selinux-policy-devel-3.13.1-229.el7_6.15> H HtxHF]?` ?*}}YR_籏Hs?Qdoq:,&îSagӶb12c0632ed63d4d283738b2d13edc755efb6d6cc$ N1d[=$7%F]?` ?*}}Ȳ,/OY8;h݂i| ?o1r>: W\? WLd + @pt LNN ! N +N @N N NHNNTN   ( 890:&7> oWG o`NH NI NX Y $\ 8N] pN^ ? b d e f l t Nu 4Nv +l w ,Nx BN WHCselinux-policy-devel3.13.1229.el7_6.15SELinux policy develSELinux policy development and man page package]?sl7.fnal.govo^qScientific LinuxScientific LinuxGPLv2+Scientific LinuxSystem Environment/Basehttp://oss.tresys.com/repos/refpolicy/linuxnoarchselinuxenabled && /usr/bin/sepolgen-ifgen 2>/dev/null exit 0p pR^q'"-%$#5-3z+*I[+b$"""/H(7?#3J2*G"&'KH>()O63>)j&0h&H// =/:*8"-%FX n'4$7-#3jMw0>w09!B4%48*K66m3-4('<W -* .&.z.^-2.&3&l!*%Q$$FA":4955K*)-:pP9o/UG6.@)>-(252215<$?R.@C.;E&7e+4 7Fl%4^1a.OH$.>6 7=b,t2615w5O4 ?;5RQ#/@~!8}$q06(4N6j4 "-&h7%=$6zLa,I,g#1/(076E+~47,8JC95F%3 Q%!-S;Q5'-&5%8,+7.ahA;HBjHS6,1o"40)/`5Q 9?i6./&95754,!1}'$4.38A-()+CG%0./-4>679,C:p/#0r" J> +w$2; E{*yF`*c/0v>7l)4QQ+01 0)-y8.' 0Y8e>g';6(:60+(yBG".')\.k=6@,6_a).I947Gn*I}/2')q!{2 &&.*.LN(C$#-3U)I*A19="69<7 28BF/<260'(#@_-.K:`6&SW.&,9! &3XP0@z;1E31d$)00313|01(12RV'&6^.'0'22D"2D)f2D)f2!(+J-=C739.*h0xI!& ./.'[EE>h0(-&'W/.U;0AG0J,$/b=8Ez2 M)B'(7$6<=677\6S6SS''g37K)&0hN3!Y1I_ /(()4& $p%/BQ58f'$#!r#BZ--I0;;0TBM)H#0& $%./KJ+6J2r.- 4.2-03-Ah55.1.5-7.]/7j$S5i6,549q,,X-J*,+=F0="274:..BCr>*A25G?//-18N%0i'2u(-*(})+!+y() +%$\%B=BW#-'8?9.$:04490#"M.^(Fy27.'q)II+ S =s + *U/V("3^w-:q6 CA큤A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤]?]?]?]?]?]?]?%]?%]?%]?%]?%]?%]?%]?%]?%]?&]?&]?&]?&]?&]?&]?&]?&]?&]?&]?&]?']?']?']?']?']?']?']?']?']?(]?(]?(]?(]?(]?(]?(]?(]?]?(]?(]?)]?)]?)]?)]?)]?)]?)]?)]?3]?3]?4]?4]?4]?4]?4]?4]?4]?4]?4]?5]?5]?5]?5]?5]?5]?)]?)]?*]?*]?*]?*]?*]?*]?*]?*]?*]?+]?+]?+]?+]?+]?+]?+]?+]?+]?,]?,]?,]?,]?,]?,]?,]?,]?,]?,]?-]?-]?-]?-]?-]?-]?-]?-]?-]?.]?.]?.]?.]?.]?.]?.]?.]?.]?/]?/]?/]?/]?/]?/]?/]?/]?/]?0]?0]?0]?0]?0]?0]?0]?0]?0]?1]?1]?1]?1]?1]?1]?2]?2]?2]?3]?3]?3]?3]?3]?3]?3]?]?6]?6]?6]?6]?6]?6]?6]?6]?6]?7]?7]?7]?7]?7]?7]?7]?7]?7]?8]?8]?8]?8]?8]?8]?9]?9]?9]?9]?9]?9]?9]?9]?9]?:]?:]?:]?5]?5]?5]?5]??]??]??]??]??]?@]?@]?@]?@]?@]?@]?@]?@]?@]?@]?A]?A]?A]?A]?:]?:]?;]?;]?;]?;]?<]?<]?<]?<]?=]?=]?=]?=]?=]?=]?>]?>]?>]?>]?>]?>]?>]?>]?>]?>]??]??]??]??]?]?D]?D]?D]?D]?D]?E]?E]?E]?E]?E]?E]?E]?E]?E]?F]?F]?F]?A]?A]?A]?]?A]?A]?B]?B]?B]?B]?B]?B]?B]?B]?C]?C]?C]?C]?C]?C]?C]?C]?C]?D]?D]?D]?H]?H]?H]?H]?F]?F]?F]?F]?F]?F]?F]?G]?G]?G]?G]?G]?G]?G]?G]?G]?H]?P]?P]?P]?P]?Q]?Q]?Q]?Q]?Q]?Q]?]?Q]?Q]?Q]?R]?R]?R]?R]?R]?R]?R]?R]?R]?S]?S]?H]?H]?H]?H]?I]?I]?I]?J]?J]?J]?J]?K]?K]?K]?K]?L]?L]?L]?L]?L]?M]?M]?M]?N]?N]?N]?N]?O]?O]?O]?O]?O]?P]?P]?P]?P]?P]?P]?U]?U]?U]?U]?U]?U]?V]?V]?V]?V]?V]?V]?V]?V]?V]?W]?W]?W]?W]?W]?W]?W]?W]?W]?X]?X]?X]?X]?X]?X]?X]?X]?X]?Y]?Y]?]?Y]?S]?S]?S]?S]?S]?S]?S]?T]?T]?T]?T]?T]?T]?T]?T]?T]?U]?U]?U]?U]?Z]?[]?[]?[]?[]?[]?[]?[]?[]?[]?\]?\]?\]?\]?\]?\]?\]?\]?\]?]]?]]?]]?]]?]]?]]?]]?]]?]]?]]?^]?^]?^]?^]?^]?^]?^]?^]?^]?_]?_]?_]?_]?_]?_]?_]?_]?_]?`]?`]?`]?`]?`]?`]?`]?`]?`]?`]?a]?a]?a]?a]?a]?a]?a]?a]?a]?b]?b]?b]?b]?b]?b]?b]?b]?b]?c]?c]?c]?c]?c]?c]?c]?c]?c]?c]?Y]?Y]?Y]?Y]?Y]?Y]?Y]?Y]?Z]?Z]?Z]?Z]?Z]?Z]?Z]?Z]?Z]?q]?q]?q]?q]?r]?r]?r]?r]?r]?r]?r]?r]?r]?s]?s]?s]?s]?s]?s]?s]?s]?s]?t]?t]?t]?t]?t]?t]?t]?t]?t]?u]?u]?u]?u]?u]?u]?u]?u]?u]?d]?d]?d]?d]?d]?d]?d]?d]?d]?e]?e]?e]?e]?e]?e]?e]?e]?e]?e]?f]?f]?]?f]?f]?f]?f]?f]?f]?f]?f]?g]?g]?g]?g]?g]?g]?g]?g]?g]?g]?h]?h]?h]?h]?h]?h]?h]?h]?h]?h]?i]?i]?i]?i]?i]?i]?i]?i]?i]?j]?j]?j]?j]?j]?j]?j]?j]?j]?k]?k]?k]?k]?k]?k]?k]?k]?k]?k]?l]?l]?]?l]?l]?l]?l]?l]?l]?l]?m]?m]?m]?]?m]?m]?m]?m]?m]?m]?m]?n]?n]?n]?n]?n]?]?n]?n]?n]?n]?n]?o]?o]?o]?o]?o]?o]?o]?o]?o]?p]?p]?p]?p]?p]?p]?p]?p]?p]?q]?q]?q]?q]?q]?x]?x]?y]?y]?y]?y]?y]?y]?y]?y]?y]?z]?z]?z]?z]?z]?z]?z]?z]?z]?{]?{]?{]?{]?{]?{]?{]?v]?v]?v]?v]?]?v]?v]?v]?v]?v]?v]?w]?w]?w]?w]?w]?]?w]?w]?w]?w]?w]?x]?x]?x]?x]?x]?x]?x]?x]?|]?}]?}]?}]?}]?}]?}]?}]?}]?}]?~]?~]?~]?~]?~]?~]?~]?~]?~]?]?]?]?{]?{]?|]?|]?]?|]?|]?|]?|]?|]?|]?|]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?]?cd065e896d7eb11e238a05b9102359ea370ec75b27785a81935c985899ed2df6846bbdba1149ef9edd39c6f18d37f29e5ed9cb3670521f142ed6d7d2bf9f2b8342d2c3aa4d008aad3243fd00e4723033e27e253289356cdf2cf9ec46135a8327bceb4f36b0f077b7a232a94e214b3b0a5a85152e4d89c193f92ddaba3ede1ad65d12217aab3734b081e8d3a038d399c20d76f9de40272cd5a57ab1a109d12cc689d12c8d6df38e418df9b3779be986f15423860a5a658fc14759683bc56375b8a051301e1757aad976ae8a9f2da53ffd3c7547111b29076133d905119a67e5072c6341b6bea8b0d631f9a5d2b3ed23f766c97be8be4228bf14d9a1eb30d30b14510ee2521aa13f16ec3c2eaed8fbb076e8d0226a3b3410a02314b31e66e06bb21fa359cbd898b8aa7afba37422ebd636e207009ee27d7fde2e5ae1cef7ba1e95e9ef20a4b1bb70f81fe823bb9ac46f51406c2df4bce969a5cb3e75df327af4ad52024cd00188383aa29c30b513de9ac2381944a2ee8f12a7d7e11ce552eb9bddc8f4c9888c4173835cd1d6ca80d47d4859444786e2f81ff76e873832366f1444a6b50861c31e12dc0f1c13d55fd1863f2925af746befff1ffe09e89cd4758aea3fc58a27b6b60291837de327054b5c43236133d907b975c2959e323caafa6e1884ef88c926478d317dd3756b9e91383c270242106d73455b2f6e703f709d58446081452cd779e165dc4e6dd8d53911e6cef4e1f126021f561ade44b1791e070447f862afe87118729e847864b502befbafa26e2ad264659d19556198027f0b2e299fc4ff8c69939c99b1b353f9d7cf98242b7865c891c3ad7e3fa325e44e6dd90096de52a882d00a7064876789765700f10300b947e3bb06ff3fc19b9d0688e64b8255c0a7030d59c4ccc591af19237523b6d812232361be0bf45a6918615b08f78216f84388676469ea6467c9fbf5150980ab7e56ca0d9b2dddabc213cc530daab6ff26805c85f8d1b152f34e129893e03ed3935862899c7d9814185baeee1fcd79e7f75d71554fc1dfa1ecdf66d5f5bfcdcb20f7fe9491fc88dd9426998bdcc4456ab3e4b43ec606de8f8d8e3dfa904725bf61b8a784b05e5914b3a20e2ced794e12ec3c518e7e05e2bf2666c735c0a02017ca224a12deca8ede93ead46a93ebd8fd849854031c1a72ff8c0fe307b975fd4fabe0c924d09700fc7a74b3e1ac55715b9ec196acd19022bbb516871a3e315a89cb3aef2e4ccfa3ffbd46ae26ca42b16df07c1d64bdac6135100bc5eb906c61ce29e5584b5c09fe517c36d531fd80f8158c6499e9df619a28fa2889c7186fb28b939c906ce31d66d44580f90ddee4111062d56056cb5e53b0085113dd39c9b40d852c2d3543a63b50287bd122b12995603199f748452eda2ababb90702a1bf0305f4424774483f9c20ad0b51e161d34eb2d7af1235d5cf0a9cd7c26f0d9a8e3cf4cb931ae03920ec75ba3403f4cd5f8dc49795cd7f41b76a299dae48f77f21f5ff2c7d31adbdc208bb1893fdb5127711ac2d3413597a5a4833816e57450d72be55204ff3e2aad285793ae76df4ed8ba93932181a8d5bcfc232eecdb3b8c62c0948ebb5c5a69437a517b037d56b2ba15dc0a91022150cc5008d3c339b23fd3ca3ee0f355ddbe449cc9fec09c1632b1045eb20263b6a3f67577476329ca82f37e81bcf12165dadb152695b047d702092ac87e2a1b9dbc926c0f1193d8ff8aade4024c20041a22ce2f5049830c97dfae27ec136779a5893c6f096a9c54533dcfa3c418c5008d3521abe56863cabadf2a94dd0e15597a6d19bbe8a8133b9651d5f4593c254dd73797fbf39f5a14b120d0c4a4a2a7f076f9429fe315c3ed41a473db4da48b185d121975f9355bb5f07921fbdcda7e3255050c4ffab64986be3f07c4e0088d20ec76dbfe72bafac5f3d8f196e4b2998dd9e94cf716ca4a2c2699b127ba40028801efcbfa0844c1b2f5d9e33933f7a4c83e2afc3b8af2fb6e4d4ba2bf08c7b9cc121e6904c12ebb6e25cce8619f58602d322b065f2c4190986a309cb02fbdc4dc54bfe67ea9dc84bf874cc05a46ca2915955e531964a2b6f980d5949edfcfe8c0623f1a861d444e204b08b55fa9276c49e5c6d35c791c3666c6ee4aadfbefe2b8e7866935fd1f7545482ddee9ded9e79f1514d95c46ca37224d20cd41305b4f439fcaf75ef4e5ca1f47954f42b028c86cf52e38af379ef742d98527a294f6cec9f6fc3802e58eb41f1f3a30ca038c2fc7424f1182189c5df6896162dfac6545e690e7a8345878447801e1bd8ce0ac9cdff8139cc0b0350a5139028d702cfb789e1f2f6d7903dc31cc6072be2b8930d718c8f51ddd197fcbd750f672f8b960a13a24a2b62798a5ec72d14ad3b91272834dcbb28e8f3b5a05e796eb6224259374d0db614875d78773b9540ef94201d94633a0e072d7ad829eaf8c96fb677a3c50b88d90ca051d8c248f439ede7151b04023582e63a6e0c5228e4aa7699139e6127852221c1024ffac3336dc8d168ced5c352eaa10ab47c8cc34440997cbc8566eca04ac85c624c14415e0165f3a06474300319d700a16b1fb84a8f07f391cab5486e9a311da5024c3477f4418bd76dc1e85b9f5bf0faca731cb933209e3d2e90726ff8acb6702de5ef40ac7cd2c431d4f8699ba91aea0d02aa5da8d690440f5136752474beda932a5e6d37eefa2456fd74fbddc6d7be43a3271f0db0ee5ab8aa4e9addcee1bc45a34993f38144120f093c5316ed7fbee1a3db7de41fb7b76aa51d3a579d24d5b383475b6d9f91dce4d2ff48a17ea6691b11272304c38bb031113378a253724e06920e7113e4bc2e7648e25f58c3dad8c81c1ea0da9944bc809efb7438b9cdd3240ef6c8292e8f40454328c2bc81c5392818709033eb2ee0a005c721750c656ace8de37e1f5f9375f40ad23ce91ff579f18c8c49d0ce103bcdc82c7f98336e241d023c1f4266c44af54a54b7bf7c1ef1a6541775c8782e35140b26d5082b6c175240a81976ea3f4bdbaac0d3d8770979db3528c1746af55235c1c9fe33242224192920bef0a4d4098e9f1dd5b6aaa5bb860f2c44d9a41354ef4e66015fafbf1fdbba7796b5ad9dfc790bf6d9596978a848e71f3efd52b0dc782a8a1fac0af76b106cd70ecfefb9a3472baf909911775e720ab6babc31761890c986ea893d462dfa5c022d71321820fec88d11bdef40a55d805251c50520e7c3657d002a3ee90c7de1a7ed7cf4dab32008565c11b235f79f2b634849623ba6b6033994aaec7e7c710711f88df62c7f8e94c27f4739f3749587a876f4230b470cd88cf90da910a38ddd08e59b069cdeea40446553f6962c91d841e635c249cf733a1a97ddc991335db23baa9dad989dbfb14cef5020313087bc384e489175e62401a8d4923e888fe920e020e327796e5c61f6b1f386f8fc9d15f54c201d194a86d45a5c3706247d0670a253ae601c8eb18163700a7f289d9ebd5893701e2f282a3bc332da708d884222ebb8441b331e38051113cde2fd0fea9166849ff3af18773627089d31268c38a9e35ac164e823c9807801a455295a9f17df3ed95508a58744495239c80b87387761c339f7f29207004c68655fc3829068c458276c475e644b505370229bfc290322acac6c55942481182998b712030823109ae5073a88b96959a9c63e36e3a9443a3eecb89b2f4909828d05b6104fd9b5c3a3c817c715ed039cc6b62d3aba7deef400c20a27ad310818a2e61c074cc6b609ede7aff2303b1662bf83ff236a664fb1633d6c616ead20bd67bc1c0707eee33bc9e3e1f9b9d7ec680a6dd1604f6e53051ce597dc553cac714ca8ccb152a81d807f998bf5cc5d4214a5f1d22327ca67357e2cdda64d099653d24f9bb04b9d5c82dfff41fac80148b878ec77ec9bf046abb71e77f59334c199593478209bf60775633a1afe780c58f9cb71a785d3e6909a199231888037c17bce45f00f91cc687da3ae5f2d6a8f7bdc931c2b7db1dfeda8bce44a5a1a373c44fc2a5d43e3098bcaead6afefc8ca25f9dee7bf2d099afd339d5e1b6060d1fae10dae904b2ddecaa0dab977e42b51bbd2766561ee631371bd5a4e529fd6ce041ec7d36d0c3d723feccdbaf72c2c6ba553a94b227a04a9b1558b27ac5f52d5dd2785eaaa27bff44891db0c7a7ae1cd50224560a42a40a7a976a8ae6b7a59cf540ffae84078b0db0afae29e4ba78ab7f6591de56004a43f3db8b9f35ce2acc2a0fda48e359ff5df02ddb692ae007c04bd469514c295f64c688df29038558c0e580ac6cd5b3bb9fea99ab0f9b46a09308903df5c497b56c7218331f179a4b69f695a1c96e28d8cdb7f05f5ef4222a67ca3e5e70d64dafe87b23e1d301537a2740e4134f2cec70df033807b57137d435126a5681f60728f12eeed2c27112b449a04ef8a0bc4175b4d0ec3b6ab61360b6f1a8a3541e00eedce3f0d7f725e65d601d47e19b673876eec43dc49f1ad1bbbdcbd0f2d061dbe079e75d8b23a9f31e4dae66013aa8689702d97d278dcc338e94f44b08072497c105d8661c3b7f1662238213f33283e152e7413393a0748ff2ff08f075f09736b9d8012f506e4528fc35211932ce15e0c69bb5fadf9461ee3c585085c5a89a63516c474f8efe17f08e9e30670088a260801b78938e50b37901f9fe3860d07a81a84058c4b40843a33279875963888d2a44e40c1ac6ba231600f480a325d677b9ea08f136a1920ba09803d97db3e20328f4339ca8c9d420e56e107c109b1c57f196b467ba6a844188660afe9ece773720730e8731f21d98bd51d100295a259803f163621975e5cfdd569cca1df66ad8bc37076d2b0fe83034fca5de2f1e4452f6a04a807c052db6f201b5d2b94021f04bc38192aaa09d3033487c0f0345081c07cd004ea6a5e3e216be758ff78a8d0a7fc263a6c1b0e4b41aa735030d6de9f5b6539444eb85b54f994c5b555212a7bff64d9dae1601033eaea79ea886fa0da93f61bcd8c122ff9adb56d76cbc61eb3384817577d0f6b989cd89d070356ffddcd3fa3a7f49f5deeda426adc7a5ef4fdf5e1baa952aaa238ae5403b1de9f79e18e828cb30946f6d5ed20314b9745aa8066bf6595a717f51cbaea0910cceaa6201964ff3b9ac792e6ab203bafdf9a366591ad0f4a19ed4ea691aa4bfa61f089a0d8f5eaebab238b969afb49b8cb22d426f33854aaeb2346194e77cbfc98644e4345e6a3a5a9710174c1d56ba64f1cbd75f9528c73570bc1a929e1fb8bbe3455930272b2794bd534a65f2198450af2327c656672f8a77ac4f7e59b3ca8e1f9d1183195847a308fa8641b080acd6709aeb42fa8a1f3f67ea11e3957399477580471de50c623954e6294c63b521b657c98b14313105bc341d12fc4142b68fcd767adc445f802d4e087242af511041d24eff691d62a79db6f82798c8278b133da9e82ab70ea5ab6cb9463be45f0c8791f7a6e4d554c900d1c43114372e9dd75cead6d43e3b2ba3787df2a74ba13003ca655a4eb729fc8985f1b92e1446da287dccf714ced4bcc97d2c92113aec208b68b7719607a1e6867f1b642c09efc99c02169929267bb431431dd26e1b075b1c645bf186e78e8d7aa1753a987baf4558e2ac6ce9577d9a16c836126e79382101388737dfae8fe653a5da7e73be4775d10185ac6048bfeb51650ef7fa0f32016830a7d93271c398b5a867e65e1da15c08b1f529c8e8f655f52fc8b2ff870e3d521e46b429bd4fdd9845192ff69df4537d2de9cd18e1a7eef34d0a1de3a23da6f342e61d15dcee3c140be5cb554abdda6a7b7a86fc20eb22bca294a137e925a6b5ce73e8357528efe9729e71a30b3e3657988c588be27eed33c61047c4783249af780b37ec971e3de5d39461d1ddcc2ea0bf2c06da4b095ef63974be8aff6d283b883836e60c60b7ed2d877dc5368444bbb95fae1bcb3fbff0d8b7edc490267b30a1942e49e987d6cd5900fbdc73a8ac1e6dbd18263a49e6593956cf2b38b7125e747f0a594a42c4d81392e2042e0a5ef638a521097c5e45b9e2668e2f2cba6bfbbb6dcd4a2a836180e8d790f776aeba4239ad2b20e25cac6c7c327f80badbfed279ab80e48cb97e0fff8fcd8d2a8a52c5a6fd1c2c9e39fadaa045a3beac6d4599b347e49a9bb740ad6bb41e28f80a021f5223783bd0e923ca64dd1837965c837c750772c01b905be10f1ae0f2a4d593d132f9be6341e8891bfe981349f923f69b59b1ff22b3ba69bae2b5ddc00fe3fad6f98b2fccd12239ea4f88332d751ce81b5639d742e2465a873fe9812bc1bd4e829ea7b1d80f717504992597ff5e43b7d0043ec1997d7b205aea00fc51d81e0ae23ab64d344f11ed29d482e6eb482bb1c73e6bc5a1d89079607870cb876ff2a4b0f13f43e62c9cf653227a18955db4992b5a1c526a84f8b573a05c5116b2c6adc6b36b15313e98e29633b81cf3ecaf6a735e7fbd62441af4d037159a24a991ce60252ff51543e62a31a384d9a19f62a9103093f53813b362ee686528e3ba8e44d1cfdaea2d08cc431c9ae92860ea92282fdabe43866ce6032b39875e8a616a34bab60a4c86befb8b156c827179f921be92c593df3702e218eb66131d38ea57ba6d8110bcad140745b35de292e67337d9b9c28163d6281c6249505e75de3feb88ecab478c230b216c5c4a5fef0261e6490bf9cba28ecc6de7619816ace5383ff5f23ee7899bd6f238b1bebda30c07a8bc4be01560526a2f54c0148ccf817db1635daff956d8f874756ab049d180664253951aa945f05b7a0bd36753995a4fe8e8595dbb384f121cad40f9f8198bcfb8011d05c07e9e6826dcafe660afe29efadd6f84d4eafb40d078fd465832c3b5ceeb4a752a3442d6170bd38e7005fe2e1b55b9023f795b8d9d6efdb29011a6132c20bd0dd2823508e77af952fe36eaec3b958e8149788d8111b74700e11c15201f8ac0fe39ed6aefbd3861be838665e9e46981b8d0a665b5b0c6bfce8707544aa49fbf826e6382dada3facfb8dbdf3cd4c81a90cf5671823a6ef79e2e0b5548a42f685edcec6f755837bb4fd8643e4933a9bc9107a6940e0823b0863ae7d54c635fe2144570652a5a6a4abc5928c4da81c71f3dde183b5e570f6ff02cbbe7b412bd16aa865468ff1ef300b48028ec2b577fef79f388daf5394ad8a0e7ede63d3bc85d2f025640f26f9c14873cd38708075f2fbaca5653a3536dc449b354023ca756c944ed83e61803963a4b4aa18e8422a4a584e6a5233312f13e999bec2e4089d7539829c435fdfce8cc51777e1c3fd6f6f7c2591a9cf97d956eeb2a5611d9b779307e897cf3a4ae33cb21b7d90dc2c2548cf9d945c61e6b421bdc331db69c8ca7a2ed18fccd6eb77ce47b3bf73ffcdd293b1e028e43f2a8a8a732d8a5057cfb74240b4386ee0c5665a8a9de47807ed09a3de4630917126aedc25dba3fb51f37c3c90babc29e6e459e47063a4f339bfbcc93dc3b54a38704d0d6e0355bea747439da1df4e4e03d79907306c9622f96412131f7ca979d8df2f160beb2851d7964c51d920d437947e4ab082261283c0d3d6d58cc2517ea8082c43ebc247a1454dfdb025b3817687de0ed991a0a5a2f870115fa41b360af0f9733d453bc3f451035bca208214c681f401c109e48752710121f103b5b69b3e720ef2639114d7fe4c0d7d1a906df813f4939314cb81720d86a41f838155f7a3906e9505b5fbffcef55e0b83a1c0adb2dce438c92dade878d0600a598ba4401d5491326696934423b16b90d9c8d8584a887ff48cfb7babee1a2dd593b218623689287626f8f915c85e5d34adbe488fd2816d635cfe1baa18921e6fff50ad7e15335370b4d4c692763f1369a1cd1d0826a421720ac4d1d651741c2127aafcb92e9bcf6c18b1c12e0528010cdde30e17315a53287cd5d366fffa173a74e6637656233b9386be9d8f78999a30197b2690197cf1c13a1f3af403c2bcb0c1a1eec7f960951167447f1fd20d4402a26b9099cad5862e318b09441897af5bc66e72d20fb60f24ddde586b8d03768a05a55819398dcd2e90f3c367fd1ba48a911eb85f3f6f0d60022371e5358bad002a391daab486da35594bd6e4829403db52169b2a46fcd77ca7fd9df7af0c2015c36107ab3c65a7701eb1c8266c46ce739e0819be1c0184053489f36649e7444b529540f46c0b5b20739dd985d3e8a5cbdd1ff82de618b85911681f5803e6c266607795274c400a5eeda08825180d4927b7019976a417db43d2ad20200bd3a8372f57389e74880a8493c303504172b1cc4706ade4e82ba0f9c71c5072cff1d7dce06c759f5b2adc3a95ed633a52c9db52f6757326e693ed9e4a5c98d30c596487b7008152aa973a958d6242ca3b90e9176df038251c897ee3355f76a6a45b7769701035b41363e05d91bdb5ead9d13cd84c1d030cf93de3447a0ba6611ba8be953f2b6b9cfada11ef8a91ee9fc1d0fc151b3809c94a7fe9e4a4fb9a6bcae2e3dd97cc6829fa8fdf7c1e77fa8e4eab3ab0cf18e73a15eb7233375ecb52b39805ca782619bcb14d29319e6339f2da9bc2680b3259df3232094965ec9ea2a63639cbc923f891c165c3e3331c2f9b0db6629eaa7b545260dc5099b04ad6f962bec14f72bc34c5459e81291cdcff2dc27799e532c2ede6a5d441b39d52cbae7ea97ffcece0f2c0a2edfe51ec7a37cb7595f68a408bdecdccdbffec2e3335e022bcc039072ebfd644f44519c101f32467752a91c511c93071428444295b970f041f166e8a7533e0d11d7972b28086012c2408ae3163a9f1ccff0ac28fa4657de3f63a4b2b97843f402282ff8d1ed18704feb840e717bd7d780bec0d54c4b67e56039c99ced1932c3919caccb1dac093002fd87cd5777744b6ce7eb9ff90cbe1b526b9321b106667f363ba056ee7cf5c62226ebc1f6da10e9c17b67f98d35b7e3239d61c4f1817355bbe640256db83e803a8cb3cc5df13ac76144c7377a4c0dce53f4c052c33b5e2e1a77bbbafde896e14a2a096e76a8c675a480939c6087318f8c4c4d742488248380c957393be714d26b90dc1c0dfef368095c1110a0079773e24322059fd7073d607297b0c33bbbd9f5400b992d2534e107fec5098a57f79a5b643772351132a950e33b63d8ba4b504a47d4cd55b935614295adf46a1d8aad6d334c44c5ae676e13fc81a91de049065c9bcf4e92cb6b5ac47bc9d3191cf7b0aa2e47579f7486f815444e06e407fef42c388de179ea8a63741c8533eb7f3a246e0d9cdb5a3e9b802fb561dfa877a5cb9d9009a13b19bbe6ece34eb6e15fd248060592bbe17d487a99dc07ed06f21e31e45c1753f93b6fda6b7590aa6477413946b8eca1816a87bc4d67330b73d0b16d829dd8980054dd4185e0116e846d32b989ae3cd29d86d43f0b3f48bedb68443c4107cdf24a7fb0e2884228f1fa4094b9c248ed1929ffd059d88f2a8f2fe5df694d9512e395e8aea1680090d7f7dece08912863f4a50ec35435f3eddff3f210c7bc6e1615748ff1638233c8e6e708439121d20f1ea457cd9e325ee2ce49f1a2fc523644906d3f1aabffe33f474d5f869d582f759dae7c2c0c8ee3b26b92d4344353b847f67a32717b1f616175b54f5060dd17f8b9ee65c87327bb456c8496933b4046aa6506ddc68941a5aff9b0b404430e00a1067994ad1ccbb9c7a723d5c0bff12a076c11e87ae9359c54928a62f5963e2b1d345c2234b8959f71595c31440a210aaa365ddc096513a6fef90bb61c8097b88a0f31366a747d10a4958daeb0ccb4bda03ec84af8cdc838e4e5f9b507de8b7fcff54e41f7fc78c9e5a627aec267415aee5fa978a4b079f0d31d7240f55c5af6f6174e0bcdf54a98f83c19356903b12d5b29dadbf874b1ecaf262624903662aed1a77d5f092d3530492301719551f5989980e75f7fb01be8364594a32fcfc645fcb1bf240f0dcd1316bfcb4cef4e2c64367444e9334500513fdf9e9ede317a467e3db6ac5a5df1460b41c85592b4690b4e3505017b93b46b4438e7aa026607fc65f49bb493919497197f141fe4b62fa47cfbd971e3b67c9c2d1653ecae518811ba246df8acbfde49a71b94e6a78bc524d423246837688f25bf349d368a64a7058e68bb17ebfce4e71e242824755b4d615f168f2f0975b4dbf4b325b1dcf84f11ed9ea59dce62a29bc82ec6a8752a0cb552f03abe5fe1651a960935ba2749c5b02f106eb7842a73dc2d38d08147602210d5a3520764d5e0c50e512cc49e113888d97f0049d0fd1011fcee1644bbcb75bcb23d14bb675efb54b34696a20d2a162bacf29dbd39afd7e17ad776fc4119de1454b11d9d3d8dd4b70bd1163ccd36c5fc681d9c4dfe518734b463e5080185f755064865b85fc104e816d870c968301efaf3f36762eac60edf7a4761be8fcf99e4ffb72a00c16b41f4274de474179dd94d02680c528f7c3281ede3b804e26c946721832025db431fefc8ebe4843d36e0a55acb1c5ab59879e074411c3fa82c241fc52bc7d1face0380626b5926a6fbb66daa5baf4f259c0572077b8a5bed1ac98949c0877651fdf7a2dd0a7246b7e56fdc7e5b34824be875731235e4cdb9658b86e55d0f2528e908332397cb5ac2463e3fa1a38e9810c52c579c1d30676d5a203c5b12eaf06f879d82b741ad44418f76de694e3549243f8ed9f3c8b9d8252dd19fa4d7ffe7b882971517f3169276bee7a4cfd8495156898e4ef635f0e0767bda468eec30439bf1a28e080da667e3b0be06cf7b4d78db57ae8f35dafc4c6c776046968b946641b46f815605232865ebb60207a114cd6d378ba58dbc34f919981ec8008ca47dace3f26a9536b44cecf569448adce6a1a91c1ba4efa6705d0f000e426992e732613024d2b74e7b7ddd935dc1f6fc0e20753dcd2ab6536cdf1742608b17c9774748cde00237695a43d1a6f657c04a0dff4cce0d5dcce79e7a74d89c19138bec691a5b727ee9c218cf4d95c915919482ec53029f633f404f61066ff7e7ccf2248d58dcb43965e0f19f6d67e087577654f6745d0d7e7666975e131042b3e6ff4cf2a258f285f3210ee4d74e9e951651f57b53c37fb5dec274280490776a05da249b86801e6de35e06c4eeca061d1aee43f74f581bd54334c2e33e3033dd56184b94baeaf3610ab0a0d59835ac050a90381709df2df437a8dd87fe08e40a8f2dd7e35eefc552b36868df39df78940b921072fcaa18f61505e60fc2bd4ce99c6232b479c39430f03cefd157105df0fa76bbdf6a63ef7da238166ec1a53ceeb7c8d37596fd2acba45f18dc261e1e1ec0df4ac2f123778dbed16a7155bf8f8b98d465f23db7e340ec5550cb4be6b81c3c2b59db85909727111b3f1a44b7b5f8ef4b39172710a7eab4f4a3a1980eee6ce6e4bc3229f7f0647a11db64075668809da472afa9f534cb18bd9f627b2fdcd1015efbfcfd7f974749ade4015695ce78e7a04f81297575a34489313862ae69082eba022f617ba88b3b6d3a9fec98603229e099fe5fd0c6c1a550b8a3f161d0e80c06be58b278ea9ee7811b070b1377b4fe8e1331b89adb920c7d3e632ec7e432864a8f75caf07a76ab212418125fbb252c5701aeedf04defa5d8c7aad2668132c6eb93f399eba71ac376cced4e9a08c2f0a18fbb4f4826d7279423092e0e0268cb3bbf3fef4d8ceac14e9a5cb9584f4ca13a0a0b5afbcfa9e5796fe904d59860d24b1a13adf7cf53be95ef8d11d79cde14ad1445271daf20f8e8dc41906c49ac7202ad63a08e16065632a5b39ea09576149c4bf37bc1ca3c4203fc10a9f39af877ce6b417fcbeff1a6bdab5df64d905c1fa3d24b31512a9d932287378943e095b222d9a3efdd72588372282a90c3cec687624f95e1fc5f1b668a3109c913139385b68cdc17699f5d8ea5b60ad35102dffdba5721e29c9f5d9e0774ef7bd9f2249f84ff74351c20155043813e005606c63ea5c216823a925db5511bf18dcdc6808f02aadf4a0928d60ed63e5b6b04d3c47da61de786f71b3ee4abb4fa0f771266f5bebf966b21ed9457dd2479bb4a25be4f0a97bfbc09c4cc5dd8abfb122ca8e2899d078e12388f6e6e5a3d81f803571efdb5284802decdb1f1f9966e4c0cfbae19212d26793067cef01a012671289361e92709dc4c2a738b6238304d51458777c96bb1601f708f932e654d8b424975a2d9003af2ae5e97fd21d8b56cf04cc67bf9762e694c4c942f07dfacf43373958f70cade7246ab8517a5e73647b70e3f9af6f599e713174110e52384976da2b15c5d97ab75edecd1d28a2444ed200ca1157924ea36473702ab025a522d313c3cbe5e5282f0ac9da5ea35362e55219df6071f7eae755affe22ac5c8fd03a96e6d376fd74b5fe3297d2e30c41a7f04be5081525cd5c328179e541e2cfc190e2ff3b156a4357f13ff84ed5519af3e9e43ccf58456758a0157cda0bf0a30b1d03be517cf3abf06f412492cce94fc08da63826b5b5d153c7296dce9380e9cfbc436dea29a8ef3a50cc98d7f4dca3c79d46a93d4485d86d53da358d879dda6d216ea8dfe428c4e5224bf63f052eea5e727b6e084e930823e89450f4f8315b6ac79af7d056662d5d5d29611701d40bc670f83881e97df5aaf48e1e6770851360d78f5722530448f4c4f09e3fefa715851613eac4173e56a8cf06d2c14562f1224fa64170f9197a1d3ae4bf3672cdbaacc52f4e7d6094c82b8cb360374a116e68af2ec415cec79efae017323373ff8513a161e2f8f9f01cfa428a4d3fe436941015162a4526c24892cd95dc1d1f3d17ddaae67162b09965ae30752bb228e1655f61d85b47bfc76478269c48e253bf728f22f6e6a0ebe7933460ac030a9559b036bbf5a157de900a216bf71b907d83d754475713821e2670f19ee4a8c997618c8d3d5070866d8fded9488590a405154f79a78e455c5893555e8eb29a119ce6f98df152615124fd0dc09e953459c56aa0efe2a752d72e40f7525cbeea361fec6a25da4c7c4ba34dce4ba2b2c69721331e2829bf252d3126617e72d8a27aa941fcecec6934cbc16a82cbde60e2e0ea5655b5cf689a386f2d0ac9a66a08958151cdb46090f1c7e02124279fa2e011410c96a716eacb30728fe856ba986673401fcf8b31cf2fbb345d8347e278f08154c04d4680a9f27b2643e15c03034b0a011c693cee20dfc4b8f65e5ee1290456b1d4a6e5a371758aa2c0cb862a0365c39c566fe540054e935490791c3e4a2d482b915795a3f854a179cad948b3fa99676aea491b0762549bcb1a8e8c7633cbeba45ff840615ed3a23b23685997078ac384893889e5653469b10c1d551349460cf4126b34fea38c29dfde1f477eee488efd72d2cfe55257b17fa370c8e2909f2687a76de6aa1c06e225c6c49e2d6badf827b4263042572233f5166069df4b1a124d9781af9ee12e985a6acba0ab7770359bedd4989a119c7311956b204cfdcd3d6d3edda21c21a3aadd519c64135cd7c4b9a575bff5bdb35d09375650bda9c2b23e04e23454621cd53967381267f3204ac5f88922bbc866a63a5da1a02df8dad730bc5367249b4f5a3611f8085f8875b6519fa4182b0a48d1778a64cb1741c81de84b42fd7244244dd8fabc675c1ada3b6749df51f9ca4a3142a5be126f648dfe5b8e80178fdd4a22c31ad657be6f35007f87ea6f009f9cfe949d7794fb213fad485e3aba24c56f3661dbb4f5d98b438d3ec971ab4fc0575bc04529b5b669ee59568f2ac901538df6812ad69413a6bc42bcd7a10cfd7ac318ad1f31160337352ecb4389af3e9246e0fc80d63ceea623ede6fbf166912363eeca28ed683d5c17825726be68d73e615fe874facc7cf26e81d4223e989f5cb1f2dd9699590a27ce43dd96fa6c10c1addcf3c4382111feb626abb3e3dc5431f4b1abbe6b5c9c0b1662c5414b275207c835e1908702fd30a54801227f2b765fa8506ea3c7e86f3602fdf6a911f62547ff3c22cf8c010063335dc2e7de8b13f62126a6e36a9ae03150af47ebba5484ad7dc0718e8e20c9a6fd310fb3251d295ee7ddacc8d7d9804d0fb61dc6b9ffa47c6047fa43836d07ce5c769af58e33f43c59198256dcedcbe05304e8f1ec042bf767b3c4e0f7e7cd954e4758ffdecb652d3eeb8f5600e520648a677f848b4f7da40fe0c17f7c8e17f3ed337773f1caafabcde27768e080dff9129233e18211895597bf542131dfda860dd6988a2a2d79873e70b0678e07729153803e8613377574a56aca2acc1cac05d30ce5fb109c0001d92fbfe005a8d728bcb805de29d3196c56d2bad380ee8f854987f8ffa98adf60d829268e47d255ad59af3b84660a99eb96c4609d5a83a7ccc077f382162a7bff651fc412a694ea90d4af01938985e9e78fcae7288b454a4e21118353cabf7f8e64dbe821e8256b0d965c7d00f68ded1367149521935e15ac41045712727387466de1291aa4fe45742b8b67c16fa88deedda6a7c3b41495d3c156ca9083400ed505d85c1e8b82b7a0d94dd160d444910a9410be352cb5db01a566e0f65f50b213ff10089d9e1b57539ccc8601234537cb60f061c1ef385aa69e9f187652fd32b59618da5500c05d59cb6b1848b429b790c21a6a53b861f7c7c7379a0217491c480b2e4088cd86c1eb4c10fecbf198860a757911daf18f482191103eaf7cac2ec59bb42faebafc510105fb67df196116b3856732b60dbb98cda5855fabfb8ed78b2873e78a7f246f09609cf7c6a606931bd5dd96b5c8b78eb7b81390a4b617e5ffddff8377b95dc70fc8f20d500d6de51e4aece3fbb2a6f596e32efb225d1eabb731e473e35bd93d7cea03644e7e22e30371c6777d612e9303acb70d21a3be0cec17fafa7f784193f3be1311aabf92fa2843b644d3112663e905b7ce89189d4e64eba83a9aa567e39b8f50a28b48e35e89b37ef98e6621ad310ede9071cd68e6eacff1eb492681905aae294db3006ac2651cf97d960c185fa7cdf4337360268b0f3e76c3ef5a938172eee75e27d14b1d8890db48b99bd4b1f59b6277ffcc55b0f645ef3337c26f1f0be17a2ebc9c705ffaafa9331c12663505e191b2e5dc4f1b21aa27fc3025fe6a40a5977ca233c38e808588197c5069f2a7f35b54f6d4ff5049ed4d4a5756583890e010e4295ee7b54afa7f9f7fa67302ebe73855b8830d777209dbac482bc7c544ac42eb056982ab5d7dd67d480849ecd98f35d54162f635edb53627c7a2bb9a7f7912abc765342f8cf531032b382633320dd2cdfbb9cc0b047b575472daa368eca5c9f111aea90ea6d9a2eb31e416bd4fb2f00d304d53791b63bb3b1a520073d89aee6559300bcd5733b70d41305d2cada37ee0e20fc934b69dc3586609e9063ee2f05d1a8fc028774a096a383b98c9ce7785ad833d64580b2d9d2403f3c08b04e8f4d830cc5a2b050ba27d792c2d874b811f481ce2f9a654caeac1b14f71094044a2ac31a983435f1f54bf731ff7856bb752b5dc49435bd060d127daa982612618d3adc68630093a3c2a70e626b502b34e44f44a4b8bc919bad9ba8b971aa474e913078fd5b16747676d2696a6f4061052fa72682e23daa8ad37db679dfdf3f614a4c408a74ca994b42641ea79b2767f9a31479a0d85f513ddd3f9022c35a99f8db6bf4159460283a3a62116f185cedb9b4df524575b3b3f7eaa3afbf78c4c794acb70411893be5993128af316eeb49738e88280753fb3b3de34d455dafcb37b879c2e5ceeedcca5eb6f151a7e489937375bd564e18f63a29a6a66f103d547bb4bdf3b0581ba083fca1f46411864add871fb297053125ed71a90c5691cf822e58e9eb4f6ec620e8a4015dc7d534f3df68798f0ecf50f7e27415ecc1a75cc97cf1caa1b814412e62bff2cd7ab7d18b534a818d05f82d5fb7f13c361c2bc19271e157aba35372ce32f6369a424f233c639258bf7e83a603b3b0d4b084b774ce8a7232d24fe35b88d547df14cf5203d21dbdc7b5a5ff9dea7e1fd3d1058fa688c0c6ecc01b09a3af34771514236ab80f3d6c1144c088c91438a1f188b513e24159c6927774ea1adfe6859bec6aae7f26c1482c1f448e811955deebc8e5732d77c1b19eebb649c9bcfa88b82b9b65f6af1870d08838b2cc90a21042cce7026b705025034cef7c681aa80b184e8ae25bf02c55b980ad2fd0163de76908009890ae44e9884e40e4feb003a036e4e9b69bff0f0035ae9120b5929024e2eab44b4c12800ed8c9cf235ee51da54a8e767901d8ec40ba7d671ba9942ab64ac7f8431394509198fb00a00810713f512e8dd4907d50b2d35ee9cec918f4a2075722012ec0f8e636d6e87890d75d88085632024b1a82fdcccf5bdfd1cd7fa4c2e53758073dc822a993ddc5a1083b049b85a5f5548d9da18c2168e51b9618178b5c5789c03e7ede2b0f377f7dbc100ff9118d4e07f7adec180c6fe9bcfa42c485b63a254f2df7ae6b1e63573fb6d854b0ad0733e17d05cdd1dffc331f92df7f7f62652a6d94194659e02a008de6cdb2816a8d52a14562b56102478727a788b5142b1c0b91a3ec0d86113bcb395c2cc66f20d0adcde035112ed07f575f9f544a8997d07bb61008ffd31b73d0887f40eb4aa4fdedfcac963fdcc50d84620ae6587a7b1442d7991d15f810b596af86150d00a65ed877a9463b28fc7efdf249b81fbd4a5da343d884d732c7b6923b9b9bb96e00347e1261257e52e356672137511537fb7e78f5e8ed29f0908f9d4b515d9e5fe1eee59100cbca3c9ba738245ce6a2354a16dccc08016dc6f325c5d3fc13ee2ec1be1315ec65e8d4ebedef8fb4292482dd7219c6039046d0d696e4e835334a40a259d8fc79ce31167ba930d54bd9b5a66a02070cb3c40a0492c169934fdee2600227f9833888a1e9bc360fb6a902f4c02b6ed53fbff8242ba2bcd9716b452e454a362977b5fa55510de4410e4190263185b30012cef7a954a7d888f33653caa3fdecbd1c4a849b3bc468d0d592dcd8914899b10d1c6cd2eb67823c2ce76c568b0b140490855f2b56f51d2af920b46db1116d64092f000f16c0ce326eb5918493241ded56248c58fd7aa2947fdd2e13d61c2888d14a462f160e52521f2343e0784673ae7fce17c4582f785b247048e84ff27c39adb65bf5c6d5e0bef97c1c111fa5686bd8df40f86960dd13532ce52b7439803ed7c9ca1d1906e3e2fde625fddee3ac4536c96152a61fec15c1c470d105b0f6136f7ab2a09daec5e20b706a5ada5a083e32a18dbb7b13c1a04d644b45790803643a28334a6946ce7e9321badce411829e465e30c2f946b26f445e6792b2454d7572e453806ddd9d95d6ad54adcc8ae74dd25eba9dd79dca1fad4608b2ad1e50ab9d71d815a5cfc1c46c8df167573e7e778571088ff9aa4dfe7c3a538d282e078dcc899d0dae902e2462d8fd9757b511371b007c898932affc365af2249aebfe8fdcde77d2fe09371a22f0702aa9d97addd7aedb5132e65e2208255d2df2a4bf1630fee13a78c79ee0aef954df026dd5987135c733a4ec0d3bfdfd49641f962c670e08a076770e868fb09791a025736e9659b92f3e267f4dc0180a50d7a813bae195ae3e63e0558d415058ac5df6581f8c6dcc6b467cdf675800bc933f24f3f2d5ace1eb36788a6a81e1e61cec53a6949c558c8435bb44efc9c6cf823f604e99a9bc845b84e1f15af88ca5ec1584abedef6e204a6899ecef7617df66b7aa5b7906e990bf8ea0fda48966dc320815d2eaf20d9a4490848266e0633ebe05df9000d6bd6b79ac774019f40bda30ad0f3519b5bab3630cc3d5fac4622b04fb890419f66da28e8d5802fd23503aa412e83b0e13931b619abab0308948b8fb911109fee3212374473d620f4c19f7740d4baf1248ef001bf3b77d0869f48aa13c4ae2b8d5faf7abf121936fd6990fb3ca0ffdc538d7c26579937725b5b0f4bc7e53cbaff648f97dc5558b3e4d53adfa402a6c3d5c1b636537cf58f3546f18b5d3cdf4ddc4e5ae608cd2fea006191c343ccbd95b61214b50a3518c6a7eeaeae2798ed464a2af289134e61c69bea938aa7e5a89b6350090df6f9217f108e91e6cfa7d7060bfff9d62681f5a23d4ffcba7b07b94bf3b2ceef050f27e1847bedf1070438c9288aace260620646857885b0e9c75fce696f86f19d145cd49d9441f8b3526d9e272de348040f1063d14806fa3b4bd04a64171d9df4b518cd2d694060a5fb978803bb65eb56ed2b520d234be40a4423fbd99f0593db00decd0ec49e214c181891e38cfa9af3e1e4a1215dba641180faecfb4d9bf4f4cabd3b72c557c664208d04fcd197ee6504d35003664bcfdd44326f82e574ce368ec4a58e5f5c15d308889646d48cb8208f731e3572fb1c13db91c211b322bfe74c39cfddaf14dff5a59539aac403287bb39d2664042721d36c9faa13272c9102d214c75eed37fe0f9edf7903fb2207c011c0b905466db8fd2f2a64379b3bdc71c15e4647a1f0cf54e6b66a40b90688db082ca2b0d5bca2e37f40a0b7c80992aa1fd191fa8164d98842722cc36298bea27e0294555e00f60668ec43e2278b60d7c44ccef7d8551336fe510d33df4cb6f3d3957dccdeb98996c1e00aea981882d7eb27ca824ec10ce9a5d5bfc211de30732da85e63fb9e478e2aa2daff914ef8d8aea85f962e8c5c1350fda5b2de154464d0957588e5ca53b4f393c7ef3f2eb917cf4ba66e8bc1fc55f6c474a0bc16ae173b088a9e67938333204e0fb14c2b8c497a20c410412a467643f61abb4f2bd7ffcb7450378af0131e0aadb4e5f63b8d340372b9d3e7403c28bbaab4d13a3f59c9ef2175b4052e45e1e4a62bb199ec56217aa32ca569dbaff5ed45edae94d58b7162b5e3920ef50846a095d774c4d2fc19470b99f3be9c734b37601bc73f864fc8aae05ceb4a0375f9b27a3c58d35147275347fdc4b646a73e75b16a74b53e043abb71fe3142f95d82ed7010d866340fbb7df1beb3b5c00296d374d732feac27200479cbbee7824738dc5c4052b8b049b4259b23578987c00cd39a48946293b9971b9a4160be39289793eec7aef033bb9575c667b8efcec762c5ff5557a2267f0ecea9a849c37cf3d76052fcdffb11c00bb01e089bc92b18c5869390d28ba21c48d230c5c58f2478d3c154cd06962e724aa2347feb5cd8a43330d2e4a3cb52a4a4d7317cd1a017abe98d0e5e47d9065bef696d4c0945ed8dd0cd0984e49bf0610c5262f6828dbdd055f4681b8b78efe065bba3c4e87ed2c1c4bc661a145c97f1a16e38daf640474ee4488b98b46d5db57b47f3f2c411134e772d254825fa56c7232266f77530e6451769596567ceddb8e9f56c67415b5352be6d0504ee730e6c2710459a9c24b89bb3b1e8d3aedf62834b00a91d9aa585a7a299fa3a0f744d09fc2fad020ba745be377e4eeb39d80a63b322ed319dbfaa73bc33e885579ef4ccdc2eb250605d9dc97ede76d5c4b222056013d5be7862775de89d96857e22c377b17f760a7912bee700b24eaaa7adb68b1c52ceb719dc82b5fb40d3d670db6b42bfd9955106fe2063e4c1f8d9632c1a5108f1bdfd00dfb288bad5ed403b592c12949d88e6e1ca9df7a4fd558faaa19a06a0ae4e5ec629408191010e46d59cc298695d6ce12a46f6bfe195b686cf0f801ba26a5a51584f31a34ab6c900ee433270f86fc62bd7d6ca2fb29b09a2f7bada553d4fa0a174bf5cc9235d3a395f72907e5222fb14eb584d9def03191f8ff48808bb2f0bd636c438ee590964648ba8554238b39c64709058b399a9a27d6549b8018521ac11ed25e410adae850abdf41b2252da00adfef550f81ebcbbb005cd4ad0c0140a2d390edcbeab27f858c7d9ed5c5e0813a0f9aac1c98d412ccbc7b8e1d119bb91691ebbe6e4ac319539353b4ddffbbb40e259028148edd81aa520bd58c5da44af8ed75d9766f61813862c342725d3682667da84ec483a6116197769c2575bd1e09afea123235cfc7218ac0df63ae54ba863c6deddd7ffebc73840e4bc03bc1b26d79bc8655e1cd53c1bee65b9ce5101d1d79d332090d304a91029cd1601f7c42e1bd1d412f0a1054c6b457778e2b888db44ca93a05407518754049380ca7e45c13d6d308f304353dc4d09340adf402dd5a104884fe850d28139e9b7d45525a5f4f0b3dcdaa18359c109eeb1e78d698d1efd4c31d449c7b8854e00d231def278435beda2e0586c0248fe6ec82a4462e3ad0e532bf1ccf2a863ef3c0a3d7dfe7b7d73de30b89506009633856cc7831cc29a6ab13d13713d99ab12c9f21d4ddf9f43f6b4a884671dd2398fb330292d96703d2b1b4ac16b6a0c6308418b12e382d0276cc167f3b496d2dabc7efbe3596ab9df284b59b2d66beee923df63bb6cb0a831355323a4b5b1c6e96d8a4b2e7902b3b4d6a436ea542d7f0fe958d5f0bb814e2ff168dc9ccbde09453956cc7dad40e3b8ca0dab3aaa9a113496fef4e598e28f96c97a9409e8a4737732a2da7e78efd382fc01c4001f058a82fa3ee047b209fe7a259e447c18c2f838626410d6040a9a9042853c7138230e41f7cd604c0ec223dd02293cbb415e7b9f9d043b2449ec139f3ca42d0c2811c70c9b6a4d18a2b2e0e0529defc78f6f4d2863160f2c80280bba0592cd798ccf3178a4d439e5757bbaf1e5aa0169761f4545af2910e3ec5ada3f8f758e2f33eeb2a36241e6a5920f04dad1b97fe4dc1f5c90272cb6ba14440483571324e80cd4b6af4fbb29d1370ade9a60c9761c674ad6fba7f943db8432a8dae784291dc83e77c0b1a39ad24f365ee3ff0789625a1c526daf051112255ded027b1e0a8596e5de92021da74bfc758c09f4a12bc416fd6c5b9bbaf26e20101751e17bc70bc2bb53b594b318d5dafb1d8d08f0c393693a68437385b80127aa95409e6275d71e1b065f115c62a2256baa1f9515f60ab02639112a9f822e6598ccaaa4abb1ffce9166bb295ea6a28534890df6c538677f3b6bbe902fb57230a355d9603c1c20c736e0e18ec32526c071d277d74c83bbe72f8abb61b8c2c319c8bf4fb467468bbecff791df4a3f0aa4a1d2904a26a359ff9f6fe404d24864be1da0a684f0036b294f6983e1acd3a6dc180593a324607161b48e48d43c784e35839da9c50f7070eaa63d84f45ece6ec21078939345c129ea74dfd80309e0a78b2d92397ad7a51c362dfd860c93d2e9de675162dd7c94dba2e89e6474d768cc415690b21f66708e25c731e113c88fa6330f6240217267bb870eb7cc441f51c4d4716e96f0262eef5b799cb76b07167bace16ddacca82eb7e234decd2fd355ccae62f307d5689d0e4239d1555d217df57a4b10861aa239f3b9303fa104d1c0c4e75b1ffc26dadc5d098bb91a8c7d6199c623e41a406a2f2b753594adae451b131f8467486ef22917eb95c5e1a8427195a8b4ca54ecb21bdebed9b89448256f95b98454d1e31d164aebba96262bd00b5eb4238cd5b562a02d02862303e8bb8cbbc0d2aad4d17dc3f81651cacdb13c3d16a37ba37d904aae3621d2996dbdddd0a537b61193105111bed47a97864d51d5f9c7fa2840ed6c5d52e46d02eee507b4631c25bfe8dfac59deda4d2771372f7d9c35de52eaeb24ed4e74d9fa7be34237e631dd6fb308d08302f48bde9295eba582854cf6a9d483e9ffe1513c54081ce5c45a4e685472f8459b40fc8e80ac53e457c740a00eac45cfb207c57dc7e77c16fe12af0fd70211f9a0c6157958d587e44ddf648fe89af9f7c5cb95794b16e59694e2d11b21e274aed86ff398118445bb9e7b6ad02e108cbe2729520342f5b18d5c58a0e2bd314d5d7702a154582beca08a6f78f2cc6959fc751db9e23248e70f02f29ded4a9229d7a0e18942fb67ed93d25f21b83c04ce2ed3cba67036ee23df3e4a4694f83df8ee65c4c3dfd800de4d77229912260e6b0b38810db05e68ebc9300e90a81f34231773052a3c31e4e1e79b6277a75046d7048bd9ec90f777a8d156caa65e34ece48f56625cbba8f8b4c4709e32e1c39ec3a730b073e91376e019f989ee3d0c0a489ff67fbbc5720d6eddc738ced6bcb4d321adc59e07d13be0808f7e33c0f31c4421f213506c3610a9327ac3a96dc9c8c1cd45171bfc4262154eae8067e1c2140736284ee3907e011a2649ffd2ac60af87fc17da5643cd7a93dd531dcba28871d128402b344e02ea869258c437c804f55c98c2b51394622fa27908bc36a4d892af08b52d4d37160bd1c6dc24afaa48b49ac1fb80b586fdeb197e5c537be5bd397741dfe6c41613ca4c36f9fcaa1332bc490300b94537aada538f03510370ac4a872aa230be7bce742bfe1ceb97f4ee5e5c0ec3604b078687a1b03826f09e086a7e5a691d452b99d55bd8b0be1d9806bd4983897ae7d6ffc77cbd4e8fc8d02aa864ea3934cc1bd265ceceb710937863f8aa2df145335a7d09e108c95c693383f5e91b0296b92e7a4bb8ae4112e24884376799280119407e194f3c5d85ee50b608157aa41a38e38831ab3abdfe8a53074a2f51b02e2a30adc54df430edacd7e45568ea8b31da7cfeedb78e131cddfb1820a4ec820a02fb14bc9df5053ff482457be7f46e0cd2559f4ece31516634a8f26241f4f95ca4769f9d5deceec7dcf5e6be79c05d7e4bd4cdbf2489e9692ee043e76bc3a9ef4a91bab6965dcd87046e0e3c57384822b54cefe1b2fe98c3b65e46f47bcc31e826c47379658e60032adfffab43f80b6e06e2e1683d975db496030b3262254dd42e75d0ea06c6703fd40f65af5ff8b67300b872f3a23d4f6fe1d961ad597d90b5a3412cfcaf8798bfea3ab32c13cb32fe4f5ac696b98edd7175ea3bfe9041f0bb037e45402035e17be3667c3fa34bc08bb714881a4aea71ff6ca5f6759249bdad2207601ef597f37ecd418954cb6736f268b288583fc186d25a975db38ce6bea5685270a9cee79d695bc99b13a827adc512bb343bd93ed9fcdd3cfc22cba8084bc80a4aafe023caa2a81298287a62fb5ecd0f9ea9309f5a4c39d869e8e0e49f7a64a393e7408d22fa92ff803f52841e6f0bf893ffee8034d7b112c77e23ddb99cf81e6f47f129ba24c07d71068631fc216490fa464a4dafff9b3106ac8a5cbf7a9d9c1cc3242b072ef74835521d6e6208dec5c7648dc24189eff3b015fa08711469599b994535da5752aca5d8b1e7e5104884b76920b4d39eb5b179f4a7d41d4a9228c94fccfa2bbe2406652bd73bf439632f27f5e0dff4160826c1bce6c9ac495ed09fc112ed56fea9e0f13a694bbadf3754b1a3e853130cfe53593a4529087976ec112fa6c52b16d3d57de3f507dbd7c327b4e4fca48a6d0eeab340da21f7d83127a7a36803e4cc48237db8af03e4bca5be47b275310d918dc821920302988050db1f35a3b3c9a8fd77c18043d5b68f9dee98dc0a0aa7b371398d632c5737555d67548ffce4409928fb0e0e535c092feaed3f056a2fb78c573fbf5457bd2c728428b12e2d1d8c417e62dcdf4ece4b59f166863f7b97cfeb9e6160d6bb74cbec1d189fc1df666682f6ea4fdb876a8b406b259ac99a68478aab54efc03037800cb31a0e0ea6d16096c1dc131a4d70eb10326021c8584d7bbabc8c6f28d3c9950b965ac7663be580ccba4f8ecabcce5aee86804625c56c6c622c738f416fa34d63aefbaac51beb177a6ffd1a4ec6f5035b59a37b6689aedd7fe798ce2f4178395b03c55d3cc57f892c04aa68a4cb9aa4667fd783168d21a47cb14c594737734d68c7eb17079290de23c882dd3b3b63d96384b54a9eacfed411dd5d024a2d1fac822652bee00419445e02e35b1ece88f4b206cabcac4944434bc5f7e415dab55734da16ba3d4076a470ec058ff9401718c27b12bdd5aa17da7708117cac0f5c6cb04a571aa19db008cc0900a87969eea5c7e175fc48694c64ee28dbbe0bb1d0b3ebfe07dacabfeab18046d0f16ed0dff5ea728da1fd692c275c50da59e7c66b8673eb9faa8e1bf4bb1381ee2179d85c9c7a0aa54de61dcffac93855b7ff776d75504e8b4782cdd6d227af138469959a65f718bbe5c01cffbb94b69d049204dc166511f35a135bfd4e493b55cf78214d2cf58d3d3152a2f829b0760bad2ea46c3bf5123fdac385e36961a5efa5124a4264a4e233a5d403e45973b65f72e723be85eeff56497c13b8882d4d41ff61703f0b79caa9b110a76cd6e1acf953131cc139fd7fb6a1e80a1bffa0846e7b5ea4c1e408f48d7370872ca610fbf3f6fb94378c99223242edfba241c9c8450300340c8c06a98dd9373efe6a980016c5fc8d2d32ba8c5f020407460006b1a9691d9151433ed4bdf4ba5e521e02308c9d738b4ffa63282007eacc8f6a6700fe5725d9592d3294e2c68316ba532f3c965bf4562e3bc37ddb7c5d8ee22f4b68044c70a550ce69572152faa22fd90f6f3a3036b29f254448840424ff5a33aa92909b501ff4a75e442c3e69049cbb8996ec375bbd406314ca545759692feaec0e63415acd324e82ae2cd2ee154bb0d8bfa926777d31af098229f0c69095471bfee918b09baf07c7bdd1bfe1430404e0816505bdfca313aeade53f40f6b9de21df57c719a38cf387a34957daa0511d4ddf01eb9dea8561362014d27d460c21605ff1c2a25d2cab3bc6e3e1191241dab8afed262c2967b4a9f0cc2fb6c3143d622d073015d66a6f04b10449cc5dd3dbd628477b01b5cd0077b4a5fb45092734e7898d2f01755520618c87968f65ebf695b0b58cc38ed869011a952a006791c359c63bb4f7afe12d9c32321c46ea1249117d0ba516fc08b973b0a8f60444d41bca9553049dd69d3cf4fbecd5fe7c0b8e05cb82603fc809d53e8cfe62aed22bbb6cb30059d5525defab332b3ea7ce44ca79353dd0b40c0fc161259635181c2c5372d5d7b66327ca3a085e62e987919e9b409a68f606b89faa641f0895d5ab84ca5027d1000da0e25890134be39d719854c98b66e8a8925dde570f53f5d95e1cf091db6688473bb8543fe4757202e8fd8de0ac7cff3aa93144acae972adc3ab6463bf32e804efa97b5c8511d136c55339e60ad7717640e967ddcaacca229ee35d59438f3f5be4d1f654d113248e635ef800afed9572b17749e28975fa28bb963688a24abc99311dfde767f0c2f3d6f8a2187b89b0780df5e4ac564b41368dd169ce83b7545da29640f0fa668aecea3a4d231f71623930bfa11b158ecd639de6bab2dfbab9288fc8834ba8dcd283caf509cb4b973f24bc05ad4620d0c08fdcb27e981a513f03b6d95accab022ffd78bf4bc1279ffdf7046f30a04740fd495b8fd453a8a9af27bd76a7744ac44d1f316fe0ef5a69e432bca215abd3612227aa6bb2ad6dc57c03bf7fae3ff6fdfe4333af3d078e0aafa717bd78869f326f84e4dec9734757c2b517d0601cec4d5e4267f04c2b6e5c54f80f2dd6f5a2c7375459ac71769cf1d70a629e88ba2ccfbdb107af3ebcb0ca7cf1748d670e4ed1681793a5e2ed6a6a668f92d33546bf313530ac0b6246c73d29cd89e0c8b6d6bc728566581415548e3e4ddbcadd8341a6658365092348eee850d337f7d1f63d66e5df8b1d5b9a63080f5826727313c8d77febc387bd495a0a454ddae705297442a324f123b6446b62d79f4e3a9254f43e5b8e15e4c2dbb450574b6ee9c5291c5aec370bfe0e954e75c4e59dc22cac69eee9e445ea55563dfffd1f2aa33e79cb3ca5bbd20678cd1fe78005ca2f3bd0f259ab39b38fa5593454dc697fecfe9f01eb987abea1abd85669658057e80bcac54a3ded214cfd2ec2ed9892afd2ab48ebc6aaabba9588566c991576fac43669850ca823f573252a9b00a8c88f66279d96b0f1b767d180cf4af8308f792e903e687c0c99fee17ac96c099717f12cb8466e7014d6894da0f7ad492c056d945fb8424006fd0f5bb51c58907e5a863daa94c1c8f9d53a00df3956af529663b4dd7205dc44fb13dd33d2451a25e08dda0f0b618896e8759042e65b2154d84f80241d1a2ab894f6caafdcf15cab8ecb32e14586bca59c3eea648319bf2ed58cd7763da58131c99f26b782e86de812af553d8e801c6ebf3dee503d15407c04553a834aeac12ac21044e15ab03f9f47de9dffc4a767c336d9febdf990fe44a540e125f50b67c985b039ef98d460d268b0fe74a621c8e438fbb65d80ac535a66cb31d0c9ee0ce0bbe0693bdac170fae90655142c149913c48958b1c4fc309d8826cc1d1ab59cfc437c07eabb0ad5e969a8252d1b6d50f268ae4aac4f7494c4999caf5c811f2e19ba77ddc4949b1394a055f8b1152261a4df8fadbd75f9843fded051aeb888d943cf45563e0dc4072c1b65b66aac274ff588560da09acf736d251d75a6123afe295951b02e8dabc9de3f0afb35e0691a95d7d270d16bb8904d31e5c2f36d894da08017ae68b796bb550351482190d44a994c688c115170da421df752abb56b336e92ffc1a40a661e1d61b2194bacd2db5916b0baebb7c97c9a8d26a739b85bae1a91b33eb3e8925aca5b35e1144eb95178e157ab147e82073fa10c191a02e329c0fa457a19000096d08834b3da2ba023522481137710a8ac4036f464b3babd90fa4410e620823b0bb9e5d96c488ed9b6d628e81a82f6dead9af07aae6add032c2077738e6f39a78e75d343d42bf5242264daaec261d669a4a197d8ac52f18e6d04191cc7ac5eef576460626e200d6127a494d8ba618cbb23244913213fbbbecad81530f6630e88da589f3d27f21139f4163445d715ce8f28be0b6ada3ec935967d51023da870ded07c1c380004dd82734484fde1adf6196d9c16ec03fa5960178e01e5a200ac3c2e9b9e179c757f8a8dac7c4193326b3f3cc73ab6dabcdab41ab1100e595f91995cdc3b7cf94e4cead6f5f01470416d7456a5349054fd2003b521f91fc8100af22cfe47b67b3f7b1246861d57b575feccce15528e361dd540eb43d6817ea3e39ac13791f6166aa51f0fc72f83eb32a92c3495867ffe632a7e084f125c0087af1a595368878db6ec7877cf4e0bf90bcfc80fdfc851e3f44f6ebdc36f1a22ae706839e77cc32b05cf1c06a21c3a81fffc79b0c7d83a7af92472b94415711505efad712e5c1e6612a89bfafe626b4952a1bd9ebab9d92c0596777033eb01b3fb086e494d278d43bcc247b73faa774ac865ec032d0247710e2cfd0cee11a23c44ef4fd256e7ffa6cb54877e128154775ff71c3a888e1b9c5e69330b7a5b9588d693d149e76af1cd5659b159dff71d9c5fc15273c17ed08f458c5afd5d3c85b41efaa5655efc9421720fa41f2e284c01ed97e85ca34585871e35f9545aa0297c3ce1d8ddff67b19ed26a15209c12a35f6e41f2569fee4da3b37a65bb186cb20c72e80ee9f4719eecc08559a4b86659d08f34522e42cba0639a98177904ce7ef86d4c3250bf2accde21a475eab1c5907f0e8be2740ce453e8a345dbc259ceaf8eefca35fdc83dc9c44bc0ef59bc84497483fc2aeb58f378de367a8eb309b340b57abe0b68baf455a25e58e87f34ad092db9d9f4e57f326960348e39740a49e0c61e9a7c09b9de9ce150c5f66046c3401ff392692dda0984b8772810ece9f642d318d667cdfd0b7d819fe4859ae2e4be203a22dec829619d859c5145844db7b2acb1d68e2bcbde0c4fa061a6336228d6f8ff04a3124cc3d8571831442feaef71a3fc75d2bc7d4684028ccf075cd5ee314ccc935646b9eb6cf48e40e809b519734060ff6c8212e848a51b672c74ab0c6b3e5b5ffdbfdfa5b18c390f357ffb312eee1143888f131b78d8fbbf4a184066259d9747cb0f7c27bb25a522ba0ab21140dd906c41731fec23fd627b1ca549b7e8159fc9f5c6f33157c1488ddb43014d70da63179db471ad1829395a4e45c905cb6218ad06b70d8d55befd9ec957e1fba943a7ff35c5bbc331d5603a01f4cf026a8e3710466ebb91c8d618a58f2c4e36106782e8adeee1a68b7289cc9ad33a06be55c8bbedc9eced7a18417e1b3426a86ac770803d799ac0e4cd7deee2fb56faeb83fb17dbb6f63128024f61be701bb1676cef002fbb890b98758b27408b3a823c9e521c04b2f2d629d93b8ace61201edd8a693528810baab6cfce3dfcee4d0b8adce692e8c8915089981f8eb589c4a35b02127ea8e1236a919a5ce8f0849b7b7a9348d748b6f001c46756fa04e0af71030564db027d72444a2513510a2ccf45fca75e4b72d463fa0007d5504b702d391f0506bbbe6528595c51f7b5f2540765dcf703f484fc4b439725868a3e06845fae8d23eece38d7c43cec52ecbbe187e377f8e52572111af1fc6947cf45801a1b8dffa830ed3eca5e700771278f363e0876dced74b3271848a3b8a6121f523fc1ee610edf6c9efebdaa519b7847413ad7d7bd6b3a53b7e2deea6414d55418e5ab34bb8407f3107bd2c027dee8787b4df98d315af5c076b587e887077f80a20b6db708334647cf03e54016b892863558efe3cf89a66dda6fec5aa678dfb40b6ef7b00e130692e5601d45b71150d5e825b64498684a2565fe32aad1ef92a03f99b039bbc06700d414397cb13349f004d28857de9d786dbb8b2cb9f004ec80a1668a0efa2c43ddb17ffe29fdd98f5ef44c82b5357a70620b5d2aa06a6a906b7ae6f584b9a1a78188577031693a6bf457a427be2b66e84b9757c40a41756ca8d59595b35de3dc2bfe823b0e429c097b7dcc659c9381f5a020953704795886563782b9d82ba7bb04a7097023cd8577eceea423a6a31dbcc37b48ffaf7164fafc781464fa510acd5b7c7e695f9d99aaac8f2f671fb4fb29883ded48634e45823b0850974460e299aa182ee5dfdc4230e35e69e3c10bae76e56748c5fbad233c4baec41a620f69aca603461e99ba82e1b4c0c84e7b59f6b3169f9cabd8388eb65755055128629f084371948d8289a948e91fe874ba6399185446454ace5884f051c02b3f8fe676687ca5cc9133c18572f6c65029f1e7712958981dde211c2151b9683d3840445538b7c21f5053af8c5d489805e67b687c5052b6d632648d6f07da195a3cee210c26f0467bf83f01797c3741a0f8e9c8d74a9f1b283b50ce78f578c7bd8655d7afabd24dfb50e4f01c7568dc5d660b148982bfc0a0452b53da59daf6d1cf4cc70956893ebfeda11884a95ac7f9b118c1279c8ba988971b9260bdc91d544e9a02b8829c0c0eb5a831c6cf6c2a6a56579d66ebcdaf8e17e9ad5720fe320758e40970d7c1670c42f85424928049d9e1e237459be793c66927974b2efb4e1c7edc13e8212f8564314feef3eb3e5e2371a63527b4316b32c6287749a2a78603f075198fd133da888b16546185d9e2eecdfffb2cd18a18388552939c73b8d470401835659f1ae7c958ee6c75f4590639a619a5599c2583ec74e3c8256a0ccd9470e6ac9a18c5c1545929380425e0969210e56c09d440c81420b186205b3fcd0b5ba873b85d3628fef76f1eb7de8a9c066ec9665428a95490e8d6bf976fd1997e0f5af6178bd6eaa1a351ed22eb3a6d31041463044cdef9af29e37e3fc465eb10137aae2ca3204d627066ebacaa5c895fa86dd9b4aaabec61697cb6612ee3356f3afe230e189af6156da3379a72a463c1931d47a4c94de69dfa723c661113a1e436d655fd8ecabe612f8ddc9451ba2f9cbf861ac713b0d1f2bddae2d556c89c7b25d8eb9e2ea3c03f1d111c56d77aa0641ada8fbf26c33a4bbc68359270e62a6d13576f3fd4f0e1e41b1ed61a6556e88103b4aa116e96faa5d9456d82ca8c652f5445d077388e7b6707c5303190acef1c22f02544eb333d838be4b04b7c50f0e82fd8b6b4f8a0d9cc0f3280870a2d22d1af19971b8f695baff25230985961d325d7d14c471c088755363ad5350ee1dc9b645577dc727ce60a470175841bdbae65c7ab5534d91e9baacb27beb4ce69ec98f7ea3406d641db11bc270817ff20db904444864cb7cc1fa6f414dd36f68b549445bdca1c1384c31771f79794a4d37402949f1ae0526f89801b569934a0470f4d525c17b5fd8fe969ae730e0201820d7f2631474f9d8ee9b2bccec68fab4107b35f8c740914708870e6086215f0adb255878b3bcd88e6bc91ded74ff02f859f9807769bc6a88e76db70058b192883825bd8eee2e9011ba5d6495c08fc99c0b706567facc21412b07165d43379ebf2f2acdbe052813edf4a407a675f17ef11e1ea028b8d22837f07da2e6faa8217b4cf9a418b4494746f7f505e69b07800be9178be18e3790e728700b56aa4370872112cbe3c00df150d22af055f6107bdb820b275117ac825db42e7c6d74e538591069d050946ff4bb81aae183edc8f39e0a25b79a13a79ab7bb0fbf3e5c7669f9de72ed773c7c0acc92f7ae69a8eca4fdda6efe7aecb810a7c86af8ed485c44b4c1a33580017514d17653e5e2c80cbd5c8be5a2d7fd5ba780410bfe4963aa09be1a79a23622b1e0960c97c27d4ef2248fb1d2de8560207c3806fbae166cefe4b70c90b0e7a44433035d65a018c57f8da3d35b85c9656b8b8ffc4a98c14c477d0898ad894b8e7978656c5382b918720313170ce1b1d7ef68fc9fe3adecf078b429cfa543115b1efbfe9b005f451b9ee76fafed0ede37aa74348f4bff2ce965b15bdc35773cb70e25454d1be835f976bf75dbaea53a297574ac6e7ef1da74a02465d0ed672eda645104a1cbd2c474802d685d20f2a38194a6cf8af6a674889be2c94e8eff69faae5b5a423635758e716442b875fb65ecce2e4585c0095b09a41ab8a28bdfe222f17d073c7e7345970de0202cda829ce69f1598d82f53abe277bba5f731ebaaf02bc1daae0c1a625c40dfb772179b43a0b1d71d457808acf5459e5c1b17c43d0b373a01625baf1c01afe68ef45d1a638758115ae6c24a06fc132616085d8bb62858d3cdc8b7eccf2e9a65a047349ec26e7f1ea31b72b41bd73baaf7253ecfecb6ba0a88b8920aa1384bd3f75361e9ce44b02e69bf19e0c69fa0a8f98d9633937008c5360ecdf7535d1b930af50142aabe8092a5cc9ea9850df752c10aa703b209e1539d712f0ee9ae91946a12957c4c827d9a3e539d2489928cc75c636f5286e233d0fb8f1ec93cd8a5e8f0a55912b248481b408f6ab309565609492af2bfa11e2ce32b56a66ffa2e23c2a2acf267745b556f979ba6370bbd96ab83cedbb84239f12d900277e2f9de29b7d5937accd2bf17e987ab8cbe05da2be519519268a41d23f3d25a951cb30b44c9e88649db9ad23837e49932a27beb9afae28cc3e18c317c8ddb7d34af85fb7536634ea0388d0005843ba031b2352a1e48fbbb37eed84b5f66cadb6dcfdca507f4482d887ac4e90ef89ffa3003c097569e7f91cc8c1b9d3324096caf66607843b45f4a7e223c29113bba8c502618407ed254a938965a2848466a9e7ecb44421d62a54dbecba2e0dcff41843e33cd92c681c0b8db5a99b5bb743607ae81226b32e20ac76dfe06d56e8324dfb1e5885fa70dc4071d2601f35954ea59f5719d9215f051c2bfa63e0519b22b2dd67f5b55c8491a95617b2f047b051d0e766a332de22421b762d4a3b9dcfd60b777fbba798a6c3b27c03b9b98f3f35292b29de7a4b44454983da51b5708338a8f8308abdec747f1b1d71feb8137509ae6740790b7bf0a428d89230fc60f28f98726dd9af09e331e2c122a44878a6183ae03afc37a71b2c1e723791f9449036ebe9149ef596ff46bf33469aa2c9ce31a349cf7701468ec92399f3f38c1137677f7c870d4744e03cce4ae8c5b5d9e6efa5304a4026445b9be9b151f94ed407fcfbc873ebd74d622f80f0f306ba295ded1911fc710a6e6e2b05fbe81818e886a5d16ceb739d6b039e9b8cec0312b7c50540ca7bab9c7322eb249bd638460f0c16b9dc7ba9fa2e47210b6b5465a671fe5fb2c94ba67ecf756991fbf3912861c090a303e42ef3aabab382772f5fe6e15c49f3bc99fde95b11bd6f16d3fe238042463b25edd2f3f07f70a613257125339a28f0461dd50fcd7c0c150055d0241ec67c95fce61ea7e2aa285422a72785e2f9f1f0ae34e436d857669be58f67b61af9fef4ea328ea2ff506efa04d7b347cbb966d350fbf17239d2441018115de8e8379b35f80282108d46ff81656fff137cc858ec39b839875e36105322d8538cca42a997fca6a1fb9ef1ef014a538c50415d2da7698781374f564117221aaeb7b31736bd9e7eef75bcb0a44f8604e027b58dd7ac8f43caa84b8b98f40790012bfc749c6050974a0115008c6641d7cdaa542cb3aabb395876afab651d6feed5656d5ff69408848d5a410956f107e08bc4af50d464ceb46333748102e994f666c7ac2452aec44166c740368a11756c1b047edd0fb446622872910a95543d52e4c22c36dfd7d3353ab0489c3857a543100a3a3e95b3ce9ae27c8b5f779b8b16411280e683f90ff8489701acaddf37d391ff5f75995cbf790ecf3d30fe1b72323aedd8a9ee815e76a3cffb2363e5868848b07ee63e80830fc40a086a0188009afe2699a7521f495ed568170c20c60189bb380816f5fa75b5df1c656571e5e06bec6bf144d750672418095b884b595c978b9836eec389652a6672cde79e9b0be5e9294fad7ff470a3547c4388f1ee01396335e450423d81b977271cec9994b27c17ed25056de9750b7513769af42dfed4da3db9d3f42fd7330d726f7d1e650bcbc2fee21972a6214c13921bd13684f9ae83f2a6e877aacc720ff88aefbf6d97e5d4b9c07be427530efb802661959455666ba53ac53c3210043acb23b1114ba7fdc708ddeae3ccad3cf75c18fc600eac983bcc34a7debe9c701fd764e225b67c53a12d5dcbe34c6fa76d4982fa7ea7a6eac622b0e635e5eb68a1ec901220c3071a3744cdaccb9518582ad3196a9b93ce60e624df1d6e82dae50c90ef71d399c874c654c847a7dcedb46b133a3461bf548ac148cfc60fe59ba0f91c4f282eecce6e0ea8bf12d6ad491c196e474cb4b1f6b3249fd31aedd71e79dc5a39921796173df231ce3bef4e04e7c3fc0781a2aa459018e8b48dba8a8194b4203c67390fc56e36b2d9053ebd3d6f0f1ab7f3497ce1c8ed8c6fe65ce98fe7201c45fbf6eecd07b635d0cb4744c83efd5916c916fb55aaea199f689ef95ae7f1571b48e6979804236ce14d28a938cb56d9a50cda7b3aef387652e32a790c428cbe20b84417d2adf7c3e30ed0e74c21ecf3b8bd4e2ca0f1e6fbf478540750f6fbc32c38096145f24c93d79d1c95302635f9e807565f51abc4501c573d5d20178006b2753b43f3d9cc5af44445439d796cbba0490bc8c25d018de3154ed74d98a1dd00ece0d946634378ad46afc8e1f5366c839bf45b21aac17d880ab1c52b839f8158fa96822d938236ce7575a484541f42aaaff47f4047ef52d4aaf6e89290d9e9028e0765316e7724934bf786ed5ddaf5639dfa8a35929f1a199b75a3a0db3e73b30b6ec69c0e4c83ad19128f69d90cb019a8ce7cff77d6cfa833a02b45d640d29982bdfb6ec9cbde193f388443580724dc51105cdd6b9fbccf868ec335b33f5fc6427b10df7311c273ce4cdf6a1db11f4a020efe27aed109ecde20cc764820a410713bb6aea9b261e0252a1fe1bbe354389264a0f11415ea20fe5e136bad5a6e8057655e3c1b43dd041c23642ab3e69edc5f56616d9e225921429b3084890c0d7124cea5ae3414e6cc7fa0ef8cf459e0dfa80465e0a1a85146e114ee1b92d01c198d674e6b3af8529c2bd2b1ec9ed23eea910df4457e496bec8cf8f5c7932bfd03fd83bd2cf6ccbfa090bc708a77e3b4586f96dcc096e3a9f8e63ce106b8c5e8ab8279a3caa78eb02d97f140cb2829e2ba1246adf5df54f68ab9267383eab24a7e5e253a3a5d5d4cbf52cf7973dd3a0b1d593c3d1d6f3689a103bed2095495b8066700ccff9476b2546eb7c98aa0baaabf3c4a025f621c339f172eeea4c0416fe732eb30843e330cb67fc528a33e0d15102695b1f1532933d4d0de7dffc45849d9c09691d1b062eb1770c1f1b8662e6704363efa31269d379e041dafaa9116c8fef9e102860cffab43c9f499edcd0ab073a9cfa95dbfcd1421a4fed59fc5039844883cc5a25ec1efc812a9516eb42465df5256ef855ef8a505e55fc51f80f75dc79f553c3148edfd1e57504f8ecd553f81afb6d28c04769bb6590fc478bc05dbce3962c51f51502e086e8a3530a4f44acd9595493c608b659bd11ad1658ca9edc06159414327c8ab5d44f722f0563819e7b4c577e299a7f870341fe74b423173a62dffd761761b70a4b856c3969441bd053602556c032fd7f0b7cba75726acb754f9ec063cd15ed2a795c1711fa77569327a6c2109c73f1f97fbff3e1a82c501781e225046c78aaac376acae6e4b6a02e80fec9ca19197ce6e50247f37b976ab1d436a076467fd0546d5cc40975d32ea1ad4980d5a1e03bcbf4a0592407755fddd33cd7bb4d97c504b86dfb31d626c6f85232b3785edf9edf65c7d0e77fa518130a7169f34d459accc90a1ef82f8701bc7e3a6b52cc381b4f7b922f89d03dcb06c66dd8df5d22ed271e2ccfc7fd4b8962498b69d7e023e4fda0e66e5ca23b7d99a197322caa02e98e71bf0508d67bb5823af494b60ec054b752c47a20f5b99df65c2ffebfae8735aad34101b6b8d0c6720f885f85414d31c530cc38c17f19030e84183b532fab07164bfe9bf25549e2c55f309f1d123fe5dd2302096f6beaea1470abdf88eae094c72019d4f4db39b43f03c1a2fabd88fa7a8b8b93a957d98601d8a22e4ac389f680aed6581cc383216b405722d51afe3fbfcdd0534077e9ebb2d8ae817a62b2e73ed75b0fb7e336d8097465c21363fcb0feddac024eca440728f8b5ecec584efca6de234aecc66cfa169c88f77af897815182c589cc6c960feba7356689536f9877579cd699d4b58281378b3f5586f1832196239c724c8000196c9fe23098b393aa14e51a99c46e386782e4c119772ff2574ebaca001054687e5bcd86cc4b4a2ca3ce509fda83f0c6d9f6ff279c2eee552285555dbe3b62f5e0f94cee2e5bf6d000368b625e08e79b26633e0af26c81e2cb24a734256016bedb69bbc63ee7a513551b597c6e833d9a13ef3a1b0ac6a9608d089e7d7d7afe44a0b8cc1c01487257dac27b1af69ab53e49fbabd3593b94e7caa7d59e0bafcc36305a6c737f08f00d710974174da4def6a67f8d9b098cf0e23a4741dda8f9c674a60409b8940396d5c1e05e313e058a538d7e3b7ae03f1ee1b5fb1c516e527249249f3abdf685a28aded6469f5396af80baee43c2853bc3fbba019f6e671e766faf6c605fafbf4fa8409075767816322f1a8e4c38c8df67cf0a1e9a0715d340381ed48e5ddcfb0cce4e188d38a0cf734616e14e32cbe5c230a87d4cbb4e36abc92f3c573ad4893d0a0089b4842de3a760afc349f1f143b1e88df94ca9af01c6febfa2a73035f5ae970b411cabbb671fed232f1172a90c462b6741bddcbae6a9d6b8f880251da023d5f887bc5284912be02342edd5207896c85a7afa7a98ced22e9307d77918df67d55bde26b94fb137ff4a50e1cb4affcdfafd4ed32641eadb2571cc80719062293863bdd00443a193469b3b7ab4ee96b2ffabe00de2974c2c24e771d3c1cf16933237a49b0d9ed5d9cbf18a52eca7f38bfaa87909febfb2d82120af4658038fe51ac6ffd8f1d06cf1e23521ab55255b2d63ce65886c7e885daec9b936a0a6c1ae706fe51b63f99d91c50376fe80eeff97527c6c84a76c86b7ee4e555748f04f98d1e7bba131ae828159c393c853a1e17118040af0f39e3da8d6e8ecdb8c37fa47bfc93c3ceee3513da269e2f4b184805adc35d539d3da6063bbdad8032e06acdb82e028af4a9caa57d576f01c0836be95fd5e06a1044821edf8fcaee1a845c0756e78b66c8c1356f6bc99a7a54a6ec6cf36d3b620ffb1ced704f817a26cb1612e021463576d1dd9f3de95311b43b9d2ed1f1b30956a2ed008ba3c79999981ea681b34212f0d46325d5ffe68940fb20314945e7e8d67d382fcf6e908c6ac0fcc998b7a27fd278579778effbddf9ea1b0818475631e9668020f78b18cdd3d0e850b8216d06aa9c0ed295f37fb6100d3a9e2f8cba53e4b5ff17eadc25a7fd7ff2b5ffc7692b0c5e8a361aca6c25758ac1cf3826e1572f0c0c53e7f6e22fa687d407c1dbd1f17c15b306c66e5eaac582b5da9f0dc194ba21e705bcb50d4042bcc095d8025d35dce18ceccd473965bea5cad9e5822e13351373a833a170f52333e5beaad3ca1f76ddd475e2b18ce9b177fa6bd737710434cf30478a18aff8f9e2bb736ddf56d3d31116af38c7b9cc19e3dca4859853ff0c23e84805ecd78f9746f02e4b6783f1184d2ab8a0fb7dbb84bb94c2b4e6ddae63eb9ceba5263e08c0f5cd26e1c52e8dacfd03bb73b98983fb944ad84cab004adfcfc81a5afc4d402a90114e2d3ffa0cabcdda64c278073cd9255bea07e7d094815ad87c139d06d23ded26b49801a4adb8fad470cb6bc93dea88cf053ca969fdedc9177fba59fac906a7bbec7b98cd5d244b3ad7714aba7de4ac95d1a8dbfb9d72ffd1d0fae746a7fda329628bd4fceaf2f9c871ae52e35113d339c5fb99db49d7d4150024f439b03cbfbd878e72073dd929abab9720d939dcfbe3a6a93f7eab4d1f258a9b2100212e5233780a8e61251dcd7c46a395256176b90673ca63d6ead1ba50e9009c7e77d2a78ee969427a1be8346d2104bf0651db378d914d5c8dcb7bd8a544c96598eb614c41ba6356e9b897094b3df11dbe6ad7f9dd36d01beaeb7edf80635644ae7b7e904eee9f596882e890b1b9ca5459786ea3a7a75ba7848db8c58061eae9dd07451ef08c20de3d03b1284023d77efb8e2c313d414cde7982f1df4d76261d328f0007a64d801d60f45d0f54972b324c381f59414891ef5b3723291311d70b1d417147e27b9f84d7d656344c36c4fe3f274b2dcbd7d38348544eb12943146f3731579b9594f5002641d4c730232c2bdecbdbea507a9cebd277b06c8d2297f119bf7aa1f45b8c197642e9a52e66dc3cdec68d5339aa742c8414c98e1f6f95297ad977dd28d49f97d7369086c92f0684788f3d04cf3e69d3c2e5295870d499b9933f6d6071852c352380548aa7f42be197dfcda42d43f5c70eff5a69f3ef5c173c749f502e29a863228a03ad49afa84a7bad6b818d741dabb8279ceeeff46a66cdf2dd4c06970a1910ba0f2163a45bca5ed954b03b86ada9d114df5adbd67a24bd25d42ddb8e6b21c820786b6a3e836c8e11880096c88a76e6b3465b2d61fb111456da58dcbccf7b19b300c88db34699a9ca265599305c22a780e0e1bed18fec6aa777cbd0e9969533401615f79cacfe402f11629b8122175a8367c1d105de7f6a1cb88225f778cb322e41f990c6409fe24b6ef4b37780c99d8068089bb3a4b778ec63c80f6f8d03343ef3770f288c724cbb375f1269b1c06cc3fb0b9a69c43ee05525c8e2cae1c326fa4713c68d2cfc23641507addd49be3af9d557b0be1597fcb7a681dd73bafa132de4a34ca6486127234bd0ab6c050df98cf6b0f111f7500652ca14cab4a41fa2d18f1c664626ba70f874a8365ea64d1e1e8a257a1d313a6b652cf6db617dcd22d74378159ef1ce25258c76e1e676aad0722a01e30db706e67788d558e44bd0fb600b177d88096f96dacfd78b54814d6a11af163bbbe30ea1d11cea79a338f1227ae73e275a50236c16a550907cdef91c7a5b0091ee7c195e0268af5ef300a5c9fe1406579ecdcb0915397d14f82ed2bc55f8de4e5abcecdfbc41f9e80a83a072d01418a2a544f718ec3d4f6332d1bb2aebb00c6ca66b9999e6bd2bc490523859f0db1dea63779b9f1f84d52cbf3e7dcede8214080c6b54916f512426bc9447266897ad4078118867e0d6746cd99378ff539066b246ecd123bcb3597c4acc172ea13c1e260468fe12b1696ba737e1984e9b593f774c3db1696be6964319b9f9388707bae3ee0858528e3658741dc271e80974045f3ccdcf5c271fa4458e81023f42761c5eb37375dea4e4d4d8b1de0b4724631cb35b0043e7ac67c4edf767115670eaf50370af4cd2637de6c760e5750b8bda3c5351c16a9a5ebc02e2ea24cd10e9fe31deaf0e250d869f933642bcb9da2dd7ae6d92e3c3242c2ca4908bb60f19d68897616973b67dd1f1b037c460f7181782191858f2003a4146daa41901058972d7baf5088dd5f89f294ddf5d0b6af191f36df14250213469c2735942e825ae6d36406817d2ec872e739cc1cb9f0bee817e95e37bb38c24b9bab958654afa1a38dc4c3155c37d1310f014a5860de0637d0a48d23331bf8afc9f5cef164c130ca4a472b360b92d4552f083d6ffc381f8b033bcc0550c42ea706ca15026f0d4171c06e6e3ed636e2d7cfa92856ef967342076d612e419457b0667c8087f01ebfea10184cb54e7c6df803d8878fc04ec7e45e1705072d1a554a5ead50980fc7dc0443a2f51f64bb73fa10f183be1e8c4368441ddb9cc5c47845c02ab67194a7f27a109036ef7c44c33ea236f799350705cf63fa5a8ed6d8075b8d483c41a589c4ef7efb716cf495f839a1f22ae433f35d4c5abbe7bbcec3a78ad021babf3e0b9ff84130557125622e93b0795670617a426fa536430d1dc22c79ef99b0474f5fc4a7812efe5c9e2e9f1a23edfed2340ce460b118525836600127c410d977d7f2e9a89a6b571289479ee50ec969a026d8054077f783ac7038fc45f1d7972c01d4ff6811fb44dbad8a5de90b39b8a8c055e25ba81b4839725ae5f33875d468fa381a5866ebfa41f21cf2bcd32c0a3e171ca4cd5ee36fda6a7de9f0c630430e796fcae444eddb481d8c61f7c1c1a6b6b6df269eb1c69ddb5d6e2c4bde345e22546ca393c69f48b4d52019f1cd025393fb97d193b53654aa6bf784c660040145a5d5da90092751a9294b526d087323a04313b76cbe6447ab73707f48abe7628a2d8e2b0a5de8dc8e7d4baf10cf6fb714170a8d0e808f9b00d1e3796967ea69bbf899bb84605751b423872250ad5e61d0162613a0876f1c0aa27c7c9dc629bc9ef8fdbcd6abcd26fcdf55e0bb080028cb3de1e3785a3320ee1652bc1a553fde8f73da96ace4c55e5d140bc4211918ed8694dcc5d974ff47276c8c157260e9099cb8042fc9f9a258a6a107023ad1f91a1cef61a74521564bee71c2c055606b183fb3e5f02c21d21f45d8c3dceb63edb8779d4e54668ea48b3d283b141db2e76e2cd4f4f609d47125519bb969771a27a129d82b326cce960126a21be34bcc01bbbda81dbdfc70e2cf40f79d3c7da6f29603a5e52e7f968c8bfc4709adfad10b5d2901740c54625168f306997e9ff6a4dd6b3089030fea08c28cf13a58a35e43883a9feaa5b6552041142f20a916a2b4bb0c0892a4ccf1a8707b3bd537b359cd86f831c655102f69601746ba8a29cd9a089cc3796df03360f77c6727dfe70cf7bd1ee97bd070a1b8ff7798ba8dc2e1ca6f09c1ac987da350d1929136cd346b5347b4aa00aa08b1707ffd7ed550b167233ae883db4791025d4d3f0893cae53d0ee29569290f29b0f73b691f05895c9a2c40357ea89b2fdebe78c41e14f014919d17cbe67b0fe6fa854d65c7a2fa0804dd88d8638caa595e49d2bcb1eb6bb45aa447c4f6ff29d308b7785fa01213a796bf7f61237c38b7d6fa76cb760315659cb37e2c88a9cfa7d48353a5e160709aa599f17ab5076cf9010a1aff139e7d908e73c96c1eeda61568730981f77f749455f6d4efa787d9fd40630cae5ce4d302f7cb502afb8a092b1a0447db8c42d95be45ad25ca5db36cd0f24768173e21b968e7f38503c70bfe56101b8152b3e1a32d922a58fe48f8fa01802d578ffce70178b29fcd877d58d2062a166933fc33d52c611c44d98beefc7a2ddfab7b17a455cabf8acab61554a4c1e649c4d228fea931d30314849cb63eea6684d5410dc66d24fa96739949aa615777b13a0849df0f9b95023bfb065c29379f515d4eb24965f0da79ebfa7af2b3852ee22611953769bc08b0df17def102abf69d9e9d2ab0854760e6ee324c6d35d804f0069d65636227f3004c20e2b74a1666b877e0701f933590c14a0693251fb7588d16d011de7e13d98b07a9935ef81774938d1f8dfb137ef0804e32d54efb3566ef86664a6b8d78d19ff938ca4e067e6c9bd56a635ba2884c97a074fd7e5d32a98c6ac2563323e1d7b40da5cc1f7a66385ef4badc4fb28ea729d6a406b13db81f59251659084f059081828fbc0a287f21a7481d8dbacdb4cd8714741779ce7f0b10d23bffed168fe6f15298797240be1ab25efd139f8f6663e275121659798aa25963f01fb9366b0eea86b68b02f48c74ddfd8f7d326a5bcdd419a78d76dc27507ab0aa42971abb2fb8f1b624d62e13980139cfdec46acd5a48fcfc5b86a5e940a9849b14c16368fbd87c5fb40b8f410d515fd63ddfc55c529e5871a4988f6b1478222f54769ccbe8ee2f3b735fa774ab209ee535a968e7f5c73ae0b5de7c384522f475b368931a1de116ed780a373343da60ddf436d33d075b54dc44383d1b526a931061cebb55f946b2b415547f11343fb2be1233678bcf7d349560ff71b11f5ea8eef27435e40088394228db93f8063dea3693be95fa1569f3b3c91b8b67f0b77d4a7523cf67d842d97ff491ac1842f40f10eacde168aec22d2d14732daa332ab4a4c30248538e83dd7afd1ee5d712876feaf7825829e2e7eedfa51679ab1d7c340f9d40420378b49fc3fc42f72a9a0ef50bf647469bdcf7149a89c14818c0ea9b5fee05682c065ca8a9032bb556e10a0a2e7d508f1d60276b6a8186759960374cfed62f261cbbe8b3e77cb01b01c412d961c16cbbff5ec6c655a18f3d99b0b8ba2b4aa9480d626d4534cf488116b5b194add0074a593366f9f4c8ab554393017f7dbcff227adc4f71578342e2d84814a1c949f6d51703ab19ba4460a1548b29a5b52b5214a1bed29e9cc43e8b0590aa3070424a755fbeff2c6ce21c722042d196d7192681845c6f898923b56e5f3a7370eaa6dde6d978e89f788d512a80fc498c33ff338ec7f0c3c600de2bb10c1afe00f096a9ae8df2b5e49cab7828c8b23e925e8b46f8ae63e024d51c5cce6b972e070373aad3419669fce258a3be7b3bbeee648a0c7caae41e311bdc63f25a49691a192ed222014d0071e3d7c64e3592feb0806efb75f5e4af2e6fed4d7d0bd43c4a7c60c815cd80ea50fcf42c7e4f1db51cf0abc3e13f4bf91a41a4fc3dc846fd52471628de83030a44e40e76462c6e3bc2cc3561cfc80134e7d03d955e9d64080cb8010b54d350db79d3f32b95068a570ea03232c72c60631d150f317724b11b487dc910d98e2cb9460ddd235a8dc716278e888689c0d5f78ab3b58c904794b17c4bb64d3d6f28dac34b8a9ee8a1dc6f6bfd1c2e413e4b24ccd3543f6eb8e1b962cf0657bead354f86f08fb83acf0f2d15cdb76cebfbe9efddee249045cc81f0360110d2c9c77265cacf1808e1c01c426620d8e9353ff01078bb31d4e49983b38764b57ede033442be57fe2e7eddbafccba9c67435feef3aa6476bb9f59c22a7186659791f24ea5aa27ff0350e301a756fec499d85eb9faf9d230b40f3982dce8192896f6fae40e80b9e7ea12c5f4d0a31070bfca4ab36898d33f2d5f351ce8cf7e17db47b09b29b6646db4334883c7dead3bc7d0ee01dcae538c3d49b1714f3c113d06102aef49d645173306c4f207ec6eac2475bc8fa26926eaab8daa466e6c34ab10668fa741b86b382e92b2214397f748cd625ba2b58e697d0180c69fda71d034cc0670d4abb988426bd872fd41b642ecbfb6be68dfa4f340707a6b6409871faa6e3067219f101d3cb77ddfff917e482730104661cceb733c1c8990e16b5508a890bb1f9e8d2487295eee1701bcac5abc493de597d5d9cba5cd5af580949919869f4f652c32fabbfa516fd7e11158d2757bcdf0f755df173d3f8a550f91664ee1fbfd1fe2e59ae2715ff9aeea4f6e5041aa73aea79be007519d9e80f3fc68f329869d7f478fe0119f2111f54df2cf7b560fb1b47165ffc114f5cbe2c2859c07c3564d638cf9c85c5b84afdc9e5adc2978b62752b13878a63ee99c68d6b79db08bcbe71bd7d43beac5e3096a2c6a472c0df4bce2087fe04ae6fc39eff4ea505292100fa2e449a20358a447dac2e932e04d7d18ffdbd3f64116e120f3aae0392e635702f6ab8282c7bedeee6904bc2880bd57531f848c8fa136e125585af4a7a7f206ae99a126a67330b01e99d67b16e0f0f06f556418d3eaebac9ecaf854ac4e450620e22a388b25ae4efdcae411eda11fb962a74e49e12de23e88b8e6e8c72121502ca28ab80ec0a5022692b0cc5062a8d2bf2cfc2be101cb922d31a3bb9f5171d85a0a03cc4c51d0a2ce10fea4c1355bb710ada6ec0f11b69a74187f2b1c63f9ba776ee670eedb92f052f1e90992332cd3d3da29b248ecc997d73887e3ff12e12feb5b1939f61c73c0709582ba97883728722837edd1db6f102788d29df604047d15a1852a5dd7fc7c74f30d392c0a8534255713cca7653257ce25fdeced943975bb6ba8593235be0f4f199d174f7843c720ccc6baf0215e17be990c8d2c9236224392020c2760c7d5610f539f02f2d083e892d69f78c18e755a0f356d6c90a8306674d83c32907c66a654183ed03d261ae20ddc26354f38aa3bdf0760380fc09bd7f12b225901dcc213c71318e05bbebd80f524cf5061ec623cf5bc895b4a6077976a7ddfb9c0cd3fa783259354b6a2d9f284552ed221b78d0b55e8eae65c02003e58fb60c50bff4d44d5bbf786a3f5cbd49c3cc914fc3c602d082d7557c3f7ab7ace38536e001bcf52eb0ef80154322b310e2ea795fe7333d0ba333dc1a7a853d0b9825e34ff5cc055917311b257cf36bf141a2decab2f2adcb50466bd0432e09ff47d854ff60e1443cc6d6dacc027bc112c705ab3b6d6c3de3ef5ce27d4d129fdb066237160be102dc61a8690c459a52b319c974404180caf42f8620ff20f9681d46a8953f4291f3de9ff279d00cb82789f9f3390a83d0f9d38050aec674c5c92bff62cf37d43b50905fbfac7db15ec9b8771850627e1f9e770c312d2138fe017e607b8c1642c6193e31f193b69ffac55c595da60862d4d14c2cfe9a6558b3398ed59bc10b4a1822dd6fb02884f6d44ccefd2acae2137921c5c0e61af9b6845095b45d27820b326e1306ee3ae43d05624e3e2bb39362187700f383b59c51594cb7ae9af7a6e004d2ae29e9ed089968a55efcaa2f352623448f5c54666a6b57111956291dcd7f5a4d181bca27e3145020dc777335c5250af53f8800e58796c059c6977c4f1b8cef9b12103cf9c39370af2ebd9ad11b66de9ec2d3451247e2f3f3002408fb776a822a58c313e8616d49869e70d2e7926ab78c4f2c95e286db19b74770a15064005f43ccac5d10198033f1a16ef1b73e2fd166acebec28a489847a9ec8537747b5c83997872a38527282e648560e37180d3acab42a72ecac8dc39a281f1c19b64c8c71eb8535c29c8f8b60a4aaad677de1e20a0f21a524e0bb3e1e91926c4021f3070eb5de9d98a8df57c41452f66e5ce73d7900307c01ee5e45201abbbf8f49bfeafe78720bb61856e7752389ff5d32b760488343be6f700a1c9e55fd535ec4584387630c08a2a48f89f1e7efab7c9de516fa1771def7e4dbac84f8db1de0015aafbd1f2d74e64e65fe58fc43a361506578af56139aefcae540f5ff015076b7336d5ef721d339c3edb3f54a0bac0f82e63cf9c1121397fb5abb17febc0e3c0acb838d464681e2ffd6d72819fba2d563207621ce08ee5421e74da75fed5eb0c36720ac7bf257418746f2b2c0c9be338ced8a733833fbeee05906259c4d26b6769ed477ba6133cee26d58d44738fbdaeb8df99a70d00195f6aa67023b00fa611d4d09cabe9af0010edd6aab27dc4e4815cdd63292e5edb1a572dbf1c307cc0127d6ae1a2edfd548dfbcf3360079f6cb5de7778ead94d8ea779f40a51468df59c9f68f9b642929d27db1b62b28faa2f28889ef015c1b547c2a7fa8b98ceff4c4e721b8d7caac45aec0866c1e62eda03a822517e99d42a6a679d36aea470b4ae2a2f97fef10c28943ea9861b09ba728bb660b6bbe5b2f052c88b744bf24caaae05561feb1a5735f213b9bd71892f0188050dd475e72c9740ae547d17dba345b4fafa7aa952bd9e0639a2d3566ee4e9ad19515d523d2e4f36d26ff1e7ef1b609eb3b126823314ba667be6d09e7c435b4d6e68e5a8f1345e55f2a71d50b8b8b105b87c9be2458431d77b36ccd6f89235c8512dbb2d57f8c59f560879332543b473d0d19165422d731c2350156be4658e3d17ab99a5e2816e0bfeb8868a7cb38627522e5d2d86b7307a41f3ad81341c03ca0d7e571b4dbebf47d47a90638207314b6b00686d4427b56330750f0121d400e9d590df382d206d0d812187260693fd726374ab708767b3ff731a9774e56647d00e850b4e31e47f422588d47691d26fae2c91a9cec647376c3061b1a41f12ad3ea960b18424e474d5462a6b43b3b083d7b8eb3cd3e3fb8ad176138ee32c53af44e90cf24ac6d1b3f3a0fc446c2b2d7211c2136b646c59ef7a8ac5a4faf92f201651879cab5905e6c5ad9b39ee8b357259ac5051ca342f48cb3b5f641e6cd4b740095645d8343e36752b1b57a0f6e303a6a7cf32fc24a3870bc0e3897e96712d82a1225701f8be67aac7299b091e2048947f23a93c985b761fb16454f89dd5cc893f1fa3aa7bd95015c9da68d57bcc35ea31bf25d69551683c6931093b2aadd0f37ed9acf6a408ed91f11101f562a2e2c5f16fdecc66dda489676775b1a2d62b09fe66ff297ccccf99f5aaf8488601f66f11b9cfdd0d91241fed97d3c0088963cfbe070f039e5fcac771780e6b2b245be54f17cfe37e425c0de47acc34e25519300a8afff1f835d63680fd56064190b99b6b0c723e7411d0b183ec38d0aae036bab9785586d3d50a0d062a3038681769da5820da23528c36df7f3c9a828fb0adb085adbe1892570135b9fcb61d795502f612507a641afe9b2b2b93310408eab6a1a581f107de5cf9998413d3c68d6243afa58f2dff4bbb6a97c5c6cfb5f9dc23aa7393ff18ceadaf4bbc3deb8791ab6744ce12d16f90fff60c7d88ad8a30b82042edb1fb6c6411d873e295d3e86ff5ccb94ca3ae8bd5f6b6f6baef56ff9d9f00356a9eaabc41f2f05d94fb7ec0f69329e3ec74e0900a2d326d76e99ea7707e1ce2b7c9e6a3f47ee0d8ab2d7f8cc651eb5cbaa2c6b617062a51b3ac075fadbea8b53d0b781e9091901c608a42fa6a2fb46fa13663a7273defe1808c6027a20202a7fecf228e09b6dc2cc97221bfd0ac131d90c33861c5b993c7248555c7a15c9d90fe9a3214a0d3d43efaf8cff196df2dd4d116b18330f422f44364c29c0198437378bdc402c079cf7f67027fa945b4782c2a06ec557cc466964d2bf2cf0ec14ebdfe615cfb1133491ccc415e202f1ab98e3c738ea119238f3ccc569ff46181e0b82c4db4e1d997566979b1005abebc940acb548ae12b96ad19af931e1cad7869c80dd8228e000126b3b93d629afb1aa9f487a25701d6ee99e4cf2f5b9f207f73e11763352830ec4e195996180fc56c5d84d0615352894cf5b67f2b1e91974da5e501a8b09f090edde5e77c5366c947b3a2746ce229b5754f6427e403fcb271e487fccf3d74e0fe67009ce4d32c4fc1808882f1d4b65436887c30ac2a06f8c8c8f48d1dc75e1446f6e02f13305f0ac1c859912dab3370f14e7959902351550bd14b3d5b84eacd3998c630db20e49958f0d8366044fc900284d5e8db58504fbd6975535a2ee1ead79b6cc88bc6831f661b1fee9d97dcd7f598338c12befa546a75c7bc86c784b367da4df13f70a59c5bf9933e95654b7701b41963d33993a9e0f46e7281411e4e7a3b97906fca7bb82652c94025930124c911c6dd1333e8f7340448aa6fbaa75ba9380a049b41bb86262d4921453133dcce9bd98da9878ff74c6a6ae2b40dd06c1d8a963ad52aef1b26f73e9c57fd52286f2bc6ce8df8781d3c4c68912a05deaf4ef510089374b5a3ea63672190ae97c9a0c79dbd339b36ca5abfece9fbcffc1a6564735f8e5b7ea9ee50b7aa3feee252816e206a7ce1ba545a90f74a20711c831a4554a7c53288733fecbbbf9f48d272d6b65926e6491c7204b34f76048735d6256dc1a9ed16a62193ef707a785456133801b11691fdd576103235c6ba2978ab05ae19878ccadc36f9574c97ce3a5bc3aab4ed3070dbb7ebfae002d7ea4c48794deab0502b6dbe03c1a49ee52728fd3ec92389993e7464e8d8040e60b211d75bcec5adb4a19ca20af1f2232c652fc25159e12e858f3d07f08910093953401a8f70c11236df7992bc2e113e51b20b22a2296639fa6133b6015f802d66852bb2b4b698f1e8a81a76e67687d0b8508a371a3cfb18254265d57413dd9aaae3742eaa265f3456bf9dbdfb08fdf6b477a6a10fdad90e7a3355697aec35bf22a8f84b655ed7fb307d0489142c045faaa914e81c608e59c6f88b82749d9567c46aca74b4e1978b741a44795d277cf7243127e1597f2e5a3ae676b42c162909e2acf12f010fb756d886355f41a24888a64d5dd10af3515f3001e6911908bc84e293c988afbdabb7d440a2ec3de96ec06b56b4b9701e95e5ca10b6589c2733c81269da2cfc17b3d47fa89dd30503200099ee675147c9e6f97da5e3a7856a4decc4b8c165c4ef804f41c533835ac27e46741496675a2431086b71971f0d40370dbbb119242adaf4e729ddf8d1e04b69a669486aff6a0ee039a66c9961c66e0d6d5f78f3a1fff5432c41265936aea1995776862f892861c937f5904d376a339dbf99a02cc9cff84c27f206c5afe488c953a574c797e99f22b5c917e5fd1a90f3c17a4868d0688696a13dc911ff02f1ad4b6203e9d92f77bbe78470dca7c72009d61b3df1e7871b60921a0d54a6ebcaa148260672a3aedff2f9764f8197d9a0b6c934cceb6820a41476eb1b6a9110af53bb182dbf95046145f6bdf102b1cfa86a5afa8b08e603fc927f0460fa9563545c88d7ca5916dfdb5c9b6c767d520679e66bf673ec64502185615b13d9a131fa4651e5c8b40eaa278c771c4fef3acc35ef76d167f79eb68279911984ac9da9e54eb431dd2340ca6c72e04c2da65412db02aaa3246250c507eb8ff42c1d25b629f9340317ce8b71eee0aa0c015b2b905cfa739bcb9db63c6779cbf2a576a132b4028bf070686f89adfaa5ca91fade9b6f6b4df65a63848c502d2d24b94201e4713ecd2aafce1b7eb28ae4f96ab46476eefc5392d6ba2fe7220eb3458363b121c138d122a188c3dc60454f7ef6fbe7479cf56d1a20347d7960a7330ee392fbb02e0d5b59f7881035d8439568b8f438c0d91f38b1467eb4194f28f7a1558882f831aa7bf0679b0059c10180c66abaff9d238887a05ff23493cb18235efb163adc0a06a2c8099bbda391161ad30f52ab2c7627ab44e1ec88fcbfa08277e4418a7a2286601e56877d6269595c4885c64ea809e9c121caa5532d4aaeadb9e9e6651be49f25470bb0dee83448cd59ad75f4cdcdf2d6c3346d6065ca27b286622eb28fee3ce4399894dfbd1846725fad67fa2b818870e0aad72f9499e1fc776431e6fa6a6858f5c6f1f0b56126e8f912a126053d445f27429a596842da82b1c3b8308ffab9ca5d5c88a2d39b0f44968b0ab67222c6b93f8cafda69183c62918e96bd5d949173c140d1f7d0d256ab50c9fcdc61c725a4a1e1f4639c8363ea53abc87a8b8696a1b8dfd51814f19a6bbc18f5c567ee8d89e0a85879c50fc1ac149cba1e9453d5d262d272c3a76a0e254872e1f54e8fa6da6c8d2220605305dc398214609f1e31edd55c8185c46fc00880f28beba2b50b042b26b20d8fd7f26fd662142b0440addcbd3a64e6ee99bb583676f96927d779481a0647ae6a8cc059d35daea794868326bdb485de1940b2a0c5b90489666a5ad85e2a4c336c730d0cc6280111fd237f90c67e4f6815889ffd803bd9cce441ac59e2aadd6e546f9ac17507798d056b2a421d381866b954c30d33a932a629b67e2745913efa188f9bbce163bb69ed44d12c9167c406883793d6e073e31f74637aa4a17c5c1e67bc663294b8f573ebade9b593b1f720c74cc001f07f29d1168caf61ed84f913f70cfa5c6ebbade99e2d4a5a9b2a872a1b1fc75c65337ddb01ea09c027bb0ab8c5bb00cfe363edbbcaaccd3b997cf926dd2ccdc64d98cdaa4389d8e3c46a789810929302c1e8d10c233932e1144928018bde47eaef06a82746533c7a4b9f1b8253c9bdc89e63f7feb3bc7ccc9aee795df2fafc139fc21ea9013ba3a3c248747fa68bb7210b8557073f3fd7cfbcb3a57eab551aead27af9f716c1d528efcf4723c5755ddd767ba5543f9a7b1c112d10174ee53670c3efa51b94b73a0922dd298c2ae4bc7585bafc8404413f0042165cdf82fc68e9466646ef85d2a9b52bf523fe8094b7dd275c84288aa10f6fe14c5dd5f3e8b2e30e2f182083b5a1f4b0072bb58e0004fb9868578a1e1fcb8be370bfec6c5b2d0318eef1e9bb50ab89fd834ab0e625af5527a5e6f82f8a3a405eff949692ed2338cb902ca715293b77dadec10b53bf024f432daa9e080dd7f2810c25b850e8c2e0b405d1375275fa5e832390fdc7373e6977f682b358897fdf88ccd4f323356b80cc556eba9346d54c0472b377c06d453348058467141f388a523f6ee723496005e37bbb98d321df49a1884bc3561c19198cc35f2ff429ea6efe3161f569f92e1da035ff641f28c04a0a8052136df82f8b0447529ae3e27f8a58912e545514146409666760f5425a3225a4c26c143794808a9cba3f10821c3a9a6a419e06c57f5a6dff47370620808ab3cfdb8f2aeaa4c2eeb90405d1ac832bcc1a55bbffa814c3471d27765a5ed6edb3566edd96e20e6f108402df41b49faf48b75484ce9d37936b2f26672e80731901740049f18de88bd5eb2f58dc4afdd7a8f9198992edbed64c2602373c57e2c06bfddc03177ac292e562cbab5e054acd21318a4a10a4805330476c9099e3d7660d79a3b2b8be3c14d05fe246eb1c9964761289d097f71472a6beaa0127023697956632f8ba77250559a15ce9e7f270e6eb1edb62586cfc31cd4fcbed345891201cb9f2834761f84bd88f6ab147e6b3f1ff90139f9c6c4fcca9dca67f6f4474b102eb1d4765f13ddda3746d54e44bdd32806a9a8a179baf0f8d75593777e79ad9eb9a370db4ce21cf5fc496d6e521ddd7f2e86d2fce6bcd92f1dd8028592154f1a8734fedac7795d4c039d5ebd66d4ac8475a137ed935f20c7fad6ec11db1f86058949a36165489f84d9cda1b1bc1d4e247187d32e953e61716bb585c1d0454f7b965292fae8b22536dd70cab60356d1dbd744f7011c840ea57f5b80a17340138bbef39b38a34631fcb4ae8d262656ab1557b3d74e09da980adc68b54c5eb56ba9716374b1522367425691f578ca5d4cfdf22220b7694610d9eff4fad493158fdef22d1c936252b49153004e8c5ae8b53fc55dfc7aee6769d559dc6d0a439d4d709b116e3abb4ead94bc8cda7b0bd12c0a96a151ff242377453f06983beb82d144028101cfc7cb7b12abe9a1ce9de7f714f1c7c24357c98d11145b5a768f01b6e6f2bfa3da6a825728ec4d1186fb56378be287c83bb728ac1f2e844241a0d5cc98b9aab6996b7ecc14b7b499624b294b767111b76681e3bd0002113c7e3206caed1bbaadf9f536c32c97ba20607bd2711ce7fad2a83149529b060620ac3c8be317fcc60c721d23665f16c9e7eb87b8e591da318ca5d60a8cd6c7acc1d3c2d7a06e4483f0186f62e2ba305649189c5e53605892ca44ea79e249bc821f3e82e1c1583e7aadb19f0c574c2e138adaa6efbd425980613fbab36ff49733b6179e15246bc89971830913c0c225e6fd33bab45f351768e60d9016b5dbe6c9f4cce77d160878dc2a27e19edca99840bc821a66df08234e37b482e1cae6644af512098d2495c11ecb228a57c43ec86768f732eaa843d810a0faa286e1fbe63bdc46bf9e852e349d15c0a170c8fffabd3dc7839f6a8190b7184ec66bf453b4eb894885d61e9e21438073e1729f784790935607c7cfded186c2a6b134916d591421f72aef18288cd68f97f0998c659a81d73526766309ac0300415da7b642dfe8ba7e3c9c37af67b4893f119f69985e1e16f4bfc24a1dbb04462575658584d7a752252839e0787f818f41901f5080e1d52f35e165003d5c0f8281cca9a45dc44769f5665d33df75ff7ed753aecec1308e456ddfee4dfb559bb6fb36cfa647b5777228cee24821962f8350ed090a538f12a50724188e273c645315f4da6267f040104edf9029bbb4da1884407f8437f5d1665d870885f1bfcc6b28d3f367465ef32dae8fdb43ffbdeaee77e4193482563fcd3d841e2003850e5a4adfab4a1dab93d42a9d707cc91f5b78382bd068555baee3664a461831989b94c420c1bfc0b53e8e4a1b26a67764ff9d721bd676265bfd2d76548d3ee2aff5fa8c6f28673111195dd8108568c5baeb5928123cc3c1b07c07cfdfb5d1b71a90bc96b083b75ada40678238949c508ba6ce3af28e601b3ff5c087f63876b575fd2eb7323053775f5487a6dabf336946eda37230d3afe6a75e16af37a9193bf5ed51d5efbe577c4527d4cf0d0b8fa8a5f15c3a0c86b2984c2fa556522afdc5cf3989be38b3f1489a775cc80126f4d1a8441834285954db30d2035e886940aa2254c6a7fa3587c874574b47e8979ae0986eb3088e01a1a670b2d7b5f7f042960fea80d5a4b7db00cdcb715765d11897aac6584687657e883a35e36f6bb2e461ef2ffbb4694e11a41c08e8059b623f10c48f63c62fb5a371680dbcbaefc2f43d32e52de3db301729a1b604cf905eaf28e369efd2b04c8a6bb11d60be37de8897e2fd350db4d073e1e0ecdc8d430eadbcce1c2f9483546647d3dbd75abeb905506182853505c63ed3e3fc8bb6c544a55ec2358f987e91434db7b3b17e514d2f48f7319c7ef30eff72cab9a0852645eadbe45f34bd141f5de7b6dd367854ba7fd6658e0ab2ee66dd20f2bbf921f3cc5a0563ec062df41b6c9a4aadd81c262a9683ed1f5beed2cb04acb8ed18581103daeee290630e04d67226f6ac86d5c680cd7cf4c79256d383aad62adb72a01eec6d9f098d5ce17185b645b64c52293358623fcb8c77479dceacd1f35821b2e43b825223eadade6c6fb97aa9226edb450e9c188133f2b5ab21b3600f488f34a18db510c4fb0c894345fc280833c53bb2bcc559bc70effc2b5eca18b6d2a609fba4f8f44f77c93b8ef7d642011a633d790ec454d67642a944ad1d2aa5e96bc51819452dbfd7177f3dd9e1579be6ac226caa88435614d0c29b519def4c5f36f85425bdaf8dbf6e858cd02aca16c6c9d82a0f18c5090080164047f2e975e9ffeac708d3a2b8be97695b2736897676ed49b9dfda9c890da00b0cb6da8a832264cdb48d8779e719246a6a830fd4033094135fd6b9e636240a4e0349526f4536b5bd4b736cdfcd46a88de2344fa8db7a39fceb5b724a9376f7e51aa417f1a10baf63cf530a4e759c4be80b251ee82cb392bbd7183039d952a0d4d1ed64f506d9efe23b37f970187481518b39553343e89b89c2f6dcce66804b8d45e1d55ec1dc36cc679e462ef0170344a83a53bc23044a873d608da8320ac65e235db368ec238efc73a0203508252577fec225b42f66ed7935d065051184cc0371494b774893d57f30bcfbd03c7ab000091123fb60fa23dc7977917000d8e9ddab549cbf957485e17c342807ad67edd3919d1d5c4c847c8eb7c6fb1b6b756bbcaac63bd1cdc9f8d96cc9f91fdca6af5f66e6ddb2355d6387d4229529bedffda6fe0a77c0907cdfcf445c8c720eff421ee021081d34d0b73b54b3d84781a1ada9dc628a4b59f6253f1a3cff7e82c31014abdfb9015711302df5363c688e3232679cfe23c0b273f68c0e161f6548b405e8177ccef5ee92b215d98cc128ec7997bc8f7197c143accb3c720c1f4ed2e331130e4a70df1d89d4ac6bfc50c642cc8cc1b05040cae31594015470b104163e85a9f519ec28427b47a3a8a0b92dac1276436acbb54bac573e9b83af6955baa5e254871e2e681ac5f42219834da9a5411d59f497c6df3a89b46399e8060121f44b73ac189060dcfdc7e66f426462aeb94eb0d7a16135d140ece4e04fab9f317cd83c2da92777bb26d75957c8d170caff2d1572dee417551be25c2b0446cb6bbccead36a25e3a2f523bc9b6fe3537b3fe0aa0918ff2e90d41ab5d8203c9701bc04cc8b426fbb2b25601df442b472e6b5d3c2dde368e1329c36b3915b82af2137dbe48a5ab8cf13af4b255dbd31ea11473575a63c08ff3d36ed69a0982b7e2faf71b27cc091d7944b25c30144c6f1e98e0ff646ca67f3c1eab89ff4d3cfbdcf15e475bdc50b64f802fd83ffc56f99177e399c256d93b6fe616073e922ccea2b52b84eb6e9ed064f7acaa2bf7fec7dd2bee3d796bc0744082041a06cf8f1e45dd44b8bfc02b1a584fd52817f2c16f6d26828f8fe32f5863cd938c5d2c7cab425f6c614225dbc671e97634e210c017fa39c3f630c22a6c1ac6673903e55c2f09c09aad4dabb76072ce6ae8beaf03e48c627465dda54afd436d47f007c5b1c7b52cf55830d6a3dbcd561bac52be9e131182f46854ba40f55c86c7935413f3c9ebaed553f9b9fafb964f0c5a03ee454b8a21bcef78881b1dcd9e4f0944f5e0dee6770f7d32e058739d6a63eb6e264ada03dc9a30d0b1db52bb8d96dc1f7c6265fd93ec0da79c5898fbf9ebb3dc1bb2ffe8ad5eb8ab90e70f448d5fe3fad48c56d1bfcd93dd5b11f413eaeb15c0056ce58e6652cffa6da783774a82e27db165d9d836346f72747d8c8d85f9487e22f9fdd22afb05e33f35a5cf7168954bcfb11617d30de40fa8ad3c2f8f52d1728c2fcf55f6d1ebbd74086b553b14dd513b6350e3a768b8678ca52b18189a5b85564134db150477a016b7824e73e59449451b33fddc3fca5183dc7d9a198d69544c402d09a96e837c02247e4a6130d6eed2a9f2b30c3f738c35d70c85248c3b057359ed5ea1cd52b3d75eb9d54174e6a28ee2c6111a86baa9775f96a245abd0122b84590b748d11e36778668804478853cc95a6b177be3e89ad0d4dd55cf07353cb8977d3bd98060e117840d167f0db84d406970401cb2938b18074c16b36f9fd560d2658a28f3aee83ffb01f39fd96972dbcddd32018d34891143f8288664e979993eba480034fdab02115f30ad476c5814c52236c0351dce3f0dadbe16ad102d558e58e46f4de316d601f1eb8559fd6e7fa0da2edaa56f5a01fe1666e4700cbc5dc1ef9f7674f1fa53a82de533f9084a762ef55562b17634c10f12f1430c0c7be8aa9798546cd20c5eff8408a3cb350afaddd7ee636cd8ec151e393db773f5bbd9e176a34373d86ef942dd0d79b9e271371ed04fc6bee281bbcbc2cb0964bfde1e396a4c18625e8e24c29951cbdc14718e6d5109b0c08565d7735b9bca70a223539dda13c5e09eedc6ac0cfbf99a4807070785cf8dcebbab95d7a05ef72583571f7cf3444111c2d7cf6631862d9975944aad75d7121705fae35559fcc29c10be0ef7945100115b9f3c54195f6ba9878e79c64132a7fe77767413faf8cbbecf2ff69e85ec340b5692343cbd35c12b18aabc308b5d49214f95c8abe9237658b6f43919438f0789c7154d639c21103181eb034aea16574d9b6b961ebaa798d75ac2904f37e5a683dbb687f10e0818620bbadd332c64b26e0a1f4c6f64cfe00b35e9c5c8265032b1bb6ba5b13d924d0d200a10249cf5b69919d56f2f8ee7d0400c4ebf7153181646511f2519b3bca740aec21d724ced7aa4b820ab901cdfea9c89112d9e50021c63c6707ad027f5ca0be19cb4de574ebbafd938b3e9570d8be400d97da0ee86ba610153c7075ffa8b175ef3946454d98d904b82ce7ca96ff4cbac78721ac8c31f05fbb8e42c55b32556888450385e3540e73d58af2f6078582f2e941d213a237de856139ef5954f8af94fa85a9ece6f4b649d63fb0284a9c4fd576ad72a86371c8e8b2f43c27ce93027d0c7593926a6d69e87ea5795b61888c1aa80f605d1ba68fb1af27697f8a409f800b9405fc44a2b70c283d640d237b73b444da8326e7171c2f699e87c63a02d79cc10e62da48ed2f97597ab3c57c2944b11186e1df36974cc03a7c87606755b499406d36a35de4966e5a983e8cf04168af815d21fe1af84864fdbc6fc0b1a881b7f266d8cf96c7b67bd124bb3c785236d119466f2ff51edef931037f4fda1951cc8518579c4fd97d9e6e43c8848d5ec133e47a9aa5bc6f49295e63884fcb22e77fc54e4941241b888a31aa59e107b714f37d474deb8b9a62bd3a6e3867e6b8a972ffcbdd03d0c4880060a0297d9841d384b36f1682bc92768a1aea387214791408a323d534f9a3a362de6cad7bb3b395799a1c98d7ab4b909d19699256f2e028fa054ce49aa8645a150c2dcf0ebbabd87f87c14285b7475ea9fb1a2b772092d94e4a2332122b14c958c48dc2d147d4f797e5cbb1ade04c953f37555803900b7091ad9c274db66dba1ad056534beb09ff8030ec81d88848d7089d787aaaf897a74f9f91692557e5b306cbc359b986356bdfe5682a624c554dc42f3e521c76711beaa01733ba252670a55910720d4e62e0d294f49c7a5be941ab31619b07f28784a8196105c38585c29fbdfdf32b29c9dff18edb10cd5d176199bbec3d9c4b2eb6a5ee2867b255ad92ba3774d2356ce55e4ffee3c5cf8fceed59dda03fa9cda4bd1fc8f7005e2d9b67b2b729af552856a2d69a43380d8e3582bf5a0844ad15b75115a79b3c343c898164ca54480b7c4111b33949585bd30e2e660344012ad27a9e85fdf6ce509e07ea1ad1d81816db8e485d029101155c57641e2839a65c77e5eb43ccd16f81f626bd74c084bacde9e7716266b39a463ab4a1f2055fbdc00c20ea10db76139a5b90e106bfa4a51f41d475c303d094b6aa0303775b834388fee4d6677e18deecb5eaf8c3d591d3cb4c956ae34c7c60fe071f5d3f19cab9a59dd9423c6e88af1fa1223501da07cc214b18724ec1c587951ba0b1dc970bda7dc0ef804fdefebadee0965e023312ab274d01ff551753dc0b7afc85e10b68a9f56428cc2267fab541213b3fbf509cab4daefa4c984e8b1480724e2e399e42086c67fecda7789d5c380e0f257e6e475c63c832aa4b17c31f83ba5d7ca5db9fdc57d4dbc9e8affaad3b65d1b3c4bf0b75df9f602ac32d1ea696219afb6952a294f4b540cce84a33242e065c609afa4e97d83aed8fbc70e410bb4ac1e64656c713f72378bfbae088c13d3e8e1fadbd2f5cfa1718d26c9376cb66449aecd642d476cdd411ab79511ea6608cfc1686b83d4ea4a0f8f197a759b62753860ab0c47b8caa719338d29ee89c6953ed4beebf5685b8b2ba9eb59fcefa66329670c5fe2ca4435c41b5ec4bddd9a69aa5727f8c7026cc337e7f5ea2b85d3e6eadf65d1da59921e9601684cbd6db98176793a8a778e4f97171b0a271463c772de46a0436964b32a57a00ff7e9b78ca13c743767b460bedf3a1d701196e2a87424a7fcdfaf115afcf9476b7992addc11bf5dd4485153818ddfe711c3fc14fb30aa9336100044e5a37d30d6d246459a6c6c38a28b0ee36c5f4ded811a115f23d4853e71cfbc48617fc8d469baeafc65234b2284f93d2a41953de6549f9c41b571867bbb6ff418332d3cbcc109f85d59203bc4d222a70ef70373f65e9cf0780289af7a3d8d168265f3864c5d2e933bacfa2424be11948b89596109584ca6e8ee0144c3d99a82cfab8846844f118601ab906b0b44730d79c9169db3822060b3fe635b51c060ba336c774dd1a5612319c004cd5a626743a468607a7cce9fd29ece8b85e868444b17ce733e80d2eae2e43585ed707a50ce1b2a2173dceff5f35b4dfeb79a69e18ae83d3f8445f0dd7f896096bd7e10383a59f95db4cd85ed6e54ca1cf899e13cd8fcf8d894fdde52f8598fb1581db8f2da9bd57d644127db11aec8803135259c6cad21a3a8cb51b86f5832f74d2d7da4c00ad6e04975e7986d4d7f5182ad6ac51225ea5bf595012f4da7a714ff27a654cbc5614843c848aaa8d1e71be240742e0225408d964430303d332924cf588f4c0bfb75f32c2907095476f00465ce5377a0864ea08f2916a2194b915e61d9829ba0af574d7d8d4fc61be6557c49d9b1893796a674dcd4a2d0ab1540da21721f9ba2889d40d11d15a03f47fb9b4758fb5d396fc3ef09dd2eb17340651bbd4d4d302171b64a5d134a14c2f5761d69baf6e087645f1569ae3c9430bd62569a771c3c9d386357852630d14d59bccaae73e88e79fd335da885dbc26e317a560e886b46237a9bf974c90f17e8d1a3193eb8f6a8a4085fe6afcfc6625155f230cf95e28b02b2aa25a07dd2b9402a7e11a026050b95f200b7f559706d39de6ea5c6a3290939e06c2dca3293634d1380cbea8776653dcd705517ec2d729f81f6402d57a065a801fad2f4c318f858e12657835c6477ac3168ca4094abd3e684a49eecb3f72361e2950d32c7279a81d3d6a36479bb03f1ac6bfca0e129b096f3fc11b1a31322a3603bdbcf5f25ef6983aabfde61dbbfb31aebf6a6438c0de64b0fb58146993c8339ed1575816a6db7850ad758ee3d1b493442e12deb80ae936380c081a69dfbe7b86cbb28d5c225733e9c7e7674418cc7696f6bc482688210a51cea3c76ba11c21c21d75191c1f92f2834c1a9f9c6d1be9ad98508e7b4876621c126d0a3b9432e15f6aef3241bebfc3cb8f2dab4b96f97a61ee2e7312845d3614d817793f6c40190d7b17ef2b7bfc8ce665fc927dfd178722fa98d37e58d5c3ea763893f1f46390b9e412bb7b986e6f26e6b4998a7b7252bee2a919d92a4f63bcbccf52f7a4236cac4964dce74ba8572e8481de412bb53a0ec1667d3f64526bce5b1d39b5a49449f20a6d274d55e60b0c722a8c3606a1aed9a73738d634bd51a4b4be81283351fabfe38d8bc07b96495b56be9c69adf49958224936770455c97be2e895476df55af2d69e308a5b1f898d2d60896055b8f95f99cda6c961be77245025b3aae7411644fea5d5ed7c0f9fb6a9d48af4287b4be060236cee349ec67d4e94f6da473e30d4d406d95c62c1e7814aafe12b62e4ebfa9b4421b156a67e6743bb98d4bd17da6eec1e5a6591e5b6215675d6704257ca0cd1f71717e12fb61f365c8309df3e3e7646cf2ca5bf8fbb0e602e769c5510b11bbf114744ee38b80e0200a059a64daa7b699ea04851f976a7ac131cc0e2da1375524def3476375b4c4fc0e8e9e114f8873394b2ae418d4bff3bb202b523d2b7c897bbbac4f2af74dd5887ca6f5bfdc6a379332dd8f0a6a3b5792c1f1921642c1498dc23802f39f4e43e8f51f3415daa93f1985ad00c9e8768cad571d2016f57b05337882a38ad9f4470d205b1eb895de995fe90369bf0b6c0d73c5923465938cf6750d0a46ef63875d8eb0958c48459bae7ed3d0e6f1a4ff0c876e86f23f199e98d6fc6810cc76de5161e8c5d2e502ef34cdae2115a05ce7760248fbf9d29f89d80de97a7c4ce37d6999ed4c65057c55aa5b6295e0897474a4abd86b58a630b5519e24a96a9c36481adf71ef824507f25f9c01a6e39074e0f00dafdb7da29b02548c129eed0f20b79b112a64e73ea9f6beecbfbdac88cac419f91c685e36f599e7419d1b68ee540daf765f2281a336d8d5994334420ccf21ac60cde19a49d0df073a40445ecdd194aecde7a0c42d2d896a031477712bf49b2967b5d1a24f133bb7553be28f71887bbc6f8b5359c45887ca6a95b586a04bae80994c31d39264e90306f73714ccddc98ab09f33d46be27789f44508d7a4e0294ddb7a972022adef1feb4bbf80b6acb41388b29f99d86196551e89be73d3fda6fbd1cca14dcc0044a97c9e1430600238a4ed27cb144440da1d6273ec8750b8d8035c7924a123c47777a396502a8ab6b7b98c93fe28a08d8377a606e099c8ad9f42dcac63554b356a129a9e9573fcfb207b27baa436c6d4ddb4f8580d914a1263461e304db5e0815f7dd9b755db529032597b77050aa6c653afe3f7d7eac9e3df2d52b926639aa3f51d8cd5471da36ecf408bd859ce900e439901bd20c3c1bf000f6e62cd234e5fa295118a5b5f55100702fdafd43a7398894f4a3dd4f74889d27294143d5f3609d97ac3323c6f3d6ecbe990dcb5d975358f54153f286e78c8cfbc76cf3e2540614252d267ac9327d13fde8abc4b282014be61a11450aa26626c478ccab01c380f39cea9dc5d67501ab68b06bdcd6440d7ece6f784539530afbb27edb7b1a83bf6576ec304ad3538edd4a02e1fe9ff821eda6d9c8f6eb4ebad0d80fc45576ab4426f0b390ce9fb42312c23430d040d85efa8cde8e1a3c47a082d33cbea897edf90b00820032156816c8cc1218b9cbc41108f910a9a072afb6d94c20b5daa083a8c6f1e49570a82b779b06e91e01eeec67ad5fcc586401c91030a8300014a92973e2b4653816cfd1866ebe6a07b7b9050176f3f0fd7deb7094b96dca67a7fab85f80275b5616414ba3d11bed295420cb62860d5a01fe557eba85cab0dfbdd4ed1d7f30cdc0540690d7bfc99ff1e5915e91fd99a5b94d2d26eaabe72c2e727cb88748e83899ee6f2f6efac8eb7d66b7578fa17671b4b70ebdf40a36ec697ece2a6d2b170bd083c0efd515b81acdf56c750064571d635ad50165f1e98519b12655820ef9393b33d71e037d8ae46f6e9ac84b732b21008111b16796ea62181f264aaa19c362b426516c97bbdbbf0b0da0e47f805847067261b62d7d699124645c6a6a983565815e6de4fbc31263380b6dc811fa9d4c1ed15690b2dc7c1afa5a4a810ee69bb8759c898287630273ba24ee35f314790e09d865d2e82dcacb1ed2ef7614e2bd9aaaf2c7b1fd1cac6b3b56058d33a13e5d998b5cec54b5968271a32ce79f80118678f2978011bbaa86de2c5579e966ae17c6dd435279303fcb2d1cfdffafded27c921d1feea042f83e96f01bff7fc98215044eff87f28e65559c9b030a0676eac25552b5961084f162e8bb638d52c81b091ddbdaaf684c6f1cce30ff4c8c60f55148aed8bc5894c22114a2f37c483bd9d9eb809a483f918cd901f9c48251f8dcb19f35d61bf1105ec96e66f22601575a5abeedfd08dc5ec6669790c3b47e557d391adfb259ee0c86566ea1c4a93ad18003cb35a752e91df73a688cd65b92b754071ce3f6328f76c6d6f455eae1c4cd80e2b05cc183e1dadcd83deab48dcf62d191e0f69e1ea30f050b80640b70c4fd455fbd6649d36f54adb32a85ed69d81552ddf2e2878f85120b57279c645236986f1affba9e034017145436f7519e5681fa5b9940890979fb54be43bbfb735eca44c3651864714ae2aedc217a619f659fafe4656bcecfaa52d99b4d40ab735eca44c3651864714ae2aedc217a619f659fafe4656bcecfaa52d99b4d40a3edab1ff7eb6bf33f108e9ac1a08eb16c954b88a844e3119adf5950b44014eb68cfbf73f27a7ead4a7c743d75f07eabe541693914e42694e93839aefe4ebeef7e234489f88176e66bd858291d9de7054c6bdcedbb9f19ebedfab02d238b3dad79ac6a853e324ff7c5e92f5e9bbbfcda63466ec3e8a17fd9b3247f183465e93ca372fd5afc77f0d7f38658bb86153e8c7472376a5d735412237aea47881eb714ad1ffba188101427d74509d8786310f1e0793a251f31819283664626cbb6286bcdd109bc3de5bef59a8492c6f849e7cf1c2a665d6b5844e749d36a714fc4eb8f652fe79b889ef808d2d515a143bd50327674d18780056158238e627e37eaf784b4505976a7c3561f4c11d3d6507b4c18b802110be70e1266ecd65aa25fca9510137f5d6822f4308c7525d307bc5aa18c4a8cd6450e22a5d3ff8ec4fd0e0db96029b188fe909be6889a961ab6d53b11520bc8ef965b7387b554bd7c482b02b0f4f80d00110a008aff7aed1c6d66dfb2edfa2605d155c2d97a1c2877fd1bf4d770e6708988dc83ba66d6a40a20293dfee564ed40c41d5e541c2997e512019841b0b19fb878199014dea84874d11e319609135d4251944a93718a1549871f86355fe0d12397a1e4e4db62d46514798e653a11b107fa6d6cbd7c1d4a8795f849809cbf723c6b3654d1ff2ac20fe4e91db0ffb8387d06864cabae9e45d13b197ef3dcccc6b0296da09999c1156c66710e48fad121d7a7eb3f20a9281c83c7715e7f759dd2b11d8da24b078973a81d23f56a3cd370391c47ad7ea923f5233254b2c62a41ea39a3c45f364074338dbc792fc2c11e46cd8506f84eec2d00b8b7cd076d84a54a4e74dfb2af63dad0b61ff21f4f95994201c284fe8f586948c544ff57e966e81d01c4e3d56cb060111b09771b67ad0ce7c76f75907623f84b05a05d45611f5bc55eab02c151e601843afc2885ab9824b294c7d32e6352066793e8ccf6663071d70e16fed8696139a12f8dc737261cc47235f1f6043d92c85ee5f87b03e8429862ec396b133cb906d4fc51662f88cdb3cd527f0c6b7012ed9be804ded9422125eb5dc9143c8d61b9b80d5cf522b829938f539a301cd22e79e52f6213df15534953e17076aff00521a5402e73915fd843905ff5a92e6db5564e3ddd38febf2dc5e8b6c7840d556c9d7eed953dea0cf43b01fecc45edfa2a8e9b2cfb89d9914c4b70c4fd455fbd6649d36f54adb32a85ed69d81552ddf2e2878f85120b57279c65ca25fb9e66b020eeb9bb140943933d749e10b7e426568c3984840a6026d30c9@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootselinux-policy-3.13.1-229.el7_6.15.src.rpmselinux-policy-devel       /bin/sh/usr/bin/makecheckpolicym4policycoreutils-develrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PartialHardlinkSets)rpmlib(PayloadFilesHavePrefix)selinux-policyrpmlib(PayloadIsXz)2.5-82.5-243.0.4-14.6.0-14.0.4-14.0-13.13.1-229.el7_6.155.2-14.11.3]%@\@\@\@\@\\@n@\aT6xT6xT@S@SSDSg}@SB@S>S;S:@S9XS5d@S4S2@S0@S,)S*@S)S)S&S&S"@S!S L@SSS@SSc@SSnS @S SK@RRR@RRJ@Ra@RRR&R&RRR=RʚRR@R@R@Rv@Rv@R@RR@R R@R@R|@Rz/@Rz/@RsRpRnQRi RfhR_@R_@R[R[RSRNRNRL RIgRB@RB@R:@R1R-@R-@R(r@R' R%@R7RRNRR@Q@QQdQQ@QQޞ@Q@QکQکQ@QzQQ4Q@@Q@QKQQ@Q@Q@Q@QQ@QQQQ@Q@QQQ@Qzl@Qw@QvwQo@Qo@QnQm=@QkQfQb@Q`@Q^QZ@QQQIQGQ@j@Q9Q8@Q4Q0@Q-@Q& @Q$QQ@QQ@Q @Qh@QsPP@P@PP@P[PP!@P8@PO@P @Pf@PPqP @PP7@P@PPPYP@P@PPPM@PPd@P@PoP{@P{@P@PP5@P@P~P}L@Px@PvPvPuc@Puc@Pr@Pmz@Pmz@Pmz@Pj@Pd?Pd?Pb@PaPaP[@PXb@PWPS@PQPO'PM@PIP@@P>@P8@P7lP2&P2&P,P,P*=P(@P#@P#@P!@P!@P@PkPw@Pw@PP

