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf. - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo - Fix label on irclogs in the homedir - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix - Allow postgresql to use ldap - Add missing syslog-conn port - Add support for /dev/vmcp and /dev/sclp Resolves:#1069310- Modify xdm_write_home to allow create files/links in /root with xdm_home_ - Allow virt domains to read network state Resolves:#1072019- Added pcp rules - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6 - clean up ctdb.te - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow certmonger to list home dirs- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask - Add sysnet_filetrans_named_content_ifconfig() interface - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow kerberos keytab domains to manage sssd/userdomain keys" - Allow to run ip cmd in neutron_t domain- Allow block_suspend cap2 for systemd-logind and rw dri device - Add labeling for /usr/libexec/nm-libreswan-service - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working - Add xserver_rw_xdm_keys() - Allow rpm_script_t to dbus chat also with systemd-located - Fix ipa_stream_connect_otpd() - update lpd_manage_spool() interface - Allow krb5kdc to stream connect to ipa-otpd - Add ipa_stream_connect_otpd() interface - Allow vpnc to unlink NM pids - Add networkmanager_delete_pid_files() - Allow munin plugins to access unconfined plugins - update abrt_filetrans_named_content to cover /var/spool/debug - Label /var/spool/debug as abrt_var_cache_t - Allow rhsmcertd to connect to squid port - Make docker_transition_unconfined as optional boolean - Allow certmonger to list home dirs- Make snapperd as unconfined domain and add additional fixes for it - Remove nsplugin.pp module on upgrade- Add snapperd_home_t for HOME_DIR/.snapshots directory - Make sosreport as unconfined domain - Allow sosreport to execute grub2-probe - Allow NM to manage hostname config file - Allow systemd_timedated_t to dbus chat with rpm_script_t - Allow lsmd plugins to connect to http/ssh/http_cache ports by default - Add lsmd_plugin_connect_any boolean - Allow mozilla_plugin to attempt to set capabilities - Allow lsdm_plugins to use tcp_socket - Dontaudit mozilla plugin from getattr on /proc or /sys - Dontaudit use of the keyring by the services in a sandbox - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t - Allow rabbitmq_beam to connect to jabber_interserver_port - Allow logwatch_mail_t to transition to qmail_inject and queueu - Added new rules to pcp policy - Allow vmtools_helper_t to change role to system_r - Allow NM to dbus chat with vmtools - Fix couchdb_manage_files() to allow manage couchdb conf files - Add support for /var/run/redis.sock - dontaudit gpg trying to use audit - Allow consolekit to create log directories and files - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow pkcsslotd to read users state - Add ioctl to init_dontaudit_rw_stream_socket - Add systemd_hostnamed_manage_config() interface - Remove transition for temp dirs created by init_t - gdm-simple-slave uses use setsockopt - sddm-greater is a xdm type program- Add lvm_read_metadata() - Allow auditadm to search /var/log/audit dir - Add lvm_read_metadata() interface - Allow confined users to run vmtools helpers - Fix userdom_common_user_template() - Generic systemd unit scripts do write check on / - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files - Add additional fixes needed for init_t and setup script running in generic unit files - Allow general users to create packet_sockets - added connlcli port - Add init_manage_transient_unit() interface - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t - Fix userdomain.te to require passwd class - devicekit_power sends out a signal to all processes on the message bus when power is going down - Dontaudit rendom domains listing /proc and hittping system_map_t - Dontauit leaks of var_t into ifconfig_t - Allow domains that transition to ssh_t to manipulate its keyring - Define oracleasm_t as a device node - Change to handle /root as a symbolic link for os-tree - Allow sysadm_t to create packet_socket, also move some rules to attributes - Add label for openvswitch port - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label. - Allow postfix_local to read .forward in pcp lib files - Allow pegasus_openlmi_storage_t to read lvm metadata - Add additional fixes for pegasus_openlmi_storage_t - Allow bumblebee to manage debugfs - Make bumblebee as unconfined domain - Allow snmp to read etc_aliases_t - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem - Allow pegasus_openlmi_storage_t to read /proc/1/environ - Dontaudit read gconf files for cupsd_config_t - make vmtools as unconfined domain - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig. - Allow collectd_t to use a mysql database - Allow ipa-otpd to perform DNS name resolution - Added new policy for keepalived - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd - Add additional fixes new pscs-lite+polkit support - Add labeling for /run/krb5kdc - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20 - Allow pcscd to read users proc info - Dontaudit smbd_t sending out random signuls - Add boolean to allow openshift domains to use nfs - Allow w3c_validator to create content in /tmp - zabbix_agent uses nsswitch - Allow procmail and dovecot to work together to deliver mail - Allow spamd to execute files in homedir if boolean turned on - Allow openvswitch to listen on port 6634 - Add net_admin capability in collectd policy - Fixed snapperd policy - Fixed bugsfor pcp policy - Allow dbus_system_domains to be started by init - Fixed some interfaces - Add kerberos_keytab_domain attribute - Fix snapperd_conf_t def- Addopt corenet rules for unbound-anchor to rpm_script_t - Allow runuser to send send audit messages. - Allow postfix-local to search .forward in munin lib dirs - Allow udisks to connect to D-Bus - Allow spamd to connect to spamd port - Fix syntax error in snapper.te - Dontaudit osad to search gconf home files - Allow rhsmcertd to manage /etc/sysconf/rhn director - Fix pcp labeling to accept /usr/bin for all daemon binaries - Fix mcelog_read_log() interface - Allow iscsid to manage iscsi lib files - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it. - Make tuned_t as unconfined domain for RHEL7.0 - Allow ABRT to read puppet certs - Add sys_time capability for virt-ga - Allow gemu-ga to domtrans to hwclock_t - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages - Fix some AVCs in pcp policy - Add to bacula capability setgid and setuid and allow to bind to bacula ports - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t - Add access rhnsd and osad to /etc/sysconfig/rhn - drbdadm executes drbdmeta - Fixes needed for docker - Allow epmd to manage /var/log/rabbitmq/startup_err file - Allow beam.smp connect to amqp port - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t - Allow systemd_tmpfiles_t to manage all non security files on the system - Added labels for bacula ports - Fix label on /dev/vfio/vfio - Add kernel_mounton_messages() interface - init wants to manage lock files for iscsi- Added osad policy - Allow postfix to deliver to procmail - Allow bumblebee to seng kill signal to xserver - Allow vmtools to execute /usr/bin/lsb_release - Allow docker to write system net ctrls - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix pcp.te - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl- Turn on bacula, rhnsd policy - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl - Fixes for *_admin interfaces - Add pegasus_openlmi_storage_var_run_t type def - Add support for /var/run/openlmi-storage - Allow tuned to create syslog.conf with correct labeling - Add httpd_dontaudit_search_dirs boolean - Add support for winbind.service - ALlow also fail2ban-client to read apache logs - Allow vmtools to getattr on all fs - Add support for dey_sapi port - Add logging_filetrans_named_conf() - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring- Update snapper policy - Allow domains to append rkhunter lib files - Allow snapperd to getattr on all fs - Allow xdm to create /var/gdm with correct labeling - Add label for snapper.log - Allow fail2ban-client to read apache log files - Allow thumb_t to execute dbus-daemon in thumb_t- Allow gdm to create /var/gdm with correct labeling - Allow domains to append rkhunterl lib files. #1057982 - Allow systemd_tmpfiles_t net_admin to communicate with journald - Add interface to getattr on an isid_type for any type of file - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory - Allow initrc_t domtrans to authconfig if unconfined is enabled - Allow docker and mount on devpts chr_file - Allow docker to transition to unconfined_t if boolean set - init calling needs to be optional in domain.te - Allow uncofined domain types to handle transient unit files - Fix labeling for vfio devices - Allow net_admin capability and send system log msgs - Allow lldpad send dgram to NM - Add networkmanager_dgram_send() - rkhunter_var_lib_t is correct type - Back port pcp policy from rawhide - Allow openlmi-storage to read removable devices - Allow system cron jobs to manage rkhunter lib files - Add rkhunter_manage_lib_files() - Fix ftpd_use_fusefs boolean to allow manage also symlinks - Allow smbcontrob block_suspend cap2 - Allow slpd to read network and system state info - Allow NM domtrans to iscsid_t if iscsiadm is executed - Allow slapd to send a signal itself - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA. - Fix plymouthd_create_log() interface - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container - Allow postfix and cyrus-imapd to work out of box - Allow fcoemon to talk with unpriv user domain using unix_stream_socket - Dontaudit domains that are calling into journald to net_admin - Add rules to allow vmtools to do what it does - snapperd is D-Bus service - Allow OpenLMI PowerManagement to call 'systemctl --force reboot' - Add haproxy_connect_any boolean - Allow haproxy also to use http cache port by default Resolves:#1058248- Allow apache to write to the owncloud data directory in /var/www/html... - Allow consolekit to create log dir - Add support for icinga CGI scripts - Add support for icinga - Allow kdumpctl_t to create kdump lock file Resolves:#1055634 - Allow kdump to create lnk lock file - Allow nscd_t block_suspen capability - Allow unconfined domain types to manage own transient unit file - Allow systemd domains to handle transient init unit files - Add interfaces to handle transient- Add cron unconfined role support for uncofined SELinux user - Call corenet_udp_bind_all_ports() in milter.te - Allow fence_virtd to connect to zented port - Fix header for mirrormanager_admin() - Allow dkim-milter to bind udp ports - Allow milter domains to send signull itself - Allow block_suspend for yum running as mock_t - Allow beam.smp to manage couchdb files - Add couchdb_manage_files() - Add labeling for /var/log/php_errors.log - Allow bumblebee to stream connect to xserver - Allow bumblebee to send a signal to xserver - gnome-thumbnail to stream connect to bumblebee - Allow xkbcomp running as bumblebee_t to execute bin_t - Allow logrotate to read squid.conf - Additional rules to get docker and lxc to play well with SELinux - Allow bumbleed to connect to xserver port - Allow pegasus_openlmi_storage_t to read hwdata- Allow init_t to work on transitient and snapshot unit files - Add logging_manage_syslog_config() - Update sysnet_dns_name_resolve() to allow connect to dnssec por - Allow pegasus_openlmi_storage_t to read hwdata Resolves:#1031721 - Fix rhcs_rw_cluster_tmpfs() - Allow fenced_t to bind on zented udp port - Added policy for vmtools - Fix mirrormanager_read_lib_files() - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files - Allow ctdb to create sock files in /var/run/ctdb - Add sblim_filetrans_named_content() interface - Allow rpm scritplets to create /run/gather with correct labeling - Allow gnome keyring domains to create gnome config dirs - Dontaudit read/write to init stream socket for lsmd_plugin_t - Allow automount to read nfs link files - Allow lsm plugins to read/write lsmd stream socket - Allow certmonger to connect ldap port to make IPA CA certificate renewal working. - Add also labeling for /var/run/ctdb - Add missing labeling for /var/lib/ctdb - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446 - Dontaudit hypervkvp to search homedirs - Dontaudit hypervkvp to search admin homedirs - Allow hypervkvp to execute bin_t and ifconfig in the caller domain - Dontaudit xguest_t to read ABRT conf files - Add abrt_dontaudit_read_config() - Allow namespace-init to getattr on fs - Add thumb_role() also for xguest - Add filename transitions to create .spamassassin with correct labeling - Allow apache domain to read mirrormanager pid files - Allow domains to read/write shm and sem owned by mozilla_plugin_t - Allow alsactl to send a generic signal to kernel_t- Add back rpm_run() for unconfined user- Add missing files_create_var_lib_dirs() - Fix typo in ipsec.te - Allow passwd to create directory in /var/lib - Add filename trans also for event21 - Allow iptables command to read /dev/rand - Add sigkill capabilityfor ipsec_t - Add filename transitions for bcache devices - Add additional rules to create /var/log/cron by syslogd_t with correct labeling - Add give everyone full access to all key rings - Add default lvm_var_run_t label for /var/run/multipathd - Fix log labeling to have correct default label for them after logrotate - Labeled ~/.nv/GLCache as being gstreamer output - Allow nagios_system_plugin to read mrtg lib files - Add mrtg_read_lib_files() - Call rhcs_rw_cluster_tmpfs for dlm_controld - Make authconfing as named_filetrans domain - Allow virsh to connect to user process using stream socket - Allow rtas_errd to read rand/urand devices and add chown capability - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp Resolves:#1051497 - Add also chown cap for abrt_upload_watch_t. It already has dac_override - Allow sosreport to manage rhsmcertd pid files - Add rhsmcertd_manage_pid_files() - Allow also setgid cap for rpc.gssd - Dontaudit access check for abrt on cert_t - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind- Fix semanage import handling in spec file- Add default lvm_var_run_t label for /var/run/multipathd Resolves:#1051430 - Fix log labeling to have correct default label for them after logrotate - Add files_write_root_dirs - Add new openflow port label for 6653/tcp and 6633/tcp - Add xserver_manage_xkb_libs() - Label tcp/8891 as milter por - Allow gnome_manage_generic_cache_files also create cache_home_t files - Fix aide.log labeling - Fix log labeling to have correct default label for them after logrotate - Allow mysqld-safe write access on /root to make mysqld working - Allow sosreport domtrans to prelikn - Allow OpenvSwitch to connec to openflow ports - Allow NM send dgram to lldpad - Allow hyperv domains to execute shell - Allow lsmd plugins stream connect to lsmd/init - Allow sblim domains to create /run/gather with correct labeling - Allow httpd to read ldap certs - Allow cupsd to send dbus msgs to process with different MLS level - Allow bumblebee to stream connect to apmd - Allow bumblebee to run xkbcomp - Additional allow rules to get libvirt-lxc containers working with docker - Additional allow rules to get libvirt-lxc containers working with docker - Allow docker to getattr on itself - Additional rules needed for sandbox apps - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled - httpd should be able to send signal/signull to httpd_suexec_t - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.- Add neutron fixes- Allow sshd to write to all process levels in order to change passwd when running at a level - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range - Allow apcuspd_t to status and start the power unit file - Allow udev to manage kdump unit file - Added new interface modutils_dontaudit_exec_insmod - Allow cobbler to search dhcp_etc_t directory - systemd_systemctl needs sys_admin capability - Allow sytemd_tmpfiles_t to delete all directories - passwd to create gnome-keyring passwd socket - Add missing zabbix_var_lib_t type - Fix filename trans for zabbixsrv in zabbix.te - Allow fprintd_t to send syslog messages - Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port - Allow mozilla plugin to chat with policykit, needed for spice - Allow gssprozy to change user and gid, as well as read user keyrings - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly - Allow polipo to connect to http_cache_ports - Allow cron jobs to manage apache var lib content - Allow yppassword to manage the passwd_file_t - Allow showall_t to send itself signals - Allow cobbler to restart dhcpc, dnsmasq and bind services - Allow certmonger to manage home cert files - Add userdom filename trans for user mail domains - Allow apcuspd_t to status and start the power unit file - Allow cgroupdrulesengd to create content in cgoups directories - Allow smbd_t to signull cluster - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t - Add label for /var/spool/cron.aquota.user - Allow sandbox_x domains to use work with the mozilla plugin semaphore - Added new policy for speech-dispatcher - Added dontaudit rule for insmod_exec_t in rasdaemon policy - Updated rasdaemon policy - Allow system_mail_t to transition to postfix_postdrop_t - Clean up mirrormanager policy - Allow virt_domains to read cert files, needs backport to RHEL7 - Allow sssd to read systemd_login_var_run_t - Allow irc_t to execute shell and bin-t files: - Add new access for mythtv - Allow rsync_t to manage all non auth files - allow modemmanger to read /dev/urand - Allow sandbox apps to attempt to set and get capabilties- Add labeling for /var/lib/servicelog/servicelog.db-journal - Add support for freeipmi port - Add sysadm_u_default_contexts - Make new type to texlive files in homedir - Allow subscription-manager running as sosreport_t to manage rhsmcertd - Additional fixes for docker.te - Remove ability to do mount/sys_admin by default in virt_sandbox domains - New rules required to run docker images within libivrt - Add label for ~/.cvsignore - Change mirrormanager to be run by cron - Add mirrormanager policy - Fixed bumblebee_admin() and mip6d_admin() - Add log support for sensord - Fix typo in docker.te - Allow amanda to do backups over UDP - Allow bumblebee to read /etc/group and clean up bumblebee.te - type transitions with a filename not allowed inside conditionals - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7 - Make new type to texlive files in homedir- Allow freeipmi_ipmidetectd_t to use freeipmi port - Update freeipmi_domain_template() - Allow journalctl running as ABRT to read /run/log/journal - Allow NM to read dispatcher.d directory - Update freeipmi policy - Type transitions with a filename not allowed inside conditionals - Allow tor to bind to hplip port - Make new type to texlive files in homedir - Allow zabbix_agent to transition to dmidecode - Add rules for docker - Allow sosreport to send signull to unconfined_t - Add virt_noatsecure and virt_rlimitinh interfaces - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port - Add sysadm_u_default_contexts - Add logging_read_syslog_pid() - Fix userdom_manage_home_texlive() interface - Make new type to texlive files in homedir - Add filename transitions for /run and /lock links - Allow virtd to inherit rlimit information Resolves:#975358- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t Resolves:#1039879 - Add labeling for /usr/lib/systemd/system/mariadb.service - Allow hyperv_domain to read sysfs - Fix ldap_read_certs() interface to allow acess also link files - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt - Allow tuned to run modprobe - Allow portreserve to search /var/lib/sss dir - Add SELinux support for the teamd package contains team network device control daemon. - Dontaudit access check on /proc for bumblebee - Bumblebee wants to load nvidia modules - Fix rpm_named_filetrans_log_files and wine.te - Add conman policy for rawhide - DRM master and input event devices are used by the TakeDevice API - Clean up bumblebee policy - Update pegasus_openlmi_storage_t policy - Add freeipmi_stream_connect() interface - Allow logwatch read madm.conf to support RAID setup - Add raid_read_conf_files() interface - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling - add rpm_named_filetrans_log_files() interface - Allow dkim-milter to create files/dirs in /tmp - update freeipmi policy - Add policy for freeipmi services - Added rdisc_admin and rdisc_systemctl interfaces - opensm policy clean up - openwsman policy clean up - ninfod policy clean up - Added new policy for ninfod - Added new policy for openwsman - Added rdisc_admin and rdisc_systemctl interfaces - Fix kernel_dontaudit_access_check_proc() - Add support for /dev/uhid - Allow sulogin to get the attributes of initctl and sys_admin cap - Add kernel_dontaudit_access_check_proc() - Fix dev_rw_ipmi_dev() - Fix new interface in devices.if - DRM master and input event devices are used by the TakeDevice API - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev() - Added support for default conman port - Add interfaces for ipmi devices- Allow sosreport to send a signal to ABRT - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t - Label /usr/sbin/htcacheclean as httpd_exec_t Resolves:#1037529 - Added support for rdisc unit file - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs - Allow runuser running as logrotate connections to system DBUS - Label bcache devices as fixed_disk_device_t - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t- Add back setpgid/setsched for sosreport_t- Added fix for clout_init to transition to rpm_script_t (dwalsh@redhat.com)- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel. - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on - Add lsmd_plugin_t for lsm plugins - Allow dovecot-deliver to search mountpoints - Add labeling for /etc/mdadm.conf - Allow opelmi admin providers to dbus chat with init_t - Allow sblim domain to read /dev/urandom and /dev/random - Allow apmd to request the kernel load modules - Add glusterd_brick_t type - label mate-keyring-daemon with gkeyringd_exec_t - Add plymouthd_create_log() - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6 - Allow sssd to request the kernel loads modules - Allow gpg_agent to use ssh-add - Allow gpg_agent to use ssh-add - Dontaudit access check on /root for myslqd_safe_t - Allow ctdb to getattr on al filesystems - Allow abrt to stream connect to syslog - Allow dnsmasq to list dnsmasq.d directory - Watchdog opens the raw socket - Allow watchdog to read network state info - Dontaudit access check on lvm lock dir - Allow sosreport to send signull to setroubleshootd - Add setroubleshoot_signull() interface - Fix ldap_read_certs() interface - Allow sosreport all signal perms - Allow sosreport to run systemctl - Allow sosreport to dbus chat with rpm - Add glusterd_brick_t files type - Allow zabbix_agentd to read all domain state - Clean up rtas.if - Allow smoltclient to execute ldconfig - Allow sosreport to request the kernel to load a module - Fix userdom_confined_admin_template() - Add back exec_content boolean for secadm, logadm, auditadm - Fix files_filetrans_system_db_named_files() interface - Allow sulogin to getattr on /proc/kcore - Add filename transition also for servicelog.db-journal - Add files_dontaudit_access_check_root() - Add lvm_dontaudit_access_check_lock() interface- Allow watchdog to read /etc/passwd - Allow browser plugins to connect to bumblebee - New policy for bumblebee and freqset - Add new policy for mip6d daemon - Add new policy for opensm daemon - Allow condor domains to read/write condor_master udp_socket - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift - Add back file_pid_filetrans for /var/run/dlm_controld - Allow smbd_t to use inherited tmpfs content - Allow mcelog to use the /dev/cpu device - sosreport runs rpcinfo - sosreport runs subscription-manager - Allow staff_t to run frequency command - Allow systemd_tmpfiles to relabel log directories - Allow staff_t to read xserver_log file - Label hsperfdata_root as tmp_t- More sosreport fixes to make ABRT working- Fix files_dontaudit_unmount_all_mountpoints() - Add support for 2608-2609 tcp/udp ports - Should allow domains to lock the terminal device - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - We need to require passwd rootok - Fix zebra.fc - Fix dnsmasq_filetrans_named_content() interface - Allow all sandbox domains create content in svirt_home_t - Allow zebra domains also create zebra_tmp_t files in /tmp - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services. - Fix labeling on neutron and remove transition to iconfig_t - abrt needs to read mcelog log file - Fix labeling on dnsmasq content - Fix labeling on /etc/dnsmasq.d - Allow glusterd to relabel own lib files - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd - Allow ipc_lock for abrt to run journalctl- Fix config.tgz- Fix passenger_stream_connect interface - setroubleshoot_fixit wants to read network state - Allow procmail_t to connect to dovecot stream sockets - Allow cimprovagt service providers to read network states - Add labeling for /var/run/mariadb - pwauth uses lastlog() to update system's lastlog - Allow account provider to read login records - Add support for texlive2013 - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - Allow passwd_t to connect to gnome keyring to change password - Update mls config files to have cronjobs in the user domains - Remove access checks that systemd does not actually do- Add support for yubikey in homedir - Add support for upd/3052 port - Allow apcupsd to use PowerChute Network Shutdown - Allow lsmd to execute various lsmplugins - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too - Update gluster_export_all_rw boolean to allow relabel all base file types - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling- Add files_relabel_base_file_types() interface - Allow netlabel-config to read passwd - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr() - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling - Allow pegasus to domtrans to mount_t - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts - Add support for unconfined watchdog scripts - Allow watchdog to manage own log files- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory. - Label /etc/yum.repos.d as system_conf_t - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t - Allow dac_override for sysadm_screen_t - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file. - Allow netlabel-config to read meminfo - Add interface to allow docker to mounton file_t - Add new interface to exec unlabeled files - Allow lvm to use docker semaphores - Setup transitons for .xsessions-errors.old - Change labels of files in /var/lib/*/.ssh to transition properly - Allow staff_t and user_t to look at logs using journalctl - pluto wants to manage own log file - Allow pluto running as ipsec_t to create pluto.log - Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files. - Additional access for docker - Added more rules to sblim policy - Fix kdumpgui_run_bootloader boolean - Allow dspam to connect to lmtp port - Included sfcbd service into sblim policy - rhsmcertd wants to manaage /etc/pki/consumer dir - Add kdumpgui_run_bootloader boolean - Add support for /var/cache/watchdog - Remove virt_domain attribute for virt_qemu_ga_unconfined_t - Fixes for handling libvirt containes - Dontaudit attempts by mysql_safe to write content into / - Dontaudit attempts by system_mail to modify network config - Allow dspam to bind to lmtp ports - Add new policy to allow staff_t and user_t to look at logs using journalctl - Allow apache cgi scripts to list sysfs - Dontaudit attempts to write/delete user_tmp_t files - Allow all antivirus domains to manage also own log dirs - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Add missing permission checks for nscd- Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Add file transition rules for content created by f5link - Rename quantum_port information to neutron - Allow all antivirus domains to manage also own log dirs - Rename quantum_port information to neutron - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Allow sysadm_t to read login information - Allow systemd_tmpfiles to setattr on var_log_t directories - Udpdate Makefile to include systemd_contexts - Add systemd_contexts - Add fs_exec_hugetlbfs_files() interface - Add daemons_enable_cluster_mode boolean - Fix rsync_filetrans_named_content() - Add rhcs_read_cluster_pid_files() interface - Update rhcs.if with additional interfaces from RHEL6 - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t - Allow glusterd_t to mounton glusterd_tmp_t - Allow glusterd to unmout al filesystems - Allow xenstored to read virt config - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label - Allow mozilla_plugin_t to mmap hugepages as an executable- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp- Allow sshd_t to read openshift content, needs backport to RHEL6.5 - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t - Make sur kdump lock is created with correct label if kdumpctl is executed - gnome interface calls should always be made within an optional_block - Allow syslogd_t to connect to the syslog_tls port - Add labeling for /var/run/charon.ctl socket - Add kdump_filetrans_named_content() - Allo setpgid for fenced_t - Allow setpgid and r/w cluster tmpfs for fenced_t - gnome calls should always be within optional blocks - wicd.pid should be labeled as networkmanager_var_run_t - Allow sys_resource for lldpad- Add rtas policy- Allow mailserver_domains to manage and transition to mailman data - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands - Allow mailserver_domains to manage and transition to mailman data - Allow svirt_domains to read sysctl_net_t - Allow thumb_t to use tmpfs inherited from the user - Allow mozilla_plugin to bind to the vnc port if running with spice - Add new attribute to discover confined_admins and assign confined admin to it - Fix zabbix to handle attributes in interfaces - Fix zabbix to read system states for all zabbix domains - Fix piranha_domain_template() - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files. - Allow lldpad sys_rouserce cap due to #986870 - Allow dovecot-auth to read nologin - Allow openlmi-networking to read /proc/net/dev - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t - Add zabbix_domain attribute for zabbix domains to treat them together - Add labels for zabbix-poxy-* (#1018221) - Update openlmi-storage policy to reflect #1015067 - Back port piranha tmpfs fixes from RHEL6 - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop - Add postfix_rw_spool_maildrop_files interface - Call new userdom_admin_user_templat() also for sysadm_secadm.pp - Fix typo in userdom_admin_user_template() - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey - Add new attribute to discover confined_admins - Fix labeling for /etc/strongswan/ipsec.d - systemd_logind seems to pass fd to anyone who dbus communicates with it - Dontaudit leaked write descriptor to dmesg- Activate motion policy- Fix gnome_read_generic_data_home_files() - allow openshift_cgroup_t to read/write inherited openshift file types - Remove httpd_cobbler_content * from cobbler_admin interface - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container - Allow httpd_t to read also git sys content symlinks - Allow init_t to read gnome home data - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it. - Allow virsh to execute systemctl - Fix for nagios_services plugins - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - Fix hypervkvp.te - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Fix logging policy - Allow syslog to bind to tls ports - Update labeling for /dev/cdc-wdm - Allow to su_domain to read init states - Allow init_t to read gnome home data - Make sure if systemd_logind creates nologin file with the correct label - Clean up ipsec.te- Add auth_exec_chkpwd interface - Fix port definition for ctdb ports - Allow systemd domains to read /dev/urand - Dontaudit attempts for mozilla_plugin to append to /dev/random - Add label for /var/run/charon.* - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service - Fix for nagios_services plugins - Fix some bugs in zoneminder policy - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - glusterd binds to random unreserved ports - Additional allow rules found by testing glusterfs - apcupsd needs to send a message to all users on the system so needs to look them up - Fix the label on ~/.juniper_networks - Dontaudit attempts for mozilla_plugin to append to /dev/random - Allow polipo_daemon to connect to flash ports - Allow gssproxy_t to create replay caches - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type- init reload from systemd_localed_t - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd - Allow systemd_localed_t to ask systemd to reload the locale. - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory - Allow readahead to read /dev/urand - Fix lots of avcs about tuned - Any file names xenstored in /var/log should be treated as xenstored_var_log_t - Allow tuned to inderact with hugepages - Allow condor domains to list etc rw dirs- Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Add additional fixes forpegasus_openlmi_account_t - Allow mdadm to read /dev/urand - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it - Add label/rules for /etc/mdadm.conf - Allow pegasus_openlmi_storage_t to transition to fsadm_t - Fixes for interface definition problems - Dontaudit dovecot-deliver to gettatr on all fs dirs - Allow domains to search data_home_t directories - Allow cobblerd to connect to mysql - Allow mdadm to r/w kdump lock files - Add support for kdump lock files - Label zarafa-search as zarafa-indexer - Openshift cgroup wants to read /etc/passwd - Add new sandbox domains for kvm - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on - Fix labeling for /usr/lib/systemd/system/lvm2.* - Add labeling for /usr/lib/systemd/system/lvm2.* - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules - Add sshd_keygen_t policy for sshd-keygen - Fix alsa_home_filetrans interface name and definition - Allow chown for ssh_keygen_t - Add fs_dontaudit_getattr_all_dirs() - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys - Fix up patch to allow systemd to manage home content - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled - Allow getty to exec hostname to get info - Add systemd_home_t for ~/.local/share/systemd directory- Fix lxc labels in config.tgz- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper - Allow tuned to search all file system directories - Allow alsa_t to sys_nice, to get top performance for sound management - Add support for MySQL/PostgreSQL for amavis - Allow openvpn_t to manage openvpn_var_log_t files. - Allow dirsrv_t to create tmpfs_t directories - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label - Dontaudit leaked unix_stream_sockets into gnome keyring - Allow telepathy domains to inhibit pipes on telepathy domains - Allow cloud-init to domtrans to rpm - Allow abrt daemon to manage abrt-watch tmp files - Allow abrt-upload-watcher to search /var/spool directory - Allow nsswitch domains to manage own process key - Fix labeling for mgetty.* logs - Allow systemd to dbus chat with upower - Allow ipsec to send signull to itself - Allow setgid cap for ipsec_t - Match upstream labeling- Do not build sanbox pkg on MLS- wine_tmp is no longer needed - Allow setroubleshoot to look at /proc - Allow telepathy domains to dbus with systemd logind - Fix handling of fifo files of rpm - Allow mozilla_plugin to transition to itself - Allow certwatch to write to cert_t directories - New abrt application - Allow NetworkManager to set the kernel scheduler - Make wine_domain shared by all wine domains - Allow mdadm_t to read images labeled svirt_image_t - Allow amanda to read /dev/urand - ALlow my_print_default to read /dev/urand - Allow mdadm to write to kdumpctl fifo files - Allow nslcd to send signull to itself - Allow yppasswd to read /dev/urandom - Fix zarafa_setrlimit - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add additional alias for user_tmp_t because wine_tmp_t is no longer used - More handling of ther kernel keyring required by kerberos - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed- Dontaudit attempts by sosreport to read shadow_t - Allow browser sandbox plugins to connect to cups to print - Add new label mpd_home_t - Label /srv/www/logs as httpd_log_t - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add labels for apache logs under miq package - Allow irc_t to use tcp sockets - fix labels in puppet.if - Allow tcsd to read utmp file - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys - Define svirt_socket_t as a domain_type - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t - Fix label on pam_krb5 helper apps- Allow ldconfig to write to kdumpctl fifo files - allow neutron to connect to amqp ports - Allow kdump_manage_crash to list the kdump_crash_t directory - Allow glance-api to connect to amqp port - Allow virt_qemu_ga_t to read meminfo - Add antivirus_home_t type for antivirus date in HOMEDIRS - Allow mpd setcap which is needed by pulseaudio - Allow smbcontrol to create content in /var/lib/samba - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts - amanda_exec_t needs to be executable file - Allow block_suspend cap for samba-net - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t - Allow init_t to run crash utility - Treat usr_t just like bin_t for transitions and executions - Add port definition of pka_ca to port 829 for openshift - Allow selinux_store to use symlinks- Allow block_suspend cap for samba-net - Allow t-mission-control to manage gabble cache files - Allow nslcd to read /sys/devices/system/cpu - Allow selinux_store to use symlinks- Allow xdm_t to transition to itself - Call neutron interfaces instead of quantum - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t - Make sure directories in /run get created with the correct label - Make sure /root/.pki gets created with the right label - try to remove labeling for motion from zoneminder_exec_t to bin_t - Allow inetd_t to execute shell scripts - Allow cloud-init to read all domainstate - Fix to use quantum port - Add interface netowrkmanager_initrc_domtrans - Fix boinc_execmem - Allow t-mission-control to read gabble cache home - Add labeling for ~/.cache/telepathy/avatars/gabble - Allow memcache to read sysfs data - Cleanup antivirus policy and add additional fixes - Add boolean boinc_enable_execstack - Add support for couchdb in rabbitmq policy - Add interface couchdb_search_pid_dirs - Allow firewalld to read NM state - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files()- Split out rlogin ports from inetd - Treat files labeld as usr_t like bin_t when it comes to transitions - Allow staff_t to read login config - Allow ipsec_t to read .google authenticator data - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files() - Call the correct interface - corenet_udp_bind_ktalkd_port() - Allow all domains that can read gnome_config to read kde config - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work - Allow mdadm to getattr any file system - Allow a confined domain to executes mozilla_exec_t via dbus - Allow cupsd_lpd_t to bind to the printer port - Dontaudit attempts to bind to ports < 1024 when nis is turned on - Allow apache domain to connect to gssproxy socket - Allow rlogind to bind to the rlogin_port - Allow telnetd to bind to the telnetd_port - Allow ktalkd to bind to the ktalkd_port - Allow cvs to bind to the cvs_port- Cleanup related to init_domain()+inetd_domain fixes - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain - svirt domains neeed to create kobject_uevint_sockets - Lots of new access required for sosreport - Allow tgtd_t to connect to isns ports - Allow init_t to transition to all inetd domains: - openct needs to be able to create netlink_object_uevent_sockets - Dontaudit leaks into ldconfig_t - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls - Move kernel_stream_connect into all Xwindow using users - Dontaudit inherited lock files in ifconfig o dhcpc_t- Also sock_file trans rule is needed in lsm - Fix labeling for fetchmail pid files/dirs - Add additional fixes for abrt-upload-watch - Fix polipo.te - Fix transition rules in asterisk policy - Add fowner capability to networkmanager policy - Allow polipo to connect to tor ports - Cleanup lsmd.if - Cleanup openhpid policy - Fix kdump_read_crash() interface - Make more domains as init domain - Fix cupsd.te - Fix requires in rpm_rw_script_inherited_pipes - Fix interfaces in lsm.if - Allow munin service plugins to manage own tmpfs files/dirs - Allow virtd_t also relabel unix stream sockets for virt_image_type - Make ktalk as init domain - Fix to define ktalkd_unit_file_t correctly - Fix ktalk.fc - Add systemd support for talk-server - Allow glusterd to create sock_file in /run - Allow xdm_t to delete gkeyringd_tmp_t files on logout - Add fixes for hypervkvp policy - Add logwatch_can_sendmail boolean - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb - Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add selinux-policy-sandbox pkg0 - Allow rhsmcertd to read init state - Allow fsetid for pkcsslotd - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service - Allow fetchmail to create own pid with correct labeling - Fix rhcs_domain_template() - Allow roles which can run mock to read mock lib files to view results - Allow rpcbind to use nsswitch - Fix lsm.if summary - Fix collectd_t can read /etc/passwd file - Label systemd unit files under dracut correctly - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh - Add support for .Xauthority-n - Label umount.crypt as lvm_exec_t - Allow syslogd to search psad lib files - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files- Add policy for lsmd - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory - Update condor_master rules to allow read system state info and allow logging - Add labeling for /etc/condor and allow condor domain to write it (bug) - Allow condor domains to manage own logs - Allow glusterd to read domains state - Fix initial hypervkvp policy - Add policy for hypervkvpd - Fix redis.if summary- Allow boinc to connect to @/tmp/.X11-unix/X0 - Allow beam.smp to connect to tcp/5984 - Allow named to manage own log files - Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t - Add virt_transition_userdomain boolean decl - Allow httpd_t to sendto unix_dgram sockets on its children - Allow nova domains to execute ifconfig - bluetooth wants to create fifo_files in /tmp - exim needs to be able to manage mailman data - Allow sysstat to getattr on all file systems - Looks like bluetoothd has moved - Allow collectd to send ping packets - Allow svirt_lxc domains to getpgid - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff - Allow frpintd_t to read /dev/urandom - Allow asterisk_t to create sock_file in /var/run - Allow usbmuxd to use netlink_kobject - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket - More cleanup of svirt_lxc policy - virtd_lxc_t now talks to dbus - Dontaudit leaked ptmx_t - Allow processes to use inherited fifo files - Allow openvpn_t to connect to squid ports - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert() - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files - Allow user roles to connect to the journal socket- selinux_set_enforce_mode needs to be used with type - Add append to the dontaudit for unix_stream_socket of xdm_t leak - Allow xdm_t to create symlinks in log direcotries - Allow login programs to read afs config - Label 10933 as a pop port, for dovecot - New policy to allow selinux_server.py to run as semanage_t as a dbus service - Add fixes to make netlabelctl working on MLS - AVCs required for running sepolicy gui as staff_t - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC - New dbus server to be used with new gui - After modifying some files in /etc/mail, I saw this needed on the next boot - Loading a vm from /usr/tmp with virt-manager - Clean up oracleasm policy for Fedora - Add oracleasm policy written by rlopez@redhat.com - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache - Add label for /var/crash - Allow fenced to domtrans to sanclok_t - Allow nagios to manage nagios spool files - Make tfptd as home_manager - Allow kdump to read kcore on MLS system - Allow mysqld-safe sys_nice/sys_resource caps - Allow apache to search automount tmp dirs if http_use_nfs is enabled - Allow crond to transition to named_t, for use with unbound - Allow crond to look at named_conf_t, for unbound - Allow mozilla_plugin_t to transition its home content - Allow dovecot_domain to read all system and network state - Allow httpd_user_script_t to call getpw - Allow semanage to read pid files - Dontaudit leaked file descriptors from user domain into thumb - Make PAM authentication working if it is enabled in ejabberd - Add fixes for rabbit to fix ##992920,#992931 - Allow glusterd to mount filesystems - Loading a vm from /usr/tmp with virt-manager - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device - Add fix for pand service - shorewall touches own log - Allow nrpe to list /var - Mozilla_plugin_roles can not be passed into lpd_run_lpr - Allow afs domains to read afs_config files - Allow login programs to read afs config - Allow virt_domain to read virt_var_run_t symlinks - Allow smokeping to send its process signals - Allow fetchmail to setuid - Add kdump_manage_crash() interface - Allow abrt domain to write abrt.socket- Add more aliases in pegasus.te - Add more fixes for *_admin interfaces - Add interface fixes - Allow nscd to stream connect to nmbd - Allow gnupg apps to write to pcscd socket - Add more fixes for openlmi provides. Fix naming and support for additionals - Allow fetchmail to resolve host names - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te - Fix corecmd_exec_chroot() - Fix logging_relabel_syslog_pid_socket interface - Fix typo in unconfineduser.te - Allow system_r to access unconfined_dbusd_t to run hp_chec- Allow xdm_t to act as a dbus client to itsel - Allow fetchmail to resolve host names - Allow gnupg apps to write to pcscd socket - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te -httpd_t does access_check on certs- Add support for cmpiLMI_Service-cimprovagt - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t - Add support for pycmpiLMI_Storage-cimprovagt - Add support for cmpiLMI_Networking-cimprovagt - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working - Allow virtual machines and containers to run as user doains, needed for virt-sandbox - Allow buglist.cgi to read cpu info- Allow systemd-tmpfile to handle tmp content in print spool dir - Allow systemd-sysctl to send system log messages - Add support for RTP media ports and fmpro-internal - Make auditd working if audit is configured to perform SINGLE action on disk error - Add interfaces to handle systemd units - Make systemd-notify working if pcsd is used - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t - Instead of having all unconfined domains get all of the named transition rules, - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default. - Add definition for the salt ports - Allow xdm_t to create link files in xdm_var_run_t - Dontaudit reads of blk files or chr files leaked into ldconfig_t - Allow sys_chroot for useradd_t - Allow net_raw cap for ipsec_t - Allow sysadm_t to reload services - Add additional fixes to make strongswan working with a simple conf - Allow sysadm_t to enable/disable init_t services - Add additional glusterd perms - Allow apache to read lnk files in the /mnt directory - Allow glusterd to ask the kernel to load a module - Fix description of ftpd_use_fusefs boolean - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t - Allow glusterds to request load a kernel module - Allow boinc to stream connect to xserver_t - Allow sblim domains to read /etc/passwd - Allow mdadm to read usb devices - Allow collectd to use ping plugin - Make foghorn working with SNMP - Allow sssd to read ldap certs - Allow haproxy to connect to RTP media ports - Add additional trans rules for aide_db - Add labeling for /usr/lib/pcsd/pcsd - Add labeling for /var/log/pcsd - Add support for pcs which is a corosync and pacemaker configuration tool- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1 - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown - consolekit needs to be able to shut down system - Move around interfaces - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints - Allow gconf-defaults-m to read /etc/passwd - Fix pki_rw_tomcat_cert() interface to support lnk_files- Add support for gluster ports - Make sure that all keys located in /etc/ssh/ are labeled correctly - Make sure apcuspd lock files get created with the correct label - Use getcap in gluster.te - Fix gluster policy - add additional fixes to allow beam.smp to interact with couchdb files - Additional fix for #974149 - Allow gluster to user gluster ports - Allow glusterd to transition to rpcd_t and add additional fixes for #980683 - Allow tgtd working when accessing to the passthrough device - Fix labeling for mdadm unit files- Add mdadm fixes- Fix definition of sandbox.disabled to sandbox.pp.disabled- Allow mdamd to execute systemctl - Allow mdadm to read /dev/kvm - Allow ipsec_mgmt_t to read l2tpd pid content- Allow nsd_t to read /dev/urand - Allow mdadm_t to read framebuffer - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t - Allow mozilla_plugin_config_t to create tmp files - Cleanup openvswitch policy - Allow mozilla plugin to getattr on all executables - Allow l2tpd_t to create fifo_files in /var/run - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory - Allow mdadm to connecto its own unix_stream_socket - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now. - Allow apache to access smokeping pid files - Allow rabbitmq_beam_t to getattr on all filesystems - Add systemd support for iodined - Allow nup_upsdrvctl_t to execute its entrypoint - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch - add labeling for ~/.cache/libvirt-sandbox - Add interface to allow domains transitioned to by confined users to send sigchld to screen program - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs. - Allow staff to getsched all domains, required to run htop - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Add prosody policy written by Michael Scherer - Allow nagios plugins to read /sys info - ntpd needs to manage own log files - Add support for HOME_DIR/.IBMERS - Allow iptables commands to read firewalld config - Allow consolekit_t to read utmp - Fix filename transitions on .razor directory - Add additional fixes to make DSPAM with LDA working - Allow snort to read /etc/passwd - Allow fail2ban to communicate with firewalld over dbus - Dontaudit openshift_cgreoup_file_t read/write leaked dev - Allow nfsd to use mountd port - Call th proper interface - Allow openvswitch to read sys and execute plymouth - Allow tmpwatch to read /var/spool/cups/tmp - Add support for /usr/libexec/telepathy-rakia - Add systemd support for zoneminder - Allow mysql to create files/directories under /var/log/mysql - Allow zoneminder apache scripts to rw zoneminder tmpfs - Allow httpd to manage zoneminder lib files - Add zoneminder_run_sudo boolean to allow to start zoneminder - Allow zoneminder to send mails - gssproxy_t sock_file can be under /var/lib - Allow web domains to connect to whois port. - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t. - We really need to add an interface to corenet to define what a web_client_domain is and - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain. - Add labeling for cmpiLMI_LogicalFile-cimprovagt - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules - Update policy rules for pegasus_openlmi_logicalfile_t - Add initial types for logicalfile/unconfined OpenLMI providers - mailmanctl needs to read own log - Allow logwatch manage own lock files - Allow nrpe to read meminfo - Allow httpd to read certs located in pki-ca - Add pki_read_tomcat_cert() interface - Add support for nagios openshift plugins - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab- Make DSPAM to act as a LDA working - Allow ntop to create netlink socket - Allow policykit to send a signal to policykit-auth - Allow stapserver to dbus chat with avahi/systemd-logind - Fix labeling on haproxy unit file - Clean up haproxy policy - A new policy for haproxy and placed it to rhcs.te - Add support for ldirectord and treat it with cluster_t - Make sure anaconda log dir is created with var_log_t- Allow lvm_t to create default targets for filesystem handling - Fix labeling for razor-lightdm binaries - Allow insmod_t to read any file labeled var_lib_t - Add policy for pesign - Activate policy for cmpiLMI_Account-cimprovagt - Allow isnsd syscall=listen - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler - Allow ctdbd to use udp/4379 - gatherd wants sys_nice and setsched - Add support for texlive2012 - Allow NM to read file_t (usb stick with no labels used to transfer keys for example) - Allow cobbler to execute apache with domain transition- condor_collector uses tcp/9000 - Label /usr/sbin/virtlockd as virtd_exec_t for now - Allow cobbler to execute ldconfig - Allow NM to execute ssh - Allow mdadm to read /dev/crash - Allow antivirus domains to connect to snmp port - Make amavisd-snmp working correctly - Allow nfsd_t to mounton nfsd_fs_t - Add initial snapper policy - We still need to have consolekit policy - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow dirsrv to read network state - Fix pki_read_tomcat_lib_files - Add labeling for /usr/libexec/nm-ssh-service - Add label cert_t for /var/lib/ipa/pki-ca/publish - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant - Allow nfsd_t to mounton nfsd_fs_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow passwd_t to change role to system_r from unconfined_r- Don't audit access checks by sandbox xserver on xdb var_lib - Allow ntop to read usbmon devices - Add labeling for new polcykit authorizor - Dontaudit access checks from fail2ban_client - Don't audit access checks by sandbox xserver on xdb var_lib - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream - Fix labeling for all /usr/bim/razor-lightdm-* binaries - Add filename trans for /dev/md126p1- Make vdagent able to request loading kernel module - Add support for cloud-init make it as unconfined domain - Allow snmpd to run smartctl in fsadm_t domain - remove duplicate openshift_search_lib() interface - Allow mysqld to search openshift lib files - Allow openshift cgroup to interact with passedin file descriptors - Allow colord to list directories inthe users homedir - aide executes prelink to check files - Make sure cupsd_t creates content in /etc/cups with the correct label - Lest dontaudit apache read all domains, so passenger will not cause this avc - Allow gssd to connect to gssproxy - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS - Allow systemd-tmpfiles to relabel also lock files - Allow useradd to add homdir in /var/lib/openshift - Allow setfiles and semanage to write output to /run/files- Add labeling for /dev/tgt - Dontaudit leak fd from firewalld for modprobe - Allow runuser running as rpm_script_t to create netlink_audit socket - Allow mdadm to read BIOS non-volatile RAM- accountservice watches when accounts come and go in wtmp - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket - Add httpd_use_sasl boolean - Allow net_admin for tuned_t - iscsid needs sys_module to auto-load kernel modules - Allow blueman to read bluetooth conf - Add nova_manage_lib_files() interface - Fix mplayer_filetrans_home_content() - Add mplayer_filetrans_home_content() - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t - Revert "Allow thumb_t to append inherited xdm stream socket" - Add iscsi_filetrans_named_content() interface - Allow to create .mplayer with the correct labeling for unconfined - Allow iscsiadmin to create lock file with the correct labeling- Allow wine to manage wine home content - Make amanda working with socket actiovation - Add labeling for /usr/sbin/iscsiadm - Add support for /var/run/gssproxy.sock - dnsmasq_t needs to read sysctl_net_t- Fix courier_domain_template() interface - Allow blueman to write ip_forward - Allow mongodb to connect to mongodb port - Allow mongodb to connect to mongodb port - Allow java to bind jobss_debug port - Fixes for *_admin interfaces - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality - Need to assign attribute for courier_domain to all courier_domains - Fail2ban reads /etc/passwd - postfix_virtual will create new files in postfix_spool_t - abrt triggers sys_ptrace by running pidof - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it - Add passenger fixes needed by foreman - Remove dup interfaces - Add additional interfaces for quantum - Add new interfaces for dnsmasq - Allow passenger to read localization and send signull to itself - Allow dnsmasq to stream connect to quantum - Add quantum_stream_connect() - Make sure that mcollective starts the service with the correct labeling - Add labels for ~/.manpath - Dontaudit attempts by svirt_t to getpw* calls - sandbox domains are trying to look at parent process data - Allow courior auth to create its pid file in /var/spool/courier subdir - Add fixes for beam to have it working with couchdb - Add labeling for /run/nm-xl2tpd.con - Allow apache to stream connect to thin - Add systemd support for amand - Make public types usable for fs mount points - Call correct mandb interface in domain.te - Allow iptables to r/w quantum inherited pipes and send sigchld - Allow ifconfig domtrans to iptables and execute ldconfig - Add labels for ~/.manpath - Allow systemd to read iscsi lib files - seunshare is trying to look at parent process data- Fix openshift_search_lib - Add support for abrt-uefioops-oops - Allow colord to getattr any file system - Allow chrome processes to look at each other - Allow sys_ptrace for abrt_t - Add new policy for gssproxy - Dontaudit leaked file descriptor writes from firewalld - openshift_net_type is interface not template - Dontaudit pppd to search gnome config - Update openshift_search_lib() interface - Add fs_list_pstorefs() - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18 - Better labels for raspberry pi devices - Allow init to create devpts_t directory - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18 - Allow sysadm_t to build kernels - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18 - Allow userdomains to stream connect to gssproxy - Dontaudit leaked file descriptor writes from firewalld - Allow xserver to read /dev/urandom - Add additional fixes for ipsec-mgmt - Make SSHing into an Openshift Enterprise Node working- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime - with the proper label. - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files - Allow systemd-timedated to create adjtime - Add clock_create_adjtime() - Additional fix ifconfing for #966106 - Allow kernel_t to create boot.log with correct labeling - Remove unconfined_mplayer for which we don't have rules - Rename interfaces - Add userdom_manage_user_home_files/dirs interfaces - Fix files_dontaudit_read_all_non_security_files - Fix ipsec_manage_key_file() - Fix ipsec_filetrans_key_file() - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t - Fix labeling for ipse.secrets - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid - Add files_dontaudit_read_all_non_security_files() interface - /var/log/syslog-ng should be labeled var_log_t - Make ifconfig_var_run_t a mountpoint - Add transition from ifconfig to dnsmasq - Allow ifconfig to execute bin_t/shell_exec_t - We want to have hwdb.bin labeled as etc_t - update logging_filetrans_named_content() interface - Allow systemd_timedate_t to manage /etc/adjtime - Allow NM to send signals to l2tpd - Update antivirus_can_scan_system boolean - Allow devicekit_disk_t to sys_config_tty - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories - Make printing from vmware working - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes - Add virt_qemu_ga_data_t for qemu-ga - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both - Fix typo in virt.te - Add virt_qemu_ga_unconfined_t for hook scripts - Make sure NetworkManager files get created with the correct label - Add mozilla_plugin_use_gps boolean - Fix cyrus to have support for net-snmp - Additional fixes for dnsmasq and quantum for #966106 - Add plymouthd_create_log() - remove httpd_use_oddjob for which we don't have rules - Add missing rules for httpd_can_network_connect_cobbler - Add missing cluster_use_execmem boolean - Call userdom_manage_all_user_home_type_files/dirs - Additional fix for ftp_home_dir - Fix ftp_home_dir boolean - Allow squit to recv/send client squid packet - Fix nut.te to have nut_domain attribute - Add support for ejabberd; TODO: revisit jabberd and rabbit policy - Fix amanda policy - Add more fixes for domains which use libusb - Make domains which use libusb working correctly - Allow l2tpd to create ipsec key files with correct labeling and manage them - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files - Allow rabbitmq-beam to bind generic node - Allow l2tpd to read ipse-mgmt pid files - more fixes for l2tpd, NM and pppd from #967072- Dontaudit to getattr on dirs for dovecot-deliver - Allow raiudusd server connect to postgresql socket - Add kerberos support for radiusd - Allow saslauthd to connect to ldap port - Allow postfix to manage postfix_private_t files - Add chronyd support for #965457 - Fix labeling for HOME_DIR/\.icedtea - CHange squid and snmpd to be allowed also write own logs - Fix labeling for /usr/libexec/qemu-ga - Allow virtd_t to use virt_lock_t - Allow also sealert to read the policy from the kernel - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content - Dontaudit listing of users homedir by sendmail Seems like a leak - Allow passenger to transition to puppet master - Allow apache to