@NNU@NNl@N@N@NåN@NNNN@NNN@N@NGNGNGN@N@NNS@NS@N^N^N @N @NNj@Nj@NN$@NN@N/N@N@NFNFN@NNN@N@N@N]Ni@Ni@Ni@N|tNyNx@Ns:@NoENoENiNf @N^"@N\N[@NTNS@NS@NC@NBrN:N98@N7N6@N2N.@N*N)f@N(N%qN$ @N@N7@N e@NpNpM@M@Md@Md@MM{@M@M۝M@M@M‘@M@M@M@My@My@M3@M@M@MMM@MMMMTMx@Mx@Mv@MlMbSM[@MRMQ0@MQ0@MJMGMGMA^@M>@M9u@M6@M5M4/@M4/@M0:M,F@M$]@M@M9MMMMM\@M M M@L!L!L@LL@L@L@LOLOL[@L@L@Lr@L L,@L,@Lډ@L7LLLNL@LΫLeL|L@LB@LB@LB@L@LMLL@LdLL{L*@L@L5LLA@LLLL@LcL@L@L@LzL)@L|L|L|L{@LvW@LvW@Ls@Ls@LrbLrbLmLk@LjyLe3Lc@La?@LZLYV@LXLN@LN@LMxLMxLI@LH2LF@LEL=L=L=L;L7@L LT@L@LL@L@L0LLGL@K^K^KKKj@K$@KKK@K@KK@K]K޺K@KtK#@KKՀ@K:@KK͗@KŮ@K\K\K @KKKKK9@KK@KK@K@KKKKrKK~@K,K,K,K@KK8@KKK@KK@KqKqK}+K{@K{@KuBKs@KqN@KjKie@Kf@Ka|@K`*K]KXAKTM@KPXKEKEKEKD{@KC)KA@K;@K2@K0K/c@K+nK*@K(K"4@KK>K>K>JJęJH@JH@JJJ_@J@JjJjJ@Jv@Jv@Jv@Jv@J$J@JJ0@J@J@JG@JG@J@JJ@J@J@JJJ#J@JJJ@J:J@JJQJ@J J J|@JzJyt@Jyt@Jx"JrJrJq@Jn@Jn@JmJhPJeJ\s@JW-@JT@JS8JKOJI@JCfJCfJB@J@J@J?r@J<@J;}J:,@J7@J67J2C@J0J/@J,@J%@JJB@JJMJ J dJ@J@JJ@J*@J*@II@IIA@IIII@I@IIIX@IX@IX@II@I@IcIIo@Io@IzI)@I@IܑI@@II@I@I@IԨIд@I̿In@I3I3I@II@I@IV@IIaIIm@I@I'@II2III@IIIIIIII@III@I1I@III~@I}Iy@Ix_Iw@IuItk@Itk@Io%@Ik0IeIcGIa@I`IVIO@IJ;@IHIAI>]I= @I7@I6tI3I-I@III9@I9@II IP@I@IIg@Ig@HHH@HrH~@H,H@HCHHH @H @Hf@Hf@H@H+H@H׈H׈H7@HBH@HǶH@HH|@HHH@H{@H)HHL@H@H@H@HnH}H|@Ht@HsVHr@Hl@HkmHgy@HcH`H_@H^>HRa@HQHQHO@HFHFH$@DX@DU@DN@DN@DLDH@DGwDGwDDD@@D?D?D;@D;@D:HD:HD2_D1@D1@D-D+@D+@D'D!<@D!<@D!<@DDD@D@D@DDDDDD@D@D@D@D uD $@D D @D @DDDFC@C@C@C@CCCCCR@CCCCC@Ci@CC@C@CtC@C@CC:@CECCC @C @CعCعCعCعCC@C-C-C-C@C@CCǖ@C@CáCáCP@CP@C[C @C @CCg@Cg@CCC!@C~@C,C@CCCCC@CC@C@C@CZCZC @C @CCCf@Cf@Cf@CC@CqCqC @C @C @CCC}@C7@C7@C7@CBCBCYC@C@CC}@CqCqLukas Vrabec - 3.13.1-229.15Lukas Vrabec - 3.13.1-229.14Lukas Vrabec - 3.13.1-229.13Lukas Vrabec - 3.13.1-229.12Lukas Vrabec - 3.13.1-229.11Lukas Vrabec - 3.13.1-229.10Lukas Vrabec - 3.13.1-229.9Lukas Vrabec - 3.13.1-229.8Lukas Vrabec - 3.13.1-229.7Lukas Vrabec - 3.13.1-229.6Lukas Vrabec - 3.13.1-229.5Lukas Vrabec - 3.13.1-229.4Lukas Vrabec - 3.13.1-229.3Lukas Vrabec - 3.13.1-229.2Lukas Vrabec - 3.13.1-229.1Lukas Vrabec - 3.13.1-229Lukas Vrabec - 3.13.1-228Lukas Vrabec - 3.13.1-227Lukas Vrabec - 3.13.1-226Lukas Vrabec - 3.13.1-225Lukas Vrabec - 3.13.1-224Lukas Vrabec - 3.13.1-223Lukas Vrabec - 3.13.1-222Lukas Vrabec - 3.13.1-221Lukas Vrabec - 3.13.1-220Lukas Vrabec - 3.13.1-219Lukas Vrabec - 3.13.1-218Lukas Vrabec - 3.13.1-217Lukas Vrabec - 3.13.1-216Lukas Vrabec - 3.13.1-215Lukas Vrabec - 3.13.1-214Lukas Vrabec - 3.13.1-213Lukas Vrabec - 3.13.1-212Lukas Vrabec - 3.13.1-211Lukas Vrabec - 3.13.1-210Lukas Vrabec - 3.13.1-209Lukas Vrabec - 3.13.1-208Lukas Vrabec - 3.13.1-207Lukas Vrabec - 3.13.1-206Lukas Vrabec - 3.13.1-205Lukas Vrabec - 3.13.1-204Lukas Vrabec - 3.13.1-203Lukas Vrabec - 3.13.1-202Lukas Vrabec - 3.13.1-201Lukas Vrabec - 3.13.1-200Lukas Vrabec - 3.13.1-199Lukas Vrabec - 3.13.1-198Lukas Vrabec - 3.13.1-197Lukas Vrabec - 3.13.1-196Lukas Vrabec - 3.13.1-195Lukas Vrabec - 3.13.1-194Lukas Vrabec - 3.13.1-193Lukas Vrabec - 3.13.1-192Lukas Vrabec - 3.13.1-191Lukas Vrabec - 3.13.1-190Lukas Vrabec - 3.13.1-189Lukas Vrabec - 3.13.1-188Lukas Vrabec - 3.13.1-187Lukas Vrabec - 3.13.1-186Lukas Vrabec - 3.13.1-185Lukas Vrabec - 3.13.1-184Lukas Vrabec - 3.13.1-183Lukas Vrabec - 3.13.1-182Lukas Vrabec - 3.13.1-181Lukas Vrabec - 3.13.1-180Lukas Vrabec - 3.13.1-179Lukas Vrabec - 3.13.1-178Lukas Vrabec - 3.13.1-177Lukas Vrabec - 3.13.1-176Lukas Vrabec - 3.13.1-175Lukas Vrabec - 3.13.1-174Lukas Vrabec - 3.13.1-173Lukas Vrabec - 3.13.1-172Lukas Vrabec - 3.13.1-171Lukas Vrabec - 3.13.1-170Lukas Vrabec - 3.13.1-169Lukas Vrabec - 3.13.1-168Lukas Vrabec - 3.13.1-167Lukas Vrabec - 3.13.1-166Lukas Vrabec - 3.13.1-165Lukas Vrabec - 3.13.1-164Lukas Vrabec - 3.13.1-163Lukas Vrabec - 3.13.1-162Lukas Vrabec - 3.13.1-161Lukas Vrabec - 3.13.1-160Lukas Vrabec - 3.13.1-159Lukas Vrabec - 3.13.1-158Lukas Vrabec - 3.13.1-157Lukas Vrabec - 3.13.1-156Lukas Vrabec - 3.13.1-155Lukas Vrabec - 3.13.1-154Lukas Vrabec - 3.13.1-153Lukas Vrabec - 3.13.1-152Lukas Vrabec - 3.13.1-151Lukas Vrabec - 3.13.1-150Lukas Vrabec - 3.13.1-149Lukas Vrabec - 3.13.1-148Lukas Vrabec - 3.13.1-147Lukas Vrabec - 3.13.1-146Lukas Vrabec - 3.13.1-145Lukas Vrabec - 3.13.1-144Lukas Vrabec - 3.13.1-143Lukas Vrabec - 3.13.1-142Lukas Vrabec - 3.13.1-141Lukas Vrabec - 3.13.1-140Lukas Vrabec - 3.13.1-139Lukas Vrabec - 3.13.1-138Lukas Vrabec - 3.13.1-137Lukas Vrabec - 3.13.1-136Lukas Vrabec - 3.13.1-135Lukas Vrabec - 3.13.1-134Lukas Vrabec - 3.13.1-133Lukas Vrabec - 3.13.1-132Lukas Vrabec - 3.13.1-131Lukas Vrabec - 3.13.1-130Lukas Vrabec - 3.13.1-129Lukas Vrabec - 3.13.1-128Lukas Vrabec - 3.13.1-127Lukas Vrabec - 3.13.1-126Lukas Vrabec - 3.13.1-125Lukas Vrabec - 3.13.1-124Lukas Vrabec - 3.13.1-123Lukas Vrabec - 3.13.1-122Lukas Vrabec - 3.13.1-120Lukas Vrabec - 3.13.1-119Lukas Vrabec - 3.13.1-118Lukas Vrabec - 3.13.1-117Lukas Vrabec - 3.13.1-116Lukas Vrabec - 3.13.1-115Lukas Vrabec - 3.13.1-114Lukas Vrabec - 3.13.1-113Lukas Vrabec - 3.13.1-112Lukas Vrabec - 3.13.1-111Lukas Vrabec - 3.13.1-110Lukas Vrabec - 3.13.1-109Lukas Vrabec - 3.13.1-108Lukas Vrabec - 3.13.1-107Lukas Vrabec - 3.13.1-106Miroslav Grepl - 3.13.1-105Lukas Vrabec - 3.13.1-104Lukas Vrabec - 3.13.1-103Dan Walsh - 3.13.1-102Lukas Vrabec - 3.13.1-101Lukas Vrabec - 3.13.1-100Lukas Vrabec - 3.13.1-99Lukas Vrabec - 3.13.1-98Lukas Vrabec - 3.13.1-97Lukas Vrabec - 3.13.1-96Lukas Vrabec - 3.13.1-95Lukas Vrabec - 3.13.1-94Lukas Vrabec - 3.13.1-93Lukas Vrabec - 3.13.1-92Lukas Vrabec - 3.13.1-91Lukas Vrabec - 3.13.1-90Lukas Vrabec - 3.13.1-89Lukas Vrabec - 3.13.1-88Lukas Vrabec - 3.13.1-87Lukas Vrabec - 3.13.1-86Lukas Vrabec - 3.13.1-85Lukas Vrabec - 3.13.1-84Lukas Vrabec - 3.13.1-83Lukas Vrabec - 3.13.1-82Lukas Vrabec - 3.13.1-81Lukas Vrabec - 3.13.1-80Petr Lautrbach - 3.13.1-79Lukas Vrabec - 3.13.1-78Lukas Vrabec - 3.13.1-77Lukas Vrabec - 3.13.1-76Lukas Vrabec - 3.13.1-75Lukas Vrabec - 3.13.1-74Lukas Vrabec - 3.13.1-73Lukas Vrabec - 3.13.1-72Lukas Vrabec - 3.13.1-71Lukas Vrabec - 3.13.1-70Lukas Vrabec - 3.13.1-69Lukas Vrabec - 3.13.1-68Lukas Vrabec - 3.13.1-67Petr Lautrbach - 3.13.1-66Lukas Vrabec 3.13.1-65Lukas Vrabec 3.13.1-64Lukas Vrabec 3.13.1-63Lukas Vrabec 3.13.1-62Lukas Vrabec 3.13.1-61Miroslav Grepl 3.13.1-60Miroslav Grepl 3.13.1-59Lukas Vrabec 3.13.1-58Lukas Vrabec 3.13.1-57Miroslav Grepl 3.13.1-56Lukas Vrabec 3.13.1-55Lukas Vrabec 3.13.1-54Lukas Vrabec 3.13.1-53Lukas Vrabec 3.13.1-52Miroslav Grepl 3.13.1-51Lukas Vrabec 3.13.1-50Lukas Vrabec 3.13.1-49Lukas Vrabec 3.13.1-48Lukas Vrabec 3.13.1-47Lukas Vrabec 3.13.1-46Lukas Vrabec 3.13.1-45Lukas Vrabec 3.13.1-44Lukas Vrabec 3.13.1-43Lukas Vrabec 3.13.1-42Lukas Vrabec 3.13.1-41Lukas Vrabec 3.13.1-40Miroslav Grepl 3.13.1-39Lukas Vrabec 3.13.1-38Lukas Vrabec 3.13.1-37Lukas Vrabec 3.13.1-36Lukas Vrabec 3.13.1-35Lukas Vrabec 3.13.1-34Lukas Vrabec 3.13.1-33Lukas Vrabec 3.13.1-32Miroslav Grepl 3.13.1-31Miroslav Grepl 3.13.1-30Miroslav Grepl 3.13.1-29Miroslav Grepl 3.13.1-28Miroslav Grepl 3.13.1-27Miroslav Grepl 3.13.1-26Miroslav Grepl 3.13.1-25Miroslav Grepl 3.13.1-24Miroslav Grepl 3.13.1-23Miroslav Grepl 3.13.1-22Miroslav Grepl 3.13.1-21Miroslav Grepl 3.13.1-20Miroslav Grepl 3.13.1-19Miroslav Grepl 3.13.1-18Miroslav Grepl 3.13.1-17Miroslav Grepl 3.13.1-16Miroslav Grepl 3.13.1-15Miroslav Grepl 3.13.1-14Miroslav Grepl 3.13.1-13Miroslav Grepl 3.13.1-12Miroslav Grepl 3.13.1-11Miroslav Grepl 3.13.1-10Miroslav Grepl 3.13.1-9Miroslav Grepl 3.13.1-8Miroslav Grepl 3.13.1-7Miroslav Grepl 3.13.1-6Miroslav Grepl 3.13.1-5Miroslav Grepl 3.13.1-4Miroslav Grepl 3.13.1-3Miroslav Grepl 3.13.1-2Miroslav Grepl 3.13.1-1Miroslav Grepl 3.12.1-156Miroslav Grepl 3.12.1-155Miroslav Grepl 3.12.1-154Miroslav Grepl 3.12.1-153Miroslav Grepl 3.12.1-152Miroslav Grepl 3.12.1-151Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-148Miroslav Grepl 3.12.1-147Miroslav Grepl 3.12.1-146Miroslav Grepl 3.12.1-145Miroslav Grepl 3.12.1-144Lukas Vrabec 3.12.1-143Miroslav Grepl 3.12.1-142Miroslav Grepl 3.12.1-141Miroslav Grepl 3.12.1-140Miroslav Grepl 3.12.1-139Lukas Vrabec 3.12.1-138Miroslav Grepl 3.12.1-137Miroslav Grepl 3.12.1-136Miroslav Grepl 3.12.1-135Miroslav Grepl 3.12.1-134Miroslav Grepl 3.12.1-133Miroslav Grepl 3.12.1-132Miroslav Grepl 3.12.1-131Miroslav Grepl 3.12.1-130Miroslav Grepl 3.12.1-129Miroslav Grepl 3.12.1-128Miroslav Grepl 3.12.1-127Miroslav Grepl 3.12.1-126Miroslav Grepl 3.12.1-125Miroslav Grepl 3.12.1-124Miroslav Grepl 3.12.1-123Miroslav Grepl 3.12.1-122Miroslav Grepl 3.12.1-121Miroslav Grepl 3.12.1-120Miroslav Grepl 3.12.1-119Miroslav Grepl 3.12.1-118Miroslav Grepl 3.12.1-117Miroslav Grepl 3.12.1-116Miroslav Grepl 3.12.1-115Miroslav Grepl 3.12.1-114Miroslav Grepl 3.12.1-113Miroslav Grepl 3.12.1-112Miroslav Grepl 3.12.1-111Miroslav Grepl 3.12.1-110Miroslav Grepl 3.12.1-109Miroslav Grepl 3.12.1-108Miroslav Grepl 3.12.1-107Dan Walsh 3.12.1-106Miroslav Grepl 3.12.1-105Miroslav Grepl 3.12.1-104Miroslav Grepl 3.12.1-103Miroslav Grepl 3.12.1-102Miroslav Grepl 3.12.1-101Miroslav Grepl 3.12.1-100Miroslav Grepl 3.12.1-99Miroslav Grepl 3.12.1-98Miroslav Grepl 3.12.1-97Miroslav Grepl 3.12.1-96Miroslav Grepl 3.12.1-95Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-93Miroslav Grepl 3.12.1-92Miroslav Grepl 3.12.1-91Miroslav Grepl 3.12.1-90Miroslav Grepl 3.12.1-89Miroslav Grepl 3.12.1-88Miroslav Grepl 3.12.1-87Miroslav Grepl 3.12.1-86Miroslav Grepl 3.12.1-85Miroslav Grepl 3.12.1-84Miroslav Grepl 3.12.1-83Miroslav Grepl 3.12.1-82Miroslav Grepl 3.12.1-81Miroslav Grepl 3.12.1-80Miroslav Grepl 3.12.1-79Miroslav Grepl 3.12.1-78Miroslav Grepl 3.12.1-77Miroslav Grepl 3.12.1-76Miroslav Grepl 3.12.1-75Miroslav Grepl 3.12.1-74Miroslav Grepl 3.12.1-73Miroslav Grepl 3.12.1-72Miroslav Grepl 3.12.1-71Miroslav Grepl 3.12.1-70Miroslav Grepl 3.12.1-69Miroslav Grepl 3.12.1-68Miroslav Grepl 3.12.1-67Miroslav Grepl 3.12.1-66Miroslav Grepl 3.12.1-65Miroslav Grepl 3.12.1-64Miroslav Grepl 3.12.1-63Miroslav Grepl 3.12.1-62Miroslav Grepl 3.12.1-61Miroslav Grepl 3.12.1-60Miroslav Grepl 3.12.1-59Miroslav Grepl 3.12.1-58Miroslav Grepl 3.12.1-57Miroslav Grepl 3.12.1-56Miroslav Grepl 3.12.1-55Miroslav Grepl 3.12.1-54Miroslav Grepl 3.12.1-53Miroslav Grepl 3.12.1-52Miroslav Grepl 3.12.1-51Miroslav Grepl 3.12.1-50Miroslav Grepl 3.12.1-49Miroslav Grepl 3.12.1-48Miroslav Grepl 3.12.1-47Miroslav Grepl 3.12.1-46Miroslav Grepl 3.12.1-45Miroslav Grepl 3.12.1-44Miroslav Grepl 3.12.1-43Miroslav Grepl 3.12.1-42Miroslav Grepl 3.12.1-41Miroslav Grepl 3.12.1-40Miroslav Grepl 3.12.1-39Miroslav Grepl 3.12.1-38Miroslav Grepl 3.12.1-37Miroslav Grepl 3.12.1-36Miroslav Grepl 3.12.1-35Miroslav Grepl 3.12.1-34Miroslav Grepl 3.12.1-33Miroslav Grepl 3.12.1-32Miroslav Grepl 3.12.1-31Miroslav Grepl 3.12.1-30Miroslav Grepl 3.12.1-29Dan Walsh 3.12.1-28Dan Walsh 3.12.1-27Miroslav Grepl 3.12.1-26Miroslav Grepl 3.12.1-25Miroslav Grepl 3.12.1-24Miroslav Grepl 3.12.1-23Miroslav Grepl 3.12.1-22Miroslav Grepl 3.12.1-21Miroslav Grepl 3.12.1-20Miroslav Grepl 3.12.1-19Miroslav Grepl 3.12.1-18Miroslav Grepl 3.12.1-17Miroslav Grepl 3.12.1-16Miroslav Grepl 3.12.1-15Miroslav Grepl 3.12.1-14Miroslav Grepl 3.12.1-13Miroslav Grepl 3.12.1-12Miroslav Grepl 3.12.1-11Miroslav Grepl 3.12.1-10Miroslav Grepl 3.12.1-9Miroslav Grepl 3.12.1-8Miroslav Grepl 3.12.1-7Miroslav Grepl 3.12.1-6Miroslav Grepl 3.12.1-5Miroslav Grepl 3.12.1-4Miroslav Grepl 3.12.1-3Miroslav Grepl 3.12.1-2Miroslav Grepl 3.12.1-1Dan Walsh 3.11.1-69.1Miroslav Grepl 3.11.1-69Miroslav Grepl 3.11.1-68Miroslav Grepl 3.11.1-67Miroslav Grepl 3.11.1-66Miroslav Grepl 3.11.1-65Miroslav Grepl 3.11.1-64Miroslav Grepl 3.11.1-63Miroslav Grepl 3.11.1-62Miroslav Grepl 3.11.1-61Miroslav Grepl 3.11.1-60Miroslav Grepl 3.11.1-59Miroslav Grepl 3.11.1-58Miroslav Grepl 3.11.1-57Miroslav Grepl 3.11.1-56Miroslav Grepl 3.11.1-55Miroslav Grepl 3.11.1-54Miroslav Grepl 3.11.1-53Miroslav Grepl 3.11.1-52Miroslav Grepl 3.11.1-51Miroslav Grepl 3.11.1-50Miroslav Grepl 3.11.1-49Miroslav Grepl 3.11.1-48Miroslav Grepl 3.11.1-47Miroslav Grepl 3.11.1-46Miroslav Grepl 3.11.1-45Miroslav Grepl 3.11.1-44Miroslav Grepl 3.11.1-43Miroslav Grepl 3.11.1-42Miroslav Grepl 3.11.1-41Miroslav Grepl 3.11.1-40Miroslav Grepl 3.11.1-39Miroslav Grepl 3.11.1-38Miroslav Grepl 3.11.1-37Miroslav Grepl 3.11.1-36Miroslav Grepl 3.11.1-35Miroslav Grepl 3.11.1-34Miroslav Grepl 3.11.1-33Miroslav Grepl 3.11.1-32Miroslav Grepl 3.11.1-31Miroslav Grepl 3.11.1-30Miroslav Grepl 3.11.1-29Miroslav Grepl 3.11.1-28Miroslav Grepl 3.11.1-27Miroslav Grepl 3.11.1-26Miroslav Grepl 3.11.1-25Miroslav Grepl 3.11.1-24Miroslav Grepl 3.11.1-23Miroslav Grepl 3.11.1-22Miroslav Grepl 3.11.1-21Miroslav Grepl 3.11.1-20Miroslav Grepl 3.11.1-19Miroslav Grepl 3.11.1-18Miroslav Grepl 3.11.1-17Miroslav Grepl 3.11.1-16Dan Walsh 3.11.1-15Miroslav Grepl 3.11.1-14Dan Walsh 3.11.1-13Miroslav Grepl 3.11.1-12Miroslav Grepl 3.11.1-11Miroslav Grepl 3.11.1-10Dan Walsh 3.11.1-9Dan Walsh 3.11.1-8Dan Walsh 3.11.1-7Dan Walsh 3.11.1-6Miroslav Grepl 3.11.1-5Miroslav Grepl 3.11.1-4Miroslav Grepl 3.11.1-3Miroslav Grepl 3.11.1-2Miroslav Grepl 3.11.1-1Miroslav Grepl 3.11.1-0Miroslav Grepl 3.11.0-15Miroslav Grepl 3.11.0-14Miroslav Grepl 3.11.0-13Miroslav Grepl 3.11.0-12Fedora Release Engineering - 3.11.0-11Miroslav Grepl 3.11.0-10Miroslav Grepl 3.11.0-9Miroslav Grepl 3.11.0-8Miroslav Grepl 3.11.0-7Miroslav Grepl 3.11.0-6Miroslav Grepl 3.11.0-5Miroslav Grepl 3.11.0-4Miroslav Grepl 3.11.0-3Miroslav Grepl 3.11.0-2Miroslav Grepl 3.11.0-1Miroslav Grepl 3.10.0-128Miroslav Grepl 3.10.0-127Miroslav Grepl 3.10.0-126Miroslav Grepl 3.10.0-125Miroslav Grepl 3.10.0-124Miroslav Grepl 3.10.0-123Miroslav Grepl 3.10.0-122Miroslav Grepl 3.10.0-121Miroslav Grepl 3.10.0-120Miroslav Grepl 3.10.0-119Miroslav Grepl 3.10.0-118Miroslav Grepl 3.10.0-117Miroslav Grepl 3.10.0-116Miroslav Grepl 3.10.0-115Miroslav Grepl 3.10.0-114Miroslav Grepl 3.10.0-113Miroslav Grepl 3.10.0-112Miroslav Grepl 3.10.0-111Miroslav Grepl 3.10.0-110Miroslav Grepl 3.10.0-109Miroslav Grepl 3.10.0-108Miroslav Grepl 3.10.0-107Miroslav Grepl 3.10.0-106Miroslav Grepl 3.10.0-105Miroslav Grepl 3.10.0-104Miroslav Grepl 3.10.0-103Miroslav Grepl 3.10.0-102Miroslav Grepl 3.10.0-101Miroslav Grepl 3.10.0-100Miroslav Grepl 3.10.0-99Miroslav Grepl 3.10.0-98Miroslav Grepl 3.10.0-97Miroslav Grepl 3.10.0-96Miroslav Grepl 3.10.0-95Miroslav Grepl 3.10.0-94Miroslav Grepl 3.10.0-93Miroslav Grepl 3.10.0-92Miroslav Grepl 3.10.0-91Miroslav Grepl 3.10.0-90Miroslav Grepl 3.10.0-89Miroslav Grepl 3.10.0-88Miroslav Grepl 3.10.0-87Miroslav Grepl 3.10.0-86Miroslav Grepl 3.10.0-85Miroslav Grepl 3.10.0-84Miroslav Grepl 3.10.0-83Miroslav Grepl 3.10.0-82Dan Walsh 3.10.0-81.2Miroslav Grepl 3.10.0-81Miroslav Grepl 3.10.0-80Miroslav Grepl 3.10.0-79Miroslav Grepl 3.10.0-78Miroslav Grepl 3.10.0-77Miroslav Grepl 3.10.0-76Miroslav Grepl 3.10.0-75Dan Walsh 3.10.0-74.2Miroslav Grepl 3.10.0-74Miroslav Grepl 3.10.0-73Miroslav Grepl 3.10.0-72Miroslav Grepl 3.10.0-71Miroslav Grepl 3.10.0-70Miroslav Grepl 3.10.0-69Miroslav Grepl 3.10.0-68Miroslav Grepl 3.10.0-67Miroslav Grepl 3.10.0-66Miroslav Grepl 3.10.0-65Miroslav Grepl 3.10.0-64Miroslav Grepl 3.10.0-63Miroslav Grepl 3.10.0-59Miroslav Grepl 3.10.0-58Dan Walsh 3.10.0-57Dan Walsh 3.10.0-56Dan Walsh 3.10.0-55.2Dan Walsh 3.10.0-55.1Miroslav Grepl 3.10.0-55Dan Walsh 3.10.0-54.1Miroslav Grepl 3.10.0-54Dan Walsh 3.10.0-53.1Miroslav Grepl 3.10.0-53Miroslav Grepl 3.10.0-52Miroslav Grepl 3.10.0-51Dan Walsh 3.10.0-50.2Dan Walsh 3.10.0-50.1Miroslav Grepl 3.10.0-50Miroslav Grepl 3.10.0-49Miroslav Grepl 3.10.0-48Miroslav Grepl 3.10.0-47Dan Walsh 3.10.0-46.1Miroslav Grepl 3.10.0-46Dan Walsh 3.10.0-45.1Miroslav Grepl 3.10.0-45Miroslav Grepl 3.10.0-43Miroslav Grepl 3.10.0-42Miroslav Grepl 3.10.0-41Dan Walsh 3.10.0-40.2Miroslav Grepl 3.10.0-40Dan Walsh 3.10.0-39.3Dan Walsh 3.10.0-39.2Dan Walsh 3.10.0-39.1Miroslav Grepl 3.10.0-39Dan Walsh 3.10.0-38.1Miroslav Grepl 3.10.0-38Miroslav Grepl 3.10.0-37Dan Walsh 3.10.0-36.1Miroslav Grepl 3.10.0-36Dan Walsh 3.10.0-35Dan Walsh 3.10.0-34.7Dan Walsh 3.10.0-34.6Dan Walsh 3.10.0-34.4Miroslav Grepl 3.10.0-34.3Dan Walsh 3.10.0-34.2Dan Walsh 3.10.0-34.1Miroslav Grepl 3.10.0-34Miroslav Grepl 3.10.0-33Dan Walsh 3.10.0-31.1Miroslav Grepl 3.10.0-31Miroslav Grepl 3.10.0-29Miroslav Grepl 3.10.0-28Miroslav Grepl 3.10.0-27Miroslav Grepl 3.10.0-26Miroslav Grepl 3.10.0-25Miroslav Grepl 3.10.0-24Miroslav Grepl 3.10.0-23Miroslav Grepl 3.10.0-22Miroslav Grepl 3.10.0-21Dan Walsh 3.10.0-20Miroslav Grepl 3.10.0-19Miroslav Grepl 3.10.0-18Miroslav Grepl 3.10.0-17Miroslav Grepl 3.10.0-16Miroslav Grepl 3.10.0-14Miroslav Grepl 3.10.0-13Miroslav Grepl 3.10.0-12Miroslav Grepl 3.10.0-11Miroslav Grepl 3.10.0-10Miroslav Grepl 3.10.0-9Miroslav Grepl 3.10.0-8Miroslav Grepl 3.10.0-7Miroslav Grepl 3.10.0-6Miroslav Grepl 3.10.0-5Miroslav Grepl 3.10.0-4Miroslav Grepl 3.10.0-3Miroslav Grepl 3.10.0-2Miroslav Grepl 3.10.0-1Miroslav Grepl 3.9.16-30Dan Walsh 3.9.16-29.1Miroslav Grepl 3.9.16-29Dan Walsh 3.9.16-28.1Miroslav Grepl 3.9.16-27Miroslav Grepl 3.9.16-26Miroslav Grepl 3.9.16-25Miroslav Grepl 3.9.16-24Miroslav Grepl 3.9.16-23Miroslav Grepl 3.9.16-22Miroslav Grepl 3.9.16-21Miroslav Grepl 3.9.16-20Miroslav Grepl 3.9.16-19Miroslav Grepl 3.9.16-18Miroslav Grepl 3.9.16-17Dan Walsh 3.9.16-16.1Miroslav Grepl 3.9.16-16Miroslav Grepl 3.9.16-15Miroslav Grepl 3.9.16-14Miroslav Grepl 3.9.16-13Miroslav Grepl 3.9.16-12Miroslav Grepl 3.9.16-11Miroslav Grepl 3.9.16-10Miroslav Grepl 3.9.16-7Miroslav Grepl 3.9.16-6Miroslav Grepl 3.9.16-5Miroslav Grepl 3.9.16-4Miroslav Grepl 3.9.16-3Miroslav Grepl 3.9.16-2Miroslav Grepl 3.9.16-1Miroslav Grepl 3.9.15-5Miroslav Grepl 3.9.15-2Miroslav Grepl 3.9.15-1Fedora Release Engineering - 3.9.14-2Dan Walsh 3.9.14-1Miroslav Grepl 3.9.13-10Miroslav Grepl 3.9.13-9Dan Walsh 3.9.13-8Miroslav Grepl 3.9.13-7Miroslav Grepl 3.9.13-6Miroslav Grepl 3.9.13-5Miroslav Grepl 3.9.13-4Miroslav Grepl 3.9.13-3Miroslav Grepl 3.9.13-2Miroslav Grepl 3.9.13-1Miroslav Grepl 3.9.12-8Miroslav Grepl 3.9.12-7Miroslav Grepl 3.9.12-6Miroslav Grepl 3.9.12-5Dan Walsh 3.9.12-4Dan Walsh 3.9.12-3Dan Walsh 3.9.12-2Miroslav Grepl 3.9.12-1Dan Walsh 3.9.11-2Miroslav Grepl 3.9.11-1Miroslav Grepl 3.9.10-13Dan Walsh 3.9.10-12Miroslav Grepl 3.9.10-11Miroslav Grepl 3.9.10-10Miroslav Grepl 3.9.10-9Miroslav Grepl 3.9.10-8Miroslav Grepl 3.9.10-7Miroslav Grepl 3.9.10-6Miroslav Grepl 3.9.10-5Dan Walsh 3.9.10-4Miroslav Grepl 3.9.10-3Miroslav Grepl 3.9.10-2Miroslav Grepl 3.9.10-1Miroslav Grepl 3.9.9-4Dan Walsh 3.9.9-3Miroslav Grepl 3.9.9-2Miroslav Grepl 3.9.9-1Miroslav Grepl 3.9.8-7Dan Walsh 3.9.8-6Miroslav Grepl 3.9.8-5Miroslav Grepl 3.9.8-4Dan Walsh 3.9.8-3Dan Walsh 3.9.8-2Dan Walsh 3.9.8-1Dan Walsh 3.9.7-10Dan Walsh 3.9.7-9Dan Walsh 3.9.7-8Dan Walsh 3.9.7-7Dan Walsh 3.9.7-6Dan Walsh 3.9.7-5Dan Walsh 3.9.7-4Dan Walsh 3.9.7-3Dan Walsh 3.9.7-2Dan Walsh 3.9.7-1Dan Walsh 3.9.6-3Dan Walsh 3.9.6-2Dan Walsh 3.9.6-1Dan Walsh 3.9.5-11Dan Walsh 3.9.5-10Dan Walsh 3.9.5-9Dan Walsh 3.9.5-8Dan Walsh 3.9.5-7Dan Walsh 3.9.5-6Dan Walsh 3.9.5-5Dan Walsh 3.9.5-4Dan Walsh 3.9.5-3Dan Walsh 3.9.5-2Dan Walsh 3.9.5-1Dan Walsh 3.9.4-3Dan Walsh 3.9.4-2Dan Walsh 3.9.4-1Dan Walsh 3.9.3-4Dan Walsh 3.9.3-3Dan Walsh 3.9.3-2Dan Walsh 3.9.3-1Dan Walsh 3.9.2-1Dan Walsh 3.9.1-3Dan Walsh 3.9.1-2Dan Walsh 3.9.1-1Dan Walsh 3.9.0-2Dan Walsh 3.9.0-1Dan Walsh 3.8.8-21Dan Walsh 3.8.8-20Dan Walsh 3.8.8-19Dan Walsh 3.8.8-18Dan Walsh 3.8.8-17Dan Walsh 3.8.8-16Dan Walsh 3.8.8-15Dan Walsh 3.8.8-14Dan Walsh 3.8.8-13Dan Walsh 3.8.8-12Dan Walsh 3.8.8-11Dan Walsh 3.8.8-10Dan Walsh 3.8.8-9Dan Walsh 3.8.8-8Dan Walsh 3.8.8-7Dan Walsh 3.8.8-6Dan Walsh 3.8.8-5Dan Walsh 3.8.8-4Dan Walsh 3.8.8-3Dan Walsh 3.8.8-2Dan Walsh 3.8.8-1Dan Walsh 3.8.7-3Dan Walsh 3.8.7-2Dan Walsh 3.8.7-1Dan Walsh 3.8.6-3Miroslav Grepl 3.8.6-2Dan Walsh 3.8.6-1Dan Walsh 3.8.5-1Dan Walsh 3.8.4-1Dan Walsh 3.8.3-4Dan Walsh 3.8.3-3Dan Walsh 3.8.3-2Dan Walsh 3.8.3-1Dan Walsh 3.8.2-1Dan Walsh 3.8.1-5Dan Walsh 3.8.1-4Dan Walsh 3.8.1-3Dan Walsh 3.8.1-2Dan Walsh 3.8.1-1Dan Walsh 3.7.19-22Dan Walsh 3.7.19-21Dan Walsh 3.7.19-20Dan Walsh 3.7.19-19Dan Walsh 3.7.19-17Dan Walsh 3.7.19-16Dan Walsh 3.7.19-15Dan Walsh 3.7.19-14Dan Walsh 3.7.19-13Dan Walsh 3.7.19-12Dan Walsh 3.7.19-11Dan Walsh 3.7.19-10Dan Walsh 3.7.19-9Dan Walsh 3.7.19-8Dan Walsh 3.7.19-7Dan Walsh 3.7.19-6Dan Walsh 3.7.19-5Dan Walsh 3.7.19-4Dan Walsh 3.7.19-3Dan Walsh 3.7.19-2Dan Walsh 3.7.19-1Dan Walsh 3.7.18-3Dan Walsh 3.7.18-2Dan Walsh 3.7.18-1Dan Walsh 3.7.17-6Dan Walsh 3.7.17-5Dan Walsh 3.7.17-4Dan Walsh 3.7.17-3Dan Walsh 3.7.17-2Dan Walsh 3.7.17-1Dan Walsh 3.7.16-2Dan Walsh 3.7.16-1Dan Walsh 3.7.15-4Dan Walsh 3.7.15-3Dan Walsh 3.7.15-2Dan Walsh 3.7.15-1Dan Walsh 3.7.14-5Dan Walsh 3.7.14-4Dan Walsh 3.7.14-3Dan Walsh 3.7.14-2Dan Walsh 3.7.14-1Dan Walsh 3.7.13-4Dan Walsh 3.7.13-3Dan Walsh 3.7.13-2Dan Walsh 3.7.13-1Dan Walsh 3.7.12-1Dan Walsh 3.7.11-1Dan Walsh 3.7.10-5Dan Walsh 3.7.10-4Dan Walsh 3.7.10-3Dan Walsh 3.7.10-2Dan Walsh 3.7.10-1Dan Walsh 3.7.9-4Dan Walsh 3.7.9-3Dan Walsh 3.7.9-2Dan Walsh 3.7.9-1Dan Walsh 3.7.8-11Dan Walsh 3.7.8-9Dan Walsh 3.7.8-8Dan Walsh 3.7.8-7Dan Walsh 3.7.8-6Dan Walsh 3.7.8-5Dan Walsh 3.7.8-4Dan Walsh 3.7.8-3Dan Walsh 3.7.8-2Dan Walsh 3.7.8-1Dan Walsh 3.7.7-3Dan Walsh 3.7.7-2Dan Walsh 3.7.7-1Dan Walsh 3.7.6-1Dan Walsh 3.7.5-8Dan Walsh 3.7.5-7Dan Walsh 3.7.5-6Dan Walsh 3.7.5-5Dan Walsh 3.7.5-4Dan Walsh 3.7.5-3Dan Walsh 3.7.5-2Dan Walsh 3.7.5-1Dan Walsh 3.7.4-4Dan Walsh 3.7.4-3Dan Walsh 3.7.4-2Dan Walsh 3.7.4-1Dan Walsh 3.7.3-1Dan Walsh 3.7.1-1Dan Walsh 3.6.33-2Dan Walsh 3.6.33-1Dan Walsh 3.6.32-17Dan Walsh 3.6.32-16Dan Walsh 3.6.32-15Dan Walsh 3.6.32-13Dan Walsh 3.6.32-12Dan Walsh 3.6.32-11Dan Walsh 3.6.32-10Dan Walsh 3.6.32-9Dan Walsh 3.6.32-8Dan Walsh 3.6.32-7Dan Walsh 3.6.32-6Dan Walsh 3.6.32-5Dan Walsh 3.6.32-4Dan Walsh 3.6.32-3Dan Walsh 3.6.32-2Dan Walsh 3.6.32-1Dan Walsh 3.6.31-5Dan Walsh 3.6.31-4Dan Walsh 3.6.31-3Dan Walsh 3.6.31-2Dan Walsh 3.6.30-6Dan Walsh 3.6.30-5Dan Walsh 3.6.30-4Dan Walsh 3.6.30-3Dan Walsh 3.6.30-2Dan Walsh 3.6.30-1Dan Walsh 3.6.29-2Dan Walsh 3.6.29-1Dan Walsh 3.6.28-9Dan Walsh 3.6.28-8Dan Walsh 3.6.28-7Dan Walsh 3.6.28-6Dan Walsh 3.6.28-5Dan Walsh 3.6.28-4Dan Walsh 3.6.28-3Dan Walsh 3.6.28-2Dan Walsh 3.6.28-1Dan Walsh 3.6.27-1Dan Walsh 3.6.26-11Dan Walsh 3.6.26-10Dan Walsh 3.6.26-9Bill Nottingham 3.6.26-8Dan Walsh 3.6.26-7Dan Walsh 3.6.26-6Dan Walsh 3.6.26-5Dan Walsh 3.6.26-4Dan Walsh 3.6.26-3Dan Walsh 3.6.26-2Dan Walsh 3.6.26-1Dan Walsh 3.6.25-1Dan Walsh 3.6.24-1Dan Walsh 3.6.23-2Dan Walsh 3.6.23-1Dan Walsh 3.6.22-3Dan Walsh 3.6.22-1Dan Walsh 3.6.21-4Dan Walsh 3.6.21-3Tom "spot" Callaway 3.6.21-2Dan Walsh 3.6.21-1Dan Walsh 3.6.20-2Dan Walsh 3.6.20-1Dan Walsh 3.6.19-5Dan Walsh 3.6.19-4Dan Walsh 3.6.19-3Dan Walsh 3.6.19-2Dan Walsh 3.6.19-1Dan Walsh 3.6.18-1Dan Walsh 3.6.17-1Dan Walsh 3.6.16-4Dan Walsh 3.6.16-3Dan Walsh 3.6.16-2Dan Walsh 3.6.16-1Dan Walsh 3.6.14-3Dan Walsh 3.6.14-2Dan Walsh 3.6.14-1Dan Walsh 3.6.13-3Dan Walsh 3.6.13-2Dan Walsh 3.6.13-1Dan Walsh 3.6.12-39Dan Walsh 3.6.12-38Dan Walsh 3.6.12-37Dan Walsh 3.6.12-36Dan Walsh 3.6.12-35Dan Walsh 3.6.12-34Dan Walsh 3.6.12-33Dan Walsh 3.6.12-31Dan Walsh 3.6.12-30Dan Walsh 3.6.12-29Dan Walsh 3.6.12-28Dan Walsh 3.6.12-27Dan Walsh 3.6.12-26Dan Walsh 3.6.12-25Dan Walsh 3.6.12-24Dan Walsh 3.6.12-23Dan Walsh 3.6.12-22Dan Walsh 3.6.12-21Dan Walsh 3.6.12-20Dan Walsh 3.6.12-19Dan Walsh 3.6.12-16Dan Walsh 3.6.12-15Dan Walsh 3.6.12-14Dan Walsh 3.6.12-13Dan Walsh 3.6.12-12Dan Walsh 3.6.12-11Dan Walsh 3.6.12-10Dan Walsh 3.6.12-9Dan Walsh 3.6.12-8Dan Walsh 3.6.12-7Dan Walsh 3.6.12-6Dan Walsh 3.6.12-5Dan Walsh 3.6.12-4Dan Walsh 3.6.12-3Dan Walsh 3.6.12-2Dan Walsh 3.6.12-1Dan Walsh 3.6.11-1Dan Walsh 3.6.10-9Dan Walsh 3.6.10-8Dan Walsh 3.6.10-7Dan Walsh 3.6.10-6Dan Walsh 3.6.10-5Dan Walsh 3.6.10-4Dan Walsh 3.6.10-3Dan Walsh 3.6.10-2Dan Walsh 3.6.10-1Dan Walsh 3.6.9-4Dan Walsh 3.6.9-3Dan Walsh 3.6.9-2Dan Walsh 3.6.9-1Dan Walsh 3.6.8-4Dan Walsh 3.6.8-3Dan Walsh 3.6.8-2Dan Walsh 3.6.8-1Dan Walsh 3.6.7-2Dan Walsh 3.6.7-1Dan Walsh 3.6.6-9Dan Walsh 3.6.6-8Fedora Release Engineering - 3.6.6-7Dan Walsh 3.6.6-6Dan Walsh 3.6.6-5Dan Walsh 3.6.6-4Dan Walsh 3.6.6-3Dan Walsh 3.6.6-2Dan Walsh 3.6.6-1Dan Walsh 3.6.5-3Dan Walsh 3.6.5-1Dan Walsh 3.6.4-6Dan Walsh 3.6.4-5Dan Walsh 3.6.4-4Dan Walsh 3.6.4-3Dan Walsh 3.6.4-2Dan Walsh 3.6.4-1Dan Walsh 3.6.3-13Dan Walsh 3.6.3-12Dan Walsh 3.6.3-11Dan Walsh 3.6.3-10Dan Walsh 3.6.3-9Dan Walsh 3.6.3-8Dan Walsh 3.6.3-7Dan Walsh 3.6.3-6Dan Walsh 3.6.3-3Dan Walsh 3.6.3-2Dan Walsh 3.6.3-1Dan Walsh 3.6.2-5Dan Walsh 3.6.2-4Dan Walsh 3.6.2-3Dan Walsh 3.6.2-2Dan Walsh 3.6.2-1Dan Walsh 3.6.1-15Dan Walsh 3.6.1-14Dan Walsh 3.6.1-13Dan Walsh 3.6.1-12Dan Walsh 3.6.1-11Dan Walsh 3.6.1-10Dan Walsh 3.6.1-9Dan Walsh 3.6.1-8Dan Walsh 3.6.1-7Dan Walsh 3.6.1-4Ignacio Vazquez-Abrams - 3.6.1-2Dan Walsh 3.5.13-19Dan Walsh 3.5.13-18Dan Walsh 3.5.13-17Dan Walsh 3.5.13-16Dan Walsh 3.5.13-15Dan Walsh 3.5.13-14Dan Walsh 3.5.13-13Dan Walsh 3.5.13-12Dan Walsh 3.5.13-11Dan Walsh 3.5.13-9Dan Walsh 3.5.13-8Dan Walsh 3.5.13-7Dan Walsh 3.5.13-6Dan Walsh 3.5.13-5Dan Walsh 3.5.13-4Dan Walsh 3.5.13-3Dan Walsh 3.5.13-2Dan Walsh 3.5.13-1Dan Walsh 3.5.12-3Dan Walsh 3.5.12-2Dan Walsh 3.5.12-1Dan Walsh 3.5.11-1Dan Walsh 3.5.10-3Dan Walsh 3.5.10-2Dan Walsh 3.5.10-1Dan Walsh 3.5.9-4Dan Walsh 3.5.9-3Dan Walsh 3.5.9-2Dan Walsh 3.5.9-1Dan Walsh 3.5.8-7Dan Walsh 3.5.8-6Dan Walsh 3.5.8-5Dan Walsh 3.5.8-4Dan Walsh 3.5.8-3Dan Walsh 3.5.8-1Dan Walsh 3.5.7-2Dan Walsh 3.5.7-1Dan Walsh 3.5.6-2Dan Walsh 3.5.6-1Dan Walsh 3.5.5-4Dan Walsh 3.5.5-3Dan Walsh 3.5.5-2Dan Walsh 3.5.4-2Dan Walsh 3.5.4-1Dan Walsh 3.5.3-1Dan Walsh 3.5.2-2Dan Walsh 3.5.1-5Dan Walsh 3.5.1-4Dan Walsh 3.5.1-3Dan Walsh 3.5.1-2Dan Walsh 3.5.1-1Dan Walsh 3.5.0-1Dan Walsh 3.4.2-14Dan Walsh 3.4.2-13Dan Walsh 3.4.2-12Dan Walsh 3.4.2-11Dan Walsh 3.4.2-10Dan Walsh 3.4.2-9Dan Walsh 3.4.2-8Dan Walsh 3.4.2-7Dan Walsh 3.4.2-6Dan Walsh 3.4.2-5Dan Walsh 3.4.2-4Dan Walsh 3.4.2-3Dan Walsh 3.4.2-2Dan Walsh 3.4.2-1Dan Walsh 3.4.1-5Dan Walsh 3.4.1-3Dan Walsh 3.4.1-2Dan Walsh 3.4.1-1Dan Walsh 3.3.1-48Dan Walsh 3.3.1-47Dan Walsh 3.3.1-46Dan Walsh 3.3.1-45Dan Walsh 3.3.1-44Dan Walsh 3.3.1-43Dan Walsh 3.3.1-42Dan Walsh 3.3.1-41Dan Walsh 3.3.1-39Dan Walsh 3.3.1-37Dan Walsh 3.3.1-36Dan Walsh 3.3.1-33Dan Walsh 3.3.1-32Dan Walsh 3.3.1-31Dan Walsh 3.3.1-30Dan Walsh 3.3.1-29Dan Walsh 3.3.1-28Dan Walsh 3.3.1-27Dan Walsh 3.3.1-26Dan Walsh 3.3.1-25Dan Walsh 3.3.1-24Dan Walsh 3.3.1-23Dan Walsh 3.3.1-22Dan Walsh 3.3.1-21Dan Walsh 3.3.1-20Dan Walsh 3.3.1-19Dan Walsh 3.3.1-18Dan Walsh 3.3.1-17Dan Walsh 3.3.1-16Dan Walsh 3.3.1-15Bill Nottingham 3.3.1-14Dan Walsh 3.3.1-13Dan Walsh 3.3.1-12Dan Walsh 3.3.1-11Dan Walsh 3.3.1-10Dan Walsh 3.3.1-9Dan Walsh 3.3.1-8Dan Walsh 3.3.1-6Dan Walsh 3.3.1-5Dan Walsh 3.3.1-4Dan Walsh 3.3.1-2Dan Walsh 3.3.1-1Dan Walsh 3.3.0-2Dan Walsh 3.3.0-1Dan Walsh 3.2.9-2Dan Walsh 3.2.9-1Dan Walsh 3.2.8-2Dan Walsh 3.2.8-1Dan Walsh 3.2.7-6Dan Walsh 3.2.7-5Dan Walsh 3.2.7-3Dan Walsh 3.2.7-2Dan Walsh 3.2.7-1Dan Walsh 3.2.6-7Dan Walsh 3.2.6-6Dan Walsh 3.2.6-5Dan Walsh 3.2.6-4Dan Walsh 3.2.6-3Dan Walsh 3.2.6-2Dan Walsh 3.2.6-1Dan Walsh 3.2.5-25Dan Walsh 3.2.5-24Dan Walsh 3.2.5-22Dan Walsh 3.2.5-21Dan Walsh 3.2.5-20Dan Walsh 3.2.5-19Dan Walsh 3.2.5-18Dan Walsh 3.2.5-17Dan Walsh 3.2.5-16Dan Walsh 3.2.5-15Dan Walsh 3.2.5-14Dan Walsh 3.2.5-13Dan Walsh 3.2.5-12Dan Walsh 3.2.5-11Dan Walsh 3.2.5-10Dan Walsh 3.2.5-9Dan Walsh 3.2.5-8Dan Walsh 3.2.5-7Dan Walsh 3.2.5-6Dan Walsh 3.2.5-5Dan Walsh 3.2.5-4Dan Walsh 3.2.5-3Dan Walsh 3.2.5-2Dan Walsh 3.2.5-1Dan Walsh 3.2.4-5Dan Walsh 3.2.4-4Dan Walsh 3.2.4-3Dan Walsh 3.2.4-1Dan Walsh 3.2.4-1Dan Walsh 3.2.3-2Dan Walsh 3.2.3-1Dan Walsh 3.2.2-1Dan Walsh 3.2.1-3Dan Walsh 3.2.1-1Dan Walsh 3.1.2-2Dan Walsh 3.1.2-1Dan Walsh 3.1.1-1Dan Walsh 3.1.0-1Dan Walsh 3.0.8-30Dan Walsh 3.0.8-28Dan Walsh 3.0.8-27Dan Walsh 3.0.8-26Dan Walsh 3.0.8-25Dan Walsh 3.0.8-24Dan Walsh 3.0.8-23Dan Walsh 3.0.8-22Dan Walsh 3.0.8-21Dan Walsh 3.0.8-20Dan Walsh 3.0.8-19Dan Walsh 3.0.8-18Dan Walsh 3.0.8-17Dan Walsh 3.0.8-16Dan Walsh 3.0.8-15Dan Walsh 3.0.8-14Dan Walsh 3.0.8-13Dan Walsh 3.0.8-12Dan Walsh 3.0.8-11Dan Walsh 3.0.8-10Dan Walsh 3.0.8-9Dan Walsh 3.0.8-8Dan Walsh 3.0.8-7Dan Walsh 3.0.8-5Dan Walsh 3.0.8-4Dan Walsh 3.0.8-3Dan Walsh 3.0.8-2Dan Walsh 3.0.8-1Dan Walsh 3.0.7-10Dan Walsh 3.0.7-9Dan Walsh 3.0.7-8Dan Walsh 3.0.7-7Dan Walsh 3.0.7-6Dan Walsh 3.0.7-5Dan Walsh 3.0.7-4Dan Walsh 3.0.7-3Dan Walsh 3.0.7-2Dan Walsh 3.0.7-1Dan Walsh 3.0.6-3Dan Walsh 3.0.6-2Dan Walsh 3.0.6-1Dan Walsh 3.0.5-11Dan Walsh 3.0.5-10Dan Walsh 3.0.5-9Dan Walsh 3.0.5-8Dan Walsh 3.0.5-7Dan Walsh 3.0.5-6Dan Walsh 3.0.5-5Dan Walsh 3.0.5-4Dan Walsh 3.0.5-3Dan Walsh 3.0.5-2Dan Walsh 3.0.5-1Dan Walsh 3.0.4-6Dan Walsh 3.0.4-5Dan Walsh 3.0.4-4Dan Walsh 3.0.4-3Dan Walsh 3.0.4-2Dan Walsh 3.0.4-1Dan Walsh 3.0.3-6Dan Walsh 3.0.3-5Dan Walsh 3.0.3-4Dan Walsh 3.0.3-3Dan Walsh 3.0.3-2Dan Walsh 3.0.3-1Dan Walsh 3.0.2-9Dan Walsh 3.0.2-8Dan Walsh 3.0.2-7Dan Walsh 3.0.2-5Dan Walsh 3.0.2-4Dan Walsh 3.0.2-3Dan Walsh 3.0.2-2Dan Walsh 3.0.1-5Dan Walsh 3.0.1-4Dan Walsh 3.0.1-3Dan Walsh 3.0.1-2Dan Walsh 3.0.1-1Dan Walsh 2.6.5-3Dan Walsh 2.6.5-2Dan Walsh 2.6.4-7Dan Walsh 2.6.4-6Dan Walsh 2.6.4-5Dan Walsh 2.6.4-2Dan Walsh 2.6.4-1Dan Walsh 2.6.3-1Dan Walsh 2.6.2-1Dan Walsh 2.6.1-4Dan Walsh 2.6.1-2Dan Walsh 2.6.1-1Dan Walsh 2.5.12-12Dan Walsh 2.5.12-11Dan Walsh 2.5.12-10Dan Walsh 2.5.12-8Dan Walsh 2.5.12-5Dan Walsh 2.5.12-4Dan Walsh 2.5.12-3Dan Walsh 2.5.12-2Dan Walsh 2.5.12-1Dan Walsh 2.5.11-8Dan Walsh 2.5.11-7Dan Walsh 2.5.11-6Dan Walsh 2.5.11-5Dan Walsh 2.5.11-4Dan Walsh 2.5.11-3Dan Walsh 2.5.11-2Dan Walsh 2.5.11-1Dan Walsh 2.5.10-2Dan Walsh 2.5.10-1Dan Walsh 2.5.9-6Dan Walsh 2.5.9-5Dan Walsh 2.5.9-4Dan Walsh 2.5.9-3Dan Walsh 2.5.9-2Dan Walsh 2.5.8-8Dan Walsh 2.5.8-7Dan Walsh 2.5.8-6Dan Walsh 2.5.8-5Dan Walsh 2.5.8-4Dan Walsh 2.5.8-3Dan Walsh 2.5.8-2Dan Walsh 2.5.8-1Dan Walsh 2.5.7-1Dan Walsh 2.5.6-1Dan Walsh 2.5.5-2Dan Walsh 2.5.5-1Dan Walsh 2.5.4-2Dan Walsh 2.5.4-1Dan Walsh 2.5.3-3Dan Walsh 2.5.3-2Dan Walsh 2.5.3-1Dan Walsh 2.5.2-6Dan Walsh 2.5.2-5Dan Walsh 2.5.2-4Dan Walsh 2.5.2-3Dan Walsh 2.5.2-2Dan Walsh 2.5.2-1Dan Walsh 2.5.1-5Dan Walsh 2.5.1-4Dan Walsh 2.5.1-2Dan Walsh 2.5.1-1Dan Walsh 2.4.6-20Dan Walsh 2.4.6-19Dan Walsh 2.4.6-18Dan Walsh 2.4.6-17Dan Walsh 2.4.6-16Dan Walsh 2.4.6-15Dan Walsh 2.4.6-14Dan Walsh 2.4.6-13Dan Walsh 2.4.6-12Dan Walsh 2.4.6-11Dan Walsh 2.4.6-10Dan Walsh 2.4.6-9Dan Walsh 2.4.6-8Dan Walsh 2.4.6-7Dan Walsh 2.4.6-6Dan Walsh 2.4.6-5Dan Walsh 2.4.6-4Dan Walsh 2.4.6-3Dan Walsh 2.4.6-1Dan Walsh 2.4.5-4Dan Walsh 2.4.5-3Dan Walsh 2.4.5-2Dan Walsh 2.4.5-1Dan Walsh 2.4.4-2Dan Walsh 2.4.4-2Dan Walsh 2.4.4-1Dan Walsh 2.4.3-13Dan Walsh 2.4.3-12Dan Walsh 2.4.3-11Dan Walsh 2.4.3-10Dan Walsh 2.4.3-9Dan Walsh 2.4.3-8Dan Walsh 2.4.3-7Dan Walsh 2.4.3-6Dan Walsh 2.4.3-5Dan Walsh 2.4.3-4Dan Walsh 2.4.3-3Dan Walsh 2.4.3-2Dan Walsh 2.4.3-1Dan Walsh 2.4.2-8Dan Walsh 2.4.2-7James Antill 2.4.2-6Dan Walsh 2.4.2-5Dan Walsh 2.4.2-4Dan Walsh 2.4.2-3Dan Walsh 2.4.2-2Dan Walsh 2.4.2-1Dan Walsh 2.4.1-5Dan Walsh 2.4.1-4Dan Walsh 2.4.1-3Dan Walsh 2.4.1-2Dan Walsh 2.4-4Dan Walsh 2.4-3Dan Walsh 2.4-2Dan Walsh 2.4-1Dan Walsh 2.3.19-4Dan Walsh 2.3.19-3Dan Walsh 2.3.19-2Dan Walsh 2.3.19-1James Antill 2.3.18-10James Antill 2.3.18-9Dan Walsh 2.3.18-8Dan Walsh 2.3.18-7Dan Walsh 2.3.18-6Dan Walsh 2.3.18-5Dan Walsh 2.3.18-4Dan Walsh 2.3.18-3Dan Walsh 2.3.18-2Dan Walsh 2.3.18-1Dan Walsh 2.3.17-2Dan Walsh 2.3.17-1Dan Walsh 2.3.16-9Dan Walsh 2.3.16-8Dan Walsh 2.3.16-7Dan Walsh 2.3.16-6Dan Walsh 2.3.16-5Dan Walsh 2.3.16-4Dan Walsh 2.3.16-2Dan Walsh 2.3.16-1Dan Walsh 2.3.15-2Dan Walsh 2.3.15-1Dan Walsh 2.3.14-8Dan Walsh 2.3.14-7Dan Walsh 2.3.14-6Dan Walsh 2.3.14-4Dan Walsh 2.3.14-3Dan Walsh 2.3.14-2Dan Walsh 2.3.14-1Dan Walsh 2.3.13-6Dan Walsh 2.3.13-5Dan Walsh 2.3.13-4Dan Walsh 2.3.13-3Dan Walsh 2.3.13-2Dan Walsh 2.3.13-1Dan Walsh 2.3.12-2Dan Walsh 2.3.12-1Dan Walsh 2.3.11-1Dan Walsh 2.3.10-7Dan Walsh 2.3.10-6Dan Walsh 2.3.10-3Dan Walsh 2.3.10-1Dan Walsh 2.3.9-6Dan Walsh 2.3.9-5Dan Walsh 2.3.9-4Dan Walsh 2.3.9-3Dan Walsh 2.3.9-2Dan Walsh 2.3.9-1Dan Walsh 2.3.8-2Dan Walsh 2.3.7-1Dan Walsh 2.3.6-4Dan Walsh 2.3.6-3Dan Walsh 2.3.6-2Dan Walsh 2.3.6-1Dan Walsh 2.3.5-1Dan Walsh 2.3.4-1Dan Walsh 2.3.3-20Dan Walsh 2.3.3-19Dan Walsh 2.3.3-18Dan Walsh 2.3.3-17Dan Walsh 2.3.3-16Dan Walsh 2.3.3-15Dan Walsh 2.3.3-14Dan Walsh 2.3.3-13Dan Walsh 2.3.3-12Dan Walsh 2.3.3-11Dan Walsh 2.3.3-10Dan Walsh 2.3.3-9Dan Walsh 2.3.3-8Dan Walsh 2.3.3-7Dan Walsh 2.3.3-6Dan Walsh 2.3.3-5Dan Walsh 2.3.3-4Dan Walsh 2.3.3-3Dan Walsh 2.3.3-2Dan Walsh 2.3.3-1Dan Walsh 2.3.2-4Dan Walsh 2.3.2-3Dan Walsh 2.3.2-2Dan Walsh 2.3.2-1Dan Walsh 2.3.1-1Dan Walsh 2.2.49-1Dan Walsh 2.2.48-1Dan Walsh 2.2.47-5Dan Walsh 2.2.47-4Dan Walsh 2.2.47-3Dan Walsh 2.2.47-1Dan Walsh 2.2.46-2Dan Walsh 2.2.46-1Dan Walsh 2.2.45-3Dan Walsh 2.2.45-2Dan Walsh 2.2.45-1Dan Walsh 2.2.44-1Dan Walsh 2.2.43-4Dan Walsh 2.2.43-3Dan Walsh 2.2.43-2Dan Walsh 2.2.43-1Dan Walsh 2.2.42-4Dan Walsh 2.2.42-3Dan Walsh 2.2.42-2Dan Walsh 2.2.42-1Dan Walsh 2.2.41-1Dan Walsh 2.2.40-2Dan Walsh 2.2.40-1Dan Walsh 2.2.39-2Dan Walsh 2.2.39-1Dan Walsh 2.2.38-6Dan Walsh 2.2.38-5Dan Walsh 2.2.38-4Dan Walsh 2.2.38-3Dan Walsh 2.2.38-2Dan Walsh 2.2.38-1Dan Walsh 2.2.37-1Dan Walsh 2.2.36-2Dan Walsh 2.2.36-1James Antill 2.2.35-2Dan Walsh 2.2.35-1Dan Walsh 2.2.34-3Dan Walsh 2.2.34-2Dan Walsh 2.2.34-1Dan Walsh 2.2.33-1Dan Walsh 2.2.32-2Dan Walsh 2.2.32-1Dan Walsh 2.2.31-1Dan Walsh 2.2.30-2Dan Walsh 2.2.30-1Dan Walsh 2.2.29-6Russell Coker 2.2.29-5Dan Walsh 2.2.29-4Dan Walsh 2.2.29-3Dan Walsh 2.2.29-2Dan Walsh 2.2.29-1Dan Walsh 2.2.28-3Dan Walsh 2.2.28-2Dan Walsh 2.2.28-1Dan Walsh 2.2.27-1Dan Walsh 2.2.25-3Dan Walsh 2.2.25-2Dan Walsh 2.2.24-1Dan Walsh 2.2.23-19Dan Walsh 2.2.23-18Dan Walsh 2.2.23-17Karsten Hopp 2.2.23-16Dan Walsh 2.2.23-15Dan Walsh 2.2.23-14Dan Walsh 2.2.23-13Dan Walsh 2.2.23-12Jeremy Katz - 2.2.23-11Jeremy Katz - 2.2.23-10Dan Walsh 2.2.23-9Dan Walsh 2.2.23-8Dan Walsh 2.2.23-7Dan Walsh 2.2.23-5Dan Walsh 2.2.23-4Dan Walsh 2.2.23-3Dan Walsh 2.2.23-2Dan Walsh 2.2.23-1Dan Walsh 2.2.22-2Dan Walsh 2.2.22-1Dan Walsh 2.2.21-9Dan Walsh 2.2.21-8Dan Walsh 2.2.21-7Dan Walsh 2.2.21-6Dan Walsh 2.2.21-5Dan Walsh 2.2.21-4Dan Walsh 2.2.21-3Dan Walsh 2.2.21-2Dan Walsh 2.2.21-1Dan Walsh 2.2.20-1Dan Walsh 2.2.19-2Dan Walsh 2.2.19-1Dan Walsh 2.2.18-2Dan Walsh 2.2.18-1Dan Walsh 2.2.17-2Dan Walsh 2.2.16-1Dan Walsh 2.2.15-4Dan Walsh 2.2.15-3Dan Walsh 2.2.15-1Dan Walsh 2.2.14-2Dan Walsh 2.2.14-1Dan Walsh 2.2.13-1Dan Walsh 2.2.12-1Dan Walsh 2.2.11-2Dan Walsh 2.2.11-1Dan Walsh 2.2.10-1Dan Walsh 2.2.9-2Dan Walsh 2.2.9-1Dan Walsh 2.2.8-2Dan Walsh 2.2.7-1Dan Walsh 2.2.6-3Dan Walsh 2.2.6-2Dan Walsh 2.2.6-1Dan Walsh 2.2.5-1Dan Walsh 2.2.4-1Dan Walsh 2.2.3-1Dan Walsh 2.2.2-1Dan Walsh 2.2.1-1Dan Walsh 2.1.13-1Dan Walsh 2.1.12-3Dan Walsh 2.1.11-1Dan Walsh 2.1.10-1Jeremy Katz - 2.1.9-2Dan Walsh 2.1.9-1Dan Walsh 2.1.8-3Dan Walsh 2.1.8-2Dan Walsh 2.1.8-1Dan Walsh 2.1.7-4Dan Walsh 2.1.7-3Dan Walsh 2.1.7-2Dan Walsh 2.1.7-1Dan Walsh 2.1.6-24Dan Walsh 2.1.6-23Dan Walsh 2.1.6-22Dan Walsh 2.1.6-21Dan Walsh 2.1.6-20Dan Walsh 2.1.6-18Dan Walsh 2.1.6-17Dan Walsh 2.1.6-16Dan Walsh 2.1.6-15Dan Walsh 2.1.6-14Dan Walsh 2.1.6-13Dan Walsh 2.1.6-11Dan Walsh 2.1.6-10Dan Walsh 2.1.6-9Dan Walsh 2.1.6-8Dan Walsh 2.1.6-5Dan Walsh 2.1.6-4Dan Walsh 2.1.6-3Dan Walsh 2.1.6-2Dan Walsh 2.1.6-1Dan Walsh 2.1.4-2Dan Walsh 2.1.4-1Dan Walsh 2.1.3-1Jeremy Katz - 2.1.2-3Dan Walsh 2.1.2-2Dan Walsh 2.1.2-1Dan Walsh 2.1.1-3Dan Walsh 2.1.1-2Dan Walsh 2.1.1-1Dan Walsh 2.1.0-3Dan Walsh 2.1.0-2.Dan Walsh 2.1.0-1.Dan Walsh 2.0.11-2.Dan Walsh 2.0.11-1.Dan Walsh 2.0.9-1.Dan Walsh 2.0.8-1.Dan Walsh 2.0.7-3Dan Walsh 2.0.7-2Dan Walsh 2.0.6-2Dan Walsh 2.0.5-4Dan Walsh 2.0.5-1Dan Walsh 2.0.4-1Dan Walsh 2.0.2-2Dan Walsh 2.0.2-1Dan Walsh 2.0.1-2Dan Walsh 2.0.1-1- Allow sbd_t domain to use nsswitch Resolves: rhbz#1728592- Allow nrpe_t domain to read process state of systemd_logind_t - Alow nrpe_t to send signull to sssd domain when nagios_run_sudo boolean is turned on - Allow nrpe_t domain to be dbus cliennt - Allow ngaios to use chown capability Resolves: rhbz#1692893- Update Nagios policy when sudo is used Resolves: rhbz#1692893- Allow modemmanager_t domain to write to raw_ip file labeled as sysfs_t Resolves: rhbz#1697868- Update nagios_run_sudo boolean with few allow rules related to accessing sssd Resolves: rhbz#1692893- Allow sudodomains to write to systemd_logind_sessions_t pipes. Resolves: rhbz#1688224- Allow gssd_t domain to manage kernel keyrings of every domain. Resolves: rhbz#1665815 - Add new interface domain_manage_all_domains_keyrings() Resolves: rhbz#1665815- Add interface domain_rw_all_domains_keyrings() Resolves: rhbz#1665815 - Allow gssd_t domain to read/write kernel keyrings of every domain. Resolves: rhbz#1665815- Update snapperd policy to allow snapperd manage all non security dirs. Resolves: rhbz#1661158- Allow nova_t domain to use pam Resolves: rhbz:#1645270 - sysstat: grant sysstat_t the search_dir_perms set Resolves: rhbz#1645271- Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module Resolves: rhbz#1638257- Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging' Resolves: rhbz#1638427- Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t Resolves: rhbz#1638257- Fix missing patch in spec file Resolves: rhbz#1635704- Allow cinder_volume_t domain to dbus chat with systemd_logind_t domain Resolves: rhbz#1635704- Allow neutron domain to read/write /var/run/utmp Resolves: rhbz#1630318- Allow tomcat_domain to read /dev/random Resolves: rhbz#1631666 - Allow neutron_t domain to use pam Resolves: rhbz#1630318- Add interface apache_read_tmp_dirs() - Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs Resolves: rhbz#1622602- Allow tomcat servers to manage usr_t files Resolves: rhbz#1625678 - Dontaudit tomcat serves to append to /dev/random device Resolves: rhbz#1625678 - Allow sys_nice capability to mysqld_t domain - Allow dirsrvadmin_script_t domain to read httpd tmp files Resolves: rhbz#1622602 - Allow syslogd_t domain to manage cert_t files Resolves: rhbz#1615995- Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs Resolves: rhbz#1627114 - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t Resolves: rhbz#1567753- Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs. Resolves: rhbz#1625678 - Allow chronyd_t domain to read virt_var_lib_t files - Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333) Resolves: rhbz#1625613 - Allow tomcat services create link file in /tmp Resolves: rhbz#1624289 - Add boolean: domain_can_mmap_files. Resolves: rhbz#1460322- Make working SELinux sandbox with Wayland. Resolves: rhbz#1624308 - Allow svirt_t domain to mmap svirt_image_t block files Resolves: rhbz#1624224 - Add caps dac_read_search and dav_override to pesign_t domain - Allow iscsid_t domain to mmap userio chr files Resolves: rhbz#1623589 - Add boolean: domain_can_mmap_files. Resolves: rhbz#1460322 - Add execute_no_trans permission to mmap_exec_file_perms pattern - Allow sudodomain to search caller domain proc info - Allow xdm_t domain to mmap and read cert_t files - Replace optional policy blocks to make dbus interfaces effective Resolves: rhbz#1624414 - Add interface dev_map_userio_dev()- Allow readhead_t domain to mmap own pid files Resolves: rhbz#1614169- Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket - Allow httpd_t domain to mmap tmp files Resolves: rhbz#1608355 - Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files - Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks - Label /dev/tpmrm[0-9]* as tpm_device_t - Allow semanage_t domain mmap usr_t files Resolves: rhbz#1622607 - Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t- Allow nagios_script_t domain to mmap nagios_log_t files Resolves: rhbz#1620013 - Allow nagios_script_t domain to mmap nagios_spool_t files Resolves: rhbz#1620013 - Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctl Resolves: rhbz#1622197 - Update selinux_validate_context() interface to allow caller domain to mmap security_t files Resolves: rhbz#1622061- Allow virtd_t domain to create netlink_socket - Allow rpm_t domain to write to audit - Allow rpm domain to mmap rpm_var_lib_t files Resolves: rhbz#1619785 - Allow nagios_script_t domain to mmap nagios_etc_t files Resolves: rhbz#1620013 - Update nscd_socket_use() to allow caller domain to stream connect to nscd_t Resolves: rhbz#1460715 - Allow secadm_t domain to mmap audit config and log files - Allow insmod_t domain to read iptables pid files - Allow systemd to mounton /etc Resolves: rhbz#1619785- Allow kdumpctl_t domain to getattr fixed disk device in mls Resolves: rhbz#1615342 - Allow initrc_domain to mmap all binaries labeled as systemprocess_entry Resolves: rhbz#1615342- Allow virtlogd to execute itself Resolves: rhbz#1598392- Allow kdumpctl_t domain to manage kdumpctl_tmp_t fifo files Resolves: rhbz#1615342 - Allow kdumpctl to write to files on all levels Resolves: rhbz#1615342 - Fix typo in radius policy Resolves: rhbz#1619197 - Allow httpd_t domain to mmap httpd_config_t files Resolves: rhbz#1615894 - Add interface dbus_acquire_svc_system_dbusd() - Allow sanlock_t domain to connectto to unix_stream_socket Resolves: rhbz#1614965 - Update nfsd_t policy because of ganesha features Resolves: rhbz#1511489 - Allow conman to getattr devpts_t Resolves: rhbz#1377915 - Allow tomcat_domain to connect to smtp ports Resolves: rhbz#1253502 - Allow tomcat_t domain to mmap tomcat_var_lib_t files Resolves: rhbz#1618519 - Allow slapd_t domain to mmap slapd_var_run_t files Resolves: rhbz#1615319 - Allow nagios_t domain to mmap nagios_log_t files Resolves: rhbz#1618675 - Allow nagios to exec itself and mmap nagios spool files BZ(1559683) - Allow nagios to mmap nagios config files BZ(1559683) - Allow kpropd_t domain to mmap krb5kdc_principal_t files Resolves: rhbz#1619252 - Update syslogd policy to make working elasticsearch - Label tcp and udp ports 9200 as wap_wsp_port - Allow few domains to rw inherited kdumpctl tmp pipes Resolves: rhbz#1615342- Allow systemd_dbusd_t domain read/write to nvme devices Resolves: rhbz#1614236 - Allow mysqld_safe_t do execute itself - Allow smbd_t domain to chat via dbus with avahi daemon Resolves: rhbz#1600157 - cupsd_t domain will create /etc/cupsd/ppd as cupsd_etc_rw_t Resolves: rhbz#1452595 - Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645) Resolves: rhbz#1452444 - Update screen_role_template to allow caller domain to have screen_exec_t as entrypoint do new domain Resolves: rhbz#1384769 - Add alias httpd__script_t to _script_t to make sepolicy generate working Resolves: rhbz#1271324 - Allow kprop_t domain to read network state Resolves: rhbz#1600705 - Allow sysadm_t domain to accept socket Resolves: rhbz#1557299 - Allow sshd_t domain to mmap user_tmp_t files Resolves: rhbz#1613437- Allow sshd_t domain to mmap user_tmp_t files Resolves: rhbz#1613437- Allow kprop_t domain to read network state Resolves: rhbz#1600705- Allow kpropd domain to exec itself Resolves: rhbz#1600705 - Allow ipmievd_t to mmap kernel modules BZ(1552535) - Allow hsqldb_t domain to mmap own temp files Resolves: rhbz#1612143 - Allow hsqldb_t domain to read cgroup files Resolves: rhbz#1612143 - Allow rngd_t domain to read generic certs Resolves: rhbz#1612456 - Allow innd_t domain to mmap own var_lib_t files Resolves: rhbz#1600591 - Update screen_role_temaplate interface Resolves: rhbz#1384769 - Allow cupsd_t to create cupsd_etc_t dirs Resolves: rhbz#1452595 - Allow chronyd_t domain to mmap own tmpfs files Resolves: rhbz#1596563 - Allow cyrus domain to mmap own var_lib_t and var_run files Resolves: rhbz#1610374 - Allow sysadm_t domain to create rawip sockets Resolves: rhbz#1571591 - Allow sysadm_t domain to listen on socket Resolves: rhbz#1557299 - Update sudo_role_template() to allow caller domain also setattr generic ptys Resolves: rhbz#1564470 - Allow netutils_t domain to create bluetooth sockets Resolves: rhbz#1600586- Allow innd_t domain to mmap own var_lib_t files Resolves: rhbz#1600591 - Update screen_role_temaplate interface Resolves: rhbz#1384769 - Allow cupsd_t to create cupsd_etc_t dirs Resolves: rhbz#1452595 - Allow chronyd_t domain to mmap own tmpfs files Resolves: rhbz#1596563 - Allow cyrus domain to mmap own var_lib_t and var_run files Resolves: rhbz#1610374 - Allow sysadm_t domain to create rawip sockets Resolves: rhbz#1571591 - Allow sysadm_t domain to listen on socket Resolves: rhbz#1557299 - Update sudo_role_template() to allow caller domain also setattr generic ptys Resolves: rhbz#1564470 - Allow netutils_t domain to create bluetooth sockets Resolves: rhbz#1600586- Allow virtlogd_t domain to chat via dbus with systemd_logind Resolves: rhbz#1593740- Allow sblim_sfcbd_t domain to mmap own tmpfs files Resolves: rhbz#1609384 - Update logging_manage_all_logs() interface to allow caller domain map all logfiles Resolves: rhbz#1592028- Dontaudit oracleasm_t domain to request sys_admin capability - Allow iscsid_t domain to load kernel module Resolves: rhbz#1589295 - Update rhcs contexts to reflects the latest fenced changes - Allow httpd_t domain to rw user_tmp_t files Resolves: rhbz#1608355 - /usr/libexec/udisks2/udisksd should be labeled as devicekit_disk_exec_t Resolves: rhbz#1521063 - Allow tangd_t dac_read_search Resolves: rhbz#1607810 - Allow glusterd_t domain to mmap user_tmp_t files - Allow mongodb_t domain to mmap own var_lib_t files Resolves: rhbz#1607729 - Allow iscsid_t domain to mmap sysfs_t files Resolves: rhbz#1602508 - Allow tomcat_domain to search cgroup dirs Resolves: rhbz#1600188 - Allow httpd_t domain to mmap own cache files Resolves: rhbz#1603505 - Allow cupsd_t domain to mmap cupsd_etc_t files Resolves: rhbz#1599694 - Allow kadmind_t domain to mmap krb5kdc_principal_t Resolves: rhbz#1601004 - Allow virtlogd_t domain to read virt_etc_t link files Resolves: rhbz#1598593 - Allow dirsrv_t domain to read crack db Resolves: rhbz#1599726 - Dontaudit pegasus_t to require sys_admin capability Resolves: rhbz#1374570 - Allow mysqld_t domain to exec mysqld_exec_t binary files - Allow abrt_t odmain to read rhsmcertd lib files Resolves: rhbz#1601389 - Allow winbind_t domain to request kernel module loads Resolves: rhbz#1599236 - Allow gpsd_t domain to getsession and mmap own tmpfs files Resolves: rhbz#1598388 - Allow smbd_t send to nmbd_t via dgram sockets BZ(1563791) Resolves: rhbz#1600157 - Allow tomcat_domain to read cgroup_t files Resolves: rhbz#1601151 - Allow varnishlog_t domain to mmap varnishd_var_lib_t files Resolves: rhbz#1600704 - Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415) Resolves: rhbz#1600692 - Fix ntp SELinux module - Allow innd_t domain to mmap news_spool_t files Resolves: rhbz#1600591 - Allow haproxy daemon to reexec itself. BZ(1447800) Resolves: rhbz#1600578 - Label HOME_DIR/mozilla.pdf file as mozilla_home_t instead of user_home_t Resolves: rhbz#1559859 - Allow pkcs_slotd_t domain to mmap own tmpfs files Resolves: rhbz#1600434 - Allow fenced_t domain to reboot Resolves: rhbz#1293384 - Allow bluetooth_t domain listen on bluetooth sockets BZ(1549247) Resolves: rhbz#1557299 - Allow lircd to use nsswitch. BZ(1401375) - Allow targetd_t domain mmap lvm config files Resolves: rhbz#1546671 - Allow amanda_t domain to read network system state Resolves: rhbz#1452444 - Allow abrt_t domain to read rhsmcertd logs Resolves: rhbz#1492059 - Allow application_domain_type also mmap inherited user temp files BZ(1552765) Resolves: rhbz#1608421 - Allow ipsec_t domain to read l2tpd pid files Resolves: rhbz#1607994 - Allow systemd_tmpfiles_t do mmap system db files - Improve domain_transition_pattern to allow mmap entrypoint bin file. Resolves: rhbz#1460322 - Allow nsswitch_domain to mmap passwd_file_t files BZ(1518655) Resolves: rhbz#1600528 - Dontaudit syslogd to watching top llevel dirs when imfile module is enabled Resolves: rhbz#1601928 - Allow ipsec_t can exec ipsec_exec_t Resolves: rhbz#1600684 - Allow netutils_t domain to mmap usmmon device Resolves: rhbz#1600586 - Allow netlabel_mgmt_t domain to read sssd public files, stream connect to sssd_t BZ(1483655) - Allow userdomain sudo domains to use generic ptys Resolves: rhbz#1564470 - Allow traceroute to create icmp packets Resolves: rhbz#1548350 - Allow systemd domain to mmap lvm config files BZ(1594584) - Add new interface lvm_map_config - refpolicy: Update for kernel sctp support Resolves: rhbz#1597111 Add additional entries to support the kernel SCTP implementation introduced in kernel 4.16- Update oddjob_domtrans_mkhomedir() interface to allow caller domain also mmap oddjob_mkhomedir_exec_t files Resolves: rhbz#1596306 - Update rhcs_rw_cluster_tmpfs() interface to allow caller domain to mmap cluster_tmpfs_t files Resolves: rhbz#1589257 - Allow radiusd_t domain to read network sysctls Resolves: rhbz#1516233 - Allow chronyc_t domain to use nscd shm Resolves: rhbz#1596563 - Label /var/lib/tomcats dir as tomcat_var_lib_t Resolves: rhbz#1596367 - Allow lsmd_t domain to mmap lsmd_plugin_exec_t files Resolves: rhbz#bea0c8174 - Label /usr/sbin/rhn_check-[0-9]+.[0-9]+ as rpm_exec_t Resolves: rhbz#1596509 - Update seutil_exec_loadpolicy() interface to allow caller domain to mmap load_policy_exec_t files Resolves: rhbz#1596072 - Allow xdm_t to read systemd hwdb Resolves: rhbz#1596720 - Allow dhcpc_t domain to mmap files labeled as ping_exec_t Resolves: rhbz#1596065- Allow tangd_t domain to create tcp sockets Resolves: rhbz#1595775 - Update postfix policy to allow postfix_master_t domain to mmap all postfix* binaries Resolves: rhbz#1595328 - Allow amanda_t domain to have setgid capability Resolves: rhbz#1452444 - Update usermanage_domtrans_useradd() to allow caller domain to mmap useradd_exec_t files Resolves: rhbz#1595667- Allow abrt_watch_log_t domain to mmap binaries with label abrt_dump_oops_exec_t Resolves: rhbz#1591191 - Update cups_filetrans_named_content() to allow caller domain create ppd directory with cupsd_etc_rw_t label Resolves: rhbz#1452595 - Allow abrt_t domain to write to rhsmcertd pid files Resolves: rhbz#1492059 - Allow pegasus_t domain to eexec lvm binaries and allow read/write access to lvm control Resolves: rhbz#1463470 - Add vhostmd_t domain to read/write to svirt images Resolves: rhbz#1465276 - Dontaudit action when abrt-hook-ccpp is writing to nscd sockets Resolves: rhbz#1460715 - Update openvswitch policy Resolves: rhbz#1594729 - Update kdump_manage_kdumpctl_tmp_files() interface to allow caller domain also mmap kdumpctl_tmp_t files Resolves: rhbz#1583084 - Allow sssd_t and slpad_t domains to mmap generic certs Resolves: rhbz#1592016 Resolves: rhbz#1592019 - Allow oddjob_t domain to mmap binary files as oddjob_mkhomedir_exec_t files Resolves: rhbz#1592022 - Update dbus_system_domain() interface to allow system_dbusd_t domain to mmap binary file from second parameter Resolves: rhbz#1583080 - Allow chronyc_t domain use inherited user ttys Resolves: rhbz#1593267 - Allow stapserver_t domain to mmap own tmp files Resolves: rhbz#1593122 - Allow sssd_t domain to mmap files labeled as sssd_selinux_manager_exec_t Resolves: rhbz#1592026 - Update policy for ypserv_t domain Resolves: rhbz#1592032 - Allow abrt_dump_oops_t domain to mmap all non security files Resolves: rhbz#1593728 - Allow svirt_t domain mmap svirt_image_t files Resolves: rhbz#1592688 - Allow virtlogd_t domain to write inhibit systemd pipes. Resolves: rhbz#1593740 - Allow sysadm_t and staff_t domains to use sudo io logging Resolves: rhbz#1564470 - Allow sysadm_t domain create sctp sockets Resolves: rhbz#1571591 - Update mount_domtrans() interface to allow caller domain mmap mount_exec_t Resolves: rhbz#1592025 - Allow dhcpc_t to mmap all binaries with label hostname_exec_t, ifconfig_exec_t and netutils_exec_t Resolves: rhbz#1594661- Fix typo in logwatch interface file - Allow spamd_t to manage logwatch_cache_t files/dirs - Allow dnsmasw_t domain to create own tmp files and manage mnt files - Allow fail2ban_client_t to inherit rlimit information from parent process Resolves: rhbz#1513100 - Allow nscd_t to read kernel sysctls Resolves: rhbz#1512852 - Label /var/log/conman.d as conman_log_t Resolves: rhbz#1538363 - Add dac_override capability to tor_t domain Resolves: rhbz#1540711 - Allow certmonger_t to readwrite to user_tmp_t dirs Resolves: rhbz#1543382 - Allow abrt_upload_watch_t domain to read general certs Resolves: rhbz#1545098 - Update postfix_domtrans_master() interface to allow caller domain also mmap postfix_master_exec_t binary Resolves: rhbz#1583087 - Allow postfix_domain to mmap postfix_qmgr_exec_t binaries Resolves: rhbz#1583088 - Allow postfix_domain to mmap postfix_pickup_exec_t binaries Resolves: rhbz#1583091 - Allow chornyd_t read phc2sys_t shared memory Resolves: rhbz#1578883 - Allow virt_qemu_ga_t read utmp Resolves: rhbz#1571202 - Add several allow rules for pesign policy: Resolves: rhbz#1468744 - Allow pesign domain to read /dev/random - Allow pesign domain to create netlink_kobject_uevent_t sockets - Allow pesign domain create own tmp files - Add setgid and setuid capabilities to mysqlfd_safe_t domain Resolves: rhbz#1474440 - Add tomcat_can_network_connect_db boolean Resolves: rhbz#1477948 - Update virt_use_sanlock() boolean to read sanlock state Resolves: rhbz#1448799 - Add sanlock_read_state() interface - Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026) Resolves: rhbz#1563423 - Update abrt_domtrans and abrt_exec() interfaces to allow caller domain to mmap binary file Resolves:rhbz#1583080 - Update nscd_domtrans and nscd_exec interfaces to allow caller domain also mmap nscd binaries Resolves: rhbz#1583086 - Update snapperd_domtrans() interface to allow caller domain to mmap snapperd_exec_t file Resolves: rhbz#1583802 - Allow zoneminder_t to getattr of fs_t Resolves: rhbz#1585328 - Fix denials during ipa-server-install process on F27+ Resolves: rhbz#1586029 - Allow ipa_dnskey_t to exec ipa_dnskey_exec_t files Resolves: rhbz#1586033 - Allow rhsmcertd_t domain to send signull to postgresql_t domain Resolves: rhbz#1588119 - Allow policykit_t domain to dbus chat with dhcpc_t Resolves: rhbz#1364513 - Adding new boolean keepalived_connect_any() Resolves: rhbz#1443473 - Allow amanda to create own amanda_tmpfs_t files Resolves: rhbz#1452444 - Add amanda_tmpfs_t label. BZ(1243752) - Allow gdomap_t domain to connect to qdomap_port_t Resolves: rhbz#1551944 - Fix typos in sge - Fix typo in openvswitch policy - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type - Allow sshd_keygen_t to execute plymouthd Resolves: rhbz#1583531 - Update seutil_domtrans_setfiles() interface to allow caller domain to do mmap on setfiles_exec_t binary Resolves: rhbz#1583090 - Allow systemd_networkd_t create and relabel tun sockets Resolves: rhbz#1583830 - Allow map audisp_exec_t files fordomains executing this binary Resolves: rhbz#1586042 - Add new interface postgresql_signull() - Add fs_read_xenfs_files() interface.- /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type - Allow dac override capability to mandb_t domain BZ(1529399) Resolves: rhbz#1423361 - Allow inetd_child process to chat via dbus with abrt Resolves: rhbz#1428805 - Allow zabbix_agent_t domain to connect to redis_port_t Resolves: rhbz#1418860 - Allow rhsmcertd_t domain to read xenfs_t files Resolves: rhbz#1405870 - Allow zabbix_agent_t to run zabbix scripts Resolves: rhbz#1380697 - Allow rabbitmq_t domain to create own tmp files/dirs Resolves: rhbz#1546897 - Allow policykit_t mmap policykit_auth_exec_t files Resolves: rhbz#1583082 - Allow ipmievd_t domain to read general certs Resolves: rhbz#1514591 - Add sys_ptrace capability to pcp_pmie_t domain - Allow squid domain to exec ldconfig Resolves: rhbz#1532017 - Make working gpg agent in gpg_agent_t domain Resolves: rhbz#1535109 - Update gpg SELinux policy module - Allow kexec to read kernel module files in /usr/lib/modules. Resolves: rhbz#1536690 - Allow mailman_domain to read system network state Resolves: rhbz#1413510 - Allow mailman_mail_t domain to search for apache configs Resolves: rhbz#1413510 - Allow openvswitch_t domain to read neutron state and read/write fixed disk devices Resolves: rhbz#1499208 - Allow antivirus_domain to read all domain system state Resolves: rhbz#1560986 - Allow targetd_t domain to red gconf_home_t files/dirs Resolves: rhbz#1546671 - Allow freeipmi domain to map sysfs_t files Resolves: rhbz#1575918 - Label /usr/libexec/bluetooth/obexd as obexd_exec_t Resolves: rhbz#1351750 - Update rhcs SELinux module Resolves: rhbz#1589257 - Allow iscsid_t domain mmap kernel modules Resolves: rhbz#1589295 - Allow iscsid_t domain mmap own tmp files Resolves: rhbz#1589295 - Update iscsid_domtrans() interface to allow mmap iscsid_exec_t binary Resolves: rhbz#1589295 - Update nscd_socket_use interface to allow caller domain also mmap nscd_var_run_t files. Resolves: rhbz#1589271 - Allow nscd_t domain to mmap system_db_t files Resolves: rhbz#1589271 - Add interface nagios_unconfined_signull() - Allow lircd_t domain read sssd public files Add setgid capability to lircd_t domain Resolves: rhbz#1550700 - Add missing requires - Allow tomcat domain sends email Resolves: rhbz#1585184 - Allow memcached_t domain nnp_transition becuase of systemd security features BZ(1514867) Resolves: rhbz#1585714 - Allow kdump_t domain to map /boot files Resolves: rhbz#1588884 - Fix typo in netutils policy - Allow confined users get AFS tokens Resolves: rhbz#1417671 - Allow sysadm_t domain to chat via dbus Resolves: rhbz#1582146 - Associate sysctl_kernel_t type with filesystem attribute - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets Resolves: rhbz#1557299 - Allow user_t and staff_t domains create netlink tcpdiag sockets Resolves: rhbz#1557281 - Add interface dev_map_sysfs - Allow xdm_t domain to execute xdm_var_lib_t files Resolves: rhbz#1589139 - Allow syslogd_t domain to send signull to nagios_unconfined_plugin_t Resolves: rhbz#1569344 - Label /dev/vhost-vsock char device as vhost_device_t - Add files_map_boot_files() interface Resolves: rhbz#1588884 - Update traceroute_t domain to allow create dccp sockets Resolves: rhbz#1548350- Update ctdb domain to support gNFS setup Resolves: rhbz#1576818 - Allow authconfig_t dbus chat with policykit Resolves: rhbz#1551241 - Allow lircd_t domain to read passwd_file_t Resolves: rhbz:#1550700 - Allow lircd_t domain to read system state Resolves: rhbz#1550700 - Allow smbcontrol_t to mmap samba_var_t files and allow winbind create sockets BZ(1559795) Resolves: rhbz#1574521 - Allow tangd_t domain read certs Resolves: rhbz#1509055 - Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db is turned on Resolves: rhbz:#1579219 - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp Resolves: rhbz#1574418 - Allow ctdb_t domain modify ctdb_exec_t files Resolves: rhbz#1572584 - Allow chrome_sandbox_t to mmap tmp files Resolves: rhbz#1574392 - Allow ulogd_t to create netlink_netfilter sockets. Resolves: rhbz#1575924 - Update ulogd SELinux security policy - Allow rhsmcertd_t domain send signull to apache processes Resolves: rhbz#1576555 - Allow freeipmi domain to read sysfs_t files Resolves: rhbz#1575918 - Allow smbcontrol_t to create dirs with samba_var_t label Resolves: rhbz#1574521 - Allow swnserve_t domain to stream connect to sasl domain Resolves: rhbz#1574537 - Allow SELinux users (except guest and xguest) to using bluetooth sockets Resolves: rhbz#1557299 - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets Resolves: rhbz#1557299 - Fix broken sysadm SELinux module Resolves: rhbz#1557311 - Allow user_t and staff_t domains create netlink tcpdiag sockets Resolves: rhbz#1557281 - Update ssh_domtrans_keygen interface to allow mmap ssh_keygen_exec_t binary file Resolves: rhbz#1583089 - Allow systemd_networkd_t to read/write tun tap devices Resolves: rhbz#1583830 - Add bridge_socket, dccp_socket, ib_socket and mpls_socket to socket_class_set Resolves: rhbz#1583771 - Allow audisp_t domain to mmap audisp_exec_t binary Resolves: rhbz#1583551 - Fix duplicates in sysadm.te file Resolves: rhbz#1307183 - Allow sysadm_u use xdm Resolves: rhbz#1307183 - Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Fix duplicates in sysadm.te file Resolves: rhbz#1307183- Allow sysadm_u use xdm Resolves: rhbz#1307183- Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db is turned on Resolves: rhbz:#1579219 - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp Resolves: rhbz#1574418 - Allow chrome_sandbox_t to mmap tmp files Resolves: rhbz#1574392 - Allow ulogd_t to create netlink_netfilter sockets. Resolves: rhbz#1575924 - Update ulogd SELinux security policy - Allow rhsmcertd_t domain send signull to apache processes Resolves: rhbz#1576555 - Allow freeipmi domain to read sysfs_t files Resolves: rhbz#1575918 - Allow smbcontrol_t to create dirs with samba_var_t label Resolves: rhbz#1574521 - Allow swnserve_t domain to stream connect to sasl domain Resolves: rhbz#1574537 - Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Improve procmail_domtrans() to allow mmaping procmail_exec_t - Allow hypervvssd_t domain to read fixed disk devices Resolves: rhbz#1581225 - Improve modutils_domtrans_insmod() interface to mmap insmod_exec_t binaries Resolves: rhbz#1581551 - Improve iptables_domtrans() interface to allow mmaping iptables_exec_t binary Resolves: rhbz#1581551 - Improve auth_domtrans_login_programinterface to allow also mmap login_exec_t binaries Resolves: rhbz#1581551 - Improve auth_domtrans_chk_passwd() interface to allow also mmaping chkpwd_exec_t binaries. Resolves: rhbz#1581551 - Allow mmap dhcpc_exec_t binaries in sysnet_domtrans_dhcpc interface- Add dbus_stream_connect_system_dbusd() interface. - Allow pegasus_t domain to mount tracefs_t filesystem Resolves:rhbz#1374570 - Allow psad_t domain to read all domains state Resolves: rhbz#1558439 - Add net_raw capability to named_t domain BZ(1545586) - Allow tomcat_t domain to connect to mongod_t tcp port Resolves:rhbz#1539748 - Allow dovecot and postfix to connect to systemd stream sockets Resolves: rhbz#1368642 - Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t Resolves:rhbz#1351750 - Rename tang policy to tangd - Add interface systemd_rfkill_domtrans() - Allow users staff and sysadm to run wireshark on own domain Resolves:rhbz#1546362 - Allow systemd-bootchart to create own tmpfs files Resolves:rhbz#1510412- Rename tang policy to tangd - Allow virtd_t domain to relabel virt_var_lib_t files Resolves: rhbz#1558121 - Allow logrotate_t domain to stop services via systemd Resolves: rhbz#1527522 - Add tang policy Resolves: rhbz#1509055 - Allow mozilla_plugin_t to create mozilla.pdf file in user homedir with label mozilla_home_t Resolves: rhbz#1559859 - Improve snapperd SELinux policy Resolves: rhbz#1365555 - Allow snapperd_t daemon to create unlabeled dirs. Resolves: rhbz#1365555 - We have inconsistency in cgi templates with upstream, we use _content_t, but refpolicy use httpd__content_t. Created aliasses to make it consistence Resolves: rhbz#1271324 - Allow Openvswitch adding netdev bridge ovs 2.7.2.10 FDP Resolves: rhbz#1503835 - Add new Boolean tomcat_use_execmem Resolves: rhbz#1565226 - Allow domain transition from logrotate_t to chronyc_t Resolves: rhbz#1568281 - Allow nfsd_t domain to read/write sysctl fs files Resolves: rhbz#1516593 - Allow conman to read system state Resolves: rhbz#1377915 - Allow lircd_t to exec shell and add capabilities dac_read_search and dac_override Resolves: rhbz#1550700 - Allow usbmuxd to access /run/udev/data/+usb:*. Resolves: rhbz#1521054 - Allow abrt_t domain to manage kdump crash files Resolves: rhbz#1491585 - Allow systemd to use virtio console Resolves: rhbz#1558121 - Allow transition from sysadm role into mdadm_t domain. Resolves: rhbz#1551568 - Label /dev/op_panel and /dev/opal-prd as opal_device_t Resolves: rhbz#1537618 - Label /run/ebtables.lock as iptables_var_run_t Resolves: rhbz#1511437 - Allow udev_t domain to manage udev_rules_t char files. Resolves: rhbz#1545094 - Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin. Resolves: rhbz#1567753 - Fix filesystem inteface file, we don't have nsfs_fs_t type, just nsfs_t Resolves: rhbz#1547700 - Allow iptables_t domain to create dirs in etc_t with system_conf_t labels- Add new boolean redis_enable_notify() Resolves: rhbz#1421326 - Label /var/log/shibboleth-www(/.*) as httpd_sys_rw_content_t Resolves: rhbz#1549514 - Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/ Resolves: rbhz#1463593 - Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_t Resolves: rbhz#1463593- Backport several changes for snapperdfrom Fedora Rawhide Resolves: rhbz#1556798 - Allow snapperd_t to set priority for kernel processes Resolves: rhbz#1556798 - Make ganesha nfs server. Resolves: rhbz#1511489 - Allow vxfs filesystem to use SELinux labels Resolves: rhbz#1482880 - Add map permission to selinux-policy Resolves: rhbz#1460322- Label /usr/libexec/dbus-1/dbus-daemon-launch-helper as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled. Resolves: rhbz#1546721- Allow openvswitch_t stream connect svirt_t Resolves: rhbz#1540702- Allow openvswitch domain to manage svirt_tmp_t sock files Resolves: rhbz#1540702 - Fix broken systemd_tmpfiles_run() interface- Allow dirsrv_t domain to create tmp link files Resolves: rhbz#1536011 - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t Resolves: rhbz#1428568 - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries - Allow ipsec_mgmt_t nnp domain transition to ifconfig_t Resolves: rhbz#1539416- Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t Resolves: rhbz#1540702 - Allow keepalived_t domain getattr proc filesystem Resolves: rhbz#1477542 - Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t Resolves: rhbz#1538544 - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t Resolves: rhbz:#1539416 - Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t Resolves: rhbz#1479350- Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets Resolves: rhbz#1535196 - Add new interface ppp_filetrans_named_content() Resolves: rhbz#1530601 - Allow keepalived_t read sysctl_net_t files Resolves: rhbz#1477542 - Allow puppetmaster_t domtran to puppetagent_t Resolves: rhbz#1376893 - Allow kdump_t domain to read kernel ring buffer Resolves: rhbz#1540004 - Allow ipsec_t domain to exec ifconfig_exec_t binaries. Resolves: rhbz#1539416 - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock Resolves: rhbz#1530601 - Allow updpwd_t domain to create files in /etc with shadow_t label Resolves: rhbz#1412838 - Allow iptables sysctl load list support with SELinux enforced Resolves: rhbz#1535572- Allow virt_domains to acces infiniband pkeys. Resolves: rhbz#1533183 - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t Resolves: rhbz#1535133 - Allow audisp_remote_t domain write to files on all levels Resolves: rhbz#1534924- Allow vmtools_t domain creating vmware_log_t files Resolves: rhbz#1507048 - Allow openvswitch_t domain to acces infiniband devices Resolves: rhbz#1532705- Allow chronyc_t domain to manage chronyd_keys_t files. Resolves: rhbz#1530525 - Make virtlog_t domain system dbus client Resolves: rhbz#1481109 - Update openvswitch SELinux module Resolves: rhbz#1482682 - Allow virtd_t to create also sock_files with label virt_var_run_t Resolves: rhbz#1484075- Allow domains that manage logfiles to man logdirs Resolves: rhbz#1523811- Label /dev/drm_dp_aux* as xserver_misc_device_t Resolves: rhbz#1520897 - Allow sysadm_t to run puppet_exec_t binaries as puppet_t Resolves: rhbz#1255745- Allow tomcat_t to manage pki_tomcat pid files Resolves: rhbz#1478371 - networkmanager: allow talking to openvswitch Resolves: rhbz#1517247 - Allow networkmanager_t and opensm_t to manage subned endports for IPoIB VLANs Resolves: rhbz#1517895 - Allow domains networkmanager_t and opensm_t to control IPoIB VLANs Resolves: rhbz#1517744 - Fix typo in guest interface file Resolves: rhbz#1468254 - Allow isnsd_t domain to accept tcp connections. Resolves: rhbz#1390208- Allow getty to use usbttys Resolves: rhbz#1514235- Allow ldap_t domain to manage also slapd_tmp_t lnk files Resolves: rhbz#1510883 - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t Resolves: rhbz:#1508360 - Add dac_read_search and dac_override capabilities to ganesha Resolves: rhbz#1483451- Add dependency for policycoreutils-2.5.18 becuase of new cgroup_seclabel policy capability Resolves: rhbz#1510145- Allow jabber domains to connect to postgresql ports Resolves: rhbz#1438489 - Dontaudit accountsd domain creating dirs in /root Resolves: rhbz#1456760 - Dontaudit slapd_t to block suspend system Resolves: rhbz: #1479759 - Allow spamc_t to stream connect to cyrus. Resolves: rhbz#1382955 - allow imapd to read /proc/net/unix file Resolves: rhbz#1393030 - Allow passenger to connect to mysqld_port_t Resolves: rhbz#1433464- Allow chronyc_t domain to use user_ptys Resolves: rhbz#1470150 - allow ptp4l to read /proc/net/unix file - Allow conmand to use usb ttys. Resolves: rhbz#1505121 - Label all files /var/log/opensm.* as opensm_log_t because opensm creating new log files with name opensm-subnet.lst Resolves: rhbz#1505845 - Allow chronyd daemon to execute chronyc. Resolves: rhbz#1508486 - Allow firewalld exec ldconfig. Resolves: rhbz#1375576 - Allow mozilla_plugin_t domain to dbus chat with devicekit Resolves: rhbz#1460477 - Dontaudit leaked logwatch pipes Resolves: rhbz#1450119 - Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon. Resolves: rhbz#1507048 - Allow httpd_t domain to execute hugetlbfs_t files Resolves: rhbz#1507682 - Allow nfsd_t domain to read configfs_t files/dirs Resolves: rhbz#1439442 - Hide all allow rules with ptrace inside deny_ptrace boolean Resolves: rhbz#1421075 - Allow tgtd_t domain to read generic certs Resolves: rhbz#1438532 - Allow ptp4l to send msgs via dgram socket to unprivileged user domains Resolves: rhbz#1429853 - Allow dirsrv_snmp_t to use inherited user ptys and read system state Resolves: rhbz#1428568 - Allow glusterd_t domain to create own tmpfs dirs/files Resolves: rhbz#1411310 - Allow keepalived stream connect to snmp Resolves: rhbz#1401556 - After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy Resolves: rhbz#1507089- Allow pegasus_openlmi_services_t to read generic certs Resolves: rhbz#1462292 - Allow ganesha_t domain to read random device Resolves: rhbz#1494382 - Allow zabbix_t domain to change its resource limits Resolves: rhbz:#1504074 - Add new boolean nagios_use_nfs Resolves: rhbz#1504826 - Allow system_mail_t to search network sysctls Resolves: rhbz#1505779 - Add samba_manage_var_dirs() interface - Fix typo bug in virt filecontext file - Allow nagios_script_t to read nagios_spool_t files Resolves: rhbz#1426824 - Allow samba to manage var dirs/files Resolves: rhbz#1415088 - Allow sbd_t to create own sbd_tmpfs_t dirs/files Resolves: rhbz#1380795 - Allow firewalld and networkmanager to chat with hypervkvp via dbus Resolves: rhbz#1377276 - Allow dmidecode to read rhsmcert_log_t files Resolves: rhbz#1300799 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow pegasus_openlmi_services_t to read generic certs Resolves: rhbz#1462292 - Allow ganesha_t domain to read random device Resolves: rhbz#1494382 - Allow zabbix_t domain to change its resource limits Resolves: rhbz:#1504074 - Add new boolean nagios_use_nfs Resolves: rhbz#1504826 - Allow system_mail_t to search network sysctls Resolves: rhbz#1505779 - Add samba_manage_var_dirs() interface - Fix typo bug in virt filecontext file - Allow nagios_script_t to read nagios_spool_t files Resolves: rhbz#1426824 - Allow samba to manage var dirs/files Resolves: rhbz#1415088 - Allow sbd_t to create own sbd_tmpfs_t dirs/files Resolves: rhbz#1380795 - Allow firewalld and networkmanager to chat with hypervkvp via dbus Resolves: rhbz#1377276 - Allow dmidecode to read rhsmcert_log_t files Resolves: rhbz#1300799 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow chronyd_t do request kernel module and block_suspend capability Resolves: rhbz#1350765 - Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label Resolves: rhbz#1447278 - Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables Resolves: rhbz#1491994 - Allow svnserve to use kerberos Resolves: rhbz#1475271 - Allow conman to use ptmx. Add conman_use_nfs boolean Resolves: rhbz#1377915 - Add nnp transition for services using: NoNewPrivileges systemd security feature Resolves: rhbz#1311430 - Add SELinux support for chronyc Resolves: rhbz#1470150 - Add dac_read_search capability to openvswitch_t domain Resolves: rhbz#1501336 - Allow svnserve to manage own svnserve_log_t files/dirs Resolves: rhbz#1480741 - Allow keepalived_t to search network sysctls Resolves: rhbz#1477542 - Allow puppetagent_t domain dbus chat with rhsmcertd_t domain Resolves: rhbz#1446777 - Add dccp_socket into socker_class_set subset Resolves: rhbz#1459941 - Allow iptables_t to run setfiles to restore context on system Resolves: rhbz#1489118 - Label 20514 tcp/udp ports as syslogd_port_t Label 10514 tcp/udp portas as syslog_tls_port_t Resolves: rhbz:#1411400 - Make nnp transition Active Resolves: rhbz#1480518 - Label tcp 51954 as isns_port_t Resolves: rhbz#1390208 - Add dac_read_search capability chkpwd_t Resolves: rhbz#1376991 - Add support for running certbot(letsencrypt) in crontab Resolves: rhbz#1447278 - Add init_nnp_daemon_domain interface - Allow xdm_t to gettattr /dev/loop-control device Resolves: rhbz#1462925 - Allow nnp trasintion for unconfined_service_t Resolves: rhbz#1311430 - Allow unpriv user domains and unconfined_service_t to use chronyc Resolves: rhbz#1470150 - Allow iptables to exec plymouth. Resolves: rhbz#1480374 - Fix typo in fs_unmount_tracefs interface. Resolves: rhbz#1371057 - Label postgresql-check-db-dir as postgresql_exec_t Resolves: rhbz#1490956- We should not ship selinux-policy with permissivedomains enabled. Resolves: rhbz#1494172 - Fix order of installing selinux-policy-sandbox, because of depedencied in sandbox module, selinux-policy-targeted needs to be installed before selinux-policy-sandbox Resolves: rhbz#1492606- Allow tomcat to setsched Resolves: rhbz#1492730 - Fix rules blocking ipa-server upgrade process Resolves: rhbz#1478371 - Add new boolean tomcat_read_rpm_db() Resolves: rhbz#1477887 - Allow tomcat to connect on mysqld tcp ports - Add ctdbd_t domain sys_source capability and allow setrlimit Resolves: rhbz#1491235 - Fix keepalived SELinux module - Allow automount domain to manage mount pid files Resolves: rhbz#1482381 - Allow stunnel_t domain setsched Resolves: rhbz#1479383 - Add keepalived domain setpgid capability Resolves: rhbz#1486638 - Allow tomcat domain to connect to mssql port Resolves: rhbz#1484572 - Remove snapperd_t from unconfined domaines Resolves: rhbz#1365555 - Fix typo bug in apache module Resolves: rhbz#1397311 - Dontaudit that system_mail_t is trying to read /root/ files Resolves: rhbz#1147945 - Make working webadm_t userdomain Resolves: rhbz#1323792 - Allow redis domain to execute shell scripts. Resolves: rhbz#1421326 - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t Resolves: rhbz#1473303 - Add couple capabilities to keepalived domain and allow get attributes of all domains Resolves: rhbz#1429327 - Allow dmidecode read rhsmcertd lock files Resolves: rhbz#1300799 - Add new interface rhsmcertd_rw_lock_files() Resolves: rhbz#1300799 - Label all plymouthd archives as plymouthd_var_log_t Resolves: rhbz#1478323 - Allow cloud_init_t to dbus chat with systemd_timedated_t Resolves: rhbz#1440730 - Allow logrotate_t to write to kmsg Resolves: rhbz#1397744 - Add capability kill to rhsmcertd_t Resolves: rhbz#1398338 - Disable mysqld_safe_t secure mode environment cleansing. Resolves: rhbz#1464063 - Allow winbind to manage smbd_tmp_t files Resolves: rhbz#1475566 - Dontaudit that system_mail_t is trying to read /root/ files Resolves: rhbz#1147945 - Make working webadm_t userdomain Resolves: rhbz#1323792 - Allow redis domain to execute shell scripts. Resolves: rhbz#1421326 - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t Resolves: rhbz#1473303 - Add couple capabilities to keepalived domain and allow get attributes of all domains Resolves: rhbz#1429327 - Allow dmidecode read rhsmcertd lock files Resolves: rhbz#1300799 - Add new interface rhsmcertd_rw_lock_files() Resolves: rhbz#1300799 - Label all plymouthd archives as plymouthd_var_log_t Resolves: rhbz#1478323 - Allow cloud_init_t to dbus chat with systemd_timedated_t Resolves: rhbz#1440730 - Allow logrotate_t to write to kmsg Resolves: rhbz#1397744 - Add capability kill to rhsmcertd_t Resolves: rhbz#1398338 - Disable mysqld_safe_t secure mode environment cleansing. Resolves: rhbz#1464063 - Allow winbind to manage smbd_tmp_t files Resolves: rhbz#1475566 - Add interface systemd_tmpfiles_run - End of file cannot be in comment - Allow systemd-logind to use ypbind Resolves: rhbz#1479350 - Add creating opasswd file with shadow_t SELinux label in auth_manage_shadow() interface Resolves: rhbz#1412838 - Allow sysctl_irq_t assciate with proc_t Resolves: rhbz#1485909 - Enable cgourp sec labeling Resolves: rhbz#1485947 - Add cgroup_seclabel policycap. Resolves: rhbz#1485947 - Allow sshd_t domain to send signull to xdm_t processes Resolves: rhbz#1448959 - Allow updpwd_t domain auth file name trans Resolves: rhbz#1412838 - Allow sysadm user to run systemd-tmpfiles Resolves: rbhz#1325364 - Add support labeling for vmci and vsock device Resolves: rhbz#1451358 - Add userdom_dontaudit_manage_admin_files() interface Resolves: rhbz#1323792 - Allow iptables_t domain to read files with modules_conf_t label Resolves: rhbz#1373220 - init: Add NoNewPerms support for systemd. Resolves: rhbz#1480518 - Add nnp_nosuid_transition policycap and related class/perm definitions. Resolves: rhbz#1480518 - refpolicy: Infiniband pkeys and endports Resolves: rhbz#1464484- Allow certmonger using systemctl on pki_tomcat unit files Resolves: rhbz#1481388- Allow targetd_t to create own tmp files. - Dontaudit targetd_t to exec rpm binary file. Resolves: rhbz#1373860 Resolves: rhbz#1424621- Add few rules to make working targetd daemon with SELinux Resolves: rhbz#1373860 - Allow ipmievd_t domain to load kernel modules Resolves: rhbz#1441081 - Allow logrotate to reload transient systemd unit Resolves: rhbz#1440515 - Add certwatch_t domain dac_override and dac_read_search capabilities Resolves: rhbz#1422000 - Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain Resolves: rhbz#1412072 - Allow nscd_t domain to search network sysctls Resolves: rhbz#1432361 - Allow iscsid_t domain to read mount pid files Resolves: rhbz#1482097 - Allow ksmtuned_t domain manage sysfs_t files/dirs Resolves: rhbz#1413865 - Allow keepalived_t domain domtrans into iptables_t Resolves: rhbz#1477719 - Allow rshd_t domain reads net sysctls Resolves: rhbz#1477908 - Add interface seutil_dontaudit_read_module_store() - Update interface lvm_rw_pipes() by adding also open permission - Label /dev/clp device as vfio_device_t Resolves: rhbz#1477624 - Allow ifconfig_t domain unmount fs_t Resolves: rhbz#1477445 - Label /dev/gpiochip* devices as gpio_device_t Resolves: rhbz#1477618 - Add interface dev_manage_sysfs() Resolves: rhbz#1474989- Label /usr/libexec/sudo/sesh as shell_exec_t Resolves: rhbz#1480791- Allow tomcat_t domain couple capabilities to make working tomcat-jsvc Resolves: rhbz#1470735- Allow llpdad send dgram to libvirt Resolves: rhbz#1472722- Add new boolean gluster_use_execmem Resolves: rhbz#1469027 - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service Resolves: rhbz#1468581- Dontaudit staff_t user read admin_home_t files. Resolves: rhbz#1290633- Allow couple rules needed to start targetd daemon with SELinux in enforcing mode Resolves: rhbz#1424621 - Add interface lvm_manage_metadata Resolves: rhbz#1424621- Allow sssd_t to read realmd lib files. Resolves: rhbz#1436689 - Add permission open to files_read_inherited_tmp_files() interface Resolves: rhbz#1290633 Resolves: rhbz#1457106- Allow unconfined_t user all user namespace capabilties. Resolves: rhbz#1461488- Allow httpd_t to read realmd_var_lib_t files Resolves: rhbz#1436689- Allow named_t to bind on udp 4321 port Resolves: rhbz#1312972 - Allow systemd-sysctl cap. sys_ptrace Resolves: rhbz#1458999- Allow pki_tomcat_t execute ldconfig. Resolves: rhbz#1436689- Allow iscsi domain load kernel module. Resolves: rhbz#1457874 - Allow keepalived domain connect to squid tcp port Resolves: rhbz#1457455 - Allow krb5kdc_t domain read realmd lib files. Resolves: rhbz#1436689 - xdm_t should view kernel keys Resolves: rhbz#1432645- Allow tomcat to connect on all unreserved ports - Allow ganesha to connect to all rpc ports Resolves: rhbz#1448090 - Update ganesha with another fixes. Resolves: rhbz#1448090 - Update rpc_read_nfs_state_data() interface to allow read also lnk_files. Resolves: rhbz#1448090 - virt_use_glusterd boolean should be in optional block Update ganesha module to allow create tmp files Resolves: rhbz#1448090 - Hide broken symptoms when machine is configured with network bounding.- Add new boolean virt_use_glusterd Resolves: rhbz#1455994 - Add capability sys_boot for sbd_t domain - Allow sbd_t domain to create rpc sysctls. Resolves: rhbz#1455631 - Allow ganesha_t domain to manage glusterd_var_run_t pid files. Resolves: rhbz#1448090- Create new interface: glusterd_read_lib_files() - Allow ganesha read glusterd lib files. - Allow ganesha read network sysctls Resolves: rhbz#1448090- Add few allow rules to ganesha module Resolves: rhbz#1448090 - Allow condor_master_t to read sysctls. Resolves: rhbz#1277506 - Add dac_override cap to ctdbd_t domain Resolves: rhbz#1435708 - Label 8750 tcp/udp port as dey_keyneg_port_t Resolves: rhbz#1448090- Add ganesha_use_fusefs boolean. Resolves: rhbz#1448090- Allow httpd_t reading kerberos kdc config files Resolves: rhbz#1452215 - Allow tomcat_t domain connect to ibm_dt_2 tcp port. Resolves: rhbz#1447436 - Allow stream connect to initrc_t domains Resolves: rhbz#1447436 - Allow dnsmasq_t domain to read systemd-resolved pid files. Resolves: rhbz#1453114 - Allow tomcat domain name_bind on tcp bctp_port_t Resolves: rhbz#1451757 - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process. Resolves: rhbz#1447669 - Allow condor_master_t write to sysctl_net_t Resolves: rhbz#1277506 - Allow nagios check disk plugin read /sys/kernel/config/ Resolves: rhbz#1277718 - Allow pcp_pmie_t domain execute systemctl binary Resolves: rhbz#1271998 - Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl Resolves: rhbz#1247635 - Label tcp/udp port 1792 as ibm_dt_2_port_t Resolves: rhbz#1447436 - Add interface fs_read_configfs_dirs() - Add interface fs_read_configfs_files() - Fix systemd_resolved_read_pid interface - Add interface systemd_resolved_read_pid() Resolves: rhbz#1453114 - Allow sshd_net_t domain read/write into crypto devices Resolves: rhbz#1452759 - Label 8999 tcp/udp as bctp_port_t Resolves: rhbz#1451757- nmbd_t needs net_admin capability like smbd Resolves: rhbz#1431859 - Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t Resolves: rhbz#1431859 - Allow rngd domain read sysfs_t Resolves: rhbz#1451735 - Add interface pki_manage_common_files() Resolves: rhbz#1447436 - Allow tomcat_t domain to manage pki_common_t files and dirs Resolves: rhbz#1447436 - Use stricter fc rules for sssd sockets in /var/run Resolves: rhbz#1448060 - Allow certmonger reads httpd_config_t files Resolves: rhbz#1436689 - Allow keepalived_t domain creating netlink_netfilter_socket. Resolves: rhbz#1451684 - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files. Resolves: rhbz#1451318 - Make able deply overcloud via neutron_t to label nsfs as fs_t Resolves: rhbz#1373321- Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files. Resolves: rhbz#1451318 - Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/ Resolves: rhbz#1448056 Resolves: rhbz#1448060 - Allow tomcat_domain connect to * postgresql_port_t * amqp_port_t Allow tomcat_domain read network sysctls Resolves: rhbz#1450819 - Make able deply overcloud via neutron_t to label nsfs as fs_t Resolves: rhbz#1373321 - Allow netutils setpcap capability Resolves:1444438- Update targetd policy to accommodate changes in the service Resolves: rhbz#1424621 - Allow tomcat_domain connect to * postgresql_port_t * amqp_port_t Allow tomcat_domain read network sysctls Resolves: rhbz#1450819 - Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options. Resolves: rhbz#1415841 - Allow radius domain stream connec to postgresql Resolves: rhbz#1446145 - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit Resolves: rhbz#1449977 - Allow glusterd_t domain start ganesha service Resolves: rhbz#1448090 - Made few cosmetic changes in sssd SELinux module Resolves: rhbz#1448060 - sssd-kcm should not run as unconfined_service_t BZ(1447411) Resolves: rhbz#1448060 - Add sssd_secrets labeling Also add named_filetrans interface to make sure all labels are correct Resolves: rhbz#1448056 - Allow keepalived_t domain read usermodehelper_t Resolves: rhbz#1449769 - Allow tomcat_t domain read pki_common_t files Resolves: rhbz#1447436 - Add interface pki_read_common_files() Resolves: rhbz#1447436- Allow hypervkvp_t domain execute hostname Resolves: rhbz#1449064 - Dontaudit sssd_selinux_manager_t use of net_admin capability Resolves: rhbz#1444955 - Allow tomcat_t stream connect to pki_common_t Resolves: rhbz#1447436 - Dontaudit xguest_t's attempts to listen to its tcp_socket - Allow sssd_selinux_manager_t to ioctl init_t sockets Resolves: rhbz#1436689 - Allow _su_t to create netlink_selinux_socket Resolves rhbz#1146987 - Allow unconfined_t to module_load any file Resolves rhbz#1442994- Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type. Resolves: rhbz#1436689- Allow pki_tomcat_t domain read /etc/passwd. Resolves: rhbz#1436689 - Allow tomcat_t domain read ipa_tmp_t files Resolves: rhbz#1436689 - Label new path for ipa-otpd Resolves: rhbz#1446353 - Allow radiusd_t domain stream connect to postgresql_t Resolves: rhbz#1446145 - Allow rhsmcertd_t to execute hostname_exec_t binaries. Resolves: rhbz#1445494 - Allow virtlogd to append nfs_t files when virt_use_nfs=1 Resolves: rhbz#1402561- Update tomcat policy to adjust for removing unconfined_domain attr. Resolves: rhbz#1432083 - Allow httpd_t domain read also httpd_user_content_type lnk_files. Resolves: rhbz#1383621 - Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t Resolves: rhbz#1436689 - Dontaudit _gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t Resolves: rhbz#1425530 - Add interface ipa_filetrans_named_content() Resolves: rhbz#1432115 - Allow tomcat use nsswitch Resolves: rhbz#1436689 - Allow certmonger_t start/status generic services Resolves: rhbz#1436689 - Allow dirsrv read cgroup files. Resolves: rhbz#1436689 - Allow ganesha_t domain read/write infiniband devices. Resolves: rhbz#1383784 - Allow sendmail_t domain sysctl_net_t files Resolves: rhbz#1369376 - Allow targetd_t domain read network state and getattr on loop_control_device_t Resolves: rhbz#1373860 - Allow condor_schedd_t domain send mails. Resolves: rhbz#1277506 - Alow certmonger to create own systemd unit files. Resolves: rhbz#1436689 - Allow staff to systemctl virt server when staff_use_svirt=1 Resolves: rhbz#1415841 - Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context Resolves: rhbz#1432115 - Label /sysroot/ostree/deploy/rhel-atomic-host/* as root_t Resolves: rhbz#1428112- Alow certmonger to create own systemd unit files. Resolves: rhbz#1436689- Hide broken symptoms when using kernel 3.10.0-514+ with network bonding. Postfix_picup_t domain requires NET_ADMIN capability which is not really needed. Resolves: rhbz#1431859 - Fix policy to reflect all changes in new IPA release Resolves: rhbz#1432115 Resolves: rhbz#1436689- Allow sbd_t to read/write fixed disk devices Resolves: rhbz#1440165 - Add sys_ptrace capability to radiusd_t domain Resolves: rhbz#1426641 - Allow cockpit_session_t domain connects to ssh tcp ports. Resolves: rhbz#1413509- Update tomcat policy to make working ipa install process Resolves: rhbz#1436689- Allow pcp_pmcd_t net_admin capability. - Allow pcp_pmcd_t read net sysctls - Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t Resolves: rhbz#1336211- Fix all AVC denials during pkispawn of CA Resolves: rhbz#1436383 - Update pki interfaces and tomcat module Resolves: rhbz#1436689- Update pki interfaces and tomcat module Resolves: rhbz#1436689- Dontaudit firewalld wants write to /root Resolves: rhbz#1438708 - Dontaudit firewalld to create dirs in /root/ Resolves: rhbz#1438708 - Allow sendmail to search network sysctls Resolves: rhbz#1369376 - Add interface gssd_noatsecure() Resolves: rhbz#1438036 - Add interface gssproxy_noatsecure() Resolves: rhbz#1438036 - Dontaudit pcp_pmlogger_t search for xserver logs. Allow pcp_pmlogger_t to send signals to unconfined doamins Allow pcp_pmlogger_t to send logs to journals Resolves: rhbz#1379371 - Allow chronyd_t net_admin capability to allow support HW timestamping. Resolves: rhbz#1416015 - Update tomcat policy Resolves: rhbz#1436689 Resolves: rhbz#1436383 - Allow certmonger to start haproxy service Resolves: rhbz#1349394 - Allow init noatsecure for gssd and gssproxy Resolves: rhbz#1438036- geoclue wants to dbus chat with avahi Resolves: rhbz#1434286 - Allow iptables get list of kernel modules Resolves: rhbz#1367520 - Allow unconfined_domain_type to enable/disable transient unit Resolves: rhbz#1337041 - Add interfaces init_enable_transient_unit() and init_disable_transient_unit - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd" Resolves: rhbz#1435264 - Label sysroot dir under ostree as root_t Resolves: rhbz#1428112- Remove ganesha_t domain from permissive domains. Resolves: rhbz#1436988- Allow named_t domain bind on several udp ports Resolves: rhbz#1312972 - Update nscd_use() interface Resolves: rhbz#1281716 - Allow radius_t domain ptrace Resolves: rhbz#1426641 - Update nagios to allos exec systemctl Resolves: rhbz#1247635 - Update pcp SELinux module to reflect all pcp changes Resolves: rhbz#1271998 - Label /var/lib/ssl_db as squid_cache_t Label /etc/squid/ssl_db as squid_cache_t Resolves: rhbz#1325527 - Allow pcp_pmcd_t domain search for network sysctl Allow pcp_pmcd_t domain sys_ptrace capability Resolves: rhbz#1336211- Allow drbd load modules Resolves: rhbz#1134883 - Revert "Add sys_module capability for drbd Resolves: rhbz#1134883" - Allow stapserver list kernel modules Resolves: rhbz#1325976 - Update targetd policy Resolves: rhbz#1373860 - Add sys_admin capability to amanda Resolves: rhbz#1371561 - Allow hypervvssd_t to read all dirs. Resolves: rhbz#1331309 - Label /run/haproxy.sock socket as haproxy_var_run_t Resolves: rhbz#1386233 - Allow oddjob_mkhomedir_t to mamange autofs_t dirs. Resolves: rhbz#1408819 - Allow tomcat to connect on http_cache_port_t Resolves: rhbz#1432083 - Allow geoclue to send msgs to syslog. Resolves: rhbz#1434286 - Allow condor_master_t domain capability chown. Resolves: rhbz#1277506 - Update mta_filetrans_named_content() interface to allow calling domain create files labeled as etc_aliases_t in dir labeled as etc_mail_t. Resolves: rhbz#1167468 - Allow nova domain search for httpd configuration. Resolves: rhbz#1190761 - Add sys_module capability for drbd Resolves: rhbz#1134883 - Allow user_u users stream connect to dirsrv, Allow sysadm_u and staff_u users to manage dirsrv files Resolves: rhbz#1286474 - Allow systemd_networkd_t communicate with systemd_networkd_t via dbus Resolves: rhbz#1278010- Add haproxy_t domain fowner capability Resolves: rhbz#1386233 - Allow domain transition from ntpd_t to hwclock_t domains Resolves: rhbz#1375624 - Allow cockpit_session_t setrlimit and sys_resource Resolves: rhbz#1402316 - Dontaudit svirt_t read state of libvirtd domain Resolves: rhbz#1426106 - Update httpd and gssproxy modules to reflects latest changes in freeipa Resolves: rhbz#1432115 - Allow iptables read modules_conf_t Resolves: rhbz#1367520- Remove tomcat_t domain from unconfined domains Resolves: rhbz#1432083 - Create new boolean: sanlock_enable_home_dirs() Resolves: rhbz#1432783 - Allow mdadm_t domain to read/write nvme_device_t Resolves: rhbz#1431617 - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content Resolves: rhbz#1383621 - Dontaudit domain to create any file in /proc. This is kernel bug. Resolves: rhbz#1412679 - Add interface dev_rw_nvme Resolves: rhbz#1431617- Allow gssproxy to get attributes on all filesystem object types. Resolves: rhbz#1430295 - Allow ganesha to chat with unconfined domains via dbus Resolves: rhbz#1426554 - add the policy required for nextcloud Resolves: rhbz#1425530 - Add nmbd_t capability2 block_suspend Resolves: rhbz#1425357 - Label /var/run/chrony as chronyd_var_run_t Resolves: rhbz#1416015 - Add domain transition from sosreport_t to iptables_t Resolves: rhbz#1359789 - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd Resolves: rhbz:#1332803- Update rpm macros Resolves: rhbz#1380854- Add handling booleans via selinux-policy macros in custom policy spec files. Resolves: rhbz#1380854- Allow openvswitch to load kernel modules Resolves: rhbz#1405479- Allow openvswitch read script state. Resolves: rhbz#1405479- Update ganesha policy Resolves: rhbz#1426554 Resolves: rhbz#1383784 - Allow chronyd to read adjtime Resolves: rhbz#1416015 - Fixes for chrony version 2.2 Resolves: rhbz#1416015 - Add interface virt_rw_stream_sockets_svirt() Resolves: rhbz#1415841 - Label /dev/ss0 as gpfs_device_t Resolves: rhbz#1383784 - Allow staff to rw svirt unix stream sockets. Resolves: rhbz#1415841 - Label /rhev/data-center/mnt as mnt_t Resolves: rhbz#1408275 - Associate sysctl_rpc_t with proc filesystems Resolves: rhbz#1350927 - Add new boolean: domain_can_write_kmsg Resolves: rhbz#1415715- Allow rhsmcertd_t dbus chat with system_cronjob_t Resolves: rhbz#1405341 - Allow openvswitch exec hostname and readinitrc_t files Resolves: rhbz#1405479 - Improve SELinux context for mysql_db_t objects. Resolves: rhbz#1391521 - Allow postfix_postdrop to communicate with postfix_master via pipe. Resolves: rhbz#1379736 - Add radius_use_jit boolean Resolves: rhbz#1426205 - Label /var/lock/subsys/iptables as iptables_lock_t Resolves: rhbz#1405441 - Label /usr/lib64/erlang/erts-5.10.4/bin/epmd as lib_t Resolves: rhbz#1332803 - Allow can_load_kernmodule to load kernel modules. Resolves: rhbz#1423427 Resolves: rhbz#1424621- Allow nfsd_t domain to create sysctls_rpc_t files Resolves: rhbz#1405304 - Allow openvswitch to create netlink generic sockets. Resolves: rhbz#1397974 - Create kernel_create_rpc_sysctls() interface Resolves: rhbz#1405304- Allow nfsd_t domain rw sysctl_rpc_t dirs Resolves: rhbz#1405304 - Allow cgdcbxd_t to manage cgroup files. Resolves: rhbz#1358493 - Allow cmirrord_t domain to create netlink_connector sockets Resolves: rhbz#1412670 - Allow fcoemon to create netlink scsitransport sockets Resolves: rhbz#1362496 - Allow quota_nld_t create netlink_generic sockets Resolves: rhbz#1358679 - Allow cgred_t create netlink_connector sockets Resolves: rhbz#1376357 - Add dhcpd_t domain fowner capability Resolves: rhbz#1358485 - Allow acpid to attempt to connect to the Linux kernel via generic netlink socket. Resolves: rhbz#1358478 - Rename docker module to container module Resolves: rhbz#1386916 - Allow setflies to mount tracefs Resolves: rhbz#1376357 - Allow iptables to read nsfs files. Resolves: rhbz#1411316 - Allow systemd_bootchart_t domain create dgram sockets. Resolves: rhbz#1365953 - Rename docker interfaces to container Resolves: rhbz#1386916- Allow initrc_t domain to run rhel-autorelabel script properly during boot process Resolves: rhbz#1379722 - Allow systemd_initctl_t to create and connect unix_dgram sockets Resolves: rhbz#1365947 - Allow ifconfig_t to mount/unmount nsfs_t filesystem Resolves: rhbz#1349814 - Add interfaces allowing mount/unmount nsfs_t filesystem Resolves: rhbz#1349814- Add interface init_stream_connectto() Resolves:rhbz#1365947 - Allow rhsmcertd domain signull kernel. Resolves: rhbz#1379781 - Allow kdumpgui domain to read nvme device - Allow insmod_t to load kernel modules Resolves: rhbz#1421598 - Add interface files_load_kernel_modules() Resolves: rhbz#1421598 - Add SELinux support for systemd-initctl daemon Resolves:rhbz#1365947 - Add SELinux support for systemd-bootchart Resolves: rhbz#1365953- Allow firewalld to getattr open search read modules_object_t:dir Resolves: rhbz#1418391 - Fix label for nagios plugins in nagios file conxtext file Resolves: rhbz#1277718 - Add sys_ptrace capability to pegasus domain Resolves: rhbz#1381238 - Allow sssd_t domain setpgid Resolves:rhbz#1416780 - After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk. Resolves: rhbz#1350927 - Allow kdumpgui domain to read nvme device Resolves: rhbz#1415084 - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization. Resolves: rhbz#1146987 - Add user namespace capability object classes. Resolves: rhbz#1368057 - Add module_load permission to class system Resolves:rhbz#1368057 - Add the validate_trans access vector to the security class Resolves: rhbz#1368057 - Add "binder" security class and access vectors Resolves: rhbz#1368057 - Allow ifconfig_t domain read nsfs_t Resolves: rhbz#1349814 - Allow ping_t domain to load kernel modules. Resolves: rhbz#1388363- Allow systemd container to read/write usermodehelperstate Resolves: rhbz#1403254 - Label udp ports in range 24007-24027 as gluster_port_t Resolves: rhbz#1404152- Allow glusterd_t to bind on glusterd_port_t udp ports. Resolves: rhbz#1404152 - Revert: Allow glusterd_t to bind on med_tlp port.- Allow glusterd_t to bind on med_tlp port. Resolves: rhbz#1404152 - Update ctdbd_t policy to reflect all changes. Resolves: rhbz#1402451 - Label tcp port 24009 as med_tlp_port_t Resolves: rhbz#1404152 - Issue appears during update directly from RHEL-7.0 to RHEL-7.3 or above. Modules pkcsslotd and vbetools missing in selinux-policy package for RHEL-7.3 which causing warnings during SELinux policy store migration process. Following patch fixes issue by skipping pkcsslotd and vbetools modules migration.- Allow ctdbd_t domain transition to rpcd_t Resolves:rhbz#1402451- Fixes for containers Allow containers to attempt to write to unix_sysctls. Allow cotainers to use the FD's leaked to them from parent processes. Resolves: rhbz#1403254- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t Resolves: rhbz#1404152 - Allow systemd to stop glusterd_t domains. Resolves: rhbz#1400493- Make working CTDB:NFS: CTDB failover from selinux-policy POV Resolves: rhbz#1402451- Add kdump_t domain sys_admin capability Resolves: rhbz#1375963- Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access. Resolves: rhbz#1399250- Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning "Access Denied" errors to DBus clients Resolves: rhbz#1393505- Allow cluster_t communicate to fprintd_t via dbus Resolves: rhbz#1349798- Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package Resolves: rhbz#1392010- Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device. Resolves: rhbz#1384488 - Allow glusterd to get attributes on /sys/kernel/config directory. Resolves: rhbz#1384483- Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros - Add selinux-policy-migrate-local-changes service Resolves: rhbz#1381588- Allow sssd_selinux_manager_t to manage also dir class. Resolves: rhbz#1368097 - Add interface seutil_manage_default_contexts_dirs() Resolves: rhbz#1368097- Add virt_sandbox_use_nfs -> virt_use_nfs boolean substitution. Resolves: rhbz#1355783- Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t Resolves: rhbz#1309883- Allow ftp daemon to manage apache_user_content Resolves: rhbz#1097775 - Label /etc/sysconfig/oracleasm as oracleasm_conf_t Resolves: rhbz#1331383 - Allow oracleasm to rw inherited fixed disk device Resolves: rhbz#1331383 - Allow collectd to connect on unix_stream_socket Resolves: rhbz#1377259- Allow iscsid create netlink iscsid sockets. Resolves: rhbz#1358266 - Improve regexp for power_unit_file_t files. To catch just systemd power unit files. Resolves: rhbz#1375462- Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain. Resolves: rhbz#1331383 - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service Resolves: rhbz#1206525- Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm Resolves: rhbz#1331383 - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t Resolves: rhbz#1206525 - Allow mdadm_t to getattr all device nodes Resolves: rhbz#1365171 - Add interface dbus_dontaudit_stream_connect_system_dbusd() Resolves:rhbz#1052880 - Add virt_stub_* interfaces for docker policy which is no longer a part of our base policy. Resolves: rhbz#1372705 - Allow guest-set-user-passwd to set users password. Resolves: rhbz#1369693 - Allow samdbox domains to use msg class Resolves: rhbz#1372677 - Allow domains using kerberos to read also kerberos config dirs Resolves: rhbz#1368492 - Allow svirt_sandbox_domains to r/w onload sockets Resolves: rhbz#1342930 - Add interface fs_manage_oracleasm() Resolves: rhbz#1331383 - Label /dev/kfd as hsa_device_t Resolves: rhbz#1373488 - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs Resolves: rhbz#1368097 - Add interface to write to nsfs inodes Resolves: rhbz#1372705 - Allow systemd services to use PrivateNetwork feature Resolves: rhbz#1372705 - Add a type and genfscon for nsfs. Resolves: rhbz#1372705 - Allow run sulogin_t in range mls_systemlow-mls_systemhigh. Resolves: rhbz#1290400- Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261 - Fix file context for /etc/pki/pki-tomcat/ca/ - new interface oddjob_mkhomedir_entrypoint() - Move label for /var/lib/docker/vfs/ to proper SELinux module - Allow mdadm to get attributes from all devices. - Label /etc/puppetlabs as puppet_etc_t. - Allow systemd-machined to communicate to lxc container using dbus - Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579 - Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579 - Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579 - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t - Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383- Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t Resolves:rhbz#1366915 - Allow certmonger to manage all systemd unit files Resolves:rhbz#1366915 - Grant certmonger "chown" capability Resolves:rhbz#1366915 - Allow ipa_helper_t stream connect to dirsrv_t domain Resolves: rhbz#1368418 - Update oracleasm SELinux module Resolves: rhbz#1331383 - label /var/lib/kubelet as svirt_sandbox_file_t Resolves: rhbz#1369159 - Add few interfaces to cloudform.if file Resolves: rhbz#1367834 - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module Resolves: rhbz#1347514 - Allow krb5kdc_t to read krb4kdc_conf_t dirs. Resolves: rhbz#1368492 - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run. Resolves: rhbz#1365653 - Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together. Resolves: rhbz#1365653 - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type Resolves: rhbz#1331383 - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init. Resolves: rhbz#1367834 - Allow iptables to creating netlink generic sockets. Resolves: rhbz#1364359- Allow ipmievd domain to create lock files in /var/lock/subsys/ Resolves:rhbz#1349058 - Update policy for ipmievd daemon. Resolves:rhbz#1349058 - Dontaudit hyperkvp to getattr on non security files. Resolves: rhbz#1349356 - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t Resolves: rhbz#1347514 - Fixed lsm SELinux module - Add sys_admin capability to sbd domain Resolves: rhbz#1322725 - Allow vdagent to comunnicate with systemd-logind via dbus Resolves: rhbz#1366731 - Allow lsmd_plugin_t domain to create fixed_disk device. Resolves: rhbz#1238066 - Allow opendnssec domain to create and manage own tmp dirs/files Resolves: rhbz#1366649 - Allow opendnssec domain to read system state Resolves: rhbz#1366649 - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs Resolves: rhbz#1366649 - Allow rasdaemon to mount/unmount tracefs filesystem. Resolves: rhbz#1364380 - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/ Resolves: rhbz#1367520 - Modify interface den_read_nvme() to allow also read nvme_device_t block files. Resolves: rhbz#1362564 - Label /var/run/storaged as lvm_var_run_t. Resolves: rhbz#1264390 - Allow unconfineduser to run ipa_helper_t. Resolves: rhbz#1361636- Dontaudit mock to write to generic certs. Resolves: rhbz#1271209 - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t Resolves: rhbz#1347514 - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain" - Allow modemmanager to write to systemd inhibit pipes Resolves: rhbz#1365214 - Label corosync-qnetd and corosync-qdevice as corosync_t domain Resolves: rhbz#1347514 - Allow ipa_helper to read network state Resolves: rhbz#1361636 - Label oddjob_reqiest as oddjob_exec_t Resolves: rhbz#1361636 - Add interface oddjob_run() Resolves: rhbz#1361636 - Allow modemmanager chat with systemd_logind via dbus Resolves: rhbz#1362273 - Allow NetworkManager chat with puppetagent via dbus Resolves: rhbz#1363989 - Allow NetworkManager chat with kdumpctl via dbus Resolves: rhbz#1363977 - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls. Resolves: rhbz#1322725 - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t Resolves: rhbz#1349058 - Allow rasdaemon to use tracefs filesystem. Resolves: rhbz#1364380 - Fix typo bug in dirsrv policy - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd. Resolves: rhbz#1283134 - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t Resolves: rhbz#1362688 - Allow dirsrv to read dirsrv_share_t content Resolves: rhbz#1363662 - Allow virtlogd_t to append svirt_image_t files. Resolves: rhbz#1358140 - Allow hypervkvp domain to read hugetlbfs dir/files. Resolves: rhbz#1349356 - Allow mdadm daemon to read nvme_device_t blk files Resolves: rhbz#1362564 - Allow selinuxusers and unconfineduser to run oddjob_request Resolves: rhbz#1361636 - Allow sshd server to acces to Crypto Express 4 (CEX4) devices. Resolves: rhbz#1362539 - Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-* changed to /usr/lib/systemd/rhel-*. Resolves: rhbz#1363769 - Fix typo in device interfaces Resolves: rhbz#1349058 - Add interfaces for managing ipmi devices Resolves: rhbz#1349058 - Add interfaces to allow mounting/umounting tracefs filesystem Resolves: rhbz#1364380 - Add interfaces to allow rw tracefs filesystem Resolves: rhbz#1364380 - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices. Resolves: rhbz#1362564 - Label /sys/kernel/debug/tracing filesystem Resolves: rhbz#1364380 - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1357857- Dontaudit mock_build_t can list all ptys. Resolves: rhbz#1271209 - Allow ftpd_t to mamange userhome data without any boolean. Resolves: rhbz#1097775 - Add logrotate permissions for creating netlink selinux sockets. Resolves: rhbz#1283134 - Allow lsmd_plugin_t to exec ldconfig. Resolves: rhbz#1238066 - Allow vnstatd domain to read /sys/class/net/ files Resolves: rhbz#1358243 - Remove duplicate allow rules in spamassassin SELinux module Resolves:rhbz#1358175 - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs Resolves:rhbz#1358175 - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1357857 - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data. Resolves: rhbz#1330464 - Allow gnome-keyring also manage user_tmp_t sockets. Resolves: rhbz#1257057 - corecmd: Remove fcontext for /etc/sysconfig/libvirtd Resolves:rhbz#1351382- Allow ipa_dnskey domain to search cache dirs Resolves: rhbz#1350957- Allow ipa-dnskey read system state. Reasolves: rhbz#1350957 - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file Resolves: rhbz#1350957- Allow firewalld to manage net_conf_t files. Resolves:rhbz#1304723 - Allow logrotate read logs inside containers. Resolves: rhbz#1303514 - Allow sssd to getattr on fs_t Resolves: rhbz#1356082 - Allow opendnssec domain to manage bind chace files Resolves: rhbz#1350957 - Fix typo in rhsmcertd policy module Resolves: rhbz#1329475 - Allow systemd to get status of systemd-logind daemon Resolves: rhbz#1356141 - Label more ndctl devices not just ndctl0 Resolves: rhbz#1355809- Allow rhsmcertd to copy certs into /etc/docker/cert.d - Add interface docker_rw_config() Resolves: rhbz#1344500 - Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t Resolves: rhbz#1355632 - Allow rhsmcertd to read network sysctls Resolves: rhbz#1329475 - Label /var/log/graphite-web dir as httpd_log_t Resolves: rhbz#1310898 - Allow mock to use generic ptys Resolves: rhbz#1271209 - Allow adcli running as sssd_t to write krb5.keytab file. Resolves: rhbz#1356082 - Allow openvswitch connect to openvswitch_port_t type. Resolves: rhbz#1335024 - Add SELinux policy for opendnssec service. Resolves: rhbz#1350957 - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd Resolves: rhbz#1350957 - label /dev/ndctl0 device as nvram_device_t Resolves: rhbz#1355809- Allow lttng tools to block suspending Resolves: rhbz#1256374 - Allow creation of vpnaas in openstack Resolves: rhbz#1352710 - virt: add strict policy for virtlogd daemon Resolves:rhbz#1311606 - Update makefile to support snapperd_contexts file Resolves: rhbz#1352681- Allow udev to manage systemd-hwdb files - Add interface systemd_hwdb_manage_config() Resolves: rhbz#1350756 - Fix paths to infiniband devices. This allows use more then two infiniband interfaces. Resolves: rhbz#1210263- Allow virtual machines to rw infiniband devices. Resolves: rhbz#1210263 - Allow opensm daemon to rw infiniband_mgmt_device_t Resolves: rhbz#1210263 - Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file. Resolves: rhbz#1350756 - Make label for new infiniband_mgmt deivices Resolves: rhbz#1210263- Fix typo in brltty SELinux module - Add new SELinux module sbd Resolves: rhbz#1322725 - Allow pcp dmcache metrics collection Resolves: rhbz#1309883 - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t Resolves: rhbz#1350782 - Allow openvpn to create sock files labeled as openvpn_var_run_t Resolves: rhbz#1328246 - Allow hypervkvp daemon to getattr on all filesystem types. Resolves: rhbz#1349356 - Allow firewalld to create net_conf_t files Resolves: rhbz#1304723 - Allow mock to use lvm Resolves: rhbz#1271209 - Allow keepalived to create netlink generic sockets. Resolves: rhbz#1349809 - Allow mirromanager creating log files in /tmp Resolves:rhbz#1328818 - Rename few modules to make it consistent with source files Resolves: rhbz#1351445 - Allow vmtools_t to transition to rpm_script domain Resolves: rhbz#1342119 - Allow nsd daemon to manage nsd_conf_t dirs and files Resolves: rhbz#1349791 - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t Resolves: rhbz#1346900 - Allow sssd read also sssd_conf_t dirs Resolves: rhbz#1350535 - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl Resolves: rhbz#1086240 - Add interface lvm_getattr_exec_files() Resolves: rhbz#1271209 - Fix typo Compliling vs. Compiling Resolves: rhbz#1351445- Allow krb5kdc_t to communicate with sssd Resolves: rhbz#1319933 - Allow prosody to bind on prosody ports Resolves: rhbz#1304664 - Add dac_override caps for fail2ban-client Resolves: rhbz#1316678 - dontaudit read access for svirt_t on the file /var/db/nscd/group Resolves: rhbz#1301637 - Allow inetd child process to communicate via dbus with systemd-logind Resolves: rhbz#1333726 - Add label for brltty log file Resolves: rhbz#1328818 - Allow dspam to read the passwd file Resolves: rhbz#1286020 - Allow snort_t to communicate with sssd Resolves: rhbz#1284908 - svirt_sandbox_domains need to be able to execmod for badly built libraries. Resolves: rhbz#1206339 - Add policy for lttng-tools package. Resolves: rhbz#1256374 - Make mirrormanager as application domain. Resolves: rhbz#1328234 - Add support for the default lttng-sessiond port - tcp/5345. This port is used by LTTng 2.x central tracing registry session daemon. - Add prosody ports Resolves: rhbz#1304664 - Allow sssd read also sssd_conf_t dirs Resolves: rhbz#1350535- Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs. Resolves:rhbz#1331315 - Label named-pkcs11 binary as named_exec_t. Resolves: rhbz#1331315 - Allow glusterd daemon to get systemd status Resolves: rhbz#1321785 - Allow logrotate dbus-chat with system_logind daemon Resolves: rhbz#1283134 - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files Resolves: rhbz#1336211 - Add interface cron_read_pid_files() Resolves: rhbz#1336211 - Allow pcp_pmlogger to create unix dgram sockets Resolves: rhbz#1336211 - Add hwloc-dump-hwdata SELinux policy Resolves: rhbz#1344054 - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t. Resolves: rhbz#1121171 - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd() Resolves: rhbz#1259764 - Create label for openhpid log files. esolves: rhbz#1259764 - Label /var/lib/ganglia as httpd_var_lib_t Resolves: rhbz#1260536 - Allow firewalld_t to create entries in net_conf_t dirs. Resolves: rhbz#1304723 - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals Resolves: rhbz#1288255 - Include patch from distgit repo: policy-RHEL-7.1-flask.patch. Resolves: rhbz#1329560 - Update refpolicy to handle hwloc Resolves: rhbz#1344054 - Label /etc/dhcp/scripts dir as bin_t - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals. Resolves: rhbz#1288255- Allow firewalld_t to create entries in net_conf_t dirs. Resolves: rhbz#1304723 - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals Resolves: rhbz#1288255 - Allow mongod log to syslog. Resolves: rhbz#1306995 - Allow rhsmcertd connect to port tcp 9090 Resolves: rhbz#1337319 - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove. Resolves: rhbz#1262483 Resolves: rhbz#1277506 - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t. Resolves: rhbz#1301516 - Add new boolean spamd_update_can_network. Resolves: rhbz#1305469 - Allow rhsmcertd connect to tcp netport_port_t Resolves: rhbz#1329475 - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t. Resolves: rhbz#1328234 - Allow prosody to bind to fac_restore tcp port. Resolves: rhbz#1321787 - Allow ninfod to read raw packets Resolves: rhbz#1317964 - Allow pegasus get attributes from qemu binary files. Resolves: rhbz#1260835 - Allow pegasus get attributes from qemu binary files. Resolves: rhbz#1271159 - Allow tuned to use policykit. This change is required by cockpit. Resolves: rhbz#1346464 - Allow conman_t to read dir with conman_unconfined_script_t binary files. Resolves: rhbz#1297323 - Allow pegasus to read /proc/sysinfo. Resolves: rhbz#1265883 - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals. Resolves: rhbz#1288255 - Label tcp ports:16379, 26379 as redis_port_t Resolves: rhbz#1348471 - Allow systemd to relabel /var and /var/lib directories during boot. - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces. - Add files_relabelto_var_lib_dirs() interface. - Label tcp port 2004 as mailbox_port_t. Resolves: rhbz#1332843 - Label tcp and udp port 5582 as fac_restore_port_t Resolves: rhbz#1321787 - Allow sysadm_t user to run postgresql-setup. Resolves: rhbz#1282543 - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script. Resolves: rhbz#1297480 - Update netlink socket classes.- Allow conman to kill conman_unconfined_script. Resolves: rhbz#1297323 - Make conman_unconfined_script_t as init_system_domain. Resolves:rhbz#1297323 - Allow init dbus chat with apmd. Resolves:rhbz#995898 - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t. Resolves: rhbz#1233252 - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Add mediawiki rules to proper scope Resolves: rhbz#1301186 - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Allow mysqld_safe to inherit rlimit information from mysqld Resolves: rhbz#1323673 - Allow collectd_t to stream connect to postgresql. Resolves: rhbz#1344056 - Allow mediawiki-script to read /etc/passwd file. Resolves: rhbz#1301186 - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc. Resolves: rhbz#1344505 - Add labels for mediawiki123 Resolves: rhbz#1293872 - Fix label for all fence_scsi_check scripts - Allow ip netns to mounton root fs and unmount proc_t fs. Resolves: rhbz#1343776 Resolves: rhbz#1286851 - Allow sysadm_t to run newaliases command. Resolves: rhbz#1344828 - Add interface sysnet_filetrans_named_net_conf() Resolves: rhbz#1344505- Fix several issues related to the SELinux Userspace changes- Allow glusterd domain read krb5_keytab_t files. Resolves: rhbz#1343929 - Fix typo in files_setattr_non_security_dirs. Resolves: rhbz#1115987- Allow tmpreaper_t to read/setattr all non_security_file_type dirs Resolves: rhbz#1115987 - Allow firewalld to create firewalld_var_run_t directory. Resolves: rhbz#1304723 - Add interface firewalld_read_pid_files() Resolves: rhbz#1304723 - Label /usr/libexec/rpm-ostreed as rpm_exec_t. Resolves: rhbz#1340542 - Allow sanlock service to read/write cephfs_t files. Resolves: rhbz#1315332 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added missing docker interfaces: - docker_typebounds - docker_entrypoint Resolves: rhbz#1236580 - Add interface files_setattr_non_security_dirs() Resolves: rhbz#1115987 - Add support for onloadfs - Allow iptables to read firewalld pid files. Resolves: rhbz#1304723 - Add SELinux support for ceph filesystem. Resolves: rhbz#1315332 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) Resolves: rhbz#1236580- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added missing docker interfaces: - docker_typebounds - docker_entrypoint Resolves: rhbz#1236580 - New interfaces needed for systemd-machinectl Resolves: rhbz#1236580 - New interfaces needed by systemd-machine Resolves: rhbz#1236580 - Add interface allowing sending and receiving messages from virt over dbus. Resolves: rhbz#1236580 - Backport docker policy from Fedora. Related: #1303123 Resolves: #1341257 - Allow NetworkManager_t and policykit_t read access to systemd-machined pid files. Resolves: rhbz#1236580 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added interfaces needed by new docker policy. Related: rhbz#1303123 - Add support for systemd-machined daemon Resolves: rhbz#1236580 - Allow rpm-ostree domain transition to install_t domain from init_t. Resolves: rhbz#1340542- dnsmasq: allow NetworkManager to control dnsmasq via D-Bus Resolves: rhbz#1336722 - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te Resolves: rhbz#1333198 - sftpd_* booleans are functionless these days. Resolves: rhbz#1335656 - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t. Resolves: rhbz#1335828 - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus. Resolves: rhbz#1336760 - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t. Resolves: rhbz#1336737 - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain. Resolves: rhbz#1264390 - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t. Resolves: rhbz#1337061 - Revert "Allow all domains some process flags." Resolves: rhbz#1303644 - Revert "Remove setrlimit to all domains." Resolves: rhbz#1303644 - Label /usr/sbin/xrdp* files as bin_t Resolves: rhbz#1276777 - Add mls support for some db classes Resolves: rhbz#1303651 - Allow systemd_resolved_t to check if ipv6 is disabled. Resolves: rhbz#1236579 - Allow systemd_resolved to read systemd_networkd run files. Resolves: rhbz#1236579- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus. Resolves: rhbz#1336760 - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t. Resolves: rhbz#1336737- Allow logwatch to domtrans to postqueue Resolves: rhbz#1331542 - Label /var/log/ganesha.log as gluster_log_t - Allow glusterd_t domain to create glusterd_log_t files. - Label /var/run/ganesha.pid as gluster_var_run_t. Resolves: rhbz#1335828 - Allow zabbix to connect to postgresql port Resolves: rhbz#1330479 - Add userdom_destroy_unpriv_user_shared_mem() interface. Related: rhbz#1306403 - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments. Resolves: rhbz#1306403- We need to restore contexts on /etc/passwd*,/etc/group*,/etc/*shadow* during install phase to get proper labeling for these files until selinux-policy pkgs are installed. Resolves: rhbz#1333952- Add interface glusterd_dontaudit_read_lib_dirs() Resolves: rhbz#1295680 - Dontaudit Occasionally observing AVC's while running geo-rep automation Resolves: rhbz#1295680 - Allow glusterd to manage socket files labeled as glusterd_brick_t. Resolves: rhbz#1331561 - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content Resolves: rhbz#1246522 - Allow stunnel create log files. Resolves: rhbz#1296851 - Label tcp port 8181 as intermapper_port_t. Resolves: rhbz#1334783 - Label tcp/udp port 2024 as xinuexpansion4_port_t Resolves: rhbz#1334783 - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t Resolves: rhbz#1334783 - Dontaudit ldconfig read gluster lib files. Resolves: rhbz#1295680 - Add interface auth_use_nsswitch() to systemd_domain_template. Resolves: rhbz#1236579- Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs. Resolves: rhbz#1312809 Resolves: rhbz#1323947 - Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144 - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t. Resolves: rhbz#1324144 - Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports. Resolves: rhbz#1324144 - Allow prosody to listen on port 5000 for mod_proxy65. Resolves: rhbz#1316918 - Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled. Resolves: rhbz#1309454- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs. Resolves: rhbz#1319442 - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap. Resolves: rhbz#1296640 - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits. Resolves: rhbz#1097775 - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution. If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t. Resolves: rhbz#1262483 - Allow nsd daemon to create log file in /var/log as nsd_log_t Resolves: rhbz#1293140 - Sanlock policy update. - New sub-domain for sanlk-reset daemon Resolves: rhbz#1212324 - Label all run tgtd files, not just socket files Resolves: rhbz#1280280 - Label all run tgtd files, not just socket files. Resolves: rhbz#1280280 - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody. Resolves: rhbz#1321049 - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets. Resolves: rhbz#1318224 - Allow prosody to listen on port 5000 for mod_proxy65. Resolves: rhbz#1316918 - Allow targetd to read/write to /dev/mapper/control device. Resolves: rhbz#1063714 - Allow KDM to get status about power services. This change allow kdm to be able do shutdown. Resolves: rhbz#1316724 - Allow systemd-resolved daemon creating netlink_route sockets. Resolves:rhbz#1236579 - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used Resolves: rhbz#1065362 - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t Resolves: rhbz#1321943 - Label all nvidia binaries as xserver_exec_t Resolves: rhbz#1322283- Create new permissivedomains CIL module and make it active. Resolves: rhbz#1320451 - Add support for new mock location - /usr/libexec/mock/mock. Resolves: rhbz#1271209 - Allow bitlee to create bitlee_var_t dirs. Resolves: rhbz#1268651 - Allow CIM provider to read sssd public files. Resolves: rhbz#1263339 - Fix some broken interfaces in distro policy. Resolves: rhbz#1121171 - Allow power button to shutdown the laptop. Resolves: rhbz#995898 - Allow lsm plugins to create named fixed disks. Resolves: rhbz#1238066 - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777 - Allow hyperv domains to rw hyperv devices. Resolves: rhbz#1309361 - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780 - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/ Resolves: rhbz#1297323 - Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib. - Add support for /dev/mptctl device used to check RAID status. Resolves: rhbz#1258029 - Create hyperv* devices and create rw interfaces for this devices. Resolves: rhbz#1309361 - Add fixes for selinux userspace moving the policy store to /var/lib/selinux. - Remove optional else block for dhcp ping- Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks. Resolves: rhbz#1263770 - Fix context of "/usr/share/nginx/html". Resolves: rhbz#1261857 - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics Resolves: rhbz#1270344 - Allow pmlogger to create pmlogger.primary.socket link file. Resolves: rhbz#1270344 - Label nagios scripts as httpd_sys_script_exec_t. Resolves: rhbz#1260306 - Add dontaudit interface for kdumpctl_tmp_t Resolves: rhbz#1156442 - Allow mdadm read files in EFI partition. Resolves: rhbz#1291801 - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid. Resolves: rhbz#1293140 - Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs Resolves: rhbz#1293140 - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface. Resolves: rhbz#1265102 - Add missing labeling for /usr/libexec/abrt-hook-ccpp. Resolves: rhbz#1213409 - Allow pcp_pmie and pcp_pmlogger to read all domains state. Resolves: rhbz#1206525 - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port. Resolves: rhbz#1275246 - cockpit has grown content in /var/run directory Resolves: rhbz#1279429 - Allow collectd setgid capability Resolves:#1310898 - Remove declaration of empty booleans in virt policy. Resolves: rhbz#1103153 - Fix typo in drbd policy - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp. Resolves: rhbz#1134883 - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files. Resolves: rhbz#1293788 - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern. Resolves: rhbz#1254188 - Allow abrt_t to read sysctl_net_t files. Resolves: rhbz#1254188 - The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system. - Allow abrt-hook-ccpp to getattr on all executables. - Allow setuid/setgid capabilities for abrt-hook-ccpp. Resolves: rhbz#1254188 - abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling. Resolves: rhbz#1254188 - Allow abrt-hook-ccpp to change SELinux user identity for created objects. Resolves: rhbz#1254188 - Dontaudit write access to inherited kdumpctl tmp files. Resolves: rbhz#1156442 - Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables) Resolves: rhbz#1291801 - Label 8952 tcp port as nsd_control. Resolves: rhbz#1293140 - Allow ipsec to use pam. Resolves: rhbz#1315700 - Allow to log out to gdm after screen was resized in session via vdagent. Resolves: rhbz#1249020 - Allow setrans daemon to read /proc/meminfo. Resolves: rhbz#1316804 - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg Resolves: rhbz#1298151 - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution Resolves: rhbz#1236579 - Add new selinux policy for systemd-resolved dawmon. Resolves: rhbz#1236579 - Add interface ssh_getattr_server_keys() interface. Resolves: rhbz#1306197 - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106 Resolves: rhbz#1306197 - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used. Resolves: rhbz#1309417 - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t. Resolves: rhbz#1293788- Prepare selinux-policy package for userspace release 2016-02-23. Resolves: rhbz#1305982- Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902 - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols. Resolves: rhbz#1242506 - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba. Resolves: rhbz#1284972 - Add support for systemd-hwdb daemon. Resolves: rhbz#1257940 - Add interface fs_setattr_cifs_dirs(). Resolves: rhbz#1284972- Add new SELinux policy fo targetd daemon. Resolves: rhbz#1063714 - Add new SELinux policy fo ipmievd daemon. Resolves: rhbz#1083031 - Add new SELinux policy fo hsqldb daemon. Resolves: rhbz#1083171 - Add new SELinux policy for blkmapd daemon. Resolves: rhbz#1072997 - Allow p11-child to connect to apache ports. - Label /usr/sbin/lvmlockd binary file as lvm_exec_t. Resolves: rhbz#1278028 - Add interface "lvm_manage_lock" to lvm policy. Resolves: rhbz#1063714- Allow openvswitch domain capability sys_rawio. Resolves: rhbz#1278495- Allow openvswitch to manage hugetlfs files and dirs. Resolves: rhbz#1278495 - Add fs_manage_hugetlbfs_files() interface. Resolves: rhbz#1278495- Allow smbcontrol domain to send sigchld to ctdbd domain. Resolves: #1293784 - Allow openvswitch read/write hugetlb filesystem. Resolves: #1278495Allow hypervvssd to list all mountpoints to have VSS live backup working correctly. Resolves:#1247880- Revert Add missing labeling for /usr/libexec/abrt-hook-ccpp patch Resolves: #1254188- Allow search dirs in sysfs types in kernel_read_security_state. Resolves: #1254188 - Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs. Resolves: #1254188- Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs Resolves: #1254188 - We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes. Resolves:#1261938- Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t. - Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions. Resolves:#1266928- We need to require sandbox_web_type attribute in sandbox_x_domain_template(). Resolves: #1261938 - ipsec: The NM helper needs to read the SAs Resolves: #1259786 - ipsec: Allow ipsec management to create ptys Resolves: #1259786- Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type. Resolves:#1261938 - Allow abrt_t domain to write to kernel msg device. Resolves: #1257828 - Allow rpcbind_t domain to change file owner and group Resolves: #1265266- Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. Resolves: #1256459- Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it. Resolves: #1230300 - Allow qpid daemon to connect on amqp tcp port. Resolves: #1261805- Label /etc/ipa/nssdb dir as cert_t Resolves:#1262718 - Do not provide docker policy files which is shipped by docker-selinux.rpm Resolves:#1262812- Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager Resolves: #1192338 - Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem. Resolves: #1238079 - Allow rhsmcertd_t send signull to unconfined_service_t domains. Resolves: #1176078 - Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t. - Allow openhpid_t daemon to manage snmp files and dirs. Resolves: #1243902 - Allow mdadm_t domain read/write to general ptys and unallocated ttys. Resolves: #1073314 - Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t Resolves: #1176078- Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. Resolves:#1250456- Fix labeling for fence_scsi_check script Resolves: #1255020 - Allow openhpid to read system state Allow openhpid to connect to tcp http port. Resolves: #1244248 - Allow openhpid to read snmp var lib files. Resolves: #1243902 - Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe - Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t Resolves: #1243403 - Remove bin_t label for /usr/share/cluster/fence_scsi_check\.pl Resolves: #1255020- Fix regexp in chronyd.fc file Resolves: #1243764 - Allow passenger to getattr filesystem xattr Resolves: #1196555 - Label mdadm.conf.anackbak as mdadm_conf_t file. Resolves: #1088904 - Revert "Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc." - Allow watchdog execute fenced python script. Resolves: #1255020 - Added inferface watchdog_unconfined_exec_read_lnk_files() - Remove labeling for /var/db/.*\.db as etc_t to label db files as system_db_t. Resolves: #1230877- Allow watchdog execute fenced python script. Resolves: #1255020 - Added inferface watchdog_unconfined_exec_read_lnk_files() - Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764 - Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764- Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file. Resolves: #1252442- Allow exec pidof under hypervkvp domain. Resolves: #1254870 - Allow hypervkvp daemon create connection to the system DBUS Resolves: #1254870- Allow openhpid_t to read system state. Resolves: #1244248 - Added labels for files provided by rh-nginx18 collection Resolves: #1249945 - Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db. Resolves: #1252968 - Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution. Resolves: #1243431 - Allow abrt_dump_oops_t to read proc_security_t files. - Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains - Add interface abrt_dump_oops_domtrans() - Add mountpoint dontaudit access check in rhsmcertd policy. Resolves: #1243431 - Allow samba_net_t to manage samba_var_t sock files. Resolves: #1252937 - Allow chrome setcap to itself. Resolves: #1251996 - Allow httpd daemon to manage httpd_var_lib_t lnk_files. Resolves: #1253706 - Allow chronyd exec systemctl Resolves: #1243764 - Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t. Resolves: #1243764 - Added interface fs_dontaudit_write_configfs_dirs - Add label for kernel module dep files in /usr/lib/modules Resolves:#916635 - Allow kernel_t domtrans to abrt_dump_oops_t - Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override. - Allow systemd-networkd to send logs to systemd-journald. Resolves: #1236616- Fix label on /var/tmp/kiprop_0 Resolves:#1220763 - Allow lldpad_t to getattr tmpfs_t. Resolves: #1246220 - Label /dev/shm/lldpad.* as lldapd_tmpfs_t Resolves: #1246220 - Allow audisp client to read system state.- Allow pcp_domain to manage pcp_var_lib_t lnk_files. Resolves: #1252341 - Label /var/run/xtables.* as iptables_var_run_t Resolves: #1243403- Add interface to read/write watchdog device - Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde Resolves:#1210237 - Allow apcupsd_t to read /sys/devices Resolves:#1189185 - Allow logrotate to reload services. Resolves: #1242453 - Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device) Resolves: #1244260 - Allow openhpid liboa_soap plugin to read generic certs. Resolves: #1244248 - Allow openhpid liboa_soap plugin to read resolv.conf file. Resolves: #1244248 - Label /usr/libexec/chrony-helper as chronyd_exec_t - Allow chronyd_t to read dhcpc state. - Allow chronyd to execute mkdir command.- Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t. Resolves:#1073314 - Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if 'dracut -fv' is executed in MLS. - Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if 'dracut -vf' is executed. We allow it for other SELinux users. - Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode. - Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling. Resolves:#1183503 - Add support for /etc/sanlock which is writable by sanlock daemon. Resolves:#1231377 - Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet. Resolves:#1243775 - Allow snapperd to pass data (one way only) via pipe negotiated over dbus Resolves:#1250550 - Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.- Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files). Resolves: #1243902 - Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device Resolves: #1238079 - Allow lsm_plugin_t to rw raw_fixed_disk. Resolves:#1238079 - Allow rhsmcertd to send signull to unconfined_service.- Allow httpd_suexec_t to read and write Apache stream sockets Resolves: #1243569 - Allow qpid to create lnk_files in qpid_var_lib_t Resolves: #1247279- Allow drbd to get attributes from filesystems. - Allow redis to read kernel parameters. Resolves: #1209518 - Allow virt_qemu_ga_t domtrans to passwd_t - Allow audisp_remote_t to start power unit files domain to allow halt system. Resolves: #1186780 - Allow audisp_remote_t to read/write user domain pty. Resolves: #1186780 - Label /usr/sbin/chpasswd as passwd_exec_t. - Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds). Resolves:#1221121- gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te - Allow pcp_pmcd daemon to read postfix config files. - Allow pcp_pmcd daemon to search postfix spool dirs. Resolves: #1213740 - Added Booleans: pcp_read_generic_logs. Resolves: #1213740 - Allow drbd to read configuration options used when loading modules. Resolves: #1134883 - Allow glusterd to manage nfsd and rpcd services. - Allow glusterd to communicate with cluster domains over stream socket. - glusterd call pcs utility which calls find for cib.* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.- Allow glusterd to manage nfsd and rpcd services. - Allow networkmanager to communicate via dbus with systemd_hostanmed. Resolves: #1234954 - Allow stream connect logrotate to prosody. - Add prosody_stream_connect() interface. - httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t. - Allow prosody to create own tmp files/dirs. Resolves:#1212498- Allow networkmanager read rfcomm port. Resolves:#1212498 - Remove non exists label. - Fix *_admin intefaces where body is not consistent with header. - Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config - Remove non exits nfsd_ro_t label. - Make all interfaces related to openshift_cache_t as deprecated. - Add rpm_var_run_t label to rpm_admin header - Add jabberd_lock_t label to jabberd_admin header. - Add samba_unconfined_script_exec_t to samba_admin header. - inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t - Fix ctdb policy - Add samba_signull_winbind() - Add samba_signull_unconfined_net() - Allow ctdbd_t send signull to samba_unconfined_net_t. - Allow openshift_initrc_t to communicate with firewalld over dbus Resolves:#1221326- Allow gluster to connect to all ports. It is required by random services executed by gluster. - Add interfaces winbind_signull(), samba_unconfined_net_signull(). - Dontaudit smbd_t block_suspend capability. This is kernel bug. - Allow ctdbd sending signull to process winbind, samba_unconfined_net, to checking if processes exists. - Add tmpreaper booleans to use nfs_t and samba_share_t. - Fix path from /usr/sbin/redis-server to /usr/bin/redis-server - Allow connect ypserv to portmap_port_t - Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files - Add support for openstack-nova-* packages - Allow NetworkManager_t send signull to dnssec_trigger_t. - Allow glusterd to execute showmount in the showmount domain. - Label swift-container-reconciler binary as swift_t. - Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files. - Add cobbler_var_lib_t to "/var/lib/tftpboot/boot(/.*)?" Resolves:#1213540 - Merge all nova_* labels under one nova_t.- Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins Resolves:#1233550 - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/ - Add support for oddjob based helper in FreeIPA. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add nagios_domtrans_unconfined_plugins() interface. - Update mta_filetrans_named_content() interface to cover more db files. Resolves:#1167468 - Add back ftpd_use_passive_mode boolean with fixed description. - Allow pmcd daemon stream connect to mysqld. - Allow pcp domains to connect to own process using unix_stream_socket. Resolves:#1213709 - Allow abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add support for oddjob based helper in FreeIPA. - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/- Allow iptables to read ctdbd lib files. Resolves:#1224879 - Add systemd_networkd_t to nsswitch domains. - Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization. Resolves:#1130675 - Allow NetworkManager write to sysfs. - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission. - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types. - Allow NetworkManager write to sysfs. - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. - Dontaudit apache to manage snmpd_var_lib_t files/dirs. - Add interface snmp_dontaudit_manage_snmp_var_lib_files(). - Dontaudit mozilla_plugin_t cap. sys_ptrace. - Rename xodbc-connect port to xodbc_connect - Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports. - Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot. - Dontaudit chrome to read passwd file. - nrpe needs kill capability to make gluster moniterd nodes working. Resolves:#1235587- We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem. - Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so. - Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password. - Label gluster python hooks also as bin_t. - Allow glusterd to interact with gluster tools running in a user domain - Add glusterd_manage_lib_files() interface. - ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid. - Allow samba_t net_admin capability to make CIFS mount working. - S30samba-start gluster hooks wants to search audit logs. Dontaudit it. Resolves:#1224879- Allow glusterd to send generic signals to systemd_passwd_agent processes. - Allow glusterd to access init scripts/units without defined policy - Allow glusterd to run init scripts. - Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain. Resolves:#1224879- Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block. - Allow samba-net to access /var/lib/ctdbd dirs/files. - Allow glusterd to send a signal to smbd. - Make ctdbd as home manager to access also FUSE. - Allow glusterd to use geo-replication gluster tool. - Allow glusterd to execute ssh-keygen. - Allow glusterd to interact with cluster services. - Allow glusterd to connect to the system DBUS for service (acquire_svc). - Label /dev/log correctly. Resolves:#1230932- Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs - Add cgdcbxd policy Resolves:#1072493 - Fix ftp_homedir boolean Resolve:#1097775 - Dontaudit ifconfig writing inhertited /var/log/pluto.log. - Allow cluster domain to dbus chat with systemd-logind. Resolves:#1145215 - Dontaudit write access to inherited kdumpctl tmp files Resolves:#1156442 - Allow isnsd_t to communicate with sssd Resolves:#1167702 - Allow rwho_t to communicate with sssd Resolves:#1167718 - Allow sblim_gatherd_t to communicate with sssd Resolves:#1167732 - Allow pkcs_slotd_t to communicate with sssd Resolves:#1167737 - Allow openvswitch_t to communicate with sssd Resolves:#1167816 - Allow mysqld_safe_t to communicate with sssd Resolves:#1167832 - Allow sshd_keygen_t to communicate with sssd Resolves:#1167840 - Add support for iprdbg logging files in /var/log. Resolves:#1174363 - Allow tmpreaper_t to manage ntp log content Resolves:#1176965 - Allow gssd_t to manage ssh keyring Resolves:#1184791 - Allow httpd_sys_script_t to send system log messages Resolves:#1185231 - Allow apcupsd_t to read /sys/devices Resolves:#1189185 - Allow dovecot_t sys_resource capability Resolves:#1191143 - Add support for mongod/mongos systemd unit files. Resolves:#1197038 - Add bacula fixes - Added label mysqld_etc_t for /etc/my.cnf.d/ dir. Resolves:#1203991- Label /usr/libexec/postgresql-ctl as postgresql_exec_t. - Add more restriction on entrypoint for unconfined domains. - Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface - Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default. - Update policy/mls for sockets related to access perm. Rules were contradictory. - Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow r un sudo from NRPE utils scripts and allow run nagios in conjunction w ith PNP4Nagios. Resolves:#1201054 - Don't use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead. - Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type - Label /var/lib/tftpboot/aarch64(/.*)? and /var/lib/tftpboot/images2(/.*)? - Add support for iprdbg logging files in /var/log. - Add fixes to rhsmcertd_t - Allow puppetagent_t to transfer firewalld messages over dbus - Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script. - Added label mysqld_etc_t for /etc/my.cnf.d/ dir. - Add support for mongod/mongos systemd unit files. - cloudinit and rhsmcertd need to communicate with dbus - Allow dovecot_t sys_resource capability- ALlow mongod execmem by default. - Update policy/mls for sockets. Rules were contradictory. Resolves:#1207133 - Allow a user to login with different security level via ssh.- Update seutil_manage_config() interface. Resolves:#1185962 - Allow pki-tomcat relabel pki_tomcat_etc_rw_t. - Turn on docker_transition_unconfined by default- Allow virtd to list all mountpoints. Resolves:#1180713- pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t. - Allow fowner capability for sssd because of selinux_child handling. - ALlow bind to read/write inherited ipsec pipes - Allow hypervkvp to read /dev/urandom and read addition states/config files. - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd. - Add glusterd_filetrans_named_pid() interface - Allow radiusd to connect to radsec ports. - Allow setuid/setgid for selinux_child - Allow lsmd plugin to connect to tcp/5988 by default. - Allow lsmd plugin to connect to tcp/5989 by default. - Update ipsec_manage_pid() interface. Resolves:#1184978- Update ipsec_manage_pid() interface. Resolves:#1184978- Allow ntlm_auth running in winbind_helper_t to access /dev/urandom.- Add auditing support for ipsec. Resolves:#1182524 - Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t - Allow netutils chown capability to make tcpdump working with -w- Allow ipsec to execute _updown.netkey script to run unbound-control. - Allow neutron to read rpm DB. - Add additional fixes for hyperkvp * creates new ifcfg-{name} file * Runs hv_set_ifconfig.sh, which does the following * Copies ifcfg-{name} to /etc/sysconfig/network-scripts - Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t - Add labeling for pacemaker.log. - Allow radius to connect/bind radsec ports. - Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log - Allow virt_qemu_ga to dbus chat with rpm. - Update virt_read_content() interface to allow read also char devices. - Allow glance-registry to connect to keystone port. Resolves:#1181818- Allow sssd to send dbus all user domains. Resolves:#1172291 - Allow lsm plugin to read certificates. - Fix labeling for keystone CGI scripts. - Make snapperd back as unconfined domain.- Fix bugs in interfaces discovered by sepolicy. - Allow slapd to read /usr/share/cracklib/pw_dict.hwm. - Allow lsm plugins to connect to tcp/18700 by default. - Allow brltty mknod capability to allow create /var/run/brltty/vcsa. - Fix pcp_domain_template() interface. - Fix conman.te. - Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc - Allow glance-scrubber to connect tcp/9191. - Add missing setuid capability for sblim-sfcbd. - Allow pegasus ioctl() on providers. - Add conman_can_network. - Allow chronyd to read chrony conf files located in /run/timemaster/. - Allow radius to bind on tcp/1813 port. - dontaudit block suspend access for openvpn_t - Allow conman to create files/dirs in /tmp. - Update xserver_rw_xdm_keys() interface to have 'setattr'. Resolves:#1172291 - Allow sulogin to read /dev/urandom and /dev/random. - Update radius port definition to have also tcp/18121 - Label prandom as random_device_t. - Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.- Allow virt_qemu_ga_t to execute kmod. - Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean. - Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs. Resolves:#1113725 - Enable OpenStack cinder policy - Add support for /usr/share/vdsm/daemonAdapter - Add support for /var/run/gluster- Remove old pkcsslotd.pp from minimum package - Allow rlogind to use also rlogin ports. - Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t. - Allow bacula to connect also to postgresql. - Label /usr/libexec/tomcat/server as tomcat_exec_t - Add support for /usr/sbin/ctdbd_wrapper - Add support for /usr/libexec/ppc64-diag/rtas_errd - Allow rpm_script_roles to access system_mail_t - Allow brltty to create /var/run/brltty - Allow lsmd plugin to access netlink_route_socket - Allow smbcontrol to read passwd - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it Resolves:#1140106 - Allow osad to execute rhn_check - Allow load_policy to rw inherited sssd pipes because of selinux_child - Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS - Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly - Add additional booleans substitions- Add seutil_dontaudit_access_check_semanage_module_store() interface Resolves:#1140106 - Update to have all _systemctl() interface also init_reload_services(). - Dontaudit access check on SELinux module store for sssd. - Add labeling for /sbin/iw. - Allow named_filetrans_domain to create ibus directory with correct labeling.- Allow radius to bind tcp/1812 radius port. - Dontaudit list user_tmp files for system_mail_t. - Label virt-who as virtd_exec_t. - Allow rhsmcertd to send a null signal to virt-who running as virtd_t. - Add missing alias for _content_rw_t. Resolves:#1089177 - Allow spamd to access razor-agent.log. - Add fixes for sfcb from libvirt-cim TestOnly bug. - Allow NetworkManager stream connect on openvpn. - Make /usr/bin/vncserver running as unconfined_service_t. - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain. - Label /etc/docker/certs.d as cert_t.- Label /etc/strongimcv as ipsec_conf_file_t. - Add support for /usr/bin/start-puppet-ca helper script Resolves:#1160727 - Allow rpm scripts to enable/disable transient systemd units. Resolves:#1154613 - Make kpropdas nsswitch domain Resolves:#1153561 - Make all glance domain as nsswitch domains Resolves:#1113281 - Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active - Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t Resolves:#1140106- Dontaudit access check on setfiles/load_policy for sssd_t. Resolves:#1140106 - Add kdump_rw_inherited_kdumpctl_tmp_pipes() Resolves:#1156442 - Make linuxptp services as unconfined. - Added new policy linuxptp. Resolves:#1149693 - Label keystone cgi files as keystone_cgi_script_exec_t. Resolves:#1138424 - Make tuned as unconfined domain- Allow guest to connect to libvirt using unix_stream_socket. - Allow all bus client domains to dbus chat with unconfined_service_t. - Allow inetd service without own policy to run in inetd_child_t which is unconfined domain. - Make opensm as nsswitch domain to make it working with sssd. - Allow brctl to read meminfo. - Allow winbind-helper to execute ntlm_auth in the caller domain. Resolves:#1160339 - Make plymouthd as nsswitch domain to make it working with sssd. Resolves:#1160196 - Make drbd as nsswitch domain to make it working with sssd. - Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working. - Add support for /var/lib/sntp directory. - Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc - Allow winbind to read usermodehelper - Allow telepathy domains to execute shells and bin_t - Allow gpgdomains to create netlink_kobject_uevent_sockets - Allow mongodb to bind to the mongo port and mongos to run as mongod_t - Allow abrt to read software raid state. - Allow nslcd to execute netstat. - Allow dovecot to create user's home directory when they log into IMAP. - Allow login domains to create kernel keyring with different level.- Allow modemmanger to connectto itself Resolves:#1120152 - Allow pki_tomcat to create link files in /var/lib/pki-ca. Resolves:#1121744 - varnishd needs to have fsetid capability Resolves:#1125165 - Allow snapperd to dbus chat with system cron jobs. Resolves:#1152447 - Allow dovecot to create user's home directory when they log into IMAP Resolves:#1152773 - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t. - ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. - Allow nslcd to execute netstat. - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability. - Allow nslcd to read /dev/urandom.- Add back kill permisiion for system class Resolves:#1150011- Add back kill permisiion for service class Resolves:#1150011 - Make rhsmcertd_t also as dbus domain. - Allow named to create DNS_25 with correct labeling. - Add cloudform_dontaudit_write_cloud_log() - Call auth_use_nsswitch to apache to read/write cloud-init keys. - Allow cloud-init to dbus chat with certmonger. - Fix path to mon_statd_initrc_t script. - Allow all RHCS services to read system state. - Allow dnssec_trigger_t to execute unbound-control in own domain. - kernel_read_system_state needs to be called with type. Moved it to antivirus.if. - Added policy for mon_statd and mon_procd services. BZ (1077821) - Allow opensm_t to read/write /dev/infiniband/umad1. - Allow mongodb to manage own log files. - Allow neutron connections to system dbus. - Add support for /var/lib/swiftdirectory. - Allow nova-scheduler to read certs. - Allow openvpn to access /sys/fs/cgroup dir. - Allow openvpn to execute systemd-passwd-agent in systemd_passwd_agent_t to make openvpn working with systemd. - Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files. - Add auth_use_nsswitch for portreserve to make it working with sssd. - automount policy is non-base module so it needs to be called in optional block. - ALlow sensord to getattr on sysfs. - Label /usr/share/corosync/corosync as cluster_exec_t. - Allow lmsd_plugin to read passwd file. BZ(1093733) - Allow read antivirus domain all kernel sysctls. - Allow mandb to getattr on file systems - Allow nova-console to connect to mem_cache port. - Make sosreport as unconfined domain. - Allow mondogdb to 'accept' accesses on the tcp_socket port. - ALlow sanlock to send a signal to virtd_t.- Build also MLS policy Resolves:#1138424- Add back kill permisiion for system class - Allow iptables read fail2ban logs. - Fix radius labeled ports - Add userdom_manage_user_tmpfs_files interface - Allow libreswan to connect to VPN via NM-libreswan. - Label 4101 tcp port as brlp port - fix dev_getattr_generic_usb_dev interface - Allow all domains to read fonts - Make sure /run/systemd/generator and system is labeled correctly on creation. - Dontaudit aicuu to search home config dir. - Make keystone_cgi_script_t domain. Resolves:#1138424 - Fix bug in drbd policy, - Added support for cpuplug. - ALlow sanlock_t to read sysfs_t. - Added sendmail_domtrans_unconfined interface - Fix broken interfaces - radiusd wants to write own log files. - Label /usr/libexec/rhsmd as rhsmcertd_exec_t - Allow rhsmcertd send signull to setroubleshoot. - Allow rhsmcertd manage rpm db. - Added policy for blrtty. - Fix keepalived policy - Allow rhev-agentd dbus chat with systemd-logind. - Allow keepalived manage snmp var lib sock files. - Add support for /var/lib/graphite-web - Allow NetworkManager to create Bluetooth SDP sockets - It's going to do the the discovery for DUN service for modems with Bluez 5. - Allow swift to connect to all ephemeral ports by default. - Allow sssd to read selinux config to add SELinux user mapping. - Allow lsmd to search own plguins. - Allow abrt to read /dev/memto generate an unique machine_id and uses sosuploader's algorithm based off dmidecode[1] fields. - ALlow zebra for user/group look-ups. - Allow nova domains to getattr on all filesystems. - Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes. - Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket. - Allow rhnsd_t to manage also rhnsd config symlinks. - ALlow user mail domains to create dead.letter. - Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. - Allow pki-tomcat to change SELinux object identity. - Allow radious to connect to apache ports to do OCSP check - Allow git cgi scripts to create content in /tmp - Allow cockpit-session to do GSSAPI logins. - Allow sensord read in /proc - Additional access required by usbmuxd- Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems - Label /usr/lib/erlang/erts.