connect to mythtv - Add definition for mythtv ports- Add additional fixes for #948073 bug - Allow sge_execd_t to also connect to sge ports - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files - Add networkmanager_stream_connect() - Make gnome-abrt wokring with staff_t - Fix openshift_manage_lib_files() interface - mdadm runs ps command which seems to getattr on random log files - Allow mozilla_plugin_t to create pulseaudit_home_t directories - Allow qemu-ga to shutdown virtual hosts - Add labelling for cupsd-browsed - Add web browser plugins to connect to aol ports - Allow nm-dhcp-helper to stream connect to NM - Add port definition for sge ports- Make sure users and unconfined domains create .hushlogin with the correct label - Allow pegaus to chat with realmd over DBus - Allow cobblerd to read network state - Allow boicn-client to stat on /dev/input/mice - Allow certwatch to read net_config_t when it executes apache - Allow readahead to create /run/systemd and then create its own directory with the correct label- Transition directories and files when in a user_tmp_t directory - Change certwatch to domtrans to apache instead of just execute - Allow virsh_t to read xen lib files - update policy rules for pegasus_openlmi_account_t - Add support for svnserve_tmp_t - Activate account openlmi policy - pegasus_openlmi_domain_template needs also require pegasus_t - One more fix for policykit.te - Call fs_list_cgroups_dirs() in policykit.te - Allow nagios service plugin to read mysql config files - Add labeling for /var/svn - Fix chrome.te - Fix pegasus_openlmi_domain_template() interfaces - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks - Fix location of google-chrome data - Add support for chome_sandbox to store content in the homedir - Allow policykit to watch for changes in cgroups file system - Add boolean to allow mozilla_plugin_t to use spice - Allow collectd to bind to udp port - Allow collected_t to read all of /proc - Should use netlink socket_perms - Should use netlink socket_perms - Allow glance domains to connect to apache ports - Allow apcupsd_t to manage its log files - Allow chrome objects to rw_inherited unix_stream_socket from callers - Allow staff_t to execute virtd_exec_t for running vms - nfsd_t needs to bind mountd port to make nfs-mountd.service working - Allow unbound net_admin capability because of setsockopt syscall - Fix fs_list_cgroup_dirs() - Label /usr/lib/nagios/plugins/utils.pm as bin_t - Remove uplicate definition of fs_read_cgroup_files() - Remove duplicate definition of fs_read_cgroup_files() - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd - Additional interfaces needed to list and read cgroups config - Add port definition for collectd port - Add labels for /dev/ptp* - Allow staff_t to execute virtd_exec_t for running vms- Allow samba-net to also read realmd tmp files - Allow NUT to use serial ports - realmd can be started by systemctl now- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid - Allow virsh to read xen lock file - Allow qemu-ga to create files in /run with proper labeling - Allow glusterd to connect to own socket in /tmp - Allow glance-api to connect to http port to make glance image-create working - Allow keystonte_t to execute rpm- Fix realmd cache interfaces- Allow tcpd to execute leafnode - Allow samba-net to read realmd cache files - Dontaudit sys_tty_config for alsactl - Fix allow rules for postfix_var_run - Allow cobblerd to read /etc/passwd - Allow pegasus to read exports - Allow systemd-timedate to read xdm state - Allow mout to stream connect to rpcbind - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki- Allow thumbnails to share memory with apps which run thumbnails - Allow postfix-postqueue block_suspend - Add lib interfaces for smsd - Add support for nginx - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t - Allow pki apache domain to create own tmp files and execute httpd_suexec - Allow procmail to manger user tmp files/dirs/lnk_files - Add virt_stream_connect_svirt() interface - Allow dovecot-auth to execute bin_t - Allow iscsid to request that kernel load a kernel module - Add labeling support for /var/lib/mod_security - Allow iw running as tuned_t to create netlink socket - Dontaudit sys_tty_config for thumb_t - Add labeling for nm-l2tp-service - Allow httpd running as certwatch_t to open tcp socket - Allow useradd to manager smsd lib files - Allow useradd_t to add homedirs in /var/lib - Fix typo in userdomain.te - Cleanup userdom_read_home_certs - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t - Allow staff to stream connect to svirt_t to make gnome-boxes working- Allow lvm to create its own unit files - Label /var/lib/sepolgen as selinux_config_t - Add filetrans rules for tw devices - Add transition from cupsd_config_t to cupsd_t- Add filetrans rules for tw devices - Cleanup bad transition lines- Fix lockdev_manage_files() - Allow setroubleshootd to read var_lib_t to make email_alert working - Add lockdev_manage_files() - Call proper interface in virt.te - Allow gkeyring_domain to create /var/run/UID/config/dbus file - system dbus seems to be blocking suspend - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need - When you enter a container from root, you generate avcs with a leaked file descriptor - Allow mpd getattr on file system directories - Make sure realmd creates content with the correct label - Allow systemd-tty-ask to write kmsg - Allow mgetty to use lockdev library for device locking - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music - When you enter a container from root, you generate avcs with a leaked file descriptor - Make sure init.fc files are labeled correctly at creation - File name trans vconsole.conf - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow certmonger to dbus communicate with realmd - Make realmd working- Fix mozilla specification of homedir content - Allow certmonger to read network state - Allow tmpwatch to read tmp in /var/spool/{cups,lpd} - Label all nagios plugin as unconfined by default - Add httpd_serve_cobbler_files() - Allow mdadm to read /dev/sr0 and create tmp files - Allow certwatch to send mails - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow realmd to run ipa, really needs to be an unconfined_domain - Allow sandbox domains to use inherted terminals - Allow pscd to use devices labeled svirt_image_t in order to use cat cards. - Add label for new alsa pid - Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition - Add support for sshd_unit_file_t - Add oracleasmfs_t - Allow unlabeled_t files to be stored on unlabeled_t filesystems- Fix description of deny_ptrace boolean - Remove allow for execmod lib_t for now - Allow quantum to connect to keystone port - Allow nova-console to talk with mysql over unix stream socket - Allow dirsrv to stream connect to uuidd - thumb_t needs to be able to create ~/.cache if it does not exist - virtd needs to be able to sys_ptrace when starting and stoping containers- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms... - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets - Fix deny_ptrace boolean, certain ptrace leaked into the system - Allow winbind to manage kerberos_rcache_host - Allow spamd to create spamd_var_lib_t directories - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs - Fix vmware_role() interface - Fix cobbler_manage_lib_files() interface - Allow nagios check disk plugins to execute bin_t - Allow quantum to transition to openvswitch_t - Allow postdrop to stream connect to postfix-master - Allow quantum to stream connect to openvswitch - Add xserver_dontaudit_xdm_rw_stream_sockets() interface - Allow daemon to send dgrams to initrc_t - Allow kdm to start the power service to initiate a reboot or poweroff- Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Don't audit attempts to write to stream socket of nscld by thumbnailers - Allow git_system_t to read network state - Allow pegasas to execute mount command - Fix desc for drdb_admin - Fix condor_amin() - Interface fixes for uptime, vdagent, vnstatd - Fix labeling for moodle in /var/www/moodle/data - Add interface fixes - Allow bugzilla to read certs - /var/www/moodle needs to be writable by apache - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Fix sys_nice for cups_domain - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Kernel_t needs mac_admin in order to support labeled NFS - Fix systemd_dontaudit_dbus_chat() interface - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Allow consolehelper domain to write Xauth files in /root - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Allow consolehelper more access discovered by Tom London - Allow fsdaemon to send signull to all domain - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Fix file_contexts.subs to label /run/lock correctly- Try to label on controlC devices up to 30 correctly - Add mount_rw_pid_files() interface - Add additional mount/umount interfaces needed by mock - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk - Fix tabs - Allow initrc_domain to search rgmanager lib files - Add more fixes which make mock working together with confined users * Allow mock_t to manage rpm files * Allow mock_t to read rpm log files * Allow mock to setattr on tmpfs, devpts * Allow mount/umount filesystems - Add rpm_read_log() interface - yum-cron runs rpm from within it. - Allow tuned to transition to dmidecode - Allow firewalld to do net_admin - Allow mock to unmont tmpfs_t - Fix virt_sigkill() interface - Add additional fixes for mock. Mainly caused by mount running in mock_t - Allow mock to write sysfs_t and mount pid files - Add mailman_domain to mailman_template() - Allow openvswitch to execute shell - Allow qpidd to use kerberos - Allow mailman to use fusefs, needs back port to RHEL6 - Allow apache and its scripts to use anon_inodefs - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7 - Realmd needs to connect to samba ports, needs back port to F18 also - Allow colord to read /run/initial-setup- - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock - Add virt_kill() interface - Add rgmanager_search_lib() interface - Allow wdmd to getattr on all filesystems. Back ported from RHEL6- Allow realmd to create tmp files - FIx ircssi_home_t type to irssi_home_t - Allow adcli running as realmd_t to connect to ldap port - Allow NetworkManager to transition to ipsec_t, for running strongswan - Make openshift_initrc_t an lxc_domain - Allow gssd to manage user_tmp_t files - Fix handling of irclogs in users homedir - Fix labeling for drupal an wp-content in subdirs of /var/www/html - Allow abrt to read utmp_t file - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6 - fix labeling for (oo|rhc)-restorer-wrapper.sh - firewalld needs to be able to write to network sysctls - Fix mozilla_plugin_dontaudit_rw_sem() interface - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains - Add mozilla_plugin_dontaudit_rw_sem() interface - Allow svirt_lxc_t to transition to openshift domains - Allow condor domains block_suspend and dac_override caps - Allow condor_master to read passd - Allow condor_master to read system state - Allow NetworkManager to transition to ipsec_t, for running strongswan - Lots of access required by lvm_t to created encrypted usb device - Allow xdm_t to dbus communicate with systemd_localed_t - Label strongswan content as ipsec_exec_mgmt_t for now - Allow users to dbus chat with systemd_localed - Fix handling of .xsession-errors in xserver.if, so kde will work - Might be a bug but we are seeing avc's about people status on init_t:service - Make sure we label content under /var/run/lock as <> - Allow daemon and systemprocesses to search init_var_run_t directory - Add boolean to allow xdm to write xauth data to the home directory - Allow mount to write keys for the unconfined domain - Add unconfined_write_keys() interface- Add labeling for /usr/share/pki - Allow programs that read var_run_t symlinks also read var_t symlinks - Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports - Fix labeling for /etc/dhcp directory - add missing systemd_stub_unit_file() interface - Add files_stub_var() interface - Add lables for cert_t directories - Make localectl set-x11-keymap working at all - Allow abrt to manage mock build environments to catch build problems. - Allow virt_domains to setsched for running gdb on itself - Allow thumb_t to execute user home content - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000 - Allow certwatch to execut /usr/bin/httpd - Allow cgred to send signal perms to itself, needs back port to RHEL6 - Allow openshift_cron_t to look at quota - Allow cups_t to read inhered tmpfs_t from the kernel - Allow yppasswdd to use NIS - Tuned wants sys_rawio capability - Add ftpd_use_fusefs boolean - Allow dirsrvadmin_t to signal itself- Allow localectl to read /etc/X11/xorg.conf.d directory - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors"" - Allow mount to transition to systemd_passwd_agent - Make sure abrt directories are labeled correctly - Allow commands that are going to read mount pid files to search mount_var_run_t - label /usr/bin/repoquery as rpm_exec_t - Allow automount to block suspend - Add abrt_filetrans_named_content so that abrt directories get labeled correctly - Allow virt domains to setrlimit and read file_context- Allow nagios to manage nagios spool files - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6 - Add swift_alias.* policy files which contain typealiases for swift types - Add support for /run/lock/opencryptoki - Allow pkcsslotd chown capability - Allow pkcsslotd to read passwd - Add rsync_stub() interface - Allow systemd_timedate also manage gnome config homedirs - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t - Fix filetrans rules for kdm creates .xsession-errors - Allow sytemd_tmpfiles to create wtmp file - Really should not label content under /var/lock, since it could have labels on it different from var_lock_t - Allow systemd to list all file system directories - Add some basic stub interfaces which will be used in PRODUCT policies- Fix log transition rule for cluster domains - Start to group all cluster log together - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update - cups uses usbtty_device_t devices - These fixes were all required to build a MLS virtual Machine with single level desktops - Allow domains to transiton using httpd_exec_t - Allow svirt domains to manage kernel key rings - Allow setroubleshoot to execute ldconfig - Allow firewalld to read generate gnome data - Allow bluetooth to read machine-info - Allow boinc domain to send signal to itself - Fix gnome_filetrans_home_content() interface - Allow mozilla_plugins to list apache modules, for use with gxine - Fix labels for POkemon in the users homedir - Allow xguest to read mdstat - Dontaudit virt_domains getattr on /dev/* - These fixes were all required to build a MLS virtual Machine with single level desktops - Need to back port this to RHEL6 for openshift - Add tcp/8891 as milter port - Allow nsswitch domains to read sssd_var_lib_t files - Allow ping to read network state. - Fix typo - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them- Adopt swift changes from lhh@redhat.com - Add rhcs_manage_cluster_pid_files() interface - Allow screen domains to configure tty and setup sock_file in ~/.screen directory - ALlow setroubleshoot to read default_context_t, needed to backport to F18 - Label /etc/owncloud as being an apache writable directory - Allow sshd to stream connect to an lxc domain- Allow postgresql to manage rgmanager pid files - Allow postgresql to read ccs data - Allow systemd_domain to send dbus messages to policykit - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them - All systemd domains that create content are reading the file_context file and setfscreate - Systemd domains need to search through init_var_run_t - Allow sshd to communicate with libvirt to set containers labels - Add interface to manage pid files - Allow NetworkManger_t to read /etc/hostname - Dontaudit leaked locked files into openshift_domains - Add fixes for oo-cgroup-read - it nows creates tmp files - Allow gluster to manage all directories as well as files - Dontaudit chrome_sandbox_nacl_t using user terminals - Allow sysstat to manage its own log files - Allow virtual machines to setrlimit and send itself signals. - Add labeling for /var/run/hplip- Fix POSTIN scriptlet- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp- Fix authconfig.py labeling - Make any domains that write homedir content do it correctly - Allow glusterd to read/write anyhwere on the file system by default - Be a little more liberal with the rsync log files - Fix iscsi_admin interface - Allow iscsid_t to read /dev/urand - Fix up iscsi domain for use with unit files - Add filename transition support for spamassassin policy - Allow web plugins to use badly formated libraries - Allow nmbd_t to create samba_var_t directories - Add filename transition support for spamassassin policy - Add filename transition support for tvtime - Fix alsa_home_filetrans_alsa_home() interface - Move all userdom_filetrans_home_content() calling out of booleans - Allow logrotote to getattr on all file sytems - Remove duplicate userdom_filetrans_home_content() calling - Allow kadmind to read /etc/passwd - Dontaudit append .xsession-errors file on ecryptfs for policykit-auth - Allow antivirus domain to manage antivirus db links - Allow logrotate to read /sys - Allow mandb to setattr on man dirs - Remove mozilla_plugin_enable_homedirs boolean - Fix ftp_home_dir boolean - homedir mozilla filetrans has been moved to userdom_home_manager - homedir telepathy filetrans has been moved to userdom_home_manager - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd() - Might want to eventually write a daemon on fusefsd. - Add policy fixes for sshd [net] child from plautrba@redhat.com - Tor uses a new port - Remove bin_t for authconfig.py - Fix so only one call to userdom_home_file_trans - Allow home_manager_types to create content with the correctl label - Fix all domains that write data into the homedir to do it with the correct label - Change the postgresql to use proper boolean names, which is causing httpd_t to - not get access to postgresql_var_run_t - Hostname needs to send syslog messages - Localectl needs to be able to send dbus signals to users - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default - Allow user_home_manger domains to create spam* homedir content with correct labeling - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working - Declare userdom_filetrans_type attribute - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute - fusefsd is mounding a fuse file system on /run/user/UID/gvfs- Man pages are now generated in the build process - Allow cgred to list inotifyfs filesystem- Allow gluster to get attrs on all fs - New access required for virt-sandbox - Allow dnsmasq to execute bin_t - Allow dnsmasq to create content in /var/run/NetworkManager - Fix openshift_initrc_signal() interface - Dontaudit openshift domains doing getattr on other domains - Allow consolehelper domain to communicate with session bus - Mock should not be transitioning to any other domains, we should keep mock_t as mock_t - Update virt_qemu_ga_t policy - Allow authconfig running from realmd to restart oddjob service - Add systemd support for oddjob - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd - Add labeling for gnashpluginrc - Allow chrome_nacl to execute /dev/zero - Allow condor domains to read /proc - mozilla_plugin_t will getattr on /core if firefox crashes - Allow condor domains to read /etc/passwd - Allow dnsmasq to execute shell scripts, openstack requires this access - Fix glusterd labeling - Allow virtd_t to interact with the socket type - Allow nmbd_t to override dac if you turned on sharing all files - Allow tuned to created kobject_uevent socket - Allow guest user to run fusermount - Allow openshift to read /proc and locale - Allow realmd to dbus chat with rpm - Add new interface for virt - Remove depracated interfaces - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t - Remove some more unconfined_t process transitions, that I don't believe are necessary - Stop transitioning uncofnined_t to checkpc - dmraid creates /var/lock/dmraid - Allow systemd_localed to creatre unix_dgram_sockets - Allow systemd_localed to write kernel messages. - Also cleanup systemd definition a little. - Fix userdom_restricted_xwindows_user_template() interface - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t - User accounts need to dbus chat with accountsd daemon - Gnome requires all users to be able to read /proc/1/- virsh now does a setexeccon call - Additional rules required by openshift domains - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work - Allow spamd_update_t to search spamc_home_t - Avcs discovered by mounting an isci device under /mnt - Allow lspci running as logrotate to read pci.ids - Additional fix for networkmanager_read_pid_files() - Fix networkmanager_read_pid_files() interface - Allow all svirt domains to connect to svirt_socket_t - Allow virsh to set SELinux context for a process. - Allow tuned to create netlink_kobject_uevent_socket - Allow systemd-timestamp to set SELinux context - Add support for /var/lib/systemd/linger - Fix ssh_sysadm_login to be working on MLS as expected- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file - Add missing files_rw_inherited_tmp_files interface - Add additional interface for ecryptfs - ALlow nova-cert to connect to postgresql - Allow keystone to connect to postgresql - Allow all cups domains to getattr on filesystems - Allow pppd to send signull - Allow tuned to execute ldconfig - Allow gpg to read fips_enabled - Add additional fixes for ecryptfs - Allow httpd to work with posgresql - Allow keystone getsched and setsched- Allow gpg to read fips_enabled - Add support for /var/cache/realmd - Add support for /usr/sbin/blazer_usb and systemd support for nut - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t - bitlbee wants to read own log file - Allow glance domain to send a signal itself - Allow xend_t to request that the kernel load a kernel module - Allow pacemaker to execute heartbeat lib files - cleanup new swift policy- Fix smartmontools - Fix userdom_restricted_xwindows_user_template() interface - Add xserver_xdm_ioctl_log() interface - Allow Xusers to ioctl lxdm.log to make lxdm working - Add MLS fixes to make MLS boot/log-in working - Add mls_socket_write_all_levels() also for syslogd - fsck.xfs needs to read passwd - Fix ntp_filetrans_named_content calling in init.te - Allow postgresql to create pg_log dir - Allow sshd to read rsync_data_t to make rsync working - Change ntp.conf to be labeled net_conf_t - Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it - Allow xdm_t to execute gstreamer home content - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp - New policy for openstack swift domains - More access required for openshift_cron_t - Use cupsd_log_t instead of cupsd_var_log_t - rpm_script_roles should be used in rpm_run - Fix rpm_run() interface - Fix openshift_initrc_run() - Fix sssd_dontaudit_stream_connect() interface - Fix sssd_dontaudit_stream_connect() interface - Allow LDA's job to deliver mail to the mailbox - dontaudit block_suspend for mozilla_plugin_t - Allow l2tpd_t to all signal perms - Allow uuidgen to read /dev/random - Allow mozilla-plugin-config to read power_supply info - Implement cups_domain attribute for cups domains - We now need access to user terminals since we start by executing a command outside the tty - We now need access to user terminals since we start by executing a command outside the tty - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen - Add containment of openshift cron jobs - Allow system cron jobs to create tmp directories - Make userhelp_conf_t a config file - Change rpm to use rpm_script_roles - More fixes for rsync to make rsync wokring - Allow logwatch to domtrans to mdadm - Allow pacemaker to domtrans to ifconfig - Allow pacemaker to setattr on corosync.log - Add pacemaker_use_execmem for memcheck-amd64 command - Allow block_suspend capability - Allow create fifo_file in /tmp with pacemaker_tmp_t - Allow systat to getattr on fixed disk - Relabel /etc/ntp.conf to be net_conf_t - ntp_admin should create files in /etc with the correct label - Add interface to create ntp_conf_t files in /etc - Add additional labeling for quantum - Allow quantum to execute dnsmasq with transition- boinc_cliean wants also execmem as boinc projecs have - Allow sa-update to search admin home for /root/.spamassassin - Allow sa-update to search admin home for /root/.spamassassin - Allow antivirus domain to read net sysctl - Dontaudit attempts from thumb_t to connect to ssd - Dontaudit attempts by readahead to read sock_files - Dontaudit attempts by readahead to read sock_files - Create tmpfs file while running as wine as user_tmpfs_t - Dontaudit attempts by readahead to read sock_files - libmpg ships badly created librarie- Change ssh_use_pts to use macro and only inherited sshd_devpts_t - Allow confined users to read systemd_logind seat information - libmpg ships badly created libraries - Add support for strongswan.service - Add labeling for strongswan - Allow l2tpd_t to read network manager content in /run directory - Allow rsync to getattr any file in rsync_data_t - Add labeling and filename transition for .grl-podcasts- mount.glusterfs executes glusterfsd binary - Allow systemd_hostnamed_t to stream connect to systemd - Dontaudit any user doing a access check - Allow obex-data-server to request the kernel to load a module - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info) - Allow gpg-agent to read /proc/sys/crypto/fips_enabled - Add new types for antivirus.pp policy module - Allow gnomesystemmm_t caps because of ioprio_set - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t - Allow gnomesystemmm_t caps because of ioprio_set - Allow NM rawip socket - files_relabel_non_security_files can not be used with boolean - Add interface to thumb_t dbus_chat to allow it to read remote process state - ALlow logrotate to domtrans to mdadm_t - kde gnomeclock wants to write content to /tmp- kde gnomeclock wants to write content to /tmp - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde - Allow blueman_t to rwx zero_device_t, for some kind of jre - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre - Ftp full access should be allowed to create directories as well as files - Add boolean to allow rsync_full_acces, so that an rsync server can write all - over the local machine - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6 - Add missing vpnc_roles type line - Allow stapserver to write content in /tmp - Allow gnome keyring to create keyrings dir in ~/.local/share - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Add interface to colord_t dbus_chat to allow it to read remote process state - Allow colord_t to read cupsd_t state - Add mate-thumbnail-font as thumnailer - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data. - Allow qpidd to list /tmp. Needed by ssl - Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18 - - Added systemd support for ksmtuned - Added booleans ksmtuned_use_nfs ksmtuned_use_cifs - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow - Looks like qpidd_t needs to read /dev/random - Lots of probing avc's caused by execugting gpg from staff_t - Dontaudit senmail triggering a net_admin avc - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port - Logwatch does access check on mdadm binary - Add raid_access_check_mdadm() iterface- Fix systemd_manage_unit_symlinks() interface - Call systemd_manage_unit_symlinks(() which is correct interface - Add filename transition for opasswd - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow sytstemd-timedated to get status of init_t - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow gpg_t to manage all gnome files - Stop using pcscd_read_pub_files - New rules for xguest, dontaudit attempts to dbus chat - Allow firewalld to create its mmap files in tmpfs and tmp directories - Allow firewalld to create its mmap files in tmpfs and tmp directories - run unbound-chkconf as named_t, so it can read dnssec - Colord is reading xdm process state, probably reads state of any apps that sends dbus message - Allow mdadm_t to change the kernel scheduler - mythtv policy - Update mandb_admin() interface - Allow dsspam to listen on own tpc_socket - seutil_filetrans_named_content needs to be optional - Allow sysadm_t to execute content in his homedir - Add attach_queue to tun_socket, new patch from Paul Moore - Change most of selinux configuration types to security_file_type. - Add filename transition rules for selinux configuration - ssh into a box with -X -Y requires ssh_use_ptys - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated - New allow rules found by Tom London for systemd_hostnamed- Allow systemd-tmpfiles to relabel lpd spool files - Ad labeling for texlive bash scripts - Add xserver_filetrans_fonts_cache_home_content() interface - Remove duplicate rules from *.te - Add support for /var/lock/man-db.lock - Add support for /var/tmp/abrt(/.*)? - Add additional labeling for munin cgi scripts - Allow httpd_t to read munin conf files - Allow certwatch to read meminfo - Fix nscd_dontaudit_write_sock_file() interfac - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling- Allow gnomeclock to talk to puppet over dbus - Allow numad access discovered by Dominic - Add support for HOME_DIR/.maildir - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain - Allow udev to relabel udev_var_run_t lnk_files - New bin_t file in mcelog- Remove all mcs overrides and replace with t1 != mcs_constrained_types - Add attribute_role for iptables - mcs_process_set_categories needs to be called for type - Implement additional role_attribute statements - Sodo domain is attempting to get the additributes of proc_kcore_t - Unbound uses port 8953 - Allow svirt_t images to compromise_kernel when using pci-passthrough - Add label for dns lib files - Bluetooth aquires a dbus name - Remove redundant files_read_usr_file calling - Remove redundant files_read_etc_file calling - Fix mozilla_run_plugin() - Add role_attribute support for more domains- Mass merge with upstream- Bump the policy version to 28 to match selinux userspace - Rebuild versus latest libsepol- Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Add labeling for /var/named/chroot/etc/localtim- Allow setroubleshoot_fixit to execute rpm - zoneminder needs to connect to httpd ports where remote cameras are listening - Allow firewalld to execute content created in /run directory - Allow svirt_t to read generic certs - Dontaudit leaked ps content to mozilla plugin - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - init scripts are creating systemd_unit_file_t directories- systemd_logind_t is looking at all files under /run/user/apache - Allow systemd to manage all user tmp files - Add labeling for /var/named/chroot/etc/localtime - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6 - Keystone is now using a differnt port - Allow xdm_t to use usbmuxd daemon to control sound - Allow passwd daemon to execute gnome_exec_keyringd - Fix chrome_sandbox policy - Add labeling for /var/run/checkquorum-timer - More fixes for the dspam domain, needs back port to RHEL6 - More fixes for the dspam domain, needs back port to RHEL6 - sssd needs to connect to kerberos password port if a user changes his password - Lots of fixes from RHEL testing of dspam web - Allow chrome and mozilla_plugin to create msgq and semaphores - Fixes for dspam cgi scripts - Fixes for dspam cgi scripts - Allow confine users to ptrace screen - Backport virt_qemu_ga_t changes from RHEL - Fix labeling for dspam.cgi needed for RHEL6 - We need to back port this policy to RHEL6, for lxc domains - Dontaudit attempts to set sys_resource of logrotate - Allow corosync to read/write wdmd's tmpfs files - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set - Allow cron jobs to read bind config for unbound - libvirt needs to inhibit systemd - kdumpctl needs to delete boot_t files - Fix duplicate gnome_config_filetrans - virtd_lxc_t is using /dev/fuse - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift - apcupsd can be setup to listen to snmp trafic - Allow transition from kdumpgui to kdumpctl - Add fixes for munin CGI scripts - Allow deltacloud to connect to openstack at the keystone port - Allow domains that transition to svirt domains to be able to signal them - Fix file context of gstreamer in .cache directory - libvirt is communicating with logind - NetworkManager writes to the systemd inhibit pipe- Allow munin disk plugins to get attributes of all directories - Allow munin disk plugins to get attributes of all directorie - Allow logwatch to get attributes of all directories - Fix networkmanager_manage_lib() interface - Fix gnome_manage_config() to allow to manage sock_file - Fix virtual_domain_context - Add support for dynamic DNS for DHCPv6- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch - Add additional labeling for /var/www/openshift/broker - Fix rhev policy - Allow openshift_initrc domain to dbus chat with systemd_logind - Allow httpd to getattr passenger log file if run_stickshift - Allow consolehelper-gtk to connect to xserver - Add labeling for the tmp-inst directory defined in pam_namespace.conf - Add lvm_metadata_t labeling for /etc/multipath- consoletype is no longer used- Add label for efivarfs - Allow certmonger to send signal to itself - Allow plugin-config to read own process status - Add more fixes for pacemaker - apache/drupal can run clamscan on uploaded content - Allow chrome_sandbox_nacl_t to read pid 1 content- Fix MCS Constraints to control ingres and egres controls on the network. - Change name of svirt_nokvm_t to svirt_tcg_t - Allow tuned to request the kernel to load kernel modules- Label /var/lib/pgsql/.ssh as ssh_home_t - Add labeling for /usr/bin/pg_ctl - Allow systemd-logind to manage keyring user tmp dirs - Add support for 7389/tcp port - gems seems to be placed in lots of places - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus - Add back tcp/8123 port as http_cache port - Add ovirt-guest-agent\.pid labeling - Allow xend to run scsi_id - Allow rhsmcertd-worker to read "physical_package_id" - Allow pki_tomcat to connect to ldap port - Allow lpr to read /usr/share/fonts - Allow open file from CD/DVD drive on domU - Allow munin services plugins to talk to SSSD - Allow all samba domains to create samba directory in var_t directories - Take away svirt_t ability to use nsswitch - Dontaudit attempts by openshift to read apache logs - Allow apache to create as well as append _ra_content_t - Dontaudit sendmail_t reading a leaked file descriptor - Add interface to have admin transition /etc/prelink.cache to the proper label - Add sntp support to ntp policy - Allow firewalld to dbus chat with devicekit_power - Allow tuned to call lsblk - Allow tor to read /proc/sys/kernel/random/uuid - Add tor_can_network_relay boolean- Add openshift_initrc_signal() interface - Fix typos - dspam port is treat as spamd_port_t - Allow setroubleshoot to getattr on all executables - Allow tuned to execute profiles scripts in /etc/tuned - Allow apache to create directories to store its log files - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6 - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM - Add filename transition for /etc/tuned/active_profile - Allow condor_master to send mails - Allow condor_master to read submit.cf - Allow condor_master to create /tmp files/dirs - Allow condor_mater to send sigkill to other condor domains - Allow condor_procd sigkill capability - tuned-adm wants to talk with tuned daemon - Allow kadmind and krb5kdc to also list sssd_public_t - Allow accountsd to dbus chat with init - Fix git_read_generic_system_content_files() interface - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler" - Fix mozilla_plugin_can_network_connect to allow to connect to all ports - Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t - dspam wants to search /var/spool for opendkim data - Revert "Add support for tcp/10026 port as dspam_port_t" - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6 - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain - Allow systemd_tmpfiles_t to setattr on mandb_cache_t- consolekit.pp was not removed from the postinstall script- Add back consolekit policy - Silence bootloader trying to use inherited tty - Silence xdm_dbusd_t trying to execute telepathy apps - Fix shutdown avcs when machine has unconfined.pp disabled - The host and a virtual machine can share the same printer on a usb device - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob - Allow abrt_watch_log_t to execute bin_t - Allow chrome sandbox to write content in ~/.config/chromium - Dontaudit setattr on fontconfig dir for thumb_t - Allow lircd to request the kernel to load module - Make rsync as userdom_home_manager - Allow rsync to search automount filesystem - Add fixes for pacemaker- Add support for 4567/tcp port - Random fixes from Tuomo Soini - xdm wants to get init status - Allow programs to run in fips_mode - Add interface to allow the reading of all blk device nodes - Allow init to relabel rpcbind sock_file - Fix labeling for lastlog and faillog related to logrotate - ALlow aeolus_configserver to use TRAM port - Add fixes for aeolus_configserver - Allow snmpd to connect to snmp port - Allow spamd_update to create spamd_var_lib_t directories - Allow domains that can read sssd_public_t files to also list the directory - Remove miscfiles_read_localization, this is defined for all domains- Allow syslogd to request the kernel to load a module - Allow syslogd_t to read the network state information - Allow xdm_dbusd_t connect to the system DBUS - Add support for 7389/tcp port - Allow domains to read/write all inherited sockets - Allow staff_t to read kmsg - Add awstats_purge_apache_log boolean - Allow ksysguardproces to read /.config/Trolltech.conf - Allow passenger to create and append puppet log files - Add puppet_append_log and puppet_create_log interfaces - Add puppet_manage_log() interface - Allow tomcat domain to search tomcat_var_lib_t - Allow pki_tomcat_t to connect to pki_ca ports - Allow pegasus_t to have net_admin capability - Allow pegasus_t to write /sys/class/net//flags - Allow mailserver_delivery to manage mail_home_rw_t lnk_files - Allow fetchmail to create log files - Allow gnomeclock to manage home config in .kde - Allow bittlebee to read kernel sysctls - Allow logrotate to list /root- Fix userhelper_console_role_template() - Allow enabling Network Access Point service using blueman - Make vmware_host_t as unconfined domain - Allow authenticate users in webaccess via squid, using mysql as backend - Allow gathers to get various metrics on mounted file systems - Allow firewalld to read /etc/hosts - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t - Allow kdumpgui to read/write to zipl.conf - Commands needed to get mock to build from staff_t in enforcing mode - Allow mdadm_t to manage cgroup files - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files - dontaudit ifconfig_t looking at fifo_files that are leaked to it - Add lableing for Quest Authentication System- Fix filetrans interface definitions - Dontaudit xdm_t to getattr on BOINC lib files - Add systemd_reload_all_services() interface - Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files - Allow accountsd to dbus chat with gdm - Allow realmd to getattr on all fs - Allow logrotate to reload all services - Add systemd unit file for radiusd - Allow winbind to create samba pid dir - Add labeling for /var/nmbd/unexpected - Allow chrome and mozilla plugin to connect to msnp ports- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file - Dontaudit setfiles reading /dev/random - On initial boot gnomeclock is going to need to be set buy gdm - Fix tftp_read_content() interface - Random apps looking at kernel file systems - Testing virt with lxc requiers additional access for virsh_t - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container - Allow MPD to read /dev/radnom - Allow sandbox_web_type to read logind files which needs to read pulseaudio - Allow mozilla plugins to read /dev/hpet - Add labeling for /var/lib/zarafa-webap - Allow BOINC client to use an HTTP proxy for all connections - Allow rhsmertd to domain transition to dmidecod - Allow setroubleshootd to send D-Bus msg to ABRT- Define usbtty_device_t as a term_tty - Allow svnserve to accept a connection - Allow xend manage default virt_image_t type - Allow prelink_cron_system_t to overide user componant when executing cp - Add labeling for z-push - Gnomeclock sets the realtime clock - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd - Allow lxc domains to use /dev/random and /dev/urandom- Add port defintion for tcp/9000 - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API - Allow shorewall_t to create netlink_socket - Allow krb5admind to block suspend - Fix labels on /var/run/dlm_controld /var/log/dlm_controld - Allow krb5kdc to block suspend - gnomessytemmm_t needs to read /etc/passwd - Allow cgred to read all sysctls- Allow all domains to read /proc/sys/vm/overcommit_memory - Make proc_numa_t an MLS Trusted Object - Add /proc/numactl support for confined users - Allow ssh_t to connect to any port > 1023 - Add openvswitch domain - Pulseaudio tries to create directories in gnome_home_t directories - New ypbind pkg wants to search /var/run which is caused by sd_notify - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans - Allow sanlock to read /dev/random - Treat php-fpm with httpd_t - Allow domains that can read named_conf_t to be able to list the directories - Allow winbind to create sock files in /var/run/samba- Add smsd policy - Add support for OpenShift sbin labelin - Add boolean to allow virt to use rawip - Allow mozilla_plugin to read all file systems with noxattrs support - Allow kerberos to write on anon_inodefs fs - Additional access required by fenced - Add filename transitions for passwd.lock/group.lock - UPdate man pages - Create coolkey directory in /var/cache with the correct label- Fix label on /etc/group.lock - Allow gnomeclock to create lnk_file in /etc - label /root/.pki as a home_cert_t - Add interface to make sure rpcbind.sock is created with the correct label - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules - opendkim should be a part of milter - Allow libvirt to set the kernel sched algorythm - Allow mongod to read sysfs_t - Add authconfig policy - Remove calls to miscfiles_read_localization all domains get this - Allow virsh_t to read /root/.pki/ content - Add label for log directory under /var/www/stickshift- Allow getty to setattr on usb ttys - Allow sshd to search all directories for sshd_home_t content - Allow staff domains to send dbus messages to kdumpgui - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t - Dontaudit setfiles reading urand - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir - Allow systemd-timedated to read /dev/urandom - Allow entropyd_t to read proc_t (meminfo) - Add unconfined munin plugin - Fix networkmanager_read_conf() interface - Allow blueman to list /tmp which is needed by sys_nic/setsched - Fix label of /etc/mail/aliasesdb-stamp - numad is searching cgroups - realmd is communicating with networkmanager using dbus - Lots of fixes to try to get kdump to work- Allow loging programs to dbus chat with realmd - Make apache_content_template calling as optional - realmd is using policy kit- Add new selinuxuser_use_ssh_chroot boolean - dbus needs to be able to read/write inherited fixed disk device_t passed through it - Cleanup netutils process allow rule - Dontaudit leaked fifo files from openshift to ping - sanlock needs to read mnt_t lnk files - Fail2ban needs to setsched and sys_nice- Change default label of all files in /var/run/rpcbind - Allow sandbox domains (java) to read hugetlbfs_t - Allow awstats cgi content to create tmp files and read apache log files - Allow setuid/setgid for cupsd-config - Allow setsched/sys_nice pro cupsd-config - Fix /etc/localtime sym link to be labeled locale_t - Allow sshd to search postgresql db t since this is a homedir - Allow xwindows users to chat with realmd - Allow unconfined domains to configure all files and null_device_t service- Adopt pki-selinux policy- pki is leaking which we dontaudit until a pki code fix - Allow setcap for arping - Update man pages - Add labeling for /usr/sbin/mcollectived - pki fixes - Allow smokeping to execute fping in the netutils_t domain- Allow mount to relabelfrom unlabeled file systems - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working - Add label to get bin files under libreoffice labeled correctly - Fix interface to allow executing of base_ro_file_type - Add fixes for realmd - Update pki policy - Add tftp_homedir boolean - Allow blueman sched_setscheduler - openshift user domains wants to r/w ssh tcp sockets- Additional requirements for disable unconfined module when booting - Fix label of systemd script files - semanage can use -F /dev/stdin to get input - syslog now uses kerberos keytabs - Allow xserver to compromise_kernel access - Allow nfsd to write to mount_var_run_t when running the mount command - Add filename transition rule for bin_t directories - Allow files to read usr_t lnk_files - dhcpc wants chown - Add support for new openshift labeling - Clean up for tunable+optional statements - Add labeling for /usr/sbin/mkhomedir_helper - Allow antivirus domain to managa amavis spool files - Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool- Add interfaces to read kernel_t proc info - Missed this version of exec_all - Allow anyone who can load a kernel module to compromise kernel - Add oddjob_dbus_chat to openshift apache policy - Allow chrome_sandbox_nacl_t to send signals to itself - Add unit file support to usbmuxd_t - Allow all openshift domains to read sysfs info - Allow openshift domains to getattr on all domains- MLS fixes from Dan - Fix name of capability2 secure_firmware->compromise_kerne- Allow xdm to search all file systems - Add interface to allow the config of all files - Add rngd policy - Remove kgpg as a gpg_exec_t type - Allow plymouthd to block suspend - Allow systemd_dbus to config any file - Allow system_dbus_t to configure all services - Allow freshclam_t to read usr_files - varnishd requires execmem to load modules- Allow semanage to verify types - Allow sudo domain to execute user home files - Allow session_bus_type to transition to user_tmpfs_t - Add dontaudit caused by yum updates - Implement pki policy but not activated- tuned wants to getattr on all filesystems - tuned needs also setsched. The build is needed for test day- Add policy for qemu-qa - Allow razor to write own config files - Add an initial antivirus policy to collect all antivirus program - Allow qdisk to read usr_t - Add additional caps for vmware_host - Allow tmpfiles_t to setattr on mandb_cache_t - Dontaudit leaked files into mozilla_plugin_config_t - Allow wdmd to getattr on tmpfs - Allow realmd to use /dev/random - allow containers to send audit messages - Allow root mount any file via loop device with enforcing mls policy - Allow tmpfiles_t to setattr on mandb_cache_t - Allow tmpfiles_t to setattr on mandb_cache_t - Make userdom_dontaudit_write_all_ not allow open - Allow init scripts to read all unit files - Add support for saphostctrl ports- Add kernel_read_system_state to sandbox_client_t - Add some of the missing access to kdumpgui - Allow systemd_dbusd_t to status the init system - Allow vmnet-natd to request the kernel to load a module - Allow gsf-office-thum to append .cache/gdm/session.log - realmd wants to read .config/dconf/user - Firewalld wants sys_nice/setsched - Allow tmpreaper to delete mandb cache files - Firewalld wants sys_nice/setsched - Allow firewalld to perform a DNS name resolution - Allown winbind to read /usr/share/samba/codepages/lowcase.dat - Add support for HTTPProxy* in /etc/freshclam.conf - Fix authlogin_yubike boolean - Extend smbd_selinux man page to include samba booleans - Allow dhcpc to execute consoletype - Allow ping to use inherited tmp files created in init scripts - On full relabel with unconfined domain disabled, initrc was running some chcon's - Allow people who delete man pages to delete mandb cache files- Add missing permissive domains- Add new mandb policy - ALlow systemd-tmpfiles_t to relabel mandb_cache_t - Allow logrotate to start all unit files- Add fixes for ctbd - Allow nmbd to stream connect to ctbd - Make cglear_t as nsswitch_domain - Fix bogus in interfaces - Allow openshift to read/write postfix public pipe - Add postfix_manage_spool_maildrop_files() interface - stickshift paths have been renamed to openshift - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes - Update man pages, adding ENTRYPOINTS- Add mei_device_t - Make sure gpg content in homedir created with correct label - Allow dmesg to write to abrt cache files - automount wants to search virtual memory sysctls - Add support for hplip logs stored in /var/log/hp/tmp - Add labeling for /etc/owncloud/config.php - Allow setroubleshoot to send analysys to syslogd-journal - Allow virsh_t to interact with new fenced daemon - Allow gpg to write to /etc/mail/spamassassiin directories - Make dovecot_deliver_t a mail server delivery type - Add label for /var/tmp/DNS25- Fixes for tomcat_domain template interface- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes - Add attribute to all base os types. Allow all domains to read all ro base OS types- Additional unit files to be defined as power unit files - Fix more boolean names- Fix boolean name so subs will continue to work- dbus needs to start getty unit files - Add interface to allow system_dbusd_t to start the poweroff service - xdm wants to exec telepathy apps - Allow users to send messages to systemdlogind - Additional rules needed for systemd and other boot apps - systemd wants to list /home and /boot - Allow gkeyringd to write dbus/conf file - realmd needs to read /dev/urand - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded- Fixes to safe more rules - Re-write tomcat_domain_template() - Fix passenger labeling - Allow all domains to read man pages - Add ephemeral_port_t to the 'generic' port interfaces - Fix the names of postgresql booleans- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer - Move netlable_peer check out of booleans - Remove call to recvfrom_netlabel for kerberos call - Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules - Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface - Allow rndc to block suspend - tuned needs to modify the schedule of the kernel - Allow svirt_t domains to read alsa configuration files - ighten security on irc domains and make sure they label content in homedir correctly - Add filetrans_home_content for irc files - Dontaudit all getattr access for devices and filesystems for sandbox domains - Allow stapserver to search cgroups directories - Allow all postfix domains to talk to spamd- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check - Change pam_t to pam_timestamp_t - Add dovecot_domain attribute and allow this attribute block_suspend capability2 - Add sanlock_use_fusefs boolean - numad wants send/recieve msg - Allow rhnsd to send syslog msgs - Make piranha-pulse as initrc domain - Update openshift instances to dontaudit setattr until the kernel is fixed.- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd - Remove pam_selinux.8 which conflicts with man page owned by the pam package - Allow glance-api to talk to mysql - ABRT wants to read Xorg.0.log if if it detects problem with Xorg - Fix gstreamer filename trans. interface- Man page fixes by Dan Walsh- Allow postalias to read postfix config files - Allow man2html to read man pages - Allow rhev-agentd to search all mountpoints - Allow rhsmcertd to read /dev/random - Add tgtd_stream_connect() interface - Add cyrus_write_data() interface - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t - Add port definition for tcp/81 as http_port_t - Fix /dev/twa labeling - Allow systemd to read modules config- Merge openshift policy - Allow xauth to read /dev/urandom - systemd needs to relabel content in /run/systemd directories - Files unconfined should be able to perform all services on all files - Puppet tmp file can be leaked to all domains - Dontaudit rhsmcertd-worker to search /root/.local - Allow chown capability for zarafa domains - Allow system cronjobs to runcon into openshift domains - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories- nmbd wants to create /var/nmbd - Stop transitioning out of anaconda and firstboot, just causes AVC messages - Allow clamscan to read /etc files - Allow bcfg2 to bind cyphesis port - heartbeat should be run as rgmanager_t instead of corosync_t - Add labeling for /etc/openldap/certs - Add labeling for /opt/sartest directory - Make crontab_t as userdom home reader - Allow tmpreaper to list admin_home dir - Add defition for imap_0 replay cache file - Add support for gitolite3 - Allow virsh_t to send syslog messages - allow domains that can read samba content to be able to list the directories also - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd - Separate out sandbox from sandboxX policy so we can disable it by default - Run dmeventd as lvm_t - Mounting on any directory requires setattr and write permissions - Fix use_nfs_home_dirs() boolean - New labels for pam_krb5 - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0 - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs - Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles- Allow realmd to read resolv.conf - Add pegasus_cache_t type - Label /usr/sbin/fence_virtd as virsh_exec_t - Add policy for pkcsslotd - Add support for cpglockd - Allow polkit-agent-helper to read system-auth-ac - telepathy-idle wants to read gschemas.compiled - Allow plymouthd to getattr on fs_t - Add slpd policy - Allow ksysguardproces to read/write config_usr_t- Fix labeling substitution so rpm will label /lib/systemd content correctly- Add file name transitions for ttyACM0 - spice-vdagent(d)'s are going to log over to syslog - Add sensord policy - Add more fixes for passenger policy related to puppet - Allow wdmd to create wdmd_tmpfs_t - Fix labeling for /var/run/cachefilesd\.pid - Add thumb_tmpfs_t files type- Allow svirt domains to manage the network since this is containerized - Allow svirt_lxc_net_t to send audit messages- Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working - Allow dlm_controld to execute dlm_stonith labeled as bin_t - Allow GFS2 working on F17 - Abrt needs to execute dmesg - Allow jockey to list the contents of modeprobe.d - Add policy for lightsquid as squid_cron_t - Mailscanner is creating files and directories in /tmp - dmesg is now reading /dev/kmsg - Allow xserver to communicate with secure_firmware - Allow fsadm tools (fsck) to read /run/mount contnet - Allow sysadm types to read /dev/kmsg -- Allow postfix, sssd, rpcd to block_suspend - udev seems to need secure_firmware capability - Allow virtd to send dbus messages to firewalld so it can configure the firewall- Fix labeling of content in /run created by virsh_t - Allow condor domains to read kernel sysctls - Allow condor_master to connect to amqp - Allow thumb drives to create shared memory and semaphores - Allow abrt to read mozilla_plugin config files - Add labels for lightsquid - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow - dovecot_auth_t uses ldap for user auth - Allow domains that can read dhcp_etc_t to read lnk_files - Add more then one watchdog device - Allow useradd_t to manage etc_t files so it can rename it and edit them - Fix invalid class dir should be fifo_file - Move /run/blkid to fsadm and make sure labeling is correct- Fix bogus regex found by eparis - Fix manage run interface since lvm needs more access - syslogd is searching cgroups directory - Fixes to allow virt-sandbox-service to manage lxc var run content- Fix Boolean settings - Add new libjavascriptcoregtk as textrel_shlib_t - Allow xdm_t to create xdm_home_t directories - Additional access required for systemd - Dontaudit mozilla_plugin attempts to ipc_lock - Allow tmpreaper to delete unlabeled files - Eliminate screen_tmp_t and allow it to manage user_tmp_t - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors - Allow web plugins to connect to the asterisk ports - Condor will recreate the lock directory if it does not exist - Oddjob mkhomedir needs to connectto user processes - Make oddjob_mkhomedir_t a userdom home manager- Put placeholder back in place for proper numbering of capabilities - Systemd also configures init scripts- Fix ecryptfs interfaces - Bootloader seems to be trolling around /dev/shm and /dev - init wants to create /etc/systemd/system-update.target.wants - Fix systemd_filetrans call to move it out of tunable - Fix up policy to work with systemd userspace manager - Add secure_firmware capability and remove bogus epolwakeup - Call seutil_*_login_config interfaces where should be needed - Allow rhsmcertd to send signal to itself - Allow thin domains to send signal to itself - Allow Chrome_ChildIO to read dosfs_t- Add role rules for realmd, sambagui- Add new type selinux_login_config_t for /etc/selinux//logins/ - Additional fixes for seutil_manage_module_store() - dbus_system_domain() should be used with optional_policy - Fix svirt to be allowed to use fusefs file system - Allow login programs to read /run/ data created by systemd_login - sssd wants to write /etc/selinux//logins/ for SELinux PAM module - Fix svirt to be allowed to use fusefs file system - Allow piranha domain to use nsswitch - Sanlock needs to send Kill Signals to non root processes - Pulseaudio wants to execute /run/user/PID/.orc- Fix saslauthd when it tries to read /etc/shadow - Label gnome-boxes as a virt homedir - Need to allow svirt_t ability to getattr on nfs_t file systems - Update sanlock policy to solve all AVC's - Change confined users can optionally manage virt content - Handle new directories under ~/.cache - Add block suspend to appropriate domains - More rules required for containers - Allow login programs to read /run/ data created by systemd_logind - Allow staff users to run svirt_t processes- Update to upstream- More fixes for systemd to make rawhide booting from Dan Walsh- Add systemd fixes to make rawhide booting- Add systemd_logind_inhibit_var_run_t attribute - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type - Add interface for mysqld to dontaudit signull to all processes - Label new /var/run/journal directory correctly - Allow users to inhibit suspend via systemd - Add new type for the /var/run/inhibit directory - Add interface to send signull to systemd_login so avahi can send them - Allow systemd_passwd to send syslog messages - Remove corenet_all_recvfrom_unlabeled() calling fro policy files - Allow editparams.cgi running as httpd_bugzilla_script_t to read /etc/group - Allow smbd to read cluster config - Add additional labeling for passenger - Allow dbus to inhibit suspend via systemd - Allow avahi to send signull to systemd_login- Add interface to dontaudit getattr access on sysctls - Allow sshd to execute /bin/login - Looks like xdm is recreating the xdm directory in ~/.cache/ on login - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald - Fix semanage to work with unconfined domain disabled on F18 - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls - Virt seems to be using lock files - Dovecot seems to be searching directories of every mountpoint - Allow jockey to read random/urandom, execute shell and install third-party drivers - Add aditional params to allow cachedfiles to manage its content - gpg agent needs to read /dev/random - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write - Add a bunch of dontaudit rules to quiet svirt_lxc domains - Additional perms needed to run svirt_lxc domains - Allow cgclear to read cgconfig - Allow sys_ptrace capability for snmp - Allow freshclam to read /proc - Allow procmail to manage /home/user/Maildir content - Allow NM to execute wpa_cli - Allow amavis to read clamd system state - Regenerate man pages- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild- Add realmd and stapserver policies - Allow useradd to manage stap-server lib files - Tighten up capabilities for confined users - Label /etc/security/opasswd as shadow_t - Add label for /dev/ecryptfs - Allow condor_startd_t to start sshd with the ranged - Allow lpstat.cups to read fips_enabled file - Allow pyzor running as spamc_t to create /root/.pyzor directory - Add labelinf for amavisd-snmp init script - Add support for amavisd-snmp - Allow fprintd sigkill self - Allow xend (w/o libvirt) to start virtual machines - Allow aiccu to read /etc/passwd - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes - Add condor_startd_ranged_domtrans_to() interface - Add ssd_conf_t for /etc/sssd - accountsd needs to fchown some files/directories - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit - Allow xend_t to read the /etc/passwd file- Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t - Add init_access_check() interface - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t - Allow tcpdump to create a netlink_socket - Label newusers like useradd - Change xdm log files to be labeled xdm_log_t - Allow sshd_t with privsep to work in MLS - Allow freshclam to update databases thru HTTP proxy - Allow s-m-config to access check on systemd - Allow abrt to read public files by default - Fix amavis_create_pid_files() interface - Add labeling and filename transition for dbomatic.log - Allow system_dbusd_t to stream connect to bluetooth, and use its socket - Allow amavisd to execute fsav - Allow tuned to use sys_admin and sys_nice capabilities - Add php-fpm policy from Bryan - Add labeling for aeolus-configserver-thinwrapper - Allow thin domains to execute shell - Fix gnome_role_gkeyringd() interface description - Lot of interface fixes - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files - Allow OpenMPI job to use kerberos - Make deltacloudd_t as nsswitch_domain - Allow xend_t to run lsscsi - Allow qemu-dm running as xend_t to create tun_socket - Add labeling for /opt/brother/Printers(.*/)?inf - Allow jockey-backend to read pyconfig-64.h labeled as usr_t - Fix clamscan_can_scan_system boolean - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11- initrc is calling exportfs which is not confined so it attempts to read nfsd_files - Fixes for passenger running within openshift. - Add labeling for all tomcat6 dirs - Add support for tomcat6 - Allow cobblerd to read /etc/passwd - Allow jockey to read sysfs and and execute binaries with bin_t - Allow thum to use user terminals - Allow cgclear to read cgconfig config files - Fix bcf2g.fc - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains - Allow dbomatic to execute ruby - abrt_watch_log should be abrt_domain - Allow mozilla_plugin to connect to gatekeeper port- add ptrace_child access to process - remove files_read_etc_files() calling from all policies which have auth_use_nsswith() - Allow boinc domains to manage boinc_lib_t lnk_files - Add support for boinc-client.service unit file - Add support for boinc.log - Allow mozilla_plugin execmod on mozilla home files if allow_ex - Allow dovecot_deliver_t to read dovecot_var_run_t - Allow ldconfig and insmod to manage kdumpctl tmp files - Move thin policy out from cloudform.pp and add a new thin poli - pacemaker needs to communicate with corosync streams - abrt is now started on demand by dbus - Allow certmonger to talk directly to Dogtag servers - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c - Allow mozila_plugin to execute gstreamer home files - Allow useradd to delete all file types stored in the users hom - rhsmcertd reads the rpm database - Add support for lightdm- Add tomcat policy - Remove pyzor/razor policy - rhsmcertd reads the rpm database - Dontaudit thumb to setattr on xdm_tmp dir - Allow wicd to execute ldconfig in the networkmanager_t domain - Add /var/run/cherokee\.pid labeling - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too - Allow postfix-master to r/w pipes other postfix domains - Allow snort to create netlink_socket - Add kdumpctl policy - Allow firstboot to create tmp_t files/directories - /usr/bin/paster should not be labeled as piranha_exec_t - remove initrc_domain from tomcat - Allow ddclient to read /etc/passwd - Allow useradd to delete all file types stored in the users homedir - Allow ldconfig and insmod to manage kdumpctl tmp files - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those - Transition xauth files within firstboot_tmp_t - Fix labeling of /run/media to match /media - Label all lxdm.log as xserver_log_t - Add port definition for mxi port - Allow local_login_t to execute tmux- apcupsd needs to read /etc/passwd - Sanlock allso sends sigkill - Allow glance_registry to connect to the mysqld port - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl - Allow firefox plugins/flash to connect to port 1234 - Allow mozilla plugins to delete user_tmp_t files - Add transition name rule for printers.conf.O - Allow virt_lxc_t to read urand - Allow systemd_loigind to list gstreamer_home_dirs - Fix labeling for /usr/bin - Fixes for cloudform services * support FIPS - Allow polipo to work as web caching - Allow chfn to execute tmux- Add support for ecryptfs * ecryptfs does not support xattr * we need labeling for HOMEDIR - Add policy for (u)mount.ecryptfs* - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache - Allow dovecot to manage Maildir content, fix transitions to Maildir - Allow postfix_local to transition to dovecot_deliver - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code - Cleanup interface definitions - Allow apmd to change with the logind daemon - Changes required for sanlock in rhel6 - Label /run/user/apache as httpd_tmp_t - Allow thumb to use lib_t as execmod if boolean turned on - Allow squid to create the squid directory in /var with the correct labe - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com) - Allow virtd to exec xend_exec_t without transition - Allow virtd_lxc_t to unmount all file systems- PolicyKit path has changed - Allow httpd connect to dirsrv socket - Allow tuned to write generic kernel sysctls - Dontaudit logwatch to gettr on /dev/dm-2 - Allow policykit-auth to manage kerberos files - Make condor_startd and rgmanager as initrc domain - Allow virsh to read /etc/passwd - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs - xdm now needs to execute xsession_exec_t - Need labels for /var/lib/gdm - Fix files_filetrans_named_content() interface - Add new attribute - initrc_domain - Allow systemd_logind_t to signal, signull, sigkill all processes - Add filetrans rules for etc_runtime files- Rename boolean names to remove allow_- Mass merge with upstream * new policy topology to include contrib policy modules * we have now two base policy patches- Fix description of authlogin_nsswitch_use_ldap - Fix transition rule for rhsmcertd_t needed for RHEL7 - Allow useradd to list nfs state data - Allow openvpn to manage its log file and directory - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly - Allow thumb to use nvidia devices - Allow local_login to create user_tmp_t files for kerberos - Pulseaudio needs to read systemd_login /var/run content - virt should only transition named system_conf_t config files - Allow munin to execute its plugins - Allow nagios system plugin to read /etc/passwd - Allow plugin to connect to soundd port - Fix httpd_passwd to be able to ask passwords - Radius servers can use ldap for backing store - Seems to need to mount on /var/lib for xguest polyinstatiation to work. - Allow systemd_logind to list the contents of gnome keyring - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL - Add policy for isns-utils- Add policy for subversion daemon - Allow boinc to read passwd - Allow pads to read kernel network state - Fix man2html interface for sepolgen-ifgen - Remove extra /usr/lib/systemd/system/smb - Remove all /lib/systemd and replace with /usr/lib/systemd - Add policy for man2html - Fix the label of kerberos_home_t to krb5_home_t - Allow mozilla plugins to use Citrix - Allow tuned to read /proc/sys/kernel/nmi_watchdog - Allow tune /sys options via systemd's tmpfiles.d "w" type- Dontaudit lpr_t to read/write leaked mozilla tmp files - Add file name transition for .grl-podcasts directory - Allow corosync to read user tmp files - Allow fenced to create snmp lib dirs/files - More fixes for sge policy - Allow mozilla_plugin_t to execute any application - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain - Allow mongod to read system state information - Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t - Allow polipo to manage polipo_cache dirs - Add jabbar_client port to mozilla_plugin_t - Cleanup procmail policy - system bus will pass around open file descriptors on files that do not have labels on them - Allow l2tpd_t to read system state - Allow tuned to run ls /dev - Allow sudo domains to read usr_t files - Add label to machine-id - Fix corecmd_read_bin_symlinks cut and paste error- Fix pulseaudio port definition - Add labeling for condor_starter - Allow chfn_t to creat user_tmp_files - Allow chfn_t to execute bin_t - Allow prelink_cron_system_t to getpw calls - Allow sudo domains to manage kerberos rcache files - Allow user_mail_domains to work with courie - Port definitions necessary for running jboss apps within openshift - Add support for openstack-nova-metadata-api - Add support for nova-console* - Add support for openstack-nova-xvpvncproxy - Fixes to make privsep+SELinux working if we try to use chage to change passwd - Fix auth_role() interface - Allow numad to read sysfs - Allow matahari-rpcd to execute shell - Add label for ~/.spicec - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it - Devicekit_disk wants to read the logind sessions file when writing a cd - Add fixes for condor to make condor jobs working correctly - Change label of /var/log/rpmpkgs to cron_log_t - Access requires to allow systemd-tmpfiles --create to work. - Fix obex to be a user application started by the session bus. - Add additional filename trans rules for kerberos - Fix /var/run/heartbeat labeling - Allow apps that are managing rcache to file trans correctly - Allow openvpn to authenticate against ldap server - Containers need to listen to network starting and stopping events- Make systemd unit files less specific- Fix zarafa labeling - Allow guest_t to fix labeling - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean - add lxc_contexts - Allow accountsd to read /proc - Allow restorecond to getattr on all file sytems - tmpwatch now calls getpw - Allow apache daemon to transition to pwauth domain - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t - The obex socket seems to be a stream socket - dd label for /var/run/nologin- Allow jetty running as httpd_t to read hugetlbfs files - Allow sys_nice and setsched for rhsmcertd - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports - Allow setfiles to append to xdm_tmp_t - Add labeling for /export as a usr_t directory - Add labels for .grl files created by gstreamer- Add labeling for /usr/share/jetty/bin/jetty.sh - Add jetty policy which contains file type definitios - Allow jockey to use its own fifo_file and make this the default for all domains - Allow mozilla_plugins to use spice (vnc_port/couchdb) - asterisk wants to read the network state - Blueman now uses /var/lib/blueman- Add label for nodejs_debug - Allow mozilla_plugin_t to create ~/.pki directory and content- Add clamscan_can_scan_system boolean - Allow mysqld to read kernel network state - Allow sshd to read/write condor lib files - Allow sshd to read/write condor-startd tcp socket - Fix description on httpd_graceful_shutdown - Allow glance_registry to communicate with mysql - dbus_system_domain is using systemd to lauch applications - add interfaces to allow domains to send kill signals to user mail agents - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t - Lots of new access required for secure containers - Corosync needs sys_admin capability - ALlow colord to create shm - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific - Add boolean to control whether or not mozilla plugins can create random content in the users homedir - Add new interface to allow domains to list msyql_db directories, needed for libra - shutdown has to be allowed to delete etc_runtime_t - Fail2ban needs to read /etc/passwd - Allow ldconfig to create /var/cache/ldconfig - Allow tgtd to read hardware state information - Allow collectd to create packet socket - Allow chronyd to send signal to itself - Allow collectd to read /dev/random - Allow collectd to send signal to itself - firewalld needs to execute restorecon - Allow restorecon and other login domains to execute restorecon- Allow logrotate to getattr on systemd unit files - Add support for tor systemd unit file - Allow apmd to create /var/run/pm-utils with the correct label - Allow l2tpd to send sigkill to pppd - Allow pppd to stream connect to l2tpd - Add label for scripts in /etc/gdm/ - Allow systemd_logind_t to ignore mcs constraints on sigkill - Fix files_filetrans_system_conf_named_files() interface - Add labels for /usr/share/wordpress/wp-includes/*.php - Allow cobbler to get SELinux mode and booleans- Add unconfined_execmem_exec_t as an alias to bin_t - Allow fenced to read snmp var lib files, also allow it to read usr_t - ontaudit access checks on all executables from mozilla_plugin - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode - Allow systemd_tmpfiles_t to getattr all pipes and sockets - Allow glance-registry to send system log messages - semanage needs to manage mock lib files/dirs- Add policy for abrt-watch-log - Add definitions for jboss_messaging ports - Allow systemd_tmpfiles to manage printer devices - Allow oddjob to use nsswitch - Fix labeling of log files for postgresql - Allow mozilla_plugin_t to execmem and execstack by default - Allow firewalld to execute shell - Fix /etc/wicd content files to get created with the correct label - Allow mcelog to exec shell - Add ~/.orc as a gstreamer_home_t - /var/spool/postfix/lib64 should be labeled lib_t - mpreaper should be able to list all file system labeled directories - Add support for apache to use openstack - Add labeling for /etc/zipl.conf and zipl binary - Turn on allow_execstack and turn off telepathy transition for final release- More access required for virt_qmf_t - Additional assess required for systemd-logind to support multi-seat - Allow mozilla_plugin to setrlimit - Revert changes to fuse file system to stop deadlock- Allow condor domains to connect to ephemeral ports - More fixes for condor policy - Allow keystone to stream connect to mysqld - Allow mozilla_plugin_t to read generic USB device to support GPS devices - Allow thum to file name transition gstreamer home content - Allow thum to read all non security files - Allow glance_api_t to connect to ephemeral ports - Allow nagios plugins to read /dev/urandom - Allow syslogd to search postfix spool to support postfix chroot env - Fix labeling for /var/spool/postfix/dev - Allow wdmd chown - Label .esd_auth as pulseaudio_home_t - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now- Add support for clamd+systemd - Allow fresclam to execute systemctl to handle clamd - Change labeling for /usr/sbin/rpc.ypasswd.env - Allow yppaswd_t to execute yppaswd_exec_t - Allow yppaswd_t to read /etc/passwd - Gnomekeyring socket has been moved to /run/user/USER/ - Allow samba-net to connect to ldap port - Allow signal for vhostmd - allow mozilla_plugin_t to read user_home_t socket - New access required for secure Linux Containers - zfs now supports xattrs - Allow quantum to execute sudo and list sysfs - Allow init to dbus chat with the firewalld - Allow zebra to read /etc/passwd- Allow svirt_t to create content in the users homedir under ~/.libvirt - Fix label on /var/lib/heartbeat - Allow systemd_logind_t to send kill signals to all processes started by a user - Fuse now supports Xattr Support- upowered needs to setsched on the kernel - Allow mpd_t to manage log files - Allow xdm_t to create /var/run/systemd/multi-session-x - Add rules for missedfont.log to be used by thumb.fc - Additional access required for virt_qmf_t - Allow dhclient to dbus chat with the firewalld - Add label for lvmetad - Allow systemd_logind_t to remove userdomain sock_files - Allow cups to execute usr_t files - Fix labeling on nvidia shared libraries - wdmd_t needs access to sssd and /etc/passwd - Add boolean to allow ftp servers to run in passive mode - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with - Fix using httpd_use_fusefs - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox- Rename rdate port to time port, and allow gnomeclock to connect to it - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda - /etc/auto.* should be labeled bin_t - Add httpd_use_fusefs boolean - Add fixes for heartbeat - Allow sshd_t to signal processes that it transitions to - Add condor policy - Allow svirt to create monitors in ~/.libvirt - Allow dovecot to domtrans sendmail to handle sieve scripts - Lot of fixes for cfengine- /var/run/postmaster.* labeling is no longer needed - Alllow drbdadmin to read /dev/urandom - l2tpd_t seems to use ptmx - group+ and passwd+ should be labeled as /etc/passwd - Zarafa-indexer is a socket- Ensure lastlog is labeled correctly - Allow accountsd to read /proc data about gdm - Add fixes for tuned - Add bcfg2 fixes which were discovered during RHEL6 testing - More fixes for gnome-keyring socket being moved - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown - Fix description for files_dontaudit_read_security_files() interface- Add new policy and man page for bcfg2 - cgconfig needs to use getpw calls - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt - gnome-keyring wants to create a directory in cache_home_t - sanlock calls getpw- Add numad policy and numad man page - Add fixes for interface bugs discovered by SEWatch - Add /tmp support for squid - Add fix for #799102 * change default labeling for /var/run/slapd.* sockets - Make thumb_t as userdom_home_reader - label /var/lib/sss/mc same as pubconf, so getpw domains can read it - Allow smbspool running as cups_t to stream connect to nmbd - accounts needs to be able to execute passwd on behalf of users - Allow systemd_tmpfiles_t to delete boot flags - Allow dnssec_trigger to connect to apache ports - Allow gnome keyring to create sock_files in ~/.cache - google_authenticator is using .google_authenticator - sandbox running from within firefox is exposing more leaks - Dontaudit thumb to read/write /dev/card0 - Dontaudit getattr on init_exec_t for gnomeclock_t - Allow certmonger to do a transition to certmonger_unconfined_t - Allow dhcpc setsched which is caused by nmcli - Add rpm_exec_t for /usr/sbin/bcfg2 - system cronjobs are sending dbus messages to systemd_logind - Thumnailers read /dev/urand- Allow auditctl getcap - Allow vdagent to use libsystemd-login - Allow abrt-dump-oops to search /etc/abrt - Got these avc's while trying to print a boarding pass from firefox - Devicekit is now putting the media directory under /run/media - Allow thumbnailers to create content in ~/.thumbails directory - Add support for proL2TPd by Dominick Grift - Allow all domains to call getcap - wdmd seems to get a random chown capability check that it does not need - Allow vhostmd to read kernel sysctls- Allow chronyd to read unix - Allow hpfax to read /etc/passwd - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them - Allow rpcd to read quota_db_t - Update to man pages to match latest policy - Fix bug in jockey interface for sepolgen-ifgen - Add initial svirt_prot_exec_t policy- More fixes for systemd from Dan Walsh- Add a new type for /etc/firewalld and allow firewalld to write to this directory - Add definition for ~/Maildir, and allow mail deliver domains to write there - Allow polipo to run from a cron job - Allow rtkit to schedule wine processes - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label - Allow users domains to send signals to consolehelper domains- More fixes for boinc policy - Allow polipo domain to create its own cache dir and pid file - Add systemctl support to httpd domain - Add systemctl support to polipo, allow NetworkManager to manage the service - Add policy for jockey-backend - Add support for motion daemon which is now covered by zoneminder policy - Allow colord to read/write motion tmpfs - Allow vnstat to search through var_lib_t directories - Stop transitioning to quota_t, from init an sysadm_t- Add svirt_lxc_file_t as a customizable type- Add additional fixes for icmp nagios plugin - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin - Add certmonger_unconfined_exec_t - Make sure tap22 device is created with the correct label - Allow staff users to read systemd unit files - Merge in previously built policy - Arpwatch needs to be able to start netlink sockets in order to start - Allow cgred_t to sys_ptrace to look at other DAC Processes- Back port some of the access that was allowed in nsplugin_t - Add definitiona for couchdb ports - Allow nagios to use inherited users ttys - Add git support for mock - Allow inetd to use rdate port - Add own type for rdate port - Allow samba to act as a portmapper - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev - New fixes needed for samba4 - Allow apps that use lib_t to read lib_t symlinks- Add policy for nove-cert - Add labeling for nova-openstack systemd unit files - Add policy for keystoke- Fix man pages fro domains - Add man pages for SELinux users and roles - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon - Add policy for matahari-rpcd - nfsd executes mount command on restart - Matahari domains execute renice and setsched - Dontaudit leaked tty in mozilla_plugin_config - mailman is changing to a per instance naming - Add 7600 and 4447 as jboss_management ports - Add fixes for nagios event handlers - Label httpd.event as httpd_exec_t, it is an apache daemon- Add labeling for /var/spool/postfix/dev/log - NM reads sysctl.conf - Iscsi log file context specification fix - Allow mozilla plugins to send dbus messages to user domains that transition to it - Allow mysql to read the passwd file - Allow mozilla_plugin_t to create mozilla home dirs in user homedir - Allow deltacloud to read kernel sysctl - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself - Allow postgresql_t to connectto itself - Add login_userdomain attribute for users which can log in using terminal- Allow sysadm_u to reach system_r by default #784011 - Allow nagios plugins to use inherited user terminals - Razor labeling is not used no longer - Add systemd support for matahari - Add port_types to man page, move booleans to the top, fix some english - Add support for matahari-sysconfig-console - Clean up matahari.fc - Fix matahari_admin() interfac - Add labels for/etc/ssh/ssh_host_*.pub keys- Allow ksysguardproces to send system log msgs - Allow boinc setpgid and signull - Allow xdm_t to sys_ptrace to run pidof command - Allow smtpd_t to manage spool files/directories and symbolic links - Add labeling for jetty - Needed changes to get unbound/dnssec to work with openswan- Add user_fonts_t alias xfs_tmp_t - Since depmod now runs as insmod_t we need to write to kernel_object_t - Allow firewalld to dbus chat with networkmanager - Allow qpidd to connect to matahari ports - policykit needs to read /proc for uses not owned by it - Allow systemctl apps to connecto the init stream- Turn on deny_ptrace boolean- Remove pam_selinux.8 man page. There was a conflict.- Add proxy class and read access for gssd_proxy - Separate out the sharing public content booleans - Allow certmonger to execute a script and send signals to apache and dirsrv to reload the certificate - Add label transition for gstream-0.10 and 12 - Add booleans to allow rsync to share nfs and cifs file sytems - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it - Fix filename transitions for cups files - Allow denyhosts to read "unix" - Add file name transition for locale.conf.new - Allow boinc projects to gconf config files - sssd needs to be able to increase the socket limit under certain loads - sge_execd needs to read /etc/passwd - Allow denyhost to check network state - NetworkManager needs to read sessions data - Allow denyhost to check network state - Allow xen to search virt images directories - Add label for /dev/megaraid_sas_ioctl_node - Add autogenerated man pages- Allow boinc project to getattr on fs - Allow init to execute initrc_state_t - rhev-agent package was rename to ovirt-guest-agent - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly - sytemd writes content to /run/initramfs and executes it on shutdown - kdump_t needs to read /etc/mtab, should be back ported to F16 - udev needs to load kernel modules in early system boot- Need to add sys_ptrace back in since reading any content in /proc can cause these accesses - Add additional systemd interfaces which are needed fro *_admin interfaces - Fix bind_admin() interface- Allow firewalld to read urand - Alias java, execmem_mono to bin_t to allow third parties - Add label for kmod - /etc/redhat-lsb contains binaries - Add boolean to allow gitosis to send mail - Add filename transition also for "event20" - Allow systemd_tmpfiles_t to delete all file types - Allow collectd to ipc_lock- make consoletype_exec optional, so we can remove consoletype policy - remove unconfined_permisive.patch - Allow openvpn_t to inherit user home content and tmp content - Fix dnssec-trigger labeling - Turn on obex policy for staff_t - Pem files should not be secret - Add lots of rules to fix AVC's when playing with containers - Fix policy for dnssec - Label ask-passwd directories correctly for systemd- sshd fixes seem to be causing unconfined domains to dyntrans to themselves - fuse file system is now being mounted in /run/user - systemd_logind is sending signals to processes that are dbus messaging with it - Add support for winshadow port and allow iscsid to connect to this port - httpd should be allowed to bind to the http_port_t udp socket - zarafa_var_lib_t can be a lnk_file - A couple of new .xsession-errors files - Seems like user space and login programs need to read logind_sessions_files - Devicekit disk seems to be being launched by systemd - Cleanup handling of setfiles so most of rules in te file - Correct port number for dnssec - logcheck has the home dir set to its cache- Add policy for grindengine MPI jobs- Add new sysadm_secadm.pp module * contains secadm definition for sysadm_t - Move user_mail_domain access out of the interface into the te file - Allow httpd_t to create httpd_var_lib_t directories as well as files - Allow snmpd to connect to the ricci_modcluster stream - Allow firewalld to read /etc/passwd - Add auth_use_nsswitch for colord - Allow smartd to read network state - smartdnotify needs to read /etc/group- Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory - lxdm startup scripts should be labeled bin_t, so confined users will work - mcstransd now creates a pid, needs back port to F16 - qpidd should be allowed to connect to the amqp port - Label devices 010-029 as usb devices - ypserv packager says ypserv does not use tmp_t so removing selinux policy types - Remove all ptrace commands that I believe are caused by the kernel/ps avcs - Add initial Obex policy - Add logging_syslogd_use_tty boolean - Add polipo_connect_all_unreserved bolean - Allow zabbix to connect to ftp port - Allow systemd-logind to be able to switch VTs - Allow apache to communicate with memcached through a sock_file- Fix file_context.subs_dist for now to work with pre usrmove- More /usr move fixes- Add zabbix_can_network boolean - Add httpd_can_connect_zabbix boolean - Prepare file context labeling for usrmove functions - Allow system cronjobs to read kernel network state - Add support for selinux_avcstat munin plugin - Treat hearbeat with corosync policy - Allow corosync to read and write to qpidd shared mem - mozilla_plugin is trying to run pulseaudio - Fixes for new sshd patch for running priv sep domains as the users context - Turn off dontaudit rules when turning on allow_ypbind - udev now reads /etc/modules.d directory- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out - Cups exchanges dbus messages with init - udisk2 needs to send syslog messages - certwatch needs to read /etc/passwd- Add labeling for udisks2 - Allow fsadmin to communicate with the systemd process- Treat Bip with bitlbee policy * Bip is an IRC proxy - Add port definition for interwise port - Add support for ipa_memcached socket - systemd_jounald needs to getattr on all processes - mdadmin fixes * uses getpw - amavisd calls getpwnam() - denyhosts calls getpwall()- Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there - bluetooth says they do not use /tmp and want to remove the type - Allow init to transition to colord - Mongod needs to read /proc/sys/vm/zone_reclaim_mode - Allow postfix_smtpd_t to connect to spamd - Add boolean to allow ftp to connect to all ports > 1023 - Allow sendmain to write to inherited dovecot tmp files - setroubleshoot needs to be able to execute rpm to see what version of packages- Merge systemd patch - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online - Allow deltacloudd dac_override, setuid, setgid caps - Allow aisexec to execute shell - Add use_nfs_home_dirs boolean for ssh-keygen- Fixes to make rawhide boot in enforcing mode with latest systemd changes- Add labeling for /var/run/systemd/journal/syslog - libvirt sends signals to ifconfig - Allow domains that read logind session files to list them- Fixed destined form libvirt-sandbox - Allow apps that list sysfs to also read sympolicy links in this filesystem - Add ubac_constrained rules for chrome_sandbox - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra - Allow postgresql to be executed by the caller - Standardize interfaces of daemons - Add new labeling for mm-handler - Allow all matahari domains to read network state and etc_runtime_t files- New fix for seunshare, requires seunshare_domains to be able to mounton / - Allow systemctl running as logrotate_t to connect to private systemd socket - Allow tmpwatch to read meminfo - Allow rpc.svcgssd to read supported_krb5_enctype - Allow zarafa domains to read /dev/random and /dev/urandom - Allow snmpd to read dev_snmp6 - Allow procmail to talk with cyrus - Add fixes for check_disk and check_nagios plugins- default trans rules for Rawhide policy - Make sure sound_devices controlC* are labeled correctly on creation - sssd now needs sys_admin - Allow snmp to read all proc_type - Allow to setup users homedir with quota.group- Add httpd_can_connect_ldap() interface - apcupsd_t needs to use seriel ports connected to usb devices - Kde puts procmail mail directory under ~/.local/share - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now - Add labeling for /sbin/iscsiuio- Add label for /var/lib/iscan/interpreter - Dont audit writes to leaked file descriptors or redirected output for nacl - NetworkManager needs to write to /sys/class/net/ib*/mode- Allow abrt to request the kernel to load a module - Make sure mozilla content is labeled correctly - Allow tgtd to read system state - More fixes for boinc * allow to resolve dns name * re-write boinc policy to use boinc_domain attribute - Allow munin services plugins to use NSCD services- Allow mozilla_plugin_t to manage mozilla_home_t - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain - Add label for tumblerd- Fixes for xguest package- Fixes related to /bin, /sbin - Allow abrt to getattr on blk files - Add type for rhev-agent log file - Fix labeling for /dev/dmfm - Dontaudit wicd leaking - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it - Label /etc/locale.conf correctly - Allow user_mail_t to read /dev/random - Allow postfix-smtpd to read MIMEDefang - Add label for /var/log/suphp.log - Allow swat_t to connect and read/write nmbd_t sock_file - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf - Allow systemd-tmpfiles to change user identity in object contexts - More fixes for rhev_agentd_t consolehelper policy- Use fs_use_xattr for squashf - Fix procs_type interface - Dovecot has a new fifo_file /var/run/dovecot/stats-mail - Dovecot has a new fifo_file /var/run/stats-mail - Colord does not need to connect to network - Allow system_cronjob to dbus chat with NetworkManager - Puppet manages content, want to make sure it labels everything correctly- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it - Allow all postfix domains to use the fifo_file - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t - Allow apmd_t to read grub.cfg - Let firewallgui read the selinux config - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp - Fix devicekit_manage_pid_files() interface - Allow squid to check the network state - Dontaudit colord getattr on file systems - Allow ping domains to read zabbix_tmp_t files- Allow mcelog_t to create dir and file in /var/run and label it correctly - Allow dbus to manage fusefs - Mount needs to read process state when mounting gluster file systems - Allow collectd-web to read collectd lib files - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr - Allow colord to get the attributes of tmpfs filesystem - Add sanlock_use_nfs and sanlock_use_samba booleans - Add bin_t label for /usr/lib/virtualbox/VBoxManage- Add ssh_dontaudit_search_home_dir - Changes to allow namespace_init_t to work - Add interface to allow exec of mongod, add port definition for mongod port, 27017 - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t - Allow spamd and clamd to steam connect to each other - Add policy label for passwd.OLD - More fixes for postfix and postfix maildro - Add ftp support for mozilla plugins - Useradd now needs to manage policy since it calls libsemanage - Fix devicekit_manage_log_files() interface - Allow colord to execute ifconfig - Allow accountsd to read /sys - Allow mysqld-safe to execute shell - Allow openct to stream connect to pcscd - Add label for /var/run/nm-dns-dnsmasq\.conf - Allow networkmanager to chat with virtd_t- Pulseaudio changes - Merge patches- Merge patches back into git repository.- Remove allow_execmem boolean and replace with deny_execmem boolean- Turn back on allow_execmem boolean- Add more MCS fixes to make sandbox working - Make faillog MLS trusted to make sudo_$1_t working - Allow sandbox_web_client_t to read passwd_file_t - Add .mailrc file context - Remove execheap from openoffice domain - Allow chrome_sandbox_nacl_t to read cpu_info - Allow virtd to relabel generic usb which is need if USB device - Fixes for virt.if interfaces to consider chr_file as image file type- Remove Open Office policy - Remove execmem policy- MCS fixes - quota fixes- Remove transitions to consoletype- Make nvidia* to be labeled correctly - Fix abrt_manage_cache() interface - Make filetrans rules optional so base policy will build - Dontaudit chkpwd_t access to inherited TTYS - Make sure postfix content gets created with the correct label - Allow gnomeclock to read cgroup - Fixes for cloudform policy- Check in fixed for Chrome nacl support- Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_overide to communicate with users TTY's - Allow svirt_lxc domains to send kill signals within their container- Remove qemu.pp again without causing a crash- Remove qemu.pp, everything should use svirt_t or stay in its current domain- Allow policykit to talk to the systemd via dbus - Move chrome_sandbox_nacl_t to permissive domains - Additional rules for chrome_sandbox_nacl- Change bootstrap name to nacl - Chrome still needs execmem - Missing role for chrome_sandbox_bootstrap - Add boolean to remove execmem and execstack from virtual machines - Dontaudit xdm_t doing an access_check on etc_t directories- Allow named to connect to dirsrv by default - add ldapmap1_0 as a krb5_host_rcache_t file - Google chrome developers asked me to add bootstrap policy for nacl stuff - Allow rhev_agentd_t to getattr on mountpoints - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets- Fixes for cloudform policies which need to connect to random ports - Make sure if an admin creates modules content it creates them with the correct label - Add port 8953 as a dns port used by unbound - Fix file name transition for alsa and confined users- Turn on mock_t and thumb_t for unconfined domains- Policy update should not modify local contexts- Remove ada policy- Remove tzdata policy - Add labeling for udev - Add cloudform policy - Fixes for bootloader policy- Add policies for nova openstack- Add fixes for nova-stack policy- Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain - Allow init process to setrlimit on itself - Take away transition rules for users executing ssh-keygen - Allow setroubleshoot_fixit_t to read /dev/urand - Allow sshd to relbale tunnel sockets - Allow fail2ban domtrans to shorewall in the same way as with iptables - Add support for lnk files in the /var/lib/sssd directory - Allow system mail to connect to courier-authdaemon over an unix stream socket- Add passwd_file_t for /etc/ptmptmp- Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK) - Make corosync to be able to relabelto cluster lib fies - Allow samba domains to search /var/run/nmbd - Allow dirsrv to use pam - Allow thumb to call getuid - chrome less likely to get mmap_zero bug so removing dontaudit - gimp help-browser has built in javascript - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t - Re-write glance policy- Move dontaudit sys_ptrace line from permissive.te to domain.te - Remove policy for hal, it no longer exists- Don't check md5 size or mtime on certain config files- Remove allow_ptrace and replace it with deny_ptrace, which will remove all ptrace from the system - Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;- Fixes for bootloader policy - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore - Allow nsplugin to read /usr/share/config - Allow sa-update to update rules - Add use_fusefs_home_dirs for chroot ssh option - Fixes for grub2 - Update systemd_exec_systemctl() interface - Allow gpg to read the mail spool - More fixes for sa-update running out of cron job - Allow ipsec_mgmt_t to read hardware state information - Allow pptp_t to connect to unreserved_port_t - Dontaudit getattr on initctl in /dev from chfn - Dontaudit getattr on kernel_core from chfn - Add systemd_list_unit_dirs to systemd_exec_systemctl call - Fixes for collectd policy - CHange sysadm_t to create content as user_tmp_t under /tmp- Shrink size of policy through use of attributes for userdomain and apache- Allow virsh to read xenstored pid file - Backport corenetwork fixes from upstream - Do not audit attempts by thumb to search config_home_t dirs (~/.config) - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t - allow thumb to read generic data home files (mime.type)- Allow nmbd to manage sock file in /var/run/nmbd - ricci_modservice send syslog msgs - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly - Allow systemd_logind_t to manage /run/USER/dconf/user- Fix missing patch from F16- Allow logrotate setuid and setgid since logrotate is supposed to do it - Fixes for thumb policy by grift - Add new nfsd ports - Added fix to allow confined apps to execmod on chrome - Add labeling for additional vdsm directories - Allow Exim and Dovecot SASL - Add label for /var/run/nmbd - Add fixes to make virsh and xen working together - Colord executes ls - /var/spool/cron is now labeled as user_cron_spool_t- Stop complaining about leaked file descriptors during install- Remove java and mono module and merge into execmem- Fixes for thumb policy and passwd_file_t- Fixes caused by the labeling of /etc/passwd - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide- Add support for Clustered Samba commands - Allow ricci_modrpm_t to send log msgs - move permissive virt_qmf_t from virt.te to permissivedomains.te - Allow ssh_t to use kernel keyrings - Add policy for libvirt-qmf and more fixes for linux containers - Initial Polipo - Sanlock needs to run ranged in order to kill svirt processes - Allow smbcontrol to stream connect to ctdbd- Add label for /etc/passwd- Change unconfined_domains to permissive for Rawhide - Add definition for the ephemeral_ports- Make mta_role() active - Allow asterisk to connect to jabber client port - Allow procmail to read utmp - Add NIS support for systemd_logind_t - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t - Fix systemd_manage_unit_dirs() interface - Allow ssh_t to manage directories passed into it - init needs to be able to create and delete unit file directories - Fix typo in apache_exec_sys_script - Add ability for logrotate to transition to awstat domain- Change screen to use screen_domain attribute and allow screen_domains to read all process domain state - Add SELinux support for ssh pre-auth net process in F17 - Add logging_syslogd_can_sendmail boolean- Add definition for ephemeral ports - Define user_tty_device_t as a customizable_type- Needs to require a new version of checkpolicy - Interface fixes- Allow sanlock to manage virt lib files - Add virt_use_sanlock booelan - ksmtuned is trying to resolve uids - Make sure .gvfs is labeled user_home_t in the users home directory - Sanlock sends kill signals and needs the kill capability - Allow mockbuild to work on nfs homedirs - Fix kerberos_manage_host_rcache() interface - Allow exim to read system state- Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t- Allow collectd to read hardware state information - Add loop_control_device_t - Allow mdadm to request kernel to load module - Allow domains that start other domains via systemctl to search unit dir - systemd_tmpfilses, needs to list any file systems mounted on /tmp - No one can explain why radius is listing the contents of /tmp, so we will dontaudit - If I can manage etc_runtime files, I should be able to read the links - Dontaudit hostname writing to mock library chr_files - Have gdm_t setup labeling correctly in users home dir - Label content unde /var/run/user/NAME/dconf as config_home_t - Allow sa-update to execute shell - Make ssh-keygen working with fips_enabled - Make mock work for staff_t user - Tighten security on mock_t- removing unconfined_notrans_t no longer necessary - Clean up handling of secure_mode_insmod and secure_mode_policyload - Remove unconfined_mount_t- Add exim_exec_t label for /usr/sbin/exim_tidydb - Call init_dontaudit_rw_stream_socket() interface in mta policy - sssd need to search /var/cache/krb5rcache directory - Allow corosync to relabel own tmp files - Allow zarafa domains to send system log messages - Allow ssh to do tunneling - Allow initrc scripts to sendto init_t unix_stream_socket - Changes to make sure dmsmasq and virt directories are labeled correctly - Changes needed to allow sysadm_t to manage systemd unit files - init is passing file descriptors to dbus and on to system daemons - Allow sulogin additional access Reported by dgrift and Jeremy Miller - Steve Grubb believes that wireshark does not need this access - Fix /var/run/initramfs to stop restorecon from looking at - pki needs another port - Add more labels for cluster scripts - Allow apps that manage cgroup_files to manage cgroup link files - Fix label on nfs-utils scripts directories - Allow gatherd to read /dev/rand and /dev/urand- pki needs another port - Add more labels for cluster scripts - Fix label on nfs-utils scripts directories - Fixes for cluster - Allow gatherd to read /dev/rand and /dev/urand - abrt leaks fifo files- Add glance policy - Allow mdadm setsched - /var/run/initramfs should not be relabeled with a restorecon run - memcache can be setup to override sys_resource - Allow httpd_t to read tetex data - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.- Allow Postfix to deliver to Dovecot LMTP socket - Ignore bogus sys_module for lldpad - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock - systemd_logind_t sets the attributes on usb devices - Allow hddtemp_t to read etc_t files - Add permissivedomains module - Move all permissive domains calls to permissivedomain.te - Allow pegasis to send kill signals to other UIDs- Allow insmod_t to use fds leaked from devicekit - dontaudit getattr between insmod_t and init_t unix_stream_sockets - Change sysctl unit file interfaces to use systemctl - Add support for chronyd unit file - Allow mozilla_plugin to read gnome_usr_config - Add policy for new gpsd - Allow cups to create kerberos rhost cache files - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly- Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten- Add policy for sa-update being run out of cron jobs - Add create perms to postgresql_manage_db - ntpd using a gps has to be able to read/write generic tty_device_t - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev - fix spec file - Remove qemu_domtrans_unconfined() interface - Make passenger working together with puppet - Add init_dontaudit_rw_stream_socket interface - Fixes for wordpress- Turn on allow_domain_fd_use boolean on F16 - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Add abrt_handle_event_t domain for ABRT event scripts - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change - Allow httpd_git_script_t to read passwd data - Allow openvpn to set its process priority when the nice parameter is used- livecd fixes - spec file fixes- fetchmail can use kerberos - ksmtuned reads in shell programs - gnome_systemctl_t reads the process state of ntp - dnsmasq_t asks the kernel to load multiple kernel modules - Add rules for domains executing systemctl - Bogus text within fc file- Add cfengine policy- Add abrt_domain attribute - Allow corosync to manage cluster lib files - Allow corosync to connect to the system DBUS- Add sblim, uuidd policies - Allow kernel_t dyntrasition to init_t- init_t need setexec - More fixes of rules which cause an explosion in rules by Dan Walsh- Allow rcsmcertd to perform DNS name resolution - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts - Allow tmux to run as screen - New policy for collectd - Allow gkeyring_t to interact with all user apps - Add rules to allow firstboot to run on machines with the unconfined.pp module removed- Allow systemd_logind to send dbus messages with users - allow accountsd to read wtmp file - Allow dhcpd to get and set capabilities- Fix oracledb_port definition - Allow mount to mounton the selinux file system - Allow users to list /var directories- systemd fixes- Add initial policy for abrt_dump_oops_t - xtables-multi wants to getattr of the proc fs - Smoltclient is connecting to abrt - Dontaudit leaked file descriptors to postdrop - Allow abrt_dump_oops to look at kernel sysctls - Abrt_dump_oops_t reads kernel ring buffer - Allow mysqld to request the kernel to load modules - systemd-login needs fowner - Allow postfix_cleanup_t to searh maildrop- Initial systemd_logind policy - Add policy for systemd_logger and additional proivs for systemd_logind - More fixes for systemd policies- Allow setsched for virsh - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories - iptables: the various /sbin/ip6?tables.* are now symlinks for /sbin/xtables-multi- A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit - Allow colord to interact with the users through the tmpfs file system - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files - Add label for /var/log/mcelog - Allow asterisk to read /dev/random if it uses TLS - Allow colord to read ini files which are labeled as bin_t - Allow dirsrvadmin sys_resource and setrlimit to use ulimit - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first. - Also lists /var and /var/spool directories - Add openl2tpd to l2tpd policy - qpidd is reading the sysfs file- Change usbmuxd_t to dontaudit attempts to read chr_file - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains - Allow pppd to search /var/lock dir - Add rhsmcertd policy- Update to upstream- More fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git- Fix spec file to not report Verify errors- Add dspam policy - Add lldpad policy - dovecot auth wants to search statfs #713555 - Allow systemd passwd apps to read init fifo_file - Allow prelink to use inherited terminals - Run cherokee in the httpd_t domain - Allow mcs constraints on node connections - Implement pyicqt policy - Fixes for zarafa policy - Allow cobblerd to send syslog messages- Add policy.26 to the payload - Remove olpc stuff - Remove policygentool- Fixes for zabbix - init script needs to be able to manage sanlock_var_run_... - Allow sandlock and wdmd to create /var/run directories... - mixclip.so has been compiled correctly - Fix passenger policy module name- Add mailscanner policy from dgrift - Allow chrome to optionally be transitioned to - Zabbix needs these rules when starting the zabbix_server_mysql - Implement a type for freedesktop openicc standard (~/.local/share/icc) - Allow system_dbusd_t to read inherited icc_data_home_t files. - Allow colord_t to read icc_data_home_t content. #706975 - Label stuff under /usr/lib/debug as if it was labeled under /- Fixes for sanlock policy - Fixes for colord policy - Other fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Add rhev policy module to modules-targeted.conf- Lot of fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Allow logrotate to execute systemctl - Allow nsplugin_t to getattr on gpmctl - Fix dev_getattr_all_chr_files() interface - Allow shorewall to use inherited terms - Allow userhelper to getattr all chr_file devices - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t - Fix labeling for ABRT Retrace Server- Dontaudit sys_module for ifconfig - Make telepathy and gkeyringd daemon working with confined users - colord wants to read files in users homedir - Remote login should be creating user_tmp_t not its own tmp files- Fix label for /usr/share/munin/plugins/munin_* plugins - Add support for zarafa-indexer - Fix boolean description - Allow colord to getattr on /proc/scsi/scsi - Add label for /lib/upstart/init - Colord needs to list /mnt- Forard port changes from F15 for telepathy - NetworkManager should be allowed to use /dev/rfkill - Fix dontaudit messages to say Domain to not audit - Allow telepathy domains to read/write gnome_cache files - Allow telepathy domains to call getpw - Fixes for colord and vnstatd policy- Allow init_t getcap and setcap - Allow namespace_init_t to use nsswitch - aisexec will execute corosync - colord tries to read files off noxattr file systems - Allow init_t getcap and setcap- Add support for ABRT retrace server - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners - Allow telepath_msn_t to read /proc/PARENT/cmdline - ftpd needs kill capability - Allow telepath_msn_t to connect to sip port - keyring daemon does not work on nfs homedirs - Allow $1_sudo_t to read default SELinux context - Add label for tgtd sock file in /var/run/ - Add apache_exec_rotatelogs interface - allow all zaraha domains to signal themselves, server writes to /tmp - Allow syslog to read the process state - Add label for /usr/lib/chromium-browser/chrome - Remove the telepathy transition from unconfined_t - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts - Allow initrc_t domain to manage abrt pid files - Add support for AEOLUS project - Virt_admin should be allowed to manage images and processes - Allow plymountd to send signals to init - Change labeling of fping6- Add filename transitions- Fixes for zarafa policy - Add support for AEOLUS project - Change labeling of fping6 - Allow plymountd to send signals to init - Allow initrc_t domain to manage abrt pid files - Virt_admin should be allowed to manage images and processes- xdm_t needs getsession for switch user - Every app that used to exec init is now execing systemdctl - Allow squid to manage krb5_host_rcache_t files - Allow foghorn to connect to agentx port - Fixes for colord policy- Add Dan's patch to remove 64 bit variants - Allow colord to use unix_dgram_socket - Allow apps that search pids to read /var/run if it is a lnk_file - iscsid_t creates its own directory - Allow init to list var_lock_t dir - apm needs to verify user accounts auth_use_nsswitch - Add labeling for systemd unit files - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added - Add label for matahari-broker.pid file - We want to remove untrustedmcsprocess from ability to read /proc/pid - Fixes for matahari policy - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on- Fix typo- Add /var/run/lock /var/lock definition to file_contexts.subs - nslcd_t is looking for kerberos cc files - SSH_USE_STRONG_RNG is 1 which requires /dev/random - Fix auth_rw_faillog definition - Allow sysadm_t to set attributes on fixed disks - allow user domains to execute lsof and look at application sockets - prelink_cron job calls telinit -u if init is rewritten - Fixes to run qemu_t from staff_t- Fix label for /var/run/udev to udev_var_run_t - Mock needs to be able to read network state- Add file_contexts.subs to handle /run and /run/lock - Add other fixes relating to /run changes from F15 policy- Allow $1_sudo_t and $1_su_t open access to user terminals - Allow initrc_t to use generic terminals - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs -systemd is going to be useing /run and /run/lock for early bootup files. - Fix some comments in rlogin.if - Add policy for KDE backlighthelper - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems - sssd wants to read .k5login file in users homedir - setroubleshoot reads executables to see if they have TEXTREL - Add /var/spool/audit support for new version of audit - Remove kerberos_connect_524() interface calling - Combine kerberos_master_port_t and kerberos_port_t - systemd has setup /dev/kmsg as stderr for apps it executes - Need these access so that init can impersonate sockets on unix_dgram_socket- Remove some unconfined domains - Remove permissive domains - Add policy-term.patch from Dan- Fix multiple specification for boot.log - devicekit leaks file descriptors to setfiles_t - Change all all_nodes to generic_node and all_if to generic_if - Should not use deprecated interface - Switch from using all_nodes to generic_node and from all_if to generic_if - Add support for xfce4-notifyd - Fix file context to show several labels as SystemHigh - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs - Add etc_runtime_t label for /etc/securetty - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly - login.krb needs to be able to write user_tmp_t - dirsrv needs to bind to port 7390 for dogtag - Fix a bug in gpg policy - gpg sends audit messages - Allow qpid to manage matahari files- Initial policy for matahari - Add dev_read_watchdog - Allow clamd to connect clamd port - Add support for kcmdatetimehelper - Allow shutdown to setrlimit and sys_nice - Allow systemd_passwd to talk to /dev/log before udev or syslog is running - Purge chr_file and blk files on /tmp - Fixes for pads - Fixes for piranha-pulse - gpg_t needs to be able to encyprt anything owned by the user- mozilla_plugin_tmp_t needs to be treated as user tmp files - More dontaudits of writes from readahead - Dontaudit readahead_t file_type:dir write, to cover up kernel bug - systemd_tmpfiles needs to relabel faillog directory as well as the file - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost- Add policykit fixes from Tim Waugh - dontaudit sandbox domains sandbox_file_t:dir mounton - Add new dontaudit rules for sysadm_dbusd_t - Change label for /var/run/faillock * other fixes which relate with this change- Update to upstream - Fixes for telepathy - Add port defition for ssdp port - add policy for /bin/systemd-notify from Dan - Mount command requires users read mount_var_run_t - colord needs to read konject_uevent_socket - User domains connect to the gkeyring socket - Add colord policy and allow user_t and staff_t to dbus chat with it - Add lvm_exec_t label for kpartx - Dontaudit reading the mail_spool_t link from sandbox -X - systemd is creating sockets in avahi_var_run and system_dbusd_var_run- gpg_t needs to talk to gnome-keyring - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd - enforce MCS labeling on nodes - Allow arpwatch to read meminfo - Allow gnomeclock to send itself signals - init relabels /dev/.udev files on boot - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t - dnsmasq can run as a dbus service, needs acquire service - mysql_admin should be allowed to connect to mysql service - virt creates monitor sockets in the users home dir- Allow usbhid-ups to read hardware state information - systemd-tmpfiles has moved - Allo cgroup to sys_tty_config - For some reason prelink is attempting to read gconf settings - Add allow_daemons_use_tcp_wrapper boolean - Add label for ~/.cache/wocky to make telepathy work in enforcing mode - Add label for char devices /dev/dasd* - Fix for apache_role - Allow amavis to talk to nslcd - allow all sandbox to read selinux poilcy config files - Allow cluster domains to use the system bus and send each other dbus messages- Update to upstream- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild- Update to ref policy - cgred needs chown capability - Add /dev/crash crash_dev_t - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability- New labeling for postfmulti #675654 - dontaudit xdm_t listing noxattr file systems - dovecot-auth needs to be able to connect to mysqld via the network as well as locally - shutdown is passed stdout to a xdm_log_t file - smartd creates a fixed disk device - dovecot_etc_t contains a lnk_file that domains need to read - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot- syslog_t needs syslog capability - dirsrv needs to be able to create /var/lib/snmp - Fix labeling for dirsrv - Fix for dirsrv policy missing manage_dirs_pattern - corosync needs to delete clvm_tmpfs_t files - qdiskd needs to list hugetlbfs - Move setsched to sandbox_x_domain, so firefox can run without network access - Allow hddtemp to read removable devices - Adding syslog and read_policy permissions to policy * syslog Allow unconfined, sysadm_t, secadm_t, logadm_t * read_policy allow unconfined, sysadm_t, secadm_t, staff_t on Targeted allow sysadm_t (optionally), secadm_t on MLS - mdadm application will write into /sys/.../uevent whenever arrays are assembled or disassembled.- Add tcsd policy- ricci_modclusterd_t needs to bind to rpc ports 500-1023 - Allow dbus to use setrlimit to increase resoueces - Mozilla_plugin is leaking to sandbox - Allow confined users to connect to lircd over unix domain stream socket which allow to use remote control - Allow awstats to read squid logs - seunshare needs to manage tmp_t - apcupsd cgi scripts have a new directory- Fix xserver_dontaudit_read_xdm_pid - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. * These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t - Allow readahead to manage readahead pid dirs - Allow readahead to read all mcs levels - Allow mozilla_plugin_t to use nfs or samba homedirs- Allow nagios plugin to read /proc/meminfo - Fix for mozilla_plugin - Allow samba_net_t to create /etc/keytab - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t - nslcd can read user credentials - Allow nsplugin to delete mozilla_plugin_tmpfs_t - abrt tries to create dir in rpm_var_lib_t - virt relabels fifo_files - sshd needs to manage content in fusefs homedir - mock manages link files in cache dir- nslcd needs setsched and to read /usr/tmp - Invalid call in likewise policy ends up creating a bogus role - Cannon puts content into /var/lib/bjlib that cups needs to be able to write - Allow screen to create screen_home_t in /root - dirsrv sends syslog messages - pinentry reads stuff in .kde directory - Add labels for .kde directory in homedir - Treat irpinit, iprupdate, iprdump services with raid policy- NetworkManager wants to read consolekit_var_run_t - Allow readahead to create /dev/.systemd/readahead - Remove permissive domains - Allow newrole to run namespace_init- Add sepgsql_contexts file- Update to upstream- Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on - Add puppetmaster_use_db boolean - Fixes for zarafa policy - Fixes for gnomeclock poliy - Fix systemd-tmpfiles to use auth_use_nsswitch- gnomeclock executes a shell - Update for screen policy to handle pipe in homedir - Fixes for polyinstatiated homedir - Fixes for namespace policy and other fixes related to polyinstantiation - Add namespace policy - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts - Fixes for init, psad policy which relate with confined users - Do not audit bootloader attempts to read devicekit pid files - Allow nagios service plugins to read /proc- Add firewalld policy - Allow vmware_host to read samba config - Kernel wants to read /proc Fix duplicate grub def in cobbler - Chrony sends mail, executes shell, uses fifo_file and reads /proc - devicekitdisk getattr all file systems - sambd daemon writes wtmp file - libvirt transitions to dmidecode- Add initial policy for system-setup-keyboard which is now daemon - Label /var/lock/subsys/shorewall as shorewall_lock_t - Allow users to communicate with the gpg_agent_t - Dontaudit mozilla_plugin_t using the inherited terminal - Allow sambagui to read files in /usr - webalizer manages squid log files - Allow unconfined domains to bind ports to raw_ip_sockets - Allow abrt to manage rpm logs when running yum - Need labels for /var/run/bittlebee - Label .ssh under amanda - Remove unused genrequires for virt_domain_template - Allow virt_domain to use fd inherited from virtd_t - Allow iptables to read shorewall config- Gnome apps list config_home_t - mpd creates lnk files in homedir - apache leaks write to mail apps on tmp files - /var/stockmaniac/templates_cache contains log files - Abrt list the connects of mount_tmp_t dirs - passwd agent reads files under /dev and reads utmp file - squid apache script connects to the squid port - fix name of plymouth log file - teamviewer is a wine app - allow dmesg to read system state - Stop labeling files under /var/lib/mock so restorecon will not go into this - nsplugin needs to read network state for google talk- Allow xdm and syslog to use /var/log/boot.log - Allow users to communicate with mozilla_plugin and kill it - Add labeling for ipv6 and dhcp- New labels for ghc http content - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy- Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot- Update selinux policy to handle new /usr/share/sandbox/start script- Update to upstream - Fix version of policy in spec file- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs - remove per sandbox domains devpts types - Allow dkim-milter sending signal to itself- Allow domains that transition to ping or traceroute, kill them - Allow user_t to conditionally transition to ping_t and traceroute_t - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup- Turn on systemd policy - mozilla_plugin needs to read certs in the homedir. - Dontaudit leaked file descriptors from devicekit - Fix ircssi to use auth_use_nsswitch - Change to use interface without param in corenet to disable unlabelednet packets - Allow init to relabel sockets and fifo files in /dev - certmonger needs dac* capabilities to manage cert files not owned by root - dovecot needs fsetid to change group membership on mail - plymouthd removes /var/log/boot.log - systemd is creating symlinks in /dev - Change label on /etc/httpd/alias to be all cert_t- Fixes for clamscan and boinc policy - Add boinc_project_t setpgid - Allow alsa to create tmp files in /tmp- Push fixes to allow disabling of unlabeled_t packet access - Enable unlabelednet policy- Fixes for lvm to work with systemd- Fix the label for wicd log - plymouthd creates force-display-on-active-vt file - Allow avahi to request the kernel to load a module - Dontaudit hal leaks - Fix gnome_manage_data interface - Add new interface corenet_packet to define a type as being an packet_type. - Removed general access to packet_type from icecast and squid. - Allow mpd to read alsa config - Fix the label for wicd log - Add systemd policy- Fix gnome_manage_data interface - Dontaudit sys_ptrace capability for iscsid - Fixes for nagios plugin policy- Fix cron to run ranged when started by init - Fix devicekit to use log files - Dontaudit use of devicekit_var_run_t for fstools - Allow init to setattr on logfile directories - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t- Fix up handling of dnsmasq_t creating /var/run/libvirt/network - Turn on sshd_forward_ports boolean by default - Allow sysadmin to dbus chat with rpm - Add interface for rw_tpm_dev - Allow cron to execute bin - fsadm needs to write sysfs - Dontaudit consoletype reading /var/run/pm-utils - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin - certmonger needs to manage dirsrv data - /var/run/pm-utils should be labeled as devicekit_var_run_t- fixes to allow /var/run and /var/lock as tmpfs - Allow chrome sandbox to connect to web ports - Allow dovecot to listem on lmtp and sieve ports - Allov ddclient to search sysctl_net_t - Transition back to original domain if you execute the shell- Remove duplicate declaration- Update to upstream - Cleanup for sandbox - Add attribute to be able to select sandbox types- Allow ddclient to fix file mode bits of ddclient conf file - init leaks file descriptors to daemons - Add labels for /etc/lirc/ and - Allow amavis_t to exec shell - Add label for gssd_tmp_t for /var/tmp/nfs_0- Put back in lircd_etc_t so policy will install- Turn on allow_postfix_local_write_mail_spool - Allow initrc_t to transition to shutdown_t - Allow logwatch and cron to mls_read_to_clearance for MLS boxes - Allow wm to send signull to all applications and receive them from users - lircd patch from field - Login programs have to read /etc/samba - New programs under /lib/systemd - Abrt needs to read config files- Update to upstream - Dontaudit leaked sockets from userdomains to user domains - Fixes for mcelog to handle scripts - Apply patch from Ruben Kerkhof - Allow syslog to search spool dirs- Allow nagios plugins to read usr files - Allow mysqld-safe to send system log messages - Fixes fpr ddclient policy - Fix sasl_admin interface - Allow apache to search zarafa config - Allow munin plugins to search /var/lib directory - Allow gpsd to read sysfs_t - Fix labels on /etc/mcelog/triggers to bin_t- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp - Fix xserver interface - Fix definition of /var/run/lxdm- Turn on mediawiki policy - kdump leaks kdump_etc_t to ifconfig, add dontaudit - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap- Allow groupd transition to fenced domain when executes fence_node - Fixes for rchs policy - Allow mpd to be able to read samba/nfs files- Fix up corecommands.fc to match upstream - Make sure /lib/systemd/* is labeled init_exec_t - mount wants to setattr on all mountpoints - dovecot auth wants to read dovecot etc files - nscd daemon looks at the exe file of the comunicating daemon - openvpn wants to read utmp file - postfix apps now set sys_nice and lower limits - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly - Also resolves nsswitch - Fix labels on /etc/hosts.