*/bin files as bin_t - Add files_dontaudit_access_check_home_dir() inteface. - Allow udev_t mounton udev_var_run_t dirs #(1128618) - Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it. - Add init_dontaudit_read_state() interface. - Add label for ~/.local/share/fonts - Allow unconfined_r to access unconfined_service_t. - Allow init to read all config files - Add new interface to allow creation of file with lib_t type - Assign rabbitmq port. - Allow unconfined_service_t to dbus chat with all dbus domains - Add new interfaces to access users keys. - Allow domains to are allowed to mounton proc to mount on files as well as dirs - Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories. - Add a port definition for shellinaboxd - Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t - Allow userdomains to stream connect to pcscd for smart cards - Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix) - Update to rawhide-contrib changes Resolves:#1123844- Rebase to 3.13.1 which we have in Fedora21 Resolves:#1128284- Back port fixes from Fedora. Mainly OpenStack and Docker fixes- Add policy-rhel-7.1-{base,contrib} patches- Add support for us_cli ports - Fix labeling for /var/run/user//gvfs - add support for tcp/9697 - Additional rules required by openstack, needs backport to F20 and RHEL7 - Additional access required by docker - ALlow motion to use tcp/8082 port - Allow init_t to setattr/relabelfrom dhcp state files - Dontaudit antivirus domains read access on all security files by default - Add missing alias for old amavis_etc_t type - Allow block_suspend cap for haproxy - Additional fixes for instack overcloud - Allow OpenStack to read mysqld_db links and connect to MySQL - Remove dup filename rules in gnome.te - Allow sys_chroot cap for httpd_t and setattr on httpd_log_t - Allow iscsid to handle own unit files - Add iscsi_systemctl() - Allow mongod to create also sock_files in /run with correct labeling - Allow httpd to send signull to apache script domains and don't audit leaks - Allow rabbitmq_beam to connect to httpd port - Allow aiccu stream connect to pcscd - Allow dmesg to read hwdata and memory dev - Allow all freeipmi domains to read/write ipmi devices - Allow sblim_sfcbd to use also pegasus-https port - Allow rabbitmq_epmd to manage rabbit_var_log_t files - Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input - Allow docker to status any unit file and allow it to start generic unit files- Change hsperfdata_root to have as user_tmp_t Resolves:#1076523- Fix Multiple same specifications for /var/named/chroot/dev/zero - Add labels for /var/named/chroot_sdb/dev devices - Add support for strongimcv - Use kerberos_keytab_domains in auth_use_nsswitch - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to - Allow net_raw cap for neutron_t and send sigkill to dnsmasq - Fix ntp_filetrans_named_content for sntp-kod file - Add httpd_dbus_sssd boolean - Dontaudit exec insmod in boinc policy - Rename kerberos_keytab_domain to kerberos_keytab_domains - Add kerberos_keytab_domain() - Fix kerberos_keytab_template() - Make all domains which use kerberos as kerberos_keytab_domain Resolves:#1083670 - Allow kill capability to winbind_t- varnishd wants chown capability - update ntp_filetrans_named_content() interface - Add additional fixes for neutron_t. #1083335 - Dontaudit getattr on proc_kcore_t - Allow pki_tomcat_t to read ipa lib files - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign - Allow init_t run /sbin/augenrules - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces - Allow unpriv SELinux user to use sandbox - Add default label for /tmp/hsperfdata_root- Add file subs also for /var/home- Allow xauth_t to read user_home_dir_t lnk_file - Add labeling for lightdm-data - Allow certmonger to manage ipa lib files - Add support for /var/lib/ipa - Allow pegasus to getattr virt_content - Added some new rules to pcp policy - Allow chrome_sandbox to execute config_home_t - Add support for ABRT FAF- Allow kdm to send signull to remote_login_t process - Add gear policy - Turn on gear_port_t - Allow cgit to read gitosis lib files by default - Allow vdagent to read xdm state - Allow NM and fcoeadm to talk together over unix_dgram_socket- Back port fixes for pegasus_openlmi_admin_t from rawhide Resolves:#1080973 - Add labels for ostree - Add SELinux awareness for NM - Label /usr/sbin/pwhistory_helper as updpwd_exec_t- add gnome_append_home_config() - Allow thumb to append GNOME config home files - Allow rasdaemon to rw /dev/cpu//msr - fix /var/log/pki file spec - make bacula_t as auth_nsswitch domain - Identify pki_tomcat_cert_t as a cert_type - Define speech-dispater_exec_t as an application executable - Add a new file context for /var/named/chroot/run directory - update storage_filetrans_all_named_dev for sg* devices - Allow auditctl_t to getattr on all removeable devices - Allow nsswitch_domains to stream connect to nmbd - Allow unprivusers to connect to memcached - label /var/lib/dirsrv/scripts-INSTANCE as bin_t- Allow also unpriv user to run vmtools - Allow secadm to read /dev/urandom and meminfo Resolves:#1079250 - Add booleans to allow docker processes to use nfs and samba - Add mdadm_tmpfs support - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t - Allow vmware-user-sui to use user ttys - Allow talk 2 users logged via console too - Allow ftp services to manage xferlog_t - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies - allow anaconda to dbus chat with systemd-localed- allow anaconda to dbus chat with systemd-localed - Add fixes for haproxy based on bperkins@redhat.com - Allow cmirrord to make dmsetup working - Allow NM to execute arping - Allow users to send messages through talk - Add userdom_tmp_role for secadm_t- Add additional fixes for rtas_errd - Fix transitions for tmp/tmpfs in rtas.te - Allow rtas_errd to readl all sysctls- Add support for /var/spool/rhsm/debug - Make virt_sandbox_use_audit as True by default - Allow svirt_sandbox_domains to ptrace themselves- Allow docker containers to manage /var/lib/docker content- Allow docker to read tmpfs_t symlinks - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets- Allow collectd to talk to libvirt - Allow chrome_sandbox to use leaked unix_stream_sockets - Dontaudit leaks of sockets into chrome_sandbox_t - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t - Run vmtools as unconfined domains - Allow snort to manage its log files - Allow systemd_cronjob_t to be entered via bin_t - Allow procman to list doveconf_etc_t - allow keyring daemon to create content in tmpfs directories - Add proper labelling for icedtea-web - vpnc is creating content in networkmanager var run directory - Label sddm as xdm_exec_t to make KDE working again - Allow postgresql to read network state - Allow java running as pki_tomcat to read network sysctls - Fix cgroup.te to allow cgred to read cgconfig_etc_t - Allow beam.smp to use ephemeral ports - Allow winbind to use the nis to authenticate passwords- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least. - Allow net_admin cap for fence_virtd running as fenced_t - Make abrt-java-connector working - Make cimtest script 03_defineVS.py of ComputerSystem group working - Fix git_system_enable_homedirs boolean - Allow munin mail plugins to read network systcl- Allow vmtools_helper_t to execute bin_t - Add support for /usr/share/joomla - /var/lib/containers should be labeled as openshift content for now - Allow docker domains to talk to the login programs, to allow a process to login into the container - Allow install_t do dbus chat with NM - Fix interface names in anaconda.if - Add install_t for anaconda. A new type is a part of anaconda policy - sshd to read network sysctls- Allow zabbix to send system log msgs - Allow init_t to stream connect to ipsec Resolves:#1060775- Add docker_connect_any boolean- Allow unpriv SELinux users to dbus chat with firewalld - Add lvm_write_metadata() - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type - Allow pegasus_openlmi_storage_t to write lvm metadata - Add hide_broken_symptoms for kdumpgui because of systemd bug - Make kdumpgui_t as unconfined domain Resolves:#1044299 - Allow docker to connect to tcp/5000- Allow numad to write scan_sleep_millisecs - Turn on entropyd_use_audio boolean by default - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf. - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo - Fix label on irclogs in the homedir - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix - Allow postgresql to use ldap - Add missing syslog-conn port - Add support for /dev/vmcp and /dev/sclp Resolves:#1069310- Modify xdm_write_home to allow create files/links in /root with xdm_home_ - Allow virt domains to read network state Resolves:#1072019- Added pcp rules - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6 - clean up ctdb.te - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow certmonger to list home dirs- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask - Add sysnet_filetrans_named_content_ifconfig() interface - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow kerberos keytab domains to manage sssd/userdomain keys" - Allow to run ip cmd in neutron_t domain- Allow block_suspend cap2 for systemd-logind and rw dri device - Add labeling for /usr/libexec/nm-libreswan-service - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working - Add xserver_rw_xdm_keys() - Allow rpm_script_t to dbus chat also with systemd-located - Fix ipa_stream_connect_otpd() - update lpd_manage_spool() interface - Allow krb5kdc to stream connect to ipa-otpd - Add ipa_stream_connect_otpd() interface - Allow vpnc to unlink NM pids - Add networkmanager_delete_pid_files() - Allow munin plugins to access unconfined plugins - update abrt_filetrans_named_content to cover /var/spool/debug - Label /var/spool/debug as abrt_var_cache_t - Allow rhsmcertd to connect to squid port - Make docker_transition_unconfined as optional boolean - Allow certmonger to list home dirs- Make snapperd as unconfined domain and add additional fixes for it - Remove nsplugin.pp module on upgrade- Add snapperd_home_t for HOME_DIR/.snapshots directory - Make sosreport as unconfined domain - Allow sosreport to execute grub2-probe - Allow NM to manage hostname config file - Allow systemd_timedated_t to dbus chat with rpm_script_t - Allow lsmd plugins to connect to http/ssh/http_cache ports by default - Add lsmd_plugin_connect_any boolean - Allow mozilla_plugin to attempt to set capabilities - Allow lsdm_plugins to use tcp_socket - Dontaudit mozilla plugin from getattr on /proc or /sys - Dontaudit use of the keyring by the services in a sandbox - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t - Allow rabbitmq_beam to connect to jabber_interserver_port - Allow logwatch_mail_t to transition to qmail_inject and queueu - Added new rules to pcp policy - Allow vmtools_helper_t to change role to system_r - Allow NM to dbus chat with vmtools - Fix couchdb_manage_files() to allow manage couchdb conf files - Add support for /var/run/redis.sock - dontaudit gpg trying to use audit - Allow consolekit to create log directories and files - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow pkcsslotd to read users state - Add ioctl to init_dontaudit_rw_stream_socket - Add systemd_hostnamed_manage_config() interface - Remove transition for temp dirs created by init_t - gdm-simple-slave uses use setsockopt - sddm-greater is a xdm type program- Add lvm_read_metadata() - Allow auditadm to search /var/log/audit dir - Add lvm_read_metadata() interface - Allow confined users to run vmtools helpers - Fix userdom_common_user_template() - Generic systemd unit scripts do write check on / - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files - Add additional fixes needed for init_t and setup script running in generic unit files - Allow general users to create packet_sockets - added connlcli port - Add init_manage_transient_unit() interface - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t - Fix userdomain.te to require passwd class - devicekit_power sends out a signal to all processes on the message bus when power is going down - Dontaudit rendom domains listing /proc and hittping system_map_t - Dontauit leaks of var_t into ifconfig_t - Allow domains that transition to ssh_t to manipulate its keyring - Define oracleasm_t as a device node - Change to handle /root as a symbolic link for os-tree - Allow sysadm_t to create packet_socket, also move some rules to attributes - Add label for openvswitch port - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label. - Allow postfix_local to read .forward in pcp lib files - Allow pegasus_openlmi_storage_t to read lvm metadata - Add additional fixes for pegasus_openlmi_storage_t - Allow bumblebee to manage debugfs - Make bumblebee as unconfined domain - Allow snmp to read etc_aliases_t - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem - Allow pegasus_openlmi_storage_t to read /proc/1/environ - Dontaudit read gconf files for cupsd_config_t - make vmtools as unconfined domain - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig. - Allow collectd_t to use a mysql database - Allow ipa-otpd to perform DNS name resolution - Added new policy for keepalived - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd - Add additional fixes new pscs-lite+polkit support - Add labeling for /run/krb5kdc - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20 - Allow pcscd to read users proc info - Dontaudit smbd_t sending out random signuls - Add boolean to allow openshift domains to use nfs - Allow w3c_validator to create content in /tmp - zabbix_agent uses nsswitch - Allow procmail and dovecot to work together to deliver mail - Allow spamd to execute files in homedir if boolean turned on - Allow openvswitch to listen on port 6634 - Add net_admin capability in collectd policy - Fixed snapperd policy - Fixed bugsfor pcp policy - Allow dbus_system_domains to be started by init - Fixed some interfaces - Add kerberos_keytab_domain attribute - Fix snapperd_conf_t def- Addopt corenet rules for unbound-anchor to rpm_script_t - Allow runuser to send send audit messages. - Allow postfix-local to search .forward in munin lib dirs - Allow udisks to connect to D-Bus - Allow spamd to connect to spamd port - Fix syntax error in snapper.te - Dontaudit osad to search gconf home files - Allow rhsmcertd to manage /etc/sysconf/rhn director - Fix pcp labeling to accept /usr/bin for all daemon binaries - Fix mcelog_read_log() interface - Allow iscsid to manage iscsi lib files - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it. - Make tuned_t as unconfined domain for RHEL7.0 - Allow ABRT to read puppet certs - Add sys_time capability for virt-ga - Allow gemu-ga to domtrans to hwclock_t - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages - Fix some AVCs in pcp policy - Add to bacula capability setgid and setuid and allow to bind to bacula ports - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t - Add access rhnsd and osad to /etc/sysconfig/rhn - drbdadm executes drbdmeta - Fixes needed for docker - Allow epmd to manage /var/log/rabbitmq/startup_err file - Allow beam.smp connect to amqp port - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t - Allow systemd_tmpfiles_t to manage all non security files on the system - Added labels for bacula ports - Fix label on /dev/vfio/vfio - Add kernel_mounton_messages() interface - init wants to manage lock files for iscsi- Added osad policy - Allow postfix to deliver to procmail - Allow bumblebee to seng kill signal to xserver - Allow vmtools to execute /usr/bin/lsb_release - Allow docker to write system net ctrls - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix pcp.te - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl- Turn on bacula, rhnsd policy - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl - Fixes for *_admin interfaces - Add pegasus_openlmi_storage_var_run_t type def - Add support for /var/run/openlmi-storage - Allow tuned to create syslog.conf with correct labeling - Add httpd_dontaudit_search_dirs boolean - Add support for winbind.service - ALlow also fail2ban-client to read apache logs - Allow vmtools to getattr on all fs - Add support for dey_sapi port - Add logging_filetrans_named_conf() - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring- Update snapper policy - Allow domains to append rkhunter lib files - Allow snapperd to getattr on all fs - Allow xdm to create /var/gdm with correct labeling - Add label for snapper.log - Allow fail2ban-client to read apache log files - Allow thumb_t to execute dbus-daemon in thumb_t- Allow gdm to create /var/gdm with correct labeling - Allow domains to append rkhunterl lib files. #1057982 - Allow systemd_tmpfiles_t net_admin to communicate with journald - Add interface to getattr on an isid_type for any type of file - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory - Allow initrc_t domtrans to authconfig if unconfined is enabled - Allow docker and mount on devpts chr_file - Allow docker to transition to unconfined_t if boolean set - init calling needs to be optional in domain.te - Allow uncofined domain types to handle transient unit files - Fix labeling for vfio devices - Allow net_admin capability and send system log msgs - Allow lldpad send dgram to NM - Add networkmanager_dgram_send() - rkhunter_var_lib_t is correct type - Back port pcp policy from rawhide - Allow openlmi-storage to read removable devices - Allow system cron jobs to manage rkhunter lib files - Add rkhunter_manage_lib_files() - Fix ftpd_use_fusefs boolean to allow manage also symlinks - Allow smbcontrob block_suspend cap2 - Allow slpd to read network and system state info - Allow NM domtrans to iscsid_t if iscsiadm is executed - Allow slapd to send a signal itself - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA. - Fix plymouthd_create_log() interface - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container - Allow postfix and cyrus-imapd to work out of box - Allow fcoemon to talk with unpriv user domain using unix_stream_socket - Dontaudit domains that are calling into journald to net_admin - Add rules to allow vmtools to do what it does - snapperd is D-Bus service - Allow OpenLMI PowerManagement to call 'systemctl --force reboot' - Add haproxy_connect_any boolean - Allow haproxy also to use http cache port by default Resolves:#1058248- Allow apache to write to the owncloud data directory in /var/www/html... - Allow consolekit to create log dir - Add support for icinga CGI scripts - Add support for icinga - Allow kdumpctl_t to create kdump lock file Resolves:#1055634 - Allow kdump to create lnk lock file - Allow nscd_t block_suspen capability - Allow unconfined domain types to manage own transient unit file - Allow systemd domains to handle transient init unit files - Add interfaces to handle transient- Add cron unconfined role support for uncofined SELinux user - Call corenet_udp_bind_all_ports() in milter.te - Allow fence_virtd to connect to zented port - Fix header for mirrormanager_admin() - Allow dkim-milter to bind udp ports - Allow milter domains to send signull itself - Allow block_suspend for yum running as mock_t - Allow beam.smp to manage couchdb files - Add couchdb_manage_files() - Add labeling for /var/log/php_errors.log - Allow bumblebee to stream connect to xserver - Allow bumblebee to send a signal to xserver - gnome-thumbnail to stream connect to bumblebee - Allow xkbcomp running as bumblebee_t to execute bin_t - Allow logrotate to read squid.conf - Additional rules to get docker and lxc to play well with SELinux - Allow bumbleed to connect to xserver port - Allow pegasus_openlmi_storage_t to read hwdata- Allow init_t to work on transitient and snapshot unit files - Add logging_manage_syslog_config() - Update sysnet_dns_name_resolve() to allow connect to dnssec por - Allow pegasus_openlmi_storage_t to read hwdata Resolves:#1031721 - Fix rhcs_rw_cluster_tmpfs() - Allow fenced_t to bind on zented udp port - Added policy for vmtools - Fix mirrormanager_read_lib_files() - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files - Allow ctdb to create sock files in /var/run/ctdb - Add sblim_filetrans_named_content() interface - Allow rpm scritplets to create /run/gather with correct labeling - Allow gnome keyring domains to create gnome config dirs - Dontaudit read/write to init stream socket for lsmd_plugin_t - Allow automount to read nfs link files - Allow lsm plugins to read/write lsmd stream socket - Allow certmonger to connect ldap port to make IPA CA certificate renewal working. - Add also labeling for /var/run/ctdb - Add missing labeling for /var/lib/ctdb - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446 - Dontaudit hypervkvp to search homedirs - Dontaudit hypervkvp to search admin homedirs - Allow hypervkvp to execute bin_t and ifconfig in the caller domain - Dontaudit xguest_t to read ABRT conf files - Add abrt_dontaudit_read_config() - Allow namespace-init to getattr on fs - Add thumb_role() also for xguest - Add filename transitions to create .spamassassin with correct labeling - Allow apache domain to read mirrormanager pid files - Allow domains to read/write shm and sem owned by mozilla_plugin_t - Allow alsactl to send a generic signal to kernel_t- Add back rpm_run() for unconfined user- Add missing files_create_var_lib_dirs() - Fix typo in ipsec.te - Allow passwd to create directory in /var/lib - Add filename trans also for event21 - Allow iptables command to read /dev/rand - Add sigkill capabilityfor ipsec_t - Add filename transitions for bcache devices - Add additional rules to create /var/log/cron by syslogd_t with correct labeling - Add give everyone full access to all key rings - Add default lvm_var_run_t label for /var/run/multipathd - Fix log labeling to have correct default label for them after logrotate - Labeled ~/.nv/GLCache as being gstreamer output - Allow nagios_system_plugin to read mrtg lib files - Add mrtg_read_lib_files() - Call rhcs_rw_cluster_tmpfs for dlm_controld - Make authconfing as named_filetrans domain - Allow virsh to connect to user process using stream socket - Allow rtas_errd to read rand/urand devices and add chown capability - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp Resolves:#1051497 - Add also chown cap for abrt_upload_watch_t. It already has dac_override - Allow sosreport to manage rhsmcertd pid files - Add rhsmcertd_manage_pid_files() - Allow also setgid cap for rpc.gssd - Dontaudit access check for abrt on cert_t - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind- Fix semanage import handling in spec file- Add default lvm_var_run_t label for /var/run/multipathd Resolves:#1051430 - Fix log labeling to have correct default label for them after logrotate - Add files_write_root_dirs - Add new openflow port label for 6653/tcp and 6633/tcp - Add xserver_manage_xkb_libs() - Label tcp/8891 as milter por - Allow gnome_manage_generic_cache_files also create cache_home_t files - Fix aide.log labeling - Fix log labeling to have correct default label for them after logrotate - Allow mysqld-safe write access on /root to make mysqld working - Allow sosreport domtrans to prelikn - Allow OpenvSwitch to connec to openflow ports - Allow NM send dgram to lldpad - Allow hyperv domains to execute shell - Allow lsmd plugins stream connect to lsmd/init - Allow sblim domains to create /run/gather with correct labeling - Allow httpd to read ldap certs - Allow cupsd to send dbus msgs to process with different MLS level - Allow bumblebee to stream connect to apmd - Allow bumblebee to run xkbcomp - Additional allow rules to get libvirt-lxc containers working with docker - Additional allow rules to get libvirt-lxc containers working with docker - Allow docker to getattr on itself - Additional rules needed for sandbox apps - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled - httpd should be able to send signal/signull to httpd_suexec_t - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.- Add neutron fixes- Allow sshd to write to all process levels in order to change passwd when running at a level - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range - Allow apcuspd_t to status and start the power unit file - Allow udev to manage kdump unit file - Added new interface modutils_dontaudit_exec_insmod - Allow cobbler to search dhcp_etc_t directory - systemd_systemctl needs sys_admin capability - Allow sytemd_tmpfiles_t to delete all directories - passwd to create gnome-keyring passwd socket - Add missing zabbix_var_lib_t type - Fix filename trans for zabbixsrv in zabbix.te - Allow fprintd_t to send syslog messages - Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port - Allow mozilla plugin to chat with policykit, needed for spice - Allow gssprozy to change user and gid, as well as read user keyrings - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly - Allow polipo to connect to http_cache_ports - Allow cron jobs to manage apache var lib content - Allow yppassword to manage the passwd_file_t - Allow showall_t to send itself signals - Allow cobbler to restart dhcpc, dnsmasq and bind services - Allow certmonger to manage home cert files - Add userdom filename trans for user mail domains - Allow apcuspd_t to status and start the power unit file - Allow cgroupdrulesengd to create content in cgoups directories - Allow smbd_t to signull cluster - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t - Add label for /var/spool/cron.aquota.user - Allow sandbox_x domains to use work with the mozilla plugin semaphore - Added new policy for speech-dispatcher - Added dontaudit rule for insmod_exec_t in rasdaemon policy - Updated rasdaemon policy - Allow system_mail_t to transition to postfix_postdrop_t - Clean up mirrormanager policy - Allow virt_domains to read cert files, needs backport to RHEL7 - Allow sssd to read systemd_login_var_run_t - Allow irc_t to execute shell and bin-t files: - Add new access for mythtv - Allow rsync_t to manage all non auth files - allow modemmanger to read /dev/urand - Allow sandbox apps to attempt to set and get capabilties- Add labeling for /var/lib/servicelog/servicelog.db-journal - Add support for freeipmi port - Add sysadm_u_default_contexts - Make new type to texlive files in homedir - Allow subscription-manager running as sosreport_t to manage rhsmcertd - Additional fixes for docker.te - Remove ability to do mount/sys_admin by default in virt_sandbox domains - New rules required to run docker images within libivrt - Add label for ~/.cvsignore - Change mirrormanager to be run by cron - Add mirrormanager policy - Fixed bumblebee_admin() and mip6d_admin() - Add log support for sensord - Fix typo in docker.te - Allow amanda to do backups over UDP - Allow bumblebee to read /etc/group and clean up bumblebee.te - type transitions with a filename not allowed inside conditionals - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7 - Make new type to texlive files in homedir- Allow freeipmi_ipmidetectd_t to use freeipmi port - Update freeipmi_domain_template() - Allow journalctl running as ABRT to read /run/log/journal - Allow NM to read dispatcher.d directory - Update freeipmi policy - Type transitions with a filename not allowed inside conditionals - Allow tor to bind to hplip port - Make new type to texlive files in homedir - Allow zabbix_agent to transition to dmidecode - Add rules for docker - Allow sosreport to send signull to unconfined_t - Add virt_noatsecure and virt_rlimitinh interfaces - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port - Add sysadm_u_default_contexts - Add logging_read_syslog_pid() - Fix userdom_manage_home_texlive() interface - Make new type to texlive files in homedir - Add filename transitions for /run and /lock links - Allow virtd to inherit rlimit information Resolves:#975358- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t Resolves:#1039879 - Add labeling for /usr/lib/systemd/system/mariadb.service - Allow hyperv_domain to read sysfs - Fix ldap_read_certs() interface to allow acess also link files - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt - Allow tuned to run modprobe - Allow portreserve to search /var/lib/sss dir - Add SELinux support for the teamd package contains team network device control daemon. - Dontaudit access check on /proc for bumblebee - Bumblebee wants to load nvidia modules - Fix rpm_named_filetrans_log_files and wine.te - Add conman policy for rawhide - DRM master and input event devices are used by the TakeDevice API - Clean up bumblebee policy - Update pegasus_openlmi_storage_t policy - Add freeipmi_stream_connect() interface - Allow logwatch read madm.conf to support RAID setup - Add raid_read_conf_files() interface - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling - add rpm_named_filetrans_log_files() interface - Allow dkim-milter to create files/dirs in /tmp - update freeipmi policy - Add policy for freeipmi services - Added rdisc_admin and rdisc_systemctl interfaces - opensm policy clean up - openwsman policy clean up - ninfod policy clean up - Added new policy for ninfod - Added new policy for openwsman - Added rdisc_admin and rdisc_systemctl interfaces - Fix kernel_dontaudit_access_check_proc() - Add support for /dev/uhid - Allow sulogin to get the attributes of initctl and sys_admin cap - Add kernel_dontaudit_access_check_proc() - Fix dev_rw_ipmi_dev() - Fix new interface in devices.if - DRM master and input event devices are used by the TakeDevice API - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev() - Added support for default conman port - Add interfaces for ipmi devices- Allow sosreport to send a signal to ABRT - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t - Label /usr/sbin/htcacheclean as httpd_exec_t Resolves:#1037529 - Added support for rdisc unit file - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs - Allow runuser running as logrotate connections to system DBUS - Label bcache devices as fixed_disk_device_t - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t- Add back setpgid/setsched for sosreport_t- Added fix for clout_init to transition to rpm_script_t (dwalsh@redhat.com)- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel. - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on - Add lsmd_plugin_t for lsm plugins - Allow dovecot-deliver to search mountpoints - Add labeling for /etc/mdadm.conf - Allow opelmi admin providers to dbus chat with init_t - Allow sblim domain to read /dev/urandom and /dev/random - Allow apmd to request the kernel load modules - Add glusterd_brick_t type - label mate-keyring-daemon with gkeyringd_exec_t - Add plymouthd_create_log() - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6 - Allow sssd to request the kernel loads modules - Allow gpg_agent to use ssh-add - Allow gpg_agent to use ssh-add - Dontaudit access check on /root for myslqd_safe_t - Allow ctdb to getattr on al filesystems - Allow abrt to stream connect to syslog - Allow dnsmasq to list dnsmasq.d directory - Watchdog opens the raw socket - Allow watchdog to read network state info - Dontaudit access check on lvm lock dir - Allow sosreport to send signull to setroubleshootd - Add setroubleshoot_signull() interface - Fix ldap_read_certs() interface - Allow sosreport all signal perms - Allow sosreport to run systemctl - Allow sosreport to dbus chat with rpm - Add glusterd_brick_t files type - Allow zabbix_agentd to read all domain state - Clean up rtas.if - Allow smoltclient to execute ldconfig - Allow sosreport to request the kernel to load a module - Fix userdom_confined_admin_template() - Add back exec_content boolean for secadm, logadm, auditadm - Fix files_filetrans_system_db_named_files() interface - Allow sulogin to getattr on /proc/kcore - Add filename transition also for servicelog.db-journal - Add files_dontaudit_access_check_root() - Add lvm_dontaudit_access_check_lock() interface- Allow watchdog to read /etc/passwd - Allow browser plugins to connect to bumblebee - New policy for bumblebee and freqset - Add new policy for mip6d daemon - Add new policy for opensm daemon - Allow condor domains to read/write condor_master udp_socket - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift - Add back file_pid_filetrans for /var/run/dlm_controld - Allow smbd_t to use inherited tmpfs content - Allow mcelog to use the /dev/cpu device - sosreport runs rpcinfo - sosreport runs subscription-manager - Allow staff_t to run frequency command - Allow systemd_tmpfiles to relabel log directories - Allow staff_t to read xserver_log file - Label hsperfdata_root as tmp_t- More sosreport fixes to make ABRT working- Fix files_dontaudit_unmount_all_mountpoints() - Add support for 2608-2609 tcp/udp ports - Should allow domains to lock the terminal device - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - We need to require passwd rootok - Fix zebra.fc - Fix dnsmasq_filetrans_named_content() interface - Allow all sandbox domains create content in svirt_home_t - Allow zebra domains also create zebra_tmp_t files in /tmp - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services. - Fix labeling on neutron and remove transition to iconfig_t - abrt needs to read mcelog log file - Fix labeling on dnsmasq content - Fix labeling on /etc/dnsmasq.d - Allow glusterd to relabel own lib files - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd - Allow ipc_lock for abrt to run journalctl- Fix config.tgz- Fix passenger_stream_connect interface - setroubleshoot_fixit wants to read network state - Allow procmail_t to connect to dovecot stream sockets - Allow cimprovagt service providers to read network states - Add labeling for /var/run/mariadb - pwauth uses lastlog() to update system's lastlog - Allow account provider to read login records - Add support for texlive2013 - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - Allow passwd_t to connect to gnome keyring to change password - Update mls config files to have cronjobs in the user domains - Remove access checks that systemd does not actually do- Add support for yubikey in homedir - Add support for upd/3052 port - Allow apcupsd to use PowerChute Network Shutdown - Allow lsmd to execute various lsmplugins - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too - Update gluster_export_all_rw boolean to allow relabel all base file types - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling- Add files_relabel_base_file_types() interface - Allow netlabel-config to read passwd - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr() - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling - Allow pegasus to domtrans to mount_t - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts - Add support for unconfined watchdog scripts - Allow watchdog to manage own log files- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory. - Label /etc/yum.repos.d as system_conf_t - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t - Allow dac_override for sysadm_screen_t - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file. - Allow netlabel-config to read meminfo - Add interface to allow docker to mounton file_t - Add new interface to exec unlabeled files - Allow lvm to use docker semaphores - Setup transitons for .xsessions-errors.old - Change labels of files in /var/lib/*/.ssh to transition properly - Allow staff_t and user_t to look at logs using journalctl - pluto wants to manage own log file - Allow pluto running as ipsec_t to create pluto.log - Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files. - Additional access for docker - Added more rules to sblim policy - Fix kdumpgui_run_bootloader boolean - Allow dspam to connect to lmtp port - Included sfcbd service into sblim policy - rhsmcertd wants to manaage /etc/pki/consumer dir - Add kdumpgui_run_bootloader boolean - Add support for /var/cache/watchdog - Remove virt_domain attribute for virt_qemu_ga_unconfined_t - Fixes for handling libvirt containes - Dontaudit attempts by mysql_safe to write content into / - Dontaudit attempts by system_mail to modify network config - Allow dspam to bind to lmtp ports - Add new policy to allow staff_t and user_t to look at logs using journalctl - Allow apache cgi scripts to list sysfs - Dontaudit attempts to write/delete user_tmp_t files - Allow all antivirus domains to manage also own log dirs - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Add missing permission checks for nscd- Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Add file transition rules for content created by f5link - Rename quantum_port information to neutron - Allow all antivirus domains to manage also own log dirs - Rename quantum_port information to neutron - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Allow sysadm_t to read login information - Allow systemd_tmpfiles to setattr on var_log_t directories - Udpdate Makefile to include systemd_contexts - Add systemd_contexts - Add fs_exec_hugetlbfs_files() interface - Add daemons_enable_cluster_mode boolean - Fix rsync_filetrans_named_content() - Add rhcs_read_cluster_pid_files() interface - Update rhcs.if with additional interfaces from RHEL6 - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t - Allow glusterd_t to mounton glusterd_tmp_t - Allow glusterd to unmout al filesystems - Allow xenstored to read virt config - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label - Allow mozilla_plugin_t to mmap hugepages as an executable- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp- Allow sshd_t to read openshift content, needs backport to RHEL6.5 - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t - Make sur kdump lock is created with correct label if kdumpctl is executed - gnome interface calls should always be made within an optional_block - Allow syslogd_t to connect to the syslog_tls port - Add labeling for /var/run/charon.ctl socket - Add kdump_filetrans_named_content() - Allo setpgid for fenced_t - Allow setpgid and r/w cluster tmpfs for fenced_t - gnome calls should always be within optional blocks - wicd.pid should be labeled as networkmanager_var_run_t - Allow sys_resource for lldpad- Add rtas policy- Allow mailserver_domains to manage and transition to mailman data - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands - Allow mailserver_domains to manage and transition to mailman data - Allow svirt_domains to read sysctl_net_t - Allow thumb_t to use tmpfs inherited from the user - Allow mozilla_plugin to bind to the vnc port if running with spice - Add new attribute to discover confined_admins and assign confined admin to it - Fix zabbix to handle attributes in interfaces - Fix zabbix to read system states for all zabbix domains - Fix piranha_domain_template() - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files. - Allow lldpad sys_rouserce cap due to #986870 - Allow dovecot-auth to read nologin - Allow openlmi-networking to read /proc/net/dev - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t - Add zabbix_domain attribute for zabbix domains to treat them together - Add labels for zabbix-poxy-* (#1018221) - Update openlmi-storage policy to reflect #1015067 - Back port piranha tmpfs fixes from RHEL6 - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop - Add postfix_rw_spool_maildrop_files interface - Call new userdom_admin_user_templat() also for sysadm_secadm.pp - Fix typo in userdom_admin_user_template() - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey - Add new attribute to discover confined_admins - Fix labeling for /etc/strongswan/ipsec.d - systemd_logind seems to pass fd to anyone who dbus communicates with it - Dontaudit leaked write descriptor to dmesg- Activate motion policy- Fix gnome_read_generic_data_home_files() - allow openshift_cgroup_t to read/write inherited openshift file types - Remove httpd_cobbler_content * from cobbler_admin interface - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container - Allow httpd_t to read also git sys content symlinks - Allow init_t to read gnome home data - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it. - Allow virsh to execute systemctl - Fix for nagios_services plugins - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - Fix hypervkvp.te - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Fix logging policy - Allow syslog to bind to tls ports - Update labeling for /dev/cdc-wdm - Allow to su_domain to read init states - Allow init_t to read gnome home data - Make sure if systemd_logind creates nologin file with the correct label - Clean up ipsec.te- Add auth_exec_chkpwd interface - Fix port definition for ctdb ports - Allow systemd domains to read /dev/urand - Dontaudit attempts for mozilla_plugin to append to /dev/random - Add label for /var/run/charon.* - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service - Fix for nagios_services plugins - Fix some bugs in zoneminder policy - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - glusterd binds to random unreserved ports - Additional allow rules found by testing glusterfs - apcupsd needs to send a message to all users on the system so needs to look them up - Fix the label on ~/.juniper_networks - Dontaudit attempts for mozilla_plugin to append to /dev/random - Allow polipo_daemon to connect to flash ports - Allow gssproxy_t to create replay caches - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type- init reload from systemd_localed_t - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd - Allow systemd_localed_t to ask systemd to reload the locale. - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory - Allow readahead to read /dev/urand - Fix lots of avcs about tuned - Any file names xenstored in /var/log should be treated as xenstored_var_log_t - Allow tuned to inderact with hugepages - Allow condor domains to list etc rw dirs- Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Add additional fixes forpegasus_openlmi_account_t - Allow mdadm to read /dev/urand - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it - Add label/rules for /etc/mdadm.conf - Allow pegasus_openlmi_storage_t to transition to fsadm_t - Fixes for interface definition problems - Dontaudit dovecot-deliver to gettatr on all fs dirs - Allow domains to search data_home_t directories - Allow cobblerd to connect to mysql - Allow mdadm to r/w kdump lock files - Add support for kdump lock files - Label zarafa-search as zarafa-indexer - Openshift cgroup wants to read /etc/passwd - Add new sandbox domains for kvm - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on - Fix labeling for /usr/lib/systemd/system/lvm2.* - Add labeling for /usr/lib/systemd/system/lvm2.* - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules - Add sshd_keygen_t policy for sshd-keygen - Fix alsa_home_filetrans interface name and definition - Allow chown for ssh_keygen_t - Add fs_dontaudit_getattr_all_dirs() - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys - Fix up patch to allow systemd to manage home content - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled - Allow getty to exec hostname to get info - Add systemd_home_t for ~/.local/share/systemd directory- Fix lxc labels in config.tgz- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper - Allow tuned to search all file system directories - Allow alsa_t to sys_nice, to get top performance for sound management - Add support for MySQL/PostgreSQL for amavis - Allow openvpn_t to manage openvpn_var_log_t files. - Allow dirsrv_t to create tmpfs_t directories - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label - Dontaudit leaked unix_stream_sockets into gnome keyring - Allow telepathy domains to inhibit pipes on telepathy domains - Allow cloud-init to domtrans to rpm - Allow abrt daemon to manage abrt-watch tmp files - Allow abrt-upload-watcher to search /var/spool directory - Allow nsswitch domains to manage own process key - Fix labeling for mgetty.* logs - Allow systemd to dbus chat with upower - Allow ipsec to send signull to itself - Allow setgid cap for ipsec_t - Match upstream labeling- Do not build sanbox pkg on MLS- wine_tmp is no longer needed - Allow setroubleshoot to look at /proc - Allow telepathy domains to dbus with systemd logind - Fix handling of fifo files of rpm - Allow mozilla_plugin to transition to itself - Allow certwatch to write to cert_t directories - New abrt application - Allow NetworkManager to set the kernel scheduler - Make wine_domain shared by all wine domains - Allow mdadm_t to read images labeled svirt_image_t - Allow amanda to read /dev/urand - ALlow my_print_default to read /dev/urand - Allow mdadm to write to kdumpctl fifo files - Allow nslcd to send signull to itself - Allow yppasswd to read /dev/urandom - Fix zarafa_setrlimit - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add additional alias for user_tmp_t because wine_tmp_t is no longer used - More handling of ther kernel keyring required by kerberos - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed- Dontaudit attempts by sosreport to read shadow_t - Allow browser sandbox plugins to connect to cups to print - Add new label mpd_home_t - Label /srv/www/logs as httpd_log_t - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add labels for apache logs under miq package - Allow irc_t to use tcp sockets - fix labels in puppet.if - Allow tcsd to read utmp file - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys - Define svirt_socket_t as a domain_type - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t - Fix label on pam_krb5 helper apps- Allow ldconfig to write to kdumpctl fifo files - allow neutron to connect to amqp ports - Allow kdump_manage_crash to list the kdump_crash_t directory - Allow glance-api to connect to amqp port - Allow virt_qemu_ga_t to read meminfo - Add antivirus_home_t type for antivirus date in HOMEDIRS - Allow mpd setcap which is needed by pulseaudio - Allow smbcontrol to create content in /var/lib/samba - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts - amanda_exec_t needs to be executable file - Allow block_suspend cap for samba-net - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t - Allow init_t to run crash utility - Treat usr_t just like bin_t for transitions and executions - Add port definition of pka_ca to port 829 for openshift - Allow selinux_store to use symlinks- Allow block_suspend cap for samba-net - Allow t-mission-control to manage gabble cache files - Allow nslcd to read /sys/devices/system/cpu - Allow selinux_store to use symlinks- Allow xdm_t to transition to itself - Call neutron interfaces instead of quantum - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t - Make sure directories in /run get created with the correct label - Make sure /root/.pki gets created with the right label - try to remove labeling for motion from zoneminder_exec_t to bin_t - Allow inetd_t to execute shell scripts - Allow cloud-init to read all domainstate - Fix to use quantum port - Add interface netowrkmanager_initrc_domtrans - Fix boinc_execmem - Allow t-mission-control to read gabble cache home - Add labeling for ~/.cache/telepathy/avatars/gabble - Allow memcache to read sysfs data - Cleanup antivirus policy and add additional fixes - Add boolean boinc_enable_execstack - Add support for couchdb in rabbitmq policy - Add interface couchdb_search_pid_dirs - Allow firewalld to read NM state - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files()- Split out rlogin ports from inetd - Treat files labeld as usr_t like bin_t when it comes to transitions - Allow staff_t to read login config - Allow ipsec_t to read .google authenticator data - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files() - Call the correct interface - corenet_udp_bind_ktalkd_port() - Allow all domains that can read gnome_config to read kde config - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work - Allow mdadm to getattr any file system - Allow a confined domain to executes mozilla_exec_t via dbus - Allow cupsd_lpd_t to bind to the printer port - Dontaudit attempts to bind to ports < 1024 when nis is turned on - Allow apache domain to connect to gssproxy socket - Allow rlogind to bind to the rlogin_port - Allow telnetd to bind to the telnetd_port - Allow ktalkd to bind to the ktalkd_port - Allow cvs to bind to the cvs_port- Cleanup related to init_domain()+inetd_domain fixes - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain - svirt domains neeed to create kobject_uevint_sockets - Lots of new access required for sosreport - Allow tgtd_t to connect to isns ports - Allow init_t to transition to all inetd domains: - openct needs to be able to create netlink_object_uevent_sockets - Dontaudit leaks into ldconfig_t - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls - Move kernel_stream_connect into all Xwindow using users - Dontaudit inherited lock files in ifconfig o dhcpc_t- Also sock_file trans rule is needed in lsm - Fix labeling for fetchmail pid files/dirs - Add additional fixes for abrt-upload-watch - Fix polipo.te - Fix transition rules in asterisk policy - Add fowner capability to networkmanager policy - Allow polipo to connect to tor ports - Cleanup lsmd.if - Cleanup openhpid policy - Fix kdump_read_crash() interface - Make more domains as init domain - Fix cupsd.te - Fix requires in rpm_rw_script_inherited_pipes - Fix interfaces in lsm.if - Allow munin service plugins to manage own tmpfs files/dirs - Allow virtd_t also relabel unix stream sockets for virt_image_type - Make ktalk as init domain - Fix to define ktalkd_unit_file_t correctly - Fix ktalk.fc - Add systemd support for talk-server - Allow glusterd to create sock_file in /run - Allow xdm_t to delete gkeyringd_tmp_t files on logout - Add fixes for hypervkvp policy - Add logwatch_can_sendmail boolean - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb - Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add selinux-policy-sandbox pkg0 - Allow rhsmcertd to read init state - Allow fsetid for pkcsslotd - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service - Allow fetchmail to create own pid with correct labeling - Fix rhcs_domain_template() - Allow roles which can run mock to read mock lib files to view results - Allow rpcbind to use nsswitch - Fix lsm.if summary - Fix collectd_t can read /etc/passwd file - Label systemd unit files under dracut correctly - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh - Add support for .Xauthority-n - Label umount.crypt as lvm_exec_t - Allow syslogd to search psad lib files - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files- Add policy for lsmd - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory - Update condor_master rules to allow read system state info and allow logging - Add labeling for /etc/condor and allow condor domain to write it (bug) - Allow condor domains to manage own logs - Allow glusterd to read domains state - Fix initial hypervkvp policy - Add policy for hypervkvpd - Fix redis.if summary- Allow boinc to connect to @/tmp/.X11-unix/X0 - Allow beam.smp to connect to tcp/5984 - Allow named to manage own log files - Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t - Add virt_transition_userdomain boolean decl - Allow httpd_t to sendto unix_dgram sockets on its children - Allow nova domains to execute ifconfig - bluetooth wants to create fifo_files in /tmp - exim needs to be able to manage mailman data - Allow sysstat to getattr on all file systems - Looks like bluetoothd has moved - Allow collectd to send ping packets - Allow svirt_lxc domains to getpgid - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff - Allow frpintd_t to read /dev/urandom - Allow asterisk_t to create sock_file in /var/run - Allow usbmuxd to use netlink_kobject - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket - More cleanup of svirt_lxc policy - virtd_lxc_t now talks to dbus - Dontaudit leaked ptmx_t - Allow processes to use inherited fifo files - Allow openvpn_t to connect to squid ports - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert() - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files - Allow user roles to connect to the journal socket- selinux_set_enforce_mode needs to be used with type - Add append to the dontaudit for unix_stream_socket of xdm_t leak - Allow xdm_t to create symlinks in log direcotries - Allow login programs to read afs config - Label 10933 as a pop port, for dovecot - New policy to allow selinux_server.py to run as semanage_t as a dbus service - Add fixes to make netlabelctl working on MLS - AVCs required for running sepolicy gui as staff_t - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC - New dbus server to be used with new gui - After modifying some files in /etc/mail, I saw this needed on the next boot - Loading a vm from /usr/tmp with virt-manager - Clean up oracleasm policy for Fedora - Add oracleasm policy written by rlopez@redhat.com - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache - Add label for /var/crash - Allow fenced to domtrans to sanclok_t - Allow nagios to manage nagios spool files - Make tfptd as home_manager - Allow kdump to read kcore on MLS system - Allow mysqld-safe sys_nice/sys_resource caps - Allow apache to search automount tmp dirs if http_use_nfs is enabled - Allow crond to transition to named_t, for use with unbound - Allow crond to look at named_conf_t, for unbound - Allow mozilla_plugin_t to transition its home content - Allow dovecot_domain to read all system and network state - Allow httpd_user_script_t to call getpw - Allow semanage to read pid files - Dontaudit leaked file descriptors from user domain into thumb - Make PAM authentication working if it is enabled in ejabberd - Add fixes for rabbit to fix ##992920,#992931 - Allow glusterd to mount filesystems - Loading a vm from /usr/tmp with virt-manager - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device - Add fix for pand service - shorewall touches own log - Allow nrpe to list /var - Mozilla_plugin_roles can not be passed into lpd_run_lpr - Allow afs domains to read afs_config files - Allow login programs to read afs config - Allow virt_domain to read virt_var_run_t symlinks - Allow smokeping to send its process signals - Allow fetchmail to setuid - Add kdump_manage_crash() interface - Allow abrt domain to write abrt.socket- Add more aliases in pegasus.te - Add more fixes for *_admin interfaces - Add interface fixes - Allow nscd to stream connect to nmbd - Allow gnupg apps to write to pcscd socket - Add more fixes for openlmi provides. Fix naming and support for additionals - Allow fetchmail to resolve host names - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te - Fix corecmd_exec_chroot() - Fix logging_relabel_syslog_pid_socket interface - Fix typo in unconfineduser.te - Allow system_r to access unconfined_dbusd_t to run hp_chec- Allow xdm_t to act as a dbus client to itsel - Allow fetchmail to resolve host names - Allow gnupg apps to write to pcscd socket - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te -httpd_t does access_check on certs- Add support for cmpiLMI_Service-cimprovagt - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t - Add support for pycmpiLMI_Storage-cimprovagt - Add support for cmpiLMI_Networking-cimprovagt - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working - Allow virtual machines and containers to run as user doains, needed for virt-sandbox - Allow buglist.cgi to read cpu info- Allow systemd-tmpfile to handle tmp content in print spool dir - Allow systemd-sysctl to send system log messages - Add support for RTP media ports and fmpro-internal - Make auditd working if audit is configured to perform SINGLE action on disk error - Add interfaces to handle systemd units - Make systemd-notify working if pcsd is used - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t - Instead of having all unconfined domains get all of the named transition rules, - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default. - Add definition for the salt ports - Allow xdm_t to create link files in xdm_var_run_t - Dontaudit reads of blk files or chr files leaked into ldconfig_t - Allow sys_chroot for useradd_t - Allow net_raw cap for ipsec_t - Allow sysadm_t to reload services - Add additional fixes to make strongswan working with a simple conf - Allow sysadm_t to enable/disable init_t services - Add additional glusterd perms - Allow apache to read lnk files in the /mnt directory - Allow glusterd to ask the kernel to load a module - Fix description of ftpd_use_fusefs boolean - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t - Allow glusterds to request load a kernel module - Allow boinc to stream connect to xserver_t - Allow sblim domains to read /etc/passwd - Allow mdadm to read usb devices - Allow collectd to use ping plugin - Make foghorn working with SNMP - Allow sssd to read ldap certs - Allow haproxy to connect to RTP media ports - Add additional trans rules for aide_db - Add labeling for /usr/lib/pcsd/pcsd - Add labeling for /var/log/pcsd - Add support for pcs which is a corosync and pacemaker configuration tool- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1 - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown - consolekit needs to be able to shut down system - Move around interfaces - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints - Allow gconf-defaults-m to read /etc/passwd - Fix pki_rw_tomcat_cert() interface to support lnk_files- Add support for gluster ports - Make sure that all keys located in /etc/ssh/ are labeled correctly - Make sure apcuspd lock files get created with the correct label - Use getcap in gluster.te - Fix gluster policy - add additional fixes to allow beam.smp to interact with couchdb files - Additional fix for #974149 - Allow gluster to user gluster ports - Allow glusterd to transition to rpcd_t and add additional fixes for #980683 - Allow tgtd working when accessing to the passthrough device - Fix labeling for mdadm unit files- Add mdadm fixes- Fix definition of sandbox.disabled to sandbox.pp.disabled- Allow mdamd to execute systemctl - Allow mdadm to read /dev/kvm - Allow ipsec_mgmt_t to read l2tpd pid content- Allow nsd_t to read /dev/urand - Allow mdadm_t to read framebuffer - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t - Allow mozilla_plugin_config_t to create tmp files - Cleanup openvswitch policy - Allow mozilla plugin to getattr on all executables - Allow l2tpd_t to create fifo_files in /var/run - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory - Allow mdadm to connecto its own unix_stream_socket - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now. - Allow apache to access smokeping pid files - Allow rabbitmq_beam_t to getattr on all filesystems - Add systemd support for iodined - Allow nup_upsdrvctl_t to execute its entrypoint - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch - add labeling for ~/.cache/libvirt-sandbox - Add interface to allow domains transitioned to by confined users to send sigchld to screen program - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs. - Allow staff to getsched all domains, required to run htop - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Add prosody policy written by Michael Scherer - Allow nagios plugins to read /sys info - ntpd needs to manage own log files - Add support for HOME_DIR/.IBMERS - Allow iptables commands to read firewalld config - Allow consolekit_t to read utmp - Fix filename transitions on .razor directory - Add additional fixes to make DSPAM with LDA working - Allow snort to read /etc/passwd - Allow fail2ban to communicate with firewalld over dbus - Dontaudit openshift_cgreoup_file_t read/write leaked dev - Allow nfsd to use mountd port - Call th proper interface - Allow openvswitch to read sys and execute plymouth - Allow tmpwatch to read /var/spool/cups/tmp - Add support for /usr/libexec/telepathy-rakia - Add systemd support for zoneminder - Allow mysql to create files/directories under /var/log/mysql - Allow zoneminder apache scripts to rw zoneminder tmpfs - Allow httpd to manage zoneminder lib files - Add zoneminder_run_sudo boolean to allow to start zoneminder - Allow zoneminder to send mails - gssproxy_t sock_file can be under /var/lib - Allow web domains to connect to whois port. - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t. - We really need to add an interface to corenet to define what a web_client_domain is and - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain. - Add labeling for cmpiLMI_LogicalFile-cimprovagt - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules - Update policy rules for pegasus_openlmi_logicalfile_t - Add initial types for logicalfile/unconfined OpenLMI providers - mailmanctl needs to read own log - Allow logwatch manage own lock files - Allow nrpe to read meminfo - Allow httpd to read certs located in pki-ca - Add pki_read_tomcat_cert() interface - Add support for nagios openshift plugins - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab- Make DSPAM to act as a LDA working - Allow ntop to create netlink socket - Allow policykit to send a signal to policykit-auth - Allow stapserver to dbus chat with avahi/systemd-logind - Fix labeling on haproxy unit file - Clean up haproxy policy - A new policy for haproxy and placed it to rhcs.te - Add support for ldirectord and treat it with cluster_t - Make sure anaconda log dir is created with var_log_t- Allow lvm_t to create default targets for filesystem handling - Fix labeling for razor-lightdm binaries - Allow insmod_t to read any file labeled var_lib_t - Add policy for pesign - Activate policy for cmpiLMI_Account-cimprovagt - Allow isnsd syscall=listen - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler - Allow ctdbd to use udp/4379 - gatherd wants sys_nice and setsched - Add support for texlive2012 - Allow NM to read file_t (usb stick with no labels used to transfer keys for example) - Allow cobbler to execute apache with domain transition- condor_collector uses tcp/9000 - Label /usr/sbin/virtlockd as virtd_exec_t for now - Allow cobbler to execute ldconfig - Allow NM to execute ssh - Allow mdadm to read /dev/crash - Allow antivirus domains to connect to snmp port - Make amavisd-snmp working correctly - Allow nfsd_t to mounton nfsd_fs_t - Add initial snapper policy - We still need to have consolekit policy - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow dirsrv to read network state - Fix pki_read_tomcat_lib_files - Add labeling for /usr/libexec/nm-ssh-service - Add label cert_t for /var/lib/ipa/pki-ca/publish - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant - Allow nfsd_t to mounton nfsd_fs_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow passwd_t to change role to system_r from unconfined_r- Don't audit access checks by sandbox xserver on xdb var_lib - Allow ntop to read usbmon devices - Add labeling for new polcykit authorizor - Dontaudit access checks from fail2ban_client - Don't audit access checks by sandbox xserver on xdb var_lib - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream - Fix labeling for all /usr/bim/razor-lightdm-* binaries - Add filename trans for /dev/md126p1- Make vdagent able to request loading kernel module - Add support for cloud-init make it as unconfined domain - Allow snmpd to run smartctl in fsadm_t domain - remove duplicate openshift_search_lib() interface - Allow mysqld to search openshift lib files - Allow openshift cgroup to interact with passedin file descriptors - Allow colord to list directories inthe users homedir - aide executes prelink to check files - Make sure cupsd_t creates content in /etc/cups with the correct label - Lest dontaudit apache read all domains, so passenger will not cause this avc - Allow gssd to connect to gssproxy - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS - Allow systemd-tmpfiles to relabel also lock files - Allow useradd to add homdir in /var/lib/openshift - Allow setfiles and semanage to write output to /run/files- Add labeling for /dev/tgt - Dontaudit leak fd from firewalld for modprobe - Allow runuser running as rpm_script_t to create netlink_audit socket - Allow mdadm to read BIOS non-volatile RAM- accountservice watches when accounts come and go in wtmp - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket - Add httpd_use_sasl boolean - Allow net_admin for tuned_t - iscsid needs sys_module to auto-load kernel modules - Allow blueman to read bluetooth conf - Add nova_manage_lib_files() interface - Fix mplayer_filetrans_home_content() - Add mplayer_filetrans_home_content() - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t - Revert "Allow thumb_t to append inherited xdm stream socket" - Add iscsi_filetrans_named_content() interface - Allow to create .mplayer with the correct labeling for unconfined - Allow iscsiadmin to create lock file with the correct labeling- Allow wine to manage wine home content - Make amanda working with socket actiovation - Add labeling for /usr/sbin/iscsiadm - Add support for /var/run/gssproxy.sock - dnsmasq_t needs to read sysctl_net_t- Fix courier_domain_template() interface - Allow blueman to write ip_forward - Allow mongodb to connect to mongodb port - Allow mongodb to connect to mongodb port - Allow java to bind jobss_debug port - Fixes for *_admin interfaces - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality - Need to assign attribute for courier_domain to all courier_domains - Fail2ban reads /etc/passwd - postfix_virtual will create new files in postfix_spool_t - abrt triggers sys_ptrace by running pidof - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it - Add passenger fixes needed by foreman - Remove dup interfaces - Add additional interfaces for quantum - Add new interfaces for dnsmasq - Allow passenger to read localization and send signull to itself - Allow dnsmasq to stream connect to quantum - Add quantum_stream_connect() - Make sure that mcollective starts the service with the correct labeling - Add labels for ~/.manpath - Dontaudit attempts by svirt_t to getpw* calls - sandbox domains are trying to look at parent process data - Allow courior auth to create its pid file in /var/spool/courier subdir - Add fixes for beam to have it working with couchdb - Add labeling for /run/nm-xl2tpd.con - Allow apache to stream connect to thin - Add systemd support for amand - Make public types usable for fs mount points - Call correct mandb interface in domain.te - Allow iptables to r/w quantum inherited pipes and send sigchld - Allow ifconfig domtrans to iptables and execute ldconfig - Add labels for ~/.manpath - Allow systemd to read iscsi lib files - seunshare is trying to look at parent process data- Fix openshift_search_lib - Add support for abrt-uefioops-oops - Allow colord to getattr any file system - Allow chrome processes to look at each other - Allow sys_ptrace for abrt_t - Add new policy for gssproxy - Dontaudit leaked file descriptor writes from firewalld - openshift_net_type is interface not template - Dontaudit pppd to search gnome config - Update openshift_search_lib() interface - Add fs_list_pstorefs() - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18 - Better labels for raspberry pi devices - Allow init to create devpts_t directory - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18 - Allow sysadm_t to build kernels - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18 - Allow userdomains to stream connect to gssproxy - Dontaudit leaked file descriptor writes from firewalld - Allow xserver to read /dev/urandom - Add additional fixes for ipsec-mgmt - Make SSHing into an Openshift Enterprise Node working- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime - with the proper label. - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files - Allow systemd-timedated to create adjtime - Add clock_create_adjtime() - Additional fix ifconfing for #966106 - Allow kernel_t to create boot.log with correct labeling - Remove unconfined_mplayer for which we don't have rules - Rename interfaces - Add userdom_manage_user_home_files/dirs interfaces - Fix files_dontaudit_read_all_non_security_files - Fix ipsec_manage_key_file() - Fix ipsec_filetrans_key_file() - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t - Fix labeling for ipse.secrets - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid - Add files_dontaudit_read_all_non_security_files() interface - /var/log/syslog-ng should be labeled var_log_t - Make ifconfig_var_run_t a mountpoint - Add transition from ifconfig to dnsmasq - Allow ifconfig to execute bin_t/shell_exec_t - We want to have hwdb.bin labeled as etc_t - update logging_filetrans_named_content() interface - Allow systemd_timedate_t to manage /etc/adjtime - Allow NM to send signals to l2tpd - Update antivirus_can_scan_system boolean - Allow devicekit_disk_t to sys_config_tty - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories - Make printing from vmware working - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes - Add virt_qemu_ga_data_t for qemu-ga - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both - Fix typo in virt.te - Add virt_qemu_ga_unconfined_t for hook scripts - Make sure NetworkManager files get created with the correct label - Add mozilla_plugin_use_gps boolean - Fix cyrus to have support for net-snmp - Additional fixes for dnsmasq and quantum for #966106 - Add plymouthd_create_log() - remove httpd_use_oddjob for which we don't have rules - Add missing rules for httpd_can_network_connect_cobbler - Add missing cluster_use_execmem boolean - Call userdom_manage_all_user_home_type_files/dirs - Additional fix for ftp_home_dir - Fix ftp_home_dir boolean - Allow squit to recv/send client squid packet - Fix nut.te to have nut_domain attribute - Add support for ejabberd; TODO: revisit jabberd and rabbit policy - Fix amanda policy - Add more fixes for domains which use libusb - Make domains which use libusb working correctly - Allow l2tpd to create ipsec key files with correct labeling and manage them - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files - Allow rabbitmq-beam to bind generic node - Allow l2tpd to read ipse-mgmt pid files - more fixes for l2tpd, NM and pppd from #967072- Dontaudit to getattr on dirs for dovecot-deliver - Allow raiudusd server connect to postgresql socket - Add kerberos support for radiusd - Allow saslauthd to connect to ldap port - Allow postfix to manage postfix_private_t files - Add chronyd support for #965457 - Fix labeling for HOME_DIR/\.icedtea - CHange squid and snmpd to be allowed also write own logs - Fix labeling for /usr/libexec/qemu-ga - Allow virtd_t to use virt_lock_t - Allow also sealert to read the policy from the kernel - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content - Dontaudit listing of users homedir by sendmail Seems like a leak - Allow passenger to transition to puppet master - Allow apache to connect to mythtv - Add definition for mythtv ports- Add additional fixes for #948073 bug - Allow sge_execd_t to also connect to sge ports - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files - Add networkmanager_stream_connect() - Make gnome-abrt wokring with staff_t - Fix openshift_manage_lib_files() interface - mdadm runs ps command which seems to getattr on random log files - Allow mozilla_plugin_t to create pulseaudit_home_t directories - Allow qemu-ga to shutdown virtual hosts - Add labelling for cupsd-browsed - Add web browser plugins to connect to aol ports - Allow nm-dhcp-helper to stream connect to NM - Add port definition for sge ports- Make sure users and unconfined domains create .hushlogin with the correct label - Allow pegaus to chat with realmd over DBus - Allow cobblerd to read network state - Allow boicn-client to stat on /dev/input/mice - Allow certwatch to read net_config_t when it executes apache - Allow readahead to create /run/systemd and then create its own directory with the correct label- Transition directories and files when in a user_tmp_t directory - Change certwatch to domtrans to apache instead of just execute - Allow virsh_t to read xen lib files - update policy rules for pegasus_openlmi_account_t - Add support for svnserve_tmp_t - Activate account openlmi policy - pegasus_openlmi_domain_template needs also require pegasus_t - One more fix for policykit.te - Call fs_list_cgroups_dirs() in policykit.te - Allow nagios service plugin to read mysql config files - Add labeling for /var/svn - Fix chrome.te - Fix pegasus_openlmi_domain_template() interfaces - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks - Fix location of google-chrome data - Add support for chome_sandbox to store content in the homedir - Allow policykit to watch for changes in cgroups file system - Add boolean to allow mozilla_plugin_t to use spice - Allow collectd to bind to udp port - Allow collected_t to read all of /proc - Should use netlink socket_perms - Should use netlink socket_perms - Allow glance domains to connect to apache ports - Allow apcupsd_t to manage its log files - Allow chrome objects to rw_inherited unix_stream_socket from callers - Allow staff_t to execute virtd_exec_t for running vms - nfsd_t needs to bind mountd port to make nfs-mountd.service working - Allow unbound net_admin capability because of setsockopt syscall - Fix fs_list_cgroup_dirs() - Label /usr/lib/nagios/plugins/utils.pm as bin_t - Remove uplicate definition of fs_read_cgroup_files() - Remove duplicate definition of fs_read_cgroup_files() - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd - Additional interfaces needed to list and read cgroups config - Add port definition for collectd port - Add labels for /dev/ptp* - Allow staff_t to execute virtd_exec_t for running vms- Allow samba-net to also read realmd tmp files - Allow NUT to use serial ports - realmd can be started by systemctl now- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid - Allow virsh to read xen lock file - Allow qemu-ga to create files in /run with proper labeling - Allow glusterd to connect to own socket in /tmp - Allow glance-api to connect to http port to make glance image-create working - Allow keystonte_t to execute rpm- Fix realmd cache interfaces- Allow tcpd to execute leafnode - Allow samba-net to read realmd cache files - Dontaudit sys_tty_config for alsactl - Fix allow rules for postfix_var_run - Allow cobblerd to read /etc/passwd - Allow pegasus to read exports - Allow systemd-timedate to read xdm state - Allow mout to stream connect to rpcbind - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki- Allow thumbnails to share memory with apps which run thumbnails - Allow postfix-postqueue block_suspend - Add lib interfaces for smsd - Add support for nginx - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t - Allow pki apache domain to create own tmp files and execute httpd_suexec - Allow procmail to manger user tmp files/dirs/lnk_files - Add virt_stream_connect_svirt() interface - Allow dovecot-auth to execute bin_t - Allow iscsid to request that kernel load a kernel module - Add labeling support for /var/lib/mod_security - Allow iw running as tuned_t to create netlink socket - Dontaudit sys_tty_config for thumb_t - Add labeling for nm-l2tp-service - Allow httpd running as certwatch_t to open tcp socket - Allow useradd to manager smsd lib files - Allow useradd_t to add homedirs in /var/lib - Fix typo in userdomain.te - Cleanup userdom_read_home_certs - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t - Allow staff to stream connect to svirt_t to make gnome-boxes working- Allow lvm to create its own unit files - Label /var/lib/sepolgen as selinux_config_t - Add filetrans rules for tw devices - Add transition from cupsd_config_t to cupsd_t- Add filetrans rules for tw devices - Cleanup bad transition lines- Fix lockdev_manage_files() - Allow setroubleshootd to read var_lib_t to make email_alert working - Add lockdev_manage_files() - Call proper interface in virt.te - Allow gkeyring_domain to create /var/run/UID/config/dbus file - system dbus seems to be blocking suspend - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need - When you enter a container from root, you generate avcs with a leaked file descriptor - Allow mpd getattr on file system directories - Make sure realmd creates content with the correct label - Allow systemd-tty-ask to write kmsg - Allow mgetty to use lockdev library for device locking - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music - When you enter a container from root, you generate avcs with a leaked file descriptor - Make sure init.fc files are labeled correctly at creation - File name trans vconsole.conf - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow certmonger to dbus communicate with realmd - Make realmd working- Fix mozilla specification of homedir content - Allow certmonger to read network state - Allow tmpwatch to read tmp in /var/spool/{cups,lpd} - Label all nagios plugin as unconfined by default - Add httpd_serve_cobbler_files() - Allow mdadm to read /dev/sr0 and create tmp files - Allow certwatch to send mails - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow realmd to run ipa, really needs to be an unconfined_domain - Allow sandbox domains to use inherted terminals - Allow pscd to use devices labeled svirt_image_t in order to use cat cards. - Add label for new alsa pid - Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition - Add support for sshd_unit_file_t - Add oracleasmfs_t - Allow unlabeled_t files to be stored on unlabeled_t filesystems- Fix description of deny_ptrace boolean - Remove allow for execmod lib_t for now - Allow quantum to connect to keystone port - Allow nova-console to talk with mysql over unix stream socket - Allow dirsrv to stream connect to uuidd - thumb_t needs to be able to create ~/.cache if it does not exist - virtd needs to be able to sys_ptrace when starting and stoping containers- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms... - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets - Fix deny_ptrace boolean, certain ptrace leaked into the system - Allow winbind to manage kerberos_rcache_host - Allow spamd to create spamd_var_lib_t directories - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs - Fix vmware_role() interface - Fix cobbler_manage_lib_files() interface - Allow nagios check disk plugins to execute bin_t - Allow quantum to transition to openvswitch_t - Allow postdrop to stream connect to postfix-master - Allow quantum to stream connect to openvswitch - Add xserver_dontaudit_xdm_rw_stream_sockets() interface - Allow daemon to send dgrams to initrc_t - Allow kdm to start the power service to initiate a reboot or poweroff- Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Don't audit attempts to write to stream socket of nscld by thumbnailers - Allow git_system_t to read network state - Allow pegasas to execute mount command - Fix desc for drdb_admin - Fix condor_amin() - Interface fixes for uptime, vdagent, vnstatd - Fix labeling for moodle in /var/www/moodle/data - Add interface fixes - Allow bugzilla to read certs - /var/www/moodle needs to be writable by apache - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Fix sys_nice for cups_domain - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Kernel_t needs mac_admin in order to support labeled NFS - Fix systemd_dontaudit_dbus_chat() interface - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Allow consolehelper domain to write Xauth files in /root - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Allow consolehelper more access discovered by Tom London - Allow fsdaemon to send signull to all domain - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Fix file_contexts.subs to label /run/lock correctly- Try to label on controlC devices up to 30 correctly - Add mount_rw_pid_files() interface - Add additional mount/umount interfaces needed by mock - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk - Fix tabs - Allow initrc_domain to search rgmanager lib files - Add more fixes which make mock working together with confined users * Allow mock_t to manage rpm files * Allow mock_t to read rpm log files * Allow mock to setattr on tmpfs, devpts * Allow mount/umount filesystems - Add rpm_read_log() interface - yum-cron runs rpm from within it. - Allow tuned to transition to dmidecode - Allow firewalld to do net_admin - Allow mock to unmont tmpfs_t - Fix virt_sigkill() interface - Add additional fixes for mock. Mainly caused by mount running in mock_t - Allow mock to write sysfs_t and mount pid files - Add mailman_domain to mailman_template() - Allow openvswitch to execute shell - Allow qpidd to use kerberos - Allow mailman to use fusefs, needs back port to RHEL6 - Allow apache and its scripts to use anon_inodefs - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7 - Realmd needs to connect to samba ports, needs back port to F18 also - Allow colord to read /run/initial-setup- - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock - Add virt_kill() interface - Add rgmanager_search_lib() interface - Allow wdmd to getattr on all filesystems. Back ported from RHEL6- Allow realmd to create tmp files - FIx ircssi_home_t type to irssi_home_t - Allow adcli running as realmd_t to connect to ldap port - Allow NetworkManager to transition to ipsec_t, for running strongswan - Make openshift_initrc_t an lxc_domain - Allow gssd to manage user_tmp_t files - Fix handling of irclogs in users homedir - Fix labeling for drupal an wp-content in subdirs of /var/www/html - Allow abrt to read utmp_t file - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6 - fix labeling for (oo|rhc)-restorer-wrapper.sh - firewalld needs to be able to write to network sysctls - Fix mozilla_plugin_dontaudit_rw_sem() interface - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains - Add mozilla_plugin_dontaudit_rw_sem() interface - Allow svirt_lxc_t to transition to openshift domains - Allow condor domains block_suspend and dac_override caps - Allow condor_master to read passd - Allow condor_master to read system state - Allow NetworkManager to transition to ipsec_t, for running strongswan - Lots of access required by lvm_t to created encrypted usb device - Allow xdm_t to dbus communicate with systemd_localed_t - Label strongswan content as ipsec_exec_mgmt_t for now - Allow users to dbus chat with systemd_localed - Fix handling of .xsession-errors in xserver.if, so kde will work - Might be a bug but we are seeing avc's about people status on init_t:service - Make sure we label content under /var/run/lock as <> - Allow daemon and systemprocesses to search init_var_run_t directory - Add boolean to allow xdm to write xauth data to the home directory - Allow mount to write keys for the unconfined domain - Add unconfined_write_keys() interface- Add labeling for /usr/share/pki - Allow programs that read var_run_t symlinks also read var_t symlinks - Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports - Fix labeling for /etc/dhcp directory - add missing systemd_stub_unit_file() interface - Add files_stub_var() interface - Add lables for cert_t directories - Make localectl set-x11-keymap working at all - Allow abrt to manage mock build environments to catch build problems. - Allow virt_domains to setsched for running gdb on itself - Allow thumb_t to execute user home content - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000 - Allow certwatch to execut /usr/bin/httpd - Allow cgred to send signal perms to itself, needs back port to RHEL6 - Allow openshift_cron_t to look at quota - Allow cups_t to read inhered tmpfs_t from the kernel - Allow yppasswdd to use NIS - Tuned wants sys_rawio capability - Add ftpd_use_fusefs boolean - Allow dirsrvadmin_t to signal itself- Allow localectl to read /etc/X11/xorg.conf.d directory - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors"" - Allow mount to transition to systemd_passwd_agent - Make sure abrt directories are labeled correctly - Allow commands that are going to read mount pid files to search mount_var_run_t - label /usr/bin/repoquery as rpm_exec_t - Allow automount to block suspend - Add abrt_filetrans_named_content so that abrt directories get labeled correctly - Allow virt domains to setrlimit and read file_context- Allow nagios to manage nagios spool files - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6 - Add swift_alias.