* - Cleanup to make upsteam patch work - allow abrt to read etc_runtime_t- Add conflicts for dirsrv package- Update to upstream - Add vlock policy- Fix sandbox to work on nfs homedirs - Allow cdrecord to setrlimit - Allow mozilla_plugin to read xauth - Change label on systemd-logger to syslogd_exec_t - Install dirsrv policy from dirsrv package- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it - Udev needs to stream connect to init and kernel - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory- Allow NetworkManager to read openvpn_etc_t - Dontaudit hplip to write of /usr dirs - Allow system_mail_t to create /root/dead.letter as mail_home_t - Add vdagent policy for spice agent daemon- Dontaudit sandbox sending sigkill to all user domains - Add policy for rssh_chroot_helper - Add missing flask definitions - Allow udev to relabelto removable_t - Fix label on /var/log/wicd.log - Transition to initrc_t from init when executing bin_t - Add audit_access permissions to file - Make removable_t a device_node - Fix label on /lib/systemd/*- Fixes for systemd to manage /var/run - Dontaudit leaks by firstboot- Allow chome to create netlink_route_socket - Add additional MATHLAB file context - Define nsplugin as an application_domain - Dontaudit sending signals from sandboxed domains to other domains - systemd requires init to build /tmp /var/auth and /var/lock dirs - mount wants to read devicekit_power /proc/ entries - mpd wants to connect to soundd port - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit - Treat lib_t and textrel_shlib_t directories the same - Allow mount read access on virtual images- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs. - Allow devicekit_power to domtrans to mount - Allow dhcp to bind to udp ports > 1024 to do named stuff - Allow ssh_t to exec ssh_exec_t - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used - Fix clamav_append_log() intefaces - Fix 'psad_rw_fifo_file' interface- Allow cobblerd to list cobler appache content- Fixup for the latest version of upowed - Dontaudit sandbox sending SIGNULL to desktop apps- Update to upstream-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access - dovecot-auth_t needs ipc_lock - gpm needs to use the user terminal - Allow system_mail_t to append ~/dead.letter - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf - Add pid file to vnstatd - Allow mount to communicate with gfs_controld - Dontaudit hal leaks in setfiles- Lots of fixes for systemd - systemd now executes readahead and tmpwatch type scripts - Needs to manage random seed- Allow smbd to use sys_admin - Remove duplicate file context for tcfmgr - Update to upstream- Fix fusefs handling - Do not allow sandbox to manage nsplugin_rw_t - Allow mozilla_plugin_t to connecto its parent - Allow init_t to connect to plymouthd running as kernel_t - Add mediawiki policy - dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. - Disable transition from dbus_session_domain to telepathy for F14 - Allow boinc_project to use shm - Allow certmonger to search through directories that contain certs - Allow fail2ban the DAC Override so it can read log files owned by non root users- Start adding support for use_fusefs_home_dirs - Add /var/lib/syslog directory file context - Add /etc/localtime as locale file context- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user - Turn off iptables from unconfined user - Allow sudo to send signals to any domains the user could have transitioned to. - Passwd in single user mode needs to talk to console_device_t - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio - locate tried to read a symbolic link, will dontaudit - New labels for telepathy-sunshine content in homedir - Google is storing other binaries under /opt/google/talkplugin - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15 - modemmanger and bluetooth send dbus messages to devicekit_power - Samba needs to getquota on filesystems labeld samba_share_t- Dontaudit attempts by xdm_t to write to bin_t for kdm - Allow initrc_t to manage system_conf_t- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets - Allow confined users to read xdm_etc_t files - Allow xdm_t to transition to xauth_t for lxdm program- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home - Allow clamd to send signals to itself - Allow mozilla_plugin_t to read user home content. And unlink pulseaudio shm. - Allow haze to connect to yahoo chat and messenger port tcp:5050. Bz #637339 - Allow guest to run ps command on its processes by allowing it to read /proc - Allow firewallgui to sys_rawio which seems to be required to setup masqerading - Allow all domains to search through default_t directories, in order to find differnet labels. For example people serring up /foo/bar to be share via samba. - Add label for /var/log/slim.log- Pull in cleanups from dgrift - Allow mozilla_plugin_t to execute mozilla_home_t - Allow rpc.quota to do quotamod- Cleanup policy via dgrift - Allow dovecot_deliver to append to inherited log files - Lots of fixes for consolehelper- Fix up Xguest policy- Add vnstat policy - allow libvirt to send audit messages - Allow chrome-sandbox to search nfs_t- Update to upstream- Add the ability to send audit messages to confined admin policies - Remove permissive domain from cmirrord and dontaudit sys_tty_config - Split out unconfined_domain() calls from other unconfined_ calls so we can d - virt needs to be able to read processes to clearance for MLS- Allow all domains that can use cgroups to search tmpfs_t directory - Allow init to send audit messages- Update to upstream- Allow mdadm_t to create files and sock files in /dev/md/- Add policy for ajaxterm- Handle /var/db/sudo - Allow pulseaudio to read alsa config - Allow init to send initrc_t dbus messagesAllow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr intd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port- Merge upstream fix of mmap_zero - Allow mount to write files in debugfs_t - Allow corosync to communicate with clvmd via tmpfs - Allow certmaster to read usr_t files - Allow dbus system services to search cgroup_t - Define rlogind_t as a login pgm- Allow mdadm_t to read/write hugetlbfs- Dominic Grift Cleanup - Miroslav Grepl policy for jabberd - Various fixes for mount/livecd and prelink- Merge with upstream- More access needed for devicekit - Add dbadm policy- Merge with upstream- Allow seunshare to fowner- Allow cron to look at user_cron_spool links - Lots of fixes for mozilla_plugin_t - Add sysv file system - Turn unconfined domains to permissive to find additional avcs- Update policy for mozilla_plugin_t- Allow clamscan to read proc_t - Allow mount_t to write to debufs_t dir - Dontaudit mount_t trying to write to security_t dir- Allow clamscan_t execmem if clamd_use_jit set - Add policy for firefox plugin-container- Fix /root/.forward definition- label dead.letter as mail_home_t- Allow login programs to search /cgroups- Fix cert handling- Fix devicekit_power bug - Allow policykit_auth_t more access.- Fix nis calls to allow bind to ports 512-1024 - Fix smartmon- Allow pcscd to read sysfs - systemd fixes - Fix wine_mmap_zero_ignore boolean- Apply Miroslav munin patch - Turn back on allow_execmem and allow_execmod booleans- Merge in fixes from dgrift repository- Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0- New paths for upstart- New permissions for syslog - New labels for /lib/upstart- Add mojomojo policy- Allow systemd to setsockcon on sockets to immitate other services- Remove debugfs label- Update to latest policy- Fix eclipse labeling from IBMSupportAssasstant packageing- Make boot with systemd in enforcing mode- Update to upstream- Add boolean to turn off port forwarding in sshd.- Add support for ebtables - Fixes for rhcs and corosync policy-Update to upstream-Update to upstream-Update to upstream- Add Zarafa policy- Cleanup of aiccu policy - initial mock policy- Lots of random fixes- Update to upstream- Update to upstream - Allow prelink script to signal itself - Cobbler fixes- Add xdm_var_run_t to xserver_stream_connect_xdm - Add cmorrord and mpd policy from Miroslav Grepl- Fix sshd creation of krb cc files for users to be user_tmp_t- Fixes for accountsdialog - Fixes for boinc- Fix label on /var/lib/dokwiki - Change permissive domains to enforcing - Fix libvirt policy to allow it to run on mls- Update to upstream- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t - Fix /var/run/abrtd.lock label- Allow login programs to read krb5_home_t Resolves: 594833 - Add obsoletes for cachefilesfd-selinux package Resolves: #575084- Allow mount to r/w abrt fifo file - Allow svirt_t to getattr on hugetlbfs - Allow abrt to create a directory under /var/spool- Add labels for /sys - Allow sshd to getattr on shutdown - Fixes for munin - Allow sssd to use the kernel key ring - Allow tor to send syslog messages - Allow iptabels to read usr files - allow policykit to read all domains state- Fix path for /var/spool/abrt - Allow nfs_t as an entrypoint for http_sys_script_t - Add policy for piranha - Lots of fixes for sosreport- Allow xm_t to read network state and get and set capabilities - Allow policykit to getattr all processes - Allow denyhosts to connect to tcp port 9911 - Allow pyranha to use raw ip sockets and ptrace itself - Allow unconfined_execmem_t and gconfsd mechanism to dbus - Allow staff to kill ping process - Add additional MLS rules- Allow gdm to edit ~/.gconf dir Resolves: #590677 - Allow dovecot to create directories in /var/lib/dovecot Partially resolves 590224 - Allow avahi to dbus chat with NetworkManager - Fix cobbler labels - Dontaudit iceauth_t leaks - fix /var/lib/lxdm file context - Allow aiccu to use tun tap devices - Dontaudit shutdown using xserver.log- Fixes for sandbox_x_net_t to match access for sandbox_web_t ++ - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory - Add dontaudit interface for bluetooth dbus - Add chronyd_read_keys, append_keys for initrc_t - Add log support for ksmtuned Resolves: #586663- Allow boinc to send mail- Allow initrc_t to remove dhcpc_state_t - Fix label on sa-update.cron - Allow dhcpc to restart chrony initrc - Don't allow sandbox to send signals to its parent processes - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t Resolves: #589136- Fix location of oddjob_mkhomedir Resolves: #587385 - fix labeling on /root/.shosts and ~/.shosts - Allow ipsec_mgmt_t to manage net_conf_t Resolves: #586760- Dontaudit sandbox trying to connect to netlink sockets Resolves: #587609 - Add policy for piranha- Fixups for xguest policy - Fixes for running sandbox firefox- Allow ksmtuned to use terminals Resolves: #586663 - Allow lircd to write to generic usb devices- Allow sandbox_xserver to connectto unconfined stream Resolves: #585171- Allow initrc_t to read slapd_db_t Resolves: #585476 - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf Resolves: #585963- Allow rlogind_t to search /root for .rhosts Resolves: #582760 - Fix path for cached_var_t - Fix prelink paths /var/lib/prelink - Allow confined users to direct_dri - Allow mls lvm/cryptosetup to work- Allow virtd_t to manage firewall/iptables config Resolves: #573585- Fix label on /root/.rhosts Resolves: #582760 - Add labels for Picasa - Allow openvpn to read home certs - Allow plymouthd_t to use tty_device_t - Run ncftool as iptables_t - Allow mount to unmount unlabeled_t - Dontaudit hal leaks- Allow livecd to transition to mount- Update to upstream - Allow abrt to delete sosreport Resolves: #579998 - Allow snmp to setuid and gid Resolves: #582155 - Allow smartd to use generic scsi devices Resolves: #582145- Allow ipsec_t to create /etc/resolv.conf with the correct label - Fix reserved port destination - Allow autofs to transition to showmount - Stop crashing tuned- Add telepathysofiasip policy- Update to upstream - Fix label for /opt/google/chrome/chrome-sandbox - Allow modemmanager to dbus with policykit- Fix allow_httpd_mod_auth_pam to use auth_use_pam(httpd_t) - Allow accountsd to read shadow file - Allow apache to send audit messages when using pam - Allow asterisk to bind and connect to sip tcp ports - Fixes for dovecot 2.0 - Allow initrc_t to setattr on milter directories - Add procmail_home_t for .procmailrc file- Fixes for labels during install from livecd- Fix /cgroup file context - Fix broken afs use of unlabled_t - Allow getty to use the console for s390- Fix cgroup handling adding policy for /cgroup - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set- Merge patches from dgrift- Update upstream - Allow abrt to write to the /proc under any process- Fix ~/.fontconfig label - Add /root/.cert label - Allow reading of the fixed_file_disk_t:lnk_file if you can read file - Allow qemu_exec_t as an entrypoint to svirt_t- Update to upstream - Allow tmpreaper to delete sandbox sock files - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems - Fixes for gitosis - No transition on livecd to passwd or chfn - Fixes for denyhosts- Add label for /var/lib/upower - Allow logrotate to run sssd - dontaudit readahead on tmpfs blk files - Allow tmpreaper to setattr on sandbox files - Allow confined users to execute dos files - Allow sysadm_t to kill processes running within its clearance - Add accountsd policy - Fixes for corosync policy - Fixes from crontab policy - Allow svirt to manage svirt_image_t chr files - Fixes for qdisk policy - Fixes for sssd policy - Fixes for newrole policy- make libvirt work on an MLS platform- Add qpidd policy- Update to upstream- Allow boinc to read kernel sysctl - Fix snmp port definitions - Allow apache to read anon_inodefs- Allow shutdown dac_override- Add device_t as a file system - Fix sysfs association- Dontaudit ipsec_mgmt sys_ptrace - Allow at to mail its spool files - Allow nsplugin to search in .pulse directory- Update to upstream- Allow users to dbus chat with xdm - Allow users to r/w wireless_device_t - Dontaudit reading of process states by ipsec_mgmt- Fix openoffice from unconfined_t- Add shutdown policy so consolekit can shutdown system- Update to upstream- Update to upstream- Update to upstream - These are merges of my patches - Remove 389 labeling conflicts - Add MLS fixes found in RHEL6 testing - Allow pulseaudio to run as a service - Add label for mssql and allow apache to connect to this database port if boolean set - Dontaudit searches of debugfs mount point - Allow policykit_auth to send signals to itself - Allow modcluster to call getpwnam - Allow swat to signal winbind - Allow usbmux to run as a system role - Allow svirt to create and use devpts- Add MLS fixes found in RHEL6 testing - Allow domains to append to rpm_tmp_t - Add cachefilesfd policy - Dontaudit leaks when transitioning- Change allow_execstack and allow_execmem booleans to on - dontaudit acct using console - Add label for fping - Allow tmpreaper to delete sandbox_file_t - Fix wine dontaudit mmap_zero - Allow abrt to read var_t symlinks- Additional policy for rgmanager- Allow sshd to setattr on pseudo terms- Update to upstream- Allow policykit to send itself signals- Fix duplicate cobbler definition- Fix file context of /var/lib/avahi-autoipd- Merge with upstream- Allow sandbox to work with MLS- Make Chrome work with staff user- Add icecast policy - Cleanup spec file- Add mcelog policy- Lots of fixes found in F12- Fix rpm_dontaudit_leaks- Add getsched to hald_t - Add file context for Fedora/Redhat Directory Server- Allow abrt_helper to getattr on all filesystems - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so- Add gstreamer_home_t for ~/.gstreamer- Update to upstream- Fix git- Turn on puppet policy - Update to dgrift git policy- Move users file to selection by spec file. - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t- Update to upstream- Remove most of the permissive domains from F12.- Add cobbler policy from dgrift- add usbmon device - Add allow rulse for devicekit_disk- Lots of fixes found in F12, fixes from Tom London- Cleanups from dgrift- Add back xserver_manage_home_fonts- Dontaudit sandbox trying to read nscd and sssd- Update to upstream- Rename udisks-daemon back to devicekit_disk_t policy- Fixes for abrt calls- Add tgtd policy- Update to upstream release- Add asterisk policy back in - Update to upstream release 2.20091117- Update to upstream release 2.20091117- Fixup nut policy- Update to upstream- Allow vpnc request the kernel to load modules- Fix minimum policy installs - Allow udev and rpcbind to request the kernel to load modules- Add plymouth policy - Allow local_login to sys_admin- Allow cupsd_config to read user tmp - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t- Update rhcs policy- Allow users to exec restorecond- Allow sendmail to request kernel modules load- Fix all kernel_request_load_module domains- Fix all kernel_request_load_module domains- Remove allow_exec* booleans for confined users. Only available for unconfined_t- More fixes for sandbox_web_t- Allow sshd to create .ssh directory and content- Fix request_module line to module_request- Fix sandbox policy to allow it to run under firefox. - Dont audit leaks.- Fixes for sandbox- Update to upstream - Dontaudit nsplugin search /root - Dontaudit nsplugin sys_nice- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service - Remove policycoreutils-python requirement except for minimum- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)- Add wordpress/wp-content/uploads label - Fixes for sandbox when run from staff_t- Update to upstream - Fixes for devicekit_disk- More fixes- Lots of fixes for initrc and other unconfined domains- Allow xserver to use netlink_kobject_uevent_socket- Fixes for sandbox- Dontaudit setroubleshootfix looking at /root directory- Update to upsteam- Allow gssd to send signals to users - Fix duplicate label for apache content- Update to upstream- Remove polkit_auth on upgrades- Add back in unconfined.pp and unconfineduser.pp - Add Sandbox unshare- Fixes for cdrecord, mdadm, and others- Add capability setting to dhcpc and gpm- Allow cronjobs to read exim_spool_t- Add ABRT policy- Fix system-config-services policy- Allow libvirt to change user componant of virt_domain- Allow cupsd_config_t to be started by dbus - Add smoltclient policy- Add policycoreutils-python to pre install- Make all unconfined_domains permissive so we can see what AVC's happen- Add pt_chown policy- Add kdump policy for Miroslav Grepl - Turn off execstack boolean- Turn on execstack on a temporary basis (#512845)- Allow nsplugin to connecto the session bus - Allow samba_net to write to coolkey data- Allow devicekit_disk to list inotify- Allow svirt images to create sock_file in svirt_var_run_t- Allow exim to getattr on mountpoints - Fixes for pulseaudio- Allow svirt_t to stream_connect to virtd_t- Allod hald_dccm_t to create sock_files in /tmp- More fixes from upstream- Fix polkit label - Remove hidebrokensymptoms for nss_ldap fix - Add modemmanager policy - Lots of merges from upstream - Begin removing textrel_shlib_t labels, from fixed libraries- Update to upstream- Allow certmaster to override dac permissions- Update to upstream- Fix context for VirtualBox- Update to upstream- Allow clamscan read amavis spool files- Fixes for xguest- fix multiple directory ownership of mandirs- Update to upstream- Add rules for rtkit-daemon- Update to upstream - Fix nlscd_stream_connect- Add rtkit policy- Allow rpcd_t to stream connect to rpcbind- Allow kpropd to create tmp files- Fix last duplicate /var/log/rpmpkgs- Update to upstream * add sssd- Update to upstream * cleanup- Update to upstream - Additional mail ports - Add virt_use_usb boolean for svirt- Fix mcs rules to include chr_file and blk_file- Add label for udev-acl- Additional rules for consolekit/udev, privoxy and various other fixes- New version for upstream- Allow NetworkManager to read inotifyfs- Allow setroubleshoot to run mlocate- Update to upstream- Add fish as a shell - Allow fprintd to list usbfs_t - Allow consolekit to search mountpoints - Add proper labeling for shorewall- New log file for vmware - Allow xdm to setattr on user_tmp_t- Upgrade to upstream- Allow fprintd to access sys_ptrace - Add sandbox policy- Add varnishd policy- Fixes for kpropd- Allow brctl to r/w tun_tap_device_t- Add /usr/share/selinux/packages- Allow rpcd_t to send signals to kernel threads- Fix upgrade for F10 to F11- Add policy for /var/lib/fprint-Remove duplicate line- Allow svirt to manage pci and other sysfs device data- Fix package selection handling- Fix /sbin/ip6tables-save context - Allod udev to transition to mount - Fix loading of mls policy file- Add shorewall policy- Additional rules for fprintd and sssd- Allow nsplugin to unix_read unix_write sem for unconfined_java- Fix uml files to be owned by users- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less- Allow confined users to manage virt_content_t, since this is home dir content - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection- Fix labeling on /var/lib/misc/prelink* - Allow xserver to rw_shm_perms with all x_clients - Allow prelink to execute files in the users home directory- Allow initrc_t to delete dev_null - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead- Update to latest milter code from Paul Howarth- Additional perms for readahead- Allow pulseaudio to acquire_svc on session bus - Fix readahead labeling- Allow sysadm_t to run rpm directly - libvirt needs fowner- Allow sshd to read var_lib symlinks for freenx- Allow nsplugin unix_read and write on users shm and sem - Allow sysadm_t to execute su- Dontaudit attempts to getattr user_tmpfs_t by lvm - Allow nfs to share removable media- Add ability to run postdrop from confined users- Fixes for podsleuth- Turn off nsplugin transition - Remove Konsole leaked file descriptors for release- Allow cupsd_t to create link files in print_spool_t - Fix iscsi_stream_connect typo - Fix labeling on /etc/acpi/actions - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed- Allow audioentroy to read etc files- Add fail2ban_var_lib_t - Fixes for devicekit_power_t- Separate out the ucnonfined user from the unconfined.pp package- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.- Upgrade to latest upstream - Allow devicekit_disk sys_rawio- Dontaudit binds to ports < 1024 for named - Upgrade to latest upstream- Allow podsleuth to use tmpfs files- Add customizable_types for svirt- Allow setroubelshoot exec* privs to prevent crash from bad libraries - add cpufreqselector- Dontaudit listing of /root directory for cron system jobs- Fix missing ld.so.cache label- Add label for ~/.forward and /root/.forward- Fixes for svirt- Fixes to allow svirt read iso files in homedir- Add xenner and wine fixes from mgrepl- Allow mdadm to read/write mls override- Change to svirt to only access svirt_image_t- Fix libvirt policy- Upgrade to latest upstream- Fixes for iscsid and sssd - More cleanups for upgrade from F10 to Rawhide.- Add pulseaudio, sssd policy - Allow networkmanager to exec udevadm- Add pulseaudio context- Upgrade to latest patches- Fixes for libvirt- Update to Latest upstream- Fix setrans.conf to show SystemLow for s0- Further confinement of qemu images via svirt- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild- Allow NetworkManager to manage /etc/NetworkManager/system-connections- add virtual_image_context and virtual_domain_context files- Allow rpcd_t to send signal to mount_t - Allow libvirtd to run ranged- Fix sysnet/net_conf_t- Fix squidGuard labeling- Re-add corenet_in_generic_if(unlabeled_t)* Tue Feb 10 2009 Dan Walsh 3.6.5-2 - Add git web policy- Add setrans contains from upstream- Do transitions outside of the booleans- Allow xdm to create user_tmp_t sockets for switch user to work- Fix staff_t domain- Grab remainder of network_peer_controls patch- More fixes for devicekit- Upgrade to latest upstream- Add boolean to disallow unconfined_t login- Add back transition from xguest to mozilla- Add virt_content_ro_t and labeling for isos directory- Fixes for wicd daemon- More mls/rpm fixes- Add policy to make dbus/nm-applet work- Remove polgen-ifgen from post and add trigger to policycoreutils-python- Add wm policy - Make mls work in graphics mode- Fixed for DeviceKit- Add devicekit policy- Update to upstream- Define openoffice as an x_domain- Fixes for reading xserver_tmp_t- Allow cups_pdf_t write to nfs_t- Remove audio_entropy policy- Update to upstream- Allow hal_acl_t to getattr/setattr fixed_disk- Change userdom_read_all_users_state to include reading symbolic links in /proc- Fix dbus reading /proc information- Add missing alias for home directory content- Fixes for IBM java location- Allow unconfined_r unconfined_java_t- Add cron_role back to user domains- Fix sudo setting of user keys- Allow iptables to talk to terminals - Fixes for policy kit - lots of fixes for booting.- Cleanup policy- Rebuild for Python 2.6- Fix labeling on /var/spool/rsyslog- Allow postgresl to bind to udp nodes- Allow lvm to dbus chat with hal - Allow rlogind to read nfs_t- Fix cyphesis file context- Allow hal/pm-utils to look at /var/run/video.rom - Add ulogd policy- Additional fixes for cyphesis - Fix certmaster file context - Add policy for system-config-samba - Allow hal to read /var/run/video.rom- Allow dhcpc to restart ypbind - Fixup labeling in /var/run- Add certmaster policy- Fix confined users - Allow xguest to read/write xguest_dbusd_t- Allow openoffice execstack/execmem privs- Allow mozilla to run with unconfined_execmem_t- Dontaudit domains trying to write to .xsession-errors- Allow nsplugin to look at autofs_t directory- Allow kerneloops to create tmp files- More alias for fastcgi- Remove mod_fcgid-selinux package- Fix dovecot access- Policy cleanup- Remove Multiple spec - Add include - Fix makefile to not call per_role_expansion- Fix labeling of libGL- Update to upstream- Update to upstream policy- Fixes for confined xwindows and xdm_t- Allow confined users and xdm to exec wm - Allow nsplugin to talk to fifo files on nfs- Allow NetworkManager to transition to avahi and iptables - Allow domains to search other domains keys, coverup kernel bug- Fix labeling for oracle- Allow nsplugin to comminicate with xdm_tmp_t sock_file- Change all user tmpfs_t files to be labeled user_tmpfs_t - Allow radiusd to create sock_files- Upgrade to upstream- Allow confined users to login with dbus- Fix transition to nsplugin- Add file context for /dev/mspblk.*- Fix transition to nsplugin '- Fix labeling on new pm*log - Allow ssh to bind to all nodes- Merge upstream changes - Add Xavier Toth patches- Add qemu_cache_t for /var/cache/libvirt- Remove gamin policy- Add tinyxs-max file system support- Update to upstream - New handling of init scripts- Allow pcsd to dbus - Add memcache policy- Allow audit dispatcher to kill his children- Update to upstream - Fix crontab use by unconfined user- Allow ifconfig_t to read dhcpc_state_t- Update to upstream- Update to upstream- Allow system-config-selinux to work with policykit- Fix novel labeling- Consolodate pyzor,spamassassin, razor into one security domain - Fix xdm requiring additional perms.- Fixes for logrotate, alsa- Eliminate vbetool duplicate entry- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t - Change dhclient to be able to red networkmanager_var_run- Update to latest refpolicy - Fix libsemanage initial install bug- Add inotify support to nscd- Allow unconfined_t to setfcap- Allow amanda to read tape - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi - Add support for netware file systems- Allow ypbind apps to net_bind_service- Allow all system domains and application domains to append to any log file- Allow gdm to read rpm database - Allow nsplugin to read mplayer config files- Allow vpnc to run ifconfig- Allow confined users to use postgres - Allow system_mail_t to exec other mail clients - Label mogrel_rails as an apache server- Apply unconfined_execmem_exec_t to haskell programs- Fix prelude file context- allow hplip to talk dbus - Fix context on ~/.local dir- Prevent applications from reading x_device- Add /var/lib/selinux context- Update to upstream- Add livecd policy- Dontaudit search of admin_home for init_system_domain - Rewrite of xace interfaces - Lots of new fs_list_inotify - Allow livecd to transition to setfiles_mac- Begin XAce integration- Merge Upstream- Allow amanada to create data files- Fix initial install, semanage setup- Allow system_r for httpd_unconfined_script_t- Remove dmesg boolean - Allow user domains to read/write game data- Change unconfined_t to transition to unconfined_mono_t when running mono - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work- Remove old booleans from targeted-booleans.conf file- Add boolean to mmap_zero - allow tor setgid - Allow gnomeclock to set clock- Don't run crontab from unconfined_t- Change etc files to config files to allow users to read them- Lots of fixes for confined domains on NFS_t homedir- dontaudit mrtg reading /proc - Allow iscsi to signal itself - Allow gnomeclock sys_ptrace- Allow dhcpd to read kernel network state- Label /var/run/gdm correctly - Fix unconfined_u user creation- Allow transition from initrc_t to getty_t- Allow passwd to communicate with user sockets to change gnome-keyring- Fix initial install- Allow radvd to use fifo_file - dontaudit setfiles reading links - allow semanage sys_resource - add allow_httpd_mod_auth_ntlm_winbind boolean - Allow privhome apps including dovecot read on nfs and cifs home dirs if the boolean is set- Allow nsplugin to read /etc/mozpluggerrc, user_fonts - Allow syslog to manage innd logs. - Allow procmail to ioctl spamd_exec_t- Allow initrc_t to dbus chat with consolekit.- Additional access for nsplugin - Allow xdm setcap/getcap until pulseaudio is fixed- Allow mount to mkdir on tmpfs - Allow ifconfig to search debugfs- Fix file context for MATLAB - Fixes for xace- Allow stunnel to transition to inetd children domains - Make unconfined_dbusd_t an unconfined domain- Fixes for qemu/virtd- Fix bug in mozilla policy to allow xguest transition - This will fix the libsemanage.dbase_llist_query: could not find record value libsemanage.dbase_llist_query: could not query record value (No such file or directory) bug in xguest- Allow nsplugin to run acroread- Add cups_pdf policy - Add openoffice policy to run in xguest- prewika needs to contact mysql - Allow syslog to read system_map files- Change init_t to an unconfined_domain- Allow init to transition to initrc_t on shell exec. - Fix init to be able to sendto init_t. - Allow syslog to connect to mysql - Allow lvm to manage its own fifo_files - Allow bugzilla to use ldap - More mls fixes- fixes for init policy (#436988) - fix build- Additional changes for MLS policy- Fix initrc_context generation for MLS- Fixes for libvirt- Allow bitlebee to read locale_t- More xselinux rules- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t- Prepare policy for beta release - Change some of the system domains back to unconfined - Turn on some of the booleans- Allow nsplugin_config execstack/execmem - Allow nsplugin_t to read alsa config - Change apache to use user content- Add cyphesis policy- Fix Makefile.devel to build mls modules - Fix qemu to be more specific on labeling- Update to upstream fixes- Allow staff to mounton user_home_t- Add xace support- Add fusectl file system- Fixes from yum-cron - Update to latest upstream- Fix userdom_list_user_files- Merge with upstream- Allow udev to send audit messages- Add additional login users interfaces - userdom_admin_login_user_template(staff)- More fixes for polkit- Eliminate transition from unconfined_t to qemu by default - Fixes for gpg- Update to upstream- Fixes for staff_t- Add policy for kerneloops - Add policy for gnomeclock- Fixes for libvirt- Fixes for nsplugin- More fixes for qemu- Additional ports for vnc and allow qemu and libvirt to search all directories- Update to upstream - Add libvirt policy - add qemu policy- Allow fail2ban to create a socket in /var/run- Allow allow_httpd_mod_auth_pam to work- Add audisp policy and prelude- Allow all user roles to executae samba net command- Allow usertypes to read/write noxattr file systems- Fix nsplugin to allow flashplugin to work in enforcing mode- Allow pam_selinux_permit to kill all processes- Allow ptrace or user processes by users of same type - Add boolean for transition to nsplugin- Allow nsplugin sys_nice, getsched, setsched- Allow login programs to talk dbus to oddjob- Add procmail_log support - Lots of fixes for munin- Allow setroubleshoot to read policy config and send audit messages- Allow users to execute all files in homedir, if boolean set - Allow mount to read samba config- Fixes for xguest to run java plugin- dontaudit pam_t and dbusd writing to user_home_t- Update gpg to allow reading of inotify- Change user and staff roles to work correctly with varied perms- Fix munin log, - Eliminate duplicate mozilla file context - fix wpa_supplicant spec- Fix role transition from unconfined_r to system_r when running rpm - Allow unconfined_domains to communicate with user dbus instances- Fixes for xguest- Let all uncofined domains communicate with dbus unconfined- Run rpm in system_r- Zero out customizable types- Fix definiton of admin_home_t- Fix munin file context- Allow cron to run unconfined apps- Modify default login to unconfined_u- Dontaudit dbus user client search of /root- Update to upstream- Fixes for polkit - Allow xserver to ptrace- Add polkit policy - Symplify userdom context, remove automatic per_role changes- Update to upstream - Allow httpd_sys_script_t to search users homedirs- Allow rpm_script to transition to unconfined_execmem_t- Remove user based home directory separation- Remove user specific crond_t- Merge with upstream - Allow xsever to read hwdata_t - Allow login programs to setkeycreate- Update to upstream- Update to upstream- Allow XServer to read /proc/self/cmdline - Fix unconfined cron jobs - Allow fetchmail to transition to procmail - Fixes for hald_mac - Allow system_mail to transition to exim - Allow tftpd to upload files - Allow xdm to manage unconfined_tmp - Allow udef to read alsa config - Fix xguest to be able to connect to sound port- Fixes for hald_mac - Treat unconfined_home_dir_t as a home dir - dontaudit rhgb writes to fonts and root- Fix dnsmasq - Allow rshd full login privs- Allow rshd to connect to ports > 1023- Fix vpn to bind to port 4500 - Allow ssh to create shm - Add Kismet policy- Allow rpm to chat with networkmanager- Fixes for ipsec and exim mail - Change default to unconfined user- Pass the UNK_PERMS param to makefile - Fix gdm location- Make alsa work- Fixes for consolekit and startx sessions- Dontaudit consoletype talking to unconfined_t- Remove homedir_template- Check asound.state- Fix exim policy- Allow tmpreadper to read man_t - Allow racoon to bind to all nodes - Fixes for finger print reader- Allow xdm to talk to input device (fingerprint reader) - Allow octave to run as java- Allow login programs to set ioctl on /proc- Allow nsswitch apps to read samba_var_t- Fix maxima- Eliminate rpm_t:fifo_file avcs - Fix dbus path for helper app- Fix service start stop terminal avc's- Allow also to search var_lib - New context for dbus launcher- Allow cupsd_config_t to read/write usb_device_t - Support for finger print reader, - Many fixes for clvmd - dbus starting networkmanager- Fix java and mono to run in xguest account- Fix to add xguest account when inititial install - Allow mono, java, wine to run in userdomains- Allow xserver to search devpts_t - Dontaudit ldconfig output to homedir- Remove hplip_etc_t change back to etc_t.- Allow cron to search nfs and samba homedirs- Allow NetworkManager to dbus chat with yum-updated- Allow xfs to bind to port 7100- Allow newalias/sendmail dac_override - Allow bind to bind to all udp ports- Turn off direct transition- Allow wine to run in system role- Fix java labeling- Define user_home_type as home_type- Allow sendmail to create etc_aliases_t- Allow login programs to read symlinks on homedirs- Update an readd modules- Cleanup spec file- Allow xserver to be started by unconfined process and talk to tty- Upgrade to upstream to grab postgressql changes- Add setransd for mls policy- Add ldconfig_cache_t- Allow sshd to write to proc_t for afs login- Allow xserver access to urand- allow dovecot to search mountpoints- Fix Makefile for building policy modules- Fix dhcpc startup of service- Fix dbus chat to not happen for xguest and guest users- Fix nagios cgi - allow squid to communicate with winbind- Fixes for ldconfig- Update from upstream- Add nasd support- Fix new usb devices and dmfm- Eliminate mount_ntfs_t policy, merge into mount_t- Allow xserver to write to ramfs mounted by rhgb- Add context for dbus machine id- Update with latest changes from upstream- Fix prelink to handle execmod- Add ntpd_key_t to handle secret data- Add anon_inodefs - Allow unpriv user exec pam_exec_t - Fix trigger- Allow cups to use generic usb - fix inetd to be able to run random apps (git)- Add proper contexts for rsyslogd- Fixes for xguest policy- Allow execution of gconf- Fix moilscanner update problem- Begin adding policy to separate setsebool from semanage - Fix xserver.if definition to not break sepolgen.if- Add new devices- Add brctl policy- Fix root login to include system_r- Allow prelink to read kernel sysctls- Default to user_u:system_r:unconfined_t- fix squid - Fix rpm running as uid- Fix syslog declaration- Allow avahi to access inotify - Remove a lot of bogus security_t:filesystem avcs- Remove ifdef strict policy from upstream- Remove ifdef strict to allow user_u to login- Fix for amands - Allow semanage to read pp files - Allow rhgb to read xdm_xserver_tmp- Allow kerberos servers to use ldap for backing store- allow alsactl to read kernel state- More fixes for alsactl - Transition from hal and modutils - Fixes for suspend resume. - insmod domtrans to alsactl - insmod writes to hal log- Allow unconfined_t to transition to NetworkManager_t - Fix netlabel policy- Update to latest from upstream- Update to latest from upstream- Update to latest from upstream- Allow pcscd_t to send itself signals- Fixes for unix_update - Fix logwatch to be able to search all dirs- Upstream bumped the version- Allow consolekit to syslog - Allow ntfs to work with hal- Allow iptables to read etc_runtime_t- MLS Fixes- Fix path of /etc/lvm/cache directory - Fixes for alsactl and pppd_t - Fixes for consolekit- Allow insmod_t to mount kvmfs_t filesystems- Rwho policy - Fixes for consolekit- fixes for fusefs- Fix samba_net to allow it to view samba_var_t- Update to upstream- Fix Sonypic backlight - Allow snmp to look at squid_conf_t- Fixes for pyzor, cyrus, consoletype on everything installs- Fix hald_acl_t to be able to getattr/setattr on usb devices - Dontaudit write to unconfined_pipes for load_policy- Allow bluetooth to read inotifyfs- Fixes for samba domain controller. - Allow ConsoleKit to look at ttys- Fix interface call- Allow syslog-ng to read /var - Allow locate to getattr on all filesystems - nscd needs setcap- Update to upstream- Allow samba to run groupadd- Update to upstream- Allow mdadm to access generic scsi devices- Fix labeling on udev.tbl dirs- Fixes for logwatch- Add fusermount and mount_ntfs policy- Update to upstream - Allow saslauthd to use kerberos keytabs- Fixes for samba_var_t- Allow networkmanager to setpgid - Fixes for hal_acl_t- Remove disable_trans booleans - hald_acl_t needs to talk to nscd- Fix prelink to be able to manage usr dirs.- Allow insmod to launch init scripts- Remove setsebool policy- Fix handling of unlabled_t packets- More of my patches from upstream- Update to latest from upstream - Add fail2ban policy- Update to remove security_t:filesystem getattr problems- Policy for consolekit- Update to latest from upstream- Revert Nemiver change - Set sudo as a corecmd so prelink will work, remove sudoedit mapping, since this will not work, it does not transition. - Allow samba to execute useradd- Upgrade to the latest from upstream- Add sepolgen support - Add bugzilla policy- Fix file context for nemiver- Remove include sym link- Allow mozilla, evolution and thunderbird to read dev_random. Resolves: #227002 - Allow spamd to connect to smtp port Resolves: #227184 - Fixes to make ypxfr work Resolves: #227237- Fix ssh_agent to be marked as an executable - Allow Hal to rw sound device- Fix spamassisin so crond can update spam files - Fixes to allow kpasswd to work - Fixes for bluetooth- Remove some targeted diffs in file context file- Fix squid cachemgr labeling- Add ability to generate webadm_t policy - Lots of new interfaces for httpd - Allow sshd to login as unconfined_t- Continue fixing, additional user domains- Begin adding user confinement to targeted policy- Fixes for prelink, ktalkd, netlabel- Allow prelink when run from rpm to create tmp files Resolves: #221865 - Remove file_context for exportfs Resolves: #221181 - Allow spamassassin to create ~/.spamassissin Resolves: #203290 - Allow ssh access to the krb tickets - Allow sshd to change passwd - Stop newrole -l from working on non securetty Resolves: #200110 - Fixes to run prelink in MLS machine Resolves: #221233 - Allow spamassassin to read var_lib_t dir Resolves: #219234- fix mplayer to work under strict policy - Allow iptables to use nscd Resolves: #220794- Add gconf policy and make it work with strict- Many fixes for strict policy and by extension mls.- Fix to allow ftp to bind to ports > 1024 Resolves: #219349- Allow semanage to exec it self. Label genhomedircon as semanage_exec_t Resolves: #219421 - Allow sysadm_lpr_t to manage other print spool jobs Resolves: #220080- allow automount to setgid Resolves: #219999- Allow cron to polyinstatiate - Fix creation of boot flags Resolves: #207433- Fixes for irqbalance Resolves: #219606- Fix vixie-cron to work on mls Resolves: #207433Resolves: #218978- Allow initrc to create files in /var directories Resolves: #219227- More fixes for MLS Resolves: #181566- More Fixes polyinstatiation Resolves: #216184- More Fixes polyinstatiation - Fix handling of keyrings Resolves: #216184- Fix polyinstatiation - Fix pcscd handling of terminal Resolves: #218149 Resolves: #218350- More fixes for quota Resolves: #212957- ncsd needs to use avahi sockets Resolves: #217640 Resolves: #218014- Allow login programs to polyinstatiate homedirs Resolves: #216184 - Allow quotacheck to create database files Resolves: #212957- Dontaudit appending hal_var_lib files Resolves: #217452 Resolves: #217571 Resolves: #217611 Resolves: #217640 Resolves: #217725- Fix context for helix players file_context #216942- Fix load_policy to be able to mls_write_down so it can talk to the terminal- Fixes for hwclock, clamav, ftp- Move to upstream version which accepted my patches- Fixes for nvidia driver- Allow semanage to signal mcstrans- Update to upstream- Allow modstorage to edit /etc/fstab file- Fix for qemu, /dev/- Fix path to realplayer.bin- Allow xen to connect to xen port- Allow cups to search samba_etc_t directory - Allow xend_t to list auto_mountpoints- Allow xen to search automount- Fix spec of jre files- Fix unconfined access to shadow file- Allow xend to create files in xen_image_t directories- Fixes for /var/lib/hal- Remove ability for sysadm_t to look at audit.log- Fix rpc_port_types - Add aide policy for mls- Merge with upstream- Lots of fixes for ricci- Allow xen to read/write fixed devices with a boolean - Allow apache to search /var/log- Fix policygentool specfile problem. - Allow apache to send signals to it's logging helpers. - Resolves: rhbz#212731- Add perms for swat- Add perms for swat- Allow daemons to dump core files to /- Fixes for ricci- Allow mount.nfs to work- Allow ricci-modstorage to look at lvm_etc_t- Fixes for ricci using saslauthd- Allow mountpoint on home_dir_t and home_t- Update xen to read nfs files- Allow noxattrfs to associate with other noxattrfs- Allow hal to use power_device_t- Allow procemail to look at autofs_t - Allow xen_image_t to work as a fixed device- Refupdate from upstream- Add lots of fixes for mls cups- Lots of fixes for ricci- Fix number of cats- Update to upstream- More iSCSI changes for #209854- Test ISCSI fixes for #209854- allow semodule to rmdir selinux_config_t dir- Fix boot_runtime_t problem on ppc. Should not be creating these files.- Fix context mounts on reboot - Fix ccs creation of directory in /var/log- Update for tallylog- Allow xend to rewrite dhcp conf files - Allow mgetty sys_admin capability- Make xentapctrl work- Don't transition unconfined_t to bootloader_t - Fix label in /dev/xen/blktap- Patch for labeled networking- Fix crond handling for mls- Update to upstream- Remove bluetooth-helper transition - Add selinux_validate for semanage - Require new version of libsemanage- Fix prelink- Fix rhgb- Fix setrans handling on MLS and useradd- Support for fuse - fix vigr- Fix dovecot, amanda - Fix mls- Allow java execheap for itanium- Update with upstream- mls fixes- Update from upstream- More fixes for mls - Revert change on automount transition to mount- Fix cron jobs to run under the correct context- Fixes to make pppd work- Multiple policy fixes - Change max categories to 1023- Fix transition on mcstransd- Add /dev/em8300 defs- Upgrade to upstream- Fix ppp connections from network manager- Add tty access to all domains boolean - Fix gnome-pty-helper context for ia64- Fixed typealias of firstboot_rw_t- Fix location of xel log files - Fix handling of sysadm_r -> rpm_exec_t- Fixes for autofs, lp- Update from upstream- Fixup for test6- Update to upstream- Update to upstream- Fix suspend to disk problems- Lots of fixes for restarting daemons at the console.- Fix audit line - Fix requires line- Upgrade to upstream- Fix install problems- Allow setroubleshoot to getattr on all dirs to gather RPM data- Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform - Fix spec for /dev/adsp- Fix xen tty devices- Fixes for setroubleshoot- Update to upstream- Fixes for stunnel and postgresql - Update from upstream- Update from upstream - More java fixes- Change allow_execstack to default to on, for RHEL5 Beta. This is required because of a Java compiler problem. Hope to turn off for next beta- Misc fixes- More fixes for strict policy- Quiet down anaconda audit messages- Fix setroubleshootd- Update to the latest from upstream- More fixes for xen- Fix anaconda transitions- yet more xen rules- more xen rules- Fixes for Samba- Fixes for xen- Allow setroubleshootd to send mail- Add nagios policy- fixes for setroubleshoot- Added Paul Howarth patch to only load policy packages shipped with this package - Allow pidof from initrc to ptrace higher level domains - Allow firstboot to communicate with hal via dbus- Add policy for /var/run/ldapi- Fix setroubleshoot policy- Fixes for mls use of ssh - named has a new conf file- Fixes to make setroubleshoot work- Cups needs to be able to read domain state off of printer client- add boolean to allow zebra to write config files- setroubleshootd fixes- Allow prelink to read bin_t symlink - allow xfs to read random devices - Change gfs to support xattr- Remove spamassassin_can_network boolean- Update to upstream - Fix lpr domain for mls- Add setroubleshoot policy- Turn off auditallow on setting booleans- Multiple fixes- Update to upstream- Update to upstream - Add new class for kernel key ring- Update to upstream- Update to upstream- Break out selinux-devel package- Add ibmasmfs- Fix policygentool gen_requires- Update from Upstream- Fix spec of realplay- Update to upstream- Fix semanage- Allow useradd to create_home_dir in MLS environment- Update from upstream- Update from upstream- Add oprofilefs- Fix for hplip and Picasus- Update to upstream- Update to upstream- fixes for spamd- fixes for java, openldap and webalizer- Xen fixes- Upgrade to upstream- allow hal to read boot_t files - Upgrade to upstream- allow hal to read boot_t files- Update from upstream- Fixes for amavis- Update from upstream- Allow auditctl to search all directories- Add acquire service for mono.- Turn off allow_execmem boolean - Allow ftp dac_override when allowed to access users homedirs- Clean up spec file - Transition from unconfined_t to prelink_t- Allow execution of cvs command- Update to upstream- Update to upstream- Fix libjvm spec- Update to upstream- Add xm policy - Fix policygentool- Update to upstream - Fix postun to only disable selinux on full removal of the packages- Allow mono to chat with unconfined- Allow procmail to sendmail - Allow nfs to share dosfs- Update to latest from upstream - Allow selinux-policy to be removed and kernel not to crash- Update to latest from upstream - Add James Antill patch for xen - Many fixes for pegasus- Add unconfined_mount_t - Allow privoxy to connect to httpd_cache - fix cups labeleing on /var/cache/cups- Update to latest from upstream- Update to latest from upstream - Allow mono and unconfined to talk to initrc_t dbus objects- Change libraries.fc to stop shlib_t form overriding texrel_shlib_t- Fix samba creating dirs in homedir - Fix NFS so its booleans would work- Allow secadm_t ability to relabel all files - Allow ftp to search xferlog_t directories - Allow mysql to communicate with ldap - Allow rsync to bind to rsync_port_t- Fixed mailman with Postfix #183928 - Allowed semanage to create file_context files. - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t to bind to reserved ports. #149030 - Don't allow devpts_t to be associated with tmp_t. - Allow hald_t to stat all mountpoints. - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts. - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of /etc/mtab. - Changed the file_contexts to not have a regex before the first ^/[a-z]/ whenever possible, makes restorecon slightly faster. - Correct the label of /etc/named.caching-nameserver.conf - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src hit by this. - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed xenstored_t rw access to the xen device node.- More textrel_shlib_t file path fixes - Add ada support- Get auditctl working in MLS policy- Add mono dbus support - Lots of file_context fixes for textrel_shlib_t in FC5 - Turn off execmem auditallow since they are filling log files- Update to upstream- Allow automount and dbus to read cert files- Fix ftp policy - Fix secadm running of auditctl- Update to upstream- Update to upstream- Fix policyhelp- Fix pam_console handling of usb_device - dontaudit logwatch reading /mnt dir- Update to upstream- Get transition rules to create policy.20 at SystemHigh- Allow secadmin to shutdown system - Allow sendmail to exec newalias- MLS Fixes dmidecode needs mls_file_read_up - add ypxfr_t - run init needs access to nscd - udev needs setuid - another xen log file - Dontaudit mount getattr proc_kcore_t- fix buildroot usage (#185391)- Get rid of mount/fsdisk scan of /dev messages - Additional fixes for suspend/resume- Fake make to rebuild enableaudit.pp- Get xen networking running.- Fixes for Xen - enableaudit should not be the same as base.pp - Allow ps to work for all process- more xen policy fixups- more xen fixage (#184393)- Fix blkid specification - Allow postfix to execute mailman_que- Blkid changes - Allow udev access to usb_device_t - Fix post script to create targeted policy config file- Allow lvm tools to create drevice dir- Add Xen support- Fixes for cups - Make cryptosetup work with hal- Load Policy needs translock- Fix cups html interface- Add hal changes suggested by Jeremy - add policyhelp to point at policy html pages- Additional fixes for nvidia and cups- Update to upstream - Merged my latest fixes - Fix cups policy to handle unix domain sockets- NSCD socket is in nscd_var_run_t needs to be able to search dir- Fixes Apache interface file- Fixes for new version of cups- Turn off polyinstatiate util after FC5- Fix problem with privoxy talking to Tor- Turn on polyinstatiation- Don't transition from unconfined_t to fsadm_t- Fix policy update model.- Update to upstream- Fix load_policy to work on MLS - Fix cron_rw_system_pipes for postfix_postdrop_t - Allow audotmount to run showmount- Fix swapon - allow httpd_sys_script_t to be entered via a shell - Allow httpd_sys_script_t to read eventpolfs- Update from upstream- allow cron to read apache files- Fix vpnc policy to work from NetworkManager- Update to upstream - Fix semoudle polcy- Update to upstream - fix sysconfig/selinux link- Add router port for zebra - Add imaze port for spamd - Fixes for amanda and java- Fix bluetooth handling of usb devices - Fix spamd reading of ~/ - fix nvidia spec- Update to upsteam- Add users_extra files- Update to upstream- Add semodule policy- Update from upstream- Fix for spamd to use razor port- Fixes for mcs - Turn on mount and fsadm for unconfined_t- Fixes for the -devel package- Fix for spamd to use ldap- Update to upstream- Update to upstream - Fix rhgb, and other Xorg startups- Update to upstream- Separate out role of secadm for mls- Add inotifyfs handling- Update to upstream - Put back in changes for pup/zen- Many changes for MLS - Turn on strict policy- Update to upstream- Update to upstream - Fixes for booting and logging in on MLS machine- Update to upstream - Turn off execheap execstack for unconfined users - Add mono/wine policy to allow execheap and execstack for them - Add execheap for Xdm policy- Update to upstream - Fixes to fetchmail,- Update to upstream- Fix for procmail/spamassasin - Update to upstream - Add rules to allow rpcd to work with unlabeled_networks.- Update to upstream - Fix ftp Man page- Update to upstream- fix pup transitions (#177262) - fix xen disks (#177599)- Update to upstream- More Fixes for hal and readahead- Fixes for hal and readahead- Update to upstream - Apply- Add wine and fix hal problems- Handle new location of hal scripts- Allow su to read /etc/mtab- Update to upstream- Fix "libsemanage.parse_module_headers: Data did not represent a module." problem- Allow load_policy to read /etc/mtab- Fix dovecot to allow dovecot_auth to look at /tmp- Allow restorecon to read unlabeled_t directories in order to fix labeling.- Add Logwatch policy- Fix /dev/ub[a-z] file context- Fix library specification - Give kudzu execmem privs- Fix hostname in targeted policy- Fix passwd command on mls- Lots of fixes to make mls policy work- Add dri libs to textrel_shlib_t - Add system_r role for java - Add unconfined_exec_t for vncserver - Allow slapd to use kerberos- Add man pages- Add enableaudit.pp- Fix mls policy- Update mls file from old version- Add sids back in - Rebuild with update checkpolicy- Fixes to allow automount to use portmap - Fixes to start kernel in s0-s15:c0.c255- Add java unconfined/execmem policy- Add file context for /var/cvs - Dontaudit webalizer search of homedir- Update from upstream- Clean up spec - range_transition crond to SystemHigh- Fixes for hal - Update to upstream- Turn back on execmem since we need it for java, firefox, ooffice - Allow gpm to stream socket to itself- fix requirements to be on the actual packages so that policy can get created properly at install time- Allow unconfined_t to execmod texrel_shlib_t- Update to upstream - Turn off allow_execmem and allow_execmod booleans - Add tcpd and automount policies- Add two new httpd booleans, turned off by default * httpd_can_network_relay * httpd_can_network_connect_db- Add ghost for policy.20- Update to upstream - Turn off boolean allow_execstack- Change setrans-mls to use new libsetrans - Add default_context rule for xdm- Change Requires to PreReg for requiring of policycoreutils on install- New upstream releaseAdd xdm policyUpdate from upstreamUpdate from upstreamUpdate from upstream- Also trigger to rebuild policy for versions up to 2.0.7.- No longer installing policy.20 file, anaconda handles the building of the app.- Fixes for dovecot and saslauthd- Cleanup pegasus and named - Fix spec file - Fix up passwd changing applications-Update to latest from upstream- Add rules for pegasus and avahi- Start building MLS Policy- Update to upstream- Turn on bash- Initial version/bin/sh  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-..0123456789:;<=>?