* policy files which contain typealiases for swift types - Add support for /run/lock/opencryptoki - Allow pkcsslotd chown capability - Allow pkcsslotd to read passwd - Add rsync_stub() interface - Allow systemd_timedate also manage gnome config homedirs - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t - Fix filetrans rules for kdm creates .xsession-errors - Allow sytemd_tmpfiles to create wtmp file - Really should not label content under /var/lock, since it could have labels on it different from var_lock_t - Allow systemd to list all file system directories - Add some basic stub interfaces which will be used in PRODUCT policies- Fix log transition rule for cluster domains - Start to group all cluster log together - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update - cups uses usbtty_device_t devices - These fixes were all required to build a MLS virtual Machine with single level desktops - Allow domains to transiton using httpd_exec_t - Allow svirt domains to manage kernel key rings - Allow setroubleshoot to execute ldconfig - Allow firewalld to read generate gnome data - Allow bluetooth to read machine-info - Allow boinc domain to send signal to itself - Fix gnome_filetrans_home_content() interface - Allow mozilla_plugins to list apache modules, for use with gxine - Fix labels for POkemon in the users homedir - Allow xguest to read mdstat - Dontaudit virt_domains getattr on /dev/* - These fixes were all required to build a MLS virtual Machine with single level desktops - Need to back port this to RHEL6 for openshift - Add tcp/8891 as milter port - Allow nsswitch domains to read sssd_var_lib_t files - Allow ping to read network state. - Fix typo - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them- Adopt swift changes from lhh@redhat.com - Add rhcs_manage_cluster_pid_files() interface - Allow screen domains to configure tty and setup sock_file in ~/.screen directory - ALlow setroubleshoot to read default_context_t, needed to backport to F18 - Label /etc/owncloud as being an apache writable directory - Allow sshd to stream connect to an lxc domain- Allow postgresql to manage rgmanager pid files - Allow postgresql to read ccs data - Allow systemd_domain to send dbus messages to policykit - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them - All systemd domains that create content are reading the file_context file and setfscreate - Systemd domains need to search through init_var_run_t - Allow sshd to communicate with libvirt to set containers labels - Add interface to manage pid files - Allow NetworkManger_t to read /etc/hostname - Dontaudit leaked locked files into openshift_domains - Add fixes for oo-cgroup-read - it nows creates tmp files - Allow gluster to manage all directories as well as files - Dontaudit chrome_sandbox_nacl_t using user terminals - Allow sysstat to manage its own log files - Allow virtual machines to setrlimit and send itself signals. - Add labeling for /var/run/hplip- Fix POSTIN scriptlet- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp- Fix authconfig.py labeling - Make any domains that write homedir content do it correctly - Allow glusterd to read/write anyhwere on the file system by default - Be a little more liberal with the rsync log files - Fix iscsi_admin interface - Allow iscsid_t to read /dev/urand - Fix up iscsi domain for use with unit files - Add filename transition support for spamassassin policy - Allow web plugins to use badly formated libraries - Allow nmbd_t to create samba_var_t directories - Add filename transition support for spamassassin policy - Add filename transition support for tvtime - Fix alsa_home_filetrans_alsa_home() interface - Move all userdom_filetrans_home_content() calling out of booleans - Allow logrotote to getattr on all file sytems - Remove duplicate userdom_filetrans_home_content() calling - Allow kadmind to read /etc/passwd - Dontaudit append .xsession-errors file on ecryptfs for policykit-auth - Allow antivirus domain to manage antivirus db links - Allow logrotate to read /sys - Allow mandb to setattr on man dirs - Remove mozilla_plugin_enable_homedirs boolean - Fix ftp_home_dir boolean - homedir mozilla filetrans has been moved to userdom_home_manager - homedir telepathy filetrans has been moved to userdom_home_manager - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd() - Might want to eventually write a daemon on fusefsd. - Add policy fixes for sshd [net] child from plautrba@redhat.com - Tor uses a new port - Remove bin_t for authconfig.py - Fix so only one call to userdom_home_file_trans - Allow home_manager_types to create content with the correctl label - Fix all domains that write data into the homedir to do it with the correct label - Change the postgresql to use proper boolean names, which is causing httpd_t to - not get access to postgresql_var_run_t - Hostname needs to send syslog messages - Localectl needs to be able to send dbus signals to users - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default - Allow user_home_manger domains to create spam* homedir content with correct labeling - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working - Declare userdom_filetrans_type attribute - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute - fusefsd is mounding a fuse file system on /run/user/UID/gvfs- Man pages are now generated in the build process - Allow cgred to list inotifyfs filesystem- Allow gluster to get attrs on all fs - New access required for virt-sandbox - Allow dnsmasq to execute bin_t - Allow dnsmasq to create content in /var/run/NetworkManager - Fix openshift_initrc_signal() interface - Dontaudit openshift domains doing getattr on other domains - Allow consolehelper domain to communicate with session bus - Mock should not be transitioning to any other domains, we should keep mock_t as mock_t - Update virt_qemu_ga_t policy - Allow authconfig running from realmd to restart oddjob service - Add systemd support for oddjob - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd - Add labeling for gnashpluginrc - Allow chrome_nacl to execute /dev/zero - Allow condor domains to read /proc - mozilla_plugin_t will getattr on /core if firefox crashes - Allow condor domains to read /etc/passwd - Allow dnsmasq to execute shell scripts, openstack requires this access - Fix glusterd labeling - Allow virtd_t to interact with the socket type - Allow nmbd_t to override dac if you turned on sharing all files - Allow tuned to created kobject_uevent socket - Allow guest user to run fusermount - Allow openshift to read /proc and locale - Allow realmd to dbus chat with rpm - Add new interface for virt - Remove depracated interfaces - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t - Remove some more unconfined_t process transitions, that I don't believe are necessary - Stop transitioning uncofnined_t to checkpc - dmraid creates /var/lock/dmraid - Allow systemd_localed to creatre unix_dgram_sockets - Allow systemd_localed to write kernel messages. - Also cleanup systemd definition a little. - Fix userdom_restricted_xwindows_user_template() interface - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t - User accounts need to dbus chat with accountsd daemon - Gnome requires all users to be able to read /proc/1/- virsh now does a setexeccon call - Additional rules required by openshift domains - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work - Allow spamd_update_t to search spamc_home_t - Avcs discovered by mounting an isci device under /mnt - Allow lspci running as logrotate to read pci.ids - Additional fix for networkmanager_read_pid_files() - Fix networkmanager_read_pid_files() interface - Allow all svirt domains to connect to svirt_socket_t - Allow virsh to set SELinux context for a process. - Allow tuned to create netlink_kobject_uevent_socket - Allow systemd-timestamp to set SELinux context - Add support for /var/lib/systemd/linger - Fix ssh_sysadm_login to be working on MLS as expected- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file - Add missing files_rw_inherited_tmp_files interface - Add additional interface for ecryptfs - ALlow nova-cert to connect to postgresql - Allow keystone to connect to postgresql - Allow all cups domains to getattr on filesystems - Allow pppd to send signull - Allow tuned to execute ldconfig - Allow gpg to read fips_enabled - Add additional fixes for ecryptfs - Allow httpd to work with posgresql - Allow keystone getsched and setsched- Allow gpg to read fips_enabled - Add support for /var/cache/realmd - Add support for /usr/sbin/blazer_usb and systemd support for nut - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t - bitlbee wants to read own log file - Allow glance domain to send a signal itself - Allow xend_t to request that the kernel load a kernel module - Allow pacemaker to execute heartbeat lib files - cleanup new swift policy- Fix smartmontools - Fix userdom_restricted_xwindows_user_template() interface - Add xserver_xdm_ioctl_log() interface - Allow Xusers to ioctl lxdm.log to make lxdm working - Add MLS fixes to make MLS boot/log-in working - Add mls_socket_write_all_levels() also for syslogd - fsck.xfs needs to read passwd - Fix ntp_filetrans_named_content calling in init.te - Allow postgresql to create pg_log dir - Allow sshd to read rsync_data_t to make rsync working - Change ntp.conf to be labeled net_conf_t - Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it - Allow xdm_t to execute gstreamer home content - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp - New policy for openstack swift domains - More access required for openshift_cron_t - Use cupsd_log_t instead of cupsd_var_log_t - rpm_script_roles should be used in rpm_run - Fix rpm_run() interface - Fix openshift_initrc_run() - Fix sssd_dontaudit_stream_connect() interface - Fix sssd_dontaudit_stream_connect() interface - Allow LDA's job to deliver mail to the mailbox - dontaudit block_suspend for mozilla_plugin_t - Allow l2tpd_t to all signal perms - Allow uuidgen to read /dev/random - Allow mozilla-plugin-config to read power_supply info - Implement cups_domain attribute for cups domains - We now need access to user terminals since we start by executing a command outside the tty - We now need access to user terminals since we start by executing a command outside the tty - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen - Add containment of openshift cron jobs - Allow system cron jobs to create tmp directories - Make userhelp_conf_t a config file - Change rpm to use rpm_script_roles - More fixes for rsync to make rsync wokring - Allow logwatch to domtrans to mdadm - Allow pacemaker to domtrans to ifconfig - Allow pacemaker to setattr on corosync.log - Add pacemaker_use_execmem for memcheck-amd64 command - Allow block_suspend capability - Allow create fifo_file in /tmp with pacemaker_tmp_t - Allow systat to getattr on fixed disk - Relabel /etc/ntp.conf to be net_conf_t - ntp_admin should create files in /etc with the correct label - Add interface to create ntp_conf_t files in /etc - Add additional labeling for quantum - Allow quantum to execute dnsmasq with transition- boinc_cliean wants also execmem as boinc projecs have - Allow sa-update to search admin home for /root/.spamassassin - Allow sa-update to search admin home for /root/.spamassassin - Allow antivirus domain to read net sysctl - Dontaudit attempts from thumb_t to connect to ssd - Dontaudit attempts by readahead to read sock_files - Dontaudit attempts by readahead to read sock_files - Create tmpfs file while running as wine as user_tmpfs_t - Dontaudit attempts by readahead to read sock_files - libmpg ships badly created librarie- Change ssh_use_pts to use macro and only inherited sshd_devpts_t - Allow confined users to read systemd_logind seat information - libmpg ships badly created libraries - Add support for strongswan.service - Add labeling for strongswan - Allow l2tpd_t to read network manager content in /run directory - Allow rsync to getattr any file in rsync_data_t - Add labeling and filename transition for .grl-podcasts- mount.glusterfs executes glusterfsd binary - Allow systemd_hostnamed_t to stream connect to systemd - Dontaudit any user doing a access check - Allow obex-data-server to request the kernel to load a module - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info) - Allow gpg-agent to read /proc/sys/crypto/fips_enabled - Add new types for antivirus.pp policy module - Allow gnomesystemmm_t caps because of ioprio_set - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t - Allow gnomesystemmm_t caps because of ioprio_set - Allow NM rawip socket - files_relabel_non_security_files can not be used with boolean - Add interface to thumb_t dbus_chat to allow it to read remote process state - ALlow logrotate to domtrans to mdadm_t - kde gnomeclock wants to write content to /tmp- kde gnomeclock wants to write content to /tmp - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde - Allow blueman_t to rwx zero_device_t, for some kind of jre - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre - Ftp full access should be allowed to create directories as well as files - Add boolean to allow rsync_full_acces, so that an rsync server can write all - over the local machine - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6 - Add missing vpnc_roles type line - Allow stapserver to write content in /tmp - Allow gnome keyring to create keyrings dir in ~/.local/share - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Add interface to colord_t dbus_chat to allow it to read remote process state - Allow colord_t to read cupsd_t state - Add mate-thumbnail-font as thumnailer - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data. - Allow qpidd to list /tmp. Needed by ssl - Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18 - - Added systemd support for ksmtuned - Added booleans ksmtuned_use_nfs ksmtuned_use_cifs - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow - Looks like qpidd_t needs to read /dev/random - Lots of probing avc's caused by execugting gpg from staff_t - Dontaudit senmail triggering a net_admin avc - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port - Logwatch does access check on mdadm binary - Add raid_access_check_mdadm() iterface- Fix systemd_manage_unit_symlinks() interface - Call systemd_manage_unit_symlinks(() which is correct interface - Add filename transition for opasswd - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow sytstemd-timedated to get status of init_t - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow gpg_t to manage all gnome files - Stop using pcscd_read_pub_files - New rules for xguest, dontaudit attempts to dbus chat - Allow firewalld to create its mmap files in tmpfs and tmp directories - Allow firewalld to create its mmap files in tmpfs and tmp directories - run unbound-chkconf as named_t, so it can read dnssec - Colord is reading xdm process state, probably reads state of any apps that sends dbus message - Allow mdadm_t to change the kernel scheduler - mythtv policy - Update mandb_admin() interface - Allow dsspam to listen on own tpc_socket - seutil_filetrans_named_content needs to be optional - Allow sysadm_t to execute content in his homedir - Add attach_queue to tun_socket, new patch from Paul Moore - Change most of selinux configuration types to security_file_type. - Add filename transition rules for selinux configuration - ssh into a box with -X -Y requires ssh_use_ptys - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated - New allow rules found by Tom London for systemd_hostnamed- Allow systemd-tmpfiles to relabel lpd spool files - Ad labeling for texlive bash scripts - Add xserver_filetrans_fonts_cache_home_content() interface - Remove duplicate rules from *.te - Add support for /var/lock/man-db.lock - Add support for /var/tmp/abrt(/.*)? - Add additional labeling for munin cgi scripts - Allow httpd_t to read munin conf files - Allow certwatch to read meminfo - Fix nscd_dontaudit_write_sock_file() interfac - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling- Allow gnomeclock to talk to puppet over dbus - Allow numad access discovered by Dominic - Add support for HOME_DIR/.maildir - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain - Allow udev to relabel udev_var_run_t lnk_files - New bin_t file in mcelog- Remove all mcs overrides and replace with t1 != mcs_constrained_types - Add attribute_role for iptables - mcs_process_set_categories needs to be called for type - Implement additional role_attribute statements - Sodo domain is attempting to get the additributes of proc_kcore_t - Unbound uses port 8953 - Allow svirt_t images to compromise_kernel when using pci-passthrough - Add label for dns lib files - Bluetooth aquires a dbus name - Remove redundant files_read_usr_file calling - Remove redundant files_read_etc_file calling - Fix mozilla_run_plugin() - Add role_attribute support for more domains- Mass merge with upstream- Bump the policy version to 28 to match selinux userspace - Rebuild versus latest libsepol- Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Add labeling for /var/named/chroot/etc/localtim- Allow setroubleshoot_fixit to execute rpm - zoneminder needs to connect to httpd ports where remote cameras are listening - Allow firewalld to execute content created in /run directory - Allow svirt_t to read generic certs - Dontaudit leaked ps content to mozilla plugin - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - init scripts are creating systemd_unit_file_t directories- systemd_logind_t is looking at all files under /run/user/apache - Allow systemd to manage all user tmp files - Add labeling for /var/named/chroot/etc/localtime - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6 - Keystone is now using a differnt port - Allow xdm_t to use usbmuxd daemon to control sound - Allow passwd daemon to execute gnome_exec_keyringd - Fix chrome_sandbox policy - Add labeling for /var/run/checkquorum-timer - More fixes for the dspam domain, needs back port to RHEL6 - More fixes for the dspam domain, needs back port to RHEL6 - sssd needs to connect to kerberos password port if a user changes his password - Lots of fixes from RHEL testing of dspam web - Allow chrome and mozilla_plugin to create msgq and semaphores - Fixes for dspam cgi scripts - Fixes for dspam cgi scripts - Allow confine users to ptrace screen - Backport virt_qemu_ga_t changes from RHEL - Fix labeling for dspam.cgi needed for RHEL6 - We need to back port this policy to RHEL6, for lxc domains - Dontaudit attempts to set sys_resource of logrotate - Allow corosync to read/write wdmd's tmpfs files - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set - Allow cron jobs to read bind config for unbound - libvirt needs to inhibit systemd - kdumpctl needs to delete boot_t files - Fix duplicate gnome_config_filetrans - virtd_lxc_t is using /dev/fuse - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift - apcupsd can be setup to listen to snmp trafic - Allow transition from kdumpgui to kdumpctl - Add fixes for munin CGI scripts - Allow deltacloud to connect to openstack at the keystone port - Allow domains that transition to svirt domains to be able to signal them - Fix file context of gstreamer in .cache directory - libvirt is communicating with logind - NetworkManager writes to the systemd inhibit pipe- Allow munin disk plugins to get attributes of all directories - Allow munin disk plugins to get attributes of all directorie - Allow logwatch to get attributes of all directories - Fix networkmanager_manage_lib() interface - Fix gnome_manage_config() to allow to manage sock_file - Fix virtual_domain_context - Add support for dynamic DNS for DHCPv6- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch - Add additional labeling for /var/www/openshift/broker - Fix rhev policy - Allow openshift_initrc domain to dbus chat with systemd_logind - Allow httpd to getattr passenger log file if run_stickshift - Allow consolehelper-gtk to connect to xserver - Add labeling for the tmp-inst directory defined in pam_namespace.conf - Add lvm_metadata_t labeling for /etc/multipath- consoletype is no longer used- Add label for efivarfs - Allow certmonger to send signal to itself - Allow plugin-config to read own process status - Add more fixes for pacemaker - apache/drupal can run clamscan on uploaded content - Allow chrome_sandbox_nacl_t to read pid 1 content- Fix MCS Constraints to control ingres and egres controls on the network. - Change name of svirt_nokvm_t to svirt_tcg_t - Allow tuned to request the kernel to load kernel modules- Label /var/lib/pgsql/.ssh as ssh_home_t - Add labeling for /usr/bin/pg_ctl - Allow systemd-logind to manage keyring user tmp dirs - Add support for 7389/tcp port - gems seems to be placed in lots of places - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus - Add back tcp/8123 port as http_cache port - Add ovirt-guest-agent\.pid labeling - Allow xend to run scsi_id - Allow rhsmcertd-worker to read "physical_package_id" - Allow pki_tomcat to connect to ldap port - Allow lpr to read /usr/share/fonts - Allow open file from CD/DVD drive on domU - Allow munin services plugins to talk to SSSD - Allow all samba domains to create samba directory in var_t directories - Take away svirt_t ability to use nsswitch - Dontaudit attempts by openshift to read apache logs - Allow apache to create as well as append _ra_content_t - Dontaudit sendmail_t reading a leaked file descriptor - Add interface to have admin transition /etc/prelink.cache to the proper label - Add sntp support to ntp policy - Allow firewalld to dbus chat with devicekit_power - Allow tuned to call lsblk - Allow tor to read /proc/sys/kernel/random/uuid - Add tor_can_network_relay boolean- Add openshift_initrc_signal() interface - Fix typos - dspam port is treat as spamd_port_t - Allow setroubleshoot to getattr on all executables - Allow tuned to execute profiles scripts in /etc/tuned - Allow apache to create directories to store its log files - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6 - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM - Add filename transition for /etc/tuned/active_profile - Allow condor_master to send mails - Allow condor_master to read submit.cf - Allow condor_master to create /tmp files/dirs - Allow condor_mater to send sigkill to other condor domains - Allow condor_procd sigkill capability - tuned-adm wants to talk with tuned daemon - Allow kadmind and krb5kdc to also list sssd_public_t - Allow accountsd to dbus chat with init - Fix git_read_generic_system_content_files() interface - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler" - Fix mozilla_plugin_can_network_connect to allow to connect to all ports - Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t - dspam wants to search /var/spool for opendkim data - Revert "Add support for tcp/10026 port as dspam_port_t" - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6 - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain - Allow systemd_tmpfiles_t to setattr on mandb_cache_t- consolekit.pp was not removed from the postinstall script- Add back consolekit policy - Silence bootloader trying to use inherited tty - Silence xdm_dbusd_t trying to execute telepathy apps - Fix shutdown avcs when machine has unconfined.pp disabled - The host and a virtual machine can share the same printer on a usb device - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob - Allow abrt_watch_log_t to execute bin_t - Allow chrome sandbox to write content in ~/.config/chromium - Dontaudit setattr on fontconfig dir for thumb_t - Allow lircd to request the kernel to load module - Make rsync as userdom_home_manager - Allow rsync to search automount filesystem - Add fixes for pacemaker- Add support for 4567/tcp port - Random fixes from Tuomo Soini - xdm wants to get init status - Allow programs to run in fips_mode - Add interface to allow the reading of all blk device nodes - Allow init to relabel rpcbind sock_file - Fix labeling for lastlog and faillog related to logrotate - ALlow aeolus_configserver to use TRAM port - Add fixes for aeolus_configserver - Allow snmpd to connect to snmp port - Allow spamd_update to create spamd_var_lib_t directories - Allow domains that can read sssd_public_t files to also list the directory - Remove miscfiles_read_localization, this is defined for all domains- Allow syslogd to request the kernel to load a module - Allow syslogd_t to read the network state information - Allow xdm_dbusd_t connect to the system DBUS - Add support for 7389/tcp port - Allow domains to read/write all inherited sockets - Allow staff_t to read kmsg - Add awstats_purge_apache_log boolean - Allow ksysguardproces to read /.config/Trolltech.conf - Allow passenger to create and append puppet log files - Add puppet_append_log and puppet_create_log interfaces - Add puppet_manage_log() interface - Allow tomcat domain to search tomcat_var_lib_t - Allow pki_tomcat_t to connect to pki_ca ports - Allow pegasus_t to have net_admin capability - Allow pegasus_t to write /sys/class/net//flags - Allow mailserver_delivery to manage mail_home_rw_t lnk_files - Allow fetchmail to create log files - Allow gnomeclock to manage home config in .kde - Allow bittlebee to read kernel sysctls - Allow logrotate to list /root- Fix userhelper_console_role_template() - Allow enabling Network Access Point service using blueman - Make vmware_host_t as unconfined domain - Allow authenticate users in webaccess via squid, using mysql as backend - Allow gathers to get various metrics on mounted file systems - Allow firewalld to read /etc/hosts - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t - Allow kdumpgui to read/write to zipl.conf - Commands needed to get mock to build from staff_t in enforcing mode - Allow mdadm_t to manage cgroup files - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files - dontaudit ifconfig_t looking at fifo_files that are leaked to it - Add lableing for Quest Authentication System- Fix filetrans interface definitions - Dontaudit xdm_t to getattr on BOINC lib files - Add systemd_reload_all_services() interface - Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files - Allow accountsd to dbus chat with gdm - Allow realmd to getattr on all fs - Allow logrotate to reload all services - Add systemd unit file for radiusd - Allow winbind to create samba pid dir - Add labeling for /var/nmbd/unexpected - Allow chrome and mozilla plugin to connect to msnp ports- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file - Dontaudit setfiles reading /dev/random - On initial boot gnomeclock is going to need to be set buy gdm - Fix tftp_read_content() interface - Random apps looking at kernel file systems - Testing virt with lxc requiers additional access for virsh_t - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container - Allow MPD to read /dev/radnom - Allow sandbox_web_type to read logind files which needs to read pulseaudio - Allow mozilla plugins to read /dev/hpet - Add labeling for /var/lib/zarafa-webap - Allow BOINC client to use an HTTP proxy for all connections - Allow rhsmertd to domain transition to dmidecod - Allow setroubleshootd to send D-Bus msg to ABRT- Define usbtty_device_t as a term_tty - Allow svnserve to accept a connection - Allow xend manage default virt_image_t type - Allow prelink_cron_system_t to overide user componant when executing cp - Add labeling for z-push - Gnomeclock sets the realtime clock - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd - Allow lxc domains to use /dev/random and /dev/urandom- Add port defintion for tcp/9000 - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API - Allow shorewall_t to create netlink_socket - Allow krb5admind to block suspend - Fix labels on /var/run/dlm_controld /var/log/dlm_controld - Allow krb5kdc to block suspend - gnomessytemmm_t needs to read /etc/passwd - Allow cgred to read all sysctls- Allow all domains to read /proc/sys/vm/overcommit_memory - Make proc_numa_t an MLS Trusted Object - Add /proc/numactl support for confined users - Allow ssh_t to connect to any port > 1023 - Add openvswitch domain - Pulseaudio tries to create directories in gnome_home_t directories - New ypbind pkg wants to search /var/run which is caused by sd_notify - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans - Allow sanlock to read /dev/random - Treat php-fpm with httpd_t - Allow domains that can read named_conf_t to be able to list the directories - Allow winbind to create sock files in /var/run/samba- Add smsd policy - Add support for OpenShift sbin labelin - Add boolean to allow virt to use rawip - Allow mozilla_plugin to read all file systems with noxattrs support - Allow kerberos to write on anon_inodefs fs - Additional access required by fenced - Add filename transitions for passwd.lock/group.lock - UPdate man pages - Create coolkey directory in /var/cache with the correct label- Fix label on /etc/group.lock - Allow gnomeclock to create lnk_file in /etc - label /root/.pki as a home_cert_t - Add interface to make sure rpcbind.sock is created with the correct label - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules - opendkim should be a part of milter - Allow libvirt to set the kernel sched algorythm - Allow mongod to read sysfs_t - Add authconfig policy - Remove calls to miscfiles_read_localization all domains get this - Allow virsh_t to read /root/.pki/ content - Add label for log directory under /var/www/stickshift- Allow getty to setattr on usb ttys - Allow sshd to search all directories for sshd_home_t content - Allow staff domains to send dbus messages to kdumpgui - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t - Dontaudit setfiles reading urand - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir - Allow systemd-timedated to read /dev/urandom - Allow entropyd_t to read proc_t (meminfo) - Add unconfined munin plugin - Fix networkmanager_read_conf() interface - Allow blueman to list /tmp which is needed by sys_nic/setsched - Fix label of /etc/mail/aliasesdb-stamp - numad is searching cgroups - realmd is communicating with networkmanager using dbus - Lots of fixes to try to get kdump to work- Allow loging programs to dbus chat with realmd - Make apache_content_template calling as optional - realmd is using policy kit- Add new selinuxuser_use_ssh_chroot boolean - dbus needs to be able to read/write inherited fixed disk device_t passed through it - Cleanup netutils process allow rule - Dontaudit leaked fifo files from openshift to ping - sanlock needs to read mnt_t lnk files - Fail2ban needs to setsched and sys_nice- Change default label of all files in /var/run/rpcbind - Allow sandbox domains (java) to read hugetlbfs_t - Allow awstats cgi content to create tmp files and read apache log files - Allow setuid/setgid for cupsd-config - Allow setsched/sys_nice pro cupsd-config - Fix /etc/localtime sym link to be labeled locale_t - Allow sshd to search postgresql db t since this is a homedir - Allow xwindows users to chat with realmd - Allow unconfined domains to configure all files and null_device_t service- Adopt pki-selinux policy- pki is leaking which we dontaudit until a pki code fix - Allow setcap for arping - Update man pages - Add labeling for /usr/sbin/mcollectived - pki fixes - Allow smokeping to execute fping in the netutils_t domain- Allow mount to relabelfrom unlabeled file systems - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working - Add label to get bin files under libreoffice labeled correctly - Fix interface to allow executing of base_ro_file_type - Add fixes for realmd - Update pki policy - Add tftp_homedir boolean - Allow blueman sched_setscheduler - openshift user domains wants to r/w ssh tcp sockets- Additional requirements for disable unconfined module when booting - Fix label of systemd script files - semanage can use -F /dev/stdin to get input - syslog now uses kerberos keytabs - Allow xserver to compromise_kernel access - Allow nfsd to write to mount_var_run_t when running the mount command - Add filename transition rule for bin_t directories - Allow files to read usr_t lnk_files - dhcpc wants chown - Add support for new openshift labeling - Clean up for tunable+optional statements - Add labeling for /usr/sbin/mkhomedir_helper - Allow antivirus domain to managa amavis spool files - Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool- Add interfaces to read kernel_t proc info - Missed this version of exec_all - Allow anyone who can load a kernel module to compromise kernel - Add oddjob_dbus_chat to openshift apache policy - Allow chrome_sandbox_nacl_t to send signals to itself - Add unit file support to usbmuxd_t - Allow all openshift domains to read sysfs info - Allow openshift domains to getattr on all domains- MLS fixes from Dan - Fix name of capability2 secure_firmware->compromise_kerne- Allow xdm to search all file systems - Add interface to allow the config of all files - Add rngd policy - Remove kgpg as a gpg_exec_t type - Allow plymouthd to block suspend - Allow systemd_dbus to config any file - Allow system_dbus_t to configure all services - Allow freshclam_t to read usr_files - varnishd requires execmem to load modules- Allow semanage to verify types - Allow sudo domain to execute user home files - Allow session_bus_type to transition to user_tmpfs_t - Add dontaudit caused by yum updates - Implement pki policy but not activated- tuned wants to getattr on all filesystems - tuned needs also setsched. The build is needed for test day- Add policy for qemu-qa - Allow razor to write own config files - Add an initial antivirus policy to collect all antivirus program - Allow qdisk to read usr_t - Add additional caps for vmware_host - Allow tmpfiles_t to setattr on mandb_cache_t - Dontaudit leaked files into mozilla_plugin_config_t - Allow wdmd to getattr on tmpfs - Allow realmd to use /dev/random - allow containers to send audit messages - Allow root mount any file via loop device with enforcing mls policy - Allow tmpfiles_t to setattr on mandb_cache_t - Allow tmpfiles_t to setattr on mandb_cache_t - Make userdom_dontaudit_write_all_ not allow open - Allow init scripts to read all unit files - Add support for saphostctrl ports- Add kernel_read_system_state to sandbox_client_t - Add some of the missing access to kdumpgui - Allow systemd_dbusd_t to status the init system - Allow vmnet-natd to request the kernel to load a module - Allow gsf-office-thum to append .cache/gdm/session.log - realmd wants to read .config/dconf/user - Firewalld wants sys_nice/setsched - Allow tmpreaper to delete mandb cache files - Firewalld wants sys_nice/setsched - Allow firewalld to perform a DNS name resolution - Allown winbind to read /usr/share/samba/codepages/lowcase.dat - Add support for HTTPProxy* in /etc/freshclam.conf - Fix authlogin_yubike boolean - Extend smbd_selinux man page to include samba booleans - Allow dhcpc to execute consoletype - Allow ping to use inherited tmp files created in init scripts - On full relabel with unconfined domain disabled, initrc was running some chcon's - Allow people who delete man pages to delete mandb cache files- Add missing permissive domains- Add new mandb policy - ALlow systemd-tmpfiles_t to relabel mandb_cache_t - Allow logrotate to start all unit files- Add fixes for ctbd - Allow nmbd to stream connect to ctbd - Make cglear_t as nsswitch_domain - Fix bogus in interfaces - Allow openshift to read/write postfix public pipe - Add postfix_manage_spool_maildrop_files() interface - stickshift paths have been renamed to openshift - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes - Update man pages, adding ENTRYPOINTS- Add mei_device_t - Make sure gpg content in homedir created with correct label - Allow dmesg to write to abrt cache files - automount wants to search virtual memory sysctls - Add support for hplip logs stored in /var/log/hp/tmp - Add labeling for /etc/owncloud/config.php - Allow setroubleshoot to send analysys to syslogd-journal - Allow virsh_t to interact with new fenced daemon - Allow gpg to write to /etc/mail/spamassassiin directories - Make dovecot_deliver_t a mail server delivery type - Add label for /var/tmp/DNS25- Fixes for tomcat_domain template interface- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes - Add attribute to all base os types. Allow all domains to read all ro base OS types- Additional unit files to be defined as power unit files - Fix more boolean names- Fix boolean name so subs will continue to work- dbus needs to start getty unit files - Add interface to allow system_dbusd_t to start the poweroff service - xdm wants to exec telepathy apps - Allow users to send messages to systemdlogind - Additional rules needed for systemd and other boot apps - systemd wants to list /home and /boot - Allow gkeyringd to write dbus/conf file - realmd needs to read /dev/urand - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded- Fixes to safe more rules - Re-write tomcat_domain_template() - Fix passenger labeling - Allow all domains to read man pages - Add ephemeral_port_t to the 'generic' port interfaces - Fix the names of postgresql booleans- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer - Move netlable_peer check out of booleans - Remove call to recvfrom_netlabel for kerberos call - Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules - Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface - Allow rndc to block suspend - tuned needs to modify the schedule of the kernel - Allow svirt_t domains to read alsa configuration files - ighten security on irc domains and make sure they label content in homedir correctly - Add filetrans_home_content for irc files - Dontaudit all getattr access for devices and filesystems for sandbox domains - Allow stapserver to search cgroups directories - Allow all postfix domains to talk to spamd- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check - Change pam_t to pam_timestamp_t - Add dovecot_domain attribute and allow this attribute block_suspend capability2 - Add sanlock_use_fusefs boolean - numad wants send/recieve msg - Allow rhnsd to send syslog msgs - Make piranha-pulse as initrc domain - Update openshift instances to dontaudit setattr until the kernel is fixed.- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd - Remove pam_selinux.8 which conflicts with man page owned by the pam package - Allow glance-api to talk to mysql - ABRT wants to read Xorg.0.log if if it detects problem with Xorg - Fix gstreamer filename trans. interface- Man page fixes by Dan Walsh- Allow postalias to read postfix config files - Allow man2html to read man pages - Allow rhev-agentd to search all mountpoints - Allow rhsmcertd to read /dev/random - Add tgtd_stream_connect() interface - Add cyrus_write_data() interface - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t - Add port definition for tcp/81 as http_port_t - Fix /dev/twa labeling - Allow systemd to read modules config- Merge openshift policy - Allow xauth to read /dev/urandom - systemd needs to relabel content in /run/systemd directories - Files unconfined should be able to perform all services on all files - Puppet tmp file can be leaked to all domains - Dontaudit rhsmcertd-worker to search /root/.local - Allow chown capability for zarafa domains - Allow system cronjobs to runcon into openshift domains - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories- nmbd wants to create /var/nmbd - Stop transitioning out of anaconda and firstboot, just causes AVC messages - Allow clamscan to read /etc files - Allow bcfg2 to bind cyphesis port - heartbeat should be run as rgmanager_t instead of corosync_t - Add labeling for /etc/openldap/certs - Add labeling for /opt/sartest directory - Make crontab_t as userdom home reader - Allow tmpreaper to list admin_home dir - Add defition for imap_0 replay cache file - Add support for gitolite3 - Allow virsh_t to send syslog messages - allow domains that can read samba content to be able to list the directories also - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd - Separate out sandbox from sandboxX policy so we can disable it by default - Run dmeventd as lvm_t - Mounting on any directory requires setattr and write permissions - Fix use_nfs_home_dirs() boolean - New labels for pam_krb5 - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0 - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs - Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles- Allow realmd to read resolv.conf - Add pegasus_cache_t type - Label /usr/sbin/fence_virtd as virsh_exec_t - Add policy for pkcsslotd - Add support for cpglockd - Allow polkit-agent-helper to read system-auth-ac - telepathy-idle wants to read gschemas.compiled - Allow plymouthd to getattr on fs_t - Add slpd policy - Allow ksysguardproces to read/write config_usr_t- Fix labeling substitution so rpm will label /lib/systemd content correctly- Add file name transitions for ttyACM0 - spice-vdagent(d)'s are going to log over to syslog - Add sensord policy - Add more fixes for passenger policy related to puppet - Allow wdmd to create wdmd_tmpfs_t - Fix labeling for /var/run/cachefilesd\.pid - Add thumb_tmpfs_t files type- Allow svirt domains to manage the network since this is containerized - Allow svirt_lxc_net_t to send audit messages- Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working - Allow dlm_controld to execute dlm_stonith labeled as bin_t - Allow GFS2 working on F17 - Abrt needs to execute dmesg - Allow jockey to list the contents of modeprobe.d - Add policy for lightsquid as squid_cron_t - Mailscanner is creating files and directories in /tmp - dmesg is now reading /dev/kmsg - Allow xserver to communicate with secure_firmware - Allow fsadm tools (fsck) to read /run/mount contnet - Allow sysadm types to read /dev/kmsg -- Allow postfix, sssd, rpcd to block_suspend - udev seems to need secure_firmware capability - Allow virtd to send dbus messages to firewalld so it can configure the firewall- Fix labeling of content in /run created by virsh_t - Allow condor domains to read kernel sysctls - Allow condor_master to connect to amqp - Allow thumb drives to create shared memory and semaphores - Allow abrt to read mozilla_plugin config files - Add labels for lightsquid - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow - dovecot_auth_t uses ldap for user auth - Allow domains that can read dhcp_etc_t to read lnk_files - Add more then one watchdog device - Allow useradd_t to manage etc_t files so it can rename it and edit them - Fix invalid class dir should be fifo_file - Move /run/blkid to fsadm and make sure labeling is correct- Fix bogus regex found by eparis - Fix manage run interface since lvm needs more access - syslogd is searching cgroups directory - Fixes to allow virt-sandbox-service to manage lxc var run content- Fix Boolean settings - Add new libjavascriptcoregtk as textrel_shlib_t - Allow xdm_t to create xdm_home_t directories - Additional access required for systemd - Dontaudit mozilla_plugin attempts to ipc_lock - Allow tmpreaper to delete unlabeled files - Eliminate screen_tmp_t and allow it to manage user_tmp_t - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors - Allow web plugins to connect to the asterisk ports - Condor will recreate the lock directory if it does not exist - Oddjob mkhomedir needs to connectto user processes - Make oddjob_mkhomedir_t a userdom home manager- Put placeholder back in place for proper numbering of capabilities - Systemd also configures init scripts- Fix ecryptfs interfaces - Bootloader seems to be trolling around /dev/shm and /dev - init wants to create /etc/systemd/system-update.target.wants - Fix systemd_filetrans call to move it out of tunable - Fix up policy to work with systemd userspace manager - Add secure_firmware capability and remove bogus epolwakeup - Call seutil_*_login_config interfaces where should be needed - Allow rhsmcertd to send signal to itself - Allow thin domains to send signal to itself - Allow Chrome_ChildIO to read dosfs_t- Add role rules for realmd, sambagui- Add new type selinux_login_config_t for /etc/selinux//logins/ - Additional fixes for seutil_manage_module_store() - dbus_system_domain() should be used with optional_policy - Fix svirt to be allowed to use fusefs file system - Allow login programs to read /run/ data created by systemd_login - sssd wants to write /etc/selinux//logins/ for SELinux PAM module - Fix svirt to be allowed to use fusefs file system - Allow piranha domain to use nsswitch - Sanlock needs to send Kill Signals to non root processes - Pulseaudio wants to execute /run/user/PID/.orc- Fix saslauthd when it tries to read /etc/shadow - Label gnome-boxes as a virt homedir - Need to allow svirt_t ability to getattr on nfs_t file systems - Update sanlock policy to solve all AVC's - Change confined users can optionally manage virt content - Handle new directories under ~/.cache - Add block suspend to appropriate domains - More rules required for containers - Allow login programs to read /run/ data created by systemd_logind - Allow staff users to run svirt_t processes- Update to upstream- More fixes for systemd to make rawhide booting from Dan Walsh- Add systemd fixes to make rawhide booting- Add systemd_logind_inhibit_var_run_t attribute - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type - Add interface for mysqld to dontaudit signull to all processes - Label new /var/run/journal directory correctly - Allow users to inhibit suspend via systemd - Add new type for the /var/run/inhibit directory - Add interface to send signull to systemd_login so avahi can send them - Allow systemd_passwd to send syslog messages - Remove corenet_all_recvfrom_unlabeled() calling fro policy files - Allow editparams.cgi running as httpd_bugzilla_script_t to read /etc/group - Allow smbd to read cluster config - Add additional labeling for passenger - Allow dbus to inhibit suspend via systemd - Allow avahi to send signull to systemd_login- Add interface to dontaudit getattr access on sysctls - Allow sshd to execute /bin/login - Looks like xdm is recreating the xdm directory in ~/.cache/ on login - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald - Fix semanage to work with unconfined domain disabled on F18 - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls - Virt seems to be using lock files - Dovecot seems to be searching directories of every mountpoint - Allow jockey to read random/urandom, execute shell and install third-party drivers - Add aditional params to allow cachedfiles to manage its content - gpg agent needs to read /dev/random - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write - Add a bunch of dontaudit rules to quiet svirt_lxc domains - Additional perms needed to run svirt_lxc domains - Allow cgclear to read cgconfig - Allow sys_ptrace capability for snmp - Allow freshclam to read /proc - Allow procmail to manage /home/user/Maildir content - Allow NM to execute wpa_cli - Allow amavis to read clamd system state - Regenerate man pages- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild- Add realmd and stapserver policies - Allow useradd to manage stap-server lib files - Tighten up capabilities for confined users - Label /etc/security/opasswd as shadow_t - Add label for /dev/ecryptfs - Allow condor_startd_t to start sshd with the ranged - Allow lpstat.cups to read fips_enabled file - Allow pyzor running as spamc_t to create /root/.pyzor directory - Add labelinf for amavisd-snmp init script - Add support for amavisd-snmp - Allow fprintd sigkill self - Allow xend (w/o libvirt) to start virtual machines - Allow aiccu to read /etc/passwd - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes - Add condor_startd_ranged_domtrans_to() interface - Add ssd_conf_t for /etc/sssd - accountsd needs to fchown some files/directories - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit - Allow xend_t to read the /etc/passwd file- Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t - Add init_access_check() interface - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t - Allow tcpdump to create a netlink_socket - Label newusers like useradd - Change xdm log files to be labeled xdm_log_t - Allow sshd_t with privsep to work in MLS - Allow freshclam to update databases thru HTTP proxy - Allow s-m-config to access check on systemd - Allow abrt to read public files by default - Fix amavis_create_pid_files() interface - Add labeling and filename transition for dbomatic.log - Allow system_dbusd_t to stream connect to bluetooth, and use its socket - Allow amavisd to execute fsav - Allow tuned to use sys_admin and sys_nice capabilities - Add php-fpm policy from Bryan - Add labeling for aeolus-configserver-thinwrapper - Allow thin domains to execute shell - Fix gnome_role_gkeyringd() interface description - Lot of interface fixes - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files - Allow OpenMPI job to use kerberos - Make deltacloudd_t as nsswitch_domain - Allow xend_t to run lsscsi - Allow qemu-dm running as xend_t to create tun_socket - Add labeling for /opt/brother/Printers(.*/)?inf - Allow jockey-backend to read pyconfig-64.h labeled as usr_t - Fix clamscan_can_scan_system boolean - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11- initrc is calling exportfs which is not confined so it attempts to read nfsd_files - Fixes for passenger running within openshift. - Add labeling for all tomcat6 dirs - Add support for tomcat6 - Allow cobblerd to read /etc/passwd - Allow jockey to read sysfs and and execute binaries with bin_t - Allow thum to use user terminals - Allow cgclear to read cgconfig config files - Fix bcf2g.fc - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains - Allow dbomatic to execute ruby - abrt_watch_log should be abrt_domain - Allow mozilla_plugin to connect to gatekeeper port- add ptrace_child access to process - remove files_read_etc_files() calling from all policies which have auth_use_nsswith() - Allow boinc domains to manage boinc_lib_t lnk_files - Add support for boinc-client.service unit file - Add support for boinc.log - Allow mozilla_plugin execmod on mozilla home files if allow_ex - Allow dovecot_deliver_t to read dovecot_var_run_t - Allow ldconfig and insmod to manage kdumpctl tmp files - Move thin policy out from cloudform.pp and add a new thin poli - pacemaker needs to communicate with corosync streams - abrt is now started on demand by dbus - Allow certmonger to talk directly to Dogtag servers - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c - Allow mozila_plugin to execute gstreamer home files - Allow useradd to delete all file types stored in the users hom - rhsmcertd reads the rpm database - Add support for lightdm- Add tomcat policy - Remove pyzor/razor policy - rhsmcertd reads the rpm database - Dontaudit thumb to setattr on xdm_tmp dir - Allow wicd to execute ldconfig in the networkmanager_t domain - Add /var/run/cherokee\.pid labeling - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too - Allow postfix-master to r/w pipes other postfix domains - Allow snort to create netlink_socket - Add kdumpctl policy - Allow firstboot to create tmp_t files/directories - /usr/bin/paster should not be labeled as piranha_exec_t - remove initrc_domain from tomcat - Allow ddclient to read /etc/passwd - Allow useradd to delete all file types stored in the users homedir - Allow ldconfig and insmod to manage kdumpctl tmp files - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those - Transition xauth files within firstboot_tmp_t - Fix labeling of /run/media to match /media - Label all lxdm.log as xserver_log_t - Add port definition for mxi port - Allow local_login_t to execute tmux- apcupsd needs to read /etc/passwd - Sanlock allso sends sigkill - Allow glance_registry to connect to the mysqld port - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl - Allow firefox plugins/flash to connect to port 1234 - Allow mozilla plugins to delete user_tmp_t files - Add transition name rule for printers.conf.O - Allow virt_lxc_t to read urand - Allow systemd_loigind to list gstreamer_home_dirs - Fix labeling for /usr/bin - Fixes for cloudform services * support FIPS - Allow polipo to work as web caching - Allow chfn to execute tmux- Add support for ecryptfs * ecryptfs does not support xattr * we need labeling for HOMEDIR - Add policy for (u)mount.ecryptfs* - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache - Allow dovecot to manage Maildir content, fix transitions to Maildir - Allow postfix_local to transition to dovecot_deliver - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code - Cleanup interface definitions - Allow apmd to change with the logind daemon - Changes required for sanlock in rhel6 - Label /run/user/apache as httpd_tmp_t - Allow thumb to use lib_t as execmod if boolean turned on - Allow squid to create the squid directory in /var with the correct labe - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com) - Allow virtd to exec xend_exec_t without transition - Allow virtd_lxc_t to unmount all file systems- PolicyKit path has changed - Allow httpd connect to dirsrv socket - Allow tuned to write generic kernel sysctls - Dontaudit logwatch to gettr on /dev/dm-2 - Allow policykit-auth to manage kerberos files - Make condor_startd and rgmanager as initrc domain - Allow virsh to read /etc/passwd - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs - xdm now needs to execute xsession_exec_t - Need labels for /var/lib/gdm - Fix files_filetrans_named_content() interface - Add new attribute - initrc_domain - Allow systemd_logind_t to signal, signull, sigkill all processes - Add filetrans rules for etc_runtime files- Rename boolean names to remove allow_- Mass merge with upstream * new policy topology to include contrib policy modules * we have now two base policy patches- Fix description of authlogin_nsswitch_use_ldap - Fix transition rule for rhsmcertd_t needed for RHEL7 - Allow useradd to list nfs state data - Allow openvpn to manage its log file and directory - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly - Allow thumb to use nvidia devices - Allow local_login to create user_tmp_t files for kerberos - Pulseaudio needs to read systemd_login /var/run content - virt should only transition named system_conf_t config files - Allow munin to execute its plugins - Allow nagios system plugin to read /etc/passwd - Allow plugin to connect to soundd port - Fix httpd_passwd to be able to ask passwords - Radius servers can use ldap for backing store - Seems to need to mount on /var/lib for xguest polyinstatiation to work. - Allow systemd_logind to list the contents of gnome keyring - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL - Add policy for isns-utils- Add policy for subversion daemon - Allow boinc to read passwd - Allow pads to read kernel network state - Fix man2html interface for sepolgen-ifgen - Remove extra /usr/lib/systemd/system/smb - Remove all /lib/systemd and replace with /usr/lib/systemd - Add policy for man2html - Fix the label of kerberos_home_t to krb5_home_t - Allow mozilla plugins to use Citrix - Allow tuned to read /proc/sys/kernel/nmi_watchdog - Allow tune /sys options via systemd's tmpfiles.d "w" type- Dontaudit lpr_t to read/write leaked mozilla tmp files - Add file name transition for .grl-podcasts directory - Allow corosync to read user tmp files - Allow fenced to create snmp lib dirs/files - More fixes for sge policy - Allow mozilla_plugin_t to execute any application - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain - Allow mongod to read system state information - Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t - Allow polipo to manage polipo_cache dirs - Add jabbar_client port to mozilla_plugin_t - Cleanup procmail policy - system bus will pass around open file descriptors on files that do not have labels on them - Allow l2tpd_t to read system state - Allow tuned to run ls /dev - Allow sudo domains to read usr_t files - Add label to machine-id - Fix corecmd_read_bin_symlinks cut and paste error- Fix pulseaudio port definition - Add labeling for condor_starter - Allow chfn_t to creat user_tmp_files - Allow chfn_t to execute bin_t - Allow prelink_cron_system_t to getpw calls - Allow sudo domains to manage kerberos rcache files - Allow user_mail_domains to work with courie - Port definitions necessary for running jboss apps within openshift - Add support for openstack-nova-metadata-api - Add support for nova-console* - Add support for openstack-nova-xvpvncproxy - Fixes to make privsep+SELinux working if we try to use chage to change passwd - Fix auth_role() interface - Allow numad to read sysfs - Allow matahari-rpcd to execute shell - Add label for ~/.spicec - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it - Devicekit_disk wants to read the logind sessions file when writing a cd - Add fixes for condor to make condor jobs working correctly - Change label of /var/log/rpmpkgs to cron_log_t - Access requires to allow systemd-tmpfiles --create to work. - Fix obex to be a user application started by the session bus. - Add additional filename trans rules for kerberos - Fix /var/run/heartbeat labeling - Allow apps that are managing rcache to file trans correctly - Allow openvpn to authenticate against ldap server - Containers need to listen to network starting and stopping events- Make systemd unit files less specific- Fix zarafa labeling - Allow guest_t to fix labeling - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean - add lxc_contexts - Allow accountsd to read /proc - Allow restorecond to getattr on all file sytems - tmpwatch now calls getpw - Allow apache daemon to transition to pwauth domain - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t - The obex socket seems to be a stream socket - dd label for /var/run/nologin- Allow jetty running as httpd_t to read hugetlbfs files - Allow sys_nice and setsched for rhsmcertd - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports - Allow setfiles to append to xdm_tmp_t - Add labeling for /export as a usr_t directory - Add labels for .grl files created by gstreamer- Add labeling for /usr/share/jetty/bin/jetty.sh - Add jetty policy which contains file type definitios - Allow jockey to use its own fifo_file and make this the default for all domains - Allow mozilla_plugins to use spice (vnc_port/couchdb) - asterisk wants to read the network state - Blueman now uses /var/lib/blueman- Add label for nodejs_debug - Allow mozilla_plugin_t to create ~/.pki directory and content- Add clamscan_can_scan_system boolean - Allow mysqld to read kernel network state - Allow sshd to read/write condor lib files - Allow sshd to read/write condor-startd tcp socket - Fix description on httpd_graceful_shutdown - Allow glance_registry to communicate with mysql - dbus_system_domain is using systemd to lauch applications - add interfaces to allow domains to send kill signals to user mail agents - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t - Lots of new access required for secure containers - Corosync needs sys_admin capability - ALlow colord to create shm - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific - Add boolean to control whether or not mozilla plugins can create random content in the users homedir - Add new interface to allow domains to list msyql_db directories, needed for libra - shutdown has to be allowed to delete etc_runtime_t - Fail2ban needs to read /etc/passwd - Allow ldconfig to create /var/cache/ldconfig - Allow tgtd to read hardware state information - Allow collectd to create packet socket - Allow chronyd to send signal to itself - Allow collectd to read /dev/random - Allow collectd to send signal to itself - firewalld needs to execute restorecon - Allow restorecon and other login domains to execute restorecon- Allow logrotate to getattr on systemd unit files - Add support for tor systemd unit file - Allow apmd to create /var/run/pm-utils with the correct label - Allow l2tpd to send sigkill to pppd - Allow pppd to stream connect to l2tpd - Add label for scripts in /etc/gdm/ - Allow systemd_logind_t to ignore mcs constraints on sigkill - Fix files_filetrans_system_conf_named_files() interface - Add labels for /usr/share/wordpress/wp-includes/*.php - Allow cobbler to get SELinux mode and booleans- Add unconfined_execmem_exec_t as an alias to bin_t - Allow fenced to read snmp var lib files, also allow it to read usr_t - ontaudit access checks on all executables from mozilla_plugin - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode - Allow systemd_tmpfiles_t to getattr all pipes and sockets - Allow glance-registry to send system log messages - semanage needs to manage mock lib files/dirs- Add policy for abrt-watch-log - Add definitions for jboss_messaging ports - Allow systemd_tmpfiles to manage printer devices - Allow oddjob to use nsswitch - Fix labeling of log files for postgresql - Allow mozilla_plugin_t to execmem and execstack by default - Allow firewalld to execute shell - Fix /etc/wicd content files to get created with the correct label - Allow mcelog to exec shell - Add ~/.orc as a gstreamer_home_t - /var/spool/postfix/lib64 should be labeled lib_t - mpreaper should be able to list all file system labeled directories - Add support for apache to use openstack - Add labeling for /etc/zipl.conf and zipl binary - Turn on allow_execstack and turn off telepathy transition for final release- More access required for virt_qmf_t - Additional assess required for systemd-logind to support multi-seat - Allow mozilla_plugin to setrlimit - Revert changes to fuse file system to stop deadlock- Allow condor domains to connect to ephemeral ports - More fixes for condor policy - Allow keystone to stream connect to mysqld - Allow mozilla_plugin_t to read generic USB device to support GPS devices - Allow thum to file name transition gstreamer home content - Allow thum to read all non security files - Allow glance_api_t to connect to ephemeral ports - Allow nagios plugins to read /dev/urandom - Allow syslogd to search postfix spool to support postfix chroot env - Fix labeling for /var/spool/postfix/dev - Allow wdmd chown - Label .esd_auth as pulseaudio_home_t - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now- Add support for clamd+systemd - Allow fresclam to execute systemctl to handle clamd - Change labeling for /usr/sbin/rpc.ypasswd.env - Allow yppaswd_t to execute yppaswd_exec_t - Allow yppaswd_t to read /etc/passwd - Gnomekeyring socket has been moved to /run/user/USER/ - Allow samba-net to connect to ldap port - Allow signal for vhostmd - allow mozilla_plugin_t to read user_home_t socket - New access required for secure Linux Containers - zfs now supports xattrs - Allow quantum to execute sudo and list sysfs - Allow init to dbus chat with the firewalld - Allow zebra to read /etc/passwd- Allow svirt_t to create content in the users homedir under ~/.libvirt - Fix label on /var/lib/heartbeat - Allow systemd_logind_t to send kill signals to all processes started by a user - Fuse now supports Xattr Support- upowered needs to setsched on the kernel - Allow mpd_t to manage log files - Allow xdm_t to create /var/run/systemd/multi-session-x - Add rules for missedfont.log to be used by thumb.fc - Additional access required for virt_qmf_t - Allow dhclient to dbus chat with the firewalld - Add label for lvmetad - Allow systemd_logind_t to remove userdomain sock_files - Allow cups to execute usr_t files - Fix labeling on nvidia shared libraries - wdmd_t needs access to sssd and /etc/passwd - Add boolean to allow ftp servers to run in passive mode - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with - Fix using httpd_use_fusefs - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox- Rename rdate port to time port, and allow gnomeclock to connect to it - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda - /etc/auto.* should be labeled bin_t - Add httpd_use_fusefs boolean - Add fixes for heartbeat - Allow sshd_t to signal processes that it transitions to - Add condor policy - Allow svirt to create monitors in ~/.libvirt - Allow dovecot to domtrans sendmail to handle sieve scripts - Lot of fixes for cfengine- /var/run/postmaster.* labeling is no longer needed - Alllow drbdadmin to read /dev/urandom - l2tpd_t seems to use ptmx - group+ and passwd+ should be labeled as /etc/passwd - Zarafa-indexer is a socket- Ensure lastlog is labeled correctly - Allow accountsd to read /proc data about gdm - Add fixes for tuned - Add bcfg2 fixes which were discovered during RHEL6 testing - More fixes for gnome-keyring socket being moved - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown - Fix description for files_dontaudit_read_security_files() interface- Add new policy and man page for bcfg2 - cgconfig needs to use getpw calls - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt - gnome-keyring wants to create a directory in cache_home_t - sanlock calls getpw- Add numad policy and numad man page - Add fixes for interface bugs discovered by SEWatch - Add /tmp support for squid - Add fix for #799102 * change default labeling for /var/run/slapd.* sockets - Make thumb_t as userdom_home_reader - label /var/lib/sss/mc same as pubconf, so getpw domains can read it - Allow smbspool running as cups_t to stream connect to nmbd - accounts needs to be able to execute passwd on behalf of users - Allow systemd_tmpfiles_t to delete boot flags - Allow dnssec_trigger to connect to apache ports - Allow gnome keyring to create sock_files in ~/.cache - google_authenticator is using .google_authenticator - sandbox running from within firefox is exposing more leaks - Dontaudit thumb to read/write /dev/card0 - Dontaudit getattr on init_exec_t for gnomeclock_t - Allow certmonger to do a transition to certmonger_unconfined_t - Allow dhcpc setsched which is caused by nmcli - Add rpm_exec_t for /usr/sbin/bcfg2 - system cronjobs are sending dbus messages to systemd_logind - Thumnailers read /dev/urand- Allow auditctl getcap - Allow vdagent to use libsystemd-login - Allow abrt-dump-oops to search /etc/abrt - Got these avc's while trying to print a boarding pass from firefox - Devicekit is now putting the media directory under /run/media - Allow thumbnailers to create content in ~/.thumbails directory - Add support for proL2TPd by Dominick Grift - Allow all domains to call getcap - wdmd seems to get a random chown capability check that it does not need - Allow vhostmd to read kernel sysctls- Allow chronyd to read unix - Allow hpfax to read /etc/passwd - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them - Allow rpcd to read quota_db_t - Update to man pages to match latest policy - Fix bug in jockey interface for sepolgen-ifgen - Add initial svirt_prot_exec_t policy- More fixes for systemd from Dan Walsh- Add a new type for /etc/firewalld and allow firewalld to write to this directory - Add definition for ~/Maildir, and allow mail deliver domains to write there - Allow polipo to run from a cron job - Allow rtkit to schedule wine processes - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label - Allow users domains to send signals to consolehelper domains- More fixes for boinc policy - Allow polipo domain to create its own cache dir and pid file - Add systemctl support to httpd domain - Add systemctl support to polipo, allow NetworkManager to manage the service - Add policy for jockey-backend - Add support for motion daemon which is now covered by zoneminder policy - Allow colord to read/write motion tmpfs - Allow vnstat to search through var_lib_t directories - Stop transitioning to quota_t, from init an sysadm_t- Add svirt_lxc_file_t as a customizable type- Add additional fixes for icmp nagios plugin - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin - Add certmonger_unconfined_exec_t - Make sure tap22 device is created with the correct label - Allow staff users to read systemd unit files - Merge in previously built policy - Arpwatch needs to be able to start netlink sockets in order to start - Allow cgred_t to sys_ptrace to look at other DAC Processes- Back port some of the access that was allowed in nsplugin_t - Add definitiona for couchdb ports - Allow nagios to use inherited users ttys - Add git support for mock - Allow inetd to use rdate port - Add own type for rdate port - Allow samba to act as a portmapper - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev - New fixes needed for samba4 - Allow apps that use lib_t to read lib_t symlinks- Add policy for nove-cert - Add labeling for nova-openstack systemd unit files - Add policy for keystoke- Fix man pages fro domains - Add man pages for SELinux users and roles - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon - Add policy for matahari-rpcd - nfsd executes mount command on restart - Matahari domains execute renice and setsched - Dontaudit leaked tty in mozilla_plugin_config - mailman is changing to a per instance naming - Add 7600 and 4447 as jboss_management ports - Add fixes for nagios event handlers - Label httpd.event as httpd_exec_t, it is an apache daemon- Add labeling for /var/spool/postfix/dev/log - NM reads sysctl.conf - Iscsi log file context specification fix - Allow mozilla plugins to send dbus messages to user domains that transition to it - Allow mysql to read the passwd file - Allow mozilla_plugin_t to create mozilla home dirs in user homedir - Allow deltacloud to read kernel sysctl - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself - Allow postgresql_t to connectto itself - Add login_userdomain attribute for users which can log in using terminal- Allow sysadm_u to reach system_r by default #784011 - Allow nagios plugins to use inherited user terminals - Razor labeling is not used no longer - Add systemd support for matahari - Add port_types to man page, move booleans to the top, fix some english - Add support for matahari-sysconfig-console - Clean up matahari.fc - Fix matahari_admin() interfac - Add labels for/etc/ssh/ssh_host_*.pub keys- Allow ksysguardproces to send system log msgs - Allow boinc setpgid and signull - Allow xdm_t to sys_ptrace to run pidof command - Allow smtpd_t to manage spool files/directories and symbolic links - Add labeling for jetty - Needed changes to get unbound/dnssec to work with openswan- Add user_fonts_t alias xfs_tmp_t - Since depmod now runs as insmod_t we need to write to kernel_object_t - Allow firewalld to dbus chat with networkmanager - Allow qpidd to connect to matahari ports - policykit needs to read /proc for uses not owned by it - Allow systemctl apps to connecto the init stream- Turn on deny_ptrace boolean- Remove pam_selinux.8 man page. There was a conflict.- Add proxy class and read access for gssd_proxy - Separate out the sharing public content booleans - Allow certmonger to execute a script and send signals to apache and dirsrv to reload the certificate - Add label transition for gstream-0.10 and 12 - Add booleans to allow rsync to share nfs and cifs file sytems - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it - Fix filename transitions for cups files - Allow denyhosts to read "unix" - Add file name transition for locale.conf.new - Allow boinc projects to gconf config files - sssd needs to be able to increase the socket limit under certain loads - sge_execd needs to read /etc/passwd - Allow denyhost to check network state - NetworkManager needs to read sessions data - Allow denyhost to check network state - Allow xen to search virt images directories - Add label for /dev/megaraid_sas_ioctl_node - Add autogenerated man pages- Allow boinc project to getattr on fs - Allow init to execute initrc_state_t - rhev-agent package was rename to ovirt-guest-agent - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly - sytemd writes content to /run/initramfs and executes it on shutdown - kdump_t needs to read /etc/mtab, should be back ported to F16 - udev needs to load kernel modules in early system boot- Need to add sys_ptrace back in since reading any content in /proc can cause these accesses - Add additional systemd interfaces which are needed fro *_admin interfaces - Fix bind_admin() interface- Allow firewalld to read urand - Alias java, execmem_mono to bin_t to allow third parties - Add label for kmod - /etc/redhat-lsb contains binaries - Add boolean to allow gitosis to send mail - Add filename transition also for "event20" - Allow systemd_tmpfiles_t to delete all file types - Allow collectd to ipc_lock- make consoletype_exec optional, so we can remove consoletype policy - remove unconfined_permisive.patch - Allow openvpn_t to inherit user home content and tmp content - Fix dnssec-trigger labeling - Turn on obex policy for staff_t - Pem files should not be secret - Add lots of rules to fix AVC's when playing with containers - Fix policy for dnssec - Label ask-passwd directories correctly for systemd- sshd fixes seem to be causing unconfined domains to dyntrans to themselves - fuse file system is now being mounted in /run/user - systemd_logind is sending signals to processes that are dbus messaging with it - Add support for winshadow port and allow iscsid to connect to this port - httpd should be allowed to bind to the http_port_t udp socket - zarafa_var_lib_t can be a lnk_file - A couple of new .xsession-errors files - Seems like user space and login programs need to read logind_sessions_files - Devicekit disk seems to be being launched by systemd - Cleanup handling of setfiles so most of rules in te file - Correct port number for dnssec - logcheck has the home dir set to its cache- Add policy for grindengine MPI jobs- Add new sysadm_secadm.pp module * contains secadm definition for sysadm_t - Move user_mail_domain access out of the interface into the te file - Allow httpd_t to create httpd_var_lib_t directories as well as files - Allow snmpd to connect to the ricci_modcluster stream - Allow firewalld to read /etc/passwd - Add auth_use_nsswitch for colord - Allow smartd to read network state - smartdnotify needs to read /etc/group- Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory - lxdm startup scripts should be labeled bin_t, so confined users will work - mcstransd now creates a pid, needs back port to F16 - qpidd should be allowed to connect to the amqp port - Label devices 010-029 as usb devices - ypserv packager says ypserv does not use tmp_t so removing selinux policy types - Remove all ptrace commands that I believe are caused by the kernel/ps avcs - Add initial Obex policy - Add logging_syslogd_use_tty boolean - Add polipo_connect_all_unreserved bolean - Allow zabbix to connect to ftp port - Allow systemd-logind to be able to switch VTs - Allow apache to communicate with memcached through a sock_file- Fix file_context.subs_dist for now to work with pre usrmove- More /usr move fixes- Add zabbix_can_network boolean - Add httpd_can_connect_zabbix boolean - Prepare file context labeling for usrmove functions - Allow system cronjobs to read kernel network state - Add support for selinux_avcstat munin plugin - Treat hearbeat with corosync policy - Allow corosync to read and write to qpidd shared mem - mozilla_plugin is trying to run pulseaudio - Fixes for new sshd patch for running priv sep domains as the users context - Turn off dontaudit rules when turning on allow_ypbind - udev now reads /etc/modules.d directory- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out - Cups exchanges dbus messages with init - udisk2 needs to send syslog messages - certwatch needs to read /etc/passwd- Add labeling for udisks2 - Allow fsadmin to communicate with the systemd process- Treat Bip with bitlbee policy * Bip is an IRC proxy - Add port definition for interwise port - Add support for ipa_memcached socket - systemd_jounald needs to getattr on all processes - mdadmin fixes * uses getpw - amavisd calls getpwnam() - denyhosts calls getpwall()- Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there - bluetooth says they do not use /tmp and want to remove the type - Allow init to transition to colord - Mongod needs to read /proc/sys/vm/zone_reclaim_mode - Allow postfix_smtpd_t to connect to spamd - Add boolean to allow ftp to connect to all ports > 1023 - Allow sendmain to write to inherited dovecot tmp files - setroubleshoot needs to be able to execute rpm to see what version of packages- Merge systemd patch - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online - Allow deltacloudd dac_override, setuid, setgid caps - Allow aisexec to execute shell - Add use_nfs_home_dirs boolean for ssh-keygen- Fixes to make rawhide boot in enforcing mode with latest systemd changes- Add labeling for /var/run/systemd/journal/syslog - libvirt sends signals to ifconfig - Allow domains that read logind session files to list them- Fixed destined form libvirt-sandbox - Allow apps that list sysfs to also read sympolicy links in this filesystem - Add ubac_constrained rules for chrome_sandbox - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra - Allow postgresql to be executed by the caller - Standardize interfaces of daemons - Add new labeling for mm-handler - Allow all matahari domains to read network state and etc_runtime_t files- New fix for seunshare, requires seunshare_domains to be able to mounton / - Allow systemctl running as logrotate_t to connect to private systemd socket - Allow tmpwatch to read meminfo - Allow rpc.svcgssd to read supported_krb5_enctype - Allow zarafa domains to read /dev/random and /dev/urandom - Allow snmpd to read dev_snmp6 - Allow procmail to talk with cyrus - Add fixes for check_disk and check_nagios plugins- default trans rules for Rawhide policy - Make sure sound_devices controlC* are labeled correctly on creation - sssd now needs sys_admin - Allow snmp to read all proc_type - Allow to setup users homedir with quota.group- Add httpd_can_connect_ldap() interface - apcupsd_t needs to use seriel ports connected to usb devices - Kde puts procmail mail directory under ~/.local/share - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now - Add labeling for /sbin/iscsiuio- Add label for /var/lib/iscan/interpreter - Dont audit writes to leaked file descriptors or redirected output for nacl - NetworkManager needs to write to /sys/class/net/ib*/mode- Allow abrt to request the kernel to load a module - Make sure mozilla content is labeled correctly - Allow tgtd to read system state - More fixes for boinc * allow to resolve dns name * re-write boinc policy to use boinc_domain attribute - Allow munin services plugins to use NSCD services- Allow mozilla_plugin_t to manage mozilla_home_t - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain - Add label for tumblerd- Fixes for xguest package- Fixes related to /bin, /sbin - Allow abrt to getattr on blk files - Add type for rhev-agent log file - Fix labeling for /dev/dmfm - Dontaudit wicd leaking - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it - Label /etc/locale.conf correctly - Allow user_mail_t to read /dev/random - Allow postfix-smtpd to read MIMEDefang - Add label for /var/log/suphp.log - Allow swat_t to connect and read/write nmbd_t sock_file - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf - Allow systemd-tmpfiles to change user identity in object contexts - More fixes for rhev_agentd_t consolehelper policy- Use fs_use_xattr for squashf - Fix procs_type interface - Dovecot has a new fifo_file /var/run/dovecot/stats-mail - Dovecot has a new fifo_file /var/run/stats-mail - Colord does not need to connect to network - Allow system_cronjob to dbus chat with NetworkManager - Puppet manages content, want to make sure it labels everything correctly- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it - Allow all postfix domains to use the fifo_file - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t - Allow apmd_t to read grub.cfg - Let firewallgui read the selinux config - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp - Fix devicekit_manage_pid_files() interface - Allow squid to check the network state - Dontaudit colord getattr on file systems - Allow ping domains to read zabbix_tmp_t files- Allow mcelog_t to create dir and file in /var/run and label it correctly - Allow dbus to manage fusefs - Mount needs to read process state when mounting gluster file systems - Allow collectd-web to read collectd lib files - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr - Allow colord to get the attributes of tmpfs filesystem - Add sanlock_use_nfs and sanlock_use_samba booleans - Add bin_t label for /usr/lib/virtualbox/VBoxManage- Add ssh_dontaudit_search_home_dir - Changes to allow namespace_init_t to work - Add interface to allow exec of mongod, add port definition for mongod port, 27017 - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t - Allow spamd and clamd to steam connect to each other - Add policy label for passwd.OLD - More fixes for postfix and postfix maildro - Add ftp support for mozilla plugins - Useradd now needs to manage policy since it calls libsemanage - Fix devicekit_manage_log_files() interface - Allow colord to execute ifconfig - Allow accountsd to read /sys - Allow mysqld-safe to execute shell - Allow openct to stream connect to pcscd - Add label for /var/run/nm-dns-dnsmasq\.conf - Allow networkmanager to chat with virtd_t- Pulseaudio changes - Merge patches- Merge patches back into git repository.