@ABCDEFGHIJKLMN3.13.1-229.el7_6.12    develMakefileexample.fcexample.ifexample.tehtmlNetworkManager.htmlabrt.htmlabrt_dump_oops.htmlabrt_handle_event.htmlabrt_helper.htmlabrt_retrace_coredump.htmlabrt_retrace_worker.htmlabrt_upload_watch.htmlabrt_watch_log.htmlaccountsd.htmlacct.htmladmin_crontab.htmlafs.htmlafs_bosserver.htmlafs_fsserver.htmlafs_kaserver.htmlafs_ptserver.htmlafs_vlserver.htmlaiccu.htmlaide.htmlajaxterm.htmlajaxterm_ssh.htmlalsa.htmlamanda.htmlamanda_recover.htmlamtu.htmlanaconda.htmlanon_sftpd.htmlantivirus.htmlapcupsd.htmlapcupsd_cgi_script.htmlapm.htmlapmd.htmlarpwatch.htmlasterisk.htmlaudisp.htmlaudisp_remote.htmlauditadm.htmlauditadm_screen.htmlauditadm_su.htmlauditadm_sudo.htmlauditctl.htmlauditd.htmlauthconfig.htmlautomount.htmlavahi.htmlawstats.htmlawstats_script.htmlbacula.htmlbacula_admin.htmlbacula_unconfined_script.htmlbcfg2.htmlbitlbee.htmlblkmapd.htmlblktap.htmlblueman.htmlbluetooth.htmlbluetooth_helper.htmlboinc.htmlboinc_project.htmlbootloader.htmlbrctl.htmlbrltty.htmlbugzilla_script.htmlbumblebee.htmlcachefiles_kernel.htmlcachefilesd.htmlcalamaris.htmlcallweaver.htmlcanna.htmlcardmgr.htmlccs.htmlcdcc.htmlcdrecord.htmlcertmaster.htmlcertmonger.htmlcertmonger_unconfined.htmlcertwatch.htmlcfengine_execd.htmlcfengine_monitord.htmlcfengine_serverd.htmlcgclear.htmlcgconfig.htmlcgdcbxd.htmlcgred.htmlcheckpc.htmlcheckpolicy.htmlchfn.htmlchkpwd.htmlchrome_sandbox.htmlchrome_sandbox_nacl.htmlchronyc.htmlchronyd.htmlchroot_user.htmlcinder_api.htmlcinder_backup.htmlcinder_scheduler.htmlcinder_volume.htmlciped.htmlclogd.htmlcloud_init.htmlcluster.htmlclvmd.htmlcmirrord.htmlcobblerd.htmlcockpit_session.htmlcockpit_ws.htmlcollectd.htmlcollectd_script.htmlcolord.htmlcomsat.htmlcondor_collector.htmlcondor_master.htmlcondor_negotiator.htmlcondor_procd.htmlcondor_schedd.htmlcondor_startd.htmlcondor_startd_ssh.htmlconman.htmlconman_unconfined_script.htmlconsolekit.htmlcontainer.htmlcontainer_auth.htmlcontainer_runtime.htmlcouchdb.htmlcourier_authdaemon.htmlcourier_pcp.htmlcourier_pop.htmlcourier_sqwebmail.htmlcourier_tcpd.htmlcpucontrol.htmlcpufreqselector.htmlcpuplug.htmlcpuspeed.htmlcrack.htmlcrond.htmlcronjob.htmlcrontab.htmlctdbd.htmlcups_pdf.htmlcupsd.htmlcupsd_config.htmlcupsd_lpd.htmlcvs.htmlcvs_script.htmlcyphesis.htmlcyrus.htmldbadm.htmldbadm_sudo.htmldbskkd.htmldcc_client.htmldcc_dbclean.htmldccd.htmldccifd.htmldccm.htmldcerpcd.htmlddclient.htmldeltacloudd.htmldenyhosts.htmldepmod.htmldevicekit.htmldevicekit_disk.htmldevicekit_power.htmldhcpc.htmldhcpd.htmldictd.htmldirsrv.htmldirsrv_snmp.htmldirsrvadmin.htmldirsrvadmin_script.htmldirsrvadmin_unconfined_script.htmldisk_munin_plugin.htmldkim_milter.htmldlm_controld.htmldmesg.htmldmidecode.htmldnsmasq.htmldnssec_trigger.htmldovecot.htmldovecot_auth.htmldovecot_deliver.htmldrbd.htmldspam.htmldspam_script.htmlentropyd.htmleventlogd.htmlevtchnd.htmlexim.htmlfail2ban.htmlfail2ban_client.htmlfcoemon.htmlfenced.htmlfetchmail.htmlfingerd.htmlfirewalld.htmlfirewallgui.htmlfirstboot.htmlfoghorn.htmlfprintd.htmlfreeipmi_bmc_watchdog.htmlfreeipmi_ipmidetectd.htmlfreeipmi_ipmiseld.htmlfreqset.htmlfsadm.htmlfsdaemon.htmlftpd.htmlftpdctl.htmlgames.htmlgames_srv.htmlganesha.htmlgconfd.htmlgconfdefaultsm.htmlgdomap.htmlgeoclue.htmlgetty.htmlgfs_controld.htmlgit_script.htmlgit_session.htmlgit_system.htmlgitosis.htmlglance_api.htmlglance_registry.htmlglance_scrubber.htmlglusterd.htmlgnomesystemmm.htmlgpg.htmlgpg_agent.htmlgpg_helper.htmlgpg_pinentry.htmlgpg_web.htmlgpm.htmlgpsd.htmlgreylist_milter.htmlgroupadd.htmlgroupd.htmlgssd.htmlgssproxy.htmlguest.htmlhaproxy.htmlhddtemp.htmlhostname.htmlhsqldb.htmlhttpd.htmlhttpd_helper.htmlhttpd_passwd.htmlhttpd_php.htmlhttpd_rotatelogs.htmlhttpd_suexec.htmlhttpd_sys_script.htmlhttpd_unconfined_script.htmlhttpd_user_script.htmlhwclock.htmlhwloc_dhwd.htmlhypervkvp.htmlhypervvssd.htmliceauth.htmlicecast.htmlifconfig.htmlindex.htmlinetd.htmlinetd_child.htmlinit.htmlinitrc.htmlinnd.htmlinsmod.htmlinstall.htmliodined.htmliotop.htmlipa_dnskey.htmlipa_helper.htmlipa_otpd.htmlipmievd.htmlipsec.htmlipsec_mgmt.htmliptables.htmlirc.htmlirqbalance.htmlirssi.htmliscsid.htmlisnsd.htmliwhd.htmljabberd.htmljabberd_router.htmljockey.htmljournalctl.htmlkadmind.htmlkdump.htmlkdumpctl.htmlkdumpgui.htmlkeepalived.htmlkeepalived_unconfined_script.htmlkernel.htmlkeyboardd.htmlkeystone.htmlkeystone_cgi_script.htmlkismet.htmlklogd.htmlkmscon.htmlkpropd.htmlkrb5kdc.htmlksmtuned.htmlktalkd.htmll2tpd.htmlldconfig.htmllircd.htmllivecd.htmllldpad.htmlload_policy.htmlloadkeys.htmllocal_login.htmllocate.htmllockdev.htmllogadm.htmllogrotate.htmllogrotate_mail.htmllogwatch.htmllogwatch_mail.htmllpd.htmllpr.htmllsassd.htmllsmd.htmllsmd_plugin.htmllttng_sessiond.htmllvm.htmllwiod.htmllwregd.htmllwsmd.htmlmail_munin_plugin.htmlmailman_cgi.htmlmailman_mail.htmlmailman_queue.htmlman2html_script.htmlmandb.htmlmcelog.htmlmdadm.htmlmediawiki_script.htmlmemcached.htmlmencoder.htmlminidlna.htmlminissdpd.htmlmip6d.htmlmirrormanager.htmlmock.htmlmock_build.htmlmodemmanager.htmlmojomojo_script.htmlmon_procd.htmlmon_statd.htmlmongod.htmlmotion.htmlmount.htmlmount_ecryptfs.htmlmozilla.htmlmozilla_plugin.htmlmozilla_plugin_config.htmlmpd.htmlmplayer.htmlmrtg.htmlmscan.htmlmunin.htmlmunin_script.htmlmysqld.htmlmysqld_safe.htmlmysqlmanagerd.htmlmythtv_script.htmlnagios.htmlnagios_admin_plugin.htmlnagios_checkdisk_plugin.htmlnagios_eventhandler_plugin.htmlnagios_mail_plugin.htmlnagios_openshift_plugin.htmlnagios_script.htmlnagios_services_plugin.htmlnagios_system_plugin.htmlnagios_unconfined_plugin.htmlnamed.htmlnamespace_init.htmlncftool.htmlndc.htmlnetlabel_mgmt.htmlnetlogond.htmlnetutils.htmlneutron.htmlnewrole.htmlnfsd.htmlninfod.htmlnmbd.htmlnova.htmlnrpe.htmlnscd.htmlnsd.htmlnsd_crond.htmlnslcd.htmlntop.htmlntpd.htmlnumad.htmlnut_upsd.htmlnut_upsdrvctl.htmlnut_upsmon.htmlnutups_cgi_script.htmlnx_server.htmlnx_server_ssh.htmlobex.htmloddjob.htmloddjob_mkhomedir.htmlopenct.htmlopendnssec.htmlopenhpid.htmlopenshift.htmlopenshift_app.htmlopenshift_cgroup_read.htmlopenshift_cron.htmlopenshift_initrc.htmlopenshift_net_read.htmlopenshift_script.htmlopensm.htmlopenvpn.htmlopenvpn_unconfined_script.htmlopenvswitch.htmlopenwsman.htmloracleasm.htmlosad.htmlpads.htmlpam_console.htmlpam_timestamp.htmlpassenger.htmlpasswd.htmlpcp_pmcd.htmlpcp_pmie.htmlpcp_pmlogger.htmlpcp_pmmgr.htmlpcp_pmproxy.htmlpcp_pmwebd.htmlpcscd.htmlpegasus.htmlpegasus_openlmi_account.htmlpegasus_openlmi_admin.htmlpegasus_openlmi_logicalfile.htmlpegasus_openlmi_services.htmlpegasus_openlmi_storage.htmlpegasus_openlmi_system.htmlpegasus_openlmi_unconfined.htmlpesign.htmlphc2sys.htmlping.htmlpingd.htmlpiranha_fos.htmlpiranha_lvs.htmlpiranha_pulse.htmlpiranha_web.htmlpkcs_slotd.htmlpki_ra.htmlpki_tomcat.htmlpki_tomcat_script.htmlpki_tps.htmlplymouth.htmlplymouthd.htmlpodsleuth.htmlpolicykit.htmlpolicykit_auth.htmlpolicykit_grant.htmlpolicykit_resolve.htmlpolipo.htmlpolipo_session.htmlportmap.htmlportmap_helper.htmlportreserve.htmlpostfix_bounce.htmlpostfix_cleanup.htmlpostfix_local.htmlpostfix_map.htmlpostfix_master.htmlpostfix_pickup.htmlpostfix_pipe.htmlpostfix_postdrop.htmlpostfix_postqueue.htmlpostfix_qmgr.htmlpostfix_showq.htmlpostfix_smtp.htmlpostfix_smtpd.htmlpostfix_virtual.htmlpostgresql.htmlpostgrey.htmlpppd.htmlpptp.htmlprelink.htmlprelink_cron_system.htmlprelude.htmlprelude_audisp.htmlprelude_correlator.htmlprelude_lml.htmlpreupgrade.htmlprewikka_script.htmlprivoxy.htmlprocmail.htmlprosody.htmlpsad.htmlptal.htmlptchown.htmlptp4l.htmlpublicfile.htmlpulseaudio.htmlpuppetagent.htmlpuppetca.htmlpuppetmaster.htmlpwauth.htmlpyicqt.htmlqdiskd.htmlqemu_dm.htmlqmail_clean.htmlqmail_inject.htmlqmail_local.htmlqmail_lspawn.htmlqmail_queue.htmlqmail_remote.htmlqmail_rspawn.htmlqmail_send.htmlqmail_smtpd.htmlqmail_splogger.htmlqmail_start.htmlqmail_tcp_env.htmlqpidd.htmlquota.htmlquota_nld.htmlrabbitmq.htmlracoon.htmlradiusd.htmlradvd.htmlrasdaemon.htmlrdisc.htmlreadahead.htmlrealmd.htmlrealmd_consolehelper.htmlredis.htmlregex_milter.htmlremote_login.htmlrestorecond.htmlrhev_agentd.htmlrhev_agentd_consolehelper.htmlrhgb.htmlrhnsd.htmlrhsmcertd.htmlricci.htmlricci_modcluster.htmlricci_modclusterd.htmlricci_modlog.htmlricci_modrpm.htmlricci_modservice.htmlricci_modstorage.htmlrlogind.htmlrngd.htmlroundup.htmlrpcbind.htmlrpcd.htmlrpm.htmlrpm_script.htmlrshd.htmlrssh.htmlrssh_chroot_helper.htmlrsync.htmlrtas_errd.htmlrtkit_daemon.htmlrun_init.htmlrwho.htmlsamba_net.htmlsamba_unconfined_net.htmlsamba_unconfined_script.htmlsambagui.htmlsandbox.htmlsandbox_min.htmlsandbox_min_client.htmlsandbox_net.htmlsandbox_net_client.htmlsandbox_web.htmlsandbox_web_client.htmlsandbox_x.htmlsandbox_x_client.htmlsandbox_xserver.htmlsanlk_resetd.htmlsanlock.htmlsaslauthd.htmlsbd.htmlsblim_gatherd.htmlsblim_reposd.htmlsblim_sfcbd.htmlsecadm.htmlsecadm_screen.htmlsecadm_su.htmlsecadm_sudo.htmlsectoolm.htmlselinux_munin_plugin.htmlsemanage.htmlsendmail.htmlsensord.htmlsepgsql_ranged_proc.htmlsepgsql_trusted_proc.htmlservices_munin_plugin.htmlsetfiles.htmlsetfiles_mac.htmlsetkey.htmlsetrans.htmlsetroubleshoot_fixit.htmlsetroubleshootd.htmlsetsebool.htmlsftpd.htmlsge_execd.htmlsge_job.htmlsge_job_ssh.htmlsge_shepherd.htmlshorewall.htmlshowmount.htmlslapd.htmlslpd.htmlsmbcontrol.htmlsmbd.htmlsmbmount.htmlsmokeping.htmlsmokeping_cgi_script.htmlsmoltclient.htmlsmsd.htmlsnapperd.htmlsnmpd.htmlsnort.htmlsosreport.htmlsoundd.htmlspamass_milter.htmlspamc.htmlspamd.htmlspamd_update.htmlspc.htmlspeech-dispatcher.htmlsquid.htmlsquid_cron.htmlsquid_script.htmlsrvsvcd.htmlssh.htmlssh_keygen.htmlssh_keysign.htmlsshd.htmlsshd_keygen.htmlsshd_net.htmlsshd_sandbox.htmlsssd.htmlsssd_selinux_manager.htmlstaff.htmlstaff_consolehelper.htmlstaff_dbusd.htmlstaff_gkeyringd.htmlstaff_screen.htmlstaff_seunshare.htmlstaff_ssh_agent.htmlstaff_sudo.htmlstaff_wine.htmlstapserver.htmlstunnel.htmlstyle.csssulogin.htmlsvc_multilog.htmlsvc_run.htmlsvc_start.htmlsvirt.htmlsvirt_kvm_net.htmlsvirt_qemu_net.htmlsvirt_socket.htmlsvirt_tcg.htmlsvnserve.htmlswat.htmlswift.htmlsysadm.htmlsysadm_gkeyringd.htmlsysadm_passwd.htmlsysadm_screen.htmlsysadm_seunshare.htmlsysadm_ssh_agent.htmlsysadm_su.htmlsysadm_sudo.htmlsyslogd.htmlsysstat.htmlsystem_cronjob.htmlsystem_dbusd.htmlsystem_mail.htmlsystem_munin_plugin.htmlsystemd_bootchart.htmlsystemd_hostnamed.htmlsystemd_hwdb.htmlsystemd_initctl.htmlsystemd_localed.htmlsystemd_logger.htmlsystemd_logind.htmlsystemd_machined.htmlsystemd_networkd.htmlsystemd_notify.htmlsystemd_passwd_agent.htmlsystemd_resolved.htmlsystemd_sysctl.htmlsystemd_timedated.htmlsystemd_tmpfiles.htmltangd.htmltargetd.htmltcpd.htmltcsd.htmltelepathy_gabble.htmltelepathy_idle.htmltelepathy_logger.htmltelepathy_mission_control.htmltelepathy_msn.htmltelepathy_salut.htmltelepathy_sofiasip.htmltelepathy_stream_engine.htmltelepathy_sunshine.htmltelnetd.htmltftpd.htmltgtd.htmlthin.htmlthin_aeolus_configserver.htmlthumb.htmltimemaster.htmltlp.htmltmpreaper.htmltomcat.htmltor.htmltraceroute.htmltuned.htmltvtime.htmludev.htmlulogd.htmluml.htmluml_switch.htmlunconfined.htmlunconfined_cronjob.htmlunconfined_dbusd.htmlunconfined_mount.htmlunconfined_munin_plugin.htmlunconfined_sendmail.htmlunconfined_service.htmlupdate_modules.htmlupdfstab.htmlupdpwd.htmlusbmodules.htmlusbmuxd.htmluser.htmluser_dbusd.htmluser_gkeyringd.htmluser_mail.htmluser_screen.htmluser_seunshare.htmluser_ssh_agent.htmluser_wine.htmluseradd.htmlusernetctl.htmlutempter.htmluucpd.htmluuidd.htmluux.htmlvarnishd.htmlvarnishlog.htmlvdagent.htmlvhostmd.htmlvirsh.htmlvirsh_ssh.htmlvirt_bridgehelper.htmlvirt_qemu_ga.htmlvirt_qemu_ga_unconfined.htmlvirt_qmf.htmlvirtd.htmlvirtd_lxc.htmlvirtlogd.htmlvlock.htmlvmtools.htmlvmtools_helper.htmlvmtools_unconfined.htmlvmware.htmlvmware_host.htmlvnstat.htmlvnstatd.htmlvpnc.htmlw3c_validator_script.htmlwatchdog.htmlwatchdog_unconfined.htmlwdmd.htmlwebadm.htmlwebalizer.htmlwebalizer_script.htmlwinbind.htmlwinbind_helper.htmlwine.htmlwireshark.htmlwpa_cli.htmlxauth.htmlxdm.htmlxdm_unconfined.htmlxenconsoled.htmlxend.htmlxenstored.htmlxguest.htmlxguest_dbusd.htmlxguest_gkeyringd.htmlxserver.htmlypbind.htmlyppasswdd.htmlypserv.htmlypxfr.htmlzabbix.htmlzabbix_agent.htmlzabbix_script.htmlzarafa_deliver.htmlzarafa_gateway.htmlzarafa_ical.htmlzarafa_indexer.htmlzarafa_monitor.htmlzarafa_server.htmlzarafa_spooler.htmlzebra.htmlzoneminder.htmlzoneminder_script.htmlzos_remote.htmlincludeMakefileadminadmin.xmlbootloader.ifconsoletype.ifdmesg.ifnetutils.ifsu.ifsudo.ifusermanage.ifappsapps.xmlseunshare.ifbuild.confcontribcontrib.xmlabrt.ifaccountsd.ifacct.ifada.ifafs.ifaiccu.ifaide.ifaisexec.ifajaxterm.ifalsa.ifamanda.ifamavis.ifamtu.ifanaconda.ifantivirus.ifapache.ifapcupsd.ifapm.ifapt.ifarpwatch.ifasterisk.ifauthbind.ifauthconfig.ifautomount.ifavahi.ifawstats.ifbackup.ifbacula.ifbcfg2.ifbind.ifbird.ifbitlbee.ifblkmapd.ifblueman.ifbluetooth.ifboinc.ifbrctl.ifbrltty.ifbugzilla.ifbumblebee.ifcachefilesd.ifcalamaris.ifcallweaver.ifcanna.ifccs.ifcdrecord.ifcertmaster.ifcertmonger.ifcertwatch.ifcfengine.ifcgdcbxd.ifcgroup.ifchrome.ifchronyd.ifcinder.ifcipe.ifclamav.ifclockspeed.ifclogd.ifcloudform.ifcmirrord.ifcobbler.ifcockpit.ifcollectd.ifcolord.ifcomsat.ifcondor.ifconman.ifconsolekit.ifcontainer.ifcorosync.ifcouchdb.ifcourier.ifcpucontrol.ifcpufreqselector.ifcpuplug.ifcron.ifctdb.ifcups.ifcvs.ifcyphesis.ifcyrus.ifdaemontools.ifdante.ifdbadm.ifdbskk.ifdbus.ifdcc.ifddclient.ifddcprobe.ifdenyhosts.ifdevicekit.ifdhcp.ifdictd.ifdirmngr.ifdirsrv-admin.ifdirsrv.ifdistcc.ifdjbdns.ifdkim.ifdmidecode.ifdnsmasq.ifdnssec.ifdnssectrigger.ifdovecot.ifdpkg.ifdrbd.ifdspam.ifentropyd.ifetcd.ifevolution.ifexim.iffail2ban.iffcoe.iffetchmail.iffinger.iffirewalld.iffirewallgui.iffirstboot.iffprintd.iffreeipmi.iffreqset.ifftp.ifgames.ifganesha.ifgatekeeper.ifgdomap.ifgear.ifgeoclue.ifgift.ifgit.ifgitosis.ifglance.ifglusterd.ifgnome.ifgnomeclock.ifgpg.ifgpm.ifgpsd.ifgssproxy.ifguest.ifhadoop.ifhal.ifhddtemp.ifhostapd.ifhowl.ifhsqldb.ifhwloc.ifhypervkvp.ifi18n_input.ificecast.ififplugd.ifimaze.ifinetd.ifinn.ifiodine.ifiotop.ifipa.ifipmievd.ifirc.ifircd.ifirqbalance.ifiscsi.ifisns.ifjabber.ifjava.ifjetty.ifjockey.ifjournalctl.ifkde.ifkdump.ifkdumpgui.ifkeepalived.ifkerberos.ifkerneloops.ifkeyboardd.ifkeystone.ifkismet.ifkmscon.ifksmtuned.ifktalk.ifkudzu.ifl2tp.ifldap.iflightsquid.iflikewise.iflinuxptp.iflircd.iflivecd.iflldpad.ifloadkeys.iflockdev.iflogrotate.iflogwatch.iflpd.iflsm.iflttng-tools.ifmailman.ifmailscanner.ifman2html.ifmandb.ifmcelog.ifmcollective.ifmediawiki.ifmemcached.ifmilter.ifminidlna.ifminissdpd.ifmip6d.ifmirrormanager.ifmock.ifmodemmanager.ifmojomojo.ifmon_statd.ifmongodb.ifmono.ifmonop.ifmotion.ifmozilla.ifmpd.ifmplayer.ifmrtg.ifmta.ifmunin.ifmysql.ifmythtv.ifnaemon.ifnagios.ifnamespace.ifncftool.ifnessus.ifnetworkmanager.ifninfod.ifnis.ifnova.ifnscd.ifnsd.ifnslcd.ifnsplugin.ifntop.ifntp.ifnumad.ifnut.ifnx.ifoav.ifobex.ifoddjob.ifoident.ifopenca.ifopenct.ifopendnssec.ifopenhpi.ifopenhpid.ifopenshift-origin.ifopenshift.ifopensm.ifopenvpn.ifopenvswitch.ifopenwsman.iforacleasm.ifosad.ifpacemaker.ifpads.ifpassenger.ifpcmcia.ifpcp.ifpcscd.ifpegasus.ifperdition.ifpesign.ifpingd.ifpiranha.ifpkcs.ifpki.ifplymouthd.ifpodsleuth.ifpolicykit.ifpolipo.ifportage.ifportmap.ifportreserve.ifportslave.ifpostfix.ifpostfixpolicyd.ifpostgrey.ifppp.ifprelink.ifprelude.ifprivoxy.ifprocmail.ifprosody.ifpsad.ifptchown.ifpublicfile.ifpulseaudio.ifpuppet.ifpwauth.ifpxe.ifpyzor.ifqemu.ifqmail.ifqpid.ifquantum.ifquota.ifrabbitmq.ifradius.ifradvd.ifraid.ifrasdaemon.ifrazor.ifrdisc.ifreadahead.ifrealmd.ifredis.ifremotelogin.ifresmgr.ifrgmanager.ifrhcs.ifrhev.ifrhgb.ifrhnsd.ifrhsmcertd.ifricci.ifrkhunter.ifrlogin.ifrngd.ifrolekit.ifroundup.ifrpc.ifrpcbind.ifrpm.ifrshd.ifrssh.ifrsync.ifrtas.ifrtkit.ifrwho.ifsamba.ifsambagui.ifsamhain.ifsandbox.ifsandboxX.ifsanlock.ifsasl.ifsbd.ifsblim.ifscreen.ifsectoolm.ifsendmail.ifsensord.ifsetroubleshoot.ifsge.ifshorewall.ifshutdown.ifslocate.ifslpd.ifslrnpull.ifsmartmon.ifsmokeping.ifsmoltclient.ifsmsd.ifsmstools.ifsnapper.ifsnmp.ifsnort.ifsosreport.ifsoundserver.ifspamassassin.ifspeech-dispatcher.ifspeedtouch.ifsquid.ifsssd.ifstapserver.ifstunnel.ifsvnserve.ifswift.ifswift_alias.ifsxid.ifsysstat.iftangd.iftargetd.iftcpd.iftcsd.iftelepathy.iftelnet.iftftp.iftgtd.ifthin.ifthumb.ifthunderbird.iftimidity.iftlp.iftmpreaper.iftomcat.iftor.iftransproxy.iftripwire.iftuned.iftvtime.iftzdata.ifucspitcp.ifulogd.ifuml.ifupdfstab.ifuptime.ifusbmodules.ifusbmuxd.ifuserhelper.ifusernetctl.ifuucp.ifuuidd.ifuwimap.ifvarnishd.ifvbetool.ifvdagent.ifvhostmd.ifvirt.ifvlock.ifvmtools.ifvmware.ifvnstatd.ifvpn.ifw3c.ifwatchdog.ifwdmd.ifwebadm.ifwebalizer.ifwine.ifwireshark.ifwm.ifxen.ifxfs.ifxguest.ifxprint.ifxscreensaver.ifyam.ifzabbix.ifzarafa.ifzebra.ifzoneminder.ifzosremote.ifglobal_booleans.xmlglobal_tunables.xmlkernelkernel.xmlcorecommands.ifcorenetwork.ifdevices.ifdomain.iffiles.iffilesystem.ifkernel.ifmcs.ifmls.ifselinux.ifstorage.ifterminal.ifubac.ifunlabelednet.ifrolesroles.xmlauditadm.iflogadm.ifsecadm.ifstaff.ifsysadm.ifsysadm_secadm.ifunconfineduser.ifunprivuser.ifservicesservices.xmlpostgresql.ifssh.ifxserver.ifsupportall_perms.sptdivert.m4file_patterns.sptipc_patterns.sptloadable_module.sptmisc_macros.sptmisc_patterns.sptmls_mcs_macros.sptobj_perm_sets.sptpolicy.dtdsegenxml.pysegenxml.pycsegenxml.pyoundivert.m4systemsystem.xmlapplication.ifauthlogin.ifclock.iffstools.ifgetty.ifhostname.ifhotplug.ifinit.ifipsec.ifiptables.iflibraries.iflocallogin.iflogging.iflvm.ifmiscfiles.ifmodutils.ifmount.ifnetlabel.ifselinuxutil.ifsetrans.ifsysnetwork.ifsystemd.ifudev.ifunconfined.ifuserdomain.ifpolicy.dtdpolicy.xmlinterface_info/usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/html//usr/share/selinux/devel/include//usr/share/selinux/devel/include/admin//usr/share/selinux/devel/include/apps//usr/share/selinux/devel/include/contrib//usr/share/selinux/devel/include/kernel//usr/share/selinux/devel/include/roles//usr/share/selinux/devel/include/services//usr/share/selinux/devel/include/support//usr/share/selinux/devel/include/system//var/lib/sepolgen/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m32 -march=athlon -fasynchronous-unwind-tablescpioxz9noarch-redhat-linux-gnu  directoryASCII textSE Linux policy interface sourceSE Linux policy module sourceHTML document, ASCII textmakefile script, ASCII textC++ source, ASCII textASCII text, with very long linesASCII text, with no line terminatorsPython script, ASCII text executablepython 2.7 byte-compiledXML 1.0 document, ASCII textcannot open (No such file or directory)?`7zXZ !X] crt:bLLlҦPfUO$8$FooXD\{Vo&B7Ƽ*& t0ҦZL޵msloB>wP޲~k?ǜx<76 C`!Ɠ$F4$2Hע.TQop̏&Ċ /09BscʩyK!CJu8-Rzpfggx`;*0AvPR}kMlĦ$Gh Lb 7[bU%jfPo_BVO|2H=a*}u}M9_ <_"و;'2HqzWP8FwOMm&~s>qvuN N!&m*}L@TsLIbr8{X|;. J7vBVIw&fp5;PR0 :P^gtL6 I |fsZ8ͮ}FA mwn, RA3 ;=XQvOy'Ol0Е&W4)řA#9&1ߙ]l ZZ`&TgLؚtFZAD4t;`‡RYrac:5n7 zFU9|ݺOMXQT@ʊ)@.(옋`ih^zsY"7I\n< -c;%6޻e-"7VS|:2d‰%oނh|D&;δ)V iH@95WV:˷L I5>+_-7nCݤYCV70'[(LjHw'εiGN ߃A&+͹4`cdU[NHw-J9.P-Wxi&fzw-/ ·2W_ho/$qTEz4d55GG'NQ '9c)G=tH{dӺm 3PA ,FJx'j3SMu^(B +A~䩓@pyٷ)woiG;>Ȇ$)T~+F(& FgI> ȴ;A)εc`Au0$_HY>of3swQ^#컻=JXWwɄ1:ĥjצ6#{z8_g;b'_ Y _l֦w^?G-tU@ G;r S ]yJgYȉMN]=/Ô׍>EqI:o !FBC)k s[2@^1ٳ{ FI{5]! /V탳 6qZ5S]:3RovzXikٞp;#cϤ/!+,& w}B5 TE֛D-E4?QB =d[ɖr!Yӓ1v#(-!3 eqQ4fpN w^g$c T0 =xB 1Yj~XMjVFzfŞ_iK@K}Ze; P3"O_&RX7 1oYWvH']u"Iej (,9ڜw`NވsofSjOT@s|=n 1Yqb@$DJz|=vdں^:^f|)r= / qP%cO IR{3 //*V5W3ܟ__i^@Cf C%9=f)vUʔ5)2d}o.drVQ7ޙXfuCiam=Ɲ=}A4F$R'ΌZD3.c؞ПV+70]`C (]FPKڙj0=TBP+I! u/!U)C= R4]$rf;!0A(Zw}V_Nؔ ڔe;l£ȓÀ r.^rq yp^BuySzv9oA24`af &"CkT,d&D1(kS3J+^dYBϕ.18y_G >ĿSC3k擟S![`F\/$y)O|S:9Eװy/!E M,QfhXՏ>%~oen(;(4rBW0KK̫zs܏ Nmqd?T )gu8FW'#kNiȴCfP#E,)Pnf ʋձdⶴ=0,Z Sﻖ;P D-r@GэmtQ81Xp(:ݠFZYd2lh $*ѥy61wv$A x^3 #Z{Rܡg?xv:\D0Ml <|I|LPc7t5p :Qbo_^h_ &~T:%trD:E2-l9#匾5<ț/2L0R@4Ac`9iբ:;!F0\D7WPXm8:WˋVizKgl`'+%؀\OL<@p_|AFOz3 ͯ]I݌U'XϲݙNEq&arS(<Wx;]Ⱃ-bUu7 AƶDlOQcv՜6YYt6@`G4YodzŹYMTdGIJ]W)7R]YhkƯ10u; _)|@+F0f}L+ZCGBDCI"4 X|m(/+Bwr|-Y&,7zR3Æw٫MDO (G!:XMƍRn7Vݦ'yg_}=?A56)LZ Gރ v x;}[t9{Gnk$S+d:~ IqU]ܸ3~&KpWU*f"~gљyp`Z8D53 /vL;6PSja1,3t9PC%)+!;]yAK. ҅7T._x،l–. 6˽C9rvl+_KŏKH<4ZsU0mKEJB<#BrE>c%OWEŞ)f%LxX%j =4\A JFF1.-udR*6#%N i] [|Wjw8)5r aWʻ@68]&X)4QzbICo`~QHDH 7}Kz7hk⑾ɪgS8;H2 e:,+8>W;l<@l_>CcPVx?,t2u񎱆+H[t8 ސ}/Y(@s{Ltd1]ln72[J:o>= %rm۪}l aiMuGGkHá4x/&hۉDʱk=(.9ґAI8#.jdqloG]QLQIFx_!@G4SK&7:m~!+G;5-bĖx/@}t. ?d](>Ȧh^+0Kmr`3o8eGAqgEWGfI *-s~ױg)=$4GGX,~>h.e SvY DrMjM@cyަumXRG56y Y> ^WaFf? le 2‹ߵ`bw*7"qȮ]Wzq$LVaݙ|ex(#l]>0%f-\_Ć5zk_ 'pZUXPyG;&Cy?9UHa?PImsTRJT5$*\ AEkﱠbQ90Bh rb9.):h>>sWA)0/8<'+A2H(Xˌ:[ljIB*Ʋ-ꃅTظϪͶ'E9tOiZM&ͦ%8$-|9طÈ=4;Kc#$y.oCPPش fJ}TztiT+7" rU NzB=Pq~i…ji&zѫ# k1S;ŷ?RT!C>/ d^Db2jhUK5 MT*{w.!8l\ҲrLQ* 7BWDy}P|Sgk 9QBr{QGaTkQu agz:K _^5;>`8PI]w6aځb wJ?v:@wCC"׺y>*2G$#3:=RCВ&ZTJ7-d2I++OM{BIb7W~Ֆ @A2޴Ui/{E|"Iq7, 8SZ f9E2TipͧE01?l_neܭ5#YC&lr,)^ EB1r~2~(`OKuԨ"|-q&+Ocu7 \%v`XSsS0RۡˁWodnB7;v4Ķc/%bZOy,24}.-U74M")^%4}"6FJZ@0T `XumUEw(^<aH1svZt$E1J&( J¿3}@.9U!O^GS7 Գ3,Vi">sό͢4]I<| W&ʠq=eWAScD)wzK˰ Ot{tD^3Ϣ/@*UrHr0v~pL^藪 UQH^^?mo 牒?$7 _d2\ mKUG%%VNqc:aO;~@E/A|Q]%Z9o|K.ЊGv⋊.La-1¶ٔGeJ%yM6 b)葼HT0׹Ű/$ w=*"Ä`h"~ψÁt=:.a*Skg C߁,M@7yW!5Zؖ|K/-`*>8o]kҽd_>g9N Xfc4z.^KS2w:m7Ca,R>+g5y4 gc3 7=0d9xrEI`_+Q@)+,7d Fg<,6: oY^rȒkXq{ycl߆$6Ő@^~Ռ#.J ]sP.WO6Q0E$_6^ԼQLE!%u UOJl"0rei/}^S c[tZ\ \JƸ#Y؞Vf]Dž)?X#CZSj)4DKa} )YQosI  pA(=S[D,#Ɖ\7+>6#zͲzJ6sN| zEE80ءO櫪fvTwGM=V\s?y>Y"6HX9{x°j*i5ںKɆQb4 "g&eȢ3 )sL=I='Yz0WFzD$%ë@\e s,"@熞 Gw^v/4 = M&PC 7y P_v$6%:3wNVvko#aZdI LKU4]OMr\ ` ܃+T/|k I [<1vzXr/&GP'.{Vv"Ts#),q´]gqH;_uqm=$%sM6`mǜH$ߓ\"m8Wו^t`%_1Hz؎ybMp`C(峗8Yc s%tL_AQ5ds? m:B;["٨;F/+#֖\톆c] $wB ЧbHo  {(uGT!ueMYXp%)l<uL5漣,&kr,~G Z0$qt>H?V Om,CS/vDMsgE+nkиrTC{G<~чlAf~@,dyhBRM,ISG S>Ve۾uaA Et)*A^-,rЍA&:vZ"1XdIaFK6- bMއAQ@ғ Sjv=4c?yXM.m\m6}UG_.6CF\77 M8ܺhnM-i)e+}99G!u[I#tiӺ-+?*Y[d Dk*ѸgĦ޻AbKI%|@vΟޤHs/5Lu.+(QlxIsn( [[Iw99'Bw_VTKBrz'r$ NTN&Tu. H28\ˢ>frز/``/T'Yi)ivSw_|| ZضpJWSq؋>[\ՖV]N8F <5P^,/Á[$t=Fr;) fFU 4RXbAO+›:S2V DS5c߬#]>^]$š=PMhiuI¦B'7 /;F8EH c~c`d@qyO2֦(J8+*݆kIzLgڻ}uZvbE/K%Ƶbd8*mPLoO܎OXak2=&q/`b2giHɵh^᯸?7Y,2k]cV)qO~Y~ AM:7#*'Ϭ\m.< IF&+-k+m;>I1Bfmy=F'ʶzjwW$ۼeQ_)_A3WϹW!q1]Ck Fܑ.{=s 0.~b4б$=xkzW:*>+ ۊ,NVP.n=.wu"gagu]ftfQi58bt)Pht{vi. B ͖pn˓%ݧ6qGTOKi 4pjƲ"tbce!L5WD{< q6 $ÖÍeخYkb..8!`-6-C|;>QK {)حSY?a ( s# ̵:\Ų0ÜH d! FD,6“!4je;& ㅏ[X_1RH}Zxdh}J`cJwسh5,˶ƹ zi+L3 EL^jTAU{I{ކng#r+*!,򛀬4},UʿA,5z( |n,ЛI>a4in98"jqVq*y $ 0ՑS` ؑ_ MBaF4IB s ؏ '@%2́zNfD ytJ މ̀ZKβ^g{4C Gus2Aw ]42Mb~~.wA)[ë)>C r,h>$c/=UByuNU\{xR*IPmbuT;rS,nKd9.eJVx&ID~QbU.. )K#KЈ)dNj[SJ&Ӭj*Y)|,yEhml*~)(!{(ۉ}8no(&vKu1ҁMFgT0>fj&!` % Qms˂kb}[7-G/6NCaڋO=k+ژ VYM ޅ[yE1@9Q䧯0菌JFmI%Ϭ!8f4~zFy:D %=)< Ep4sB< d f[Q~=0ư[`We+# |-CU@|'(Y·y%M[HqKOxJbY].˻ m> Cu&M`:'V2mOE3rY8,xd 8.we=uh9ed2dt9آdv(i 042:Y"8Fr7 @@P!ZK'KCZD53#\L{(/; Tv#i!vx>mF]:xoPvRC^ >QC-Kc~09@c⍳D#0L*fC{^@WEs"!\t܄(F̵24dj_\bByf΢h)96X#J-˱JsDw!gQAʨxJjkWx]8Y@B7_ȢyCxNz1ge)4;$ZN2H.gb7U (K MU$C%d4UQ}>OeoUa< 2:D}dbhzpu:]aQ'^v-fL[)FJ"WrU1)UJ=s3xRo]uf9l2uŷe.ߠ mMGd }h)n̖fR_k)5} Bi5R4}t̎7R_ȶLG͌AU`l0r?Q,d^iYxwO@f 钚U|Ppހ?Kj{_#U.Gx|. pJŘ |Ɛ?u#QMNe^YI,RbZMQ=5s0wz4R>k#x)%̬)UFz. ({D3C2![(wEs0>k"pv@)T`DK3+/[mid 80Ub h"𰿂|%O$T6DTՇȜGQLXGa<8{ow܊x uD[A z }+|)-0mz4G$1.7%V9 W>\cٸ _Ӓөm+3K?ٱ+qjV7[Pl/;u bڙst) Cf\·PÐ.W_)rDi :_Fqm@uDbc ! ':led]yoTN/,{G+ImJv *WHXáͭԶˆSbrrߓ!X ΝԢBEff%\zJΖisr'r䊖mLS%[)*CyMm%.UiΔ9_6 OCC{*H_䆪֩o%J/~t_~YYh"{K葹gcAilB15b%PJsmq{g%Xs6bWp:8HljZm$ymJJ:grB~hmؼ,S <,h4[Jd45ҢZ[v*j,5M7@ *{OaXuIl4wopbQg4{"G)n1S'yEkxbEX=U~0UػgU~q.h{`S2ăs~XG_J:)[#֯Y"<7㴛쏦@f5[x*PesN J=Ky3Cuh$;Uvw.ҟ.k* +OdRQ h/{32Ol LhX Tso>iIѼ)5oi@wW^YYGP~9TeH |!]LI=6*-iAcu DQ|S=FĥHkL7wvp4ŗcfGqMV1Ƽdj0%_`3U] Z/ 'O N1"kʐ4 >$,3I*R_52bM1a}ΛsJ3u*Eʔ.hJ=u_Bk8Vs?ЂڏiWhOFc9~IWJ ,dq6pA&_i %ІR}miG똪wtFG卛JuA^ќ=Kl&~D! Xg;3ý0Nc9YR2=&u=c z>=-pV/RwSl]]JZ%@c*k M3/$yHr4PaCNуcÕCFח,,4vq<bA oL#=˜+ 7Q3[.dkVrv*|~ꐷaGɪ޼+nfdL6h\!`?Z#s8m(\ dO&%ׇq1^vR4$U7o;Yu /Yq|lr ҂5O*u8϶x4׸q$FhϪL 3U |xϜ0WE\Nm9c.Fjo1jT>1Na߽=L٪&ǙFpZ5ͩ@}fǾdޣ}ARh $,JNnhF AY:X _isk=@;4ƹ=/VIHh  ]xWEohU zj8ED "dB%79 r6ɂ?$[eBf7P$iDr]㿹VVǎ'xuh 2W} }!\c<:n,MFlvc=ZR{qO Tb[TZБP~9FpyvCnnNֺLOSŰN[ұ+ o" >N M%R*S 0ϒ'4J83[`@}P5K:=rNeNiGh0n5>7,L_qm$݈NOM`_P*Vd9?eqM5# }OhpM!g2DrS,Cd0s/Ft)TeD-`KZ.E| <\u*ؒmhO$e񬞐"T T3~sWPzU찿|B("0pSIrʆp8~n4;y=qLl;XVЗMjiG%T|0eS0d/H(Il }Hv]0GC}}& tnK&N}ʰ 1ֱʨv|(Blu1@B(7ij! eCxlwW 6d F LZx+‰4(֜2pi2( #iһ佃KdCfոz]D +SoxYčTYHKj) *-AH ?I#oݠ#ܴԦ ޾smP3*\h (>SsRYЛ]߻mFSӣJ =hӇ5;}4e-M,$/MsެQSx 0%1B׆Jw|ܕ,_C8]!Mכ3).yU[m畵\Cga rt#$ /q/8D\a>0JyT}JS ="$e,el%sL~ B=.UG=h;Ne3_*Y9{N)l5b`n|Va!mYFjENP-`TbXcatqܼ$dz_T󷴟2 N?vZ&α=v$pQ R0_ j^DYX{=9Roܽ[[8&WMb6Hjҡ,v3hra8r"B [~RPzf4CwY{,553yd6p#lO<NW[6K[kߎt~CjAmp- ?pHZ^s$UsQ#k ˼@36Ts}S>x !ZQEхErʐ&&7t9@Dk]ԑ}ta6[QLWuPQjC@Vd _ 󅷐XI<(6J:J%G&h]/^Ϙ&uqr2ݼ x?]ʦ:ݝA9V 1nJ5SZd!m$4Byy!)"'Ŷۭ'4$Bz4t"CXvWq2/$I1TMl>p4!HfI(=G9a- \x~ܐD?ؤ}z('0>$K*Zὴ[{, kC {{+ю 8p W-$ ~ \_~qT-s"4+Y0J}KD-3W/Yf%k ߅HOmqɫyhZAz\&;0N mmwfŤ>Y[M4FZzBh-H䟬ZCZX~K/51BO,d$Ԕ^ $A]yR@=3 r6cUpby"ET:H"· AN`41aڶPP,%DV@Ιb:]NQNx^,eocW*S `F ]Zաc|:?I3˽x#? m7N0Vae8^q>y,]$/zv}&rJB85Fe}u5ov{fBYf #oՇ~)I<[}WK9\Hp,`Dg3-9g'Cz_oSECF!6VWHD4[ 7שs"@(ۆ)Ze#$  L<ֳȎ邪!hoMwG (f)wRO4iL-SDs?>ܶM_'wJTM8"ǶuJXWNF{{9cwK?U7(bZGg쮏);~lFH[2y((VAև!*kżE\ ?Xjeki]ȆUZdN6Y>iϒkt "rvQkv]Yud'xC)J˴,J Mu nnrfO@7o@w7q%175.Lgo`TY=G47yX,n$+!̀RxWZʳ%98CVdZ"(}o۪! +2%RJ_JbRYa'yT +eб7* gޔP=v; ;zhP"Vy{$ J9Oϲx{ '@N?4< gZ6 #80kDj/sӣ "=7_{>;|\HO`EB^u돂JJ=ΪM8& zh,²7WrC$3ix +j?~Ӳ傤ý^f<Àq1֖Fyҿx?)SC"+h vUHO¸iК-e E8lƮĸӳtǽF}Av=6y<O|V `hͬ1|%9A#g_,HK_1gR5+o))#nZkWC\0pv}N(Վ tMe^Q+PB'KY[?4M3#žHBl Y"4T4qH> (䘂{=A˜}OMK%sPC:Ru)j~$%ckmomP(&.0Oqd &BOh j*zrر8ʹjVF)P3.MT2g@G5du-hKe;xL<[NX2u(YKߞXL}?K)L]o11 /vε}-ܾiha#8$C*V]2M4ĵUӪlDq$a> FݑvsV5{5ftľTto^!\%!,nt]kU tm:OA)1e7B>F"]J5(?"<9Wy򡶴Oq w2;mb1TQB_Ug\pU0M"DSzB a?(Z"0>ـa *xJs݆JSU[`ϨLę∺3j&y=07c!ia"gQ+~m <*kO%1g^I( ?=(}[ƹ OUkx;u.$+c8B;ɵȊjZXtcn4KErpȫtH΀mF s5[  ?\f4oQб =U1(ȤpƵ:ɠ)–M+f]>?[$lj}/~[ndKAtca8-/5&c>u野hbp䗂tr\ɏ Q%0\0YK\U}3̾5N' mZ$ZߊPo(gn;Ҳ2ᠨU0{tguetPm+)@Dw&wgI`d'Iէ;D(̌s._[OC_҇Gllą5X"-Ꮍh2 ߠx9&ܢk&WYHuaT$f:`XvHZ4v  -(Λ:젽K]Lo6ƦȑYb.3*%cEw?+4&܄ӿ!i?$ }Ko ~޳K_2w;6E߶ɠJdlq zޟ䭒=C3D<>)}vd1BS1sfHU95? =fIH#h]/Dh kv ]w1r[[~x=:9I=lXy #;,^SdVk>`lE"w ™hpJ4K.N4Ű S ɦ(DUlDģ@Yڴ!br*ϔOv꿛[;%cN򳼹La%+qZL[ROΐE$1̒rFyWx }ء@p?s\)7rHY% 9RCYf%qziqOynelsQ3jFԷdeNT~ols79X#>RCOd>L~֪#4 XyBi1@he]+T yT#Pj3 Z&w_5H`GؐPBGɖ'| e cV ,UO7go}Jť}#ޝ:nw!e6%$T~ #0}j2^!|T+j4mU288\tO@mu9):m3r]; yxzx\7Uy'9*IQͦa/"ety.KY.X%׶󜁙Ul9Bۼ`I%N]KQH@`u0tثVXuS[u8!S|a$Lr:jc~l;-4:)ʈ'Ol@&)>ũijGG8xNggQHM* "dm-{y}+U9MgBHyubv -x2WYݖIJ:gm SAT"(jLy0k~UZFI'Dbd%yYp ;gʦwXT0x<"[yh>4 & FJr^A8DH̫T_W1F"dޏ ~ 9Oy2H6kd dH#L"0b/XM'M3%tHW3`@z =_0_upX:/XF- B.ŗK+X 2!$^Wv^0 ɶ6ؚ`sB8.YiהPz O4C;K qˠiP"k|qy-?*7hQ|/AAFFA`0q1KP#DZk &Jvz:=V}?MO  o?׍>swg΄`g>Li<_=D9`9 7ŵDDdoI !8]$WPSnc(-\GYUk~WTQ#s,S]ݦzĐ۪w΅5ΛҀ!+'nf[whpi;̦o CF'0.Zb̕E`v W>]&%N;uvb.xCU&V,mg{jH~wΜ9+W22Kdh2@~M[BZv8کIYi}8b"]YДI=f؀#,]ηQ͗U3)l(ݫaah-x:»?DzV#-^ͺ(+{TַG'H6dnZ.1f/) HC83 vhFv@VvXny(OXr 0%٬J%W)#ji݊@E<}Uk&RD&JG> j"3d.>UK2}d1@o>\QdCSo ga"LiI#!'j'o@aϻ]->K9 o},ס皕 ?9v/߸̕&^ƚS<ϸ8wNLyfcit$3g_%s3n]%)9Ԩ׉LԼuCci;3lc{Ok/8eCLvi( =̳ֆě?8UVM]Y U"ϔQ6ܸk7G|(gz/0ABlvXC4L_D`Mp q>rmp&ksxva~SʖJl2}CT$׺]%N -p*kj bJLC\|V686טU?ZQ7QЙ+ [%rOEb~2J%]w:3|pT/<jD2Oa KӾ8iE6L+j&3`'PctX^)^LdvJfM`v\f!BxFb=%osP^v TP0zĸc|* 8l.U=h&'%uq9Nf7P\W98_wj.M Qk}{џ)^;DAzQ$vG4fޮZ08ȅȼgja~5Qd-j-4Za"@i)T4M#b7Eb.:c Dшk6,tNX#nd$S`stYfJR F-+ U"m:}=Ǔ>NnߋX,d7$_)="fyf Th] ~l. #TO1|P-oE #o:(5ܿ5 tKL rP#pn&f33.~H|Ba'n1k Q9O=k8~Jd\yjZZa!u\̐c»BqV}%/s]{]^gcv3YMǩ5Bh)sku<6h|xtۅVmsѓ§sǭ\Gb C!~$1#~-( t9z.ՀՌivhH(.9'֟3 | 4_[F|Ά`&U87meE&S VG~ }5V%HnWDHK(Wy:ߥoAN]x9C)K 9'lN#.,mf`*rh܆Y.ˇoF"á)2y+Qfd-"7a)}&g,X*nYLDkZqPh{Hj[ܻ@#%9ҥhe C\_DCNo?y=zYZo@pJK` zZZlG@ +ZRp&k&&QA,luyE.]afr.: xWXoTV:jO^5Ȅ 0^qt֪@Jc08 mRd7zQ/)0rg1O4$u2$y%V$P^!o＂"0ȔJnS0XKyKE(PՆ$U1g%kߏ2y `b陔E"t+|9`;/aվ1㸰-{ ^} F2}fbuBE0LF9xfu苎e~ T j#)iurqŖv)QV_'+\Tq؟jR-Q $=2Pˣ܁CjlUT`x~Sr; jU{0={0~ӵثE#Wc[R: b%|5gwTB$_ N}b&(FQߌh(3B/JTbxCDx'vSnÏ;]Z /DU\}߀F[9$?{zYy[`Am*GD5,vr}{[YyurbSv؋RȖcuG<&}sSfS#.}}V ⭡ZQr۴@ `ZV#h e tBU:;7.]<LLnUf2iS5fGy 6ne֢%lJ62" vRkSUYẠD㔒[wY~w 6h#"2Rڣ @%;5S+JCE[oM4l]@@z# [I>#z BA~$@ mW9<^F] 䒾,ԬkDP8c#c '|'OR\鳞K{K v{A  EFtcO`ۯĻ*-F+7@d"wj68e "mTl}Pl)T\}pI&k~؉'Fp[$ak8W)[6AQ5GdPc3yvOt Ų`OGo)TkD|sRX_;J>] ƲOVHpzq *('Y S~3k*]2o =7ѯیar _.UnGrx}`26``8V+jצLi!h%=Ef0Z&݀ MNrP"0)A/ȼt mދyIogXTtB26}Ѳ:uמg9vv:3?h#ϕiHdN1mk-&Hl d-LhLqNx,/06l3U[ܳFJ-ݢ Ε۵X%EKx_mJD<4.{Ř Q7FB<~V[W^WI̝qB*}-d Wa8 1b|R:n+gن0P7Q l|6W{/Oqi?{/e(*GI 7dÑ0{q QHyN!ĜP`MGE!;X6&MS&ME˚g J!W.{Dޘ .JF{ЫX0yC%XYyηѓp Mhkd]# pa⽊]i|=ȖSkM׬ *  0brZzs )zQx(3qsAYG+\#/pG{*%D.[R٩fQ:I})o*bh )8p,!}7W%{i BI.4{F0 N.-PƦ+?9Nf#^U`VcUc4*;EFý&4+ۙJ0k D9`(B d*VΔ<}g/O8m9}cz8>1 Zf1Ą1xӞlWQ$ $OqK#U,qa~;o wt}LFN VmMt .e6dF{ (ңҙ@Ƃ(#GەxXw޿?_׿&?4 2|\D>|'^vF% CT(A {g='q35d4`=r֬$~DYɔ(³=?ٻH[b"oNٓCYoeOpTŻȨY\2Q )hSF ѢZUf0} x^S<~)<'}*:iAZ)aݢإ<* cE &s{9{Ξ|_%2)n$3'يWa\Q4mQ[pz37L?+7AOwnGFו2DwCYD#:@킒y>+p$3ҴᚕY)l)gy6-|"&saHn$_a.i>gŃj"iDxp}{-\Hi/8QFjU-ݫZ]|twP M!j%#ɂ:ښstI[kc*;-]RA"Uu H,c2|B]VsIZIAU*iE(i9^L9I"bF.~aj4=X>|&~چYp(iݶZMd҆MlWId`H/h sΨ{/lKL<֓/z"jzzϟc6~s} ]Օ %/*J' gsol#UDʋYưWTGuFMuk؄ۆ/XG`ť,@F:$6`6crAX`p$p;B .9C-8j;=X_*c 8l\0)a̡W(P`Νh!`Q*[2dF;u5%C+LNbnG׊/56<4Uug4 +Q2/fRbxqG^mz">xIoQ*FȊL ľ,HN0.ׁC0\y@8誖(YCm?i;^=\Ekjޢw:O/۵9" z&aS1AoQngFz`]y,M›z:ZCB<7愦ie@T\ U7W3TU/?oO_t1[(4 4_Q-;y&VMwV8.9ĵ{ZЀN #@?hHUKFjeR; M#e]IODAHldN,m1>|j(Q ܍p4=YJ|[ >~a+ȜFl2' Ps^ncT[^vu&FâB`W,k³)kz!7/@҆ǻ*,մ *[yg8wz?#9w 88Y]}-I/k@v}:'g{'✆(Ζxyc > $ 9О,,2.) $ܟyfͩsrʃE1[!a#iPwJuVx4I[|N~g'zC|I9~]sd ;O؆\(^IE:kּj#GLE※n5Nu@/.޴4*PMf ڝO_wL=_rwl_l]w 1\hk `-ds+ea@OݦSW?>q&Qo?=8~k ڠ< 'tsnI)ęvxcVIp P+:['RG60y?b'joIߖ˫,vvU(8=Qh. D݃$8y ԗoσ!?Z^2l 1*U?U ;GǰG9۵MdBaG ^oV'$2 .T~3;Sj`5&3=OG6p w-%xħ.u X7N@ꏁ P4}ٞJ.ym[A3># CxK$lW2a,IŔ ߞ yv󤦙l @u˳T7,AiS'l άv'SC6rTxYѝ⻂SRo r796oS+Fi*F2vA'1$e4SBrUJoi`o,_ a+`>n=h n DZXy3L:ʰfZȭu}#IᬰU$5Z#TΦ䠐|yŒ(DzCgJuf鎴Pi!\ d Hy8\@1)KswŻX~TUMԪǚݠ]^.%F a3%M5vʱ`ˆ/Be]Ј V$v\tL 4.wu>,u.Z(Z#.rq-C{ά*<\r%++`R[6cĽ͞g_FUw'i93%Sv*B-&P%WfYm ˭>6 GlC} g%Ti3cGX@Eq$x ٻ{!N#o-ʣy)hd]ӢqĴ9ø2x&{=cfbK b`:7aW>8m̳hRE" D MwoJFz̆M(&= ;3bTޜt]1|pE\H!q;B3ֶ#1ꯂy'E[:0* 28fڿ]\oTp#(mQ?=26Z^NYyRDl߹ɛ$b)7Y y,,\Q5ܸTZQŤTh)2I4uo|%{9qg<є(QXs.u!LCB5<$oX&d4D2.r%^$`2N>=p|RXৗ[Tm)SbShvΔPQ#20P'&BgcȆn;ٰ11Tp2TRiޣh!\LɃpR݄<ͼI-z,9wY- wSUD)#YE8dҺJiWi(kSO/=q lj{ILw4DYg<嫫?L7i"Ew ht16?\8RLg!eٞ(֋\ZSк6:r/Ӆ Vr@![ !/ DbWDVrCh.|=S( Ev wNk"C((Ĕ/!X;h<>ɦ  'G4\i&ͮ,pB\L]W=SZb1j>jRܺM4?љf_7/` :ɡJ>Jm/ YG`:WSAtn4ES0^#O&T>?†Ɔ[(*FxsQ>>DEm3@ФJz!]:LӚu.$s'X#PɱnzJX76p y>9Z$ no]MΉ3]pL5%J>Lma+uv[oSl'=%YCD I%&L3*`@)@Fe̿2/ѷ3 JδCJ(\?(BcGjCڔc4'F@4O:a0uBTNdAZa(Op'`->§GS˜IjgOr~i\ԶmcFꎴ)_L11Bԥ3.kOJ_f:[JF94=jZ(T9 m?1` "d׃iD-5BWW5JxUݷ]okBĮ- ǁX F[2P2DF7&wTR]2ZtDwW}w3KtJNoXԖUU Z3]3ܫr?F+lUs 6!Z W+jU,p_.pSxc8KghMoM8vD\`eDuwM@ؽe ʘ8D+^ևܔ]Q N3Q{b zCL"쪡_I^=T_V+Wg6V>b'}`@Dycu= ?&^󅛺p(Ӈz+V `i* ~Cn9{H0c Nϣ&-^qnxpUj[gIG ؅^V_Ij.@2 (SykY VYw|>o&S */IfV̿i2I`U´J*$uk %G#Gu OFc CĝVTXf mbAQ\&M-$I0ǰ̝>pi{' !?!θ=%|,#9Y&475EZ W-?3ѻ5_U,:|JV(qun|r icngn@9ږ1_X&7ɀޏoCUmbazPfy dt ,\ ,M0Ҷe xxl\#ɡ]l}ˈ?'ut9䇨N Um[<{`A烊 )M886gi V"9uiD*A~8®95/wQ8ɉ+MJJ^J}zzd QHR_t_, eFҾ5GLAI}5q>yy91;ާרcyj, jtKܷT,₷J)4CMBpg/i3.jO`n\ aɤEX)T!¸r% EC'+O{3\rUΓ^ˎj>Ia(㺟u*?cOU^u*1:[7ՍT ]Z-mF,BmnX܋{~RH?^o-3WAе:-pxvHx%ښ L[f7M̉GWz%4UO,3m}\Y&:g!̃66ՠTx1 vݠŽ5ѥ{ G̕(?XaTsv3ho0y&`x;JI6W4YA' OY0{$YmD$ӳ^`iJ.AUdO(^<ЋQ(W]hJ_t$ M\UXe[ԘHj1 E1ѡ, ؾt\Xk?rFK5~k<,z^s6.FlX;y`:=Bqa]t%O*eiq-qG>/4Th5w<8[@PD(ׁ:>b Ů(FO![٣$E R `Ha_|r^:惗=h=NR`Mp* ;V8R&)eN6JE@t b2a }c!c\CgitYl'i$j*|lR{A %нA4"Rk̮?YipTv: [t&3LUq/> ޳bC yȖɋ]^ԷGsRrnݐn> %'@ /n6~ptJOwl-ϩt RBilk)/rf~#o4MRoI.MI+B[I9$r 3=`\oԬ̑M=j; ȫGq+WlZl:w |pG4;+v<6f:-Lv .]B[{9]@dnԍdF{T_qHLa.[bnB<6/7ww!q=*+3Iz ;baNY#.[| sM4͟U0g8;\וI{6[l+,'4tH ;!0śUnCdW9fc@ݘ6DHIxCdt8?h{KZ8Dg0t2UVUդ#P˟T=sWA T㐳.:!A3CE;<`icbB-i*ᶂ*F`sɁ~Nua(e=& z?LNحiQFKtwu|WnZwmG # kX ɕɿ9[ 2$qCLMgfcx8f)Ԥ FbLo`}x:j?>_7S 89Gqn(ZR)-H:#WQrm@}O@Lm`gSh1?3-F:8t}QbӉ2&d9 ^qڬD뽜?0vİ/IDyfK6E\B'0],꯸2/GZ'OoXLLkoyBƣw)F{vՀZQ"u ێ<Z|z\l^R!su$2|@TPQ\-Lʑju)S Iey8.h \NImm'5!C*y$@v G+iN]{QP$__GdP:{~V]1|O-bü(:@܁c4 ط#Li5sQLz.+=OIg.Էf~Sng0C3nµn :&޵ kWXͬ9 u,Hy .Lb&z0lb'hCB;8wʕlR[=Q@ϳJua5 0 I4Q_þ?U1|&2Lfmw7Ρ]6gH4@WGj2o*,6hs7[9 [3=]2sS j *TE"RYOŧd>[?D׆T}jP:k_ NmȐ yY1Sr t %3YbbZzz>p=4E|EK* خ0Y,z|A(B.m8}\$)3EYO೵眑ywb嚟ivaá9hRzö"\G︈Y,@0':pk 5w>,Y-cc:@qjаi"PH+T9:l .2o0gS K b k5S@Q|(TunIE64ǎ5׼A ]3qIj=hZ$~A#JS:vU K~AʬZ5Q2GF ]ɊЇ2jQۮ 'ٱm[߂?(_QL[ݢbJ4Ăk rfv4JVwΗΔ%Ii_˼qJWc唗kv/~X ":V̧bSg׮Sqrʡ62Nڌ/υfFg'o JU&BYloڋgKT fGX8G@wMK)CR֫=Ir|ΡGOZa5 dw1- {3 f=pyt0fV*q,`Y0u3 KGpiO bp\>!lMld'&Ij9nAm>YRUWB)$Z!M" !UxCQlKFJ ,Xp MݭQ>9⫉c~zb~bOmHxCٞiG=O{7^W5svktK|"}B5Y5.WbɉSduJ @o\}\wU▜ @G ZpyzLUb =#*׊?m)trVOZ=6*Kz߹>R"6ZHA!L|y1{NjiLI-3 zL[?F7.XN%ϙKgy=[a].Lzs+-+7NiE7[|CqNDe?#]-97r"Ch2ՙ)' Ǭ)_;fcWGTcsMo23Yl }3499Azϸpbt*bE~:QuBQ,vU@JVS6?.XRnMʽsZ6%»sozEqga_V}yWgK^rk߅o9 :I+)0%_} GK2#;ttٶPu[2fMn=W4{*}MlQR[dѠX*⛷Mzi}v_}̈BlCGmc|aI~tm W?-E)H|=k!OvM4(9Ze{MMR vyL-ylSRޤmߍ\ ntio3c[M#\62oo8)Ñ%5KSW@;!v,0hjPnB FG>9_X] `} Ue]! Bӝ!wt,O7He">o(6w燕Y8_8ur!FLn@l%"Yr0?2CjY@ Ї)k WxtXȭCCuV4ujoq}yr fiyoe:uPM{:8QŦT8h9FyaCzXFS]W>[Fovh^F…9,,!:#X m$gdO(d:j>N2p'`*[d& yiωzWM|='pOBR@EiXF'8kK\=(&hؿC!xA$6BCK} #xnBYmkܷReBy. ?+EQ9R)wJ-,d\8Gz?鎍 jo4H꭮Նv~?@q)H$ffSj"m`ꨁcri4LKSuq& QFdQ;PDGX QPfr ܐfmG4˚cs&5%f| Q}v暈d%)jOsОD{̷H4ͪE+׺9;Kc%vTCK7jʮhF% [yw7*Ɯy /xDoû{fXDźz0 5s l"E Ul6BWZzs=@W5n7iG]1B֭l r_bomf%M<|ޞWt5cdvpҎ#Zz`O[XuYE 2څ;hs>i`dn C]KVP ή-]gtF(bz3ϔz5j uE)Xݎ*O; pWφ($h%CHr0 gL#zEo@PWNyzV-?{ C0M[)Oda+G=eΫJIŢF"eH, xqИ®5oGRU^sF/On!ЩY.~|ę |)9([1NswQLrDi Ϛa1oz I+ϕ x\rhF o;_2g-2\Vz N;|nەiOG7 $7/iYILRw؝s{!j>u9r|Hi-"]-r3v]y9 eU/6F߇>o j 'm@4BFg@>xGz FXsI@90nP잜]}GKmj_p0/+_`2"ψI|}?! :$\]}RQoCh9Y;nW .B/>2~|b٫(E<'2+Bd`(6cx,Q, fr*苀ܮeh .u᠄ԙ@Lo i|t!_P1cSq&L2ܼTWIBڥ(XkMvxU,)|!eD29Ld(ç*n`/EZߛV,X(g4/^n9O2!ժ6We}jPT{9ﳽbl"k911f-OɛAç!޾^_o*ޘ>dLʬ\4$;i5۝B4h&!ycF/?f({DM)ϛ8LixDϹ2?K3{Uvu8M`gPUѥRtų?Y29oW6{p'FNmjKGŌHDłu&}?>έا<]t@~;3œ?Tԫf˙08g>>xc7ϗUJQro\^kloMS8ji1+~SGeBe;{^HeuvKY IL) `;RJ!N,~aOTT.P',umIgH(hDx!o74ŚLb#y̆{*LE,_f!^% i*)S2q?2 3&z]P" lrcAuy+\/se05;B({k 4ȳ+oEur,  h[(ȑqR42$KHʌ-%jB&͉܇_=G ^m~:eqj_@_=k[#"$gR7+Whbv{k* q-p_hVQC쬚%/]CKnqJe\Pi )<^"1ʑ=%&/6 j_ e袻_#/F@Bt)#?@H$gۉ+2:4} O#@hbA EPYq +fB.'BakNϥTM ?`cVK̡O)IRk/pe$4Jݶ95)bb_`QԀ/ie!9CE!D뾸fsFCR.G#g=Ati /^YLq epIrW*7} 6<"LFeL2/aײ$1YOG`+L4G7.(@R I%ޝM'Na>4e!UI9a}M$ѣih#JJtvANdD/9%}e5i-[htfP]](/y؅\yhאK*I>AI 2솟4RrDl$J:ߠ%ɿ C:$9QInL(lYs g"[rP"2ud5t\dV!dәW(CbLDxvTe_vãu~~_ 3\X!@簄-~GrG~QGur;glnr5-kVƌu6lLlx惊w 1wЋw FŇmR20 |^om~؝\H`z/RpaɉY/`rI8h4V^B(I^Y*ԵԜ˂ ˔ɔXoTP[y=0-^ uA2l4Rk6Ί$7]߶;'+x5h<P: 1hITZ;Wtr7->D0Q`Qֳ{C``t rǒ QЧ,Q:}ŗUڴ+ $f361+EʉީDX}"I' '3^3N*a ߆YGKNwU/Vk/Ϫ'yXNRR9 @]O=N2o5K@lb;3xy ^m}t ɲN7KxěH2JA[ya%(WV=TL(Q! D@)GZk& Ru )9!:`%lE>o.O̕e?pG$ ͟Fd-U kn-/os ROq#j WJۿZL2OCL-u/8Gei&yj#"պ]cDo5wG 3pӋ8*incG}%w)~䵎dX S, k 6$ՀzO>r}[*ݎ3vׅ5k'm MNҙ"չ*~O|*e9"{^1)Ar!XK K]̬z"ޝ-T~껾WSObC'W}❄^sru42t%ӡE1BI7EfO #$My=-j<œb68-,VϧW>a /|-oX,r߻y'yT[ZcX doa |zp w@!WٱgLʵq'Xx?ϑ噘P@҂y%8iYRaJʷAX?犂4IsIaIДPr$7ג0;#  N%$z̽Ϲ?Y((p Ë}AD ;<ʯIMTorg;PXc}X#-l7_\r8})KH0宄ۃMaZF[1Cu6?D)- ZiՑoZcAC_k&zaJ$_KV2HM/O (}IW@.E=@9ֵ!+"+@|J=9ѵ,"17PA ?ܴYB?L50I`pyZ|@P4@ּwRM1) UPfsٔxvy)o/!B-sruF/~'̗8;%#伪7JHTO7 QMz>Fv -+4<؟,Yt 4OO;{_{U9mˌo>93+gD']B]aBs5c@ .9%cIvIzI`7re'heۚpm;!kzzSW0o%We& ҆q`ݦn%:8'X9tnx4vaBY@ճqߔs0PQ kz{̛YK@rylTh$cp)~fwdv N\O"ϜwgkC"ѐ /@h]&2ldX^a>IbJ,: - 9-7RM~[w.D0Tlg;q*0޴^DC9Ã<*Ăjc6j;:+ oG~trB]CsKMW9@-£L,=hݕ0-+!O:mzxwL˸_w^3"rhI$J_6I_$l? k QZRI$Jc+$ؔAx}pѷ4h"}BǰW <,JbZ /ʊLP>jW$A#fUp+KjͨbrcY; ݙSExҎL_.W:Sz.Q !kGɨv#Oc@&mY+Pެ @v|lJ8R|';yNbGXK-鈊l M\M$.2gD?z@(鴢18jwtŒ?y o|$˽ e2Cig挺uՖ?4( _vptJVw0t?vN)wz? v &LA2sp%~!(P!Vo'T 8FK1Hug֘ji3W~MJc5)l$=0}%@!Kc4bjXQZwAզMf 0;_z}7gNG% a(er.9F|1"m+&uBo}B9ϴ*|sn9@Noq-"Kً Bep?J]|MS\\| {ì|E|S]eK̄>8{U&XG V)V8oI0VcQ;< 3q3N4 ~oX4,H='K+ĦsqϺҺ_^HEj <x"EoPi@M_qYB"ÆFԑ[B#4H2e͞Wc_B'|FWiu hRO?҈-{mH xB"IteK*,Ԏ hH&HѫS7xVbG>5m0M*2gP45 |>eiɡb`;:ˣы9戟wpIPkO!B]`[)m75d]|?H;r.kUYm,vÁnޡ sD%%F95o̎kb;E h?֠˖UXqOR㾇ݫCxdktJg*k[ ,9o{S%˥Cٖ{V+~uV4^6_%oL s mL-=jXX:5iDnK whwsJyt>IPo3u$R O{AzLCA(W dI8g1GMi EB uy24M]|u@V ZN FQ=U #YSsLi<_ʀFHi կ W7mA'+ނ tbL:=7ڋY4[/ JTU2>伄*(G\sE MMa^,?4<}1,^IXU Z'Rzv_:p+ſ06}U _WصgP`OXkN+O)jwtA F= PJ<D42F zq8ɰƟk/d mp0Ev^zM%h*MrQj_q(ټ`!l#0̖ѬÈG4VohEtXcs,oʈ̞0TB''9kLy^ R fSx }p ~<;B";Ϩ9 F3˞@{rgZ+gz2c ~tB2I Q!Wc$%tKwS4) L<)q]"4$īST@,V)M XQ\ߞꍐ珠~pNJ)EmfdjD& dBnsG3qENX|3S!Cp q+k8o}`^wu"VM (Ъ%| d3@ NCS+w@yYV#t;MZ xe/ qKCEO(B.\),L#l!y,NsIF@rbtM XF1VC[zu%iz &.o`!:_gh T"xmJW@@TGDŽ0!I`UX*&RPYKTrҾ/#NvCXXH~hHH!|\a͂^ol+и=' ujg hSt_"lO&Ӓ!R(7>N\jegV6'Y^hˑNH ~Sa{9iHeE~Mbp>;ݍ 5Uyzۣ/ 7k|Ш5ރlt45|?ъ!&1sx^#`&$:GX7@c{Z]^ &.dh&X`'[@$)&»WS`Ծ6*~ByO:y@UmD'h@ 7W]3 yg?'4Ƥ06[M U ;X8q6amAC3vGZ )Fd?GW#S[v)OXl(o$d!uF߶;o>8 ąW{Z  %ɑq"4d7sGg2^`f{niEFu'EwNʱT(aZ³$j8/k{YIo<\ypw;CM@`>|1ZǨ֙I|e0oGsP5BxOv7MB׫&kU$\m[\^,Ѻ5*Og??TCbbsme+ˍφSb_4)9 -m+(KpE=HÁZYF fH) ҒM_$͒zTQg~x67Nu-̥7@[}r|v?׳ 9ڳOg:0 yijK Oeڄz;0f4$o㹝,i*ʀc|J=9;᎝#o-rV\_/Gp|pQ !wE_рAPŷo渙mQZhZnMI*<`ך+;9a09@8"a|j-QӔRycX64k"ĮDXKh'"]i%]ELHk_G2WbԀx*SRuFm ^ <%{̖iȟ/'ML̓-nJ,31 4j$HѪJ!rbׇkQG0eێ^zae˭/--6n[5(R.`Gw x\&k֠+ h+tAq"/ud(&烱!!IՖr &AirƍteƼY*EN[^3$HZrYIͶFhn(~QD2BcHiGloF3~ϐO((\#B#bdԧ떭b$ KoE-sS:h~٠Fz8=A;qvGHu%nn\oq98:*/B;^RT7,4Hx??e.F¹\5r>1'jinf|?_kک OUޡ1:ݪGah\=fz<~d;CƑXC' *|(4p3^()ܰ [IY_`bp#bSX1I]n?..|Kh1WvC@vFdQ9qwhKH aZ5fA$6Du)d7`Y`#ezwzƋ1+q.7v;2 p]"yhYx̂pk7DQXڔ? ӔsI۵<~4n) m]c+Zd1|)_*'ثХ_M C/hE-e9ЂgpiAMS,!5I'n۾D_f;FĜnMXx +oݸd +⨏,9SyO`}Gi+p06W58j4%0:`w&ϏY4wY)J+UwE^ NJ0O&`|cUdtyE׳faNᦥ4ף7yiiAha$aӝuAgע~ѕ ɋq8߸~7wmWJH@ƶ ɥkk\;]*Ho7R5ZWPP-AԱD.F\f% igԿ]=k{1u,a8؃<_irW`CjTeP;PN( Q>AӜ|ug^NTG/͉$-Ħ 4ݕ@IOϣΣHS桺d!CWid֗vcS8%`x ?OHﰈݿktktdC|+WVhwdU W1^Pֶ AYi,="Ƃ[0QQ`kG_S+H_ŤMz0Z/}]qEgJ3;`TCfn u-m e%p?t+Xb1LwIǵp->3 ]v%# XqC& @vN >0aI 0VcFI Dbr  /Qb{V@6|DG *^$/L u*8 l8"gXoLc1)Vp.-({$ {߱FOy"] T ޙ+Kd@ȣ;l㒑Ӆ=&YcЎb?? SrFRC RkWI3*pBfE]0^ ž$L$2| p5V]T (|F[!ՊK.tTprLCEsZ3._]Oћ.'K*Xŵތk2dKg4Cs/ )g'ڽ`W=p M لz@VaἳPq!Уɩʎ[rnV3RIF}WE$E鉱B{/.;ayW2$=7]ŋj|,XPl;B@rM}# dn'B;@*n:Lj栢G,JQstI^_m$$KO);byDW0B`gs)8̇2YA)r&IrJ FSD؆Er0`|8sU ,*v%)>bO:ΰVix,2QGH!es|"4]z"~vƩw2T>L4ˀ "*V4 L%r*dt[?%ˡLezX5l&NSdvT8٥ց~< cXe` a&du%I ,"M>ou ^:U9+czNOˆo/٬&FIk"Nᣊv#[}۬GHnq"gZ) Z&|THJ5c %s' _81t{o/ ]Vvξɿ(( l J:C8hbM[5gŠ{)0q%Pw+^"u<٨Ӆ x=8,@a { u K \bؼV懕5Pָ}*Hy1 [@ :d!/wZUb^ $5smi9eaᚸd?}tl͡73))9NFGx5Pp7uA{˃0BҠrus`fxkSL`7 栲N-C;J2RmO,T8? tI޹0D0+0 {qWo*uǪ=|6Y1~^V> Aԍ~Ů+{O-JgΟR8!  -h`u kiЧ]01 NL=0:"_1D v. .>Ax:v6u歲PX̷)wuE=JHgmx /U9_JaS~enډ\ Wj ^4"E Yvx:79ssgF9L \2p #F\٨pHcMՃ6%I@a4YSš"w2)'2 J=Ć{^#w<4V>%f6 yU_"kï*ʡ"z!.0_!51cnn.v,0݄D∷yD5qUP+")YlW!GB-n%c3DI% i4=J?L]̃ФMJFc: A7Ȝ;9(BFIȌ,qSؗŒ[|f 5bsѷb3.t%UAwVUg`o+ֵFy:s\<(x29t,WiE97*ǨAso9U9 ;Öb}L5!Ѷ&+ M('z"6Z"|IgީfF|yk50kf=6htW02SHf*9h-=\61neےf5GlAlbh+=/Bqj¬> c$Ҙ60᜝ЄoʜΌj&OBJcEz,D1Rކr 㭱\FӉ <T1o KcYt3$f}Ѫ^KF)[5+W/%.~Mhdr`qcK䴸9"GO&Oӽd~:)l0&.uVx ]Ͽ%aa4tmrx\w't˙.r'ǏgBN,ZFe3ʄ֧KrIbk5^ʲ ԯX]sq5?N:`b&z,Ff-.u5ՋXJz ?^(0ˈ giJk LA9^BTzRԫE>uaI,|oD_nzBtGM6YܾEZm(v6?`ReRԍr^DYɪ>3WQt`Se/9ī"(Uq9M(\c4C^WclwўwzlJ5%70MLA0ڍ &'Tv. PJe({,x'ɳ:ߧҡ)NpY' }Q8ۑȚhDZ_0 @ĺf猳OjTaP7^-ϔdqߞn˝`QLɌFcOO8 $| nlcTZ?K<+MJZ W߬Cￒav:x /m;%y%5 ?&`Rq(Bb ]s u 3$&ږh+iov:*^#dWoRf.csJ689h% !+xJ@r3Gq[KI~g+jj>&^=G~ {<6Y5Bt{HÓG:hpm73#FLejq!]"##6*y7snq=w(ܧ>ZybS'nЍO`]leս[);͍kvW+Z{@qez-p _*9.O*WtTnjUpz_5A3m欲-[DSZ(L7JBg?~p $`min]a(E]$06iu@y*Q' {,|J[6B0e-{ew8bqg ؋1U^UÏfsѾUl*H3fdaΩ-]fD|SPc˜)hKȑMI|sL r%{Di^iSlFqXhZhaaV>Ӹ6.Pr]Pf֡sNb[`X d$Dy*\Σ^9:W"0hRzIB4 Np;sc])9ޯ g!U;k)B0sw0 im l_Bwʼ-7mgHK*/M%1&ގҖV|)K;wuX N@;_7AʿS2PUMn\3>v`mď4Zx sz#-u0Nֽ\H; ,=@Sc(O|./1== 5bMtqp>e}w6 ĈX{Ա1fmͩ(t6LtY%`X~U1Zu@vH/Z lcHДNZ&۔[ڒ i='E~J`u|n7bf?ZR "9OǓxDV&*#'MWgFVոf%#rAȘ]<\΂=|lwkwc˜8hJAQ"Re8bC&`'7?Bg^f%G+~_)+Wrӊׇ)] &Z?@%4N<5h2ʒiW$>$Y˧"gEx'yCP3ճK),x bqFcv!I#@Eแw}W?,;2ĸB!v7ωi̟ +5>ްeDKʫ@D M5|e#J Oˮ rC6<Γ5wغ†DVP3{ޅBK1^v?ԝ|;xx[sgԨ`DyRwD7١$G&l<79wËhM!k8-#/PY-_z( .GʠقkWtԇGhS}xwpUgTZ u :Jˈ{K}h!E^#\o_O]Y7( `w)/$wbb7߅],i:{ȱwS6;sކ/8tHoMn-2m杰OVx<^"璕b;U׶5\nDh4auiŜ'A,類")M1:BYkx.=1p` |Z*\I|!L4x8  -K!ȫg*S51# OhyGl[zu¦0JXȖX\9=%PW` d‰: F(Whd( KPjKTMIj/y7]!Fwp P2 eG G(?}{݈/YcM.M< z )YXn7z]_j BL*Zab$VQ+z".wy {D5QqG5v冁޽s(7~^@SjlIy۽EYV*T٭ZҤ"I)p&Kk;o #WΆk)Yzؚ!/X̱2$2Hɒp+>Vd5 $xI,3.Q0zKM'9͛o(ci2lIj5cQnr=OlqhJ3&jXx;<#V%De~ʹ.ng-1V]hZxvȴZnDQ $Җ&ypaR:+9>M&[!XG4 HN>.OxRShd- #w6΄,'RslBB><Nk:r.R.JxMRFmVA$Z{{)i s&X&r4k5\B\6m$'ŀH=Ӷ2!'#s?uZ bbPP[rzirEnU_U4S@_+=%!, V( (U*4f2$V>[FL5 MbcKD[W[ݓ-'؎^HQsf,C|1ˣ?zԹM`d)`;X5sEH"Q?@1YdCq}A0Es^҅=?| 6: jcc@A*PHӾNobw\F}vAyiYu03Ev0"< oikOx- .SE+syF]3Xoq)i'--VЂH -h2jC,(#]>5E鐈FfغTȱ9\3+[_Mm׼M H rSPgOvXc%1D-3^"!0眴Ȝ:ޏ|E'a?^3y<)gqD2\i# jgq'7#(j7ԨފĪNS3"v+ֺ~^AF,q(bh4HmSGȴHWo$ f T8;j pt溎Fy2JM˲h:h*ՎKAz PlUn/`x `>H0xJHJCj|K̯]`t+<'Pb?~Aj0Tb+e d2r`]_l0\*|K6Y/oyh\a8΅}3Xb )PƷg Dw K' oϐ6٘z@/{p.|-b]1trH%AnDϑ|+ Ed[@Ǫ-@0&6tC1d}b| UǖԔge}) âi#D/GQuA»|`ԺlZ:KRږ'rzmI9G_(9lyqU&gR)#,mb5D WFP tNŗ2"T'(ON^vY7)u]Iß X2!;ᇂGlCJg/*J\!X.ׁfU:-m upC倜PLXNwJކeMQ_uK_>)TPsxVHf2qr,7}I/R&rCU_t|P!2pmWKtJGZqj-'$^bMYnV2q9 p,͓>zzf$͊h20j ,'}XQ2U-L\o!+jFV[LjZ$weN-,,3WO_cd/$JRm3t6*QxF "/89XPuAOiRO3h?_@) ÉD3i йO)GWcN3.snt4Vs0; gr/p"9*tQ(Kـ{jYK'Q$$ZUǑ A{VJ/M}Um:R  /)k$)+Z\c@rU,BZ6.^lhynAߜRTò* 4ʞp#Kwb^ Z7G#f-q&o3M:dVC5=I,͓ O?Qik'p{i:QZk;,ףcc+>\f/Iwwk?BQfekB-BE6G'kZ2heޭYKSS ~j7~7 אG k%0ޝu]?oYaO}[?4ajQB<ҁ˥h<-@r1\5Q*0'Y,9's|i]c@pw@TpQNϗw0-⪡oԓ\a VS:DҾ |2>( $L BAګ "pu0<6l7@zVg=^bd`MS[ե^U0gS^1C3+1A~Vj !PI#չ#D4[PFR 0ySڤd hG͎QJ`ZsN#y[&>sQ]3KLdW2-/B  oǔSs 3Ū%'& >] WՔfQoM;f8--2n=#. Q }Zј#렻#mVL4o e~Xf8O)]Ua:Y$ܚoKvRQؐ?N:*jyi:с̃ ,p k{~,*[2^3*VFbZ^ELo_YBX\ᖚH񓁾E|YFC&wů 8awfa"BT'+j KgLz4衁Li*9݁^72%_GD<.Z_ynx[n@ѽ 3tb nWvPY-.lb7%8OID(-mU{km7e_oZ*57nk&~E.y5ka.Q-~`^I0d;#Ku6zE/k c#ykoX0r1M=Kj"Z禶kY1 Ez[B+8Ee7tHu i&.G8-*M 5 ["hoRbեA+f+7}6~B`<oFf|D`AL"甅0 !naui+UqV}-RjH 0WoA܈_dj}iH{er1|a?&c^omi>鼐;嬍0.&mEmb\jolM]uMµGJ?cZ#Nz9tB1ie 舧J+ۅ!xlEm_C(ȒQmς7`9ÜߺsݾFvo/; **0m hP &GER܄t'SR>l|tE݇@ ns}iM 뚩dVM(b66Y>PC "DLQb\HH^ml25 =4W"Eb=yaHG"| SNV 3G}JbTQo=tH6͛Q&0$#\C&$TULU_32M lrڀqC+H^aui\Fd}M [W_ь?ZwsCSbt0̣ D}@.m|# q(/8 O濣6TO/MBL0ԁ!TPG@e#BEy['×,~a꿃wu޳_('Zruw9ҧF2_aK.w(RAuiRܬ!.Np@j\]so^MKN]Oi7 Jv8j435g[ٿU_K$&*,Q-qlcOJS"US:yovM{4h̢*x+¯jFKoG -ܺMo1MκNPXֈH44%?#Y/IUA #^2l jsV=\sSUK/ g|_pL U.vo٢w:uZq Ƌ[\i7QWf CaB;a'ʺ5&dDkcj~@VOèyW;eOW QF)XR{9NYIk ;kzLh$}C'#1 T7Cp>: iKXp'auW:D#X,32< | mAQCNJ_vش2)jGyr9K VLsP1q$P X&Sw¶z[dbTQRn.- |gne^mEJ?I q ˳*[c/Kn^3V+4QCf | ha ðj3~yPc6,^lFpg-s~!QxNy2uʋ$X%0h #M'3(':xI JEWt2rZЍ6:0I)TX!q1~VAE纳ĭ,MMje4WQsy32c?CX_A  IH5*nSWԟ]Ԯɋ(#Hgl)?"ȁ~Ս1~'rz:>> fb/6n,M5GSj8 t. )F5%|zýȤOCg~vFmÓC0%˅&xz%rrzAzoK&6'># &,1y, Blp z^{oCCǜ6db졙ΊxU @懘ך{QW8k1?8$:"U8J'CU# 59,KuH{N-Z($%(NTO_"N j&$wCr;UraWqtJвh!3+ dC*/Xduy@].Z4T0O1tzH>fNIq|hWn_LI+ ~Ȫt'O[*rRv'3&H^m5Tp~2NKawIkHuE:ܘrY[CKsB(55Nzd dUtri;=rS,8ՕwةCtQ珱ބ^2`<<̯8Q΅71̺%`O{_X 2vt/|Bߦ['"69ЏkCdB.#z6N0xG+r]yq>>ed-DwRmK+ZGbqӸ.~1%̤]KV?Bx.Ui`y0cU+i +\ 6VOu`;:+ $Z VœaKqmfCnZ7L 4ה-4ԛlEo@YVlMzRv '\`Ck w73+sFCEl L]i\LsC5'/]{v4ǀV483479E>`lf~4vʧǦ0mY&|C s\J\ߨiq y&h:ǰV]#oВiwew(xy}WbHb1y{clv{ MR5 Kqҳe/f#Z(E?V?tBQ֞սPi098yBqm`}ܜ(vƵ8J_9^(y4V<~ 3~rAQ8öGwz޵$0lWa̟ 8YN39(0:#}E(FeBN]CHZCӃ2{au( [t]2vG+#hhc"@}kjAv~Ѻvߺ2KEn T"?Co|5QMVؒTQ{wEõtDZ({x9s3c{ǢjN;&LM}3gDKǒ h@c(nyR]vDtSdq)iy]3m ?a7pş ߰>&٨mWCn^/|[!':q' NgI-*k˶xgj6Wtz 5NuڬEE~1Ȩ|~=]X"ovXߖE65IC^Sh&^AZyyd ** A7ͺ"?{M닣ʘK3Dԡj*8{f|ApjL{&o#HHGt6y`:1 zGؗ^8:V^O(jj^jCXz0LdJcC} ]s}Nz$CKӷI$ [*ֆs|W?dQ44,'O aaȍpJ>K{ؿpb77 8XzDؑ:Ysvu0nj6 볺i Јsv9nց7ɾҰDJ<4`o9*Yc$ ]Z%I0w_[3P:ZASQ=}n)t򿠒x_ZI..#ٱnl\ } G#JyK+Z9z _A (&szSo՝doA6O8\)kC56ڥReXZ_X! IҢoWsh )wYM^$ S%p`~|ȳ Χ闝!32!/JSGx0QQk#&:6 ;T k]\l#mCf".нa3v)j C @p'E"VAE4/#jP j DFP#:Cݱn+@6T''o{8(lN5C|z~+{*EY[6!v6ZĢ=<-g(Ў郂dG+2v š;N^U4JQ<軝r,@aVoП6 U,B -~CH#.,x]z@H.ZR ێuHcX𫁌YCB0Ue4n9KYr &l{#ė"&G#{3\s g>_.y=ΌC llf `HAxg\rK]Kt^0AA/~b%O>8bk*,p dOܝljxGu a  E "%'$=KMؠ'^` gKѼMs0"cwG=%ܕ)H*@s!X#.{^H5447fE MwX EXo)8gpbit>Hhu#7 P &<-MZYXeEc0/AB}}:6mBV_{pI:C_ ۪!M#Sx_V]Ab)-7w/ 5Nن|%rM<-~`@%Il7>Cgޔiv\-CR+T" <A#/Tya.ɷ;5=AC^9oʷ;iu5InDF,:-8)e arK={}3 Bi|G&a(Gx_u"cD] hҚdgHjg6#:-%ۦ)o<@!e:^i ͅ-Ue{M?t4EΌJ%t{hBO2bBiİ' ԵRa(AtOTbfE I*Dk +ٺ,gKuWF&qy;S578RbТW%_ ' OYÊU8NtMs#LMU17zDf;h)h4 ͽ_tgd>"DrB*K{8qoUCQY8OnC22{koCl:Vid\u.3By! icJ[Ʒ/'u<#0L8V@ *ۈS4u:uӽhu /ī^ۻπn;W^/qƎ[9uĂ0n9k 4;lzq:2B'{d5,pMr!מ#uן|j8߅*_{>O2DNCr؄;7+衞 \1|PB羱M߂$e~Kt481kܷR9-@l'7j !o9tĠ{lvyv &8MmNVsMo*Jnx|A^fzf q=d1$ޯ3_C@IT%Cv۪==zqUY6הOYB z`dp .˾ƐRY4, )gSVEgS_g-{vb)l#Dk{< -`\ Q+/T5<VrIT=~ }7$Q/7$eL ❋kL!יWx'-{Nj?r*8SGd!X)k81\&.ixQV;ds..q# qS+UͿ2q;;Ē!]%;vP C\l=3e0V8UH~{x=R{-hV"6?:_Kng]h{46a[<1\:iؘ5Cݺ)E0PFQ l;EJ&-" HaX}BZ!?L76@KLv N0-s+hZQb1>D@opfCj< =[%,j?%r@~R Rg(yܐ<nGo vȵ;YoD#,.@& Cv mSi9b3B&.P p#"Yk<;L<v4 "sO6݊voU0ԚH9D3нդ^Šl<A8b9;#3mIV"+§L?)\U]0` r7|ƏJ+M26H߁w!5U*n"JGBãʭOp;ʺڮczu{EYQJF؛Ļd?a'3" 4?ghbhN ;(z+C*L/ +aa2nJ|WqKcM8Q!%m tm}K8 E;߅x!ǰyC7KH_uAi  gmDiK ʹסTL>BJ< kD751mI '7P>x< )NRё 71."'^dS&1yw #[} /݂EBzbKqiIFQ$\Iȳcݜ/ F;u(r9{瞯 F2[|UIWs #nzBuqu6l霏WB%4L^M^[/44% ÕhAIAur -q WP:sD#&B br~>ĝBֶmh06E8ڂ ?zaDiQ`-NkgQ/]ǾhG=  ؄I>1Il, lTrK֒5p;n0NQT$%Gc3̷G]lF^;D/Hd:Fy_!PG;T[j>%D-]Y.6l?1}z7} |yG ^:LȽ8"7K#ux57Diz "+X8مMnBh>ŸfV7X(uk23 mf^2< GL-~g# e._;:a 6 |yQWZ:qZW]}B9 p@&#Sĩo#Эd ]`Lq&W]U C0]@VfM:V6yg6)xUܳ,$ AG)cjUIi=CUZ24Z€nkW!Dx^:ڍdy5^<4!1 3wĻLFU d1?QLhw;' ?XP̐4T_WՓđPV^YOW+g ?vIl ~5aIj7 T[\Ĥ&JV0&ơi ͛)DE Ә xMD:3k#Cܑ=I9`"ѶwF,7-o^vjw^<$,kmQ ڍвB΅ \W @DS;>U SK(>uR.mR ?18 j'[^R,uk ,Y\\^wI4zC;#<ϖy *]3YZjwHLoӾ6#Hl,`>ѼSfƃ(L"}A[dOg޲mol'{@B :s8YZ#}_*~h0',ZOydTS2б).u ;(+7WP@MRF/#c<)nd=OuMH Z ҬA!yC&S<,|sh!̽wâYCRB1Z`A*/ARD^tE8piamR+Č퉫uWS-'F+,1" ׋6TWX @mep4st \;̷ԽbL |&#Rpѳiԧ8Ivk%TpUfTөaZCAu-D0E/ēE7)/y2nwdlGpaQl+RU *Mti6ufi=:p2sH&:ԾX /Ӗ݅q(cڸU6 wI]+uޗyiG )P Je\a:3,qŀ镞C,Ɔ#d3Ѹ6;66 >%6K`"j812Ƈ|7ecb i8/O˯s(j\BmR"@#ꍨtB,nMjMEX͛7Dh% .g&T@OTW YGAEao@j %Tv9axM}խ-VQ9اȂ\ӝO w!R*R\L1LM;y -(%FEH9D\Au+r/ړҝ*x5^XTMlN֧Xqm3`ʆksq=#́ ͹ އH*Ķ6:ٳl]$t$Z9CvщekPOhu䅹ɯ#>ba}bb úҸHMBm(}yy9VRYQ2wf O NMW4,"LlruJGbB4#lМPlM$,}NoF( ,2xt}W#LojJUTumԧh7JRN-riYYD\Hnv1]a8n=E))P0X՝4q|} HWc nZECrsx7 u(CQ+DD^643_}Or/EN hKy6V-<]6T3Ӿff0Uj=QTK ԫNTOCI7e{߹o;%KJtYa#c#d2s&tmr򊸸TPs+=#){8jPDifp' ;cՠ+0巂yhRT-v^VZ)XPw6JĚasz ag_&FpU]D^͋ٽ:*|ՉP8fݿqz7Ly@ۃC͋g?  qvISYp淚ߐ2a0.eu4wՇUuI8}l>DʚJ;?+#;ZUHikV9n\4viZUV$YL@әcƳ7QFAT_elӠgqgv ý;[(:yT>D]*FnSOc=Wng?rC#6 R3 hFW¹އ'`&<'B=#"g7HPx4|-3{]~~<ᴶܘ5VFmܘ*¹t=z%ޜߍc5;#YQ"6φI?cM2Kк̌寍$VEH*^; hb'Fq$O3ė?dpWėdwɱOoFN'⟚c^˜|?̓T&[s$^>-r\̜2<4^oՒ]Ѳ4 7';." vLѺ^sNkqlf:x43HOBhK k!̃:ך1܀xuB [ր*˃TPwr5[N~; +k[k6' Q˽ôysXPj#5r+W!!*WwH .+%"Dmإ vRDLT}9hn^ve)h;ў՗T 3ߠQ~i*r]^] Q~ !!~tBy'W$mC45X\@F|$1OyOi9Hؗ9%0Z sk}_(c;K433GV}(bHNcN+V  gSz"^ޱ˽Yn vѧ_PxM ;ܕښ;i"4CY$Owvپb?wWlWPІNMs66^NV9Rfv|3RHB>܊-Ob` ^J T_맿?50bnQX Oo&R)|1kiպ*^'l9 us(ރ %6a/sy2FĕäwQf;"͖|chytNi4Zy0$l$qnou:<?D(|{>f|xc(3|Q߰hUZ逦+ W}W}A~%wlY``#t)<]oJ]^ĥT ,5NQ/C{ {4ð^{K4߭`?*%-y-^e;hőۅLi; up* +:H4m9M=Zh;sX^b1Oqi< b%do.Be=@ R9UC^'(T끱^EL8aLƅğ\^۫;{3ȃ~X*"e*60-;T=",T'Agi%$%x mxφvGSP~bOe 0^v Z[=;"Ccm/JJl{^L{,W\pHY.+x, ~3wu'dz@twݺMi@ԯUl+W!T,p{W>D ͟EXsy5'O6+Um 7))4}R^oISC>*$j#h#dU*I&}z-]ꗦ hsk Z,57ܜ1?#\,3tڲ~%REISF/X`4ƒ*#XyAHhd]fjS~cxiѨl'N7*rYw BF!N| JI" oD8\alYdۍsND/jquV4i{h7I2fG}z%!U ZKN#3´ѓJv3b0HMaA:L _7eRn*+hѡ =:d`>$ׄ)m e)P\Rk cM]b?j;ma%z͜י6=N܅M7,xL 3LjrKfSOf;H%ʬ?@卾g8dvc+SE@; $:p ]{Vl n.9+i #+y"7HI!Q(NH@oXߒmdיMjn"mAIpEe-Ouё:qsme:_X {).KVDe.g .avt"9&KC!ŨLg7ϭuHw$hjt_}̞*X!㠴ynS1#=LcI.n͘$DiW9o-9rU5]z,5sTqrnujFXyT-[Y*T;C[{Iىp:vvMihHf'߰mo<4ETU'"͜0PʚłlQ(@y+btQ)}2{$J&dO\ |Z9 El*S` Op0Ûa=Ɛ>Ayu+ #UJRhb?wTϺkի.yəΊQXr1E^*L}<|%\;gԩ妝lbN?Ȱ)@e4CS)-W%<4JXݙtw03B4݊BPlWËwJ r_48h_ȬKFy{:FjiMߧnr bT/ʢʑ42LYe&G5I EᓿS+"ldgf1/yCxo='BAW~4 jjZ "W.Q=wg(F޾,Qq^5ZWQu!, jE*ڜ ЩQǀ%˅fIShڮ[d{J SG<5_9 5僷oAlY[Xa8F*p#vEQxBDs@z3w*rPCyӂZŬacp@)ڮ1Ża )V:j:D((/qUP4V%,'Mok)8S! 2{Fw=D}2A1y;SaRhAx, AВmkw\# Հ3RB3m>Y*s8x+M #/aKemWˎ'q:xg+v]j,%'?z&#N>m fUeD;4k䭼_6,hnv B]'cf x"$Mui+<,{F萃NK,Fd39\ˌSCeҜWhJTLCI︃*+~V|:;3V-R:e[m$ƫawl~0w5%mD?9oGXkzs@U8yi[> Z \(Y6c1_;Ce H_2?LVEjS廉,@᛺Q(zqg U(߲@!J?2-=l엱0=Δ8"XʩYR!^ƶt h&a~vdH{ A'Y}pt =!Lu"M"XM/HuZXՒ"M)|rh= - >ޢ&^,6fWٸhodF ]%O/6& _Wߋ5 A2T!߂QC5u#N.Ty!e$Axsg|O[gf4(4XV^p™ p%aѷ;xЕ6*~:-fǩ'E8Fyx~^a"Xg}c,ԓS gŷ!RZĘ9SoMh=H~(-a|44?8GjH yȷ8ypuLQ9lCmU Aok~D@`{Eb`{\&Sh_/DQ@ (ky gZ#^X [#`,wN`ڑՆ=5Eomw9EKxY#2\QzVGp?2.Āޯ*݉fXV5Õ2-T%.3b_B=x4*#uC9#3d*LzIy9u@a=^mpqQ{h]89pO鰸ЉhT+5`ݟSfFH1~Gҷ@/h .er"B8hzԼ,ѺL4cN2kf2/5t<63>-+jW{2O朌/fouE~]곳mP*e/Vqq,%nbhhtT[L - 0Pk[vyd;h'˝[kNKZI.nC^DA0[hCt~_y_B^~a8:ϲ6lǻ20*mP?͒/6}X ?nL GU2$z`s~K՗Yѳ3)Ч%*]#lqht_D=|?g4 \siտl_[J) t{ ElQ9owy<̶jGpxcX`*hT{VR0ĐBZ/akL|0۴ _06*OIY`0}sr[߿{]6fqeqCqɈ7SN-ӗVY`+ùV9Elaq}@NoifJu/MctWvȌ=gʀ:(-fӆ[]^iO{2Yw(ai}i[);JI!{I6i &6(/\Gj٣:Ls;I_i֕E$r(Z{}ogc3$&xZ -2 #yhJRL_Ύ.ʢP1B uJ_y63iʹ1˽O|M}x>7c+񔘲&UWrß5zC3qjR,[,s* y/&QW-/\xfgXx4 Ǔ' w ^ x_gGjd4ȦF&M4 05Y'-DȤuBbF3%dUH~B=*kGd`j;lk,Hp꜋{w7g%ˆ4RX!%PpڣnǠDXB-0hl2+ak>)"y76)V?+4DNm14y(oJ2WVtͭv+9Ff/`mՅ>RcB8mJ#y XS1vA&K ̫g'>d  @y^==z0ƽK\ر&giUNwn6KFāyp|+K?*V尓-X ~61 \'%<99BCݰf]FzΘy(_Dcy2v]| ُu۹)U4V2"X2LaD5y2:E8ž/\ou0˥qߢD3GDnfpK3H\ѓQ -g/dmu)y,O 4w(`v?dܽX r)tux94 x$ɉp0GM/gg]`O?csB?2ĥRp +6[}԰:ڴq)j @ Tq [/Omn fF| M˲vz'oBCiMZ]!r M͇1v9VϭZFOB:zy"W1譫3 TU}r ?!<@m ۈ\}ڥlg6 !hcwLJ[:Vap]F kaKຌ 4آzhU2Jƕ+NSAEEQ㴞>f\P`taW P͆U6Rި]Ԗ 40]L5ȴf9Pc޿Q`Dy}y'*r41qVh4i?֢]'BE͉>Y/f['WɨhjJs..7PZSrRsj:~M|`y{A dq||CxĔJ;'XO|@zՍck|I=?îHhCBzS:mIi+V㣠͝',P!o.Э@S2ఓyN SD`/wz`h0F:& YSʔ. lR!ZW#ʓ%Va Rt(-+I{ 0>[c1 jcgkKg `cAW# PFKe7yg`er0̮,*niN`zᴧqPjtԶʨ:_9Vqr`.q~'ַսwOD}Ouxuu:ap"uz|A[WEM7YrXG-a 暐 CI 3 qo0 rh|sebJ$k\P>"ǬMehL9Vw{vj5co\U94RbiH][)KtЌkNDWsҠE|JhpC^-JO4{*)E4ed1PYqSe2!aIe}j7,^\tqOJxT+# m^cgUN}(e[<{SHן[2qqQ:(ULl;2k{s,P-1Eg`NI%a)0b"Ѡ"g*Au= ܫn$NYכƍFv~(0%7E5kYִ_דI ,5cw]v,V%7t$3 o&d6Y I K!(*! ⽟cгf|{e_Z(cko0KL %ɏ`F>CUA\uޤaKV?}J.@v6w]IOZө$e tb_+= vӂmy Y_P8{~=ҡcvpY(V# q85egj '7,Ex1_2΋)4zj}]bb?)5|(3 j-dhDۑ-$-Eǝ4cB`lβRQ WݚX@,U/b5LoltD*bGw;bQ(nuxF kLẻ<jC5v@rGt#NHYH24L`TkZ8ݧW(G-" ^&VC6h*Ou-*y|aXޝHM*wKAk!g˷b IkKiy3R郣+Q_QgƉۚ[M2z5P^ŽOm`*3wMk{_gg%d{*:ؑxmdII$3>;N ţ^Itr-j7pC/ό@ǮK7˝JxBk/c4k|P.'I& 9&-re2]L;EOhxÿxBDZ zwؠ m[UsLLBкR$hEԠþE!2Bnn>l1"u{b>>s.{N,#JPJB7/|'&3v7HWk =)0{>B+x+L ;>O-?  `/2켏a=> =R BmBikp5籚Iv3>n]59,N_t5f{2ALj4LRR?C>hR6WZ\k. D7_|Q?6x5O$EJ#CNeәQ;6/z>tCu$ŴG lr%0U1|tDGƻ.@_˕ޅ 7-ZNkh,!VP>?#_X ?lX}>udۯeQ#`gShR3^0o^}in}\CkCqFYre ]\Mw FGX^bqСj@W9ɺ8DI _LwJ긨TGҒ4^7?#>@AJ1>4O#d&*/FOUd?]m;Kpr5P܊ eQu/B34CkιG-8PSG08x뾓+.Ow-}V@u .9d b@ci$I12N+iwwX;&–t4qjџ`Q$C,=,PNiH<ܵP~}b 2 #{# jvlt.6I+ IֵwXZnQNNqŘgJAGo7"<{E`>GgMΨmL^dޣqxѠHYO b%sAX.0*$e 6m [vTh§ Ɯf\ n]}|XԔH%jgM寒$ƒ )w,HI0{r e|?{( ⵲Bǵˍ=h>r(_f>- ؈"BF(rjObnF+ d*?UMZ` z)VӬ%M7m`%,$xM)9sId ^|ET:)n&o ;$ 7'A?%ITvòE .-'V;8q| 3pHc:/q_̾6ik? *WԋccڨP獉)q‡."~Eb;G{M9;F`ݕQ=uTaKe_/ r}Uɲɻ5z4}K)]XCrJ[#FNu.vm0 DžEx?Uj\o s6muoK"'U^)AE6͛2 o3G7rpr w* a$ttv ]a{uqB&p b1Ta~ω=_НTbIV괋/vTݺk>奞(o3d_у,_R,,Psjr+G,Lmn^ kG}jz?x/毀ӗ 8ٽaQ mvgJ#fkO_ĕ,\g#+>!d,*鞕{~! D{/-) ԖrDgDtqV"`2KS /W: - _y2EWEgk%ߑG(#ݰ"5 ˉԵ nPEO{iQV{ d?/R3axFjnvrAAxrdPq$`e.cOv|x%uoJyG`5 WtkZ˜€#Ih_ߺe_x~DJ9AeX)SGIVW#=cMK(r CD,jWDF}/0)⫌E&q'< MCьW/-챏JuW=ܟGdA1 yJ! ҩXl#׏=kn$Uj-#JGl P1|B 9NQ>SWqDGplY-sy!ǟb3>Jx]kc>ոS/= .CsoV?u9GTS_/pc"w,C8l(+ +qm_!S\$}6^cs2z,.9Jw^H}ᰭ7-a9L$7Q5Q 0g-~ficLИf۝j 5oG)uLT* Ho-zZB9:\ob2)8'(AFi);vg+u1ilh,Ym;Rh׸s&b[izgY,hօR*a<s ?>$iюH&m=+L٧gt;RԎ TxՆ(d/q^٤Z$(ϪAt /ONҮxa%/)7E:nkF'8@}J aB͜N~a8T߸ GWj!Ln^GLŕjfVQ簷8xNM\\ϸz0QҎd&6@+\4憬B :vح)W`%t Wr~OS݈o—hӀuTw8Sf iT΀`4sn(C/yDSO/f ƦVK 9_ck&El*sٶBMq+-VQ'l-fM;6{\~,jI |[PEl2YYm,|vCe)ŽTUdIwZI}^hP~ՒɈaҥN|9o.ҋbvTru(#O荆-D 3[g~ خsݦₐH'm0D<\ 6P D&#,+0=qC4?̴-pL9=ZtxW>TJp.=#')[)@"֠%C ~U3Gt)m}z!X΀k0K6.w 42ά[Pl{$ Awd?nR^G;Q~XGۂ_Ӽo{:T2]"8iLer1WӸ[O{R A.ElNDd;K"!⡏ }u0J拆cV'~I*i}74!pR'VM2u ;3 B&i5e,}-=zg/զEtp`N9`[ܣϛCkyNǶ4Pȇ3=BGI[>Am?vViP4G-P ?n-S#"5-l(6[j8K6#/v.e뾦>(k*_Xg6<(,IdwMh,1[/6Y ݊*6@NDp\'JN5ۚESZo)fD e]hx^ |V [BAMV%ݡ2*)S'sh^1LJ ;hgYa떱 #($I V4 XHgk*@R9 Zj͸`9kԼ@edMEP΍n'|zhv(ވq/~J'C/e5tT6f< F*kRa[_aóI&L~t8ؽ+[@2JO u<) F _ah8ճ٤¿YC}drYojx1f 8HME|pj[|TLKvz]jjeVcݏE^7d^n)fD, r}r4|蒂HB݉}H;]OCdG^K@/ ڑiy g AzuJeb'5nZ֎ w-|W7{x~kZ5~T!!qk=7#"R[$Ed߷X 3v)hdx;Xt6Cȯӄwog FsV~y2a҅۝M\4ź™0dڻQm(pdARov,K_vzXH8[MԽRp[9WN+> yQ+fzA(iCР/eS,5J͢*ɼ﷊YLA詉wlyyy0·IE.I6uq8؟vZͬ|غ̴:ǟ܃L.4S 4;8w[R9ԃjdJ0*@ ΅\ %(?^3]̉_\zV6oL"K7`.领#y#SWwʐ%BUUg ϭ^D$Y؅A$;7YN{m49=V[qט&3{V,BPPVOBWC~imĤ 7&"sHBcLU⼏,hnIs6 uܾ% uxdPP̂.=)Ժ ymPL- ?dMǦqnHD֎ nز:`,zw,iPX/ =|p7\Wn ׁE9E\h~^|~΀Ũ-HTr5^/|"j};!NO4\NCl!܈9NҘ{~=Ć|DDG*7 *I.N"HSR,o"$2g"su/K!oRLX{bPۻl!X^k[ص~=B~èΜi!@fגjk *xR;P_EUaX|uqzJm4*8i[.q.ÖlG)nKW`4[ ]솇P@ܤr_~>, c;y3/[^v@^xBx(Bcy+Y͵OrQR&쓌73V'^6M:o %,Z!y_WW~EwT1iW WVEވ>*ؿ tBE^6! y{ܐE6d>,[K)Co"ȫjpgNM3qWs0DSuryNDUTnDQG)̍"c۟L6_K D~ϗjP3 X-kHF;|UuC=o uDX䌘pm/bx\-uXС xyjb{BAٿ&2ʸ!d| '0Ǯdm;G`3zg٣z4\Pqgu>Pq20&*oa(j{p}҈Xaqk|kkbapH]@!$("Jq0}8+Љ)-;U*LfB0΍A:RN`Pu2,܁zlo^aMOeSdP71S{Sh"PtaF7aȓAJv6T. "hU` >зRJ1"=,=2qߺIc~ ;~,ϟNEgqh^"RɮW_I8Th&Xnӄ#x`{:r"S,>-@d{\H65JCx`8BHH2r!x9T˥2&jw :Zljj"IKaЄ@Jd91G-HA;!"ma6OP9޺\TWb5͗9. sԒ<3*7+< PqtF|WP2RM Lљ(L$eTsTOEs,8N#)~ćOMl"/x?~CèoDW[-K+ L;5 n7|\Ht(H9nT];=3w a.rCM k̭皅iT6(ƪ'Y-dB.[aA_ lcKQ ҊIM*"0mXUKxKs8j1J̝\źoY4㲢_S#ۂxЏϟcO2_}wAp@gK7d.WFGMd$UX[>Wߊ !yqja"qCvl@CSg]&iZ ȢB#%ؼ#*VTՅ 5//nAL"My"!uXĖyx n9Tjw| Ǵn6MhB "@T;hQE (ނʤ?`D$NuwlXy1` 25A71>`Eh-JpsfJާ@rlI6  :'gǤ DH-JU5ҙG*,lj9mt͇? X$r+3\92kHjp! l56_ Rj\ շ]Zr)[;f%W,%3(C-Fm= >/yD]ѯky( >;_@Gy|߅lOMV|v֛hB0!ee؂fk7[twJ%Ǒoγ5_idR64}bxfCCp Ϊ׌v $[@/4 EO+ {bzQ st0>NV8f0Q՗SĤ:6JlXTy-QWNGM`H k+*fpOy2]VKƗ LfC%^-dEܞKe2W~}ɓ;yɗ!!TokZoוfKc'[],%-Fd4:x2 ݁|{H1`JPԎpSP4P}3dLRSP׵Âj=L8+uL&3U~'0̣<4SMڰsb&jz˻H|~ֿ|(K ).FBxKa@7 ;!X-sb7Y&Sum_ljdG#ŃtD֧2Nzzz{{bObjRo @V4qB@k06@mIRgo >fc#yt ofDG.ceb]z!3MV^! i1#[:/j;U0>d<Y>fmK m^w~ײΫzgHNeWjW=j Q"l2 Q'8OMԓG)ΩV ]M$@Duk܎?&2,RP4pNX )* Ҧ ,$|gzR~ץx/ 6՗S .3Sx˘x T`֙AA7=q)"j Q4L8 /!xj[ti b (s30<WC7Tcy73[ִdLǸWl2>J_Rxjẹϰg\{u-PуP22 gS'B$IGd⯢3W3^9?^0(H9R;z*u{ ط>w1iaיNa~ah*Zq*vkgPh8s]^|6"JM(m@"2=*HosDT!swR9`-Nct'ܪW t^ h>_¼U7_DlcP1zW~tD1>֑ڑ,# `c_$YH!h3X?I'fI'5WMZb`O|:HbNV?H;~*R6 )#_YMN 7eGҍ E!Y4-b!H_cn#r=.Q 1_`xC&0Kg1:D:-\fVmmݓМńr/ض8u$}U*_@}þ&oR|s+C2,B!] M{7?V٘F /9rĐ)勄}ҡY\ߑsFRt9xսoQN@;f<1qy"Ӭ;GVAѺIbMuE?_+vI.ge~jN 9+ZAX/o+K؏u}hIJ6a?TԨ1E/{xΐeO/j!syd{ƙ})3AW(tj냝);NCivWNa;ŝlP,͸W: djofY L355 ǖB?})!{E}Q F _ 頸 zt^tMӊ!BzjOu7!1xByIfD4PkGY4zUy']74[g/~2+ED8&DE\C"ڐ0wSBmY{Hvm>oxp'Ҹ~j``d%}IUYoe͵ݴwa(ٸ!j"Z :1v0Mæ*BXږ.[DŽ_^X{ NXbed00Ivv5x>w0SG?.9w #i$%ˋ@3+ B{a*#35R2OŨ0 M]%]mgHwFvl.L.f_+8vY}$M!݁C ־ ܌FT!j[2yޡzϮL}cɔ haDfoCBH_jeO!ڛ͚ 6H"#x2 zNX'Ð5埄6`*#yBUrݘ} soۡZ73/-%eۙ WG)}5] L;&(VR̃_ 4)B,(ۇ%V3nh}DuGjDބep^\5#T/e"z~S=lW _t=+tN迀:*I9B?#ܔzH2$d |V{쟾V$_Br:h G<CDW\X,D#丬[?h^*XQ@ E†n+-mB 63Wv OES}~X j Wcu@ޝ-W&d66a0";D.0 ]sK(i$&|RJݠX:ϩ|˘sEˉȐE8 T~Me_EۡXwk.9]4){tKܮ̷WLbm%_C5eW<yDsO6wrwo:.p2cmݽFt LtOZ$w,!( PN˩Li'ZDW&.!V̟SZ9C ?cJۗ?{L-zQMD=Hco-snؤuosv_|1< 4<&Mprst l,])Cg3!SN~$~;_Dϛ,/辦 za`es盻&j5 ?+x烳ԇ[r8Y;,zY1Jf$ [ۣBa{3IҡK"'1=,\ema (ufN"4{*@|::V:4Π@ y6Q؈.3Ri0xN;Pd!pm` h'aQɨo !!A5F=&2\wkH,N1c|UZU-`5%%/F3'S93 W?K;es:SNQ(7bѹ`iPG< !=g"+Fx@738h_nͷ\-rKIeªǯ O3VRGBM^-`'nԘEqxxY胛5V-RV֛)"aI"^ H/L4*.f 5>),[Wf|s:p$]SWzY8Hʁ}F齸Tkf-[UÉ.y}tgٗ>@V3ZӚq%WKs(B! t\4PPIX*5=SUY"qcmx|&րGXO$$D/} ,ƜRci ܙ[S12PD4RyKPv mtܾE3:(0s_={^ݜ@㧍I_zXk=Bz?:tfP[Jlwt u1hYNU*hKpN̘f8ЀLXǎB̊%P #cpг)qޛvdC1FԼpEC>GeUvJ_lwKy6UHJv S] V@%{3;l,\En>%Nt覺6'47SkxaU%UE6uinH `Eu!nD2-wCZ y6 j,gk4M^ةSdRpwE[e6UkW'A'vRv#80}Fdۄ?'bm/jF"v6\ :cɎ!'s5R٪p3ҔT/d.}5eGxϨ{?r;+㬃M-¤9܅vHۍwq4Z׬ܓ ^WBp]8-f{B̚Q׿pqɪY](o:Νei'1ögUPKwD4hRwC4^iQ-kM2fdžb9] I5"8}{~}nQlɁ\N@5c~r\a_!A' M=Es-{̌ J%I=$Jip}+"k'7v>ӕ-HJ7kAJآ\ku(zՆ=C0ܝy!Be>4.*pi#Gؙ&}b3lQF\?3Q'Yp(R,2!iSD Z֐< ?\nEn pjri %UDpӡ杼`N<`bH([fh';vckTA[8pI@\)0=/7 NUm\_IHҫZT>סq:xN/h)XX7| s8I. jmD9Ѹ=5wA(Zs4 w/i݌_!V.R/쫐e.6f|*UQ,):Hzpԏo$hvLSZn, AC)M.v[w0v[:=k;JA!njR*BV{[V;y9?L!z. I+\y[7pl_+xvy^L^q+n :? ݒCDkA{^ZȾrۀstzf BPv(qyT X&;!0Y9С&^9,_JyHtMoD"ho_u\[؈O{_U4jžZ@-ȫԗ;G}]ΜQ<\*1v i!6UNZh@~o90_0<0'@C:?}  i/DfTfץ"şx`G⩕C|rw~SV Dڞ}@:ENi+34Fh#O~ )#]Kܐ0%Κ%1 v׺ZYݟ}˄I*?_`M^%y&dY( z#(S603oe,QH-uwCl:qe# 팜-ʟ~msrDg / 2T\5q΢YxqMԬR% Fr,D99G>.3*P¥H4wNK12C-V2@ƥP'Ք^]g] `B 44WelBc^Pz%X93$:uk7G;ί:tgxԗWrymgݝ:*4 {"džS{RE3Uv~lo]0oibOkBh =xv.-1ֈ$1s򺉩F4?]\mJeGgB*IVhS. l@.1baw؏* HXQ]5#&sW4.k'fW9H1VLʃL=O:چD2Ro7Z3NPx3ZsÇ IEpG$l;?^F ڶ ]~~P6֯֔ 7fW%2F8RISRh>}VgM=29" iKnA18 ySF(*%%ksjW WHf(*>ҡPY3hʬ'bl .ژsMhf|WfYtTY e+{֥|dYiSˁЯ~~Q\ҷ`vO(i*e,Ʌ6". -H&i1خ6y`X ua XP*OC=7QQUfLkTT |8ym.ޢ9L<-2Qoa_G>NŞu lz3o#[U+osR*m&t*&!fǞXdsR .V炭iï]S*U8Q<|P/7[2ƒP4&)_-XSЅ}?Ah\&]rkY61m^PF!1gG+kP0LB; X-XaRYVA 2c|IgB Yf b@qh&<ɼugvu=O CjbD^L SƧM;PoU<7MQV} l eՙO8s`u=7v[m5p)opG["~KT5`ORNA/[ )K=ޯ^=:~!{nҠr ϥGYpM[,Bq~*:-sPP4%p !\*l(&pmbK|n zt[bE;TUYYiCɕ?-ۭNqrv`쎡P~>oǃǣˆ?o7ԥ>X@H2߮E՘TMQ.]Uh9@\þPޭ<5|bx-f__+6~0ʊ ˉR]Nq$M,e JlQuzS/i{B1} IQ1eQz(Kr`kǝDyV^='F}+iX W&qg+pF*D$\$]`):u" Z{R6P)Ӈ3@kV%b1SIxe UXxB@֥l/Ÿt֦*Gԫ "*m 4~kt$#7X/7z!\>Ji\cܢ]E*!;2*^<#OBxCXn72IEv93l{pӓ1o MѐWhjZSg pCL58L)?uئ},Ut +Qz{gW!`c-WOs7ȗ @l'Wis9wR"xjJѦ;J koma_`(H >57C<SpO<+[8Γ<1HS1h&*_T+-3}׏B65*'[I/w1 z> s&2Ff!AP*1"h#?V=WE;]C ,x~_Bf|9ENy0G"#Im恲զuo/)2ɴ)}v";=jēN4Ŕj_o wvmk4䦒. aӓ@5G\eySZCZBOpQQTsDQ:8[\O"7WJ V^Ҍ3=Pj!}#(zQ\p\*~.sf:?Q?.l~n Xo8%A^|vs)Œ6gJ-bA(VPV@w,S )f%gͭY%5U Œ\k y'vS6.|l@}hRmhb{iy~98|-@&~B\TƩ).E2w~r-Xj(~'ZAax@?Zcw!s) p Q̞wS{] uy}By #4e.p/͑Gp\*:X2))BfBVC 3c#H Jfh:РtlGBCiIwƅU{?ԙ:H-+6ҴvVJ:wFL*`yUc17BrD# +% ( eƽV}rRkfD-YJys2^=LaZ}V:h<$A/SqmS3,Fx:y 9N ?wJ=*tdȼJPİn9Dqō,v?mMX&S=stɲpp~JźݛEzػؕ S_<gMQ!G8X^rsV¬ܫzP?pZ+؟y3a:g OW[eX.ڿy26#-XSԣX)P',}!_ȬQGi/|긱dE~Z~鹋oܯ# [L Y~޻E -Տ N#fjMۇ< ّ=8nН4\Z/;jGiC9,P|"[&݋5~GҿJW2A {u坹-q$]1>GZ5c`R y7[V!QG |pe)…M!$Fa*l-f)SN3kV&BgH6!" =NSu[lׇVɘ4H,+xm,ASX*W9܏]KUo.G<,Z_NXvl(N.W5pj(1'=d\O"L}\1M gy@Ր*Ŷr3a!Qc1TG|=ttKPѭI5MK^*A@A[&aK5UZ N@\WzdRg71d=P(d!nt#YX~?—W.* -r5sp\4H N)"6ѶayIc`'i[BAm]"|k]=@<7a:>` v旦bÔ8ɾUa=zϕ]0S",r:v FXrT*sEQz*e*´Nǰ߫ cM[~F7\L!eŊ|~NLA0ƴ^,!sghe^D4BSyи-\Z J(V-oL-S>UP|=Ѹz?F" j1P0ΰ|QqL8&\^Png k蘼Wx,xaO~ W ( hd GWP]Q2㺬ȹ,]d;#SWDY*Z^c.:\M+3 ;1Qm=gh,`:ʯ?kŭ &"gǖ^ y3aד8YmݽE2ƔJu|73mz+`R%Klhz{H)1Q>w͟%yfסIp"Pm&ɛÖXDДΛ!OlKAYf8C`1OsMt.]zQgG\T=}*>a8%r@c58:X7EL~Ÿnc4[}s3RYz7Op˺n?\.{{g-+#< `(!z<` 5#!w&d!qt \/os3u9嫙Js賈x\I DӶcSO@d@tw!;jaÌx)?kxuWswUK_uH0gWv%}ն4-!r/~'Q2$`Iݺ䤰|WV}'u5V0@NָCKT7Єbʩ0b4Y!qIU|:v服V!q˻7;_ I;s(G`'uB&Gɇ;O 5y uc'tUEwe2~MzѰdAݞKdV{%In\pZ"3X/+EceJM_̄tNlA.D>{z&9fqƱX^kO0ULa;$ov߆x[lOGYb8DN ;/-.آ`zv%LdE 76cG(JS(8"7-IBRDOą כk;2 &-0k谙,ORD˅Ӿ9TIkWT} 1S;կgnS3-v#iGK^M^%$slH8{dP ޽=N~ "?&%̾5jB\XS+ ٤@/V;⟂T3j!5P ׃yUL^mvG I~=6T70O=X ;/Xƾd"cWΜc;/@208 W `*xV)@S\+@=`[ɎS6mp@eg$fmUL4'm 7$܊t-%L~pd0j; gPjpΌ+ v6^F[svXj/'[kA&Դ1ᰡLJ5 ӹU }M=:u @QD׈a^T Ҷ^ȑbSSHX'NQ{U\5Z+&̈L,4HV(~hyj݁CZt-j"N ̏+IpkyNBd딒s\Ab2&+D6Keo\C,[Ku}R҅%joȨA}(oWZL~ql'A,V&B?ȄIWdXq//:N}u5L{03ģ s E1d<3ب´ dSwG\N;+Vbz arݝs0*\W-\ {f(ƷxKSyq)='Rc? F+6#Q=엱˽C@P~/|nrV$+ͩ? n; ,Ekۇy&܆ c5V\ܨSwo}#uXj-e ?` t2{ [n`3ê+/#9w* }d7Vdpqm^~xR،Df#l`R1&jm >[r~vzX_S] 'eO+[$FajYBl(t'`}ևNH S%+|;Bbq|ؾ$bH8mxeƁJ޴|%pi,68Ew6\10EȆɪLwuݏIհij5MTJ?Naxs?+LvbuJtV2!O\F*p=r8F `ANWNIț[S7-[6qIfi?(}Mn3),۲/OmWAYӶ$Ѷ7>hJ WK?4Чpxۅ~n <fPP,JZ\F .w09>SyqgKq q(Œfʂcm|&곏B+zn4O~ѬrS謘%;^xAD溋rP n昦xFxS=+ثgQ0n-3Tsģug@U=Rt~Wx/\˕Z4nV+O]L6tUړ[Gg܃ km tMb[IםjVBU2P9Qo4z'4 }VĞŜ;n1wnY8E-Ʉ w6K4g]z5 w._gnl*ܰ7emHi#22JX($eg\߆Ed8 MJ:J'BPyhy.B"eUұ'H AMQfj22%\#fA׃إ+ /qF8`71Ăr춳7sc`Q [+A]B]k[>`:)Z 5mp"Z\uAp5c/\wiY(g<{J5VХlk緑7aSɞmMI3lTP[DO纋)) Bĺ,pNSG=ps&蠍Jkaa/[}T4Vȋ2Z ʶVaFYqW::Ne.d%S)!R{$*%c|y^UC\@fR`Xwa\\NAc|9IL52HR88/u<]]ۑxJsC9]^\ɵo_K:IVIMXQiJ>dlgW( UV;h"uD芎ͳCT=LZ=^M.R: ⼠WOw={ FqVSA l%QQVeXka1(ۯլSTڂ9&prS΂, 괹H̔,Z+Nד.š|bd-68j~cP?IU*>,QFev&q*+2@ t.ڔ,PGp8c 1k}a/3'.An+UP4(.tC[mրWk<޹w BUpq8KJ%WzHONӳt,љzqBgbhO_k+#ڑ3e)fCQ.4`DV@JS˅_*aVc187XQ;h\`,Yn=Ŝ[ymDq(iuR.iz׻¡"";N+C- NZiмE0q1²tL.X7'p̳6ņd胪﯎Ɍ'ਉI U{ajꄮǥ >( 5UvLZ`^#8^*PB]% I hA-z|u^cBCZ} zkxn%[~XD[8 4qt /f6oS/r ̂}lt1ͨ{|CroK1UtZ\kF+6VvA7efZЉԵ.̇/mE|AfI0$fm1Ipٲlk;ˡS2'#;Y>cydi!D+ LJAhNt*hw2( wIY8rő <&_\4qPO0w1LHgۇ!BHZ'D.f51ْwx `3VNK--|581KdQ}zaؗBohEڰW O& jUkk_%%]d89h>6^qvʣfa/+oT(߫ ;:V0w+6>f0J⼄?[R=JD 1ihsqJP/ Z N.{J9'/(^r/ʸsueRPv9u(@_k Hvv`6-Mֆl.fF8X9YYC Rkp)r< OsY B ]j%f BHjx~lZG,-Eƕ 16$pF4LF]CvJT~|ڽ*(a+y"5qJ׃(f?>A܈PO٧q2KN$zsShZZWtl 'an#,|iɇUERm72'z:T"dpɮ־ l| tp8?L6&=Tܟ&Q0ax}d| y(VGZeKؿ|-jh/B#@:}]NeZ!I>ՑS6@}lp)zm¥}P1~Ϸs@$;bD%XHaZ6ļ,M!¥5k\qǴBZP`a)޴Y]*s$ځe`{.!zkV P~yNGl=q~ʥ06EV,b(d89g.R /`mYcesi _v<ҹ*$;:?iaQ]e*pЛV X\*V {,#-o&>$C $A_0iaZ5NnR5tߦ _+.v˛R8MG4G,tj75&킒C)n'E!`ؙ{JvjB53hO-B}OJj"ɛ`'kpDgglJ̪j?p g-eoxYDd]i{G2DYˠϞ3Q,GٴmO :\2Uo!] RP b mS4[CxfwMAFkNȎ DVQt29 3&}l> FKVu VK0B"ZxaύRiO#髟 F/ynIErѝ^My\iao˹`t;wL=d7TҴ23[U-GFD3.ݬ6~{afFB0(qD 00R.Gye9aZCh@0Ta1ÂŴ[ird~ƟOD"@6i7* .3$Vb6+멏*`]a:X-0zLԙ> HC/c>;&y,[̮TƐ^Q{w)\^˭#e ;}:? tErDL t:B|K"6Th8 {ciq ]EXwZ?-D"cl| r*a:z&O\QYmt)uS!m4[0A8K(\WxvtRm鄩/p]*"V̓& lswî+ kyNT79\|zl>Nj,E`&Vl; Yqf$ /})5a?|ǝm.':UGcm ,#u*BBLIj>/Pݡ@-!ڬtVst\ 6^y۬*/"70uR2ӇdDx]AaXXRW'27`7}R3m&"`06go)j_ٝklKwÞo_hAB,T )BnPN(N}#s'" BaL^ċDŽ,ܕ&m[G&W%YLAG5kp, oF pD`"ȳŦ|ÌPa.|C.OΏQ:%ǚ4E X@#WAMG{d ixI8P5t)*~>mfB;W<L*F*|<+# tnW;?GRH)RWHvTx4 %dN%NˈbJ{0[ŎEy^!QOmi1aQ ًHSţ3t&.=RCQǛ }pt}(jJ#Wȷ6b`yd(r'Yq"rm -5a]& Nk#%2xQ^_5 o]QS%`RS.)UD{N@\¡;LB;ғC䱫FTۺkfIr͗Rۄŋ8z}Y p=/0w>cȯl"Rs"F1aHDLkHVMtkP ٤*)c dJ-L\)wt/E=? ǙH4|/)SwL)X/ HF (dޱ5!K߰ic@VLp_PfH]ˎIŧ|h7hM'mG<,wůB0?g}5§WK+f ,"χny*~uԴ "PMǟ ~;c7 9$U+^s~i0OeDIC-fjx|W+h "jH!Wk['P H-:AK1)#soo8,k!#%_*w~Yyl?u`s+/I_6XbjP9$3|ҐϐVȎ :)m-Y*#뙤`HhJƪgTϔ;@틝|H(H> ި^.'a+տJ 1cGtox;JP[el"[\rk3Ԯ& @W6%/OC,;ⲲӊlÊ,[1Bb@Z:Wg}gxex) I*!J`ͅ,i ,VKMmRҳ:roW =4Hl C4YO!eN.=׋ NYm`vm"qwc Lcr6sCN%$Kj1r4"K{FxjqmQ3h9@ Z%1KW_}hvpVճ~9yi]1gPלy[ɱ-X${JD^C^3No qʐ6AHIe KҴ\3T>`2*aؤ&Jsqfk^Y-m<.}B!W͸hy'Lb'gy">yU8rq( _/O+h0%e3CO2hoYsdVk%`=\\->43P^;+BFA)6 Lp8FԐZz%D7.@F"hGmUmỄ;⿧[H$C+8)I\>C )'=S]ɾ=`Sean\O}=4:(d`En3s+`#L@΄0)V);Ds&:wC?9+IwR$|Baf̯$?,OaGrGq?/'\6=XSqF컽&`h +q;plj~[ݯHjي_º^grx~,@~^ɩ ^5FHL h|IPA0]bPiI3)&vbf\/\ ׊+}.e%+ JQblVXmg*ǹr: HX?(FU8$X8ǒ47jQJF>m*fx<@㹐_ NZaYbG9jy#F;f"aVPKSENk#3zU~ʻ6&k'O\XR=Ql)+L ԼlF=R~%r7*vVS6}39/2xWuRT8uSnYMS:sj[;k "ԎGhwG5Vy+w bmܖ.xD2:ƻH 8Ձ՘B|\VDs}9g_dp)dP^"(t(DW7h õw]s1L3dOP%XЧx/C_5cVDݜS6!upnНN1*XP0-L[رhXAWC [aZVO0l ,6Ń8J#Y8BeNN-BP|,tX3 =? 1H$BS;t &#P 䧏L^EըsWѫz+JQثL ˍL^Eo=aDXX5Y ǒ =( S@G~$M}*,fQqꔄEӈl!ouZ GHD[ Ȁ<q;τ˰4I1j;H|ĉgMie*ԭ^ʫ⊊b'鲢GJ*@!~{Y~9_t5xاgrÝD[14iWid;9#G^DMME޽`wh\e-;x6t4cQ@65%#ITLBr"!vbmяRp7 аI29G1{V+X`GgkSrLI͇W ҥ([dE)Cx!Np"%KlSFA?akUi߉jG}7n;Z|m+5m# ,m-Ӡk|i6X(Sg-B,1*m\Gb]-x F9[^լC ^6Nhk Oô+3j eÿ8hhX +W׮:J-7Y- #ؘӾj2{a]oA0IJ>;OP|&2m':gn@e<*犯nH,(Cڭ$.א.Fm[d>Id%ٺ,ܑh֪ P?E.4bJV*l,b@|rs3[YB9Hv%'>Jjw !_k`b(;הwC~/c'm'gN卡bD=ClnybyHMɎD1 h*xMTț$Dx=e>΍U)"%T{CJze W"u%⓵ DsFfqژq5Gm].x)ܑ: ^bQ"˘Q{jzU:& N1Ks Lg'9!y=4 h MHh hEŝ̫+ٺċAR&\"]Ul -2_L+@k퐓qJ{H ( (,_[C\kH 8!SQqK݌fMbSE[qI4 q+Y߳ep6lZñ ҋL qOzba~GwI~ GCPpύpQ8+%]cL Vh͐te av5{tS$@%Y9x2T7qX,ikoBDO[bwzٵm3o惼f#:|TzBOP `at">`M0 h;L|0#`=) Nmgs/I~}ϱ9ϻݸ[l |5̈Kk`C^F+ws۟`dT.aɬn>I O-æ:Ad gJbki^wUMVx 2$g5cyA~*h?vJY>!emUeUD8#rhHMt؂}j`@5݇Cqc"ckjFK#d+Ц,sPg>8QD{q­-r/DԂwSR&@8u$n* c:Vga&wQEwGר iN8Ly%tfE~`pZYwߓ;Tq %wk~3昍tC›stbU;C.v\LlS^/[6 52 sT_bY)GoO'>;:MԤ(a %}w޿`tq"k ֝*m=zH-Kz oo|UC<ݪP>BGnO)PS IdYaD̠cy*G9AGOkL*wx[0GW\M+ӛ0L6+c 5~`a ` $_fgd3 2-an+yh,ffi"1qNQ>$"5l0yT1[e%0L 41|6^=iAxmqKFP$y-Bot MJΚE;HE7h\>a1Z$s'B6 bG8CVXqZy/jf6(abhexOqAĬgz cqrRW.M3)D#ʇT1BV$T/5B(cvW z/ZqF5ca?/([?oOe*t =3{Zvk-Ch_7}D]7Eb-Vv&sXY"g U^%}qIdg7'Gkjjn^ì~,wDlW\vY7)$`TO]81F1xn`1 ;JҜBitlҬܵEriqi0> G _>f8Q Umro.VŽ~94mA.`4|Il٪ % l4ʪw1jen,b"tAobOHԚ+ [iZ(.$U kGKm# ʛ߷,.kCKs7mb; A/מL o9'm0cR%:qSr!1C@4Kv{:gqC`@to).grvB '8cKePP%<5' ~{C9#OHb!iK`byb&E㫡i2[+O|}]h,:Ʒ:]K ʆ-آr95}vuFa-͈hf'AH>izeYXd)/+C.CY݁+w;шVTO_Нn UT!9Jx(RXib[h |%!.BDsabK Ǘߩd!FYP-'Fx}bM.C_Z4i*|Q gRfmQUIi&X&ҀS4x-!N޹~D;/׽2Yת: )XE6k E-%0_71L~aLG)'+aʀj'_@- 4ЭIM'>unL=86j_C슖鴥hջ)l\ ,]I%Lw79dוov:P=,Чe´U `R9ho%"dC䆰*(/C5WM7Y|XE/`jF_VGP0:L3A`+޼u.3x}.\VhAV\ b ̌$en5<]SjV ,yFUYL弞WU/5bV)v"DA(ߘEkP0:j; O;lY9isG盟\,ڦp(O/]spbQ]3ؚMD}$٤'hu#KXKX4'\oGMթo :/慓!+07q }l0y]q va?bsT,9M4;y^@JRT]gЬmѲ}Sԋ1%gN7hn3 g8{ea# MpIYk*P)O٦MJ> ?WT c g^1ȧ WQ׬qD Z[d `f&z)c(jRr+ թr%zjjY;sЫ 0tLg]Sd}nMMUhuv^.lL.K9su0/2UF!DOOcŋwrAsӣ .8aAu0K܇Q-Ss$#l .j$b5fٹS'2C/R`[ /6=ț1^}!*Q68, vy$[*&<+SIm/X.N*-=f RU. i}xEmѡP͗u∹=de- _C Ek.QNs&jX^(mGmۜ鉫#7+?KxD"Ch(OA8ɰ0eT>!3:h*]x[̆ghWu'5H+nvyBٞ4 WUcc:aDyIw#l(*F%RIQN<baKgG#VCUVxTa&x'd?魐ƕ11HŽ2Rpt 20ID 'sQŋq4K8>v?~Lb,mphlAM[|iW_i#}B0mO=5]L2#^Z20RgnKB7kڋ"ϐWPr р8?\зd54'vt 9THô,>RFz@ .,\ZMp_5Vv{XƺSfVM]p'KwO`ϳg:M y>h-{{*6[a׾fזslȂ]toـ4 rI, oa7|rE“lAŐw[C(Z`Z"evܨk }x޶@ f"0o86JP4[Xs~lQB~kLQ3@)č-v9 8q1Q3 7l ٣<2{:Ҭ-ta@b,Ea:޽?Zg%F}^p [8oi mxgOfb]-=UK3m+,z"DbN Cdh{ӺO<'*}DԆ$V oRX Lyۅe>ʥD{މV]ʡnR1Nᓿ5e=ay ފ%j~-Ky鈃6tѨGB/lq#>oȔ?\ hW4_?@jj. J@?MJ('v $ޱھx248 w0z pOoW3^RA.l7(U%{uk40691HC=SE !' Dق2ve T@g<F|ܜژT>ZpWCIYsJ WpBq ³ (F g9u~/=1üP{Yzg*qqȃJ5EnX`0{̲w} f*.]4J~yftV#($a.C!(-}Z43H9o,bNM~#խ3WT_I>-'J7vǕ.r) n G-|..39ixuҁ] [)Y]j8gNmv 9-=./'ysJUU1 F+E.qq>(4"kXr$M}=%Nݡ&\`3cQ'XpZ|0u銲!^i eb$U "O{j1&b4Ihrg"ɊM2\+Km{zː=εpV GOqIVaEFܑ`+'`P\Xw JhKO/Tq"kq1,"E"Ջp\`YvtqG YpboP4Gq{crt0<Ƒu(WHOY&U:lAn`J]GcJQ"93ȅqنj^_lJMt܍Y8&K >c*;`cp ֌YOF/@3`J[\˜q:d x(͍I i( hMD &:4sGv9Q8fA6.#gpTt4BVWm_HL _ pR!w$'&G,FƛSU- @N8ꘓoDD46h))Jm 'Pb"T#v}YgEn@@%#8Z7~9/+S|T B7*|5zXFĸ7j)=x•]nY+S7P1NLvY36h.Yk/CVxP-ꖪS7` #@^e C -/.\JsF2iaa+$8)טFˤKN\xfr0_ jAf3T<,-Xt%L40VU tP2vSZ@ 3{V%'pwWqBSaWnz|G@O!ZOqXYƈڅ#4{p5v5U:6|| }2 <5/P*ej? ~qL=ޥ(H 06aO-TnoƦz$ Jb5R:Y9Y Pv䅋v:crո5)%.H@@/܊W.&=93 .2Y0Աr:_=j>e Lf<NzƔ91qq6^3*s2VZ:,M.kF_P,rQ"/r߼s̫w>T@H!ڨLc*"JZטi؃lgi>F)+,n_$|Ֆ{*Cj%thEbɵHj=bu\ɥUrAҝ(')zI8kh Z(rQyLD6uq6HȧņJƏ$6.uWmy _y 3;VT+y]o%J32 I-UZa&2En.gM)St9!z(n lQqv&pIPؤ޺AT='c=_JNeoD?z(p~lqV~:טhJKc]l`F.S 9m%JUF^a҃ 2EʷB^L^fՑ|K$CzQ>?N=!fWW]i~By> l 3`H9jHC(iAKO%n"3@EYiɾQA&0S';toV^E}}/zpլ">m Z0) #0? aK}h[3L5$7 OpSgZHs~ Q4^c 0aj=.GXҎ-ZęwHڹzPr劢T1T0 :9 Wf2YnQ^=5ב#Ǿֺ!E lVbsX-jS؃9Xhd=.5@=ɳ%P|JƩ /e{ٸ72?9 iK`&57 OT6IlHw@J krA"{%Lڧ)`Rq&A]xsOCȁW]H?f>?X3;dh̻H24JJZ8#9*:Z'FE)UCZYa*śG4~ϕp2aC+.ۥ2qC! "?G(B%WW~3_)5,|` wbꝿm:'԰1u6N/`|hL~{hnu],Nk~Ax9 iQN9Z:ŁrH_JnO? ul0$T(YmL$c8?=Ա([Pi-%" k)q+dHҸ#v훜B^O08}Q1?SW/;aJAȓPYk:4[{7 glgwea  嵂BTAS*W𚱯zgŠ=F#PU 'K|?i&w/ڊ*0C 6j4m{+覥zQ}xw2{W\lm aE_r#W2zxr=Ҹpg_U1:p+[Ҟw}g1sV-;_#Ѻ;?$7P)'Ǹu;d#t~ 41;+(Ҵ=O&uț o 0u8K|]4 q B9vu74|d12[JcY[TJ+|^BX(^hڀFJ}HP Q'kw.T-3p WTA:-6R~ҕ?Hqbd\-8ĥih@n';T̾\,pX3 3 aOwZnK|ݝx e r+C6Go2:5˶!qa\P|dAvBj*:q gyUaƅ1Hm3#OvE'='~.CNs  dxwh%ɌSW/X B&]ʲ9/ MM qfH}TP%WtB!3TA֍[Zu4(szYlo00qI]H8^sѪ}?gry~9XlS߂, F"(N.D9~|wgN,'cFʪ;Ixce=R&i> f; A;~+gI!ē$&[P9t98#Z FSCmVk{ 5{ݟ`>􍅿%7%CZ%qT¢j ۮ@cA; سp饴׭ޡpdwƭ:f4ȧi4)^Q~GBmdHtFSS-h\CGMH@6omns^S;"μ .D\FGH{^G<<ةS؇F+Q~ z̾o˭9S(,3~e[/%eT a)ާl3BR 8 C4z =8a% j\ ՕXx5pDyA?y3:/O5HL-a,@*;vggxvbhQAS+lc50evpW\J+XcWa.k r O|"PlRUZ Vl| W|RAKA¢DslVs&h5&HXW)zZ;~4tc㧶R?g6R~$@mW5v׆CRJ`s 3AGy 郏P!"gmHtlMlRU)l0.`1;  pIE?À'޼R;Q8 l4tǷhPcvqrњpDX{V`z/' 8f} ?KG"PA,!+Y)BKHx-7,xh QUt?vE<[=2  nCaD,=OqTDB,sr#31b $&8Nᛨc*,Ub[] $co "yN 5}9ٴBR9)yN]̅Tz`ғnaKvFJ5"`F;) LYW L_ShEiXgH6L`zF'n,+r U0XT 6㣼eu.Nh 9goZ-Zkv*_G%-)j'içTȥKI@z=Cmk"Hj!&bV wݖdwjVU寴8 f]&<A?'BM}P2W(+eE4=empx˙6 lf'RPо}uNuQKq@~jJ†5c7P" #&/i5=c*1CB Uݶt_҆f_@o)B﹗:BrI= {/YȶWZ`ZBA$>  tB*EyEvs$Ț:±'G%( }u7D\>TЎG@Z&/}94gZ&7c kz duc!̆CÛ3\Hu|)l *%y ]YJxgWW~ !6cvK*!cx3oOA$X|G]|N[VƲYpJ/:t<^*gΌS7]6 Kd;FL!kރeN"K2i}H? z/Ecj1?lթON86 tS8.Jd1Xz]n^K6q5D>םM Tpk1؆Ҳ$Kut9on+v|*_9P!9@Ĥ[_],jY8UGj# hB4j)Z0J:tRRzD[lùihC%-7. qt<*٭n#ܴ5$3S]"ɣGz/F]#4OU#{4}YB .նv_ߏ{^N|W5,nXK/:VVBNMIm!瀾`?2,W;oh^ 3XЫP]LWa8Oe5KxL@ 4=xh4'$bhG0zdxX/e,.y6ۻSN }MJ;A^=$7RWc‡(]e`ƙ p?}ږ$Ƭ:Ч+A'(C 5 xߝuV#"Z,;JTNڛ\VB8\R{F$hPۺxa| 㥁w}l[Zd(Ӑ0{rhC'[.-qkZ2wi931^, jRƆNq L2sݎδd2J:'l"`6<,}ᾣPϝLR݁A3TO0]16(̝E U1lY(d["3ʑMj#8"Mo~B|_)kwKU?J)8&/=b׎- A-]%ǖY%5T!ӎi~< !V.`>oF08(,:m-ҠXzUN7)FT0mkM/|ۗ8[^@1A8$KHÚB\:Zj[_ pC-ڷdZy4b;+l01KRW B.!RD)[hל܋dYb_<6O YT}D&T|we_FQ  ER!ݦDK:XI[@ՁV%W@WlιΗWD9HezC;Ov|*E85P"cI9*\uo. STTB \m 쳯v.v00XtT!w@E(dKx\x0,2{iF_sxd4%*v);v-XՎw_2H֔3kEytl펊2B'ELLfF(E fd>$xk8o ËӲ ѵ\v;aY-!$^<̢XĐ#Cuv&o-rCfP}&D i]jTz5iεWWS-(۴D $$8J ̠Ez>i=M1~S'U*cH]3 4.iZ꥟BmchuLTX6&&! + ՅO#8gT{hsWey*jˠ4sL,gQoN>3]8c:Z N 58aw{0pfkAQFn$yPi1w+O+\ cym* a{Qy[2Ɲcė;Ɛ4^涽TĉIU=Wfy8E`v[tm8Lz֭DQpuOMd9bw`nẃ^TkG+k,spz#t Ͽ>7Ήsa,[ďkܠBh@J$2eYj4Zܾ(3^uZHMqz2ԦxpsQ]AV.[-C5e=cߪ# ;$m|$xh*)?^/| iǿZVC$_? - ߼%z °N?+ׄ&YϻטUC+^ʻWFBւsoQ(/5 N $TքװL k؛ftu6(5C1eGoj҉`P3ʲC`(9V>!]͐t 0}`l {}oN;ti=zG+Hz{6SՐ$#}^V7\ KK%1zp J #uK8DyJ8`P 4" /+2xٚ,ޓˬmLy4N\w/k2(QgY!IJ!vau>Ss{{e$D܇@ܸQR=ybHڃ[Wnx.Jo\-W_gɒ۩"6/ZڊQaS1k3w%9@H0u !qBNؽ l/5lvGܽ lpo7݈G#,3Eu\O8?fhgULl)p"ݤNjS^=<䲣; Vu be=KG:a/<kSn|#|!kFUiXB'6f+ cJ],UWRZpeě 8RNԅ3+kHԸM3n* @jr!B1CwHX&HVCI&[H?q߀'a fF)<}F]b2 ƝD @DÉ#Q2Bqr> ru<9dm:c“.8})h=ީ la\UduXBڙW$B-'xhN"OXvkˤpS{^-e`Z.m̉:ok#M&Vδ{4\?iY0Ă~^iKI)&3[P%a7?xVp ]:р;s1WIťxdz4]aaG<2(P-H?a=[oJ16ޟx9T}9^Z^] jts"9 Ok9~ozW%_D$|kb[->m,["36uЎ2U2k?waajvRtdRu` mz3 '̤y7jNX}X a-lJV#(kK˲~Vɯ4'ɍq= Xk@0hBxRZit^" 'gk6 @qk[3zϱx2zd!Xk2Z#Ne1hn1Tׁk4x|dPzO!0tWyM1X~Q\5#r™~AvQAp]̇PI:wme-v{I/(3;Y\ih8MИ|Uw*a4uQXM.fK3n XMVM4'K?usO5Mi[^^<{ġ-5BqlMdoh(sD;C[k+ruᣘ7?.uPI3G hGgyr];@5vGskCl蜎ӦuYo(T\ÄiW!1H5(W09 t_<. /3⒖k(ϗ2?.V T#}Tӗu;%*;XHOnƯe1蘸|Yvj犴zstSąD xޔE}A#tDc)$q!pBj?*ڙ׭md-)*\Q)6*5 R(FRl+LpPiߗz3u򔢔9P+H}c{UJW qxW 56GX$uDUZ a^\GtT>GTSHdfͧ'Sh(^},hqẅ±{$Zc0+"c@^Lܫ/Yœ2g܀+_eØNVXu:Rt6ڬ4IXIS;BBNa=DeLLô2p^ƍ۔t_ bgB-bFC7ʬj5?SHe0}->֌n%Yc:u"c$?gpCnc|j_8[MvuKNKxBuCQaB'%k-b5\q=IHg槆4{ U'*$k@!Rk u 6C$6y6fd?݌&QfϰPMy26SQpkQ>U,ɢl\"QJ4(1g<6e2r<ο(%5(Zd{O55FoօK%" WݥPf;yp[fʮ{!WHV],nG$Sny͌Kjw{~$biiBPiKA+md=ZO51c(Cavt{Ǯޡ)erKW/lL{X,BYL(xEn!:HV Τ_9{̢3:K2c|B$p:hܨ ū~EوEқ6tƴ.`b$]2za=}PW(&=}B*,?' P.詢H#2ū*w,4BgJu}n_BK,1ض~ X1 ,?.4\/oyFp᧟1]ijB7u`Ku%L-\OJuvƍƞJC@=FFNh15nB ThdZSUkB: ޿d-},ɝp7۞wR(rNrMUlEQl ] #JwC[ؠ](`xhᒢڦhYNb]`Z'Zz)˫79 b< yAeoxD4pDoYt9tf$_9QR$U{XLKW*_lոb7S_-O|#?%VF< ,T7TC1ct|N`m4SLAYDWrhrҡgf'R?z#Av(H#Wھ DkZ JECZqIr #U<@BBhO $[Z[UDSr^ m]`&upPܮ|z`KA 3zک9= J{V]|g6Sl{Fc AXWϣ~BLCNpk9>aϮJ4Mej> GC ݷ'FZ"ү3adFLYw3 ;Q{Y1ha#߮wt{#k b_9Y|*P-:L8jGZ"[ H..H üi'E9 e }қs m&P+{|ך՗!G>͜_i_ ~Nu4$X@cCf׿\M7wN"U67PӸ[IxOZ,=+F~43UXo !Y< =(]V #w)N,EQkx7a$$voq n؏&Lf- 9\oՎ`dQR[D$\v;֖R_A;^,={Zw g{:4?m^ Ca8 =rRK0?&aO`h~@hMٍ*JԞM_K3 uicsTewrYަفVX J3f?˜'rAuXg e~Waof6V]}* wpXnfs;9kB}8vsr 9^'o1 [ !:MR]]|Q$qgb?U%G){'sB=_k+Gt*ګd[Ա 'ĚxZSj: +uݦM[i+K aWŝI^rv՝BPv̕}xS"!'<|բuUmfa @i!GI$BgNU٫lNςg`w0$d_)bE/ByW]kx$$X 25y $41R+h<jqu,.#+.Ql<^L׌,.r֜Mn d]}bk%}P_ HX6v6 M/1,0 mS[!s67ӗ4tiMDơDΠM[V3!*  f}$}ӝlxy(ʆ$@\Cb"5W(lLf(>Eb e\7)(0l:rȖf!bpaz=Բ+4|qenPe4%3gg_9,;^""gJfZgig\7ȄvށGBGa~nAO@" l{y#;ZDix +UF94J v p]mkl|Ϳ_P aM݌g'k tg"zour\ #JȬl)Jy-[& b8r '5落A3Ća(aׂ*)ȸPx`vHHaCcZteA{pnɞ}X Li>b~k A6͠p`JG =f.CiĶ^- nڙ"r+ prX(EyӛeV,dZ^h6[f|zˬ 9 aW ORL5. w>g1ڝ)H^Z7IqP1aR:oDaZdm'6yV ,`Jv 2 OVQM#{V\PY# FB&$摙E!$D. 9Č܈aN_0;Y 0rBa4lM0zţBU0~;L;8.gTjZBLt x!K ggqj!l1kC}1h ecI_X.}-РA$[tAY-vOk;R;(gR| 6AM zͨX.#cw6N36i׈-@%j,E5Գe6?-wYjL׉u*ϟ >@m,Vv )^HU>tnȎ3II[#R׫9'5#I8Ϝ|fQhG]E{폽u_tϴ.䳶b16mmҬqDz:{6Yi(K$ 45σlJGdr 2G1=1)[L#|Cy Lo3L<޳t>rg. ]zI$a,љUT|Z qA{ _S0oz)^(yqŸu$6rV@vշc륐; n?hǞQhR$_;spհc1"p`ռlƄڣ;,ÜWݣi7U@:%C=4]6%Az2_ؗǵl/ Δ8ʙFK?`,`875OX<fR9+`9bD9=0rT,i@/mKY 2wS` !|ҢtOM.qr`g@*\XY露tzPJgT%dqFe0 ?`T,[p]5Ty5>,ѾwFEJ;6-8̅1Wjn}^,dvni蔲mn5tApWv`6yfѸ!ܦNi_賧! P\p:_6w,ԏ]ȷVG9 [DqpK "r.uy+U%oPGx=``0@פ纇NVA! I; Q&@З$s!g)M~^Q/D{K:Ox% Ga'ǎߋJyǭLU'{InAo2Y 97@*Cc }zNL Pԡlqe.]nu{@>Yt;rĪmls\V >Jymbq@⤹=w%|2wylR((a,aV@ ϵ٣¤vQfb {d1~y 禁u <.gu6XGDZI>ukYETU+~;1 `lJZJ~ɷ >ڥ!݅m/S;! 4q׼9Jʓԧ9%=T!i?4+m x\M8erHښ\ke1a\=gC@BS63=tӤy\R5)Io xk;$Q:̳1Œ2P\E} liƋF<ÍSbĴ !~x@j(R! "ylIp+pN#$s3if eW;56>GeC ?0҅CUu)2Sn%Ś]/53 ;V 5{h D%J/gxtQR Cˊ v)}Jm ^Q8Е !8]=1BHcW43e/uUN (@SSD;A*&U8a=rҬ2H@;b=10.@~s\^2DHn;OZfE褯 RS7JPy6x^V̿,IܶZxp_HF(ӯ`p~X㸍?T>+ldmoۺxޙqY?;ٿO}uڠƺ7*/K2Sl8$Ѫ'NC09| vp1m^%mQT9S37S;ư N t@0+> T|YSQlf(1 WA2vFz`mV⡈D Y!d{|SQuGRi]ꠄ/3H@=J.JllwA֥=r{[U+hIe,2qGlLLnkݚ`E4X9z9v[JeդB-SLA\AYl\OlU3!#ɵdg;K;NQ,;h)_M.P }9GHhɠWw|蚫N$Io-93"xr+N'(ۤ_rTfXXfi?(O<|'Yr6*u8D:/_N(Rkf=V!ܜ}QiNo+ k^Ͷ0V"!~~z~q 鳀8"!H5sN|sky08 =Ę _p`#^t50&d(f!!/͌JO8 ?)pwX[| 9?*r^e' v49Rr[Gx䗙-(e{CqӞ2'It5HFBz>X\/_p?r jU=EgQkX}$`V( Z:H wP A6Dҵc66U~ .uUlTMzmZjj0~LkNTeI-҈C*D3"qi8f#PڄEQ!`Sij~i|3Jf:m|Kx@HD&?;73ZvFl)< ih9z~sҞN?.nA>iv-Ƿfeb۠j;ZgkI ܭ+yq&tU"b;p oLpbc`u>ύFS8]J7tꥒJ *29kk2d. -1+t>ޖъX2=M lld77bByfJ\]yn ~# @p&~}Jyn~}' 7= k\w 㧓\iE+#}IV" @94|W=8`:KMw7ƞEj 5^J~+6oLm5LbA'44sZSW$85ҟ&Uav'Bgd%g1Ɛ6JI  zrxZ3csnGF\ ڨH3\JqgsDLk&BbK!P,V.sLlDҫk w'~zٍ;}6\0M>Z%;( 8݋.G#rBP N-y9q(}@w!Qn5=XLip=.,xp e|:j xPSD:3$ *a2fs6'`_N(zđ[9lBt2u^OI ΍?!: dC~Ԍ0lg5 >*"n!1r*W{P\tڿ5>x%ci?bhod^>ԼOy74$N̷#Cx < i>59C7Zwt  ^Lđy}hU#lj" #{ןa T[XPرaF y9G|fόj7bjE$b(((lc}9g+ nrNRy9M5ԁbQfvanga<1ۥl6trwhWjooQ_GMT6a X<; *&Do,/2Q\_{[*35IC!뷻>Q%Lܤѩ 5ߺQA n `u!$ȠoX7Ki?I˷E`3aAb5hs7pGWAF:3Q}c*Ubk&`=K^c+S}5'˷䰒K!ڲiHΑb9$Û=Rjkj9؋ =nPx$ek t8qP. LQDm(t|dA x6#Q2CSS9sAb*]@0 .n$:p<3Ow0L !C('D;͆h+UqJ$ME6MF'i*C\`k),U!F[=v.nm0i ~\CC%uٙ 8 û)T|T@W%i!khpQviAP3ɋ&՞ .>5{&TI%L'-%eh1 E5dݴpUXAL> X)KKgʩ?._r/&k;%qwpTgk``&oQktgx uS;-Є~͆՚;c@$@,:|0ZQ/vт)+WM1|sJ| -,g X,pd0KMJjF_+,bb=ay?> >HTLsjw=$Nuݾ'|m/l4 y8z N PuVD]ώdӓ.""64Imu{f:XKCݺSfC n5W4N{ ?"5h.~2f ؍<5\w2^ߐ tv2reXSg G'{)Je>zuH&5_%e"tiFg- I>m\I W5`FI UpAߡȆ`;?l0=%ruV 4 펢 m μƷiƘ<7 HMj(o4"6l~8/?]隖Ef+HGr1|KH&9kE<\Kʅ7&b `~YB6Qݖ#Ky؊bOE?} ZY,rA:f(y9El1iF{9O* nOy[#T hLCb}L.eֱ^)n3MY+THuIP7lUHtNcxᒞ5W6sRjӞg٫cw$}"xU(%/i$&D/Hh7-bflj*Nޗz˳ItFI?Oxûqr,FiW!U=,"03U ;LN\+`rGSA3f_M3a)~xp1m6`'_G {/HرQ0Dy;%&2`ˀ ̓Ce{u{0م刌xBJ<7Y zyf|pj'ѩw0ĭ9% V50՜gEBu32iƾj-4:|Y$;ʳr2jI6}ZM4|ck`if*:Hr;|I?-AA`<>dq3*J\L3O#_gj˼%/I }*/٧1`Vbҝ4x49HgRl>ىj+.örǑ}`T X tLOuYTوb|b׏ @%G᭍[YV 631ɨXIc&p_$ K@>7'%: y׹r;|Ym~3x#F4Xh Gt|?V%6~^߲NtN:eSxL ,|˾LVBVFFE|jWm6.^s3(l ";U)~f? Xw 'H4D|vGՒLQAސ)8| n/h*W/{d&7(3v0&%v+P`@Ž(RNNCG>Hܱk#G$⁄A#|r0+{6뢭? B.f\yF![.>E{InrN:dJC`^:%Hd^xnCa kq[z||FM:_GbM C;/ e}:q0* Vs0V%٘*;O ߾]ӻSuaEBm+%\xѾFJp}KwRj gK>i Mvh+TRдG ncED,҉S34d%{\LC8-Bᗪ-Rt#A*}4&}\L̶^ `0207,U !>B-M 6D@6Yu$=O38/zn;{BwV ?"G:}{CD,7$T":n]Ͼj|,t#H[smƛK9r?fڥ!6!z{a6\{JhbEC*^.nX`a Be+ZإBmmvVYBXŲY# ՗Jfa}>w0?]Gr\moq5_ngii`/:RWYlK'Wˬ;$g mKcƓ'QDGsGB(K{T7aZw_Y">fֱ+)Z'ӑJe=$ݍe8+=w޽ml^3f (:xKl|UM4>r͉<8@{ $ $#IT|vqѐb'Fb)G0ø,cTR\H{H1Ψoa0qBhY7m[͓IT˭SQ}ӧIf3TQn6v Ĉp* I<' V DDPxQ30O*Y c[=3&1\<b>&dv# 0!\ sSdJd2b^X/ȡmS|;I T~u `E=`L07Do%gMN:4.ҫ g3A8cT6wHT$R$yGDթ/peb;V ƫLdcEq7++++5Q˝0{Pl1E}hYj<*d lB<ߥeu-ԛB9рUQt)*} KsQ(Ft y"<=r.qݠܼm;:%R?fNѾ\JX'%..9oWŖ7ޡ5UFnw.h]"r i >cta#BLe8 ZyU-X)vkElp3iE W(.z)ȪĢhvGb?mIw|}"QFL(^n/4=0:C}(Ilx0M7xx^*k ph"2kmJdP@K.{|y|ʒ5i\c5oht'p^FkR G 27wx/꿖l[n 5Uv}f%n">Ul0 ,NW'5x3vpk-z039,qj'N*( +oY@۹hK\M%;۵D[ssJ?ad}d] ߥ 2%YS%>9T 2o?ZJY1~yYyX3lwo~k3|\X<#ɆK^SRC}_ou8?o/aޥ=b?9} LC>7R]LS^w:iKl:!m/nf>g!3ܚQ--yÉ|Y!G)rU4kj!UX%v˜ܠiuTW:ݳwy15q9S)ReфZQ$)Ed$p=(` +7h,a5ܔ%T*y5ܱ- k–`!qI uyj/=ß 5;%8|}ri"^qhj'`hCob07]}<@1 @k(G߱NmMd묁6t!D)@DV4o:FN6Cj6vԺdA*}F'(xL4i~o(^d(@u0veҍ4M0(`9;8Y>6ڸZo[8eB3IÍ4TK^_ HC.R{\;i^"Rӳ bHipp1ڤfB2QDrMNqP<{]Mp6{A'f!߅ /cGȈ;1q kف{A"kR$nF!hRvb3ɐV`\r0Ÿ3{ e"[n0QmۙXD}Niɠ|tO1CH\_MG jf04ڙYAD\ERGo qJZo"X}ax/d` 5q?wK8aggsBu}8D =,Їu|UQ @eZZ઺cC-{Ά|'OgYۣV4XE} >a$cu3mQ|a'MtyM#\>E%Nlqe4AP lO`d֡Uw>e'|(>:GH"#aΑz(}|:VƇ3C5!C$|^ Zt[djwHȐU16,3VZ}c䫻jEcƑwReo̴8m)=)#gȉOOl HOYLd''%nOsSeIK|&Pqə—<`]2%50nf^ٹg)j-tg_oS+YPrY˵r ),MI%bhXو{Ъ0.+L}37陵CR%Lb1*sGHxJOYq"Vt8d7Vt-C9[ճ̰x,`.lؤ|2bciZcvUE椨k@gy ]|oΡqE|#ˣ;E)YV>ʆx5-tDOBPrT_vՍ0:s􍅁ϲoJ j0X~(Nc)0{Fumԩ΃Wgѻn/jfU'lGj"bb1 3ĊӚQ*pls$N4ȩa&ScGsLe_pOǢSg@3G(/ zh?tljn$$RآR cuH&65j\Jn8T3/aq! m=T^ȝ].篛Ƥ\lmgEӢ[;)'ka޼io^pz+vA`{cMY5W q`l^T''|oxt- /gi5xHٌf<\*ܛ${W@44 o?{iQ6)iYҧ[DAԜ2~[0t& )y'olGDHҺLRB֬OuR)fu6`(SAu(|ʳ3yY֌Ƀ寗w<Q nt=ۍ:<͞H)0x.қԷT - 28L;aNGWMζGÔ40=h +7FYop2uYUfnm"d,=t tx梀vFKK}PqO1lXk<ļB>@Šnxoݦ1Tty}9āa>ԝNϽ[XKf'jat!dQCL< t(_kC3]w @a300a,ѽ`0-t^a~wx+^N.fMt`[» {צDkXɂH/FWL%2Ko,I2[Ebh汃MuZcNCCRgx۔iѸɗ$d)\3KP4X0]! u(f݂2 \NX%屼F4|&Den966wݾAPf'2×h|ZBـ`R8BNȷ"b !gꚲ;D nISl]cK۹U %+/\H=|19>O#k Di YxH)7J9'0S`[Q֤0lvR@TL|k_~)Saڪ~ zNkyT? 4\&CyH~|iUHltԄ9֍ lum,ngv׫, Ò4#h ,%. @+k{{q k=cwpO#&pUntvS;3vDBh q!О3$;;дm%8n7$%TmOϺfCL3jv,;Hb‘NE׫a'*3yw;}C~k]IEb$|W _45\=XՕv4/,t2XYxH8 _Tn?9 \W#D#W⃐t!As1ylw@>3JAp10C(jÀwߣÞ(@7oܔw[rݗo լM0`x|#B`&DjzvU4[ɜ2%tEB#eN cDM`;պi4utَNcoFInlJ*2Bx蚪1+pQ\8e.ɹPm:1L⚸i( ZSMQW U%x;=REV^b4OMW+=Ve8s3)DSY<6q[{0䶌P腢a. 4EW 5=iDe{]ڿ٣o O/O:-TꉏÕE p%#S<DĈuF@0 êl} W]xBS "f^Xu f>`x]"ʖ穅ؿF?BT@A~*8 N}4(\K}ĹdTjԿ{.\g4?h300t^"#01W Q8ܡ y1.kD(CٔjrF{X1fg<$4Ů Ȉ|aD &XUu4KJ"|R-Bv0c +$ϰ8uG x| 矨&e3L@SsOvҴ8g ̡1QL=prkSQˌLf׿ﲲu~nzu2IKCS֩G票@I 'z_(.B]In& ewo>puYc yV.VWu?FEAע׎zvs9L椨sdLE 5*r4Bb.n:yIT,#~ )+Е߫låfhpv0MB W%{{긎3QDrL* Ӯ[AɧG,vsA?-v6~zcm]Ρ\L1Iz,>. =P3kw"=:ز*4Vof^6^J0$$UrJZ%jkB@z*rGd>\*ȹ!RCR0Yi_yޙ^sqznaHمH2֎ܧ ~f_8^[ ~ĥW9L%!7NaUgx8$|RҊ &TYN5Sƌ N%N9"b/y Hrd N1%M5} c~s:E"yP]PM}<z\$Aֺ4t`_3Y\0݀cb*"@_O*62Ճ[&ܱ`)DltF=i U&: j,/gsK)ʵ^ΗPl7|Zᵺ@8B8F wmvc_H*|S;$b3¨kDj0Pջx䩠[kJ c>ߒITtz׎-ܩ0BIU>(yX^zskS-q)?ziSZTz*ԂPT U KK_{xg}"_f練zU :!Ui5NV;<${ eΙT;]Wsw&dThaO: I,ԧ~7h添tf61#gpӣw\(H.%  ?i,]vQzyCF%^V8ALR`eE,! { < p܉!-Ǵ5ܯ LF ݦY®2`9 pV~'_Hh7"RmK{KӚB{ze,ݢq+1U>"*H১qɦˌ؄&{q r?G%f &)1At/_1XGl+xa Xl-xM%&3M>DtI싽Yl>\-,k:T C$^,5)hM5\ѹh|h1t>؂ٍvH'Vi$W@h/x+) q1ݥxw؋nc4 1au6a"6a) ?%%Iv >~ۈĬ#Zf7JTrt,j$x;3)b@tQz^IN$ïJNP~^[麢 3NQ@A02'I1ޣoX6dY;U΅~I ||.:cx[,i; 4S)L5 U a IͯUCTkY)'9gDr?#5U9l:p_=tl8\%h, +k ^L\])zVb5lTI!.DxJρO!sOY*~2, zE'޺0FT?[@0ã8KZ},iu.\sco-0v u]r#_ [^e$kI_h5Bܜ8=oe6Xx|Ced!\Ԭشc9xP֞,%]]8[ y^D\>"Ut~~.a},!.B 6NU9 kyQ}a:K8= w*cDJ{'Ʊt`8Ŕ$ ęd{ ^*g9nIn"^%-벌|^Uw~HekKXGD4\l dbONJÏ.`P4Ex)bh|վD},}\&ZZe*ov?0Y#3R!O[=\{z^:?=Sӑ[ɑcdK>H۰'Z#@6 #H4ڙ)/ qÈ[ xW0@wzZɢԆY0g~ Drx_0%Iy,a:N5~6tTE3NZP .G ;xj`m;p"0׃T*)/95Q1ZK)x>:G_Ѣr:qn%2)oE}6 7LTa` VpO]tт?ɹp>''JիAkcq^Q.gǫ8l\-64n5bUˡˎ \38R>k0"Q h9&_~R=*a+$#^Ղ+RGtUlDc{O1,!gD-sr: es, 9z fT΂VHB_4?mbiィ}1Fh"9^zf$mnbJ.cV߃HUgyɻ.3_/Auv>y$"7st4+y]ڀ0m"tMDIٸ(.)ڌ됏so5 `)%y)%NOq{pN[ WF9M'c 袀 . L&_K'qkEh1f șUQڽula!{FK@or6Çg`;_n¾x}0?Zs``/h3Qm6fD*]OUeQۮ'"PƵ`Hc/QڴQF,/\^nɆ.cx]_m;S);ˤ 趬m#eC4d:^Կ4_-\] 22MycVtxG=|J=U:KT`Fh(f("0 I:竣퀹J6;"olC=0f/dl ֻ0d($^u7wb#c/JM?2/n5\ Wr_PW|yחH&L`5K [!C > zIBu.^g14Ĉى75׃\Ow{0W ol K(:eI&nU!憯=Xd?Pۺ.᩿^YX:Ct}S:&&ON. ~ޱ@d V j:N $ly =E/rI]ka=4\MrNJc0"Zc1kAYUI(kقHL($[~Wv"cŵajV]*MoFlwdp?(b(I62gZڒ˿F'BylzF2̨2f2=:/f iQ\1o`i9܂y"3:`sp:xKT^IŧoQ q>+ff;8{n$"[NcH)%-PPgPH+>rܸ.KG*<٩ujiZ|cK!UPdͤJ6j{"rUrQMdͿ|x_. WDXxyR168Z|u-)dQ@;*EАelj>nO+i&fpŤ˯c:02 Aڣ1NS%,qF!#ǙL0R I)!Ji)l|jsr7d'x< =lGЧ"a{l9 7AW*=lj%HDq_@@'@ϫ8OGPnoۗ02^,j Ҝ~;\E]lW]K3_u7#fAphͩN3n6U/YERNW#fZLĺ`%xf]`ď{$m.tfpPczsdaB<n11-G_ZsK]{S`_p'nfVB096:g'mĽoiҎHcOPo@cN-4w(@MdZp~7V[ކZ_5*cRTYe2 )v׃gɋJ\#klN< >0LUVyOmMP[ %I"яkA|g{ɚe[{.@"D fK`am\ A0bpt.Π+vVտR"*_&=U "" .Ib2s.;LPIT7{hL%sF!şZd5p3W>X49WbO\4+nL;7+G;6]SAT[ (o͝&FAt3`%9|'OddFU 0LX+Z.yɓ`zyŔi&ONtݰD^PH?7p8?rZ ib;7}$®`ǡiXF2h_+Ε+pxmr~Kr=qBʳ$hªhm5!ޘ8g81@=L))݂!v 'HgoF "5!E` ma 'oiuS`j}n} b<6B>=CZ^d\1 FPM>d1)7 zJ'|6d#@=DBuβ MѨ>4H7P+Cߕ20aLPG(t-ZZ mD/^'eoc3+9="b|]ۤ#+}-/c9s93P =4!7lxbNN~p|d.MRvleU{Fqرat<`\ގdWKpemf(o:lP!M5nK nIrqZ@O㪥 @O1j7ڽ}K*?KI9 {T!x_(@7)Mg {}L'%؅_!@ݸf__I&1ڼ1;_$8d ;$,i,wz,svfь_2^X)򓽹 eϜB l'Se]IA98RکMqlC;BodS3ϡ0.ld#IV1v'`zAz,SL%94wXߠX[4zAt'ry=7slHzjUL rWy;Yuyg?O2/.RnjGwktf¡.M.^`L ov?hV~6qNجN/ Y娋2>ކ 4ċ;_ ڕe.ك+pmNх w<ɋr>9$p9><*?h,ͥmtfI{?)h$U.Xz*P k1$yeWAfÆ R*FQAhsssUwHSH۝[4վjL ӧ3|c+)nqPRQf@o%h٫z,(綾HoLoA%'VsLHoWn:pZŘ4Tuu+W}wJ}WEXF|_)q#鎩0"^ '}mY4#=H'0:pa'鴨nz+,eqɊ#6JC?5iRׅQf3 bz5ɜ.+% Pu{o&5@"?,m/^<6 [#t0e^1BqK cm8^r牅e_gF0z]7߰_Y}i ~G{j= =Oy֌;;+]V5BM_9n Tͭv:MF|P/ dž$*0%~ɻ328fh2vD%"ӏ-߳f;ZYxob;qrrfz΅(ب].@. 礪pDEEu}2XWHD .l|(0 3#ӣAr>)/[PRҎ˕Bic}>R}B+Uw7VƝʤdW G>?M-;V9':#x@X{Fgz]*g"4 ch ߊo{ (ԥچo/L&H%0?R֊(T"gև~%qGB'H62pqx;4oK).LX= ,&;Qn!ͻuqW}ıe$(YJ?->z;jd^TUtz1MTM}$Að ؝'M"@z-/kh=Ps\{Ym9&히JgLi7/ZE\Bs$cDtRxʕ.*] ,P ~~vk6V`5RQIVb6«eZ GqQߒ p`2n0wn<(t;/{1fcc(;:U/CYS%6 ?ED(bU7sg^#&g%[sO,K W Jmg׻@QJ%Ԥ,KS1 +v@ffJ{*VTNzzk:[1o"D:6w`L)X(C"퓣pLܧ5E_=Geqa5hA$7*eÆ̌V"dzrYrPiKD19D+YO#  !n;]]A.wVA*H:Q%r`;+WyyPHū*J‰$]ɳy-5Xo[\aX9Tٹ}<<*_ 12/`֬hBl*\)9 pj(omw˹["u99=ۅ`0[MN`1&LlytnPkI279"z5%n>U+2T9\\wJj1NBsZxUqP}H6HĴz#֘|2gt{`1˞@7nQda*kQ~uynAҪUYm]K≗ գ0tgUpQZ{n0;K 2 '<(88ikR+@>\rĢu./7 ŁFЏ8wx\?C&ފSEkZ2GPrIZ6v.VѰ>B,c \+<|azA? Q?ߋPn]p4&oт/5ZH Ώ%d&pi~_Oi]BI_:K S) &+JMˊ?u \⺅!^r\i2?`m?$k} ٜƄ!Im:%yIjBhO5&.ͮ"5R5=ٝp7a_*DP*jҡ'!( hHb EgIP?.B-d3q mu%C.t V[]6 oۘr3ռۉo҅Bi[!jګs2e%cWXѕ9([cc.+¼^w<'NBTc? h4S\qC.ň6-t6e RZ]iDC J+\zzHm1GpARtRy-4"=~ljvlhMFc,:'r~FІ)g܊ ڹ"sut Ud{;9JFE3yXunoYRwΊ8H}|/ˎaPKI{XD\v]]-?ao?8*:=wTqx܎PbJ˓DzmZRl9-wR8LYgzk>5B_@~>#`Nm:C+F}[G klo0ׁ!˺mp#, *Xã !]4} \Ƌ0xhNq#_P-ot,>c3GgC<[[+wJU49H*}Yn.vghNWgmΊjTW?NPG)K4sGMa߽Ԍ-ŝP2,z>D)XiA2>wNY0[@VKYvE%R[U ;j>Pw~,q|̪ c _ I`=/,NGjwpˆ/^)j9NlTpl~[!?Ӊar]jV޻o Eo"7|`pa; k~8:qӡeAImx'AGT=|3clQj&Ś\kQ9~jc`|}Zy`C#aX=U]/Ǒ .{} d;ѷLg4eV^˴ޖab&[=l3EO[ʨ'ݏF˿#MP}4"ÅYb"rtSu&sHIHSxhbxu.oC-,/0&$"q_+5'ƤǛro]$% RES'B\hIL_Q]lWcs9ix޷L"j[Ghb-zbI} 'wD,c;.]gRb{R}isx\Ѹ"XrJs2)F8.T=My4 @LcQ) f{\Sl25ۡ{|NXRTlUk}HC6بbpq ;{)5Swwt晸iM jpa+4$W{q~݁~2._ɱ1+OC !,%G1́x%NHr+1c~/2WẁG&BUe\[Κ])R}EYeG9%`ĪDպ9\)Pc=v@ OLVPz og~'Cz7W6hRCz?u8 9Bcמؖ}zdL(TaXajڜAܭH.K\~{S}>Ӑ# "-73u~JګMW(C"24T_3atOnzp$k*=V @; ("p[j؏4aVNejwF5s6{2BR1؇1XGXm߄7wٮj2@TC9p $($o0r{ wgʓ[!eZNh)f>=4T5RKRE |K*Zi0Z;얊)Tڞ 'zb1}3PjFh8=nzu?]Eb-9-<73& .Wgr,3xFr9sry`S76<W͞> O5bUm.vmF*-9d!C1:Qސ͢’J9X|H75/˪5^M_ܭFZg755y+_TAfSv6 zWG^h;~s=_>XFy8<;k &*zqt}ġf>;_Gb{{O@9"P sMM ~G.m VgmOյsn=q,zt'|a4SÃuɹ "Z.VfקsY!)4wPm`}2\C)S> *=!^xN pP%{835Y ~)/zMRJM ֎?Ey eV}N8 W IޘPNV-iualsDOCkLOә@d( > pvtdv+j/z缩(c s* 0+"UMhA0opsjZۖ'2]i}3Wg5/}TvToit >=4ӂ ?>,.Ģ~{7L3Us}3ȷ<!Udz٣XqHy*~W:?ԼeiJ,*>: 8fT',e.Ċ`1%"{.z E6Ja2@-I9 pW'=x'$ X}2;n(5\-f]=zȁޒn-ﺅv ] ЄU 5IG "3a[|yZi=G3#nP4w.]7 ]\pqrPզ_Ab×D?z bXTOӥF㼉$3ۡoɸft/W b K nAInyP!rtZtlm4c,S<YM.W0EGHSȬ`k 0v !swd+Vܸ DDJ@㹴WFj )H͹rTH}F9F}'o8֦ 78L\nŹTk:Pq@*zTQǘ#б!S .!л@M4^>a#UD7 Ljz7jrm/5=f/ Ix6}T׈pw 7̧&{0~ƿN,Ǜҿt?9|gԑxJ}j_=R1Ny8B]vZnm_[ RnFfS+eNOWW Ոoxvv~|{JL,7Y(gjv(uoxחS|Yr8uNLWG/R0#1L0;=*ZH3TU rc`T">4|/f {υ.ud+ʢIkphLME?؅UjXY)dk1 -H&Gݦ' KSh`oܷqF=#y‰Z(趁  E!ZWRNr`.jq mz ju^P34$aqR&Fre:G vUllT-=7m#qtzpQt?\14E{ܿO{Q56j$n}X:XOl۷Y~/f\I庘nWAS7]L_zc̍Y\ aQu/ޡM֩׌)?yK8z0#? f<:ήm#ԇwtq4 0q T3(T0̳@  (Ι(G\r\"UjH&2-W1`\_+> &֘"rB[(ag|bȁ%<$WPYێby;UJst?`Nw( 'g'i ׅN dT_)?#f Gεq)Πk~MUJz6*N3ۂDeߟUkQi|zD YOW bׄ dQreCsFwN>w$WY}}wSV,E3EFI쵬Z"=3s4cx Fv9DLk` (]„kn-\>Ѡ HrSXAf(s\ζQٺAiYp?B%m'阰yݿȿ!e^Ig1YW@u.{vBgFsۻ@ #诰s{Wn*,sq7Y$ɊCN }hUV߯ NҫOMyBDnC +I{B , 2sCi7Vsx>CE,^Շ;%3:Vzd^f1h}|9iD; 6PrI3#gs-DAnrP./JNcG":Zy?o萍 IArrĆ,vwl_( TѵA zc*\OqE#K>=@;΄BA|0 +!H;ua7epwFR!Z(/A8M"FxZƿtHٛ,疮w1V6Xq%B 2 <7av⾹5TR }xZ 1ߌCy6hÆh[1`B~}BEpb,ꔬ}A|<ާj<LtN1Ja],iQq6;-EQ*B 0v\e!{I8TY{#_6ǒDD6~_<ɖ Ii0G,CGVeV*Ug2TWzT CVg1WMpؤAXH% (0"3KÐW’PCi?|I6Cg..yMp\)bX'PҢd/` $L3|ߟΖL@'܊ĮT$6IyBx"5Fp ҁdkoY׊Ew* ^13rS\gBH^_ Ywy3z"GuܗǮfHB1a0}vzĆ wp]Lpq]h$8$).i䜏  Ed z'uQB"8ŋa  ': !y׭ ~41M: pXwYu׎f\jWS{v&ǝHvN&(,+m~ DnflFᩱChQr1~C.*xMʙ2Ω{c! 7r%t@bc|z-ռ~a"b՟JR+x?|(N[ 7ʊmEPiWj(jjX@JHb6Ԣ@BhAASعUhF6*&e&>l &D*#]kuf~|:_'Fso[_Mu> F_)\}䰵fOC8vuIJ p ˡ4q:8Nn @b?s%#ǺĄy'?SLJzBF=Lйp+|G9X&~6݋8]8LN滛F!,ssXH,`В8g8'U G:Ezd`kԆp@#>^ )3ōuߌ6}o =8Btt0~Hp*t¹ 핫؜BaS_ ViWf? <2|._ŸΎ)B>j?hŻXX:\sI —ʙ^q^3®CŤ.@ϡ&>T#.>Ta lUľ{)Cʉ#d.dKxRJqnuPJ7%Xخ6Kб{M$À'vpc=տncY$82LI\_V$7_S vՀ,9@ 8\m2l +Srf:OwΙrlQŨe*~8 O"?X(־o˟@6F41N~k`{Wj('vkoh]%ѥDEjiW-ػ52z)s'ًmU6lZhGn5N qsAN2&P%m ;@1JvPOAɞnP2E?N>=_l.Aex\q79%w##> )De08( Oe"),/R]EN*G1SŜX{OF]A5~] u#Q/XpT3@yGqjHw^n_}O1Qg`.y*i>)bIjE{VkQi<)*IBd\uÔ>uc>Pw6ыX+o& TMM,)s[M1SJ|k+u=*~}}MptcvnKFZpĿgȎ[p5rmIx1Z 2V˜D~kHm2\O` g/6-5"x' 84NBĭX> Yd—)syEPLf)n"T|v "JbQŔh-1X|bٙ' BQGl H;h.U.kV#=B=+'b`=pWY/y0یjAsuxy7 MrjJՅ'ir7xTE?yF1ZW~FaJ)+z,k!Ռ Kdm\ã) %,=ƶ[hkPz!h P\4I,Im.sPVg li'@ՓDl֐bs$x~9N-|:U6rL+/? .tG򖞗lrk `aL /Ik2?o^ $G@Pv;*edM*qFRV9JD|J$'y"r9qT`eG4EgP4.I m GYNRPf}z[9re5LVhG_t.̽\ЙW($kɫ&׻&'C( vS1Ds cq"'G>8ETڕ [*n%Dvߜ7r2<1=2g G`豚fqW,K_zDq'Jٛqzxλ9hk@4)͡AR}晞':[bỤ֪:ɕgq3,d[}.5tr/'/ H[X?m{ANdfc`">6Tw=ۤao:m=MJצTEMYeyް B:rҷ0G-v[Ĥ]%Sr"Ng + A1M+ vo_K n„xцϔo/؉oy=U]--șlH@pT5A#@VėD\,SM'}3n Qq:Le1CYxnjϐX|7x4@s60{b-qSI0cjr]؃L9}VR& oa~󜳙\ܼр#DľB;45#׉y/{=gytFXg>Z$5sbvͭd7/dg?!,FieHNC"-Qk`Dٲj{Ť Tݬ Ntٟ;_,ۙ> {}Tds? I靳FQ$Wa+JEŭ '!3΂Yu@/5q~t ^81(}2{KǍz+])F ݕ\#KsRUvMP0\A_cWW<@^te6hzTqbsl>B8s !9 : G:qL5P9u?6\ PZ3"V j=Ji#"S9NȆ6DW, cݭ*4K 3"jzAgV;T~_Ab >o򚟍$SvA21=>^Ζ?BmU#AdC +*mf-@nzP׃4/ ( {iA'~/ =fSfILJxp)2r8b7AW9Ocxꋟ]U{fw\یmį]b.6=y x[o{+U4BK0i[l78O N= ²E%)t9w6X!\ln1JEb0Zμe2HKL5@@f ^^K74is3lnS13nյXܮ @#.~Ch' s}[=_5@f.VO@_S^iS,!`_ިJzWK*A9$<[3P84(]ɝɊsz_G`j#YZ7}aJozD.j0h"dj@Æ|4GtUZg_h]`ӢgR.؅I(N\t^2`JƅrT6.[<яw5>Qshwo-iٓcqnxDՠ y%>Vы L "[;%3\Pq%!>X\~Miv9Vҟ\D!LFW,W%F7GJߘ2Z" [*EWvb9$@pyhbc;.ksxL@~2\jiϿF;m3(8; R|ˇd[Mדg s6㎏n]u ݵ 5ގv?@^,= BLOTE& iDLz'-dR%AP@6% ujiIdg=eνъǙ=u}Ɉ&JZf&7HgJ pK2q42 H7}>i!lOAIHjа41\vWwT.7]ITWJ $=}v|0-0&TΞq VN5+XX{E&^6h/EBde 4?w%@d{ƿm@d,#YR#_Yt/>%՛ꒊ Gv׼x2bODW!J^u z::I ސVW؟8hT^kI  %V27ygFmOH  N}6mO>Y-rЬR,Tu Oz3JK!>iPi.g&6=k{˒Yh@G)QΊXq}ߓݝy Vuv)0fD`ω>\wP|h@XIirh:lmDv8 hp;uW"^9{/k==}BhZC(\H"CL3(ٝgv\HG`fC2!kldD;L8+c=B2qmxIyN🧁f7#VwA7Ȁ|!r^frـg1r;gMZZqC?9(T:."L֑K58.Tk0Aj[dQ{5_ͭ$pb w֥*yQXRqfǶ=!W(,1\TTe+y$5z{<9g(\|ƚj) my* G@T,p^v m5b= #zNY:,R(`]Y75: dԇǷ?q {A\`-@NeN̥.8)p mƹC V+%5Ңfd?E־ٕ}ási|xه:\I$]#Kdhڬ"qcM061-Ǘ-^|tMSs 5ZvXD&<+j9be$h+dQɶfoMФdW5$ t GhC=tdf69Ʃ˔Ix}۷C9 IecCuD@5 v6e"Q͟ c` hf|E#P` A:/5BOH_]xA&edB[i .ZTmI54X-֦OӍH\Y[n(m5p 7MυqJt^B@ڄի$nԻwELQW}e"\<~4oUZ2Ys(q缔ybך/2|1:?omnzP {³!K-%6#؋~u|90_q ̌ߝD"E h!qVE]y뀆}<:)PN; |fCܜ_2̆DF 6&PW=T:ɈHbl}$/73F@B4in-aIn~eo\' h߮zSbvU.AN/iL^V!gsiRe ÕB/ Zt>﷕Yns%e1nPvY^$G(FH$!3 JM0)Eʌrt[](@u\glfpulGW{'bp79N-s߽z -%b[*"{$;߫|rvaD(CdG'nmf)e3lf:sdwPu+ZÞkRd:ĜZ& e$72E; z2fJ^ZC)NCWqEpo8lOdz6E:DYDžE4V-lgcbeLfr яY͌dPvFWYx-Z{Il_Ơw`͢tnkWq5E/Lk)upGblu qcFVݎnft?_T>;ǫ>!E D#ī]5 SI{gb uzʿX3fF mp 7tb;,}1 i¢y4_%Qbdy'} Y3<=0>0`T܋)XVGsu5/S9?VsεUO@Ubr Y'MȁژuL5QWk50@e-Ni G,hz2i$Cj^DuJ"ᠭgs9P*f"L_.S{Iݡ5t=ᴕ ;Lm]'aquewr^ކSUiipW tvES4{5-ԯ)mM( m\Q]t7$bot,SPrKH9g~6`_jj_"p ƄNpѴ˳{F*tgMX\TN@ 2q4C4т NEI*j2`MQX|dI"OZ JM#%UW006Gd!/,/g؎eb!9_8QBt]OvvHqH˯@S];$l͊ͧ0v>8z/KrC Soɾ %-[OUFC)G+-Ŝx}SW߲C˥JUȍ:W堠G'/Rt>[2_|[ ԏ>o~yqneL\sLYFX*Cփz %FK(X0)eDqDZ+Ajyk\SkP#_PNXg ~jG+emjW&V2ųc?@OXtcHܱ& RQRN<Y"U}gX_&z)kQC9 - ?$zIɵ 98mUUkO@%>5h,pS4<ȷ[c>RﵥGH-Rܗ/r]/8XF0N>2$ڡqDgȫʲ#y/  ++Z]H睤0UJ.Qx2^X5D\'X>nl_&MѪ<+zjk"HcI[#y0/CWIBJRs{>g_DȦM"VZT=se*$.5a҆ Q ܒ8$}ٌ'o/hM`G`P_X(y~ѡCac gۤw#PCSrps}1,i\G wdN+:8gc4amYXPIKΗu]YlF {Pcj #wv8P#kd Wnfz6XW/MqEj=M-pmYG$(VlS(hAŨ- پFM$#%jmuݢ 3WTp{b|׿۟Y$.Ce v>j)78}qb0b@@ژc5ׂe@I"; Bfq:X,ZZv,S)$:i2V^UL*}3&򑑪a|;!Cci[0}xfpKk^ACH]ؐq)dyѽ4RPo [||u 51ob<֋rjP? &E> $GATD.jmFntSD*KDQI/w%[}S6'F[mm*TWw{ϲ[[*؀?,}X>Zd&N7Hj T.S;p {]?r)B &2+u{Da.-Ei&J>֝ {(r❪?^ۜ B0M F 5ô/^b?O$kKVB?& 9`pk=6:@ k) %2Αuӛ^U I07EVEi;b깝#B+caa^,A¯>U?ZMg" \̧: [DI8*KLъ܅T\&)蕘fSrKaf~StE2z{^%srp\Ȣ擧PלBM(=nRenIi98}Τ[1IN jr?Bw4IJa|]vaڀBG]Z„* UfLơZ ]]cV;D@{,} ''6>lz5?ǯ/'.8D4k~+dmoJ[+ZynOq 6rYz^Wo4kI?ᬝ_sr{SNw6U,uŴx=Tvg Ob.UDjhET ><ƺVI8vզ>O;C^[+zB ̆\NyͰEgk\jTŊG$A?1XJm(׾vܘTMz=C|;~6py!bN-YsB.MA76ä6Z/c=ǠX:Oetţ+aǙ|#2>K}v'+wzN:cUyb54VQ [_mwoAV J 9{;Vd=A`)*/T(٩Efm SwŒ+<}(Dh!ah7JayFst YA&H]c Tf]G] {do眔 IjH`Dz8An*sdeeP^4L51 Ǥi^?6b0PzIՎ^ ykC4 Ai䦅,6zu fj;UQᓐ;.*Ikqi T̩uˮзJEUB%<.Z|4ᡣc~HjҥҎ$>x:eGw fEޒ'F*Wޒ C4vs/ x]6 BO4*b:\iS[' R*^y5iP Uv)[~ʷAQ=oe܉@>/_hJȝmP<8TuhFEJk&u[-:niN3&ʺyl?o]d_ ^(4i^ZDE"Xlp48DQșGw&+k+kmMIJ~Z<Va5DY<)Z ĒKOO< (e;{&&`yBG[tGe@bʫf[XYOXAXPE_L©56Zx1.ȫ\|z3^(&5뼵eƁ%iqC{YF''H64ߐ14=5x!0VY%3h DIe⑿5Ŭ*vXW9"gJգ䓈׍PhIWwrB8_*c+?m_'ѵ(R)Ғ$ℙP(ۇ[)Gm~ɓ*tԖ:zBVs_,Jr>i4oy𫴀ILJeN`kQ*ϵ; 96hKRXѰۯnɸ ͳ3 %,-e7=-902V/|V=.P+,Ԣa=S91[SӮQhuNg4{G4I,l(񠆖{bh_ TZ)^~ӷ5ie蟙<٭Fw\D050-g\;# M5Hp裝 ȷk?4)A^n⿝J*aK]DۦpE98'VH2_*ׂ?2>}E`!huZٟθpenU8װ ῱|NCMn vcvIȢGa#"(zm"d3/&Իu$p7dݎ80A{$tjDduRQplBN"k%מg{BI4qsϧ">k*A =r {B-Kdz~g$Qw7N{jަ[/a=lr+A('5M`+3:SYP[0[W[hT%96AJ 􊍖~H6ݞk:5:P4Y5ܾ-GEBuYԯX4!e8sOw5ŸaANRmm^ :+29cRvypN%7ڒOG,MSD3\MVܯ}ل!8׹)Q58!:/v,>Bjy- yap!ۗ@yh_ډM]臯*d}brGfmŻ^>g0abi- J+{גP]8,-"\L+3}0$3 'f?txv>5FI7C8_X`FbFp, ;_ @̘\pqXfZؚ{.Q$h?/&fXy~+ѐTοT~ Z,I47j D$ 1Mh1(4/pecr.2 &QJ~!ŭ]%aTbpAi[! yMU̘t3L(kB| #b$O3_1j?aNq`w 9C|)[&ƗXwTh~kJ ?%]MֳX, 3"}>x`reT؀"ad_{_k )_"}X.?zOb1X{ܼiyLaC߮v ?)+፮h3fe ;G&uwFtKl­dRl3q`-(hʾŚGk:v(qNn󩓹& =ΧA|%X&Z4!R!VYu 0%p N.yLܽV/4V)&oOjte `jnL9z C>uL1tgn蝕3aTT.Գiy^]aU|nXFw_V%eri#82I۴[=T SPj1Uܯ6wjg2q9tK H1 c8J-YxTY?_xr-$H{_s-;S `SদYtqcH;=PBbs"G,{ MoۜMn3Im޽:Oニ&Bd_kӖza3ɐ >m(aq ibۚ ګlz()'HϠ@R Z|9NݜBQ߼pPZOZ4NHQNW[)I/4֧ @"+][@5ʰa!Aܠ%&B ^!ݞc8#rBѼ o51`RVzH߉G`}X`On2)331B$f>oA@ )>~ N][233 ^, "‡NM;a1?fGyI1QJ43DCI,c{SݷjI>Kj5_j}`v/:9 vr/,E7S(c}rh˲KVd F @r𣍶pU5c)ϫxqщ̉X䝟z,L0wL _Δ2v~phv pAtuq`BɄ8tg[P|6 iw&[H=5;8~̍DžQGYKb<*]UD=~>5C`PVo%`۴Rdn kr[#1>= lI>)x:0EʀҐ:# }ZN9qRG5Z#8"n/W8UO Fx62D716-P;P^-O/ni5W)7e,\`a럾y8qOoF hp2>0/ѼWg7BF^6byT))HKf_8KVxa6foR}-\JX! {.MGZ/Bϱi۲li4㕎'( *fM?Ž1[["}8U:6 n\CmWDSY h[e`O}\mO+貎gCk }ł.a_g)-.sبVYKiIYm TX:==Œ -3Xq{ȸRU)%HEq3KBCYlyG9O#\{Mlϔ޲5T`LY#o;v< Äl $,[d'Lw]A /u! Bo V3y/<&K? ~N 9 n<r4b)vTwn;z/_ҋNc㊹΢beSNޢ*ÚrP#u{ %ofo{XٍH& O%1o0׎"BTcbkώmTTB3 $jWEF֌-.U-[wo짚@+([*Q4e4Ev&~ATӈ~fg0"BL!л1ɠHjM :N.{:֣01 \=Q$ (o̅k*&rH>6<-4zw<ێSz%@K5my%{cMV=*k523{X+ֹG#-hjltp$?Kpiྡྷ /W]ne[>!9.G'c؛21?6L%*Z3Q8"P9:]2=ct>Hoۋr%=pwç V) v(zVcC/HӽNE%Qx`Bzo\O9=Th **`eo}b{ydI{A'me@wǞ éb 9B y$Kk%H= *҄7W=JJKyegv6,QMx"7DaVcDBq{J&D8:BY*y[?! ~E9D&498t`D6 UwސqzI.P2>C0D̝TN ho8Ks qr < F޲FwJVR{2K;xN@k*}@iJGI%/"\,bVa lCFV[?4lf%b|("{{;AMd]L@|'MM&=Z!~⤛;fnϐ, z IJιO&$47EsޔN sk~]w-D*_Ǿ=~N"05i'$ D/&;PUN;H%3s|f-OR DK}TQݪ8(K?ֶNj_q`!?Q;L.Vd+ ByI4gANPDq1ew\Ze?@ voVO;hc|~ چG$cvz Ĕ?.&'x-Ҡ]Fmxυ+nb)5'[2CB-:=iFOosKM~pޒZydT=^xJuRWɢSt vvZ >l¥3#nKE5+=J4Gy$ >c&/#Paѩ'WHR1l\xH W>gNvCWHK52IO]IoeDk}b{b2ګY:{-W|bnMdk !qG/7b'nA &T&<϶6L蘞 bUoM5fgˌ @ Ř6CZѨkuvXo'"fVI}!9@zRwc|WA "6_x;˫K0zZ+z)"6bPy; Vh]d31mrQRhN϶ <*$,^CBDĚg_YT?-RP*GՖZsUm} {~X{sZȧ.5LLRL[% E/T|Ǘ<YuTr=*QP8K^FLG9 q?bUִPT&)*-dĸ+*JA#ڑkぱeywy#]`G(6 3Y2o== i\WQt‹ rRٸpFMG֍k+XOcGi\X,)2?z"~/S~r嘅Kj>6PמÓ^Z54Fĉ)$nN{s[/$:[e}EHCTv} *LOؽ>FX huM]z Nݑ[kc9{*9f]Kԩ 0K$J@K!Sy@mN({H@սfʛ ۱\sW*cTrg){F*|^FJQH'=6DO` qn{K@aNߨ(ɀu^"5zPbr2=!SΩ "LCEφgIDG$4O$?{B< f1rwgs]#8B'EKnQ҉*TH:hyS'jDOJa6HaziGx|tN8oQ?@/ĠϥԲN-%1- wi?)BMc_Ðow0klۃ_Ͻfp#'{R!Zb,s>"Xj"‰_׎Fǵե=,h~gOL!XWuUX5j Q]|Hx_mUh@l+Ku9@m? vi6<˒̱V%t`!y)Ʊ kH1aU%dm3siʋF'6x:c ,ܴyzV/\- k,a\Q:9\}!Q*~'Xz K=% OK,Ӌx55v`qmtF,ũ+1BpNdnj>\&IӮy%ԤA~#͵­H~ˢ֏ۦ폰\G|HՊ#&FV&h0첨m/]DT-war6UΫ$֚QM `=TA7R ,a&NW>hTwS6ѻ[̏fWO.D2*w$<S9C8FΒĝeL Fx54$sp\b"Dh8 &bDW' I b]4g|),eT Ǯi]TY'nNKvN3IҌ[6+0XA/gY~wny 0Y%)L#NZA+Lab-*Eljǿ-W颞8,5, 6PO*Yr S-S_\?bhԄ^: [$ T}Ƃ"l4f!Pxt^UsU lU\dI2+#-[qvYe蠿0]PzkSޞHϝT` \uԤx~O[0-7/ӹK#\cv!X˂.#lؕ[!B^ Qr#$ӹ@IC6U#g_h)?V  cWZN_yu;tr6RCTq#N_k>NFe&r|YDN]p2Ϣ}vo{Kv %sf3r@k2(aQRc!90DxN|"()|mxL_ i?匠6g2'tV , I/'>Y/W,U"kqe^5 EMؿ"íH4j/R̚V%RG8MR4{l8Hq5$;nlUM (8mug ͉$;&_wD|_t6h!MZ:-x!oHĭ<ܝMnG(f!<(RzM`jѐ~4 x8AZaGu/rА\ .H.&~q|( `$Xk}L"-rrqq(9w {ɊOŹk5CG; ?p>\oETL\qp> |IV%0-Km{aq%ʕ4hW޸3 r3 /@Sn!H,pkc˪Loh[<ϱͩ1)%3+[8 |ԍp;Mч1neͶݝnj8=4yr=4,8b:Hc2|<PUK #eչpAR%v\EKUePM*S[ȤY&65 #ūRfMARfqk~GM&VIMPVdn{M\\ES!Ao( y|0d~sgT#dVTl$J9nҲ(7 hl^ij!@]VnzJJ$fBmE54ח^:%]BX-]߄̿hD ev3<ь,7a%[r}wamY}7+|xeC~M`H>" ^e8Ъ6-s=rXNx (͝nBQpNDkOky]҈bp]Xl#,`J]Oy蛺P)atLr,et-=r\DL`q/eodžR!N;v**!ٔ w"e>yHgڮK?O|{^f|YO-yYNt ]G`H(6ӮpNaTIA[i`ʥo*e׳oΓe֨GЭv}=y4XZNtԖc T)jYsRyHoLeH:DXΧW%kBq,C%%#ѶQd,Gv] \2&LQ.&gH:M9eOaܗc[L(8rD%=՛iru[k\+]ǰla6K4 kj[25n;]ZoXW74? L$ws Ffثjg芐իOFUIVfמ?M ޏ Ss M2|=>yd ~(/8ZWB{oX)sT>i([ڃ 䵏S [sϵT\.pSv-̄FֲUZ#5mjQPpr|G˛sM.EdFF6xVr.lpC#V+%⣳>$|Vu7^3o@"DDh}&#Q)eT<+lGtgF?vo^gA,@2N7j,$'`UݐD3[i::R>q\I7JrhC%ƽ~XT&o,ZΛ8M#i'qf{HbGQBU'ձ0?@E"|^-q&uEFRW8H'mk+1{׍cb9yT@κ, xssat혙s}*)oq j*u$9Nk-yK sRe$@2358:Ԣjt+8sҹ+?LO#B9] IA~ą [ 2O|%(*A;fx29O%aL*_j歒^Y9Kc"&0LGl@s_UE".Naa~'0fEE:fjǥlK@ ?Ԛ.+Amh\ ^ΰӯ^Zp鰋 &h`sDYgĕ`yQdF555 Nh_L[MDn_{ݐ~35Vxx5%M6LeKžZx*fۯiKVjyMHCL?Is7GT T~۷kh7&1PԆoɒ,0bO]ҙH0_^tMO~Z @|D6s'e+I @~D% GnL=E*Rp/{5zj蘬Clm?92nS}K:ߖPaCK|Ղ!+D1h|M O<4,M"hPXmAQrFϤK.(Dhz^6L1tLI_HuW*ڰT>-uBJO K{0H<6 TsjW'22{r8ӶbZǥhpLc0Ѕou_ʴϒh_KY57բoX;'&'\;9x GH T@rX5vԉT`LDwiS8bLJS2@pnJLSq zTKpnCbjbrVEk@BD^GIAv+V{z7O"= q_{L;SFUT| ,}[R~fEr "%boL/,ܐ×E`t ;jA?MO42bc2N~j*ѐ-#7y&scBRE-8 f/l\yէcfpO+MXG\^-Zؚf2z5l|+hrlݛ[jP*K=|qb4cDnhY {?_.ʊ(8V=NRMWMVY%6ۚT (\6Qt]ڹndtE9`[2Ř4dJ %7oY {4G*,[f6\vr*c2p!aa0 v8ҥ [4(J{H5G(/Ŕ}CߋК/{PkE?SWd#%T )ƒmU9";:ecx9_]٠J|i-΢@8OAO٢n ءV̂K z\vNx  . @/䂐;yFǝÌth9 i\ _Vz%.EHzu\7J|zsi|] JNƷQdT2{rOCZ_ .pGc؂M{) ({$ڋ.ʍY0/.4ɴ#nL}D M܏ᦙv# ӼŝP^p1\Q+>8'(C_jbxY`% \U\\g~RðxvZdhwZBl HBDlb]zw9xQCśaůSOS~h*/O@ڌ4CgsiN*>1 d@WP-ϧiHZ/"gwBm+InF'lSgRFF)/QΥŕ!xkG[u"'N6C>9P {*x#=FVYmzwWUt,v3l噰5he0J:H h 6k%(i$4=ZZ'l[+ o9W0>M0ɞYwaxioifL ڋi}G@3U}L8d( o\37RGS:횆6o %f LwJ2[T\ʕ~ fm9vZ  TW A;IrObZ6y񊕺]G|cȌ,veКl.vu̥B֢`DDGv0X59"eGږUm $[>tNFcjcy4;[6 }c!bDSe+|/CnNY)HT= }_$䄼5%hrm#ӠQ`7~~ x.zsitTR}+Rx8nYzQ1k{ 1IzxL|M V&EI:eB:D/G- δ4 H{-튽,cRԥJaڵ_w.ڗ=iANPr6SsU.'/:sˤݡM9!zrt'VdShXCA`h6glްtw2* %LKQSu ztx kWgMy0!O9#dXĬL(B1=EНc 4:992ޡ6&hDhXTWwbos0'OoQXI82Oh9PIDA!ɳe@1?_pSD$M񢕃 @G_+b?TJ%y5xXٲ։Po&61+>!xcuJzņE4U"{nIl-9ȶq =*y-{RW} L\VNM51\F@y0i@"ʵe !_v VfXٖTӂ7:vߚƹt'. "A۶>?Fby>##6qm _;/`'wBa^}̛X,Zu]Z[hٌZHV6rEznUZP P`~ܒn ޡiOl ^P"A.g||KE~JG͏>GcƐwck3L7q7{hGvɨF2bvIԠ}<38a`E_krS25Hª WoJGr7/}<3DᫎAVk+.O)M'$fka S+[JwX SaN~)FޘQVdHP{ fkRH_o'7SH|<"k]O?m;,>O5qA\WP#~*F68/Xy?Qh|kA!(bftKJh&pvGUl AB`yb'<vJF?GI.F[Z[CmW9 ʆiGdb"WbYc:D˂? Lh `l,K`sy!4& ̓!o\MA|r?I%74#2I46{^S>ȧ|'gtHn=AU,e8A«Y!ۉ TD*퀋HelK{`"5+ϊ20OtCѯ!?N.?|oꩢl]-d!⚍;>Y~Xh>@*O^ҵX @a)˨"<.waΌN\[Z ObnѢ=*V_w1+g2oznBJ̣EɳU5a$v-2&fZA)!菐Xk?ʪ(d7MaDM)B3~.ފC{U}1j6n]ny )ct;&=iplQD-_G꼂3z"7@v x?ɯd-^$cg2:*@5ahZէ+qxKёkuzBaMiJde`]y˴n*kDb8e&Ƅx"+/nrػE{ec٦l Z[T fd38&emӨ6O]s.&aH;8orn$YinǮ cͦrYHk9ҡѯάK~õNmZ  ^@\o4BQ J^SFzgAxPjW~}M꜏ۚE%|A'RX(P=ݸY=XjcbP`y=օǾ- :@4#JHhbi@ *kv5Eb7)E^9m{ogLe'e CwӊfŨ n<3=sŌ(UVXINmXǣ#+4H4GWzܳ|]5s1]% OXmQ`TQq}Sf ,!\?p#~ϝ${id[ < 3n"AE ~דV;ނ֘PP_]KwVPgR,.۟ک6"_;1^e+&=n$d&5X@%l@w/ ͙J]9UPZO#/fQ"?\|^Pn,şA.-_bD͑SW_G<WTHtϚ!:qV!W<*%vuˀx tPg Q 2n? ƞ5_/v6,elʇ$z?ՙk! }6qy!ç P-"F ŸW700ʠmgb8$Yҭ}2i p cۙ40y1a"+{ *ku jï9Xv}1{I7?cT%p1@Ƙ,TP *ҳMX%L,yc|,"_-ךx.w` NA?TJ}?)\TJX'@:X [eP~= #~Kjb4!*j@/ }Pcy~>>qX,>)͏.Qq Lz* 餅Va肚F|gt (dFuD޹Υ5LGH^?\I֋-ΌDnIm]qG`7^յ.7]~<[x#"DP2?LZOT~{Oz a_WhqYSu|R){Ⱥ µJAI~ۨpTӎ 1޵5]/x;ٜsc-IuFRX!Eq!7|k W5" N˜'_ ļb`aȩD۳A`6cũɬSVIh:B9 :>BPMNT=yH:{=cWQI^J)Dme3׬bu~\`\XPDBB ,\'mA&la__ҝo#S;xzK)WX.E OڽbRI ;f\ +.M&nUM)kɲЖ:y*QىkESj~H4sGAؔ_O4UO5 @jL;铝mߝbkz?gm8GW2%Eifmٷ=xYwbzݧ<3Jj^&Fu[d=Mevn;7d+4Gvax+G 7)N}.0WLۇ" j42Z2( FLApfit`oi{ r2r#c O 0ad)#9%GAץ7Q Fjk t]zX5+4r"}˲N[iUD|԰Jk3%Դp>.ږX< `0zR_C"u1YG:0挤rp[~\$Yf};Hz]މ ʤt/[1JMJ}D\K2jS Y\0Zi*Opݓ.80'Dϩmn TO>H(Fy6ؔ6w: 2P1<+A^k΃t"lB= Mرn4DymݡncӆGѬ\[P~"m)4b q/vdH3p6)s-2߱6EL7L$5,w=<-2R_jI0[/cn0C8(WK1;pNܦP{}@:ae). tz|mi)r.BwJߝ欄W m3ФM-mA83=9bXV~T IYpd݄g8i1͵a:3B e=[YwwJup:hlVšo~>֥%_̓Kh-|^L\vB7q.*CMh]Bf+U.>(U9h 펕)?~֗K˥`8`BRR I16zVB5XQc*]8 pU*}` Ñ'xa%E֨UG[92^mū4ަ \pR @=D.BYQWxf>3QtxXb͹cHS^~VRq"{䁾1؅'1 uoӿʎx)FU_UɠDݧ_F̴׼c"xG8/v)W#K =y u4sڢ[%s"7j6+*{hѸw`B"&T2m2޽`z*Wq:Sey >ծl&tmWt/&zt:c>mrfu}ۖ}~2`J叨Tn)\2g;oiף p7d[:CPY-=\GP2@7P}a Sd5R-6bpx;@7ωq 2` ¸{жBJ&S"2+]k8(܌.:4vhXė:4-V4+?F)A+Ccsꍚ}{BZ)%#&;mD}D,x7knq\NWLNO*SfS-{_I"ML1Bk]o:BA+).1J8˯ avgi{)Ѵ"p,'./zYM:Nb&8ىȒF*-ʼnYeR F"HZ2@Rg2^p=ŇUVbdxH BUHNڊrbӋd?cN+ =G^}4_8~)?+1A"g{*ىs+eFtǚ .V^a0Xkgi^z-Px#дNPҠ%y& bƏ0(zf(sL'S[]<]u+ Nn&)- $ˡȘҸz0?.GZ5dʱJ*\ }\8!s58T)8v[8<X2x%pYPWDZG~iTDڿ?):roIjr !CI/R=}r3OՑrnҬ[g9m1Y"g!@ijȮ(WkV00{TuUI_OT+r߶oj,Er?ooIa^ ViZXPyy·qv{xd5>:`[DI`",~UE Vp.q[RXnS _v.=$Ңo+1k,Hx!DˁРUj@2gYLp܎-ư'M'׎J1b/-C+.BD@sE=6[)TLa_noL="-pe< !}8q]DZ[ v${ * xkD<ϭh9'̟:B#>"![璛!V ?.z\2HA$pVdT! ["=sG Pw{Dy_b䚉X$_ei"ʫ߫3 yj';u9o&zqW/VDJ$eG9&0qCEpzj!T cR/3+z?Tk\mb&S G \ CZ,UfӈɤQğET5"8c_nk4˺m ?`>T8'5]Q2- k Z) b9pn7b2g5ŶeGQH[fg̓hӗ|Ŏ UGRz|*&nHvOA!:߶zxuYңU(LD8Rg/ OtG.Lqz,r"ih\];"1l/=C6[1>!ĵ+L R ^V3'R+ǜMeAo|ߪsf4w8؊Q*)!XKroYUUwv~Wͺ6[p"w)c7#^+d/K(2/i|6=ZPqH޲>,,\d8mj\֒{/qcWh;U+õ~J^Nt}y*Oi먍h&Dp<:Kt"[!JSj򪑏Wd Hۋӽ> &">ީЉtrRb&k~B`]U&zޘ[ X2|ޘP=<OH"p[Dr~$Y- AТzm}bjRev$'gRvRjܬoL7æFc/d+݃!Ws!^.ł1_\ Oy4О1Uu2KI i7gk!ځ o~Tly8X?}zǤ4!?\5 ٦XE =աxam:8!ת/8>&ϽlbQxR8Z0˓FN̈́ۚy&ډT P| Dq6ݡ(k1e鹈ċo͝ Qa*-ws/O9_$xѪfq!!rT<$A|: JS G.mNJ,@ȃI IA)B#p_l#V<_ Oh2z[6mzBUm`iaHp-nWY7(6`B/]Q[ß&cUQ )/MXCant,'Nj,qc)E/ 0Z4&~ 5d5z ol7؉^֝;\Za NYyaV6MG4hCiW2otxtp֟oNȞX!JȜ;d/CkU:z뻥O*k)-ϿԞKZ\C)Oh.'CYaJWP.ӭ?ooU㤱e/Xﷲ3w-KPjQ'GK% r9:5/=mP 8 /?)F)#L̺0 g7,D_$ *";;K<}e~mFlkږ2BUR0A;GTK79BD_P$k;POY!VēRC,v"?VUU}7/c}7l{;[1^ٜ{ 1?Ccwv5d.rEK/󥉾CU Q+'庳XH^%k|I躄zOU}wQ_9F~gNMt <1;OBʼ&I6MN̒)ɕ޶ND+6K@ ?A <=}Ey#9zc3ߗ%T* {3ĉB ]lZ <0QjA6iځ;f,׬Qdnˇ^j#邰s?Xu:ku  5_K-Vp$ʓmO36 I_O\W.pii)2&vkkv#e)]-ޟ2]najQFam!-[+UDġHjȠ;#l2d~BhE5ߦ }c=_BPMp!pARZٹ 3Re4#,mxƦgg!&8hfo˄n-9V}/wEtDd,B饰pd<;y[8jITR3MVTȮ(ZE(2O,Zno˙2PY:>,zoY$ԇ4 d3``?nOS*dѨ7/ QzgP\ #3] ?Gώ;BIVBi`&.9DpL ߁鑒NhА` `e,F.'lt͔^k՚e{_".UCM݆&!n !ԗhJ]y0vjQ-6,GS~8z>^4˜t_*K&o:8~) l^4eW7*5'*"5O0h,$ q_y ugob`*k,K"Q.`Ot3rWa_Wx:xّ1\s7Q:ߤ"09Dr': C* Qh\MJ4 h)Eߐ\w(gbx>tAdþTnVeͤBۺSP 0'%PG](I7~1m; Wb-.); Q?7>'oQ~ jlSi8I(`w}fjg<|֡Gq7U 2㚧wv\`Qswv:A|X/<>*I1ZͤvC|!ͨy+g *r&;hNYG=zQ`6xGNv580(3h8=/₝t=LDNI&7ܡ^NSIFK \:6dksFqd1^''O/oF2,{wqpK.|;SZCG0ghlt]=Ի rp,B8ZgzZy(f 8)\;pTR/ewIjfdWw0ҿ'b`MUG5@;ӄL~DG37`Yj!#In%D;VgCPU`C߁3(?&~,̑}:u{eLCtbqDG0}'hNvBݠ4_ei'ShԛȎ S6sd['K"i ݗ`Z1l( (O.Q:=0T2sMfjEOb}!H w\4J8x?Ժ\ SpDU&d8:rbTSفV(g@ WXs.`* d񈳈B/jjm Dwf8gRQSUV (:2oYGUIUH i'E3& k;owmmA@R0BPm"`'O&kRtUVl&9˲ЙZ`UEW6`fxdxbP ?_fQf/Sʏ!^[5(g݋ZoUʆ-5 װX0yufAKyv 9;Cd;IZ~؎gc, vT7CP&*ϲqVe{ÐN!/V "`F5+f`J艒3YqV;zWILs`~q M35Uxb6z7&.]8;|YN{+!bx4o_Ed>v髊-`Fg2SE4 A葇rI󍔮.0'jsĤݕǃܣ=-wX$&A ߉/V5Zё8V4caOʙ/>hq,87[}7prPafV>ZY6_-|Hw5W;F?4boCL A!d#9/|ﻂ766;NOdnqk%6sQ( 2RjEat1Z+DEPOj}ّ(阑-@!h{m+1lr4\[j7{c\m/]&>Rj 2NXib%2 ɀҷu3ԫmN=d;7q>2246C,x[1.7k[jgLVg0Ye|֓wNyjٲXeEƳЇk;Dd%T3Ğnx'H}j+ =$LDХ<3>IT:d #T%ZFi3Lv?@n9&}ț1AAM}U$ NKhD=m*m<>sG {r=U|Ma?EFRTŊpGJQII rjY~5cy1d\~H&R| 7<%EjF^ DZ1R8A2J 7B:z ٸ& G}9f.SjX$Ă8q4$'"T/-*/ՄX09Q#g5,NǤ3s#PiZ;i;l wDa*U׿ dKT}.I''8)D=KꈇIrop@nͨS#p3CDxp<WL 0YF 6g!ո.o{E4/쎽4W,%oK C9^HZQ0]+*3] HG }#@wP@*<.RJIv\.|uke:Jk25trc uUl&y@R1EX΢&_w!\*mrlN@/mY5С AC [ %?[|?G+;$뱹 :Trki~{n}3c|/ ig⒫A܃]o"m[|T =$E.{wY`kJ*4;zp|dw=[Dy͹ajh?i)|8LAvX8YZ{ʸ 3=5t/ (Ǭ)w䠧YrsE>۵ B'@+>y :yxZhC&۳7_w +3;[2 [9Q"?l4>@/Jl~ uttGT5gմ-}>oE9LT'짦hN*dtXdb3yzc1dK3&wt[]j|RYyu&( Fk(Q=l O*2o4"üңA_Wv{j$hb;l ~OϏ>ϓa\@3aZ,- [m}YdQð"CD2hxxVB-P 2Boب|ceѹ 8ɧn1P% jYy!ghreq+I$u@ՋW(A:bxdwpE(EOi1Ihka|-k~>fp9v-՟GR0{\o -N3ggP 2yR&؀}d'MW'7y=VX!T?P4x>[|m} G"l9h+'ք/)o҄*zFQM)& rZ wJ+տmmq]#il )/|Gz5Vk Lqg/;-atB0~efdZ!9D߮0(WYʞ1q3].w؀A6r; ~/zj}:mYX,@_H$HcJ]ѯ9iH'6h!Z~ǐZ0 #)Ehۢ4g>ΐؔ "ï)@8tUV>k!-t&f43mŪu:~I ['<3O)vi?5YKVȹcCDFcLAoޙ Eؐx4 j" 3N_Bp<[73F^ dϊ(O Q3,*@5G2،,átRhv # 02{DlWDǫ-B{,4roCRۂJ1+ @Mf#+@H{Iͷ鼂U`ݘ!5i>MiZͼ~Dɋ> -GsP@x\zO8 (GքNk1[큁#af<(r͛ӰެRrPkᣞ!=J$.Wݙfjǁ}PN~A8ט7߆֛6ŐAsWi r6#/ۇeu1Zެ'6k@'~0 nP5H<&\rlK fj'G3:ЂfR5:f&e":-{9c5eL͠ȺXh (2bH *wV\vuo1 ZU}2͢n )]*t-s=Q&o웸gz4;#6!AH)(0dYKYXN%S$ ң'SytTS+V9\PM 6~Mśm>.$EV6 jdf3QS\WG$ghHG\feg`j`*&PErj~ǚ3@L^p~G@hk$13ɅTop=v k`/=LmUlF;n=~#dN uCng&q{O<)p( "ETM;HqcdjW!C$kVTQ68 AĈC0oʉHI/Eԅ)rW pr5ةǣ(m$J /_1ScPUDFyT\RTթR`kyo-HSeAF$$bZ>f{^zm";8C.Ŷ ^6s78Cg*aDo6uHB2(my}iFof/_R<]FQ *WF/P&SJ%[zmvmx?B;̻ܓmx?%QE]uTؕP{__:My3ܾ424EWW*VKq5jq(ּΟ_ wm JI 'GFKT}0kU#ʎcrsg(+PȚ{Ѩk[OQyOVuPCPx (ዬ7(FVſxK(#x WK)Ѐ52;o5@nsɑ"^KݣkZϻ9/2O었AfxY|驄ko?9֯,{Z-~ YSj25>> q[O$( k{zEɄ^)'MhG.{tc.HS9ʸz"ZoZC# RQ}(.B]Oo7z'HEDVs\׿:7bt;T(s~8k(J*M+OdW[,RvVͶē"Z=iɮYq]]餔P+ˊ(t&@cRaʹ(}:kܷ7GzA>cV5ȗ$m]B|}#pnIm@,ޅM= Cns=ڷad}4ԇu>dbU5^j#ΫY0:k#_g.8oV!]m h7r!+_#يBsF?luq15Ǣ<12ĨEOׂA ޽t!+f:yK?ɓ[V@g"vo@ w%gnS"G>hWkvI8IoMlQyߴ[]lbclta|Klzl?|PRB%9;6 Đ S7@rQ1q}d"+a5zZY9Wy﹈D`Ҡ+MriQV׾ld8~h%Kƪlt҇L칮B~^p{ osCk: ,>~n ǍhsVe6_W+ۥflvH\CP;(yI&q,٠O~un:4ɮKj 6, i*NrVr[-8M&'0 ÔejMߵ+0*Z7$1 n&vl]e6*ޱFtx5}V'pfzJ|hbɿM-8`IdCwnjdvhŦj5j f3DT/6Pȫeذ! DF!W [!u1@So0gevQGa=ay)ɬgIH~ٟsֶ;%q5g ɢ+C 6VJ8LF1*-T` ;!u9v SjnNYHU!7e,n͕BWۤ1+9q s]82cI<& /W ,e:W/Fz D)}c<Ԋv1)<\O([D Pq j[t[FV^  "P|ƴ'(R;5* eP{ L!x{:rWgZ~? 6vU_Ѕ ZGaҚxݰHpq bbr/n.gXHQ:oarrnehvne/g{`ZDQkV8S(UmU$+Cj5f/\lz6.>J*4c90EQEr]Εゖ%sMF'auT2w%G/Fzo+O-LRUh֞P5P"Uv+Zs"~M@tr3Av Pyɳ<ʇ}hlM&ieLFZ5Uk"ڡL`cHD[oOD-/QT+WPDIۈLХٳ()1B7zʑ/" >CZ&̸BPoGpC078=!.A)y\/6}iP7 UvC-r(U'iKI1B55گp|U:Fc_ȰǺ:|tGnZ;G4UbQOҖp3VmhA-D8s \9կߥ&gǪ5NkyZ,8[~?OF9KקAn7isb]Cv/:\_1>Q3$6UJQx.xR}2&rה-#_M a$xaSʻCNC$HXŌ=i1>X(YW\kT7]pG$i`W(ֲg H #a!d(** bd7E,ސ`eQpE@QA箔yUgB/nV@ iSiǑ"D+"YyF%,0ٌ * 1Dwy-֠BOM҂9郱"xX4@ _ 4󈇣bٔd.b ,l\'JYoNNۆN̦9.amHZ #YxaUshSP6 nD)׌rGl9zr5 szqÌ[Ҵ 0J$2,t'8B*|m䮙RrL4lA")Vn!ܐ("TS("ytvW#]rzH UԞJ\C{sXjyTQ)Ät"[OJnJkвawۣmc"f%ئ\C?6 4-z~u&v`xg*M)6ף|MQX%wk¥\"C2z*ʤi-,"qO&?+ a@E_La% @{.h0W"UGӃK;5/[Q zr 3[=$ N\A'S_,t8#:DX¿mmE4Oю Y3~1`渋 M(?*_A3\iHDغ5}}e#4ҋˁyێD0 `1tJOTw-YG\~٫!4)DyG zqWbÉzJǃ"2.7~gs7 h|\ɬT; u=rcGZw㮇BKNJEk?~oJ#ϰ;lKQI%P"g{mw^=CLW`6LnIXe%k?ț 0<_P_E@)$xd/26w "RRP57ٱKu'8 @SpPES|bc}1KH-oP泎i58FoJBk(Dٽ.:yX֙% 9/Oܤ=IB븓؍VD;bŎ=r5 2?r*NxJKh`dJ;P:(@UQ "{o.ʲt("m„?)i(d_#W%RLW|?h/[7y 6=4 ${*W^ZCsm}Oxy5R S2dsd]*#9faԄj]YzT0sM"1,9ք߮ςDo43a.0p/֧m/NU[tm؞E'ȑlTF%8xuXLy˨DLS[w ([dJV-0hğ~9*]2Ȱ~.v >Y@5]4G4fӔ o6VŃzNG)k$_ptNZ1ŸSo!@-9md.pV2Иž~~"nY3nѴ^T]}fEۮٷrH-NOƍP{cprNbX8y_?vu=Y 8)Dp a+-BYMFo`{:-&um!!([B+̄񂒺yTa{u^pʢBДU { Wd!e ҴQESq?NZ^RF$*J˽[L~@]}l l ~5 (]RUn4j5]c[O!X'Fʔwd{EiُRo*AZ&Zi==tXëв5{)g6T1&]2!̎BTri"no-jُL$2;GSX{,`Ώo::q[ '͠]Gk7u]̝S*qrCЯo9^橇uh'7?XUA! Uf*x`1e(<9rE3ZP3EdKX_2l%,EX`ny@B hXA ;#JVkms-ޓ簊k椊͞[d'.R|CLKDI~Ў`G~!:b;4\?@~0{J Eݩ.UGUnu}l.OUk$!S7:>k] DQ0vi^TՈv03szU2Ҕ0F\j2@DCT]mr Q6m2 ߝ|sqmXR1XR- b /y ītyk-Y=U]-Ll."[#5h#%rov1w2a"Kb>H$:STa:%F@"#xEr~zIyhbQW$7Qӓj~iY?3phQR㛜"7֏^+mW21{‚t,0ĭ&##PF쭳חk+.>6Ϳ劲Rm)+Eex#c u( @NkhIto$mM{ׂXO "`*4縔!95 0ڍ:(covdlz]{Ξa/荔^NJm"O:!#R/ Ƣôy Y.϶g\-{yz9b~&v{ \CE.]Q'Eucc_1 UQofI7auo$E]Ӝ8Fx'!d۟QMq8zUي}51%IELx ZMU5C1ƷAj;x9QIgf>tj,Bd1W䶪5)G@-,.]+7UDO ^#.M!Nglmp2rPTFah$cʹV0g.}5VF/Acz~i urs*mSۡ|҃ z#$gk:+ ɑ{0|d`dVLyLGtz 8`X7M |t+ONGﯶ.qp] f0 EL9cyW)fɜlӜg(cź=ӕ/D^' 1t'Y3"E8nnၗv+$\xfE5(=]|q, enuͬ>T!gҶ2@^a1mEྌa^(T ǂu58obw/}%A>y2ݺvP^PDcyk̈́[C:C=2`QǑ:;'Կ>؁f D@BH*,A5&D"*د'_KJXxxc&GcuET0"k$X#;y hhD fc@Qr7^A0d- _yDhCdA2B&`ݵe)ֿa: (wy]X[D:7!%~7PuA~(֬ei*lu@s>sOHy|-H\4%854-?Ѥ@pvPUjc Ug ,m9(!בBsH5o{7o/_A GK8shFUJfO|W"[a,H2upB{0%9wJhY"\{Kդ<ѳ뢈iVH1 ybW| &7 *]SV, N=C Nı݂JOusn"o> M-Ij/H-*KG%R~©vcq}`#-yV~4I6 <)@n#˵ŎJ2Կb*. hD]R_v|ݿ8[:ɥ*5GP7:#~CԽ0l &%yƸK sl"%=it{Q|y~+QO)du86"yS :g%]࡚D 'uN]*JE78ZLےow/ի͙oc}?%g #{qeR Wuoj9Dkⁱ4cqCrSEtA_i}gaP(=DvjlZb g>dwfr!2Sw.bkºQ,- = ~Ɠ3Uy_/`#@TbIw X#CeL,SyN<fX Otmjle8 !j$\ӛsqlAy*Ch +7i`i0 cߒ  *(f~k:)6B^}HL-QJE-6M0`aBSȺVfLCNF=Lp76,,dMg <ΞNTOea>x,#k}}{;"r#TYUˣHS8@U"WCk͌ n{l`0_lIƘ¡hE TeٜI+հRn+Iev+Ǟ/pFv`-2ɜ$ "^cqȌ߄wVuWN  ]{L:H:TH üu" 9NYSf˕#Eޅ05{`y[?eUâvm/ r@zz[ӝԗc8W3<-Dl?hvLFF.*kHrp01f0}zAZ#OƁl yD2xQt!Kr}#oJ'"yZmiXC8^MmxeK^$>+')im9ԼB!י;6Z;';W|7y)ui# j}=A~B  vhrfCmC% k?A #wO$"N%"W`m-EJzIRF#\ezZ~YXq^ YL+D3yj(>Px"p(h%8tuDq.j@j$(~QdrY =]gDca_lB|Oo8Pؿq$qZz(gZ'bRa.|VF[ӐLIԵkܐ5HT%_ texUdpE*WG*sW.C<2>AݤпtuFg%ۀgԱ%$X!} /ϥcc^ʂW VᄐDLOrOy&lm8Yڎ Q_HŃ2 [;\?3.BI{JMIﳁ.1tDEWb(Dzn&R_j }LM,T_Ntqd_P@o%l}: PhE&༮֢;Q^ αP\tC#RRT/AbmDc:6mdO7{0T`^1f >l6X]a2*n)f}&+VwhP8%̜K0@5ۥ<›43R]hf_Q>f4}3eBT f)(f!)U+-P a yі3~o!hD?HkqOTQuluPɈr`hZYNeQvyfZoSJVh|E @=(A`o`l]Ru;Trs+ 8>6"6f>3p(In ֤Ct+hjzWƮu#r1*t!mx ?&EDaC<?`x -`(}堼\qm廍JM_Y ljwb$47u|9ؿ1qMbSKwtytxY LeY (UWLs;"kb;jCu4!!UzlJZ8 爢7Ej)ehH&Bmږ't.nOᙓ1CܹUv$:D_U -P9KjXզN5PW\X x> =e#¿-_ 0Id5K8M΋-e|ht5B>;`Ԇ~(\`|λ:Ջ^_ΰXPNcڔ*+u5WO^J)^B @ :4w"waa-|{u6N᫃%M(ޞo1`tSL O1$eAYZo٘x<lx A큧^VTi>$5N; ~}F1x(Q,:Tx5r{H]hh~(Gs׏ban\&"t@\ 1U6aP#{΅0FUFpNڶ9J:B"ǩi%Nڹ%0"N6Weq:# /ު4 -ٝ UZlE:YZoآ+H;f! a'ȣp> qjqd.ABp(C/Io\(qfBPX&H?\O4U.*2imU`]qi)%磽aS(CXֵҎuH8lOGoolLLGy~,GxPC@g1j;qAny8g@25FksӝKx4ChtDzrk47ZNjzm#Jr&([qj*m ЄvhG!Jqǧ5ـcpe=*o^קe<b(h;oS Uw%BX{ƃU4nwe&IS#aE5|֦kDDz$G?FdvrqF$ !^fz?ex`_u\wS h]x&ӈ)k3́m#ow~Xo5>n^mUoLt`LBQ6cNDKB,Zn;=Vr#Q/f82IDQ+]fy5p~F VLo <~c4 fUQ44EzE,pku\ytb])e۫ rb +F7c~&gn=L9s=0=Sl*?ݕ"J= ʌG@z 4kadg66 ػs⋒őLm!)%DJhEG1Z~`t ţhf 91t4jѓmWkl"˪|/%ECt8Z II?~d2jC ='2IIX$YbOYwep]Tyl]n`] _Vw~yW+ ^y@کF6< j i43٨$33 ,;'hkTq8W֑WL{cI,ޯ~<LFlWg?ޕiA@Jۚbm<3Xx_弤H^ HaGR=| ;6K.V86gLc%2BhۂLXXf[}t4\PcQC!wQ_ȡb={ˠzP(1NM]F gN,^+ <,x5 EFr%@JжS g[H")c^rgki.CάPoh(#+Z?ui A՗8V!yOP]>9we\N5qKK_p}tFcϙQ[CcFJm1WHJLC?RB{ƈo{F,Db80B urI-[= Wm# )#$D 5F|$"ʍ:Ǫ7ChjPi$b~=ޏ졈S(tVrNj:};J%HTm˟}a }prߝ$imAtjS:v-빌"P+u-L)xZ_qM>1ò𢎨0!Ϋ8RU%UD&]P0n&%^[=pyueQ6I .jf086(βſ=}43#sms@Qū%M=RJnqʁxZ$g2̄?~Z )VlL%a>_"u*~ =qf7;V1Xn[4At2_Rcn'+83un1}e+]jloh,}Sv&T'%\KX?\*r/A;x8E՝|s GO- q)nsԋtF:K#vy byi[ޡP=NWi å w*+K&!=8^hW5{Rk,wJ0p{ Ø+C(&~vLTV4`"ah~smr ˁc*+^^8iVG(G2%9+iVgRBf4O ќ#[Fs-7_#KۇF}8OjJ%+l"opE!ܴ5 #'[ ;|&䰵LrT6 g2tN22l*c)jWϓܿ:]}BU1҈d-YHdļRQȆS|!Y&f._$ڢ7AZ]8+%30|oQG.%MA~H C-1aߚCW +/6Pk6XɤT!_XLr)6ST\egmD` d_:L%^{9$!|glkX~H,Ȕ,Й\9[boIۉ-הr$'tX%pPGNw=W^(JZZ iuE&`?iCaP`\Hgu'~9K'^<6Ҽ:a&"Ց3NfaCo]swlzdE#PO0^ĵb0\%x@BXs"g#GP0mMՔ1 .Yc~"ik>߂[( 1*<{`g|jfP vK?*yjԅߙaDAUOqCabru^MkY EċJ,Zx.w { UT@g{*(`eW~SۋjYpq6b?,U+=µޗwkx qD _ɒ{Jqb q:Sq >0$ڷ4[3 sޅ{BL `/$[|6* .~^`̸֭~=O=2`]e[Vw([ vМPf yn';#{8dgq7so:6;$F_5 S qPN.m;@BA0F1w͟>B !WM{ H+bې}_xHoѲQQV4^h 7w?'iUe4w/YL0 7]4玫&<6  '3 z βgսADhW i9KRAq1 o6II˻ _GS= n(JҀ#msf6 No%;>;0`0<@d&UBC.N0KbwY _6&r.>ƀ4%4_!'(jآ-->\4BFmOYFEIଘ-%4μт|[2i #:"_oQcN(>O\(Dwj}P,@۾}M\i 3h(s*KL -w /)DD|ڶ8|/Qx0Dn&uRp+l =k?R@EVœC`vpÐHh:#4'B=Z9k7tu ='v}~8ޝd= ^DDa3j:-m[.8NFr\K^s/M% q{W)Ĕ%cF{RBKC>I w7g^s BIrUS?rqǹko47DO/uK!!7-AbZ*ث/Ncg}̵hu 0.ZfP>=\v pZP'g\ó3d>s/AR/Ik#g8C/Ic-NLUb(ȑR)xcdUۜG\ $ڞ{[V[1%e, 8lnY+eVv`{4Kp :ZoZ(>?T4p̆ge}2:] 5AYS#;K\+mmz4% WZЇtKKØ>mj $Llφ!~9U[B0|7ظa1)2&@tGAa;75AW+Ex׮-y䧜C+l;bӕ UȆFw=4)A6NW鯳 +v0*w;Gp [-{6 -,f~^з`s.s$[ AoZ'Z%ƬF\&bj, ,՟HA+*iڋ%,[gj7tnD'kVѬƕ,z FW}KtN%\su0J9(ev] ,ݾl[ |Kq云"?TEYEl&e_lKTJQq"fzOξ+9: ~:Xc7΀KP[]m|b-bvʩcd%;" XG`%U\ZDuI ƇoBt eE$Ι!iH /?h6\;-H$48lJ@} xG:?t%j 2kNp13!m7tF^ѷQ1Ǭ܌>ԲŹѽRS7fȎ>\!ER9ϦB}CcIڥ VK~GE|Zmk1i=AiRP*QSiVFe8P%? M\EK7$*c@XfTb_x|#{z^]eOd{e)ߔRJ, EPB|4ĝ%شoDSAKK|`>@Qj4C&6cnW9~KQtw\zi7y?}(ap KƎjiYc:U!l )ȑ[7H5Y=Nqbѯy-SW*}HiCz!@y߰^ %&I4#)qg}O \-ji%NB 0t= ~0RIm|@}ye%>WzHrHl%w6 m?+(`㡤&z57#{§P`2ۖEP=@FЉ/kLI,A$WYߤYdeZObC__B؏wgM^v08@e]a(-X )c#|د:ڈNc5h.`'uBy T*aO6'i;Z9lVw<]6 8d.7)FK@BWMc)R_>$qQ 1.w9[!:{=vεt[!yl1{3~>XGF䒃x[;bFлlGJB|0^%XyW 6 ?azopܥ8.$pi+m5 !,;Qf QJ=ɋ HKwΉ>jwy&pA-=ϮFed9!p{ǝI˰dA[,{J3p5It50Z(ۈNmPؘ "3X|7u{g_':П@;v'&~NO t5^CQhJs[,JS fUѾd:CX[I,U~߻#yڦs#0:&e429ۣ0orSf9&j"!(fk!r|xDJ|ipZoR I9>+CVce5*]Osk?+ՖBH[-T.63<ID^c%JM,]g5,#qo|k6Pw gh" ǶKarPb)^'֑}Z@G }8[>F>RS۝(rY6\xT 8&Q]@| ؔ'Tp+xDder.s jQ"B$p6 o53jš,7<F>W}T3;芶{Ҏw"]>( Olڣ鼍\e{T j]va-˕} 9oWd/9gHwI%n/^}܏ۨvC?_{A̫۹ÕEGte_-sƱM^p_OZI\=FW, m>Pq,W荔^>"xr{Ț*Ɓ[]ہSǤ!K1?OSH{ez >:х]IW=!#:UcqM+nAѷ~R m|4ٗ!k̠Q+ n<*X͏ Ms/p^:;=`ҧ5wY܉)E2pA%w!{3G77sY˜"T[c їVί!{:=⬡\*m2WLS}E޼ "/N8J琢 { &;^+S*x;mj(m(ig6IY ihwɉ m64XjUiRk{G1sۻoxooMJMjҫ'A<ſ FPWzlPf~0.} s o%wKYPRz` ˿M7@n hCcuW1kޢ7=tsO9-;Rm:1.P;Xu[PX<\E .}g i+k@%hIҿB} dHUqy g#~#{zl:qߞ{,&[Bg?+[ΤNF b оc[͒[-r"=dv$Uq-NN ?K~aXXw\#Jm`9uL? B8]Cayd0:uorsRi _Q!*q%)!lU  ?у|/BCUZJaAqIm&0~Pg*#6e(o2B(y=YÄs,aV?sX'F 7W :'z{xAvб4;K a)t>] ̡=r XCp_/~_IA-ex 45HaS*v[ F/F_-wΥU72v3'R=-K~4#E/чE֣&/xTg?ֳ%N,K5w #N}6v l&7mPQ0LSrBː1[9XsI˽m8\J㑣f;z3^8fLX/r>-aU8/DQgsbo\}a%,b1X̍ά#z0ÑHfOR3el{SWWϸ\-BX@+V1m+wplw`$LH 8k#+ޞs/Jdd-P宐nU0@Wj2IS$#x'4i&>z?JIFAt Ț't+=}'8^Ck7f".SYZ^!L_w ȷkl='h (?l7ݣy8RY*Oaa>,w?;YTtY2[C@Wc0(}ArPaCyā,K[1Jp\stoІNq&Z5 F}w"{xZN).CKr- ץa͆s{Iqw<ǛCm?"[6KfoE3㶃ܷ=,͊VG1K.tsаSQZ{iMN;ٟo^%ʥmWHVt^L ?a.M0 GG.\! yqqO04C})k#w<95 wڭyC!wm̽b!C<ɮ=V~ZAq*@b͟$J^Ro+$`ˑ+W\ GޫvJ:%p {%Kw-(q Tٶsi>{80+rM)Å%2 39j +,w2in8ut.UUE_\cԐY%ƄQiE(\H*,8J&._4y9_.F ) \3e-;؛ܑ(c2j?rv$}Ϟ 3 m,P6P7AIn$YPק aOϴߞvx.n8 Wk/74\{ڃY {܉uu,}ݽ-e 'Mr]~dx<9nVSs[yf+r1-0mpzY?V@7GBEaV;gү~1{ ȗ0E@ @h~wrюeH ~f)1tH]EHam?/Z7: nfL;s~S%+X} =Uƌu ρ˞f!CJJ=6P"ߨ4VNc;9$KG=ʈt櫫ÿu3uڨy'Qub"eEb"g&# //*\<}!}P# C}d[ Tj!eEQ{Es0_r^ K<:jͨTv GhA{[N]'=2<(]ɰIQ aBs/%*\bqӘ}z3NrW"LuY>`^ɤ Ly>F؍Tڨ*\ϲvLV xQX)> ]<·Ц`Tbu}Uϝ&KO^'#Ӌˉ/|@!Wa'joܖBtЌEJ> {CWj/:N{ G0O:LӍɣX`&A#g38,a+T k=9 ꭰ4,` - ŨkDi]wmtiUMxb/`∤~V`QQ Zt_F"NqBmJuRH9pljW8V z$)΍NEDW_鉻KYlE^L6F5/QXOzNQ5Q6^Ee,~;άU2th/WqC-1on>9\>0Qާcz@܄CCs~!zB{.Nl2]ѫ_iMի:Uth];8E~o) ~'Xt@ݺ} ҇*lZu}W sFKb?#i=_h*,hJ;z^Roɵʺxlk_w. Vw' d $m^U5tqبxN꺘?+H8w@ѓ'0RėATՉ[knL7ւQ'.ej5u z" ֫.]GƷ?Hx-,t?XP^an.G,#Dov56\$.<+ϣp9|=0!?k/5qEw̧ ͩ>`rxXg.;& Bscmi9 |w}$|LlSxnO?FOLctJQkaFIRoIbuSzEZD?nL+#AVRj1& >foLqFŃ_-q+חV !q9A^$x׆s RoQdwXkX"g9 Xon ck=41&JXIv3msN5/Kն $0ސ 7Iɽ>޼©jNq'دIHp;>:[Q{ [75ׅM4A~6Z79Y`Kqpp$6d4?ߝ݈My;٧/lYP\K^Q~%ρDuר8_pP TQ,;b"$6jƆt{m~*'!Qxʛxٮ#?GV gsָt0Ċw ukJP?p^1iP*A; $*b[ߤ髵UL:O+݊7z>T06LoŒߚ^#_) aaFg݌z+ŷjvxeL$G\6 w+2hݯ}K-TNT;gk6Ԅ贛 ZO,̨=FDJ }/z-6h.|P@ֲ99$Zz#E-niڍ2f`+#(<qGEd*^-/~:۩1YAn[2,'A%WIHI?I6 ,nksv1-gt{939xm~⢸_/mGVWg. QO]u9K֦)ޟGk\R uXJYw2U1f}Nbz8ɬcJa;B8$"У'k@S8i8NXP,r^Î]3=pu'qj 1 oi/ 6bA `B,glIy55P\d*_ٖEջ%= o*zP$9/wόԀGfA]3"vAWAY|IX0zS"5#8`e>~Ӥ(\mey|guҞ'I%?kf53s؄[xo<8PwG-YTdf^ %Y G ym8lz(=?iR.^8XT6Cn(_0˪i:AT11NO4dKMyjG"B8*WEDv'0W+#ߞ.',ߕF(3 c!m|PV+e%htdG%4OI J؞/ru}P[L?\U mDmMU&O=J vAH5q7qycpc= Z[X2i9!@-O1vQ9}gr@!2G^WQ>+jm:Iū)jij Lȁ7j )_bOA&IXwsveK)}_A~n^t#˲7Pʘ8| s"Z;h&XV2m<6[r A=TC  W MϿq7 ᦾʹ5!<:ݰ=Y0(~ɀ : 0hEOe)'S,ahGo#eqz ~ =hJ:i=4X# ꆁς% ՖĦV3'5o73O?dȗ-iQ;b=lكn9s!5CJn^$3P ,Q~ qܪrL?V*61VMSPSFR ]7iX{<5GF`BK: +oM,|ݑ-N_~eIm[1(2H VW@A;寈wUr bm%~:BgS܏&3i<ԍ񈹘T鍣4jxUK?g+|:(8Y,7r0W_SC3UyHi#$*J0oFC'O= T vhu\!|t6N!/0+n8Jo2U0V.6OGx>9.NxC9z'=Mf^3g`NgK룇.[`ukIm yl3zDYEuV:K0tv„olstdhSZ UPc۫c 1 AKeV_{rh1UwQ: Lg %Dz=QVXqAUmdF79@?◳k]i ]p GX2`AOpgn3"zr ?QL=dVKZwdz)'Em񛍘IAyڎUY@v͸x+ݞ_sSK/*.IghRĔvosO1.*@v'+r/v#x"w6WJv2hܵ׬^EJ})etͳ zZZedyc|ŔhԢg42J(kL#hE| |IlBןLw ug?5CvU`!е?uX~F}KOli?]:T.2Z&ڠE7.{L\ =V@7"+[>(L (@IF\5IS2M7Enm=;$I=7H-H}gY`I0p^1^q}Zw:J/K!!f"f,t'1P+ߗLWC+~?, 9k a1[<1Csg7$qwSM#JЧ.+ɧقs  & _q*TK3 Mdm5uc?&\)1&IZ͎Q_ybFD,ej]1"كJ}t;f@*[!NjXQzZHh55մNpsII=tW#o=x">sʰC+ >2ƲJ8J~aP5@b5Bvj cOORpvրx--I1ip(/g*3g[sˠPn\;rQ#^uQyƙ@ 42K?$!xٛ*>6Dț\xm,?wX("~s0Tvo`^jya=aD m߮\FqqEl:2Ƹչv;/_k'*6Z3}QU`~pnh'$OW_/uT2b fr^E |K/\j2:h-o7|8 7/ =)j Y  "I s<`%_z^4ȴ6从7^[ܢ2U[~' _WFDκq"R8uD)s={gpnzV>u3˃C2f;JۛE0VH c"f}Lq ?կ7W6!bBdJ5x7N%6Awªä[-vA ´ڞȂIayAqnmTg9\!{[iv. r|PT>gQjGt#6סAU]rRN0\ԯRPܿ-c!P@{oo (ń某L:56617"=5P ^8" ~LL?7|i3TJC2ܣFQ^2G<ӚY7ߝ^'Jx, ?Mh%vgca=uK wׇm5YF=bBj:%tXvxv|!&hyMn_c;^ZyrGm/#!if17~8z5#. _$uY/7Kq*gwAmN $+U'';w5<4*`ڌ`^#*D.; " hhz/h^fVEc=K@Yۿδ>[i%Ov~Rt)dRIaϧ()EgLb׵ Ꭵc,d%L\(SӎfU pS^H`لzYb'j=c-*`0>H<}Fc7}\[b:W ϻd XHx ^ 3Y_}pNIʰ1|XK%]x)xv&Tz#RPummS-5CM{p=}Mw.|b-tyֳ,ϬonXT?,2=O]qZ7c5~<^l2OeY5U֤@5پ<6J'MQ[Y {X)Ђ_}wꣵh!6|t%)5cJe})ǩ@ x])¡Q[DhQ,S}k1r:.2&lD&l`O.X!RTYXR)췪;w>HďʷhX"h坑xio1 ߲Jz']5/#l,*׆ˋ% PP8>pjGR6J8ό#^Tx r/{sXՀmܠ%G/~T$.ǢT.2LnX=1ºLՍpMEa8ˆ2%eE E[ʫ)Ov*|[ lp[$NK xY:V|7hϳz} `uuHvo]-iu)t~amS-ι]j}0CSo(gޭ0.\JU;~%4% W{0ejs4G5yvjI!N!SckϪpy`{&yTnfz^1,YtՓ;m΢dc{ѫxwWy+w Npziy!WD4D kրBx]1y.w {iwg9gm"N}I.q!ɑR\nt- d W^m(tB'O>feB!uN(ñ7+#@%*P!t+bK%cXonN$mVϖOE-;H3KxRz ޭŪlL=ZXPү=7~.غ)3UP5ZEiҘYxԉ}H!h[V^}Ӓ W)xry#@|Cl<ϩtJgH\D}*`v}6|Q8sS0*ĭZ!ZpЌX.gA}{5."13zz#K,%* ώ_ ʨHsK\ҋm+$]mRخOq s)%M{+EuLY, ^2gKzƥLϔ}ۊAm 3CX0#= 8&7#8;ondgn&6賛 ̣۽M"!m@ ZL@dbD |9zMeuk*!m&bfWb^R9X髛藆Y%0Wv+:ra| giSK y)\[iUs=SFxAE%wbFВ繕_GRCDrkهUrځ hS+Gl,LN{]L+3Ұf$<ۡn\sUL(}&-S*X9" V]>]Tڲr.k\@ 3eeo8(Aخ0U3./tR_07L*+ 8cBdKy@Lb'n^5ʪ\fk \yMr@߮D8Tm}Mբye7{=DzPT![#CX΂A݁}v FnzPVN3fxE݂?YB 43P0VHzkbeFWQ_!8]Doѐ%r rAWF[QBlJqq\e!mB8\Kը6^<ǟNߪE? p礦F/8=2ʬޖ (lGu(0"}_>?0*MH՘!6N %l=@tGa(O﷨] NԂD`!No2PT ]ٷ\ Xx-Xީ+aжGxRv VC`4Z|Repbi];0;c4FƒﾵJejA`FvyFr?KwԯG;n2a(4vY >щz!Em'&_k.n#jç:k%3'_NsjeURSupe4g^ "YSAUSEx0 jrpe1p=A>V8Ԙw`IR@ c$-/^c0HP̊)*sģMoP ad{Ř u_ˀ2aVm )B4#o0)*lCl@\LB΁`UӲr/T3 ܕYNQKY"F ͊/dB[ߏh38Lq%V%w",#8q myy1ID^fպ𚑸fBS~ڤW!axȀ龏ʅ,xNJ;#9?n\pU6n5eY1}ShWnQ^f!/5ͺ XcNn|=ec{]j5y1u4_+*XGXqEHkmv?Nnrar>ုj]t<вNZK$*X`N+Gy|$ʱFPv^oˬɍwhB!˼A-x,',9hy >y?Gq jd.%# P 8%!@󺆳 1<ls of[t!wzW (}k+:RσAs[w g[ÌeR`"*ҏ[W\_>!~, `ˡ1 Hy>_>$o[tz,KWm2 ft Xl_z\ݚ.fU@^UfhC\Qhy?3fIUBv0!Xhu1]OyaJnձ,)p|SJV6[ IBfS~Ec &6kr9*Aq*`?X-&HP7 hgkb" h&-5nW 1 .`? DBoT}WQf.i('N6^=+f΂ џDy(7]J^ # f͎N}Z < 1ra]R `G-L;,Z+jh˂Z 倈h5-y_ ͧ bpT(=$(t0K#`6I@aLܩ4=R]g,YIH929L{2|==_.,&,!UɭSnwSD}jf \w"r# $POVu~<*W9PQןP? tM=Ȇ0 }Yˢ"!J0se bHU[pG 9eP巏:( @\M$?HOBK"Cu!;XԈi,26IašFVrVN wk4-u V^+Oe%_6,B CeB\>D^i'浯AGTGއ"h5Gr89|^JIܒ{Mzp?Z/M(*nC޿&sHᑼqHh> =sKfgM#=56[;0ta)Q"ͫjwǷEmR<;ٯ;3©R%&YV /7TԪj.y`㝘Ix+BNmӈiTs's`=Ϭk6 |UIl7Զ*jc}w:Y~CXjRp=wV<^*j wԚϸU{z[$?blQbqHvJ ݕ͒ND5B;~:V/ioQvNOXE@-[S[?+,.6 CLU |mOYOv %6cj \NZDF;1\o4dS3ɠAfl9 {4J4ɛdk 9Fqdr po:edID+ qfUi.#_ޙhDHpEB8$cBc++Ua.]=8~A &UvD%L&hbJEN-z}ϙO@LX2hJ9FqKQjBAUkBEswPn1<^kgSOEK l2Shcw!!ଁ*nf7cX̀xӥ .bgA ܬ9;cs`|2;9;6XFNhT?4p&(u4sJɆ 4AnP ,YtWWu++a]Vܻ`%ڽz3(;BUmHP yMn>!ۊs*%Qc5 G[:mCd'}|LjE䜀1 =ݍ*[.d7, :qn :ܺ)fJ/_it0xZG/QE:횾o »x",H@dD6QS>At8p&V8-J$)ؗY/uʟF_:CW ~iMpJ9Fj.X Qk=鼖)U`FYumiiי蠭G\^\U9\(9,9Xwh6VÖ&jI*%CŸUAXAR]+{yɯjJwqL=gvHV~͉h.Mq EAy-318U^1Xxu4Re?lSߥf`twoI˥ʕb6Զ#/5 "+;PrțBB/}k Ä<]!"h,8ZF>9v yKj5q9>TmhVLJժu\D*F0-ՃuSv9H=jnϟTfo=Yc:#R<l+SO*%bqn2!W1x[rʝ`>Z]:4Kuw .PWGMGoJj0gdD 6s[ ]%:NƔEI!\)}#Q,jì <"",Umtoz՟\isW1cKKpkGۉTI+W>4 43Db/6,pG* |d+n5 Iei^q@S?NjO,ev6KёDf:jBf9.Q &ڦ0|X-FO`w.S -e~>Mf=Vѭb%԰֩% +[[T0ȹPzzR~\5n?X>Z?|hq(/E ,$N[HJҶ ,6w w )DQxf J@@_?կNpؼ,{f:8:(Q^fhMcZoZ g^p20,@e: FGc ҆Cb$^TI:yBUx7T zr,aG<P VnÜq0rc+1P7xu<0A8`"'D{V>pem 1e_y+8+7gJMݑpJJ퐣VU5i9kƼvje2yhu; Bo8>ΔN$j{v`Q_axJnZ[1U+tGȺmS8n]  s<?L3O )g$D˿'Brtӗ4&ۛ3ItֿݮQ;soeȺ3fk,0 14Q s}]HF\7̥C6c8Iu& ݦQ!xe> LZF;!A_]e`v8W{ t۸~i i|# / Rh %'T%ZgN0f .ꁐZ_1Ljyg(}1%r 9#=Eh>Ԕ/vq592.c" iw9HNr 7 2{wh(^L' V2 fyRvPRM:K4"#ɲ*9r)C$Qvţi 5;'Cf#&JSU[2ܘF&@' Ԅr#M] VDțLVxktlr~ m]`EX spmhP= nhWI nmZO9{'$LidħN'X}8|X&dJ箏&YN(isb(y3K5PEǷ#"mlFeqDå_G- n>Gyd; 7dIoIs~B P1&&Y~+2JX# Fs$']! LX& NJM+J_sf Vִg';LdܱhiZը\{"I}O>QpRos^f+d Pݒ&sqiΎmb#x߹Ԧ4YӀCMΞYj_2Ù.7X;z[˿9EZ9|(vrGZ,9WpҼV_]Q2=P W* .σw7̔Fƹ"B>f ۅeӺ͢ʠ&jўv ݊dž} dưXVs9\t!{'ot"ny/:Ve:(yxEcMx,|JpгE05g(Y_"O2Vrn 5{wj5M'{p63;DJ8ǖۘ$;eZ DJJִu& p| ؋$Ύ&m#0ޖ󉵯B>SRc &! +\᪄vwE9 n%it{SҞ} L{-i%XU_2őX,*5&|1<9BW؍%lҲjC"#w- {a/q0j4aɠ"Be=t/W$/dvy;6d^:N;,1 C~ҿF6A/0"iL7<4a! f!HL<̞h+4Fko:&TuJ|Cm3tml\rFDPeqˋiu 2Y%Ŗ =w9 !8BȣWaqgQ8/0B@N\_}"9 @'m%AE9y\ҧ*S&֯ '/f֣Ѯ7{oM#D04eE/dڵȋι'DE "}yⶃHԙBf{٤I S~Ǯ[ Nu#.v{g^%Arg0 Ɉl_kO}O (VL-vnvqgF 68wSF!ɘ % "*>\$JUPA4xˀ*eWU&h0~#(W޸\QW¼|I54"fvZ qz#|yLG_GX' Ӑ;{*7!^v5 Bʄ]/E{%A%Ch`(?ڍ:yDk'uAP?` zWs[h/@1p- _)e5Ck5Tz^5#jF Y-Si[+ ZM'yoDUri Xk3z|˵>61$LGߋWo&XΊ)VR!*qX^SOLA[( U% Riz段ґPuRJ[%!:HX3DR/ d=^Wۓ.^da}IB"X d jyWUN&0Ss.iK5t(:>1^hH:^F-[=x 6کg&WKNat~D$% }x-jtljn@|U'ց M;rP*Y0kr^G޲8&ze~N#ae!瘣/7 BvBoM)0>ʰOTb"ҮDԊW6(vUgeDdNOဝ?p"%!lg` 664u'nJ-ٻR4?Gd 0[LǾTaDa*uH I5 6jzSz%7Ġe(t-3':Lh: %<*m9wg:撈ML$ç&jq[RS!ڣ.!ߢG9>_Qֈ.40='OYvBLw؆Rqr|;J;tൺmkAPq]Yw-KгB>d,WM'J8cA806ڊq¢#շnM(i~ߘCM&x_T lJc yR<]_Fw-臀)Ph=K d7AsqFmNfZi)g@D. %4Z#R&,buFm/E_<=sik]OdS*lǔ\g1wӂ& }I*8в\A 9|bw~ &+x:[;66o#ᙔ9iOwmYۛ<i$ZL/ji ʽnNTR)l𚱒j u|ԛPüCǯmȆ Bf)&^ZoM& {4&Jhg|#G}W\\q<7j@*i[ilp_zX(~ :S/lWf}黿O|pqKK*,7-cŧGddfX[P5'gT/m rY~.Ĺ֚Qsm'#=sw@rdZ}&*6Z/cpᣌ%3k?շu,җ7Avg0>*0XJ+! U8~Pnpas" .'1<\w 嘍>)r[z>$*sɫ7[D0tH M&hCӾ|kJNۛEhXV䶌1p5WH|%tHdXMF> (:>i"'S~O*s#mP/$}c>K6OIԏFp\^k06t| \\aڕES" DB1uԙ\ʒpwCl:ꅒ ! pak)@Ы>^CLr' (5TJb2''P)#/InlW> K x¢ "Z6T">@.c}cS &讪;63!%T`rjjp-Q;\@~kiKD6++52ߞ+е ,k1Xr@U* LV(")/C~%lSXU=me [*q;tv]{tl״6L3>^OdhC*V9\] *WV ޖ׌(/ _5C$cF eJ/zsܪ<>gTڇni<=$smh.YR $9Syi& >襺?VQ@bVt[>4U] Kp%w0D/Zo)=iÃǵ"NX>[}om}r/&Ҧ6N;&2˦«-ee썫H_#vl x\gƙ?-%E!n7NL̕qb+5n<*8 P`y(g sƺ4OOm cpܙݠZ(cYw% c $ BsVz+Zr4*.ˣ6KXKH}6jZ2޵گN015/}%xLƥ"!s;ZT>9l^ȅ(m.U`?zH ;@&8u:с(uIvX5lF^ 4@*Ӌ/h}!}OsEXzv24[!#T)p:-Q٫g>C*@e9G$-ˎ\ɜNf؃z^d_⼹JE 6O/p$NQgV|H#a9S/ ' 0ѥȬKҥ:c%{ ͐n CuiqDd~qˇ[QBw+䄼bxAkqg$>{5Ҥ%˯>%׃pzpD#뮢]=X[Z&-B+]i01;.h3.";d>KTP \&3+z}VNчS7) @g~}ΗALyxg-H(!ٮP}-o ɯ.pI$ VˉQshg"@akk")ht85@#ZџuX\3L= ̖ ~xWfT5FjVs)JZa5s~UU?3V3?:*rΩ2`N #0鿯p~7?ͭOX-Xs| gK K!S SLFg-h E0̪qA !!d^`xs!=ń+n:aa"qg/ͤAy'Fkcfg˂1}J֙$؛ $LϢfz}o_#K߳2\b&Z/- xܟDmt %As Gla`_2+xDC']WM5'P/&uKVef7t8To6*jڄq֖o8c_G4Q9I&Ӫw802DL':Ba(tDYd::+j8l}FEG3NH?^3)0\g߸:6~&8%5%|>hr2*wf k踮LhMPe%ue\ux-8\7[CCm "+beW)FMC2Oݭ' ?|+r[1S)nحB1h @~jG6c#bֿ%rZٴ=FOWy["ҐYc[GqTL n[IfbSIjcEvӺwL\2! #G N{5*WaS|vd8^Y{t o\8_Qi0bI&i}=<cҮk{M~r|\{6k3T|M +#ZCwdey&f b}hP FcOs0N#N!iOfE5}zw[GI;zW|zsovQdD W\A$$rpg^tkHKT~lBL4pS Ǽi{i͍j j][UĠ9U* oHrb!]CtAۢkT^5a5ڼ.4Q:VM.RVY,'M{PkV"e KtEMuOƳG Q37}!BD ߓh̍L_e0~D!l }<8z%"g XަT ۈ{?!$`l wդJSN׋uclYbOG7J$/|Lq} ZX)>ΪjlU=D=ŏI rϚ}f{f[ϳ>As5Z4{ait{p(ąw[b=5ߌ&ezw %%] @VS"P O$f"AHhSlޟ[fG!i%w( tsƃhEܞ+x_hw(QbPS~r^CF_0h)lȞspϸSz3KBTaN yNo.Z&qKתeou:\bL14F ߂:D48[G1G[qa%Ԙ2l56k7c.dwuNձ&kOK[XMn %`\%"Thy/Ө+(űrp$;衰oiVpߵX>b51'VnL߳-qN@d,uT}s#҉ 0*~bC^4PɊ xܦZodNNl21Tt̛4!fYѵkHΪmJaBTfqޕdL7hb9ӂtpow5`Z\Uur˓LxDFo z=$,nޘQ~ޯ#9(=!;i5;̺ (5Vr@!=:$I4 J9L7DB6fm莫pP߬oVQ B';O iQ3Cx[5eE& ke@0uH#&vo:>yl?vηaT 1SCJQ"_~8mHSU{D#'r^7ov*V+%WiBra?>$$%+]D4նwBɤg"#5)r  9¿9b;)5S <` їYvb]&~{ yi1&D@Ew>lOj˚3Rz<HD t4fK9A§ sN6s s!ᧁ| 4f{J_!2@ 3֚[{H|pBGJnN>UҠt<~bWiϿƺw "6Bz`!'you/eu2YśD,fÝx)IX ~[ :"oRᙈg!XAC,U6-ɫB-98I"/eL4}}S]z qeYK0$$_™6,نIddPK34j?] . !C`]d+>5 R+!y?[;WhUSA|_t,+c Xm#Z]L`6AP <̜&i ?1|񔡧ZC.{ H&=5SOvhJ@c$uƱ? O?C塎y$+Ӓy oa9x$]3â/P1%W2 e-AV&좁}'gIۃ%yU5O!H%@ZI-BdI J0]k$<3sA wPgВ[ft\-eFQVnFׄ% ̺k:3mh^.([ vКU@IcOFOp|1ѣ5_QnJvQgᙬ(G{/rm<5|wso(h4{8ObP` O{BϙeF7Vo 5i8?=)|%E) A&hfi.u0]BI7m,ADֶXu_7ϑhsPg>/OxVQ*X_\bP.@Ș[0K+{:]u6K*ao*b"+3N2ϲ~=g 3w.i(oO$y\ 1pz|_$Eicg^\Gx=@3=mRs7[qmXh|Gu-sC(A+M0e$$i%֙Vُm 8y*(`O?@ \ȣue DǠ _Q>פ/9yk`x y.sMZo;SY ?»Gf@Imu!^3Tc\fmF;OZоk^>kŸJ;EK҃Ś*7:҈MIS i{} =?l8rYL"X%pFqvM则4_ TxiEf/Z#gw.էpجc|ye Bc( B Rp9N u#9OvWYYU=:[,^w|x~a ۷ b_*90Pϴrsʟ2R֑$DWak| 7[7@ȥłw!,ӇҊ+v Fy|İ90GH=h$ ӝ7oo:* N3;<oxXUۛ p< I cR>!%p-0u YV | qJ+c0 *A!A8^9-kE/4OiPc\`ygʜ<I^`bQ7y!| Y֍n'p~PۥPYQ'?]4w̛lҊm[-[ zD@IWLBMw6T0`;5 ǜBSq em‘jUѝijJ}\L+2ȀuIQ wX#I&}࠮` g!VC拒;B| w>%C>G#ʉcwIg'Ò?y^ >ڸ&3.6ܺ=cNƗ9lûXۻک(Δ$ԁQ qjӑ}M?y#[#2$l^gM,hExk8[~ˣ"λ,J:R_de"msvF6%Fy -g3n1 lym)g*+!_\%z~C7mu¥l2-a ۂ=ҍR/.U>ceJ˥uj&j|A@m\vAy'$sf^~v]rgb!ҕ~Bf%ہgT`Ұ{Xbڒ8Η?[W}Rx((y/j O \-*$Kq͛,icv"_⸌E#vyachiYe zQ%QjLe lF*I0Pn}55*!%rr"ts&&Lu-AOb};^XJYPkV,`^H1Ӽ&dOIU 0kF-( KɟKi;hR2=LY)#$eù]d2bZL2{4rō#L ;۠VT4IM-P:W@vl 7rx9VjR?jGEԭ@KߊM`$G(.u* {$E΍X)g?c"\_\M>Zw*.O8ߕ[hU^/dp6ٱ9.X2r#fh2Zq?1@yyT3Z ~D*NNՠ /Ht0Eg] 44pGZs.{ Pbzs~#Cٮ!*ߌd:E#A1#u`KfZ.ŲUWdfYpJI;NNxw>lC ˰3-Y*bxK^m5}e^a@h0TFis/zGڲ|dQ2Lw-/ɖ2OHHO@(Jd}Mgy^+9M(ۓz4oVe /\e/C J#͛Fud|yMx]>G7^fYnWֵ[P0fSVU$ќ\/s+ؓ(-1eE+OtnrcYƼίHHX /v>UuA'%x*-[Pw3S' a7}vWE$t/9ϚW>VW eGs$2r![(tF` 3gV ]p b{??(ҀǵH_rCD\1V>e.eNeH g7],rchoR.'"ˈ{X9>si4⮟4c h V)UG EVʞI7H/ŖAWM`$Ep:VaZ_qp(l XւS8mړ\(5*kF8fø4=] :ۻ?[C>v!Y+br:,)69ft gM:~l<9()Kyz/"&9:i#ڰtFȧ!h=y'PqS_=AsM7y2 ^q%DEGgNfȬNz`_={9Fi [+?518}^@o}̊;HGG_IQgz*}]I18imVUz5@ߣQL\kH[ᗥPl>Wy0D0#d#{@ÆZmM<1ݑ"Z ^SUV :M_~Hu#`&>'2!PnHH9OACR63t0rR;W]Įbl" x t{t㻀Ο@@Ex(f܍6epw}h]:eaoqڀO:y '{"#R-\n>Rtn;qZWkS34 HCa1\ث@v/jK ="E!w翧G2o"2UG vl@f!?uheXiCf+7茰S{DOm^nzuP;x=6R7@#KqAJn c-?+q2ULVݣ'Pi9(áPT*YR =}ɻm %{>&&G9oay#>1L-7UH#؀yLKoJ dI+ xc8K.dyP  +TEvbC*ӑT0+C/ٞ% a %$S:05U\SKw6 ~)?Sj7UZ sy@Cb3D l!ߨN9E?O}J<|٧\uh*~J4fHИ PWJBxRWِ!l܁1v)e+Qt[9Lty1U;<ٵj7=Yk=.[*H6f~gD+H KIsaSx,<}9V'L9bB7ZRtJt9`Mc|!N ABSLGf@Hobw"9.ЉǸm{<1+AK-{hުWa- 7A^)w[ϙ츿&ĥ5N\`ƶWa};a ]>G4p#`jbƞsQjWg}o|k{O5\XJY"^Cs?aHjzOZ+X7K&c+<++ @<$u)6N}n5 ƃfk?@"П6RM8<=9` yp#G^ZHIlՔc¦i"yAhE̷fhChAˢh=7wbO r%&w9*C :}|̀aKU>zip.ݘ')1Ҙ(Ҽ-˩(9^uT^ѤU^^xs @nzpJvN=:|ZC Lp޸4oR4YCC;B7'(/qV{;g*^>finBF.BH۳U۳Ch!IkRPU'IJ2i_1o9MٹM9DcF0CX^4:Bsߚ H^av|}>3l0l${YRpm B߆E"st9;OB1`/7 iŰTSn+:k/(D0#)%dlfs zFnB67 bjYTWS Qtgԩx+}.06үLj)ṋC O`Qo;>]bv9FAeY/lpJJ8b%6q l4hFuO >'غ2B HI6bzgwC`ۭW!|l=%qԖL06kq0 "Sw{/>~ Br1ڟ^po8Jwa|8@K:Agh!m.Xhy 3W8lY.٬s% rbvx \ޖqoUvlbQ"vNL2^uSyj9t}܅1NrpdǢ[*WFFXpU!ͭjȰF޵/I}-gH dՒksx࿿`Ě*K&w1cN9?Oo6w7%.FYi&xN_ut?7x+"7XAf;cfB4XX;T VpŚ-4s)W7H8wG05Tl(e 0voևÒ&Icf2@k!CB3tѬTSm怽kDnk@ nU(DB1iz,#X\yjX*RVew j9*M8 uӰ8Mu{#3P)&aDrܚL?`]uyZwco# {glN!\XW-}p*}0~}0,5U .VBTlg&mA_Cn 20r"{VuHnsO9[-at8PǾXD0 KXN0,9V=Na 3!& .P]m>^ &7\pYN;Ǐ~fs2CWRr;*0A=$3b(p4U O: Vߓ.:T+1>a?0A?>$\T#^.sW"JvȒW%ȌXNu"X(ݢ2xJ5r\{C{>ltX&Ƌ9tb~]4rP|JMk K>Ȁ~g&}Xe3B{Ճ7z҈^p?\l`WPV:J^/F) ]tUNH9 Y:gQ~"j,5n^/{*Ǘ;n7\tzϝMTI1Zԣu_ϰn堆VPjFCX*9P-#} [ر P %ÍDBV^6o7ڎD2 Uݒԕ#K5gcXa:QrBr817GJaWсQJgg?=|=&cCNbgxÎa|: aBAg[Q@/tA &f&u.esA}iĮbS=D!o`c(CJ6TDH{;ޡB.L]5Xo4^R+RPt(pozz[꾮&NᑸQA],ZNt ,3T"GX@f+;0{@hX!}c}T.K_jK3h%b"%@< čӟ'gQ%I$S^_3_]híK 3~;/Udwz-IKɰC(㼡D.b]鱪Yb!K׺pwXd)_#[p`\6 WHCkpC4IJ*VE5k~խYOݲzv/As6o݊ I2:5`~F =>X:x(oQxW\W)#z4u[r%ݚA]Oe܀[9 {ύO6?pЈo1?j#d|s+#Y< bYq8f%4pQk݃Lqg Ɇ*QJrנq^;,K UxȸIFO4'՗ g zx?.$%pR?[;Μ=WKSAZ"gir-bζ8`׉d7LfMO@Ajb3o ܺY׳KDbm[B_Gw#E!wK:ȣxM?LC Qȋ]%dS(1rE*i2E&i~~c4F.߆| ;T+"Ru^3@ɢ8DTB)3o\Gc} k8v#OP}>r,٪(] :@ALiE$y2V摺#=05d ЏaԌ T?VPE#@B!b2_VrH1"?JnxI| 1m|{&E ނO@B`sВ:RYuzU5g&r\ Z BCdu];Vuua5&ĥZNĚm paHީSB9j\5tmtRbf?~h2q8KyxT̫wլm'gٻCF"hzƥƘUAVFCL\laM"MJyGN|WGc.4ȸJ0~ͬmu::vf.1Cyhqz؃M CX xsMt"6fpO8 ,b&o?žbŒ"m*e$k3'_. tB)bXBEMAXV֓[e-5Fn0fb_58D!dN*\#NS LN{`x./lwҾ굫AK*;%迣OLʞW^5Znroh(N3%sӹhx0XeDsNCP&&aoLR|z9I.*ęis?PraJr荰Be\,b-ֽkedՏȸ >)#a>.eJNsw0BpB&^( # ?lG/^/Fwp f0Xnmz u ,eC@z^lF2c*}Ю߮,oUh&}}e{51 D 69$#i qז0daVǺ|pD 7OI.ƕ眭}*WRPpJlMLr|$*Z,fSg`YEZBFg_'ubHHZbn䘥qZU3z)Z.}TͥX==nMtq` ,jX=o[yt9neAK 5Xmd>ۦo8E8x$-Hbڪ-C2wd s9Lho6)b צb _1+@myD1].%&*m=%ժU W;+/Oiw>|/c07C71{AB..H5>rx:Vzho$ow1^r K5UѥlqYz_ը;2W[)=տb+}N$+v_>lFϵ!WǟF uDzu5 f˜%K%u$`4PuIve,UǑAI"$D+C"v>IuXX'j{xmشZMYmS+m;x]dL.}۱1ϊ(2K4oܩF̥ۍ8Tsoox2&b+Jg-BJ8꾲xsj9xMwFBϮzbܕ2.:ľE%KBBLhaK r qdb ̿>B62[XH8S@1 &(v}qZf@~ei"! }EZkNR{#. _?HO.-,soH{uX-А6JBaY TòFmbM$ߞfN;*}wE4hn\Ms/޸&T_㗽 e+#0i0rd'SKPW~ m[d9WbW0Gxl_/?X"+vb&,s<͐|otHo(n^QfB۽a*>᥹CXDuj,O94P/?Ů (IrXT8BaPΗef OhRh9TO>t0!Sfd6`bRtCVST` Ve'\ ڻҽRíkDLSS)鿲?~\<; +'vJ^D3YwLd hGƘ*&W*7 s؛Cy #|d!aBEed-A`a2>Y5 ShQav[/E$*A$Fld.|KiI2bsj+~XVǜ~V+;UPT֧.͉:C#x.|ڣ_SާM4YK2<,42nLCgQ;HlWL$Nȡ73W~g<_3z^z +oTy$ר''A|Lï-\bgDW+k 8gLo[[jCE ]JM3ww d>~:[,Q $ݾLcXx.M$:0nsN-DU@lMBg.  DAg XMeℋ/WNSc%?XM<=Upt'oƋ 0j G?jk0,~?h& 'bWמWu,aK0Dژ?Ġ>3J5T pM xD Ǡ%臦?>ޕFqfBc)j^.R.aJL Ҋg=r?+?LH}ghXpي>1_UD6buY ̀(qQa}7>=.R OrhV#&uR~ꒂ#$e6k82*~o=)+5K&>қk¢ 1xl('scE'@h'߁1#k~@!+0kx=3^3;b]A1)@;c06jG'>;|2YK`5<}CMs9Yq\*OȽnH< kq$)LjV3oJTWBvYFfZ_{ZΒ$ +HME0dc^/5w c ^wSupWĘ(QYK2%AXGl|;XZd PZF)JlC]80a@tepo3\DـB|U"Q(Z<W}_9bdN h IRj\;m]U^ҾLo f59d]);%wZk̗e'Ef$ ,Lo Y~F:b?MO!k"|F7j"eUesJ<{"` "Sրψ`=pŐٍuЧ+p&N:]k\Àq)5*VF89ӌKSM4S9, 5D9jwr)*"5'tvYNIpUTWϑ'tq)/d{ 7VL&!/{XgO_Ҷ`?1gH~x:CWn,xwL8?GA-VL5jCNCVӂ H3Vc*Sf=0APr;3iF @|Wy+&[XX67V*:5$Ynmw;{g 4R%n}PZVyewh^5SŇwcm7}9]q"Y!ykL *'xUss <&Tw9 K)abT\&kfr !Z 5+[騶kQ1djz<=ʤT+8 x r ER86 aY#ʹe1@Y^'Ne*ʛBNd hCE g;x&l}>>֊i&/B{S\N5Md?fո5d+Vo lD3ժV4JY *ݠd B&?Spz}Q+kM'e:pHV䨦h0ׅ4PX~y8+RU"BQSy Y^Ø忡4S+&Q޾0Ԯ9ZO~+&0a}#Js-rˁmC)5 w+ T(JAj8|[Bہq<TlI61 kK߹sʋiqLtWnG|tMMJN4*~#m #CH.!~&uVU&lx.]XLGJYxLUcjY.Eΰq'땳9jl%tUJ%D~qTF(7Rͱ6&NO({C^g(E@(!u3؜I9lٳW\%0v@3řP^(h].hBtP$2~NҲg”s~Z{O` S IM@qz_sM _(W BPZ}~+؝:5lםM3 PH#5N*Q)a]Gmx~<*mwgS Oc`'2V 2nW0-7PZ̻kG%|^?Y4Pd]??r2ߛXȼx KA}|Х.'JdGn@ei 5@ j>vę׽[z};'Gw= (+*ߛv+7rdJ*}ׅ`ja/Isd^eg /N<~]^>fS;} ʌ9Ip['gӺe2K_敟k%9оM0iΐy:pzI7TtCg`KCgtwy'Z +| nf&1@b:Rkw*0_qq0lHL|DX)R*w`W^FTr1[CG,5њV EI_ӇO>gJ8)q?@̲}]8f<}ukӰ!;^.񦌣C7e4k4F׳v ;ELB%^S}M˙g|Ͻ}O5 G!)!EL`4(61 @`44`)]~Cq >OZ ; ZiB2}b:#:C!FvO]~fA?am܋s HM'c€J5&PQF[;`$IbH~v7R;wSRj'h#"棔c: U/i®Td %ϞxQ("Iwv @ЬbɐRc,Wh?u`bNDL%&)bE.oጰv;#nF@[b7_^yi@HFຑ+[Wf b\}Ѱ10mo-TLLzх`l1E@6K]^?"F]C,Q)H@ImȤ]֬asԃ'6@pq}`TZ*|CƤ\4B[ u}y悉DXYѴ6g:GXv䭖6á\>urhDpmq >ݟ (f@4-dO6e(*U .Ho}'U },>1F'(6S bZx93J OJwP>{(PG o4=HX㋣ȧFw&z҇=p P#c*7K!L/r5yԽY(7Q`!X{M CA8Ħf&9qY-CW̹OVXӃ%Ff&oڬӌACYs5ה8,;F jš*Ij I~ 5/w6>GLaʐ[qZq8e=IM쁅Dx $iU#ԑy~p2z\Pzget u~(aG {y2Z[O,/O$u#X\WLr#Š\ j7AXD>},` 6Nv^ƊQ͓m{ߝSKwOFΉe~g"Ό{Y{݄;Vљ}oZlZoN&qԞ ܛI4dӳ6Uc57|7VbvlwƇoO4x@e6)_X(ڑ&f ブG P.NQJ]'ѱɹ ^[go3䛅Fڶ?[{u= 3H[PIO` lVTۯTŦ|]rt y-aC#FVV: zI0\j'?>0B)+.>z<>O*A)#{ȵ[Fs|ZFHe4~iP81t˱Yӆ]2"\|=TPT+?V `ډ>M;h~-oKD_oEHfUHg#a`UAG:P,I3OaJeflX:kG1_Ǥ'*lZo!mBELvS5YHRNy<<))%,SxZttF=}Ejw|@X&!V1rbiEq&+0Пnr:vYjX֯;Z%N 3`E[jgDvdOiS1%߁l~P 7I䑟.E_ 8]mNYB>y鈛=x@Xus_i@C}Yrv81V` O,Om Bu?7{A!Ȩ4k똪GޝBl"'T QњMu(,'-ugsQiB0 U::$[>U|A`y)5]rp6^K.߬J0k~zQلr*qmZ|L/HrN! \IO+zI,x ݓl$yA&H <"sŤCt o3F 8T9:ο Kֽ7D1SQN4]A+K2 9C DȊK ~@5W%GSO 8N n6P|W)_6$7qZ7mf>i-) -Q`﹐raP6?&iQ=D J }RWK*xhAQ`Jvݤm{>Y/qT%Ӳ`&]e}*YI9ULVϚ *&@ECLY% 2m*8Z?'fNWK6ג^!١GfGm]+E"sksj%ŽJZbOI卉y|eG z6FEi.4M'p=XB,I֜Abꏠ؟/egnP Wes; q/-z$8t̄pʏtD #,iùbHլo02\.b|^(?pJiN/ =o=Q^N8_t7zZtBguR9q;͖71:< uOZL/O&e}̶ /4\Hb0Y.c`@N0OMǔLؑ5b+{FKwgX&q7 MaQ@@j 9g';]!>tT$v+ 'ҌȲ^% 0YKn?+WiN]g;~+W9;Q{ۤlizG̰ ΘO]mm.<-x̥>"`ۨt%-60Q?e/ZAk'>/p?5h Bѽb۸ʧx^.$Doi8qPP*@*f2PAm&}t0f$Xf{ۛEQx#kC9Jhm|9ـBi.:]GǦFT$; {uó#׶.ۮi1^"!esz1 tˀ͵(J7Ske͟YYaH0Vc^fB $srG~lBF[Ϧ]uIzmit#b~5RIEard4|~KJDp5=XF!0 T[qS5%Ǒ7EXbA]`#b$}w Pu@`$*#L`UmS~M>*D`4f6 e b`t϶,wLgkAO~q p_rzgŖyy{ht)uf>_cH ظRF-6P#/z-h:Nw3#z+Ϧé#؅K .Ո*cE4HpH|Q4Kߊ3JJ\?/JeÑoPmbſS6GWa]~gE ]Eb mj&&EO-gfh5?V#V$7%?lkE'U\Z@ 7 `}6M:m՗]?=h>sf,+p[?kyvVBh|Xg93VlH/$)})恟1s%%s',Ia[QĂ`03 u-[8S{oXfU.%njQ&VB=!gN"m4Z B/e_A\S WS߷rPL~|.{ ,3%0m;d&K{OhDKiG+ r\_рm7=Ցfz&Xؕty(Np+`Cnct}UO+ljnϖ,ez xAةUD D~1!|ЅcJ"I(3_s9RpGlILGy9$cKVLNgbgQ"s U^F[\m||Xue1-R"2&IV@n$q?Ee̚ 5 :fVs0A͐Z_S3*ŋbB yV.ķtb2=xANg.j8->k^ݟp?[Ye%#h4r+kW83)= /::f nlD)n-Y=LC0ਉcΚSQח6'zP:fl_6z7WQQdB7GW4jIq||xh>zE&~sp I΅SBzvm8J(Ьt-o/mХX Os)~pPW9{l Un4M"Mk RYd(^ԲH>FcVN8A(v2Vڤ9r PlW?YhQh!yq%?loѳ_3& e묖%&Ԣ١ 0̣%ciY"hڨwfoc.%4!йEd7ʷ|9Ju\N S>EF^e~YEL&>b• ~@:o kTG!0}-ZV[P=AhW"6Jb# eCQߕ JݞCO9m޸%1hU[` }s2 ǨhCQu 7Xˆ` p @b<ӱ;0Y\i,yia_{1n1u;#0>0M㯺I(:1]xtt X e>*gdžjPU:~:jKR7Ĭ vԹ3DmcUU7)6WGFAGtr:4?ژVp=U= cXmPmhHZ p:JErTrfrRtը(2A_cl8֘PE}/pYç梂Lp! vvW1a!w;xͺS>~̞ 5~%ݸQOV9' 6xWߘ,m)@4Y--h]!`޳pRt{n;9m {Zl洹_GWl;#4L)+8eO)?<]vej6YDY(+Rr;%{}󁫌:rߩEG*%>-;'$ o<5瀍_X8 .Ǽ#V {sj|QORE 0MW9i5zuP\,MY:&6#Pf6ME`Xdj'l̂XH49켴ܯCs-+/TB!>OgU]o,{ŵj 86qȩxxG2Sf9XE#AWe`E̪( a_ZiDuKOR"UnLA dAJ^YT `OQB8Bo׾{t{+Z\2߈zAb XM!CQ<5o5Q ~I`A!it6oIN]M`3B+LſA70U`ҏ-$@}eҰ0'zHĽDe7q/ d )ىR!Jpt*q3Ɨַ ~RH3Ӡ1sB0 qZ˜ #hg`?W i g@l,tbՒX0pS4XG}Wenc'DξMJP.\zKзZk/xtRg'zh% H_ M䬇''` f3ص;Mc6BY_6Kݭ_^!g?0xՐ./ԼRO.t/c]A=g?蔑cxa}Vʼn+VG1o6`$򔠊BW1B;JsYd,)(7/ e:sa۠;6_^ Uvn@;#O,~Q1x(#&AVLV"|C-Hgs-!j}Nځ2\GԊ43+j,('2e-I7 ,. SUHk0Okr8e5,Q6NoþyV^/eBWO> 5;۵\2b;^ifA6_ 0tˏJtnӄf$atF$_2MNw@@ˉvU ,A}'̊ Fvփ~əaR@oբk/@HE~K(ۯ=2>~ >< ?)'H0grFQArXSϝהZ\W3_<<8Џ) 5q&3/8L bB%YE.2l 7lρUep,Fֽ 3>5p6B-Gpu qhJώD|‚c,BK~-|H2= t'2Uk#n`$.aĥ5@dVJ2r[L@Xe'葎RGzL9Jilد*wܶfUKjõ@ۘYlv iת),F`t5:Sxđ5 )?Fyc3<@2JU~#a*/ b E0P*\j,bUV_l(/a&, 8Ȧ3$]6Uؔ\5"}5g[^<4Iswz~=vWIMbQkX#Ba&ku< V\ߴ0[>A)i lFĉn*36!ʛqceCB4<QƌaKbM_Lf2]ux'5>34>qqw9)y__mZL5:&ŎZL4a %3 Et$JC>/ o~aBiܫ?-Y?7wt8yO[ܞ=sQgxcvVq2~`cჷlrDO9?nxOr ~ՙXxε!"ne7yº< C@Dn wӵ^Bōv4p!(t F l9ߨof3c{5of_ %{4QڱnzT Hדr+) n\]+4`GgD$/{eWLͼщ}6B* ߟ~Imqɣ6,%Ⱦ$=܍:ty_ַm-jUm+<&& h t5XPɃj%O B1f4ڜO PK8 '`!Bmy$]7 07Z7$cWAHtg"CpDuw37xD F1/0EyM7d%gVS٥,+ة9|"D|dd[*YC)rq8O͢8gn?v54ukmU)CQ! |KiL%oF,*Tʝ6P` [-eYM{(@ Uz`S#h[p։Bߐ/+Bl=)wb#hۙd%;\ELwպf@xD>~С5™C=Zv{507#!ym =879JS,B{H(v }hq 'z;L]gDC6a/R5}&ym6orG71) AL!c …Yx*Dp/X1K'oHbaqSSѹFv^y͐[c}ss*S7,Dl[@zJ/Ӆ` H/0e** ÕlBt漈4W7Q 2L-DCccm scV]&(%B;Ɗq9S@h/c<}C Vbń<ժN"ZnN@v7")P|_\}Lr=d#& fM;Lj 1#3r-xFzjUĨ$(ç?3]𦚃.KM:q}EC50%8K}dsT~5cCٷRSe1f}}Z垊2پ@ݐ)uC|A. + 0Rf&2, =(47bqjBM'g\m 5{!_]r:S{bdf{ݽh?։XB#D|.ԑc))fɺ^Wm'LjG}{=\rBIBVBU*e5 9yOJ]hWИhrR{&{7܋WoRALd|Y8b" >嘭 ^[N:AȢIO\yQ7[H tVl?`=dM.K:r*2آ,yۯ$mRP7åPF0Cb>/C+uJP4<t\DߍB=c}R1{ ;8ԡk࢟fJQ]z@ ?cVуC"N&9 },c1=I),WluKGrPzca3^awh¢GAxK=W[ ;#9&-QMT3#ϏζVcb).p;Gf7 eɗy0Ϥp]HǓ`pKia9 4j.1fh9&*1vkRդjzs 9xirs̓l soL*cvx&G+w4gO",۸ˀk 7+&4Pj~&R1]nPV5'0|aYd" !Ln.HͮҾG9؆LNj% ˌY/eͬ_alW\4d 2X&]f1߽[%qöb.nYxlg0`{qҁ&W4L]xG.D -[P` v,Ѧ)Y;FK6R u.gIdV"D%}EڳF<89JMعT*'/fm8_];ŒKC^C}r]Nj ղbR1[%مt;MSF"'+F+M&li[xoX#oV,9aD%:iW/SI3ȗEN[9ZE#6H;?[ >iW=:/ħDݱb`U)7Y'bd^[cP #fFGVL[w~#k5fۂ|99LD@Uu̹|l.v]xg .mŴZY}Wd^%;$>@3w,C@P[|lsJ= Ȕ/ ['9,4aϧPPElK loN.2~%Hꜟvfug=x)-ros7Xi]E:.Q_qNj ُi5;[9ںqHͨ՘nSxr U'xެ SzHȳ0cRp7=;鎛2)?lsG|mS'C$sb7Vҙr-)W̬.MTaղp3JaG$6{T}byWp4W}"!)W>kz *t0k;- A v)W@ЫF|M{XyP"(, e\P]$Ht9>(pKB$+𞉢/ډ4we&dƵ uT^Ȗq\7iVn%o'-z&9U>å]!vuЋ'-% b!`U3>{GL8qG]fPcVJ%|.8(cbe`:鱠"i+ $;^e4as)F2" \@N+?TQ2rU|/ e֭  ňʵ˙댗Ms|oLTݠeJOh; ۖ0ģ0UP4F=S*dPiۋ9mfZW1)Hq$hyeȹ(I|bu5큓zBY(I)b;X4Iۊ4_7zt'kcgu9 љz-h\^ i6%?T-v%-nDPwQк3̾SZ OT|&Ļ^ V9ƽEQ UrrZnt2s:n~B]Yb+}":ځJ遹l`'_jGxg 1iQ8o;q2QV 4+E}ǟ}VYí4C32&d@;L)ac?X@젃hgBیAVOH]Avy0GeqVL{p\侀C~/:5+aLws<i 512adl?Ce 1e_KW`e04s@/㫥.j& E T=ڜ谛F9HN]N0ꉧI:Vh}De^`DŽ%7q2>aw`ZzbO$?,tҜ|8PI $Dei!J$Eq~bzypsySEАJН6"h>kl9@N:=ix݅սxsppK%AQp]9J^tkʹSC3%{.;ռ~?/S!e_'Bw?Sb4M> =,CRPox'P=֍HoP#Ս7?lJo~QրKۏ۟t[ T۵>[XJ *9~ǚg4zcfVywsErC$o}llls܀筃H#r+ԕ%TA ?KG(mO*,Z)įh.\|P{'΀9֡hC>W\H.v2޷2S)qO0{$61\Ydeb Æh0:RlUV0r%gP2`&Zιzgb4!hoCȇA&WS8'F.-U}7}y{Ɖ%o\yx87>l-[i4 }Z.D4?k[s3Ti!_h|Vl5K.ub CHˆUzRQ G*ٗ9uLj@PrH~t U)>U|ls g$4 +48#G7Il*P {z.W``Dq ZcgQVoFcHD~JR 9R,{cRDS yMc}r+);yϩE=fCTCfDԢFsyOleYb:u>r5)NR;>JIydAaʕxOXXíBtw+WHE NB8VOBIv\CsD)/τ^?b#]e{Gm^Y݅q*Ë?.YTdI/E:fny۴eUAl1;~ϼQv =u,  <$KHJ%3VBLKB/9f$m䞪]H>k2IF8'V+h v0BA^[T5<9e-u5X8b\Cbsjc1Jo.FS%e.>DTnE%KTWg.9λNy?CLJYapS9)p5' fF 6@$A#6"Xs&Iвo4<m;[@a`.*4r5>RՍX^8ހpFa*/rIX`}X)ȻespnlouQe1EFfC#mKYqދ;eNMDcLˊc< MLF.2v^-y ˗hёi#tw[~sKգ~ip^WԤI}W?FFhNGLess>QЧP 3~H$\I&M 2^RW+%]}JZ `a[w_FiaԋWwԯ0P[;uwq1OckpC#bO-fϤV R)YK 48VXW38S7'?/RbFה~{dZZ>/ #"ṅ#. >xZ$xgP&Q72j$ SxinIl.(-T,. p^ aƶ)l sI|#TCdZM$b !TȃC Ď }Ff*bzn#M7Rn 6Hnց_d _0" x}AC@m~dHR{M> n  ҃UY {^{HGſQ#8c]CKd"*XK) @elC9[w<_NX %8MzD [W!šf0ZJJq8Beӱ{I\Yȉ5)Q8* a1f,A3WMm $Cle)7 cqb.k;۸ X9Ub3fƕl[*͛{ڹlJԪ qJUe:2J .߫ѷD6Wl+Ag L3"8"Xro=ՖvA%S],Fdfs R >툑z۵86Fcע2\u!QЅnb7AJLfm2?YU,R^jo*ލ|jAH=͹ޔrU+2=1y|x#:sۈrq ~JDj*AeN77*_N+ݻ`E^2/X8U͔0.܏K^׽Ojã*_tGl13] I7=4 >ykCMu5!LOiOҞo>1U`|*$cdrAd MK;Y}7˜'ctY "v۸]Yg @Cb=6Jw<~nK܉,z˔'7񸀨-Kk2il?Yyȍ p_"Yf'#W7 S( A~j<#akx.$w/ag=@/9%AU\![y(K=|E C[J԰ڋ6ilz>rXWԓW7ILYP.|l=XbR-49̾־@"N9ٸ͋Z^_).8UDbcљjUHUѭaFЈWG6n|)(]~"hxEsr)d SbWq}tn:g [%+Of͞ EqeކKJoa$;=cPI)؏-|ft0cMc~U >X+w{ \R<}TY]Z!zOo0q=~;e0J_\WxMl RyB sno眦>gM]Cc\nʂkKޱu_hhDV2FX¥ib>&9򸔗 0jDCU2i ;:E/t#azhLm]ɨw-{+V-d?"Ȼ IY;r_ݥ-N}Y?42SPB1xEGqUKxBI;N)j5TQ!&G@s fL[67 dVeh8{2[ wQ6 "%Y?wD<qiQMiԸđ(Oxo9#5Jz uɾgߙ7˝GS0/,/ '^!^cci#{Ƨi)|3'3 zC=[\?>Xgvc~:Awa;VDPZ  QA'hfX|t =SV&pb`$aU_y¡N4"L[[FăS$6K>Jlo{[ziw&i7H_$c×Ŗ ;0nyT&_"Gɼb|o궖+'W;xaCږÅMÑ=ed=R.mu"ys=B;>rq;~ZN89ir ,& _׬| Xw9f~N?"zj@K] Q2*#P`[lեIQմQ|cp{X4EcX&=O eG3E%#H~}ݥu3x-'>f x:GC+ɾk~6}5Ja% %@ !DVd%Kv0"f,eAG:=dc^?G}Qx׉b0ξ7' 0md]5aj~xY,$+A'xg fr6>=JdnKlP4_r_gဦR4?_Q@%Q/ {~CxhïuFg2`X_XtM~u߾C6-ʇO'd=;>S$E]z=%[T.1AeXc!Lz֝11폸N` E|K@^x8e]8T A:~=dU٧ G (꼡$ɴ._ۆu*(}]9CM:Eϰknn$ɽSitT[`sK1`18@ݮ#t ҳݖ -hnjW^PE$Xӫaw;pNO"Rxun^\M>~ʕJ8(1M/_73ۮEΒHnq iÕ됟 ro-;0î챚Rի0,{A/T* )@ SAMj껧ug C(֗K{ ^znt4mٗ0 k?nKXm嵀V~sIjF|[4}nAmO<~#%IS;C2k#Լӳ*pKƫ]3XЪ o7%uuCJJ>0@JQ#pAJTejd#Yr7`i3X u)1T"Q. x#.$bg+{4Ms]i]zE0YV`y.>ߊy"L ){lloYY׾謆V{iӈ@Yl>_Z؀Cw@zǫ[Y ΟX;l6ov^rIZCqdJp$1#9PnAζBK) (L?X$35]Y$t2t_0)ԛik55|FkӮ2%"tiyȎִh 8p\D=+Ĉ%9F2 )3?O^z0AH%JVߓ .EFaA# 2:c}, 7dWXͩwS'3ՙp1X["ʀ`?8ԾЙy'sߠKH'j{e\'i qqC`=q+},VzE6VH1d877$ geGTtߺVz?M!$@wT*#ף)k IXeT*D kW^] W:1G) {"%Eڍ- 0;|,\0CJ4 H~gQ?EugӣaQ"`S}}Gڿfī`d /o+ƶCjp4zL.9ׄ>.S3C*`>  q2%Ć/"r}G[@Q%,yꊞr%5J\ykN&[o%=1e+&[)6ܫZjuS71E;9ބr3ns֓HoX-Fh`Ty[̑rly{ Ɂ:fo61s?^6c{5#;ZljC9p00Q;Qpk(׫h hL4Iӵ\=s2coC Jmm1wb'` qo-PBmDҞ~x94Ve{Rh+VI!iؔ1Gdi?6dzӱu8~ kA1)!aq>9+"(ⓊQk_L8Dt^޹ AL5smnq;ʙO5$2{ˣskƌ$` ΓV]A?q{|T Ip9=oeg I՞hgia":YQ9kV73V 6RiU 88I- ?aVmXd>y"F֌튧s؏3Vh1T ;zȌRjH a<!Jq~"$$!z:7v|`%(qG y$[!PoWo~O`)QBt"hux W91he?矧婐B9Zz?u?ĞKvd͑p|*Kwԋ BZJZژ՗-*}qұ 5˗$X s3C%gX=y-z!<Ҿ#{jd-E9rEw9ncfCK YikB1أ;=.]2/[EM{PJ8GTq[ N0$b <8ήI.ofd|˓=#M`9(+?W4Znm nXuXP@U݄K>kϔ y2F!TJܑ5AGEr^[.ǔۿ~i{qolᤘ =gSQ2T'lްT{Yl%tsŘ~%6emj%.|މk`mtx`a= ;}[~@Eo fDAirHUjϡTtea3c7eB$7v)'J̓떮wA#Ǘ!ȳXZlU tA?A'Bq]QZ񂦵m3U>lnu??]*?S* 9FWoΏ]2޺a}:Iqk.-T@H[$VGqiiTo/r7lRW=Q.dN ڀ;4 gȨR=J%?j5V7q=VK: |AgU!\&jPT0W&Vɽqx K}͵8?3REDİ>94Ybm@]A/Y!'*pK9sbj8+g,T1< bpS]0н͡勭rQz+Dc58\I '3Rgu۩=dą!DVUnș`gc5 1P=aH1"g˹ t0Q$Evbxz%9rYecZkԞW#%+j7!o}5!_ %9MYԓ!Y=:P|t-ė n}^19qKנ,sl)FTp3QA 땜Cm"}҅Um pTw;dl,tA"ml(eBLSM'ݑtI?+3+0:$re(#I9-^ ^f"Gh6)4Zyv06FD? h g3<sUGFmͽ\Q)jY< -+&ȭ4E7<غmʖsAosD:'w9bx[KA[ oA#(tV:ɶ۴O]T {G c|BE'P6KOET՞/N('e'^ 5M֎_4Vٛ'K[?Z|ׁ$E8a_1nBh%嫌B:n2 RVp_^Sғ P?s \Nw Yc]}|O zb*h%h zƽ]s!)3fK=fIXsQWv@{mPHOMMZ ,e45#rVR Zlgu[f2*!#pgČ6 2e@ PK+oO]~b#q߬d*ad,FxkVZOꓯ*><*VeID2\=- MGt(l%7:C(~E2S$?IC1E66'3D"uSg3%I*Y ,Rȴʝfpa0}[$UM35<W9b,B8kwh@-@~g xZҶK-8dxji[grWK[O$^WON! eyd&<9F&Q&:8WKWC#%C,ϟ "MTZ)a\Lls`!VXѷ>U {$#=DyPo/0p9o ӉHr6tK:-{:뻏hc/R۴=e)oȺz>w?N ͡$R -aNsH-\7>*_/M^}"R.T#Sq'[2C{Ǚ 85Z`YwJ'"wWvYe9ߗ E鬊){ 0XR4<sߌҿ2<D&[APc[Wˣ8b ]؃(Zj:=x~<.=V٢SnS]K/7u—V1BxREzj6qaY%>MiaS۹^l0HU?,#< D4)D'wAQF>è)4nh.ge޽djk`*_>7|!t?ý,2dYxcLtd"JDq BHu*#wqAHJ/-tG'<' 务k$*>g2 '.9͉}Q =6~}'zC18VfPq l|9:~ qhR  d"# _]!lDFC)Zt.&JR|G/.)u3b/9,[j'HM~pgc[+_55X;;VMaǘSH9y3N3Gxz $Asy'WlBëffILw/WE/CGޜsHFU5}e3n&gs*& 1|#姪 놬 4\`%'nDKcH=g$:sN]ä~{PؼU,IJK 8PUL:ݕdž'5Puc9ow ˝T֋S%&$NWݣ_Xur^e5dCNPjL9'f`&1J}|2p>< &!3y)niNd3lMZ-I(4d]]/IF^=EZKJCT<ǫW[2>$neo 4 &bGQWn;4sᡤJB*rB5AQs;(kb ~U9is[oxdKj V/!1ߚl;#)E`:(T޷GbLH |ow@ U*i5HaE=3TC@Ñ>;X/B f :VPUrbbՖ$TZ}zB/T o Derp.֕]%j I.qZC;V#RtSu<XްQfS&P򯢴y5Vf4=LDԳ'%/i#5$b]R毆[`*9RJ "H6cn#$;V^>n_z;ۉ8 ,=ž܉UvRݱ ^\1[VO&x#w$:C)]YYF#0h9Z#j~DPl M '\CZ ykb >N8M ]< VjoA/k ǂKu}{pet%5k\MK O'kD0Y8@gxB䝥4 qY >$_Hʑ"qg"ͯ;(;h-%ά7:jUDS|7WϊjqBm)7)(<'ޠEa "Uy,T0#VgXFFJI t(}9mҲUzqڡTǢ^EFeOH +e)}uvëm(<ڰ'Ӥ2Z)>DRr!O]Z6@0xс?E$'Cğy%:Ra/MTΎy)PN*S}ۡԒK\2].qO;&-6hyh#KUPa:0{YzdLzg뀧nh+⥭ γ=fE<0^^T&k|fc X4鬨Ay3cm : ^G׷=h[D FpKi G"k |0ftS(͋+tOIL&9=72PɟUAJҀAI|)T9*t6>´ISK-KA^u?BP 8&N;Ж5 ?&P07#ϴma=vޏc6o?qXlK#qŦ k?u_Gb;g<+hn* A$cBͩ;#[OC}PUxC@Ju)_chԶ|.+D(t"Qs% ֺt)+3`GhBu=|3J3V$4[crI{AP7{x⏩`X֜S yBc63N|RZr~*d3>gW_"(CìD>@x?<z"#}CmfCg`]x|Y5¬B+^R?Ҽ Vw iz!j$H [+CC|Y . (t~QV P}B^HKK$qqghթJJE4#_=Zq9LؾdxV=4l3@vn1<gH~uw MN{aN~ 0e1lwʶa l:C.hvt]fу~V db Hh~ E0.WZW'%Y %g*hRP 9i['3ahi,0!ac'OB Й{rM EG' /+s@(s6&Nɑ:A4#3Q>d(}iuάx07"&kYM6R|Tb%9o󷻲G>y"] tVQ k>W_u^6q1 ='I!ʗ|snlCia\_k߰2> *Xi/ EEg(S9r:؇`8ЅXAoF)Jgzl9w7&kd^QBfM;%]7# j:YtJB) :ro:u|^WE+e80Gs֠U"?PVIȍ(^6"yn!iSqANH+ꅒ1Ƣ_Tv(HJ2Wzf^b BQZ/N}UȦ\8g6!PPore!fqog ^sUgsa@}xJݿŋ]"aEl:)tB׮ǎK 0{<>D12f]u 6vU)CdUI֭{𕚚Rjuhy]c*XO,E{6!:)v͚{XGOblN(ghsGl~vj(HkEWvmӟbQRXgUf*#nyc8Q f5n$U#@6Y0clWa'ؒB B#dR6% #Ӳ1[tYQR)㻃F$ WqQEߚs8C08DsY, _RQx?׃r>5+5zN 7c:h׃8 ?˫_xGrloRR^D$ +hP4옾Qlln),b!At&:zCIPչitD*c#Aq蹝1WpC{9)f\òN_ Vg >LJj?D 5a8Ħ;. LHZ ѻ~-]/19:PnRMH)mU֓z[ɕbl<@F0#ڋɃmW~@SAZWRRbfCkE)BՊƪʖ V u̎vffNUn`_0 5p_-7_F/떒^wJj2f%-[ jEgtގ@$ A w8_=ݮ' YɶRTE>/vZH&Ƶtn0X(a+`7u]6s_7zOnbm jíeMT~ݧ {*Ku7s0PzdTiYBIO*Bﴖ>bȼqG$HbKs~>6`y2/P'ai0W6 ؆̈WzwwPU샂~z$kɌ *b>+ϐi|YO00ƠNtaOB!'n4=as)['$kj8*f}.>mK[j5`Nj`W6$]>ytƒk)zM n Gh^ɸQq`Co`rU]v!qQ \ZR&Q)SOj:_MywvR:Xs\c Nŏt$bU Z 927L*f/A @]‘@#ߘY=fG Y,mOkGrWs8752o~r:#OIlF1j , 3t2p5$d; Kʠy|,C/|A`rgC5hUMd[ԲyYZ w:tΒ6M[<1PMClX:Cg}k]|"7+!5 kG1R"6l%kQFa z:Ty <]l)4ia@Og;n%bC܍䁤^90dBOI'Nq:^00RNLN~_yE5]{?^Y2BUI0cP4 f_b. Cg0 O h%cA)2[|4V1k)I,*rEVU2(Lc`i?r>8IlK= {LrيG>6>?!/9PEܻPS9O vARGa9&9$lzI! "Ѐ# tw,*z̐оRrJ4,zgw9h\#N@m>m@$A]6BomrxK;{[\dv[ o[`.c x =}@x,ns͆6+mAnP2md MڰܸY<-g/ k{ 0 jlq~.94L@O\ZɌ?:18;Р==tz$+1'o(tI|CIS٧<_ R}Eaڳ-嘖12Cqw4숀ŕ%\Jb[5̮IP(!5SC \큨g)BƳCh=Mɮ q!٤@-ڡZϧg/Y[[hCNsUТ=Mg J.f-E J5 U!2?=" h\boW{烡:䷀VGSRvy*U&WzO$8T\.=. 0Mli{{=S yf$Of .f5\748/pdrpB*]:@ *ˮ zu:qg~BkujrC g̍ޭꡝ!gqUPfq-[2WwX9mUPy>(fSlZ.Q2!0MHce⾬^mߓ86Ml0KVrƿ'xV[ PG^߇&A09I+1 C{LL]>H?ÂTؘ[ˑd![/ : \"*+%r!vk(%L+E/yQǝR#-H5d\ط NzB%Hޔ~~"ͲrQL.ĿK>}o ]By@ {,a[pN`>I X t뿻hKF:΄xb rcVp$J&i.mdOb`I(x$2͆[l; *ՠ˖jlhDuwܚ8: C',O}&ig#@pr#zpgID1A/N-E>[P9?9gfKa6'b Jf-"<d(|l_6p@̭[O+oXW@e %DV"BђfpC.<|t~  =]Z`GlM~EU_b`Vo5 ؊cP峰 ott:go[KHy mZfqJԏ|Tn2?j%hqٗr 05Q׵(:І-`5>b!.٥L1Q9xYx%HZCVNtzӝKd|^1FePa恡pUTR[ =JV‡B|B iu )rV; H`_!ԌSRl%۪k=MsQ~N9%䟝ҥLn3%oMR:Sr!}&ƅ (ROʔNPs/ppG5k ZhTvC! 8sMc8*M r]` ׶I uy|U0U-+-ZEM|bN$Of¨\%^kK2-k_QZҘEeᚿ푍Ka5w{MaHHsa*m*<otZ)õ|a=ˍf9s Ao9lKAzjqzIY$Op6*ü./器}{Lv<6_ Ҥ۰j?rߙ1ы/^j4Lvp\Sh4!Y[v iettWx7,9RHHOk;XKq@GV-I֤fROݨϯdߔ*1௨aR4T*A39nb̅(mMpWo< ى=KLe@ BVYfW7a_?_d>;/+6@~'r8m(BT/O;0K˶&4$ts'{l=~d Ǝ]߉>e+uGPU7~~04'`[c҇-=vI)Q6({'U]* 4n/8jo< eWKԀlI|7!]gbΆP8 hOR] 'i˟܇G΂ Xȋ9io[2y>7ëy 2LGZ;;g~vW nhGI "_c|ܲb˟F*-07DX)Zq᥸JAW1 ?[JRp!bk|G܁V3T%Ceی}0VT[FE*h#)~k-2,L mJ!h $A;/Kf`ɪdyXh$iA4,(&uxEc0.D],C寿ZUUP3[*[Cۣc~U/,߻;}#tٍ\ Uӿbx`-.!'vum?Ry*di6NN"9KU]N>hz9wIexb[ K圱8ˉ|yto>tLk:y= Utk {;: 5H֏l6\`ѕR Dv&ѷJ`Zx.~3Iu0HG~fh4`.Dv=~5eZAF3'@bؐ~UcVuL3HF[Df.Bkgєk ?Ò1.ߏ!q2>7PEm^I]:\q+ }J`mɯ[ҷ3ꋭrVڳ D`VX1 &M-zs&v m_Kt[CA")90/uE"MO7:e*|)MZ:GN'4qq#X‹MW!vlǚ{hщG``n!a!e+ĊRˇey -]]nlet+\@Lk_nI9&*2wOqT5JGIppgjM>,`6}AHǾ:\_Ӌl.Us Sk>֗U 20M9K߇ҲCN 'k26R)"KTN,[TEpţW=~dB1qkiPI$R ;(U Jte&[-6`G[m䜱CSV9®qFu7g1M:뙕勋6ԛ~)SӏsN ПADP*SN¬ D]8~Y=ŻC+ɟ'fpbAx4, ڮ5>*:i$czT^Zy_0h~5{G2C~©^=-4wl}nB%Z>)BLZ{ ucix/qcKgy 2;rQv<|݁| .(²^@8Pm%4 L~-zUos٩viPYxu疠PU0\53?h.WkkaΑQ0W%-V*' ##VŖNJot5[xtoWx$Z<Ґ,G]")Tzt> Z .BMxdP["n-/OXC\Zad Nm^5} %b=9 +Q=ѿ2neF{+Y@q0KUCAG v}js; rCX"YQ+졢 tPQLKӒ2tb~,X2h)e=Cu᩾9I"96DA:Hp?y>?kdnfI2NHhS\n "bSh[m?& a[g^dvL2˗p!Ku%nhb2>#)^"xO֙Q4'+\P逜$%]zDrl/_G7S%rhG@DZHh.pQ&%M edߨl#qAc/.A(bm(&V"wBdk_Æim鋾(!˴@XL^4iSh:cG>^f$PxzV3x P3$TS1Ġy"UsY}&xvx-T.OQ;Ω͗\2_!aOb7rNsLc2vk,]2\Г#=73@PO4er r.qFǜ/ȏǂaQ /,5~ݝ =X4⛔;JSl;޳ȟ\k+*їCgxb NK߯܀u1lę wi+ ]ٶx]7dUe۱Q^?qEEI5Evw/7DKη(7]7JBYo݂`Xٞz1^T٧J@@qkJ5z ?GИT}|vcQپ V`bkYUT&2:q+@v;я&VWߪ1| l?ρӼhX{*):Ј'.]<&P Ər@"Uf}]G8 ߟ7;iA* j,T: [WHZWe15Dx3-(UUP7hgZWׁz _@DC_oM}yz;9ƩVx|WTD=#.5-YbyY Sa/aZ{;kz;O 6]8X9WдSSXhdu۔4g~*&;fxqw U"w)" ku;!cM80v,qe*H@>D3 AOOѢ#q?ĽEdw[+z~wu{jc٥dRBn "I%5_;ZQ'UfOR̞MAiߒIp74o(A7R[a.yWUz=EikGL:PvHF;DϭRxMXGnt/ϲl Ge4h_S0i.sR)O]Vh9E~l>DS~^EWI |}ڛ=:t RZ: S|R~靔4nlY\ ~ͦ@ǐjI *mS w9"1fT.z-sB^SB#xmkbƖЕUcDɺqŋdK%ئ2Tzg䓔=#D\0:p&aW-˦5iGwr3hTY~Ӗ 4˜eH:2*+כ?@*(޵N p;'3Vڃ8!:S8 դo]~/8 *!