- Remove allow_execmem boolean and replace with deny_execmem boolean- Turn back on allow_execmem boolean- Add more MCS fixes to make sandbox working - Make faillog MLS trusted to make sudo_$1_t working - Allow sandbox_web_client_t to read passwd_file_t - Add .mailrc file context - Remove execheap from openoffice domain - Allow chrome_sandbox_nacl_t to read cpu_info - Allow virtd to relabel generic usb which is need if USB device - Fixes for virt.if interfaces to consider chr_file as image file type- Remove Open Office policy - Remove execmem policy- MCS fixes - quota fixes- Remove transitions to consoletype- Make nvidia* to be labeled correctly - Fix abrt_manage_cache() interface - Make filetrans rules optional so base policy will build - Dontaudit chkpwd_t access to inherited TTYS - Make sure postfix content gets created with the correct label - Allow gnomeclock to read cgroup - Fixes for cloudform policy- Check in fixed for Chrome nacl support- Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_overide to communicate with users TTY's - Allow svirt_lxc domains to send kill signals within their container- Remove qemu.pp again without causing a crash- Remove qemu.pp, everything should use svirt_t or stay in its current domain- Allow policykit to talk to the systemd via dbus - Move chrome_sandbox_nacl_t to permissive domains - Additional rules for chrome_sandbox_nacl- Change bootstrap name to nacl - Chrome still needs execmem - Missing role for chrome_sandbox_bootstrap - Add boolean to remove execmem and execstack from virtual machines - Dontaudit xdm_t doing an access_check on etc_t directories- Allow named to connect to dirsrv by default - add ldapmap1_0 as a krb5_host_rcache_t file - Google chrome developers asked me to add bootstrap policy for nacl stuff - Allow rhev_agentd_t to getattr on mountpoints - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets- Fixes for cloudform policies which need to connect to random ports - Make sure if an admin creates modules content it creates them with the correct label - Add port 8953 as a dns port used by unbound - Fix file name transition for alsa and confined users- Turn on mock_t and thumb_t for unconfined domains- Policy update should not modify local contexts- Remove ada policy- Remove tzdata policy - Add labeling for udev - Add cloudform policy - Fixes for bootloader policy- Add policies for nova openstack- Add fixes for nova-stack policy- Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain - Allow init process to setrlimit on itself - Take away transition rules for users executing ssh-keygen - Allow setroubleshoot_fixit_t to read /dev/urand - Allow sshd to relbale tunnel sockets - Allow fail2ban domtrans to shorewall in the same way as with iptables - Add support for lnk files in the /var/lib/sssd directory - Allow system mail to connect to courier-authdaemon over an unix stream socket- Add passwd_file_t for /etc/ptmptmp- Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK) - Make corosync to be able to relabelto cluster lib fies - Allow samba domains to search /var/run/nmbd - Allow dirsrv to use pam - Allow thumb to call getuid - chrome less likely to get mmap_zero bug so removing dontaudit - gimp help-browser has built in javascript - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t - Re-write glance policy- Move dontaudit sys_ptrace line from permissive.te to domain.te - Remove policy for hal, it no longer exists- Don't check md5 size or mtime on certain config files- Remove allow_ptrace and replace it with deny_ptrace, which will remove all ptrace from the system - Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;- Fixes for bootloader policy - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore - Allow nsplugin to read /usr/share/config - Allow sa-update to update rules - Add use_fusefs_home_dirs for chroot ssh option - Fixes for grub2 - Update systemd_exec_systemctl() interface - Allow gpg to read the mail spool - More fixes for sa-update running out of cron job - Allow ipsec_mgmt_t to read hardware state information - Allow pptp_t to connect to unreserved_port_t - Dontaudit getattr on initctl in /dev from chfn - Dontaudit getattr on kernel_core from chfn - Add systemd_list_unit_dirs to systemd_exec_systemctl call - Fixes for collectd policy - CHange sysadm_t to create content as user_tmp_t under /tmp- Shrink size of policy through use of attributes for userdomain and apache- Allow virsh to read xenstored pid file - Backport corenetwork fixes from upstream - Do not audit attempts by thumb to search config_home_t dirs (~/.config) - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t - allow thumb to read generic data home files (mime.type)- Allow nmbd to manage sock file in /var/run/nmbd - ricci_modservice send syslog msgs - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly - Allow systemd_logind_t to manage /run/USER/dconf/user- Fix missing patch from F16- Allow logrotate setuid and setgid since logrotate is supposed to do it - Fixes for thumb policy by grift - Add new nfsd ports - Added fix to allow confined apps to execmod on chrome - Add labeling for additional vdsm directories - Allow Exim and Dovecot SASL - Add label for /var/run/nmbd - Add fixes to make virsh and xen working together - Colord executes ls - /var/spool/cron is now labeled as user_cron_spool_t- Stop complaining about leaked file descriptors during install- Remove java and mono module and merge into execmem- Fixes for thumb policy and passwd_file_t- Fixes caused by the labeling of /etc/passwd - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide- Add support for Clustered Samba commands - Allow ricci_modrpm_t to send log msgs - move permissive virt_qmf_t from virt.te to permissivedomains.te - Allow ssh_t to use kernel keyrings - Add policy for libvirt-qmf and more fixes for linux containers - Initial Polipo - Sanlock needs to run ranged in order to kill svirt processes - Allow smbcontrol to stream connect to ctdbd- Add label for /etc/passwd- Change unconfined_domains to permissive for Rawhide - Add definition for the ephemeral_ports- Make mta_role() active - Allow asterisk to connect to jabber client port - Allow procmail to read utmp - Add NIS support for systemd_logind_t - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t - Fix systemd_manage_unit_dirs() interface - Allow ssh_t to manage directories passed into it - init needs to be able to create and delete unit file directories - Fix typo in apache_exec_sys_script - Add ability for logrotate to transition to awstat domain- Change screen to use screen_domain attribute and allow screen_domains to read all process domain state - Add SELinux support for ssh pre-auth net process in F17 - Add logging_syslogd_can_sendmail boolean- Add definition for ephemeral ports - Define user_tty_device_t as a customizable_type- Needs to require a new version of checkpolicy - Interface fixes- Allow sanlock to manage virt lib files - Add virt_use_sanlock booelan - ksmtuned is trying to resolve uids - Make sure .gvfs is labeled user_home_t in the users home directory - Sanlock sends kill signals and needs the kill capability - Allow mockbuild to work on nfs homedirs - Fix kerberos_manage_host_rcache() interface - Allow exim to read system state- Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t- Allow collectd to read hardware state information - Add loop_control_device_t - Allow mdadm to request kernel to load module - Allow domains that start other domains via systemctl to search unit dir - systemd_tmpfilses, needs to list any file systems mounted on /tmp - No one can explain why radius is listing the contents of /tmp, so we will dontaudit - If I can manage etc_runtime files, I should be able to read the links - Dontaudit hostname writing to mock library chr_files - Have gdm_t setup labeling correctly in users home dir - Label content unde /var/run/user/NAME/dconf as config_home_t - Allow sa-update to execute shell - Make ssh-keygen working with fips_enabled - Make mock work for staff_t user - Tighten security on mock_t- removing unconfined_notrans_t no longer necessary - Clean up handling of secure_mode_insmod and secure_mode_policyload - Remove unconfined_mount_t- Add exim_exec_t label for /usr/sbin/exim_tidydb - Call init_dontaudit_rw_stream_socket() interface in mta policy - sssd need to search /var/cache/krb5rcache directory - Allow corosync to relabel own tmp files - Allow zarafa domains to send system log messages - Allow ssh to do tunneling - Allow initrc scripts to sendto init_t unix_stream_socket - Changes to make sure dmsmasq and virt directories are labeled correctly - Changes needed to allow sysadm_t to manage systemd unit files - init is passing file descriptors to dbus and on to system daemons - Allow sulogin additional access Reported by dgrift and Jeremy Miller - Steve Grubb believes that wireshark does not need this access - Fix /var/run/initramfs to stop restorecon from looking at - pki needs another port - Add more labels for cluster scripts - Allow apps that manage cgroup_files to manage cgroup link files - Fix label on nfs-utils scripts directories - Allow gatherd to read /dev/rand and /dev/urand- pki needs another port - Add more labels for cluster scripts - Fix label on nfs-utils scripts directories - Fixes for cluster - Allow gatherd to read /dev/rand and /dev/urand - abrt leaks fifo files- Add glance policy - Allow mdadm setsched - /var/run/initramfs should not be relabeled with a restorecon run - memcache can be setup to override sys_resource - Allow httpd_t to read tetex data - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.- Allow Postfix to deliver to Dovecot LMTP socket - Ignore bogus sys_module for lldpad - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock - systemd_logind_t sets the attributes on usb devices - Allow hddtemp_t to read etc_t files - Add permissivedomains module - Move all permissive domains calls to permissivedomain.te - Allow pegasis to send kill signals to other UIDs- Allow insmod_t to use fds leaked from devicekit - dontaudit getattr between insmod_t and init_t unix_stream_sockets - Change sysctl unit file interfaces to use systemctl - Add support for chronyd unit file - Allow mozilla_plugin to read gnome_usr_config - Add policy for new gpsd - Allow cups to create kerberos rhost cache files - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly- Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten- Add policy for sa-update being run out of cron jobs - Add create perms to postgresql_manage_db - ntpd using a gps has to be able to read/write generic tty_device_t - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev - fix spec file - Remove qemu_domtrans_unconfined() interface - Make passenger working together with puppet - Add init_dontaudit_rw_stream_socket interface - Fixes for wordpress- Turn on allow_domain_fd_use boolean on F16 - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Add abrt_handle_event_t domain for ABRT event scripts - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change - Allow httpd_git_script_t to read passwd data - Allow openvpn to set its process priority when the nice parameter is used- livecd fixes - spec file fixes- fetchmail can use kerberos - ksmtuned reads in shell programs - gnome_systemctl_t reads the process state of ntp - dnsmasq_t asks the kernel to load multiple kernel modules - Add rules for domains executing systemctl - Bogus text within fc file- Add cfengine policy- Add abrt_domain attribute - Allow corosync to manage cluster lib files - Allow corosync to connect to the system DBUS- Add sblim, uuidd policies - Allow kernel_t dyntrasition to init_t- init_t need setexec - More fixes of rules which cause an explosion in rules by Dan Walsh- Allow rcsmcertd to perform DNS name resolution - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts - Allow tmux to run as screen - New policy for collectd - Allow gkeyring_t to interact with all user apps - Add rules to allow firstboot to run on machines with the unconfined.pp module removed- Allow systemd_logind to send dbus messages with users - allow accountsd to read wtmp file - Allow dhcpd to get and set capabilities- Fix oracledb_port definition - Allow mount to mounton the selinux file system - Allow users to list /var directories- systemd fixes- Add initial policy for abrt_dump_oops_t - xtables-multi wants to getattr of the proc fs - Smoltclient is connecting to abrt - Dontaudit leaked file descriptors to postdrop - Allow abrt_dump_oops to look at kernel sysctls - Abrt_dump_oops_t reads kernel ring buffer - Allow mysqld to request the kernel to load modules - systemd-login needs fowner - Allow postfix_cleanup_t to searh maildrop- Initial systemd_logind policy - Add policy for systemd_logger and additional proivs for systemd_logind - More fixes for systemd policies- Allow setsched for virsh - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories - iptables: the various /sbin/ip6?tables.* are now symlinks for /sbin/xtables-multi- A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit - Allow colord to interact with the users through the tmpfs file system - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files - Add label for /var/log/mcelog - Allow asterisk to read /dev/random if it uses TLS - Allow colord to read ini files which are labeled as bin_t - Allow dirsrvadmin sys_resource and setrlimit to use ulimit - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first. - Also lists /var and /var/spool directories - Add openl2tpd to l2tpd policy - qpidd is reading the sysfs file- Change usbmuxd_t to dontaudit attempts to read chr_file - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains - Allow pppd to search /var/lock dir - Add rhsmcertd policy- Update to upstream- More fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git- Fix spec file to not report Verify errors- Add dspam policy - Add lldpad policy - dovecot auth wants to search statfs #713555 - Allow systemd passwd apps to read init fifo_file - Allow prelink to use inherited terminals - Run cherokee in the httpd_t domain - Allow mcs constraints on node connections - Implement pyicqt policy - Fixes for zarafa policy - Allow cobblerd to send syslog messages- Add policy.26 to the payload - Remove olpc stuff - Remove policygentool- Fixes for zabbix - init script needs to be able to manage sanlock_var_run_... - Allow sandlock and wdmd to create /var/run directories... - mixclip.so has been compiled correctly - Fix passenger policy module name- Add mailscanner policy from dgrift - Allow chrome to optionally be transitioned to - Zabbix needs these rules when starting the zabbix_server_mysql - Implement a type for freedesktop openicc standard (~/.local/share/icc) - Allow system_dbusd_t to read inherited icc_data_home_t files. - Allow colord_t to read icc_data_home_t content. #706975 - Label stuff under /usr/lib/debug as if it was labeled under /- Fixes for sanlock policy - Fixes for colord policy - Other fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Add rhev policy module to modules-targeted.conf- Lot of fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Allow logrotate to execute systemctl - Allow nsplugin_t to getattr on gpmctl - Fix dev_getattr_all_chr_files() interface - Allow shorewall to use inherited terms - Allow userhelper to getattr all chr_file devices - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t - Fix labeling for ABRT Retrace Server- Dontaudit sys_module for ifconfig - Make telepathy and gkeyringd daemon working with confined users - colord wants to read files in users homedir - Remote login should be creating user_tmp_t not its own tmp files- Fix label for /usr/share/munin/plugins/munin_* plugins - Add support for zarafa-indexer - Fix boolean description - Allow colord to getattr on /proc/scsi/scsi - Add label for /lib/upstart/init - Colord needs to list /mnt- Forard port changes from F15 for telepathy - NetworkManager should be allowed to use /dev/rfkill - Fix dontaudit messages to say Domain to not audit - Allow telepathy domains to read/write gnome_cache files - Allow telepathy domains to call getpw - Fixes for colord and vnstatd policy- Allow init_t getcap and setcap - Allow namespace_init_t to use nsswitch - aisexec will execute corosync - colord tries to read files off noxattr file systems - Allow init_t getcap and setcap- Add support for ABRT retrace server - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners - Allow telepath_msn_t to read /proc/PARENT/cmdline - ftpd needs kill capability - Allow telepath_msn_t to connect to sip port - keyring daemon does not work on nfs homedirs - Allow $1_sudo_t to read default SELinux context - Add label for tgtd sock file in /var/run/ - Add apache_exec_rotatelogs interface - allow all zaraha domains to signal themselves, server writes to /tmp - Allow syslog to read the process state - Add label for /usr/lib/chromium-browser/chrome - Remove the telepathy transition from unconfined_t - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts - Allow initrc_t domain to manage abrt pid files - Add support for AEOLUS project - Virt_admin should be allowed to manage images and processes - Allow plymountd to send signals to init - Change labeling of fping6- Add filename transitions- Fixes for zarafa policy - Add support for AEOLUS project - Change labeling of fping6 - Allow plymountd to send signals to init - Allow initrc_t domain to manage abrt pid files - Virt_admin should be allowed to manage images and processes- xdm_t needs getsession for switch user - Every app that used to exec init is now execing systemdctl - Allow squid to manage krb5_host_rcache_t files - Allow foghorn to connect to agentx port - Fixes for colord policy- Add Dan's patch to remove 64 bit variants - Allow colord to use unix_dgram_socket - Allow apps that search pids to read /var/run if it is a lnk_file - iscsid_t creates its own directory - Allow init to list var_lock_t dir - apm needs to verify user accounts auth_use_nsswitch - Add labeling for systemd unit files - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added - Add label for matahari-broker.pid file - We want to remove untrustedmcsprocess from ability to read /proc/pid - Fixes for matahari policy - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on- Fix typo- Add /var/run/lock /var/lock definition to file_contexts.subs - nslcd_t is looking for kerberos cc files - SSH_USE_STRONG_RNG is 1 which requires /dev/random - Fix auth_rw_faillog definition - Allow sysadm_t to set attributes on fixed disks - allow user domains to execute lsof and look at application sockets - prelink_cron job calls telinit -u if init is rewritten - Fixes to run qemu_t from staff_t- Fix label for /var/run/udev to udev_var_run_t - Mock needs to be able to read network state- Add file_contexts.subs to handle /run and /run/lock - Add other fixes relating to /run changes from F15 policy- Allow $1_sudo_t and $1_su_t open access to user terminals - Allow initrc_t to use generic terminals - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs -systemd is going to be useing /run and /run/lock for early bootup files. - Fix some comments in rlogin.if - Add policy for KDE backlighthelper - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems - sssd wants to read .k5login file in users homedir - setroubleshoot reads executables to see if they have TEXTREL - Add /var/spool/audit support for new version of audit - Remove kerberos_connect_524() interface calling - Combine kerberos_master_port_t and kerberos_port_t - systemd has setup /dev/kmsg as stderr for apps it executes - Need these access so that init can impersonate sockets on unix_dgram_socket- Remove some unconfined domains - Remove permissive domains - Add policy-term.patch from Dan- Fix multiple specification for boot.log - devicekit leaks file descriptors to setfiles_t - Change all all_nodes to generic_node and all_if to generic_if - Should not use deprecated interface - Switch from using all_nodes to generic_node and from all_if to generic_if - Add support for xfce4-notifyd - Fix file context to show several labels as SystemHigh - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs - Add etc_runtime_t label for /etc/securetty - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly - login.krb needs to be able to write user_tmp_t - dirsrv needs to bind to port 7390 for dogtag - Fix a bug in gpg policy - gpg sends audit messages - Allow qpid to manage matahari files- Initial policy for matahari - Add dev_read_watchdog - Allow clamd to connect clamd port - Add support for kcmdatetimehelper - Allow shutdown to setrlimit and sys_nice - Allow systemd_passwd to talk to /dev/log before udev or syslog is running - Purge chr_file and blk files on /tmp - Fixes for pads - Fixes for piranha-pulse - gpg_t needs to be able to encyprt anything owned by the user- mozilla_plugin_tmp_t needs to be treated as user tmp files - More dontaudits of writes from readahead - Dontaudit readahead_t file_type:dir write, to cover up kernel bug - systemd_tmpfiles needs to relabel faillog directory as well as the file - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost- Add policykit fixes from Tim Waugh - dontaudit sandbox domains sandbox_file_t:dir mounton - Add new dontaudit rules for sysadm_dbusd_t - Change label for /var/run/faillock * other fixes which relate with this change- Update to upstream - Fixes for telepathy - Add port defition for ssdp port - add policy for /bin/systemd-notify from Dan - Mount command requires users read mount_var_run_t - colord needs to read konject_uevent_socket - User domains connect to the gkeyring socket - Add colord policy and allow user_t and staff_t to dbus chat with it - Add lvm_exec_t label for kpartx - Dontaudit reading the mail_spool_t link from sandbox -X - systemd is creating sockets in avahi_var_run and system_dbusd_var_run- gpg_t needs to talk to gnome-keyring - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd - enforce MCS labeling on nodes - Allow arpwatch to read meminfo - Allow gnomeclock to send itself signals - init relabels /dev/.udev files on boot - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t - dnsmasq can run as a dbus service, needs acquire service - mysql_admin should be allowed to connect to mysql service - virt creates monitor sockets in the users home dir- Allow usbhid-ups to read hardware state information - systemd-tmpfiles has moved - Allo cgroup to sys_tty_config - For some reason prelink is attempting to read gconf settings - Add allow_daemons_use_tcp_wrapper boolean - Add label for ~/.cache/wocky to make telepathy work in enforcing mode - Add label for char devices /dev/dasd* - Fix for apache_role - Allow amavis to talk to nslcd - allow all sandbox to read selinux poilcy config files - Allow cluster domains to use the system bus and send each other dbus messages- Update to upstream- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild- Update to ref policy - cgred needs chown capability - Add /dev/crash crash_dev_t - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability- New labeling for postfmulti #675654 - dontaudit xdm_t listing noxattr file systems - dovecot-auth needs to be able to connect to mysqld via the network as well as locally - shutdown is passed stdout to a xdm_log_t file - smartd creates a fixed disk device - dovecot_etc_t contains a lnk_file that domains need to read - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot- syslog_t needs syslog capability - dirsrv needs to be able to create /var/lib/snmp - Fix labeling for dirsrv - Fix for dirsrv policy missing manage_dirs_pattern - corosync needs to delete clvm_tmpfs_t files - qdiskd needs to list hugetlbfs - Move setsched to sandbox_x_domain, so firefox can run without network access - Allow hddtemp to read removable devices - Adding syslog and read_policy permissions to policy * syslog Allow unconfined, sysadm_t, secadm_t, logadm_t * read_policy allow unconfined, sysadm_t, secadm_t, staff_t on Targeted allow sysadm_t (optionally), secadm_t on MLS - mdadm application will write into /sys/.../uevent whenever arrays are assembled or disassembled.- Add tcsd policy- ricci_modclusterd_t needs to bind to rpc ports 500-1023 - Allow dbus to use setrlimit to increase resoueces - Mozilla_plugin is leaking to sandbox - Allow confined users to connect to lircd over unix domain stream socket which allow to use remote control - Allow awstats to read squid logs - seunshare needs to manage tmp_t - apcupsd cgi scripts have a new directory- Fix xserver_dontaudit_read_xdm_pid - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. * These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t - Allow readahead to manage readahead pid dirs - Allow readahead to read all mcs levels - Allow mozilla_plugin_t to use nfs or samba homedirs- Allow nagios plugin to read /proc/meminfo - Fix for mozilla_plugin - Allow samba_net_t to create /etc/keytab - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t - nslcd can read user credentials - Allow nsplugin to delete mozilla_plugin_tmpfs_t - abrt tries to create dir in rpm_var_lib_t - virt relabels fifo_files - sshd needs to manage content in fusefs homedir - mock manages link files in cache dir- nslcd needs setsched and to read /usr/tmp - Invalid call in likewise policy ends up creating a bogus role - Cannon puts content into /var/lib/bjlib that cups needs to be able to write - Allow screen to create screen_home_t in /root - dirsrv sends syslog messages - pinentry reads stuff in .kde directory - Add labels for .kde directory in homedir - Treat irpinit, iprupdate, iprdump services with raid policy- NetworkManager wants to read consolekit_var_run_t - Allow readahead to create /dev/.systemd/readahead - Remove permissive domains - Allow newrole to run namespace_init- Add sepgsql_contexts file- Update to upstream- Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on - Add puppetmaster_use_db boolean - Fixes for zarafa policy - Fixes for gnomeclock poliy - Fix systemd-tmpfiles to use auth_use_nsswitch- gnomeclock executes a shell - Update for screen policy to handle pipe in homedir - Fixes for polyinstatiated homedir - Fixes for namespace policy and other fixes related to polyinstantiation - Add namespace policy - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts - Fixes for init, psad policy which relate with confined users - Do not audit bootloader attempts to read devicekit pid files - Allow nagios service plugins to read /proc- Add firewalld policy - Allow vmware_host to read samba config - Kernel wants to read /proc Fix duplicate grub def in cobbler - Chrony sends mail, executes shell, uses fifo_file and reads /proc - devicekitdisk getattr all file systems - sambd daemon writes wtmp file - libvirt transitions to dmidecode- Add initial policy for system-setup-keyboard which is now daemon - Label /var/lock/subsys/shorewall as shorewall_lock_t - Allow users to communicate with the gpg_agent_t - Dontaudit mozilla_plugin_t using the inherited terminal - Allow sambagui to read files in /usr - webalizer manages squid log files - Allow unconfined domains to bind ports to raw_ip_sockets - Allow abrt to manage rpm logs when running yum - Need labels for /var/run/bittlebee - Label .ssh under amanda - Remove unused genrequires for virt_domain_template - Allow virt_domain to use fd inherited from virtd_t - Allow iptables to read shorewall config- Gnome apps list config_home_t - mpd creates lnk files in homedir - apache leaks write to mail apps on tmp files - /var/stockmaniac/templates_cache contains log files - Abrt list the connects of mount_tmp_t dirs - passwd agent reads files under /dev and reads utmp file - squid apache script connects to the squid port - fix name of plymouth log file - teamviewer is a wine app - allow dmesg to read system state - Stop labeling files under /var/lib/mock so restorecon will not go into this - nsplugin needs to read network state for google talk- Allow xdm and syslog to use /var/log/boot.log - Allow users to communicate with mozilla_plugin and kill it - Add labeling for ipv6 and dhcp- New labels for ghc http content - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy- Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot- Update selinux policy to handle new /usr/share/sandbox/start script- Update to upstream - Fix version of policy in spec file- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs - remove per sandbox domains devpts types - Allow dkim-milter sending signal to itself- Allow domains that transition to ping or traceroute, kill them - Allow user_t to conditionally transition to ping_t and traceroute_t - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup- Turn on systemd policy - mozilla_plugin needs to read certs in the homedir. - Dontaudit leaked file descriptors from devicekit - Fix ircssi to use auth_use_nsswitch - Change to use interface without param in corenet to disable unlabelednet packets - Allow init to relabel sockets and fifo files in /dev - certmonger needs dac* capabilities to manage cert files not owned by root - dovecot needs fsetid to change group membership on mail - plymouthd removes /var/log/boot.log - systemd is creating symlinks in /dev - Change label on /etc/httpd/alias to be all cert_t- Fixes for clamscan and boinc policy - Add boinc_project_t setpgid - Allow alsa to create tmp files in /tmp- Push fixes to allow disabling of unlabeled_t packet access - Enable unlabelednet policy- Fixes for lvm to work with systemd- Fix the label for wicd log - plymouthd creates force-display-on-active-vt file - Allow avahi to request the kernel to load a module - Dontaudit hal leaks - Fix gnome_manage_data interface - Add new interface corenet_packet to define a type as being an packet_type. - Removed general access to packet_type from icecast and squid. - Allow mpd to read alsa config - Fix the label for wicd log - Add systemd policy- Fix gnome_manage_data interface - Dontaudit sys_ptrace capability for iscsid - Fixes for nagios plugin policy- Fix cron to run ranged when started by init - Fix devicekit to use log files - Dontaudit use of devicekit_var_run_t for fstools - Allow init to setattr on logfile directories - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t- Fix up handling of dnsmasq_t creating /var/run/libvirt/network - Turn on sshd_forward_ports boolean by default - Allow sysadmin to dbus chat with rpm - Add interface for rw_tpm_dev - Allow cron to execute bin - fsadm needs to write sysfs - Dontaudit consoletype reading /var/run/pm-utils - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin - certmonger needs to manage dirsrv data - /var/run/pm-utils should be labeled as devicekit_var_run_t- fixes to allow /var/run and /var/lock as tmpfs - Allow chrome sandbox to connect to web ports - Allow dovecot to listem on lmtp and sieve ports - Allov ddclient to search sysctl_net_t - Transition back to original domain if you execute the shell- Remove duplicate declaration- Update to upstream - Cleanup for sandbox - Add attribute to be able to select sandbox types- Allow ddclient to fix file mode bits of ddclient conf file - init leaks file descriptors to daemons - Add labels for /etc/lirc/ and - Allow amavis_t to exec shell - Add label for gssd_tmp_t for /var/tmp/nfs_0- Put back in lircd_etc_t so policy will install- Turn on allow_postfix_local_write_mail_spool - Allow initrc_t to transition to shutdown_t - Allow logwatch and cron to mls_read_to_clearance for MLS boxes - Allow wm to send signull to all applications and receive them from users - lircd patch from field - Login programs have to read /etc/samba - New programs under /lib/systemd - Abrt needs to read config files- Update to upstream - Dontaudit leaked sockets from userdomains to user domains - Fixes for mcelog to handle scripts - Apply patch from Ruben Kerkhof - Allow syslog to search spool dirs- Allow nagios plugins to read usr files - Allow mysqld-safe to send system log messages - Fixes fpr ddclient policy - Fix sasl_admin interface - Allow apache to search zarafa config - Allow munin plugins to search /var/lib directory - Allow gpsd to read sysfs_t - Fix labels on /etc/mcelog/triggers to bin_t- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp - Fix xserver interface - Fix definition of /var/run/lxdm- Turn on mediawiki policy - kdump leaks kdump_etc_t to ifconfig, add dontaudit - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap- Allow groupd transition to fenced domain when executes fence_node - Fixes for rchs policy - Allow mpd to be able to read samba/nfs files- Fix up corecommands.fc to match upstream - Make sure /lib/systemd/* is labeled init_exec_t - mount wants to setattr on all mountpoints - dovecot auth wants to read dovecot etc files - nscd daemon looks at the exe file of the comunicating daemon - openvpn wants to read utmp file - postfix apps now set sys_nice and lower limits - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly - Also resolves nsswitch - Fix labels on /etc/hosts.* - Cleanup to make upsteam patch work - allow abrt to read etc_runtime_t- Add conflicts for dirsrv package- Update to upstream - Add vlock policy- Fix sandbox to work on nfs homedirs - Allow cdrecord to setrlimit - Allow mozilla_plugin to read xauth - Change label on systemd-logger to syslogd_exec_t - Install dirsrv policy from dirsrv package- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it - Udev needs to stream connect to init and kernel - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory- Allow NetworkManager to read openvpn_etc_t - Dontaudit hplip to write of /usr dirs - Allow system_mail_t to create /root/dead.letter as mail_home_t - Add vdagent policy for spice agent daemon- Dontaudit sandbox sending sigkill to all user domains - Add policy for rssh_chroot_helper - Add missing flask definitions - Allow udev to relabelto removable_t - Fix label on /var/log/wicd.log - Transition to initrc_t from init when executing bin_t - Add audit_access permissions to file - Make removable_t a device_node - Fix label on /lib/systemd/*- Fixes for systemd to manage /var/run - Dontaudit leaks by firstboot- Allow chome to create netlink_route_socket - Add additional MATHLAB file context - Define nsplugin as an application_domain - Dontaudit sending signals from sandboxed domains to other domains - systemd requires init to build /tmp /var/auth and /var/lock dirs - mount wants to read devicekit_power /proc/ entries - mpd wants to connect to soundd port - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit - Treat lib_t and textrel_shlib_t directories the same - Allow mount read access on virtual images- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs. - Allow devicekit_power to domtrans to mount - Allow dhcp to bind to udp ports > 1024 to do named stuff - Allow ssh_t to exec ssh_exec_t - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used - Fix clamav_append_log() intefaces - Fix 'psad_rw_fifo_file' interface- Allow cobblerd to list cobler appache content- Fixup for the latest version of upowed - Dontaudit sandbox sending SIGNULL to desktop apps- Update to upstream-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access - dovecot-auth_t needs ipc_lock - gpm needs to use the user terminal - Allow system_mail_t to append ~/dead.letter - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf - Add pid file to vnstatd - Allow mount to communicate with gfs_controld - Dontaudit hal leaks in setfiles- Lots of fixes for systemd - systemd now executes readahead and tmpwatch type scripts - Needs to manage random seed- Allow smbd to use sys_admin - Remove duplicate file context for tcfmgr - Update to upstream- Fix fusefs handling - Do not allow sandbox to manage nsplugin_rw_t - Allow mozilla_plugin_t to connecto its parent - Allow init_t to connect to plymouthd running as kernel_t - Add mediawiki policy - dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. - Disable transition from dbus_session_domain to telepathy for F14 - Allow boinc_project to use shm - Allow certmonger to search through directories that contain certs - Allow fail2ban the DAC Override so it can read log files owned by non root users- Start adding support for use_fusefs_home_dirs - Add /var/lib/syslog directory file context - Add /etc/localtime as locale file context- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user - Turn off iptables from unconfined user - Allow sudo to send signals to any domains the user could have transitioned to. - Passwd in single user mode needs to talk to console_device_t - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio - locate tried to read a symbolic link, will dontaudit - New labels for telepathy-sunshine content in homedir - Google is storing other binaries under /opt/google/talkplugin - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15 - modemmanger and bluetooth send dbus messages to devicekit_power - Samba needs to getquota on filesystems labeld samba_share_t- Dontaudit attempts by xdm_t to write to bin_t for kdm - Allow initrc_t to manage system_conf_t- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets - Allow confined users to read xdm_etc_t files - Allow xdm_t to transition to xauth_t for lxdm program- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home - Allow clamd to send signals to itself - Allow mozilla_plugin_t to read user home content. And unlink pulseaudio shm. - Allow haze to connect to yahoo chat and messenger port tcp:5050. Bz #637339 - Allow guest to run ps command on its processes by allowing it to read /proc - Allow firewallgui to sys_rawio which seems to be required to setup masqerading - Allow all domains to search through default_t directories, in order to find differnet labels. For example people serring up /foo/bar to be share via samba. - Add label for /var/log/slim.log- Pull in cleanups from dgrift - Allow mozilla_plugin_t to execute mozilla_home_t - Allow rpc.quota to do quotamod- Cleanup policy via dgrift - Allow dovecot_deliver to append to inherited log files - Lots of fixes for consolehelper- Fix up Xguest policy- Add vnstat policy - allow libvirt to send audit messages - Allow chrome-sandbox to search nfs_t- Update to upstream- Add the ability to send audit messages to confined admin policies - Remove permissive domain from cmirrord and dontaudit sys_tty_config - Split out unconfined_domain() calls from other unconfined_ calls so we can d - virt needs to be able to read processes to clearance for MLS- Allow all domains that can use cgroups to search tmpfs_t directory - Allow init to send audit messages- Update to upstream- Allow mdadm_t to create files and sock files in /dev/md/- Add policy for ajaxterm- Handle /var/db/sudo - Allow pulseaudio to read alsa config - Allow init to send initrc_t dbus messagesAllow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr intd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port- Merge upstream fix of mmap_zero - Allow mount to write files in debugfs_t - Allow corosync to communicate with clvmd via tmpfs - Allow certmaster to read usr_t files - Allow dbus system services to search cgroup_t - Define rlogind_t as a login pgm- Allow mdadm_t to read/write hugetlbfs- Dominic Grift Cleanup - Miroslav Grepl policy for jabberd - Various fixes for mount/livecd and prelink- Merge with upstream- More access needed for devicekit - Add dbadm policy- Merge with upstream- Allow seunshare to fowner- Allow cron to look at user_cron_spool links - Lots of fixes for mozilla_plugin_t - Add sysv file system - Turn unconfined domains to permissive to find additional avcs- Update policy for mozilla_plugin_t- Allow clamscan to read proc_t - Allow mount_t to write to debufs_t dir - Dontaudit mount_t trying to write to security_t dir- Allow clamscan_t execmem if clamd_use_jit set - Add policy for firefox plugin-container- Fix /root/.forward definition- label dead.letter as mail_home_t- Allow login programs to search /cgroups- Fix cert handling- Fix devicekit_power bug - Allow policykit_auth_t more access.- Fix nis calls to allow bind to ports 512-1024 - Fix smartmon- Allow pcscd to read sysfs - systemd fixes - Fix wine_mmap_zero_ignore boolean- Apply Miroslav munin patch - Turn back on allow_execmem and allow_execmod booleans- Merge in fixes from dgrift repository- Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0- New paths for upstart- New permissions for syslog - New labels for /lib/upstart- Add mojomojo policy- Allow systemd to setsockcon on sockets to immitate other services- Remove debugfs label- Update to latest policy- Fix eclipse labeling from IBMSupportAssasstant packageing- Make boot with systemd in enforcing mode- Update to upstream- Add boolean to turn off port forwarding in sshd.- Add support for ebtables - Fixes for rhcs and corosync policy-Update to upstream-Update to upstream-Update to upstream- Add Zarafa policy- Cleanup of aiccu policy - initial mock policy- Lots of random fixes- Update to upstream- Update to upstream - Allow prelink script to signal itself - Cobbler fixes- Add xdm_var_run_t to xserver_stream_connect_xdm - Add cmorrord and mpd policy from Miroslav Grepl- Fix sshd creation of krb cc files for users to be user_tmp_t- Fixes for accountsdialog - Fixes for boinc- Fix label on /var/lib/dokwiki - Change permissive domains to enforcing - Fix libvirt policy to allow it to run on mls- Update to upstream- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t - Fix /var/run/abrtd.lock label- Allow login programs to read krb5_home_t Resolves: 594833 - Add obsoletes for cachefilesfd-selinux package Resolves: #575084- Allow mount to r/w abrt fifo file - Allow svirt_t to getattr on hugetlbfs - Allow abrt to create a directory under /var/spool- Add labels for /sys - Allow sshd to getattr on shutdown - Fixes for munin - Allow sssd to use the kernel key ring - Allow tor to send syslog messages - Allow iptabels to read usr files - allow policykit to read all domains state- Fix path for /var/spool/abrt - Allow nfs_t as an entrypoint for http_sys_script_t - Add policy for piranha - Lots of fixes for sosreport- Allow xm_t to read network state and get and set capabilities - Allow policykit to getattr all processes - Allow denyhosts to connect to tcp port 9911 - Allow pyranha to use raw ip sockets and ptrace itself - Allow unconfined_execmem_t and gconfsd mechanism to dbus - Allow staff to kill ping process - Add additional MLS rules- Allow gdm to edit ~/.gconf dir Resolves: #590677 - Allow dovecot to create directories in /var/lib/dovecot Partially resolves 590224 - Allow avahi to dbus chat with NetworkManager - Fix cobbler labels - Dontaudit iceauth_t leaks - fix /var/lib/lxdm file context - Allow aiccu to use tun tap devices - Dontaudit shutdown using xserver.log- Fixes for sandbox_x_net_t to match access for sandbox_web_t ++ - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory - Add dontaudit interface for bluetooth dbus - Add chronyd_read_keys, append_keys for initrc_t - Add log support for ksmtuned Resolves: #586663- Allow boinc to send mail- Allow initrc_t to remove dhcpc_state_t - Fix label on sa-update.cron - Allow dhcpc to restart chrony initrc - Don't allow sandbox to send signals to its parent processes - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t Resolves: #589136- Fix location of oddjob_mkhomedir Resolves: #587385 - fix labeling on /root/.shosts and ~/.shosts - Allow ipsec_mgmt_t to manage net_conf_t Resolves: #586760- Dontaudit sandbox trying to connect to netlink sockets Resolves: #587609 - Add policy for piranha- Fixups for xguest policy - Fixes for running sandbox firefox- Allow ksmtuned to use terminals Resolves: #586663 - Allow lircd to write to generic usb devices- Allow sandbox_xserver to connectto unconfined stream Resolves: #585171- Allow initrc_t to read slapd_db_t Resolves: #585476 - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf Resolves: #585963- Allow rlogind_t to search /root for .rhosts Resolves: #582760 - Fix path for cached_var_t - Fix prelink paths /var/lib/prelink - Allow confined users to direct_dri - Allow mls lvm/cryptosetup to work- Allow virtd_t to manage firewall/iptables config Resolves: #573585- Fix label on /root/.rhosts Resolves: #582760 - Add labels for Picasa - Allow openvpn to read home certs - Allow plymouthd_t to use tty_device_t - Run ncftool as iptables_t - Allow mount to unmount unlabeled_t - Dontaudit hal leaks- Allow livecd to transition to mount- Update to upstream - Allow abrt to delete sosreport Resolves: #579998 - Allow snmp to setuid and gid Resolves: #582155 - Allow smartd to use generic scsi devices Resolves: #582145- Allow ipsec_t to create /etc/resolv.conf with the correct label - Fix reserved port destination - Allow autofs to transition to showmount - Stop crashing tuned- Add telepathysofiasip policy- Update to upstream - Fix label for /opt/google/chrome/chrome-sandbox - Allow modemmanager to dbus with policykit- Fix allow_httpd_mod_auth_pam to use auth_use_pam(httpd_t) - Allow accountsd to read shadow file - Allow apache to send audit messages when using pam - Allow asterisk to bind and connect to sip tcp ports - Fixes for dovecot 2.0 - Allow initrc_t to setattr on milter directories - Add procmail_home_t for .procmailrc file- Fixes for labels during install from livecd- Fix /cgroup file context - Fix broken afs use of unlabled_t - Allow getty to use the console for s390- Fix cgroup handling adding policy for /cgroup - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set- Merge patches from dgrift- Update upstream - Allow abrt to write to the /proc under any process- Fix ~/.fontconfig label - Add /root/.cert label - Allow reading of the fixed_file_disk_t:lnk_file if you can read file - Allow qemu_exec_t as an entrypoint to svirt_t- Update to upstream - Allow tmpreaper to delete sandbox sock files - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems - Fixes for gitosis - No transition on livecd to passwd or chfn - Fixes for denyhosts- Add label for /var/lib/upower - Allow logrotate to run sssd - dontaudit readahead on tmpfs blk files - Allow tmpreaper to setattr on sandbox files - Allow confined users to execute dos files - Allow sysadm_t to kill processes running within its clearance - Add accountsd policy - Fixes for corosync policy - Fixes from crontab policy - Allow svirt to manage svirt_image_t chr files - Fixes for qdisk policy - Fixes for sssd policy - Fixes for newrole policy- make libvirt work on an MLS platform- Add qpidd policy- Update to upstream- Allow boinc to read kernel sysctl - Fix snmp port definitions - Allow apache to read anon_inodefs- Allow shutdown dac_override- Add device_t as a file system - Fix sysfs association- Dontaudit ipsec_mgmt sys_ptrace - Allow at to mail its spool files - Allow nsplugin to search in .pulse directory- Update to upstream- Allow users to dbus chat with xdm - Allow users to r/w wireless_device_t - Dontaudit reading of process states by ipsec_mgmt- Fix openoffice from unconfined_t- Add shutdown policy so consolekit can shutdown system- Update to upstream- Update to upstream- Update to upstream - These are merges of my patches - Remove 389 labeling conflicts - Add MLS fixes found in RHEL6 testing - Allow pulseaudio to run as a service - Add label for mssql and allow apache to connect to this database port if boolean set - Dontaudit searches of debugfs mount point - Allow policykit_auth to send signals to itself - Allow modcluster to call getpwnam - Allow swat to signal winbind - Allow usbmux to run as a system role - Allow svirt to create and use devpts- Add MLS fixes found in RHEL6 testing - Allow domains to append to rpm_tmp_t - Add cachefilesfd policy - Dontaudit leaks when transitioning- Change allow_execstack and allow_execmem booleans to on - dontaudit acct using console - Add label for fping - Allow tmpreaper to delete sandbox_file_t - Fix wine dontaudit mmap_zero - Allow abrt to read var_t symlinks- Additional policy for rgmanager- Allow sshd to setattr on pseudo terms- Update to upstream- Allow policykit to send itself signals- Fix duplicate cobbler definition- Fix file context of /var/lib/avahi-autoipd- Merge with upstream- Allow sandbox to work with MLS- Make Chrome work with staff user- Add icecast policy - Cleanup spec file- Add mcelog policy- Lots of fixes found in F12- Fix rpm_dontaudit_leaks- Add getsched to hald_t - Add file context for Fedora/Redhat Directory Server- Allow abrt_helper to getattr on all filesystems - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so- Add gstreamer_home_t for ~/.gstreamer- Update to upstream- Fix git- Turn on puppet policy - Update to dgrift git policy- Move users file to selection by spec file. - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t- Update to upstream- Remove most of the permissive domains from F12.- Add cobbler policy from dgrift- add usbmon device - Add allow rulse for devicekit_disk- Lots of fixes found in F12, fixes from Tom London- Cleanups from dgrift- Add back xserver_manage_home_fonts- Dontaudit sandbox trying to read nscd and sssd- Update to upstream- Rename udisks-daemon back to devicekit_disk_t policy- Fixes for abrt calls- Add tgtd policy- Update to upstream release- Add asterisk policy back in - Update to upstream release 2.20091117- Update to upstream release 2.20091117- Fixup nut policy- Update to upstream- Allow vpnc request the kernel to load modules- Fix minimum policy installs - Allow udev and rpcbind to request the kernel to load modules- Add plymouth policy - Allow local_login to sys_admin- Allow cupsd_config to read user tmp - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t- Update rhcs policy- Allow users to exec restorecond- Allow sendmail to request kernel modules load- Fix all kernel_request_load_module domains- Fix all kernel_request_load_module domains- Remove allow_exec* booleans for confined users. Only available for unconfined_t- More fixes for sandbox_web_t- Allow sshd to create .ssh directory and content- Fix request_module line to module_request- Fix sandbox policy to allow it to run under firefox. - Dont audit leaks.- Fixes for sandbox- Update to upstream - Dontaudit nsplugin search /root - Dontaudit nsplugin sys_nice- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service - Remove policycoreutils-python requirement except for minimum- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)- Add wordpress/wp-content/uploads label - Fixes for sandbox when run from staff_t- Update to upstream - Fixes for devicekit_disk- More fixes- Lots of fixes for initrc and other unconfined domains- Allow xserver to use netlink_kobject_uevent_socket- Fixes for sandbox- Dontaudit setroubleshootfix looking at /root directory- Update to upsteam- Allow gssd to send signals to users - Fix duplicate label for apache content- Update to upstream- Remove polkit_auth on upgrades- Add back in unconfined.pp and unconfineduser.pp - Add Sandbox unshare- Fixes for cdrecord, mdadm, and others- Add capability setting to dhcpc and gpm- Allow cronjobs to read exim_spool_t- Add ABRT policy- Fix system-config-services policy- Allow libvirt to change user componant of virt_domain- Allow cupsd_config_t to be started by dbus - Add smoltclient policy- Add policycoreutils-python to pre install- Make all unconfined_domains permissive so we can see what AVC's happen- Add pt_chown policy- Add kdump policy for Miroslav Grepl - Turn off execstack boolean- Turn on execstack on a temporary basis (#512845)- Allow nsplugin to connecto the session bus - Allow samba_net to write to coolkey data- Allow devicekit_disk to list inotify- Allow svirt images to create sock_file in svirt_var_run_t- Allow exim to getattr on mountpoints - Fixes for pulseaudio- Allow svirt_t to stream_connect to virtd_t- Allod hald_dccm_t to create sock_files in /tmp- More fixes from upstream- Fix polkit label - Remove hidebrokensymptoms for nss_ldap fix - Add modemmanager policy - Lots of merges from upstream - Begin removing textrel_shlib_t labels, from fixed libraries- Update to upstream- Allow certmaster to override dac permissions- Update to upstream- Fix context for VirtualBox- Update to upstream- Allow clamscan read amavis spool files- Fixes for xguest- fix multiple directory ownership of mandirs- Update to upstream- Add rules for rtkit-daemon- Update to upstream - Fix nlscd_stream_connect- Add rtkit policy- Allow rpcd_t to stream connect to rpcbind- Allow kpropd to create tmp files- Fix last duplicate /var/log/rpmpkgs- Update to upstream * add sssd- Update to upstream * cleanup- Update to upstream - Additional mail ports - Add virt_use_usb boolean for svirt- Fix mcs rules to include chr_file and blk_file- Add label for udev-acl- Additional rules for consolekit/udev, privoxy and various other fixes- New version for upstream- Allow NetworkManager to read inotifyfs- Allow setroubleshoot to run mlocate- Update to upstream- Add fish as a shell - Allow fprintd to list usbfs_t - Allow consolekit to search mountpoints - Add proper labeling for shorewall- New log file for vmware - Allow xdm to setattr on user_tmp_t- Upgrade to upstream- Allow fprintd to access sys_ptrace - Add sandbox policy- Add varnishd policy- Fixes for kpropd- Allow brctl to r/w tun_tap_device_t- Add /usr/share/selinux/packages- Allow rpcd_t to send signals to kernel threads- Fix upgrade for F10 to F11- Add policy for /var/lib/fprint-Remove duplicate line- Allow svirt to manage pci and other sysfs device data- Fix package selection handling- Fix /sbin/ip6tables-save context - Allod udev to transition to mount - Fix loading of mls policy file- Add shorewall policy- Additional rules for fprintd and sssd- Allow nsplugin to unix_read unix_write sem for unconfined_java- Fix uml files to be owned by users- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less- Allow confined users to manage virt_content_t, since this is home dir content - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection- Fix labeling on /var/lib/misc/prelink* - Allow xserver to rw_shm_perms with all x_clients - Allow prelink to execute files in the users home directory- Allow initrc_t to delete dev_null - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead- Update to latest milter code from Paul Howarth- Additional perms for readahead- Allow pulseaudio to acquire_svc on session bus - Fix readahead labeling- Allow sysadm_t to run rpm directly - libvirt needs fowner- Allow sshd to read var_lib symlinks for freenx- Allow nsplugin unix_read and write on users shm and sem - Allow sysadm_t to execute su- Dontaudit attempts to getattr user_tmpfs_t by lvm - Allow nfs to share removable media- Add ability to run postdrop from confined users- Fixes for podsleuth- Turn off nsplugin transition - Remove Konsole leaked file descriptors for release- Allow cupsd_t to create link files in print_spool_t - Fix iscsi_stream_connect typo - Fix labeling on /etc/acpi/actions - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed- Allow audioentroy to read etc files- Add fail2ban_var_lib_t - Fixes for devicekit_power_t- Separate out the ucnonfined user from the unconfined.pp package- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.- Upgrade to latest upstream - Allow devicekit_disk sys_rawio- Dontaudit binds to ports < 1024 for named - Upgrade to latest upstream- Allow podsleuth to use tmpfs files- Add customizable_types for svirt- Allow setroubelshoot exec* privs to prevent crash from bad libraries - add cpufreqselector- Dontaudit listing of /root directory for cron system jobs- Fix missing ld.so.cache label- Add label for ~/.forward and /root/.forward- Fixes for svirt- Fixes to allow svirt read iso files in homedir- Add xenner and wine fixes from mgrepl- Allow mdadm to read/write mls override- Change to svirt to only access svirt_image_t- Fix libvirt policy- Upgrade to latest upstream- Fixes for iscsid and sssd - More cleanups for upgrade from F10 to Rawhide.- Add pulseaudio, sssd policy - Allow networkmanager to exec udevadm- Add pulseaudio context- Upgrade to latest patches- Fixes for libvirt- Update to Latest upstream- Fix setrans.conf to show SystemLow for s0- Further confinement of qemu images via svirt- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild- Allow NetworkManager to manage /etc/NetworkManager/system-connections- add virtual_image_context and virtual_domain_context files- Allow rpcd_t to send signal to mount_t - Allow libvirtd to run ranged- Fix sysnet/net_conf_t- Fix squidGuard labeling- Re-add corenet_in_generic_if(unlabeled_t)* Tue Feb 10 2009 Dan Walsh 3.6.5-2 - Add git web policy- Add setrans contains from upstream- Do transitions outside of the booleans- Allow xdm to create user_tmp_t sockets for switch user to work- Fix staff_t domain- Grab remainder of network_peer_controls patch- More fixes for devicekit- Upgrade to latest upstream- Add boolean to disallow unconfined_t login- Add back transition from xguest to mozilla- Add virt_content_ro_t and labeling for isos directory- Fixes for wicd daemon- More mls/rpm fixes- Add policy to make dbus/nm-applet work- Remove polgen-ifgen from post and add trigger to policycoreutils-python- Add wm policy - Make mls work in graphics mode- Fixed for DeviceKit- Add devicekit policy- Update to upstream- Define openoffice as an x_domain- Fixes for reading xserver_tmp_t- Allow cups_pdf_t write to nfs_t- Remove audio_entropy policy- Update to upstream- Allow hal_acl_t to getattr/setattr fixed_disk- Change userdom_read_all_users_state to include reading symbolic links in /proc- Fix dbus reading /proc information- Add missing alias for home directory content- Fixes for IBM java location- Allow unconfined_r unconfined_java_t- Add cron_role back to user domains- Fix sudo setting of user keys- Allow iptables to talk to terminals - Fixes for policy kit - lots of fixes for booting.- Cleanup policy- Rebuild for Python 2.6- Fix labeling on /var/spool/rsyslog- Allow postgresl to bind to udp nodes- Allow lvm to dbus chat with hal - Allow rlogind to read nfs_t- Fix cyphesis file context- Allow hal/pm-utils to look at /var/run/video.rom - Add ulogd policy- Additional fixes for cyphesis - Fix certmaster file context - Add policy for system-config-samba - Allow hal to read /var/run/video.rom- Allow dhcpc to restart ypbind - Fixup labeling in /var/run- Add certmaster policy- Fix confined users - Allow xguest to read/write xguest_dbusd_t- Allow openoffice execstack/execmem privs- Allow mozilla to run with unconfined_execmem_t- Dontaudit domains trying to write to .xsession-errors- Allow nsplugin to look at autofs_t directory- Allow kerneloops to create tmp files- More alias for fastcgi- Remove mod_fcgid-selinux package- Fix dovecot access- Policy cleanup- Remove Multiple spec - Add include - Fix makefile to not call per_role_expansion- Fix labeling of libGL- Update to upstream- Update to upstream policy- Fixes for confined xwindows and xdm_t- Allow confined users and xdm to exec wm - Allow nsplugin to talk to fifo files on nfs- Allow NetworkManager to transition to avahi and iptables - Allow domains to search other domains keys, coverup kernel bug- Fix labeling for oracle- Allow nsplugin to comminicate with xdm_tmp_t sock_file- Change all user tmpfs_t files to be labeled user_tmpfs_t - Allow radiusd to create sock_files- Upgrade to upstream- Allow confined users to login with dbus- Fix transition to nsplugin- Add file context for /dev/mspblk.*- Fix transition to nsplugin '- Fix labeling on new pm*log - Allow ssh to bind to all nodes- Merge upstream changes - Add Xavier Toth patches- Add qemu_cache_t for /var/cache/libvirt- Remove gamin policy- Add tinyxs-max file system support- Update to upstream - New handling of init scripts- Allow pcsd to dbus - Add memcache policy- Allow audit dispatcher to kill his children- Update to upstream - Fix crontab use by unconfined user- Allow ifconfig_t to read dhcpc_state_t- Update to upstream- Update to upstream- Allow system-config-selinux to work with policykit- Fix novel labeling- Consolodate pyzor,spamassassin, razor into one security domain - Fix xdm requiring additional perms.- Fixes for logrotate, alsa- Eliminate vbetool duplicate entry- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t - Change dhclient to be able to red networkmanager_var_run- Update to latest refpolicy - Fix libsemanage initial install bug- Add inotify support to nscd- Allow unconfined_t to setfcap- Allow amanda to read tape - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi - Add support for netware file systems- Allow ypbind apps to net_bind_service- Allow all system domains and application domains to append to any log file- Allow gdm to read rpm database - Allow nsplugin to read mplayer config files- Allow vpnc to run ifconfig- Allow confined users to use postgres - Allow system_mail_t to exec other mail clients - Label mogrel_rails as an apache server- Apply unconfined_execmem_exec_t to haskell programs- Fix prelude file context- allow hplip to talk dbus - Fix context on ~/.local dir- Prevent applications from reading x_device- Add /var/lib/selinux context- Update to upstream- Add livecd policy- Dontaudit search of admin_home for init_system_domain - Rewrite of xace interfaces - Lots of new fs_list_inotify - Allow livecd to transition to setfiles_mac- Begin XAce integration- Merge Upstream- Allow amanada to create data files- Fix initial install, semanage setup- Allow system_r for httpd_unconfined_script_t- Remove dmesg boolean - Allow user domains to read/write game data- Change unconfined_t to transition to unconfined_mono_t when running mono - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work- Remove old booleans from targeted-booleans.conf file- Add boolean to mmap_zero - allow tor setgid - Allow gnomeclock to set clock- Don't run crontab from unconfined_t- Change etc files to config files to allow users to read them- Lots of fixes for confined domains on NFS_t homedir- dontaudit mrtg reading /proc - Allow iscsi to signal itself - Allow gnomeclock sys_ptrace- Allow dhcpd to read kernel network state- Label /var/run/gdm correctly - Fix unconfined_u user creation- Allow transition from initrc_t to getty_t- Allow passwd to communicate with user sockets to change gnome-keyring- Fix initial install- Allow radvd to use fifo_file - dontaudit setfiles reading links - allow semanage sys_resource - add allow_httpd_mod_auth_ntlm_winbind boolean - Allow privhome apps including dovecot read on nfs and cifs home dirs if the boolean is set- Allow nsplugin to read /etc/mozpluggerrc, user_fonts - Allow syslog to manage innd logs. - Allow procmail to ioctl spamd_exec_t- Allow initrc_t to dbus chat with consolekit.- Additional access for nsplugin - Allow xdm setcap/getcap until pulseaudio is fixed- Allow mount to mkdir on tmpfs - Allow ifconfig to search debugfs- Fix file context for MATLAB - Fixes for xace- Allow stunnel to transition to inetd children domains - Make unconfined_dbusd_t an unconfined domain- Fixes for qemu/virtd- Fix bug in mozilla policy to allow xguest transition - This will fix the libsemanage.dbase_llist_query: could not find record value libsemanage.dbase_llist_query: could not query record value (No such file or directory) bug in xguest- Allow nsplugin to run acroread- Add cups_pdf policy - Add openoffice policy to run in xguest- prewika needs to contact mysql - Allow syslog to read system_map files- Change init_t to an unconfined_domain- Allow init to transition to initrc_t on shell exec. - Fix init to be able to sendto init_t. - Allow syslog to connect to mysql - Allow lvm to manage its own fifo_files - Allow bugzilla to use ldap - More mls fixes- fixes for init policy (#436988) - fix build- Additional changes for MLS policy- Fix initrc_context generation for MLS- Fixes for libvirt- Allow bitlebee to read locale_t- More xselinux rules- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t- Prepare policy for beta release - Change some of the system domains back to unconfined - Turn on some of the booleans- Allow nsplugin_config execstack/execmem - Allow nsplugin_t to read alsa config - Change apache to use user content- Add cyphesis policy- Fix Makefile.devel to build mls modules - Fix qemu to be more specific on labeling- Update to upstream fixes- Allow staff to mounton user_home_t- Add xace support- Add fusectl file system- Fixes from yum-cron - Update to latest upstream- Fix userdom_list_user_files- Merge with upstream- Allow udev to send audit messages- Add additional login users interfaces - userdom_admin_login_user_template(staff)- More fixes for polkit- Eliminate transition from unconfined_t to qemu by default - Fixes for gpg- Update to upstream- Fixes for staff_t- Add policy for kerneloops - Add policy for gnomeclock- Fixes for libvirt- Fixes for nsplugin- More fixes for qemu- Additional ports for vnc and allow qemu and libvirt to search all directories- Update to upstream - Add libvirt policy - add qemu policy- Allow fail2ban to create a socket in /var/run- Allow allow_httpd_mod_auth_pam to work- Add audisp policy and prelude- Allow all user roles to executae samba net command- Allow usertypes to read/write noxattr file systems- Fix nsplugin to allow flashplugin to work in enforcing mode- Allow pam_selinux_permit to kill all processes- Allow ptrace or user processes by users of same type - Add boolean for transition to nsplugin- Allow nsplugin sys_nice, getsched, setsched- Allow login programs to talk dbus to oddjob- Add procmail_log support - Lots of fixes for munin- Allow setroubleshoot to read policy config and send audit messages- Allow users to execute all files in homedir, if boolean set - Allow mount to read samba config- Fixes for xguest to run java plugin- dontaudit pam_t and dbusd writing to user_home_t- Update gpg to allow reading of inotify- Change user and staff roles to work correctly with varied perms- Fix munin log, - Eliminate duplicate mozilla file context - fix wpa_supplicant spec- Fix role transition from unconfined_r to system_r when running rpm - Allow unconfined_domains to communicate with user dbus instances- Fixes for xguest- Let all uncofined domains communicate with dbus unconfined- Run rpm in system_r- Zero out customizable types- Fix definiton of admin_home_t- Fix munin file context- Allow cron to run unconfined apps- Modify default login to unconfined_u- Dontaudit dbus user client search of /root- Update to upstream- Fixes for polkit - Allow xserver to ptrace- Add polkit policy - Symplify userdom context, remove automatic per_role changes- Update to upstream - Allow httpd_sys_script_t to search users homedirs- Allow rpm_script to transition to unconfined_execmem_t- Remove user based home directory separation- Remove user specific crond_t- Merge with upstream - Allow xsever to read hwdata_t - Allow login programs to setkeycreate- Update to upstream- Update to upstream- Allow XServer to read /proc/self/cmdline - Fix unconfined cron jobs - Allow fetchmail to transition to procmail - Fixes for hald_mac - Allow system_mail to transition to exim - Allow tftpd to upload files - Allow xdm to manage unconfined_tmp - Allow udef to read alsa config - Fix xguest to be able to connect to sound port- Fixes for hald_mac - Treat unconfined_home_dir_t as a home dir - dontaudit rhgb writes to fonts and root- Fix dnsmasq - Allow rshd full login privs- Allow rshd to connect to ports > 1023- Fix vpn to bind to port 4500 - Allow ssh to create shm - Add Kismet policy- Allow rpm to chat with networkmanager- Fixes for ipsec and exim mail - Change default to unconfined user- Pass the UNK_PERMS param to makefile - Fix gdm location- Make alsa work- Fixes for consolekit and startx sessions- Dontaudit consoletype talking to unconfined_t- Remove homedir_template- Check asound.state- Fix exim policy- Allow tmpreadper to read man_t - Allow racoon to bind to all nodes - Fixes for finger print reader- Allow xdm to talk to input device (fingerprint reader) - Allow octave to run as java- Allow login programs to set ioctl on /proc- Allow nsswitch apps to read samba_var_t- Fix maxima- Eliminate rpm_t:fifo_file avcs - Fix dbus path for helper app- Fix service start stop terminal avc's- Allow also to search var_lib - New context for dbus launcher- Allow cupsd_config_t to read/write usb_device_t - Support for finger print reader, - Many fixes for clvmd - dbus starting networkmanager- Fix java and mono to run in xguest account- Fix to add xguest account when inititial install - Allow mono, java, wine to run in userdomains- Allow xserver to search devpts_t - Dontaudit ldconfig output to homedir- Remove hplip_etc_t change back to etc_t.- Allow cron to search nfs and samba homedirs- Allow NetworkManager to dbus chat with yum-updated- Allow xfs to bind to port 7100- Allow newalias/sendmail dac_override - Allow bind to bind to all udp ports- Turn off direct transition- Allow wine to run in system role- Fix java labeling- Define user_home_type as home_type- Allow sendmail to create etc_aliases_t- Allow login programs to read symlinks on homedirs- Update an readd modules- Cleanup spec file- Allow xserver to be started by unconfined process and talk to tty- Upgrade to upstream to grab postgressql changes- Add setransd for mls policy- Add ldconfig_cache_t- Allow sshd to write to proc_t for afs login- Allow xserver access to urand- allow dovecot to search mountpoints- Fix Makefile for building policy modules- Fix dhcpc startup of service- Fix dbus chat to not happen for xguest and guest users- Fix nagios cgi - allow squid to communicate with winbind- Fixes for ldconfig- Update from upstream- Add nasd support- Fix new usb devices and dmfm- Eliminate mount_ntfs_t policy, merge into mount_t- Allow xserver to write to ramfs mounted by rhgb- Add context for dbus machine id- Update with latest changes from upstream- Fix prelink to handle execmod- Add ntpd_key_t to handle secret data- Add anon_inodefs - Allow unpriv user exec pam_exec_t - Fix trigger- Allow cups to use generic usb - fix inetd to be able to run random apps (git)- Add proper contexts for rsyslogd- Fixes for xguest policy- Allow execution of gconf- Fix moilscanner update problem- Begin adding policy to separate setsebool from semanage - Fix xserver.if definition to not break sepolgen.if- Add new devices- Add brctl policy- Fix root login to include system_r- Allow prelink to read kernel sysctls- Default to user_u:system_r:unconfined_t- fix squid - Fix rpm running as uid- Fix syslog declaration- Allow avahi to access inotify - Remove a lot of bogus security_t:filesystem avcs- Remove ifdef strict policy from upstream- Remove ifdef strict to allow user_u to login- Fix for amands - Allow semanage to read pp files - Allow rhgb to read xdm_xserver_tmp- Allow kerberos servers to use ldap for backing store- allow alsactl to read kernel state- More fixes for alsactl - Transition from hal and modutils - Fixes for suspend resume. - insmod domtrans to alsactl - insmod writes to hal log- Allow unconfined_t to transition to NetworkManager_t - Fix netlabel policy- Update to latest from upstream- Update to latest from upstream- Update to latest from upstream- Allow pcscd_t to send itself signals- Fixes for unix_update - Fix logwatch to be able to search all dirs- Upstream bumped the version- Allow consolekit to syslog - Allow ntfs to work with hal- Allow iptables to read etc_runtime_t- MLS Fixes- Fix path of /etc/lvm/cache directory - Fixes for alsactl and pppd_t - Fixes for consolekit- Allow insmod_t to mount kvmfs_t filesystems- Rwho policy - Fixes for consolekit- fixes for fusefs- Fix samba_net to allow it to view samba_var_t- Update to upstream- Fix Sonypic backlight - Allow snmp to look at squid_conf_t- Fixes for pyzor, cyrus, consoletype on everything installs- Fix hald_acl_t to be able to getattr/setattr on usb devices - Dontaudit write to unconfined_pipes for load_policy- Allow bluetooth to read inotifyfs- Fixes for samba domain controller. - Allow ConsoleKit to look at ttys- Fix interface call- Allow syslog-ng to read /var - Allow locate to getattr on all filesystems - nscd needs setcap- Update to upstream- Allow samba to run groupadd- Update to upstream- Allow mdadm to access generic scsi devices- Fix labeling on udev.tbl dirs- Fixes for logwatch- Add fusermount and mount_ntfs policy- Update to upstream - Allow saslauthd to use kerberos keytabs- Fixes for samba_var_t- Allow networkmanager to setpgid - Fixes for hal_acl_t- Remove disable_trans booleans - hald_acl_t needs to talk to nscd- Fix prelink to be able to manage usr dirs.- Allow insmod to launch init scripts- Remove setsebool policy- Fix handling of unlabled_t packets- More of my patches from upstream- Update to latest from upstream - Add fail2ban policy- Update to remove security_t:filesystem getattr problems- Policy for consolekit- Update to latest from upstream- Revert Nemiver change - Set sudo as a corecmd so prelink will work, remove sudoedit mapping, since this will not work, it does not transition. - Allow samba to execute useradd- Upgrade to the latest from upstream- Add sepolgen support - Add bugzilla policy- Fix file context for nemiver- Remove include sym link- Allow mozilla, evolution and thunderbird to read dev_random. Resolves: #227002 - Allow spamd to connect to smtp port Resolves: #227184 - Fixes to make ypxfr work Resolves: #227237- Fix ssh_agent to be marked as an executable - Allow Hal to rw sound device- Fix spamassisin so crond can update spam files - Fixes to allow kpasswd to work - Fixes for bluetooth- Remove some targeted diffs in file context file- Fix squid cachemgr labeling- Add ability to generate webadm_t policy - Lots of new interfaces for httpd - Allow sshd to login as unconfined_t- Continue fixing, additional user domains- Begin adding user confinement to targeted policy- Fixes for prelink, ktalkd, netlabel- Allow prelink when run from rpm to create tmp files Resolves: #221865 - Remove file_context for exportfs Resolves: #221181 - Allow spamassassin to create ~/.spamassissin Resolves: #203290 - Allow ssh access to the krb tickets - Allow sshd to change passwd - Stop newrole -l from working on non securetty Resolves: #200110 - Fixes to run prelink in MLS machine Resolves: #221233 - Allow spamassassin to read var_lib_t dir Resolves: #219234- fix mplayer to work under strict policy - Allow iptables to use nscd Resolves: #220794- Add gconf policy and make it work with strict- Many fixes for strict policy and by extension mls.- Fix to allow ftp to bind to ports > 1024 Resolves: #219349- Allow semanage to exec it self. Label genhomedircon as semanage_exec_t Resolves: #219421 - Allow sysadm_lpr_t to manage other print spool jobs Resolves: #220080- allow automount to setgid Resolves: #219999- Allow cron to polyinstatiate - Fix creation of boot flags Resolves: #207433- Fixes for irqbalance Resolves: #219606- Fix vixie-cron to work on mls Resolves: #207433Resolves: #218978- Allow initrc to create files in /var directories Resolves: #219227- More fixes for MLS Resolves: #181566- More Fixes polyinstatiation Resolves: #216184- More Fixes polyinstatiation - Fix handling of keyrings Resolves: #216184- Fix polyinstatiation - Fix pcscd handling of terminal Resolves: #218149 Resolves: #218350- More fixes for quota Resolves: #212957- ncsd needs to use avahi sockets Resolves: #217640 Resolves: #218014- Allow login programs to polyinstatiate homedirs Resolves: #216184 - Allow quotacheck to create database files Resolves: #212957- Dontaudit appending hal_var_lib files Resolves: #217452 Resolves: #217571 Resolves: #217611 Resolves: #217640 Resolves: #217725- Fix context for helix players file_context #216942- Fix load_policy to be able to mls_write_down so it can talk to the terminal- Fixes for hwclock, clamav, ftp- Move to upstream version which accepted my patches- Fixes for nvidia driver- Allow semanage to signal mcstrans- Update to upstream- Allow modstorage to edit /etc/fstab file- Fix for qemu, /dev/- Fix path to realplayer.bin- Allow xen to connect to xen port- Allow cups to search samba_etc_t directory - Allow xend_t to list auto_mountpoints- Allow xen to search automount- Fix spec of jre files- Fix unconfined access to shadow file- Allow xend to create files in xen_image_t directories- Fixes for /var/lib/hal- Remove ability for sysadm_t to look at audit.log- Fix rpc_port_types - Add aide policy for mls- Merge with upstream- Lots of fixes for ricci- Allow xen to read/write fixed devices with a boolean - Allow apache to search /var/log- Fix policygentool specfile problem. - Allow apache to send signals to it's logging helpers. - Resolves: rhbz#212731- Add perms for swat- Add perms for swat- Allow daemons to dump core files to /- Fixes for ricci- Allow mount.nfs to work- Allow ricci-modstorage to look at lvm_etc_t- Fixes for ricci using saslauthd- Allow mountpoint on home_dir_t and home_t- Update xen to read nfs files- Allow noxattrfs to associate with other noxattrfs- Allow hal to use power_device_t- Allow procemail to look at autofs_t - Allow xen_image_t to work as a fixed device- Refupdate from upstream- Add lots of fixes for mls cups- Lots of fixes for ricci- Fix number of cats- Update to upstream- More iSCSI changes for #209854- Test ISCSI fixes for #209854- allow semodule to rmdir selinux_config_t dir- Fix boot_runtime_t problem on ppc. Should not be creating these files.- Fix context mounts on reboot - Fix ccs creation of directory in /var/log- Update for tallylog- Allow xend to rewrite dhcp conf files - Allow mgetty sys_admin capability- Make xentapctrl work- Don't transition unconfined_t to bootloader_t - Fix label in /dev/xen/blktap- Patch for labeled networking- Fix crond handling for mls- Update to upstream- Remove bluetooth-helper transition - Add selinux_validate for semanage - Require new version of libsemanage- Fix prelink- Fix rhgb- Fix setrans handling on MLS and useradd- Support for fuse - fix vigr- Fix dovecot, amanda - Fix mls- Allow java execheap for itanium- Update with upstream- mls fixes- Update from upstream- More fixes for mls - Revert change on automount transition to mount- Fix cron jobs to run under the correct context- Fixes to make pppd work- Multiple policy fixes - Change max categories to 1023- Fix transition on mcstransd- Add /dev/em8300 defs- Upgrade to upstream- Fix ppp connections from network manager- Add tty access to all domains boolean - Fix gnome-pty-helper context for ia64- Fixed typealias of firstboot_rw_t- Fix location of xel log files - Fix handling of sysadm_r -> rpm_exec_t- Fixes for autofs, lp- Update from upstream- Fixup for test6- Update to upstream- Update to upstream- Fix suspend to disk problems- Lots of fixes for restarting daemons at the console.- Fix audit line - Fix requires line- Upgrade to upstream- Fix install problems- Allow setroubleshoot to getattr on all dirs to gather RPM data- Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform - Fix spec for /dev/adsp- Fix xen tty devices- Fixes for setroubleshoot- Update to upstream- Fixes for stunnel and postgresql - Update from upstream- Update from upstream - More java fixes- Change allow_execstack to default to on, for RHEL5 Beta. This is required because of a Java compiler problem. Hope to turn off for next beta- Misc fixes- More fixes for strict policy- Quiet down anaconda audit messages- Fix setroubleshootd- Update to the latest from upstream- More fixes for xen- Fix anaconda transitions- yet more xen rules- more xen rules- Fixes for Samba- Fixes for xen- Allow setroubleshootd to send mail- Add nagios policy- fixes for setroubleshoot- Added Paul Howarth patch to only load policy packages shipped with this package - Allow pidof from initrc to ptrace higher level domains - Allow firstboot to communicate with hal via dbus- Add policy for /var/run/ldapi- Fix setroubleshoot policy- Fixes for mls use of ssh - named has a new conf file- Fixes to make setroubleshoot work- Cups needs to be able to read domain state off of printer client- add boolean to allow zebra to write config files- setroubleshootd fixes- Allow prelink to read bin_t symlink - allow xfs to read random devices - Change gfs to support xattr- Remove spamassassin_can_network boolean- Update to upstream - Fix lpr domain for mls- Add setroubleshoot policy- Turn off auditallow on setting booleans- Multiple fixes- Update to upstream- Update to upstream - Add new class for kernel key ring- Update to upstream- Update to upstream- Break out selinux-devel package- Add ibmasmfs- Fix policygentool gen_requires- Update from Upstream- Fix spec of realplay- Update to upstream- Fix semanage- Allow useradd to create_home_dir in MLS environment- Update from upstream- Update from upstream- Add oprofilefs- Fix for hplip and Picasus- Update to upstream- Update to upstream- fixes for spamd- fixes for java, openldap and webalizer- Xen fixes- Upgrade to upstream- allow hal to read boot_t files - Upgrade to upstream- allow hal to read boot_t files- Update from upstream- Fixes for amavis- Update from upstream- Allow auditctl to search all directories- Add acquire service for mono.- Turn off allow_execmem boolean - Allow ftp dac_override when allowed to access users homedirs- Clean up spec file - Transition from unconfined_t to prelink_t- Allow execution of cvs command- Update to upstream- Update to upstream- Fix libjvm spec- Update to upstream- Add xm policy - Fix policygentool- Update to upstream - Fix postun to only disable selinux on full removal of the packages- Allow mono to chat with unconfined- Allow procmail to sendmail - Allow nfs to share dosfs- Update to latest from upstream - Allow selinux-policy to be removed and kernel not to crash- Update to latest from upstream - Add James Antill patch for xen - Many fixes for pegasus- Add unconfined_mount_t - Allow privoxy to connect to httpd_cache - fix cups labeleing on /var/cache/cups- Update to latest from upstream- Update to latest from upstream - Allow mono and unconfined to talk to initrc_t dbus objects- Change libraries.fc to stop shlib_t form overriding texrel_shlib_t- Fix samba creating dirs in homedir - Fix NFS so its booleans would work- Allow secadm_t ability to relabel all files - Allow ftp to search xferlog_t directories - Allow mysql to communicate with ldap - Allow rsync to bind to rsync_port_t- Fixed mailman with Postfix #183928 - Allowed semanage to create file_context files. - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t to bind to reserved ports. #149030 - Don't allow devpts_t to be associated with tmp_t. - Allow hald_t to stat all mountpoints. - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts. - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of /etc/mtab. - Changed the file_contexts to not have a regex before the first ^/[a-z]/ whenever possible, makes restorecon slightly faster. - Correct the label of /etc/named.caching-nameserver.conf - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src hit by this. - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed xenstored_t rw access to the xen device node.