}_߉EH% aBeĺhp9댿L:dN.Z[G~g'תc&,҂Me}ˁŮw!q",^34GAuԾ47dKIİA8 Trɚb_/*e`0Tu,]:9֥-:h|%Bep4E8GzF?wڌqХ~}u|:X3^cs^˛^Ni^Dxy1bEyNl/bt/ c̛Mh>roΔdxڐ=^5q c;12"jv6"s`@4n|>63gɉyuy0.KHF?3cP$)K3zLGau+i?)3&ZԷ271'zee6( f` ƈ|"՛|FlP7 ):Q.aK\L3^Nliu 칛W$7yQ"Pܴ %3\NE d+ׄoͤc4ؖ,,fW(RHC4)-#¯"z^$A6R(Զm|gaŖ +jc75tr7=DY#yH=%龪^5K2dIm<k{D4#df<3SvhU/)q7wdŕ73{h ZFPQzw},Q4H@yYvԽȇ[">mpa$S6s,b?p? 'SʟCbmLDŽ|Ú\)[ &0׫5vrgd'a͐ vδP\9jQhp@شs}sPYz8&Ħat)zD|҈NJ8 qƀB8hVKθ{rjhH%j&Y^A{_w4P~4c=/Mv$bA u&LONե&Xpc"u۰mjb?(mi 55 Un0 `9(=R~HNB)֠ EE+T7c_ Ha7D< jw1}C(؅"ibT%z0!g,WuH<A?n 2:5n3+C1^s(jd/9+ 8(MT_&w todK/o%=>8qOBaRhxdbcT&ӆ 6ZkiE]o.?in5wܢڟ]K кH~ "ye=mcH,Пn\$LtbK#2}tV'oӆ`*?O *cg)9X|w~Qf \j@ѦA?yt{̢I(WM娰#U#R>O˷SC4)֭ 3wRp3_/Gd/t֧<N${ K=>K;> LNJQdxJEdG WC;RYr4 1$\5m6, HLnя--~i, ӈBӉ"UO@*$]*|s7󭐇,~҈l*=EMtB0?-e2c@i4AO@"QT 4E`fchb pBE^TB o`)&jJou x=4T,0uceuuQw $੐[³(y:;[ǰ8Q`P[B9}Jmqq^ lΘ{a_g?f 'm3d>,_ ^ u,]#=u>]ŝjg!+?S FORf(M2oFE_ B߷dӺƒB3^.Afkcy{ BlӬہ͎L?l[x&BU-6#g:S)0ޏ%8drDf&HY^'u' g8rן@rQ P"5ƌ>(Γyл/PBR@?̅w2DKQpa%ƙe?Hx7&|n3g_~wn:%1pb>;t:_}* L PڊV&+%Bzb9e5q{w`3p"N CH\16B6>86L B l0ȲFLF˽|$SXw F"$w8zH3ы;p^ ᓳHkFJwP-ڴKVAZ="v5Nƈ[Қ07TJbR9HVG(6,Q8 $$.:2$r>6#hՇw5&$K9J^E Ί" l/^1mEM Ù;]H#F"( ZzH H7AT֦ZЬ7j2.KӕdNVr? 5\=|o$謳:ÿ(?Cd&V l-lD?xB]I̲^-2ĺnZ޴2#WABϞ[_@PRl/D@x;+@ _-υPX5L%H?.𓕿K8hoNț L1pe!䕉vOj"\c5nji}$tQ lwZ]e~z(GAa*fLL $I8+ْk.[T\j%+Ryjʍ_eL7+ K1'LW[n*W;$ W-O#-`Т M9O-y@T 匾c<4>tBUqyj+YW2rFb6xWg ) 7V@єijw6+]pE뇴K*%j9;EK;[5Vɺ5QX.Q#:?ț>LJ #fR|9!.Pv ر׏TmZ1x]nrJ2UQkTMrbZ%6NFH d,A9-Sos 2D^!KwSRᮊ?AJYI  Q~᪨LNv0 L.6 JyOl 6R"S Ǎc% 7Ʈw6f~iov5 @%D`kGu<Lp(ÒgBgxH.X$ta2(OchVظyǗ E} <o,xJ`z=-ށQj80?` ,SmYiSF,-kOR\ bzqNUٖ'k:w[LaE[3ʹW *&X_y7[@>PpK X$!aZFx>T9w0)59jf#D ;s0x*]*̷犓!\}M~>6eNdBwX Hr9tFHւG@LZ5f_}4.>\nYßyOq.H.9vkڄlx:3%[0v||}H5(s/-(0V*72DMKV(+rI̲ngR 8=\TӬMCmm̙ѱfbmkǪaLVZO838?7ٸ~i$Do %i-p\M!@o$]fx/֞y$ _hGs,R>S:%3 k5\J,?X/fh1X,icX`Tw`MC\(N'@i,ę<ƀ7}odq`(eYij\@h|'lz JI.N9φ9,R3 6zΎm%*9rr-Eʤ $v_1zK9"U+8в,aXQ`-Zdimw*<^^!xQ=? n2:4m~{/K@jjH!w<3 IX :vb&"xxEBQcY (/v$l:ϐ [W!z0H-\-!ؽR-Z?CBx[yrW}r"t_"ހVf#͕ vgFZy\l6 L$Hj V"fF!;Uͭf] [&:+IOom45F Q=MYS6)Ңxz8?@y &lZGʒ;XXBcAaN^;3]Ნִυ(udMn9^';uەpoR5`o{J"Mhz8hDZ H+q觉sjF]+(qn\9UQ<5Yda2;ޙ0Z@鱗{}/-!uzY7gLI+`"浈%/62x8FY e=bEقr]^\[qU8Zc^{I3kro{;/B?Tժ*ZĦ`;4i(pWO`A|J1|0Z2XDw嗳"'Bg``=ES{x hTo H Ơ+IuT+ps1uۆDX~REcmO3R(tcyzÎ(̡k |Bh/l`wK( NI@bKGj|`v0)OvTG|E(1Y ,"ב[  7erM8־L_ S/oNLg F~AT-@_vDR%էC y6S+o)a'V9`dv">t>F <dz ci {rvl% s}s^ y|Jf..sSj~Zyvj5Yb^U1o״oK9{ M`jk$p&<"N5ŸW/W|wۻqb_PR؜X[-bC60*&P5iHlsi׼o[[ t -q}`g_!H l*(Y)`㰮?͞>+WVD}#CT0걔 J]ɟDjs$ WIi^t%у63ج.Ki עIRl^|K>D_]SpVVƗOwR 7їs:TyTA4FQ{_Ƿz$dKi`\7ߘ.]$\T:UE y>?sYxPu ۅх޷³%w!h̴!L(X%Z&0$1@PΘlj#8b:ι֛2^S( U3uh<8hr??FtPơ+=]-\v^j>IBb9z;ZteO[F4B@ kؚ,ԗ*9['?$.tDAv}G] .`-v8iY 5h[A(WSc~EmJ.yx.ԶTTI^_kz~[֞">iQt/1 {lm_&`r i~Jw4GJF82Ǭ}h|q2$lfh~V1Ä.Xͺ9۟\;5'՛יJ<%,_| gFSs=Z`vE8]69Kz:Qtu q9/$0v!ճr.E[_´{HL5;hCa-/?ȺX:qTAGv߀|I`c8 Ԁ:V-484QAK9SZʮ&Cv~چ~'  jnO̫ƞe.nʪh^GF-aX[-Sߔ÷ISjb=#ta2|V]8f Uo MX" fϢRß"HUPPĸR '燾9hkZXHcf2kF)7KߏmøbZ[+}\9jF*"A|۰t2|a;$VІ'ODjcYu*^m(,ݱn[ hڼ%`j↞"N9"E`W,HLw#>7sY mԱ+R䭟(g>?P^aI "~uS$ {Q8 PTm49[nޛr*X*LW--X En!㦟\/F7R玒&)G S8La\cn@^*Wf nYwvf(r:!a;X1=qʪ(ur]~GF`I3lp^1wuWX [ܡ+sQݟjA{t͕Ç c%GƾVSȄ) ى $h-XG X62npIв~"KuOr+yɊO~&CZ@pN4E~ef[[U ؝<{qxn7ΏqA3ҭq5j3i4k*Y@~kWڤf#KEZ=hGPn]$n)k蘴/#֛ 3)XYc=ASda6Aijy 2d] nlS񨇼I6-b_RqT+R,1K-W'SVpOmƅz)EwMk Ec ,e\IKoPRMoS}O=<#[MmTikiX:Is /kab6 .5gzY$‚cM.өl q))~o26-i=S&GNPBFyIW^EUU-<|Sؑ~tQEPyr(t4+oҷILZ ΢k?>V(zĿ$Aygh/ɓn|Y6' pY//XNKuoE wumla O/1%9$<v+(Ot²GcE-u]fPc/+Aa`|aQNM|rvE`r sdݳ_~ 5X"mܹd3!=A.n,%1b'Eh9* U_I{SLM@4sò#*; 5~?2y@-°yl/,R>ٗ:qZb\RK\b6W=bƾ+>>!Li`l,f?MYg)U V| zFap.晙>T<b X-z^3,[lnHDn:/L^[K{&*C GHZ§{/uu.ݏWz#!6qݯҦ]H D Y X"6 )։Uk>_}5[աc5maMR#*o\Y V1vɶjX(C?Em=neH[ĈODr~zw7vQG 9,0(@-΂*@ REwC+p:tLfc肜n.9sT^Fzάh|Wp rj=N6 yN@WAiTʓ֣xqL-bz'v gޤĺ^MWZ胞!*]Bi{7'GGm41M.7}6S;7<V!M q6;h0>C>'x,\7>hW" I gŖ̜&qn@[pG6y+џ!$Xtwt"Pnc6r!tkXɸr#hM*qǥLMVegjޘ=A3m'ed#h4_+ 1um}|*a1ς;տ0`9t#zy sHMdL7N;!9tCSq5Va3x{곶4윝Y8rk06 '`|eAN3,͝6':NB] dy{ף2`yuegaK`E۾ jL nʴ'&!o ^ ֭AvM mTJ^Zq> 1Ĕ9TpfZF,"6>2dSp;\Z 1g6Wp l~' -ѯb\XdYc.,GYNQxɌ! a(yoQ:pqK&NhIvD떴g`I7SXv4T$5ܫ`LU |]$B纺O2r-ǘx^yWб J M&`B> +AlfvDo- Y[!W:-Dec7l4FJ8ՅP sl,j \Jq6E;8jÈ7z$j:FxYTn(B޹vкPkˤ;H!|v&0N6y/&UcG˃wڪ?"!&H|t\HYH P a*B,g @K2Lp+/R o+v)\j^voƇȘ7<M~65MttZi!t{C!? ˆq 9#z|׶,:tl3 %lC dĸyORJSbmYp{7$ $y GtPZD5"hKҡk$K@&p 9m_)qCsNSP/H7-3ۄf '̰qE1rO0m= ,&Oj#O]+ҵ~u✚#U'gTyKU'X]~LFz0dR,ޠUPp,5Qcu}`K]()U܈<1S8,L"k\)LIex{|dY *TD-W Dbm';ETݯVvE+Cywu 4"<1`vRK)K_O GWm~L!6.I5em ś"Uduˠbm0B5t hx˪cP E RGZ< 4Nlr| 'ӋqҠKxI*Wy'W[ʿ8L["K1KRJ-c+T|Xl1~a*8tT Yd" ֨- $ӋTY@&T/D([BKOû$: :2Gȕ#/ch8 *8㋎eZUtW`t>͒ KT-H@G/j%hDVF@zP.|GHDe!,_T1v/Ͱx)_V|ͻ?Ԍ46"1gs{Gü.9)YλNޢހj T x3:oAN]d#\#Ryɕ!W3d*uo;ژgpD4(FX.av.jRkZlM^Lr7g |.xb:bdt _xQ.F/=/*)G()dwZ:!V,XɆeDz$H/vȤVӬcW({84:O tb+60uiX) i%F&ն,E#-+,md$gf~ɛ5 ;闧RgA3MfJW  /rdܧ(;MpWyDxQ'tUQU'(o+W76$* TeSJA BDmba2 5 ; DI"| Wf>9v*i*YE[~]c= O+ p"Vdc4 J8j$-3ч%,'w Eق>w;}1~XgFޕzau+j}wURŸG{4;Ygqjg:4~7'Q8­g 4\PlYKI!c=Ϟu,yےFcV7`3]Ya^5a)wo&q"cd}F'#n/MIWA&He+cato\67~0#I\ HeKvh Q|F|̪JQMA E?sf充9B;},h]h_'-x”V853G:F <۶G/Yo.}OG!ҠĆ8ikUke%ne%$z]Ԃ9H_Hr ō#5ޅAr f J]oGI%Z?dHa"rhGk/Rg=A}woӌ;n;ebX<Ĕ1T6סWCW%$\faꨢ%nbBdwgSc{DEf=a"Nޡ<Ϝ\%3 e$V9dW(U*B;U~we<Fcp!_d1܆ܐwܞqePtqi]٫R<- i[YkUѵN҅#<@tj {4{еH`ʓEGi??yp=G.o_kH+xe)RP]WrqG_Jc_KNP5Ji v'$3⛮W%ԛL}q: u *aɻڡrgzqT]6 vNQ3n%MۏH2d˛eFjI a{3W0}Oe17G˴N>8 Wrn}"'4HwBnPkTFʹ(|"\oErwpB&qc3v` gƢ/AWYq}d D;+O}!b0Bef{1Nh&|X zyz,Q*3 *;*u"oXTCS'Pl6.Q}f^SR9 p.01_~ZIE.Ɉ!Cm\2W >uKTˬ1@B=tBQ7\S_{+vw A ήрDo%qvs)g/2ZHj\T1r+k> /oJ SևmRcF֮$Ul[]ۗJFÈ=QK@[Eϥ<:4Ŧ?vn"j|L%֒zyl`~D3^dOe6bKoSvc7u5I7 me HeZBD3Kk̔gQt:W) =V!4u0|~xavi > :d=s rgLK AYBJ>*F /od2+(]dBGMG./M:~:-Zz ܪ%yjW9,QBK39 >'|p^kŅ/Dz<2]Al55O`H5fođޖ vƣcک.Zh' 3- >lWgRk.%߱9&Fwuy f*xB,@ŁkUpJ Pj)0JmS/b^v" u!# 1j5G/79wD-uWzl8$j&@ 3N&#EH$wyH>]i,UcKbZa-ۿ (9ZrEڕ[iQre {ю ]Bk/yKẙ%Ez&>+go'[.(/<*˝߅5]2 eB%`rtQ>U*<2e.@ D¿9PQ6lgiB91r\")NF5*NB5[6Pg(j|^wma7Is苡$^dɹ;T}^T)|H-ݥ!8Y-ߟƛw5"K*R=^e_$l?ќ虥v"96G5ux78kg$hZBJy XR -7&`͏> .1̹W+9zO5e)Ok`}&$ySETBhػ:[i ^o>b-$sD#fLvZWruHdW 6e@ۥ D1nw+ƟܪkEa̮`w$Fu|LJ,huGo̷ ES@A4BrZ/xtZo9W}m >;HDd:΄j5_-Jkڧ ##=p0pa`v>+ri5U^P,_A$BOӓ"jhR}|l#RX]2) vc'"9=^Q&&7Έi'U#<}@-@`#FH6d>S_p2Il $pt,1֥6uyDÜQ \S7ox?a!p#0O|l@.ʳ9yZ&K+E> /'S!o{=EDd2ٛvW - XJ7GLQcgF"v\%+ߴb2Sf4# gqpSaf"N kOaQS -'gyV8^/Ѵ`7#c5}3,͙FyTB柬NT]Fy]i]/Y]! U}ț)3̩K8j9:lrGe镤O1TdY ^'1[7ޢJG+ +p IOŀ愋OyW *j Xl@ѧfX%b6Zpr^0MSKTUiJ욲u : +c 8: %#/k\YZ*;>; qyu]٩6tN/d7q2半iq'Dvj2"BasCA4ǠU/VzwqRì?_7>H-TP1(Zq-c8pN4)n@Eb(_<>|U;7Oyq"++Y֦xRWQdNHJ7/Qy鶚 ᬂČؚOM;!JY'8*D Jl]/2=  S:2LnC@ /uusC;L[4RN6$9og3EKPm7WA$d)`Ee7E6b#NPq4h`䪽TᶟN d*Q-ϩyC.kΑ@`|w (5ΙM?{$GƠcUudGڜޙ=ƙa7}m Ac3iX7WZQ:JxAȋ)+M}&vɗ6ؚ)ҿ_p9V[W7`@F:`;զtB|nqE͋>>{wx>Vne 4SUQzk,(ì>*h<ې h&Ɠ.4DG*rW;gt KuWM搜F[/#E$_omLDzP+~ FN =l>w6_UFV6> Fu^5)Il-pkn(/?V~,qU$d +QPAdfҚ*Z`tj -ZrURF? D#ek*uC_˭EĚ' ]xrbI{?f^En7A99j@ qwsVLf Gvg3 dެ ++d1H.*Ǜ֏ȼX]sB#-ޮd"8yBS]ɋr{|j4y1U5XS@4( !1TMŽ`B˔G dT)td=ޥo֖6 R / TcD5gNgC_ ձ,u2 `^^ou2 DCgQRiD@LGyҘ&v7klU/H^i$a:{űU| ԶxpOh-~g^9L›e_|T桉ku-RqzDH)ёvȀ=Z9K+V3`K/Hts,V"ß !CԵ]q {:'pzJ(I" d0 F aGȮo𑓻CXM,VEy}f. 4"3o[M=>sdЊZ|i6ÂB\· cMpjRµ# uuϳeԇ2EF y%'3)EW[uKbobȄ!B*X nx@ \:~$@G#\ Ǹ8=RW6$+QeQ~.YE o3,&mxlJY uw;tVRbT KcV5I5?u)K%R.[M445 ()y&aGHG| 6PW%AP'X3LrA]c7H6_G >M"V@pkK b? oMovqf  'MJ;=mdǂcXQ_Yr(3+n6,,L›UR]}Yq<79b,I–.޸rEW~OE؋YcP , myaV[`n:da609klذr4W@1*i|K4ӗpðH:tC [xC)%&=ja龦ZWyil J%$d/(%[h]{O:{FQFUϭ3 = +ƿy'@Ҹw%Fea T䀠;΋NB ҳ}.cw;ɉ0q%@ŨVsTřGݨT4o|YRetp%N:τzDd.HآWEK9?5Iʰ >:2L6p? ZX0:y\@t_._A(if00VDYQq(rd5$(P~  S#ӚE݈W=k~Γ*9X-g";C@6k[#A DDVlN_8${RjntkR: vQ߹`i(3<בaCd^6Ҫ\5Yb%y1UGvY̩JTK[]`ےdm; Mn2[{EOi@LM4튘6EwD-7/F8\n}W6\ITekvi%* ~h"kPqJʠ'goڊեy?pLJӋ@D8i~D+>-!BݑUu{ppuy$Ȩ v~.bƊ%kYWY4*VgÎH zPh&JיM1N%CSbӧ\z f45qAU% -zWz^!y! 8Mřf+NOSGo?U-Q~'>5ĉ2IJ~˛]ONj v i3ͼ` D={u :A2^V>J)Ub ]f [ k"ziнф䃧`c@G跚a"b×^VApC7,1$6JoR`y?x"E0:m Igds,oUK7Jz4aIhEN8<#]͇e9*'Ԝkt0%-vIkͦ0eŐ=+n!B(X5/yRC5?sG(`0݌HD_ÿc3u,IR" 9˘A9[yU 4zN4r)F2yqF$f_<_o!S%] ʺȁqSciTDXK^$ ;TVwq9A/afixP=W Đ+GtYY/`eNa2P6M C5e!FuA,un&6ʋ覻,VR# 9IdǶc5#"Ò(ZErQ _I* l]6eۢh_eJ2v!=e3nYgeձ^fӱ6\ةk*5?~ һ_qlНS8lt{DZ!WU1qk E/ ʆs?]kP6lRl@_`qgjČqb,%ANi0ݚc;x;%s[ `J]5uh;p?>45 )2شA^*2'fs3s8yeo,ءiCfKng3( # ćwg 6_VT%hUp<ãe^iTCK._6dzl $ӎlYub:u1i&6-PC0S#ݘq#]ir<Ӆ"hp-=Y <$ SYf"Mu4kW#u_9`pDPF& aMdD% )fQW)3s; lNGeĻ'GoP#{(|`Lre\T){\V|-=Aw\G C̥ذ58-ǔVB,!ҙ!lUP3 zn?X?ρrEA7=JG :VAebTh! ]*]isTOK(޼}/5iPd752si+yFo4 kk_R!C ,'p|&m^37!́6eDL]'aU8X}.L#%CT?ASNE"^2w3L*'sfAdAHE"I"Yut(_p}(G x}:ڲp7F_T"&r,>LsL*YiMCDϠ@i!TKN 07޷f.0v_v6V.ETt^^-E}(e Y NRk cI8وVE{I͘V_B;46Gn64kF38l=R}/y;7ōlF[Q05)1]SnW7-]08=avvЧFA5/'rS@d& (GXkݮlJB7^,L.[?gؗ#,MgZcn,"6nc<tUwo@W%Yojܑqh͞"g};<] |I^OX[M91O[Uo i˄Brk-D/&ra̿wBŹy[A1}.Q 0!2'e C%5CbGznDZ]̄VF,RR]&B@cy*B<#_^C@28A@x{"nߴ޲\~ig2q8`|!5cҀ X{^cWψ˧.>-xx:ngʱT pVÅ>ш|6 9ݿRQMWƽvicXh[ӅD9cL  \(} R4K^aF4>yFlOlZFf;tȿa8ڬ|8Ma(Eà韣MT4|xK!GJ?1c02I VZ6):9j#ﺜ :pdXߖE &P<HM:4xX ,'ț`M9 )^,Sc +idJ8{pK3@T8>{'/KQ6gl3E!FԬx*,,uqjoM:^ Xl[.[}~PɁͽ@h [+tZN%L,۰I,_5˺w.Yoqx)6Ͳ fzݦٳY.1 kbѫeφbp#"WwNHJ Tk Rzkf3PN>P2Dۚ<.n߭lm_ v~Y|=o剑2k5 ǃr{2@O $mOW.e'U]˞{wl\Z˯-hb̌ 22eAq'z i\tDbᡖ1_$O5w v`GD5Zy"08֖hSICߠ \ mNd;vGKaW3lTǗU^5('X"BsO6 2+3#ݳB? c(O8& $ 5:@M;J;5PFc[ DiA\X`02#ftބr]dG/G-hSLP ao= ֎oJDu ȏ [7UHaF/Q+By}_R,&Kv`_iܓq1|Txw»h?S/AsJC__Tj0LǢ UjiX[`" eqݿ ;L~Dg ʶNzhGlD_&Tk@\貕DA wda@w/s J⾝J«e,!`KYOH00py1(3 ̶z/3C/16`#iXz YmE&p'| `N ?zgtpq1A03H7(Art4e_ܷzNWݶs!+6q܎Q!ρi5&=XS W.ykXS7y5PKG߄s ;]->ZD2,Vj?[}K,A5١ϙ}} 7)0ڙ7h\zm1gquk,zɟF'N f/Ac7&,'2F/9zu}q;UwJ8:Ｒ EE;BqGھ7'Ue\}] ;U imZX@%#!PɄl['w=Û2Ƣ[q4SuY2N}9"Xqd ːoVXy_,cl5m3di1""j=*Z8Y|f6X/BI r+~V}2q4&7s$5f5 DW: ,\RQ] OwF"B7| ˿5]>&=)YK>v@ ]Rx/>X*^V6 o\H^Et 뾃j-r%Ŕｖi:޼n4-YŃeu3wJkwbkU4%'U`sula ֗y~zͅ }鶨D)(AQrf+筭-(,'ws94v /?(cH99oZ:'_z)܏0rؓZL@z^NqqZkfߧZ7Ƶ Ёz9 @+_вh'w!C*l}6П@c%{PM$4^|0)^tH/?90@pof!rR:ɈOW %W!ΞݣBZ5G.Ž{QWdIX:gvQׂTqvzRBXhìs\xS'#dz+}B|qG:߷n ih.5P`BhbO#|1 Tnk,(Л^03{CF/ƨNMm1n%^iڇZeKўUmWݶ5ƥ$\HgAiz`8gM11vܟTm̂4IǍF%(Y3Ű_'C'ձE&!W[q@26=BxK5A2XmnqcgMY-sѺ/';2&8pBoZ̲Sk,OPe6gyQ,~URV,ncBn.oǥy@4 B2ؾEʗ()9R@Bf/QFM:b; dD~ycnYBh#t>IEl5O8a4!h>(0|$"S¾- sjkxZKa?`qo?*Ա{vTr]̢g+9]p ?CXHe '%+#H3@_Jp0w9mlq ; [$7+Y)B}5 < u@ʤΝnfØv*<:U*I>tׂ/EPȧP|7a0S**j zh8W]?9A}@uG$Yua2"bs=Ng2o 0_l;rm)̕$p0]5~S,iK &tOԺ`Dg:6 vSa1 )>^9 1HuBnЙ#z_U2ac0\4ǐihy0Wi@z?1(|7bv1&V yمB`=Q!cƼE * I6߶fRƪS<7:ZUKUf$t(2KxW9nsW(и0 H,2;Qx!sgl:IF=mf8Sa)@h"'@wțջԉXJy2l.(i턬-e K/TG"E*?DﾞKz4-Mm8)AQEZy[Rc:}3Wg|r=|FAA>rEyT: K 9|IۭP)ۺz7$ABTgk#y*MМ;C≛|V(&f.X_,So%-@Xs☷f @YkLVV[`iW Llf`&~^ aD? ),yK֏W$%tJUˁʹyJY=F?0.#1y}EvڮG BCwtz]?#Vc&+86OqLC% c "-5wZHx ĆG.텨~iQ,&mb(ұV? m72|cMMSK $)&>Y!7q%[*G=-Dm桪|Cs{.ulC^(9vnf\k,f9fZO8k(W8+^MAUWkSփZNDݭpBFzd*An"+m+0ˈpj6C,7uNh.ֿ!ʜ3%6v]CzlYrȲtڇ@2DA#vN*_f[Ax.jv? ݾ>8(y6q(v˯!ӏ-\eY;0 #9+Dےh MxD*/ S;]Sqf|+ A/p&Lnoݡ[XK);-;PQs,hG$~cQnm"e y6 7&Y2䧡ٹ ol~ud4)[$[!D)ax]h^y$4>cyy :M!և@iZlN)!`D܇q4vu凍>2OEqh~&$Tv8¡!{Z?WBRfn^URSfNМu§1*M 6f^QRճ;C 6QVՄ3ZIKDz>gݍ>,U&M+TjaW%H\j2ޑ!QUskۇR` džxv-}QȪŦ8cMhP -~<:u_0<@W3{lYPjD_\nf}e)^uV[mo'nm+S^cyVcS2[Ũ.m/fmp4~OQݍsGݻw]{lF#-dRN=Gzi8 l 5O*5JFbhb:pdI D: !KV3t+B>,s~>eӧH|"YE"еmAl؍LzI|3k0iP$h&PnJg`=P% H\uިc"Aںҳ@ ~X㥷i@qy@G:ʅt銹jfYY^# jxu3ҥT`{[P%l.א&~ 6Tf4.oDg><[!cH|/vD3,iYFR)!z ׍"p: Ĺjm;pp:&ZRLJ|$e =31$FQWӧv+S3noۈeXv!Zp>~ouq&łIS8 b/dgZ/)PSh>z.j4H5I^;%m}`JBd}(z=/%QMsRZU^1> ׄO> [uev~ 8qs{KWNqZ?#ݣ^m84^-#i"!y̤aS2}2O%b%'4:qvKZ =s5ߦ݁n \\V{n==qy<'pLdoV'G괫qnEMd.iE 13m}wl5~# ^7g+3#ܳhY?Nw~u_A]mI Q~i2NF1 b׵͚'[TJOЮMS g$Y9gEĭ9` һcPyQ -[Cxq b\Md$+Gv8Za(P\WH-ekBsoB}Fո%ĮR#MmIG@#vG9e5CgfJHCn<v `wāNnAN ?>JtW3Gg3P<* ,̄'O"N?=$zL&NUzX ({gD?@8F!3-.YF,r"2xŴ2RV[Cb6?MC+Lb_l(E:!*p둌%`nc;xmi]"R6*7,A/֓gZXڼ'-5X_Zu0w^٦3} TeA.K+$ƿ?<]r/`ViWNmW68Ö3jbexӾMZ#oVz?1@?j # stK$pz{4EZu)ST[i(Bm=ôC gSe;I*7ÑjQdhgs4RI~^b+Tc#C#\=,@!󱣉S/zor`Ϸ'sY6l\ ""*|_ȬRUcc`_TqI#_c5}c28;2B|`O~a*Ai8O `g5'(mnoxBI(RI=+r_DnmL$0XqA($4]DT`Ta!d9H6lй .iI7tM 鉍G92"h WWެCU>u;wRgyMvĐퟕ94ݚNx;=S#>`ۺyR@)7g~"?qV.?o/[%.7MЧfg3pw'Ξ]J k&O- ¨HhAcq >Xz*`u%-8 %YLq(ca[rj"@#]jbX*#ږ_6<`QӖ1uFX>ѽF;dwƀB3UWQNKu4\тq lr|5PoKe߰^,G" 4dVT79Df8au$uԨue=$1ek/-:s@ 2K(V>1>.=䑇B؆:",OZ|PW{. i,EV*1;x0'7MuRBᨀ}:jKZ` !?)/&w.&qۤӆor_՚w#ZAZ=#Q,z3K21Y?$w^Xϭ#SUߨUu!jUn)56朜.U٥0pȤھ5pieq#0$1ܮrwcZ|/DaoMqD]ު\T18%LmjW\hsb1Ģ\è̼O-jVf7 4z2w(aWtrGʹxvJpPT_ۚs5p!x'[Im ϣ?MY|z~-R577-w$r=ok_J׏DB%2XN3a@ VoyƖCtCuG 1K}BjU4?7r܎1d14{sIAc:tAߗzt‚bX Fm]G2S!" G$rYh!<à {;W]*/tWn#KrI_;\a  i]ދU{&5Aw?{<U/BUQJ<8~~烆M5,a\…2 L"A{_.zG+h 찀2Hic(MBw=Xcy?v>[a&2Gz#.겯1|2p*]C]T5r;JGJyܶۆ N9VBE~'=A^n6{Mۉw\9x,uq#%dHh>m_C4oҙy[jAXvm']o1289Iwٿm1 9ga8]&D"a;_\D6Kf ZCr5YJ wo9 OC{S? =no6,>%}G.<&. :6lGdA+Z4$-/<UpC}&-m1IA';HMߢ|hv9c5zF vO.r|K7Dz[mդ~V֢2}*FmQn&(eOqr׻3jd]+ߙbFVK[#t_BUi*e;D+JZQc#DkzWg}gp SI~2HT-$/D`mX)w1b mJ_?iA\L>`DΉ,[7vlQ,dC(~X.4MRfNnZU9= (͋ee.M}4AY̶A<=}Uz(`Zf.pխbBer#U6q1 z$nsت|X?7^ڒAL'MdE3 trb+W1ٌJ9$uREA =V`D:~s*2yVZ@ٕ_Ab2cI6J}å?>6GvPhhgvL\(jwF%Hp yXsaQtʁ+?`A=aݣ)qJGzP`~ea-(4ivHnvUh{ Kms68per7ͩ{}{6V#'eBLO  "WC殳s |Rnjز[Zʦ"Z ^VpGR(rD3AVȰCUB^5 QP _(LU&`j?Dgٔٹ/f\;fBݠsuF9 PAtn\BpL$fӾߤGQ@x-ʭ)!7p̾DO>ޒ?Hyepd 't&>/!"0eCU^\ E*5bh;Bp0̙;ʤLS3,}=2G ß5fynj$`:Q *\n ?8,kTM!(2:L8:S g[_݄{ɠt7bxbk4krQo-2GB]Eù'T'$z@/āi͟;DMZ;%n HMJѶE ~$23GFNJueh|: 5闺 lBh100㮲מ =cgCws-#VK>mRZΌgHҟHT<$*LҨR-nbeG&R;UC6Íԕ|CJ3.5_7$- ׍jW o]񧖒#'jOѐ _#U>Jb2N dۋ E7-<4'biTAvtN?a;DY@g{oE`Jt3BAZYl)bOmÑ;Ph2IJGIƨJ$e7%TVEZb/6'BkI|z^%$RU _S9 Aңpqe=t7\{-i?WSh#$ //9&񲑛,NКQSxb<xClWv'9TSw;bܺḂhǙ^N8i{FQgr\ձ놉W&ZT1!v,$՞wH0]+w tXd,{ %8#wݔlC/[W_6# 8)3՟>@c]vc154CsYy͆0ftfSuR8zUz4s %8R85Gbm*A\/ ./}3(p/`A(nu>Tĥ :<֏kXs9i.{ I  CmҎjgKV.T?SJ7"1piT=˦k=ƷB)Hd6}#apG7%;GAke댹8f*/%Ħ2rW2p=J#,[&GapM**Zq5dn0^ΪˡLV(V)ScYA/}L'ӊ6}{k@β~|6*%` q96 X.npfI& \o- F4SV`=q<=[xd+V!!^d^5GT'GL~a;3*)nǀwv+!j-Cס3{ݧM8 &u6#P$꘡;.Abry%5{W ^tL݀1SDOVbh ݲA p̖X1Fdw"s޹ CH C]̐\KYqޥCC^r*i(iC q,2W4׾ 9C$740G%>G3?dv+n:Yw BA[-cwYT[M?CI{\FƧ͈͞X$Ɋw uE b|?S Wr,y$*5 ryb@V?|_=?ՅTBǣ]| ͣg^ }cv)qӌrI6k2*4,4]W'+$L6\Ҟ\[aKUlq.77p.ޥ `IZ6`e`Oa9{T=>KH`+{(b'4$XT!LS{& vZZFJ hB t" }ygx6UZ2Z ,fpW w,}ŶEywB)Q Ƚst|׹Jb֬1[*ͬFXQ0x ~# UA+8Ur1pOՊ%rlg!<]/mf>߷q&õc^LI/&u+ǎ'WkL1v%B<1L{plJRIh|D!a:d[ڻ 'J-+DxQa[W[`ix0wޫjPq AuIvHT?GyIc% :dw6^ow#^RGMlnuܗXU)NK?;^H }KtA﯆Fgv*Jh尚wIn쏐n3wf.AYP~lVk-~II#xNQH4u Rff쪟U&['}H3ܶ?,%;R>hmnLrNx&PPfΦ^K.lF /=Q^l4ԗB@@B!SUAE;ud6!qi8eJHj%ԄK\zWv z G'/RFCovkX7 v+ŔHfE3o6dyؼXԁ_+;L ip-$$O7`P_3wی$Q^\w8Ħſ1eQ!;堅@|axǭU\)_͐ڄ-! NXI;͋>p-jXcNag\@h95e=FIDw:'a!j<* {bf%[WP¡aїNaWv] $Q)$*K=?*ЌԢP'j6?<hȊ<(k3CKPylg& (aAn, (DhJ7i4|v܉oYjZAn d̿ɰPb/v {νRh޷Rs1IE1帯tL0)A6H0~1K+ rh4d$//te[T^pIqX #z3`<xR Z]Dq^ 46CE5u_R۲@v  #F |x-7O;C, `]_L+ڢNvr):r,wC~^a$ l  37}&}K [Sd c$F?6h, v;SvO vcВQ^a#ЁE,ݽm,Dqdt8%?(rQ Cw죞7<;NcLXVyO}~7WH&^z0E$x!ohnQpx5F[Ć:Wti%<ռNf:~*_._WUxðPΔΊN  [̼ZwtKp!+SWB&އKGb)){ެ<&PҾ`oXR>M7N V>s@-]g4: %iw-rw׳ؤW Eeސ}K)>3Ft%B6vAiX{M2'tWUvlm:^̃&w 't;Gq˔PRSo+Y&͂AZ3s Mѵ^Z*DjH+ ^uybOR'uw}۱/r\}г 9No^qݣ΁nZr&MY&x">H(eR«Mb"wUFu/Epv!jꎱ}!ivM`a0j32LS䮠ӅJ? i%ܗ̫G gU/FJWVY0 B5Chm"m)D(YSX)TcH`/Bq D5qXoKpW椵9)e.hIX{Yh/w/v #s}(cz ]QCBoS,е 4Bo6e4T{2b` 6Je:3P$}C}j%X.v9.fͿVXn@8_\OD4K0FA H+ʒ7N wv enYCX+ p>*Vj :3V;|G y V*tF6[?M1t[dFSVNνP9)O'"+ud!wҎ2ZΚ|  TeSp dq>{${Q3)Y=se3UDax' I3j>,EʨH /law<>X h(z;mw&|`RbKɃ~7W9-1]rri(+fGw|cFmmM;#3M|FJc8"%{7-)x׸t`%Dgu~#::rmY9ٿ<|v^xVJvOg[`z T9ڮ,d4_Cg*65oX2-鳟iLAR'狰+L=$TC)ӄCWv3:|pֈD]saS:|>FIQ-bdP5CDRrkͥAp jp$ $?/LkS%@SgoCAv(Yq8“P0DMNKֈ_)i0&1mkؐd \K[Ylm< /"VbW'%{ ~к X;áe؇H[u#\`5#Q{Nv[WBK|i>^?Q9fTtZ 0S{0N,"C?sSNuK䟭SC/MխdAᨘ, cd MjNuؔ65ʘg:T7}C5 JAґG(_msG_Oʆܫ4^N[ #^Q W{#}S t3V#3 79!s$7Ӹ.>N;FjL>@1_|CQ+Xd3y>~9[INɊnjS%*(՜<^Gs}فZO= %CrT2wg&Yqc'ʃT NyMYSSq:s\ kA2(S"Z #{?kdFa(kf.oX,HVQ4߈嶆Ӧ ؂h5Ól3b(>yVh caV-b#,'ΧD將pOG(Z'xBzKɾo3vK4pREx4 ,”f*ZOL!4y4Fѥ0Ex =E4,tl֯GݩPT^r䚹Mhu^vӃqS48~GmVɱrڭzVYnYμOGegEo7z*O7mHhk^#-qC_un~j?9\/ߪhp6[H=1ܑ8ZJ2\> uPM]vt|7 qӟas\Ɓ @K M+Kl`xH `j]d ,GbcsiI>Q1e4dm=zmn\6+tY8I4i lOkGϊ(V|.M8>Hc~ϣ9[/!'S:v RPIb iMTE1oZb~XTԤ/%\9<096]b'@~yx-#ģ'[%d S{贫:ʶ?Dxft)a:O-!+֋.CcLm475#̱-}LǢ'iB"ʽ6?pU60Tx<>:p?S'}B EК\,nJڰ_I+ϛ-~PL3TGߖٷЍgxՔÝ]s*@Bk GZpjRVWH;mvTo52]VXϺv3(3/cyː͚HBv<1'z;>a~pT\U?tMχhy '(YP5Ƙ2Xxf%Iaݽ;Ný'˘ujȰ8ǿM8nHC/jGBE:6ΖS|_gY,0/KF`=KT|2:Uz*j@et"YM&iչ,7°E QYvRScc9NH' |3e؆E-{˰2/rywb@=JK*5:}ж`SOmre"97*x : /(Tl~ݽ&S)釻EXRr7ԛ|_ԓ<a.mfcȠŵ[c.u]U& I57G6J MPGnX]uTq-b/zz6~$~z&iY8n'C@;;" wh,v-}ն~MeaRS!r쌛,L__.qϷkd(2< Jn*e ix 6qeq%7lﾎ|O<( amLti` B;gUJtEXz%3߄ٔOiI@Tet#RDd'1#l&AO{' ]uNrEɧkz\ī6RSEwYqNW:[M؁vFe"z@d5RF}B>߮~̬@쎟qimIQw 8}dKr}`s"q@؀pWFZǚQ:>:rFhQ`lE!/[D%8e8Ж*Oksc 뚬O y w^5$aӆ tK %1)cDW:R̹# Vc˜)$` m4x3_gSˤ?͹c G]@Ky49NH`Du\t2n.LpY~nJ߅:l8cQ`,:FKR5c[ε!KmZ"1x^J}r=/&b徻5%w֧+ٹ2rjy&< }:LWe=Aʴgd%rŘy cN Q̗I/o<ǵ\"rS15h@P@^h̒jjW( 2(koK(;vAd`.T8{(^Z;QsVќ@Q&pW =?Tq{ϋ<U8՟MhV%єPLb7dʂǂ$>l[l]R5BŹ~ז+{Mх&/ܳG}H."Rrf$WXh*tI Ob(^j`Ԙ"TIO6ʳP!"'j5r93.gĶZBB"=y-yv$.b Wʑ<@LTyaLRY?́~H0O.[o('B8>3$)M$jxhHZ; jN6N| Hn4bψa!p7 B~w$߿qJ0; Nݴn[>IiQG>dV0P[3742jߵ𤬦*mY0znhWè6LXaA濥 5%t!3g*'=1 z>”F:B+:t;ڪ$G?: GkϿac F5>ɣYaCnA^a  CQc vqW_BKq-o_ti9珬UZjQ@\VRp[u(5 ע(Uz|:Wf9<0rߏpEp, 0~q%&qX2]ErNqa>o" 'A8%sn o=5A-Zàcb\/ $& ϯw*"xTW)=]wd n!sgkٝ,K_T%Lr pVA#=d4jޑ47Q)zue!$NЌz|9__a.%|WƳz-}':Hks~_twSH{|G-#/oܮюE cC=yGrΨ[Z &rw1¨o,]̓ I os#2ܯv73`>:(޲L5UZ\k&n2)7lW~x#dۡj{fi ~~RXr\qF?/ܝHachD7|3[Yi4z% IL6>G kh }:p-k?`*yL^šcEOxXw>X/H:!CPx&C%e4-]?0$kuӞyqJg"mB;`c,C3R꼠w#D)fENpD~ STI7ȋrQ瑆q`"FZVF?LI5Ӓ;1PVбe0pt%ƿ|B=G Nn)3 -m2p7K`0:ZQ~S|kF<>|N`7 ӓx 1Zpq@6Bh3!ڦx&T`ahKӮehD-AMh4&BOVuj>yאIzq. D[Y}jDXc+™2cLX2 5EijNuqDDq;!CGPw{G>{Huϭ).jo?1Gk,c 9HSH4x9;A[.C^ka0:;Yբ{-t C 'jH$sW̆ ߍ}~_#vdD $w=m6jCH# o.21aH}o֐߽d܅of 𸳏_q r3'wd>L"w px>y8CNe3`RTg`Q_k\\ NL2F/:27o7 NH $fVk'qu6j*'$MMt5:b/W%G |ť>(Y'L,nИ 's$\!]8mĔ\\4ofk&ekr.`[ >fpnl%cսgnd~ڟ9*o1qID$E̗ Y6 S >ĭ-2 &B6Tpl0iu}?̹h[_FX9F?AQ{B͠'U)6rX}t^v2WxU;*iÅXfb12>̊/@AC$-` D2\]/mؓcj~d4gc 1Jg4/cdR/?o7i/fs~vC$9d#bڱ{LֹOlO6H c.iۋP̤$7K/X+bkv4Υ[ oeqd>  ] hb5ӯa¨iBpduCk.;D a~扖}T¼bh _m S T@sqSSC~VպˁdF@k+6u9YhΪ8lLc 츚е[Z^ a(EXa[/GcQHK/-m -)/D%{e9DFobEGgvXdg  3❑n(е>G{Rx#"NEr-`ҘUFU 1Y%8٢6BڢuP-Y±ܘm8L9X ܦ >l&vr))|kB-XvJ &1rr}Dl\PCq/_lf2%ژԸYDHa:`Wԅ⩦ dٕ87GcĚ侈7إGxƮ˦=Ɗ敹q?:gYtGp;`؂Y+H^EFm*!;G*e-= Ҫd$X.Uzj)7ǀoGeHriROJ]ȩ`3Rd_ |ێlS̍R$l q!#|7' e:DC~.%C cI7g24~>`E̠0 ee[QW(ltMeڬ`[^؝yRlaM>rd. xA80c_>IuhCù|'BĒʭɃjweK \σ=mZzb)= dIi+a{r*\k,@;G4,~@@~dz\f(c$ R]E/0@/T\p؉Ap`N #jC1;Qu8瓘ј;)NG,o-Š੦)˒g Ǐ :X)'R1=t[)v48e,Ҹ@T^:!˶E&D R@E E^CJ}?Se_X>"j3GkJiP:gGDQ62<"nޜ;!zL48Kuh:Z.w|yϣBht^iJHvN?U" 8P*ɨ%c[Je(./ tcjeK:צ>9}?v x[(Rj C)| UOxPF.>Z GpNnl݀@0Ժ DJ/mGkDxl[g&~3 .5A=|^iK?kqñ.lԀ-Jehmn݈kzpQɍ(u:+4xz +oO1q@*Κ<}S)͢0R]3ShU7Y:g}6 F$'31 V5ǕlS,Sz N&1j>PbP* _TVB4BB[9<@~ ]kZ }r2/qY_&M" ܟ8@i{l-Η_MւE""> ER#~`,:8ϝ4*D}wr+ZYsJd.o}q%Hm a͐! MMՎKo A5 VDOFi6B_?QR;Ø,tuաt%J`Avn8IKeՍ.ػC3םqkRMkI(Weu_9ȐVƕ)jU¶Ok,Mb2_x9Le[]3^2!$U6UX`ry.*A=5wJJ#RP9#;o(K@1+xϘEű;$I߽ŚhDeӚ쟒q =ʦz|= &$83'Gqv 3rZ|XBt T2f,KYnMhDSz;9ʘYX2G*: K2"zJXrK  \s**Y8t:uZu}d=_Nk35 d^bdZ. *ѠG,6zt=o1^`=v%8[۰u`dӻH~$jq>'i"dǍ&\Gsk_oR ١DкV$;QJSRM ?W.`B$l1y0{jDsmeHB%j#u,šLB^$X nz0lKt|LBn*XUHY@Di =? ңŊˑ2}U3~Gab ^PQiYk.WYYnuN7hVRc}Շw ) /Ezk2coҢIL"᠉OK ͧY| s_y S 7zIܩ 3~(EQZM=8% $Ǣpxw(Ex"LHV3]}8*3_pe:59OP*Z熪~ZHvSBYu#a܆<:)QiMj=Jv!ܨ5[\ ?EVk5w:uGJ; dk-Yb$H5ye͈;HȮPh̐@%H+-Mϐ/k5?r;zT@ ޷.c)jsK?{CwA ŁV$0 :js|*ڬŔ% -^ "w1 G};2ȧA[8GmG\A#1EB ݀HQrAM1p$*kf%9+cßwj)ayGMg7B0ܼ \AZ%2>we$f%Y;/캃S33_d=x38'ӯ8㟋!0*gY5XH<{h͛]$T=4#E7~݅^t@)]X2~hY6*{i@cuoSZo  "(O;F2% sz="{YhʢJj'.\| RHɉXRX\&vDi 5!L_Y%0BI>jV珖',|5&\!UƪC<zOX1.͂[s%k4#&jXqרæAB̧cV='SQ۪Y܄_QlHg`Դ9[ހhm@|]Y4~MRx+{2o,ߍo@Gm~ֵ0=;b^^WpPw3$ 7I#*0Σ7!Zb^Nw71v~iY~<:00Ra+ %ؑ4~hX>ۏ :I뵈:'/= J mVaskp+[Ma1|QS2T8"t2Q&sKvoKdGtS$n[~4/ uŖ~FF&t:LAh hYb'0#7#-!½aicp(ajFb\CHcduX.PPm&#+c`tozsĻ$*_+jg7!Alڴ&7wa) Gc?Y5ķ?b<q[qeN}t;nKJ/9TA*XƁˈgM8 tZ@X+hO u9!}W"YG.5-z ŋD+a{$}2i$7ЋQpŻ'*Ewc,2%2a.eT.m{F 5IeSÞRbe};,`/HQ[2RP[b n@0O6MLz(Ő]TNG\{⧜#Zsh*1 aWEbMm53 ~F̾ |G!@lmmtY-0KAgme3"iK]Z_/d[=h]2]7ɷLHޭl&it5"Ÿ5GQfxQvmr_GO+UgP̲1]W0+s5F({&6HAVc_ {Mb򿹙EvwVc'B gGuޝH2GzHd]dABdixSAb~غ kNEZyyCrm“6G Yw`" $ItU k dOVv L#a=1br!^uM2 {*|3׋ e=~[%ʈ/,Zs$j'"U/Z#7[% vl'. I@A6]AseVO<|Z hse8VX'W #q]37'UI5 PԮ@Cuݒs*˪! a+Dam-d}DF%!ҥ%.d*mlIӶθ5,h>)Gnc/ӻ2*>)5jGJþnEDg%"  B3kK9o~$;N99HRM3Q:ȝ_+\f7b!ݨ }p+qų58ʒ3ʨ1L"_F82Cg(ay Cɿ7eûm5obvh]qdSđ_17igWv *އVXFg&7wiG"u'G6P Y,pqR;y{w.E3o&AZG.Z+u0Z1.w`SWOؾlq r&+"Z<jTޭ!ԍ&4Nw=Ȣhkf{8^\yXZE q NA ^x`f79~z7|ÿql E^g{x10=`ko4rF]z7td+ʢ>alSΝgE6^hTzdՓO$f8ai_T!]b%gtN&f7CAmښ/PTE:W/8|U1ݯ6y PD6 #7NoiIw/ʗT^,Um42 > Whrkɘ>2qb؆qk4JWT#FClֈX;5 l"I|XmtJ!@?N6Y %H*!MƕڟE~fAmEgWFUArj}QGa+20,k | BG%/ʯ)Kv@HAb`qLr5݊yխWG5m>e~~ϒ&a<,@#(WOQ/OCN]DJVSVொw}gk!x;oOi aeC, *vn煍fD}=KeJ]9ED?;/1BAgzJz <tQNKz o\!G Xd.*6 bLc!S:# ߐ  /&5i@(R}6vrQAMf\49T±yfw?}ɠM8Ÿx4+5hEduԵI/g^^c-nbS~XU՚I8iV!@/vۇ%h:gՐz#ܠkį!mSOS[\C^U l)%3%hrEe:FIP^)=Iwz1$EބY*:z笯@R'ޛS,O&I0F;x\b&,ϐ9K= Z4]}-hK(=5:.3S*?ɂKwl> QW_ThiVG(KWl]|? ağy+|״VQA$UvPv1Nk]y9\.H]:/Rʸ.[nyRVЂ3dΠQmrLՇ5@Dª0 -jIX|^7dRd[lz7YƎ5g%5l];=rHKvDLG)['TWФz.lC4D<+><*D}S{CϬbSGo;Yq30wj7\%¦SHEʮrK >W]J ^UhBed頋HLw񇁱sڎ|n%70o:CXӳi`O73$fd?,ᥣ%/r( Nk$j計ʫ{LG'ט2?Yh r>t?e;Iqqm1x}h.4>ds *-kXp4 3L<7wY~'s!x=%hn70H9c?M\YYY6PQZyUl^;-ƴBB/ =[b0TaD ,\f6Vל/wL`tvMz>k6X]^7Gw(~F^>"xV|:꼘.@K2s՜xiN1o )OT6}]]8[N]~ 4j 8.vN`L=`8tѓ~ rq9S,fy[<~L.P]=epXޭIH/K[<`C&\ >^fl6.ˉzy{mtk49Kb}Pr]cHݪW[Un@JNV!۞lϱjDiNC7|Jm~mZoI:#oCLU[QBgD(-I腸aFS$a[8@vL^4I` /0JEFjXؾeI`;ڲW@_I*3Y&˷c6ߓ-OK^!m?LGT)^4C{"z_gSCe =N`ch桂>= (Yqej՜,*a 9r`HMn<ۮƇ|lYE8QhGB<Q1Gͷ L# }ՏM.%yC|g<&T .ߒE.ǖ%AEa]$O;"Lq0)_s/wyٷ?9b(𭉞 MbM)2ae}p= tgf؏\l:ە<;<*P5&E\iɇ{:nyՅ+õ 2\Y^j|"yU+`}'UTg0!30 4#&$dU|<9o?b3։5brGWbzOM9&0 lH2:L7s@Z5Jq@|Q0&V _m.5f]l$ 4+[sEGiOox4q/!vL-)>Ձ[7g*){ _2hSmdau)@_ۺX~p[1PQ-6l q(<OJq/N- BوR<虃$ۋ>'|RղF#ׇQ qRLj^V7(Or͕1[us^ߍ$xAP1zolv!zOnHw;`>ڽgDIkA]G`Fa;Y&m%n\֚^#.o:1pi2$~ۮ|~@z PWZL1@3轝X3?ݽ jP]Ü1dV(g>ϯLX>pÒTv]pPŨ~"}9B*,=QTDwvvS]-r0/޶Cǥ(u*DLlasȒen"N'Y>!nʲ,CM'1fY9B?T҄-p]%^޲& eMK˒bBnF)љSŦ*Q5=zN+2Yr}lj?6pRtez1@5ɨ|+ X5KCgէ}CWk`KdR0wmܤei%EL&?E;9Dt[iFv}cMV:OWBڨpkdlr~KP"pq~83ŏ¼' 'ē  $G*[*z(xWUPo@>sycdSea߁o$x< @|/# LQ7y D;!/P]NXj(7κ'+C>ug}TJe*6fɪ7lnET0} Kq4*WZ>M ;r7<9u^tTA(BaUu#ݼӈS_uQX xsv7q?|tff'a7ɱ^j՛؆*.מEK(Z${-O3z1 JU߳*GM& \1&gR3C,3,mɎ?/m,} ǯ-Xj}]48U#ڑb4{@sgB7Exy˛v{_`oZ>kgX !MCY3 wKUY13B>\"ќwP!^a"eWd_Xp%X'cAzYy)"A^ßPr+)63 *`e/}f[@ȃL,mJ`m;֞E_Ax!̹+ףa(J!gI~7̂~N9 H?`+?ۊX5uKg~y& ]+){t~/ K^od'%zR$W:,wrmmW!4g/ a $sI0~UӃ2 {#AaJEfknp|:YuzSFUL 0p^}< ?b5A\AY7iG{"<%:$2*5Z1Wwl j'qo@0lg~?E8 :#ki r3XVrYUb0À*4ʷW"qlVFV `Fs{ڞc "VF`PP6TNV$*ֳLe@k4ISRqmrVY|w+IDKy12[*R**Hc94/;0łW/*TY=K!e贠Aœ96S!wQ.(<"J潣a{G!64 VÃ`MrB^Hp_%[#m3_e>ȇ@Q߿~B E.S>risqs1[#>q]_ FQ' >i0e88Bџce=<;Qy*de\tIO@~{RB8JNB#E Ey@Rm-\"uy.]/nˆ\Jrr؂1%9dlEෛ=m S?o&gHtF8ն6'çLg dÓD L%WJUMJDlz/mt2ꩶx4)H&-r0)vOן(,Y=Ph)KDjYa["GBnC/{ wZ?DCTpԈm2tpt$;w@xcyܚbPZG{05h@=䉒lAB%}|Q:]iI_L͋_+*)[a(^xejЇD 4!Mʄ^'(ͨ716);G&Ue{$OaXvQ/{^O8.B*46VU"Qbg%siB BkP8bIt>:ѺLBn`H|tS)JQxdDW#;Z':A)='S #`dۨ4mex*z RG/tk JW#|5 ^,–f>_+AڶR ,'DIYġl$pl6žV+Yp 5gHV4a d*QE%105?rXSaj<`DpԆr`V5!9E8L-Q"|4qQN_:i2ⴐ4kU:b%#.Yo lm1UP]1+  2r9wNnw|@AfnyHޥ hBV (2 Sa#M}v{Vy%އ$Jz_:Y'tлcLzY`َߝajSirO먋 ʦ7-V=W,`sٝ_ON7}⫻crz x$0<x^kg^(Ba4f68u%+j(s\`_=,N5lPb#w@-cr${E56g  `w{πE!sS@W<"j#7EVv&m.:4ׇxfz>]ЗǵY$Its3-^Fet=n vx>70J dp<rq4tm/OIERIt `)+D45|97-$m FnHc-H %|wӰ͝hn 5GbaV3.p(]ht fK(E_aM}۴Ƞ/;Z)?îo)Ro vqY/E#I _I}!@\Lc3ꌣ*mƑrgFKF )mD͹$Ĵ\M=szڡ D7??$'cQ5<&l2y-ǂ*}֕6Šzۢ̏>_t.VGfrA`ڵ9t#Oez&fwH{/Zֱ: VL7 `"75k'Hk9ukȅcstI󠀩L&؈PIn.KEYU_[}Gu{L&`5 Ԣ K2~cu]*׈Mwʽ&a{uL+x8K`\]OƭVnV~a$3(v'98rZ$ 4;&_s~G%`;ڊ&TGN`;)R7z_uh  :ZJZב $jo&XƼ(s_۷4Sk" ©/BaܤSw0sXuP=Z^ڒ[ z]D\Q|+qwp6'\)ٽm_7DB<~]IŻcqDېmYS,5VhKP饈ػ֩9pD*YFutb|p74%ܦWHTM`4JgQ=V@;\Kʢ6|[6!t2R !HQ8od/!8Zك#:y 'K'Ik1*Mٶe.,W&.-[ifVx(^mEo4Gx\#O)촔+7{AU>ss\Hq޲X2{V/!`1' e÷(hO ߩF-:*6XSU-!N]Ucj4u|ea BfpiNW2i;ɒ /7uHײf;pKfְW.ʝ*Fj=eEN އĴaٟٝgh0lbEα>k<礗"ߗX Rg^kh_aVf\nWa7xGC(a%ra _v,R(&ET<;qn+~w.tGH-]k$Me\:$ sA3`:XP#_bpjX \jyz$D[>y,aR"~5!𖷼jhb (HV]),ědneWHʕn6)1w=vG"e [sU\쿹Vpւ_9YBqyܣ!}cErPN tߠ-9u/ H6AKA?(݈J@0qV{AݾBl*мO_ [,`h=4=;7Z$  x\e({ᩬFDkOoǝy\{2Y49vg6+̫+j[d8Fnˣ--"1rmOZ,ze&ٶ29rBaQa(Z%jcDbî!h]O{^M+X=R1邧`8Dcu,J5f |i"I1t7]uEjwAH0 lI$_};^ჄWyxwR+Wntb u 4 ;eqKQ7hSypY&0+ v7>?g\wLj"j^¼k<īN-lY*#P%H`RWjR+>3-v 8<4|J:᱗KYjJZ/1 8 $<83:6I쉎KoYAG_D Bia(d>GcieP!\){L> IᰖV+B:MdMOBϑaITofty&Ì8`4"K76jZ3G rPjփ;Oa.UKp_8icx:(uJ';~5x= # GX?^r|xs> 4G\Ь_($M%|%m"$ J~J#rJ``oΌr7H"ٴ_x>Y !pkG Ű 5&ZL2#\3}SؕTEO;4Ǯ&t5V3MI>02 Ђn%XîOR!y{[%tYüyrdW['>[$fi)Rw~f<763KB2[ŊRABO^L7 (H{k.UtzX!^"@ Q |>VQ,A-Ut:Ub9wK`F ͺi2ifyP2`m<ſ"jQIef2vNAom_739%uȦOQ] 7A"GlVL31xC`--di0}<ȓ gMM %!}].=NfXRjЛwʹ2J"~?qCg߆(_p5S-U#pkFx@BǽtĜ螗<;;(KBڌ~h=cX#! C@PW'x(S m6&ug%籯C!JdF7"yU\I,y:z~5$\KaOfބbEI@AF6gu;G]i*ѫIj%(`}TXB>.cKG_m~/,s,BRocgL ow̬r,K"מq~D[|-*tOgKZ:-#Ʈ>P㒱ᤁʠNPăފtW*NvKbq'i 1{c@yxKsn" ?4]nXiRP'srM6Xlѹ/ pω{<,C6[RA07/P} e|TPIKb;jvHFIzQHBФ7""_e?Toթ 6o /~G:]y"kFjGp@(2p FO({(1[Ǣn]_^Y7yAr_)H VOIfj>UFUF:hCLRbzݥfjXlM% FߪFUE2LXH xQW[+b]I?_!cl?? g !ԧl$mJqpX_-~KEJZz|4%fX1B3P]+brdw:Bű^(,=|:TB/Grg CI_U9@Ґld0f}^2V#+ݎ8!-S:7Q7uRNf{ejYf1fiŷ b)Q̼Fm2>iِiPgVC又ӁlYN |95ѱ׌V51=S=LW.)c1c(x86*2^W)o|j^)wVX vg+G!z,(7(PB ȵQ,G0J/`]LmUq+Of&G+p*\"6Ȝ'T0^Q7sl#^oڌ3뻂oB;~vHz _q1(7$Qn}7z܈x|[ E {Ffgae8\eʑo<>xF x׆K9)N'wʷ&]dzW)baCV\яkErc-]V'b/s[s\DDudg|  }r2i i]ר.uʇ Tҁ*u,c(CTU@z=-B x !D_ ŒQ}CskĂ𻡬$Ұ?شF+ctJr6sUz*/@8H/g\1 pYHx,PUAH =&`^S!pqyg+,JzSl =¾Fr.r\yD*} |_뚐AD"ëuj qQrJnH} #v z#&®2TY)ﭴ|ӡA#s$ouLԝCf7bpfHm|Zpiﵔni2A_ʥM<Ȕ߸>1\iiDPqϝ&AbT do OƘC\-rMhe>+,Y>@pĕ0Ѓ0S w^" 9mԅf׶R7̚BO$ߣzƏƬZetnXF+=7D0чnc,;F+)b%~\:  YM^.:TBuQf5uC'vLm2r>!0;\ǻEso58hT UjvoS4:@0;Tq[+@:M˝sd3̢L'ފ{ܙBF_{6b0Ѓ/bi]P !#!w:9>`BRF񤁤 !X qR=~"Y k-DP`} b[P?A\!-g*J"䑩yo0a2ʢp9&JhY0F q,M(ݝ;o,_F\ ͣڙ*GP^pL[' 3e).r-o6 89>7#9,HY"ݹ"_n#ѕ1Rwkb *BNsE:nfPX-h -q]؇vi'lܡs7XlwJSv`L5vIb\V>َ&Fd3dx(Hū.s']7::W- wyx>{PsEc w2髜z G5FJ qۘ6F ,m"j4h{Ğ SL4~N"dze?&pZA;(} Q^DR9!eρ5WŸ(wQXn+}д'%i!g4Qc:btd`:r}u  B{w]OO/ [w_3v*a%(iRt0!.'˥hkWR̝Raz^Wa(,#0R )Lj0ze)3 %4J`ByVuj-I=%3P)k{*<JC#^ބowbff+2{$Tg nnKd.J8|( S PX[\v&3]7g—[vXXvybP²'l*iN7d qZpt(> N:A=3Dp!iSǓnԔlؓRfq<$l*d6 %)94/gߑ>ןvjpxX 4̵Qga^4{v۳ZxI{Ͷ#;~ ݊g"*Q2orHa: ,Odh5v:'Pg=Tx-Մ sk$31n!=PE׾˴:d׷3V.br}\ uwp6RУ4X)=?Չ/zJDbI$b0jBpr_pM ]4>Ԙ4d82&u 0h[mⴂ[1l6(֭`rnEy Bm(4Bd6X8z VC1"A6U,9YyG/_mAF_B#3x?"% 6Woꖜ0p>A*a3-4g&d=iۈZ}&} \5ہثHOT"zpiIHô1Dㅼ1!VxY6pvŠcsޅʊ8xKo*ѓ=y~8 Jp(AVuP۞N%o}jd-Grx/\kᖜը%a&so$Uc Q-N1#O╻,V{= L=MuB|*̃j5C?p-8u٤-"|YKAR/i?ԮY+X%|*cB0TH雕yFې/PÝ.Ǚ* إ`v=Gg(4QųG9$%sr̶sgle0HihM#Y I@tt~[-kHnG.|.t` >tX9]] Ϸ>!=x=,, { ?|qV:WtveE< F]]--H pP9'j\L$eizYc+4toIn_rwɫmcİ8qR$]vqMS5P4}ʖ^X*-y6^A!^7zTf.%uAaҠ_8rHT1[o:xAYSbYJe1UKgA8^P-obs%aU8Bt߽\ xLjz5_y=A}3FL02,؅(,\ToZhp EU^# ;dg&9SFA.";_4)ﲨF3WV7fVy|ةF>K?%Ԏ7S8;?&"G>,F{>u۳Vp-=8$gG dKZ/LaOʻ])|RΩĢ)Q ʅ8Y<ሿBo@@x6og<2qP\])c%vlZ-  Z_GF2#gvs05˿oə8"^:IP=-*, zU/>D08k77I>-a_wCS$ v/uR"||A8_pILLIm9xҐ'+% 7UC?&OznnH=ZFxϏ>5܂`&ej5)Exz+vBX8iB K!G,TLɩ¡rzٶYumF}*:Zr[vCNAQSS;MQxJ}zo^^P 0=c:';\=d!j?]4%ԇ}b zSg(0 pxxun'g$6W0YڂhU ֽ.UYн?<*lS4u$o_uGWuT&:m+ !QͱŬTK\ ev$x ݇spSV>ėpw$ a .l|*&.hJ6& 6 %U+RAբoQpe.x*O)@W~9PZ}k_^4i!m1q;HjG Bg$)n]]`C _Uh҆ f Twxlڥgyio{7_u[$PqԕoBؼHYf\#TlBxR:J9 \0F@V5tͷ8wRwX2<;b0am7bzXA{|tS6+'B$ z_ȋKbEP2A xm9]&_"s.kښޣ3jHo\틳9;]cSZXO#%mKPS?w5YnaG=`.}re}~@6@-H%=`jf[TyF?_GJ k:kъ?rU[F9_Ve닆u@cW4DtnK7j!CXOf`@+CQSj&C4/mG|Uزb!U!;luד]K DKOeqbd OVDҳ&>åpN=a5J{)c5^Z;]| Bᬠu]:Bk&6?wM>ۀ,XB-?%w3˗ d!#\:6uG;2mV QPLfFHs6Ů:wNfrt5sQ8e_˱sn9k yY%RM(_` ᰸|l'T𽗼.B)É: INt@|UK-d'v' uO>L>0IOݿx,wѤ#c%^ef ,W}Sz>>I-0Bӏ+Jt w`"hm)up__[ߔfBչwW̐O«i81f쁓ܔM 5j G#~ 1Rf2Ҁ&|P yrOBi{h?厸 C'*'{MMwDbD#qGY;x@&Ĝr,8i@o9J<\J)ί6͝~1IMXY.ȴ߁0 /|̜Wh^*m#fjBvD} 2 bd4De>z}5 k^Q0̇i wmm;[:F&˘Xь1o2,WÃ~#َ! ZFZ 4v**cc)ӇWJM0s&!jiú|[3DLMr1. l7~gAMEc7э*o.>|S~XGg4!_)8q +G߭(!Uäo,G҈}꺨:U+B"M%qFS+02xЇ5HuU9b6P&.|P*?7ztN]&eMWwǰ1W}uHߡ}{#3wWyՉӑp]z T+a8]fQF5'NhU^)kw.? :^lDru 1~Pg$Wd&:(A֢:Tua&krMs ==D XA4GU|A+XE~If"E4 ϋtY]0T$ImXgE~Sori0u4cd;hd"r lA3 7&Ig]RHq+#FAA7On9B9O񇱳m|1qqeqV Gk6y7;ʊL3W+?'uxc+oraG:LXRԜSXU&P `@'s_jspX]LjI3U ]:|fQג!j] D. Nen#ΘlGոV >̅^a!;c|&j3:"vƜ`[`#H+]ߐ_p̜jsnAp Ԙ:q~Yk4|dzE`W58_ /D.̥ hiTtm ;+|ׯk֝s @_b.zqX AbTDs`ɮ=P|gk}Bx/-"hRQP|/FMu}UiAǍre0}o]H\a|k5Ugq+]˯[x>2鲀='p6B@z} ͘ZՏFeK!j}zuw?bӃurY[BVw^MH6 bq4$hFھV2ؚCWioUݦzh,ɶ\dWd _JSyS6n)CjjvUιi|-XVB`snb: <? )3r? )r -{!7cd]"&f9uZZma^Рve#CξLkB@]7y"hը2o_d᣷L5hӏv5{2$&=ڕ`fuQ_+>= R7ٜ%nTdM.'d.(l}# \\`'Hf'9#7s!9 ȵP 60y#*Z22؍+B 2=Zm#jLDdNJ1o ڐ{vk%bXR QI%Lc:l< tDmm/I++p ;9vVٖu1`Ik\dF(Enkct•tOs&A#OhSJ r{򫔧r,9tw"x?"rnI߯bf+*{YEjF~vs½IYgeXWI.&5= FXv}H T)rynNنIiCp:#G1Yyz (*cX~"LVM6ᅭE[E!žϔtR؛ap̢ku|ع(:[m`F!eK<=C;& -G&< /#2DUeD1$YSL` k-G +`?Yʩ1UuFja탨^6Jh*(=s ñ8vǺr □U&N ]`A'mw#2\{O^J9s@z4R&^4xa=< +Pv%Aq.$'DcT{| ga "-P 1M4`!Qևh4‡ge(įV?Hdp ɼY9qdP[ Z$x-صD-gӹ|L) f?t<+E<6ZӽVfzA hx9͘sv䦯 Vs%i0ۀ7!3:?><̾3{{5LM@-fbwǮC5)sG1w$b^#jtaQ&xv4㏐=SA{4qÝ q琰Ͷ|cǝz!DCf)Pꍚj=f,'*[dQјf8G=bh4*ԭKprp4io [ң. ,H(Nk;i/c/-07opR; 9#tte;Wv,o޻:[ ? 3ԘC^HE0%o~L9m-ȜՀ|Iu7֢6q`; MPʓЁs5c-Hތ pSÒ]Bunq7cE)W8ub%h[oclPcУ\a Zwں(*W<"Y ^ICZ&TIX۝1oqYKwOm >IsڕLҷu}aI^F74a`Ml(;&ܘPL%t,DAlI :A;mIf+ٓͥjѤ 7C塚UK?d`E>G֥]6SB ^4iA$ l /p3qj=G+u)AXC,*D Ȋ20F ]#lkG>]`|=$m 95aI\_mFc=U(;K@|6)U94&ƄTIE =LPЃʭcuYoIpL׸92A0EVIJ1x*!匼bm̡t߈RvI$PױFHx| 1nk"DT7cKýy\%g/frH9eFT@43|AUJfHi!53P_]z+8!NuDT)X v#-U.P{=KdL0 GNHùrX[""#a7ĸ\Ebgh`;%Vd{I퀷A4ʽV*k DYɟB|8FQC@ų rb6V]1.)Ho#1 1T8I%Ga!j13JSLDu>T~̜ZTz)ȴoSmvL޼mG;cG2l &ׯ@:JXU T6Sd8! @hV;ZqFAl }0gDA/w:o 9m5jپ?en[4 Ji͠:T :R$8[]̵o>mRLYr> (9 k25)4| {3&iM۳z uGVZVMd[K_tr8_Ћ\{mD1 (Sc^o@2zXwD>Crz ,sc> )bo n<͢ƥWut98C׭a0'y0fb^E7fv:u9w}fΚHT[7\|[Q aaqOl%7}@uF0ӠBxpI-8QП- ’9/!Rk'/Nr0jI$D~U^_R%L-nj$]RҬ֒CRl:4@uҖZtYw}Bejd9z65EY,rF{N"K5}%ҥ)[/!|n6qsi2N.jNy;SRGiߡFΐI7;oHɎ8BhD巢JQ*ԝ:ERVqTruX2_V00ParpEf^h? xuO2[$o)6BLiˊ98]@UE8lG42x?)Xm2n売Ğ2o;BɿZK\ý)HɥGKhm+ 0UucvrkXH1 Lָ0ӧ7eTI &:Ev  Rg`:ν5@r+|ej~W]0>OF\P^c2"wDQߪe?t<5&$>Lp|2WptlbM6Mn>Xգ|DgX#r~t[zX?뚤Ƹ~[ -02fZ,n%($d,PLiEz"o`C6.2`ӷ(89ЁͧJrn" Ys= nl-<&Xdp(vrOu ͕.K?`{^ t˰Ф]̏F]|XiY;2Su>)ܳ,NLkRVԝZ0yfvO@qҍЍռ$5V_]_ޛYy`~m&wưjB.]n(?ƶ) *X v/:J bǤE9$b OH}\D2Jønf) K('cڌ%7l_qk 'V$ދsxYBuwc{cC;Js1DPk_~OړR]Ios]±stm9:)Z^:۵\2NW|y8WcP3QSCN"/"ވ0 *~hAS0tU_3zʗbXko艒OzgF~J6Bh9%\@cUB_t>mHNmxR҆xb+Gݞ9\i[6C(:VO ho:r&FJ )y"ܤ?p,@ؔx@Ӫab }BYJ̲ rM#^+[>qيf*ϥa%S[u /=-5فeHQL&L10iW!b(Ǽ/'M}9A|z>ޓ*G[]>M&YtIÎEnB6 9(2 ܪg_:2ݩn fg=Tz2?`r͜NC}{`.5o*$v!֑g3R;ӷJPmRe$eu- 9qv0XMD^dVxD~.KQ?gwnny=1ߥZ("[Ni=Zg>QU\+_vc@R}ǺP赸:HC6/Գ96٣HTٌYtH 6cٶk~H*mWUmXGuL&A0^/ٌɜ}f'xE WOEY7*~꒱_x!JḂ&ST 0a-= c#\u`?<X/I?`Cʲ=OgQx@G>ZDC% S LG:E%ܥG 6!`w{;_ZiymDR/?z=t}*3>V<@<q;o)҃vH2IwdơK%_%r ҝtʖ/*mI;[$]R:;' M.iBF~$ݛ]$’/1_7봚DOmN [߅EyͿR;`[J%j9VWGwOVrלqpz*ylfÃS Sq=.]v&8]ycߑk)SyÛSD~RB%Ʀt՞a5ީWf:1++)a)r\YjK> m{TeV2a‚`.&n'4l1[d&(#(#Y%boaEq#~хf'`zk"j?UK]vD6G2Pʪ@aY{^(itۇAB=qϏ>Kjs*hĉ:Ih䶭sek|[}\rjzJ=1aC'L LdLfAoWk5x}˾O`׃di'k.saB\߻)/v3J}*=]p Oi^/ ,BFAso|gB`0,MX=]Gj}&b/k{ yWE{BR]^9Cjt^tj $fZ JdA]yyjR!T`.Q|9g~0YkOٚ^z&*o컿U#]Or{BW6FP]uc)wX9J^vEm-ʢ$5>WBr&reUf.o=5e fp/"Ybܙ<ʛp]jn=xc&%ͅEwŢ֚M 07(ҋl=,xwz;=".~'8Xbuȕ"S’u#iP_W!px$\S&vQ?eݎ*X ZX%wu =ZTG%dc%7pϔ@ Z߷ =ݶΔ8Q2 @(aĚiqt#ӷZtY-m ^asvJ."| 5.k| M$麛4Wl؎ƈ|o;/) uwjTLzJlv*TvS% bLU7'мX' @2EtiBn~Q+;fMY$0(Ƒ]8F Rmn2YkY.%9O[br<&#>MxDټD}ݬ-M&t;&$#x#֨ߨ"dlU- -,p̅Qu I'])ɫc*tX!8!w-"IyT/E< 8AO@A 2Y.o[Wz8{5tzCϜCGЏ-ELOP`Y^QGs̬Fv`uGZ%IHI񘔚0Jo=&KM/ąo:e@{C|~ǬVplj L4J<26q $o+}ԞESiny dK i! nPC <@4 SCƍ+P4dݘO$lx=OM9Ë.HnzYWqM2(ۮ|ܘ ^%v Q1afYEa2EO}bXW%yDUֳb]}Wذ =(QLS$݈Ԡ\Q4¥eFC,q@Ԗb;f?J >͂EtapF| ׏~edƴivAeY$'c^~ޝű<0Ƅ1{n.Y7uWDO~2_^~d^M2~iq0AYm\T _.:hy|2yF6U7JJBj&eA ]]eR;`K\chjE= OlU`0{ccPa<@daW?x_ (5I6})|ƈ})0nMXbsCP ;(f2x-7#Cl`?1ZYOp$*˖\hQfX8p D '0a~+^eHCbb^ GBQPPy͏GJ'sw|_="s+h䪌S`/Edy -v "QJYF6\;\cW6>D%eb"E9D "Kf`DܶS^ ~V 8o:#f$=77fgоIAvc=: s5VPLU ,>JEԺܷ` έQ麄nWzѲd8!10A ^ӱH(ƺ7TU8/' Z`/vncZ-[wgxt6?ԕ5i%w:(ֺF9 `P cǫ߆C+Io= uūtɋ^$|mMy蛊lM`yGA)h_3)f'D=WFd;v0gGjxq%R؃MnZVSK3w=A /x/;aX7nBn%:X4h9 MǏH7dO56}m:w}$eIcbwU4/8n1Nr.O\j|R呆׆->\KbT+`Q?6TG> LLqm?PХ/bQ*ձ9ցqdjr%Nmsfi웑8A&HKQ|uϐeU}(c{B*YGYSe<)apPWKϸY'ɦb=fd+JPB'k=oX2Y"m؞.|P-T/n߄Raq1\zNBVY($*vuv/2st?H~yzFSmGɶ΃MkUwke<>mkY$` wEBelYW,}g4q̢v>!eN̑ fBR<0KN@j3H3^O׊\0HU-/3͒d6dcS9YvKVPrn2`ƋnH:ŢtR(f;\j1H5 TN3hr)ْ+<ۭEt1gf*6TW ~vk.KV) W n!&{PM't!傕gQ`ם ]dV-7M5wƈ2At6.W/Mst *K>t^:o޴A{1i.ۺB6xYU̕QC>m3㊇*_aeH%SqrŮ@pkfpA$lߩT_~ ' T3ni#Kokl*]푰_+u;'mbkC0]l iJӍPξ\Z9"JGN`Dj`<ʦ($E9C0iu|Pꧧ:WߤE`*qbV7RT''̠rJ:ǃ{ FPʀ5.f\v@J+;ySrz`ՓKtЕa?6 XFѯJ6*kN7w$ lC$SOc3Y0 b]3ob;1:(݅lꊍ~dr0nC6 z'h(l_0?V8<h\0olf@ dief}90}Yc ݛ`T`=Clf*[EY#\AIbMz^kc[<5JXp}R8*7&rc}&v@TB"\eќGKܔHLc%]EPmkdyn*MLk&mhAтVP)U5% xꈅ](o[RI4{3o1u4\A1v*2LhߡZ+5@X}ݔ8KS|=dkFܦ4Crjfp>hl'@ʾAj}%~z,Kf }UbhnY!Ev6s˭NrO-i,Mi1 Ȭؖ.ˑױ,^KM53{Khny9ENq7@/ ٽr<E:0 ʥ5^ҝh@ J[(H'ؗ dq 2[k))is ^K$?ƣ8~ ƴo!|*팧Dj8ʜ_bEj#KjK̥Ӵ8^ެά2ýzW "nˏزJ\ඓ KߣQ3E,:+:0Ƌbwl5q.v)A\53,o|I_S=q!k?1Tn: nYd5{%@ؑі c^^ީ?}ӤA3:i*N5= 1!B>JhExH9ƄJ8Tv3h j[)!Bզݣҷόј (4@)ü&l`4c|A:Xh dHBnLfsbN)gjt$oh~% 1_v3|ZSZPo ]jc6T`vTʙkk\oP3x#W/tw2kq- F%gKZDe;NANSh㋕7[?.&I^]>UZ*fLiRm#x/ChZKT}^e`|=~|04歕%zDZFal&wvܛ}޳O{92!VGw_V8psfe^dwH#\0ώ<Y&'&:} \Gk 3\V;mI{؈cEɡ%!F0+`7-XBX]i%>+;]lڊ$Hl4'+i?q2+W9ac&U>G P8̄X$BW|*;=A™~'9?TrK8 mMUs VbI~ط)hph _p[r ǧp}nي2+y[A얒Zu{RGl\&wbW`cR՘G*0ZYNC7Tŷ|1)Jթ~(#9&@.hɛŮUb,ʎ# 1Z{!6{]t 3'׻X61 mQE,|N߶KE  t"F-R9{`y+GDe$9w䧷xEu:PRnv^e.\}6X]hL3_o䐾̜";4Gp-ѳNq3c,$&M>=T}[GiY +AUu6.}XV t9vǩCYεr]Ň`prz6Ȯ/ˍ砜y&n!*(%|*a++ X@WB1!%l8,jjfah`6< അ\ߗJ.C$'ſf%i>vl^3/)t;jK<*[ +w(81e :R .ƀ@Mrͧ҅t9*FUBecI4;'<9fCKg :S q7g %- m |Tp_n6I uBjVի^8o vo0s*'Lyۖxѧ: C;Zc=[ny/ @ ނs"?0#uK4JyM5^Vj1gz!OoANùm4 '5ӪOMujPxSM2^x-RVܴIS O ={ʆޥ3 w[ ZxZkP0ot>ƲLtylFc36bZ iH  {L?mC6-fNGH@9V8H]h7 9(#U:7 [,Љ#$i ŋC^ ?QAjV4grq,*ZIO}RωԺo=AHnjo5ٙ,lX5"~Cm}_C\"dSAo?FS7W!*'[he!n[k23+"j'`y O9PYfQ4`ËX~`%. MKzmEqrN!}|QbUWG:l!u#P:O0AV*uއ"6i'%DK`l#BTo%!YNh N22%r,f[i6h%C,5T Tz5h4yfp5?GURf.b2LS !gaMz6I98V7q6[}4?P͒+s&Ɨ@?~" gbˌÊO$Ձc0[d_?HdH3ESپ`]UT>CQ \6 ŀZUqiw \4a. x׉8ޖ *)q++d2o8.d}vB] Cg,]tpP!=cie+dR(T>0k<>jZ9Zv083QZkft 4 A%qi 3rN=0ePq& 1f o[sn¤jJCu͛U}t*p($S7=ї*^A-Z M֐32S)Qd_ !aK8hZAgec:κ6e.vT- ;-u럟 ""O48Uem+0=P6Z)w@F$-d9i JF)F"'PKz(by;j#Gu=HH~R#z-p,":Fzsnh#9ܔP3]ͮBd*>r/]8~ 8TW /F)y\ZMmƦ\j&i 8 ګV):J\WAޅ{fփߓR`à|wdh ox_8Vku Tr_i#Js4v}5׌ Kw.@6 < K'go2&"sJ>ͪO1Zc\rvS ?XQVCcWz+zvvGD61وP>aX(bn:cQ 2o7=_3Z骙jXEmd^2*_-@孾9E埝#BvI<(6`;̳m-PbAm׌:Ֆ\!ƂC)U/tO\{_Eh5%=8;^B (Adʫd>m B^`݈@h|pKTA-{t8;38Wh4A`K)G[M* ٗ1g$6eY;j(8u`nF%T'u;J6F +(^X ϹHrU懻^GЉG޽P/4˴f٢nߪX4U0_Tef'F: z^J<7i} 8mwCz͇aS;޷Jٌ$ǣ&e3"D1Prf2٠8lǣjo 09o9_./~Y{΀sb&x$3tH7BWsJO"k#*Es?ܩŌ^w͉TK =4]^4V#m Awd˃'`(FuA*r]:l8nf-ŝar_e`femW6LCۆ@/+*סEfHq*ESaWD,(A OHSUzN'Pɹ 6 A~oʝ ϯKCI`CoZzJޚVB8}z*ꎊ1Om,P*.Uv k LX+қMdR_g*pV+mFd]yMm&3SS[/ բ0ΎP( >#хݚ:KH'-˰#@6+cu<"m@"6ay1+I43N5~pVO/5 ĭ8t_\Z*d87=9uPFf3/`"ݯ$(jG_6 uA.< `ﴟZX%&[.użM"NC #K-+-}o YD(X  zNeߟ=ﴞAv#iS/ [_SME zў_w[i-9/gsWȃB̅đ}рY'vOTIVx"0?fZIv ^(,w6T'mEA&i\Ϩ-8f*]E~5g>qk8Psjd/X6Rśӛ?Q|cKdBY?f(k5<-Hۄ; tMJh܌)̕Y^esDlˎuP$CsD[2 m1X*"Rc}򮀒bl -%-1 Y@,-!F OLM1N 6h3}a$|f_4N ~ &6f&X_ ;/r3uĝ(ƶ=-c65%[Qk(4b7yDxzQt*d*N$}; 7Gn nJCf ץԃcm2ƉڄߌEj ٹ-!C/\,kίH $Nʈ$ΝjzܴzM+щ`eha*Pk3;YvZjwm)zwKUW/ ]0BEx6ӈz * SDͫySɉۍPU4CISͿ vRhb ~}үkY"/^`͟j)ubO#}>iԼAiY+Sz~j5] q&(Ly)03G-wMFt./DtJ7GF9B5u\eb% yb4m1 *6⹝}6:RyB 䄼kq:̳W&Ponmۛ%ޘHXN/m}6ucx9;Wk\MWR".5`bX]+PEQq$o7rp Wnh@_Z3&p[Oe_l!>hN7@9qiSӽC$.,T,ګY M_/t,oGmZmVgo;6VQzx !U8w*1Xk'm@ lW:;/d3B(* j +aɤkb(d/.&eW 﫶)^\XK*p;Mo.\upl5P9`b,VayTH$rw &)p2r=^# VNFơcMQE%*ũ;,gOָsӕ4r~Kc5=śFK"W܅ :c#fE _SŁ~ $ Ƙ3>t <.¦I .7l1؟um*0`r 9(I~W4 <3uJ`ar mC߁?E:e6 pJ:ia(,cL?ːicN% &]iOo63zk`9) wAhʪU('=Z5 ܌L?j]tew[}gMLMyCJ,} \-Havw ۖ=qQO/IiMȟܔLD_&OE뒆#qVD^w_L{^6潚hGW>lf]fa\;u ʬMWThcO/bLFmT|Xj=bOfVSpLLncRԗ*o09+羣m 'BrX yo4sqH 4k2+>BK˽Qk>YH_圼uޯB}m wO=nL e`uhtTh;[{n[Ѝ11A(t5YMj܂$mm[h HIBXЎ/d&cWh?+3ыvk,psX@ ۟ͷ K kW/e*%xa6WȅA{\C75xq͊꡹_]K:"FR%ԕ" c2r ?"Aϕt|+X͢}qi#խsm J\0e ^zl${E1 qςD4 ?VGaCfO6մ[=Ї!Nԣ_Is 6W ]sRo uG]ɭ`>g9\0i;[Z ><ohŋ݂%{es_*?Nz_tX>ND>y.eU$2(vՃy䦈h{t~F@=/OגjL[Zťmf<`g!y:5{o=^ld Ps)1zO;DQa%"R-|hm#F{#Pf#QSBTSǹEG0__i&~ѭۏuIP6 f*O3X:iQXTfo/ ,̹Y%T)J')&xwxMy^ Ͻ 7 )Ld{94dCT8A~\,C}-< I1Fa-_f?Q怺TZdn}49iKs61A !3BiNTg~1”'wsz ЭV!1f-E)1,E 4WXo:;VhLٴwΨ@5E!m;:J0+)ϽN8`G!#}#!RLֿtȘ~H8ۛ.Xy.RThl䗈_cNۤ [#_N g_Oہd>0T)(s2x3#8;:B =tTϾ :?5MJn)5.R<{`r3-JvSx3 @'Aj [d~֢8-Fj_t2 ,Ⱥ^;S]ʠ ;A߃Ue89s1@>Xbkm)OhJKo'\B6[}XPRI`FٵQKLuXsts^-8 YCB8)~ABda;5<'\16&7r++lI$˧(#h-h,ju'w\E!¡`A!t24ycP٨_h 1/.+2%$rW+ X{ T3[nł .u-'4؉&Ȧ,!uk05^r!$ ~sPH}|gÂ+9ۨ+] ҭf͡rfbB^6P[:z73aF0Bu܇z5;o?GΥ#"ȟ͝@UTNǍ <@$s޻ͮ<f$aw*م 3Rѳo3 ]ةbA#qZ*EfvNXɥk׻{uj,QE(4kM6$yZڻ &S텅ZjnXQ] {5: 7*BQ>d Ju נ ޺4[CF'(R6^4}D`P>00[E>qz3bu[";9"ڪї?'Fc 0B(m#r)Ԫ6:[z5!X4rIaiԸdR9~١ORf-ʙ}A}[W"~ZкBv3\Ŝ0}~SlwXXхkiݽ{>p"z.SFS kFjd cCȍ+-ls2 czoB:iǤܪ9!p}t$_Cvmo4Py͚iHWiRYF b[G?O>;bA{Y("k^4e<Mw6:31|;BWEį04RJ8 +=OGŽ9UUuSzs6ů~zqԥ~jwf)u : BJ>#rd~ v3պ9&2ضsMc"= 8Y#h4yvP\' 2WRڿN_Y(2ɥ, 2#0LtRWs^4񁅿1:bVzweG1I(<&45#%h6rᐾӻ$ 4[а= |byb >wO"$aZn7+ >}<̼,8=Ku,w^iG<-UQDd%AMoֈ^3R<`GTϖ*21w%XE/08i s)B)qY4U"4}A1ROc!6U4T(㑖-܄duBFw?[}ߋ%j&%Wv@aXazBw)LBQ`ZGd8,=Yy 3Fuac*5VЁ> &0R1̶r #fдOJOڱ;Y'X+aTfLx';--o`㳩;[hM93;9Ly d.srxu|' "ܛ4T2wy\:rNeVy hM{>#pg[eXgN h=>781}@m ړL#{&UCGe7:;<IhfLOE;]ڠ4mRv!d߅i}={۩4wp»KӖRD;bK{{I(O 2zڗ)oĞso#O3cHvW8twB&w_!S87?]\wi5ٲ} ԰ w'@uƹ}{>Rj-ri={ ܡGYR9; j˶A"^td1,WGI{/#%/ xY+و#G,΃:8>vCN唈ZJɉ提[[0#<Mjc ?L>Zr"*hՎ`2r(!c:@tWT;|%Dՠ{ةnNUSv=Szyy8mOk 90 b8S#B*Dъ99iW<'^Й]ojl\NèX:ȯ\X*2u2f'MK'CWJL07 Gh?Ub;ﶌ%t)Nc'TJW-Δ7{=]=i/<'Zr޷Hya]8ْ0gDZ+ph>b0 /~UJȸ޴b "K nb!KWGQ0!C1UDY6u9[>&4 7m&d{ @׹a&wȫOîq≇ hċ+_1s>wcN>!JPf)mft~ʷYFcvH0  ٭}]O"^"P|A,YbtHlP=<V\9DS3()(USWTYb5!|hEFPJ z* dQz.D׀d&vum~t{d:߰$]Urr:d I Mf VyӤgG}8GOZgc>q'kH OzTFHLk:Kӆ!To9TH+#,?Լ2Gs1`vNy`18Zh#K2H1#-}]"9="4aQ1L+ItGeh2JM.Oߚ{xڭL3YxkN|=yMVW_xjI菠դ`1b}&~Qy^hfv9ITR=L]Ypf<=V/x H!CRu u=DZ@޺%Axƙ B øl3K i@ҳޥ7%<[5UV.VܰD u>!1},R+hz}d Ua&vL%&$13e@~$;+.L%߆,9!ݰ;6[Iȶ^`p2DW8K;V Q=JyxMaV^dFWS&7>#!a_?I5| AUzV@BB͒&!")8Mt>- Kؒ=qA" ␠&ǾkiSMWvw-`sNm V-Te]\o񡆑ںzD/:'f݊U;d=7O=rp7_C] ux>gGtұmS$ Bd''er_{2 AwM*9+VrX)&F?Ly1GV;Y0UofY9]C_I3>>EpkTNԤa 0|h⊞A~ԍVVx.3 ΅y8\W7Q=[-JxeH%YQU7.O/_IA) U6P2}?̓ouׅy{Rf!Q#H~OI .xf r[[/ F˳M\+fi0ND)J΄Ὅ)!e=pYTEbl-FFf둬9v]CC~-I^ޚBPLJbg92ꈤ)Lvw4џ)#*uݾN޺n4f4HSB/((s'qR'0Y*cqHu1P:cSΣi`۠έVC2XbsW?=2!)䁐)4]sl2½sULفn>o P {i#]弬 5'X N =7V(y*{ $6{ 0nI$3nwp=l;)yU"%\ODsF#kc@R; .)~W:tw "+"PàԜ^/8&`9;߭ 73/_sxLX@.3iC>5=KހYz&L!Gz $ŰvIAw2_Fc"cÁ R~>[i|))LWl16v~7hO1+q' YyBڣ cu1({(2kiW)R~հkKH?F U'Pz 68 ύwCk5 a\ RmXUFT31 ڷ,6-mC('ݝVSA#x%WB|O3nΚaB4P $/3H>"uÜX"\g*P8n:W*iˣ=;{KZ9 FHy2uUY25J`W.>ž*UܼjϞ\檳AW4n}w/lǯ&o-M/&bG";ׯ•*ٕM0}6k{2Lu̮k!ֺu#!)?>}|*Ǐ* QH];)W[&67N^+C6~GqF֡ SvQ|)odTIs16&H\ɩ ?`$@1gaJ۹ Q+Zc%S5\ %a">xlrC :xtg\$L'Ž[#mD/meg'G)al,B['LYND3n^xӒx{Jn,?Sk7{zoqcqK.hfbtb[ԥCL#gvJQ~|ÑDxzܱLIGVDDOsc&>l!:; CB#8Oe KfDn1 HGґ],ʞ"ulAd^^lSFPz2<U"!ff\S޲Zn|f뿻oq|MuE -?(Ɖ"%a  ,@i쬚x1qg! ]\:£1jZd\N| ƪ̭͓>Hl_N1]0wJBޮos@ϱKMRiퟘvG3Q:}J %^ΰz.w vf<,LLR"ȁeCgOf]F \E̴x )j"W1GM iV#5E*-`9,.Og*nGwU%[B_ޤK BXVf) #;ZXfec bfu%-DF"i` \f/`| opѵoS2 ?v2ʥڳ!{}<-]]-5ͺkePZ/̀+sH-_ ,:UNƷ-8 kucApC!%#F^9e_mE#6z8ovUT2P L1:Qe߬UY)ӛ c&'+U ]ӃHazzo5=d+}"X(7-=.eL)륶y*X Mp۲(̹F`,;!-5xEk2}Ju"0tuH FP<ވԞ 1#Zg3:4&@Ye ˰X.2,9IP ![$$Y=:nLZ6OQsjfjL r[|6#~SfriZnz  7z AP@}½J}3ڥ׫R.yW v =&dz8*xM3^Kȵ /yHĝֲY)1#'ԁ(R'GeQc`L4#VV[{'4N-J% !hHԨ9%FJY=vcc& !+]M];D1 G?k/R!;fIn~H&g,8UKcnf9,lryvFIa+vM2$ Π/)kQ~,XܒȣV ym4[f^5qT=tjMxMo-:tL8NF̰;)|6E;ců3+Pq!¿\)MlTAF؎)]e5p)PqÑ^AޭnLف-2&h  ?Ŵ-+H%7bkI)_h0;ruy/mOP0sK̯xyE^*j sm_1"9XOlw0 4_xKmDj,OGmz8P>|~X'a+9[rtݯNgX>iqP]I[h;OApҍ Xohl`x>9d _/U[}([*+;F"&ЂZ*65Wh K&=1N05:zvǒk s EE *[U\^t a+SE"0%#ۦOA˵ΐ?+X-֑ى}SD"MHc;R@I;/Ƌ3[{aeCFgYMy> Ǡu"Ib[-r3/+aȁ VLPt?ǁ*Pnz3ҿ:놻 I15ł7i*8]"|ݱbW-&ƕa[4@) 9g]N)-.q@m8(uq3MYsEz)3&٣3j o]ps=BM'r(m^32sa?#z(iQs dC!ps oo[i=X#b9 F XXM1$S^AXvIf+ ns Ahϊ߅9Ρ: IM!ױ9F"@jK<傕6c4mn= =nwh4R$ E8TSlߓg 5pRW‰[#_sFP+h,aFv/UHء;?e CQ|ۣ 6oƼd[k4V)*rn%:F~J߽1ͅW,uLy[T>7fgR[74aN6X_` L0kKDz̍5(&6)[AG NsaB8e>Oxdy}ѩa> df;pV=rSl94 f4rIt]\Zm#))X[h0!4g[J MGxqy`2?ўFP7i5 D0#2ik՗xw^ mөn~cj;c7٦wg+̦C{`H^9Ie*5oBj,&9%v⊱gZXEZ@P۫* %0o^E5t# mh`pF?'HӘfa\ΐj~.pزYٲZ \Cx;+a_%Ib5=쥭e}Ծ$@v)rF~wh/"OGZ*[ty"^`T+ut||h f7W I Nc.?y]2Ry6qGN7 IT m Ds^o{:NFpžr :ӂڑ2dW5H|( hyV%j@| [o #$&@Xh:>;zIO;Q uI5d/ߐA~DnY6@rh=`6IAx[`Hr]Lkm`v xVmrU /1r)ׁt@BH_睮bDi%ϫ"Mcʷrz ,DAۥY3CaWceWi͢Z,#blj2 wȁ }H!7&=i U6烶%~>v(&G5k%I|}\Ū2fX"VT pu*jܑ1Y`wPQa$y f2UIaRo!5xr٪bjO/6Z(:5t7{zĝN RTyYCV=`i>uScAޚ1y>.hGW5+Z@3Fc@r>6Mxq8*O"" n"p? :8OH@"r^>-e(uH"eʜ! r6)*ք;vRGW({=.< g=]\;g)z}v܏/PK+MeRXND1X/l]LtP_BPQO= Yz^ RSD-]g''-#ٔn;97*-t67=s ݑ(].|k8!|J,G .R12'ToDrQ|T{*7%?*˄!3Y)WT+YWщa\qsY9|Fɓ!ܱ4tl!0I KqjRW \s8v wQMfY_DCmi27SŒK9B-eߍYc~cڰ?PאַnMDp|U[-/qW?Z>8"O*Prf>]̒9W";n"[kHI$w]ZX&Zwq y~#Sp?K])ń `wGaR`m;Ѐ$TRõEQ3Z8д 3dKJ Iw`B_8: _wƛN%p\b v'U~Ckz?QK? f?P 1@Q(jQpތ>QZ~T W^Χ?oUzyF >mg8 SmH? A9Ixq\H  , VtR-56ȑrc3o= 0Ôqi@]ɧg)](.;\7)-W7o1m;tin:j}%guҼ3¡/Qܬ3&“\",Tv[˿T\Y7qm3BchLqKFOk'tm{>ɟVtov.v)nX߿cW"bҙ@xhJ"],v1RUl꺷Žɳ HrLJ=c5gNSO\=ޝp17lA_Czv4o6UOGs?`z^lNuS=Zhk89{=vݦr/D/:S6m4% 3+N vhZN-Ѹt@Mؕ+ȚP7m{${4^;R@ڢZ-1BZoQH5FF.pf,0}z_Y _dZ' :غ҂Ϸ{^2ܕ7񑆅IHzb"ݯ1Ia-Ŵ 1(VB$7*I%j21I#P쓅ϸA)j |; )YnYwiS4V}5' ͯNa"# (M|q/YK4bk?Fd/g?ʹ?AJRQ{VL L+]p[+uUkRwVZ2 !@!uMn(A?:b>,;IYHt#i،Q5 ^ιԡޗp AHI#)sۄc6NX[ΛҎדlr /F9>,6xLd gxDCrG9j2Z]raXO_0B*AΙ;t[X}VBoa"R;*mP,b3>]R q$>a1jV9ˤ͓F~chIjcoͼBӍ@o$KzPhH_'+ݎ`MΫ/.\D$ybR"vE7"nPŎ{%J*g{JhvθF{kqQ@' lZr da3Oycכ蝧dM3gpޖr qBc:07~ev E* ezReέt3SuTbnir6SF2~YsҰ6^O rߋn=/\XxR{K@3|]ӌo Sׁf{7JFG<VFfDHMVkBEDg3Qw4à?#(Dhlj͈s0!`,~G܍hGB_~%DluJƋ! FFSmQ Ɨ߇ 8@ xB 0ZEg?մIE0Idv4,聖E.rwtfdLn{ F>ے,:aHAzĨS<7lKcžlf7q s}"Ft}Tnl/?rX]ザ(bLQʰ_vwҼ mCZ'8[ʀ"JgL@~ >kn+ΘqSR/<*J }Sy{5G@K hm, çwF/Q'(^0JB28mU[;߇t5(y*Δ k܇A;;! B,"xTc`i?h%]^q~d$0A)>3Kɰ0|2d!rn o-b]`¿}FSڥR6M\a!!doOWςF`77DuɫqE1di0-!`m,Zc;lrWwN8ϴQXЕplFM\dha/FJñ础6sDm+sk+x83lf8<7!jP@C!'N,8>Z^62Gu>FmHy{ɱ6WT&/IMlk53#):~ohx:em_n y$_ƨ`^dfq`s@wJ&'OdfBjID|ZG=UC6LiT_qd FsmeV^.\LQ4gyYdKSMڸ n>RmFcJǰ,{@]ا"ttr? P+} +m$Fqqڨb5t_ #>_"F r|sX&%կemkz)d9ZW [(ߊGQ۴X7h(lTe|{$xN!=s|ANH1=Ӱ@ȟ/Sr߱]N er&Nc%ۢ;He6_iceE8%lϝtwz<"Rq>$@È'&wSV` 9z[*ed7vlVj"z7B >(3ZgzA uEv8"m\: PmQ|ѽ6!R??_ᔑ.yLKG~P<87 3G+1zڪn/%ʼ*Yhwz9jEm2NtY(_Byk6͝KCMPGlQ>2Qhw% [1^8:t>J&y`*l(~nE BCzގ/Ú'y.F'Iy^?!fs[ThO%nl'&Gk9 ).+kW拗!A$4LZ~Q'~,BG;b+ozE5a@i1Y6E0ޫO)]MkIѯyդ/y: lx/ǑGK #az#TgQApaoIi'K |[] e|F(b|Sob}@ʛ-y- [l߇Yx4]ݸ?-}20)6Ψx:Zǂ6'D FAd u4Kh$. M- $- h*Z7s~UFzw^0;B@% '<"FRẃFغٙAf:V$_7uYP @&'??5o^?뻰 Y=oڽŇ`^"qQFk N䆻i\y9bHvGvwι.ƇgiaO!9 $AtsXZB%g";! ||CAF 0\R& EE%!RM"dYr k}+v{3}~#ӐzVA:]Tk M^rWkP<7;Id}|B?BqȢ|G@, dNa\v2Q<.RPwsͨ 1N- (AgIc{'wˍuHntb&^Xdh5 hEHnT&*A4 ,/Z"uwk><zv`]Ȼ a@*ŐL^6SD7 $ao[iߟhچVDJ7eЁXIe|>h=ucdZ]kU~Ws'ָB'\0r6cuW׿蘇0Z1x,zB VvHSNq]5s8!vx 8sQ#Rs6~SAk>%BO o>CM.*60|i@UDk`X9WZ3^=󈂸΄77 ظU~S7ӱjg>*yu7?'̞Я^UZg^a i|j^\ ҕ}(f_j,ѻ˄vюM#oms"WjL c|L IuҮ_[%ΝXuCZmPG)W0#xfQ5e}`Xu .Mg&m, =xS~kւu1 - Mt-4t1` +64;,R86-z8liE{w^Y~|?{*;*{*ug}"cމHI$1< 7ڥx$ y<jM+0J#SʿMN + [tIeBgFSq,6ץ;nH;Sa@g[ ڀd=睾ϦIb~ns脨h]9HK&)p zKl)`#u6#"R\$LYXh_ϛe>*( Z5da`I!T9榏vL65{zFܜP6<kC O/)xw HfM̿*ǪCd<Z+@Fr#64Ց1 #2j߼LqM)6GWbfTxL :3+`òB@C!IrMs6>CmH$M5ڳjSgzUѦ zʺ[H֩VGĂ8Y"xTXL(scSX>4|עޭ cQ ʂI_b7Ȫ(>6N8;z4z(qbLd$2PMTƺ-G2=fH] $RM[Ftn|#hAݺ~ ye pCtƛ~$)U^QDa0d c:Vj-/}|Pta sF1&A(-yo3 Ez5Vo,=3FEkهO֩w׾ LP?c|p%阀# r&-<|>Iҡ7HTGa_yMv"G<1&[9@_  7 T !:.^ fp!$6l]tn Iϧt+!Kml]^N TYdѦmn `fqGpLJ߸ NT̳ s7}APҽZVxll04>'d/ԕB\T!D,=x>;pSENy±2[yHEs!kGah"( .E sӟp}@qEfjGrB8Db rJx+ #CT%ETU`P7-H&E#7%)A_#fwkP6mY#1-3-v inDX}o PڼU|k7U!C֎7&赬 RK"\`iW#vњ~~ϻL|~ѷ٩OΘxOjIޅ}TtV:WDGt !v՟\$EfC.;Mrݠ} m /Lx!UDo:cJ`1fHǗxwU+RO)W҇N"+ LI:?>Q\wz*']fϩP1k2VSŖd||/Q6i*` WD <;O%FnO8w{˖ԞLktI$ e(w*YAsO9~=O5RE㏱T辩P12 oh6\uYQ*i|tמoIN+EKX"mo<\(ah?H,ZxA.k&J)=zUm!/\0;Oo#~ .@/8̵ .ltͥk_ݸ $2\? >".솙:[&>kw%+lnU]^:[|~yZu6Fru oàdB.uUⷭ&I &`?t>ݺĉߎ3qG>Z&+,8|Yܴ I(˼X:e pY3ŤX}>-H2L颚tFH^DBͱsdŽD vyn~ežޤةJ%,rn ^ŋkHA1RK/):'RUJ%]_5!YgCU;"9Xیw.@d|hNrҙ Pi+C9eFk=d\yP6{}7 _ y B9%>kKIQ2R_=#hz0CNOX/j$R0}ž|wMy/ɟ$=M0in&*[r02!MgZG2vv: jP2,{7DFRbvݐڎ~ 6l!wn*5VS% J"-yh1y!9>lN4qMD["l)Qg~kc: 0Ho4\F)bcJfGh*x5gY0|Q!j&#ZK (8=ў18$SIBHC1m1|eYtP,Dn$?ft:}wI8 Q͜rF`LNV8Xt 򠳿Lk^̠Ff-*:dcYKڸŰIF¶Zȼۗ䔤įjBGp[I|$hˌk!~Ŏ; 57܈*S y]F!=dnq% O}et#oi)8ɤ--/WR̿:o:J jgJ 91(3A-G!W?!N"iUmMa ݪx(IMjyLsILm!Sݟq]lWF7Vh7r'M^i"WfIS;/M0Ɛj0LFPutt%4_pzH 3!CnXS}ant?ϬO᝙ JqZ%9X~|BbC2kckdH5n1(?KWxhDJ!b%{q1h@%)d< nL0\wl}v=BIW@X5?Ml]3`.3x[iZ*-ȇ3#jo5S³ پEov~X QIإ"6XW+趲T4{osr /q/XӅOqHGu *=`#\u i ) /fY5뒊άHGIz4LԖfyM;H-{mU'ӺiMrGK YNƊl֓҈1cn%bɈp^sd;n+|L̊U޶S/ǯ)^V'n@d]SkU$}=/:Bɚ`&xp`ل^EOj+K9N&0#i]o@D97 q\Yҿ1W:> $4ӍueLpr`PfLA2I;¯,WiB,7On_Ć˯)t2 8QgK +{ˎ#lb⋖t?d$ Ԟu!|7K>cs^~MZ*s!˜Ah0-=iDpZWY f8Zc~&J/{legazo$9;>x<ٹ mQ6 >z5"2*mٓONO7KfX [A UfѪCrƓ oGO܅RN7Se#;G^(d:).εw M,n<ѣB8gR#*=,Qz=VO}2r^\*2ZbV *Pw j揘2`P4+6qfַl2$j-_z,R=^г~s ĵͳ˝\*F6uG2[v^mFsÜP{lelJ&cRݺGC{LAc> ('D#/[d=t˫tqldL/,z(2>1,Ih x+vǥ?nPY,DV^`GqF"#w[U/>p7y |f3TXlDAHM#jOGPb3wʮJV`(Xd|MEDQxe/ITT0gkj1I fph 62H>1ZNUy@wOe~S"= +Iz< !kfz,i+֨N8ɨH ǍcS2ށYE sWuǺҁs/[;U# 7Aa [N;InVr4`[Oұj+RKELRbZu~f-ӏ]p؆A@y :sP׏/PO1.{i!{X+!iA4&#_1&.01^J(9s*_^n"Rl[s{ ۱2iNԠ8unI1K(W\H|9CyDrPct[]M[ -cfۅڊ Og@EIr "FĈTض&|^9ʘ h{qTG#ˑAq-33=ur[mFvib|xi(MHr{lWT+ (5'*jR@:X2'e!?{tv8W憕}A06Cxsmr_ܲ )N1ϾaZ`TcHd5 ׽*(OoX=cOa=r_IbnxB;bL!:R"߽|j}gN2Q 5 @i>l_Qf_|<=xd"TBK>V7 o-]j%k< t˓%GuxldiL)vaEP@B ~mҸjPxzQߋhq6;nG\ѿ,컄9WK2_L5=":1\XAա[(j)z2l% `%tr5IYJ |ز3h'-+#MxߺT;3@}fo ʢDLTaCs$r/p$;nfljZʪk+Ou$w#N+Ϳ9qǎ:jMLfh>Տ ƪ)*u^PgH}`;۸;J{TyZ0:{ oTR -/_b{lc%hm,Wxɷ'onz\kT9y. t[)~ye)g,'ć~8Հ0ӎ1 :ϸdٮ4E%'ŮwmXKo\2xɏ%mx)ӟ.a4V'Z(:?}=utW[2{ ͅ0hy`\μ9LZX/j̠t[*l*G:T00xr7'LPF ɼ yZ4l57_򐥽j:z˾BT{1CJ'd`󓃄_}nt—@; `ے> - 7a8]Ep"аY(Cu\rDRYR!M H<ޏ׷bŁ$W Oi31/l%գp~`*b@ieĿ9HJ>zZ5e ]^ڑG 1)ق',ۉ!Gzpڻf.'Ʒ#PTS?;:XSs$̬szzOD_45:7̫xnl%3^>S>ՒKM`jR Ü]d0B~Oja\R ?iA,a Xc$ m1XU[6ֈSrE>hQ)~jtPXPF sh|ܙSBrzIq3`e{sws(Ƿ)0K4THS.g@F顺!ݛh?鉵`3A~nbyΔk) .@RqUtjl)ېEOpQ!p 3&/)6=V\XT`Iw0(uGH8smX*gNɚf:϶-u H.xwD_wRfp-]ÎVaĶMי%)Pz [2DTg 57[N$& irDT3)kSJ]1E^%xJR Ǔ Rm=h2;V CjYMC:IJrLr.1)^$vf'K>e 5jQւ3ف=q1[S> rv[4ۙ?dh~q˟ pslD;M}ńEZ-ql8'x)2- eQ[ Fq޶{4<$mV&Җ;(Dl?;'ӤoE!E Ck+dˮUmW98=}Lh&*= ?HQP/%oZ{g ] ݳđVπ6; P h(Yc妒9J8C)MR@D6 O6'#" V= : DRG!uM@'}jDv8y5 7D;Ī>b$dkMܣ֗}` 79m?,bn-y#*VFl8{:`uspg{n8'ft3=5v|ﵿp9>:94:]SoWCb؅ {b&f- VE/17 f0qPQ)HڷZd~_;<}V&a[{LQxA>E:W]5v? ٨z8:Pl|RRkGNQ%w͙*wq|kh .uE > 26L΀בt܉0<^:΂w%U1?CpϵPz=NȥA?#jyW U6щuq>b{-6,zn0 gID`\:@t*i|jwMkCe4y/)6CyZ2{`uӷŒaF,p,5ВЅKp>#.UusPT._Y'tGӤ U_W2]"nAhMv=n5$:8|"Or1 c=.㰰K4@L)~B]N ,L}Y^Zم^/ ƙ38 f?>nIǍ59*4 }M+VGg;!?yh 6n-D)q&-u".g8Ըz67܀EQCA%;~aӭF8!2 ~9W+}n\]hM3v'Y~SE],<v~gM9rvTf=-5djO7Ce\;u}lb̟hy ; ~)0_?Cq,sacqwL$ 3G-?u ?`z/nw5e]'"SH5;M:nq]tGpCH* {دwJ:˛H>a8.i^`\[UJ;=Z|b2ywHfu|W%80:O!"cmnlyšcPoX#w~-)u+商l:Cṥqo~5b:~ ae\f-}Ö] a<ٚ@&|ZՀ? hE0\d='8x36m2Vޓs#/Q&uff$آG"2THkV@G]ѻjJξl/DW  bmAR&~:2?&src9)Ipq+mp’)VuaJpiFjƉxeF^;aif^uQTJ90+Kg-0?ahX)dh=NMR7ߕۃ:8mwU9ĮԘB+Q:[kN=n%sr=JJ1ЖHwη(p}Aj`S3QAqPm-YYJGWlNhaPK<2n|n!JOw^te&7ofcO+ͫfERjy]Q-+,+S^Gh[m89:ћ;mzc/t0,r#@/5~NF0xFt"NDze#.*~W$y5`$I{e)^u6c m7QR(R:–e/ D2-nC._%Tw>k0~1ql!'D> ]~_I<.>0XlY)1FnvIf@"l$gOq xv0Sۛsciq(D20vr h57mN&ihB W#f#]%%5$|YK-Z#!2aJvv:eӞx'@~^uw fyq:yn F&/Z&";4𷓲}&O@ m{8%fe͔JBD2>=zD|((Ң!4Z_}SAS#52\37,WU<[b]Cv[V>XyH\9]F0Yi<{` U(8hnkhOnEe*;Y:v^ hdԌ*r> V@WW&Q5j`:6fI$j\⤮('\ f+Q끕\ mDD=@KIM*Cc,)j ډF" g40D 2){%`InCLQkmH/D>Vj&\Te_snp YXMoo{awdk-\-DE9T-R=>pRY )mM'V T0jSj=*j]bbLPE86-Ð/ pҙR{`& ~pAIf1ݴ@ن<Qb BPwi-ڮxSCfop7rjVA1}.q届h9bpI4ֳL^RiH~i丁sǾώ OȐ16n?G5ք@tDZjGs-:ˁdEn~*!i&.)a9-JdP={t:Ž\,~ Kk*^m>ɩlT bŲ'"=RE3L3k˽ew;*Hg/ 9Y Ho$IBڸ"لjY;gTiq b 5b44( ȺJdbܸ_^:\y81T#fvS]CۅCi|q٧7Ϣ*y;SO?:8xMqQ5{c9ĤgsbQVxAO$A kMn,&EF :u} "> Ѵ 3eAޏʭ߬pj6ތjDW`9Z;ZTJ Ɠ\$( \(RUP|@=/WBяY&v=@۝LYE.Bu, ,Sشbf豽euKb8qDnϊ я㬳!؁Ь.;}fOf v]P١(ۭ3ڛ6Xj|?T #̌fROg` {L#L! } 9%lmј$L@[0Vm8;[Tc>\kgf%_7ۯ~uq_[CIH.'6xJ΂ 1^ U#v@ 5:L?SI۴7("{Ъj,%sTcUXEeV'F5u~"aW(͢B0Ļ0vܻ:C} ]NM_0-,v^2 Yq @M]Mҟ Lz%$i"̭͚3OriO;V·_'쌵 b> 3oo 3xgFaQtz8}YFWN)V{ܕB':Ŀ 8.aWQ$L@_G;''p1쪔?.P^*i #<) 3J>0tZUi@]\,&n]Nh^B V# ]Q$ 1$z8/&tlmZoy~ءSB֩h 7er5J)[)WN펂eJIgmXݏ(xu/`.y;&t|AoczDZowZ.]D=3݇] i3izz{8MM3¶?7H6VWcEJ)RH]n':&n4آ[b_HSU$ `c:ЄeP"e>ݸv-"*l& C"Ii@GץmSIt>r A%FVZ,|1?_kz:p>NH90=yc'=۹XDʿR _ϱUPCEX@k7(;R職 *\#TjI7׭Hbg5#O2##Tnz쫘lyprQPE1r ; :PnڡK\Xgg_̀aoy@b@ ޥǕp 8QV`N u@Q˺K.Fw96'ӱՆ%3"uy+Z"Td =Yau۷J:{4j-u}f޾=>,P4I6!p+8jm¹[1H*A qFve7MO~@.NB87ٮYr!#,JnJ.„~ΡRNtD՟B9wx+2=1Z~]Qr*v ;`bgd&MYg{a]a>Ya0 v7jҺ?i01Lp4ْG6P$ӿ.01$r6CRIGC+Sp5quH Ā\:Τ?7\e̷ JY'"N!MÓb$sxD#B*xLddJi1p.MCjaoP*cѽ|Ba(u.z'MGӾg-QdG,+w "*.+80zORByslo (/%~}Y8! k*0W-># ЍrhI+p"O:N6A: b\֢Po E$ u[e"P9t%_8wIr)?Hf^ vmLhndwFe|q0un.uf% ;2(ڀ?1@ Rh*5/C?é #"i)N 6(c|ۗS߶k2:gs!/.WNJۨWJyx)UdL7j![]?C>~Jk!z4L%dU -w gV:O,qK*X{cxG(^,J],n]b~2ZUu#-T^ Ȗ-YY~-.Ԍ8kM FIk ,Ԁ?{q9Ǯ4pq cCFZ23Wh!wbIUlVz@T}˫Zdr!3rd!1f6hT4jyNN@H| l{ EL$E2C;b3\t8E` ᧖*a46h49 ~-xW7-Q7EQ.֡4tRcIry'Y./7XRРfp,R'34kT충y1Qu^btԊdA z६R#S^ZX@5"Ԩs|lk+#/ĺJy?9s5I{r)w˃ĈHb)| vjdIN5F CM*6=#>Ԁl xïe8DU]v> m0HkN &3|xRC K;S)qIJTִV3& H\i#SA҂p6 x@JԲwԽӝQ ۀtS0fЬ$=bvq q#+ɊM$n- ]0s;$Sk)Us.]nW 7]]>uFۙX& lSq!Y)hAR֚J Zik"r'{eX-ͮQD/38P_Mx벚JCm9> 36 Ѣ~EY3;K}(b(&. "L8Rg쒯Wa /x 6_OV$n@$[CZeZZy Ze ա\E%BW5f(񜲗y"B\p,zF/;_~My= NI19iU^DiTH({];z^ x́˰TNᾺ9ENH(x{$nIj*3a)Q\\i{ %աtH?*"}2W~ #Y>q@կ&^ n ]%Xl3XŻwvK9ڂAbLT[}+y PH`TNvafcz&{ZdԒ$|=Ca2Q2&2ɰ#paDLЩ2*r=eȓS?T%t+Vy`!ϝR7s3i?Vg׌kKd.<A4BTUɱr#Fi qSٚ x0 Y(e FDi LOv59ִB_I,Q0B uʊh1(ErKi[5*p0EGGэ_zH5?9(b 㒅4wŧ = TL"&^p9.uk].2j!:벨|#c 3$Υrj@nfJv^B /S^ 4l l\ gQW~Ϸr4 VcwzZubσLLSqU* P)Ww{ ߖa9mCi->ŠϩnīWWtY4ECYTPYqM 5h`*QK᝞~ұeXT\4f\pS7K"@}Cdܖ*+_"lznwZ]0Y{3\ p(ș0PXIvy'J޺ &Y%6!̈v#@WS%:OboaSjUGA[E_1yRC0q1=;\wӕ-`ꏲUt9vlJ&(nu:d3^TFxC]& 7t3T$bdM$/ 4%{DD9[rk7=ރ* ?/!aZ>MEpS2Cl5 ׌v>܀91s0ruyC 7mIR32G3 \4ǹ>g)a7SE<9_dž;=ğf\5jg}E4:[t%IBs\7 =g.: p`y&aKRDE+ ,t Cf.gMQ˧2)`+9W4,CP.G#dOAM<VYC@_kl{Q4~!`}$w63.ykd|H=dX׍h݃rlzyF݄\6_R p+|OmsZ Bw$b)LXh=?NL'N&0EhRtoH.=leRﾌ7N4+dV6;w,g<_Ԩ{ȴX6F߷Vjn\X%U삌ýRF _RSz&'@[E _Cv6dϱEd}e,.pzfB @.Sk]HF(zAEҧCt?^Gu< Y"ܠ/(-t|􀇢'v\r;8B c>9$V8Xv Įc5'2|_ͥw1y *>l"y>1/1q~vf6t:b'*ܷ+|kHy@5cؕu.5}hB Uc3{k3{3S\KrgUfCUl(zMm(jgnWK4?T!@$k[4(j`T ̄5& ̨tH/s/P`)˫ zu/gJZ]Zj=f]@'7j*].@"j{Lmf ubgo;èR/.-ڠO^Gu dm;9)HmX3;itcN멘y$u5~4c}ߦ3^xwj%x]y47|eti i۪"V#,:p@/{Rz z%Ng9H(4>=ƙrT@˘x3^t)% Ǵl,T&fBx;}*@+`KDfnȒ(#h׍OꊿkDIa+ǿn"8&D66-]1|;GxG`R|O |@X6 Heۡ,l/K%qbb ໅ۋ!Q-(`MA00E&$;d:ڌec.17hHS)jhR7<:g$k)X)$Ơf*entLݿz4P 8!$IQ(K[ *R:< ~ٱyafoCg^ǬJyC kłԸe:СG Nԥ1{q 2GشFu!t0O6"h9Zl! ~QbW7l"|+)Uk.vj-Csl^@C,wܰ}T}BO&ȇ홥 N2^=?G84^3TnOo Z!sN+hk3L0rWpSI 7@讎p#r zM 6e9e>͕=ٷXK)AH?pK!j<]6}9jx¥|3o X|>@C 9,s<%Q-YtgO=W4Q>yE\ib-_2EG :mY;(ʐw/wm 'xWFeB aHU>hpK0{C'@1W|5=_H&dW8ՅzҋrS"}ß6f"MYsMAأ5d ʘxc.JbFv 1H32/_Rηn_FoBuir T}Dw'S0g6_Jf`^jQ0[qf}":M›&;NY7]i6-=ߞWQo!iY*tx - (߶qf8WmX-чu(LcG і^!i% ]hTtJyITHp >K*C,pWVQzYSXn*q8TGީ:@! CYhP G, H?c=vWz+RiOο8M. ۻW2aRi@?TP.^+[ }okZOweiLj:q1z7mBA~0QfK-p|Z/`- l_Q $S윝Hp^,#ZE# >Uhqq X]EgK3]k%dUU_-MPPS rGN?XQV2r4d Px)'2pW~M'!BԱB9`WՂV_N`jMؘ vuV9Z'ʔ?H~iuBf%j# 1j#$+Q?N>0(<|8N2e|Ϫ˼+ ۾SZt'bíJs$r^ɁڢJbNvX!X%A"D|N8|RZ@6L 3N FPC| ۦ"II~;U$P1[s<Î~(mds7C9#EI9\Kv,k4fˣz[&"i<`0JrBnKY&.Ud wH)N{Q7n%(:-Cڈ,Aa|!lւ8d_xddPuqj޼XU+o}DXpMq{0L&SbҊ!Z_󓔼6i( A\ ɲg.yv_]`<[_2QBiNms9ȳ 9@ -Z,T?aU7O |.OE7cJ {rd=ĀrSZitNl: eB'W>b2DAǧҫ SH>U)@;eQOl"C'F g8{rӭ/|҄d?6xS%ѯM{ZUBם>i Lo@&^wo26I?^J~CKFW%ɑs3vȥ?Q՝VI:O@bZ5 as P~ }5Cy7?<=Xoقj#DJzXC쁞/uSJXsjB JL83"`|&Vup]48[c׼|Y=3=wLmL@:zʸXDU\4X4`T8R\; 򲜟| ~򜇚fB3Qmk\2㹠5"+!Օ9oDŘ?:ǐ~y:znhV 0{LxD`G']V8Zn^1%-bTj,/c7Zs○>}} a*CMAmZ`@}bo׎.:Dy}DYQ~/AW\ڗыS ks͏؄'1bJ4uyğZ5p 2a3cv~X[6jV.Wg^i9g瀌Xddw&g8q Qiˊ v̖-\z~=?H-1LqHins* đrҼFjN >ݲ? 1rNeEYYF6y [ \PNY) As!Ɔ}sLq !4U Nd_ ?Szx(Wb0~ cxղ F]=Da3}?1 pl W?Xu{4ݖ fLvĎBJ恾5 S߶1WhL?nVY/JQ{Irx1wg]ƛ* .se? ؿ;&RFur;]q*,ӓC׶H z}#8fZhDN4-hfVL ,>@X"S([\PطI+Y␊ci~!C 8$fWǮ9QlIyFBT/Kp'ܐc lTU5:A.E~(̫=_&<86E=,ߣtY)A/r} ~|o>ۀ WQ縖a # ޽ˀ J07q`p/@Ayl3&Ph`&HjE '+-.8|VJk)ڞ&G=jbлq7 ;z9Go2JLsʑH9(_k賺sb6B*}}2:Mq;]<"%>R$ڞښ2ÅP'u, nHDJ OZd&`/;2M SݦXcn `Y+U%F$[HX #VX.1lL޼l 79(+z,^pOuF@$,;R =6ʤb\ ZLP!&Q,4ʧPK䱋YjF CfPJsYf&lhF"jSo40=3qÍqE lpFk3MAe9($(s-bZO`j>WT/[a.pU!-q4 nC8aJ)g3WmE+Nd+s7 - 9_t_(Y04q45  #qt6=3#>2Io wkܐmSfHѬ jU"y^@{줬[xl(faY7~c!,Q5ھ*AUFCUe{}8=eTkPBtR9ܻ-@sq~/ .6A\H hMS2iPoΗGpg-ˤ-lëDM;+#0;SEn0g,䍩B߬' ^R|lQk*KvRyHQΦHɈ+[O#zחY^wѕW=,k_hAsDثi;EJcr̍FUH ̄)jIAbZD6wJOS\~T|ccq&v7' X!)JxfQC˻tjlvz2j9Rh?aOQH&آ~fS >/?8Bȓ|2_WS3XYo/|=J 3kbC oM^9 ydE:KړN'rZ{v:RTQ - U~(KEL#y3Kܲ(;OtF%`{RǠςPGBjm%2~Lr {JhmAF82L0)"t j^;ەZIcJGyP8v-J|4=`.&,:UN ζ}]75}K{;M14li*^HsLz9*TaKFuS|97_]`d0:h[{^*lwvHnhGPz)Q*V\E|l1[Z  B0BzΩAgT/~Ӄ\L(?_P_}ЖXInkB뎮Kv0Mv He[v:=6"|vGZ(yjv45Bǁ0H1\;W~ ϝm!|ֶ޸8yDy J e^qIA n*PK{%,C@ɺQc`:;Բjp7ێ RjhzklټSHuΝʣߎoXJw 6J&ĭs)c \VHƩEY[]n~"怵lS=ƓFDGI%LM`O÷2gG/dߞz(Bセ C hXR tb[؄p"0ykF H(0r+szah{섽B:-j!pAjG K:Dbˆ51ZHlg&=4>fq.*DJx(rY|f(tOɮ/xGj4qirE|Rs;<OG?KhgMJDȚ=">q0[ F(tq^RtK+~*bT5bm.&ՕE.ױfr2uX<W&槖{a,|/lwE<7e/ w{t/Ŕބ|Ve# TQR Y6T?^MÎ8(f0aA9D '\@spY2"Qr&!!Xy--s3/]IVWVcW0<ؖOQ\% g:|[%;ܐm% \/*n@{eqN 1YjP8h)rX +W~S0H[+!M:8sw}Q`,4Eu|j #j pw&(v?K$脰3 9(~o9} _~-xx yC=# tֻE6afBcYեefܮQ YࢀB=d"K3I:8au2ʸ?,sçOǎ]tٽ.اbxl[)I3A(^fI#rhg_`|XK! ng\ foș 2 !=k!ߵF[vosʢȉoz5+vxCCP1oT)BEi1OjM_abLx3S ^*Fgv)B}+q;e+tO$P"!ofykH")m+g:լI&iz;針j0ƈ&)XdPj$xϪϳåUԛ\f@wSj8:yH 5y 9fc[^ݦll0oViyrv̨>Siķ[Iy|韏8o7F{ 4a4: B4L1=/pb찼"aw0?Q [7U׃J Xs@,5;geD^FD tEM)4=k݊*(vǰcDb})SL8'AU~nK>/@E0]ksf & ىFbS%FJ=;.}XֺשMBGUOh;oCCáI6!1cɪ@Aizs2'd/5Mn6;M:6C&G~} $1ۧgs-?=: U-.YݽEYyurڢsiU's8qwÇG?j<^Ei[ ˪S`CZt(c+yҺS+E'ƨu'Ҩ]>:+VFs]P-}Z34͘4_b⹫9-p7o6|l/{uOo8Y]{'>oQhIO#颉R^]L:ۿ r Z1w֤ lłU(f&?YE8/_|,؛ŚEW`qOS0#.:4,[w)VTW_kk.7:kmyV7Ȗw^LfCWxÕ \xF@ÓECHС/2Ɓ"c|EHު0EOK?W[ZB}97,_@iH1[qB)W.&;(x‡ ˃3΅dڣ 2{\1MЪ1wu\.YpKZ:9?>r @m+?_C53J}rtw Kh׍sH!ULz 8`b?SJJ/뭋!'z}15 ^ѥ҃sdU$0y?$h) Pdp&D2;v]\hz! Ḑ֚> j+&F޾dWi]&}/}@P 8hцS':Fn񿷳f*NiPA#ځ$z{x򧨳&ZݩD?]hp116`;lD??qZϳֿн#~Sû"* nm,{mPrPo"/@\mH/ӁxFH]#'է@ِ ͳh+G qKz0hۼ& :m۟$ER-өG|}oWG* [RњVy2`HODO.Fv-~[>\eCZYI Ǎ3u Yc)Bw vyQQ] 0?dFm-`]"^t5NSxPXf\2 !\#]zˇ܆QS#VJXqga4R˞}aw_RpΚqx]DZS3jin6DT$f01-iL:L3-߽c064EC%W @c'[@5j,=BV>V713d2݃[gp 5={DBolo4eQ1݄Gࠫ^ XGK7jd({S}{Ol T.$>"Lu=<˛\_?kȱj2?[Vl q?]p iPtlwb^ﭟSuVxF+rδ _ h[sSu&Hƭe.i.K' T}yr̊fK{ߺT޶2]\)W-Ի(á^[ѦE#CLP^m` v]8V(J')EwӒ\ƃ1J#DgQ+- Ȁ, a߾ST3 QuԦGC 0yF* JB ;ZCGr /t ) ]vSwߣ˧;\%:-N,^]탓4qM.PnNI:g)/D mM;_Tl͙fa_}tMFeh%=)yf&ZI?QSc\Nej]N} }clėy +lwd9e+C1(LwOƢ.Xw@-ӱHBfkfM7ZCSĠ(*t֜,e G>Aɣ"A->^,dCkxX6`\M0H'A΅ϡnI>e܏|\vsqF2X˚TFG}%|PG  aVZBp=\ו&PqH^=iwz:% &Q%E ]Vl#v\QGB}9j?Te6f3(v\ "5pC⼻.,!EԦߌ;BE't9%c4EXP- FXp饗JYVߢ|Hmjx>Ɇҷ^>eYqhPvY at#8!^YG&:!*uIX_qN8dvة_.f*0y=!'4[ͰCv9ZTK*Pl߀)6:K堔b~5~@D-ؚD k[~㪇}y\JvmՄ&.rD HNhذCu&!B$Z0͚"u q HsZعF;p0%UZy$N: _ *(:6V{ <ݒtCb^8!0enPEBY)wddz_6:ԠieXY°N|T۾,E/mC&K. Y%Q賰x=PѰ0]|XI lKՐ*l8: "Tx%j2<"L'D ]єBB(yMKDLHFP=$]UZJڃ(kBi9!2Kfr4Elw4\O} Fe9]yEy`x>U~W@}e{c)_^sdb͔sd0'^!.ޮ{N,*j?K_#EUwB&>'atwbKpPn ܳ_kB! i?T{bA&ҏҙό&`ZZ?4#)J> W&x3j4;z5 ku@` SdO E[kh zi|=RT\0-N+JYh]ABȖVJ'.rP _|R6*%#n-r3 >0b/F^9U?3f Q4<8VlsMlhl{qNS4"¶uq,\SJ:Vtҫ.P2? $; f:blgMM*gF"!9]#ߛ/ 3hS PeC÷76 u?I 7E0)xc@_6j<603 5J`3,qAVYk0F>LD Ϯ⊴mzx}VV񁯁b )`JF\hD2DmZf&e]TU|'RT hOfs##dZJ r2I"HSšKh'ZG ?cQgs}šES`Npfb?Ȋ#s$8ؑHQ\O $@9V_ę){_E.Aɗv*t Va/F_ ,'v 5twp079t:(gȂRߍ= DpD6"Kl '3ޏMVyIdMsZ׍)F\m5T0Ф D.?Ri*cuu`}/Io)_\ۄ$M:rΏJt!#䆎 U5\s3[nЯ_=ǫ/| dȇVil"ՙViCܟN{Jvh0/^7 $J&k Jb0FR l#CXN7AϹT줰 -\ Ms\K5d.`sgaQPNb}- x 7yLf)-Hv2C Sy0 ƺl'_]fMor!1D@X"$ #9j45jW6r3,E^ȵHp'=&Ÿ㬑i^lD,jxLKkw3ZVxEdy&JtfwnIdAW`{O(b{;1 sp?j9*|oߘͩj}Իſ_b4ٵKv}()R-ΫSni.B-f X)jurm4mvJk~+``8)#=,bʱ_V)W;,P+LEϔDeG璌2TmWiK1W?6`"):2s!z vdß{0X|x;24C}mqYm(lKHhiJH &+$!Y7+b_rrdI}ԡV/`~Mb¶Ku:z?㠮t@}h@%V1ەe: 7^& p g3kk(L<9k7`Ԛ)8ނ-Vt 1-^m}s+X/6h\i\Pr #C0T+b.U2}SFPG躓Xb jL7iers z꧑rnRt(iDd6  )r 50oNgԅI` }#}U(`<[!ƳS0%rCXjՏ'V^nlG:hEjַ({̽cC4;t;h զ]2N>7pU }oȓUQNygP沢nj0-~8,tj$^Wv9zU,3f{DxrH ; (Q_͖_TR(k@1Q_]D2!gaYvz)xMe]W`.i'E*Kz'h)?J{^d_2-8$*"`JUkOb >gj!ҦaD;C;8$v^G< Cd,6,0/}1o:dz/"Gh4B" sp|s&{USV9i6F_V<̆~&V _diW14~C,Ɯ\"/nǘ5__09!D҃D2.dŎ$s}e-m1䡀K.D؈ڒ7}:1Zf&<8GxQTb rO-MPm|w/X<5DnB}@T*G*=怅3P4*r0 ,T)-;{J\ WBn!jnS ` b-Cف(j<#x26}ç£!h:C:OS wONS?V`_Uޡlz@-fT; ݖ-iǯti}pAK7J^TmnE67M-U-ܤə tfP^+'+N?un KԒ8{c/Xa-Ria5VBUŻ- "3ys ]=.!N9u|-]tniH}֞v6 <O")c{:16DzD!YI~o} X MDy׋Z2 3vxa +wYV86֡ܯto648ޙOTieVo"w,)\IH?f]zxDϼANkbA1LG iX&Q4{Ggl~{gtjgtּQ@ d3jWsYJ) 0x-)3xR`aO1E *nՈ,"P7&N6(p P>bgVUjŢ<1- +R Hfn[J n:(%ZdѾxi"Or! d9C@ya9ۨ'Ԓ!:_d:pj6\Tl`PoGR0*!.R,b^zK9ߵySK/hl"94VO ͠>Z?y~tn1sTA4d+O`Xu~(׽{H8Ѱm ^)ۊζƇmRflbѼ$Nmz;,V02ѱ;fr&,L4`a耛[G*hwŃӸGD N-, ;o"zI|Gu1aV/̙"}l-Ş'iv.cY%3f ݫ;e\ yEt~TibLh426p/O;BW%0@w:ɔZXLs*1c5~Wz\pw~Yut$E,*E|{Km)`29(,>5U!J 1HlƭVa_cyGl(yqo|fV!%{Neoّ{C/Ǭ[ZfӡݎM,Te*N.4Y֧y0@"n5 [55O&ZCRgy2lGV5CL8FGK Z0ڝ6;Ǥ|4n/#zj`$C9.MXX05oP^La9xn]Vmbr*ruN"Jz5ɟ3I ޸-2p삺 ޲Us=13u3FJ6÷J `5D4|}dHƚfΐ_b`6QM`7%B _bla[ zBV AEQnb{ Any{FeBt~wr fMHɊI:%Vcb7GtxMv H:Pvp:kGN7Kws7ro8ؙ |{V='Sv PH.4Îfj1,imj+}'MRr}Nju7Zݧ}LR"B!~8k& qPK)0ڸA:$eaf!*v-hh}jjkPNNqo/Ôܶd,ʪ]Bv|GIjCDZ1A- >,*>K18Cq izI̩ƺ=7vU_{mH*I\1^ 6Cڐь?Xw"^Et(cԏ5{} FQ ˺~(gѫ+Ow~G.FÃ̩bz/ՔΪM(n[!=ЌX&@4n%@dP>2lHJA ~b呗 ;BMn h\ڇ^ ͜/N&t||g)}(8qӟ"cJ^a$Bɀ4ռ uӣVBWRywPbs j5 ݸT4?:yu62|=Mw#:cMĖUr,3S)ې)^S(sk?2A$h IF942Lڪ I3z,9dx91Pyu!]tVs"L|hR`~mԈ{?Uf.szZ>3+D8݇JkY̧āj7m<\NGM鍫Q? n)pQ|XD[h#RU*zNJ2{39b<〒LZnq ;OF!I^ny%znY2eAQд 9i,컩9(ry9`+?b'IЗ\iL%z3/ bE!w7ٴ|:d"h~@`UgB=VU! y2IaE=-5oeM@əPI2F?aalz%8yÃ"1'~oOb4{;Ϣ0Geh9ڰFvz]Ubn^g&_n/Zl";~_[E$c\"c 4"BAERC':2VahO(;!z3IsF_ w'5`C 7S+¾Dh5F.%ZaXs|F֏t A`iՔ}s {_H'eШCϤq\LQ{^k {-lTƒ1믒T2jo]T"a^:uߞԈ 㥱?އ%<%u א"e;eq QA]`G]rZ4%RԲi{6EV4̛!9+wீST~\nf-7Jo(4D|0K%LX6Z^U ,OL/YZ qipnY9s.d)Uu{]b ('ת XV `kN,Thڎ٤G]O.W;e_y ٗBHݩ| lbP8K a kdpㄦ !30ņ*.lBF-StYaʗdwI(ڟ]AZxfKvafu*AbU@_@ʵG7V@Cz /8)Ϗ-π~*LT_(<页D|onz^v-(ծ>V2X|=tȻw#Ĉ\RuvNcZ祴Yꇐ[([Nn |VWV0Nսog={o0sQju"2K]`S㫭~DS0fSbq'@={! PK,PL|GaEz;8j՚ᦊije+_!Ԅ'\Y9*JWsXdؽo#RĦۀ{aKDc}Na/!kp:+o]iߢ^MAo Om7qqVy.Ąb(|10W ,Ίp~#1 lZgRN$,*w94'sQW>~z3%m"-6b+S S/t7c D4Q4l^L\8Sh25Fˣ 8XwWV[Sy6rΊl&QJ| _JO4^|}٤^Ah]O%8gѕ[|kn`& o5m=swC:XwPo!$΁70;؄;q^M"Kl2 m= ,iñ)AMlsyBO`GXԤvUW ^paB?:UG- ͻ9ؤzSj֝7fWUxdrjHb)<$*:5bȵ1' =S7NBzHZ`:/f e`@ &[ƔlL{ ѱנPg*Ҟ<hZ\쟆aCg4gn\F{g `PouHQ)@PڷHk# Gĥ/#:(~!ԕ0YQd`MHo/:Qya8&z@L7HͶ,:qy| #S3b[?L!PB=C6[G:E3K ƪo{ljzSS"۩n(cy.*dcB]̏`촦e=hY+̠>pAV_. b?H#eY:R =k r1VOf'9߽|H_ܙv%fځqoi٫b uU_qi(vtM/ aTgO$c"Ho]vzz]$aW.w$;:ܻdPAFk2& p 4p'( j;'X ο'v.d }\kAE?帬HŇ7`ӹ[ љ9m#4L[+a0Ȑ,0U ԯRN~ZG2:$r'R+DUq{,Rѓ" !SڿhbaefCӼC `Č*ʐ}Ӟ11:W wV\ԋ,!Ȱ-2XObY֊efU}f@;i}O'Cd#Xoԣ4x|aC<]LX%|\*]lfs}z>yTTx[A ݼrɛ*6lôTYXc V_JLJ(v.$Q~1|-wdfwiK[{/֜hwJAY3wj6Q&+(\l ۂ%94x$#u?~+&HhJwR50ia{//ŗer94gB-JU3 oR zid7G g>e 9usܐίjkE|ڠkz=tc M]v}LQ a$4!{lSZN'P'ko ^&ܩG9khDcSH15ݴ=K\P5fazN_ v"!@ONJT\CU1m)(W g'q- dICZ<'4jP4Y)N')} -0܄W ނ܋2|6y_4X9cLʽ_](EJ>}-hgcu뼪vTU*U5m&kyTv<3Cַn$14g Pf|?l^+tCG.ok閉bȀP?\[jJ=8Tdapm:'qtۈ`Tʨ:>کqydv;߳ t$a88OC\yA.!)t$C3>OzbYLnM2q:r-tBRaWw(1JAhV0՟ O<dQ0}hXL"V.Y#_pMSɁe !j0B)://V3$(R (͖uF|TQGtsަ乲a[Am9(XcQd&R ;-q=7d=I1Eo|MD!2>NlAq%* W2VCv*>˚&@i+_\8٦Θ_cWBkAuXE~#`lAχr {,T|}q)q7,U֜SN& Z} ϥѯsfؚF3H?BݬB3kv%i4{AQJrx yq>G#@ E@m܂" m&O ҥm"RU,>(ΐ9"^)b觮qhۗH*-KN/c\kj 'Wҗ۴BPf831XDxio !71BSTo!¿ڴBPVkC2Y,ak҉`8,U|x7_gX !mz| g= +o(r6<3j] ǢԁF?ܔM%BnZQ`nӝ_Y~8]) Jf%:r(r!Ej?jvcyuNkD# ?KHh_GSab)f_Ouʗ\061!{TrȨ'"2:p z4`֨ p)hO gĩY#\dQ~Wɩ׍ STZbƽ2|_DtY%w9#q6XCV'eJ.R1ߐRّ,}EH܁ 53<&L6L#zʣobncculaƙclS~ecp9uJ7h/DϰSJU-M苚X@Q x]\8D DP?p0NL1ńeɁpL]ct~aD)/ݍUj]3G CT}EwzL@:Y4m#˖%}-y99Stk85"LINj+-;mऐ+tq3 謃!1p )P!:M4Yd`Huv&u'g{ _`N=Ҧ] I.哣B++"Cິ;\F h_uA"Ó.7|"- Όtܽ jhg?LU'Kǟw-w~)r/Ez%k<\X["_ u>s M|>~ atݬTVt^05$lVоÍ tXg>u'MֳZ.'jDK( cozb~3Zި{e`wDF'0-gOyq#V{zS͈f-l)!0싙kQ3HL=H;%DӥzHB墜r O4vp >e hR($FŦv.9 PCJi_s3@TΜֳs= \ K($}m / VXy5GvŽkYj5^G۳`4b/hNOPH&s׈3O 26KsZ}YdIע 6~CZQq&L9E5 "t,ԐNׅ -฽?o=\ze(í=[ \tGf@yjk ᣪ>Rڍ=zy &RI_G*R۹1J1x$Awo5G-+O9[3nqo@v{P1f% RAb3ߜf,c~+,9 .XQc4]JigƗۼXi06_enXZ έou ͎L'YP+]r@wFBwp6l./ԫ@<5]#SQ@NV [dFiZ`L89z,"kdua_XTi0jyoilLR[0>cF<:+u"cz@OV̻QCOL 1K%DS+c{pG-W ؞i "[{[˄7`0#~n#K[g#-%;6揑|BfaGDfYǭbw9i=o@UQ.ٍhw܄:Da 6Ja,JL>$H 'o-[.`+ɤGRKq\ VnEmGR js9A4aD%\΅[VQ@8O zۀ ^@8]Oɥ%_ Z _j4e qJŜ/%O Ho,7Pf>Rlw>h!F)QذƯhFj弧TzvHMV=4- !rO@{KaO|Rk a^.kYuzȱ`%c0*d<5_֢$S#J=sEu~}@U:\hb:#g&ynj΢XukzɽkD5Փ, QM gvx.Su2> /GLtNmW2[ PAtSv5A6/|#^7Z ԉ?D-1hQM-ك+&śoClm;KdDxѺk?`L;,'7v)Wm{vymO{/>5=!sH+# KWkL&uKN*a=U좖symtpSbP˙ *:gƹL/⁏:2g=$"{ ߵK1j?Nt|pzGnNGC;8&sIz M,aݙ65LA llvxپ%L z 3]K Dw+P h,Z `9*g m}qn0++$8y:Ρ,YgcgWwxgr<@_sT M_&9іA"FN1Fx Phm^񝭓zMx$XLN@~:  Pb ||2,= " e\JB@`/v!ׇFMWn0QWYz2-y`w{UY9 ՋPgL^ x{rܛ^3~/Njɀ9\D)  *> ;x߉m6jONuA=&0p6l 5 5yR-FtVmlfm $&Cg#[RrLАG*.mj>4;OLj6Ɓ'[R?'OU~ŀS^CG¿=omV֎ŭ+lGȃ?@~F!-laĵj$OJTVǗiF͍ 4RM`SB.3}$jу,g R `^+1D:١Uwkf.ȒpENtoc{IO =/pP~7:-)IQ?Cā/A\ xe@LC- fc=ł"cl!1":Ӵ® ![9&W*n4/y9۱yc& R-fg5Г|q%(t*%(+#[?# HX0=W h61rZJzo()MNRnK-u݁(Lk Cπe5v@(ϊ՜hAi18f7 }=,aQz/Qb4mzXz(=fi4k7kϟ yIw[Y0*8=6};=:"%C;xğ}u?5J_#/Ldm*('sCXNïG覬 ɀb@r1Ef3bbGTǁl?WI0D说ffD0F|A0n"jfobXlڨm K#aVހ TXLRWHw,H߂l@{9C~9T!S>Qh57@I #֔)1t"a9Dʂn5Jp\j0r\Ȉi]*r4*q}tU({s#g3׏5Ɏk(^\Y Ąp(g?vnC׀VCKدBR2Z~k z Q&n|v NFxj #c4rfNլ/,sfyg}`׫im~+Ǟ4A,w0|X_aL .H UoL \;gl6zIf&"p{乽HxUID#_|eVy19ʺ΀h9q~ fe|]ugbxfFkb>NU1`\mbT t5e$tgwط%࢔hʗ5֮b>ql=')BULxXf 8T@Į +Y`׵^  ԶW#>o\ ǀAed.̺[PG-i6ƤHV8~ԝP4ӤCJ-S[G$y>N@1y>QQ#э=^β6ylfQA$C)X39OvVRX+dͿ4ڔe=bE=@o%6=DpݐA:fqM;`,q ˠylo[)~OO}`ו]9IJ^L8sTB"~u@-N} GN.K81H5m |;+ R8kzp&6ƛ]:l7QEEcj妢K%:dB F6=n\ a(#F 6$ 0tI7(u)J* ޷! gMkLᦨҽJ$jЪfSYq (>ir^^~G{-rݥ|D @ "_=t2M%sPR⎯e(|e+tlzY&0 JQ\ƘHSfN[t C,7Ω> N'W\c =)ʼnf ʨ|vdÒgvǟpKa;:M@ rV=yx^ [߽+"-=3 (G;qi^'o8Vuq|,V0nqN?O=,yQ;ZiY!sy$wajtΧH84" jC.sY@@s9SGtAV.r1TEFh|1젇p!u|=\͍QD#[ r!Tij$>;-8:lV5,W Q0C2-L'B \I2P@?Z Qi, aɥk b#V$e:]!mf7ͪϨ6'ܓu[# &. aF >. znrv;1ip3Z"sm< V=|5%!̖Ai0Bc\œסG{ 7~||` ׷/JCvD~k -wbJݫ0p QM͘"YO)yѮRAgjIMb  yNI67B/|0qםSR*UzVVPXH50,]] b9Iڈ+ʤ΋ .@%cܹSQF8rsZ4nAJ.KV:T}bp隗<+ yy1"udW H#|#W('}J=)jR-@l [ۏZ3 ǫCugg;~E02X3ƹ9Y(_:H㿌`Ӥ:Nz+0]%f4AO]XMd/|!7h8j?V5;,=l^0+< `w2g=,;   rD`|$}%UV"K{ N+#TAwB?qAĨ ЬxE^&O6Rf\YYchh* V.~ O )-Ok%N*r\`\? ?DKNo.Xy윍v?wK҃;(ʊi)dʜЫv[em"BDa ~d'`#U1#Iq|V;A䀡!mZoxM6Pv, NqvC:$!U3v'ٰW6n⬾fVLkQ\6z֩8J!cȎw0GK= }Hl:j&IOZ0 )=zb5{HL)? Q":/z]Sj("^g1ǧ[UA%j-oyq5] < ^H֣muˣ4#QrHwq+=/~=N?iVw])J!Ky)>Pcs9NB-:|{ճN[܉0IJHz@y5RBUbn 'cD{K4v!M51niC)=8T{lUVd_^z7) yr=NzO%Wm #Dޛ6QĚpͪ9H#B:<8?ͿPhoׄq̀&j1s7ù^V 0E8vjKY QWwߺ;4}ON{)Ȝޛ'd:~/CoZ+[H?51Y&>5{ ($9;=ܦ.`kuyjqas6#?I)xfַG1!2+ζ##rxooO-Ijr  B??)>>)5!GA;I~BO^zr? T}hnm?,D8j{@.wDx׏ܕhgSQ/{z 1_6HVoG '96}ʢ+!PmͽX͑|֯ůPZ{"Us&;(cFAQa`,|~3\*M#[ Qxzæ^݆G;i,}fQp K $3w \պ*md znv[Z׵:F8jJh"u6hD8?g,Εb=lg2MG^Pџ1!Ð p?/S3Wt}"K* 0,=+1g_)l"c-0Ƌe')b%Ě/!)ñۇb3~ayqJv)93{ ZwͰo$HRP}3UR9 vȵqUNF+/sei%]W9MlSᴈﻔ*yYxCܠ g[U'j[\&dgs;&6K_:K_O9k׮, xaNL#' *r>ƈ ޳-G W/n,Z( nB/XƈCс _`C4Z?bɣ+s+kKu.J2n !3oݺ2FBiY VKU ]ʪyp!(ucL)>&ƼEw!$CfjO<f0Z0}@WA0F"=0[q/^xA۔CDZ"$xV3HRzb KP"n:7Y ~0\Ψzg\t^  ΁w^M-8 .Tag(VCe(ܞU@ԡE='TW;BjWYٳ7i,4-c(24Hg<A̫v@B4\BUjwseEnDBXa5M3j9Px'(6/o}/ORQGҌ`WY`0"9,A Ndu: R5<P8ᥛaHKXk Z< U L$<*bccigzZb]Qyčr:qqy/mDsAx_LO-u~UAB@B"}J>.dDenJ.7m/aڤ bTϢE{oR_ )LkA[ 94q 'qXѥD*#;nb R1 mǐJuE(rݞLgK*đV+M/9J_މ:bd_SaV%:9rUU{zA/#f,Xa3{E>]1s<ů:gYșw[N,ѡeq ]p8 Id,]Mg &r`[6p "QxcG ^DD* uT|(QoWWڸf(0l/nyʶ3#dQe#ڹA=(t_|m)RTQ44}';ti^zr׎79I.DjǪG{`u2e_r>hZ )}fDvPgj6h~*I2hNpڎ[7yدg|l)پff^uZ2E'u|0&j?jݮ>}ʰ:beNO /[3}fi=mS}8tF1ֽ/}#'֪x EFecqe"7pw8&?U˴l];Z-T)>;٣ ңK~unˋGrLRSTif*x7ѣtZTYS?O 7}Sbr'XJTQGK}pXV?S`D܈4uT2DpzG>.Êl| =c)zAfSWj<8JuOv(*w>ID+ɅFu~|2k0~ԹDy6e燿 W0uq`JI-yR& b ZuMoИ"@&FURŇ@G-&@8/XaV[<=[dTwo0wT<i8ڍszE1Gy:k` c*~)yZxOPYT??벑#X0Ms6:ƷCݤhrZ|ε.5{X@. o855Bgz!?6M?IZRb_ɳ5!\ qwF.^fKU&iH/WJr=[R;+:ǻy(;oE4u\d:% 3~׊.U|( :1"$yqUZa,|ɀPSo.h7PpV ȁ+Y巽!4RP%p"G9mArzşθhAMr5Wm]8f~<x@!1(ty0ȅvoQcm^#[E Ƌ +-Nқ_w2_+U!?۫I+b \0n9Ɋ_ת=M ~1[iS>~nCzb&=n $>-=J[6v4 DiH<`;%?ws)F,V[46ްs!tjQG+'Dnf^́z5N7\.c] g"60(kG]qd 6@MPEvoQ'fWҧȇb`{t~G|5o'pM q:aȺbexDXEQ僂 DWpN.VrX$[p~V1%ʏ^@w\w q0@.jgVTkr y ˜!]r ^ >B>S]pOoych.o9Q?)۪#h_pξZ&8c1,\wXJx4[ݽ* !i&)8/z)e]1OD7=dcԔ.mňk mKVc`§+3󲎢{Je1 c 0͍м2ڟ0"0+;P 8U uQ16d8J9#dWl27/{PpG,oGJlQ19Mσ>߽){CmJ+k4l *b>t|-YPv_LZB_4Җ 'ңx/pܐaG|;w#Q,p{3K͝Q#>yB̒OR3XA_gM<﷜ U=Jst? =t# Ҷm^ JmZ7k'F 14g.9kOJ^LSӧy1l0'sN0Ȉ{3@L6_'@HM90ߤc6̊CS_[}xcl_]U4nqQwX}@ |~q XU`F M}F'K-E7O3FVwyFhL|&ccceE('&EqG6* 4~>x Fv'NF{#jl*?xi~HIlcJDP=Ea,D{=M8p"yg #ȶyk'W&9mjWZ*ZqsKslDž,< X(*[˶)^]{3X'fI0A˲NV%]~MUvyx-ٶOĜ'9e$i 7d:= D~OX!fTuW7"Ro}Kr*( 6fROQQ* Io$hgG G̈'ݢ 71:''qftfpL^9qgDSwQv0牵dYX~^uϋ^|5B?95=5DqqDZ!pj@Fu9ۅӾ#zv-mWnK9WTKJu6A;`t}j e^$8&>BQf#oy.FK9cDv$JǓ yX\Du"ǫRGlFapaa73ͮ1 Ζ~ZObC .W'S "CGvx*[Y35vH1[FFG*dꅢ8eغjVh(Ug8~ H 0>3o#Ң:rANXS cj)1w{PgPǥF=6J džOs{Ѻ*1j?!`L#26!q/4LV?&K\zұ Jy /]Eki1:TZozj>/'i[r"5tNBۜ1b$j8to <W¿HR  %Y=eb$] J Z@6mu˶ /mA h4i: < !5w@*}֓A8#}*O/_HD6vko#E1ڍ]opnWF8~_*@)._ZCglfx-?s(<ٛM-BӒ, +llD۵ p6~p_KH$8:oQȑcPiGZ"~4KzYC1S-jmU4vzk32J8IS-zRw[ q;hVAYC:kۚЏ0@H"r)#jX0>|`ۙA}Ľ"95&"ް*(`w s=8f4QFW p{I 7T&;ps6$Of}bVL+M]//[ɥ}6 eoPH(~C!d`A' 윙ȍHxҋ&_eaDR[(`4g!(}!@+ǖ zTXxr5;r<Ī~)7PO.cB'`Ψqn>4!( /pZ08 R'`E(2u#\S>)EV#1|{ LJVhIZKRlo#t~)v:2ןfS(ao(9Z pƬ q\!Oh)"l#: zoo{"|ds%:jESM7E_nҁJ=;E'u[J&z:|m!󃥡ӿ(sM-&L-,;%bq 9q_o)E3+` ~gJD$6u0M^W7܅Yy. v,cPJ^5>a}ޣ pI_ݩwqQ~΢'J:fɁprPI^=a,ܔ2O+$Eo9XRoiraA]PV#'tRE؃p3==&zxlZoT~* Qq#~v}8S.Y^KDd&h~SҹzHpUUb#ƪUb3_@\&dٌ8獂$mbklw\bfh JQ[A iv!GG.܋qR?,F+]Ɣ"k*`b#z8"Rʮ?QEz !ۼ`%Z(Z-컯:dبg+#jontx54 ߮ZlѤԧE=DmuuzU(RzR ,DV3O#@A/_:2 ?ũ"s,71fbe?i?$3^=(c5]Qd7eHزR ڊdmv<-7cU%,%CoYo' ]ZLTO7v(Yut+ZNF Z$)#8 8 z%.z^]6VNKq[W P֛eaCOg#Y n([F # eS6'@'deڥq3cTLa!.@VB6x^D:F60]HK뜵uY(D j˗ m:>GyͫuH~:+G%V^UdGzmf ʯ>O(p?9 [HBЗ:}B;&xe- J!Cld 1s%'N#>:nܢY]ti?wJJ0=QnH671fDiRӾ~R<pZz Q[FyofvDQj:J~%IyE8Qh>G I, |6I~lQ^D is <IUUhy0GC5G6:h] ߻=]Ep z'g2yt2QT>|0ܬq39$2z=qPYCvCk8zJbf\t"@L$?G øg3x]q2ZIEV3,䠰+bbn?l;^FT-Io{0G>ppQ|&pSͮ ))vWd o:`7Ug=x.z`p:!q|/- &`14}|k0v@639 !母?9sDbp rE86rs'9"Ҳ0k(I^͆I4 w+|a ^H<q1!3+*7x?6o6yՋ%PNv +Q)6yX+~Zm|X@5_7Ҁs~_-HR her>#=6$o̬@"$gA84e" M3?P7Yq-}߯|K4>7ˬ1+̫;8l<5k {}2rom.ݗ~<7Fa!%08Dj;e9;N1"Z[ 3G9hoV;J _&BsVy_bcy?S`OR(+v/l8EkUkh0Od*XL>2(H~+Y񴹐[~ƅ7Jň*}if#d!<aڪ3% ) {dX.OG{Cz>?BДQLckwu<Ҥ؊8%4FCВO˙8uZ+@fOf4f`V݂= =4K q&r>[gŷ(H߂.2m=97_7%g( XՎo"+Zq), dsTs]dkZ)_PFuR.B9[|zSJyGM&)4f,zu|۪cZ|Z: |03ve 2jOhz[6L%PT~ ls>zL\];)9 Xsb1m(Lk+ 'EDc{(}Wo^Cwsȇз+I5kƹݐY8ݚZppy o9Kx }HP-&TaN-WZ_(w}3 P9` !W [gը]hC)DOXuZc59Z͡hk#uVo / l{(\ǎ]Tr%qZpRffJ .AS9/k1ueK!3 ^u⴯)pvRע& 7o0ܐ:("ZL㥱QB_@U*tj6oh}EdԷĊ诇bZ?(GJm؇ o"Ak VUYYH Lr hccѫ 9{`uEC7Q--N4l fx!۩0v3 ~&/!yyAAlfD)Y4 p;%YyVhkmhjuܩ#X2+ۮ]4@Dt?*%>t폰ǽy_S&NWC Myb'k%匼ٵKդo1_%#"ۋ5!2W>߫YnSs{A+ 5aG- 27iϹ]Һ@ӢaqWgANٯ2(A:)ALE7ZtiMTA9loS 0! tbJ6f%:JISwVN9ms8Ԅ<QQ̓Gl-̳?5b/o]KjFݕM,-yQ; 4$&G8 "T&P[fDWKラ|JQ!I8*9v\V6#Oe$QLl;;vL$MsRMAY~a:VѮhz?O$R&\U/'ň,Uv)Y?)msOnSǞ\:5 {\zurw;j';+2c!'py Nt#XzA!wN6)d0a\F^KZ󁺢Bѣ \N-u Uiϴ'6Η%R gQ"ezg =V1^+]jr':a} YXTi|=_$#˘FC[#' Nj ]"ܢE!$Df2c ޅΈ)4eԙhZ:hX~PܓWW_.G },r {u}!I}IR-‚g 쌧K¼\_!6QaNl_z:'O70e Y@8˩Tu@@m*Ӣ%/Ogd<! W}*{~P>8{HL^qHle?\>0Jwkxvø;mMw\P*?`pW!5Fj))Fs'߂[AYy0_7hd1 H( [oV ZȾT3{XAs_;,z eh!wƿŚ!}( SEuu`h6= է|6ejZ,1< .B3]7jhuavsԆf6+s 8/ό1~ܝ թǝr6RTTXh2k숞ǥ"> GaE2Q[\M( 6K^6 6p-W 5-pOvWhCV!P&l㑃b.{nMC,׵7)3➁,3P3XgmJ!/U˅&2\[ٞٚRM[v~݀n̋h\9bNp]dʙ׍R=XϧN/u JƷH` LQXcq' ^nx;b>Ib GULh%##hQQtcQC oF@obU@^xē֙}q]M"⩧XΑe v#|3v,UKV7n{) )^ hk=/(*.p#0mf=83>cɍ|f0VYd%0u{A$2!qRB0.b"rZBq'oYIO>uHK+\)Q޺i\FiYtc׉L٢Jz"R%.-z5.O2Ek|kы<4ȦSS~:⃕e|ViUz M.X.iv=TE/%&i@4tRR^Q+X/B8Z%$<.A;qEH6&BCw裌)a?6{'E{x8QfOFdu}r!Sj]m`8T5A7wyQLN56x tJhA ]x;i $T'o7U479SQc(z@ ̆M<,8۽L Kt}lTӅnQ!Jảr P3(MU8 D9#1$#1h>>]e 7/x"I}amvU9Cz4<5,{Yv*  7GdWe+pg~cBzeY[:MsSMe^=ʄmeḎ|k-|%g"44k/DᷴNVB8¾ah#~|. :c!/3q1K>.Q5T]&ړ`61|rm6JN$MPi/!48Lռ{y!UV#DүXtKzZxb;0HKq7?ay߇֍1;!`^$%= C`.7Dj$xLn7q$G1H}l3JJhZ @$#Cy lg٣ک2ZiwUE_y_(OTVup$0%\jWC_ޭ<`jO2$ƃtЙi N6Ha4*lC Z/h&UC@j;ڠQ]竞-BRokaEiL#R([2Z?Ң]%@@.7_-'R*xܳxeS;<RʚճNSȡODm+ّ*AfkgH@(DJӼarSjb 0ڊqaeQe`59/wϜXeWec *$QGЗ/lE% fExh11vj phZH[IZoqɤ Ctħ"2GuJ߼v?\T^JE=9U^uL ?)nE NT|Nxk8*uw#>c{Z.{j_c.U[W\ ]VD8F'n*WAښX^Wýs}qB!*) orvs]*]vKyBȄ1u@aH"tdz>ó~ˎIU-Efy|kʶ_5E#^X b)T)!tFUg(ӟZBؾ=JF yr39['L&*#EEY/O~^q74Z/>ֽOl-?3qRܛ?T]M a')HH^#guҾl6#Ri3+vЄpE,*Rk/R "dl E9њ^g l DmSCLLLJE3ÛyKwPH5+NvPlѧh -V"3 Su@C ~M>2g࢖=TP\;?60~ݠTN-8}O I0WY9jOE[MT ||$o3ӣicSERv');7uی>-WYOz-p`iIZ+l''FJ!=؀1rv*}fOgwA+2gIS;_hX21QBC+Js㟻eߥ:4#G a^QVt06 Vdz1}.uV^&0AR0LłI 7F8%џ<2)"pcMz349:uz[1h]YফyMT: %_=!L\2a%nä/l6?QYC/*śL6xQ@ bjѹH4P* -wgY΀O_O{Zw$]8Y?©|r;P^!D%:o{tX>)I2 b{=_ %z˯]z'd'6UŨofzk(!eVEΓJ pp(1 g cbSml\pB"ظL0WwUQ%&".wYۻ{ ׺$}}#QB Gk(="`'YtSh obERl}+>;"w6VUSSG}=)kb  8pA>4毱~"N[uYm }' tF'{5l] z=2 2IrӛdyB%z7ǣ:t 2Se$FO4 #DɄNxt Wד]mW}~ ȶ o;~ǘǯ@.V1:~/~+<4P~`wV"wԪ jAޏRGLA\ҁ=r" _*s}5'l1 NsGc;z=rōڃ#qLPpT]MuZ8X/L${MrmO1V"tNRg CɹX^(D#qc&`HCOzQL=`n ~~-T{vްɤ@;*4 ǞVˏ~>qRY_)+4Ex#[M˧$~f9w"3}#un0;ߔΈvqyA[}A䆪N҂L ΃#-bk!>>;?|iY (Gs{l tŹrj$pUKR>V.tuB;Ǧ1ZP=Xl}Tb5 A:#f 1|hnFoQPFvdtRnC~w(rz gŝ~>J_WIChWd]v[WF@CJPPcJ-wU;쯬l2Heʥxѱg-q؞Tۃ)}}qC1jBfm#+v!t65aKUؖWX3e3,ldw9ID$RG|}**zi`]Ewd@H۝y̹EـV1ISSwX8>E09z1RS([%9S%JҔ騭SHneϮ&ۋ-,fupw,݀4\0Mܷ 4# $]K ISrxc>?57PuoP)ߎtf)aaݎ4&ٳdU'Ǽw¤{vKD8M$耄u؎ 9oT Z#Fќqr]|{o UXtnZ8T _hkgrஇ-v#ϵ1vZ3lLr+)n :~5uΔs`RѼ:\0Ӆʺg+~bAJMqR4ID` Ok<.Wџ{GGI?u|]&2@{ †*-;%5?) 4k}-ԇ(iqD>-  d9Dr>N0t/9mH[u58?ms uBH*M}()e%;Ճф}a<#@}J}?˿މN Evw %RQR)WHi,~7mslOY| 4B'\\nհ_XQv9jF9-Sj6jk!jtaf6.L]1omXiں7܉x) GP>} ejKґX|T"i6yq#9xjܻؿ}z0d9a٭~wg R_orgV8qN*y䓆j$ʮoqa^ g1&}Qib9ѓ%L>ԨXd "T1nE^pmo!5Dy89?vZ,b]xXx3JyMJN[&XHئh"5qNF]CU3sKUN䵅'鷂WYBUW$,|:6{jps 4B.e$LԏH0X«J@`s^ 6(1=O;ׇ]I|.T~AH?c Q$X^ϼ1uxa(ƹ$eijĬW3_nAPPHAQ7O>l uuj ׊P4vpxiDU$QsӾHwi2Dt Ʌ!aȊs3hCN9)*(Ա0a -Rbq {[)T™pA$UuXLh5U-=^ljgE)`!eҎOގTH^VB;}.C QJyR[ͅيB߂m}{o0\ogz뤉9 F{UJ^9ş eɽ!;aҙR"u𕠀Cv[B(=xn\|m窲@nZF"dX8Rr#fԉGA(wY9V(Ct0n?o{]@՘ɺjRR_^w1WKߧ*dBh_aЛ=q/R X qzb:IUr+0A0G5:8Y*L(GgŖ@N85/8=הtqxfͮҰW3*/q]OsVQw$1/ۻz-u増@Urg; /_4fbO Y 02MJ-džɤ2F N]cNepi%RRrq;Ӗƌ7PJz׷Kv䄑rw&v5$&iQ?^IC-#QSEy|1@bcv +{]V[_ )4DNmz2|d0+ZqPl,mպoЏ.pcSdY]š%,sg!CmNo< 6 |@iC"0j= >Mzm6#T^F'LƮ[KMh$7L<֮1X Fo->(rR7*ř$O5!MA7VC̲/vϼo%bc)^ cGz>!cpUΐl$=A ST5eJ, "}1Z\DY f%^q:%@n&˼؄!3?jts4tBLȡ*fSPJ?("Dh.cMr<g.q+?,-mUۍ\Q4\mYyw&*&|2sM lD+4| &gi>UY-bs{N+ YsSna5y6)5o*\ּhԫܾu6xpfD$q8 Fpo/xQͲ ~mmb51qƅ2 8"++Ҙ];汇gH`Vgͽ%ߚe@r T"(W1{SqK6`AEV0BQV&.4nk9Ӄ6Go+Vk;$&`6Tdz-:G6|  eKo%>$"0$fuS2UvCR-hV|#&o ;bL<1p%qk|I4!P79tsghd"&ЬU ߀lVS2&0=~iH&HN/!*`p?fYw|f e gw6'0XT^ t/o JN!-WxmV#1fWitu, BR}G VLr927łu Y2tS8X9x0ФxX&fU@ҧ-;c0u)vQoC!pCIeȽ3 v3Rj_}Ic.OQ!}'8l9&鹂i@zSSJ a _#Ӑ ػamb䦴+j{YnhAr,Ѝ!=EPh듘 Nڙ@~J:Q6DUTc!'VwA7X1^LIY 1jr/ vf$)I(\vb;/PK&Blz|TceH0!ErlSt"~r;v=i2<Ź!ΠqVv;Oc֬IpZEZF{g!j|egyqUª=q^`íJ s^ğ٧Dq-e=pGP¤K'2W%c!%>rU\N5lݫ>*n[xTU5vZZtr  ?gqS֪OHd U~iX2g7FOF4e rg3mZ%]Hh\ 떸P+/Iq]]RKkor|>,nvaWqmջ[gd*,^Dj倸ԆЊhC$U-mf1P/M2ϰ#t˔AoԓE烐Sضg2vڣ.@#iND흿`iϠUl* &.A0; T+je9b$qsY{w[t;3Dh3[q_]9nTBi>eۗ۷eI#ߥ6K1[^< ÂW[mWL ȋ,3hmv@X^3]iA42i:>Ql n{ɶnyV{?XN7rlkCFea?c3D$E?g[6Ǧ֕2Q=2Nk'yiiY! &!̒zG]5*@ ˝qfg{=A̪T/o|'ҷlqv1$=?z('MDvzįS4#kVnHbvl ~WP%_?A@%|/S6Fp(wdGf&c>-_8k#6l>S XFn=΢S xaրOAjCfy1׵f\~R}WڔWpPwmVk |N.1^a /RXm^(:x{ g U:b.E^/i U! (*ΤEwxHL im+WUѰ_HwJ֫IXf>~PȰEj3L{,rթ).تّ@L>P̬ԸcJ/@ #Nx:T]BEf*{z&RzacVUi'޷H&mCׁ좡=ju9)9 'Rp^n5~H.(?ìf [JW)g׃4y]ŮrABUK(*uV8׽R(8[RWFj[+1q // I΍A)-:v=(0 ՃzzX< I$l M+)VDnbV 2NY+lT6g=PHEE4h%`̼#.MdIb 6(J6_"/xF:* HS\9'zi°@0Ns8rsXPɹ8+4T0X ab otœ󇧠=wLү{$eޑ6+v{A9)p5Da8V{P'?G<(*Ϥ[Lp+D_Wxֈ0Ccx̘U]'_Tfhh6ִb0"-.GtoETPGI;ȴKH"‰U`D5XiurV5ʌw.nfz9Iu#@o\U3&)Ypz`Yv5 EUP v e?yd~b{!YA k3~6MlKHUFB)6Nc {xj`] j&)!&,"'nAr T'S'mAGx&tU?]0wWڇ_ W3 6uAss%j I.J#(M ;?J XPԉt˘x-kVb~n"a{Oyu/; ׵ε눧~bZp9AҤm(\m#⇛6@t`њxy؟,X῎ Euz4i(Ⱥ; 6A*Δ{w/ =&aȘX㧸E<ѐ5'MaQA+{aQӑ 'wĈCb!G+<]~IW[0R-wuYzPj~׋}@57ǥj/sV)`-m.dGotn gT?H*=KyU o_yؿKedߟnsw.1ݜM"g99㻜MdkKq&(a@y#\oK@0KGX 缛3$2BR8lj/[[/ BqH\H_e^pNkhf7526N|4ӓP6',jtUV*GsNGknf~Ꟙ&Q{)I.OiCsmfgeNt|B;˵!=;${DYUS5J4O9Y+D9%I{yhaD qVbl݋a%|A}z2L^t-iM+y,o 314 W%z-GLz–$ھ8h]$:9]k%'@~:ih6nJ4aWY3Zc7/CA(`Z"sYL;25ϣvi}߳\2]pxIֿka4oLA0zʔz849qLgJLfD׷qV Rz6<0i!FZXg{<\49ɘy1H0BO >*4{`Q_"(O8PXΣPǼ X'89zoa0mQ2>W`xAA)ҕc=VDX:'ьLӪoUY mlϼe繰Ũ"MTV*j3gti!ߥ-_eyy>AU ]heuͤbiN{@L;f}ΡϯCTѝz`C e*_V;ih}V>dBG}81sEr(FA;;:t'8:vCOWK;&dR*6 \mVgcV_7Ww D8{eC=d-ga]T{u~>FSKHOqIMr/Z&r]j4D;? !Qi$ԯLk,LM@͞<avXY ;RQ.|{Ëu‘:K(Gbh _(9TDͿW^+$d&+/A?.oGƒ+,9蠁lXffW6N/zS?ꚽ8{WH}y! %lLJ/lgY"dɓ4ubWӯjQo{0 p [*Nf]+Q,LDӉExT9fU;>7j`ZvUW'){r}7e@NI*7eVCSVC,&؏eb sܺ 4l̺9Kw{\4պxh6* = 4ai@wI{ ^rvSxdIyYIe04]OuĮs6C76&`NJ47Mш@5B/h1/*ЍTWk9鈁 %<zYaC.WЃ5t!x]И csn;ퟗƿHi n%k,ˁ" ef"Ft;_!H;=mXE5<@Iecp yF:mNn0UW~?)HrDB@C6923-nS $"G+_I55rbޓvzisL;=4Os!CYi(b^\64Xə71ukHZϕ+@aK>Gu:zMimͮ,N2_&?l.:siX{dYUҪkV@>dؒ)~Z3YWɫHL{e:om6P"kHVzO`U%`n"@ 8EˋKիp?lyN~{e%5eV!+It-lC&.D["E85JEgh:^NLSn>_APGC@jzo`dkʃ )E7*}HO}QϽG_MSHh9!?6cR\\+(ʇo- NR:uWHVYuyXlppEVjۍkj@u/G-w $d,Y꘴X:$9/d[{3s$gX;(PbF)`MuT l9C{OVC'eUCJ+Uk Tq>SoWnPg}ӽ1#̕Ǜ@a؜z1Xi'B]P@IKGşmL"zz+}qen%xys[^wZ 6 lriEt5&_Z!"p|KХ(ئƉِ4H}!|WGYrX$6QUXo[Ӱ@rGͳ ?0ع̧~ćPv/@h~VNHwgeT\G@THÌت-V<&Zcu+ 0rEN4|:v'Lj[|R7jV []_̐f<01eƒ-.ySTBxW?Kd(ާŗH#9>NGiˋ.ȝi;kdC>mA?j0'QCM;]7s<-%͘ȂIw N's1h?Ȅh8:Y YRP -c1 OBD _Go^t+VW)Uja鑹7N-sֻoJ upX=y&@2 iT/`wVGe1"uJ/r&+"֜waG)VXdKH8I7i͵z8lQtt_+IjaJ<3k.nǖ"rgT {٭jyĵ[R@~^a̾E;K UQ= G}u"%DX ٴ:.'%;5&N:[f%kxї[ / #عyb033Vi[{)Pveɼ }ǪCl 󏠛שw?r"*6j!@hB^-.?69{\ǤAaN1%T Ff&#Mހǯ,}WyO [jWʣ[cԎ/Hi܉ Ld],J=g;N_}4-{%?xUUT6I1Dì]~7cj%: ߇ikU䁌Rڇ#R}9'mϐu(QRE.Ǻپm֠5BT޴&i}J.eJۑ-wRDi5.Jɪ[|| 5L2GF`']0Ur-HL.>M.A&*=~bB:*Xxo\^f}¨܃uQ"28:crٍj\q;}9D}Ůu}h6oʝ h9yD$+F4DGZz7Fatxs?xcf 8~ž}/Of;]_Lޕu$#\3|@ˑ(Ox&WMWm^ +dvw(V%&VDhm2RM2~r Hu$Mz"OxK(/H9<.Bz\{]ugPI;`1 9?%"k FDf"ztz/h$cn%fi㖰IAy#-78{cAm5bFe-a`-|P(|K]6/#Qv,>}s󛛝<)w򪅤K DmEkuo /&vk>S^Zє%PشWxS(ECkV>XIhVz:_MrI#;!Ȱ mD%7X6$b* P}# QgY?OI~Džyh[*iL' 1x%fF쩘BI:hJetQ NQh=]E%cُ̃pxL4` b/x*>,ѸR_IA yݕbNλET8$mC3/ɡ"{3[}&jy?oNgd >Vf l{`ZsQNVnWȘlλFt~KlsMYbeE*Q%EgdF:?XDSuҧiw%bBݨ}XXFĴ/ XY1;[P:e8򈓏|kj#먙w*"I,CP_7-`"LfEf/K~SϫMftqV*{E Rz/l`bs: Pۺ{Q6\< @ؽ&Nב1K>+KE|@=#\$Fk];<ٺ(*kqMG}Ch9f/Wͧ}&;!G'[o^ЯXe;*(U'Gd~mlG._}tY5KfÐ?bz`lMYHvxmCr{-]u ]np|,Y>6:G\?;1W,[D -hd1w|h@hr)a6&UJa'M |lٴE㹬t&T&*Ъ%scd%2 IU83{6O5B<ޚ(aF@Xs{"^h:H}J8}§=7g {OV`?{(mMjrVݟޱLPiݱ Neq8N`&`5d(ަcDDf wh?S:|:פn`||xsS1$B9&bNaw1md&wS|m8>#yXgh_5r# 8eXY Y>5?5"e j?$d(nجd|klxYj:х!Udߜ+IT m'3Ce5M6r {8 X&8=t`l333ؽzc 8xSA4>S_"FqUqe+*Ioè]Lz5lj E"|T[5ӺAU[,&酑J0Q}ʿ&0OQ,X@M rMqvM%!0^g^; u(hbI9 Y{ 4RdfSn{k$g]Cԛ9SHeC8aHfbhZDǥ"DbeB]+ /=s-5znYtwBY7w$v WB0tPu]ŵ6q nCCǴ㼌XA<>Hʡ++admG7 F&6Q@⳨ИJG>4U}菔SGr & w{Ah#|XN\mkZYˎsU7{NSwtEIVj]#f:7JY!;"̵. ަɟBwB +lq蹺0@/š20}n ƱX O N "W>s;^?F<p|>Dv5©H,k[0t'- `pA.=Bg_}r9V$8'qɋHgQaY0ٵLgmz$<{ߨj|'$XXXƩ ?'m9UzkO6WC&ۣS;ZY2s ',ĝ9bxͼy|U0cXԞ4G6FeAҌ:y,zJw 'XoPʊ*Go/Жt)ݝ>qV>FԢ{H;Yv>ie8 6CG&r5at !"P\$@s>sHGe*8 $tr!<掼*󉝯ѷ%jUs'i̝0w,KVӡV|yQEH%45Ф}o2-0|uۘP\v/~u9biNRZE9@DhKW̅h]ڒ{*3pgnm={^֪%tf8SYF7nhĝ.$ K*F*": NgRx@ȟ.9*u9+OQ)o3SLN{Ɗ ]/4}IY[`~ܲ~ #$A|G{qr=dsod*HHGô\,}rG,EX`:<@@Y͎RNA\q9ˍ߯uC+]Ŷ 9-6RHr`(2xd׻v*sq۹&/[q·$O_:9Z[e87U>\>D9.peQΫ[N|& -FYێ{eD dsrG7e[.rȘ?{!J6Or_0-T,.P퉱5NNBc(o8N[|0NO,R< fv3q(,LK|7Z}\"Q%up],$[UJ+OC5AiHjnzӀ+=œk╕MH=T PKbGf0w@_!Ӝ;g>- QެS0hˉ*w7U%IHg脩orC7p$2<*unwGjZ?Ĵul8RX=%3 do2cz1_ߡVxRsD]Op˳ౢ@lɐOSQXֳN83uL2BUv_|Rul(c8QYUS<$be"yb&v|}B`b {~?~vΫ۟HNj<58/U^&n^O>A3U#aW^p苪LK`+xMz|#5DSZ=ၤU-fwk*R@UM7ݸ.;_uή! V*{Q~Iy;:N;uH/%RE+{ab:@s;q$)rF7(&9L9eK7l;y&uӒW=BIVܽ~:_UEj8c{lձ['z$;ԣ`wW ȸ9 q.~eiׇzkJIJf |ŷu0H̒m-cw?8[n?bl0Yk%K30|ikGg74y*!\B S 6Y'D~@2~< %,, hwXPDHc)"(Bz@V ]WYS&}RRj EΥMHH̤+4т_blVy.I(%$CF蓛+雁NzϋQW YE~h>>IV9[cQ6Y!fd?>RjUw./^{S[u5YP,ckbǎ~k9*ժ\q P]LzV'K3pb 0|:>3Ϗ f1I&գbkD``#'0;XǓX<U;B7;GPRz|TqN#t# +)YsuU.X)[BXam ?ޫ>㘒 H^1p:Ud1rQG_ο^g8`XO9 qp.5)j [ͭ&1kla(S ErA/9I¡CNF<0R3*rf;\7Nsxc+7zC)F]~a 'yGȠ#_ w\Ҏ]KͿ ^FNt$Hu6蔗՜ ]RhوYΘ({ӏ3&MQJZݗzYWdQAWxǮ;MRqQ{\jdދkRՑ+NV|c€+0Ҙ[ouGmcjؗ CoC*L8(Oى z>@"o2rhyc;mXVb߆pU9KUle/# a֏{b S Ɖעg8ӝ}w~~~-+W#8zyC#.iQO;w/ɕˎV˗AYlɼK/Ea1QJȃ5#g(2W*&Ƕg@ih=Kd N'3;*"nՠa[Òݴvc]*E;}MHw2|X}i} ΂kFʴ3_5+x"EٜX3g912Y Ax0v-裴?XnubaQ;@SgDVh n9!DK 4)l{.$e^W&G@*N#(ǖEiNsr 3Øt.`[ٝZj&v㳴v}k>\]SRXS 0/yط `=a /XM o#V3/4)-Xr68#A| ^F^L k(Sʜ̨t[ŹHvD : rk0zV|xC/ jO2676J6W3F0JǦ @"à ٺQX/;_ZFtwٳz>!Iqld2!/T%g>H-f4P]}j2crΟ-ƞeAXf!:loFC\tjcv׭xkcu(0,!}eso+#d$tSf)1]1%9hF`pPma`?ڊ Hܮ*|Zɚ @ӐcXϽ #URt_VZBu%d7"&1J+HjcWdu0PfԊ]΂]HE"=%K]${oݟ"/eDb~CWq@;渎{%޹:wJj şp#F!]vÈL7vMPFru's28lu<@e+dJVH1SfOf'"$_˄+jD2ɠ4b^,<;Q.%FLe"]ܦ-Sgoi2AiΈ-BQ!j!O1@>$s +dqO(5T##LAON)Zw#ڍu,&B%@թ6b}:h_kXdP2c"G͖yM:9 lyKVH7K2pZQ?cGgJӉ 4*X0A==XH@3Merb`;DJb `7Y6>"IǮ}nsAdi~"M3ƨSFY8a*v[i0c-;EEQOLHwШy'&\Fa%%QܰSRUv*,oM+bϡ_]5Y`%JkTbw8cvx('PFp;7DtA9n | t Sx*Cw ie+{1w>ft/S=ƣm-Rg^4\>Gl".@`^*ejQU*GDK65* =β6׳.Z4&:bp~%b]˛"#^LyNhLB4iNto[Vզ7 (mk:6qS<kj Z3BG!U;+/6ZZ>(,0:!U=&A>PLAyG Ԗ vij(p o~vŤMG)$#x3ܶ{]X8z-W7=xk^9-X wY8o iTdJR8 W4\QPBf3Kjv &wm јÑ"7|/L`5QKs[he (yLV'`̹jMT<[S ə-*p9ģ`ί7[9OQTy”(K[v*)|(=ld5p?]y.` 4\ScĐKQY2;ĬpYﮘ yZ$ȕO噪A1հ.0"y乭B3Y}\pvpivs(*Dz ZO/}-.E ܋4=SЩ8 R0zKY57P"(& SAJU$l=N2d Ǒ"5Dk_jra]~$)4~ ߜC|U_},8'Љp} 5XjD-}$ \h37>#hަ^?ۙuQv*;f-nj5YP4O!Q+wNDUA'R!s.h2"uH+4\%7~g yA:Gs墢1F\:j7g-{}.w♲uR<ȥ.4})Osm\bVg vUVT wv@0m[oRcMĊOQ(&+mpS v ?}3uFel4aGrƀo \u/Ԏuc]]FrbG5XԑvkqeB SU{ї+}MptRFOcI {#3WH ۲}kD4gX\?2Mb;,md FYdIihF&,~3n}!,۽%YY&?8MGG76P8{%ٶazAő1h~jU6A&F2Nq%mq8XA]|˯L@}FfžF\2Z?Yk{G}xctL NB|CYt]گM"j TYg6+ہXvldͽ `-L(t, W7!yں#ǰz ~-b{i0z+Q?[۩`lgr@2R eI, )T;rпM^|ts"vp`5/l<8iz&DT拣'0XT[N6NRI!IRVz~lJ̙)<҉H)FFS8\>rWGײ)x, <{M:Kx"CB}g6V$F2`K%S5{'' ̍ז HIWsegǢG ZfR]AB߯CѐB*wGyMȇ{KG;г[ p+ @+3^?,JHU 4Dh^apj s@#ภ4V!1;eT}rЍt,s:!F #@d~ ]bw>ܣ|tsGJ}GoW'd̉R:Rpk_R5}=z=(;J}A>]^&E8ӨF1e \ŨHkVrm]t}U.} 3/45quoh(5h>Ovy$(hb.wA|P{猟y"KNx@:25ZLA([=sanF*ǮeŸSR:gh 9mRMoDDL]%:\%6-5] UYn"C(Ujxpu ;u}6n 0vb9n b8@樈Źy{v5p2G^  lfQִ5@ zT|**Zx*a8Kȫ20ŖHuAy[K=O(*1M]ZQa6:9? M87#tĭcUUs%e`SI?!障rxPw*Q )gel3D^g(fPI ]N#'zyc0٘VJbI)adHk>P`O!;=neϻ tdLQLaoUt>G$SdALhK&_ uoh T׎>o8%.mnL`MdOQ*+lC Q[%ɵR>=O6Ү#pWJ Ӝ ^^[8LwN~w|_[~>a}?YݐԐ:&٬<lZW3R^ݬz0kp>oj־fa0hώ1=c0"9B*π hreNlK2l_]\;64,d3}8ueLZZ 5XS&QCo$\e!2%䬯<[꿐}l2s qjX ؽ!/vDD3f'jrK1(SQO0QpQ@ l~J&PWg?< \&h$ME&h4L,]lB T1w=x܏>G<ZRAJ9!8>0Pq }+**-G`e,0$3/n k`8C:NqXa @Ѫ:4p] (jc~j$a D[+0o`{UǨ`h5i@!Usq1M9G[41^?UCN~$slhl>b)\ C(n?C.t)&Ltl)f+.{Iي38eU f="98đvƔ$ oªMńZpаFxSƥa.Sz'88) իU  qZ3@h!D0Ͷ0Nςzq&.iFq"d\&"&#^20k c 0и&QMc)Uvj][GOYϽ`=YK6fRE %y݌B.xSJm/! jJ_0ub\r1]];]RPŪwB!Da 7?!/v9APbGbhus= O/E.;1qmKn\Χ8%u TX7CpQ?b|hxlS]2ccl*|sD{jX_Faǝs.? yG&U,?T:vX|7b&&;=K/XGVQExyt^t" | QvƲ?^#6=Zڙ3[6W.M )X%vt0 1ufDU6$`nLfۗ C5]@#?*FYt1Iu/.DM5\66Ih iL~8<ģr`j&=b"J07n#Fw6.z܄lyf-ԯe7aL:ALa2L]j- 08 J+z!T!Idɘ:Kp 3k))vjɬ rH=84 gbt-G; Aٱv+T ,N `)<)G$]{=27zOd&ޠJZ:.x7|}sC"46*"*Tx-č=`[dLuZqS=ΑRuuإ CZ\#2Z#y.1p_NOq7H~$OiIP~gB~6^>)~'659%/>=[Rm7?Hhhpƒv^B^bE&6z,oP \VQ\w h,VoGrIWǾ a  T^L*?r _aaa]Olrxҝ&jOqfIxN>s=c5rsVrؒ]1#u UEVmaPhXK-OM;,|b !xטЗoa'q.jh>!N(C7dסӝ~ $iL7zC2!̌0&WH{-RaFM3̻HŪu5'e#mXh{hr|t-7\byjp\NYv]պO'~Xsf.bw$mx͍9&X"5$erd.['ۂD @♲xh!t~$PoLd}|q6XoXby烜 о~1U+7,Ew Iy |s:6xx[XCV )T3s:*5R7ZjebALLt*fYOUK~ Փ_KrᆛgTNgl3fszP76W^'V#]Y'U@{Ge05"m@d9n!W5@it]ۚ:8.~P?e:1-c[L~ :8WQ|eׁ*>L# ˏ.)%+/LCk6P&"8vnit1|?,)ݹKcYBɮH ofLeWׂ;.W*7k[{H5s3 ڋU8 9b$ Rvt31KdddR)\WʠcAtc/]l\mԋZa{x rm276$J\pƙzu505(6~;_*,~˿$Q>xq zDb+?)!!IfED}Se)!`̡Tl"dտY>NɅHXYqVډr5mcZ8R6R9\̥^uzDZfhDJݢUQ'BҫDn_%/meQ Tao7DqЌ擏L&Mӵ uⲖ'˜v(߮.*+v ~W_cqyTw3bC;")T8| >&ުh:-O$btxJ\#y0ˊUsvgj9vyUlonUTJ8O㶇{Er/;Hp(/&me]$ lXoJĵw/A](/_yb( 6puȹZ)50Ck,׬iCbƯ&>SEp Wmym0a[꠫WKBڃ3a[ -JH8k>+6lZoU7$B8*x570]Kۄ!(nWXnjd=c&#.%qpԜ7`U.5@?ЕWufi_v/t2 ZE{ |681U =6!2%cOW=sؿ[.򲨪6&ИqA1e߶LMaJ ~0%hI Z,Cq7K}GRKXӀ|lj+ wTq'x&$'y4 ^hf2 pCc0,  mJ8O$f[*N:O 3Bd]*@n14*9[5\-8_J%AB~A9c]*A]\:-R:dA>Bi`zqJ!VQ*W{fm6;/_[U[I(PUhأ]:dc\$HV08)M`+E7i'nLs\6=- gRn;3D{*7ⴳg W(aRs̶ci'Otv(VQDx{Hj<3YcOxM, 8N\y*N8~޳Nn|g;G.JQۊ k"[)p dRO4R8%mR%df堈Nd6mE˞}"+3g;Skw/6\sS`IB(" i7R:s6%u׎ۤNq9J.D\e>ޓJż,g -7$ p&zM]QH@Y!lv_t>̰8 bq& P$*M69.)'i֭V{g2<a5hU20bE$e0:KNXHԼ)[% 2ƕ>Ј[n8y,J " ^,?Rف+=ZU ͖<@̋£Ԟ4!Ne<:#@ sP?w!0p(fJ@0ϵ}4Uak/K+6#̫?8L^aXs ڇ~>a7/n0Gu@_O6BC=OR%c@ZvPi6Wy\ -\噔um3`xZ9EO2 XgBKS49̺QAl9>ʘv}8 tܱ/Ze;9|c'9]\4s'&~lكAaQ(:e o׀)hT&ls\3D5N6=S3b3,K%3X$:gli?Qnʡ* K+G,>CB@;-4W$@T;j7iG4w%HB{Rִ#p;DP%HdfW O1Zm#Pُ%~IH5\瓩#G¬ws4 Rߌ`]̛榺צ,c̐&בf2-!f☊oKy0m{z!pZ̟} £s9gK3Jʓ$Vq\[Mͣ9"pVާ <fW`4A:[@,겎xδ:Db5s>>>, >d6h`u]R\dI)W;{P`+~?sĶQ+xo2۵Cwe⟁e`]܀#@Z @@FaRh`v?UTM,1yEg^M #CF>78u|0UV<$)z :ԍ̜V7ILפdqp%BE#Ŕ?uzNyWKGjYq j" Kʥ9tA.鷞t߆#oSS)'˜B/*=5K4X!eܟ4S5yK qh _gh"X{Kz}-ye5d1sHY"@_-BV1ZăuRJ0) z E3և4c.zoC?k~ P2lji~yLAҕ[qQԊumBϝn%[eƦ=Ӗ/'8姢^Lw rnANT&M8}_&-0n)vFuCORK4'Ph)՞={.H;?h,o4>AO%dlP;gʐPh͆{#H`4m~W_ ԠgAs! ve}`8: N~̓Q-W?g^D={q?AqI S?݌)aÉ>MF!Є1#ݤOm2 5˭ C'8!9v|Ju!4&-4nȒ)k/ Ol B hq2,8S4l*5ٰ<=ooXVbjp|lK{=µ4{"eEԹ`dw@_!PYT2ƼM5_O e4i[Yo'I|d.PCVp-Y  a7W>IscquOjʴRcLZ@BG>$0XN$bQ^XgGD/K_" k}E:z Ao`T? I1҂/ 8!V1$BI4|%Fy\ô|uH?0N| 9.>t#vK"0TZC|k4)'F3B#i6us\W-7YZ49[W ԉ@GG" ݪĺ6sZ"L1;86pb ).yxR `v{TAp;U3L*@+9p#|2rX+@3>T#K` ]Rm5PE(pV..%6 c4FyWį䃉T|M r|T ,=ۄgu}SVf|jа Xfmaa(rP+L#[b8\P'k 8W=0"w?l^pR1zK#ąE@YG}{vP+)[#2_#2H-)yz<Ϫcs*إ7k>_k%Ҵ6faXB Ug=/N^K*d{ ˢYFCn:,ZӐjETf.УPG6o{TAg'Dq:\ l%G$<'l"[՝9+(q#Z[kRg NmRiS1An'~_nx7 %:WcZ8?kaL.VɅ|Rx@:JއpHS1Ea?KK !UjX7.D B W9쮃<`'mRO@ޚ_(WȗnK}iݠ&HXA`u ;H!ye|a.={igߛ`_*kIh4dWwnN=*g%k܎aDn4uzAؼ }UlQD&YM|!m䎟ՃguZH-,؂NiҒ 0TW:t;d `g¬\3.Gp-\Cf13uG* ;܄GXvzLh=ht6PDs ]TU4ElArMɑ)󆢜=9ĝlq8s1zmܻ0Z['˥%1 ½ʻ ]ZgUM2M3fԸϥ,LXDZ"qvh`9 ZZDiQڽ -\5*0`L68-{9.HE:oBkԽxDV^}dt{l "Lo޴7J89t+5A}f|Edi 1hsw`uW%иUԣV|P%&k쿂Bw{>&4s!-B<9Ll~G:q!_ ft}N҂eV2y v nڰ@@,a\I! 3lnW,Q:n} }:ZPJ ת/G>E**]CC$Wy%Frr߀uDWZٸ5Y%"\4YXMdcU!~|?caſDXΥ#j"+4Rȓ8$DpLVR\8b? FH^gKhD16H=;0p ʨE顳ڻᒖ7eA8JE3L&zt6k(,'̱Ak:c~Xpלzl>܎McV#8(mI@ċ `䆒ⰳm-Y2G8M]]e'kCE~:W ψ 2qHp*Kb۳(T%6pG;}]8!mx lb2Itw>4?j?P7Ӱ)4~JN2ec`B>y[ 9>Qx/WT_]^#Jiv(|nOwTmwAU&BVG7!~iRtwn"i嘞.y #^GH˾^3R.G_p^rwYo"wƼa} TC| \A(D2+I'p]A6JQ}:SNؐG~)ŏ1FGNSsmx5l_ΰʈU[a^a۷RN 3>`تҒ̠$7bFČez}}{D4aYK\/tOCj'i'p}nJȜ(N0DmQLLӓ̺?;;*Аa˧&k$*6-g-1]3<҈, 8*3 T"f*EDaq-I]j;&v I2XDfp P MPl[m%@zEm,`Hj}](rDR}xđm |G\WH!8 X)$OA54Ot )B2C-avUld'cCѤu.{Un~@F,:o﹘D<eޤjDѯb:{ ʻZnFSh H!Q?uͧOau%w{͜2,HB@:v#t5'LfStDL"~xbo49dr'6= Kp۟Fb\'"x #$${ky(ZqWlu(*I#3)oT ei5 G(ъ6*>lvKYL%%هr{c!S-6 y4Pnv݅#% ʈ\Kz e Q ~^_ekxjLH_q([(qO{Bc~`W1߳mRAIc%X^1%Zi ^@K67CŢW IxO '4zé |0ćHcTBKϡKJwkH:*(0F0ayS;0JFU- fSKgӃ*B7Xn=;=ů!32TkMxA%V[~ ap 8:7Fm,X}kI-xM!fֱO}=, ph=lȪ[Y~\K5v.J.V]AVUT=~3P;$%&6UMA5 9ɉ)ǵRPQlK xQ/=#21TkuAeXhÁ79MƒPӗaNo`5Wݗo,KuG xEsPI+|P)=|^G<#okr64ҷ_R^>ST;9(0r Vk`ϕlW-ܹ=Ƃl[R02o(o="c֟k{dG,s#_lWa"ic8:$ *Vثa3->H2I 9- :wy6HWVKЈտݫ| /=}@/hIP:?IR(o3cN"$ DtG}1ܲȁo9J(ͷt` f'9N<0{8>.0Ҍ"kM>jtXGğ\c夺ٷYK8l#uQ'ؓxsRx :ڠt6˱'BlqWaWy_k 쯵*.:Jˢ]x6UymQ5Z2ebolfl75&aG A4^-g{/yY1;w1+J%q)&. ;~6xǴEɬUA]>: Rv#U9ncT CZ[E|AQI?T#7$ği OZkd$ޗb̴}ۗA͹2T>" 2.Ƥl(؟T' )4J6i4(3cݳՌ"g.;&h#2 mFt3 7`@3tyrO;T$ 5#Y)s<XYFXofB%/gW] Ȝ"STN47tw^:Ðx a~;BٖƓF+Y!hT_+JGmlbf\z/-D[dk6vxQn+hжv(v@Dh{_ej2H=ܼo>g\T۫wPd5Q§X#JoZ;dNgvH!WV9n]Nq\zI+zIK_;ԍgt>{ V'@-lXTɞwImLQr&IsLRa9C+ MK $y!H#:C-}ߋZD B9"GtȟTM5g0D\WNn0wI.9Lbe%)dd*9h9\- ōyZY,%PCP 8G+a'C)o#"b |w0Np,}):qOrTp3~nq??\hh)/j'[4ϝCʲA%4ޜ\8 Rq()+QD]CB):(,46iJ&Br#HP~ 6DJ$. (`}PUnG\ eAaĮP|gќag7)s5~p"@ =́:dEz5Ŝ+Gbݿ9z]e'LFπ_Ċg7NÃ|5Nعzu> JxÅau Oq^|.co ?x>k2-;V'y;ѕ44x {Jo/$A#VwAR".ڣ5YRSX-7m4Y3_9L?|j)(^ b~jil*a.m،>V/,k%cuaZ%*/BN>g pʴebw i@Rǀ5</Qy!6t'[+w{6I YѼ=9 Q;v g}h0Iy&qHK񏪵T@\s\(c+B)`FGaizoX{PՊ8V'C"n.XI{J/oUC0]P2bS#Us QHS߰7o4fN yiA bGd˰u7+RM 1@IԨ&o? TT6 X[p7ݿ0PY1LWkQLehœG`ǡL"K<]8;ĚN~AZj*DZEqfDxkY]ZMu)񉚈HrS ͏}`Ot|P&U^:aCA;Mbg=mZkU0FDe?t0N>%M+=!D7;neOϱW-%/#mYة#@b R, )$s!HǞ>*w,O0͎&>JR$ $ k> =ppǯ3Lm^_TP/)YJ+Pnzi&F]~PaFqzh.˜hsuw00\YZ_ȎtJL(su@G4w m^1 aiSJG¦@ͤ5cw?֌ OP zxIN["`iեDGTe MEBM s: 2ǣ0gTе5yfE!dy}.wO{(E?%u{P0!_ 1 }Bڞtrz%jB,K#L͓ FBG~F_Jk\➭eɀbτhPrF?<$tɐ\yKPYc_mi=3{d{ȣmkLVX>{ˋds9KrR(mkI^~}xkr5r`\aph9[@UЂ4d?.rʪ`}r^];S1:aZ\iڿ>=r6bq=64lE Bϗ+y&t\.9^!6.\dFN M()gY;h0|߉CJlHRyj (HeiDr׎ %:pb:% O+d_wɤ{AMP0 Fӆ 2j9}>I8MhgeZZw{\HY}(y PT{J-8G"<啛ߜ4,9 yھυT*{I]z.g qϪ@1>iܶ^cƝƩ%z- Gj;< Yjߦ`᡿CA L }רڨpBc^a؃+ʅ,59v~t).j. y1 8d۠=*scMg 2KrV=li Vl:nU4z\XՐm:B]%'{Dަd2w A3=;"aixB@y+$?1BYқS s Q jpv6MG.K hʡ"t,< HdR4c {"*"~*1c>M>R 4T. LЫFYa;k4rg9m8:NW>!>h?rp{lڵ]W=R kߛ̟߰(s_aQg&oa>ry>Ixjf*G4ǻ 1)^;UsVdž߈:|W~aa:xiCQ.F1]W+ilqSArlC1ҽ;Liybo*SA\cK]ؠqю[X'Y޳P RaWϸNDrw$ի`x/.$'͹S+E?& 7p,yQ"ZGj5pTr-覭(Tx$y1~::tW$lV(H1< (3P_J!|[A^%RY"k.!o]"@% >]L {8 d_Zc:'thW@9C' (z,nw _L~cSINTpb{P8N21\Rd\lb>]Gj #wٻ@]yOs dC?V#U-~@DǣڳB) Wy)5xQT}_b폟%0nY(C n-v@s۸sXb"1R2iAZ3vP 2G$E629[Ca߹7щV e#I fd**%} [)?NRdDr.^lײ.x`-8^1=  Sr| N3E ~]} nL u!Hz _+nU@H2AJIA[pl䏥T-`CA&"'V "UNk!~k\`;Ih8? qc?۠ !"$\ -R4w%?l4AUi&i392|5 WsD99+p˅dRmФHkAt ,ebxz7\5Ìx}T{<.?#Xͤs؎zif/֍daa:1e5`&G'|Z _gj%g˱0}U!C&$\/T~*/S-x#Ui u-(r{y8:f3XhB2!o\2No?xyQ> M@z(ؐS Do'dZHϼ[-g˴sBMD1#1o,һ"Jmar.-<.dSUSwVoUzȮ}:: EVZ*Ml9Nn@?* %h:b4m_yi=؝H<wu׉Ҍ0P8Ob>oQgRT=A*uE#ib#¸)`*``r/Mw0KͥAP0{mK| N$; x^˭MxyyaD:}]t1m*nu5R頮᪢rZ:8 9 pT=yoabxuÙjFh4ZWvq `|8]9ɉacՖFTR5yIamFFH\qhP7 Qgl[[^ r7)N(~jh$%!:N>B;T7.uBnhBE;U+%e"JiMNވ'[gRJ* k`غE)[[>;'WS>)$cHסaO{+_ۓ]U|bX:@. U9B@Mb #sݒ}ܗJۆ>\"ۡA,_Ϻg@0%""*`o.m5;ige|)Tj}\pWjeشϝizR3ؕ^a'wJw2EvR,z{$u{31x(MO$ arypô@vȄ'mēWw6r( L_ByncUmڭbU=.C}8 |*LQ`LFJ_Zww+g5G$g:6LJ.-}A?}Ğ`=(O! -ްd&g :r3:M/oE &Lq.DPF,Ѷg;qC,tgg1CY:$1 D-G?YzeDuJqU: /+=v}(sULK el!-}G`^6sWfZN|*~_{/qާ/*A\PY}K>/@aDZD&{b[[̻j3 4drL m lpa$CMD$g[dzx%ʮ_h]ap?A4.wCh!E T7*H)D-&x|49yO"NE-gA,˩Ϙ*uE1z&]1f@k?C55kUq %NWX\+0.5|GBnknNGͳ˯X*" f /RQK,ǧHp+MG~@8@5/j8t.8َ߀.Д{HSAэ&hSeᷓ0mmS4ճ6s#CMyC"t H @.K_$$k D,W96%΀ u fW|D3}749w A\ saQ7JZdx*ԇ%>k+D}Q4Ww$v2YrնC{1YHX M=$_S=_j}su]dIp^9<0%IF,W1cNKHL(^z}Ҝݨ( eSqK݌ja &;,Otά)YVN{U{AEc/k%0 {e p^;^![W! qg$jl(gs4d^s~.ZfΩD(d^$T)Q'@ O4ng,ADc KAꕀMsɩRU"Co ηNB{"31&_9Tc|ԙ׸-i;e# gD$M[y8 cFխ3B^wRN++?NBfJ:YޔKF >,OOWb Vȍx'7bT=x<"ay/tX0pPt%8$!}[tz}|DFmwdY•jVt9y%7kȼVP *ydP2YQRBL?B *)nl艳Y9,#00ZHPuT4#iX%\{&k U䀍Ѩux`!+9U7.t ʐ俹)?k0]t~V贚YPVj>Ikid(G0w$SUjK4}#N s:g-KGζ_ɞקXqcw_]7EN$. GtuL܊ WRy=0'3w.@2Tˊ(͇V/7'˃QgB2ÌǶy,76upa2n D{@/ʿЇ17YX09NQR&`X֚Q/HEY)T"G(ɨVA lHE2Ž~[|(f>qb*cǿ m5"N؂D|{AlI3oj0KmPV y5P'\r\WVh&'3uyсKD,H5%jgXLH{o"z5'##ξ VUrB\l}nW_,Vdm#t>ȝ 1GZ=´H&ߥ@,we]*@JэK1>4! : #d{FϜc+0eDK-I"nWq QxfCl ȯlb]opLߧ F>L$sٗ1wJ(汼(`}Ϙ: jtm!)#X =7?TTPݕH-t ?ޟR9iR-}2D^5? -[! oƸJ5~oŏsS +'?c{yl*Ggu)qom6f\-hO)vELAwk?7}YK{4El\Rڴ0ÿ'/t T(MV}=[~@ùlkǧ=|=_(/67´rz*.u%?db[: g"*ezʕ1ə5򕭄{={h7"LGxlC^Ƞ|0 h.$* 0 UD-/\h4̣D{dk5Їfdj)X+4Lw @`E2TO4fAG 4a8hy1 0})(ko\Ǻsd\qLSL<DžT܊˼lXI76G/2E5 {+Xvz)Ԥ܆_ʴ.֞:9KP8y~0y>; / h-;#JnCϳŠG1?PK*I)muiІ̹H !M٫A,=((x Qyv>0l~ 2^x,-Pcs$ V_>0R+{p^J:Q4c2Ĺ3:#e]f)=jz};LJZoQ%w$Mfn%Ƀ(0Ы A"uABN+GBhw^-I[15| qR[c^%JC.i7}M%Zn~WN^S@st1 QWDYϓ~j0?QG>pG"/۱Mi_!Z!ks5px▛.HaY^1MJ)Nү'MEsfJv8vӴ|M-ahow[3FW8z_t|yWC,wϸ2>WqĒ)LU"wm&bc*mv-ndt246.c|mjb-J]dߓՄ.zIgm3 $,I~-U-'^hxq`iKž:}z!)3giA{8QGObbHw7ĝ 0I>uOY}`vF\9ĭ[nQ8tC\l[Al>qE ^$ZxEPn*p} yi\0B72t0%*3k~ޗXNқ캪۟m"ފƧp˼ <.qwHK[Z@ߓxL_-' f;&;_%[cXIY sPzy07>o&ctm;/T&ש7i㜯9BOS8owG ۍ‡Wf, ?[R,Xx[e( :V=&m^{B ׊z&>hi=YV8ۢDROɪc} ~E>n?_#xsIJ `)CJx՝K7%QFSiԟ-/Kޙ pY5*4C$wJJ/1ck..=v[iNgY|,ܛ|䤠IlyT,p,+4b x?GFoK`4b&uv꒿ (?ՈQ-mC'=)ѷ)k {pTZol=ƭϪ0<=@T*MMğtG{r$˙}}- CC $F{|l|@OpoMRIf z"'2nnӝwσ{seLWҐZ) SYĶj*s7" L^v@4ҼO7-lwKyϦY Q4"vvo.2E7JDC_Wo5V$&Yǎ0$b(j1Ks<9'DE=@.Vl/nllSrX\JPPo7O<slGNYXVéH}33#

w*nAbࡷwl F/ Ep Te/)'J/g>7Bbܓ j<&WGׄ봇fz$8T-b M=6 K;Z׮wha۩9|@۔[ֱ_P\6UCw6r&qs Êb<v}%~ԎtF"q=J=H;p)xOB00:`EdLD`$nr ʹC EiCOtD^=恸zQв@ϵQtnuRsh't[el: ((0aG]"czm=r?'ßb~P>S|Zo(3䛠` u{ p[O2B98E9L6 f!!6Z Hs.VGڍ=9>HKm"lƆ|LrGV )`;jg+Oռ#W{`tHPt:AOd5Խib4~%~%c9JeW6 LpʒӍ,!H Ib\J~~:L\[haǡbU2ϫ܆CߤY4%@kw>bս:#Nq%LT7Js[B[qe;$fw~y/75v>5ّ4;I|Y珰^_G芈~A 7b_/[V)˼Ԑ-|?sǒd!~lK̒m$u[ᄥ76w#b0#  *Ve"w}ڡAtlcB*V S>b5!,cS_,PFٍWU u!3SSo'.#&+1k5׌7>(C:st8O6h^vgЛ۔Ϡdvubt *J&dZ7y(I /e+2|kQ/'ڗ:1vJVɵmz馅KXT$'hڜ7!RX"y[w3(S2m0RdڼWװBM;Y1;0%G Ezi /XR=!pWh|y@fjsϊI!fZϟd[s8g{=逾TUaÔL:h=gGS{s~?%#p [-yL]N=-桵Ntb$KXKv8MhR;pp $;gɥz?v4 *Zjf~[bAϳk/m%BY_+rYj7G}qYڰw vb/?Wc8a `Q ,pU揸-%te޲aYІ[۴Z`+9> `3wc(Ś9$: y%ϭ8_ ZpGK>#0̭=pB>a8y**PjM#g| +'~o;0UJZuUc@+S6Y3dj)/`6 AN%m[zb +y/@A 2YXV>"p{V;E"' (CDh$F,;Pٿyѣ0b +gX &g}q{?^rv4wT|;n୫2R[zۆt=(K'Ϸz@ATU-䯦*S gϸ/AbPU_p4J꾈mm[_6+uQ`?CmT^Y[2肤Ɂ(||2[s5n ax;h/*_͘ ̀ex9$uHKaF];I8 " vNS(_@Vbdh;J#-T@63Cfe یK#eQT2])fnJw|׃O&I@$}k.[h /J<} Iy|'sl7DLڤ0-SŤAS7|Kٳ*^쁗d%'^l9ɮ/}i("|1>T4G.;Uxc#O#2 ,|k V6BtpANC-0hIiAM,K+0{ϼ+MkfP߻:>p[W$Œ Amt;~;JDد*E+mi(UwZޮ_7NxfoɅ?}q7j{Lڣ#0g.=U@ E@v53~#nҪHd*XP̑c"4=.P\t3gv"9 7!Jf{ ؞TtkcV>4xzo#ŜH>_V5}cQ{OJ1v(o(2*ŢSo!Dhf{!bfcOkAY06CxUFjŠjΎH|wɞ˧{P99 G=Ʀr@gÖA)^f64h^v弧h<s2Lv y5(,Q -֔.+āf+(194["~z$8 Q*1QOuDxvh˯b8PZӱĺPf,QT3.ZBr2|$ %'e<1crly(V^$ESb 7;FQ$*Z40M7;/NXjyυEDiN&ь={\46k!$[=5>`u0b[VQ䠄Q#OP ގZG|X6Woå2mhZd#e*ؾr Yŋ~>b2+Õniq8wGg7M4NVoBo_ mmb8tC j߆ނuv*QeOzA ǧ(մzbGSg `ȌJ_ruƸwn5=Uԛ*rfPxMbXE7fIq+2Gbo%KÒxlǪϥxَTZUpĕ#ӭ:*1^ud 3X.l+a[w>gZ;//â^ Z8d BS~vY[!$h\A&hsGQj};l1!x~Arje_iتKSr_,49ȥ|`t1O-h`@L3#|{`DH[ϣt'*H0Urlj@ +-ϱDvș^LyoۣDYooyKp_-}%Oρb0>F՘փf5-fMW ?!($3OwoFԐMW]OJW.]۸5600?嗟_u-|PYV #|StL"Hp(ab$ f;`ό=[`%A.H0^% ^,߭?L?>F| dǩ7!8N%E K("2|lOrj9x"w* \pMlIі^Wm?:Ϩ PLяW;Z,I5+X7ܳߪa*5xtZ^+;0:}"R⟻Y.Y߆:@ [GT'_ υ`;"vGm IZ_ TF惞$]ezr6ܶ R')mݧ~q4OMP\|4 gCvT4aT'ܬ<,/;s1Qk$B7M X1 *ݎ=}_/P3kMph4}Cvq * P|@nYQ5މ[T^GBȃMHT9EF+}wL b:U8E n U%Uav"`mh4Qx$Rw4l‰SI`+,C[zf\FN~ΛJ~O屔r"H "`: zXj)1>:aNUZvuRJCm"f#D' TGف"!+C4ˋ! c.5/'WI8O)|wkÏdhal Qo>#*NnQ`l:n^xeMmݭEx_ IJ#.1:3+!PZP8:SfmVtA$$  JqT!ꏀ K>4!JSbKm\O"y5gпyTQ|߶7t"zᤂ8?7 V'Y^%s*&AFi 4RlxA 邭 ֑MIA (؃2!tv y2󕝦MA~zBPGOғ~%/~|aVqȭm2*\v pD{JyVi/#>f+4ZE@L[ՋQ>z`9 궨@NUE41dݸZ Ԩ[kXEYVLJ]RV'26^ŏn>1DP'c+#0B&6>J┙Z,V3ޖ-cmJ%4f4U h(+ZNk0}JÜH&rhm(7m4p̙ L؋ڏ1J&0TRYX3 A|{h7KͷP\r+mK遃ېqXm2$9gsH) ҕ|i}f%쑄gaBKSy`R6Def>FˏŧyubsP,T&IhN.=QnRa?d3%' De˜^tʉ![ C5 -|0 z'* !H ×,q͙φ ]v W3AlFU9`eԱ,Ā ֭C &C;3kcerB~U ٷʙO ~ ) z!MXCm#oE38MIY $_aVWY0ΫmV;(͔ ۦ1هf8 .ZKR< 4ϻw &1O)pjO? 19\dS?/G_Ek`bhRu#%Y"+ ΁]=iPgP`L2 Qyz}"e|$v)爑Ch?qΩ51-G}̫2TJq<폟So 62o0`Y߱>\Az YNӚolޫHY2<,NOwy[c:ClXv>/_!|R7ut#38+P5%OKt4$0y[l͑X6ue&7#37U 4[=I亭$,XY/ChRtoV|e4D"5cMI+~3Kaq}$B7";)*.xZ+)cq׌Wz4B{&N<APΔcxO17ims22)X\q߀?3ԫkB1c i5 FԸxSЋqd&p6wTRGL_U "y=:ݦ8R^AS8ssv(>çgW/% {ZYmo3g7`I32|غ*r)dUM]"8s\tZ ֝16Y]Q7yof4Q|7]!|mԡu|d~ A?7y\+ .S=1jN a<9;yu g ZgALH|}EL29b<4QBljR6qfT2qΈ l.#{GCxf˒n2z} i7/`F<6&Q ;kIN&漌Ee*H?{?y4SYwoYyglllAMu {d8)I˭ۃ)ŠK dy:-V8~8fJ}P㋝k+}r~ t H$,`XӒ4#ǤB [@otׄ{P@ nJh>1ec OnnN#Q k4ia+U!@'U ~ʡ^aWeOjfKc»J#jPtyyd'_xAʉ5ssn?sI~`'@i!(%fZ H\ W>ZT%w"# {8]M?!VL(?U[~y)DW=\aJ0ΛxZQN1⌥xBw].qS\f{-W'2ۍ˒q Uݲ?5cP?T+^˥B[ALf8BlO|&0(yE8D\x%zM KP\*{|R) 80%*a{ϗ8\w"`%E߬BuΊON@oҲә{mO!w@JJL-p[c6at|+ʦy\\t~I^d8b;I >INuY{ ZW@(l+ x`Tf@o55L$"dMh[5MXYPN 7x9+Ԓ3U-.`"Wpr~UffGgϺ4{#~bdd>Sn "iN% opʰ/K)׵Eb?;(|Řv-3PԾt0%*uKRMxѲ g!+5!n7ʉvPҡ]^=t*זHa]%/PȞ { qgsK,o J7]b*͈,xH>N .ʂb0~xEIiL 7"AeePA FT+F[8E;~ w' 'ӥW:5Us>u'.qrjaF@.Srpl5"K`M@+3\X8LS`ezW0\ޡCy['{>@=Z$PAy4Ay9`Kd}FanRڿHsda{ |fZvz`3)H`(]PvWEa>xY|" 5 2!/d릋CEi8ޑ{G!0"%38q&o%'ky%})<ב߂G(SF#dt53Vh Q@f{˺ c|?(@bϥ_ J=^9;PBCקKܽ2٦7ϙkߍgX6YN=Y)IQ4_p  2;peDqr϶WXP[X99 ۲أNGTP{[,kVwA,H_У7dB?)kz)gא倫5rV߰H&$xqy`Jl/W$|UtƼ:ňI!{&6`ϩ )Kjchܸ"ۍyI&\پnx$is*d`T8 KG˱kp\VnC"bԝ1Ghr2Ž֞v҅" KU q;T|Ge*7g9vB鏚X"ÿ.@<ɲJTWuYI\?e@袢p+\(v[sKw@s=r PZ2,#@u ǽ!,J ;i Fz/D!?\@ߑhҸNI|Cٶ!EZ: 2}1PiO09ZFOFXn Лܝ2Cgɷi:ƻ$=PKƮEt6Տ7a6f-Vw׍=cyrag  $yC{7İgtf~#91C{Ԛl"IZu;R7mfW y7@Ԋ#}U]*XڬzM|޺ĖuqxZˤt3b|yWc%A}+t5Vby8s0:, ڧ)c41)S|lX4\|qdED5Qέr m59T]ȞadVȸw`(櫾(Tޘ"Ra%PT)`iޠ߃tIR"O{3z5Pi>+ 31节2< ?m7yAe%?Z(OGm kX\햾(/ nޭ Ly868o xD&F a=?[>A2mdW0VICgcuMEK0Zpj\6ÖݓFSb'rð_IK|ښ%vƳ%G*Z(n-t4( ec_|sN,ɩ)k ؔ/Iu|H<5t&".G ILMI331=T"./Q}+8>>+coD0|(8Lߴ䀝%=}owRN.U nhYs~IX_X 8%OSkQ`2w`^魨IQSȕV-2LӅ#۸[܄/7]cu@Gj4{`=܏ R$afjƪWCjnvժJDӽ{UҪ+[)zzx{oQ^1r-1+M)e` 5c}DRPպ;mQpvH1S`E[GTjZuY*c6oh󊧤uIҨ p;y|=Qir}]4ihq1yuxgӣ =ќ i 5^y;%ɑUAEK5GiJRYb Q=c_oM,?Vz8Čg)?8o7_?{TI-,W0(yh/EJԘ~8Njp{H/0'Hƿlfn_xC7>`EL nV)袧~^±*Mc |Dy\KHM`3-ҷ)}yHH1Ą4DJ΢/VWi:_Q]oCÑnGx3gғozF\=*%13/\,B' m}M'?j+ϟW5q咔`ƏyQ<_;2DJo)sUpdMeX(8/ՌeGlȹE|K =HST0Nin}9n^X",P?`F+5=`r_2յ@ 從˾l_$c&]{5QdHaO*]^ &hz{">"&m%>Ezy34j%<[Ϣ0MSvru7tGh; b^E4yH'YdjrZ$RYI`''ݽ0;[sR/#FKI{M]#Pi1)ž#A(-\^#ռ:90 UM2pm `y BaXگFQj,p^#pk8ՐgrPE׏kϹ~ `IJq~y)Є@Qrfc0|Uyf!,66x0^@Iab.:>2+<\dө.)U9ۥk](ܰRYJtwS9Oh<9N]2q-핡QkQeqqvGNe$c4j}Ğ3'\e;=>֏pkwzǿr.+g9"P5D˦a SXἓh<HVp@%W~筟_U%pp*hKKF4P>֬pRy(p vL㣓^#C$ձzdԖmfa;,5_;X`b ;*DBTQraX3@%hэ۫e݁-Aɥ k/{iT'"E{i yP>mȢkTC>i)$͑`]+국& PH9|nУI~#:yfwF ϶eskDZZTC"Qj9E`5|}d/Q uAGɫ^gٖY>=8<{"^T]U%=~^V9qfNoWPQ# BD+l0X=bn3sMԭ%c˯s1]{AxUY`[ZO8Q"D=6/hu(&ш&(o\ %}]GQeBVQ?~/ض >WpL,pNNk5L0S `vE^칦P),W*Dft" o#ũE yx|{uvFY=uk/Uz]dds]4v޷FBxIUNpP/齇CGMaom9E!u` i'M7y@ 6IVNֽr8HO\#ہTV۔54AW$os7&`w}#7mVrW u"SGn~0v/>~1ʍ4B$Ή_l4"tlRP(FzwS{Q9=(h"1 E ?i ',|cBi݇{`fuƏ.SY d[(<8'6E~ОiiJnj *kꁙa(PޤV%И׫RUR KUI;JuJhZk9N$(*oZԴ[0Ҟ KqDRਖ਼<;~N ̪]I@1wByC9UUsA%Hd7K~1ƭlLR6CX鄋T㍿9'=fCoDF2?`F&'~pkIm?($ix^/S,Gd|/`]`9Ʀ+;ͻs `[;67u~dڢ,אpkd_P-ﹽFxIu"Tx ;>I_MZR5d"3)?LoTRO8!$Jkajuv7z~ס'B :U9ޅJD:tQK lնg MECbv  %̳ZU&С]&|8VkrR#|ƳUF$A1O i==mA'%P[xc2 -=g;}Cg!?]T1g$^ž2@ p6ݽ6lbc@>xC{ōm, _0v)Pa]~au+sFc4}U{ !8|/^q=8@嫓MnN&OTǡhV,6OXzZxx@HFU H[1qŵɺ]{$^8[iq(D&9ߒ(:A-8u7YkvvX&e~(d㉸azM2K\^-79ϻ4˪FC/WcW0xS渒>۠+[xpOI,g1z-ſ y/ʴ^@o N;$fdžʳ}?H-0_NZPz9og ~Rq?c >z=kQ *gPi!ܖ7p+I^tIgnl;EY7l >RW*Hܮ4^w5pъ: |+ _cؑdC"k{bqIpN3ǥ +daڠ`3%[W(I;K,$! QD5r Os g K(ĐjVOHv|)l)oY=br/Ks:^]+.V2>ȋCf(UQh"DkC©I), O8OiWEߑeN'6 +r a"ō`-GngG\١?z .SU4AJQ d 444dǓŎSN*:={C;|r&.!ii׭}-Z$:GE 7K[ I*6degn1;))>uV8ΫH$fgKt7WߪHPR6]d D#GBEyJ$`/CΚpnTk_dnܫWF;U)r6mX@sZZ )Mk_BI&hVh|Q8iS GMLkllW dU2+ Dz/ i]5b+XwIl7W<|(QGv8A;U<շID0A/Pc|)rnddͥzbn*fXO"5R2(Co3GqX"gpBʇ>MާŌv臏Y{8bqHuh֝;Oe b8Yq? 9( ZWχ.9UoMz=|iy.aۍ| ǫ7Rtޯ\_=iT:{:Q${Q}N a(xׁ?kfÁdƓ(Zl!Drug)v_?^z_}M7vЎtf{QtIFI>*{Cgq:Ky4'SAwkYŠ: ӓi ~/4OlQnQj^Hsϝ˵NH6ы:em#EpYbmaG=ͥ"3QxTELO`Di.[ mQ'p!iI6;}OK z[OteZM/s.ᛋ Kc'`X{ˆBO*}|͎92'HCJ&;m2xׂc-j D}/5;b ZU";E-FgK쵹CZZm=qx߭-m&z_otpJA{Rx~þ͆#_;E'1Y_XCHў@x= Cޙ%Wi2s L0.m_IM@+ :~._xQ}&w3JʊI9m&NJm+~6:.dBY*lI#F/~ݛKd%VRSw1EЂfh=rK쬟O|(EcĀBMO}v{vFs_;5ȷ.rU+>;*Лf3ѰO(x caʔAUo>~tpC`+6f#"t<d|KyW3FB*K[58x@)0Q$䥷<WM\&Gkyб/.~%+q:^Fs6Fz[<9ϒ=7AYkסD!>]Вltϴ/!)/lo` <; 7F(5>QǗ cE4|dMp46@ci?bHhS Г <b!pv ]ݏp1iț@ e-Lq0fxs ֑V)x5sܒzM|8[5qiӊ14mC"3:oHՍ;#oWa/yTneW;Pz}=}j^t$hKtƠ7Ӻ& j9Mzc[H"No'zJ?蚸~! ŏR^,Xjj Ы?ZɄ͇n޻iӭ-J6e1wrs^먠6,OxC_P)6NuE/Ra긪 mӼ†_ 6 1e=ߧLo}jJ$kLP䏇ebD]~]GGTY=ffwWgm k_홬9.&tȲ!_AWw89Xk*P@q!ՒӖlEQzAP*yd.]ͳ;)0CBkD~= iy^";:3nci9ܼSAԳ0Xֻ~(ǭWXnwë5ڴ8y uاroB2,Գta#7j o`))a׊c߯!eryXGTޛSskdZ݃4R]) f<T }YFd+jZEC|[*b?}8"H]>cDF Owb׿6 {+^$cГ,c^x.T[ixPkHf9,GO]6=6]@%1{Inq;%ўk}l D |e/~?&H Ƨġ}BB(N䅉܊o0vtT ڴ贛2?`]NTcQd@`zp p-@kFdu OdACk sISZ0 OEx&e]~ Rk"zLD|*5k"fI%/-6e4)( ɺ}yq64Tu/EAl^B2~ =sd1RE|OoO;=ދ,\dw7;<39lMTąbpu~.9>o;]8 X2b=~>Peejg7fmn:Sn>EYV“8(EEN7E&EVaA9BawAzp7uƸf,;hBA"8٢Vv8 r+w2oĢIoui:H86FЦks5~7?5壓=fz^?)B7{O8Զ<(c)( m;~ Rts,'`n1{[gYVB.CECU-[}L:2fEx^7jD=Ťsߞ1᤼3;$Ix䳀X>*ѨBCt{e!Foztw%yG' ed9mit1/]%Y2,*ΌS({ƷUW\X0j]#t¸+]'ӈ4 $7?TU8/o@Kt$4T.(G$n&jg4/KS9HFh<=r8l?ssbse-Կ5VI.яI1E%u¨%^:Z_͉9L썖{O#4ÍQZ7kfI3ͷB|ǽ 'ʐ ;.=m(FoDf~QZe~*$I䝛^H?o|zⰃ=.Ig[p%Ǻ"eQ?, CiFqovpzqS:H5:1Q-$&5r(Ɛ^NDE/y2ht"H<Yp,]w>k*sQH1GN$=:F4f>>I-졙p_,e6є} #N94 %K%^a{6H²'%a&4sdN!% $i tm4Cou:𨥾=U)z ،ۄZpD8dɝU]x(4g +ۖ h畂0+yf*x$V P bLanP }P+ 2VZZgBp0@.tfm Pf*$KMly?~%Z/3f=){_K͐UZqns\|4KXuH b˜ qW3U{zmi2Rm0 W8ZH3}Qa}#TQb 8@beߑ_}DBݞ DCpJ\Я{H]xi5Q;-Z,00ھ]pqrH))^6dLyX0&'EwI!+JcI=Ai޳VaBf$6z7l7._=k[_UENM t\gV.J X#QuёBmH{a.GV9$)j-%$fJnx"9@B( 4n.Z:nc:,;j)W2,|\''W )ĘR𒕞m~ J~0IZM}uX,osϧZmX,:WCj\S@MTબvj&qܨfR}X>Bv |Ep8~\ vh$lg+O SiM5%'熬hL@&1$"^MdW490e|9f{L5.nsv1Upjzn$i{[^K,@[z(M~ZeeyޝЃh6ؙQbzhrвxB>m[X+k&3 ljaLМHcx3BM&lkۘFai7Q>֋*n|P_+V.1#mFJ1JWa}1Ɛx./[iiHmi$6PHJT OT3SqӄDV|wx4M^M1WS䶟GN*k\Oy PZ "-G@ rp!^1|0Y 5#Uni[Cxʿ AUAOhXf`e,$ĥrq @vdQXO% gSQ` ZE}1V`3~H!0*N2,rJ1P0Itx$>,9NHAt0A1Pڠiy"~VwF C'rmBONzQ?B=ScϏ 2ma6,/V/ zo53 f5t.q<>#b&Axk߼TLT@=&R,8. Ynè3߁ iX[=< >P{B%7*J(ә^ x0%Jlv#uYC(A\n ÚXx[J?0} ‰,hO9 B)xw~%;CHf쟶e9u euwu+n x^3n*4=[iBK~7i;B7 ߥrEJ̮5X ITJ5 WE}PBH) Go"O6OVZ]_~5 ŒٛV,cpO@ m(TM-CA&/0@"↹M%/ԟfKLۮ'o˞]K].KHmyi$l_G^YN%8Կ F Uf%j9hPtyc|WPq(WCzH$:v4r3 W/n~aVNDFH=4V-/U *.E3i?UucM< oچk^g!.; P)oQH(Gxy4k*+ ^=R,bdn>vt!:ϝ :g+\L-ORM=٫S:RwφnTI]1qIvhź(eT>XO,((!X2[-T+3Jˆs.GaWƧ 'sm0Cn^h!7z,;WسhfbX0_U;dHVCIdނq{Җe/T/1;nMblUoD;)}[ʪW²5]<"v@1D x]jJX\j4I;KƠb/uk"\Y#,5Y=o#h6tbW[n!J72ɠ$%i ԋ(mTxfd5JB1Y QJex?X)sk6F`7PN <-"Ic3'K4.ѻNU A@]*-eD]qXOrz(#*$|cVmɷ TOW u 1ے+Z`^|U~d0ApZK>^۬_˒?@L8?JL,'~+!4n9i0éJ>~DÅYrSԊCZsƱ{V#kgPb s]XB {(pg^QEiN5u޹cB-(] x6E,RZX12h&.!g)p!$2o@dž0)N!BZ=Inlp9$/51LjnQLrKAY0wCDc EbǞҸP_lK՜V=y?ߊ:'Z"Cmٲ9IraXuOҕtQWLiGc{F|㦭6۪t XX@!5/?#OeÉB>1T+Ɇiji\Xܼgz{[C-C1"ʷ\QBfx%IwӦ\Mc.m R ;}:L[0דJV5N xv7]@rI칺[Lza|ͬҊڳ>uT& ~$u<0B(.Mш%?WuL.f[3XW'8 uwb7 ?nԟd,:+Ӻ6M_dY֍u7.mDtwr4C_"+.*?SS#(dA 0) r#!<) z[&82&1W< ᐣE#tL+b۰,NNK Lp+%g,# (QG]z'-1-Tk Ybes{T8G,yHuZ_Eu ͹?. ==u,hXP#RSA! q o+s>0+Ȗө㮻a%'( O-UG1F[:f^KUh: .d^u=uoORT`^ uȸ]>?" D"Y|ukŲ60}Ű ]6?ɦOw(7a :+()%iWKeEfgpHIԃ|!/?ʕ`eDSXU{qro"a1FGvBn;`k\_i+GU^̯.j\[d?}b׀h b?oTWA̦A0QZ3 Դ0:/.jpˬ%-gB,p;}nVIOup$G%W4⽃qۻbpTxv E sobLi-gnɚ7A`Řvփ!RiyүGW))0}t;XSr;^rpO}4ʍ՞Ycď4/ ir9{F3kFI OF[[tPdK2xuk+KPF #&j,/bWEOtk΀i[h*F6m܍i*6fJ R)}IyͬyU֬{SoPy:s'+ o]ušECV kBVET _\ǩ;K 9p,U%oh5\XݱO-MyA]oG- `;5'όE6 "M?v ޶ʤ}N&gp9|]O%68Fcc!1rN0p?ki4jY)SWDj%4}*pڑË4<ࡐ98 2Wj5ow,4 Td_hA mܧ9 8ߴ\&B?1(>%uod d01 c{v@Nj'Y,7UY yh1Rtdèߌ:a ~_|d&mvB6o|; DxE.CWy{ń }q? = H 'bZ4vlDX$ߦ j.{hr; : cD nKֶJ2Uc̝ߑw;T䜎-mZ^JXTuZE^PnqHgTBjC'XS8Se쏰8t30U;efٽ3>(A%ǨrwQ4sO%_E{O/sׄ]҂m8QiVF۸Yl~;kT{GhOds"}=ض8@6U!<%b,D@ ԕQZY=>3TS<9bW#(l%2dp?T8`b֣6 dE-Sq&xuMh}&Cնh&^HH๞"{5/Iuhauh Bgԡ9mS7qrIiIaC\._,ۦ 4O(T >wxKB*Ij 8-:x s-zō-颃G[R6c\ VpƌhӐIA 3y:.p!!s,wɎ\?vCY QPmkbFsMON!E466ss}'GkeڨoPpzz󦱼Bg33ĨP}c{w.tA*=x(2} 5^3/AF-,8, zR bnM14DqX/:G}b nO2ڂ% 8=J +c2iɷdOb ~i˱9"mBKb#?+…8I**(K;ا8LDF&'0Bp/*A'> z9*)p1BI?9<LZZ[0m3-xv۟FV>NGn|)*vhMLmw6{ɰ~^Ƙ8ZTBx/.Z|t5{'VjΓ2lP0Pvl۠y܋GYH W"@bPfX{oAIVIο =r8JPLa >jUG吀SS~ |䩐&60gӀƀ>=vPYz+|z).]uΝC!=u޻2VlƬtt wDay"z]q6Y}5_6~l1"8 K?R̰x8|=w:Boˆ&V/;[%viC׸[\ 1 {-lXs40送tȅ$ G3]8R'u) nL5B厴Epnm&$} `_*/"4Qgk6[ۊΞD,&U& Y ƕ;}"+ׯ?O>y=M'sP ֌ ã"GI܇hr 6u%E~o>BϪ1}QY'9D O5b"-Sjމ~z|E3UViByK s;`\0\!8v_>/ zsS,!$Onm6dgU u 03IFWBoxj~s-cB IzhuR]:Jzg'|FY ^s&mp9 ;?V҈yU0G:bs4LUT G/I(IvbSBkLxm} C61 J;)NiPz/)66kAxn(Pw)ߡU|LHmk(4.!V) ^7`k Ʊ' wg>bur:ǡ8 F^LR^(Ϩq* <^y[Fg64T&?.f{g Q_GnUPspܷVYj#LXVOK I#8ǐj!O*4\0Z:~Al0b|3Tj8g|rrI*ЬIiÔ|U܈$wWE0}"X`oW0wY/# ߷8ʼpb*u(Y%#bW] z\+)PN_  5[*L1)7k |Za!*9X}AAo(ⶾ 9ؕ3cE*fׅ, ?B ̻Lj}Q## 9j" 07;1 ^`c.ʥoGRbTx^L.<A8_ϸ$bկ|_ɍAJBΗ\@[u$ߕj/8ԙZ(: Tw vLw`f"|4mo(%Uw27c`Y4]޵Y@)X`%b?vRMzU(HӉeF*QBfH|J:{ȸ6uJY|I 4՛Ϸy$,Ձ.kS)Y#n T7 Ș-QP,Ժ"'/oE'au qŊa|,[/FF* $h?M_~{N~|^$٫ K["6*+R7;:P7`X 4.-7#(Ԥy/`W<,kXpjy#v,tr bwb{@FCr1HU _%J^ $ P8#[Rw쯡51k=X%}e[{mb9eH.&zfgq".1zit c>dYvkx~agˣ-.U]=0@o\-\:յ P4Y9D]&d$pOT/tF-ZXMf{2? b“oIO 3bO^`l 33sno Zn- YzxSPsVr`lUW LW>8u淁!|Q.c`#fqhkt1Jx1Z54AF nttސFxi\l~slDg-uYXct_tuvp\׍bObcse7'au:G޷dBu41YO {7 Aa}L=@Uyu@!"O,#vOQ(.`=|dD8zA`-|5Bs ?n^f._͑6ؓ9~:0(; 톨z\ A>Ng׻˿7P6#)kD])S&m?DˑbMcƶłȗ]K'e +'rEP0܍ZڀuW7,X#Lz{=XX\K=y9;OS.$RJ3j\Ƌ,%_JSp uti2,+8*K෎Wy?6 Ty'A񖡵Y%wp6J!E19׳7DZw='7'f`Q$"(DC+~4(2HQ4Va!d/U›hr,-boݞ̣OɳI"C %SE j{o Xeaa\l7ǕғƧk ߯O5wPoA ߘ8VDW5$/ C7u#(ߗB8lvJʋr݃qZcر,iT 3np(l)4kK!`9Qڃځ~~\dJm>:I?Zлۤ\@Ib,(9|r}ZU_~$-)CS|5?<̻~l?PՄt0"(y#lV$JxkmdIbZrjwHAq~hHEҊ >*a w*wZUCn#3F a#2l諴+EOɸ wƉ(=}s&^78vvU^h.SEqRDZvYjwݝUj@3\bw4izN8՛`IՔoOQD1浬Z&7A(K*h]@g*T$Tاm/0q2%i*#g;vPT.j\کS-Pw]qI_Zb4L-" ʃ8+Ư3nU76GqaÌ8qyrK_Ɣ4؃s~T]Aoӊ-my\ęIM(J jA+F3XVX8[<:"DU ^Ͼ8$TOa C^KbfB=2 ]f+4 q.zN}͚1/\^d0ql,St*20S_dSb0lnM& w#\u/х[W/nnB8 4lAǁA[s txkqa°@.]Hއ vMi╜%!KxǪ uV!|_Xb9_*_U ,0ݔ[ dY#/An?ȌZU)d)>l ZN_9U]o!Փ!$WtC]~Oe|`N0;6jKGy^5+Zp:}c4ROK/lf`Xr6S" 44k8~>ުoB?3 QTXʳ| OǴ3gK^3:yS~Z]-3*"HnI'wO<K̨Ko.X$khRq#nM-Ѥ :P78&:@J]a18n]-Bei}gۧ4A)h0)čb.` )P=u)n73ʁ/_\E)\#C[ߟ}6iGRk^fQ- 0Ѱ;pD'P!JXe8s Յdy7nмI 0>p:l E)j/INp nfW]NaFϺu8jX?چ/nДu0fedȸ.he{bHBGo{`< \gBĠ5i$17'o=k9[ PBX;ѭU.FJ( Pd;X)u( qzQ~@~YD,=%TOI;G/7[ STtZfl$ YVY$<^DͫV' JĘ|.{?eI{U%nO?9!r}/f l:>lV֍'zQ5$&glG hf|-?1!O! k$$>{qBlvaC*LBY H^_^@TȠȫ(@h71d=nEď݈$q0nMsµ!opL|2oŽ,9c ehGo eB YJM^Kj2iQ"d jXzEBD?%$b->Ie4_#*M2-wBs4J^N3O|Kޔ%Wv6':b(PYu )5~+5sf\A xu$ Z9tMƚ[͗`a!>ERf/xrސ0)8%ͭK }ۊceyβW(?t3+F>δU߇4e֪ti4j;уŃO[Ͽ'=#@'j +(LNb.IY;x.#c<]?1W|a^8f_dpqWS.ge#×]?/oŶ7%9r~5 ]\L-\%s`B WE-apMzBҗ\5?f FCNed>e yd?pCF'/+]( nRa^>|:3%gp]y3H?Fځpu! q%: ^`v?.Ŗ{}mbl!6/u"{V YD>jd˦AR7nL;w)OZ: j-V0JW+~ /͓vd[LF1OqǷD?b,9Mh5QEpT'X,iLDjTJ6#+]9ۇϛ. `RgMYPsN\BP\8C.5D^t-DU5*O2!]cǕWuYill$DR7y/) d!TE]v.P{1ti@:^@Zu>lX}Bw_Z!#<;;y] uf^t/b#ӑBfoCF^ ~@_ZrHA1&TP;0 8F:BDweסfL:.Vfy Twl Q`md/"R VajoR"IP_si{)fد<Ӡ[sܮ Jpr&cV'WO='h%\E-=7'YfihE4e"8i+3L:ɦx:ybz^lWfLs1dCNhDI =:Au`'RTAe~?4a$YS/|GtrP ǿSmD}lC5B,]̗RmT^ ~FT C5V置^F-6P-WgqKW1Q&zk1V]ŶLt&=XvWXL;>˵Vt)ΙN!9V6ja0/kvFK7 4>oYܙ(aX役|b,s#" *g]bn{Dњ`#m+#iX-CXoY ڳ0hp=߯u츏U ؈ɯIku"lv^2S\&54U?Np싑b:Pe;_Et}m<@#}=;.qdTamk'"TV*qdմZn {n"J,h .lCAflq~^X-&+B6eD_N\ tOEx(}> $0pU[ 31z>:0A/|Cbmb@#ΊLE͵FHkoPYUb&NL~$i ȣ3kiX iXpD0êL˰0bk E{Ei[𖅭jjWm<*$TV<-X,w8clrLh% |omZo|^+d_Cy<0ML˚3,DZD Fh5 'ȫhvOUJgg_x^jtZpAw~Igk ͥmLaVuacsa]UH)斐枛%ݠ#/@?i,+m luXωO,R%Duץ -gN2CO2 eG8jׯY2$uOCfNJʺ)Asj@UZm+v$d&_?Q9Ph*?>A}q9 Q-saH o# UUz6X.>¹-YOXK].CIZђLc;2C57>3pݟjY'Q3^"(LT}篥xZȰD02wC$#~'>9Gh-^ӐO,1HgHNuVaoj|FLj_,3O6gΒ{BjUΣ۪^fa-SNr4Gt::kV>əa_OUqhP<2iepKڼk=u*Xαdk>WWi{-TuT =Z nz_ulDGπ~7f|kyK# pD R$*ryS*eAKCTH% .Cށz= rjTH5Ooi::AOMTQÚu)?sJ+ l/+ϔL 1ͤ6̍dBCoz[+fR 0*,x "29+sTN^TnP b@,w xN.Hb8Xh:=҆eѲ{Ϗݍat ㌼/[,'8Ӵ cA4Ss%8 Ga^aR> ʄ0Z. HmNswo;/4!FRشLTZ sݿEu,F2/65ӔUg,]݉w9({A-h^3HW֔NWE!q*2ӣέHdt*;gz2qSg}r|'@CΔ1^7YC>M,NzqalpOY4^J. z"bȷ>Ay!Xܝ}6`:rOa,Lȅ#x9{Ƨ\KQ^W~S!1YV;NB̬w& & Ea#A=KAaU9{UDvi'WRy}h2視}CFjIHtznqâU.滚ѭmK44öC ;In،r28"`xOS;()TId<e6揰V0΄t/Bttmw[IOlߗH7=fCh SM<)0ЄQ#3Ƭ;99 /9hx@( wy]AO@OS7(sJfe05#D:1LN;RUQIkpY+oOX%P@+TDһ`Q`۪P3X޾B܏+SK'OTHn][q !m }ݔT@# d,/20hKnS)Lxp@=,pl}ؐ;.>7Iڕ}]u+GV!gcoI+}ErM[^2 ؼ3.ى;>~Ξ] =.KF<?SWAbawB0tDs[QT谌I.W9w"Klra베Z^r5J(b8J\PӇSܩK"MXK@At%HxƴzQD `}uĝhEYeqO}8-GRwzKž@FLН/4SF/>'S{beBj~݈yKAbCHP ڴOvx,F|WjqDg¡}ZuaA GO=sA[` ]'Kճ1gEL53K-)t3vքRO c18kKrw T4ڊ=Eؚ$۸V1Lf,ȧZv?eiAֆXhG0a}O<ˍQР:5'P4TugwR <b$kMbZmbcXyT[& R!tܳ$1z2gzͿá,)kP%>!3MR݊hVN>/].`_;4[됆![b;H4Uլ <ɬX$3%k_*|bab2719˝HٜF4D~y5IZWP>zm;Tv.22o{ ?Bb+4ɳ cD2X칏23oTڒR[[KBkI ҺNٛ^fgE |ʩ6}- dՂsF?IjFJ'OG1!뮎1=={h[½i?G⃩ oVkO-ZOc5Gf/5(M7*dJ n#b0W~/AsX~"]86p_ V/ǬP0j3dpio6;^ߜ[. +R *k-Lk Miŝ1Zy(i5xpMŀo: pЏX |OBm}.]#3mQhDo^q*$Y[Ptи#&/:ibs.NJZBw>zj&sFrxPZ? \j |Ƽpe[._F9 oD9+jFF?"tX9 :P}wZO&o\ףYcZQQP4c9ܚ5\6MasdNUq ^P>)ɚ]&che <3g*k`PY%>d yȪ[1n:(uPu14Xt!DJQ!m#GA:ib\z'gP*]Je h9 煾"Dsx8Uh)e3# |d- O*P?H ^8O(U-ҔӠIpŭHD)^>+N!8-  MŸK[&BDӺ{֋~G}:\l5'vml G3j6=H b^ntXݪIݢ8˙0.to 11MuCSU~pz+sr* }ؾU)J @4hO6.P^/(JӰlQc۱NwnI'Kİ*$ Vլ )ƨ|w*ä~Ō-B ߸MMe l KYc=IiP϶p!A1B,dYES[g44b(|Y Vk"#B.6kF{F㘾GW)c7@Q \ e)YrQa ëGvC8@%BRW޽ߗd^ſbX] Sf;V_9% , m#J\,|ev} nyئYtv4j;]`\ S2ɢjz8(b20ȕ"}jT9 G %#H =, )PVfNywvZh修w|_LH)T\5yJI At׸ͼƽ !M_ y*$:F.sa[Ks^t0lڱr>fL+7O>y';)Qfy!ᙝ5?"RBT]uTSp Zی{XzH~\%WreY"CʗN\/q[ (i?/ Val('!bEqXgldU~^hф,-Ea~i^ecZ`e SU"TenQz ڢ7 =A",s(;n͋68C`KGg&'662edrm -8`^>{ GB#GPŌpG_%C1^)]G}uBZ %`2z5ViyM$ԟƕuD>sWF^!ԝQT޼ ;b|Yz &{9?g~aaxZ@EծQ%zO_O}BNek]bno~\3xc#- ؔ#x @ xn:BDQ{-nMf>Is Ę+1И;e|mr; r?vGmB=s|(WmOTv.8B[VCᬉbPOZwYD8lZoV08H졝P&4YӔ:&tQ=E ݌eͮ*&?M/Bc'qʕӈ; *oSαmRnfyZYٸ$L0㯀JgNr}D=IY;-J\3ZLZ\B?,`f$J4,"@ҧn;SeweHt DL 6_Y.7aCEZI5!2K 50*r!Pm=BOĉx!4sCϤ`/E \6su~D&BX?FOl̾p= 'qH A2򅕆06dis6ݔJSI?Cl'/_+S狔*vH l?1I^pCx gq {Xx'2d[lNKX"x;WArG U9PSp:lW]pl9+>?[6   i6=h2f/FU+Vm_.UA2e5d:{σx**]/ׯlu h_z%SU7PW_D؁ ^M+α-r.!|냪#GRu\aFէ}'V qQ։N^r9Vu܁aw|3h21p(|4B.V3 ϦP*ފm#u8]9ʮ0tF*NU>Ϣ!7 so6cތ *M! s¨8^ZꝗN=m184f6J8nӕui:m8,Hv&#7cc[$g)5,Zɽmʯ+S$I(5ex5ؗw@kSWc98Y_aC(O_>q%.7#3A`bD7DžfSG v2;gYGm,FLpot[61:^!h0YpPϋjTp{lm5, #] mjނߋvb #mU&mr>ߡП-fYLо{R k wR4jjn.{x&*2Zmb2%j> ^SczJah06땤YSNk;dd*1}#ykQw]\!L Yc`(17zJnoəN3hp,y꺷w틛"3&.[qI*ṣJv)`TOA}7d8>QNs?tUŌv?H:5eAq3k˛C3nK$L0*+K=6\XU\qg`(uKIJ )?nN?l ьNa:8%lg{D_X+Ġo V"\.W&(d!߹l0^kV"wPQA1\v%q#FCgTW@*DI, Eq'I75gJsmxdq;2:a>9ȽEFzkgsfha&MҏȀz$9C-N0|ߌxq7d)*_ (g[ O`O>۩K.4'gק8x=yN0|Y@lUqmc% dUeZ%3 -gn_VS0/ݸd==J$6Fx5d̤VMD݌_UVMܖ r}`uv璍\wOfj-c @?=Jwbqh]0- ޾*wk'SŢ3qЦ!>R/g/Y<G#8xBsҕ1aA34'E$2h3^! PZ>P1XG $,/!̅QM:[IS ELc[eVx*enO0w .Sɚ_$OܚIߗ/WԻ8B5ˀ=y]Y!=+AL^|}c%ۄ׍xx+mK; ?v=`xDm~O`uD3bpU?s%Syt] vږlbPP!S.qC((vq86znyBE %ݴބc|CIyӦV-eVdZ>׫Ъ̌h5e #mT8 ڼpN350 o{oIh%`;qVǵ&rĐo vӵsrdv͸8]%rJLM%>_d.VDž!$[[wJT- xpc7鳉Mpogow-oB|هbkr,'j敖/% coCה$gbV*,*U#0wjnlrlMp iYߢmtX@b0z}"ƌѩPC$ _vPY憞eUۿX _"dҩU0a{2[/>˱]~0JB۬ѕ%ėZ'c Dn|g4D~tuh1:Rԑi31t v̶DMm$Lɼn^YͨOa3qHc[h}\H~ԯ?_5.gpqXqo/v؝t.MLtuH?b ya&4 ߕ]E_,+>%|u|W. ;Wn(Wѝ$~T5:~oI)m"-Tqfwp2c [Y`ԨdBfoҜ*=b4nB*<"E1ٲE m%>M2*8';fq25&UC=ɬggHu*ۋ9{ tۘ9G"+=Rq`,|ѓJv3O"Db,#B z1մtBWUߪEpd\7B^eI B2Roa"#<<004ިO{"8 ]9Ҹ)d$7 XVJ LI'%8~Uv.oirf#UǴD(X'\QuxX_,^Y7!6NEiv$Ҽ@K\1Aћ ֘] ` iD^|K;.jh@ώ !wNkhī?c Ene3Ӏ _xt\{hSs昲 $#kY9>*"ϝ!ޖ{͒q*z,qզlts5aU N\ (K)u:xWud*/FBn7(Bњ!h 6"yWE ~Gqؒ# \GQH׭ d'n T~;@8z귄?}8KYE=>U" F"%@~'6pNL{@8@RuǒsNBybw~$qdl)ZZltyb5FW20/Δ3߼6+*ɎOv7 b4 XkZ[r^FglVIwB:r^x?8>]W]OwSWh6҄p?tn6O2ItdL^kx`*!nASG%BEYzjHYM?mAL *0/յ[kVqsm1'ߙP.`MRd?tc3o>k)e\݇1zy~Owڛߢeh K ~`u&y3>7ojC $ 2]^瘸+,c~|GتBTe]`ي5 [lT&dG(N%};q~{uM{ @3T,|/0Иz][ Wa1w"A胃RRMKBxAӴ#,k;Woniۿe8LGZaOZTMaiŀerV֤Ëa j ߂ՐWq=D(d{c')8FO %v7~xU)HeP( SWo8T!t!<(2k/u]}kd)d@?,#ׇSL[GҎ ʵ%v3/XMsn_}Dͱ*2Js ӌ*\%ـVFPpDR۲0k4<$싲~Ⱦ׿#0(zʵ۹aw\M-i|F*&,fB7g 3i yҏ]]x'xޗ={|D_rb˾zsh"YV00G>kLĎh (F$[UDYVGd6>\zP{$v!Gv'>o.JF1`/7UqkM*Ǫ D}]Z8wIHآsF*IM Zv-hz^Z%$Ӥ\'ώ$ǵQ&XJTzgHStuj-ZT=Չu[[#b|L|/FmwåɁt~l N e$SտhԽUl9BگQ$WT c6/ F8NKΊՠ;E@ROhM(MgЉg`v<`Ukϟ[* h}@3A^^uOpV!\] .[߭* 0s^@o }mݳX% A9ok!:+3?Ңw.Ѝ?z w_[^dDq{Y?el=BH %7@AU %mGAA ,z5Z=ȼ8[$lFXs6&3Z :WPK:mzj1N@]#K}B]FCƴ`GnA}U or+{&Yk:·K)2R?z:(dƐG:q*0*no`!mmd8)J@B[#{qbVǔgMD=OQhg(|=f e_)} #hdz;km7``'f6YJƐec@S+FTRXO$KA5RaiizMAA~Yyp/P X{X⢿q̃^OH[RMD[sl8<,0 AoM&H Ws2Rtgh6$=x(R X|" y3h@:qvmkp`@4wXrxnY9C jV#c@ PO?بlɽZ%ј Z]+K]aXq%suU+•WWbzaB@ID9LGqkٞR?N΀hxQP}Kκ`G@A.,U~rM+6/*ŽkZ=VW7W˯4?QG˰$|p.rrY~jJ-Y~)nXJо0L23ʿ݂vzp4u)n 㘎j)zYPM5sFo'niilrZ5 Em0u昊CʞF{hL{zvJq?≁Ԗ2|3.%7#W!P?vTԞZ7I@ی3I}),H%w !0&ݍWPG)Z;Xq]e@E z 9b;A$ ,}X Qڃ]Y~4ML~ WTʜNk͗I\AJHR'D-~cr=0$K`'H:Z*m_>_;J OmS X>LI\Z6wFB̺^FgSMdqEuҎ yvjbV5.cDp^yK``zI%!Iw_QHwDj5%?xkZN6=`u!gjٚ/:#vna Ho+~߈Vv`TjAXEË GKC]A2"ƩZAar{Fo4i*Fu^ړXSq1 [4pM˂Nrq1e>KD% )M3ި("/j:,}4O$֧}@vq&DLd$ ->ncx=:Kw:M`]ۋ:s606zqK秙.;w-Y:p8ND66ۄVËq+ux}5O>Dv aئO; )!H);+zM\Oi$,`F6W*j4 lJ+^r<S:oKɫijbĒ" C~$(&8/ӈ[2 #%b]H=aMO^7+OϱI`r ˠ;}^j?t'/yx3H`!!&*zrx:p{!N50-Mc `MECȀ{4{)kˑJ)e2>wiCIN.{9OBZ '~kYpV }f3+GGF"ϼYIQ4%/a^ {"7e(&I*I}/)ː u!{۫Ƃ\4NbSiKEf>ci|~(o^Bj/bPլ߅Ԇ֚ 8RpP1ʮyF"9,$fsa `f&t@}I I*^,UzP|GhJ-k6&蔘`J`h!X[U&wnlyu/}b ^J4"KFE9A!p=?Ѫ 'b.>#gy4KuDUGvd-4op!`S`͂Yl!}B6%M7=0[ t񁔷p+}iJ)}fLM8cNC6 -ˠ[g8mF{dSC|YxWz0/ |9'WrD~m[4;QGEA%lPLF͂p-$֌&AC|7 dxQQ!8eX[eCj =Z$d YD{nҲK=mJtz6]CJ]kBY28I?`*RMl01 m̳4H .Rm^-Mnwh]Ov$OKH!5OnY- D+9RRׇ3ƛ ' S 1F g -XgF5KC5ɷ Ϸ` n$uf:j`w6$C@| ,J9tjr{Jc~xNЉX7h_Yh[°g-TK͚x6$ Z]305Jzjm7nۨ,TXWZ;A/_İa zM 90= %6;fI36-1(/T9o-\j/JׄokEFr G(Ej8y; KI_,DyE[ȑM~ShMX tu)zaF~nљ*X8t CV)?I]4 Fbv^T2\v.xM`!wlxJ TԲ[Dj؃^?UOՑe)1 y"Ǝ߹Q26XbgJtn5nՎSd~#n+1N OC6+Y2fOu $b۰09(Oa|sO{#\]9arG_19Q~|Xo4bsmf#T GEk[Z\ݷyW)Qu܊&r 3F}(%U,ᒼ7zb"xVN4Vv]&c?2n-@ut uA T'2m- 0wd8RsWM]Dcِ`lIΛ8H!Ts uvW5;I[u(=/.)靷eq\ϐ75dht>=f|wev|'zB뎑 CdW"!Oeukkbƣ?3?a(x+9c}[ ܩSAP+e$M4 )q[)CƷ) F+|ۈ)&\za;2}5x@ˁhd h㕐|jvEHz _Kk#(@:c@C]=wR|ÒSo=,^⇟K>Ks^e#m-*ʉ} 6f*%`066q@o!\^ƛP%̔inRUPW>m{#IQ@S==gUVA#XgjB1WT'7=i͇8 AмQ!*am5[ZGPZ;yL "\:]7*)Y|SRΤ-Ib4DY!NyDv84[Y-5M=QR̝½AkA׷{$ś䇜 &qAj`:CxI.n *2+7H - rn'{dsHBmwɹߗ/LeUX$95SЇ\Rm^LrXH5x zMqs퍴m#ŕ~*Ox^_A $@ b}}W{,27$pxk VkSF:Rd`*E*޴.!{.{녰2uBږG O*,R>={h!v%m=syrt_q)^hɽSur(bض~f'ѱwh9OYθ23QԠd)LTKSMi)_# l|ʗ- B S.(7qrN|09kxF ={ 6׮/jd#UC) {@#vwH8 +bz(i'H,EgķmPу_',^Q-' ;lBM@!g=ՓJ|iX|HaM44ъ j G- uBri&r?d2@ܵD+6dr83Ȉ&aۀu|h[G֞!)k$=II42UU2z,m%Slﶄhx1+115gEt^s,- 7)R+w#oޤgc֌(z=E=:Ԅo*#`*h'Y=H*SG5,S#/-Ssߗc;)FdT``_nxNq4$`crua^%?QmI'"VRc ̈uã1Zprf@8 ّAtZ<y):˚',%X}đ 3U("bsZJ1i"67͐< U5PD)'~S׷48n+ le'<ǴJc `"> !li-3y=@+K`7fi' u~zU+a-! =#_c5AE%R|/e=R=f'Ɯn3S[b@JMjz Skex xd4`31j8P!Ո;ݺUZx\V!90ߤ|R } tfRS&|`3mƭevc*pYa*%B6s-(7SeSƎJ׮6^vS GnӼ6 \sh_!9(Dm+Oy( Y-ꉛW>zt 8բz|²BʹU9w}g{D#l.֡Dm^c}`CtC*լz!mYq7um~V8tHزb;d'12bUnS@#aehAX(-(Q'Lo=|i.5PeyY(BeP]^c*1ٌn"9A {:H޳ ];~An_3 kmO{ڐ踚Kro15OQƮ }!QJa߈Oh~mMlpYS_K>CRu) l8e959zhzZdB=*m@ YO;WPw_<7X1^kS: ڵ*U?e'3t TKGQ?J6}c7%gԤ \hR3I]ֱ<%GTt1 ۔@ñ ódW{1pN3g)(VЃsk~6e?}vY;< ӝT:oԜ8ƭF+**Tk,{fϹ7Fﮈ%[Fd@ؿ[0Qj_!@ Y6 S8(xx|ս L CQFEn Ǭ$^pް=Q H}baw3zAƛvYo ǾS ZK7YVv2Gks; 7R~!~v~DԤ8#/A5P}Ľ?5r~OEY! B*@{^992K_wM>8tj&Ę<s8i8dgRVs8[0JL/ȕ+N+&M!ȏ헟E 0lc wR~<}|0х\ozFzz'J6vEn@[>x'OLdoGN$.:1;25a'GE-auwƒ1l/ޯ-WYh;w\]<*3v9Gt/ևl3pI)_;#44¨"6L+QzH~DOi{z ̙F aw_:<eqw%볻Ҏ'Ŭ 7͇MJ=+5dz? q1^@+Ҕ=<arY})dK~G7o}uƃe-SJ)tCxL*F~2򚄍S;Ȼ@XSgyvo *UC~I@/]ԅd?wJpDZuû} ` IݯcCˡ5o2+)AGD́v *ųM覬+kǃ;YRjv@@X"F1 O Bt ӉAV)biJbf?3Q vFg>=lg[ ƢR ݜ]صg˹T;x%p$4:iI% gV^*[*YLf>;\>HFrՏIQM_|Yw3e}[ l[FփWR!! y2s;*etF8-{@$Vɴuɠe+7CD*oeɑUVhG3GHm8]5R:' MU=Z|e'T,jm=XrFQա>@+qosISA%ո1> 3 "8k=f ¹xPKe?y"mGpm*fBd2ww 8/V`$Z~|R$kzKL<饅 ܲ=_ŀ@>3n0c?'ed6r7R>O"p;tAI0c4_^Ml;L<q ?uk MVF " cjI=zJЗ2.kXpw p+2 7k(5^v淶%+ԍqnD')-yr"-{O5/^g  xJW p'pl*h$r%1hgexh!v&/X x'G_ |%F S1+\^lHa 9T@1e }Z;S,(mSH;,~w7Nb#-+ǩie!-_;Dh'VXB]%c.goov* b"VBv wX?٥|tmS|ĊJ 靓vRa/^{E\wFɵm<5+}Z `zGBT!F _=7tc9Q?`ѽX;ay`Y,> )nK«j!ӏB >R%ԝ}jń Q[~so6546bG6F#2E(yx߿W%RuvOu4](. $n H 08O1 ] sn&בj(TG4#(!45O1oR&ZvI*@!t 7ἱcte_\uV(R*eatz"\t/L8__\^Ϋ UK*t-f_\ 4H,1cIL</5t(pu߇r0yeZee'pEE@<,x ,Ŗ5W Rs3յzT,X`"QP^q/D?qFċzL(qXpoO-<+VqXsܮD#!Ԍ;BlT\_xBe壱v]vOTlNrفRMZPlLZ(kopfoDt&g-,iA֫iLNst.XJ́1>2-Rq,wdt'Ae=҅']dc[ۏ5v+0^M"nWTW=GPjb# ˖=,2v"f& .T@Ew3Ȉp/)Ϸsy~DYtBAxM yCgz'k{)~E'W.t L$ ~/iߍLz#9$pTǒ͂m/Ü]%AYIm=iX\*!vĹX$$lR;:>/@A1;3ۛD4ꮼBA'C8:qHc3eIb\tLq* "a r+V" 'I0fqʞ>k6BTUg,.e^OM3.|%牡i\8RZՠGċ  T=Z4[Q 0ɜ%XB}ZV$iɻބ1]Cfb6Š.nHqk3J#&΁7Kz̦ a(DoFۛ5ۖUyiRv_zUĽʦ*_:|,BPꢏ pr ,)n4[^^$3|_6 2Ȳ`qglZ1 Ӽ-lj#u8svFG.VCAкhpj֨)}Zҁ2V*Lt:c&V;鞷9/|u $;@yF}$6%`8cΓGZtf 68j+!'cx$w.Zk%IjG {kE{nJշڡK22s~heұGobj-E:)>KX{E¾N,3x?³RFoEzU3VkmɸU+]Bvzq?[н=廹"JTsB}kMe$^XGX-P`p!Ys}uZc:~Po98 7dTdv[=v)yL)B:ͯ{DdW¿~P94KS$h2롳Z||[0 wptq\{juBq^/j?.G8BsTGҙz=:X JCUxPߍ߽xWI!h N^$؉NWq{P,su<;En,LF~%QeWV?@verbif(Z"qhi*~LZ_d*h!bO#M{B1Fm,"|6"j$8F)U#1/a6$Aw ?!r΄e~|wW+]jan;po"Ք%8 698!6Tz(%ZC?Ug_b{+E`c0#{iB;ղ!yXx~ohqS+EBcS!&!ö5Sq*ʻ ߍ .Bt.Uf bK<ɉVgUGA }ڲ2-~_l"GBpCMYR=7h3 9hi C`g(pE|ɽ%zlsYF j XfAZr?r 紐җԤVGk^+gMj¸ĤL_hur>AqF䢱Yӌ*,A+J]1Ox%q';B?QnxLC^#sh|B2w05| 7. eGhZֈ<$J6 T5pY~-ξ$`bĮ4$y]QHp?6&ZbR(NF(V|2#<|̒ӈJqZ2tC".F$Z)ó{S\ cΆ&*l %D _)_N "Ex50Vo`hr@SO d7f)BCGr ];/ [G @*6n_B^^^ЪC$iXˮc`'ZF eM^hϜ65TϷYwBtnXց7о`r$#@`UՖ,ئC%w5B^X߽RwZUuT3ptkQg㳿ⶈ:"#K'R᯸=sʋ0^: nNOfnD]cH 7YPY~ 5P*-Z|t.eÚ \kID)qԽF2ۈ?^CSn 0l%GPW}:ً Fcd.澽*kϔ)K1Bx_f"F7c/BIt(jDvί&R;db[7VW#Dg@$5Z\gN[Q=zx*6X]R2JS F7(t 3S u( &G=\O+,sɩ-@4AKo).>Su{PPA%JͮsYkˈڈ Uxᨚ=b Wr('O',(X}4CCh_{bvma;/CpThPHՋE6V7"h'D F4fsv$0b|>s؟Zlut~ٗ!Ӷ۹伅zckpɶ |ZƑ. C@2@aE&+e$  աt"1{j46XAMjz1_@Nhwr/$NU 2~/7vtG:~,p sr/ zړ䖅\$"$YmCWy5UX#|&n< ǟspJ#M*#L_:FoǗb^p8r`xB*v[휜 8Kb>;b 9h JhԂ"Rfm; &zLjxفoH˕5WeS9?(EBǺ [غL,õ"w6K[JGOc[aɱaq:u <%\9/-miL0YAkSMkVcUI{IxLQrU]1|4TF$#k?'ثCN k߸Q+2ƺ!B/eXiAn>WfdEԌx he-B+.,aZ=7 3 LJ=R쓾y͢&[`ӏ::J ,(_*@1u"/$-/XwtS|H 3:DqW P)E#bIu 0L vָ| @&F޳/| "'qnl<<'*]/7=(hK"sehxRvO'0̡TF! 8đ@n*sZahϛ0,u4.Q H*/hkfW~ N 3d)Ռ/veR!%2I1Xcn t'>nvb(:P ل40YQy}-׮[qW/jX=]&3K>=E k#YeT+2p+:+fdEi8U2RYQ(qmCtl(~vYb@ElgtwgC#jQ#GޙR+ÙHZIvګK I\(WSPu=E5EBvbmp{ߢps.;BK*Εq45vZHjT-tz褏0TS >8۩+zT2O^gYYQ7ڞ`G]i] m*^g>v%di|ZU)"|%rdya\~Q-0;fHصg~m5OKIR djZCH-źY7KY}xbgyF'+ Ɏt]ϽL܊-k/d6.){wY?0]6 n>N k4Vk=gnU9?tdskIùw&lɲCM]pٗbp3qif?a5"(R=gbe\7҇fI+bcFw S dGjQJ5 *lX63oIZK΍Y &;NeEdp!d%.?YvFTG '"qxLY\u,G}-lK&i7HP<\ˉoܶpL\bL`.}`Q _q&(YK}=`n;j4wՐd]uq7\1 G ѥ}~D`TĺQ D2Y]MpR.3@mܻdʔ|ElO/;\7x.ttY?Qk.liXAb=؅ԘIk聅?br*c )͛ UI.%^:wi\cEST "=_aXe ~KAN`( Ns^h+oA$??4?Е)_5M !qR`3_eR"6 dC/zLIn:@V,<q17 Էx5KQ?)X!Jl 5P/o_ #^i'}UoDc< tWzP.->J2b/'Gy%bHh*OF%]RBH߳a@#^\O3BĒ&10f)/aq'yGe35qy?gmQr|}$1[=/-~L]iiJs:fu(ullvf`WyZCd]q @E[st؊w Tp/ћ(>5Tׅ@6dQ+d<hòO$)[GyijoLq?cCT&m&KH(`ג)܄hպZS:e;eT_%jɘĪfߧ:8jج=h!-+.O 7>v+E;]d`h״X?4U*&,py"g"ZݎYZy[.лWrVvk*i*cK8O$>>=QɶF {$5xL >\ew?z0"2ǪLou2u2ki(5Ϣp4=cw#/tWv7Q96*uD)[hUA^ Tԙ-e;C,HcysW2PT+A4 0}YA b!1bPOx? V6g|_j:2Ɂn܌;H#o)[SGkCi 7ɵ,E!\v#zJGH˰ݡbIL{Iʘ‚iJh4vF6bU,=n$vRG}`7tBZ}g{[n[$h[UBZ@gIGWpSl{{$)7`ıבW{ 8/K3.t' ZL% ܟ0 _x4D2- eFMHԳLɌGG.1R.6}^|APCܖAzj) 5֩(?|M̖UJ^8RW*arGxr/-3 !lvMs 8vO)W+*{47;CGe-ȉs߆XXxߑ#iz]dZч5y`b:ى+!{˕,s_\k菥%bC"cVDRwzmpFjτxZ;)N`&l$dͣ)l{tBIBґ1O,&3 | Kģ3Tx4$&2%MퟗU\|('>fR_tjk :bt*:WfsY@Cl@+ ()JOSpx"K T('"z\˹ie.SJ <W;.l#wa+"WŲLX-F֥tDR8ET &j$XܩNIS;D4rȈؾ&fg'7>J݀\7hHD~(1{PA럦~(`6+0ɨf}6eUF _㼐!N``YArrw{%+j XݙUnN{q*ĘN* <(upZ\+ 4G9 4Θƺ?adGeEzUWw~,9~F#vj:w޿ VEs5FdiH~5CBO8iRRVPއ0BXc8qrZ8 R3~§ :q^oh^%ٷzFQgeH)j?@]lzYXyEMõ#oL mqhF -6a\5=1ae.|S5)k?t-\xl[6f4ݦ X)ܡԓ^4S0p]OFfޛV m~8KP\Lh\[ݜ*l2=9ژ٫6zp3 t^2e(3p &;t՝?.FN 5;i&pAu?H@Nl=p peILͭM|=ӿmaxg ϐQIWKΘo{PizaiZ|ܵ={8lav O{^} '76ޤȽiw\= !9YV.$?=nW]H|D h{{%UWZޢU7\[}ѼYf3(| @;mET<1oK:68E|0Bx[ 0W)㡤#&d#l$ GVgͯ`/*ݚ< )t \_5lkdTz"<.$ P8`BYѹM_-и8Zͳy0/pT8+{Ls߬J%M r'8}I`K6̝Uz}iɤx:ӮZΰmou'ҹ_z[v1%2/% ?:HMlsLfQ,8=2(NwgZ$}9B㱀g I! ||шHU =-mI3 *;Z4a@v">)A~8nk"aV(t|Ѥp:@q I%rg)Sc 8f+5d]<WGrzs yk@'9{rLpD$&3sM s*t (ǜy3OtEo*_Qd:uyHLzAu蛭*ueBcɨf%-ءo*B%ea̧6Qx٢`mֺͶTڻwF l k}X[);{zi7_5ׅEMa2kﴽħO;iJ:ԮZR(ͺ@?XkOl.8x%4|G-ņz a5,GlEƅfB:H,:.}, R< Lř\r1PCXl$QBIɐQV" O25A"vIKRb0?-`CM:uP^.qGEt&i8e.yr狖i_;YfśX6V8?(8,o/isCw췈!S 'H]dӣ/^@vG(h.EZܯ*w0vor嬾YMQ9)^O{i6ygMY 6cF Q2s !\eQ gK6]e08Ő_㻔2uHNg "ߡ9ea\MP7i+5M!5ݬwѿn0Qɷ @N;*K/"m֬ju~˥MYca7/qȺ~(N(Hl`j?$@_ƕ&` @g˨nsc,duES(zi:C.ixD),r1dk EJϒw'+bE+UR4;U2uZʾ?a[Eh(.{T;-J9Tf2\X{J .! Ǿ |V;G"Z!21,GsЎgz9ͩ6s|F&Zh*Z3̸ &G\ iB3΁@_Wșd<wF:醘(uP<vlsA+cq)B%6)TV]t"3 Xa?z)6ĩ/|sT٘YR,vp{νη3 1>vK lZ µŨi\f(+k!_3mE鑄|u&0iMlމ+Kj?ʺzj43f_J@q_رEK^^'t J)~upQ!rwHY~F:>PIy?tΖdT]ǥ0(s8$vh&1t 7wKA.h@67KN[Pa&@%%HJ+홯 ~,sg#'om<W ՎzN"HHS<܏\)p&W'̯Ҙ-+z S&Bma.fWI*6"8ݜږF xc s)4ι6&ǙM0L=o1fNÑԟ\H1V>ji=R^"׮rZp}&,`q#Ύъf|f.R0kX}yv[dΤjGAE;"VN\u߸7(+pQe9$nӲg}cVԇ2`ࡣ@ոlK* $.D"#VkʠarYY/3iro}v,qkP-eM=N%n ͛iU[sm1k.؂!%óYm"xw|8W!%1cQVz * ueS.֨v\cl7''`LH/tƁ8'Z牰MQ:3~T3DDI+L1q$K%MGp'_I R9kd2:e= 6OUvJ{p\?+:<8+.2[bP>h W ɶ3\]WJKgl4Nw%Gc+u~2+z{^Wj^s/s>@p.RVDkx~Xė.tKhoD]A<Z<ӟ|b`\:Ή\GJW9wÙn 7#@TS(>r{tx s_Wg/I]>ꮷo:5͆\㔡 x:|.Ol϶GT*BBSmG#\ \v?s#Q?9QtE^Kz4WNonćH@s޾B'A3P֤Pۍ? L|^}X@g 0KE$sߘELC ǔӲU:k?5bOap,4ujJ3i߂[2g_5x " {%2PHoM|xL6B>"%!DZrB cwš'<*|N ܹSK^iq6IT]rWiyRvsq7)AIX1J٢PӍJb%BƱ}\FHTFAYQnŝpN)ݐGT, /enLbѬG7ZGNJIXǽ]q~FhlIIo y>q5 hX[_CXp| yǖjH۬l!o{Л:13F4!g9qѽdyR*͢si"%ڇWhԋ@D-4fB%;1XdzJk#Ħ /S]l ^ |ZF^bDx81e&n_L|htT>>:2 .m(әL!]xC~* շ8Wɤ9⃬6%7$rz&[=ؔA7$f옽k0zqE]YZJ9P#!r^9 <_=A.)Is#]){4PyuϢ3,# l@;,0LąřB C &WFg~lrt{ 9yn;fNOP νg[o[A FY0 \&q$6e+ԵAkRT%!.5%DN_9XVT`66|2#uIh|B'C=H}Sg%'cz:f"rݨA\ė/nU;uJaX[UZ3猿8a6jz@MR0ƺTeKY:a '[]q7 r7Xm#P[YWk=CI?ɢ_9O33oh^6<8:?}7f`%#A݉뱱`^n.\|jIm9ly<X c'̑0ʱA\ nakA+T"7<"ӡk{5{.Vg]ZIKa()G³ƓymnߐהhQ"xHXAQڌ}h)!z$s B:MnO#.$/Ha4Gն`_bed[IzNG ='L>hyFߚL~=DnkrgCRҨ%l wS_hEPJ߼SVTo/OО7ŋ!vMЗ 5lGbqjAcnL&}5joftk4G,(]lm~Wf`?r ],a%Ǵojd,DvP'uwVP&dJ e "e2`8"ȼRK4=46 =Cz|:,3nɬ:V$2YRCN I ]e&V8L8_~K.!AՈ+&UCݯ>'/Q][{`f)@}ʂ͗Ez ]NE3lɆl-ce.NuB^ 805*6o }e(gC[Mo^SPHauӿűbbILm Z3w&,ΩӍGV`6<@M&lM"qeڪ-'gN(oUO0O~mQW 5^@IǑ 25ZV9 fUIh rnhNJ+`ȓAB{Cp+e~^J!ءc?R."18&iu5[|L#+2R5~R,6Ǭ؏6KdPC WiجI6Ik&9:p2(^dK@?!O]72yd'ɢ!w6R1p% G=x,B8Nd|?ȑ̀3-|&3&W˔ lPy4S{a䇶zh(+9x79 [ETm4 oڋT8ThxRar ENJOXUGzozX0?ghqtBx):.RN&L)ߣ@!sQEX[2s>{WJ>5ƍr7 i_/CrDjMexOC1} O`eM%E{+ktwj `oQ~z%3ȌI% =1W~y_d5ri֌ U8 1B^`{gdRg~PEPXd;{J7煰yn,) #3 uLptE&jvjHM)g)ة%7N(iB Gd+ W;W--d";bXAgGmTE5]9|fȓ^ʕi3mX^cŹCUXъR3))gnAvBuZ {qNBARD|ZQWG \jٓ>H"LOvr!K7Cr^1`au O"B dyd0)֕wO(BBo71pHJjd Ѵg[-L-eYZ5(j|`  .dF;XfgEˣmy`?h?@-7x<#d#6!O:ºCnU?9Åȯ; {KZre-لO+Ù1xh BTD2rπa{+?xSD!ClXy6\~L;)ZJ_-Eۈqqc{r8]$@sv~LvA,ǁ+%K˚_'E¾e'~{nx@+sBI]*^vK7j9,Ly ~]ve~a)Yow5o1Nzd *]&`ĞmW>ݝI[G&aS8@B0*qUܕ'&yy7ߴyT'*zҀ6 @eݰ;C_,$q{U[;l ]'+?Mo˻6 x{6O`D |`J.r"E`lb}POFC\]^+lBJȾ;A,CN K*[DΙ7§y@ @[x#jY(>{Fq3={jA{ͩ+L, F]rTt6NeYK"KV{p "KHͪIRQwj}7^ɩ$;S4Q/hn]n#Lj$|2t냉r?Iġo'ӻA:Ө!.Xo=[ւo`O-(F.טrΜ?Gϗ㖖FȚʺT>dpo-Hw͔%Aew#82y.h~qqkJ_i"#(sU4IH="FEAqCIB K~) ;apG/rDZez@1oQ4JJc=.H7 Xؔ kiƳT[[T='Yht~V:+YxNYm=B/M̑:)?s)j}2~')8Lmh7: }/>\xaRŵ|8[3LUKHE`B'I"x;5"d 崟`W|+©z+ O;CRm_c[aͶ᳟c f);Y1j ?sLZ"x_qͦge~f4L43uݖ mcacr NQIsDE;/3Hfhu/niXgo5x>"-~=7``?UlQ} rSq9 D|/&|pJ^P}{k#K7u kp<х,T僈өi 6]%cNs:y;#|k6fL8ټs+kiɆAz_sEU>((n@ iGڙeyvx윷ۜ܊SrBwqB,h޾ZPF}5̌'DQʡz#?#շ"֝4!*0aܖf@]RaI >}\Pͅ>>VDӆEƫ?.g;nGJBkz;-9Ҁ0 T,K-%>(a\g\#eimԟY0[ǔ&oobH bVCU Ap]o8~bXl{1GAGDYmcv 0"H%G X$:2ԯ!o1C<4%U y5a&*IƳC\4.E\)H$ ÍA? y׺^I jAP + Ym%d8[P'Wk&v}gu4oa!; :ˀ;wF'M#qF9 wPwiJ>g矍Jf' j8DO\Ts#$h1c[$ϝl´jBEDF3%;9xA fJ}:j$Շ䋸nK[5S_;)V?I9f<]*K<7rJ+&FدQsԔ}Durmʪʩ$u*} SN[KU-c<$oeT]+ x0uG2!QrvPUn?ЗY2^Pk7 ,E'g8Ԫ| Y-簼>@rndSK1#J7>V& mg(fXS2juq<oe5V Ո[Pvqd'8~sQ !^fPbdWLL6.Fia! 9jA?#k[ n[Heq5IVOYnqnl#%ɨuL9>qBG*^W6ŖBʋqKO5E,h*Xg#S椼l_R[DM"Rmu@OeAhKM37+I=%5T3dxoNh*ӵbQ GߪҧDfmiÁ.%F%.60l?+h<71">߀1 |ھT$  ?V(MST2j[m6<}H";T=jBo98H[暴h?K<6(UBcuzPD:PV5a kOvz`0(< +3ACdeε\L(|PƿG) |LB`B\#Z \W+tXӚ>pX_f:\ә 5VKV[: V0F $mKb\d FMb6rIĺȆ%|OSATe/{_˱b.QQW W=OTdx'YjrƝ16ޥ2AOYn?K=.oɂ`6tAY-9? 06h; hpWp50!(^lWoTiU/=SDBg4z4Zw v7`HҫHFRg:h11Floa4^1zkfU8k{ޣEI ^o3g[닟fdrN0rTVu.TW=m`~ 5Ӷv1 ,qq-0e6so[.ox;ϔ+lƤ z] ¶룫V0mbN]M/S3Bm-ԧE&Yg*$mzu9un:=Sf0[xS.i~s0S18#< q͞2< ǗMZAqCc].U¡x9Iڽ=$J@\exl{ ඾v/.0$S-ah ̩B#L)5Vx<%Bp&r~c\x,l *S}b4?q948Eۋ6j=Tjsplb| f 7jgsBС,Z.;.kg> t*)|Z½Nc"i6yL#=܍o%:[2 ?L9Aܡ؁(WK[ɨtY0.dBGj$UwKNB%)Cdop&v']wAj o %Oed/2Ќ͵,=?kNN;mռF $J淔{KӼ =W-k"Y 'Yh?>f?c*`Ԃ`w)iSU$CW$~Gee`L 3>KG iZ5R s^XGccdm,{|#<@DFˎ-y'#j6d̹rYG^?׿ڝLŷ+>g~vEP;TFhI}BùAVzhN+najZH`SGjstCi(YrHipğ95*v@^~71Sт"FxJ'5:Jǟj(# HǤzUn^! OC[R|#^|0Z \7IayxV|_n?koMUq`YC"5@|X[7p*$`־9c놟~:M<-vtO3< ֕񃴤 TbR4.!g00jb`:5;YݴqGcNW3~I >6M KJ홉Ԕ{:;i E^| mU:6pcqE$В75N~K[jV| */p/~c<O(5?s;.ctFWPw?t@6a8Z "k^cpaNī T]AJ;Ja5~V.z*Lf;QǓ3}[G0qhjM`iZH%w9TZ+eES|ZA.=ӗ=RvEG1U9R<5 "BY1a8D-?IDbutX:$'<ə'-ox$Uc*D-pU:o \MTeT3!w;*/u>:~͇Nr50AƊʩfB} _ꂎvauRFHqq%y}W> S/F|-tʽ=cH;.'f5p;Y眯7*uJԎXhN E6|MZž,{[l4wud~wR5wA$v#\gV$.`[ w-1 _QZ \&iXBFtvsJc*q 5gJç9zC/U/HnT;SMʣ[4 4VʔZ6i ][K#vSl_H)Xf4/);`>~Y|xȾc/%(!e6ʻhK;bVivD_G0۲Tv"ЩgF/x~?ұv'Au4;KGSŤ)ޫIiW~9ef$?~ZZq1Z{яoGf%"?VG4Ќceq2wʿqY4=17ъg'ʻ>uoK7"Uj.os-l>4>5sUQ,g){J>ÀսۊNJyJR~dA%.SJ[Ut昑0p7ѫ^C~gbn|6>ظ5޹qw&~?wa1M]iIJlyofg}o:<Mr)e; T|K"-& :I+wd$[>H O_N~|iTd9pk&Zn(4 Z-n W w~`g]#p-ii k85u ui>1J49K†,y:*Fӿt Yyu|#gx*-}7Jѻ.k&C_?D$*FX:+~oᡒ3,y Mlnі3pl6z,vUs"G=ژ54u*T+w[YbT:^KGӮuB_VfԐ.d|71\rxKl_+0]}+$m;,3{n*:Qr{YK놄O+Я"7Y Ƃ$I@-(en[繴<]JXq nMs _iƦgk;`kruI!%X4g2sYT -AtjӁ;S1B[B|!C %>j#-Qu% /qHd(Wu[y&>Ay!85]p!F% gPp[QwʳHyȦ"N% r:~z2Čh9|z)UR}dKPv'FNuQuԛvc ڿ{s9Q1ߪ'K)<=JCNp&SB$SRMc]kPz$ ?%5"-<2|F$ڶW&6&S[pi:.0a݀`i`MgP ]"@v˫)]r; Z4֒ÑÀFvdL$/U=OG'Pqս)؈ʭu]B9"n X U0)4Q>(lO8 ]D~ș7VV 91͠_ýy7pt`(i [ Y 㷐} <:Ly,q8Ңjމ͵ 'S/k2< [y9urIXɼ;o~ a<" c\ @vud#=2Z4?bE)&ŃQ ϯH&q`6D]X3gJܻ%!ŎCuv;Ƶ:ߓ:a`.7*+wC@>Z 7EÕևρ; z)N4ʦg*ciFറ:l*ګ&0[,lM{EST9c9LC\CnFιLFԙ*]n4tp`- loڿ\bh]|~'Xg@݈QZV9z ٠NپFTY/1Ѣ6^ `݊+c,d5r_+{vE['gi+C;hmZj1aw{Ez1X6RQ(@k&iW'tϯʄ0yhW"‘`ze Io:7}!Zywf/lR/{He[6߲ ą~[vm;¢*1{I(Lifk&"ԏxjM|dz$T_ fs!aj:$YݶS*ۦP%Zblbgk3 T?O[Wk6$0Dpyj4"sǕ"ox-Ձ%T  jw\5ƣw(Yir)$)ɀgl"@o!_*hn4P+EƍqE:\8[.E Yp`p6|Kl}4opJ` |nyk˫$ ,bܾ4[q_Ao6|a)7`T^%e0b"JjeU[J?,fN[WOiLY_&{a괥|- J|R*I d<Ⱥvh dEpΌj-6\<'v1z^ۃH}I7IAgaxӨF sf?4$D "@~7cO_3S,Q@Ԓk~;$$T 7w`x5;O#S*{׃%$Xk}؞E7?3~laĎyv[ռ)&(}łu?j` pQ23=g EfE+`b􈹉%l7eKMϾf=E'(71:VD1X~8iYB8+kgXZ2S4IuWݾLK(301q_) dX## &hh/5 3>Rz |dݲل~8߾"T^%&#cou|>4:7]<ᅐEhvvpUWtL-NtKLx!oj[篟֜P'ۢwiC"-(ɧckd]a]$>bwxƲ_ʕ Aַ,H1qKOK[ۼaL )ꊌ<+t/ !i1ѝTSIm(HAB7B[6Z~t7n4x< b}[%j~8 U{ԄƮ4nTnxh  b@uG,6rRNP_!Bb(ÿ){hyNc#͍D%-ZЖkbU%8ʨ: +J*v\y^t|׸/(pldFƏd4x=vR~Wн) Xad(7Hug/k9DNS_;e֚_+)t1)\KS&9΃9[-{ZY1G[*SMZB" )v _jjH!"1m"ՍXOV3h |a*4EI%/ mrG[I\O'V)K~=͐ю׉(=xE7~qmЦC{ѦAr [/T\n~DWaiwB( 3cRtorl|\Ȫ ުAJ+ZB"kyov`c9W ׭1 c=;F`7inc^~5ho :i6dC@D&~[/4%d"3eG1f @A@Jፒ@{Y浖N.92e88Giv.0ֈi4.bǭjM+I^\  ]umK4TCdXCRA<У5xƺ z3ꗆ3G\JaBt .vs %D06dM1yAbgh dqʰҦK Z& #u=dwRrA#D2a/Yd{[ I+W +P%9~懪֔F*sFRbuÊ1ǂA 4j6Rcy%};P4.Ċ\ZX: %ۆ}mcC)%8! ?$X]ؘf\@/e@MsnY4=.h !nɱe8mo }25I9dbsb`E{6nRۜ)b#$*CvFܟG^ ~7G&TKm^gogMX|-2b́2ѤD1aQ<3cdՅnjvlct63ChlwЬ4LGN'Ab+Tqwȥ4{['7UȋdQOz9~gtȷʠczΩ4u }$]4U/9XmIHS|9em䙛k}< c"|!cg ?} KYf`.>9dCa7Nۣ1)thК|Έx,a mq3_ƾ!e4Q ee<&]_~6wq6|Vn|[XQ (#+.XS޽SHw?6ϖ*LAA8D1ě  Ӿb=iZv=4m.z4o~2 kBAKO-f]/Ë n݆Ae \wqFiEU>~#dՌtsg!ڀ=P+T(Pb1r@Ao ʬ8N' Ⱥ7 uz?&9mYg3li,kjt'(p.1D>gjW?$2Q9=1Ug3,ĵpl$|!g0~34XPΙv*rkP3xy+ ăk,J%Ɖzud Y){F%g}qM\Ej9 xLGR݁9`DsldWmtu19@c'~?;M~bϵIjdEߩl- #'XN33 #+* ódCM=ktp\ !c_MEZh<20"?F3[d)O `g ~R{ ٺ<Ɏ9#׮M*Fj'e4 eIEĠp__\Co%x_JU ~+Vp",w LFu0]!~zh`(KS<iՐr| `;RT`aDea&uX\1 Fhp߀`8G`煷Ɯ(xd)p ŷ{+!6RL9N.9B Źr %` '^"[l&~͇@Nje6nV'VOhaH_P98qSr8R{xHpSOpϡh$Ԭ$ӛ+c{CTǕ-f6*nIoIxay,$,NےXSn*Y y:&jOLʝoyΦ_=:Q;lx; oL*7f}4X7?#eO_S/[ r[1W$)4w9 +lըg qOp?ze㝕G{>;+ -SkHoL'7?QQQ(&gU.ofp-ypo]xKugׯAZf[wn6h Q %%/ҔpFHX_:4D$S.׾SݧO<ƷhHj`ozwǘ6 HQlJ|GH0U C4(eV^_ CpD&}0$['Pv-.ٿ(l7!޷2z}:uXX sOqCF]z4ȷg,&Kmę {`BP0V=eJ, }DžܴhdGXyX_+lsLW)M*Gv" Q"`0-:RSi*5Tf,c5f Ut0wo#GC dVHݲv<ْ» c' ipPeDe&dh}.4dvXAuV^i/j?h tX@B*̠j:2l[hJbӝ^"Q}7:U>9pLş~nSڪIu1G^|de|ꌤ(lܯ_lH+?٭RaREAa@i[L)?d&LdAֺF$:VCO=񊬧Pvn`f Xc\jR3RJuHN ye6%^ϙƀ_Ki 'dUZկhWVNFWX-2\/&s]nf֒&(ssئZ C=\vءV(USހx˙^/l塈w`›> %A+bF- ,QW]Z2wz[! s'"|oyF+*CY1Gz=.(C9X"X'<3Ƽ .+v"KelaSO4A3/H΁hX3GGûRWWOzT\hL zPJ~ѲI~ꖣcS O e"l@ʷhR̜ڊ]&apGOVX]wy3nr)6ݘ|ڄQ JpEoQfTcOwq:Eq;n@FOz5VțĊֵbR䜗Dp,tC|.L+`yق&M*Y%/";R +DSI+JRreQ+BG1Ŋ1,e׎TȑOL2F"(]C?fd:ezȑE¸ aԾ{ Nu+LDض;*Hsj/\&wBl٘-H2Vj)az9'y#:{|s  ,G;Y*Ɉ%3PX/tRc88X 6x$ V?x5a PEs_̄$%ڵuU8ZDn-HQ_g#Gp X`1{ y m5h2bMJ2lgL~œi^OװYN_CC>cHf3o ghqh VMՇAKɋs=>Ex)K^mO lp1to IwUNmXApӪږE6r*(/Ӊ㴖ؾRtDf(ɱ_:3=1S^f<(Y_v$l,~\ a&pȲsR}E'L:/p=>s\#8D,BG՜v9#&$ǔ0~*+Qk`4M_d4fGy؍4vd"}THT߫[U4d7v遒= !r~%Df~pfV"4'bcsbU$i.Ȕ}&#I5Jcg__z h6AT!gBC*¦E8ip+Kvesu( (Hf J "r%&ZfC^Yc o,GWl>шbqus{U,>EzA"2a%C֐vQxH+rj!Xr?~p Fj6R{/\6 .T6cQ\AwH]4n40Ɏet; Q>ipGoLWhc:lN =(ejf1Vbtݓ6p~w+W\gb3P2IT)8/GI$vb8x؝QK⊸phsRdaWlo!J9Yz[07?zuzL'wGJ X$y6ZwAGHƙqճ*]ʛʍ=*nn\8s'T,.x;ɐj;k>%E$P}!TVzi2F驽<uRhg85@8FJ6Q Nٴm,c%)xnjץ+gT RIԔ3[jDŽ/~P&VCR ]Ov% z؈I۽pJ:(7% *U; <- sY᳨Y1"By,ߓecS#z>3ؔɋ!%MTZ&QdRnl=A3LjT)eREon>@*RѫA2{_خ9Ri{\gFH%DZn{Z:&YQ`WUAD?͆U =LPqp#)/S|c+,(]Lj7]&rޒK1=);gv4c*cR-"#emCzUʖ#W h74U@Pu44f;ж?W=c<5I]k ?|[Im0N736>uu5s"{4_K^\p1y\'jca $FFRx(uâ8,*&E =ۼȒgivJOݘ4pW9; ⮎VKBbLf!TR@yZw~W3AyP>xjX`Ӫ R)wrOe)4c oVu4]*^oBE>1Rt7D6UMTf˶|mפz?,vz &fC),OýA|;x]gǯdMrmJʇ1T7ھ`V߮(oXp#yY-1(jQa@ԛ O(?dc&ShJe. a |TWK״y uu|yȬ 'E6ɞ 6E}ZzZMGapPL>OJAݡciU3+_&rB4y³0T%J[%ː"T˩ C:l =z%!WԄpf(^T Q ('^LH  bVV4%AyzTˁ_ '1𱚼]ܫ@Xh;Wh@&;v0ԦQ,&x ؚ4hb6XUMb 4t'xsul#M@`j .(fEEi44q3.!<_tIxǛyy y?V51U\DŽlZvʳ<3d?SF.nH#6?ë\@ZcƱĕ+gU^;Rh+!Ba}0.~xpgI $k!R{ i$|!tf*jc6Nͤ 6H2nءtPY^>Gab,[̊Ne͛w%Nr(xұy. D`L/w12U6Cthq.W@{|fYE{V1Dj< :hDIZ`r&jכVi4tkr^ώꢚe潯o5O)㡆ԻrQ )KR1S86\I/nIpљno':u05 hL=[< Zx'{8s >4*>6 1_h? <1xkJ"eqΐ{lN,[xmP`đF-D鯷:bޔ of Y<,_@R6AaGA +3ro~ )ySԨޖGdlrv@UhJ|oF}5; P玗K8 ߯Igenֆ@!|r<i*lU7 Ϋ'uk\6qr6;G u6Mx,]+HUMRZv pq 8_l,zEb t5lkyɳ:ο r4O%(ruT_41icfu 5!'⍯cKunk)ߦ(V \9NڼKú2qHl[}!N8o *%#X|)QޔбIi\q^t*"k_<.e 0`]m/.+ nk&F%xGPq=~2yX0זuŃ9^`=qŰ er.W1P?{ h4_Di:c.%>Ei1ۣ I ^//-сYXXQSOgŕ|=&Im4Xk)`Q6BhG%(;&cw!9kK/-<ϼ1kKN E]sz:oҬJ@SŞKL0>žu6ؖV5DvoykRkLX珫zS&pugJL?r j/'lAXƜ98a h9&/snvet G!k ky׍L)D1Ϊ \1EN^`$h؃1cC9ozϦANH6:?SK]NQ|IjNdR.& R/ esת!\nTࠥR"Ftb@|Yjl|&U71Y}e|O@82qMI"{ɕ%V0z-3צ ߴlKqp:vnUMK; aaDK[<CO=giPe9E<\υ~UE\ m(1.y8  pn=.[hl!"y >LZK7sϮ]h~&a兔7I$:5/I[G=t7Gf7ЎcQA5ZG7CbA}iY$=ٗ |3Q  ;5'VjZE➛o3Du@{1H(vpM%;Uw~Wա!Z߉DIPBQ?X _[@ Of$MD[RYGbSV@ 膸!EJ/+"VEoӼ( 7߹}r־Hf5Ki}ֈJ 21`rꜵ =f*d5nQ8ܟw0nis ֲ ,xkZ/7]'|~ \k<5$p0>nhY NxQHٹ!L_\5[^vJWW6A_B@ױ uJZK9/HSiLEW nFp^N3I܊b>&͸KvvU)@%jQ3 ?I7h.kcB*1V3` y}⠻ 'h#]BИizA@}oq:ꡇXQ>6t WaLP64L`=D^ ;Lq\Lk{/șĝ t1Byk'U _Pi█枢/S7A[YNhhZ>}JVVea1[#]QV=4-~& ,gkZ[懲1-%_JP2[jlLtv \cl. R{WgFQ cl$d{m׶ODLr)ϴiwBʇ}Uxhs.(g#*1!m˳fEf~&P$_ q $K2ئ7%v;ZOq" fW~@ h0 87,c ˆ֨Ե[xpeCK4 %$aOd7;Z#X%.o(7y)e|4x^"as vM4(!$qY9RRH>R_j ;gtO I͚cw#y). KWTk\_h|I:E-Fl]0Q0Y,P2GvBq[4)64Йcb-q 5>*ƂOSQUQ;~8|6)Z_| "4&$ {E&#T ӱcjY;җZx/. .`IX] 1bW, X fnv׎Z&8~̋ "Rڐo߀>C0Hn8j +U/!()_7,e8+,K}zS+Jo s:3V2XŽ|VC5󙖔TFXQynQd6"OJwa眽*vt9g4S68=sKzh15%B\5z~d)Ar)Ě4WC#T|W؈Jʛ /ˀWӞZ@m=I6R'Uδb]ފOp=ٺO#RLwwKh##ǐ3tGE%;5'gj/cJT˖. 8(>^xʈ`Jo1p^>,48l7Y,j3!E3ecaz%6({ =|ٓSѭv6R! ΈH4Є KA,$bo!8iXد [ Jۧ0>ULXtw}pAgǍM1PpV TzewY:8{ ؿlD1Xn [$g o6*(l]`8K?Tma]!F}Q94hr87de' GG]]!Ac>ѹ!:8s)ib:ג.&j /n. aMXs-ʶS~6U8;m3U/}'gHYN'KOlJk?<o='3JX[$Du/+Ρz5?4*vte͵$9GSj#-e@[2YcKF jm zM g7 @u˽X]sr ,7и!Ca@6"T7kfWi7B$k, %м[ZNVj ě YVAȟW(sƪmf. 2dVx`/*ROv`84&Qe>}p|) J瘰䜖!D„DV¨OApw [=Ƕ%\x,M _(tnJvA O4`C!LpvY ܺC٠tCmG}&vg2|,%ԨT)S\=7(}=U_\ 8ZC-; jbA>?\63`pJFcԟe7 fBuNZiЧ{op?Օ>^r[;ό4gLm#ip?VnGM.9l`F b-A#nG _cj29Puw-``џŦip!| DLyD1b-0eZ%s~ց-2kh,O݇Aޓ159syGrڴPR63Xڅz}[-BjڗΜWZrdh1=3Ҹj$_/ewCmAH8服k{lѫ Y/q3mC̐d7+CqWr-}\Toys=8!ySJ{Vu5*/ꘌc}_zjW "82ԩrw/gkVtp\{jrݬ|k_(TzB!ՊS:A"WZNf&O˰ N4Mdwequ<T ! pv:o7t`OfCx;FH=Il@ќ74.;&3Jlo-;bf^ Jdwd@9dí;= ;Ծ| Fw[ߴ Yן][=ԍ2Vėik S!`Xk<4S@UqRD)HDdNtl?T&WV2)5V{= *ʫ)drfL`=TY`na )i∍P ~~rC/O/wBz Q9@we(+eq;I)?|kKld%S)f1햎l)ܺ;MNxj|25M!5Ō|`EA^$P<ڷu1=jǬ)%k~h3螺hgXo |Qe|y}_xт:zEVۋ2tR4J_A r$NB_zMlV A9B^J~_?U7 @dcIL9\1%"3*O| EF"[@#0mHS3Xz 5&"|lVD}cЌSmѦ=,W7%$:phF?hO' U{X%$ -DPq区t}J+ʮ[T 8*5=.0.7)C&ثx:~ Sr݂&bHB[F㖔~J-[ٽwMWRGٕ:6,6\CuݷZBv-X'>s5+qJr?%m("%J8y!f6eG8S~+'`m v9-sJ!pXS#-6;Ha}N԰-hj8܂Vdgogj|GxSJԎd!)juRV< 5QW8%F*ZJqtWc3`:D@lF!LGWhvޡx_[AQ[̠kIq{Qjp0ISAzj|7!?)/*Yo к_ȆJ?gljB=2PEho{/X 4g.39Zl~`cCyVرV-ӐpO-+47}K:kbAs!uނpV6fzTj WWyʅ'(x&z©\7@>eTh }m]VO?,DxK{]|p q`޸?a%㐀 WWIW!DŀKp*36&ϥޙ>Rvy`c63RF .me^NBX2q'BF6z*FL:MvC@bs9- dm9?s$E/K%V^U7E쇾2ܻ9J0hv~o\K0}pֶ\g} TKhrgH`evmX6xx:7Eͱi(=IxWđ,GWPIm2X$cK|akyϯqA˞z~ N"cz=8l8iK,4cMa5iBa2Sd5`c.i= td\*TP@ 6!?gx%Nvum5fi u/PPW) dR s# &QWɨ-Snhrn&eJ|LܔA-p3}Asi[mȗ!Dq B+ mrקEu -09i2 B@4DGU5coa"fH_CҪm8I[\Q\߭mS=18gq!_,ѳ{Z"=m:^vs(N&V2jJ}GMc͒}>rE5(=p۽7!*+۩w1.r\ܝ%x>:L6^c((`ӊ]Vy8O_.AsR$JԟFNLgmu>I4٢G=߸N#c%)m7gC!x.S³NؙOa '3"dYWW F-+X2"0U)G,e{ b6rVD-@ ~=`JeT`Et:kwõ0YE9kYBҊǽWQ:TM˺aDbH<~K0P:P RQ^}<>@^v1:U/H+YVMA}EI1EONpg['/S秧^:>GgX"kӼU9P&0klK* ghy{ir%j}bܥuQPg|}-D@ e2%<"[op3?\١GчqO۪~m#'x]fxʿS j8c9fcD `?\!9FiE-赏~y"6?T>+-˼?tSEJ圲qL|!5%kJRomkL6D̽ʼbF>B$c+?kӔDx\x;q dМG]7CqLBjl(7_%Cٱ>v^dsnt]Y=[58zFD2z:+Z2;OeKB9e,u+5KB^|&\̓_VAZfl8-ƃu,ۭ]%j}F*熬KB)928LRwi7qL8HcqD[S]$;XvfdSkr U!1!B`kA|c|񊓹&$;q ]P;2-fth~ (~^䑊q9z.,aIeаUy;^ 1Q&,X((-_?%' ->2hלzq"$l)p fw's6ijvs9apF;=VsƖȟi ={^,^OXwu|PL$$r:{Wz eb2T*{FetE1'rVQ, *B_՗!rX|o&.p5]֮Lp6VLN:VQM8n:a)Ok=;ϡ#-']~gň*S ShJ VNX~htň5[& j<uezh?Zmh>F-R@/Is׆JevR!AjF׽u`oK]~8._'"WvēgNE&ɶ.NKYo_'O԰6B?sl8YXǞe@?:nՓ i7{up%BwgQ ڃ4Ab"}@ XY/2߿hr6=rTh"?HaM6'~`^gL=2?ZP%%_f q8Glۊ7\B_+MC`"`.z#eqvrK (햲 =w8F*JLp ==q4o '!O{=C/R E~;/}Ce= zF8kP-J||\nl潮SwM 0=_W U5R8`J \?CDNG(8t+$} §({}A$- E` rIthn #YSP=|+տA9 KHj1w$EkV"c&5J{| HƳdW7cKgψu<Gf|F U?x ǭWAJ!Wsjп[ ]a@*Ёj]m ]T6X=2Rp}?tqgi~SgyKiU@켨φBf(ssgF_1x\?P0N#t})e3AJۥl?1ws=n }K== >X D]ޔGY0rMX w*4Ɖ~Yc2Š kxgrO#<2} ;<4@$%Fϴ[fݵh3vMQ53ĢܣJ]zw3lQx;όnKc-9 +/YX֋9 m2DeƵ8< E.WwXz(G"RA'WpoiR(`HܷVэNw*D'8<9d|$s Q8}`Pb>ߡD43a,}fܴmf-3hA9|iF 9jUgXVh^\+I oRҽp" 4Mծ1(lP x` 3;܈RO!/'W<|&GQFQ>v .f3%ygaHχj[ء3N5I`6gs3vԏurL,Vg\cgb+0酼1>.1LX틦;Kv$viwM0չ5PB@L/<Ysٿ//$M@Z6 ;uEM O/tH:ćr*>gzD|+Sk;4aNoX A^Y30zM_^fUDWf+S] 7lsS$I>!8NT9VV%D-GZePqV'W:`,[2XXY5PLu͵I$sk^g^(sD)CS]se{OZ?AiCKb-RWҲR0XYu0\R:AUT `Os^ "< \Ti^[$Q8Lĭj2N:{B޽/ o@5bm;љj}FF-RV<˒^ 0)Uf iKfGGƆ2ا1ش1S''7ZY6Cqfتً:DS`OUNŤ&hN^Ja;S&#=NQOueXez79L2:%XQ24E(B13G{TU p ˟Pɩ '(Y#(NɎy?HdӪe*P/0?kIնeBJFm<L&5 9$Ymf88>B_iU߼_EJ٣R$=I ^Tv`SS̽4|ml}Z1Sg,ilWv.danݔٱ:YSP\D%!_J7G3?n.7|)ƬP#x vRVAuG^n τyYy{(LE jm=pI6Ou)Uc& ~^=Ig;RpxҨB/z䖥C7'$#T3pmm` 6vd*ͣ(},L0nM3 ObKF.dYŠ7/~OAĥMw=dOcߧ<@E4 eV`ݨ+:oD%Hk@2mW;:2P8'}󰥯r3NM$@T?;I ` f^2A2* o(iz̔Gϥ;.K Y]}bHB'ᧈ=ٓ7#df-(*GV ցI|1`iH3J|E9ϚG7ۢqtՈ"2=^ [Rfc>$.HeAT;1^K&H,,)z@1 Ux95kx|jĖg㓗/8)8.`mʳEMD(ex;=NGe&v57s*^vlEѾ%ЀK: &UJB#<)Bp0pQ .=ewO!#{lKng]=]`)? s[nV}a._x[R-U|*`Jog% $_=e "+I %)j_d(3[_FaeoJ2c/Vt;)\{Ѥd"K(>Sh@זϦ9#hMqSl׶c"3q!dVc@ MU6oo^0bG RtE3v~7dx֛䄗0|XRD s2_N}ͥBl፵DN}*(b $Vg!}Yf,\r35E/#Nt?sČ8?a&~?CY"Y@Θ| 10gƎo;t4L71^cbsxQ!)gwK;0{P=q}h$X`.O y|ۅwRoJke*f-FwMp~qȂOD$]p4~0L$3~Eu&K2$oq S<^܀5L~%5P"1+URe {/_ P TږZ䄝h xΟӹ4;#IpC^1֓Ҳ?xЅi!H1>5 Ըr[qo}ƨetܕߤfwap~ԹG_ tfvnซƹ3Y#vF a[JzhIYu|zSL\*eyWyDhJ2%5#O >Lya %ʉ#qn{ԑ%sϱԯ+_DnO؇#ok٫-$l2?O~AY;xZ(T{O59'Ej^-9RߗuIWl~Hf^KC)k76He]:~C`4pBUS[!ӽ #CGp-2UheCi墐hJ?="C0=|5eIۦkT5dQq́K[v G-@e!'?Y*ڛ_|){1򭳸6WNT_}>-IK;ut]{HߗoWo/zX!TXDރSԹ> g'cYMwxOwd օ^17=jeܳRg=|Ɔ-N MkVϞD9,qq*~ySxT=Q NhGU3 (+Sw)$7L2ru74ʜO2{/\%a8M%x d%?:G$9JJS2=gjktzt+vjQR^Dx5vzL1(VZ16oq@!F;NqzJmg+eHOt)1f|ZIA[? VNa^zMH_ PnOkOn+H yD>z,[n"*s=k`!Z7t!ϵH9;p2\PӃr ]р7oEeK]EOpGB7d$ HshMЇCR\^M,&3ݮYTJB[N-F\IG Šf2@ޔW[KBޓAO.]l,v hgC%`)*]>x(Ü} >Pf&Lw<QK:wjzS7 m Dd劣}LvU5:`D@PrP5e%Z !<|^5A79X0XÒ"1qE4j"+_8I֕S<|`G ixg_+zEq%x븖GƟ 2#AUN hEM=1l\Z9X?yf(8pgB*0MvFȘu Gж^6e_*R Q2aHν K8NUynhgМh"Q1ɾۉUOT:HJ%u!}ՠꂧBí|pnn>6^; 3TSL=ɬ - ^ ZȲ 䲕_SdIL`.gE&Q' ɻK#erB_S۠1mg>x Ɲm)8sDC#i^j}#6&cw?BdmP[ŞwTiC迋}7:kltHnu8&9K}4x4q<j|38dU"u/r5宼#%@P)Ik a寚<2#aG$on"5]v,x&cLVodZWl SQQC-M:<7' ,JU^,%rȶp^t dpc7YrYy8%,4Vrr7m#@%JA*w)) <? :oElv_6ab>IJ&Z.ƱT2Iݛ.˪Xzlf*{*x/ sP ퟫXX{& !.[u:Տ9WL^7{<>Ra1?힋[Kᄲݰc;v~4E @J>& C{-&an ⹞!;h-oU"?SЌr^C[T)n TP߼amq)PȻ;47%Vn$2ɜAxL*|BqN)$(S`y}"M k͂hכ/*.eHZG!͜t3~Ds %P3L};`5/JNW|h3I%q 7b/,/VGUgz gڍj~ȍ"=|&/iMլN:vGICoaЊ̓q6,Z᷵ S%Eǒ̘9|- "R˴+4g:*N9L4V)o ~tS7؛P`m%p)q+0*D>3+q3&"wc(Lm P`7f5n&hpe5q{={J*Îчn*YgX|37O n!N7޲)%+tJ j"bs([iSF^gg#;Y#(sR^w@ ۜJUo^^ye+?ji`#nOorq&jƣHtRzTӜ 8/8~!vY>W2P/W#$3E[8y=C_3@,B (D#7ag7gUr[fBόvkCR/b@ɍ+A,caH@i/ ?|r\lTk/I뮁L7rna0,Fhgr&{uo2 )$hI`$0Yt\ߙ*֝j"5ˮnRNa0+R '4oWHBXH"!hC7%k>%Jwկп6l%> |UmkL>2q&|%?]`X#K`$3W. z$-MF]Quz8ni@~(k(p&'T6b3H}{z05ꌷU,f῜z+{6{Ea ІbhW(3.'wg4,4-Jg/79kyTo=FatfQ? 7)eJ}lAM; 3 M5-5 D4UzRlK/~ 0fzF+bF'B{Q4  $e7'y:]P#cqHÆFۀI 9F7xɖ&TdS p,s7nIK2TiWLFR>[asrnN?d~\w]WAHLm>Qb#Y˯srwa$l?_ቫҌpx<ǛpM?DPU,lyQKo!_٠+Y $}`ҁ$$-Z' CB+]^E悵jvX+t`ˬÀ'n^fFIawwa0!sLFɯ5"肟,(S@b=y9?cٞwNw\+DC;{Cy9FX7\:UhF7UNC*gn 7lP|y;f: Tuф%z2+g[՜/H&R^WPj&Zzާ_GsލB]-h] bG$2а}KX}6_׮HͿwh<d˙v˚3yu a+ *ߓǽb@,AIJϠaKSoMaĄ9\$-y81>NwvO]Aj5Y{FQT gV&t(([gՀ諀ۆΝ_+ ]͞x%;Tꅚd~tb?ob'd [ 1C;*-vK7;Α{lDxFU3 P5bNrqxAzib(Z"j^aC1u5t:ޑ_iA? Ab43|N֊_Y(OD*ƪ&Χ@:XVSb;5h͹==I[%AsfNp^I_/8B:zp@`/LLBj%̈́ڎYV2֬>6m@4FrKe~ÑbQ V0.3mA V[LVCTv'C K#ؚa]pLq5 b~jgsK?}& ( $W\.s[F> B/O8t gՒ9+| ?ރ>wӎ"|P֎ Y&paƋCRlBsaHPX5.ʚ?J{]\`Wypu8@v1al_1'q8j/G2'G*N|O+E&^ ~*U'ol z5\(ɕiMd=2/6|V hҿb1[ YLdd~i, %~AdL(SgZkJmeeò\Mí7#w ɲ 0cn!h L@:-h:64/T/k-q!TZ7}/jYJQZ"&^") pjE^`2U9NYwwf^FK2 Z_ծ )^ o(< '8u\d]1IoM<Ǫk`$X 0Vy$\ 2?lJ3+|0{3 giorX?C-.a_yΩl"'xVo sӎÍҗiv'kQ)F-뮌yopSMsZW_ϋ~7ƜxnD~bAǍl@B|8{YGUα(~ /3`fe DVSr؉+hU K_=V&*D-&pƅtqR/RNW;~iBOnD^ ^G# Ʉ{F!7PhDn%!o}2[{ uiheZ%^4]ґ'VI~2[,h,|$8%#H*l}:mВ=J.9мq%a (83#ŧ˴kՠh@/jهԗYZr! FI>(w&QK}]'۶)CHtB=CB*!M}|(5Tux"E5 M,Źq$q:v\c.Na_jT: kV32c"oY)==\4F"t_MP4?jW}kc?p2=naة3!nJ |OD b'("N8~9U "ofPWu Z}ȯ&69UT}eTHDg>8^Ze߲+}Vyy@'Q-G( J ˚Dw3/i(aTfDH6~T'L쨧7O>I~nb!s0}Q-S56ɛZ#%Ͻ B'ċ4Z4g&[2(Ѝ㔅E ]UT9ԝBh(%A-m6!?ÜE?g8a;X{ws=HVwp 8U"3]C~w7NPvz-{phaATu#32,%|IeqsWZLX&U7 axn<"<n{/_;DT! `. 2>(.t eCM):p}ըtZ cK2ü,|?HFYlK^Qn8ekv7x<%`>PBgC)k>vj0w_B>#Ҿ(%oLu)X(.ʜ[Pv>.=*َ+f+]-.vB\7O]NQ^Ғyz r>Ҡ&M-0+r^0eDBu 44v48Cܲ1Saax;OhH4걢Ny=o.ؽ42<bG\t8"!i[B0? }=&Uuw̥Ƕh_I3\3ȉmO`,'$Ϳs.2Y${GUN\Gv{1M?|gf` E+D.M%癨dɁ]/05A;[Cm]6 m-Jؿ1˝t[͟{B<AKQ/FwaI9۫"wћ}{IJ$n#ֵ̖dEw=!džP &N so0Q7a5^zDLd֢:/*$䢫0iLj1fL8/Rz 2DDwՙQdz{ SY($|en)XFoC^Sج!wBL\YF.p%v,k4c>aA `hnx<%eco VJ}ػK t{&x$8b$kHL"ոJlhPHrTV6 Za,0Uw/9 $T4Z84 yNMx =}z*aZnc g A=0OhnuZFrAF da,2 {*z?B"sf̣wa-P@Br 5P' x|H5ЊPGό/2 Vn%N`cE?5A]nZR]G>@BRhQZ3}3pɞzHt!0K&ٙrP$W̎Mz Yd`[ФsKiB]o zFusى,'s#V-~=,>m*F}T^NE& )bq?蔋fh_|fz0n \kXEJ}AXuno3vAnj=uffJ vEFp-l=M$Xq|y{ux>nZid#q *Heq| znhZlUHߧ7^0n{B(#z [vÙ̏" ҎmOJӥ~Yn2y QY$)+׃g6s^ic!L 6)9NQ]6^ΨDNBrĕ`RBlPsEˋTa'j𽆫M9")"<(?ʡV97-+ЉYX5}/h=Ի2 @ܩ'O| A㠩H*ۃ70:;H ֡ {Jx2 +;R^8:Yt45@uPvWޝX~SHqYVp+L]Wk`jkxbYԍ ʼn}h>{,OɮJFQ#k-Cu2h#2{{>ݔXY;QS\`j(7:"nMWQ=%1d746_@ta# cs9MԠ} m,Dү +^)V~ZCD~z)r1;WPԑC6۴DhjYp{TҽN#M4Kol y)% IR޲9yzœ*~rc+]P8/c_eĸϚqc ".*s!IVqNT`o4gr}Tuw[EqG(L2wjGPvrmn=?- W9KD)lgB)BRKȧ]qQ^&pu9s!% M HvcYDK](S.c\?q`(fmM*K t|G>XɋsM q쥊)\RrRLc%YRQ.-Vu''+]c7I Ҥ]u52 'ORla_Lުɀ-^E`!p1$WԿ`j+Jo{ေ nHZDl'tۆ=t“$x'(왍Ok)e@\oaow ˭]{ ,Bjv+Er6pkIŇEV@&$brmr#h;xTy7BL>hgXfHp M+Z-m$xͥn=B")[DaťEEV(7HR ]GmQL+8(vH %DB.bUPm]G-7-,MEͨ=a'JmtzC@ x3*BRs^T73aY2f &-}9WԙN~G*/h"#11 N lb;Z$0iޙ1WώMt@>9h=%>B6sZ[Bщa U+Bj!|?rulyW_ FcpES* W`P:_ c]F@  0'm?LN9HY7Vq@X:yTH5l|ݻNF33(Rr;`e!,`9Agl]R ^PD)A% 4<9`1bU 7N/t<iM]B~ޯ0%@W)E9 'T&F >gڂ@u-tO>)q94+̼5ߓ宾=`gv_ʂtk&Ib\a1JrY?39lucE~U7:<*mŌWp40 :Z{ JHWNDl0dgGV9cQ.@o:&G!kUn_}r,!x4k0,cvf'K[p˩*roxtTZZeӘʷxQN½~?{acIl:i_)`̠IKjqnrZ2jzB.ɮߐs0 HԱ" N=8qqx>')i6N=$a/6SM?GHyRʽ%PO0r=0!ߧ%uI&6Prc~{S(0yFzft4DD{:=KIq)D2 RsjmieK?:˥QsC3_-;[RyDBL ؠ|*(rmD@Β@)/"*JdoЈRF|QҾ# L!]`b(ю awzK٭^m^eك*z$ƻXcO-wčem0nfx4JZSqo+9'X"3gA% /X0 0{ytDzۯ"Uid"VWg%(\Z,A\,cZQI͗7gQg}1d- Z[%\_!ṉ/1Xto)AZJ4] z r'l0Nl !rh:5eW4C51#ڝPr{;*ڡNom~ZlCA,f4ӨFYYWI\2+ҹ6KQ2vRgkbq2E05n K@8puwjMC^UHQ HI[|ԵN ?{_ad BwdU*eH e4vPr{vjOg ,hAzw*yo e;(࿷(7>$%IVPt'j>8vn-+MHϖUX_t) p$gNV0?`5Xf HXgKXaʴ5BK|GR5 ܣM^TfaJz(sREWB\d\תIwn JnT3 yϝ0oCۢa[͔ts}/VzN emjρ)>XlG$=US{woXVq:dp-}vËx^]5B([Ns}k[~շo^$ZP=a#5 9^oa pO\6y(|e reT2ßDa %&quևʖϿ=B 8S$/sQ-~; pW @Q] SDEZQ=k V/7=(YrWGsĿFa@&x|ID Ůî3ĆX, vsjQDZƺS0`v! ;:cJHňe Nٵ԰ ŦZ  &("!\7Bbh (7obaB75l$-z}s%Rc\bj7B^'tE 4tX+^t_9G9ǩFY]a}N드eRϜu(o돖S! u?=ΈFa~K~`c𷻡~TVT@T.g#S'|&w t =cy "f\||y~54?g/A atۘ1 !GlEX/|L~Otzy_lՠ6+q1t4_uX'ީ pH;ӧ9ڣn%w$kט"1t& U^\{Tzlsھ{GG*04s(@>{/5Cu1v+څa?l@A]QϙNa(Ly dAGb3a)h<8ߔqÓyAGO]eHIQr蚐?m `_oYRȧ%Tn10IB?ճA*m:2lOOK& n4*f{L<Ҹ3:"gLVɀPW}ۚ2p0#lw11{JɬS" >:m+>z\Z>g#"Ep97e2Gor1\bRt,%%dg[˫ܲ]fzkM'u&j:}j{K\]:`2oxq}- }Vz溃=Qq&OjY~N-;ַfk3I?`/KbFtLaҎYS[뙌K.١ ]}NAwd&5Ln &=D'jóIGDdwD2'-Q$"$Dy/OxN?؇&wDvYE^|ȋMG9|1& MnA1wuچj)-Z-^NQ?1@Km< RMp~bAG6jN8$_ƺys/M-V%Bud 0sx&I;_{l;&)qszq_ 2Ob"ψj p `픮|pxچ처W "HZjfP`yú3-4HH"F suƴ[5'GFUvO x2),],#\p Ppmi.fb&qډ(eh/s F<2}\sml d<|yΡqcқ"LV+AzZR#K M+}J^Faf.*7@ ]5("|^=㉖##7I$9b>(<05 8(y)wm z"|eO'n.$meUvXZ,i/ A!ȱAhB{z˨y}`LVQ츼 Pux/(an+g(=MF^ C l} "L9 <?mlF=]{"?`p 'nngS]r4=tZZ[x gLVOM:|- qjML"+`JFPTAPkRixNDu*Rco6Ř<*m{nS$|q/޼5ݿLzGܰy0EOGn-1x_E0L}x~Ʀ뾈GO8ʤWd9%a|al"ap'`2jd؃);l[-'Yr?wtWSt?Bgp]/ O $_FXeLչȇ2@1 o,P.b>8LC0j>%/o \_ꢙL"ym_;뷬X5sZޜ0 M;Sk%[I[gROP8My_?ꪫ)xz3hQD֤Ewf/ Fu$"WV1GcJDWn v?4aU柤ѵ;~4{OBkhj؇w=֔5 [*Jy3+-i(Џ@)$2Jڷ$ 2p ; ތ~Em_ 2bqTI7Q^lCIk˝N蟥 w7_v#zSYb,7|\-@Y5HH.ڒЫf|J( ۤ6k\ ߘ':uդW,t0,?1x,UJ *3Ͱq&`2*4n.*.=au^VmcZzkNQʺ5UPin:9z0vm);M,j̣Fq0~6HZG5]sT1Vh9A~%g̯,RgDŘqX7}rNE clK@Ã)NXvP^> fPBu|U9fBiv3+H&oP6S0d'A&lQ0%W?( ҐWe1{"0i~G_l_jPj縌!A>tBN :}J6%x\-CS;6|`7$.ʬ >\ZBY8 a SobCN*onA?)MАFB燛ҥ-1@%⹴G)ÕhIf>G2 n.׀~*8wZV_~D辈MV2m5u&+{7M!)qnSӪF5Mi@ 9Sܲ9'2BbBAgѮ,qnAsGD|@rkiZ,`o%CI"򪂭:jq'g ʛqW#DLW'.)"Q hB< .4M@ >h$w~!)s &  ~>.2s50LOlr*~v  }g+)B4 ;Of}i㯝 NkiҭK˝8FQ#מOffRZD_wJ9}sgxܞugGnߣsRM9i}iV5~.ZS SWjR:Nmlq=r26.:YGAos<=Bņ 2. 2U5MMv).)JBKWF*Q@ K+R&U4Ӊi3%5ύ^)n}1m ɻR+t[ BS=)d ;*lߵ;Ľ._>KfBqxY (F|0.Ve%S61opMG ё`α'\Y]J ]PP6 ;$\Fr>&@ZU9ὢ>Ve~HtVn̽芭-.α'\YfRXvB_;[sS|11np#_(˅ѕ~*'uMدՐ%S61opMG ё`α'\YfRXvY[ڭR+t[ BS=)d ;*lߵ;Ľ._>KfBqxY (F|0.Ve%S61opMG ё`α'\YfRXvY[ڭR+t[ BS=)d ;*lߵ;Ľ._>KfB buKːWRg#┳?-k~KfB4km sS|1yW"*-xAb@B:".3.KI/D籆Q7YhJ+x'NݾB Pj0>RК&V=~uCa^%&w|kS|՟:z#ΔUQr(mTL%FخxB iWZ tpnL#~ ~Cjf>gTϺ?:z ~قk%l O1N5P9M¤?0c!|IWB8N\KS> 7ܙ\Yn__,c7ߒ`T0e6Q}=eBlƯ:5T]Xͦ'c=e\)U/^ g<o"i;of|!܂Al$cĨH0BZL~xd(P-֘7 1&PbS^o V@N#W!x$@MPZo NZY~\\E_lF)FO>n0+$˟Dp1/A$-],22v:gpz)w?Ѐ'$F>&c)p%7fN*#=LM#N2gL$yB: jieɆ#qB]k%MybQρ|a4|SqM{')HPJXPa+Pkm.N<`(OoSv#K.=uБww*?o} ou̶1 4{: YZ