- More textrel_shlib_t file path fixes - Add ada support- Get auditctl working in MLS policy- Add mono dbus support - Lots of file_context fixes for textrel_shlib_t in FC5 - Turn off execmem auditallow since they are filling log files- Update to upstream- Allow automount and dbus to read cert files- Fix ftp policy - Fix secadm running of auditctl- Update to upstream- Update to upstream- Fix policyhelp- Fix pam_console handling of usb_device - dontaudit logwatch reading /mnt dir- Update to upstream- Get transition rules to create policy.20 at SystemHigh- Allow secadmin to shutdown system - Allow sendmail to exec newalias- MLS Fixes dmidecode needs mls_file_read_up - add ypxfr_t - run init needs access to nscd - udev needs setuid - another xen log file - Dontaudit mount getattr proc_kcore_t- fix buildroot usage (#185391)- Get rid of mount/fsdisk scan of /dev messages - Additional fixes for suspend/resume- Fake make to rebuild enableaudit.pp- Get xen networking running.- Fixes for Xen - enableaudit should not be the same as base.pp - Allow ps to work for all process- more xen policy fixups- more xen fixage (#184393)- Fix blkid specification - Allow postfix to execute mailman_que- Blkid changes - Allow udev access to usb_device_t - Fix post script to create targeted policy config file- Allow lvm tools to create drevice dir- Add Xen support- Fixes for cups - Make cryptosetup work with hal- Load Policy needs translock- Fix cups html interface- Add hal changes suggested by Jeremy - add policyhelp to point at policy html pages- Additional fixes for nvidia and cups- Update to upstream - Merged my latest fixes - Fix cups policy to handle unix domain sockets- NSCD socket is in nscd_var_run_t needs to be able to search dir- Fixes Apache interface file- Fixes for new version of cups- Turn off polyinstatiate util after FC5- Fix problem with privoxy talking to Tor- Turn on polyinstatiation- Don't transition from unconfined_t to fsadm_t- Fix policy update model.- Update to upstream- Fix load_policy to work on MLS - Fix cron_rw_system_pipes for postfix_postdrop_t - Allow audotmount to run showmount- Fix swapon - allow httpd_sys_script_t to be entered via a shell - Allow httpd_sys_script_t to read eventpolfs- Update from upstream- allow cron to read apache files- Fix vpnc policy to work from NetworkManager- Update to upstream - Fix semoudle polcy- Update to upstream - fix sysconfig/selinux link- Add router port for zebra - Add imaze port for spamd - Fixes for amanda and java- Fix bluetooth handling of usb devices - Fix spamd reading of ~/ - fix nvidia spec- Update to upsteam- Add users_extra files- Update to upstream- Add semodule policy- Update from upstream- Fix for spamd to use razor port- Fixes for mcs - Turn on mount and fsadm for unconfined_t- Fixes for the -devel package- Fix for spamd to use ldap- Update to upstream- Update to upstream - Fix rhgb, and other Xorg startups- Update to upstream- Separate out role of secadm for mls- Add inotifyfs handling- Update to upstream - Put back in changes for pup/zen- Many changes for MLS - Turn on strict policy- Update to upstream- Update to upstream - Fixes for booting and logging in on MLS machine- Update to upstream - Turn off execheap execstack for unconfined users - Add mono/wine policy to allow execheap and execstack for them - Add execheap for Xdm policy- Update to upstream - Fixes to fetchmail,- Update to upstream- Fix for procmail/spamassasin - Update to upstream - Add rules to allow rpcd to work with unlabeled_networks.- Update to upstream - Fix ftp Man page- Update to upstream- fix pup transitions (#177262) - fix xen disks (#177599)- Update to upstream- More Fixes for hal and readahead- Fixes for hal and readahead- Update to upstream - Apply- Add wine and fix hal problems- Handle new location of hal scripts- Allow su to read /etc/mtab- Update to upstream- Fix "libsemanage.parse_module_headers: Data did not represent a module." problem- Allow load_policy to read /etc/mtab- Fix dovecot to allow dovecot_auth to look at /tmp- Allow restorecon to read unlabeled_t directories in order to fix labeling.- Add Logwatch policy- Fix /dev/ub[a-z] file context- Fix library specification - Give kudzu execmem privs- Fix hostname in targeted policy- Fix passwd command on mls- Lots of fixes to make mls policy work- Add dri libs to textrel_shlib_t - Add system_r role for java - Add unconfined_exec_t for vncserver - Allow slapd to use kerberos- Add man pages- Add enableaudit.pp- Fix mls policy- Update mls file from old version- Add sids back in - Rebuild with update checkpolicy- Fixes to allow automount to use portmap - Fixes to start kernel in s0-s15:c0.c255- Add java unconfined/execmem policy- Add file context for /var/cvs - Dontaudit webalizer search of homedir- Update from upstream- Clean up spec - range_transition crond to SystemHigh- Fixes for hal - Update to upstream- Turn back on execmem since we need it for java, firefox, ooffice - Allow gpm to stream socket to itself- fix requirements to be on the actual packages so that policy can get created properly at install time- Allow unconfined_t to execmod texrel_shlib_t- Update to upstream - Turn off allow_execmem and allow_execmod booleans - Add tcpd and automount policies- Add two new httpd booleans, turned off by default * httpd_can_network_relay * httpd_can_network_connect_db- Add ghost for policy.20- Update to upstream - Turn off boolean allow_execstack- Change setrans-mls to use new libsetrans - Add default_context rule for xdm- Change Requires to PreReg for requiring of policycoreutils on install- New upstream releaseAdd xdm policyUpdate from upstreamUpdate from upstreamUpdate from upstream- Also trigger to rebuild policy for versions up to 2.0.7.- No longer installing policy.20 file, anaconda handles the building of the app.- Fixes for dovecot and saslauthd- Cleanup pegasus and named - Fix spec file - Fix up passwd changing applications-Update to latest from upstream- Add rules for pegasus and avahi- Start building MLS Policy- Update to upstream- Turn on bash- Initial version/bin/sh  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-..0123456789:;<=>?@ABCDEFGHIJKLMN3.13.1-229.el7_6.15    develMakefileexample.fcexample.ifexample.tehtmlNetworkManager.htmlabrt.htmlabrt_dump_oops.htmlabrt_handle_event.htmlabrt_helper.htmlabrt_retrace_coredump.htmlabrt_retrace_worker.htmlabrt_upload_watch.htmlabrt_watch_log.htmlaccountsd.htmlacct.htmladmin_crontab.htmlafs.htmlafs_bosserver.htmlafs_fsserver.htmlafs_kaserver.htmlafs_ptserver.htmlafs_vlserver.htmlaiccu.htmlaide.htmlajaxterm.htmlajaxterm_ssh.htmlalsa.htmlamanda.htmlamanda_recover.htmlamtu.htmlanaconda.htmlanon_sftpd.htmlantivirus.htmlapcupsd.htmlapcupsd_cgi_script.htmlapm.htmlapmd.htmlarpwatch.htmlasterisk.htmlaudisp.htmlaudisp_remote.htmlauditadm.htmlauditadm_screen.htmlauditadm_su.htmlauditadm_sudo.htmlauditctl.htmlauditd.htmlauthconfig.htmlautomount.htmlavahi.htmlawstats.htmlawstats_script.htmlbacula.htmlbacula_admin.htmlbacula_unconfined_script.htmlbcfg2.htmlbitlbee.htmlblkmapd.htmlblktap.htmlblueman.htmlbluetooth.htmlbluetooth_helper.htmlboinc.htmlboinc_project.htmlbootloader.htmlbrctl.htmlbrltty.htmlbugzilla_script.htmlbumblebee.htmlcachefiles_kernel.htmlcachefilesd.htmlcalamaris.htmlcallweaver.htmlcanna.htmlcardmgr.htmlccs.htmlcdcc.htmlcdrecord.htmlcertmaster.htmlcertmonger.htmlcertmonger_unconfined.htmlcertwatch.htmlcfengine_execd.htmlcfengine_monitord.htmlcfengine_serverd.htmlcgclear.htmlcgconfig.htmlcgdcbxd.htmlcgred.htmlcheckpc.htmlcheckpolicy.htmlchfn.htmlchkpwd.htmlchrome_sandbox.htmlchrome_sandbox_nacl.htmlchronyc.htmlchronyd.htmlchroot_user.htmlcinder_api.htmlcinder_backup.htmlcinder_scheduler.htmlcinder_volume.htmlciped.htmlclogd.htmlcloud_init.htmlcluster.htmlclvmd.htmlcmirrord.htmlcobblerd.htmlcockpit_session.htmlcockpit_ws.htmlcollectd.htmlcollectd_script.htmlcolord.htmlcomsat.htmlcondor_collector.htmlcondor_master.htmlcondor_negotiator.htmlcondor_procd.htmlcondor_schedd.htmlcondor_startd.htmlcondor_startd_ssh.htmlconman.htmlconman_unconfined_script.htmlconsolekit.htmlcontainer.htmlcontainer_auth.htmlcontainer_runtime.htmlcouchdb.htmlcourier_authdaemon.htmlcourier_pcp.htmlcourier_pop.htmlcourier_sqwebmail.htmlcourier_tcpd.htmlcpucontrol.htmlcpufreqselector.htmlcpuplug.htmlcpuspeed.htmlcrack.htmlcrond.htmlcronjob.htmlcrontab.htmlctdbd.htmlcups_pdf.htmlcupsd.htmlcupsd_config.htmlcupsd_lpd.htmlcvs.htmlcvs_script.htmlcyphesis.htmlcyrus.htmldbadm.htmldbadm_sudo.htmldbskkd.htmldcc_client.htmldcc_dbclean.htmldccd.htmldccifd.htmldccm.htmldcerpcd.htmlddclient.htmldeltacloudd.htmldenyhosts.htmldepmod.htmldevicekit.htmldevicekit_disk.htmldevicekit_power.htmldhcpc.htmldhcpd.htmldictd.htmldirsrv.htmldirsrv_snmp.htmldirsrvadmin.htmldirsrvadmin_script.htmldirsrvadmin_unconfined_script.htmldisk_munin_plugin.htmldkim_milter.htmldlm_controld.htmldmesg.htmldmidecode.htmldnsmasq.htmldnssec_trigger.htmldovecot.htmldovecot_auth.htmldovecot_deliver.htmldrbd.htmldspam.htmldspam_script.htmlentropyd.htmleventlogd.htmlevtchnd.htmlexim.htmlfail2ban.htmlfail2ban_client.htmlfcoemon.htmlfenced.htmlfetchmail.htmlfingerd.htmlfirewalld.htmlfirewallgui.htmlfirstboot.htmlfoghorn.htmlfprintd.htmlfreeipmi_bmc_watchdog.htmlfreeipmi_ipmidetectd.htmlfreeipmi_ipmiseld.htmlfreqset.htmlfsadm.htmlfsdaemon.htmlftpd.htmlftpdctl.htmlgames.htmlgames_srv.htmlganesha.htmlgconfd.htmlgconfdefaultsm.htmlgdomap.htmlgeoclue.htmlgetty.htmlgfs_controld.htmlgit_script.htmlgit_session.htmlgit_system.htmlgitosis.htmlglance_api.htmlglance_registry.htmlglance_scrubber.htmlglusterd.htmlgnomesystemmm.htmlgpg.htmlgpg_agent.htmlgpg_helper.htmlgpg_pinentry.htmlgpg_web.htmlgpm.htmlgpsd.htmlgreylist_milter.htmlgroupadd.htmlgroupd.htmlgssd.htmlgssproxy.htmlguest.htmlhaproxy.htmlhddtemp.htmlhostname.htmlhsqldb.htmlhttpd.htmlhttpd_helper.htmlhttpd_passwd.htmlhttpd_php.htmlhttpd_rotatelogs.htmlhttpd_suexec.htmlhttpd_sys_script.htmlhttpd_unconfined_script.htmlhttpd_user_script.htmlhwclock.htmlhwloc_dhwd.htmlhypervkvp.htmlhypervvssd.htmliceauth.htmlicecast.htmlifconfig.htmlindex.htmlinetd.htmlinetd_child.htmlinit.htmlinitrc.htmlinnd.htmlinsmod.htmlinstall.htmliodined.htmliotop.htmlipa_dnskey.htmlipa_helper.htmlipa_otpd.htmlipmievd.htmlipsec.htmlipsec_mgmt.htmliptables.htmlirc.htmlirqbalance.htmlirssi.htmliscsid.htmlisnsd.htmliwhd.htmljabberd.htmljabberd_router.htmljockey.htmljournalctl.htmlkadmind.htmlkdump.htmlkdumpctl.htmlkdumpgui.htmlkeepalived.htmlkeepalived_unconfined_script.htmlkernel.htmlkeyboardd.htmlkeystone.htmlkeystone_cgi_script.htmlkismet.htmlklogd.htmlkmscon.htmlkpropd.htmlkrb5kdc.htmlksmtuned.htmlktalkd.htmll2tpd.htmlldconfig.htmllircd.htmllivecd.htmllldpad.htmlload_policy.htmlloadkeys.htmllocal_login.htmllocate.htmllockdev.htmllogadm.htmllogrotate.htmllogrotate_mail.htmllogwatch.htmllogwatch_mail.htmllpd.htmllpr.htmllsassd.htmllsmd.htmllsmd_plugin.htmllttng_sessiond.htmllvm.htmllwiod.htmllwregd.htmllwsmd.htmlmail_munin_plugin.htmlmailman_cgi.htmlmailman_mail.htmlmailman_queue.htmlman2html_script.htmlmandb.htmlmcelog.htmlmdadm.htmlmediawiki_script.htmlmemcached.htmlmencoder.htmlminidlna.htmlminissdpd.htmlmip6d.htmlmirrormanager.htmlmock.htmlmock_build.htmlmodemmanager.htmlmojomojo_script.htmlmon_procd.htmlmon_statd.htmlmongod.htmlmotion.htmlmount.htmlmount_ecryptfs.htmlmozilla.htmlmozilla_plugin.htmlmozilla_plugin_config.htmlmpd.htmlmplayer.htmlmrtg.htmlmscan.htmlmunin.htmlmunin_script.htmlmysqld.htmlmysqld_safe.htmlmysqlmanagerd.htmlmythtv_script.htmlnagios.htmlnagios_admin_plugin.htmlnagios_checkdisk_plugin.htmlnagios_eventhandler_plugin.htmlnagios_mail_plugin.htmlnagios_openshift_plugin.htmlnagios_script.htmlnagios_services_plugin.htmlnagios_system_plugin.htmlnagios_unconfined_plugin.htmlnamed.htmlnamespace_init.htmlncftool.htmlndc.htmlnetlabel_mgmt.htmlnetlogond.htmlnetutils.htmlneutron.htmlnewrole.htmlnfsd.htmlninfod.htmlnmbd.htmlnova.htmlnrpe.htmlnscd.htmlnsd.htmlnsd_crond.htmlnslcd.htmlntop.htmlntpd.htmlnumad.htmlnut_upsd.htmlnut_upsdrvctl.htmlnut_upsmon.htmlnutups_cgi_script.htmlnx_server.htmlnx_server_ssh.htmlobex.htmloddjob.htmloddjob_mkhomedir.htmlopenct.htmlopendnssec.htmlopenhpid.htmlopenshift.htmlopenshift_app.htmlopenshift_cgroup_read.htmlopenshift_cron.htmlopenshift_initrc.htmlopenshift_net_read.htmlopenshift_script.htmlopensm.htmlopenvpn.htmlopenvpn_unconfined_script.htmlopenvswitch.htmlopenwsman.htmloracleasm.htmlosad.htmlpads.htmlpam_console.htmlpam_timestamp.htmlpassenger.htmlpasswd.htmlpcp_pmcd.htmlpcp_pmie.htmlpcp_pmlogger.htmlpcp_pmmgr.htmlpcp_pmproxy.htmlpcp_pmwebd.htmlpcscd.htmlpegasus.htmlpegasus_openlmi_account.htmlpegasus_openlmi_admin.htmlpegasus_openlmi_logicalfile.htmlpegasus_openlmi_services.htmlpegasus_openlmi_storage.htmlpegasus_openlmi_system.htmlpegasus_openlmi_unconfined.htmlpesign.htmlphc2sys.htmlping.htmlpingd.htmlpiranha_fos.htmlpiranha_lvs.htmlpiranha_pulse.htmlpiranha_web.htmlpkcs_slotd.htmlpki_ra.htmlpki_tomcat.htmlpki_tomcat_script.htmlpki_tps.htmlplymouth.htmlplymouthd.htmlpodsleuth.htmlpolicykit.htmlpolicykit_auth.htmlpolicykit_grant.htmlpolicykit_resolve.htmlpolipo.htmlpolipo_session.htmlportmap.htmlportmap_helper.htmlportreserve.htmlpostfix_bounce.htmlpostfix_cleanup.htmlpostfix_local.htmlpostfix_map.htmlpostfix_master.htmlpostfix_pickup.htmlpostfix_pipe.htmlpostfix_postdrop.htmlpostfix_postqueue.htmlpostfix_qmgr.htmlpostfix_showq.htmlpostfix_smtp.htmlpostfix_smtpd.htmlpostfix_virtual.htmlpostgresql.htmlpostgrey.htmlpppd.htmlpptp.htmlprelink.htmlprelink_cron_system.htmlprelude.htmlprelude_audisp.htmlprelude_correlator.htmlprelude_lml.htmlpreupgrade.htmlprewikka_script.htmlprivoxy.htmlprocmail.htmlprosody.htmlpsad.htmlptal.htmlptchown.htmlptp4l.htmlpublicfile.htmlpulseaudio.htmlpuppetagent.htmlpuppetca.htmlpuppetmaster.htmlpwauth.htmlpyicqt.htmlqdiskd.htmlqemu_dm.htmlqmail_clean.htmlqmail_inject.htmlqmail_local.htmlqmail_lspawn.htmlqmail_queue.htmlqmail_remote.htmlqmail_rspawn.htmlqmail_send.htmlqmail_smtpd.htmlqmail_splogger.htmlqmail_start.htmlqmail_tcp_env.htmlqpidd.htmlquota.htmlquota_nld.htmlrabbitmq.htmlracoon.htmlradiusd.htmlradvd.htmlrasdaemon.htmlrdisc.htmlreadahead.htmlrealmd.htmlrealmd_consolehelper.htmlredis.htmlregex_milter.htmlremote_login.htmlrestorecond.htmlrhev_agentd.htmlrhev_agentd_consolehelper.htmlrhgb.htmlrhnsd.htmlrhsmcertd.htmlricci.htmlricci_modcluster.htmlricci_modclusterd.htmlricci_modlog.htmlricci_modrpm.htmlricci_modservice.htmlricci_modstorage.htmlrlogind.htmlrngd.htmlroundup.htmlrpcbind.htmlrpcd.htmlrpm.htmlrpm_script.htmlrshd.htmlrssh.htmlrssh_chroot_helper.htmlrsync.htmlrtas_errd.htmlrtkit_daemon.htmlrun_init.htmlrwho.htmlsamba_net.htmlsamba_unconfined_net.htmlsamba_unconfined_script.htmlsambagui.htmlsandbox.htmlsandbox_min.htmlsandbox_min_client.htmlsandbox_net.htmlsandbox_net_client.htmlsandbox_web.htmlsandbox_web_client.htmlsandbox_x.htmlsandbox_x_client.htmlsandbox_xserver.htmlsanlk_resetd.htmlsanlock.htmlsaslauthd.htmlsbd.htmlsblim_gatherd.htmlsblim_reposd.htmlsblim_sfcbd.htmlsecadm.htmlsecadm_screen.htmlsecadm_su.htmlsecadm_sudo.htmlsectoolm.htmlselinux_munin_plugin.htmlsemanage.htmlsendmail.htmlsensord.htmlsepgsql_ranged_proc.htmlsepgsql_trusted_proc.htmlservices_munin_plugin.htmlsetfiles.htmlsetfiles_mac.htmlsetkey.htmlsetrans.htmlsetroubleshoot_fixit.htmlsetroubleshootd.htmlsetsebool.htmlsftpd.htmlsge_execd.htmlsge_job.htmlsge_job_ssh.htmlsge_shepherd.htmlshorewall.htmlshowmount.htmlslapd.htmlslpd.htmlsmbcontrol.htmlsmbd.htmlsmbmount.htmlsmokeping.htmlsmokeping_cgi_script.htmlsmoltclient.htmlsmsd.htmlsnapperd.htmlsnmpd.htmlsnort.htmlsosreport.htmlsoundd.htmlspamass_milter.htmlspamc.htmlspamd.htmlspamd_update.htmlspc.htmlspeech-dispatcher.htmlsquid.htmlsquid_cron.htmlsquid_script.htmlsrvsvcd.htmlssh.htmlssh_keygen.htmlssh_keysign.htmlsshd.htmlsshd_keygen.htmlsshd_net.htmlsshd_sandbox.htmlsssd.htmlsssd_selinux_manager.htmlstaff.htmlstaff_consolehelper.htmlstaff_dbusd.htmlstaff_gkeyringd.htmlstaff_screen.htmlstaff_seunshare.htmlstaff_ssh_agent.htmlstaff_sudo.htmlstaff_wine.htmlstapserver.htmlstunnel.htmlstyle.csssulogin.htmlsvc_multilog.htmlsvc_run.htmlsvc_start.htmlsvirt.htmlsvirt_kvm_net.htmlsvirt_qemu_net.htmlsvirt_socket.htmlsvirt_tcg.htmlsvnserve.htmlswat.htmlswift.htmlsysadm.htmlsysadm_gkeyringd.htmlsysadm_passwd.htmlsysadm_screen.htmlsysadm_seunshare.htmlsysadm_ssh_agent.htmlsysadm_su.htmlsysadm_sudo.htmlsyslogd.htmlsysstat.htmlsystem_cronjob.htmlsystem_dbusd.htmlsystem_mail.htmlsystem_munin_plugin.htmlsystemd_bootchart.htmlsystemd_hostnamed.htmlsystemd_hwdb.htmlsystemd_initctl.htmlsystemd_localed.htmlsystemd_logger.htmlsystemd_logind.htmlsystemd_machined.htmlsystemd_networkd.htmlsystemd_notify.htmlsystemd_passwd_agent.htmlsystemd_resolved.htmlsystemd_sysctl.htmlsystemd_timedated.htmlsystemd_tmpfiles.htmltangd.htmltargetd.htmltcpd.htmltcsd.htmltelepathy_gabble.htmltelepathy_idle.htmltelepathy_logger.htmltelepathy_mission_control.htmltelepathy_msn.htmltelepathy_salut.htmltelepathy_sofiasip.htmltelepathy_stream_engine.htmltelepathy_sunshine.htmltelnetd.htmltftpd.htmltgtd.htmlthin.htmlthin_aeolus_configserver.htmlthumb.htmltimemaster.htmltlp.htmltmpreaper.htmltomcat.htmltor.htmltraceroute.htmltuned.htmltvtime.htmludev.htmlulogd.htmluml.htmluml_switch.htmlunconfined.htmlunconfined_cronjob.htmlunconfined_dbusd.htmlunconfined_mount.htmlunconfined_munin_plugin.htmlunconfined_sendmail.htmlunconfined_service.htmlupdate_modules.htmlupdfstab.htmlupdpwd.htmlusbmodules.htmlusbmuxd.htmluser.htmluser_dbusd.htmluser_gkeyringd.htmluser_mail.htmluser_screen.htmluser_seunshare.htmluser_ssh_agent.htmluser_wine.htmluseradd.htmlusernetctl.htmlutempter.htmluucpd.htmluuidd.htmluux.htmlvarnishd.htmlvarnishlog.htmlvdagent.htmlvhostmd.htmlvirsh.htmlvirsh_ssh.htmlvirt_bridgehelper.htmlvirt_qemu_ga.htmlvirt_qemu_ga_unconfined.htmlvirt_qmf.htmlvirtd.htmlvirtd_lxc.htmlvirtlogd.htmlvlock.htmlvmtools.htmlvmtools_helper.htmlvmtools_unconfined.htmlvmware.htmlvmware_host.htmlvnstat.htmlvnstatd.htmlvpnc.htmlw3c_validator_script.htmlwatchdog.htmlwatchdog_unconfined.htmlwdmd.htmlwebadm.htmlwebalizer.htmlwebalizer_script.htmlwinbind.htmlwinbind_helper.htmlwine.htmlwireshark.htmlwpa_cli.htmlxauth.htmlxdm.htmlxdm_unconfined.htmlxenconsoled.htmlxend.htmlxenstored.htmlxguest.htmlxguest_dbusd.htmlxguest_gkeyringd.htmlxserver.htmlypbind.htmlyppasswdd.htmlypserv.htmlypxfr.htmlzabbix.htmlzabbix_agent.htmlzabbix_script.htmlzarafa_deliver.htmlzarafa_gateway.htmlzarafa_ical.htmlzarafa_indexer.htmlzarafa_monitor.htmlzarafa_server.htmlzarafa_spooler.htmlzebra.htmlzoneminder.htmlzoneminder_script.htmlzos_remote.htmlincludeMakefileadminadmin.xmlbootloader.ifconsoletype.ifdmesg.ifnetutils.ifsu.ifsudo.ifusermanage.ifappsapps.xmlseunshare.ifbuild.confcontribcontrib.xmlabrt.ifaccountsd.ifacct.ifada.ifafs.ifaiccu.ifaide.ifaisexec.ifajaxterm.ifalsa.ifamanda.ifamavis.ifamtu.ifanaconda.ifantivirus.ifapache.ifapcupsd.ifapm.ifapt.ifarpwatch.ifasterisk.ifauthbind.ifauthconfig.ifautomount.ifavahi.ifawstats.ifbackup.ifbacula.ifbcfg2.ifbind.ifbird.ifbitlbee.ifblkmapd.ifblueman.ifbluetooth.ifboinc.ifbrctl.ifbrltty.ifbugzilla.ifbumblebee.ifcachefilesd.ifcalamaris.ifcallweaver.ifcanna.ifccs.ifcdrecord.ifcertmaster.ifcertmonger.ifcertwatch.ifcfengine.ifcgdcbxd.ifcgroup.ifchrome.ifchronyd.ifcinder.ifcipe.ifclamav.ifclockspeed.ifclogd.ifcloudform.ifcmirrord.ifcobbler.ifcockpit.ifcollectd.ifcolord.ifcomsat.ifcondor.ifconman.ifconsolekit.ifcontainer.ifcorosync.ifcouchdb.ifcourier.ifcpucontrol.ifcpufreqselector.ifcpuplug.ifcron.ifctdb.ifcups.ifcvs.ifcyphesis.ifcyrus.ifdaemontools.ifdante.ifdbadm.ifdbskk.ifdbus.ifdcc.ifddclient.ifddcprobe.ifdenyhosts.ifdevicekit.ifdhcp.ifdictd.ifdirmngr.ifdirsrv-admin.ifdirsrv.ifdistcc.ifdjbdns.ifdkim.ifdmidecode.ifdnsmasq.ifdnssec.ifdnssectrigger.ifdovecot.ifdpkg.ifdrbd.ifdspam.ifentropyd.ifetcd.ifevolution.ifexim.iffail2ban.iffcoe.iffetchmail.iffinger.iffirewalld.iffirewallgui.iffirstboot.iffprintd.iffreeipmi.iffreqset.ifftp.ifgames.ifganesha.ifgatekeeper.ifgdomap.ifgear.ifgeoclue.ifgift.ifgit.ifgitosis.ifglance.ifglusterd.ifgnome.ifgnomeclock.ifgpg.ifgpm.ifgpsd.ifgssproxy.ifguest.ifhadoop.ifhal.ifhddtemp.ifhostapd.ifhowl.ifhsqldb.ifhwloc.ifhypervkvp.ifi18n_input.ificecast.ififplugd.ifimaze.ifinetd.ifinn.ifiodine.ifiotop.ifipa.ifipmievd.ifirc.ifircd.ifirqbalance.ifiscsi.ifisns.ifjabber.ifjava.ifjetty.ifjockey.ifjournalctl.ifkde.ifkdump.ifkdumpgui.ifkeepalived.ifkerberos.ifkerneloops.ifkeyboardd.ifkeystone.ifkismet.ifkmscon.ifksmtuned.ifktalk.ifkudzu.ifl2tp.ifldap.iflightsquid.iflikewise.iflinuxptp.iflircd.iflivecd.iflldpad.ifloadkeys.iflockdev.iflogrotate.iflogwatch.iflpd.iflsm.iflttng-tools.ifmailman.ifmailscanner.ifman2html.ifmandb.ifmcelog.ifmcollective.ifmediawiki.ifmemcached.ifmilter.ifminidlna.ifminissdpd.ifmip6d.ifmirrormanager.ifmock.ifmodemmanager.ifmojomojo.ifmon_statd.ifmongodb.ifmono.ifmonop.ifmotion.ifmozilla.ifmpd.ifmplayer.ifmrtg.ifmta.ifmunin.ifmysql.ifmythtv.ifnaemon.ifnagios.ifnamespace.ifncftool.ifnessus.ifnetworkmanager.ifninfod.ifnis.ifnova.ifnscd.ifnsd.ifnslcd.ifnsplugin.ifntop.ifntp.ifnumad.ifnut.ifnx.ifoav.ifobex.ifoddjob.ifoident.ifopenca.ifopenct.ifopendnssec.ifopenhpi.ifopenhpid.ifopenshift-origin.ifopenshift.ifopensm.ifopenvpn.ifopenvswitch.ifopenwsman.iforacleasm.ifosad.ifpacemaker.ifpads.ifpassenger.ifpcmcia.ifpcp.ifpcscd.ifpegasus.ifperdition.ifpesign.ifpingd.ifpiranha.ifpkcs.ifpki.ifplymouthd.ifpodsleuth.ifpolicykit.ifpolipo.ifportage.ifportmap.ifportreserve.ifportslave.ifpostfix.ifpostfixpolicyd.ifpostgrey.ifppp.ifprelink.ifprelude.ifprivoxy.ifprocmail.ifprosody.ifpsad.ifptchown.ifpublicfile.ifpulseaudio.ifpuppet.ifpwauth.ifpxe.ifpyzor.ifqemu.ifqmail.ifqpid.ifquantum.ifquota.ifrabbitmq.ifradius.ifradvd.ifraid.ifrasdaemon.ifrazor.ifrdisc.ifreadahead.ifrealmd.ifredis.ifremotelogin.ifresmgr.ifrgmanager.ifrhcs.ifrhev.ifrhgb.ifrhnsd.ifrhsmcertd.ifricci.ifrkhunter.ifrlogin.ifrngd.ifrolekit.ifroundup.ifrpc.ifrpcbind.ifrpm.ifrshd.ifrssh.ifrsync.ifrtas.ifrtkit.ifrwho.ifsamba.ifsambagui.ifsamhain.ifsandbox.ifsandboxX.ifsanlock.ifsasl.ifsbd.ifsblim.ifscreen.ifsectoolm.ifsendmail.ifsensord.ifsetroubleshoot.ifsge.ifshorewall.ifshutdown.ifslocate.ifslpd.ifslrnpull.ifsmartmon.ifsmokeping.ifsmoltclient.ifsmsd.ifsmstools.ifsnapper.ifsnmp.ifsnort.ifsosreport.ifsoundserver.ifspamassassin.ifspeech-dispatcher.ifspeedtouch.ifsquid.ifsssd.ifstapserver.ifstunnel.ifsvnserve.ifswift.ifswift_alias.ifsxid.ifsysstat.iftangd.iftargetd.iftcpd.iftcsd.iftelepathy.iftelnet.iftftp.iftgtd.ifthin.ifthumb.ifthunderbird.iftimidity.iftlp.iftmpreaper.iftomcat.iftor.iftransproxy.iftripwire.iftuned.iftvtime.iftzdata.ifucspitcp.ifulogd.ifuml.ifupdfstab.ifuptime.ifusbmodules.ifusbmuxd.ifuserhelper.ifusernetctl.ifuucp.ifuuidd.ifuwimap.ifvarnishd.ifvbetool.ifvdagent.ifvhostmd.ifvirt.ifvlock.ifvmtools.ifvmware.ifvnstatd.ifvpn.ifw3c.ifwatchdog.ifwdmd.ifwebadm.ifwebalizer.ifwine.ifwireshark.ifwm.ifxen.ifxfs.ifxguest.ifxprint.ifxscreensaver.ifyam.ifzabbix.ifzarafa.ifzebra.ifzoneminder.ifzosremote.ifglobal_booleans.xmlglobal_tunables.xmlkernelkernel.xmlcorecommands.ifcorenetwork.ifdevices.ifdomain.iffiles.iffilesystem.ifkernel.ifmcs.ifmls.ifselinux.ifstorage.ifterminal.ifubac.ifunlabelednet.ifrolesroles.xmlauditadm.iflogadm.ifsecadm.ifstaff.ifsysadm.ifsysadm_secadm.ifunconfineduser.ifunprivuser.ifservicesservices.xmlpostgresql.ifssh.ifxserver.ifsupportall_perms.sptdivert.m4file_patterns.sptipc_patterns.sptloadable_module.sptmisc_macros.sptmisc_patterns.sptmls_mcs_macros.sptobj_perm_sets.sptpolicy.dtdsegenxml.pysegenxml.pycsegenxml.pyoundivert.m4systemsystem.xmlapplication.ifauthlogin.ifclock.iffstools.ifgetty.ifhostname.ifhotplug.ifinit.ifipsec.ifiptables.iflibraries.iflocallogin.iflogging.iflvm.ifmiscfiles.ifmodutils.ifmount.ifnetlabel.ifselinuxutil.ifsetrans.ifsysnetwork.ifsystemd.ifudev.ifunconfined.ifuserdomain.ifpolicy.dtdpolicy.xmlinterface_info/usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/html//usr/share/selinux/devel/include//usr/share/selinux/devel/include/admin//usr/share/selinux/devel/include/apps//usr/share/selinux/devel/include/contrib//usr/share/selinux/devel/include/kernel//usr/share/selinux/devel/include/roles//usr/share/selinux/devel/include/services//usr/share/selinux/devel/include/support//usr/share/selinux/devel/include/system//var/lib/sepolgen/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tablescpioxz9noarch-redhat-linux-gnu  directoryASCII textSE Linux policy interface sourceSE Linux policy module sourceHTML document, ASCII textmakefile script, ASCII textC++ source, ASCII textASCII text, with very long linesASCII text, with no line terminatorsPython script, ASCII text executablepython 2.7 byte-compiledXML 1.0 document, ASCII textcannot open (No such file or directory)?`7zXZ !X] crt:bLLl$ *w%c pPV-M'i?pJ[I?9<2+f3/=My;ez21фrE;XvSP6ݠwbvG'ӽZs|l/Ʌp`#<-{`,)sI'wE1Ϭm핊߬ M(ugPmB<`3tϝN-%^ύS H ՞AHaެ0dSr9kTEyxa扄AmM s\(maJUpou#h ݋:ir S<;L/ovӨDOX[_0!<1`5@.}KShː?^[?¥ɽH -~/{,hwa&(PIELvBM%%`n&"ü]A,ci+ 4CC69YH'(T7T}tQ-s$#+4B4Ya <2K"6_'9-1Iݙ300iL@?7"GQ_ TuZ Mƨc&7M>hRTcP u3Fo3}cA>9od$ve"!rGL:Ch>^(T!gS#yT5z_U((HFeh3*ʅ޻ -mWRK~_"th*=/sY&9yb1Y-R{p@(T$u(`*z(ts3ca &b057e9Mrjk*؝[*ӍR҅=JOdFFAK-%_b/n)/^bb y2V] q[s:XVB(ʏ43Gx SL^Ԫ50}6^up܀ǔbf:ڲŊ}>Z[J0JYY+ ~U8LK{ME# ji /Gi +.o[F ̽Aڅ" ImzS2^xv3wvtx}g0+5kb[!:/ c<;5S\tFxqGP3'{a-ǡ7 J&ʁIx]! շٹ't\!('~X BKBû2cVM)p)a!&kq컃 •]F2؊j,)1sN_xj|a (|# Hσ:y_\dxmR*XrVQ zZ*U'G& 7V@1Ju11^aVHl^7[AT YK<(I?1b@ROƠPG|a lɋ?Xj8d9652n] L#>|SΝHBs:wWYd3^f4jj - k.r#cXa8Ï+.> {$Q8+u4 HZ)s7Lhwn"AoqgWKv(ҦdVeEqx?HvP!RQ SV"Drcyİv޷[klL_ΊP%Ď &p}VŲwQSF0㲏 $WCʍP?1 CmpF _yνna"-2U\:/kzXa&L^3> 2> QiLnևC(OFEPjGqR&|3#s5+G5|(UQ/1C \@%99: Qȣ6&UI5«Wxnq;¥Cx;|&1ioK_HuVI\{vĄ-< 8%En<ktK^pP͠=1?g)WvSn52y[nN+\TJ>^NnxJ/eJqKY-n1dL٨Gt0_#~3J z\U`V1 xsm̡ &T _T(q%:"v ^`,RF)`-6@mYsMf"Фt#BGeɀJW2>S;fqi7.B  md^ΈQHa'n:3a!E.q00 AY.y@ԝw \6/FtA((8inmd /zKj/+vԦ Syr)aK⌬nwlnLt;fQŭkD V_ѓ lcXi,)\)pmUM dxf9,/:0PtHG֯[nʒS'&&W9;G+D#% vP- VXY4, my1DqHQ0>fZPd]-" ɌqGhqj\P,MR7O4Ou qyt aơ^00oHcoIT:e^ um回kxM08\vSQ * GyMyPmLTwpg㉗1P\*5y͓yg{<_S Hxƅ4M]Z8T& *LWS it$ ϳ#$$,ĥJ|e0<,FPLn`^yꆩ`ȈcĂwMqV61ЮɡqۑL* )+~] o0wvô ` z!y}Gckce}.A'\bKV{`  1ߒ\[#Ƴ$TGfކ|]g.Z.HOp@ !s01d!y"t #ݒUMA!'OtFLj˨c 4S{}4°HAi =k4ߤxSW>8t{V jv#?R\/;{~r}n ShA]4 &Y+ n YӪ.ݦl1qџ™xGauҺ}َ@Ƀ{A uլ) ה^EC>]V2Э lFeQ=+j&V4j5X]Gk 7J^ܑ?쨭Q;4!%fUb0s,36ldo&&P`)-OgB`YN)$>O{a_k8m*WRgX& fz$2y#S\ͱI<vkEbFt]ɪ{Mէ]uObƚg$.u?~oT3ZH^ (ZKjJ|бφNS3B|jdTN| !:KPtE4;mn{sD(Ls}OV=cQՉ{Ф\lƓ|( Qu;ƗCdJa:ca!bPl6TQLNC~||I֎ʌA--ś$PsB_-.LFfWLh~/HD}a'aTX4 bW nd$e/ۊ}7pF`X@婂:UZyȺ* $+q~_26yl> j<ʠXY#gi+BȎld Q?yzܢl#i_/Fݔ˒jٓ ,8-KGR~6io]  >8`ꮃv>0k:(s1f:9ԋchjdpϟ`=irg*`L oE˓=#5msej OJ A UAȋL U%,.pF @%|AB6ǂsyչS!jG_L>+M2Т;C]x9zAW#"p)srIYt;@kb8Y9݉&LmXN֞ W7CkZéx=HABaILHl±ޙ0˭rP -; 4R>-eYh` ~jZVkY <oA=XE{;T!e.;K?V ]z30M;߸p:mPukS2#whsR6(z4.)A̯.X( 8oU2v|tl#/Lc$Y #ϿJidX-K17e{BR/g@ yn?V=|RBMԧ6lhVg:mCMA/"KmLqr4=[eǁcX`2΃ 9Z ld[;9D jЎ,$=,I{y"q\&]ꗭSd]^ê9pռdBoo=a+55օUӯ6&̪W]͐4*<T T>eՐY< tZ U[%^.$& b3MVփ yӮ/pNԠ,T` \ Q_QKEPZ 3WY<|u/e, T?S³~߽U[;a%Ql[bnk}^DCt~3`.۪󦑹'14$1t| J_YB!P@| }dbjWRY]C&7GP4bl͵NN:%J2tfP=J $~x2&k 9R03)|wF-k9dv65[8J٦_?]SiK,XrWbBX,\&(}~OSjVMcУ"b~H>ycn ro"}d!@c' 7qǛ=q(O1~ H;i# }M#rұ߁U"^_K􍚙r&!!i 5۬=P'ZLۧk 3 nb 6@*hL'ɋ! M6Q/ߵʡT 5gzsdPb1=Dj0eD#/ #;p\*.x 0'YoR^HǷx`f\vV)gʂ.&>rBml #؄){uRV9myMϥ@]U,2ډeElmHڟ1|LA?>T{Z:PKFa;UN 3%U⁗Iaͱ |.!Nƍ`PwFEg~ǭ"HW?0ϥK8i5Lr)>(;Ƈsl,54lOücc|BX"nQip8X۟(}ؔ`97gŸKVY7y {5)η\M|̦t,b75+4muۻc_chb*uVu˃Pv_J 3Qی4lNΊu>AU?aOZ,r *\5u)ߩ2.zHcqb]+7l8']U&uIVD0G8ww?g2}>7g-`-n(v)Z0@/^袡TV$@eq/=PR>'l 1) PG9-G\ϝ>)ǍC oO6\K]91p6(%l^*]uGO:POsezh%eLTY((!͹`x~t;{ 9Exc=u!s&J;R8ǼX,a>꒩n*vh=0QӓV-^"%<ֆXȜ6ḓ^G\]G-5ikN:\7 *VBkndkgO:M3 \&]M]UƠ#~愍c֨=F^ WK<F0zihc3[ tߪ^7s1cUyhHwm?hGL>%аY[٬)=(:YbW5 dnqũcP]`+?dsS9uOR"7=4IP6z!a ;P/>9*ґB~M꾩ݨZ~95h{V<6JoQ[C{ ֕.RVШf#RMY+ 6|6'CчtUk_ͬ[Z|7r܀y-爭]̉4.x ^A|[tg͛^jɅH9ÍtdnWvBZ]MLQL^pIrp\7/Z׻ن!mӺ}#@~ZJt@!>gSn=K*7_ޭ֎)4Z-3e4RA/|G8ߗ/EEO׍Rr^,䷳ȅ{LqV%s0aI2ՐX.'gmEkA4Rz RĨ0*DaPBNۃiZԠ@2e[;,fHRuݥ*DrW@]4;|^-钴 RW߶XѲ,:Z2ilw>АxQ#ө!kB:uPOXKf%ӎt̾և{ ER5S)hʌ?,؎lh{gFLp?X=s;~_gB dVk Ĉ@-o_OO6kC&j[:yDOU2ݗ{R\9j^ZK/hf-ǓA&ZQ%:.uAL.b `J[@uey5v&Dz]( v-nv^fzPWd+~K,|nd($t sЯ{l0E}Ov1;˺'a|yxg"iñ8QN17wAom VJg#wt 8FT>fB]o0ETJq-WÿO;tR 0 9t:sIp017ڗV'{u]Yy$ыjTڅItѵ^j u!^&Vw۵ڷ3q>z| z5e>.vBKB5EhyQPI}̤?~ǹfŻ@K33ķhw!Y6 -r<^/΁ntbn@l A.YJXMgqf4NG(thv~ }KV+%n@qVῺɍqBfכINr xќUcgӛ/@PMjn1sEmw=дSB}F<-L8BaU窧AT_F;)+JyG1_+}6x~f8e!1:7\wuT{m9K*&vŎ Af}!L%|pho^vƣd7Ho^%łOQz!z]4+wǫ;)ekwĚONsx/=;ot\tPiv lmaЄM_Y_BM:Sompe[ɸ2DfCIiNwaUkv>)IIqsChC[d^:/'_6~G>Y}:yk:+o??^+k׋Zjy i9C/@wmv[T.-Dl0~>L=աQ*!D$WAB5U+MN3h? Lپjdv}\1oB`΍lٺx:E|]R W#ͦ=&1 HVsw/|- CYsASݸ&mPjk_ybrOjKE6`*΄FWz2^(?P^/x Âkfs |LJbfE:/sBeb)D"jRIv~BOao^#)_AMvdXnki6wH 'Rv ߤ0?4MyuC',-Cm[CPgfKD#!j.Ea<|XNi)*h%Әv^mMga$tҭ2:XLiXC9JŒQ׬V\-q<6anbmF j+áI(. qcX-(YuSUv鳨M6t8KE-"ɱ>5=LDǡ: o ~[V׶Cc5-4qJ=b9Z~%ʘ&o9&inߢBxG1C5%{yLX%-d~@lB۩gar]91{\ P)R-9[}g͟Vx:4hY SJ`NFnGz(S =(n芼 ?xHȣ`J<ϗz:ᓈu`ŧ>` ywDi%fjt=mw 3u1PIRy+f|%@o˙> ִdVt"D*Je*MD@Z̗;1ot}uO q !rLyBܽ2t<9Sn lLHMFspw*O7:5ݥB!c:럛-X{$rLdXK? >s;(4ˆ|^+Ko>s*5<ٖQ9I4{/*Ӎ} HYvar[r-'*)S7`1`vS 6=Ig#ufaꛁVvRo̘; \Lȑͧbcx?-Yi> Ф0H/iܧ{CnvOotRz{ߨ*J0 ?d #%uJ 8)ϝIWyG~ķNj'nlE/Q_wj?V0N1Aǫ񴜟AxT{؍LTdFA]`jՐrelݫ mv3YY8 ;YRjg2!C ޒS)R7 >ޮxP N._Qذ)hd;;*N3晰U˥Ϫ=kن޺& {Q\#HH* t cj<$SYox"Wa ˥QHsIssfyNv=CRQ9p2AS&Š6\Hgm4'BUL[ N8.+lg\$Qce~V%hwN).j Ld+tUUM~RA@];WKζ ҳsR.p̂9r1-PtE^#4cn(g挧Cؗ_L/ؕ}a7 {U8x,P+5@MUЮBm`( &ॖ҇QjAb!6> {NHӶTWuw"㡃R&<¶Oq ( Z ufn)#z#Bp3[XiZϼO0!Y+lXbeYP)j$+hn J'BOk?Zy;bz:ЏW-=G5n(}Dj8JgxoK *k1MJ]jEGx Y᧕g⭰"ךVR5)7SKeMhY aFRN{Is,x{qPk_ 8ʿB>J%d|YX֮ s\Pj3J֦Կ$>xwYU@:7Q%ޘoj'\.-58otpKtE0!jQ厗6Ą w%hBh(Gݺ.bZ[b` uOgٓDsO,m$ʼbڼel&JDh1#7;pڊw2Ja[3% QR 7B Mԯg7S$bڼFR6]fk rj1Wu` ! HXѧ=4G#,g![,Yr]3O;G|U;JЀ _]nD\_hf Ho7ihȩm- M$vcz1 3L,(\ B,O+&6;%2Pc?ӱtwr-CϿ7?NEyj YKe3z-P$i1;(nhkKAvvɰ)eKt/T<' 8ؙ_v@$;FPJ1%Y2iK_Aת/g LUD>@uaS™ 8)Kurb8QiEt]S0tK,Mz?=w򗓲e ʦN5t=" 8$}W!<@9,E ƁYIye$o'eFT+ 5Kg Q!AV"z_Ԛ>Ϫ1VX9޵ђa jiX ^Zu Jv.lw9۲³| _3/JM[]*lkPM\HwJ{jڞ(S*EB.37Np=J7u2QٜbfIk,L2qyQ4@]ϧ@YH`R[z1hۢ:PM؂L]31l2Vnk#M,sL]*+g]1&9{Y!!Ke(ig=G ^bR^EoES[ m@X6#䬙> YF.VݴopzRP$?'Xe{NfUg1P+ܬ mKiV7L:%]sy+|n"鿡VACmHoM-OzQKY"yJ.P\Lg+Hw扁'y` mȸCfH5UTi挰\cм/B^?sz/ĸ.xam/іL(foJpg_$g3;ƌ=q}6ɨ*GuZp.u:Hlcз~p%]n$^4L$g-DZsU Fv}b@"6]9塹ʩ}Y?/O5;pÒrpQq,pS. $;D=ڷdC(oFpC}{vUýf#0rدҀīE4WEpI5v OK4t{P3P;%Q+(S,Zʖ@0{#tlU9宲s=o?\2ֳIJK>umN$*}..C{SF>cfJB\,:+1e#D<ˍujaǡsMu_DPyAB4E}iA柨$^[۾xn9 uX)wzUINBn|l55Dmq'OqG/Lۇ OgsNG(\7\sp.5Hߞ!yӱGŎo@țݚbsktU|3&;gdS ;#N>M~S"hQ:$xq$̒c%o2mwެ$r|s\\Ooq3_e`, ᚿw1%`.ca !VD.N!js:hSkk ,HSw"*f|gR[m5g/c^w^:T_ht2Ғܧs?$9x #\RaZܐ UwHwS=|GZ1Ώr ELN9׭RYސX%C0{50$NMM\P]k/[|lX QwxhBjuE4M>jG=~uz \BMN^At%ЍNz۴IV0/ov8e(n-aGfct9_ Y`ܠ% Z|`z½-he_>aD\L[=.ĵCWec:2_5zy2k^ҒQL݆^j[\@O(/k/fŦl5`%6u[.L EqGK.Oϫy~O@QI6~7uRj'u?oﾝXyincs٥ cQ|_ħJY&2W= moЌqKvd !:~I? ʙgm!tU7F*na>~꣪5ɂwW2sGwN#׿bV l)gΪ@=_3T$AbQ#^rY C-c-}my7Q8`Wlae*$Iq0cgqi>j>:<Ddy|>g1y;i_簒ܲcwBځoP~n A<GEGblL =nԷj'Ë́'jkvM(2egk)|}N\22wZ'*Gw"%0z lL!AGb5:6Bag(z.R,W d;w;׹NXANrbؘr{<Ћy>.|V-1S-MQ e<$]߱_ yŊPS+h8|>"#ݾ xzkϸdmЎL#~-.VT.fݝ)w c&FpXtې%ʲjHcFV8;{ˋFֳuDg˔+1{T6LKAhL>JSnyȅp{d4:߷_+[B쥴z,pw䘚3ggGF?_qKM&߆/^ 6gg~z.6v W9>XH}nɼ }E0iq29HQJ1b~U%)֑<*$^3kU) _^Wr@%7AI0eu@maǸ+`{x z!HBջʮ{`抢}Jb|Ows;\F6l +ӌ3L5X¾ ©|){q}E7vC`>l?跤r>sF-g}DWK(44|. aNVHKrIx_Ӛ W|˪p8{p 4:9h./%DE/ܨ7B…l E:<3ܑ].E^c&9" *ua*r}ȼ᫾gmJ@CFaĕ=X @Ru[ +~.UfXD}3]yU'd `i ],v xpgqM8n;XqNC@ԙYab'<ҭPVthYغc%&'  jE[YI ug۸SkqSYg+0)[*A3Pvni7M+DCuEUql%^L')XTT&2sZ"^@#)3XZ DwF= Iw!LFg^>9Ï"G,nhŽܖ\(y<G!h:Uﻴ)8n{;m:.G#jD ea4e6K~7"gG8 u1 n(l<,5!r+p/BmZx1ǬnsoKxJ}b|_il\ 2|P^>}>q*IOg;ˇ$(e5.hX1đZI`B]jzAS6_KFBhf UxRסJpb\ Ymsb *ChlQ-m1p [HZeƗ7(8HD4o;< '25`ad@M5NO0V(6LN{Qs3e?Ak uHJ?F_?d mVRe*!Ɯ =o^Jy-o+NL 70U+k-.lzĽ0B(".*,734{#c89&/6q>^j"X0n9b]*j&aRt`;.y s w'MM;R=EI7o7ث4 g%򬖺XZ'LZ}T |A%TJDlVJ?z&K:|AYؔ%h^`e,-OPqβBS?aDAB}mY^P="@#\8g텶pi$ WR+['+ɣx5.]mv\6bg}͗Uf9&T ?($X!b>YN9!]̹GLR(QcCύqQe)TZ%LaEl8F_!:<=6M \b~3s&jMFJ\FDmF'YW%xO3zʐ1f-Ј&Q3*4P1h&mz*j3; +B5EO򫝯gD1_ ="޸*J+B0@Kr68P_+csF+(. Ē/` HD%gG jFzyKw4LW `Oh'eBFCNδߣ9WZwScB+۶Db_s'AԽ W7:3@Q+8NwMmh O0ܠf0MU'~8J.>z脬,8 N5nD@g;kOŰOH9s $ơK{:t>|3Kl89h(tTzEbRy!s#|Z$AX: ޼YnB3],iQ7R%0IM&+D{$Secp^p/AoW`TXT\/'ئTW`+`O#@HqJG)A}K-fkԨgr褸0v=8~A Wip;<׀;RR q>>x-@ی6DGSżcNW)|\GAS X"D0#O,2q68ŻR]`Mtzˠƶ0[xgZ{1 tȉOv76: 68 G<3 *%o<3}}o:M$fRg`,onĂYL&v|yu4O~yKW1 $?8Q9-РkKgdn1( 4]%#/4B\{D*Bͧ)Lt,Jf`d< ;q?[Ϸ?dI ]Gtqeބs,y+)UJF1l<~ޒqXe54B eIkRO=.a0 mm$' 'VIlo˺[w==Ů~^$flCap-A"cQp8E e/|RG E?!%.I5}(xd?Rpɬ ;^<>19 X|䊡ȥIbO`PRp!-Oh/W/%Ff,v4Tnx|Z舭R+tY.0bz;©B@aYFSR X>g 桜U_s[?S*svϓ8"PpB廀Q'q`-jpΗփش0S[#aZ6 Yrop㺌MSJ8JbN.ӷ؜&b LM*?,uWΤ-qzaشr1-]orvP7( v6>J6D*R1'y%QTwg3\zPM%0M]Zc8W < XVQ󍕜=7&0N^cPoP Ҁ_XL/KXg."SJϚ0aQ%HyJ{#%a $䷗`ÞalNU01Rݲ:4NA5-8sCwd _K1vG[-]cVDם;#՜ ?g %0_zp{ ko ܭ/8MʬNfؔw( TTNf-꽻ARji|0/tESrąsUZUKNӇgۙཿ^s û*XØXU3"SޔKZK pM:6a0&\>/5ɣ4{ |,A2;=q\*1g)R7sW߿wvF#O#pU=*dJҨj Q~PXsVnNW?11t* iB+i=gߊ:wzTV|j*%mF0ƺ psmeEj3"(\6\qC`5.?&-8f:9(0F98yV]jq̂5qF|;C3hA.*[@C#0m 3"aGDg*ZK]y 񭛎l8$.:j#cQl AW&څ`XĠN+ g ȶ"hD趞G.eZ܄:m? ` Ըc8p=4}sQ"XIoeh1\Iӑ>³\.ʔm0ĥpB&s=-SIt]-HB)k_d|ijY'`/}ڥ:(rM:]Xv7d+epp ASD M(rB3R8io6&5Sy^VKQmQU쬫LEcF+vaYt#vy͊2+m<  s;09|gXZp~3DJLZv& ~sXDA"F+QHr{B@N)Ҽ =Xi&Zq;SDͥ~y]bӁ=nyjޕ OaPGvqډOBW#ݓ5뉗Nx=z -:jR,1-˿#]0Y9aF7R<'M:%ZʛNUdTfEf"+ -ۇt c/dpEf6ߕ"{ [9͸ `YYZK_&,aZ ^|@J,=.Ha>aNJ[pɢi^Ēw1B} a F*p<㇬Djv j0 q[je)7⸿T; JPC[̦xZ4TZ$rA9Ti;AjְV@ ,JX\xk%RYʀpʧ3eXB|TsY/J Dlw^/w]Q2SSWvV,1ڮ56x 6\WH[K͍mTlCYf.|?@ 0C΂-Kbww%yo9rj/?qd|rRYtY6xi:F ~lg޶ÍFEaZ Vf}QCFGA.^ҋ$Oj]̎*h/`R<53})t{PN"T"Ó'5LԐ!铽=9a1i?wEAoATwuHG:ŀKPvR"'4aa^%:~cm%VI!c dCf֕ͨ%Rv%rMsݍ8ˍ2y|9@\#(Re$wu3ڱTb~j?l-|A%}5 `p?"'|G)ǘc:),@N/s[tNMGpk+W)[JJˍlBU>|5(7˙C!rP @cjH<1M-WDo')ڧax)-'g 6&k Rfh ʞ6ALv˕ ˓=x=}q#5ikrk>)1 uTYWd_*@|bue ,FD<#ʡdCl~#S{eqvlI%%oJ} ݲoZENj~>εNt=\Hȵ+n'9Rm>$$W7L'5 @Y{)u<:ǞV p8 hk;> -4ڏ@&?@.+ ^6CՏc,)TD߰WI/Gdh ʜj!Dm̋cYQ,4A\2]t\KP)a/cK!K,ZUղ~u]+Snʠqv#D.o\E4/3 . unXZ/\%^fG#p>a`y&ǭ+[Pwv #3}3aCB*P8ӽ?8B 4.Ff\dYyOO{;*$ _]ȧPjUr}iV?7[@3iXg|B˘üs_lh1O ]9K=q1iAdr &/nWXfb6oe !nm$MU*OQPEO41hLwzQ,ڛ,#3h~X!8riaamH)?$"e7op7+"&s9UƩ.6ǫǾu阽nDS '*pZa~DŽ;BER%rE'']v-|EW[ʠxNiA RgSd.,:Zڴ߁~ӃWkD آY[}  h1D y_mKq;#Kxu WV!<@+[/R:(xXǨ:&MVuK ebnX ʍoP^佲J joM(79Xo$Aۃ؉^E9"QN&ҡiw3dMA(L8aZ{" @Cd"#S6_,(+CBPǡ4e2CAIQnXt|l.9wSO+§S{W3T:Iriawnݶx5GA5NOӃ,D:^ 5ugGx=Dl;AdBzIm^Cb>stv+N7BnFC9,`.?fv-b̓Dg~*v\&{ۛ{ QkxjNs9a C#kuB# в4/Ι)B-Gx_@S$xmgi`wF,R`^mܮegD**\JjwlKPj 6X%2*t}$LF:$~xжCzتH;ҫW>!8 : |_ЏgaX9+j\yӞm ?Z%4J 9R ak~d2q?[rU4o^ h5oU4%^tiER hg,MX:D5䃈2@%OXM>N]xa2t*?F`8x󕆓CzK qtм%Rp T%qOFHOF5QDnЯkS8!6;d 9Yx,٬?e/K7> Ajݟ-@0hճs>\Ut\A'KSCf{z"Tpa!nyd}(D;鏯G#eb$Z\ 74~~xkMlNqb P};{t' ׂwxn3/eq@8s\ۧ,tiJ? $iN5SiA[yd/é֊#ۦr%G4L8 %_Gt|1UpbuRg$.9n *;·fg#\1֠#MR#@.AH\P40}½հ5n LQ|B(Ya* D5zڵ5R#ҟxVRG8 cW>MEiT-XdZA糽SiE Y\3w0dm4|62Q8?E*kUIUccL},mSκURwys+ ^O|ͯ[ sA [rzT~kH+RϾ̱%ܝ!N +<7/"9QPmLI8x[ڼxZs߬9 q +&껹3uaOvߦFՊh8D qo8[қ!$ۃBF*LC͈=Cͦ0Z&**ew-k @`NX׃/7d8LcwiD)# Z1Pw+.WH/ea^YͬA^膊<߮(b(#X7aBo% ~RHOA(gs; 8@AVW&\1y!ҹQHM^7A%̃bC@p $CI euBńYyb}簎)9]@NAEQ< 4ڬ#ö7~_iPUӁZ6]M$)a4~*{@ aWj1Vz=F4z_-G?ry-룘drggA3`VN/d[1sԄ!A |O#&դ2&Q_8 3ޠ9Zc` WI=Or*SkU Zq5D@;e٭:*ʔLB_u ֹ{5͘7HkиY;: /w7C&(}'Cz+g KMv(1*dS~Avʹƣ>ҭS;3w51+fCJ&0 zA)};I۔rr QAh/">tL =dC6`0pZ<26Q" H½iǞ ѦYo7r'"-Zٲ]Cx(I:q4ĐWEJ$Iגul?gHR FN|X zӝEeH5pJ|J%z5YbÙmd*ln(e\-{5&D!9kR=Z U,eN=,A)̢Wty+~W 9{`ې(whQR7oFIޣsn@Rj4ܺឈˑ,6G-M;DoK YP@~*= [/?VܐSgɧ ? :ѯM|i4;WL.^R\^-Yl&/׊`Xh$-`$kJ«|g&Nj7=(?ЪgםD`lO ΰbN!o'$;SqiDb =(nkT1#LAdazTUc! ڡC Ba ^ 1V69bK֘bl!#lXQ<tIPӐAka 鴒5kcڄ #AQ:YC$ iwMt ؑA|6RO_Ғ(TGgT%O(?~5-rvʌ:6EؾƪńO3Y9tƵxV+#ZdR(@":m59Hߺ{NaQgde/`|j(M8#W{*|)wk,%,JV]n9x18&(3EB2EXoD%Е0DVO;-Ah53A{=|TG%@q s%R'hUa7PZou7Ba\(Qቒxu+RUtǺvV_Lqc |; UXpNk?pa ]-.c~?eJ۫fAęGyQ?#,&i5ei#1|Oh RV;f#[PY V "&-fo%@o!l^; LɺSFG} ;ia}\ ׾f GP䚠jsc>~ ~bcG dV"oR0+=t1O,9GPU˄Q\A2Tl wVcbșrB[ڦX, vw[+:e!uٶȒgY5Eon9r^῿SƀgeU; 6$0C5D@jBgѹZf2b$LLX]h)3%a0./I> 킶kX]bϾDlk Yw?sZq?_FjF=2^61wWҳ[-o1caWv;7 ACv' Fbk Ou3CIߜwOj KsEi)Qr1oPO$ 6? .C(IOt! 1;-ma`K66--ui25 R%}!1-8] <] K_eCC"3Ah p|#o=ƍ`% Hcqtf̥{0Ȇ0*BDM}u&uC'" ~&ӬyRju j=:YL̈́$WzTI.4`T# y'볥oĿhpX{8݅ʴ~}-$p.PA[sX|< 8k/: SG8=[jIo-f(g]^!/ÞۢpR,ڹ&%nd?p3kqKo"DaY6r;k0}ufO~IUHa!Yhm7Kik dCJF mSPBeٷ/="ehQ^CbʴYq>Qw6Czp+E)%F,45mExpuo}@>ay8/@!Ur91?hGݍU']Zm7A$lU D[vO)s#ؽ%ҧ^ϷP12],c= >}CuK|3\xɍwl%܏~!p~Hj2 ӟg_LMZ0h]JUkᦝf9.2(tXt$5@:KZ?4b?WS/Rۓm#P#}je'r=¢tՀX_渭ܟhm2~*+mM0;j\6ˆbamd0!"%RH JզOpMgħmw]p0/3iGОI Fv!xN3%H:9I*xBL#%P>^aPl\M!FoI S5D pk>@UMWyc3&^uS'@iIWw2<*/EVN̨WxZ6U@8Cyt۔ix]}K/5ZDpi־uhՕw䜿bϑViabܠWK+Ӗ-νdi[*4XSSC5L\,aoT8`'#~;`!1b܄nR# M=sƼ!̻Ow)&w~lqcNzT0v?'?#]M!)2cW7XOK8ue㰍.4ON{gf~\ѹ'8"0(PMm> ҿFN٫z> k9FMeA4yRvk'gm~ ymN #̃>Mg5R2P Tq+;9oZsU|p'H7al13i,)~Fw/d1tڧ]6jxFk\Np3_ia7D}z4.ښ2E`P iB++0C9zBo;bEw; BҷJGo:yW^4yr ߜyYJ཮#ꯒ~4tہDՌ'#cj%sx6URM@l3aߠ*YEn(%~4oqW5B}!%,3τ[@a4ϕNCsC˯M5 ʻޟe"l7Gg_n,20pޟj5S<ٌdbZYEp>|vhϧ4O@N՞'PIUΝd-S/+bѻGƫbL?G۔˝v倪5m pO|[Gk /)F:CZ; S?rArK- 4eyA%YI;v]"m[!5=GR[m(KR&.L( CKޣcʶ;[}ge2#~ܔhI /i Q{s.hz1$ -|UR x hc5N^T=I@2lT+ah5Y92F֑d|-H`"5sxPw5jZMucT r'%gB%C%\/M~}g{xfR :|WwtK.Tpnp .@b"3]S繷ѽ Fqi޴GJuIUr4;I tQ_]d aXh?:nr=k;JuLwTn8I}_7 YoiRl `.ɗcHH@i=Ϲ 'arn=grV|E!|L!m[rjmҗ.<pru ONADvj 0c@I9~N:>.FU;Lˠ٫1l G-|~y c|0$.I*4CfB W+XR$ 5JE)f|9AOo] T|V.:|DY}7Sa6BwTuADNi#'+|cg$j Iğ;l"l!e37-5Wj_˒> 4 e 339K2w5OV:Hg\XAad O,Au5*f3 ZҕaוC\m)>5^@3s]hѷuM}/m?F&f U;VǮ3brȘLoClj69f h-c׵joB"'hQ̯;3\(RBTɑƘOE`1nV GX#Jֺ~.lE.Q@jM="ҎVY{#rfzjk5#  T|fXHv¥$}2ۖc5/kK#ߙV:E  I)kLDHa(B*1xiMh_q "5.xRC*htzeOdg|bͲ5y~1&䷌l  x0Qf C`HCz\\n1[A m7IDF+7(\X-7"2d _ށe2["X#EѸ5]r3ы$ΗE Uk ~T'<`;33qX#%I3TcOhl'S{ATd4~53M0VD^fq+ 1_l[!KY jF>_k.j/Q%v]crew*,êW>^qT_wVFȴ qt=~ޱIa YQ2 4a+ jG-;,_[3w%7xBHvLIb;;Yl [ׅ :O CyF0Ṫ3Pr߽΅q'J3[w}>mu_AyE6ȪO2կ`ybK!Oo, @RJ q&_l)$ET@Z?ݚPb64?뺻꺌I>A j%(}6q%vuD)q!@IВ W++uvH|#WbLф" P!@N2C79Q^F=/=ӽx2吻P-O)9zC10lN$ "B=5f^AcFqdPBޏ`\Q4`QB 03vaYQ)|B -!qzl<!T1o0N8Sc,|>)Gܟ{/?)Sp%v|yw}q|^jA%N{Jd1>">ǥ Ţ0U`>۱PS1'jӒ->?"~WB[n&ki'-+ugP~V/ƘfЯY P2. W b>h6,>CUh8H`K_4NJ6ǯtb5*<, +ӏӀO$ QC5k#:(rV8tγ-:}.+3(Q YU=oozIE{-;'i .o,o-Hv Eoޛ pM~)L*OZ T:%9E> =J_B22խ`57;( I??C ^q/\"G :nM6A'Qd1sEI&S<^=L8LS_po~ew'[tiW0/CTFk{c ?:yZOEF>gߗ 95|^#ts hKVY}&xf',TgICs@&n"}8>R$O+^ԞF2aktNU0p%XR%|겙O?"o Vbk@:8g0e۳{mY !C%3x؜/,Gb(Xlu2?=` 2qVUlױT1y,b6=J-Oa_ةՔ$elZ2BZ+47mj/ ŕ-(nN@Y$r0~`4Qs%t _V 6QI/G-)M8z0ˀp92ÎKz PuikuJ﬽)LEYZtZkΩfSMrH)%̕$ɠ 5i͎FS)<*+YGg>UcFV%*gիV^Qx.pPkG2,Qh-ֵ1R<7e[J#Jw7n9רВAw#Nsxr%ɡ`Ss7:Q 1u)3XU;M5ǃ{VhXN?K C癯-ޔzF|zIR|<,ä¡[*d_oLo HFI'ܿvX٦1pjl{ QXt#+$l܃`Rg61@/?w<!fҶIb +HoiiNH9QM@L__`}~FS7]WG 4'3c/ZRJ>M PuD֬Tdp¶@_3'0*gH,|tC Yp90Rl9V|jBC+5}1OQLfA\x 0Q72u Wx2oޒ2 !I +:VfrFO?_ ȋQ$:Cd_%[jEBZ_Z Hb+OA fl'dҗESdjAeY9>|CG ,~D*!7m[Rd-2myA^k2OJ e)J ;԰~Ƀf>P y>&C"lr;@V2L;$vZhל.VDO >*!}f9ܨ;OL{JgτO:@_+sUv}l2Nߏs(ΥWv&5&z+$ZJܢd}"%$›Db3hlN'/|gz-Mm\cwZ%}b4 iʋ`nV{Ak 9Mp(P{Wf6ßLan"]xC3#kFG*0ހț\:9KUO *Ψ`bh&Z#iV_0tQ:&%[0[N)wlQ6p]&_<{2ݼGtoZ]P(Q'&G%!Iz.Zg4]OdVS~j^P0%Ifl:~ky♍?}2OҞȎꍍƏNOQȫ,=&AsKH0g;W -!UA }^(NgHx9GzZR2Lv7CP,FA,(\%unTY~ caYݨf{Cj#?NvWjɬ(ǯ308yWTeVyߗO3߄J]#A|[?ri@Zi}F}0I+7Q;U,BIst>H$ܸ0+&"a@{H.J4y;5IWFR.=z1d#P7~ڱŕmNq0/V 84˻-l' 5BIDrGu6ff8H1B&n3Gďԡ["?bX]e"f7ވaQ}D"l ^WпU`KI$,AW`1=lz(7z1*Q'.hH'0xTo"+^, W`WkPU a >U v~9Q50V K~1-uK79Ҕ7SZy8qb*g֮R` )"ް |7|g&6%4={.i l:+#@ 53>Vc:Rraf!\bb S8((xS"~kx'{Wne0SLZcEA s$w]PFKpm QniR,pASv1\qQN AbM l!*j{$ {et(z)p=) ۗZ+(ꈱHA; an oe\P&DGc;ter[)Fhu.SO+>R1L i[ʐ,4Q|M`}$}2A8b⬖Y8Mq`n5lڑ5WH?LB%3=E~yyU~^>|)yw*&Kz1O_Ğ s K"S^ 8Flv)OVQu%EHicC3dH+%`R( +|$gɍU+d~QT7W=6`ks눞8M2/,w.@`#Yi9dfwBCK4fJGtq HTLZ ه< K~lK>Yo @Tl0>5u-گ8褮!4cH,7)v$uucLU _0Zo3;? /@"<%x+F[OVDڰtGG^|ʬpt򒨳֊1Mt6JFr@}1ND< OłD[k{έ&WAwD-#We~+TKd}>3rI߄!93@Ht;KC_%{}Zح]';雪TyD.Gq*ڂtepLP,Kͼ]L"_ fp-gR`_1pиn_V!ee x/.p'v R߮p|q.߆~pdx@Y@O)doxwPGK0nO sӍ}SR$'g4Of|PN9A/\({ y B2k1f1oT-p-Dz : D7'OQ?OD2P}Kd;Yt>f xbJw9g]a >((ȑ, v I ىT54.l!G4Ԉpnŷk.yj&_ |q8FpV;)2q6qUCʐ創b'7(L=͵6>DhPCA;ʕflH}oSI:L<*88y:*ٹrb.䦵c,"=N%LZ84< [%*xPkr6` C*O;TSD+VoeO`,brEKnbNKS0cd>M` pAlC.# P ]ǎ*80P`pw"D0+@3! {Ur'!ID wdk dHROң!@/%|L8t!N Nbi؇g[.tdUՓa穑g 8߱*7ҔRs)e & ?zn:ZF P2*Gԩ4ox{<{)Z? wW7iE'FpPBߏeTV~@ĝC]6AG >IJ 4]Uzfz@UZˬj+AaZ|q*ٽќKxTj;g XEl%9N4c+ADڍ#- Oy2#sY B`j_l(Wp%%<!0@iJQHY;PΩ@C֜?; _ldwՕs8Nx``);y.h96ӒBߜ>3Pdʹ opNNo47q1.g:=n.@i酮 {_,dBS73u =1<8#ۀcTT|܇(,9yd<7e9e y-ՌsLR j>/qC} fkFn%Yr{,yCXERȁ{YoNQ0hΒ!~~;qL k9&#%N}=&u'90tqR9DF6O9cBզ_|o2Cz!pxth"&Rŝޣ otp5Ÿّ2m8JrHBGP_;cS't"M.ܪ;>s08ch t"ΦN@!a0 q8!;!Z* ^)AlrV$37rMI|?/tA$. MhY1'f?E|^U.!w*YicYSA\!LplLk'*/,?e d9G-GSqm Wʵtŝ3fAc,jg'z0 {?A$6f{ #])jS7R$o.xHAFc%,%JvS}iO#MSqSl\#y9w%)3=^aS]4݊e6k+eEݘa$v̈|3٥`Q_"e8o1Qb0c}42B!ZN3aۛz}J̉iיJYCl~A6PQ&ÒU[g̓A_r'*F&ن%$)q6kʮ7<|W)8]<'8[ͼ:(g  W")` eMj~.DwFdΥN fl^3d~+c>B|=?X$\V R8*nݟbL-{۰v-g̰'eNtz xd9oƌnx1ds;$!l^Ǜ,C$n5B?n_0+XDI,=IfZ^RC!nbӾh+puFn3,tG~n+^$y9`*e 4bL񾤃W$ {8GIDUD_KEψNl4$b0?)dpfV~3γ; N@$y?MrhjQA(ie |ԔZ½Djzk#e_"_5IG(7M-4WpЍ/Br}7jc3 :bõ+~7-3 jPbz@v%e\\;vG KE*<8 c9klPk6 snCX΢8˶9k\+@ͼXlαi;&gNLMժu+P9a`8J8ԊSLepȉ2γ k0)5 Ǡy?qM%:M˻WX+uTv\% *lE/e-yW[nEҒpjџ˷Q'|tJAMJ6j!WpX3Z b>?~ 7&N4l1 ,E -OY;Kj-kAg)$8t'bur+ 0yq#yS/DCn2rZ,<@s-\ޚ[_RN&̌-PgO+D;2$CqLGZFM熅Z]@霡PS]m0Qkevm%rWZ ڀiU>` Az3򆠣u4<\U썥o3a*Ԛn)=hNV9mC*y+/[8 B~܃K8NYmH:H)(nW+tϼ{(~2gk ΄[cD9*؆ۄ <'#h1Ƅ0N9|o>)_x<ڿi8 1Mz *.:(vH" qP?]mU! ]d<ĮeZV}^2 Q?brSEB~oT8Ch lB:N tx%DiOeQzpVA^@6R5Vz /5K;SW$V6Y1 zA9]GzX-%NFB*L,Hs1T)8ߵ$ID$M'%tvYǃ(\T G]]G@ܲ-3,QԸ)2uaFd[{{Pxo>k/ ]+AIG~ؖz݈I34Iߡ9U~  /C-Ze$lq`O2s&mOZFih6^/ .;a׽~ΦyE?FYM!#TT#~KAV ݶtB$p ݾ)RM7-XzT'JL,"||NO+s9j.B=| uI׏RA[i3R+kS"=pfPձQkzN<4ګ}aRN,'5:@{s|Etq^^% x̩\\ 5fZ+Ɇs9Gus㼕jsz )Mѝ&j"[/ue \~(:k5j3]]$eDjkJ+TuP`nwb%3ZF;:2 ~N>Ua?o2c$Ik=X׌|.j>z5g_$0;BT3Lqh)TJ0YZHEAu Br"B-@;W[vp0ڮ_|Hڥjf_u!Ku7k$I#:t3/m0 :w~bnDX-,]4V^XLpIlIju$+rq.ij]0ТDa!U:(  ;4C޶eO#,Ȧ|k:7e k8#0W&΍i0(oÃɪp.Ks$RKrR?C\o_ϵf |fk/F\u%XeS쯥٬_G`G 2P3v)I%^]#{{"a0YSE;‡Cf$KCʋ&yH929_'!mx %kb48&5wt5ݤ̪.X ,0?DRy&J-0xl6"8wIG80|-*%{ֹcKU#-!f2V;GF5Cz+XYegiܸP7khXCک寥_FG?]ۉ3W;:_Kb27끌d!3S'O 憓;P"p&T?\PDBgJ/l{+cE v `:C~zpvdbwKJ˝<w>2 Uf)Iwz7X&eCI})96a{R>$꥗KԨͤ˫eePEzzw߀պI7*8r6jU Ă2oCc=hr6K}煮XZF4W3!{_mv' ekC -KV犡}.p:tfᘒ $ifx;R QE.0IQP =J%bdÒR YN|{?98j`&'@"'3JEӗXg\ Zu㵙$(6RxCrf=#DM%$K4Mo,SC 3esH<.ВWPi >/q{6R_iXD^r*AE`671Evuo)ÎR mωcS[]FGB+i'rUGV-|myfy% FPHk>u`kO$ on|pv8>*d90 :XEa~xXm$gB^ʍԄQXr90S< 6qI~alUYG\\Ӱ;(WNAi{(,=^7Z*KⓐKgK{rв\irRGUd^]zN/"Je$Ƭ=em jA TC0*E8^"|kXO"q _`^lbcAY`lz˝&t_fN=}l2AX&O\@Ez).KB,'vO2Jv `)↧hLl KZu<^E$EZ(#'_Mqӳl;'T3rvN,@q:?XCIb9eT 6$א5%$Vs;ɘ/ק5Y:X^"9,z #KzQ8PZ\N.37t5ptCƱ-P1y ~adMuI fmLy@|"~a\l]9_CرS$}[9½ E?G:ym3c}nLrRMě395*O;r\d兆,we5jn w̧ ʀ{><3<|Re{67ԃ0 ǚζpMJ\ONuLDVg <6ź0&z]1&/>'* Q rhDJs.T\Ie}ZS 5k̭2 |RD>fEcaB50 oNmQфrn F7k,TBՐ43pr ur&Ϳ,4/|VlOfB^d8|)rr54>K x8񐿘ze !Uʢ\0Ť`Aܲ"\~T|X+#v:Z*}iB/ʧuTtr3S;6&T`-jRdh/!"JoPY'LZdۉ=||IT*/3wɋӒr ^sA}tQ'keثO^YT~[L.tvu`0? P+yr6# S!D"D[_jWnҚDi~}p՞. ,ÎϋKagJKFh gcza[$l욹4OA`q !NW pXt6`_qz-(訂b O5OǢ1P#.y h^z0+M1|*PxY/#B7q",> ! `?Rm?x#b.$&i(ĝ S=XY9Z4R"m=~qk~߽?_YEA]? %zU9s5 v5dce*y@ *T}BeQ ¸Gğ]gLBC BEczxI^mhڊe*z _ T:cGبa% ۓ}9@1䩍O~a_,fc +[B\I[1SFH:3L2EC/FAdp䇒Zm;Q؉1g}1% ~Gkv>z!;f]mQŔgf}'& n:}E(_66JrWtkq>~K_Fm!PLtD Ӂ髤/ңBH]Te{ZEM{qE}`Z4]QMW(l꫺ole'a<'W(EΚLK5 3@u2Q[jy-NL7oP͗Z q|fV)bΗM(]UGvc/[Y'diЋ?],HOscd#1g337.P cCB~O Tug^kVRz^"%z|+'WS^d#|)ӽ{K3P&-)lχ-}Wؙ|WSV8Vls4. mT9$Hs)['MH;~Wo6T;r?EGU /3 8{%8*jΙ0e}a/K60]Ʊu&.LL^TfʛaR!pmaEKpD9b.Q2E5RψHuD0076?jJj2e [FQ_ x~&5;έp*v ?8HF<*qGb*)2 np\"*qK sr_PK1!3Ⱥ(Ծo!;+R0\`A^3]gzHX1Mg'PBƩ<Ӷ\p-!Ӄf{pB))hX!1;#V¾ΌбqsYP/ɝb /}x'Q驗G-;}ZL~g L#UGeytX]^](%P۲ Zfv@R¯vlXhN1jGր^pCc-,}%p)tH MݓxGe7#8J@~:2P Ll\~ii$%+5p 5=HRpjNψ|c8L m[ v.zD9{WG`~d"} %ƎU9Cz<@E};~N{BXcݢp;# F(/cwTv[Mi,54R VJ"#jH)?m7ag"%RSxy`l;L`N~:#%׵)oUP1[xyψ!NoAB"#U_Hj!d$H^*#;3ڤMK"R<2H22E{ٚ>sĪ2X]^>lfBGN&'ۘ!9@J{ɷLu ɱoGjdY;͈/E&FF|h ` B( VJʽHQ|HFSj:1nJ9l2,D JF^1P;)HW8O?Cm{i3pQТJrf\lꗻ~:+mߓ x/XJ"iD#,'JAREz0bI_|kuŰ.>溍0;ҭZvI:ܬpN̬ [,3ᧁpC._3n;f>6Ï9[㝄.e[6Fmצ ' X,~^h;1gA_^шdmN=/\zt)b;P0bx/K1QEWĈ+sIl: GV" AX@aZ<~Y}TDF.V:8B&YZJ@$XBm0\ %j7?V+ԯwL*H_zhKϣv=EYu )- rTbl_y~ &-r\cse럋n Ǝ(be2.; (^ƖrhH<Eɀҁ~vVS᫉v`v,fV#nhC2Z4>+ǘFW?0]_ Ʋ%%n=~VxG@)r+<+J=_Cbr u M $~!umN98̓ķ bnsZEDs5!jcd8A .GG嬏cE9>:MHQmK%빆jLeyĤdtDqME%LrvF̻.MK3f%CO`>^1 ]k>, KDrF%zB, m~ƁD]f,A1SԇwHړROO ō~MPʕ3 Sy3 Why _m~pw д^` {]C98Nz#o|Fu_Y&I>IFPe[,{>n @3GU;Xݾ@rAaQd4%5o59~8Hm7;"=nޱ߄. ]!m&ko6*%,,r@nvE* {,H eodTdwd( $?z{9Ma;)3&'4y1X-ԻH໘9:~? V>oV͎/Av3ȓͶ 2W/$6&=]K-]pz_Vf=¤%(lL@, 8Ge?qUヹۗUO fn&c ZNu`|i6: cH롁I%n$.J YX֪ :AP[fk#ܯ1ݘ12j&8T-f59EdBV7bq#g a#~ÑH8ر3atHf`Ba?r-hPޯ\j L2߽Zxwƛj́JniR`ɯ~F S`+II3Q;#92ݪXlaɝBCƏ_d`P]S2Gpwi+eO7w Q`$LBnp\֯21<ʮO[ 0 )QUX!勃uYu]Q״*}-ifzFωs{8-UyCT!(!Zeֆ cu2%mk:uP iZfݕJwdMgLov-? 2MJb$٣-HJ=@3J|,8a!Al`N=z7y[lyhbYq{ZQ1i24)!~T=6nZ ["}r*cb7Sd|9Ë|Rb`_1^Y8_jm׽3G%UfӔfS`z C=o֓H)N.c_"l߭gMSr ].xmclm7ĜtÓhͽvYm &L8yՂ MˀDli_2F^o :wGnЭH-@{?ݹJby;ߙk*&_ 5tE0z ƒY!$!g(u&Tvyk:ckICYxγvaA]]Eܥ;hJ3R`i͓vCn]nc=p;ʟ)'ʏeRYr]դ؎s]0ofl\,Pj:9o8K ט=8;%݂?Hr-_EÈP;GR | EA";#%Tfz _Z!2v( uYgYsΒ}acgL'lgtλ ?`Uj) hRJW 37NDٟi= H,(($-a4HfSk0CTJٔLﰬF_E0| %owX~zݎj`Op5|8,c!R_&w5/w߀!*S)IwBJ35~Z;"Wsfқ6gԇ(4}l`m FbjCQAd3*4wp bP2O|<|{%j|b] '~m}ݱs;D7^PÙjCxTpOu8M8pu %P4 ΎՏxʹ|$a&Iè6o[|y/p'5Ed!@ %ۗDNULdxB^?["ok2uQ۪oLkU_kҜfg=c)2U ƒ)аX 2g@9pKTH~*aaىGὗ\9\S_&\S'LQvuT-.@BH߄ \B $$j_Xp()e"VϺhXl;Dz,QLMi7E=x쁮f#k+ ka s_ѷc&~'acMBǑK_1Ojڃsfmͣ-p >4Fߔn72L^wf!X 6Ncc(N]K?Ba|8'{rkYj.z=R ­>KޙӬ'bq-)@Xf F gԨ̳I,Hg/0%f# WWoUXo6`7RP w-}9, +c!5vriK4 -Q}5Mtj;ŰG_qf!P|X& na^HI,;J fɽkrA#}%[13ͨ6k*M)Ubʮbcݏ!QZ]T5Ǒ4G W&+j@{kP[ 0Zj[#h]7/+CE{U/ggR(};px21_=*u) A Q``YdHKJ"!TCe'0Z{͇'AVU Tg[jXY:*^f+7BMv'Y9'-<@`s_}Y!ewm>h9!x d",rCoϣMS! 0*b!T#\a+ѝy1|wЍ9)&/CL^H?L_S`̫7:Lio%:s}aƏWVvhk8xQĿ17rsR34J'j?<7Q_I8>3xYWt@9Ң];Rag>)!x9vaO/ '2=2{stYݏ[y{?FR 1fPKRx)!ɫgPEtfr' -B+J`ViHf_##C>wZ@I CC<(n`lfUWxiQ Djw[K|7\ΎN^ma5dє_1ί!f(Ô?]'zc95/3:uZS/n}q<+~g\q,dfA./R1w)4UҰ#{ .YN,46T(pG獏F it6Ajh:+-KM3.[nWwZJ6նw`N&F4Y\j`w*Y ":j\US.r3Z~ - o5W$iLSOR#xح0 %*_T|߆wNe&u#rJoP.)5|y**1P:rrsD+8Ι_ ɶ@:ie? 2-V}-é_{m#FάsOS#}zscDeӊYT ;8?Xv즺a¿!hLn@øDUiKnВϡ52Wx.|r,x쾐oET)yu %=Uzh#-y, \ׅ 0ێMv.wO3̰T(tu<#kXuZί(EQ!ˈ%`n r=0k Lc?2\|_jcÙ q9^y|c7vm o2c~ o] s |6D#lG2`ʊ .VwL:<2 mB ^|2Ia/>^qf}rA]q6ښLKŽiofa[;V+o*#fN5 16@P:`aCXy2m=s1ۈ*PFs]f'ejr*k^ 8Eҵ/nwfj7H] v}xjpn$|MaJ i%@̖b}R99{V脁i_'̖8;[ܟdphÊ~TA|PE{t:Ӥ\5l^30O䟘wywDG5xc&!_>$Co{27W"<]J.Ш&uڄZGve#{nAn?w g:=rFQyB Ӆ稤^RYS,,#-SQ},MaSG [g+.\T AtOO9fÔ lj_yQi(CDC d-b׫k '5KK8q@ B?`6dCup˭Oz0Va#o 81HB`/0)}hu 7:9dђC WBfuL ( J!MKSw~ؑycؽGʏTz-n6gl+oX_Qfc&kg΍!I0^?Z;U>s=<6%|p5b9R ˾婑>f D|][JDW\ᠯr0`Iغz>h ZXm؄3y :)C=IPf#lWsSju ہ@b&pֆh_tUYn6{$VDfkC1\D]MR&fd$ηk i7tK'te+ _<85l ;g B٘?}M{f&\)ƀٕdֵiy\iV00{{*t5}z/zUH;X `g%&u!\xQruS\Sns4J ;*'gO6vuUޢ'Qaf9~l`aoPmWWgnx bHFhXPݤV #ʹs> :ӹ ܒAԾ(a*%2 Oߠ/ݽF6=υ-N[]D|x\xu8oGcLB$1_4fgxrV7D"Fh"n"q3\_`CŶ `ߊl3̩P/O]CgĨ5^{2s&+a++YC%_ xVJ;L)׼Q)o4}{G^q@Zwj:3)(ۺpAK[@]ꊎ2Puf_8 Ef<mbEe IMܒZ}o"'ȶ'7r>NaYj~F JɐP I1Qyv;|HO>&r7/Q-ۥ>\Xƈn`W B=J!oe,~&g"+Ԩ8{퓍6rsl"YOo*!4R_/$^-bC*ۦLN.( qJgJ&-~D"Ѳ)J|{! H LNh.+u䎏3I` P\IQyQ|,I?q\SFI|tQj.b8P.j FQA[H8VZRԮ}$e+g>ֵLwۊ%|-xJُ /D,TKB )/o"zD 2D)7,Wx "PswTWQUR`C:b à\!R凋p/,,+#{ڇ=;{Ѣ,`gŬ>!Au+g O7t#bZV}VJS]֬ D} xKe 2{GKFNRLslIۼ,[q ʖs;KYZ$!c?5j`#:bmqaÁ {(Y?x%\L=h˜ +Z-c,]"Eqi86IӠ5w#vnmXT3mw}cm'X DI\lW<9; ƒw z$^;AxäyoöU{y6LeT_hL&k/(E8=6Fܣ{DRl9ůt& t# =(7uU( ivG*&uǤvJgITP_!L+*GF{J/ Y7x Js梑Kx,a-)u9GRn?UwZ>~/ؕ:#쨶160Y/k6磼ܹE Pu YF*h qWmZ˕Uhjf]R#&ETؔzSrvzs!" P8b>*6䟊n>2|bPˤHaER͒@.!Z039t >?1X.ң/ fĹ8Xa3r _w=Hm &l5MDʷKEt)^ T1Mʂ1"HOX<-"Ĉ7{\֭+tU#/HiM,X53^'{t-@ĞWJM^wh68|V_53:y[fq7ӭsQZ>S9 ' d+چ e/Y|<:8|XnDې«h`oˍ)'@LlںӨGyEŨUa[R9D Qxa  q*dέmZ4kz B1n@B6S:,?*vX\"OKdQ9tl6s%2kRd~l:ÖѣyKx%DTXYz;FsLЕ5/ӏbaOHyJӒσÅN>q"?dIJ ߌfu$K,h'9).D/8.n: i(.2==WnJ0$5zCAŀB[fEZddm2`>Hbh8Y:9jMiYY4sǘ%q*>8=0E]G ىgk"/NƘ.6\Ρ40i?ѣ-l[ѐǴ xVHw_"CZzՍ?k.Jz#$)iG2(É@cRܸczA \ji@ϕ*VF.rTx!KY/],Όn2.f'pSia9׎k88 [#,ta%̡G *~BA{/2K鼼_'&o?Nc&B9}# =߄{k#a̿F*2vP  8];Vy`70LJO-:l~w'*2`eGmTSgc3E֓c#pxIk}lIYJ^ˈgFT0fEgK6BVҤhɾ~Cs<~S>.in=YO-vʲ-8uZV{Ҽit<)z7P:Erc[@LF v<@{h'jpRs"7sGMh"H{ᗦ.ŌCsS"{k%tQ[c%vtu"!pԍX25A()<',߯I˲MлvPZ؊" NTD C³ϳ:_ \jtƯ 8kO9=lyn"'pR S6E<% L@#֊za0;?9ͬeRJߴiw/)kqy f_ Gx{{-©ы@^A.д.d PYU<֑8 h)IT~(." S eWS=*Wjpђ~.P7ɀ {iO~(eB"!ήn7s 02[ȣ(cJlt!5}0}QyՃs`'ZbN'Z8Lj*6G,~ftkl0架:7v*'4eay,'lOp%v;t*i ( ?k^'&;lo$#p}ÃeTS 2Tp5Qim[>O՟fq(jqPXY1zH-x:ʴlGkOzZ=A\D#ؐt9%;ͭnl5K×=d "MyE<-tj3+KMqAڔVXI Cز06'|簠әjrGT\xGk/I |xAQPWs.\[Vo%OS ryȥ+xW*޹UDg\EJe-3Ǭǖ"ʂoHgէD uui'UoU>X{ Eսp0}8/V [wi H=]]i4LCˁ3L$:R΋\(ekaQ&V!kDlj- #岥G{aё0;W+!ߧbqSʗ$o~Z[NqW0f єdP3nC`XIWݙ;ͦ :~c҂8I Uh |!ю:X&C @<|f{qW6 "K+nku=NB#y _Mʛ{q9C8_Z6 sbG@$#ھ߾0$V;@1J':E$XUm0/h?89B>r>`qسβėW7= }C.$p+֏YMbYcG-=Q;>xH&N&o!?i1)$">c0tԷ}W XTOZh ܅t)hW-q"[k&%[0'ֶ M=|!oc1c:/80!Wd-1h~pT  ,)ViQdMa ZrCL"'m\,j$77JdH-Y_-D_TGͶ-j8D_f90ml\t4ŅH=q<语rt]hUAU:Lr>@$ث6: L^㤷Ca ;BT*$o2& %Tgpփp祟W14%E)1͔# ,tmQ$vJdM-aR52 3i]c#P}͡`tXCa n>t,8#X~<ד0!r벼mT 0h uz>HJ 'IcnaR|q4޵ue=7Po6ՓP̭DYx1L? [{EȃjL¤bZ1(+p8;R]ᶭ4wZ+AYC@s- JǓ oq]*jeʋ&ݝJ2B~=+^+ڨg/z|>`Ծi_evƴl ozutZ=11U1a EBkn5۪lb* 8U`t1*F>PU왕d[wPJ\mEAx"U&~Z]W½;c!ѳeKW!H( w6:U~@A;4ߪ /GU?(WI@G}rk]B&m2Yue8+TC7NS?-,>d1[(˩[>(IS*Hwq1@BہDFƄw-,.ޔGX UHuL#@rD3["4,[+9ٿso^Qؚ#q:$&&x+OdGZwf|Rx>YCpz6kHVYq3N8DgSaIf4YHL >ŰX/ ha;o+iޕah`c)H-?5`M" 2!]9§j\ -sm!>xSSΧǍB6|F '*$R2Mꆫ}t!.Je]q"yh1DBqՃC &qolz|G`&3z|~m!` 905`YDfc)SC>M ޢ0ޤGb^)=m`cQ4 x-ITz7z}X.lJspp_(ODVc7VPG!`nRQX0dkubթT+RJjߘV l_Ce3+3:>M^I2M=cDF=1p~liK?i]{Ƈu&QƠެ= f5KBe!- F7i`񪉵nbGުѽ.CUdυ81ebo]sD ;K G)wS!Lxڝh:L]q#~vmD0dy ?Sɞ2,%NKw?lC@Frr$g+.s&?hF8iVYF1P l%"_`0L}b~jL]9eȣi6^ogZ<6ZGh@|}+㛘$ių7HT'ǹ(#8ޢ] ˙a!ZºpWy.A^/>{/9r'?tPPB"( |Ƥ'Qjiʠ+s=5~8]e! g& )Hڌ[J3[&2+F;T݇w^4$rR5(3h^; 8' $LJE(.3e `@K_VSrMaA]-<݈~vh,1͈YLa FVHQ]t10 Eۀ ''f>`,Aבy:u3qC/3H)%B9fjb˚lݨ`BZ_s@aӓ O!]+ U<{.q<nnG$fko˦=ղ7{G %qeYGfWJV~n2jON>G-{s9~V|9Vv׌=O d\@Ƞ(ft63,`ߥfN'wZR1C~+]4 33Hht45 ;k.큪.+`+]&*FUGHSr>h OGr02߲^lReOjCOȹbFwcrKwYtaӇQԹls S<&?iR2#+h: *l*eԊnS:l N Z6d/h[+21r0 ]7MSqDSo ൜yMܲ 3cK8sS8Fk/.8ڼlZ7I*m̆fRJﹷd7I-BYA la ,9ru\!KN [W2|lZ-r)'|m%1'!+  ]!o%'IT @lsnwX Ҍ[#b,ɣte}O)ut=0MfeeTT-/w?LuΔThJX2z7*OsT\ --ێ@+H`: גE؎;@]^]UOo]~d |}Gyj˴s N|TW{TړnM(W=Sh? zV2dgpaG byΊۼUЖK8Ny߳Pɩ;3C$ v<8 W'<]ݓg8$F؏DUē<ʋ}ӿqJ|PQFωS+]pi߹!̧Pp} #y-˜B%R3 *zH:iT'G7nrP*Cp9aG&{ja@~O\L]S9n GvH<3=Y s^S,3A6IlE_JLhl&t: ^p3PVL#٭cAӢSmyH~C{Z]P= EG 3'FDmBGJ*̊l  *-8o)jyu}ah`0EXOEe'hNy9PߧM/P^acNH»9fp0[G'){^$|5S] Lj3WubZ>5(68 Q 4=ƪP3 9 gXH+tUXzI+A- {옠*S?kH}K^ ; ze-if]()7vz6wO{9;q0vy 9MMlq>/6V+:K"kYaesLԙ~ud^Kd(9k0Uc1;_*s9 2| `Tv:@wjak oMSFWK@ RR=$F';m"+tȧV1>}`MP:R >G30n<; d늘)SZ#VFi| SU"qsiVq,ݱ{J40ɛe a5xKp: ӿϰ|3Up+!1{j] VJMhL"vgS )+Sě2\5 t~)5ee>O<1$+?J>cju\,:$kHZyU BcT:Gpg([ ZqM!d.du!|=ݳ~׺ :_Ú4YnH8=^F, (ifl_뻗m47d rއs,ڕSGX9{zy~>@F8N&x /1=Z6t'l0sdEg3E&G7L`kd>5j2}(eun)f0&$ R`XEePQpWxRʶsccW6 $>:vaH !R@'=T-;7M`Ӆ`ygNOMV= !/{]}*Lt+>FuDy9,|)[3 B|S^Y~\С];ERn!zn[=^\LxPT h|'Za| 4e,Hc'DlƬLe N8 wQ+~&!~>Pu s1Y\&-l F9Λq.@;^e8>S kt|;Wlb &J@mS ZzA"ZqP}bJ«i\jL$x|-J#/OD%ke103^syI+iKsC|؏b2i۲-7p)T `)P7m'b{@Ȇ>HgB5|d3^`zԖOZ̾S_UE l;/T N  -B=F 8;sݗf))-#I@8 ajr(9pT4-NZM)xJ5h#c@CR̚o/]x(0n ) VWǁ(n #͔(-ʖx V6mAXD}7y/0y_3A8N,L&zccKWɌ@)S`d6-;ro;g](26L"fɵ].DFQE u5eT6Q} pכf0ɁYY;

  • 0P#X<)=##_[ s.l:vmbɘ:+#tf=ALā+J2=lQ.cB~'B#l5|Ŀ P,reR =-37,ɯ"G Bm|F/|d W3y>i z7 T"fH(sk=?[olk}w x{f:-[JIH|!^b83Fcχ VlK4i=BS=Oq)NNg۾m xx-S0](nlem)Cl`հ<r(<%A }&HL dEmnӪcʣudMa 솛&y=AniPצռ~  J㔍M(}zj-@bGiec:ń&TLԻNU`FN[|c-:32m#$aRC ][>jC3o$|e.V[ OBeYK'r7}7Q CǕFW3a29/3HiqrAQFP*BK ͭWAtXd6վLBU'^˚ݙ;*UA(޶YǦ;rYui3:\bD'ts0{-yn4TOu̙AZe|ڑCҚ!&0@Jo_z~B13e oߌOu n#ћ\{[5Vĸp8QIĺv~f$euyN9f6On9NUiBg9ma4iXɋJK|=WUý5vOK0RQ{JS5c6SQPdsxRgp$j?ά?Ȓ$\Keo=mD"o2\mM7["\64Iq6`"ZcYkBbI۸pa07\ď.Łs=H~[z›R"P"-Q|1>͒ 5r<S9}v)X'؄0AwJW.?2P1!$eqR79=GL%Z'3 XA? -U$9C{iהǬ?,2J44P3Q`bY`{$t-L ?N9,;2Uʱ, XtyƝ5Լ$uu=#ɇc=n ;.[\ VZޞMr`MVkժ~2#VW1INgW=^[+ q}r*%a =siWay{.=Ќ5byРOp6m3+n/?0tu9EXH\WJ0ƹdco 6b]EbOuۼj;`BZB$n[C2C5x:67񪃄j= ]c1nZ@%aٓuP)htH%VE\ 4C4AϴEfWOB#S{ c\_b_(_Qf¢qS~副Q7XzO4˒tdݜ V/̛n C~bȉA?z& g}]0"}*K QzVڹ -Ֆam g<׏3 A3X w TF!Jn ^{0 9>jԋRH!RgI@y+[kєx$ɀl+ȧOQf1ĜD{w B~I׊3ߌPuH^Uw#,^#&L~۱{m2%}l.w`Yj*5i4ڡbaC;"OR6fq0z^8okTa2! %Rm l +`Ev܎4EEs'Oy7[[|tw-O'{VyЫ ^ *x@`+E:R$Xs_x~:Rl(CZ־ī0rP4-~3fnjjR |/7KOE> HEh<R**m'GN:ɘٯ| ED\z7nz|5 ^JF~>'!)Fw8I ݼ{bReeqFu6<+-La lm71J3rir6ƕ" wyXԛL/y&;"Vx0hP7ЦECϞ'y o+,g) R Nil~" M-C{k~cI(:r0 KZ KxB$ϜcB Y ]κ%*F<($|ggq^I mRnƖHu@e3ӛHEA"{b{ Q) N.:_rӄc0ߧ/ÛZvXܶj=gq/~181U LQ@SlhYEOˀ#%dXT.XQ=sdϸ}sVeDY?;fkXC\tN"<-'cF TI*b1.kw78F]"VK@V~tPW4kljo“̀) c7vp^YopSu;~Q[{Z^.{Lyll@hx= Bqxhw j"V=NYQ3cdfuLFmsOާV^z, G>L*9D(@in &X^nmݠX@(ܿ7.fuzv.F]B@± X'i2D4in'SXգukǐI1 E( Lg rgi}wKΗ**p*rv'y^mI3^DO6L?˱ի@bq1}(ӎ1RHב;fŜ+V/ї\JQ5IϷ9L}< RBh.Oe+s'>.sOv"Ց|~ 灳6"\-BA6;tiB2QJӮ@ع0koQ8wFa(/sAE򷞑 %=}cNo˱sN~GreqGfc)#H4&䘛" H WyJFORo5ĘWcf"~nt6OgIH9\_l^z Oϥ+e#- #Є_JFsPGIuځ>[9R}z _a|468.%jri)65oʸ^"#I _g /3z::򂬞 ZnIt$8<(&1ȣ}zsqG _sXoYX0#NRvnv>᧟Q,wB\|>HHj6&$T+ 3,)ݞe~yPD6{oq}7IPJ/}GJXvnRkjZ$EN6qC DbH7!zDyTGP \u7C/dMk5l8S }Սs/X<iB_hV~~e|ZW2ok~'#RU5&RP^Z biQ yCo8CD@su]#SJHsݴAP9.gpbD蚨b:T)β;wo\_C8AYc̉2|iR}JTx4H2euE$ؒZ}-mB8H\ހGDh^5?4zk.ط:3VH9c#HCg]K 'BT W!@>0ᢙhyF8CRZMѦ3v)\2(i/, tW-4nXꋘR""iנnχK 8vd[o[Se|İ*"_=G 5۟iED=`LI;1&/덗ŵ/nSfGP%!>ORoMla ~^Rpx wmxLD38`=Y^ˢ+ v=/B?-BjJDY @Ũ:1gF>-O\g4ÕڱDMnn Ό2H e}Px8$K78.‘ YYDR2j ye_=$Pi*t D%N%]@?h6]J o Q _oKg@:P/lD\f b>~ )FRDQ I"Ȑ~Z"ƐYmpNɨ8Az*ń]n暕vW8zOc%| N><^?0D)l[̶7[P5$*pxi bVf}a57EʻuUAanTQ|ՍO~lڇPOh?f BS r=;6xHoӆ2IZ{h248p<b a2&i+gG;.*=TjUfCf0toU 9E didyXT0zaϝ%agq^V qpNWH 2nX%;G$UL[ɛO^#d޻h1lx~,B˯)2mblh5*dW[Ukrjd|M)eDop9;Kk}q\sE\3 ֟4"aDgDgB-k4ުbAp(5 i$}i̠PV?oC5XLvH0L Uh#b,|H!ߖ DgY_{yʈ$wsäEBͿDv?/Ai W嬨b \xi9r^pJ܃XW"bOØɮ׎(x\hEY{ڧjxu='<@BV-˟A-P\ ';d bzѨ@D%'am"BE; {L5hn]'/#ua'B)Ώ!3e|ol+/CrϷڦlsi8:l5wT0k Lb{HzV!$߳~Q}*gd%OZS ̳M7 gWb1-u]j3ab)AZ"QHd>| 9#7xLgޡwH*"E/8b aMtFx"HqO:CB>ZR%(R+-ѻg/KIp*f]Eww4g)~JQԂ0FD-gLEvlӜ4F]R/$*?}]6/:sΛ1`10vxѷ=H;/q!6Uyu*}3bG9W$rrFT _OQ^j@K&oxx`@F鞡I$G+/`No%Ϟ{E]S _=R O;yY߫>I=Q( 敹v bQߡSz~)bɣIT['hPZ\a6BN|J ,9$}gJf?U~%;ڣhj֓Je,͝pl/MY=},q|7\oLJt5!+fIKC<==A&UU\Ayì( !-=2ֵ CXYﭏP}F^a&k nwXe˫@u,Ρ- 0' ^sЌZ/c|8Ȼpb́a萴5*c@sf9 MB'ַ_/ř`M0eq*?;$"laz< t^bvȿ׀Me`YjLX ظӐeYC/!grt&9z!Z2B(|}6@}!C9r;x͇<5j/T3鴂ه),U0`meB*,wM#ݐ"w'~%.nVj8r8Xs͌H8h1 |aBc#NPrD1/KX(`sDutu>elG7aDcH-6CsOPsuʍ-)knTDT ڥ` ͫ糰&8&y%p#n[1Dɩ(Cܰy sf/z}0"עARd/hKm~>lsۺh|ܮBέ99M@ص<#jk'{mP3MDrMu:vXo-T5QfiF_+z~LwcNI5l`g`w 3OhW 1?6,-'! :j,#55t,E\ZZ*6&`4JE} z hs/ U]V>p Ego¢`NcLoN*0%.W\TG҅@HL5RS5%<{-,a5~ }"7T}<s*, ;Ybm?%}̏6ؠf&eq, ?!FHv;7LsR뱣-^1;?ˏ/,WM84R!"Ʉ gfbj41)J*T'c#S}|^a/fS`T%'RI>DHbXdnj`2H۰Ŗ >L8 SQOiN}ÀM"5"S#n@ٍd--KmVo3֏^AP*q(\sX"8w-pU7dM5/8d:~j{@hMbp8da2twV5dNCTepjM>7B 3QU8ghikgx@髁`8R$@k͋c`Pma<ݔ}5!šQ4^p,ëYtý^T7UݴG U:4V6a{(ŠF0ѯW<zTU+"3|R"c@rq1+ߎ b g8YcQ w޼r^!кhߟ'T5c-PJHRK!s9Fj |d>R9_ 1 {+R2°cvfqظ4>% T vL4WQx],ܛyɬ?(u2(Y h,H袄+xޒ!8I,>8-*w9BL ^q~fFȁLJ6ӑW#yzg iKMVyک9|`9-,د Fq@=a#WMC =?D7B>͑V;~Nl`mr(ĥс-uN}tl'T/p,Z/+|LzA ‰U}h7EC!?JkC2mI!LOI3SVqirfV7Λ˰s qEmuܩU;beFD ހ\@[>B 09PLݟ3P_quCBj [QHPSwd;=2~i1|DԴnkNfd(8b5qx Bӂgf/ *@c(q [E5bfo2KѤ^6 ZoUK@AE=X]+luo\A[\X.8`JMf 00 ԖqL A^QȯݙҐg͡d=)c7K$Um^#Wj,^U?F#4q:؛Y)|MDP&WYseP"VeA0шLYxGzN\&ɋ֫ uNdA75~-AmTy;'\ ?x&:fa#3BIzk@BuaBт@n r썕̦SJC"Tj5: )l- ۑHȝI0%%>LWXkf~˽I%꯱W/vG*x;:5WZRMSuнeOD\q\hc1Zp{X%A:;@2ӱmwZG0^,bāE7=4 1OkO>#U3^ZoVHXPi'yJh@2r$=!)Gg߷\,Nj)u#hm ɜ",:~$_Utfgz%({? UDBlK%޵>|mgsi:d;l5i~&d+]7*%%b" ۻ%F^ҏq1c#TkͻP4f"/3}hً{Fx&+X;%h%žI%Z I Ŧw23\Z*H[Qx(2LuYf"NpeL<?QNK̹|Ҳdʐc[Ké/v\@*'T+JZŏW|;Y&:9?$Coi>Pa[˛ 50va_֞P:M]`۩ 4Yd*[`EP\. d:[` q8P/_}ջCn$T'Hgo0zbbêϞ׭C,j:ݘo?[Z_YnŸ.ۺ:}N&Ar?DSQSW!ħ75֚VuEZWXlR\G6Q_2Y@[Rd, q~`zUhO%[Fq\A)"n;&LxÇ1-26 qiјj~!+Y3,5Sch/B6]t袮 %OU x +ž41@=x5Ǯ';3 N:,+( Ŝ߻^vP<=w-0!%jjיT-?^guWǚݵ F=+i5"7 mTa)G]f%Ym'nA3Y{]!(+t/g]j5l@z>ki%u!`E@CBRWʑfO=\a`$ a"%zOƃþ'DӤNHƉɽ7K$'o ŧTFI٪7?KI^:@8uEl*˫!(gV-?OeG^o%p쬱=ɈGwQ+ǚ&Nz>g\DU$ӺwAo5SeL.ba? WԞO(.Am=q;LP#qR:1(Ʃȅ*N*16JUk v I C.rA)]y7Z󙮸y'iJ^BITϤ{% ˨7'ԸS@o7Gp"_dLʤ, e"؅sDZy7l`&!lJ;\9]In#=1aYTYd7mFRqjIrBʇ\0b{M6EHZGD{")\5nzIG yLs곋d tTtm6 B8D^@ GtVICYۣH/(Ccims‘a(wύ͵8DF}ۿ+ ƾlyjX'0)FOx^>W>?h,~x1ejaXBdGv/4 ,fQyOr۪#ѕ*>"Ӝ{B?ziZ5BeePW#r맨k?RD(CV<ADD߯94~OU|;uFVz,ܫ*-ibIut,"7R8O ~ aդV֋tYo=i鸡R NWz^cȗTַaJHm`m [i8H {$)Hܐ'79$"yĈYj8f,u: dΫM,ltQwx AZ2l"AM0Pxt!?Z$j!dG0fWS23w17+ sT"˙[r8b,GkaVtڍ#hA>Ҁsڱa o~,}ׁ~aG`.ռwD~pisZ!N Kbqň,/ )?q3iUp[\(ʰMzPW,kӅE=G596/6RwEo $v||QPTW5gLr'|}gZb_ qzχe6@*q3~DG0f DV >#y.\RuNF@Z1n섩@RT+2艚y(/Yn!Vxkӕf}FY|Zi vr-)u 0e `Y`PM% 9ҝRY|r b(?D M/Lý)lVI#IsnjxpsxtZ'AI RڡM^,'%kG=A$DGQ # (eP!Wi\}?nCFg;l~[F9_>":3$ʭiw~'kc| ijCml*ۛ& 4} x/LF4i0%fl{mijщ noGQk҃01}^.ol\~4r†cYz^GUѷa*1S> D<0ؖ= 2R)ѺWZWĊ3b`2򊍐TqqfB݉!yB{)2o/j ?(u(pK% W~)1}# &}mVIz]X<3 Bx,lWxsGLGud2?C`_%wk&@8ǂ^Xk/`^|џ2eaxϝDCk^,pk[tO?t[c EC kjbtVrmT? -;5gNnYr5Z钶\d[HG׵V}xMr5ATNe5k)g<;_O]?C_\>ؚ@yh$jΧpj0&ո |WJehD/xz3p@}o F^tp VPan/f-#aN#hZҡɟ`q8&W3Ovc>9U-Y HӼspADjV1amX5 'w"}(nuBrȹNx<Ҭsub7g3Tc L5t i &xL_;[H˜s~Woޥ(s- g=@bZuG2='Rmtfű7 n>Ό Eok>.{V"0At|-2*4CYGZGS4L"i/i'9>P9[x;{{oj3:S?FyJ1Ħj~Kp ?nAzSHv̪b z/!E_4`+TPf, As6,|],b8pZoOz@0κy1n)*gFq3n0V%4g(RALL3=hl VJ4(1UHWkk=jB)FzMclBMQ(tos;GzР'"y@ aܲ!ԫ9-+nƷxɣ ?_ NLuPK>?gg'1G]۴0Ń}ppK{Qf5_(r_iW]Ne|*$tsڛN*7Bt\ @D,1r )27}yCE3;1d0vmŝC 3zK1q@oq<ŘRK*}WUكGsP/s&?TKዢ<<[&K,' p@PKq>3[W$5B*kjm lLهB'xAD\m/jVչC4[M-,R TyN%FX $Ƥkmz9ȋ7Ts nv!fu+!lm.co TYͅXlzn?Z1H!.oOd&P V˼$yJSvlk2T\];WdП6 ("v=l'"YwmWVZG,WӔq@}Z+2u2 TwqmV&!UH FW.GbJvVϛMi C:>TطlK0IT+ZJlU.Iu }eS`{_J@D7rYOQ6j=f&(ܔF Ξp6 C k"לрʓ$Sj"szʑ؟c5!.3fi'PpA IR1n5Js4a\J(.7NǿOz~=h[Ӆ Mfp~͝&rM:Cr%>Dc c=1LT#Tn9a\fA·1Hο揟&Ťz Ĥ@ I!ƥ`Zxb@ a4 I sR2ո>dZ`ʏ/mhv0K wtzq ,,wC{X1ѥIup)uruarDXUnȇ٬φje.9;N“3DY XY<:hhpMk5d̍7|i'n4)ˆc~3SaB@g.0WeMdG*hQ*vkA)ڹo{4>_yQB$Om:3$]]%@צ.#xw&J}Hϕ*F3%ϫhMs#4dfn|3tU3SUZPOOz efTN%Znd"5lkOsDBQe_T/HwְgL4<7yz .^";Q?]YOX&jI$^?v@L]IcddE~8dP/20;soB4{qTK~S_V,ֶqTD:%iw@>g$j3/:ɀ },B˞L>%o3|2~75UKŨ2hGg{Ӣ1~cYn"QX>=kU#d9ٵIJQ.VAriDž:UaLD<+neǟ^rX.wTY$Vxz" =zCt˵RtDCvbCS?Nr:! ?6x A#L+^S`+AK y/Z*G <3m2-? ˒|CQ>H|$|))}dz܃H+Ecc}햴YflGF'?^-#0%ZN.lxP+ OH(Qj3]רcp5,]H#}xri~A|Tf%ۻΒ[pĺЫv][l_N/ ϱ+9+P ;N/BWZ> x%._Ձ(l(mY&Drz_=7۠Ԧ5k!> cٺH7cۙE^v==v|_l?G9sLr?C;LOL!cTRt'\.[dy|[6!c>AI\F!T YF[н:Vz =`8t*] jg-QW/E_J-"A s utc|N:;7JǀgTzZ6f<x/U`ȡT!d ~#q|ܱz-E&NBȰ=ٙS])ʱOgU?P!|=1Tgn +wYbdAO\ֺEi7n\>"ܽTCopŽ&r"`5e :}Ŵo:w4|5)1g&l^/1L Ld皮E >VoRݠiȟ8􊗛2t ʴ)SxMFX}1P˱##S[66+#}KL7BݞNQW#0O1,>3 R&zQ|O`k_;DhSݐeM쌚Eg&[o- :A[F {E5#Uko`y#+I;ixtL}.ғnv6Y`1s_xB)=[+w`xoRi7]% IQ* 'OՄ[:ٙhB&W؝U[͑bM05½:;8e'MZ!=acmF}8ֿ%+f`ʙ\,?rcKE'RͩJ*٘ q`@TL}t˙CpI/fs{r֖!鍢Y$ǣ^.բQ/!J ۺі{к%0K]>X0E[@+y^#n$rkh SWh} ĚӲnF5Xbw#Ğ_90ՉyL!|2>S2>BAO]qSZc+G aw9',Y14SO}} g^xC0s\mrdZf1`)e2%p2ڇ:2]·κ,\I lH+F9_j?8,XO<3 E qnirkWGZ/u A-XnbŠ"suZCE W殾i~j9I0"Ё̎wH]sE}\~=%ًn<0 M[ jWsp |4PRlӦ vˌ@4eۨަq*ܔT0d56iZx>ПF.Ify}>2gZМ q;P<erMLF$Ke,N#ׂ[*ngo^~[ĨɦmmY@lM^HsM"Ҳ l9, ׄBf* oN~$$]%>La:SjG4}9&)MH5ώ>(/rn7PK N= (>tjplxô1Mtx$49Y ig"ZlrpOҘޘriO?Gw4y7 4L;zv~wW% DɩUV'kl mE2j~aU Q+:s|d73/Lۯ>uot(]zcNtS͖301!ZͯҙzmfbioghԔ:J5xZ~Ie-5/fJ`qlg"<ɞK)-|CaRԜiTFU,xsedjr,1qÍd$GiuavԕbiT [` 䇪5F%/hYPƃK`2wѐr5oi,Y8Iu.n_m~u sV#w i, 6RK.M}7`OVd>?e|R)*9#+nT|(`KYykbdCYG\ ;u/gECL(R!bNv׍Tข5*ްȐOT::qDhL}x|w$ P\Ζq%Ǚ57qZeR]>jh`$qL:ՊLHa_-MA%8GܴqjH`c"G4ʿ(yB Pgkbx)ZWn^g L3;9.TT fHvO/S!V%L{0݃~z{/FAbkڦ=k 1 xT(T-i)]8AAqju:8w=X |}GՃ46)mj~bD*Dܮމ^r< i86rNYm 8pW@>>I9\ZY8pr1[,10'x>0,NMضͯpNK+7ɏC~J\[6b-/Q NI6ϟnb&`@%="FeArAێ3$)drtt4hNEm[`*hN,`:˱NgSr^VNuCP,0_ZL ƫ'0XDVQ?92>穉i0&Onrm?*S)([[`Λ'+7r2"Pۗ6~8u-Lfw(Lcx6jE+:8Co .!-5%fbpvY.@*XiJOÔUe7*?\MJ_Mx  ~kflm[ؽ9HoDSeaz?&h gvo']{qMk\Bڨ JvGm exGvN3К*iRNft/ y\uLqz[Ht`h3B:":)m-.*h7lСyt?R\$#te9HWtI<0ٽ)jDmwE@V-H폒PI%>AF\#_Duaכ=)-NbF2opeX\eTu@jmY3,+eL̽faU\UTO4ƓO J^.L]*Tia鑤7hj,0a~A|[W݀HxGs7PJy}BGẉ2^*'=}WpwGƶ>F֦(z0-q32eyۤ< c &_*˟8 V>#5F-xYH12E3d<&=3R-t.GGik1BԆC ZdROFYbέ7U CDv7nA}ȤSl%39wDE$~E®TCkYJ_@Sq#c6[.rݭ瞷OZUәa("jGWC`t,exەp~sểH#&83ksxC/.М $ iWbi}m ((9K_)^'mR$BĐt?Γyn􇟧U `O0n$/}چU|׆9/OC‘T[p!5U1<Z{ DxNe'V{sJcFTUb!V,&mWTB7߭^!0$8C!UXhWlk8dW+Leָ<8T:*Mp/1gwC[[Mϼ{;h}hIX9VZKZ7^㮼ʷ6 ќ9 }E{+C] 2ruR؝$S7(Hg徚SUcNJ$sMkM;bC9G&wUţ*1p N3@[Ҿ0%ύ݇w] 7EuAnz/hhX[KZ9~XTw93"TPMkbR&qw06 QZd9W֢ }]okt*au/Evs4@|6OevJPL!OZ`E.tC(a8(#W. abb3)fA; Kv.'~D]!$G3a(C*N|=,{a][IHGЬ[o z7N%>, gCY:|c|_Pd[w6a9J{^"˴5L0~3 )r,8l>ӓP=rcTRXdsze^Ǩ)`%S83ajGrABSpK 8xYT&@_HQ&d@l&.oM݅k4 9 c) g$:;s{ax3Tp1d]@c/$j.zj ?&dM;A-9H|HFuoB\1SH}&l\|I0q='a mC#6W/3Y#aKn(-:A(XDÿc)8-!(Xnͽ,Y`]f\gjb0^v8\+r!Z!g^{Doh4sXE+(=tU"/-4_@㊧xGuk wTH`/Cxn4,y]5T)_+g.g^qK v?V bBp 3#MPb|{_HϿxӢ2n)MoLzTrL^j[[6SDTkgP:De+.\\9W-9$\f鸄_MJ)76|/he9M4Umc*I*Uxg5Fj+:L> 26,,0[^N'r]/hAԥ~xid݋'_-ҍ֍q#L+;YAF%[?<_~Q8 "tkR6[ o^ dFyMzەjS O|y eUr #Wxjpc_)Œԕ&~y!᳝;D!8kT@VKԉo}jks3ԶB >8՞s`<@ϫ)tV&= N6Yynu7[^>.dE7)"N.5't?&r4zhE6 !#qRr*Pr.a6=?(ξɪ[FeUfwoD1;>|( w]"6i`(^ 7Ntrƅq_6N|Пk:q0Ef:s p *v⪲g_Lm1~I{r~<leQGh;~Nw24"u4nmrx(o1f9?1yx݌\O(Ie@9npċ$Le<_H~caцjqvW{]-y2#$1q1q]]_#ZAu9y^=zIT[8*˳ԅ{+7BwoyQݎA^2sU ˄𧷟=.-zh%qMbKCuzCX霻iU([)| CÆefE"g$w`FQi'3wv/qyw@qneu|2(GEކQ$w3;>>]:]w[wc5Ǩ)h$,; 7 rhAL;U1Vƅ\HHYd-+XA[64 uME&S ɮhH6}HL:(Iwo{4M{[L}]f/ OJGHĜV%j0⁵R8TMvy.=- ƐuJ` CuFD: %o;FIuBS4G"{E橁)b9?ܱM-$(%z G㊑ukV[ix/NQAYW%#ȷ9\T'[$+$d@" /[_g_Nd5}wco g6K(ĦM f4/ȶBXa>$;G/h^&ᗚ2ͅBגUxNZ.閌%"ɏmiLX4gbJ OMw};5'Ξ˷23QCgOus}GcE[Ƈ%m 3hRSݠ wtטOr_گ#!tn@sy~㜴7 ܁Uj+:69X5:d­=y>$%u7 ]8|v;u.* CQG釟?Ϝp 3و"j4I<2#0&>s`SBmO5_ѵDI64U9Еw JQ>7OAI|jKeZqAR<%"y;߭:>8M/@S>G'j2{rPEtM7+ eSKP楋v>ZW0 Ouyvδ $nWudġCED𣳣,2DsByjA\1KdN:! 1!<#/@_ x|۬_$?Ӗs5-Hqgp{6KDV.UGM|poq+j)?J)& $72d/xK|ltp  ͯtWh7oVo'Wr!* VGoh:aiTr5:omFjJk$eSR*I~r/ADw3R{ #$>HN s jdZ{vKmwS:nfM|T,kN׊[ÕtT b"A4;rfYe?\ f54Ds'JH O궍 ,bu.+~:HcN??(C>w#s*tK}bDăqLHE-pQ""e9,Sw*]}\4ޝ,j?YH(LxGEǓ|2K5˗Y#zy93j6;㜏^Aψ<3^)ZI pѸ VzIbxh vy نOMA+E& 9nq»<S qu{r|#]v1%1x_)+3CղCR&7xji8US d<D1oRaGU?31:QxyxH#Pn6ad/!+Kdz9$\BZ>G=,(dmA̹$Dֶb%wG%@S! B\mE>-dM&Yg{dk.cVhkL{H (g3~9&nRZj7cKQpc|JFTĦMh,c fr˘i`TJ͏\P=H9=2|ׯ6/TwnE\zGtVNty&3+r+e  U,[ǡ!RQձXOLSʃJ" m&@}8j7Ӟ.8 0&-i^[&Wi)'&dAƈ܂mvIaUq%sR}Qxj\T\@AOA)b; mA8+{͋l3ח()n6#ӧGɧunj0+Ӿv}S*5[LtTM5}w ы ⶾ)녙VW>KE̷#ٻWbTcٌdgҺ߹)f|# KSKUb3t U9TBݦ]q]5M6 (2fx6m'um?/f: 5!pH~"Z%'RD,B4% 2E"솩<˂-*da0pn"D0 10h9{Fc%2w{רۢӑz|3{K ;0cb Prah&=^W@zhpG9D.jш=KI/ɟ&3*Qu) IBbC9%m_\_6*t/7ལo[ `.۰f P.9v؝]7ƶQZ% _iWOr7Mj|Kѐν7P_#NL1B 8wmde/=qx (?.+ ]eC^0 *_6 +P],Xnj@7EKq) Z <ݢC!7B/Ko/|U+)ٮv,,24=i zK"v{5b{}I Q>f܂E|}x}YP4_=3v$ڨQJ874d:T ;MVvFJhe$:,ueŞA#ux(D J,J[G<%Lvuߊ{)7JoӞmN cz~VtXw! [ !.HJږV* kH‹FyCvwHk@QY5/#苽1iPlV[-lDv#\gWT)Ӯ֬K/ "'UpfD\K%yP Mdz <'ˌ'v#+}b-w XNx^ZⷺMj"# K!)a1V9_F]ڠHG 7 0&<]qrSO6J?/; P%?)FxwAe`D /Q/9Lph}|qJ˟tU[./;8|lߖ\qT_VſPNO&0w;Ikf1MXh{'A}~'u3@;X*H҆[;1y}hAocv_٥,@~1uPt"1Co;Z(,;Dҝt+ќ·0)qE}tr%:>UھV Z뺐|0);F'$NB5GzՔӆ[7 qޣa4ނ,RshBXUd-h3& Ì:)@{\Vvؾ7հcIdVv$NZʋ[[Ѻ5~AUd4|Wh+&Plj2 eS8vlI|%pRZ#90OBo^=["HS@ Jܒ2uB΋zx]ņ1%?65i|veJj]:d[&&%?8MWA!"bdsֱqc8i$MJc\/D g}gDz޿$5->g] K]9U{73MmB-eOQ3&lנn@&yL?hklvquR=Kuďϋd"1sbZ,v!JAJ"RRc׏B󜍈#VQq}\`g #ґ*OH7GTcX LQEL#O1$ Ę轘‡CB@!4r53YG԰ ȏxILe+KPW-e c01QFŪ5퇔FBDlw+VM %Z[X祚FՈ5Xꤋ|, e;iFbUoTVq ۊss$=J[OȂ]76=hKH~LC,{GaK5/9Бo6#DbS 2G[D~۔U$srV텐d0MSDXj+)X)Kgc/1\Rj4 -+vU*NZY0l6 7,@c={`H r`~)$ew;!i{YR /(ܙFξfr)6~~DG1TvB{d+ސVVUaxrVɟ7&F3( *1?wo)х%P{Đ9=U޴:Ml;I/DR^|--N1H)# t隗;!8gN3]n~xgnSn~>Lh-:-os@Kss/ݏ h a.w\"a<г_ex &jW9&r] D mW+7L^9e ;M2-32UaJ C$W}yi,1T8 놯)w 9Ed4I"Ȼ9eM؝$VGw)W3f ꢏ rX9ĚZhKLKhU2'Ųo"BL4zaa0pcVU=zey57=-?;jV uB[[t.gXȅ)g3)ӑǹeL.2;N`<-ֹߔ(for;x'L|8F/3= ?Irt-[% f&Sv/haecQ"5 d"ܩX9vG*^ۗ'r_֞ yuvJ{p >~aߞ0'?[bR+>/LHb\#χ;f(@f}{z~H,JKmT! Њ1: :yޛ$\Sw@Ԇ}Vy~D`*` ^Ȍn2n+4#ʸ9iZNHZ #tB5Iޗ1E"z^*O C(w[F=*2:83P&,<]ZӼ-oC0mNԵ?߯,m /ЮϘjE&ET&z]!Q͚Hslٲ5baLτ4ɪ, l8:.hHc2cn.BO ʹ0Px!50-gSWAi$m])k01P"':pܽf9 8jU*ڳ'B mXJn9lAcb[~n 0b[a78t\t _=y'FKaP+lXzfpwM6ӥQR\yhn `mx^I HmE־֍d.[̓bG3(; _LpmLvc7<)TyXK>T;Mv&z/x.Pw_ kHˬ`ּ %+ h-ݔ"O2keܽbR1Au#RU !X6gyw\dתϰ+վldRVoϧs{sb Ѕ͊[8sۚ@кX-mQŌK]YA+k<ɳy '.5XJѼy\|BVvn&k]+|*2dtZNqC# ڇЯh[ L ?,EΔ r}Ir`O5PD)wSqhjnDj[ܣa۴%t|m[Zր̪%Pr;eN*QV%iV~O#ۻl1!0,eV˔N-gws}CxQ z 绝#LA ^d"wXa2cŲBzarвz y*eSgrnMa_rb1;%`CeFN:W/侦o ׳^M{l4yҷñIŀ@~)貴cɍ:w '$ X6(Lfm29Sވ"|Xbp7CUw@oGJ n('RHxOqEn~^,>/}T@[+!%?OѢnG1rڥH : }n˄ g=[R料/"eb3{!yscm9AL4g!jGZ1Py2U"2^[Q?'PK[M=>k>M,sO5X3ċ[=FQ:J\  <$]Eә8g+4M'?>^hgiWEVvfl/+7tSc\(5^蓉[Hx%+{t3!-ۈB)IC,dDkyMhJ>M>aZ]T#W dL4.5*-ERB|NLzhI'9ۙGߑ,=saGِ6qluOzz feWr5A/6ItD /Tu*aO}p{l@t1=b=9 \F$lkpn酘U],S ~l-Mox:"۠h#! ?/sz9>zx%)S+`%";OоTfO!ܫӘi̺!"-5[NZ /h8) kH;/[?nHus@G^Q\ oCM!G/@ Ǎ5ukqNvǍddėGRљ g%\~KWBh{l%땾2"?. ?QAB Wz|i#{m 0k*4W*v$I4dþO}:ؿS?;v`8x? y@kZB %";WoUO¯R3}lЄR@(%'KEp/"x/zVs ʮPښk)ڂ?O)nKboTnvi$NU"(?SDEf}͙b641t` e\7ΡeGz9Cک$kF$"!u+ i*+t @-b@ki2anht!8PC:uS̉[Rht$3 "^ sfrPVzؑ04J4ȗ[˿x.^p\_mP!oyPˌ<2 A[FZl4A1oO3Ga4:5wn6.u]Ԯfwԣ̟ԓYX%ǭyA߮v`%'S;(w#)]~QN*LqFxlkr{ڱqUφ3];m9!_k҅mw3^N<@)˱K oC` ȢkʱrA4h 0Ү@KAszuW"`=,T'Y0B%s$7 WBTey^4K5:?q(GAQ]{m5J1N꒠L l)G֘9 "%cp_,j%[#EK=H2 /ׯyoBu/Mwa`J)55p|TjaYf8NVuRާiTx^m50UPwF% >yFO/P؍ ^c]Y DAXnzz/BKAT?r!ܦoCU04L/#7b;qeDMmx<£'-4eKM "GG[˼{Z%|dq!tLf#B?pu㇊+%&AnQaBT2˶uq\FR Ri`G4ah.Nά2)t^ W㲄&\ӣrg3T\e Φ<>G?>=#/LvY"2ii4ַUr 2HY, 0l?6. j`a08rJx57hnl@`:M9ՉJpjsǩ|f'!YTޡ7d6s"au ;E v&HvJ0-L:0V?ք ZoAb:.'6a`"X ʪ} 5<牬@.qmX6('.ZC:dr>t&/]2\!t o4GKv.`s~$FgG^&:3\t~jC4\&V]TP}6}ǓUusШ<ɓ`uEYf.7_}bo)0. !U#9< . YT@?鼸"S1S(>[gJ<uݥGF~=L/JJ&8&3p!E+46A ZxߜÌɫL8m e^m!LKo}{*̠l K $9T@ ! ʹd{ih"~²ٟ ; -x%">T7sDvohGY+=MʵLU+) 1Et?> ;b(&hFbDv <B8nu =|D~Ϸ1/7X| r|OCE4j!3;uHly-#VoGnj&1"J9P(]m'q7ͱڇ v#[ϰ$[KەvOsZ=+Z. NYE|#I`}8倶@_uV:iN+eO.a aS4tE%vc3ٔ˼` HC*~o5  /DC\f(I҅-Y,-+΄1mdSK֔cݨ"}z:wVndO3j2UgFɈC6im`#a;֛Ǯ<4|i̢\S SK;\4&:\ :ĵ&yJ,vf.^[ϘR;4c3[;t=`0ߒ&3RNN4e{j7iI7|0Qඌl*2pYq̋PͶQcE(fR7̏k"anćZ@2YFĖ[;䰁l }?PBW4s#uza'ska lY1,c+чl}qg=[4njף%bHH?J,IᐘT7z<{zKрIrJ7eTӉ5~ ,sR]օtγϭԵ23䩾Sr v=Nvd+S94(ʗ?f0R^_(Z( /Zq[3YK=j4Ӵ< Z9T.pX)VBan eУ@5':d(i-D@AvMzZC^ Z*ثM`ʵeU$EQVd1j2D8^mE8j 1/ bxk I^M_++jU[>,#Q5w.[4/4- Egr&џKcmME<᥾1pT Q椆z1RX?{v/510U/݈[*lT)HSAI7L{y;R<4"P(&ah4.dZ3/FNL5{?,ToE+miGAso[8ى,] ~Mځʂ`9NBܛ"sl@;+@Jxڏˉ̡,,sx=-(#/G[wΝ3ȶD!Bf{-H E_Hϫ!h6xL,b>#W8<hk3?7U sZ{E 6*6ҳ,ONşO%X?zb.Xςs~ژ"n=bث|j\lOaS)s|2BgFCE5t;ZTtنԏ]K j!왁ķFOoOɭ+% :j^)f@  L Sɒc|{1(-j`+;iβf \LD=5qmnirORL`,1SY  ;`a};cXR!'3RCwi='a_%`cqZsCLNa/zHԲ$/o.%]#*7'Vӳ lR=oDqlL}`{dɔX(uR vYn0QP7ڂ$Q5"Wx/*G4]x^[_Y ۠Cx>:a,rkRLuopUi1t;g|U4u.\.G;'ːHF~^k.ufXu3"w!tj?đ`+ 軇TB4OHXj' ]d4z2K<ZHߍم'=sS|DgOtCalMR#(F}ď"<լTG8* ʉ7<)G1J\ӁurI&DrT6^\E<[h.LcYB1YWtPRPdDV}=(Xl]_AGQiCȜƞ~1E[eTYb|CM#^6RD brm"Gou6 `M3lk~B oDC{U?m.bb'I oqh&UZYv띬̉Rx3;oGJʰ2Z"Nڕ)=Je@_d0ͺXOۡѱ`ޚKN9c @#?#e"';Yw0duor2燉N>8EDtg}I+,M&"" \sSn̠D1+/2Ȍ(c*1VT$*yQ̲,u$i]0#5DE7d/hE]4h)Js)>Ʉ9*p~e#z^#o>9gnĘXw.F0OûksQ+!p \?Jq3;ߊ{ 5efMj^;ڝe޲(k*,B5'ub+Xi̓ NZ`Co7WΚ $0(ܪ@(3{B] (d5GtfT& c nFbUG_}vemNu=H-CVDBr eg[A1Xk]f4BaDüT\gT'u)^9<-oѐϜ%cV͎\h]IJx in-pՂ1CkH1u~GTdBV89@Z6&PC'ۉw'oo Ys:e> M OF~f8Cm&Yw9j1k gXV\Aj~&Q/EiR]h^Wé'3c杶v\jf5t:VmjmC9ۿYJ {=%t$p&+.NlGԢ뼉q`ڭ}Ryhfstpyм{ 5O(Ҋ1Y*%R:jm3QC<]&hJ>-Nn} h(xRUS0AZxM;0~D!>?#q{J*Y\8i|kW&v/7Kǟ^ qGN [8[~92Yu,Jc|p7Ԩr&Of689kSLdžvNNÜ.õMiד<CDSm[yhF'+{_݁ ;} ͺ o3%w?2Qآe @]fck}s?utb.! 7|мIvMh] ¦ׁAXs|z-g԰78UU+hT4 [d1CY> ="ָϹ" Τ(z?9N G19<%?(ꄖDSJg Okf,bb+K1@#^&>f MK !"SلM@SQL\N:o+CLƒi8ӝK)9]xg7#CCʺnԑuũ7xcb8d}Yğ{\8x$mf7"M/3-z6&. ah_C¤[>nKL?}Sk̞yl?%?gNɇdT[U %T>l4Ƞ.,S nv.> 10sEr@E`;f>fx3GV%#}XO5Ox.s/ շ]OES͂SٰzɗUSOXqڞ ݨA1$oh8PP87%A +8Z#/+'+){%m0&6K"4G+@h3c:EXP s1IwI=s\QYg>1kܬ+˷ I@s OLuJQo+[r.WQR:U݋tqeXgװNgYĀ ;<PͬsCJ2q?/[Pj{;G ?tf2@KӨU;4 K#"mKI5S唩[ߗ4K*0VBX ]S[7F}N2VoತFsg %vky!i,Ϡ gwhFIatޯ赉ET`dkCҔ^!ܥFM| VTe@ҧP]Ps~p.k? 5<z[N`Wm_.W}{u:f/iaiu}'챛vTO #XX-R)x-,nvMb-ZgKB3$&OTK1>-cߨ')4 dom:Y 6Jˉv"̍L9ȦPrS3.nCM̊By@ ~zP* q]a g掿6l&%;DFe1@8fu(j^/3eW,@7` O`p1{>[9c1凭r}Ht\(YT$n)Җխ~ElZk U˴{Vu69Q:m]H #+U ޷;`f *}]i fQ@ԈW~GlђN1j-SD7&L5٨Z$|1/*Ûx:͚ښ}P8%)"W1=WG_#&(1! zMC O'N)iğ.yc3_[_O+3icv–( T J+y kX-w&:]V:r㋐K(UB|OG>,V]1"-A?z%b++f/>pҹrdKaq Е U~yNEUv C@XPG÷.N(c=yfࢿ: @dPC+m1ŘWSeVx?,9 yc^{оqmyR.։ci,Q E5Df8&l_uy'𰔺Eϛ9$2",颷0/լ.|2Tz+)kdL=\De@ig> xA=+?wIJoGj>2THԌr0 Fj̉3oZ2s2kl{Z u'A NIcb-A8ٖ$WEp?NǶEŬK;4/8WDcV vK$?}%4 F7x|5Иi'e9*7%Ώ_NPZy{Y&ci-HA\)6[ҿMu1cS4c  [kE줇s}~T_J7E5Vլ߇~ L,i;sQ4\Tuz/;?E?^]\.4<ġ{m' (bKE3mV\_UyDuG千iޑ}%w27TFϞsV oc @{)PD0~ q#Bň{`[^F޲y::Ө/3=$mӷNC Sc802O?KQ bCIFCS?P#BYɮQ zU{C($k]Vq Tm(aaGo)Rg{+߂\$FT7}os,۝bPH $h29)y0ca/ ｸU" tQ }U A2"O__yXc ^ڻ1SE%E,N=,FT3X|IwMGo!Sx#܎XR<$Ǟ ƩXl/E~9 Ø4#r"x6lj b&}laL( 72SqT7'[$:f c0 dyfd̕!ysqX fĻ Y Nyؒ;-xB ]Wfӟ;|gG 1# ]=^x -]K'T`,:t%AbDE.S^CC ]ߺΈ{ñ[*?\N4`@^"]kL ]( R=%ÒꠏZ+NQ;sd4(;hDM ؓ~G]3d#Hn|GO:):ц^*_B'1 ~X3,%N=xߛ!C [IPy qo,8iU11搔1fW3h*uk3U6}+׿mУy"ggO1.MԳtK5龏XئkH}SoC#p(oMVl%lpGwRSoG_h +;$cEt0#ij5*5 "\H NP]hi;QvnAX qZ41csyV0blZ.Φh%u Os;d s'ۤް0ZN=q+03P+w(ԗ ul[R0E'1uY(&pI؅4C,>:C@C__6f-|eC%n1S̕k%}!Y$,ƾkF$} o2 e]=f)>KuSy/V9K bfўvb !~=yWQdi[_'~ǭb)o}.feyU#1Ÿfa2ֵL䰼%`}Eggs-ڽW[~<]\cch\fsI-?ʀ$:T0'Ɉ` ОO2S8ע+gC.<cdUYRْuˌFʼ2Gd~h&@ѫsQȖ oӖUq0ᰄB?7kBl)6?m@N*z,Aصk ! ^'%2 mF^_ma#DrIe#6b1;IHig G' ϻk6ZjԮӝACF t$1vQ[pd?O3L!ټ(uY_e -} /Ag >,ez?#rѢr=JbR)*A GDùWo6>B6M4ddCT j\,5r+y—%f\d+)L O)6PW5Ei$th)E]5Ome#@ |WTX L-RiYD,Y'z? 0? ''x˫14Umz >ّO]%,7evD$BQvX(&qӴuk3o խf6d8V܁jʎ2>Y68hE~ ^Cکzt #n@ P|ْuV|GqAS i&5nR^l吥 !tuOݼHNX",S~c,JGQ>ٜ%"yE (x#C^ PtzXbfCF@RW8mD"m=hb3R)DZgz/2+_ycT&Yo1{$ƝBpZ'yL8gk]2;p_P `jwhC?l]c =TG]H3269"!|9jb<̠˜-,4-:1j޴XvƐQ%c *\EǾe2(hٕ>9e@6&06V6@ꦝ!8%6_s Fb(e2ȉmt0!rNĬkS+ VzM_: 5⨵u3 GH!dK2&45D_Swn;w՜؞LHccHKnPIBȊE)' }!iw.߸ǼT2k脈Bu*[0P7t0Hʼn@'e_R-y)Še27ZQYD$5,[CN~,7l sx& l<԰ͨ$ԟUܖ¦w4*R@%PjwewFgIލ KSwfڳcL#{]{/c͐Xme( $m=PeU%6j-@ar:.B<31_"NNWߵ5 hYr GO#[4at^9`3&8=q(^?vϳE8v.bqNx7OO/yސ m24+4i\h(]kzk~kR.q 50MNaQ^*qYgin}>*uˇY'Cth!߮+ذڎϺ(*Zi0Ka/ 0Le%lku`v`TٗFqs&Y\!x .: [k8 af58:kd 6J_кNZ(MaN,nĈ1)sBߢP|=E"D=Kع`ԹoSfp\lGM1N$|i;@*^nۉGxdG o51Ja`mlZ1LY0( $he&_G8R(!X(GeSv- YՁ!N5?-%W( W>b}xkVu@%:GTei~:J y'Dy穝R|ܘ&KKӾߎVKդtJWMU*Z0zEu[ɑ8!K}fS W|iLLױs;)P+TPAu yI^zǥ"Z ]Tȸq|Qȯ,kq &g9KiOb-.xNa\_Ӆ?h JӒћVGj96J7Ŷ|1qqU j1x­jv@5|STTҩw- `_Ռ}g)P6dɄv"AYE6c1ps&`#;t\T)p~!NP &^܋61MVcÕjzf0ʁ-!NAc؄dѩtn ӣ 5vVI9z }r^>5;"V9!BY \xÜ9I|X Fn-ɣfzhHheg}B﯅2I&pz0G?[HO10݊'D#RN a6bkg'dBpH9#IfupUsS3ղWlؖn= I~ WP0HL=Kw=7dmN!OWIJu `‚qvl۳3.*QswNHX{SяT3|YBݴ"H0,$%PDs s7M)\#X|Ǜ;|cѪ1& qg(<7cſ C ih/F&MBEo60ĖL@!e"c[n #?=4@GRex'k-CF ?5KNJ!_˂{R=v!0u}ňsL ٬ewuCw.G-D*QY [ҹ7(>ڍvH^.`d߱2'a$$^A>~<{?|E:=1 1bVtdf">ŎLyEͩ2O# v#l7/Kl?f1p;WitF+, C8eP}w&>;V`Y^U֬b%][ʊ~/g-)5Y}hA:N~oᎺ!:4w(Be!a͓D\@)YvY![V!>)%Mʖ#'5`E875s,{Q0~h{]@Duy5%Z& :T($!` )8t&Y6Keq&1YXA h_A.8ŭSb !fV 4]ms}L AlM- 4[N**pB҄2HST:((P-6na}b5KGZZ@0odSdtXwtRE"A&R1`*Ji/ %J!{eZMP' ˣy%C~ &LC/$l|nG0=7)ekxO~EW#5MY6i ](K!7*.)i;V䔜{-yjpvWA?;܅؁\&6ZBs_0Gl`=]P&Y눥RC6_mI< bsc@MNw<9窋/d0o?Qc~K,?GLo(bL "uJf}Z2= FA>j]җ0C=c<\zH/"5f{eyhϿHtwf|64,E&k/"' D%5s/I\Uw.lFlq㜲>ȅAT'W CtKHp;{z.UdC` 4^rxCaa=};Π w9;i1N8Dyb%gC|ӱPH٦wqB0dn:4YAolB^Q#np AgYw3˶d|PΏugڋ3O(e84xW17mZRjI9Nb-.Xk%ي<- JHe\eĬMaɽHNaGvÓi(QtS~aKm I|YM.9-1!? 6#\k eedjs TRW]Gu*qR ͋g9zgoa6Fj2X:GDY-_Y'|μ @x%-5;+k)D,l7q-І7TK@'6pB~O W ynhԆv-oҸ+jqáOaWf|/Q1,wU/洖c/Q B1[?L >@h.Tr81F=NkwE#p ~ND";;u\z gJ)Zb z Q^P)qXB_@X_U)>RCIɣ+xjA1yYn 9m?H]^`HkeԆib$Ҷ3" =WHa":^ ZzFDQxEQ S?2]CMAj"ЕqAQ8tD=mt9y q#o1Cw 7MJ߫e0`DEt׭v_mo5?ԊXAP<:S6q$X_J\4ꅥH|l$Q6dB- 4=0^d.1|NdO s$ J>i1Kqh|r~ik~þ/d~Փ{HA`}Cw8nlc*lfڏ~%%gDQ( :ߌ'h}[Y_cvH_LqNI ]&d2]kML1uɪg8RX$D ^fި& /QkMEst6 V#Pex|eM%%1*_Q}[HKhAvVS8}y1X1e oGO'[OIy<ւ}K=I`fB[BdPYx,%Ña5~#;&ENs?CZf_(%9 DЋ0#jN2h+Fqs +Yw6Ǒ`p5ho6>.-7C=K2@eY` 5 ˆPwImrP yZ,zwT@!R)b7t_낰?Զl{ }H)-@eWϘ"`'1S "1zC{?I.5G_<c8u_‹/6zM}hq6v9f, Qha `i^mT~46{o>\hx} iEbZdzqAlm_MBb3bb$үԨ]ZMyH_v_01V^n9 ªmʸJSBz _Jeoht"6՗Yk?BVH ͷW !\45QHRnj lUh#ޔp" -eCĕdkd#=N.qcR7{8~9D⢵.x?7 5:rܔ &xY5sYTxm0Uο'"h#v؉zׯ4q|)T$A()gr"wtе;ilX085o 6gYoSWPslo fP*UenfV0T,_CۋϿon8enDzq͚ >zX)P>z!WT^aߏ2> D4 F.Y]dHV=6QnS `S›8F#i -Z֘Dv(4Һ|x.46a!dBHetLHz' k.Љ^ׁ(:IVl(vxQL$ݗGXLk Nðzu#=&޴XL֬J#P& Ƈ58}'[Bj}QډPqIK*ޖwUݣ+P-_6䉨C^pğ&NBAf o2yΖ \ UK*(35%awF4tCUc^fC_{祘dąimDi=dvp2de!9 #8-;iO`\K:]˜<+;-_LFT;cZVd syGe1Б :W0Wru`[ZxF ^v,XкpKWDx6 P0=H\ҹABAMZx$O5/F0 Ԇe)H[/fXeQ0cr$.;4I2ngN 'W I-*&Q<]hZ6:} b79%D㖤Zbk] }<39x“o\췉DZ8>(3%H1d:\9&, JGKDB9eljbZ+IS#c}ёFE֖pp)f^R}TtiLǟF9u* r}|nS] :x]m?׭r:PRSZ/kJ +&neG(>4#W*TQ^]C#9GakSMiE8iG@c OCD.UYo^!s@n#.saO)_'L z9l`DgH]>=Io`GӺQmZ^X|6bJO7YJTA6Ӏ/L}mly} Tg̭YҐa-f |ۚ4W'hm&ДNxOª»5dQb@0$E7o]^"&D>kc}Wf-džM 3I ^ 7$| k~fV1.I {:܆ vGn&78"_7qf(kR_Ȉ #U4 o/;],Ov):,w, ꋮ~ (bݦ/^3?J^0odaG@WGXe#9Jot""&ʟ(ѡ]Wm<ʽE/v32 gԲ} aEd ..c$h+ i37, :"80tPc."gT?8qJW6 ̒\]3~ `lw|nw[Ra8J!i%>CAQgq}KWRVzB͒?r9hFoMNʷ9Pf# cCbzM suza۔\A0a{B$hjX[m\5im0TaC_?ﰬʣnF4U\옧[3@B( 7k#P.Q:[+ "3-B"[AO -9.ҙzթj%gkS,_2Ɋܝ.O MI!'e_C~e<)4?ؼ_xc:U;$~YNuE"F\Ȓ̦K~kIXE޼@ 8:[ڈK hMg­ȞwF ыr>KoɁa R ܝNd`,OJJT4s_]adGKA]Jȴm a/SӍ#C*؜gi ssFb3>IfTu:er,_v(\A$7 5Q<5YzygSA?7c4}.w5 S/*PPKQ>#"/>etGˬMCW] 0U)ci6v.u H]]8IvGpZUQ]?r ,j:j϶(F֬ϻڜ6F{`a. R 7sO~gϡj>kJ^9y8e%νϟĈL+E1S.~W%m4Sgɟr1~={@V0,L|l;칣p 7}v0Cju[?b>Ô5ߋВ(n*U3$=MNc/FCo9M'o`EMS?c~aM&AaCw Xy)]?קn[4OU#2E[xyt\U șy!Sm̷a\R|M4=\O\˕$i qz-Q2N8KJi1혒(C6"#, x) }c0Jukw̦N4 N_G#=Rhkϼ2?k:TgݖsC+<Bϫ: 7k6pf-yq§VvXG؊"՜nr[ɏ'TO5NgYPOm+PWt)p.ѿGi h#}F3 4,6X׽ދ=:1ͰE7=l@oV3s>5gcÔ7ziO u6jg'0(#Po]~`I[᠘3&,6]ˮa@#&,+Q$** FRHBr/N'&>.-hXU`RNhd;l,E6BL=gKLFKԙi90.cG{0[fՖ-S_c0&!ow6N֨33集VWvc:}rFc(kEumNc_yEBTO(vPGue0rRcHKt} 1y,w))/5[1 ℂrD9=ane-O]VPğ1qm;y>9TS&8khV0 cgY'rHǮl㩬^H \{OS;++:6,'HMU9`~z!a"Vgw=Hݣ>/ʣz\񒆈|*TM@]]%=K*w˽8PD^Bs!.8T`,a4uLq̢kkG0F4U{~mYDuk(;0(Q7f(f-7Sϖb?D;7$ c ܄m[2FvN )u{CKxi\#: 1aA˕xb|R3"KODO~8_$uYkf}UTͨoo)8}xaˮ`!̺Q#Z)!LKlMA{c84J|~,*coM+źP+:B5v:vn%z NecBZD2 nqE%sB[OI5_1{R4-@Igu*[Gx])HY:MJUblxXW}vlt. W4-y3|(sIPfޱ;"dH[Վ<܇6lEFCj9izthh`N\uʐN gK~cJ0=cmA-j段p-_dLC^ d%iOn_(6T?%ƣ~BB_5ni?Gd<0wgXix-+, ^A?.~/h"j,^t!NXC7{SiVD+Fy l麱Fw6;CE̶H(/\ޠЁ3E-k]Y4#c˞MYy,lgD1{2Њ 2RRL `h^kμ (BDpS=La?96WqQe9<*#'kONF>헟z-I_PRk"+zjKXϻd] 3%#Λk9Qy5ޏ~Ӈr9yk}yp2kǕ\~G6Պ8agj8*/?R*֯fn]Sy쳞 m$]rQ!a_©L |ZiY ݍU>Y+(Sdel#=b\4)1`Lt=|)WA2-{\X8^P0`/5KI=}޶tRa\l:3_{%kX)e&τQ-\j@Eg*tvզ Z?X %Q/v9WwDo?_꒓M*FbMh.a^$L,) }#.`=Wx^si衫Š,k"~}t d(Hb ^޹?G Ta`,"'fMD{JFKi"^rMA2\Y#sVw%H5%EqiW$sߡ05MOJ")0YdumxzB!5a+Y8_)8juWUV3I@ 6AɞiL=є!h)5A@ pG ]Spr5*_Axo$4[up~ ӳҠu_Sf mM,HQ|ƕw-IiR8޸%0aS@ g f~hʿ,DjPzV "9ĔhRaڅ45FNIFj3ԑE@Io ö Aɱ0bXU\¶B54>Z`rnjT*"%kL ż.ܝ 6W%"hX#k!Aa@a!hGT(Qڳ' Scswu+WtF< bć&?J^H6ϾGRw-eNpcvib㝉$,߾+D*=96+Gv5ҽ*!@VB.yvD#%%jd쒸T swU=nth\hCW,Ap ׼|$OWuf!GZDVHcpK睙vsS6gNL_fhwźpіdAjCpel/Ҍ0 ۩ !I{!in mB!S&.e"ߨV^?Q`xƔ xn<'wnߺД֦*{WR=Q>/*H;2Kt#$6Ӄ=M<,G@[QW=obdЕ~#(O:2bPnZ_( #U4J TMѠ }K+^]qnkͤdyro:•j2$-x89Q1pX XGJ>l؛VflϡOgBp+S> ]1ץFZI$=9Jbv>SNB85J/puSrD7ͭ_ QІD!,/2g}i nei560t"J|aץ5:ՖKDΝChRzUXزT\e:[6zk7{Q.ǣ wk96|h |~C E&?[D-m[E/b&tsqy, Ky[iР|i{d&.`Zn]ʹ5%/S/ !6GNb}Z~&[`os.2 h:kgha4+c [fGb'P c1=o'^#ugirˤV1Gߞ8-{9D:EWu` -+smTuHo&dY*wywV~(hלJ>ݓ{k0縎 hEUVv0 PO!0>o{"( .KXs!w@Rgt<\Y Q$;א /0c7awM"^5@Rڮ}.HNeTcyN[׸Ȥ 2$c ]:y Ⱦ^B¨e6b*p7ߊ:ףP+̇X29|J_Ru2XS|V8Gl_Ǥ4pxk/Lgq+=(#צp ESz6j?WK5 Aϵ|5|Q٢=هyȲv Y2wfZ9_vcعOTFQE~ۊJUդ˱(%#[YZ8B 2뚢SaL'_Zgz:Ё9uAsx8}W`;Bo6d{ȏ >TB7]( *2iq0sȭO&R*#>+{T4݋ˢ"v5U>3F:xW]A4F l`@Ճ S.( C:8ĨӼ`[^yaE(4-S aPhЩDoUGrsoT!R*!E$҂CA8=lCj9NCO3io 91)2BjwIx>DbR({[]w y0RZmpuoH}c}rTj|ԵAwoDگUکR.n]5Jy|wGF4? [E7ѮHqOsRs^nr.~6^Wx+-w9"((w)E]fuz&Ь舆[qu^_8nQ( &D{uxW|0XѾVTpoҝ[R!Jq ڄc(Rsӯ G=q:}>@Gڅ /Dzf}[SjZ~u/#5ơ,b'-L>β6'ޚl*BTLcm|-gT{kQD+SgSB+1̒Bʼn3?s8ϭSnP\|hAfOs,2AMj0<V(Uζ!ljЄ67Kvô.]N& 'Ree6i& 8glp}hhE\lV'q[6`Y"?FTZixQI?4rn:<}:d(>Wpc]%sE7k'W2`stvN#aybw^рě9Zg/-m  3Nw\.Ƶaun`Ȑ+Z!IA}bpqeL o!2n3R[_mARF>gRaQbpzj=kH&&Q<>o2\:Gv5̮9k P1cV<u::{:%xwALvƒEW'h+uX[cRǔ"cZJ3x9Aj}*H([qhK<]j]A[ U/nicKMDZgLiE8 qfZk3l{r5צEa0vԼBBjX!7f v9STS:SQ񿽵:($X7[: ٩7eb|>̞AEg9Q쑧VUp^kÒ55(?H:8v@v#.E/ߓ}**cg>`qqiZI HdK>R*Anh*(ɹH>Nc'%%;Ϊͥ:wo\V{A4qߞhɮ5^?a#sFga*1c$'rه1DtHt ^}T%.D=ӱy Dp5f۝Ot薮+ƪ80e^AX/+E+=kVX-{+)'{;-a&tImC/.3jV%#k{CD5 +m)A@g8/"$!~h2}&?FCE .1/C'yI"LGz"# MOuRQPߨ:L1iU3?C>/kXZ6()GfD{/@f}Wy϶)YwL@E\v>z."{8*)p~ ;K[@1WE K u/'o7H\T;jүBB4W4h`]+,NIl+nQvR䢦voE4ʛsE?K߾Qs6cS%HMIG QU!j.Yφ8|aZ: zu0C d~ ӷn=lMNs(_o. ~}6[<ۗ|W4Nw6VBҗF= زLxpK泽@yV2{*D:yLg&Gӭ1sB~mȌ<?,6u $AX^eDNAAB_~qeJqUA%'@oKK  Mpˆd!e> _Nj>PZ==+.CT<\yakV0w菛3ΣO >/7*n5)omqd;eGG;Oއģ!{ߛroHYǙce0l-hUS:+3lӳWB+Io;H5lݳƥ u6p`(V|s'9-ln-Йx Qд6\_Xv[o<&fnQXLj"%,j~jJY+jlC cuu30`:‡KP *_%/95 xCĨK+Q6t/+6i[Z׀ׅvD8cy"bĆ>> P3ME8l6T J7 ^ߡ!/-.{\C;ŮJ" =Aa d6IywRǸ 6lCVmGضrR W8 Uoh5YZ]jo.™?Ws!7D%^*]ү}90O!2Oف#;dKdmOm DxV[0D A(ڽ*{@ۏB5jZ)^fFy|D" K1FysP̷a>3I|̬ c8U2r`Dp&4WI3rIeBUc^s-OχF-X4P'prT;n*P&Nx`B&v<%ZAF1'Y}q\&+Q0\ߪ>=iUg- <8qpLbq B(^[LLj8 iȎE.t0۝/\ӌJ =o4K3]ٗ]?( G NPVTǵ 2M^*s9BCp7zef8\xrH!H=uAE">j Lgf,C]1E8ǧor2KٞI\誮 >ξ~`DA4Q/Tx3h4をy|2 ePVeۨ ­ϼuhM7 %/ΧA=IkvECp|U3_~u&ןVm35Gl*ֵW, ϓ-GpC1q,F`7_dxcA0K[Z?*)۳ `Wec@Z(kWjqn*gKQ3VzètBd'u@Wg+0D^z i _({;A@^lJ8p&, zQPD.i?<8d<)1BA]ﻉ CeX6wMhc.3  VT>e[܋OS;F+]lskk\+]zw<9ޔTL]ș8|D,CK8c_MIOWfg# -je]U٣πi LC ^ HL8a f)]!+n^G8eU[Cx_hͿ8/!T`Lih ;Ix}Z^T$tlhC7~y*.gvn0v+M֌N#%惲cVMKOgCMOؗAWv9\,i4 ;DޱrTU2jZ&ʬ*GMv0Pe;D|J% !JyB֑BnMpm7S>28mǤ5U> mfy[6Em|FwqJ#9n/uBw 8M_I:=dze`?HpX.4S;?TƟPmlĞvz*RŽBk@E1Q0>Wv{g^]J{׻ExfTP!HuWمۼ&j,2`/{`p~}8?`q?<O/>]/]*׵.Œ8!l =-2=7 4[! X*hy]amIBv}`E!&`Tw(`(>mm{I%|&І//oCRl+6AE fufh~PsW_7;%wgYT * XSG}FfSW3ֵAMsyC8|%ǟj\$9_ %:dT p":ꋷ/p7,:IM]y8li ܷYݔpҒ[[0Nsz9,FoEt2&eo$-o Vìݓ=&:"^z OW3|(G qk-ї  ;?ڧܞѓ 'T[9Qℍ3M0A|)mT @\`͑P҉0q}4C!-{ֹuyt+ &JN4uA"n٫{/3}~.}#KG 6dSa)cFH=[.ørsdP>7NQn|?{;)}4w=壠meO1iSxӊj)(b9'ڡ2lvšl[`ROnlx;IId7Zbv*ӊ`~6~h:%$gcZ__PS˞q _OT.\K ghdyV2z5 t Z!ij0Eʙ$7Kl2.=-Ie=<<7t֝zH1=e'V%l; P]Vu6Μۙ6R#]6\xKMүIitrbVBh*O;+U@`YiU(lMv]ٽTeJ?˗Um5Dny_K r>ZDkA&x, ~)ߑeH>.|`Z'BoŢu;= hRÏ$y֊te;}6oYA2eۋ-"t. vnԾA~5lpS9M*q1՜zߢ8fpQ=[I&4autUVF 4}o$yl4;t9 ִ]p)EPlҴ^מ@pϭ".0w^[DSңS38{P I;Rv=O<$M\Ak`f(A&M?)}5{NL'H濦kNcYlM/ fhQw01+!0pl%_-7Xy:b2~Y GL37enD sP27}"B|*;k;֒,ϑs')䘮f+H_R`HS!q-` !0:}/яJu Wai=N,@oIt$o+V$^:(|T U9Ƿ6:q@xv|Z9Z_Vgq+[8'oL}~Β0."Mz,syᇨZFL2@9xo>x .!hWEL~`w͜s3M k60md݄08^G -#erOܾY($0yܛop%X'M,i0ƶƾ^0ZG q*r¬ݭZ=ΰa di~r2n|-(kK#bH7'ݧQTdCUea:ϪUXszѐb}{t/8d.MelVK4l'R9ؕR8'g\tFˍwsSIUbt-Ik~9e]Ξ\,N1f~nxJ;mEfjt/eA/gn+nmAjyjaP$TJKdcޕ;İ_d< BTuZg@-"4X:P2S@xV X Ӕ|l:qXy9#>զ2^wD_tQ1R|uG*ht]e+U>qξaW԰3 _F$WnlhOPΫd|{)*Q9-0Nz5[]H˛E )yy dSWr(P tl \И.l))86/N:O5Z"o>؎0)T'Tl3WO>|vB<6 &ked~:}:caoi6XaݞA:73BI6jQJlܥ\)^Ҕxei]"?3sOT}\ >ޖ(*E g$hP vn~LdQkdp3$ \FoD2>'i ,D[61j`k~ic\.>#2ץRW'x&U܅Ub f{0uwV:RE_FF,Ģ /-k-fizUHMA3N{ x?Etjw)H/+ O4)H_X<5}w>.݊!i,N5:Tѥo3h:SF2.FC+SѽqIGh >ˢO"0$F &:&#A [M&D(2w`uyI)A|VI3$ğr됛NqFkroBCkN[Es >F;U:)?J2٠ZU.LH|_׭Sh].2z=MQͭrUX9kN`xPZn\qHlϚ(898o؟iE`kBYeKY+n hl  ώǘ0;oXɜ 3 v~A@dx67iCH)Z>px.L!13C\uW0æb_.v !(X$em=^+\d/]  U\Gc7HDN &!F;l,/Qz϶zo1#CsU^s9vq񚵞MLFlVt>UUP_6 H-lܫ|瞁 y3=2!g(R KvTJW_[?q~RTyM [#+V;UEXKtR4 {J2uEp44oa0xAnU^iF솒9fiPPjLoRu3~cuQe%~JdS<ϥ?4p Z3&8흗6hL~0J `xz%IE,- y]HZJ++^ywJ*}Ҹ!L]4/b\^֏* tMVTm"]ȡw4q§J>ZM:5is4BM;|/nFuayب \ĢOoiTȘǹ.Z^a+̸V/#Š3=C4$_R_MS|%4׎9W'RqҠŀ sc6x|qHqx3pB.LJ˜Ǽ@yΠv- jԙUyn(f_LakP׌[FDK Yt}= _[ cN Ѣ0e+^(]hL4\: u~;7soou I S#4NR@fӅ,ҕ>v&-sl\hAnWDŽ9 xmVYdΒ|f ;Cb{kO`sv1[\fOpnqe Fй22kv7Zg sWs덕?-o,c=H.' km+}η'IkB^\My34_8Zy֚ѣ̀r ίIwH{2+[$@:&5{R&_Th/91wҼr6 91K3 Q(9. ZlBUE [pWt $I}|"t!rhwv"2"ū꣛t&x$A,EҢ|VTΙ#nG$5$RM5ҫ)߳(  L "*Q9k6q"l,`BDA_`Ίìs$meŀDz(iKL$Ll`童(:_-_ ? ]9^ qo"\$J3ElDy}^]2?PE(+u D;qo JMn,1#}#0/?,.b"Mgk>FGܞTNoJÚaeh cpQBp[-KԘa/4Ew,jd;K;nQ%,3\ ٝFp=WOPfp.<|+O[szͲ+!I:&4BsE.' ]ZhB权@oGrV4&l׎e1@&& Lg߁ʗuCE ^_1!cUӋe~iQ : .޲a-5R'n A&$mny`S''*#MCz&H14b2P>MC{J 7,_ JI9k1Iprv6ÛK壀CH GLM z/1IpT<2pb~|}Kj3, ݿʣ$ϛβ-csFƗXMiGLГX0BTqQϣx8XTUnd6Q^w'>|˘ HtRV~)j=$FrōIZdf2vPEvvP$ټKLEsKy6쩵ԵFW cK~Ƌ8O )p9HwuZco->,گ '3^׵F<:CFӷ)uMC~ϻYpţ DiL[޴ޕ"*BOy#UTF.Lj bF(&#?6NxB {NzTidyp_ 6"~k/yMX~r6J DB¸v>R`2dR&->Jjb&ͦVx#T&F.N%ar辌ˡ2;[VWeJMwERV[MU6Au3wi)zUa_o+LDܕ 1Ws1 (j>}f"߈A[̩Ρ cڹt3re2Y "++_=<~խ&҉n1@0ᚬ Jo{Jp R>7YSϏRH=Z|Sz,, OR՞H}fk8$k*k9)r.>`u8{DkGMI̼z{`VaO5XLsrv#A>P'̵`"<˜bGͯj<4ZdpBZmʺf2kg-%+ d P,U@54m*kͻGnl Xқ" bEB«}/}.X|@ŸR_z=FievmdMfsF7hFu=ˮy8V@=eT=t[2 G# Lm(+(7h=ŷ]yW7EjZ5piM:pyN✆*ri,E и-~OS>93ǩ^dO鑲6M!يkmifw[ ~0K|AHs?d#Byo:Ed7 _fI28u"9~><{ #vuř˽6p6t >%z8 _kq^ I|:(p#m/sEH2%{Srr!T[@/jU=+.{7S:ƵEV]N$Q{ }!ur.^Xaq|D?ΥI<5pD(jeN VÂ@B%6c ^Ȓ.ڮ9Ї2_lQiit5.^ڻX>PS*J'yWoB:ʀS^쪽ߌLAENSD)\Yzѧ+}!߶Ʉ]O-! n֧,Dt 7V֨\E7˥πZĠ=le{;qUWzh GW5[7VITdc:r#(DRQEJ=XH HBn.g[;81әC֛7J\˄'&hi cϓ bGEMpˈLm28ۚ?od 6-[Z%k%imV\1u)7lu}/ȐFѐƣɜ9Ni W#85ʬ`%~gdr}P˿mSvR&I>+F_4'/k!u%&(<byp.lb,-I $̀3LK`/Jp*v"J5Ӂ^\ $J`^]_5w?giwE9 ,KN!FVҘfT[ %T]T웸iFH&H5][ίVSj# RbO@GD"YfcWk>vx]/zW<>䔔"#<1ti8)-9(Ŋ6gKS3t p %RT*xYg)OK€,yi"h(o,P91?=;ShX tniB?YK~, uDpH[pt(5#Oy)h/&V=GwtMK! Uq%>C8D?+>%, ԑ:U~y⿞WR{/P)%}㗓FnpzUI!b˾[u^W@y}ν"SCQnʉЈA{r Kp^۸1 ']·MFђY-Nmhzu2 b:-\' ~h äTmm{ RM*\M/=wo,~|*%z [{:qkžMoF$EeSp7:n=C1 T:JLܸ@"{4v 4e0E T.5FTL$]%d]auFXϝɯ(3G@/ X0kٖV_=$ '%Z\IUnF~ Hi1R5t~?_%Li( 齪_ OUBSNSw@ 3ƫ8[:[99݆}bb rQ1Μq&y_')-na,1A5PUHXJSn1STLTܐ Ԑ97f!KZ vFVg }V]bS :wQ@ 4&E..Sנ,on6 0NakZ眸Үo܌동zgq  )/k=LٯpNW4T6A5zwK=>ѣug{Ȱ1*`HFuGҿե!Lw2uȮ:~L@f\; D lE#V9jsAT Aǻ^@K@kkMDىlq@P; ׬}@͒Fi>q\TqIR1zAՄkMJܚ+J=!~:]ӑ^Vi'lŅ-(p4sdsm20 պW&&YLcJM֭zlOR?ѕ)[~Xbմԡhvq`fyv*@ @ ri0G{hh_WOUI=L'L_iº~Dfɻ޷kC~{  (JbڼTC3߷Toltg므឵%$nx{}7Ċ $CbP}jAIp. k4hߗ њ] J_V\7"I ARj]^9ɯ-|^{6!Jk-,xÀrϘ;odiu07>PyT,hCWX{{_+&\@E `v#$_ׇYULsmfB&p-`pX5 5V%UR]v=4T-!1d/,~*|p_IgsdmmSx0n>JKS2bQr9RZ~t;,_>(L7?~WivHnO%'L%{0L A=@ s]pQyl*jաBg+eF~k"8œ<75;WY=C]9˶> yZ_–bd0{&#ɺ+C5w qGI68ҧ醈e.Y?驢7N% SڧJ̙-, ~|-mzUdzpg"\i;{ZI.bE`6+kMiCWŝǛ$*)'`o͊o7uD+nf IDij+Jڤ$ZU¿ '(:iK.21VLPSw]s mǿ*ϱGpubE Br/²h>dWp)KG`;J2J BCs&P5#Z&>:RnC /8QHq6<}/f*7QqW%ʵ.&z} |lKl(+Mra];<@ %4@#*k`7l{Sφ=?Edp'0HlbF;ۮ?Ƨv1aQ׆%𿩞;s",ehS'M`Q|;Hz zu}EW9 $ C=Yys'Ԭ ؎yio)D_*a YmE+9+RwS&x] iq@rJ^Lv̓)@&leβsAN;%KJPqc5Dt&odW0$(ɠx/C̛NnVSi9{ kjh9V#-o_I,.<a0]*4qz"=Xg- !.Tֵ!v`_hXP s{O͑ɸ4rk4yVW*ڽu_UƚP`?@ ћӚ%D= Jz tTmzd4ڏtmWc-^ #7kU ER] I"S=.QĈnJD?73oQρ}c(Ӂ8gp*TKE2"4 Hfh,QBqj jPXڊE%#aM*L-5gc 56 Av?PK6Kxzi,yA@钉Iy0"\|A,cB@NB(f e˛s:oH4s |ى*K 8688kwr2~#Io[uȘ(h5oDeݷanQi;&{ѭtʑ  > bT֒}EoP[_U404D(/{*ştfvykqMwgք`xT֒D0-Ip[n6 y`.@-5'(g9&?*LOC3f˴UJ3%[LV{ bC^ZAE5v#$1TAcޝ%Bln_;A@pF2+WN:K4 zvn6DvؼړUqhati*HHMЮŶJq~zK'H!8##͈e3]nLJpϴF,cDj!? jgP9-宻3f|4}|<5 $%1w`sݷnzLO !Sk}-PKN|dSGZ2TW_\GD]1t)D#Q!/=Dr7ݴfU]pNVRoL eh!{X,_':]HX`YWvtymR{e'|+˔bC$9wY2.I ^&3UG/YΨ`]v UP$Ik5(G NNTq꠆Ll`Kw-`(m}|zߺQJw-@"r4b"ICIzdw;Sv.<3*Ź' Tz,pMBMhɘ<4)3L  %r5 c|vMU!~'7`ߕ='uOzxrzNt~S,! ui1Pv,\ s;(ɼ6ÖAVAhPAɗHꀿ]V>8!McNc _]twQ$<]x;Ӭ(M= 'Kv(*3L!ym雟*; GSȀ S\t{Vk P.1uQT I%=a"Q,xG7h]bzYi\XF ,nH RCXᄍ A$MDf_hp8Rt緮SwIXVE#>R*`~ԆVh`7;Lɬv*r^ \i![Ja|ӚgnJ.􍨇@,_hf5d@wUF˻g7H-unG>꿫*.:HhB[%b(3`'LsT tx%N 5c.qJߖSyuP(N4_i/;&04%Tlڜ0֞HRͷȶ +CQ}PGq 0mPxnrN6 a ޒ"f=CwVхNx9 Yz~_UJV>>8g֥Wk )7xŒNH6Np^9.sqd0EBA`V-jH`-~}j5o&[/ dUN}ubB5,}}j-DoT~)d\2h6l-"b0ˬ _ 1i0Aג!`rDqn \p˥/9R7u}F]wÇ%*zNXBzaZӗCk^hX1Dt$*h?y]Cgoo/ FMC_u) iJaRZ -[\$ +E9E$!HNTP.O=blLIGIA.n|){xk\-|8NX-" O[K SZ i| jK<Id!!.Tt2cjtnY Ӫ5^|stEũ [5{*>*Nz*BTEKSq}[&H3:3#\b8v;ywlaDf`ZH2(dkG})ód峳ĵĦqUϦClXʏ\DZq% <}s܆CIbΙ6Dk// |P|?[iGw-u6ή10nje_7MٔV!?Rvsxè^}omE Ok R o/\Pv <fCl`Cy*lj36j O(7S4OѪס4J\'rnmQɸsݟAIZW]K;Ё, w%C1+%2"[ɴ(:?,/2h~fړĮTeHS4O1Ȫ*%0EckA\ҏAn!;oK#'ay=Z|"J H(NэuT+ $-kGvUsRcs,u8҈/ņ%:}m {)6e;o.b Rkl :y,ʯj͂;`ɸ J3tt\C?kZUW8O}FW@8:+\PT6zopUZw酘 ǻ&;ɓ uÜE,IqҚ( l3ITXCWa\-A傱k+ߞOu+3#]0) f1R3e@̓ 9Vj[o(Ź5Klk6Vh`sSbSH(\͆ɤ?M 5 yC0D b韓 nY,ӂxI-Nif~{5ς2 ᣝc>M\/ʊ;]D wɇOq9䩵O<`mOg{2sXI!O#7MżIƶlj` )t&&4#A!O BhQ$0<F8&)6DC7AwcV&z@w0utj/~p:ijǤ{ ^py&^TxU;+v* %`ƫǻJ&UrtԷM$CΧ dft䝭D٢16T|Nb(O?؅1}Y>Aq5J6 J7)hWҽ+4b/M|dl rx(K-آآJbGm}U"-|@ N ^!> B6rhM2L`U&nP;Υo )TE&RDL~*W!4Y>r K"+qxq%{:eJj|5`<0f_iP6) wg?sc+-Cbw QM;3=ğ{G0Fo}0M̪MVz.皖{ 4&MwWAj1`,uZ[,ar/];}]y-٭x4X߇ ffFY +]q.G+;h+:V F\'ڶ|/.JVmg$#  RQ+ ~3M/aEve?uǒ1=:rEU//uW}n W%Zm<Q'y4h`p z02 X(dKADZt_ն" u+wRlkxq㔛Qq;6ޤRLt ^\o"0 ̸խ45rֽl0 Y͑80U ~9z@]eҬ i8-]#xK}:\ૣ&ɡªEmDxRQ:fj͋ȋ"~>~y "8D ѰNi*a2B'UU-[`rhܢƩP%yg$䕰Ђ>CႾc.*29l;D1Xpֵ.S0P[2ts/p?y _&&c/'Js'W2g?d³Zǩپ8X GC&w6#KE bf=~58]] 0C+/YJgjݛ;T7:4Yu߳ezY:(z%vyA)rn7E3֫PQ^=KMH $)bt)ٕц쀺~YròTj•rkTIt''Z =jj&dtt\ j&*B/ i3ҪήˬGycފ̎"A!.MG{_ h6d9:b$p3NҔl|H*%qޠZv(\~y[ғ rrl[ָǂּu p :#6"k~pgUG[K.|XP-_]x3RJXdtv, O^G>k'#-p$e;LzCj i7hұsg .$/YJd}RBSW=L]vi+go}nAl2pXFuvLXZӧntĔtga^; NP0eS(oJmalxD'RN-&IzmTZc?4AR5pИ08~i;.z~C R8/EGRZRHCkP^{Fi( 'E FQr?Hs qn**G^jU@u^49 !v FT2Ȫ=Z<(ZKڒoa5}{Y})bR3|U4sCÆ]cS֌8b5;P5MBB,uJ[ rZ7x(͸+[:]YE'h%q\'"Po+>ѻ|H>|n.3:pjºc=mIK>kdWWDo*tX "ē&YM 8ŽTx㝣g}qAOlunyT9ƀ+*.ze 841hgHIB+A$YA p{oФᵴRJ 6TOۧl&i% '> F, p/A.%>| _JLAZ]>lQWU58*RZgxL4"FJ*mVf6&rJFtEVo$Tf/BިuV:>4ω.S('3:qV/w;抙 ViDѝvXFT[N 9C@y}2\,! XEgh' SdꝃTX+|#QΛPf?*U #ݙ)^ CtYM`f̷N5G@2=6gmȃXL.uQ .9ݠFFMƤɸ:G3 Tz^_s J}LW3| TϜӲ}+wŏ;gi3*ϺACTpܫOQHrORBbk2hpOV%ya0lE6t 7FA^d-tbڽ-kmU-KßZhnf#&A07?g,wKFM^fFp5m\u=Mfa% exntO|8е ^,\pH ~7Z5y|WEcMSӹ%h+mUȽBj ˹5U,ץD,?$5&*vٚiz|@)KR45IRHS"__RE=ivc^翌ӡ F2* ю;FGkbl1fBٸ{f=F q?.=?OyezNonDl-+,1 MǼRϲ9YmUål*TZ5YG3^m2xW!:bMݓV,<5#Gų)C*m*s"ʯGޙA_&*O~̭= r8¬FM)<3ܟ">+ˡ,q-}ۣSKMLP`qvՍk?'ay' C8N5-?wً}`nooNhQ": 錜̤=E{zLI(6ǖFnÚh2<\eM`r-yTXDrc/4{D8+9s=)&e 7CQ*R(<^8ۑzJȿp]"-O|I:6` & fcj~ W{r08IOsX<ۣODiWRMHr֩P=8zj qR>EbOm͕. ;I-LabGMpQ{3 QΙw$["Q^03ZdoWO^p.8¯9]U'Y70|/=\^pJm?ԨԎԁYg81r\AD숹1>vAzbrd:4 ԃ+gG(H05ܷ㧜/\>k# noptzt+]O!D\cfѪnզ&qm@qXtiզm$A3lײc6VZ,lx\׼ VYf<1kǾ#tY_ǝZn[5_)Lk;_ 0;2et#ٖO"g$$]:ELDB$h2rS~ umto'K͈R:ʂ7Mrƫ]FlFwRyd r5pK:*~%N&9.V{>9?ԙy NUd`יwGk"/{:T EgP%5T+-R{jkY>B3 @R7ʡOK9L7HDZhaCbAoxgZQ{(l0uk_ iW &JU(˜$sF=uƃ*R.`p9ܺxlRRL>'7[T& |h^a/}S2Fj HetEDCRH 1Qv. j&ޔ'y6ŊE7MliWww%p|e6_*y9).G-nkpp)`? |o'i5B}0zL(\1aOCre &;}~xv/ m泩^2ٞ=F>[ Pwt}Y%Pw$Īj)p<_3HXp AfAޮ㫔Hf]{ylM9״D6y1xkX^/+`qf__ @ }m<ꦐ0*kdr^^sTHOUn̎bJP(qd'"ga Ki"ZzCtCut`W"A?Xn͗k5 /u2*0AyޟӁ84H۱r3w40{|S3_}f>)s[qK鈉y`ϲ ;M/=_1WkTy`V6M5Fu5C+Oey/sX?}'`PKybcr8 1<}vip6#oYV,beyJCeC$,!(1I$6PxEPZ*h\[t%  ؚ_@7 1ߚj`dHe+:A"V׸H`6"*,'Ji$L/2wMOa s.; \Gdu134``Po a`p'~W9b12ѯ|}Pgr湷V7߃H2? y! ܭE͈'{'5b\IRXUa(h; {[: ,{,I Wv Zhqkuvm—nNʢ˧c.2) ^k0T}@ESK)ј#LHS0̑&vX Wu.uW,-^ ׵JPGl,ד^C!e7ualtβ- 5hujpj xBI/}3>O¤!6sgOqJ݌8~c"B.w6M:ޥUς8$ct & -Df' cYϰ%Hk\M(=ؤ\N ؆tZXibVyAi}qP }^hwM TUd!V241ў/R``"2g Z̓riV#z2cWOD#֣3>j"'f:b| /sAhɽޙT_E#vi  WKr4jk-abhg+U%c0^,*[j';aSU exrF@n8Q]w<ߏe&d>Tl~V&F?PU]#VF7.ݖIIN49&/@;jvjӛ$k7>-IKf0"WP 5y^+&t֫ qh.ϼ6Jg:~1ٯnL aw;fky:-uA547~)L4 x>0ڿD}Rπ~[ YUS<#&PX:j3鞴=Zd\^kdDyLd 3(c}V<yԃY%m7Z.Wr 1%3ƞFn 5{C]=ʯCs@ C7GgbwJy;9?=DѡpP͏+= F *zƀ0әvv[53 '\}es2'dyfWwE[] l\1q+?f+l B{3p1]^w"*ph vM½5b"覓3#>2Yl-hoc 7IW&Q;'(!t3:bX'*7|6ׂSCjh#@enJ< N#D9PJ.̙w&)<5! `Zftab#}$_sTRᪧx.oY_:9Rdu8@|̹y+)"aeEleBupը UayRR2Sq5[r14I5 Ȥ7OhVy% >̽mAg|"׽O7XHy oTRo񆨳O~t{K۔󿌌@̋bbu|7@Iz3;wO[ZŇ &Zne ُ;d?S}b 7xгm ޯ 6+;&Acm|$v:ij*7-AMP/ #?TuDs:O_d`{FT7rZٻmc: !:M)@SOeP+V J*眘$cړX0;RGdVߥ#in8^c磂\,W⃅hUol8 XZ=fk/O@QOiD\GF "ꌧ [/=@; [$xt9 • ʖ`/ѮN/rաF UydM;VV ^ki1 !9%(-X![4/WbUTpF4 H/O ^{OBe ^vUIk”dz9?9ꕆFYn 6?JM$X^2L^+v8u,V)ī/L'(4]$>MGĽ2?nx)%/ Irp|Ʒμ-9+G'Mɱ7)Vb#5'+ k`X.'BlIz6Zb'&Y7#m/p.~.a ى]7 ?qKDҹ\/쎏i=V , :b<`Z85"-~X}B(k#>〦1M_ͨvNbdD3aWڂv.Cu˭&?L;OWփn*2" c5:4uF.>VNU|σowom:gUpP \J.Oǁ WwCFGQF Jo( lug*Ǚ2Dl>-%+4t|?Dm2G%T\gW߸N@"C-g;,垷>U΄^V]xO;8 ~ mCP[߲ Ɂm {Nf5ާq"bdP` 1`2{X wta5*[ZmJ27$ %r5>]Ɩ!&0|YGn롌 $ >榛Vtm~e۹WOLlC29p0, `n mP'e"@Cw$yY7"#/5"T}6cC}My@l{#x9ä\)n]~@NJWijTgKHe`KƝ8wTGt7g$ξz[|nR pR2ıqᱤOgOCEc|tĢ"]7VE灰|iim7/NVX^w7m—BS\Hv2̓xN˷;ؿ<_F w;ڄ ?MPϋWZBh/JEJE6īM(peLZq=@.ጝ{s=Wѹ@](H.,zk| /?]jى;t؎̀MS1njq{{_~\D@ݭܥ| {6}r.6"fj@e sRȂǰm+ F_6X ^{%5`@(nifMSJX ` 5 cwls t2 ~en9f(Wej٥IMg~Ήb(x@r>iIz|'Uw5ڙ?UĚ[4$YDyC ] J{d 4c#EsEhrc$Qd?!M_t8>.m嗯6 Iթ d { d"?$zIy?1^(Yrp~מULtmz,-Vz&7.AEe-} hif]6!f8.obgCO3DR =P!Jk)ø (A(K@ lpIBfz&ۄ3=ĨG*u2Z?xߔ ڄT˔W HTo_[-6&Yl^ta`B1Hgi)#xH\lL*QmWv|v7Gk㆗ZJ3 5۲TT~~\p %$no\Izs;n>"@]2v8+ʄk^L ݞm 8s.& D3!=\fnaf˺w )*ZcYk_ͭo| +Ηc&2=QU@LfV!Q$_(>:zbqRek8-O<,|AHEp^ICG/)Ѡnj[֖^G*ȝ?,},D[3BH׿)BNi&8h0a/FhƳ= \I,,&jmsKkN} t~&^Wswc۸JtK5sW~ryX3"u ֣ߨc{5߂7!nlW9WՅ1j-9^~=qúxHĉJL [aVrڭ P>"R׍ vZWMN ]UX[%E%X3fGRlh͍&S1үLsi,|RɃ;w$yKj^g`xH.&]KTjm=j֏U O]~B05mP9o~:Isȇ9qǂyW+nUVd1 ̅;?i] 2ڬ}Ē &O*V 8`pu^N/Jsu]5( o~ͪr[;fSeGSBd FBEramq~A U S8WTnK`ϯUZ]{M @@>V;NC?ξYJ}6V.I l<%0d.L>孓T3@]S&{6qb.8.QTA9ʐJͯBLV>2՛9u>1 {KGlp6 b _ DtMWT:7ǔ!ƝnKt0z %VpE/ e;GX .c|ȱOexk{/E|ԕ M3À{{47/Јiy~ 聎w2R^ U3~B" Vϔ_٠,0AEYAqF8OnN=IxNϹL2'!?%>uce*:=9bLvwb2 YFAri1aszͧkvk¢պݒwHJ#|In6@k,講dgHxC`^{z&…K:ȑag62lmƊ(zLM}]Cq-N?}ճ[ ʀ$B0^Ԟd=9[_]sreh!>F=oK}s,dxW&x6_$ղOX}#4rBM^"r`yX>09mB|y5_M 35v<ˢRro0#xޟyY T)y oǣ+ .,}@ttYmPܖ!]-2Dr"iap #(E̋o|HB> LB́[۔x$Q;4Qq!tp+v`/|GeU e߷Qgćr8eo{|V'"쫶q٘9&G0 ƆjG\ЙR{Cj+j`RPҟq8*F !oW ,oQ0T*`_Iqa.VNѨڪ߃fSg6#4'döV}V@9~ B,uYpGwtiObXSzT*/^QD@m -tOn~V5WK%DMQ5@9Õp.jw&%5'z 21D+VMv3r] ~}= 4V*D_b+Eν668caXdqglcHC9%%xj[s=0ȧQr|xtMAd$ձv&3B[)D{J8? "կG,~yn>BD>m Sw8ʯc֭Qj#?%4nAnksM Šbhfcz;JoRg2渶4 blWSb~f}ּ4s,_" O~)๼>oNGjŏ⡔0 5{AY%8EScF+u,9Gv "3Cu XZ֞*Z,e8Q~4(= &] al?n$pQ&qSom(PjeBb1"@Gu${̯PE'IQ()p5Wz8Zw"jJR΁W^Cr;24d#{'roM)^$%y '4r R좰nm[e33338O1^>_Xy:F] j,a0P&"Ae1ߍ"Yx,EtDc5  ;ذ.ʔ.Lt8/#SnKk+w}NrOІ_N*Eл.M҄`}Jb:,o#5˻zuseO瓖-CsƖv!ޛ2er'S;'4d1~ 0^' &<BXrEkh9R<0h@Hh6K1)o tg|OOg>/c=A @BfI^dS;)5 [>^)_++q ap!(7 Y["HQ S'BSPT#vV'!Nih)x K]pL b [NR̻с^ <|0`3!F%j1-|lx ǻ}؞')߮xИDJ3ZֺHe&iT|anlF~HW<>{sY,Mr4 zل5U1p5-5 @nĹab>&E}hW;6ToqhV|69qGیV4=}!;BsVye.zQٱ ~L<Sl{eYQu$YyU`"b[g|/1ifs"%\kQkEIOۺO~~"qgԣ6⦑˜x__Thv= wp?N~XH<`3Rd'5du~NqgВ<ś bDAf1x^DmdP;܃RB:˂ža׆D<ek Q$4XF="n*6\HW m$!y1"}U/M.C3.xWU@@0NX錽bއ:δ v1qԬSglCΈ\7Ƴ'}SgwZh~JH%D"i=?܏C *Gʮ?o//"F4j-[-q +ӽ/`jlUfvXV;@#jǢTw ƀwqNwn 8/bMAi+ݿy K6'#RiCI3z5o2#=dQjZn*K#@OfZR.hd ߋ0b^?䏈L^ށO'/b{ٺKlIV+Dkهľ!E:v*or]W5 |AX^)p+3TTMB!؆Y7HYtYob^ءsI_XjЩNZ m"n>=W*G.uhe&RʚV E4g3ze|WN}J? 4>]KD[$ 02AX/2#JCW^ r җ[* y f"&u:@&P*WL8hAFm&Dg('^þm֔ bp|.Kp߉"@7&TւMPFĬhK3G{ 8D00س_v_]A`=v1yr+bN[T^Hm;cǖ;|*[\Gc#({tI'ԴdVo ^$u+ڕv_m!FrGϜ7pZZIg8UՂ0!Q P6=2~҆B̞^>BZ 2+({xHHoƊ1z1P+8pQsͨP>"LmE^!sG(]0urH3cF2lWZgS 0^ԻU?kO6["m4CPUքgҳIZ-oю—THDJ( '`h}ggg2 !J Fv?:BwИSM=2K.+M%Qs5ĕRps`Mh[Lό)_x.>+E6:l;x/?%.Gxz{eY$ֿ]=n ݳ-jCgJɡёw=aFyWp>}\mJ#e$ވqj<=c?Nvk.쇅гna mH0HNna;;kHe2?wΓ|.٫GWY">B7@ʪQWw籎>ƉOY*5SXG=.C@]6*9 6oQRhɞW@lכ 3*lFCLBe10 9_ى CwJZ(7swP˜J~ O-yɋ6/.>|WTk[Q53n|5](Đ-8rBhf?J}|ݎ4-GD } 1pcx߾`ݱ @o^~=g gPrt<# Qf^SxwQDrΊgC1[B2zN(8.➳SC+3*Q!838sV逶I {IiE:C+IR%F Ē~;p/VOA[y)aEO^!(+Wٵwnՠ"Y`k~OjRv_wp?v7q̜}U]h.!f9ayQO9E=[EL &{ yp"OXĭz$⋬ȯ M @tMdȕ?ڇ;``\#p:>) >-LB':M#KPl?V{NKOswDLdYbc_ b5i丐RT7/[P6-f7yh}f0]0Mț֟9b2Qcqn%OmHh5;_t zlӳL81W"qNyIjYìirۦ8PݖK7$4-E˕nh֘i11dRvĀ]ۖsjmFBPi--{56t_m=xn|66mLb#7 x%|%^L ^c5*GRyjcBE ϧFŴ21 2"6G X'Rcɛz#e:bVa3A6gN tC%Wp9&FDZ%Ö0kQ-X Z@ l',0n.'+dӟ`ptϰ^sqsP*^68vI&;Ywhjkw,QꗝAZ>$u6Xk]O,vNLyŪWr z'c]T\rz.HpD?%qXvjk.EZW3MOmp!#6h?2Ĭ]f"%5Gȏ6 \ fV[ :4(F]ܷ5.#a%(tqBP W9wgҷ`"S}`qbB}MLRVyƝwK%W35:f+Ԗ!u);zCqvrR(38 d "x?qRov-UM U.[?< ooVO;c t4 1\)D5K .@֝oP9rT8 8n٢EE&=tIc>T0>3w(M<|)[e2Y,?7 Rw{-;UA9 RR5y"SA=rQ+n-oq8~ai^]oPPDVkzg.EtU6{4 BWL[H.'341aY7'K[V*?nCWSt\I"lxqs.Z_>&v[*Pwl$(AYʷC8,e>[BۇR 3P\hN'E2F`FPrЬ<,~W؋$Y;%jtZ}CDX:ezREQ'2:9' >[e|D]@=ynaq6 7\"ŠZ䁉JJC;Eʩz@)r úDv 2Eym Ʈ`~=iQj$ ߷cOLTr넜DB/m@?'/%jS;6׎n ի| w p9n3 8I4c$;ڬ('FmRye拉/Nw Fgr,ށYTԇmaLy)HK_ *I~2-,w 9bDe 3AkҺN'dO6'P_na/1GD8ZH:_Vb*,y6V?^NiM:K\η^#ZE\W{A59h,.Yr$(tH @j@5{`˾mh˜t (?n?N=o G$Grm»4Iaԓ^6x~vK!oWIimV`2m[wBx{~5{ύmSQHM[i!x'mAʯ56y ϷuM&z`*~/@ܕ*좜fV)d%yӐ}W&܆Qre~/b}oZpea2QB%̽`RZ\0U;zN]hdmCtsd "85FUX@לm >Yuۛ6&?8O)X(e&&#%N}Rcȳ^ZᶸS")j);WK=Xru߽`-W0.YA\z+[F)m(+H; -StiYxv % *zb*NuJ8^BI& !0gHr! ͡\?wg޲NWC?f&T D-}~ZBac"ġK&vabQ0lvce o (+kKaa/|V6#S[/-UTeQ5>Twfy(GkniLK.$&E>~EUet#T>˴Հ:pԩC|Px~ uI 8&BX҉c&h)j@%/S aED5 icr$4al*ЁOt[YÄOF kP̢f{_O4,a9zòn[R o#Q Y`6Fr N; \,UOX@EQ; d?\A ~( `'!hEWo?%e4xffǚq.,)e8\Q/ANvp+FgR'2UteApB[#%<B&.P< D^k["n?, ,8m4%;e7 x{` Mnc7 d#ƆJi`lB7g%Fvd߱D$4ܖS'aq gQ- YU$N~Ӓk8^1܀A5w#/\v5|8+Wn*ei!^$,e#V$RV쵼 ”RXA G~!ߍHYNPMsQz&UdcNn IAֽu}}*sN:ӀZ^?A <{2?Jo'5 *bDBI `lB1,l/ۏC$4ELo}VEj ́ ob7,U;Tyhd$kUH|ޖAD7j ҭRdZB^^!K80U}NbzR%AXT!ie`ُ^)%C %1F%-iK]}O:v ;<JDP' c*P0 ?D1yXlЉEȞW|jbYHua WB<ب5U*-hJre۸ńHN^`{@p:UZ\x tDی֯GDaH}js Hm $nKiW.V_ x)lYwX4ċ'uCh*vzb6i.g_&:o`*wOB J| 3,z ULvD\di92[Ü]xYRrH-mK{`2ɐԨ Am: Kirb}f|C0{ʕeܑTKzbćOϧZY)O>أ?p6cP)+/ ȥ_'F6xB5E8ߖy u釡əcƸot2 /HF~F%*O\|8*'h% 2o"8=3}wɤy?"ܷƕ2E82lyB;PfFv"W]b텹4N᷷*o~amE4m]$tknz2&BV!4#탃nIfWwpվ_ %vRvOɭCtqyd!,DrrCt|k_bdiV> oj`5?jgNtu;sU!#X$fܴ&$_X*Xzt!GP{?)N]P m/&xڑ,{d*ۭD8ll2FD:&dxPM+ (jP- ic2  ~(|OY0&7,Y l 7 !--NV@ ;Jײ8#c >ʮ KfatiMEPОj(ʶ=&!T(ze>*cקB9daA~@Ŕ3wGVu0.Re’#<{$ ׊L+ˤ'->u _7Y1"8̆{92ܨ޾B <f\1+upqV[}W>~*T}#˳Ap?iRBS|H|KHKFHHS7?ԛINyY["n9ooL G?i񀬔&8າ)ĨCj I7 :ѽ(&紿 b<>7mn}'Y0mE5ח]KAԖV2mV֦v$7uPH$Cqu5 9_Pa3;%u>+0z^Q8+A"fz! hzϸ1YOw8D \.PRN0O=s7 qG`ූYj$9foKɻbAb&^}ozWnT3R0뛑~+Tsg{>YJDT/Cr[3γ4EJ3s1\{k'5c1%1cz=udW;b$QXFRZ,%}CǩLBqTu >qҸc΀X:jZxhy[E0i`JSTĝ@ۮ);&]}>]be> ((ogH61 Bh.QNwIbH\{K}R:͎h in5|[Y.qKL(ΈĚ\E~>tuHD`o*0ˌ(Ӯ''llq 8 V~qRoVd4cT%E}ä́Y~,С{]njL kQi 7LN?r?#.H?DJVZ=6&|\݄k >R_&-7GS0 3\ L*r5k_\ӋK&7f=(\dZC 6'/mrٍ`iԪ#`r۪I4qr[XIR- &]bմkŘ+k7+y^ߒC 'R:% f̀)m|KFLaL`"׈RzD+q_JB ^0>.) +Ho1>GDEWėR׳0ğ*AF)xcj CbK&~aIe^؛ VZp09LFvvЉ0s½tL!i;/VF1/,!pizn\$/ћ# 1 ƨ5oH4`ゲH.i7f14a=|:*`TPOf$ [ -*IHL&݉, @]$>D5'>9.tWZwVIn`[,b|U츔FzCE)T(jB΂0d'{V\3ɤi81FMfKTsNܘ9_5;l_͞Fh:۵5oB mv<'rhڴqn88q r4~J 5ڪѣHuTNUN\zYPaqq:M)'[9D (Tbz}r\\Ճ붂[6I >D:Vxыn/qP%ϧUs?!| T{0lGv3"{eh؞)w >oN4aWu9s+ӳ?y CJP +ie$W^Fzt +cШ9Ğ f:ئY7ɕSPp kla{?E"]6iwbؙ.g P2 d6?[\# ŭ`&fSxsJ+f8V=} 2]9@Plsެ$Qh@}8A׫)l?E)Ϭ4شKSY}v1SuЂ1v +]mҬq 5ҁ_nR-Þz}ݜ`6ǭBb]=&B)p$4 *9mpvpPx ap;Am$#%O=/jcv:,B]vX/1G&)8AdgH}^ӬޤDm%c_,z%6adJaPS/q5ʌ(45|)57\nxkWL"ܸ٨J##cm]gbnŸEjJ3=k^{#S&׿NT6 h&vs75ng0J/C`%%)aFx{p;Z8e ˥UzM8{Jc[~5V; 3t_0K[l5[WI@ͤF"*=߰Ji!#*`?̴q]؎+s ք![Pl.2'KB7XMAPq,TJZAmUk<sMakSI^fda䢇e;:Ut؇ 7 7+S2%6؈MdT'w ޾K"fkͤYP߾:%!rp$f B_CIՊXԾP \J .'N[s~e~oF9 BOoAyπ`|Y3]FZ86^k%5g*˱xm PR`*՘,H=DΓm]iSv!Zz(d=ף6am%||1%oV^Ż}ҏk(g} :h D@lLngc&Ӥ6Ιa 9baUKSP ?ehK)IV:} xI>tma`.}1YTzό`V`#jfY%Cv$\` .pa%`L&bŠq& nVn,v\RᨣaܞPsXm ..` t VyðYXEGj5Er&3]R<FL7>RӲG;-Xm=XScή*Ѩ)rlo?~v {KMъg,73NW/u fZ)8:$rA#:4jPgRfl̏XBy"A}&+U"cPCħ,&4˗ous\J2n3EJvmG xBn7GGbBE C*8Hrn@{ dL?G{OFNe݃tK֚hWW`et}n2NKY&>l!WHY2}G!+uBmeAƬlv% MtIg}~p d_8~-P]I g qtaxU*~3yq /O'!.=D˄2r!P-G$k֗;.woJ>Q2v{KϘRpж!u莲8u} %vt?U0x<ˤhD{Yb =zvNIJ\F (il>˩~D{!؈*O",Bn)a|IUN=F‘:l|exSZ_<͌ǐP2qE(.t%^m֑l 1Bn GlP)k\B#n-Ώ|ݫ~|;+>EO Bw1a Yᱯ3Tʵ Pk7ٗVޘ娫q0<Ԍ E(guaނ,y2N r{lĽ'4 wUUo2<rY IEhoQ/|QQٶ]B/1W|+\ş8'rZ(r=rJ  DFᙆ9K;h]1ˊ0nm.]]Ff= X(^VB^4Ũtw5Rb EH2/&&SA8Ia>HƳc 8%3{&tJ?A0+@9[,۹Sޙ|Lk{i-oIM.jL% ԆaXAJYmt{腛}|3Ƃ8q@sg"05cz)Nm`:C0T[΁rz"^ýk(^V+=ONJi!ijKx_@WtK)  :WnUU1tj<2F^Yߍ5LKO<|8caqczbJ6Wz\ܥuZR? -9$| -I֌F$U{.(ҿ[fj%Hlq'zOo|^ffnWH!wiF9¯[y PdPgՖ106䕀wc͟{,בьR!8ttN9sDgP5DIkHdlL QgcŨ[9#4QSEް_`CmْmZ/$$N>^)@+UXynaԗ-ovkm~xr*RF>EB=$Lkt:6T5 RVO7AgV{ ,FViM~PJe6bn" [^r٧, ´tC0^ʵlohjٸHkq^#Iv:#N&:}x{d̷aF>,_և`b;!Kרuu-׃~\jhlH[4&y&z\pǬ5p{W)3vMNܮî{6tET=+)k[=[͹P2QF 4H5iq P0"ĉ[#e{kJ˞&V%2pi7h"c>4;_Crk)Yel++tm$v .PGUHeF d>ws}k[ytvUƱ%фƚS&!b^'Yیb+, %jre9ĿDqi0^e=m (q,-uT,& Yaf&K:$6^fRO)S #/b]!rRF&&wĤA&y&9aPZ+HQIl̑} q]D늋|ϓZLm]\e=O[iv`"<0o{ n))Ĩq%fqD븹 ̟u Dd?DqšFF+{A&^l oaZS\B{ek+]dҕ] G .tbd%oVƕw"KGF;ƹ%VD uOr5wTr*\+`MOq]k0^SC`v?OZE܂03i{{7૎IW1l`mVE @ 3~=d5'h9RmS\7 o< t2S#y 3HA c[hx`\OOBLJ^H3NA>:'ݳLݿ Huʺ86IYF$JךFSޭd$=8 &qvsmhDzXk%eITg#ؾ&gt DuDl3Mht_(^ڡl~?I},g-3v>㩉,I`ôN c>]'d^P#@H8i;k Aezt;zmDDC}x)7{Lחg( *gbҠ=mrR} )s -¸PJvd _J1ٹvj7w.>'ZF=&}=#ZgĈJ%/D+qibK0_qd@׻̿T 'Ҕ'qVk]Y̻=:Hy?Wڻڪ. :ԍfNю;%TDXkB.}МuM࿃Mg>ɵl&! V~'Vai؆Cߑ VJ4W[wtNK0>mlջ%4|tHV6~ -:!f8/%eɳX_{+@MpYl|}ĺ ʨdx(6Z/pN#@bZ\k<)y.HYL"<uHV>>'Ibj=Hd $WlQn߿;Hy _84Rc\& EC!h$b(N"@76e(Gs}mNsWxZ0 +>`X}ѪH>á 2\ը&z O`5u~%F䚆?WR.C97 \]D4|> ګRŃ qt8W!CbdQSM?ׅZPpN̬^ř=҆mkz7 p295㽔Po D),ǔr+MEg-ZJm\&Ψ7gbL!z3缸7_WcywQzs8bo6co$i=DͰ6gLDzL3h=c>Sk;Ɖ{~e>s6PX,ϾLUP&b GCcl4h! Ä{mg.!.BDQ~3;/v[:m+*̖u0.Jz>ѡL9$ $kd&髳j$ ;r;p$}%&!B lEP2zQ9&q?^(FZY]#A'ZcWxա]hcР PFcxnc^,Z GЙn+d,u`DZ 4%s2'[E+3%Dz]jy#q92L3k^Y_@a$ٽqƎuĿK92I㙅#7,rEi9Mc#nH"2'z͸xl7Y{3X~nrPbL_Rc]ɺQ@+Nxi w{O~H."\/JZ8})8t٩P$_ԙ&yYvEW_?D&8še$2[@9ZyxO4nEF0i4j+9̟ar'(t`w<[IѐaEc;CqQ( Gl|xqдI\.g)PћRA|aӾAKYn#./;~AkF 2hD=| ^tA}UR(by9xY1{ (Ĭ##GYkVr=v̒C0Օ:O9@;ZYӣ:HUQ]tp@ ό@) C槺,KH=>QAi qKť-ipte >^scԡ\ۦ?PKj}7&cpI csspEzNzpbt4A{0r6SON{)(-kI/slO] h*CNU-cTs?->)vpx=P1񢳹b=1+Ѡ\^l Γ0Aδ` ? Kk˾T(y9\T|oD nWc,`*.qSmw)ۋM9pNtvv{9zCͧ/2 1NA>.lAwr4h@k.6:1P/x# ǚaH#緓P뮊q} TwA/g0X9mNtRnp( 8]MA(ZIԕeqꁋz +N@EBjz,^xPQ39uHE^U_A~[9kv>Ř(`,' PweXΒyĪAYՋ3I?Gqovfm"$3x&rl4mc_<]^]5@-f[~ߝ$,\מL$9(=Dc |qgfJwkbTԚCi]+=t4rSSj"w Mld)x|nJod([]ZUg[MIyW:Dż[Q yo$9铈\M; K`X_vN:ּ6C \V+/McVk ,Em<jI xy0HQI֣~'〚 ai](S'h:(GY"ۘyJ\.wF:qVaVʂs7\hǟ3Z,3Z$p( jD-`1dҍ8{,p*72Xq`,M*}p &"_;d:8Ĩv ѢHX)h5#;_y7u1t5 TȬΌ@6Vk!A\fC2O썸Q0I_kRyVz}l2Prm2g160z/zx i!-VX\aBeKDe?:-F¾ɓZC=-^)em&L{U)w^XаQʇ]!}SuyLǏċݼQl}.X ꀸ'~9B9io9+j6995[-륐HicJ7E|S`4tфO}FsM߯I5sJJ#=$/">^kN+X?n sp7uy I5%з:vr?NODO]&1RdhWn~ckbgh*n“I?U4/GW~z*t#:CUcD"ɹ.B~ ZDj]eT1^P$&~ADBJcmN'N`l,.3FDDԎK C$r0A_vj̨Bت^|T J%-?G: iD>XbE 4 BýR)ӫ`?-?fE(邞A Q[Xm\#L.FΑer<1CSϷZE% ,o#p] Dgj3O3JuPs𹇾0cm3|׭OFG7LV};+.O)|Pn9*%j[}̆7yi ("w4Sފl>`蕳G! vț!̸i#|$h8b `Nw8h%-Qkns],ל ~2~]ȎM9]y=z6;:w ~^ >hi+X,(21n4'x ! iMkŏMaMZRI6&Z;7 z:S۪Owkfc50г s]xϜ;jVR$~.;LƲ鱥U@biŰrzMF긳_A8̬)KGsك+8b `[[StIi#9 (]s3G #>7+[fzǫ[TH'`?؞¤D =ZC}g5!kd(7dˏCp>HN:î w)=՗9z'|rƏABb8~=Lv:u VȆ{ۑRy0bH^e &^CYQۥrJE >S_|-Q= GGHгȥtY*i<jX["4Wc byp_Ի;4]*]YG.=,jGuWcxj$sYWةMyM o_u:ZvX_bMqnv P粼އfN՞}q# mz:.z\y%3f&Dy$*J5}TB~Fr0Il䞚:8:{8]ޛ@x=k-2Btg`Fկwv@Hdí1n|<4Jհl+3p(63"p%}N42Pd!H1J`%_Tڅ>>;S9FRP>gװ yo[_m0Pb˱΄K)1$l 0t}xsxHW*K]F)LqeP,?Xx%{G\LJ$_3P0oJ{-dCXFMxNADԞa@3E$m&SB֣ӹuĸ/gD(_?vf2/BC5{r9z k< AEj͍DI#W5t6BQt ibA(GؗN^NSo"{ d/K]aG; r 7t\aZ 宙Ś8.vCG$K2 m϶eHZoAd3&(r,Dо\~XO}*Ƅ)1J(%S-;{_lw6(jx~&=fzt(_mJ` HK?k1? ?wVJ焹Ȁ]IDeo䴦,boXM݅v)Q*TF0:Hڂ*ɉ/ \0i]*Jf EX9;/I.gY@"9f_=姢ؐ#iaTg,7:PftbMC tMY˛fAJ. &"r Tq}1IB$ߦg#kw j_t Ϊ9 Z0/ts{֙6q\6BG4"Ott[R7)͐NVd]]/"V{޶ u ~bu#Qt)RvŒâDFlh\X-*ف*I߿.'~;,$+ޛ?0xY)%fCiڮ BKm jP"d|Q U{Ȏ| _N]K&8-v6bsjO8lDm. zq-[}qnR7+M.-L? 4[.}aNJ4Ca)PtBO %)8_Ydˍb{BX@J4r?\f>lXYP00AVZcmfq`c9gYp~.rg_='Z>*[ߵxW+VeΠf Bj7}<jJ/SGgJs˝JR{)A6uKi< uca6Ü:̰Ȅ=?+L ́ QF!N8J[k!ݤcz.1$I!o2pgޏ t)Y6rGT+niiޣbLʖ;VjwWc(# ~* ZowKM<6mDd)qeL6t6)|@=k~@+ʦߊNg@Fsŵ`!s"8)~?'u.P )4F;& tɃU!;-iVI8L uccdilkDP)t@c7aۤ y,3{k j3LwٖBh`ht<@9 4~6V[&U 8|#YDB fye .F'0} ljtOZt5RF*\lR>jDީ*A7<R`*З/֣l&~ eOGs&)ӌ@gc;W,Ma]n>=x*'A)iHjV֋}}扤w/fN!>Zv1:d'勞 E􄦿m_3( I^~-%jcjx1{d.> O)Waus94&4%DIzfLR n؜Z$&x4PDBcWΊeJ8T/e+vER~,.4H+~= Y#N&n 9$.҇rfI3f(;D526oIW2a1'W#`ݏq޵TQEZӞW{RmI!U˓C`Xe8{HE(Rn. N1aMpQgA#{idlMLZ"| [߉9&j2>fZa{])pLG%#@TI r 3@16hMÄnv@Y=.^I u HsQP*(8} ;Hi`߭6WeÈjBTjZs J~IRe=qA !٤.mdȘx;(@Jֆd\9UNL;?E+kK7m/OCm{^~LW aZ,&JTe:XVªCId }߹_ZR:B"TRQDu^ Q?(t"K=ʽPۦ@{t!JK'&Mi1|oqȠ"s;/kVMW* ԜޓFԷq-]1vO[iI#k.čscš'@|S_ی| &Z~]rkǟ!h[a~!Y{)'1$z?+l,lx|uc)=3GiI8bY g fLS\V9u}PNDeѾAc@I֩?AR4| @|RVG ~-t6[9׸s~;8D3~~8I=|QO2>֕ՅGW$zƉ">T.T!<$Aeixc;b:ӥZL\HyK8 =l{w{ mvl";:y=q!XF-@ڴ- [ۯ*(F]bA!:#WOCXξȎp${#A 57YVjߎ%"(c1|%݅R%z6n-D6cbsL,s\& `,rW7gjզBp,36gQЂ <>,_ ݿkfv髚H#r*ۇEB5 XT6DbKyG6_W [ta B#>$ N) `E}зDAI^:/cvMdZ+a0"FHt ,pv6?7Y^WډjTY0w1 4dn"t^n`S]2',1' "/{]l\͑bIp\xFV{V,ZG| þjOo5 ׻dKxI{;`.CS@ {LrX^!&lΪx ?Fo|g?[aø $QEzx1Mz[].;߹GsU'S!3ދ-7ࣦ1FSGz  7-]=)~`$06!TUNU\b${jA WOi]!8-gWe@EKK#),9Es TAפ[wQo;gf!9Z.cc/BFT; # _گ?X[ɨGջ ?jYᬬYĞWŖǿ00'~ pN!A좍DŽ"ɇn5A y3`vYr/{%Gьgv3Ib,5l}F]bg$lmx8KKu6]֌t%נ0 8[SI3˺(}ڜ.0JuwΓB[9)N7 LUg/:dqO0g,: Q=t+'ҽѳ\7űY]pޞ)t5})4IU(WҔ+և> 5Ylyk0BUP ~'5nohh:Q4$o" :st+nilnUE["IO(>=ZO6fih.^1,6-j[紅/xuoO0 ˅SHc,qF9Js0~'bZ$#żû29bV[Br/ ]Fvq e&t7C!h9g\| "N)f,+&&9OA c;u\jɨw2=ggpK)ɨXGݺeѮRXX* xka܂;ݗy:ؽ< Զm7k.c?Y߿qBKh1v4' oo[GkP6)pџѽFm#O8bȕ:u6fdnK8~Q_mz)xpLc<X? jӝ19oEXoSW7$pK-oWY[wȒy -kKyD[ Bې[ueŗ2M8ZI6Dh̅z'JtBzQ&TF8m )j r̺ݜ8Ms]c2$JԬ/ah޻G#vra9X@oz5a.AD+ELBA~vtglX K3 [zG;YpszaJ>dzӟo}Ar`i}$FiPjկUx?靇tCt؊!'pԍX˔șu{ Ggy@аLd=N׸E;SY0*ƨ#{|ڕW~?䒾YodQlŋ,5F. ɷ(}a٢BO?;Kj]B4P)B%xENQ~sZhnЦ2"[ :%}9GYn[p)5FrY:`j|xFǏ8؞aA7t|.ڷqqղB-}em>5FLO0\<ǴF)hx!; \5jt!|;/,= OlLPw;꓊:Gd!O ՟kSaW'BV9`SA=qQMjA_C!V&F\agrH `T7hҺ߾ 8L^ t(T m~xr7?}LD ͩ" :k]2VpuJM8XۺHNywɡ_lgM@Zrdh]2 c)»GOL)93+;H/iUJiȭ2+zM: @*[Ҿq|\2Dt8E;fOGl>lMG[Aq7!f16 ?V妍%'_4X@`AQ"5JjBYf7oC9.c Q1FS?2rRW0mHYH?5x+sqo#bjZ9KP7adymx˙A ߞ]l,ճu>4")v#X`fݢIV\ؼsA]p^-ŚF6+V=o 9Wx,y3-XP qx4e{ꎼYAȶgx ]*FG [ZgD+V rb+qx3iN[rc*>UЦh3|O>mC uٮev%$] phqqi&Blxh{ qr 6 VW]gAiD?XoKwK1S9 %.'ܽ+ 4-:c9'6`KhmJl{QWW-mJgVlqɳ׎2mj H|3KF7"։Ѵ0rbY932\ 6Zv5xCO 0}OEffzS`/E@x'ꍡcD$ݤDXɌ"Sҋ^i)NGp U20ðX.QЮtk"9vM& Gw{˟pؔߥD\Vϋ,OH%O':{ ڽdžd BʜNXŭC&z9͟ޠ oh9]!HB73XUy[IhJo*LpEy0~i~b4:K 14_kXN*i.; FY4#);XL5)SF8Q~f0$dNQ6QV/i S ? 7pᲓۺ Gaj.\/7Iym t'.c.IFA)ˠ/'m%#H|>`eü3۬j١dʂ%oS lyT+{d)ٝ_n`NCvs#p#*(p8f8K℡mGġ1mzdEtAztߡ#oN799>w,|-M#|>6䞧do+8M8զ| 2^1P4e>4 vs*.\Q/]'\`R$QK :zP[:vlZtAa.eWe+ McR+ Cb$hK9$`Տ„9JjIYcTn Ul҈ ,W(g[K)?!.ƾ? wȷv|"ue?HH6tǻ@n ʓ(;K~T$dX5`SG?WND_"!CbTh L- 2xy=x$-G"㴹wX#48G_,jD4ʕ~c1 9)y]חjGXazжIJտ$Fh0l+yd#nزLݠ [|ER?Wvh5퐠![Wxrd)T1:-ʵۓ2Qq*? . DKއ.`[$> oۅ}@Edu[IpD''Vv;LrKAx)}9XQ=;=r؈,N[_a|b*!uZzl׻mo7![' FYQ{>S^nRjo U.N=vͣ&Th/p=hYXST񴣓Wx~WKki& BT@nڪ$ zj2 t簙7`;d@U'R6c 3#g40ҀSN7lw) N]N 3G \)s7A`?շjB]C-{[Z}1]&yKHÕX11jl7&ŞSF>J,`x=Vz ){+Dd`] )rL@xh\y ћq[ʩTߒ4)xz{Rtt/mat?rO%](1-^'7A1wxg#B8T WrĪu= YLgb3.uW7@GWo*3쀵$0K= ߚsFd?No_,' loXYMAYJ3xޘ ʈLha_' !`[%뱖 ƭdBEF!Ҽ.UN8!k.67?I+a@k{KZ=Z3Y_iH͉"ԩJ;Zjj,5G40oW?=J*,x{YkRFX~3ՌX!xD!Y~\Bp !#vq:'3AM()ϝIE}Mx{l=&KL}:$|yn K} $1@D:9PuUUBTm8n.hI f]t€6;4ᒀðn/:,fOaRVc09[g3~B@+C|^-ٓ[!pT(hK!Uw$lc?~|\|ܷd,Dǖ<~*;6^M&dRAibni-fzqp3qH~Rd3pQ8\iO޵ aK7C:*q'qeC7Ų*l2놌-.hl-i룿]2Jr$` Z JNLax$>?kqeݞU^<1 ts90 )a1[zZNL|P&:H ?boz vo[.p}s?LіPx[T%tf,)/wbF=ad =f@ :f! ѫpajZܬ Hp,C=9k''7 ~Ҵ.= j6j>`)ķ.AZdU!wpq!;7Z^ͫԇ-o2nC );6r8i@pq%&}-{l2c"Ɨk*8 }I'DS{xp%;;=J8u^,'9J}bS)0™Ğ/* _pW`~>ST;O 2^}Qk,| 3rQuIll?ΥvPsT?Yu=@EdUjݥ0-Pϰ@A6k†lX(̈WU*,ZaݭjJg rgl?/v'̶ǼϙqO^2j)~8\d#6]YzoyH[>}.hI'5!WyI-.Gqmn}H:ȧ)[#h-`fc. R0Yf:&yN^7ǰLo! F_S Բ)bN暈\|AjHՐr#k% p.2{ͦtErgHA!b˫!NoV1<#^ȭ`FhXٓF[M;it,AțP MM#^y߮n"18d䳞ߙmMjL@,I}Qu2[eaL:ï-8@ڶs(˸ XY׋ҶR􇝹$O[{tw(.#x^o㴝{Y+.ߞblo_lof]HALIOpAtq # utf)fA{I5:? ˊNYGXN >B]M)@C|s0`WA2A=pƸTWi$b+0b FM^D=#]L`;p9 &kS pڥ" )J'W\x- U{W.muc۱QOv~(j!&Lv 1="CP$4c XE4t8nlS5 F|z6c?h{?A[E5!h49/ mSמaZc;, w4E rTNJ#m+ڻѝ;>sҤi$r0@9b\ʕ꼵# 26nN ꑭ4Gfe_$5ۖ>?b0g~+cBWq%j⧁3rM"WAdRkC513ׄ0L1ne@dʼq Q&Qwڢ [toy9m %< Q\+5{A+A 3Nƛ{.U>VD^O \y]]aw[S|pϳk#=Y KsrB>5 k:oz *5R x(,p@[,3'tw=_c0HޛթI2XTΘ+OSH ]<sa8N29sІe=MaǛBT],YmtPcEA}(Dfx:^>|5~U/$lE"61l> Mr𝩫7&$oĩ`_~'>}i9B{qYGHVTKߧ$;V.O1sn |%7#qi7]R3$He} hW )9xDx鿕6l1\MsY ?^QlۺG>So( V|ꅩ>_)e:rIS\u"쪅?uYC>j)R_@WK4~esѩ>ڪ!iL/!#?̏%_޴o 2gh+\dд*ytNGCQFV6%XSm]9[SAVހc[%zeN뜽6eksuV^uBqjxg{|ܷ5e(<˲C.Oɷ6 'l30RLU/~y= % (+B1uhyj8}Rp䏕aMrӕ(ϒyUJA{y+%=1X쐂%CLA98hɤ'Mag *2ω;c$ 8SUs e@GPl@Av1A(H a~؄haLe5+p.v% [4³yF7+^]B6Ai/Ƶ7'|`k6UwR;G SLSCm[2Vwtuss:f`6Qw޴/0/TLm]r<5ubA<q$G|ɣDP^%Wl^Adn榽& @aۀji6 ;xCQtTn;eD"^@F.$ J5%RUa9\J%ֺ/1kE^I^ȋ#2ӗ+H`0<*\e$/ݲjD$?7Z@Q c~T?(ŧ@QHM̊ ^P~9[7S:.۠ kdVD,pVǓqз3 l aR|h]?Χ wj/kn%dVki*&:r 4L&)N뛍ZMQ U͏nǎe[Ϊ&A|^9iSmz#_+O3fL5Dav.h'bsRa pzT}j8sWZs⦍u,Xmg^"b^PKdw p?h_72 $R] S*Q3$n\j]TR̂?24d?/[i|7dC-׳xٖFqB4ػ\pz޿oxS.{Wi he& (tK|d$ k&|f=^Rt ?Wkn5/4oҚz@eT¨1"^UhXt![Y 6do"Գ6K HZI$뇲d~$֪'uOa9^ zkqk'wO[UuJk|GG?H/_9&9LX#Nh ɹU5OqLgpaGt\-ݤda0t~OoD2a JZH`uu[ :Xq@uo;2CɆP!VE_n+(PJBzZ„v*}\A[@Y5)}(]u.ylӇ _/^ZpkLj_P7c*ړ9ȱxD9/ Po~=W#C3a].vP > *pTn#s8B*/^Il]wBيؼR+OXʑ+DrI[n3ۛoֲi*z)'3re@/INGh@Gб^y8qlLLku7΁5 m1+֓~<1* k&2+EL +"=^#z'g"M'_$. G߮h a5q =X6 u d=c߹u!|;8%31홫V+0O:&oq:8֙_$mS峥+6Ux#}k^ ĉ"q@?R+M2j?oKz,td:4Ie}.rTp%/^CHq;]PE#{h1X#7zQFfwd 6y 0ZV=9{._2seCoHn*TIJE}'Ve.3f-|`ΰ<ٕPw;} |ǒK],BW;=I=Qx@b}B1j>`ȓ%x3|S~$oj{_(M \{A+Ƣ\^¯*_X~ɡkZ.>Xp428{>o̖uySv&@3Xm)C`A iHՅkyvV]=:mؚ%Ί+bb@)Z>^Z" v2Y^?3Kwg620=opJ /^U'}M4M|,e4ZmM &t7Ŋ O%mr-Ȭ$vBwGYiFQ Gߑ;"m=.2=uN̓C 3=ٙn/nwvO r+hIz4,&m+Uџ yS9;,mn !?ShR0g%/o`G-vv7q+CO=7IHG ceƷm$ g0fHT]j፴ Hll4guk&oR$"5Eecg.װ [4'^2Hg}'UoaN`#Zl(sD7UUJJ0Hc\i89,?h- ltbPQ1PR|,LƉ2M^%(`x]nT4ݿJ u6N?:jiwYesug\>Rd 颅 VzOqSˆ&ŪB=̈ֆw훽u3fg(;uKfx!<82pOMW#vɉ[3ik9T8|ׅosR0ZNfo<$v e*DkAh0>#{bM.5'jIvdCI ްs8*("G*y{P+ _я *R7|i8 Wla%3?;o~+q[S^Ev=7k?8< `Rb`ƧoWly CJ#A V| &PEQb:jGqtP BW вw*o Ee6H6PR򉱨%c"KnwԨ"5 ·N,Yk6O{ ?s@ʃ~zXs5%Ar$?O$W3y`Ѳ.*el_GJvT!L,(*tuWdh?m]YsՐ!yCflIGUh4a[+y[WIG O扱ǝYo6⦻ZةLM/<ϟ}hqvz{.!\\OI$t:o/[v](s.`L^i!/h#h8*B|rK'B5넕NaAEx4o'YGݤ\b)4,p@>Y:AO0oMq@7=kЬMi%,̊Pddn)9/LIB9pUϵ %!>9Wk3EZ;B~drb&NEv`+RFALLEX Q. EwޥrP9 #̄Yy d DQ_Vb,_"UH%x%:t~2ZA6MYKlfO8a :sOFDox)Rp(y5WJQNK1|DvhEx T,;,$$W(x?fMq0y?}tnߤ{t$@#'J ~I䘫L@uRE|hų)77<%7ew'3 Cb*QmOm")Hg\]Vt[ؔ`Ud7 .XԹ1*jμ!$fo]Q>f ģ5i|{o Kl)K9ϯc\}ʤA&!QC˲سfXAvo8`lPho[л \ +#Am?y1cmj vǃ囓a,Y 'fP]fUeɒD`wHibLQE(O&ʃX5!ZE֒ޣA)! v>߂\cDB K[%#ͪ:֐nzk7̣gO5t?ҫ0>h3i5k/|Zw`S0i) Ob5Nm p(c-"VgcNm,le+U ;]Рp6=Ȍ!f-$[uԲtU#Ԟ()vxLl(CTEYM a6MϾW.(kKC'ؒ9ZQzGPy x:"è'1 U _׹?+!bG>&O:0!havLGyk#bZWƟ4hX.lPabv+d)WُZmG[o vF6Uoa]:ϡ1A-'12 AəӮ*d(sQ9,:ZP)5"ۮ %-DIlEZx``~BJOmqLf=NL101Y= 󂐿M2 !)r/6 6vĦXX-lrן1kc}bag驊(HX?}ӐM]ǂ+u,LO.'T) >LBQug9cB`OF?Cu52oK> XK,xLz1^xn֘- Vd4ƒ&/!5jߧͬ^4ܗ-b4Ƿ;ЮS,DXM艵na X8Zjf#=6b X5,ٸ`mVNG0_=4ǿYK2C y:&& PdfX_# HC|PTQHmtz3Kki߯(B ‰;Fi!<*uar$u 7.>O"`3C,V{ R/Zl\"u͝tѫ[;E,3$z@fBo&TcwwSSӃ2OZ )V*A$yNoFT\~*@xS&/#*ٌu/H)PSd猠19!d}-|ћ=o\%BD(jVOp fuB aѾ)U!J:w");>WdX颜m,IpSM{7IyuӉ6'Qo98}؃н2V98EQv:IC&*uD8"0+5I0o: q[Ag#ʴu Iچ f:0vhK7)[ik)c2ɸ A{Q"ޣJBio,ڣ( VE|[Ef_O"B |jZ(6 kt֌_oŁszjh|(o㭁48.lml ɏg ;L^fi0f5rHn2>7MqᶲpI$cYUlVA;pĖ\HY͐3~Z>V5Rx41i1)_7Ƭxج. B&׽졛$Um7 06׃B%hy".+3k }XqQiOAM=@&t]/1㇜X`orK9.nSg|9J0Y OWWT޻%ߕ&#dYXEOV:"P*SͤU69]5K. ok\߃ Mط.'19C/JPq @mlxk̵aqQԒ©_7Hj(d] =9c2= [߆{o43nQ{&'sU-apY_Agua7ܔ?+vtnF-:y]7jq2 Σ: ؞1oBp57(&mZŝ8)qY›/dEn\9Ғ^ec2/[L& jJږ^oג]Dh(}%8͚ym9a_?PB.ћIU"jH*L߱W$1{d@n2 qmӓZr8ARXv0&PBH<~ʞ&uoRw֜]11>FAhQ@RAy;v&S؄L^9h  qoQN`#Z8Մi+%V%xl-`\;-T[[<4;3=wݨG8:`ݍV߁Y8'qtIg)=MYl^# Ϭ9 Phծh֭&^ہ*尐Ƣ3\2hL P| JtHKv~`kZ&įփn=ڹ_ãZu٣?YAf5 /?CtpK^QQZ[cYKݭh,k[M,>(.18a 21ŁT v&a&}}NىIE.cs2}0|QJlh7ʸե]&)B "/XO7wtjG"a=yJ|)6 dʵ6/\Tb ]eF AqKO~j# P|8_j>LM` ' UC`I;F]'{Q T78.J!RNS5Q,/n'ڨRf榨lnqyymHʵ /s꾉!pkgITJWg2XZLLZUTk&ڳƓ4?S+74`8'1Nhߵf]6+'|SKT:}}Rp<3Am3ʇčy9p߱D,!~7(jѳX&oIYZfF~bl3ؼ6)_&4DǤ$ǝ&єS13ժtq7 5VJZ(ɒ]"CJ!*oq%@!oaޅbjЅ9ҙ ꉏb  hMmѢ[ S10.m6'MBŁ"p)ZةGݩWtQGǎ=2ǓVdllZA]YXM[89ZbN`EQ (:c|u'` "_i]gn.hokD:yjx)G["/62vR5lB?3r-vnfe+Rma 8#O߾攼IQ}GgMԒjem\tйJ{ӼF2o*F$RȀW5.u2b=~(wOGf*XDz4юA" Ap1  ōo心6i_d{ wj$[ЖRkMb=K6RFPGOe\$VUi1&JiWkndqEW)j[Ӽm zZl:ohG GtQZtVfPbP)ҳ׽POWR` }L;Y>NImȰ,6;#IDyp=),x?$ wk KbѣB _/خLrG'ړL!ʰ0NK=tD #|2,v* u!1pŶp;Q8w|B<jJp(<ԦQmGH1̨Lgbw }~#P^ѹD%֝vbۈjJ&t7tC Yy7H;"W YиԑWYg'A5)N7KG.\xY]g I00a#I3mebG}yL`xepá!>siOoȶd'ž5ר|Wy[h0#)\6{*q%hnTb#d^׋e^<s wUN\ vTZ5%6ml:Cyy)}U< 8?qەzFs!^o oE sl D8~U#-=J |ݚJpc4&{CU4yW)+::[qfk*о:gW:!ݮE;/@uv§8f$4)yk"`![2pwی%LFeQ7̝lLU$R~thK0*mcG nԈn )ʦަ&!COhIW }of?wu`G WCW2liߔ4FixU#t6~-8]m)MB9 tz"U?8 "S.3,хC7kbY D5&gŎ l8E3 |\1q&K~SX^!բ9+y#8z#=!F`xĵH2}I]lc&ڼƶ&^ rN4aYo{0&ȄjHѱkcmE $x9ChU[ݳgqڌb.sa5擔)7`\ σ۬iFø߲D=ccYGLF(7p {is56Roj - o or36=%m6gۍ[ޟLt ԖqgfW'[o빤@"JE ҅挧 ljZ;{YQi`vp`?X6~#).wng'Wj7BJsrbI=w?_@IZr#䉍V},ﶲ7N3 O!\r_}aƮ0v[7$o@I"Yl/ K ۥ&Řǥ !xeD_X$`=οQ9Ny wkTU76DUӕvw%jGpƇく9$]RTA%H{PWGbD I}cwqh4Hp2祂I6ȝe@ 0rsjUb. f1;_pPzN?FqF![ejԤY7Hf:qOǠt=*ތ ^h@Uz%iHmM੻c u~rF~ 2XwVJy<)a=GHfg5\ʃmTrV!6)B8^}u.Vv[tUudԃ-,zMՕܣ!~<3x97ȿ2^8De+²/~Mt z[#x8d.Q5G?:nnbgڿTA7 +]2H&co'MQp2z̐! F|Uep,coߋ\6MQb*ULBcP}{DZ-*.O1;/c^P{\~u. =b3tu2;/N&QCR`IV;52/Us\f'k ormcc!`+x{/~zG:m[4Dl̚~0:@pGn+LZh}E5fk14L]ކ.#l:[:~?6MUsu |-jG&-Y({YJ S6Ɩ|l[є\ԙ#D#4CQc7Ϟ.5 CFszi!2YY6&ο ّ|U6W YVaԛ3{U4;yvf/뻉$P|ƭ({@ݐzWi[,{`$fp~C5aj]זkӢ'8t+V>*ӵʓ!fm c`m>|K.4Xl /8[ Xc!'#EgHG96}sA017}yt'ة v{wBD%U7@iw ܣlr |.EYX 07U'D^磫Q=|rJ6l,uؐQ(9YS'fv˯J (f L$3F z6Cn{C`"VU..O`_fLioo`#Pߩ'61epcu9 ̈́v8rfÎGLJe  5sLHs#͑dBg[Lئ*(ClU2`%:CH1)yHO/Ʋ K6=2YL<'s ̹-rTМ&Teem^|7+7𲞺܎MiJƓXӷ~0.N|hVߞa|/,Vpj] M)۵;};OZ#Xw|`o4|&^V\^C0UJ6dVA.lhE\{T_6pNpٚbZbo r'!~jAv6jWMh2n<S u@"@@3q1T]U{ {B;ne }c{x9nL+NCH 'ÇBhv1 o7=0:`T_łϾ*5i|e/3-[fހ[K ܑv9uͮ!=Ɠrhte_*wsg%H(t&_^yJT0ޅ-R6FA<jf!֊Hb)VH9Z2yC61S꺫|  ȡGL*^\Զ"}Iz"_taʑ#ߵભ3nvѸr DO.7AZ:i?rn <0<߫ Iel7Uc|&V)72'K5~ ]=9jC|YnCH\ Ⱦ6,!}KаN=l0[Sy2zٙ<91\ RL&!l'z->N-L!eebZ]Z# }^fX8̚^_NG%, =qwX$nַvʄl;lET܅Ũ'ڌo R]VQLobI4p0A0ͱ9g72H->j@4^6~I҄IRTSF7<ΐ2% ,;! @1=y׳T;de]%ZY!ӽß^Lb!!ıs/2fNH4dBT-&5S EUwS~3Jms@O5LEh FzdqҩkUM6M°cB}U) ) T:rT &2op=h=>9t_W䮍Ji/`# f M/tF5=0'2J=/aI֤.q)?!GyG jRܿի[Dx Z|.%-V()OHOɚo!sُAO1CxN$ߟpd1|v M~4ym\2uEƣxn2]~7fAX9wcEmݗ,pm=^rNuw_3zFT=qiAqvLK{%ȿϻB{yNK nv6V8X*hIW@p~u|n;0(ۤvleG&hhپ -(кuM^6a$1Y/ђM :`= I!1 F$S8Ocl`B|nFׂKH˫Ep.L9ٟ2tWu\um]CGrOY}NEdpH;ACGlӪ'jsՍIyOvO[k9W", VcQaoj zdFUp51`#Nggl|ڂ4'sەކ׏*00*^OsYY\n!atOe F&#6H/+ 槽:q%~X몍G%EM\oU^9f s5pf^|[xm!9sf~W^Q)6P*Mx$mi"KycbТ7> ۗL(`% rJsAǙ%ci|, #ޤK18:ꔰz | L7Wب@ҹm"-7"@EꝢ%u LGI-GlsmM(BhgFb9pe0?02U$;D =ɕҴBh>OՑfZ4S{dCmг5 HM=ꃊCmTToP5sPD X38dҔCZsBy7t]0d mX4-YVuD\]!ic\Nb†jTwy `$XB ey}h`VIoOee@ta;mpij݂hT7s::[a4fBbD0ѡvNa&]_m79:=Mi x͋Z tܥry՞YPyVXn%#r5vư@IAwX"(@e"PAOdc&uZ\В)Т0B΄$&W*ug] =YXdSDpEҐy,Xٓl6M5k lTH5[A(۩FWf5S4.2"!J|n2 ͤ'9,cbnz\O t|͍& ۩GYiϳʔih`h+XI/o)dQ}gNȦrs2^w09/Gʘ&|&Ct_ĦwZWS8|Wvj?N"\+oPnT<.aH5j0ݤ(VIC9\#J?bv<Ȑ uaZ&Z7Ŵ 4bqsA/N9R hñ&7qEIsU ߥ)ں`,7ZyBnq mQ$)\4w٠3dyU5I'-,_3xG+cɿ[M|1,97?@ȀPIR8xˮ+M.U{fW3h!X?Ǧ_+X HpM 1r,HI$^ik.$zDz\םs*.NB &pԽ'eqg (\BH#0U$F7&TŢ\>~!݄WzU15fO]jJ&Cg<(=ō3/~ t3e 2˽Z6YMxjƧ[#F:p]MX^C+v܁OXM6Zu/ \{Ό|4k@(?"+[o9mX Y88#P&>E_F_D=ttH6T07 7 e=fd,p%vvEYVDCEk~+ؑrE_#8,Ocw>`V_>wA@&OSiJ 2jZZkT&Hc'x;xdzQ8,Ǹӹ΁ҦN'7bHDL¨:{Eev4\ߝFH1#RF6b.t+,ּE@Sϲ>4I`ʥ.lbYՒX =jߎڜf|>g uv0X!(j*ѹ _TI*woUBwXY6b@D7ܕYE.ϕӣX`{w)q MeN<Ŝw'pO[̘J?D:*U^BePs+vBՅ8D'b5m8gc&(iˈJzJIcvkE[B1ETD)JvJ:SZs_h G K'Y>yeØ/. NLc-A;f X]nq#oXKC7%j )EⰯD#Ee0@n;LurPǰp޵ez!(j9ka`PfMI<ؼdmFheYfǪP_Y`hq͏)Ng-6^1w4LR#1gTwv &ɉ", krZO"Ʃ.EQEbY %ň#P !3H3b7j~WuK]CΌ=!2 ʌS5p*l?cm_N z:3+'+ArYrKYjmRէ[VZ}dH<%>7e\i}-#gG9./P >\6#ȈM.񲹖j:i3'LN- kH@ADÀ5POz{}U^86jSfkȖ&9{f%o-A+ l`8^.y'q(NlmgKSfy #8ub]֞/-ABŕnosA7 5-md0G >ۛN'Ph0dͤm>UJ`-*<'ov4_`ȫ0l!s\ %G ir5)f ic$5.ݘ2t]!B0(E:̉sTAJnB:CserH1{ b˪eʨ֪Q>D^=T=:Sq'0)Ʈl &DQuCbzn:&Q}oˌ)s[ OHtx/c7mycҸGu;1 sll~xFG%!r(gDK=U{b mUrj G dv` 64oCSB^4}J|ǓIZ%,mִ ZHjA!WQq!jjΒjB=O9ɛ贺l2],(~ - torD`F쬗4 "{-P)έ{ќNz!?IØNu&{P`br*S 0שQj.za4SjL<㞅Ы;S#^~烎 ;($/[ZQR>QHn&X%4oʇ.ţ>πnŁ\IOσ- {elI,>ϫR 弙PdYJȭvtRdd& Ug0*(LQ#`M1҆+iU* uj,׾#=wWk(AXq2LS5e-!kf |wڬ$=b52r·H6wN{AFyQյ-l\bMS.4W[JCejE/u().z0Lw9;/2 E|E+fĥѹ5l])943w'qG|9(kV:gq~H>6_bjj qܻF@T]xu{Vϒj v(3;Q4w7lr(ϓc)1 E켟F,XYԼay2 $W6 q2&ҹϔ7)iE/>?ϐ%pn>BI)!,4MnvNDϏ|ڌG;ma&N%NQk3f%(M7jT^T';C!r{鵪]R/׃5 <=OKtW\NE*i.ʾxƛOG![mgv}Յ~58^ ʣNsS@Df602G؅p|òėA-˱j 2}9y  )0K{?LpiqHgժE4;PfOeX< ih1`߀G0K@0Y!tL1Rkb;hs(kW圎jwgL/_V}E؈#8tGL?ٖ5Fп60^:L}B;KU(NͿ w(E>52Qe,].z9aHj[%/D7V2LD+'퇓Y$\( ھ1$KHʙdA0TjPx!7aW%ncn%Åbds K[VݕbjBU߅skHs;&Ș~(+ޭkǚ6_L\ )zR!&JE,Dkh".qq麢SagchXB>RF||YQN1Y\yr5 _d^vi9vÇ\$AE٫R},{5*B#ʿ.JJCG(M~`w >$PZS))dQg[ ¤dCJv@cOiv gpd[G)2TO@)XMqoԅ%L jByPˆhZ-db5n!Bzh$`ͩz"E7+ܗ3&%BU,U9ߐ%Jw B@̆kAu ڗwHߚS9}9)q Jߢڪ}_p!Do C'9} YTk^%0[C:T{shhEqXľ1USCE4I V&,gG%xc dr%x.~OQ'Q1gPY3xm]fmྴ%2@,1gX}NXغlk }gzMEǨH==?٣WYy][e"۝OYEɠhP;6 <ݟ Y|ּՅ电P)Ma'_7X&X} `OEj"Nb7 lNnpX* ێ`RGA m:-\$lC w"w-!v>vӛ4;j<>]CE1Ts,%SK)f7HD[l@~f,P"I'!Uܭn[}a:뒮^ S, `%!CBMRMZ&>z:>%W*bقܻp /oڢy͑$vhixO>[6h Hй]GƋl%BKn 6eS/3 K&5Q(0 :3M_F ƲjI UODpPcU0,܇U|zڪz8;kZ)g(ޒI'#L^9$4l,$^m^tϖuuwI1Kf׬; ›"*ѯa[Awo_l(59k 6RԔUfY L}% RŋdL4A8P~x[K12QS7'Ho njX6Ķf/"w)ڲpiQoj'vw)yO41u)`?j$\[]Hp+RF4!wY @3StA>Nl]2Vԣn,)~#$2 `~D|wbl1e֎8XT2i۹ʄ5: ݊{0C`QHݬVRڤ懄2 WrP+xP|ʉ riQ0q0f5+(K*W46yڏaeƂ6㲁Ut Ռ2#vd' 44U"ihxKQ|/9l(s&q:Oش~cNL%e;;!m<@n2c}/:|Z.CB?mJφf /c[r8vxQ̷?P),cʤ<|rh)2C؈R}3׀@jJЅ$F`@CiNT/xd@krX3iDhESX菢. 灵S@uTCLC.~)smi3YnUv!,{u ק]. ͊Y9g8Lfln)4 .䀄=*4 .oZؖ ja,8!a/=6K@AybQx~Qva{$L`ø&[3$ճ"WwpxJ&`Gx^.y\ۜPZRQģ*E&LD~ҕ_ KsgI5$w L֌N?%`|A {JeŃ`[-q=+톐amT d5ULYya Q"_Q3JTRzގ+T?S9~m<-,ﭪ# zy&S"Ɩ<$4|٫8A N`ht5ӻ %VR&N>@8zVy}<^h{P$1h:H m?Xn^bE7$|C0k2,c}N,Wյ'MQlzġyZZEoOJL6?Y†!# (.9ܢoFUZ=?PSAѢ1+̢BD DKaY]~3=(5 r=]4DЛF8^. RT _y\i8.{y<͚ /HkGu?~Jr5$ ϱtYJrB%Qp?Ŝ}UA*3j2wsw Eľi)qU᣶ $jI5OU0u8jBȭY)t8!@ j.n˯n|o<giw~F1JzcՍ$S΁3XDiE0/;rs]nY:V={t=;RqB J^:7Yw3,7zr \U7ЎQAA6 V^ӱR%nEQS+&ۤ>I"1PE^OF=< TMB,Rꊴ[|suÛx _)pW\ndue<%N+eo@oG@]ibG-ʯ$h!視xLb6S~QUwwWIC'mHS^mq]OS뤁 C+ M!m,Nεrl+&Ȭff!dEIn\u8S&< HfztЫemO7{,ˡ2 CzM ̕ oBx*Y 蓠A-2xr .>ʌGBɶ~Hgh8}cOEQh[wl7]ّ=Տ&M_xT%+oQE2#Pv5%,6 ~ܚ,aVFQJ5jӕ)4LVJpǎ", BM)\E\:=b*r"5x`ړj,Hs~ڊgFdSp~bw>X͝{7fYc$ELj4 Zf"ab:>K_#mb"F4?P1[QӍ plsb1FAg~PޅmbQ\UKD/tQw/0da5džK>ͪKhl/lrcpC1`i+uޏg}q/]Hx?fʑkVOg<4 s@{p;ѧ.`&VҋO]73WCIg *eB nFX\s̜Q%,>{匬1:-gluG3]PӚ%jČ72@y)a~d{9Ib5Hn3Y[Aa7Stl*5+.R  OmPFҥ:SxEq7!짡H[2z6@k+"Tv%BOԅY'a_ \=*Ǻ*;PӃ-sw?X}WV$^rSqDuūo"6hoKIg~[W*[dծ8u@z#'o :v֑4`S #a&&! _"NapXD!y#-]|*>QGx8W"0Jq# ֢SJ0׫BK baFQ岍qs/e+XW bJ׌'#9å0->~v勒u"f/Ex{jN{c*zӹt kpi* 8{^ ha7aT6W&gS8\ZY+qc\CQGOW5c ғwa؝<LvpKfǒ- b>f8m:(swWS.!R@Bi4C\ B(Es{ÈT2(76W ط_v]l (9?|2-:q3t{h6^\k|__v oZeH\9މg@<^Ap>2@c_tL~!=KG)-xN&b9o!U&YGSyCpÐгJ"~z3i@8@ 4.4d[u &K 2Yr,0]_(mfNͮ O7?aBߙn8FbH eO 9W;H;[%OF8w qUגM E),R'P,bvFyWp|o?VYX2C*`vK[oPTےz+4&@ (+K4l-Ԝ+]g$L^B BNRU#QB}D'! 'eH̖CVtuof3i:o*RQlNP6d?kh̻A; c`,l&ol]fH/1(Zex1 ;=v΍bgޠf$s*"ClCd&Լ?텙mXu<ɂ1y\jC+:}^م gZ,RWmK=` )U0kSN{8J!e,m5&xk(.`f:(j'a#?^!ʙ ./Nz&_Z8 =*Կqus.Zץbچ[()%I9qFh"$js/]НpLK{Mz]Obn6WrgeA`z v-뢼YkZ`C(Fh}$z҃1tydF :K1BC+ܓuќ 23J/a=#'  Io|_36j$vFPc›u#w% /l\+1>>Ud=` 3IhleHZkeû"iT?/\0pvo(:/! u[a1կ# KUv+BAN(Hg|Eq~ G 6 T66xK΁oX1:"$I "m3'$>?X˗-xV>p#<̐(7 7zCc?5D?@'ZMG _Z!}4?mR녕\ ?V(p|#bcGVeS8<y(# ˓@f鏱<1!_u S}|xe?wg[ Υݖ>-5zq&1XIcS۩۩K69^L/  hVzZA ].A74Zv.%L"C,&ΣhQ\o]qij\ ]*qѽqU]*w.XN(4sIꫤ[ -z%bD[&c\K!!1"^1;C?@#.hN !.y/LP?ScI6yaNڻՍZF#ӀꑔRʩx R0O?{-]ҌOcmwsãsI>b"D`PEo]cly3ԹSd4+K wGt O(}CiIJ`ۯҥ Į_&;]vV|?#VFC +zp V#S=j<+)vg:^{ A<>O-zxXEIJ>?i/2m9L\1-S1tOtZ#m^MW#mȄڵ__Hk:ǩ(6f{)wf XJF"}=U C c[SGhZ $Z[N3׏A:p$AbI}fO[+Ov=hT:> }d@M)ۼ}[Ї_չ> tFK 1rFm:d ȼ͇A2>qȩ=xl<\ӅW~ʥU(ipwVn*'B|Q{30?v JZL_Ջ/ߺho !>A} ZUG<2Fkb [a5Wcؑ`᲍Ng^ڳH&+d 08){˳ ^ހrTKlz91"-Kzagf@\ј 'x)naS˽!^ٱxV +CA{YWh^CdUҶ0]BȨaF :Xmd,MlN> hkZHE7_oM@̑8͂ mQ}ƽQ9$НI|^kj *h&我@)|1b,CpQVDW̭]T 0բcIWlɁh+7hT[% !eAS$HVY?5.'󷔺vN5 rAEyyLPrJ/VԳ:k{bC8c ǧ_Sc9XF5S 9IGG4w<ɾeXI)) ߳5g 8A[ΦR5ҝ4LP xup2/Q̫UL1U q;n"PQ {e| X7?v-^uH lj#CطjgL(-_ 0_o!%W9xAfU 6'x:Q 4Lt"u`ǘhA@dGfjK$ڮ^<%LAﻣknxվyf62 TW^/IVMma]F&)u<¾KH(Oڈ岭$lM_bh߆.^cG~&09<\}ݢe I.aT{0>~ 3/TgvvGzLA`j_ƆjȘIT6_?1n&?ȝ (&c',42u !E9ˉr]CA {۱ނ!sj ~OӎQM̸WP?Lځ/6OS\} :SKP0F>`g`+IFIXc)Iwª#,\UhB&t *-Ұ0ZTnp4#׿WC+=@3޼IKPg[Qji$#=^ۙomdIQ+=!U-Ѭ@^?;z=ql9]:PNҺ5,$O`Pu~fTUWTWR"F{VW71v2<3wpB1VGad=o}Q43PCG\ְOdS/f*sԮ1z Kt9߆%mlc;ٹ8xW_];|5InHL׳wpD;+@07U (›s% _i4Ӳt)i!50my~L1_ho<^Ƥ%ևS W R5NzlNN]1-C^{#BlciZ'mO+n]7:Ys'Z9j Ƨ[ [  дDRUdK!yuC3`7:pXV JoD1G*_G3)xY_GR*VY/o2fQL<3Ϳqoĵy @v9 %Vw8##x5P,Cg Z-S 5G[Z L3'oaֳ`'|tt @J0Ti=tW2+mLޯO[[ɥB!)p·Obyˢ^0Ff%~T_jJy w]zf[gg mW\!9j$-zn:m`a$Uۦ8LzOC5h1][8~+3ChnExe.u(}w::dQÒv)z7|ĮJr-ymLyj\m47'tb cc ݤJ$4 }_NS60pϗa&.XM|{?x)1,n|GJda ''wɋld3EY)&@ t֦6$}x9Y7T4J'Ia!H4p%!3mϹ x72쾏x/*q5(i "Ɠ:цLJҺZ+˯p11@`?eP4VhBwZI) 0,@@YE1^dE6m0BUgު˲-;D-I~mɕ_`5{(}2`\?S00bmii$M,l +!5l?4 @lH#ygPr:mDt:>(ppq>83]ĸ0p7)B[ HJ,mTn) "hNՈw {.cZ5s7l1W5hI@k%ce QI}h od'\sFuZع=f-U"FG]\LkݗS HCO+RXQJ^Nv_OR@ݯ4s#"(|e}cF,LjT^$nKϾQְxVp pi@c ] ( DdX6. *2"Ku @A#=w>2܅W_kIYI)4a[U4Ԡy8r56Y/>rUü:_9Th@h^O*Fyj&'LslCE?_CJmRwlIPK(g5fnئ/IU8ru@ jtRhNH{4,ű*m9 "Kc[8/A.9@!Y 8@xdb;Jj>~F͓5daxKFpCҋ1j(ݢTA!],&p~*ذ+B}䗷p"ssypycIEjGy?5qz HD¨ZN&ËʃyFc"*iѵ6Gȃ㦲SǮЌVҏM+Vx1EIYᮋFvX|{M/4j+0"t.#]jT?;oP P xԋב _lvi C. &{&Oݡn|q jeP:T f䕝= 0쫈ΐ? u2(/Sa8q<-iVK;yڔLm!^/w]84V \GFibtc' 3Ɲɤ2k5je"R@*&ll̢N濸Z>JǧWU5c5Ъa=#}N:@|!چ\ c$~ 2v=8uUKt)iU~ cC^A }ǭ݈oP5;]EMS#Y!@Iokui0eU<߰~Y3d['0 \h>0Sl8s| 1]̍ ݊ ݠwAVc b{;uOV]d4 }X@y\K%NI#MY?f52 [3j=x듡T tN3Tl m=mG&YwP(zMwҘi` ^5te%'&Z@ D%-Y<]9UY;vu`umݕ!m%X7L[uu#a@.y0iB+#fMwr*6]S*ERF]]q[ ^YYOYb0{Ub%J'-TU6wP*]$Χ|s]i)y/ixM;&*rc~Ǣvd[3O"{32Ȭ(VpђpZ$l2ukp"qrz]#Ǧ|?wi:cd^h$U)lp2h}GqCٞs\OY5 ,1QCn%W8wƲZD{ˈPXV5g>.O g,jK9W23v./ 0g8F븙=}-@h@DlY,[xM0~FL=:M{`X曂 _v&Mv9E3@ b}0q-8PxR}1'y,**ޚm= Q躧< 8%r|C6V1&[%?%*K %2 Az.' ܎?8Rҕ {5I`'$P8ʀ lWt>cmID^BQh` V#ӞA8RmYop;Ě׃'vI-'Cc=dPj~pȁ&7]#&CL8pѨHXP4=FcrǼ+^ [m[D3|M=ʖ_`aB=v4@5ZG ۯKBGOw%SnZWQj"9Ӷhp\cޛo|))&ع\d~[1GLbo|^Z( kuHјN?t9{۲Dg?,YD`VosDkK)@1;#oғPLޥQy?uL|2z4?:]RBvze $;\PibdUI;Fhޣ}S K$ī|.IN6?{zIJ-w=ޱRۙjFmuý=C_=Q)̶Ai4̤Sl9_ͪ h2mX[vM{ E_T >7>?!1ж\CN$6qJJwIirb,>;X&F{;ffȗ3`ZVV.xZ{B"``ve jflRX4b^6<G:=n]YE]ҝה!K@ GN9|-5 hyzS#iT)FFꆯBeǎFQ<ʾ.iOQ+ y(kF0ix"j?QOFĦgHBy-^?(YmۃEpjY L}pH`|L ^ph6‡5{m3%b]ՁfRn6͸ËәM [_̖ʩ~&UAR UP{dzԍ؈ aIb7+_<~K]cXL ,F1cQWnì OOT){ .7jB⾉hj_⥘oILzD%*$h5Ҽ.hl-~B8frp21+rYxOb_lGLij-%Rľ(͟\:34:"h3f?+$-2sh)g>:c^݁\|޸гITo~ȬZ[+VM>L;6])^ Ϸ]6,-+W& ͞(?{0|X$Vvq%4Ls+Iw.j6jp#|2άnH"ِR!d!+Ч1#ሪ?{p9jJ㾇0`8GWP<%XX`6m@$ e?e![ I5+F~u}!q}+w \c ٷ@8ϵ?؋Y#]BJ!}CEbz.E8/fn}@el ԧojMD=õh]3#I#TccTCb{UEf&Ajܳe Xvpv+Y=K P\ڑ >Mf8|) ==z{WMj `Dv6&<*n UZefXpXWms/eb:F־ƃk P$ua)s^SaeuQsg4C +I{/lbiE} րcP=7)m(TB'=Dm#J |ޗj`#fV^;=x2:H{-]hĥf:y)\Hcui2guU:e2cjbz:wꫦA\CQ{ y8ʜ}'9mBfAbofj .]V $(b&nk{v7|7GYz]ҙh6Nh+0t3yN0 {fjW-|l*_֪3t' 2S&ZӯȦ3vmB"7;O:_VxT3]*]R.W=ܺ8Jܫ!5ɒty9n_ܷ=׺ljWד"ΫN V ͔d&أUra1M(J/tDْʊr$k / ̖p{O_bPX4u#P[՘XijVׅNJ"vY\ofNcIŅQ4mXK~^J쥎?BkuFINJa5O4@ :M̽"x3-w3V$:T7,x >vSp! 扅B!RJz|JyB2a)D+&>lpFw* dC9kFЁ̫tZA噦UP|qǚ(CVWcT}eUk1/0_8-UHݜfb#gsߗ̦ZrzkΞ5B`eG?k=/F+a6a"w ,Yo|tw+^QC޳RSxx{_#z.ҐԔ #DdRb;\*uΏRTx[$JqSM fr.}Zb!L3 g)Fr4mٿJV7~Ӣq5c'9ReWT 3>G7OB?١**[ޏO JP+1p ih~Xdžo P-%85L= LE'nmˑ7ߧ🶁aϟ5x)|e71y57AkaWՖb%?K*~,M)~ۂk'QH=; #KON7!{PdRKHnf}Ţnd`2 r86N>. UσiQ ԭWX(hkC$.dWhZC؍*!K"@5H 'XEyj@VW!#CC5VPv[]d./HV`IjjdUgo6Lu=Uv-7aʍ^QQ4p!9v%Mڞ&(4T}{FH}hNWxg\`TsHv2ए!/scSBjFܩGƯg%4f}g TZj6}2U0K4`Qb9O&滧-YŠšIyr_L$ @IQ{ `X≣n>k pxm(*1T` jƾ$n)/n6qd瞖SP '9TfƦ%!Bug%`N6F E%0X:/AeCg ٽPqꜥZ[ˣ})jYTGү)xx:uPγqo!\ 5nɜ#dx LMg}gI9c@ιY>VjI"Atwf8ًSޔD "'yB{Q~9j{ x-j"wqPдXE[} Σ' $;TP3g=X*Kobib{`tNΛ%a3G,g3, 5pf3 ur")M/=RGސzFEe:Fv.dLuR5>x"|jƧNk%V \F8ZDF* I&n@U4|$D"DN i>TIoH&ȁs_6hȚG8đs VG3!ZC[ ~3|{9jK=DVrp}/va_Cvb qX[7#dQeGYPISDҮuh ;rqf-txG=z2zt6pC^P֓r6컭 :șP)S\xԈAD±w&.Ͻ] gX4cWBɎK@l=0eNK[=T-\S$Y ,]<{.j!]WRlgG-'6ZO01(lIxY\-yw@b/"XbHֆOPA.^ѬFq< x#I]')d0h'lEs6_mW@(.6Nlϗz2Q'ǐqc&1b[tfbF`Vr ңfJQR}T_h ؼaexf"7Ԥw)bǘtROM?YׇJ ,u B2IeQ06?I@B^1mbԛGl'-[80VtY N1ǹ2*h8t]C!aӂ'_wNwn1:mfٰa3M'!f~BP kHChń)'\zK(`?P5o3/#}1!eQ#B_V8x'DqcU|"q'?/Nē5(+(1 x/x{4ue l݋2Bo ZEkt{_ ʀ\)tڍKhb]^{-kG)Zci ytTɏ7=yȌlg"ewL1$sR?M[f-Kʻx(NB6w9HJp`,8X6Q905 V0탊mvFOņmb3O^{9nRZo3ugd?syObƂHdm7-UŶPTK?D7Yk21o$X0M:%$`Pr7=L,Őy ,!smR61#@pzLRCXcjX`.-Uq~{St "4ʉR.M>95NtQaAJiicR fBHmmr@,i<7ᆀչ(I\+V b8`-dVI-2ƄtJ*r׼{3{ 9y'v 4eg#H6c?5 Z `ò'R{ځY# {0d9)}{XzXpur|xLHR4}3x1-Xs81!TXE &[LˈHsdXϽ̥iț X1 _]Ds''h#I 7+K) 4f!4iܼa$]msb/39#mD.K ipDL6yp`mKHguVCL*6o`_`\Jj1~wIJc441^4ifJbFL4?Q|F˅>,s y뭥[/7n)W*~VvP@P Cgʄyd>ҫ(DjG^Q "5U|#w&QQt=[f>j)@9N6bdj؂ G*suU [;8tD4 ov{/=KRr{"zPLRWztФy  Tq8 0;p!e3\01KlxgF1#BCFpZ.˜4[1:4M,{ٞ^8oåbm⛃Z#GKa[  Fא C&E^!}a+o̪X2hՐ{; ;lj{gF$gԸJU\Ӷ.Djĥh747s) N*m48p27q!w[{ ѿ#0JZK3Ɠ9,w CcGt+9x`f(g1%+w0 {#1#>y?U *YbM,&pP4ʃ2JPΰU Z)H:; 뇾oVT_V`&eiQ[=r׵7vaj2ox༒e;Jjk Έ> sv!rrN{2[/ ȅX98r-M(22r ӟH6#s挊Fm8㽲R nMB,:QDwQ46 9ŲhͰ:j9ܵfQ@-~LM*u~{{/,MK{2[ 殃`qY11g dS|3:q-CTrD8WD`PǷs$ fpNdOiO@to1armCį=pI( rC= 5_N@ _y_`5á0/bhG0 vV@_r%i[̋Cy\st0m~@0dƼQsXQ Vޖ82I$7np oй=tO*[c7~jcXJhVֆO~6PgcѶsiް&F6 `M?I3脣L˃<.V{WwYap+L3X\k5+>+afoS_Cį.]+2|5䏇_ܦ }#sd/Ʊ)1~2W4}8sph~Hgrv|[WJtWs-/ϸcWiE;$ãg u0b;NZlNdbq?Z]00O]^zBZ.]Y88U_g8i{կYեR؏ m#@y+{jA;R%y[:Y0H16-`X/\p|H$:°cEJNoAZ|GRe*{Tfd 32<Ś%.֊g+.=13i {U5ZORCz qǟH-Ƞ@#l44*N3 0y_4nj ø#Gь װh>:+ԯ]{ʪESl< {#x h?uwXv @k=IӲ\IO9]ŒQh(fsE-of 5џgKGPIS-xg;]:@t^ ( ),G;3k^[CKQȢtTAcy'eCB䡸~&,[򊄚I$3!cQ홖z$RzFFCلh~QeQݵϳ1uV"& 9M7߲EOFO&ے@E[?+*WxTM/\W욕_VT;H-R 1P2wn9(D_p¶kv)#3LmKxxHp V;?I%bUpQ0G]p P" nmg}:)mAtNX6ƻ}Gv: !n&ҿmR^YUW}9.导7r=p! 0D=gφZjs)//q&x Yy@ aA,e :|f>E A A*WWi' >4{H`G]U$ϵKYX9UGLOYS؂Z'n)K&vUoqKf0|?SFE"h 0DM.u-`eMԕ"v7c)>i3?t3/41cDgkFOUFjb1֕Ow-ԶO ^A*sM3 KFTI(sk%ӹ0]g, )@ue$/8o\۬ $=L8G@#ӈM8}`|>̴^J"J}r5vtFo>BW/~:!Yze`;M2 :g|5v{F gtŽoܗK2^%M̈́ nw?aeaSӲQ*xowo)SS)㩹rEs=O d?Zt2GgUcnJc%R/}uvxi ^L2Y~e7s 7+ aM LDXTpȌӵc)3>毠vTڤl=O/# $ iPOgzآ^-UvA3Irp k89a,>?Ck$! kmKh2Kg~ucN&D!o=4f ߤqhMeTsZ~Y A؟;e|omJ!Zt;kOMڄ٩\(6qD{< s\?CЅ$D v°K4.x|$' 5+ꟾW\ -IZs/`QuͶ6,/]_ߐ}0h21#}B'e͊<:ȏX VFqߖ w`dIx=͸-\";N.*+KE]ނ?=wO_)U'\ #c/N KBhP S= d`|刅?w"^ߦǪC/f J>8c/s>3*ŨN/lN-3 n;B%d a\XWL\H{"?oSJ04?dk C5рZyGxxYfl9M_Ie4A^IZk;PT ^;P(m1&I[I/ A&~'.yGُa} d´0)VFغ"ȱ#kA͜n}'q #4LҨC=9cy-lxQ.VݘX:4"nn,YǏz'f*KH,w8sZ/޶WrCLԢv-o掅$pnfAVٳq-(6o[][{cNbbB1A,BvGHebޅX'H4T}{7~`ӑezRU(q1W$ Xbj)1)'bIuU熐0Z'zJzHJ?t5,Ľfۧ0-xgJ!77 NDŽul0y?皉UTv &4!\(ai?kI6)#sCqN,{.9] 1 G")Y ;USۭ<.~'3wxqI<"Jsx Mji0PvYܼ+&++] q* >Кl7 }}xø`Hd0G"1b֊XdR2/{)!8ȗ'siPb d- {L;{ja3hx琄l=zn&2zp49[["E=equ.9of~HоAg$*1pUWd6h8/0d+CV= _Á/,MEG8>{e.cxOٌ&ܦc{Ls뮯) W1rnänڙ2L`~nGt E1ӫH0-͵~畠W8G8shs6D ʂ+۳?ړ i'Þ?)Տ H&ӌa^U>=V|Q }Ύj@-_~ri=;Sb0bb;5݋gP! [Z \u H uͧhb׽/-N) )Ӆ{ 8bm@NtĒbf C=|۰Չ@_W/[VB[첧gF M=V񲹃mb\#VQp"37KփfN 1B< 5aalH̸@C$y6Cx S[ & .Wķ 9.)*ڀ0EW&PTCR-D֠1C/`Y/ԒMJnN:M١Y1^0h!t7CQ,]Q:#V(ǟ"ߕq OƎ}sSePl';i:դp!!\l<n*ܗ:UW0}r B%~11/``5 I:9N9XƙH^?,t 0V$7-Fo?ӚX`F:e;F2+4GUxG1߻ڦ/V[HZTSOT2JkHzU'$qS8m8$˃3bN rIπ?.E!Ql}[ #"(oy3B, CWS1;6?W.o}̭2Kˍ`9QkFN~Df0Xdm fxNK1" Xc!3FOp$#F$@pxSזtk\2[,JMo]WJeW] Zt<1r'C#.e O>+,x_@mÕ#]$F^a"Y|53' BUY RvpG_}OX)5imjr l{bhّ2?Ԫn``7&W>ԅ90ٕ/2k &+m#խ޳n]/L+f& O88}*xnVvp}iCve=LU\AQp(j-CE.꣦ZV{ɟ9okbI$s M:Ѓ#KB!7MH;I1qDbhX?iAˋjf.!}.;GNq&s21!LdpN!LQ-T6hqAa1EG&,T,܊4@NRSm?,Ӄ]k޳JHǹ{jدX95[W~=C e)hV >gm7cJ]̉^RDʽLOnD+.V\@g00`8C!!m]N>\xӶ_ձ6Ҡm:!?B=I;fW_q@I~A{HHWȕ0Qy2Ÿew\у'D/U WBzrL=&.N WaaK< uZ~Hr \g]DVjj ,5ڇv nc qX6cncfv d,3n2%F8lÕa6 I|&Rލ}pgꋋSgm9ΈuG Ҳ}ݹП\.j"WY < E:5' a@ˬu#O?L!m!j.={c{~Gہ%,4cܞ w Z)j \\G]|4SdMK|1DZ]ǚ~HᨇM${.mO 2s0/<\*3@Q蓨ρ}u&2`)&N#y?Nt0u&: U`ɰMRlTj&G hb}$^)opăhꈫs)T?I~Pbiʘ59WÔ!dʄ^4/h_9fu1>b>93nty 9CmtZ|.`fYV:%Ka( )}D:(ךg7B:tA/-u @LW)]!Y>uj㼬ѷUxŷc$$n X/w$x9P4 |j4ym0Ζcvm76HWĨ/AoTi'_ʟB)$u-M:jR׿b9Ɇn29>VUۯDX}@i@D2Ggp`S4SSWbyf* JKSq)[bS:B AP ^V^1J4Gt `0|74&#\s{CbmZPhO9-D;eF-IAڲɾthY Sߐ.@4ɳWeʢU&E VRZTydE2zFH3/k:RD*[vv[[=3"<(6Dix.9quwXL 9WoDG 2,7F@uQ/bE:z9B 66OWK p6d`;;=eɚp-y5QqHJV&zA8ƺe6f,:5* J)P^U5i% \a[TѪ,o>STKYux$UF{_FD{y\%I՛v_E2goR;Q$Z,/+,Yoׇ8%6ħT@~ݓtX30w)(pŌtJ}m)KITKb߯0nS_,WdG4W{^^p4U36DqF·#q8dd ܄^uG2q­I AueI؝ SU$0WHU.6YKܴ 8}_re~#1ovPn$/f/;!E!3~lGI1p&Dc;6 ;ߌlalNw!{㚋`xmx# LH٢-&U `7ؓ|!pg*w;8K+LaL$λE2jfTU!6Jsq#C+YwZ}6n#5ޝйX2 whq19h1.L6#1M1X. .݀ߍKyp:fvn|%irc)^(<ۿH7.IΓjI$† DZ1\ߜH ydfDhX~kB\1"]DQZ'8NP,-@g+捡1dF;.yMpu g, wnN2S.O' Nf0O M\/ѤB1DBWt")EwV64;a*IyQ痲ʫ9tiy>|8zO|aN}&͝E{D:2I'mĵ˳qlO0u,O݃^ccٙ7a!wjle7~v,g=~4Qb]-%9]уrcSps!3YDR\~J7(+Щ6yؚ F3>7QJ ۄ{ؔT<P4hG淔o#_0^ED&#jݗم+PC }lnQvd0֖?`R:j(xHyw-ڻM=Zn'TQQ}/W{a*S'$=+|IrS^hK")%J6B?qJ}$, ^:75~:F@>C_ Sf fQly-bїe\?,D{&Gt6]uc}t]okh9pOy t`IñƝ,ys?̶pf!$ѬFm?JM30A^CLӂ>(:d:h(f$U]v :ѡk[( %hz`f.@tݶAij)w_hN;[=k}"xuFkLHN~aJ:|]\݀ˌEm#Tw>8>ȠY,f󵦜i:+9XWt|ZN20~ݫoѤKu AM{]m ##]Gݓ]qL^m~V 6B c60@1Hz[%{&}>δt0 ԭ9˗nVW&(- ~^rqΧ#[b¯zo}X"ۦKV2|Ը!qڎĵ(ܐU+K,оK.΢`K瓹Q^PEe-TtF/BN@jyƯhntߐHmd^ ] Y`8i_;v㭬Hol-76mЧ׆#i9CRz6=$y |w#+*APy{]fǢx:UC@t<<&bDRIN:R\zUjX(&I:h\elL&( ' ܏T0.dͽ1jSFme O>^`\͗=`3RV {'JaLGͥ1ʄ=y 5w?ٞ%&*_NxCq(n/a1HoSZy۪ p2R8%Kkl/#XG8կlWɑ2̿敲cl3M&D0y)Lv@Na:.K%v_>fE/BǭDPW8F.LtX0`%arȖAcnn *_˶]JOOT  *p(ۮ804::h0|RvXJGخ{`P#Qvo%,gZq/ޘxPT|bBeKM2؁"{_n pzqB5lIɂ]h|w+!"qxW^05o,0x&K!w!L۩RtZ(HE*= Bsݿ`k=uֿ#ezCl B'9B9 N̉u+EP|K:KR?vc]AĮ^bs"@w\ڗ6Bw$j # zH r>O/30fxk,&y }M'=݂՟"vcWZ@X+^Xv<@q X&/Z X;^1 'I̽ g9<#S gz{$5 \jl _0UXI4i]&#^Y3+ G!b5n3f2c*aW%k-bl`QITgBc:7$7 *@n@a\?A'i g Y_Bx E{Sz nL>K;<6-ɑn7IM7[ KwlǼmP;$Gp*5,G{sK9iRbӤv(f,q^q O6?z^Dg~ljæCzzƐ;+<ð-@45ᦀ2x&$zK [4h(F-ng vy)>T! >䛈}ߟD_+jkmB]dI5:XgppԳBK0B"Y_$v'wϖ'::if4hَoC N{"ZPG5_(C.fnI忈 \x$!M $0DVZ _ÿz/CH&C)0J&˞őĜ R$۳~FwբK+.a:<רU ldlw~~/߭!T벱LE:LTCشahyx!rU 6m7+(] t,h>cjSc+ 7[h#6Gp'ŐEQ0-/2!86|LL׎7O.8wtROnƔ\(6@,+{> ]$mZn:ϟAjK"wF<ݱ5o-\.P*KlAw 9 \dLjsy2Äb}+lv6WW 0#{,VF\5c!y9s)1({pK^ފ`3aG؟L2\1V5\hˤ:;t}Q8u"fqWɬ+n!(x,a eG6F]-Ծ#Gj]p-T%OiI4V52S͌FxkGBEFb`>nTY"i!M&n$&>̏ 9 Vq*Ȅڕ־:Wț]?8ŊA<G"9,3Xi}û-HYu0(Gڌeލ+sK7ԝÁ\h50Ypźk-f4e'1ӂaA[q7R7cr+x:wXI:G\{/֚KKS. ;#z?eH6`@ꑐ`qp>yrDkֱ6Y#@(Y&̸UJ11QfwwmR+^>e2\^W@gQpWʑ[ Dh˖׆Q=Ua;2!Q ^8 A-GJHh!2 R=zysc( 8@jcMk |vuZk9>hc F 8" t'0qe;y|E;P5!esp ӟx#9DoX\dE-vI*Zoo &#GՉ &`$xԒǔB c ?o(EC݀[keYg%_:qľryuAW9Cs)/2b'}*JXl*I HHeWm-idmW'%Nۄ^&’@ǭ I?x8%0fd%Et L}&wﭸ3sR M}:5)96)BCO.[f6u0I2%zby\`_&jo`me{ռ5QIr+ N>řo`D;͵}`Ɓ8 s {E}@C괨*̓tmPh(`X .r]i+tcoWwu3b7H6t[zi"M_+O]B^34.Oz])Ezɔ$ҸeРm*(܈O\~Ђoc2P5#{* $<] zd]^SJՅ]+!qO>nXg} +bGT)xys*3iMH'Ӳ1gޠ&+Or>澺lx+"5X9If p&p$kηKOFC*2+sa&(=sU}~sM揋ixC,LHI[KY9*(R."UˢPmv+7sU9{=e:%\ݐw" Te#0'\x/KșQr}e3s El]WxDsͽ&T Lk̀8]CW /}x3VgnkhC87IP7٭THR4w!^$Q7>VnFزt]=|n :teyd%³3ٹbgŖ+3c%e5VUbDײ;<`&ixEcR|V$d 2n(}*Ňv;4C[rb}JmrȌ{TRP&˴hSɷflg 9#~;Wf-\6i^R1i3đ=߾Dμ :׳{F' _'sЮ!v<6d4dG԰l<ݺ>K页i=%S%_?71"k ^LǾ?u':#@87rBe>27&qojqP2l$zv!O='֌|F"df}F ><%y1\b@^}|h:0(O 19 >ؿoKo*]m[ p 8E@D JZ/e0oxøsV]޻7kR,5 kCQ*$mTroZ@r$H*WM .d]( X oI-鯠a՝Nه"Nv(^M>P$+K{bK9WxL*KCFDAOޗ_.HAT.Ҝ5J͝'C&:?Sqqffv}O.u$}wE$t_Ñ| XqYphwêt(/Co3g[eWd & rxykpt hN !xe1L[˔̹zGE܏ߪd|$j_Z7* :LX*C4s G07I5u?e~`5vQ |bC\WK@QI{_aw,KԹcx` *$^4Bmg䖵n SBFzsq S"eVA4 `8 :|9?°@4/zԄ>xooyXmD,zO`TfBG?eyiWO۱_ )9r6;L23X,yw@> ű()h\1ЮM[wiun-QݘlSv䖝E\SX6TWX:qzZWx`ڻN8Η>Nh}w\EOpȍmB6_)Aӝ>K]g:އ< uM 08a |Ƴ/T򎥋7Iw6WadQbt*A,w7_,]T#7ϔ_GWJtV/t7,-~lL+'!ݥӪbj% Dow9^< 9\T/..-S*ܡ=*۝_cӞ v:K0bt󰎤\+;^Zźu"({s_*F0.ޕL"1Q*pAy/{Ιw8At"w!"8d0DӞƹSJ_؇9>t p.Z8@ЀU۹b$ouGLɊ~M b՘ע8XR 4nƪb1 R0FFvhTe jd1NSaP$ <ScozX/y;_[C KNvf Y}:Ot˞' .%Q Cmrǐ{EԐA@d=sTQ),$#fbZՖA؜erqw,?-~Bl"[F'˦a!)imY3cuסo WUqj.WZۍwޒ#o̎!hRkN 5أuU[SsKi&p<.`Ԙ%qmZPoOh<$YST,ʡ5;űy@1Jh~̛[r(~yq#~`bj9Дtq{a!N 9.Hp V֔Nn_7 RLN)q !uڞ¦{Z} {?p2e4]ݺTll|VcRrRwgWDɗD$ݦ(P7u3oE$\9pgd{|ܲ"A~j/n٪xg]G4O8et;\c W7YBLTbY͞{--uNGMYpl;#_dnr P}ǁu>ߝ KhJ6MMwΜ2;)4*KpR4ܢo1 i`sF£M;2=Z R'1&/Гq'v%Gfצm*#|A~5xabi{~*;s.3 xfV`# D01 v2z6<$$ oz\@z7+e !'0.KOceRp Q,,?08ꛞg^~.7J>쑚0t{A;+O ܧ+2Y[K60;7b#dwNr/u1X'9=׫DMw.Z~mQO:t泔6 %7e6O lӛ_p>DL8ي j"֞hmS/\'bma,9by_]UvGB&N|5lZ㧝+˅Hr&eq!C-c9°Ǫ']J,8&M!SY'Yߠ}"|߇XeRjTUKJ>= ,՞g {٨7_Eg{o !iI h=-y[+ gj~x? D ?q>i􋍐 EG|\td_ߴCbf$|7}O*6e毅=HLeԉڅ+,98;HQh T)d!]/hȼ1xoY.=C *ZhVCgmM|㩑'?Y~ɹv!U5\Zq*M [1>mA0l~6s>-;=> h5ttMM8@T߶kNr]oF{؝)DlmNS? `\$Ku=B`Bo'J*Cԡ_ RNj; Zڄo(&ג,P.Tx*^8>$PT^@E_X~Sq+#?d!֙)Zx;?N)?Gj*F7c-jrWe1bށ2Y~Zkm<^Q| .0om9rӋ|ZʛpcёyB=[Fs8ގ޲tex&-.M<2A9v@Hꛦ_ *ynU\|K*'q\ :GqAEDžqAЂ5n¡Å"fj.ocӁ)#_mMYm ^ȥv!,lDM9΢蠂1ڮ(.;|QaNܓĜuw&;PV`;|[J$z=*kI A`,jw+I55A>lEsg0D l &* ,Hso:F;7/geC6VE6q2ׅ!KW9!=gTQn,rC/+U52/ꖇ~WBkO==~kBvJOB)ye]ukQ ɹ [JwS !L?v_RdE%xq,2$jZ>0o A2 ><\kԻoSG|jp8jt?V@.1n=5PlzoF}!X^jD<1|Iޓf\A<1h4@㒯&{ h;f(ѭ UY0V[&> tGdJa0z!:m $%a$?Yx|5s3"ӱXxTQYU%gZᔰf Ks@h.*qQ|wa3=%>cDnŠEs8T =Qjmf{샩;|eݖ#da2^pkcߕcdX~0@#.v:v w #T= )j7rdsmBeWO4q0; ]G`ªpGe̠csу85,l?9$sz/6C-({ 5 iΥE}# )ΡVB gm.hDOKoaIPPC _ÖS ٔrʸSOck%%Yo%)3—.ϴy5_(wTݎ[vQb08\"a똭۔.yr$=;'.J7"PWQvhI8PAY|Q#џWŵ>XfƸFaL iDnxPc) [)+>6Qo'7g'ENjk* >]smY + qwgJ<+aZv r5l2N{ɫ(Peoçᄸ5ޑ:/x!VpѦ,xOYu&B|{>꾴}Zm n41xSrG&zM 'mR:?qD|D ۋ]k7hosQsW*~ P,& 3zZOs7jdf+KwEƨ1N-VUs]w:πegva#`f/]i]ab~Y}6[4g))Oz_h.ܵBjOܠhqmރ {Hw+?{[zoө " u}/pP 41\2`7޻ьO6?7y%a򢚹ZН}r 6%9%?!n28`@B@'םEE} 5B@z[|r~Zu}\\jP]io"PtL!՗`6AEYkHʪ77#f#@pb4G$~^&}18OrF;yc/p&ƞˆy}yґD9[O8dCg5O!_{%JPE/<@dGSY $ 7, zĺI!:' &udA0?2ٯ$W;YO=?&OOt1z)ҩjth8-Q{R(G4Fb)whքL ݗ]=)=Z10 M!`î3woP|ږ`.79b+ϡtDK_Alh"~Ip\$ty>}kGPJW]="&lfdžX劤`UC3$h׳2wԈ4(S߄'% oF G9gmxq;D,Q 5b#±E4f}>mla& ~UY֍mdl V4A[] COgM[;[d')-YWޤ D.0[9J;*::W/T~mRX-_jO{0RwCk&Ʉc#sJGQ81pM~|D!_с"ԈL.j\~UjȘ 'e&O)&t5|Dգ=ԕ %5\yA_Fpm?"VlJjR'C\b2)DSD Ի,zv?5 ;'Vir{21:yȣiE~Mg>IDwh!(} Rq!~0:xx$xyDqEO9ګaC$#@76̀ |BL۞B$  ufJ@/Fs-Gw/O# MCe oޒűGEAt!d~hk/$^eba#6Um1׏ҡ)=揬 CMem7k RoqϞx῅Ͽh'Ph[WP r fP}Hm@lL`!' 9*C+28.̧vi3,[ Q}Ɇމ֬Fk~F IPʹ#!=DJ%~? KZ]T xQ]P.#=78-HՏWZ!$]2^ ԭZDV !vdaYjL=*9F1jCmCX e䊧p\L0UQ5¨"{8k(0[ Q|U_jvE]P #Z%PߗVR3g.˺WE$ g#/ބǤ&'r-=e/?y|'p]\lHs}g^MBÏ8SX4^w]Q1ϑQPM #xQA0!Tvg+5z?.=?$69׺]N#5z05T 6Ba+n77-vj?{WcGѷΟ~4˶shN\{_<;+Vo|NJWFEZm/rmkepQ~Q-o_q'ipgtu xH?u`A@hUh䆢EDrioW߹7救W$hS_E.h[zOɿL#zBoVᇔRM쌀dric>J Vdv/汔>+'8#(}Ȇ3rPTތ"oHXUm&Jq<.6U sz2?GG{ΦJE:-Pu{aHI"3)@0ѳ@\G*'|r>9FKS4-u\L )pw~8DCg5 |ِG3#,SALݷ(}rX/ֿL&fޒ>k4 'ΎKpwbIbp$]t蓖[֙yzaHs+ b=鮞VY+؜lHG ܂*MuG ;(ؿy'>D!䋶ܙ>-ǨCPf'Ֆ:rh F 5; qW@ERj,F8)H̠lҌq2` >΂e4ɻq/J~8A,Wd::R\_e08c}M9ͪ=˔eM/C/0gcN: !ZrX4-q5n7Qa\/69^ Fi3Wc194k-l48reM .(0RR,6yr+uBr2ij͵Beol}^PZ֕wqD'~^.Ȣ&s͒`L9:Ӑ=z+X+dBU, )p|ЬY-7 ;i6֔8|kLX0P4ӧNڗ&`=jzRWo (pv?oxҜl1 @<~4j]r7M H%voGC]g 9.$[^|9\7dj;JcK {q!ŽyqER GEǻ0{%@\@)/1T`,7!q!)i.' J˨ z`75!7.CZ'TC ˷DT3{L)frx$kX ZZC"Ufdq<ҩAD_ X 0cFa츂rb OwRӣs%Ƭb4Ϗes)-frh_kSMjuXgJWFT7+km:xRv,Y`^QxIfƢRn;ʎKt]hR۷+4fZٲiEA- va첣_&">&i0=>u4a[{(jEawsд2Deb߃h>WSf3͞13Bޘr "fW` ˄fo?!v ^A?ranҥ{Ѫ8W~SVc }&`T?sVy \cH J't=HWG Rq(7~pg5B SDuCBbn=vmM*_D*ⷞa*A\Mܘ3 OB,j.JQ~Օ2\4}8yMg-73w(66ʋw%o(2GXe20B#,]WYq1<@$#sWA0.\Zڮ_|RX1DHu.o'aLSKj'{g6o)Ϳ*UbhblAT4C9%\񞇂R R-Jܿ4brtʘk.tBz5dj¦ LN#~>d9[b1nR3aO/~0PG6gQ3+m%JJ|-'!x񯎐, O򉵌G~A݁"ds{ _WOYKk)0i\5`sz0v~NY/8#10hn2:CI %O]Mcu7aQZ(ϤiEU :ŕfʑ~mkLnjoDy jqmn 1H_ oOWkբ /$r'4 g*p2 4xŮ>b>,:e$BayĢ!\<="0 -b).n"GL>?N׬_<{]'|+lYSRӓ~ܒʡHـCr4>lOׅfcZG~91sܐvy'=VfQL"ʮ5%HzW].f3gK:+2*KT (Q=Y^kݚG.y՚4;Ҩ{0zb4ԻNe8ױd<'4'pI XBx&i^i8`xQ\p4.8ӈ( k G]w'xwNÑ NTTE*awzxX&ihr!"_8# Kɐ >'tXfQ?ͫ Iy1j{q V5bk=slifF'}Nk%Ogc *@-xj)J>VqKl0Ghvˆm)"%9q|Br'dcOLzy"K_1oR" $Du4(jFtxF 8f5Rwh35s>x=JΚ>WTF j/7MAԞfD E>g5aP,{e<2:tގ_Xc{#Ϻ>.`f( 2.y*D ^^]}d5 Wc[G1T Sׇ+0{fhԐBy4'.=HҌ-d10&>+72BSQhU<;`uLu`-CDh)AZVZaxhk6y[cJSN}>+6- s&\!9g 0%{ ͊\[ikNKr/pzwT3/"o RD8ba%rT *=ܛd+2Ռ̂CNL4u>4[2-ʰ^]D'?w}4I8#݂V.ibFoK"OO Fo +sɣ8mԷ,E̴qZ3manJ۠.D|=(̀ĴǹqBYđc,A_BiBF2j&^uH*KvxQ;KNl\N%8mM1LjBw"g%c,l;W6G if׳u,k#i!"FYt+ҚZaQb$'wZ /9s 1ߖF,SVRN ۊL4|!.DJSH6Im)$XkS13`(:/>flً_(4ێ^#=1 Z|J"+睐 Frp J&Kr1t- iƼ4* xEiN#" MeUs^y;a3N(@ 53ߞp5fjSrTnLʶl౬sF=PcFp TA=WH..&RPy#s^o*XxY)DĿ)By uT}28IaZls|xAVnA ak[@6 BG]_kOEaqؠ.V8Sٽ?r7[ˌOcҧme{yN$Ę %ĵ:* ?ʵu>dl'>A@ /23kMWa& &ZNu*osafl 3ѷwzS G X?іN}E2e) fK}i?)М8QG 잡6K阺-fe C;Ug&zx>ږ](Q*BN$ֺ)nSD~=cgPǜ"5$`̝(-pZodc(_"ذ*zy >'ًwteES&OMUc]: wlӦ%0g gtF4 ෈z-x]Ļ%zvkm5-lގ6h3f8.z9h`Ŷ0:p+Ϲ& ƁIhFl>j'us;Fۣ 4N*鏂 Q_o&Z)ҖVf[{ct;dsur>)KgCP3<_': N{n!?16'!TNA梸`p 7DfK4mN}! WLx"@U"LW?w |Sܔ)4Tan gh+&~~ P SzqŕD:^=t9ȉZF5ڏVNafï1nV0on䝴 Y=Hiݎ.g|Mn-oDE!NEc[:B_g}7?5.8Ϸ wY2+HaXOĹMЊa]pǏ?\hn,_86Gep{@^|8_eCJS_MWZdwEq;*q@6S: iOxJ &Ff2+EKT;҇냚vi <ʷ9Ql6=<{6{''l=j'ǯa%˖ w.Ge2c\LS^)`R!#וqv>' 3οJ:>Ҋk|q7Mti4+ s7fv^-q IyphqkfS5( >;1Hduk7VuU`iBǜGV$Mk6!t 2{"uz;Yxߕ-x3cvh6BI&ձFջ>6u;Xzg~[ ʗe@OεLV\;BM7AQsd?rh0AZIb'aVm8Ѹ{%`k(00ŵ?,Op;ܘfa؈;RL~N9^?h1Ԇٸ;Ax ܆(B(oF>L3n`ޤR(aw+Q'>wpCt#]|J+fT \]cu#h?s쬑EsL)eC5# ~szL>8$$]db0@,WӟL)Nvpy19i"x 0Ks_FG"ӐK70hTv8xEO6Q d# !^ۜ?E7Ա&C.Q2&.FbWޢޒ.bOWacq)kOGjj,4I<@}G=.Y|%NT/m!iญ ޛj8der<:ntL6 ?H/r$㉵Q!bjW ) h]\b˹/vo M\̛}43)POS )<ǃx6iAO \[7a!ZK5!"̴#7{~aCսƕT,1znƫ{e(J?ګOk}Ff /r"7:ٺ'WzcP#ڳpUbU jJ7KR$G4lqƟUe7c#kEՄµ 6q%Mɨo4 " F%Sr$~]]\D-VN|yN_*2i|[H%FdDaDIY/Ӧ#’(S+{'ӫ%#}f'I͝p򌗽 I}ʼnR qO;azC%N+K }6?lpf2<ѳ徒Xh%4$i6t1"Hn!Q;pq~_*m0 [ !a+/Yu9K:$,rX=p]"-q(y"ߣ 21ȉEI&+'C]g?nθ։ET~k7nQln n^]'#D$cM9MT1Ѥ3J&9V1<DTV1gzp'\FŖ60h0}:{Kgz Y|I>Ykʚ_^zc> u[+Pjh"XZ 0pʼ.w8dfPWg7R su~t;wIyG6EAEFoGx5 F-ӑ3eOMכ.چk#0 lKWГ`e #ݽ 6jXoXPQrBJG\OxO&5R*tw^ bJ!.HJĆN/wDVmR̛wur0IFm^(MLxBm;QQki{)Jih@^F[K֠P8d0(1ƞi]f ޝ\t7O AO4L?4j5E;p3w[3\;ҒB–}9f5px5>qR+^ -DzIOd{d]Ʌ%Pb'%eV!Svqˍ:4-Ȋ'rxJV0N3o,p{k)Gl֌RAй4%v7D|؋\Nx43Mg-C94tD,V<ṞOR##j(M&$},/H+Jt o2疿8"9s&WkW|"DkJL<5 嗻1Tl"!H#eM*c(ԏ2#b(K#?Rv rC[':uX qIiYڈㅶ/|yAPsK 'ߵ jCY U=`9F7ί }:|?ꛉ@^C^gZn%nӱ at@SI4 [^)9lڐZ"D?CiI"[m_"ݯ pVz]WBq;uKR]L4?n:w!R353R>SkHOg ixOk_,nYqTi}ۇR`Kr*nK 1Ь7%C)ʹ^{l F6ˉsq}o-*@8ZX toj̖/B_')?X!a{UM'?w;T͟_3+O7/68K:#OfL/H &ϭFa ^1CTBfMW$֞`#}=:&ugugqxRuylqRy~7mQYPzo q)CCAš(ڈf12y4 8$]c"7Gݧ 3`0AB?x9r}g؝[8c0/jTh"g 6(Ufݘ]`5vG6'%+Cm;>۳6?'ei_.݉({-{|x)FAf.ޫ&F(9N;Š׆\8WݺpxxOϨ*!p'oZذ Dn!ۺB v3lI (~2WjJ;.jrzQj4؎O1/9yV8+ZU)kIn;:[3 AC\ z1+ ӄ3DUcyH37q7 =zsUWƒ{Lo,=/jƄ*՟50vy:I`bO 絃4ȧCa'{VN-ԙ3pWd@:^zݤuH}b9 ! yV[WrwY,1T7n8O ⇹^H[2E:xʷ:VFޒ-7Ѕh<\é|&|1k\0~?VƏI3I̧9yG~:̽6 [T4f|NDg>7m|bn_.^P\[TzAMͻB3Qt|S"" DVi#beNJٍtà0}VvSKB(}O)Zymqq⨣Hi|$`lrChRB|5bH쨕Y/ṳ/fA1 ;s8/ՊiI.,zQvczqHqҸ[n%)>=(kJzSF/7h[TUYe>Oy=»#\`Gl689dSehTԖ419-5P\&Nsym.xj pq6}KŐ6*:7P'>4R&k%hNЈeroeK sY+6OXO; QH5qa]Aӕ{ NXG=NR siXAn]09#2 :GJe txa,HYf O!Gāwv󨃡?n@nah\3=bY=V'B|NϘܞwmY7,|aQ_V<1X X7RgkLqECVl8ħ8\p=Z%y,Ri^  _(%ig.c|/Fd{.h$+bi+3-usa%uNA|6]}N]oE8ԌU˵V${crM`WtʮcM /Rr87ew=TΙv)6]ilG^-"zua]p4Qzq0 VK6ş`zepPskz)LFtn zo,ƦGʆ2KFܞphpA?+oSʈ`/|rn~6k:[V%pIӆ.cT +!QNN> ὘gR8 pUY'44 ԚG=0bԼ} ht~R{c.bE=/X&5bEcuC _+G73 gެ !r&ͷ.[&bhT.jӸ/T-KcI5| E~:. 63PsE*Hˀoi,ϿjTI&y^a8~>,/'H"M+ \˺+gߙe@&*aU  Pq.vXM*Qc3/GK1 OW[BVw"ji~DHu ZVhqj$Do=0Ynuc4]uբYGZFFe{D AxCZ#; QʖbEi)V l4ڰ=,Obߍ$8N^[jH0Gx߉ 79kmynqxڒG"wǏjڡ1w`,c1QAuZW^-9el/x~JIhg:MTlz&o#x8v[0 c>jma{ߠ5q1VBv AhKL%O1#5 O;o=,N>7M2@,Dz=x5dn|D_@LY8jGD>IKng}6U#(PiPu/*^F~_tBn:jeq9H }*mZ ;OGm5>!Sm┟vjCڔ{36<]ZX",jO.FkP*(ZSȱ ̔tm:\g5CJ-k Kϛ;A")ƪU'bߩҒOB\#XnIwe oxfxjtl'ct2)9 \R=e=6El#/RY4"f4PuP x+(dѶnNv1p>g l0&4ύ|#N۳c-`J4A`nN)Odz ๰FT|RLbR!͎RR_ (` t=8D|ӟWK-1$\p WF@w8'tPL<.?t-& ,r3] nH4ۓҭg6I_tscQ%lTZ{%S=Q$DBl)'Jg"k/4Wf>6^C>/Ar.b'W\{KU""YaY)x"l](jx,1c,#M g"S.\l,K* ]B =s\tzSm%>;JRE.o6+;!g +g@x@Q5YeaEL깇ąY _& mWIG \(2WbQ ߧ> fwO~wX~ 4ݲQb@-@`I~zTejl X*cƊA¿H" 0]`9ۄ[KV _$:A%/ͲT}@Cɞ1y!V 0.L'% 0%ī1У'I]|A Ͱ< <=Qusb"4(e/D**3~d,0[˭ U8M,c0W6 H|O}̨X5;roz5lƮ;Z/r5"w>{zc}÷^<$>D7HlV2*PyQ}gh2,B?m+9rX1 J(GGp:خ>eGxXǬPSbm2fO$%E<~"b{̲^[(:0WI~IUSC*C:YbŃ G=;e32{BE&hYQ34>JHxKmDg50,'믘QH2OB~BV\rv uEc=To19%Oy?to>xezr2"R]dGA 扊g#/hg#K,V=~Mmd FHRyn9Fǯ1yfcf9]|<!L_t%Jb LI gYX޶wXk~C% ZL+BgFT;-KÜ]c7-v-J f$W[}BئM|r^ڞB ɽv_/*d'o͍K/RCjPr-3WTsMk͈.5 5L3nl؃V?΀P^w8r=2Jz}ʑeB5+񿒷K&',$~oC[!7s|Gbq̸4X[F͜H4#hUVr5 %[s0C8Ԃ[^';#fj/ ĝ;3y]oLJiԦG25'4ZHUV3AEE\hȹ4_O֞Hjx jhLیc!F|ΰ6?R=!ois_#ǹ?8J2K:>V*墷rcpeЄ&)I38R.MK.GZKq'l`Z]/v|&nL'h(Ηb[? E8D¯}|I}geN7MHо`3Y8!![#HRevBIsW_,\Nu}#uA*ψ{9rZAz `"Mz5HK$h?k/z;"(8סּ Nɱq HpW6 !-aQ^̕hw s,:jx;1RkyQ08B(zoY H*vC\H?h&//c^GQD^wl %b ȎӸzMң:tp?mvh^K}jhVz${Yq~ɈmvG4~vTXG.3Qloc3oU-@Tk\,RMl]cte86$kYXmUiط@[.?=NT 0fg9ᄢ/ِ|Dn㡑5BK#F# N4 ޫNH'] [F\'(;y,Vt`!8ej-^%7g.q2G@!m>M>U8W1Ap*Jڭ*]/-/gqB^h)C`qχa#bolSlp+ur"NE]ڞx sX+,#R zn54LA*/4cL^ܗע+M:r^DۈN%l,ې+GK;ϸ ٜhdݞ`ŗok@[[}yKj^?bffgp>|cQ@%Ƃ܅” lq~-ط\bS#ePGP+92o+")ԧ06{ecޤ19aWں%^!0 ;UU)|%Q N>HUނCk,5z>ږR^8dN"w찳lVsMo~r`X?1]OXPO"DPbgo9gxitaLZ ~泮Bʃ )N1dž,W֞GK\GwOLO)ÍW_>xA푞NoD#R |Tsm~tp*WiĢ܈W]Rzg*ƙ)ߛwS?G8 mZo6"r661eI:bV~W>Z2%y.FevF"/S 1,}"ynI=S7jU[s,I1x$\BYbClfN'}g٩;<̓<і ǣU3hPkX Rh`qY>Wt+6-J&,!g\>h"2/>f\Y9h,UM7d<5T|wB~{llNdUӔ|R}C.IIq0ыq%jmSza.1Dьoy@#;{m_ AQhx x,_۫ ;^U[G?󚡾jNupBgt],݀] 3Jm;!i)l;Nc#;H=l~W($(du n&LA%$f.~c( JoT&etSEZWsØujF'; z)gYp9^E ԽhJ4Ĭe^⯘ [ Òh]hۯ0:d1;@XƪQHĠ Z!W-͍reACw2LB#ŧM643r[.?FW˺я{r* og#f;,%=WČT.u k[3EtT^WGJ=}nB+=nkz^I.Zp nkwIQqk:#khjFr=?VM5v @ǖ\sSsk$b'44Qy %+_F@lͲUz0~ Dj8% DW$eFts=klu S0(nSTuBoJWnQJsL zeU.eks:_cgbQ$-3L3ȢQU[s6(Svۥy˩BeF]MLI=Ro;%߄# e-b+5OoEq(sƷx KflS69ce38]&}/2i81?)+ݝ}Q$s N[Pou8iֿ k/'F4]/\U\~'Lpk]$0d&1 %gX [[pjr UՀIgI˭[5޲$rHjV=%\Y~>ٖK֩{6Q7ĈI)l,Y;G5: SDP#}RY9ӫ=Q@.Fi~Lu)碱XyYrQz2X\D(-G<- ׽޲yQڻmrt!lĸRJAJ-aɣd7qІƳѨ$Sa9Sc t2WK)a*0  V 9>QO^A5\yq&b^x[e5朏!A&姲!Z!"^ȡ V&>Ӫ6Ey^%M};&st$+r+E7'Wk}/̸ jW~;T/Ydf!xԬgi!>!|@mpMLJA!zO:c(Չ2 -&c(z[4 22rT[W|"YxdhOǑaC'62s>APQWgs,x'gt@*]dl|.[Lc)a/™v iPcD4޳üϔ/q0Kk"p2ĪiLK34<%tPlz!ʘY>~: !ccՏ[h Ic8`Dqp C>Yp®%iy?4mdqF;fZ1Թ6Ov#vEyMReQt+BkǁnDd*aTG|Y92GrӐxzc('.:رu"ڣ2ґ k\ Bf>"z4;Iq%`͉nZy@.ts0W{rM8&B6j7ab>ɞT<,KqP4.v/<Փ4ld+SjڞbP>q p ֔>ڜylO+qY%ߨFfsvj/$$V6׿uSLBltΪ]'k.`Xfz1'1+{'Լ *ˣ>M6Y+ 9%~v¡`Z4D&yjWK3K*T\ԍ1f<1\:&,BrI'RYEGT|էRꀱ9ޅ_*0CT-5]EF<|=I9sT8b *o[ !|Vi wʔe<hӁ4\X;4~ba:"6oҰ"V*o|:pr 宆x No0~qN|e۝,֡zL P _ 13D4@lYnh&y;}5f/%3y&L~hjwv_yI!._.AF''^h=c{GL'he4:yoVL^bJUHBSSUGmz8gponB#Yx'lfyCV/%ɢC֚]-GS5ҋ{$S <}xZMGoVaL = h#D3 4ǣr$H^4pa+,i~Ҩ?\3|ض$Gzfn:ܮ&ezR.A 1W5ȵHF-8)ZE4fsjܬ'kn@ݸ/,`!S^lA \ȗK>n*{ML@l̿.WjpmdI鄁rY%l-rx('4[;k&?()J2䰵O-Ue+ǖЪҠd aX׋˕)m1[|e<Ĭ0T2o{iܽ!u&0S-#>r ` ?+}&e|q0;˩hd~NsG۵hV[KiiBV rIg3)Vwi>|WCʋM|e]Ofk2*yqHm̓<ˆhw@31ffoiEE4\P֋8D3VO/ҝ{ۺ[PtD,Tڞ3|Qp Pg V6&C{MXь\ez!']jÍx o/\n bǮ&&wQvMI9iJi\CΛx,PPfٿoiu虘VVyMQ~ɊH ^t"Ҹidzebg~eOd :AӯC؏er *T\"W'S<'oo=QvaPi7#Mb/8 *<Wi~Fq; Q,QHj,uoijr޼T0(yi)g*j K?{93wJ:B+Fƀ՝KtՋ|-kC"EFZ<c!殉=k( MDUmK+84_5h+!Ծ:+L%wʏ {#TlcMwo%h7z#oRTe rYoD<&q WÓj[ qWCW' ϶m`$Ċ Zy!cl|ci'ɮiL贞MԊite DCQ`1K9+dw~HtB;չklSwD/y9!Jۈ!S7 G>\rLITYu-wOk2T `|Cёf e7(;]Ey[w<,sur@EZrEN2o @Ьn[YR cص~?MNA ea;csuj` &]!Zc ų:@ ю=ʩ~#E_T‰7np{o·IIR`8US÷lAEX=o^eMVՍl$UVb/tVF&ᤖ)M2}byTyMUYCФGiRV["z up 8zz#Jtab@n=qI#ͨkXR,.FG A+IkCX\ Wji\Yg'ӗ/u h꜠ 1Л4L)ƤljW@E'HZ`"X@P) T+ )oo]'K`W7^bＣ q3ڢASѼKsBO.tj;2 P B@!кp!p֝W/m=/.Tl4Oz=缁椩}E-;>R x3%ACk`= 7DWP*3PW`Gsޡ]vNdubNTI),*}JGu=]Yl(ܹ„S-6__":7씼цR6aqRy݃WZVdk:| Lז̛(sG/eXh*[ "QI Q9etC{E54jԛf# i<#@'U.~IkY5`2?yค/W9߄sx$4շpn.%\s'U/vndhldsYw5yLIغo僗 f)_' iOΛyfLnF. !4"'C6WIt,ɀ*kvߙ]]uh_O1?&' 3?ĐTJLF󄐎U,Z-C8q!$ˤD4"AuyeR_*Ԗœ0 ޖt[Ɂ9; KT'`qxH2 I5^Ꮽ ",zDW8 (g߲DVNV\cI?Ym :>@)qJgasO}JmBI`I߭]Ҽwqj/)cJH[xŁl:TX'<=͝8Oɝ Io k#̬e E paE' 2.V2Vm!:h .x3~D^@EK?eDg SDW: t-7Azҳ`V*`Mr͈ĎLW}oHL._vt ]nGFifT]n>9qsNiួ'e+%ofn+`u@}6[<8pPrLd  _Rཅ*^w :FށLjG܌.K`Tt,  Jov~nLћ7݇XJY~fGNʈ#x2"z^08 ޞ:^YCYWђO+Т5 )lY< Hc_$l#.OU,7E8%> ^eeN@?{O"\"Fv' B \|)4f_"*ݣ;&YI{j G%s Fꡁ_pQج~R2SV)da^]X}ĬeVewJ7#3%;֭զR,C}G(U3&oJ3Ӥ Gx=f$[2{f)Eg4$Z\ 喜 #uƿ2'̱~.Sd"܁X|Kb۰]_N TJ.K $# xnX27MoUswkZj`~ݕ26Gb#[7ñ?2m֠5SLSdrbS`0Wi}&O y> @u**IsTGά 'r̂\:Ofۺ0ڹ+C-\s~ UZ_T`H` u7 (OxaWʄHߦE\] ]꤮odOzxٹ;̂GOAW\n9 EX!]]"<4/_Z\ \b'֣9gѫbҬ_82Ӏ5D$iNퟮڸN P 3DBB'&ݼFmXg\K~yʲcNjzXZ E}՛ʉxAL-` &Mo6X0d%:l^2ޢov=vZDBId_؛|a#(ceR.V=Jf:Mu:# -LZկ 4LߝI9a "ࠟOagZXjӠxJ?3_k R0sh$R +UH.5nЛm9|ߤZVﰱyc2s| nȟR*\M^KJr+/t1Id*{R' % jS( _x2'=.emE8_y'#5iBy '}!G{;+gHB֪pD~S؍' ݏ`Co F~ܖ jѣ']{*GWV ےV^+^FIrƏ=j v"g̴ eG61f[Hs~B:bjXC&и䭆S=m)1?,_Xo'b6?/lG˩|"A }czW[x\yIiջY?AJ&1 z֟-8@l&Sjqum!tV4>fLs";>iRXk?>ObUqYzRzƇfTD3j-=.rFf˩$-@ hqjZɛ*`l <:FmII:ЎCFQxF"$r %Ps/u\83D~6L+a.:W =>Z>Kbl}O[>#-'-ʝ=ACfFk3ɶV"P[6/8l吸 Ȕ)کj_$r?AUӡLZ㗢TpЀaU^6u)ҍ~(i3E˶/k8s腼F1ϙD}&B^Q{((Ŵ;G- J%.z:.P{+-.]Y^ ޗ*AַoJ+3"i :-=^O wa}e2JX)J%z$WUeZᰲߑ3!J-{ - )<w`,e̝n"Uq ߑ4~& e&۔?ww\CM/UFy w4s{*ÛLL {o[v(~o'dadx¦5ML;lƿ )\" U!ո廠@qbA=61>,9utc#Hei:^u9ij=iߕ-̐uTLS`ߝ~7R\SZۗov8 ;%4 x`/﷙RI'k2Q,M*'4p㚪'LB,Bz/J1Sh6c}Co2'sW<7[u)&4TKKl^Upht]~!?`fP/i5˿!%uQM +} cxt|סa&=gĉ8cRUҎ qݎ{]/ Yay\ iY%3EDNLj`,^şOA# x0!/ /AINa$-M:ITOA[p<.^J4.F[,n _s)+J NY/imq~՛z%G[o]$lq[ϴ84 נlU1amjS!r _Ԗ!kEJ$nZ/HiIK~@O߿c2`-Eh壼)$ƁC8OE|8Ág̵?u[X!'=_s5|A<4>bi|y|"WBʸ.72c8 d0s3' n`3""B5AE$_l)gS$^}\fyH#o={%\r]N<^[ԊXYb7vp'P*gd%%z`$dn6u#acpSO&ˑZ/?1x[p@BJՇJ5n0Dі{RvQ'f8qWx[ 4cgx/P-zFŒ %Q V(,5`<kMDt|XE֍HYNWn4jEH^I,ⴔ7^nd)ÑEyQOy^x䉠Gj ᠆7bR;@޸Bz'yFم)bv[$i#~,XNhp+WBPHxI٩ ͳ 8T]ziAM+4=ixS q38:) Zg*6(k! -ϟv eE0ct! ^%-jC9fWĒП8O𦭯>R@~G XܬRS!a% Hc 8B ђP2puUBk,X~5=xe2'|MR-3 '˪"* VK()|~+D(þ:~0Ś"O&ky(op<@ra|%pJ~XABma76Φn{q$ރ5dc%;Z~;"x'9{$Wzkx5+ri,`#aTƱ+tsN'_'8EQimj}J_\!THRjYV5jZ:oLǠ{ Wn}D3nɳy$_v&#ۧ1 6yJy:!>,>LQ3Y,jtpiC2- :_n#FF.froK{W3.-%%PfG Fo~LC ;eo`>13!aģMnBBɞ6Ee'+oqbo頿91]tRvس-(^Nc~XCO ǒU6vjK"46q-}W1YVEgx ,'c(rpN 8Ѻ.B@xKJR}(A]gS-k9 c}LJRJ(K~dj 4%DuG3*+ꗫ *(iۥ٭?Ƌ:PDj6;ka[`͘XS[ ,*~xQ[-ňCs?^i0?`_5x IS&a%?EkY11XƄ#X!D%`[WLpheqy]eBYWylv7ϵ`3 ݉٣j?SݛzK0uE{ps˛5 5&/:B ks8;P:C3 vKT5p9N >x+L<ةGnͥ>i>_9BŠu5ԁdt>2aRb%8>~-眝&|5vx?p"/־xCC]uT@e6Zu1t깟'Pl k!^hMڀ.l0m`J[rՀ{k0pZ9x**W K 0dD~ ,_^;зi*b[nElz{)ٱ k^9ߥhv^[ɗFN쒇SGs vD).Ϊ Ju" HKKt7E(lŇs./ɁNȁblы=i+ jV[<\n$(sR.^c]}[fEaUHD71>#Q6g(bZy}>CRR?8m*~YK6d+|hBYB5Uug5ᔳ.*V2@XmB̃u&eO[x!"ӫiO\˹$4ХMm!wg_Ԇ+`֍!3f]$jOj=1SV8%T(By!"ăݍK@'g{;mulEL%LrZu;BeLS먏ZhSrX;U-]УY5tAgR.v!kkY$"y*oyIgϯkXv8م 0KqQ0=٢c1Cw-Vx!UlQ-j Vj p+_Xh-7L)Su#uz)K#K[wR鈤A3zT 1V8^*VswÐ* gVǧTl-P>YT8thF,viXBhFo͏V^  tebx>'%8a S1HC9e-B= +Ѡ+~:bAuAeBXhT9RgU3 bEPrAA ޏe^ΚJ] Dm-@o, C = n*֟`L:3̄&47 p#&b.wx =#_Ux1(Nñ'8+3lrYR<Pbtejs59!9b 2yAJ?Yew}ʢx&W{z@*#QX (;]+QBw3ﾰo'FJThN(Js΂mL0'lf D6890X+f޹ChH.&zfaqܼ8̕-Èw_t@!?rdܘ#|/otJdQ1Y؁@)5ŸRҶ(: Ęot(Lx&i \YB^ud]FS\B{r]eˆcً)F7m,i1y -X׹\EwV'D7 PcGHȄS#T CNyQ\b0OԊv9PBAg#_B^;n ٘ZJ9,bvd;a=hM'鷠EگJʭ<4_Q`#=:]ŅDu-rqS?N DMC\y׿m[fˢe' a i=)Xr%^[~7Iӊ-Q2wnDžxt`J7 rYNZr'](U5OrgLn{7b|<jDbF/N H30bު%)_&Ox{&bK$6FXܽQ{rq%M~)cVTDga}Aun[<;Q[޳&:zF}DnvoY&*J%J;ƁᔊTXZ̻eo<|cp灱֫뻍%7fxi!P/BĝYelॎmcU )m.,_uaSӿe7ӥ_ 񀒲EM.3D'- #mc◪Be"15HV0OOK9 gqC-ꖸ^"7'jv#,} U,v0~WepWB3N^F.=Pr*Gf? Yǔ=O}|ASYFCC~/GV;F׳m 0$M+"-KRZThv:Zy`ENzq<ȇ0ZZsF<ה7x$y/ !J@A԰,B[VU)eb.'|:&G"!uk.ʹ;00Kv\7q8SB/{jړToÂyjsEoi ȶF86bޛ(^׆ߙzcCq,1?[)5P2œyoMc]c8. 訁h=p4%nʧ6G}x±'ORmk+˕Г 瀡&D9ؐM%'ty^J|y) Wh(w*y}CP\kE_XСHnYK5lA3ec,&.KpwL 6<`29u 9 a&0=;Eа6ω( ,˝Uc/܌Ct_]ؓw*|ϋ[ggPZ:uޡ}3$fS/_יj}zo35/մsp$M-KK;%TjțezƉZ-Mdf$JcyB0DV/h}L&ٲLCmҭMTfP:'n*%@SZ`w-@J;=Ye/tM7=S 0s{)b{M zÈAI`p/i[!1+ޕ^>Ͱ 6a$ڿK @ng^ F6ouP 0K*+ٙ51<xHY(2{[G5BPOɇ9 x!h߆z;OT_WJyp.sp!n`ƀGlm#};:AkٹffO4N|7olr ,,XOӣGQ+3!&|Ү:}_]8>Ƿ,r{A}3ID+ BS_ \(L)"|ۿa]ٞ|::(5ŀMO!V],UGF5!_pTW) %Y#k(y^I c =_Hn];us^Rˡ m⏎ؘ 4cS DB'iqwvXb ]n&WEמ ͋ V\g=\wL8j"st8hh6SM\M뿮eإDՎ3N~oTVIӰ€߯{$I[4T>c^3(5vN i.rOT N;G2[=dRu8W^іZqjgBl"őxs07>F .#OidNtaMp@% nJagE9 [Ymfo;g>"bc1 INpL!vMa Md+KukM %oHdGyTݓ#JeoZVv沄 <5WU,tV~n|`Bj8Wug}{ bXE Z Y'3IwkIQOuWL&[g12zN2mm•Fף޺꘴$O)fȠf, KTnjH7$xMF5b: F&كP=2SzP]tRI3̕d mv<|:/b>Cm{[i<$`$ av%kQf+0*ED^\I[bfRd" .)gWd@v+<glC!KVn*QOS!w0+ê5hp4fD"}\h@vݭ:dH^}H9FuUC>Թ|ʅa`h<9ڭ)p-/$F ׽+Vjľس2މbG,|<ϩCmuG|ݽ!Hj||nqXu q/~@"O`fzȐ0@%ejM$vA=5X[(SqazuRƖN0UT\ygX) #."d")TrF5yE#SNbO샟SoQ5 dzjpw!Jqt=X{(Jg\CNEk܇&6^POڢo5!L;\4~@ ͖^>AU*Τ_] 8Q?6ޕ3|-5؊+5'ocj Hg#xJ3z/͈Pp$&@un|Nw/ T&CagHbLL5xێp?moJCw ?_l…?1FToo}&1 DG-<!CDK70)z'ISP\|Q>sRIe!76PdԳ;܊5O,X.Dn󱰹}1pL~$_JŽSx#_˓n^.ш,[ Gw JGYI:FUUSlfMB`g "$/+c Dx9vOKLhrq\H 0z:u%A]c8"+<҆ãPس=gX@Vf la_`O&( kv)̐Ci-vˁ"DmWx"LPxGes-DZ@NŰ>xq̕$ _TBq(x|y-s !y {`aO% icE6N sq/GI ?p~qV8ޛw5J"f<07!WS)Uu~poAR@U-xO8l/mAXA3Ho[RP=@b+]J$BH!Nya& v+K*H4,|M:1=( `s+!MC sPÚt@zX_1ԫ]+Pȧ}F `BǦN57F!n9#=>+ z ڂ,Ζ^w)Eb dI(,n+װ<͓qްyWxl;u[m^73Y 8<9X n{ sCc:5C'K@u5Sx~]쟢\S3718ļv&'cڥSukDg[iI8i56Mg%&vϠ 4q8&5,Jt>K/Myd&'3\ 2tnF™#rm^ر7 kbd ',2X˪N1,j~p-vҝ ֽ-bX 񼸯6$s *,XV<W!r  =xoԪ@Gu"c tXZj,jhާC1EhHT:0ڝ൶?z@ 2̛+O,; ^t%|uuZt_C8n,-;cVJ\5Q~7^ȏ1E>ܴ/edr*$R|q #I*"\VbaE^VKI\ۅX2ٯC+״<T>)%F!ew}D=,*Oh" ~@p*` v&1=3in2rR;05. m+fnT1A&.y:Z0>dr#S2땖Yc$⍰7c3C4ht0Պā w3#pFi~4C_fUN+728b+~zmh@ ̩09SbӺg%wJwifZ^K K>XC?~lh5'%Rȯ0;I蓋|;z>tBxjO.{߾'Y[8rꔃEG^j4Gky򭔿^],?1 99E⌭wOEmw=uC>r zC ^UI8hJ蟩HO)|+ X:`C3I k_']+ Θ:nn kOHq=wͰtƁyqÏJ-3Q#Rzvi${>)ȺLy` * IaE[J71BGKw37h:;{mqH W ʟ<]I W~I`4[ _\a9MC]?Z;Q˩l%vyqwr "5eJl9ˑHZy^$Qh5y$KM3T4,N:>܌&)JEַ|"_~;KiԘi7|-Im$UW2]v"OA]~wR󍗛es]\A,dl߭c!rkPA}N4 ;A <|\3-w 9URy/hh׾tu)#fGZ9[.sb8Tis ^6 )g+Zax{*ɟ4E$D7'({z^j9m]i||I"'iɣ΋_'];UvِOLEf=XC/b.ϵ%j0%Oj3l $j҃O7TERJTmzҠ)tMBJPށ >mH(\# f-QHtgn԰: )7-FD3;7'1GCv轥EJ K}"`M46;`*T>$xu=' 1?Ft ^fsntItVOv Nڿ47;I:zv"}T?MRQ X|lϯ/e0moϿn KC[҂3qA7IO0Ng R\qdݗigpsN n o)_\zis zkTa;Vh8,:NLpJ;XVY;JxMVҤly h](4\S:V^"),H/mE"" KISwC,p#N+/2 RSuO kBCc9xΦױTN &*4ONSuyeu[Sn"?4XGGj]ɤ7;@f]&N;'6깱Ĩը<[*%םNzoխ X %m?| nn U%!Bel6w}f6(ڱU Q،·m p?^:*xZpuYIIeI:0xzxfz)~7CsqhH]e2CA9[ÙG_ƪ ;I`hT&j,7624lx'evU4Dy>[$bXU/Yw*ռbX yzMDTvquاUx^;8Qq c/+h7}'I\R" oune.5 d 0\F5KBZq|mvъF9UԬ.FMTV@*'n4Wةv:up~xg>5Đ}IO^1KxCg}Olc~*% LPGZH6l6!33~ ^YIÁT}(r ?k=سd 1UD̅t} SAX C zp[`m uP(JԠt{~g/PS.USؚ=rrx-#YF݁~*$f`T,DX}:u7lyy/;wKr{8HxWBgxko~Wc"옗k*#R)Mck\A\PÖEF*-WemCޘikgA2P@@ީkVM@Mq%Γh74L3S`HJ:݋ $9 ji zT%* XE*7g 3XRQ iZdZfR<ټX85Ir1Cl '7Ua7jJ/d57&P&**f.MT|\ܙ*({}q#`b\yKLcd(}O&p %vYC"XazHMDJ9njc ~PP+HdMZeǾy ;^{*\c@P$fωM~P0f4FGLtq8ߩA-Oo+g/ VW=g-ja ϐUx\| F&14;pԢc_#nٟ4-U=>Vť OȨEg2 TFbɄ3t`B7w^YC$dדؐlIV/f5<1 s[UA=#wM\fLv%?8}P|^)Oü;{b1-jIlm,"2F_Y(Qk l77kրᾖЧ1sUf/E;(ї^zDJeٮ=qh_@ mB@>"ȇՖ=\}jf&M!$ p4R`.;BENB@OoW Y jvKjm)IżDLۚJMQ}'0?1qtD5`(WE=~cf;-|D5^ S>溹5NA{퐛0"In_Na,jagէX tHZq`/Bsݛf Rf Nٱax]D*3cu읧Vs%_MKA[[I]mvRHʹ&RJɟZ7+m-Dְq%;9dT(y '^I,%:F|JYY'r<| 4*vKdAmmt{*iv)pdSt8 ' B9}P7" (0D y sA%Y5C("UA_3>,V [!PQ}JB82qJӒsK`ߗzf"<[GeZ3)ԁo'~^gXoT[^c۝OPN Bl rHIy00N#%ǖ›B.(Hu դ}XQIt;HQj8/ ^ʨWżtG #gb$.d,ݠUG0Iz1 ެFWr] t'_GcC~ DqP ^ڳk~[(+lfrhC;PG%)d~%N _QcQ`_5dOۈ<ūXT7^r.;SN J]4fIl K~YZls؁h?Kx#)>y/Nβ4.Ӄy%N_+q,7PNxpc_:&%݆N0 )kYAj:rDSZ GzJ&a jKsnz+Kl#Wnzne|0 YɲHAG~U@1AW2ʞ^խVi|Ώ3i"ydƜnȚMv.`Zn҈x4X!p^OERM㝎qQy#d)U*7ØW<5[x)1UԪ!y GNX:WK$,Rk-`pxb'|z`_*&-g r&\ݸZ|d+6c3& >¿xh/LTӌՉQ1RTp)IZ Ig,NQR_ "@=~\A+f , p@}^UMƩ?f>b ћ'^[[RJ|?qd.~_HX@1^Ɍ^A/_.|[@O$uLeU=bnXZKЧ}cSb;o9fj. d6*HΟR8MÜ4zo @7^mnpYTidi;N<5[l0$%rJ&s>Khsg tD\86cV t8:@WYg{'^^@XEIg[ǻ 9oD`6!`&7ƹXȐߵ]z>)ѫldewNAQ%II# I5]5!Z0B}&loZi yIZ8* .bo::||CH8[vCI;DaSq3G!XH;D}h.HZwAl՚VxZ{W̻=h@Npˊ/ hy"6t!8Sn$2.T[q(% 2J–hF$˞Kn B[xG)r)K_z؁%/<(vˏ;ǭ#]@9U5Blʷ9[JU׬-?fo{ې2݃zOBe$!u ضPlQ{XTrGM&Әŝ`hn".Tk]4#|{4.fD>HD 7ezQot |JKJ(4Cb2mqM>}XQ ==75 @M̬ $]{sC3sԄLdήblP/܂]`s5]|H̊A' (UswtYp>XGWb А}wRC9v]BݫzqNQ-;r#Ĭ9X/o,P|a}3Gσeq%#MVTK&ŷ|һ >0}_3uوK !% A)ڮͨ3A 4 ?3UK΄eұI+PR|3͘PERf`9Wki3 c[W:;R+eRS!q$a"~t5^ǛmCNK~%]M ʍ8'X([f~EW9eE1V%RFi|&K1[UL'x!'bdv8r;c,+TyVc#`!.\\iR f*`)m5D^w=.[' ޥ$`9o&n q lK2\Ŕ~5ʀ f~,xl $ˡ |LjDc}$a`\9 Fy gXoۗVZŽ]+X0[{} b,ǘ*!xL;œ#)w^e`CJȎ.;*}wYQ%dmڧ]%y4({7(kCPv+Rw}X9ߦ-[!\;,T~6@传I DxRv9' 0GcU\oVU53yV8:,X_PpȸxX餣OdPkf4Te?1dH5J-!zDIo}KU8'fD=Q{Wu!b DFBgs<{ LYvEu`ZO؂!4[0|r`65x"kK~\ 0l K?/zu`R{%]tsqtm@ tjT @bVn!9fu89j\ Jv^(!ÙLUn!&)z##ķߨΉ6gis^\j|t2^S;ʤs_N-$r<If| Vy=*>zkP<E}”vҷTmfh-ZҒjXhK ġ'I6R'гfAąAX[UH:Gҧ 'ZT:&RE*o<6듬-Wmc1b˰Us2NWuGe'UF/A |az6!Yv;Z6SJxW&AwI6~E1n 3-GF֪cY"9KP\yI@LIc_$ﴯ *XtL\g?e }AJ2Wq0V-NK o*ZMjJ㒗4p墚2S7%0P_A?iF5Jkeݯ F< >݅H6ietNe`z̧npI.7rf$>j}H骉=l?ܶaa+|xjwvl@m#)-^cP_ 4HѱqimrM4OJ?-{oУL9di;:hZȸF! FÕ &qҿ(JU0-S&$)64MpißӞɴ8dG63R/0Pr[?iATNx(N/oVKTXЬh-5cK)''!`~(yGJT i V <bS;n5j3Pdݯ&$2/Y *jq z4^NLLI.hUJzOg9H!v~q۰oKߙWM:5Ľɽjϋi 'f|I ovZ%%M=+v!#t roYJR L:Ύvm)(-Hﱛuh<5PXݛU\lp[gGxsXOoI_jhKoS>z_AWuUWkϊ5;N,+o<V뤌'J "Ե6WRCD<4Pws_vG\73X^0X܏EQ{{_ {8 qF!EjǢ O ]жrw}y5O)b;pe ݌)ݖ%] fqw'V1UF4z# =}JW"o"W~]RQDƔ^cc~d F'bdFp^S"܀~x$;:Wptt W*]EU9ja9?pvEWRnTk'!e-JyxiQp|bFyK[8ݘPyvwKL5}(ڻ6{BȳMꉆߓQI>O ahr16C\;0u ׀VKXU|+Rዶr 7/0^Fmi&FRB`˷J{ro#ekutP F%׃u?`aES58IOfMJ&Pvt=)i'26QJZDm(-t/o JsuzR:]k ʏ4M `oyۮ209 TF[ 7X'F9k]Rr`h_Y\VEk.xFݪt2;oڜ9L+Omgah8D JxV)NQc?iNjS/jе<ݠSGYO(❠J6!LL/iSi֟-zbKڑErJjKD.*N(??XsۙL`M3TзΛ⩓rMm7_7wr͵74Kp| v7!VCH/Bqv2ޘ!1ͷFo/NBAzR9)ZР; !f(- X? 24qk}׬WцM~NG4~A&fd5\+}yyٞru[D{S< J\^jOe(B8<ڬla)9WXp覺ee7@%_[W?E9oS>4x A{'3SZqހ5}te>{R$K1v3%Sf> /]~֤:%_ȔF7nc _Rp|⿵LFγ#3 ķܤ1 ׃K׋_pd8C~d-j ]A!=df /P_Uqa$bF(gbGy~?KL)<N\X}Jc?_nHj-> 6"SߗJj4yxx}@"9$^#E/d2Æo^+QfDZOR: c!PBH?`&q+?yGID$uP;n-x_٫̥kZms\hG]@ 1GxJ]ߘQ WN<9HuE ?qNfCQŘ ˡdNrQLB>ψP,O~!m$^'aru)?9=E[c&aOS-cSbZ)9dd@T<6oßHkLW)d}ҥEDL?NeUOW?8SzpԤ=}y]Q_l8mH;dìg2h몍h:nY\w_]l)X@=ʉ&g K<jO}h*esXt#UOg7zYY0c 竵ixI9n2l(7FV 0.z!-AI:!z67Y%ˣyyy{;ydB'Ź-Ѱ!=N{#iN>ޛVg4oɳ*0 kp1)J^Ү0̤tf3|Gen:nH}ޡ7\yT 'ӯ)W;\5Cj'<$BE3,jsFvԟFJ7)vJ1%fދFBLpɧK%o0]?k$ΏU 囒L݆'Rj.TZxs߯b? m;KKL-{;VHǚS[_3E%F4"ĺێ o9<`S{jy n: ;z3'2I}=hbAT .˥iT5A DGF̂)k|'MЍI-Nba|8/O'gjKZp |ed ^Dbic+T E7EĂ0=CI.9E3_5b RJP0߮exXO[R3Mo3=m~uLjL3sRۭrux&z/L좚EuN A>qlv`$2ŗMLC-JSNrn|_4.ix1E QZY90mvY_6Lr ٪]Y\[8SkH K‡mBub8 ],Xh rcP`dy{ c:7 q_Tпޯ~̡Yl Q,)%mZ$?[GE l@=7B*_'^B=UivC=k$L4g4*q5lTb #<~/tp9rjn)TD>@f?(li)4wg8Mj *gm~Π$F4YDQUUb*)ٶʴn:>,U><ΡW1]c=xks~Tv=C3oK@FPL?iOWKKw=s ߘ>Fs HjEVU(b=ceu( Woފ,j9UfW/6MI~hPk! 3K*m\ߕ h<2pHL 8H2s{)ۍzlHlٿNTP6(׉cڀO|MV·~Lʵ&T&/9*tjcoEܟFHƂVB K;YOhr+=NB*;x,M\ZLi 5&S}:ޙ<(t]JQ֛"@[~M'PdLik &sD[_6W.)8=h C(aںJz;t!Gus5K9u6a)s//0%usA k5 &_Ɏg_XazsvĎ35l{JBxeA&׆`Yqz#_:_Nt+DUOJN;Q߳KAoqܿ'xZnm8yӇ2+j/_ F^vD7.&R$.R{Bf g>lxf=~2oHg5Np*vZ/MO jV%,`zFqPsR1dgf\1{eFL`>f=bhF`5ܴdhxep0ҕ&;,QNa)XbfW һVggǞE:ꎠM]xw,Ari07Ր 1v6pX,7͏sDU%Fr@QOU f|ف{OAd=JQw‹Ŵ=F`յ3s*{{3 ڲNcQ ԇ~#Z_-cb۷)UdzDw]o&p%"~zHnؕ! 0:7V6$xLWDdOZd/Ne޻,ڬ2Ȑ!WG)GXµ4 I1|Jؽ']ŏ~az{\Pm{!6h&"(@-J.cQ@:*^r+T3 f^ EAn}[x?Wُ`> wU%AO n'5QׁC{ TPN9^ kAs`lXqMs&Mjbj-ң=Ua+/ov-}N7ppAJdVbk14A6_k-ÄF0^U@ravTW = vwY6fl]4jgczOn1TUA1@qme)`3ߢ7bfҺKkػ 1Ap옑eZ PtڳL)4WDc~ Lz2GWaΕ7%'/ s*%-8Ob ˢIP: 0K-1‘AI::Pk_C契H=dBa1ˑ5]pф{ b^ɛ0^#yȹ}]molf\EeegC]e2E{wߛhrK]1=BNp/A[tȃkhˆ`P]_F'zݽ L[)}dN qw|kZ4tnK[/X([KCٙ>KȴEGȞؑȗ_V ͏ѸZ|MrLt*iۛHDZ@]X!I`9 \&xӶ g2vN^QeS}, `[m cw>&@ ^t*{ITmvz#c9Bmϳ|ֻCA*M"-S٩5ށIhA;%Bsԉ1l:d\LхZ2ak 03^O~hG/,[bі W5p~۲2c,(Fo}GJqDܬHV{֢ᶳ%H/ֵEEC):I& 9s,MQB)V~PtXw3X|k9Wa[)Aw/Wp:6рIz<]WPr_̾fĒPTr+!?m{ѫH7[,#ӗB$`xw2(v0F֘FriulY MY?ϥZ0בWgsAv"=9G?ToEt ;@ TaBx#N" AZNL:ɴ0{J44@jϗK- vQ':̚G_s^sNe:R?zl.S7"o>. }[znD|j{?&.[g,yLW2~gFи r׌09j[jK9,pcs?Ŝ`S?}#l8YΔV~gu"A_TIS.%'{ %Bej`}k`"pR`j!&ß =c~Ò8l4~7$L"=Qv< GqOE1gmR|!8h(:>gZ,z6%r)*Fx-PKz{I^Vndlc5Yxј٨zSuݿA:?B,&gt%n_MZ (Y_O9D襢SW~i7=P_>tDPO6jzCM@~.jykx%9߽[\ѹz< +sF|?YGxlaB#E`IpТj`*ߊM+NEfsHѶ+?aLL]2tCUn8ϙ| uN-Q1.S4k;r;$٢~ثkwB[bU-C Ĵ\B`Z7=_GzCJ4_b"7 sԺ9aY-=F>aih}o=sno:†@k;!̶Zݐ SlOg*/KY&(^P1Oo@@,~Y2FP'߃ʰqukMȧ},ER]Dlxm#GSELw'sa-2Irk ׊h&v r @.4CuLnrų+1,d݊9|S0Ѧ=VaS,)v^.m9Iׁ m,𦶒 ıAd"Ohǽi81`j;79iEسt|߃*Z#Rao͞|>eV+cRimm "ysr,4qT?xx(frSؤd(j@N%'@? ɫn̏ueI1;U/AV3"6I%t_Qi4:L4m[x$MlgHW˄Ӫ^nr0qe5a%9x1O'Q_Տ9ЦE:!a*&I,pt\jbhuxD?6!=g,bI)Te3} ߉뤬B"ŏ?m%v(Qn6|7q7 mC\%X="v(摊EX$Ny[֤g3'T@w+_?{P}Ƅ]0 6У*ʋA؟rhɐP8F՞GC`Ƀ wdETޮǥ‚!牞@-3BZW%Jmly*:9iІqS V8O^KҡaշLh]*4bRxxDb4LEGI߲-zȯK WF;A~ o"ذCl\" )y7em7Ӎj撺q#bRZ+e6 ΈbqH ;#!+1"P4,Xי wM\%@BΨ}Ypjm ґ06V^2+mSx]2'7Z*}1LhW;dnοAm"DW|>yF fQ̉c)'KG-tڊH@HFRgPLC7șkJ5ܲdb]c2^c 4I"їFKLė1Cz{Ŭ]ÕkJ :[ɡ qOJB t<nhL]e5J~#MUc!*:NsW["M]W0ԗ!i'Llb/ fRL5"s˜yCmIs(4 {6J+ev޾OV ^& >IC~!ujYQu {_ô/sDTsA&~WҠ;CI6"j]HX.Y}@ܥ{:8qL+f%v {gr1;IyT;q }uj.mLzZ#`rl3zN[9a"Zb| KFnl]Op1jZbD,w+vŝӠF0㵁X%V^k X_v_ GN?ӊK]m <~4{M\(faML^Im̜gdqFx'].BЈx{K}>)i_cs?.Ln݀C=DQ<8(OkSY r3,%摞[$@#3AN)`85-TX *"8LA}</?ٿv! ЭTH5jDmy,DֱlxW嘿հfi&HzitT ,Ĝ*q*X׺nU+оR5h#GY$ 3 3䋧FR\E` v p P@k΁*!aj H^_ss"4ԎK-Liaf$[g%A<*%J)ͤb}=DÎߑOp;t::&TlYz^&w UrduX;c $"&<ȉ;ˠ!=%XT!J{ ;ۈeO~, H֨ Eb2 }#4!M5ǕڃbE0^,9 َJR=3FaCH(c:*O`ed֫%?5_fpPO9S’M=F 4yph]^chR֖J`,رzc؉yM+aʣگJs6/orgLӞ &D)a$޿rsʏ2C9ZiJ{ x_BS?׮Rt\:P5 &/w/Zff1 KZnS4OmX%7^RboJBMc}s'W -3hDdifC  ]8b|$DhkQo$hy|%B}m٩K$`\J N1n#PiF݀ 7q!4sH#ސ˚SNrT1jƝc^J\h35gmkCLkc@0,/;A$sx-|79>xrǫDGXRD63<#(:f#JڮLb)\tѕ~q<НסՇ}zH;A̛l$3ɹm<վVm|ʍ ?|m)U$[DZn `?4x<'F#WgY1T4oSv ;#/ƚ?PΝIOqHQq(JvUTto߿j$G'm'i R3S8$NԋFyaϟ[cX^_ٝ?3YRq8<őb'+&k]KdWXI5VoRZ$$^S}+UN_a]oۖ0e(Bg.Cy ^H$$ ]? ΰ`@(P/le(c,T@WC0jմ3AyYz`B~':RxtI[K\ @ \m `f9kqc|k1fօl`P&{ .EQDmEh{z+;.EMO2V#:o-NYRC-U+N,9ls~ڣSYk3\&۳O2T~OH%8wsS|8'L.fa\TDIy>wS5pt\X25knJa~ףcm\zӴa~"?53ΐPv$.1XAQ&;f|75Wl6 4-&V1=wttZhn:wԶOl0%eȨ0؉ ",%O6\Ξ) o5bϚPs=M1тE_cE;@dhOslyxl3AŬÓvo~Xgi& )X$,!'^\n۸؀FShZ<:]'pu=LB*z;D+$S"תKK8{\wr cI=`h*XɱhuU#I2~2zxX>`nZ͐ %y+b=ґPl/E/̼ ZpGzlO̺Qbc,mzF5bO<)rRR =:;KE ͯ d̡ٳa FHiH/] 4AcNwU9F?w`4KfK[OCϻ#~5` OH<1yޙqFp8ᝃ r"sm( )MĜjl>c;ϑBa5ujvaQSZh J>8crjP3x&8,LסtRlA8/=4y&Ъ\އ|N_\=y8W$m-&]TY֐>+qO^ 57Wdd3RWCKCȺCeg  #]!|M7xkA%v:3sŸW&jssL-E5Y_FA@yc)&y,5y|Z) ֬%_ԗkQkVt88[w )'"ß֏g-â{: =kCjuyZo6)wyIs64߹P~SshWNe8jQ'["L,d$ ux{io;L0t)CR+2ɉ'pV=}uFjѢ}V _hv%S3Β"3:;?dXVb'ϊ^!q8cJ3ϷJNϬe6_3@9}Pd#_ѠB\퉶.Ѫh1/Vh EC\ou/r^B5@S'A-/@B;7dokqd1@oUf"A-P; 󅳖ZȬmyQjile{}EUȣ{ f($(](G|<?zS=_ip=NAQ~NzKPy=rGlL_+Wڀgͣ'~wbi*!@V 1F.Ys|CG%ż;{KuM=]oWozR+9-/%|KnuKCFg,Y4!Fϝݹ7{㖩ͽ-;6"(Ҝԋ&s'H89y%RANrB Z,(9IZ%8SǐrPd~kz}-҆Ofrh}N]ЋH]J-[&Ĝ=Bod`“d0/1ϲog ɿtʋb#@2!YR:NuxK3qؾlEV|;L{Z$*.4o 6)[OZpPdlAGCU~q;sV/CYS"+ӫMND8-ǜEF S$$_B!09x M`N+bS @NC$!kHFC")8.85ٶhƯ |cyM6w̛)nh )WaU!8Y"Se#M"Q8qRo% (`>`Ѕ¥n0E(PO˺u b)m,@GR)?hk۳/s.uYvefeHA;;$E듋R^=NDjB:*}SF1}a$?$"*S m5ѮYS/qave& Zճ@.-D5 @H"\F{cGbf=I{zE{2fʉQθBzlgea,S"(i1 phpI4c|>V0$~SM&WKf"' ㎦$4i#&Ȓ.)1-./בe"OAC,VO{HGŞh6-!A**]FQVN!"8âdS;F̏:PW` 4I#nZkKn F?x}D5N;$o$qo1[݃C;f;]N!G|0oOTkBz@7ѿ ͛G0geT)|7݃(ʞba!_V+|=2JB9oLKUbɡ/-پsϢ1Gyw&$U8.K$ "lښ +umGnLIkf-$3[aѩ䳤j3=QJdsfnqyJQu>_ǐ[K!%ɦY+"!V[cӰ^5SX8G<ٍtFq:e}/LzL HxWgUN0v,"tA9?8DጛjǶ[ 1 oTܬ:{KA:3rC)(@O2>#󔠳/v~Mtַ1)XQ6kF]3^F)W@ p9[>dNSYD07sk3iqHL[u"7 s/s#d)aBC@d ` Moqb-Zɧ.*tZ=rȏ,EO=!tm*]2f8jl(u4s*=SFk]JArBxbh-ɫ#5?ğoNJ@A >3b uq~;}&=#6(N3v>4O4AJ8?nҎ&z VْM4^n ;}\K?Ԣ?6r"nS*\PIx"G]0&3c8te@q6յfASt/M|Z>}ӳbxF:pϏؖ3ojI62J LԚ\t޻%Rʱ/ +wpX+4bZ%r9F"8se}C?w4p=8*MGcTN>\VEtoB̀%b+c\ESj- /^(`0L9 uh]GvZcȞIOh6D,uu图:1YEs)\To&>");#k<$R"yZ=Df71tu3Mͻe: {z2V*3ma]OXficFݒX*a hK(ɔSiaA%KS4:u .a)GJge1/w菟hlɾPfQaD .Vsv%2}3qUN:~wzϷ(<61K:\:;Z&{ -k|%aL@_k{l R6aWt >Wd+T8#1]04sGh$_l8}*\, KJZ\&agԓ.mZvHmߧk&AGʁr=#5b\JE{ǻ %̲m2f~ٛ?Pt?/jٝi- DZnP "0>Gb}kDw̏Q'3+Gj}ǰ0qԥbh=U#q"dX\ d123D<>Do?EV= NZ$m-7Ҥ8mpYS(K:L pv kRƚ%UKwjд6ZGPȜ:[ nJ,J[;܀b?55;B=4>= ذ` b̿EOR9j 2}brww&/Y{f`mڊ~6?4Z l3B=>rjLK|IK$O^y>.}}@zdM![9}{RC@gtͽ$S>W5_>k?W݂M?vwpF-s?CfC:wРvjAT)9 0ʗԪ_.Qb@=_n.ZbW꘹ ($!P+Gw$<3GVݫ(ߪx(a[VyUaHXGW ]8Zx zջt1HBv˒mxˁBIlOIqFCߖ/KW7yi_V@Wk,RQΑg?N샅8 .?yY[m:M<f=\;"tRu5Sʂ 6`ӻ(qYfcښYҋ7 pZ!;y =~I*5?iЕn6;t5mr$SzEZ:A"**_uʕֶh/SԳ}"ԇdNvL7K0=Cc@=Rx[(Rj7-Q3zk-<Prĕ-X!52up"؞1 ,-k;:$ݞeJujdM&pӝmT#c;Yן%굙4E?5 7<dgZc 4?V.F?0,MQk>`;7ߏMV܊SX:VZ߮{Дx_ʐ}I!bDv0!s!ZᄱC4et:_aWg;^t̺ò+2'+^-P0B S7C]);(@z-xЕrf 'FGF># L4-/_#{In<]rM3*Z i An]_hld.}.t Yq;)-?e !}czfXS.BT/PB9K@l‡CطqwN7A`fKpaDGѤp2Ã-Vq^N\Y>!1bl>_nTe˻U߱@;'ۄpjrQƙH.ty!^綝1;T5*`#VGMW p.T/M|A ԍϖm8$Ȥ{ mx"Otnp ͓,Ǚ"3t;feIx'PӶD WE])jerKhkGȮ-E+hc8Nrx =E۾(0wh }1hRIuZUM6坹S;;9A3c9/-,ؖ4w@l\jw[PЬ0a063RZsųMWS枇'"ȗj n?R H9I /mb Yϴ.JyBI $7ϰHop9?ϱWƕorߑCyS :P{*Aʳ a~w.ŦicgM VPKY(Hh ,#IM✶T rbZ ԅ悅/V <(4Bl28]oK~p[˰|~R>b[,Pym9E&*ucj!@mAs37~3$λJ"3Yf#8ŹGK_֦~gs(`_V+2]`Ku^`~i!/ơp@9'c!pdn7boZ`pCM Y̌!ȯU/3 f8jY} ,T·FN1ƯYHлOUdйIOC;hyi;AbLA,J*,+dtc=IV<;һ7_z/]=ݼ[DI"G 6:ldDE@"Lu"'w*8ސ*W_ Ή*Ak9^shzI( II$ Q!/GUYg&HMo'#H`OʆI&煕TT_L=qMqBђ*'kDaT? pe2嵏yx&KRClAA,CYAl2QǬLH\@٥a"I2%P|Oqݻ@!A#h_9 NCh ?Xb2`A #-wζ/u}rd՚^ZLr}h?\Oa֒`9}Gp!TBnF Y”<-LUVp|9nMNi#.vHܥ@fa־2mðt&z6+߿,O,9)$1a)G, IQA)HNn 2oxẀHC _N}*km7S2ށj^I,f6xo#43Ev%OKt[ jY3K6s;V_3AEiq""ώY w{:Qr&(U=Zp|88p$U'2͕:ZǍbU<o齚0SLC,]0Lwu{ۅ{QDղgH@'v<T5=/ę< 4i$0e9b7L%W)Y(3vAH;b"q) N-Y+w~J.JNu m Ȓ s!Ò2q,xŐZl:PS-0ZScK(ƤR-gI(k7%5P$,k~%kNZR4ob$z16hO}q^хS!V\07ly3N>:tO"*' ~Dhňe<k}r<79}bmM,Ƌ b( ܶ '&D "sI @D@(t] ñ3 +1a ڎ* |3РKju˷1.>B:{q+ t ̰0oVTnؙ$!J@{`ΘDc.C~"ثK /`NHgzb;%&VؠI{z`tˮ-4S`qqeZm/|`AUWD#dhq"ЈAQv3t嵚sK-3%yhX,3U I\[\d=7xA\zTh l5&:|dP=n`~9gd#v>(T;DOGC6_N&6OCF1dB8G'E.OAH1dj%kyTRe>ome"n_W`J6$P5PSf7UNgaS;c`y\AC0qU/=1zjYП [67`ay6ҏ_w){ 3@WRl\^r i) ǯ&KȻf 1B8phA/5:l ̧YgsoޕV3[Oꐿ\jyafפ4VoS6*/So"*8cKN%&>3*pq7SFFN<_JX__''MFBkfeCSO$1q5Om>zs&0wXsWL0s e>rOb=Qw;lꯄcJ̴]govi?^CE8iZ=i7ѵ-8q_*9,312.iw.vD3j[R1\r楲"fwwґۼQK&Aj9\EҺIlιB6bVF6mҋ* G/GR2~&^Ⱦi"3&{l@IGhR2 V]|!B[ LK~&]2kjZXKз.Drf&efR*l gs 1C3CהMv2A mqz=-΀k.\U@]F|vvԣ?$OK綉?|e-x\|[XB2؇Ȟ=bT؞xH!;y344<M"fvwÈc,` }Kp+(1aDh 蠆GH/^ 8,/cOBn%˒>C țqc0;17>5fJD?g$POA" Սcah#dΟ\XarFHYȢ"S-rR:QIw:m?LBfELm 40V}v cor`Amxj7ˠ#m S zCB5gu5T4}x$ö쥿iٜu$@Zkvnc`?wpz a9po D26B߈ YwAѵOxCx~@ZYIJy1;%u=!t7rۡ~P!=/kCCO\VK;viCf6c 4^" *iPQ3$R!!1O^& mg1anG܆A1ľuC/\K * F;U/e&JQPY1b>ת;ݘIx/AMi医[Hqi~]"vړ8uaώc {01$.7KlqNסyCn["2*h]0Q_{uH,`QA[U&&viUf]dYu*d~QBOQzq(aZ*X<pS=gcc5GQ!7=1,^M`umnT,_b i>O;;έ]aP2Ý)KhN|zǣKOJ[+10뗊W!Bc8fJtt.p /G`v5zoȿqG ^!7 !r>c4L6$u8c3m#WJntţvk;>rDAp6C ˺VpYkk &D) NqQ0?gi`aciCvP a֞:R:ʭTmjKX"KMQ-5KU1l]t~kk5 ?s>ҝQ w==Q-}ipseB]*Zš^?Vxa p;v[F qA&M?mp.O8fQEuK*d .:?(.I&[{.잜.ʛ9t*(mvcn! q<[z(*_UnJ7uּsci)lly|fA Cٚ~!jP)._ .64e<Ň=5D{j:FΓ,hJ Oio9\>)~r _6EPӱ[k2xqZ| ۥzr#GMe4tᛙh+/Kd37R)v˭$]Y%Iv]ۨ-1r0#T /2PDŽԚXSSxҸ釃$M&5;|oPEUz9#)S90Jޑ PM-[I5.'(jp\~'NVX/ҷaCe-`OQNh\o qD&-W@c?/ւפ y2 B~76Xn ]*6)@{( }@p{zFlgr!^--)Iy\2V*:ɺN(u=FtP9Y&;4o۫" RvyYUUoDQmNvꖌjܾ)OK-yk${ a>$"eQ:UWhhbv4hH@%R $oǕ,0ɘ.'_Or+80 ?Ȧ O @Vi޸f]1^n>nrm͒JޏXKqk)ҵק_!mDg%ڵW P ˉ@χ+moϘϗk8˦^G@@kۧ-VE"g.90zH`Կ?&cﯝ2⑁{|2_6oj伀c~;S.e`ՆpЁ =쿀\]kKB BU? C *Pn)ra̧97&Fo%Q#vL|4pҧ1z gd'sz xlnT[^7کn}3ֶy+K` Ov^O«)k/~hGʔK<-})LŢ%|ҸD{u29.S~ d muL@HARݿLe8Ⱥb=<ʱIN*6\(HYO9[TxeaXÐCK.QZ|=5Ī"JŰ2@/jڌy\@LE)MSe]{v+NNhd41€I8/JI9?ҥv9;Lᝆ-EaW tnz,< *:kb|X3 Ѹmx'hlxQx}^N#ţxOCTFX4}SR[tZ}gbydNY-W .mF@$aP >Vpӿb nHn<#rFlhѣGh|p K\dҝ+I$2n{EC]}j# %kcNFeXC^Jk}PoC{}϶lvn2t^@ w+P{0?wB;;5"@+5ևqfJ m2XR.*rU]ivkeUx[ىĬFxs]EEPe~GwSMl #9ZU@tWth٨zo('LP>9ꋕ36̾H@;@U7}:>8 UrY0lw`>(dYI.HxqLZ[[69#qȉIC^yPZ]EQbۏpJÈ= Mߧ|leA\'KьV{& {U'#IL=邊5BqynX\L 9Yy.Ve" `h,&mu!2Ћ P]6bpIFOB?0g˷&iihbK~TbAʼnܯM({Bsޗ@&S|zJܢ>]Olpz㕪cpȗx\$s  <%9?ys:+aY(N!ϔY6^԰U,2=ˁ ]\ǧIlǙ ño/Qd}.BivBnv iBKb#^w{*P_EhٱY4;M׊*6APfU<u' 7Ue.0=3qJU^˳]c}.I^:KIv_݀pmrsv߫U2tŔAYo"Br>"~|BOlh$@[}$w~_r8x)\ڭ?g.]l\ [H"dgTY>1t@}!SNP=9R^Ö#nkd 0w0#nL4L51!oMR~Ls# EAAk Zoc97ӯ25*hSikj l̰MNc6sq™^36?O9zM:ZFv̛s|4c'c{GAUW[w3<VkAFnP'qI0nxQIsBy zm R]}|(tȱ-޴Zƍt돠ӌ'3"JnƤ˫hpT#}kdo-1 ɮɿ91p۹/"43dмFyB{|Z2bG=I# P&MⶌMdƸKYi27 (]u9{#;F7 ɚYT[e*IE3n/+5u;nY4-f`0Efq؎šd+ڄ{*k&C 4yoWPl i)/5zU"/ciP7,6c}HDmtKȓ*ĺ*[ƫ >l3>/i;@{)Aٜ7r Tس/Mѩt+L61Ց X!Ho]L9ò&PFxY MWLTY)cZ3{F?̮}_F~-6[P.fS'yzNy4--:lܛ7% @J8j zE㬸j!=@mm:W9G ~ZlT%Vm9wȳk*z8u] z/3Q4HmX 8xHfhxgԁo{FS8͵;?TS#`b>:~4Fs #p%6 G=tR9p7@pexL;f`*>zI&h qLfh-HƢ]lH3'۹3|b aߵњDbZ˰z@"b/%i `\&2+o+"s4cI6Wċn>TEflqQ/e?cFD>TE]0G|9@o& ~b|KKZ^t)y#h]&VK1AYG>Я\λoD`|n_/WU\_"[?F&c3EVTOa^'Q= #aQ݌ H%@Y ajkի'zճOYHU!ݪU-jZ_0 9JK"Tn["YY>7\3&3:OOC,~31 <&*~8 dXS;` iU+ƻZ⥝I}٩dDnU}0'[{(z :V1Jfjp `P|>q =9 p+M O:*nЗL-;ʺ8"`ɗ [4%}Cyt4tihUĻR^S-Vʆ4+ǜ\Zaz9 HdXr,<i.uϰ6۔W$8'E$gfK~K} 1,3W(j2 HЪCx5| )EMJn#)joMj}uKF忩;kY(׺w4k FAKmTR}@%яg+Tu۹,],)6:[s4Gd0Tp$&0 ۱c]\UtRbj3DlOWw[ܢVx1'^NQK~6cyYu{" }ʚ~?$BsU% )<GP-V{ &04Y"kHoXCswF:G2CH0.qt1Y,7Um)IV$z33I4+8F=Ld3 mxP:'rtߥKߩkJZT_H<6f v7V;?aX$=RcDS+01SUGI- >y0Ƃ2H/e(+WJL5VZ5OA?Nwv=X{k|pE/ >Mf,VA[??92idPo?1MkJ$?6,y+jzaD^ :lͪCi,6%c, o7?WEl^ C _ 9b5q+@PЩsޖؠ-,NixX"h" we] gҾwQ<}cD@X:˵KhA8!ҙIk̈T Q}_40KR."Y!PrR4rvJ/TlR{ߘ+3M0ʗ 1zNiy DКSXsH5WXaֱrHq?~5/ڠ9&X}FKHxK\M!`Yh3:΋OFVD@hwpv 0Nwg@Qct6x9 eľecsR4f. fA:)XݠT6wW>r{G\v4"1J$Y jr)>lAN@J 5A0Xgs9Jn =yb#'~ra2 vvmP+vX/{[<ٵγ Ĵ,Ӌ藖pmMs }T07 {V9p: r n6b0'xrѼ/S1 JDq֟~X3.MG#$XmQlhD=pMcU4qP*x=9#ȁe&@F^_b|Ua~.-^O֩$!QB)m>鸭q&Qg:W,HkpGF63`#C~/7 G7wp48OBu{Wc!ewŧ30J``9x~o6Rj %? %$f>QHtQYFF5g'n\}T##h=f{TW#L7SK?WrqCHwF] 0 sǔ*/#fK|1եمJNA)+@P ZGFfWtp :8ևtGYvOHirp&4 5jIWqLhI%aMMNsdЎN9<8=b-+/M:w5mKaGERE3v"g1TtvQk x̧vp\T ]Tb!?i]Y)ǫAU eAvm]S(o%aQ?v sEԐ;'`![ie vۧ(=uY+XMt\DzQ1æ qB-n;@;5a|g) VU?3r)w%B ! %X)o!Sɤydj cx  R"VPJpgͰ!ZƮ2x0Q 2]k:5y8~XklL5a|:`B=7Px-'@ ?S8etOXC#"8֋RW4C@J" 1t ؅ќ/A`;̃1_j]O3x}LrŠxa;y;R$$3FcϠ`i,@¬Y$(~SLMW-cKqr8I=go݃ Xk +.n03SN_p|,t;_0 !-ETGg[mn7wunBQVw[ZO;V}=^Mf1cU&]jm f;!* ̌ѪeyvZ~uA z 舘\^5/m^:ˍD'4曆e3L1z)=e'҆։~7D)f[@1z #%xaԄ%D;"ah -o滞?0f;MΌ6IFAq֫F_RT*;(o nCb<}joe@% *^IRk Q#:wǤVKaE %pDz0&&?GH #q;V99\>\K"ܽs/&kY^7;v޳rf/QK"Ӆ/O fFV{>ꇯE MQt:wXp+z $8-_e`PQm.Ftn/Y. >Y9$/Zo.`ux+]ĥM|(ȮЎٟnN<^tA :u I=sn*ncfY&% $X#^`WҨ*54GYMnzLjJJܠY R\=mOP(8d"nW{B5FYkE!Պ/g *oj3;:HS"%;йXBZDoD狣0ߚ!in[v| o@N>lLVZ_ḇ&wleԿHR9X!~}Bc (~T_yG_GJ4箶aň<$8=ۄ &L oZԠ4$)g%8wi,ofв[3!吹RΪ+!\؞SbQ%xb2OQxھ/WU0J߇Dx=Πd,E>T|fp4~‚vhe(A#JAřA;\? :Lq;eH(᜚:!xuE˖~r$+),4'VW`\C[ O qZ{ _^2JO9[c/v86um[ Jwƽ1Dc[@&M?TU g7sCBZ\ +2(J93G>ШՀtk?e%O؁x/&WIvg6A7gSgHAՖ܌gV R%@3Ԏ#"1lz.(PZ\d/ MԤٶA+(ܨ- 6n*O?w:cD2(\ FZݦI*cϚmѴ 1M_$^y"&urkO 6q i]Vŀ455O&6s=HU1H HPRo P `n_jRI+-<4%#U4wP^nK?w۱d /;IJGiv:[sbv3 Os_Q~Օ(QxǴ-y;O(%0U:>QG>d/ƺ>n[ 1-p+Mמ/EJ߹C(JmW AI[4bm11q 1-f8Ŗ)eIy;AECW-K\#%E47a+fizܞNNxt6~{ou/ZVĻ-K<^ ba@Z 5*H~Fij,4o?j1UeE؟%-/vBی b d Oe}[+9(韚Ox!@h:)3Aٱn0aLِeljɃP:5v lj[EjOe6㼚D_W/KP Ta` D#p8`F4OsZFi,jG5Ŏh.$Y$JE;&"ݗ>ߺ.s̤x@BY^4V4C`!E ,0@Ss@=1ηxh3;cATvl0톞 x( ώ OǨ?۔bn&E 0d#9'Z`|FWZ*!36\TX,rņ]ߵϬӂc6# -Ĥ4T<}Z ;90^Xr bt?5yv6yIȖA†LfR5gwȧ" ,) % roe"V ZLYd(Y'Y61tUCwDlcg6zaz@%+ %[{W%͉]tF@7ؚ2  Dfi0zhFf[HV=3QYJs|c'ذ\^rZnGzjH+'h0tTh9h:]p v& Qv]7CLE-͋z*va"~h& -/):8 Zˆ1L;#l[wNkbdq,%eG 6l #Ɯ{ǿQ+?k_b˟7HK LɗD>>sgYVT+ؙ0+cMګ𪎳+9, S--R aXPVy;R!lS ][a%ŨiD Fi#m2Z@ND><^l;J9ỚYHK߯8)g[dŤbxrl8&t$`EvAf$e)Z}Y ]cNh& N(WPvz]pT]D4y"a!)L]y4hS71Ӕ/,G'B #$+$a)|ldLTi/T= v.-X}-c>5Nu94mgt"K ~gH}gjl67} =bڸ/#P .7gg]jLO-xdz&cfBY1c?'o:QV/[hܺOZlEW[?~#ku ~z{1Lz Dg=֪g2o@;A]!ܥ4.ה4bn&bo"¦KD>ܹ5;g^J혔JzE[vg<:oc2jԧe Y(>J89 v4{$os`N )d> pY ꧊/ II;_+\& ~mϱw5>'ysvÈʝ*:\ccD}fc}K:ȾAv FA4c҂vQ}$8 `7 QsU0ox'd6~ ]|;m]˹ q@2f aZzZC@ W3;2qB/+<;l}ʙ0Cj(Â:Pn6|i_Qʼn WTs, :@M?: >Ge5T(̕]9JkC~'Y2T 0_Xߔs=(s&Xw.L"fԵshmn?;ѤG& 8F,p@grR6 qYםq4# mJ$;۩_Td/T%),' t{ѱ%LsuI 8}1>96{r [.>d:Z)zf4iY?R4݄L~c;qtm|1zX{#́-::(nT LWbn;\E$9i|xgx\OP׸7RO}IƯ*hYJ=r*]M;Xq\M'X`ִ1B'ĝ5h2^o]ޝ8 no,V !fK'@dQ)2j'.<# ޻|҉5h/P@GڥkWmK-~$qn dE<`YbvǨ q5M7&Uk1QZ]F2J>0CMSb Ѡ+wd]ϵ}uXMԒ~T_ǫf:O1p7GfXgmfo!&;XXDj|ݠc]KܩS#?J^h~x/H֜F/ׯ-򱢭,ax3(sdPHչv_`&9k>TH@ tDLxMVr[oBrsh1?3Dd{%|=Njo m>b7VV)w}?T+=-Ƀ_ksmMkJ1785N4Yjl4F=+:3ﾙb=U:e:&2YjJK l)l>bu̵UXx ׌F!Do: fW sMLPhL:&q_MҜ{b: ןB eRl1p޲6MP`bxn[ t/x3}}A栳C2q w`Ro;ndO4;Eaa 4j' ZUmTXJ.h|$e'πXQ^F_As%}-cl}b4!*{G >n{2Ĺw/kѕHv$"UR$G[7>z#l=;Aeڴ:*|Fδn(e W(n+2=~5'#\w-8y)Z'JGajX-X fcDXmGpwg'Dÿ Cg~s \$OC{ sqʁrI-Ĕnq}FMr޿vGu̒4)ן9yY6%)8.`ǐtWvoضٳ$** f K@kE$b>hLvriuJ,D} Pގ~YœvıbKHޤl5`y(T^꟧j/M <|Qyy8K<6d5뱟ׅՐj}C ndkjxL-*Vñ_Nwuw= ȕS~ceA&zBc,V 8В`0iP,tR w~XHm'd)zP0HWtϥ||q^Xb_vnMjX2.jCfKUΥ}8wG w{;ht~UA?*ưR) uv]& *gLW)b&rt'b(- Gd>& }yyfs%]i#hiժJuԯ |TCt'}[V ,#sEB[ŭqE~o [Qn^r)rupxlw[R`hrhVߩ押]zpr6dWi9D*=!0pvejǸT+*X9?2*M8 {<7Mlk1SQJ?L|D% ם]MR܀(pA}"O"'n״K)v֬>gNBWEBjKM@+ ۙ償WO&ĆW8o`B\@hIQ8\ 'q’D*q:s<6F);aWo]#fBm# Vi.,uSETwwTQ|ӥKվ5MO}x.;U#%Dg`[}:}cf29"zmS}SM RB1*+0pvToϟp'N9Wp-VΊEN uW) eH(v+<$ wZ7ݒ:x*$Нϓ@jGh̻QXq7GLPםϟm^Yfs^41;~=8'epژRq-sum T'3lz%^0S(=NDRSzghgGx ǡųsYto}w\q7+WPFc"\tKUD8R%R2tY+#l&C4ɵɨ4Zi #.ط̾GxYP0ܓ޻J[o+NxJ]'-27ժf) b,4wsJ5 |,b> AY(4tBP!#AQ-s8 "a7cr/Q@U 1Ć@[JLS %<~s#.m|(I;SK:$,|v4c.W0?,DF"`*C3ҹUX$he:)AU\&,חnןj5Գ"48MUk1!IE(ϩGk6qI≌+* w O%Z"T#N?YUysr 'H]7)?GG!ҙ!i7|p"/a#?̤zoFO5vbͳRuygjc7BH!W8\Gɉ)z3 5Ƕ o0oiTj5r$Fg$X]D'…͎.) Go SpU [S@e;Q)AI9d8e#|IW\FF`EiRY %C#h_, Z &5`y[Jff^GA6axФ(2h$+KQf[O88Zfޔ\)z *)+-#okާ@=$;FdcO㙻jNie (zl|9s)#FVCڰadG|Xvwkw<>(87VE~kmqiZ.ի68靻F@HOu=Uc7Xl0G@0+rvU}:t<٭-s$ R}' z­V/h8钇5J*q;Y%/Zl Th}:8pUJ%-S9%$'`ƞ`t(<;~ *&d֜3tI~KJbQXF7 pR G{}}wF:ȼL bR&3;gT`I]ZytdE~oAeo`_ c=qf  ҧ7l…Y8MbtXjI}`C':m .WO. BP KrśFN-vsY34C5X ctokѼA|df:ϊ| d-&vP4tD$xM`tLZ$b;#G/ԥ-YheZ>SgT \eZ7$ؔ6@xȿV/-^=Q9,T%;h㮛Y/ܰˢ7YYhZ}gfOJDߣOVDB]ib)A`Rb89yzλG, X0Way KwZXjhVlAKu1h]m嚧Tvo+Bn*ʸz"CǕq H"/}8}bqoĆ!kgXg:||XT=btN`Opi&A{VYU=\ Y`kpranb@so ۝M`uM~2qI!k[ճJ$-~k~6E83%_/9rzqZ5$0|{/3)UWg "`3uHށ 4B\o, ^/_;In.,vp`UFz ET_H'SJVySfܧ8}-\ h3 {Sₐ]],S!kқ]9}iVl\lKD b~ׅ Î;=i=cؔAHvFan& i.*FDXw'1p܄|<fP~cHw0/3|m̺h3eE;/o1LR +.r#,1/*2Ћ~1`lMg4r *t>/+j{9nP1雭t9kKë~+8EA"Pa%)4s삘<}"ÐzA(~`h>$U;5-g!b!1oh䧈׭+mA(.<,m?KQ2K(+N %oe8g84͸ގ׵m2}ԯY(7uҞ%bW0ZZ{fM$xQu፱-/PłfL|aY.᧌mp/ FM6lr%W^@AipwO<;^[ CEE93Q7ιz"{AA[-fX* P)s }[OQ1M2[}aDrrQʝ)=wt0X,UNq"p0jJ^*GIvKDNb"H~!;Q `I5Ar&uu&TԴ-:~\"Z[')9VǚzOmpx4i Tgܐ<$ *f rCy_rg"xKuC)Ne+o&]HZ3rvzq"i4jɁMER !1"GB/ACNPX`a|m%]^8{Z);UBa#~,if:+[o$}MU^ #!T짴C*G'ňtŦ 4Y{_Zc (T֑DD73妀|n lg u)X&\=[K82EhOXW`E{ZM ~bb6RM˕RG]h*ϒӅy+OUB.vIDȣu5H@܁2XdbP*An7awg`.!Q]pu08095r$JM5\2Nl) 0*=w58D>ln["Y_ A,ZwWAJ2!W>f5] I:#XC(Q܍l02d7o˲\p0[6g}xsOd~+h!yS$gW I՛nk,O1crL2sI;͠!ZI'Xe$Ƥof|7C&؜tjڝ6.?>1UcS`3qꬠfҬSI0[c fL/ Gľ87ÆCGjRo+\XX NGGPV Y,*۷& 2{t77 bR`Ĺ!Ն})`1v,աEGY/c7Afje'a9DI,и\o0!_B:Բ0 0 wcp8w /[Ljp <8zw쭾ֶ=G`t~]PٖU b!R+-BTk\D"۴jOO ynE /1;ɜͪ6[z1F wf6m w=EZZ? <8^civUZsûW,`HI@KԂJS9>l_D 4O^T:c#s9n[tT+cАhRńYզ͝=A.QS̮4wVNo=R ~UO W/"-ϢX+W>PN}5#]Fj؜1Ih^E`Ot&+aq BtJ2J-V`Zs@Ǝ!䯡ĩ\6-ujCxbPyp @cА>4 H?`}a-H_L#Ct2J%"OI*'(lxPbHkE$#u4us+^np#SV+5~U=y%Z)?zI*vL&dcD 䕚xUZ,`ڶJ,oto3PY9`?9wĬ#}೛?`ȤHJtO'hs!]jM!B:TM2SOhg64Xzj2Z,d:eCZh$w fE' -v}7w$03ޭw#˯8eV +:t<^ʋ[[Tm+G1הRg9q _zoّ('\H kiuhZ}^>K2= PxsWBgaY>vpշib-3P}ʻ #"ķ䇀s!80bQTjSwcb0}'.p^:H=m\xYu@I[z7( 7Q,i%ScB}4ƈi;pm2 ˱QfOVԝ.?snv N z4}mo+de5Y> >k886\`xPҥq]aSo(}S +>K-eM\"HwbZHȗFs4XmO-YA}gԜQN;ѡ$!uPYaLydhEK>B#hrTmz#<!_>GVU,{XͲݐ'(ұ.:<83˘ U[U_!`%=q!²Gun?6`Ҷ+6"Z]P t#[?65B3!~LX`qox &5D"`U,Q/#s$-4YNe}71_8סVNSq.ZT b}d egX&M 1 {GŷۚN]W_I?dfGVydYG"<10*J[H X T=qnǒQ< 6tPWչuqD V?ݜ,x1\^ o+6LJ#f5k`Lze$8;ݮա.4u܅;!P| P|; 7yzlR'1z% T"Xha}#AWh")qQⲒ%(:X2:]pH%B> FI<:p+7<ѳ &S e},zcM=̧>ҕYWM&A;q+g,>r@ڠ"[[褛 3)/@oٞМ.L,ZHj9NW`|e&B\^r7 뾌ˈrRn)CIvNs\^E#qk?ɚPf[n6w7mDKaB@ʚFLqҏ|K49CڏD0NX&%rΌ ry܉\@m֮+RRYMI\*+RfdCd&͉Ug!EV+Wk U)0)yO *'KNg%>1:µ:t=l/%FN`Q)馯 ɮ Ea֓;1^UpAtSwsʫ^k~Z#>F Gx~3LCEi;DGH0  j"LZ_$Pe\yy(3 (y &LbWE*+:~\X_}am=`A/>.kړMNx$2||~v]!C iqڞJ%Ɍ%x7ߔ"Vujh`WB5$P=ʹك֥XCv'iPNk!Z3dʀtN~.K LӼ#q0qvp#իkT54V|m|Pw{L/ZΗnLžXAݝB8P=I@ֻ&e;"_EʫˎIDQ%a~2&zq:3es@l"vH A0NL4,`__,Dɶ4R?n~ K%Wq]f֔I|h[F4ݩ *VvHKo`vb27MM|:D)|j B4qD %z51D5wq7u\83@-<#Obr\͎T hX=jC:"&/5?]޻Ru0i2 q}jU$3rFQ&!`#5C6M?AyrvSoU-Ǣ9C1,yT?GM]+3U\ ibG=\bm4T*MQondd>ȡGTSh>K!󤁉riA,6n0Sc݃C{} f${D")]JR*KJ{Gdli PVUޘѭu>|AR!>2J ,\}۾_@d0ɻYtG9<eJ1\"(#3Ǭhp:/!DϚ,,x4Tr!hSI-R"ʁ6Z:PyڬGHvOdf<8=\IT0P\ϴJDB2V?$Vbܮ^ ćLuPU ~VL-w''*Ri s=aMn ς]xqĿe'瀬VN&n ݛt==%M|Oa+UO1෦4ocRw{[_䔉[ wJ Ϊl FA^"|ɕ}FKt?#M~v)`CD~~ΊP^&17*UnXVU$ /AOj5Lt9E/%,%;Z|Fd`DZ?]As!^S űE<_=E.JJt[f}{hwn%369>[>u}G$@}!q-MtP(Uv<;^x}(DD YhvZ/@.z3r8Aeof55Q&?jvh<ݥF˾SeNzzH'G.zT!+5~}KvhT[ i48o&\od ,H駖x} p`{‚ywT^,91 78<õM$ǘgC6 GSTH m&pH툡 ՞ <; *>7SA6:kz-)J]elɦH];bz |m݈1$^Xgn~1ʜ1f sSHsx SB4GG(6bj(bHѹ+p|>ܖK AT.``)hFEJj}| )nnhdr(Z(\yEAC[V@Z`H8G)s 0cu'6 vΓB!U n&\-t';{/FPS[{t*P1Jس9z@ ]LI.! Xd%CJt-n > @ulP%vq4 ׷UI*>Ѣ4Pv@dQx~:}D`' Eݰ')dε`]3.<9FU:ei -} )6SEw=" )xfK;Яd^h-ZxORNc=a`-: A9q ̼ ÿv IRBz qĘo4TԾ:={I3Hh5L ֽ 6ʀʠ)h1@ݽܾR89{ބƊQP@Q)vqJX* -:@a50aV v6+MRò[j5YiLᇓukQʴf@T<(^8o [9yd7ȄQ($@._ p]N,\et(J_0:DEpi6QzzjrHbMv /agQi0bx/{ WDRp nR{,}A~EYwLEP+ʢ39`\cjpr4ʔ:F_$NX~gv2:4Re,8$0Fb`oAMblCGږ 8f *EJt`RvĀ$W&X1Ө4 gkTA:[[s71T;.zB.#Y#!3潡QZBhCŁ pVjD,kvf ;<˜1䢩nkׄ`(A!{#&~ݮra=˱|ygeVŸ]J}i~ 9e^Cs -{fas <;eN|h+5py"̾G$c8lk G]G >VB;gKnN1h퍝y$Tg6a|*+ioZ, zNu ђ*$tA!wZSխh%|oyMN}*=Iͨn[ &"SQm+vm5q?9&`oplTTۄh*0'-!m]wW(O)~v`q))f,X'3 yx(A/@7>Wk#TT3K[l-tGnvjk2)J1d;-؍|hUl z~F]l:$,%;(]Q  uVȔ)9l_߬\~c{7 GB?"F{-;o43snմF!d!.xx}f@ z g:<@*7-K.7f yrؐYRSDu^O`ܝ,/_Y@&OFе GwA wЀkT&(yd ;zD23Kݷd'V VC.IT98əE&@*"ŔT^eJ-";<[OܚbA3(82KΑP&.y3ڣ@PbߟȡԳHçh0|gSO"%^%} ]Үy#.H`a|j! [(A7*g Tϯ\\|KWCI!rV1M1ooݤWQ׍wu 8aД;~Y!:˻s8'V~-]y?bLer#ӉNHFYcykqͭ/9%ISB:v^2b3G#3?cȊ,ʊ[AYЌ< \[vs[.:ΨLu3P2=fx=%!+Y{{E@Y<4@%2]Pqq?D ~ݼ4YeZ[cF[jbݙaWS1d|ED71>/Q D&n dF8752r=OC$l/9gP}A<9~دG;O.KoB5*M#I$a|[0lރJY®6j@əw"t -5mw&{N[oWH 7oCǾz%TvAᬸg=אzm/;)]-ȧ wj_pFJP4t3tBp-+pXd%DX.W6G-!ޠG Ix Gr^TkpF„O睊 rڂ{&5RBFJ U=]7s8rՇ5ҐY9qU?Mʇ=>&  /yu+/dxXx2CC2.;k:)!ײZpM3 1g7ʬ(B69qZ jD1;pd8WDX."ۂtKpd͇*9%z,m5L c+f\b1+j0q!?֪̄*=%i:yh?aЀ9&2Y +!15w.L$w3jf@v N A)OBccDmWzi:4ȀTa'Y7jMoawHޱdtڂw4Fw6UPAYv/ʊ+>f]=ruo.eݥFQ$1{|1護ͨ$W#+5Zq ו.1d=Zq0G;Q Zpp x~mYq)[lTi 鍖[ hM {d61蓬#,(5>pN2 ~9Tz&rR"2E CA=h@UΚW;KOq/'xŬFUIU1X/{XK\ɅhIn1Jn>.)$Ǟ8ڵ&2C!ܓ6e#s a:Dw)~8Pɐ! %Ы] s_lX}7I-9`vF",o~ 8 \M>8Xp|Iia8苡yH#oҎؙiܔ'F~LdMʢP_ FnX-j~aӏc fA6b@)#oPm]Ebtɽ`ٵ[{HM Uv6ږ۝W\y9 @> ˫L0i;$9-!8 5.(ْi a ᨀ&mΠ *%3 9Fl[FrZk:5 "P3rHuo&{É5̋ޘ8$:q4E _+f{j*c(Qbźv_^HRH ``ݤ Cs"k=^X"ۻ T^c+HQy}j22s4ӟBv$n˙:J]Ⱥ|l+txt׹oW<^ov)V>NN~*Αpj'l<%n!q>tf剨rEIVvqj p_lmj RoeA RI҆h+8uJo?b,FBhTꍦ/*K,CkgCoY_fBme/G@^bLS ];Gm]1~!(1s u{]TDb zՊ`CFƟQHW $Aout3t#r'Ky0/F掬5}- Nb7~i](N WtyLl`]48tbd6w`\5A,of.0VkX >,5V-QHG ?y!&cBB-Xn"(inU(]ӟU:̂a@McXvڔ!HUpnjYk`D8k F@A_ݡ#A b!m'My9 '[4䛣~^#мJ0MOx#kkT^+8U tVHl,nbҷq,Px U/^ڐ%2p\soy0Ef0,e 3HUwivIʾ΂v qw%p0^!$&OaZ~vaŏ@lL/;" ,CŦ#I` u Ā"I= &Y?Ф6lMEǡL"_dJ^Qٹ.INږ#i&PK(A=iQ&!e{O綌4w ?5fgw ˱3)a^߀OW]lWEn~Z2Pǘ1攛9k+ٓ9+r9TTc_tFR]',"WH~{`Kd[NK>Dd[lr yEѵ@8q'#|5mj͌&Ĝ٨.nYo46m2rBA*ag,~}g@I* C2E3ZBfڋ/@B'=4e$yNOZ ݾ}+HQ:}f׿yO"}OmPxPhl;cO\U7(B]c_AU&~oU)T:y3Z @nńy,sǬ.]MCcTfPDO#Wt*.VQ QYC?q!A2N&Qr XL^m[mW1W'{w<MRvΈԿjzPN5ʖ-  .jWHX1m&T Jq/XHhzqZiSṇgy6ʎmnek鉫 wnOWekA'{^yE'E.OdV*E~hFq-,y4d@9Y`э-yn3e >#v WEdA1%!2 5 _ܜ>;ygO@ &%whjD2LQ21fΏ5#&&f{o SXy GǍ_9ë^p"IT;Mv-X5ΙeLUoJD?Ɯ4Z;Ќ5Nkk>tWiQ1QtZyB~' YMb\{fUTnŃìQ{CYv*%BqPluG^[]ϾEephÌ@Q6O,G; & .xl6 HؓV3?ʈϋLNFApeeF_mRgT́<1CzlzW~?I@dLwӃMi>T W ҏ'o68sU̸Q +Y"<'%qtd·l^`wf  V\:EATj{cBYэ'9;a F5ڈ|,:tGWRW^$nC0qۼ O,k5W:xBKY.ٰ)ej76E|*3]UYILG`lE-VËƢZ;2,bh] V@`6梭bMLSq9F|sH)(ѥ~  c1ڧ4ΘaѝR(9Z'C׷j@FZcZ7|6YXH- cVzXט'Tu719yD1ѬҦYNOhµ$VFV 4 o-}冝7`5+ufC ucՁGC|y41)ȿz~~\W~C-=8؎ o")JٛM]Y$& lƋd916Xs ^ER3d{ =|߯QKLᨣ/%UĜ %/ - QK1YSl ~Kw"~,4 : S\u)O`vł)["Y\:a6=4|<3tn(} { ̔%1GCx܁wa$[8f8QI.CrAmCtl7) >+]!?eu1 GGg&7'9xCo!U }fbw;:%0D+n9%_O=?Z6N q;Xp̺/vrVGoƪ}FO•M#<LƋ_ lsi..b6G$/ʡB0L:𚳙ǭ D#ߩ=" #:ĮJkO$D,J.!SU*RFُPQt&H߿if 9/A K߫f-G"i.I_ʵYb9865T;즨eֺfe8uл}w[v Sꋚ*bWhx2f+WH([[~wafS4w⮡𓇍`L iC|73n{ c>gtqx,䐢c: #\OIltڍva0uɜЂ)c@d@%^D {>@e-_TFlB.ӄʺk(RsxBJO4mΘx=EZ|)Q}i`5sɋ-:Xg./mhnJji0ݞZ;VZ>lKI!LEr(8 1$3H֗0VN \:غX1d@W^+++k;P)g+1<0/ E39A3 AW(`sa>c~ n&YރFbEIQ`^}hV)SD{rx0e$4qXXQDu}:nʶA;٥z"u\u'6.ou?o$zbQAk kv1 0blLL0DZӂvlWYd}P2%d;A}3'ub@f&'ƒRtC%Grn,58>J^ 3O.0$}sX,:iX"J?#f$ 3IaªQ/\wf4.c_~G ٮ6Uم|896?7z翶aζN9Sw,5 ɝ9fMz`IFTD*=br0ӛݽ2|aϴُ ('Z Nv%@ў*N ^x\zD'J>4d7'9D@Z},#-;k7H 8 z ~@."1C;B$Pȯ:< >[;C|ou-+,uuk$GoMY\s-̛*Ú͐iQʿR P!}(<p?;#(WT2WXZkWN^ M'SQozC#Ă*DkE0Cl+eE 4j_tzbr$> Mq"9Ұlm 0sFCL 0i$e!1(ixT m /˔PUgH^l<\4Fo>:I 6NSS"y9 Z"\td{'u!G?s5!oJ)+axGEqTuksPㄪP!rMK J2lr-EY H۰R=?&1Hݓ56?x!C)@]M!ώct^xuH>?_Xb1Hi6)XyMBKp7:(d`SYӆ.FCi~ga$yPÝF5_s־d14̻mcrJE ^AX*tIUMi(LOSv~FcW!c y׋tUAt]V1Zk}TA Kd]Ef"}@{c6YgB6+fЀJL,vuno1:[w@|H|L rG1TݰKUD~E^+\ڲ47<>P&]_9T!)u%EPz('1rvC*kfKlo'{h67ߙ zQvѨmajXIc-}3C&[=2b;a=m,b1ofP"I)Kc<.Q ^ٌ.txaGrʾdx[f!M[U=N qli#>z/ɉޏG;OjZY0 (>Dž0?xUd;:.Pj#z~\b͒eH?!eqZsڬ%5RR Wo!"2@L-^*= 8 53S졓4{)c t`&DЮU e lmZIj ͔_K0sܠujb<8Rmi@<<wo\Ja(IҾ=v'[/l>&H`8,VD$P)~WNW ~O0[Nh5]mwl>XvTکkVz5D0AT7dD$_Z6Gdz ŭԭ Y*9忆/#;,Y]T. 8/]֢z~ ֡YjkmOO;|O`pW[Pa0cbZyy䓏He<ڡL(6+n~gaA'wQj̎R{2ky=P0 P͘Vz_R}DPo+sR1L*D&MdnM1~>>9a-.Tcu$O{/#˷{ PLilܧxF`ia,pcT+"K,P /m2G4ICA ST'pVz45ϘR-D^592>t- Bb1sЕ] %$kXMqЭn[hx-r}6|5T٘3[}p؞ȉENj[% s|G,\bzI$!b'#zm9tLg-ܛ='k`E+$I ~|Y<H-8'`W`*vdpw,4Y}!yW< 9S>Gz:CQНT|8ϥRgiruAiߖ+<lL\"#<J}Թ]O)zX=S}0 lKҤYC*x8% SUPF‘Lw.Vx#mYi}SwЋh:T3 RruL-61;p>Wo#.䴱ʱǓwB.`uG7/K߅U&*'Dwz B46=y?u2ѓS%ם+l#lGט[g3H'Z3WJn>q7NZ%uR&HqB 5_ 0Hj: uDܔreb\G`ե'yޝ? 2˨9k \+k઻T5tu0:ZXޕh`]Z8_Z:o/2s /jaRq[ ,~&ʊF+j?aj@f}iw 7|Vԩ)}&ڗu2+.~_,Ja oK{|=HG_hn 0VeUH-[d)ŧ.Ӑ<#*﵌[+RމiqY-\i 3|1YbAw*B^սOwuU7k>;QڸrPvw( :X_~|(t:/Rp6CvhV)Jhd =mYw+Hh#҈b+8D߾Pqȁ-E?nIO )6꼒prm`*Qd۞L?(߰ll)H~#|LV\uԵ7w&EvFMA\F.wV+3YPm!UYJY!]9fӢ'K N[# N7MXIyL =LjaJ¾x2$l 0)BVY@) 9 B-e$[˵/9qvw- wy~>~yA>3͆:-z!8t㵦% : 7~$IT~\]Knm&Aj]gdF鄒֐$jJi$_vŔGy OfL9ۗ'!l{AzOBE IM#&y$@ѱu1!vН "Иb|+~EG񽧐Cmʬ_)x~hHhM`2ٳbn35gH:x1C,\X=ϋK@P'o}0[aDC&7Ɍ~܍U3pL:Ph%oI%+4 fNlEbi6Vz8Su< ?XZsϧS`R8VuzRu!'4g+f![FN]0(YeK *^ێ>e@ k``0Б? e ZHʛ~&kNuKeT$s'zP|K/QQ_jHu[,Xb QvL:ET&VTU("^~IвbC}~є**ԕhhGpx4/{^9\fcH+8nP{nO;:ˠziNh̳>BJ8ŕYnOq} lřt2X!O+J 6{N ϳ/N߯lrfp<Dwhn/d($eh^6Zиb53)eŧS(j;dұ`m긒>En*dу/bRr"# {]{AM[֪L~SCB]3q1U:~O)QfBJý1u$~gzb#3>.tp簔}-y4HTQcq6̞Csɭteu\!#s ez]PnvQiZ+-߀nRBo5 זj._a$IR=؉[ A69! ==PԬb?8M'舭ChB-'9Ȝx!cxf˜ԱA܃uš#ޘxzd!%6|P^il``)N0IMuM2= ?`;k+lB+nVA磌.k s;Jy ~P_XYcz|Чyۻ uHzN=!& L<0[ĵ$+z,[ G5uCٯV"oObЁpKrqui~m0;P9iQR7 f\Ud1L8sۼ[}ߥKiiѽ'`}1ltLuݜ(@DO uƭ61hKw%܎ya!H#4$j*%_nS=^QRLց403 N@8vMu>Nű KYg2Vr\0/" o_Vf_\mŔA}`jD 6\*N^=n~)Y`'gՏ1܊Ko$kۍvSm8`m0+wv 1v3H32~/Vt{e&{9%ηLM㽴ߝuzTlm*U`D$OcuY)dlctrv.ὓ\B A (IF%Vcb%]xj kwcP/Nch<4\[ΦJSC,t%Dt@l- #l3Xd$ے^ &ۥ3{j[ճi$\q~v 0*j]WlR$x׬&hhM=kт15hQn#on0X~\'V|T^&}A@כ6G$DPYƲʍs/8Z 4$XĚqX=X.;'7Je0P?yS9Yf zR[0&)Al5Zq^nTugqj4 eUΪϙ&տFڦVx_g^ǯMIgm`VPk:_tՐ^>Xo^ "esnD"/H̻XbԔRmfzR\nEzM/DAKTĵX GxaP/~l_>}]s٠UQ 9]$(j7Ysp":#]lC{8wQ[dz)5pO<|]se, *r"SLݽC85h7܂Y(Nj=T JPVZ+w<(=rN7Eb<ԌICDB [:041 SV-ҫP0W QJȥBDqnU|Zo!簓e`VQGPeޏ囲ml +t*s;պGclYbrTCdؐjcRX][Z w~ߐ0-0sokWÈyJz&X"&_}s;jm=x$#ݙcss!hN5,oiB?l E N!b624=ڽ<ËOcnsA|4dJ?a7w jlA=xGqoGIt+l IfJhQZ48@8Nv9T҃JbbQR,3p-*gc߼QoĔ={/6m0T;-MrT] MG@dK\!b]ERFI٫4#@(eDgYHFhK6aJES-վ`mW"^`Ǯ(D.?rkDΕ}bOLρܮIb򟠥'm(Fy?2БntIlM:L}E\h:^ʹk[N>,6rұ9PeazHFK/*Nǀ@#϶qT 4BbE{''wa|W4z{ArYdj^sK !G¥>ppb;AQ&ZzK]$BMe3ʲI'_ յEQz:Tf* *FuR"2VtZ8?sn 2͔mP+YߞZW'?Kp#RPL+ *yUn2G Cgt1 EŇUׄP2Sfiڹه* ]< 9ŮЀ@N"^m)2 |ykxa-n`g4 F΃Cu36Sj^,'{[hS 6X +ND{9E#CedD'R-<½4w]T<5xRi4Z.a( [f$" Wxj PdqH힤R6G9q`za*l}=UfvFN8ୄlS@Fi.,"gfLm(/}n䦍:˷0-sj ttĻlXF9bRZnKr#B*@-%!w[NO9WC۪$S;LJ.ȤP!O&";Z9pq:douiC2J$BYqGbVN/.O]Jރs̅Co8|jRAN\+`ozKڕjZv=_梊;N#fTX!mog݂3&'fxB[te'M:iuƣ| fKBTV)Z#󽳴wX;lj?cfof 2_n#=n(JB(*B-5t3~YPdgjOZPNP*(i1o/'0VLmmZ#5?ͯp Oᆼ/ӛ`#{#-=h,M d`{#pZ_Ⱥ@2( Jm%|+7x*)l4/"o0HUgyBzRuo2z$I|P%>j(KP;eJU[ ndq`wuG ?d rZ׸<8GJN cqXun'ݘ$4$^fFXak:0Gs s@qH oXi1Fr=ٲ>vaj {|a[M~ȓ2žQZ "UҸHUm| [L ٯK[޺i0Fdg(~7'_]x2.\ݛ!K:>T ! W h O ̈́9%jۈ $3.V%-1}!$Ha\2ŵ'㼌H]Cbv*]àl=?X4>Smmz4/eC;bsfyMR.t ?lYm&4ZjRf8ڣ}_NSP#OYPwofGjeo2UracN?XSY2I]hSP$ 폩ֈt򩆪G%;¥IV239X%ݍmCH@'vN ¤nWK:]W?w1W\%´A8/OPX`r,_[4D?^6,ɴy!V˝ܒ5K>G)CVώi9i: (0-VC^xu#u$WH0;ޖ]O2>~SǁɥUf+1?R{ y1>EwBPc>YuO`i%|CBch\} CH\a&7N]&Ne?bB-XR)ܦȕ^R@(R2v1FߟUi b!ijL!2" F,l0Q }\::ë:Eqe%Fb!}K3,e" Mn,[=S,H)蕹@#SHөJ'v2ާ;6aG]7?]~7L0Zj_5|,$g?t#9PO=( 4Wϰ= y ߃16R[Q:n C3ȑ|T+ = Zشn# -'W= 64 ̑¾`$BTV;C-3҆mv]W;uAx_)FJsAוo'Œ;flQ @ o b_ѭwꅿR8"a+e)we^|wu!O04l:gX[\Z'F޷w5`8iN"-d0K>MibE?oXHǎHl9뼚II;יN#7~Oܟ`$"PoR d޶i]7WW"^)7W:uӖx%);/hoHb,2> ~=hJǝ'lt~20IE`?eP@Wq9-w.%Ömt_\0 3C;i*wxsPg|ȘBha#6yt{F*Wlv0%@@~~0ڻ>0>;NY>_#. Lgp&+p{DՊѹ)|uIfotΎ=Z }4O"$Lp4)!tǐ$Xf: 5tӮH0+ _p{w4KHהC$͛ui|9_M6g)_O̥}D"/2~W ק2CM!uh_ZȔM&4P79v wW}IV^do+Ndع(@CC9_-(<Ju;E6y4GaT3XN1`5j=Y{vk z@RfA+3stS-sя.ræBH3</HtlgLʖ `Z#2sŔ ,)YT8Ne@l11e'@ՄGV~.h90(ec4XHj% -#؃g{}T?ELv_-~ӫzk.p#~|\&3Cd "N8ߪY66`;,ԅwb8HI-EEɩFuC9Rt"9%q '=.FN8f)DN& Jv Ոɭb3ϔ0`ȉD<=9[aG14XUYH.mҷF;GH*V@2U|" %>WbA*C  X)emH7Ft '۝2cy지")`mxq CA`40$0p dӉ`z-s6G& | >L姟eTx$sDPIu ",T]ܦ04Kiλs:#<[v#۪yfSO~v?hke]tsVutSZA=Jɤ&[yfEEІK v^rcR^n&P])/d/1|jK?9کAh#;4da΅)|j< ?$,x[+튉L1ٯL/Й+_hbc %@A%!&? Q-i. 9%VtY(kDbkcă =;==Qvtn[z%ķ!R>?:km(L>;.@7@Qu4 ÊM rq;ru>fq 76!h|{J)@$u1=.|5[v :Q<oTl-g{6C Ń]Y*Pe Dg;J>rgvо뻋JNQȸ8W"&DF)O }Anm zm7xgplwoys4A4a&T|;֊u3PʾR~]PeF'j:JECS0j/\P7je[L8B[t^ O|ÉMx|S8^D eGD6*@7uKȒ,_Xp%$ R?!/=S! CX9@r,w@IZ~k{g5@-O!\+%k'6+sHbnM>"ir/ToB. ԟg5ح8{Hpfv+F J'D83JHweu|$GL5pwjX*b>Q2l#N!V^h-5{ޖ9LPS*n6tH#WD3`*행dP|ufNG1ξ,(*y.EAa&b =Q.쥭c$G_üyU_|VxفL^2 k4r~o3J0*tƪj*MujbdK4{Kj:Pٸ/j*u0SYQܻ,PBd8idh1RN)}M쾧.T?{7c>}F/Vˎ)f!v>o-X8by;\?c!f?-e:#Fu) ;G5 $b : l"zR9wՙ1y1Qm7e'0@(zCU77E`Tv OwFd7axsoGXM F0aTe4vP/<$ێ:f ?,A4i(sRP6j T[^y/Ĺr"S똔lmVs4` wHabe-o'mbq۶|_v7V,+qxYrizET)/(s71f^t%Fpx^OM6 fwxv^vuh4ʥ*r\ hY%| /(8xGr'@lOt{_z<-AyaA@N̕[Z)l՛2Ϗ ۿoa ⍗%aR&:Q?ۓzR)~:u9j)`3j a]@hF^7e|Ŷh 3@dz"a*9<|NwiWv-ww Ę*`IygJ vosihC!oq޽A}5=A< El@]<,ҷ~MT*p-!=L%^= vmj9zWZ-FFzp[,Ŏ`Ɋ.bAR5MBY\"eT;w+zn-ي[IA= ko<ٟ(-VUMvX!$DBH3|, Կ 1g*H|L%JLtYJ,[ǖ-Ư*+`Z:(wЉ;)du0џe8Z PJݫ8u[TZ ?wRn79(/#gԍG50~Դ~KR{IC5u7!M ԭMd$1Ea]guÛPKU9߲?dbNS5C;7a\jKɰIŗWc'`g0B45gx^(#նUTWLrx3-鍜b0.Xg5qp$ݨڵf7 tkP[XyTTW(PlմK1688]v*d3[b>1wڔ8lDE^Tp;:!N7|=xiEI9Zڛ=(zt1Q-{+,: /m W,&rߣ+>`raW7L)%Cڱ2QOxpEVsƟ,Fȸ촍zoJkfA^K8JZ++F),.d^|8BRg=Bgͯ8}<("ٶSQ6%QfBrpDKi3%V]zȸq"-{B0o,͢G#JBƳ yQ!J|,P-r`D RzpZ`w2yL*bϬ}2dPGjt.|qAʄM,( 20nO'0pƏݨ +}uM2$^ij87i> lO^mg<`u{[֢Q]=D{R83(5$^W6I%* $Kas󹀉%(Pbˑ49"3uRD!lQ,-\O 68[i8,w*ſ+ymR*.ImM-=E 46"fѷ _WKȞ HɆ#+Bv>@zW_81ȝzW# |zyfyL_t#W]Tk>+;@V'W1^-/4娪Ѽܸ'曪1@ >E:D7n}~ɜ@ 2]/$8eەOe4B>MO&FHx/RZ*^6XRmNCj :{rMYDiZS㿾)?jpac_)B͔]Q6dױچvp#ݜOœȃ0-҄-J5 L 8LjsAIbIK󜟯Tҹvo%%aƊ0o%"ivSYs}!2^`O\$dCl/u,A;D%l9[ۧZlHН&3c:]KA=x(BdXīzΩ|F$#mH[ւ1DIb3}-ĹnRsr$~v N_pb  껔/м(NY\E~J2$ [brw'|v:n$҆Gp,|Pve[ƱOEn&TawQwh C4!De '練aݵ.uan 9!)Q$_՟_~b,R9.EAT+6kބd!@ #}]-=gLPfo: WHvy5iVx*tޮ >oiGݺ4=j1MBj1'GmbO$vv0)=xv3f(%',Og>\!VuPݟ>O;&صsȲnl(lD45*!1\ᐜHIʓ)>J?˙0Uh<Sy}5EÈe|y!>N+41q#ZX~4*b~T;Np cߤ{׈rZ FvώYo"U]@c9xˇe;4$:+N6I AU nuq 71OޠHuBpI!):"CB~O( 6h g+{ }q "-Tlv>qˏ&jVxvqR$P'&o9QtEqi]S>^K4]&O|ANScN{ׂBF&g[J'S6{6 Qn\6p Zl6:I7ğey xIШ2ԑI5Lzq_Fġm8 Lzo\و;φ~e2]/C5̛nHL˙9Wd?`0iPȖAB5ͬiN>"od OВ5~IJ5H48(|#5ez.wgH ΊeiqW"7af%Y6XIDr9%ND$2PHeQ ^=%'>_ɒҙ,uHAetޚi81SJ]%* E˵_P{>j̧qصxܧ,,%Ë5Zt]%~TR n6#4w^ # ~-ѽF/w=½籊G4L"+Gqc$(Z*&3yfcM]h -&aA1S/Ǎ 4͊&2kc1DV%V*˧+^I|;rvQ~qg2 <|Ȝ`ѵg7 OGY^^߅vr+d.)'TR*1D<"UσV>x_M w7=wrL,!8\^u:4!i"bw%8qZqB!J6{\a=;l|#&iʰS3aG\w(ʹ΃.GLl2F 0Մ5lOwlYCng`ti:X) F5 sJ ZGWhz#)Z BW#Hvivzj V2w 4CYxX)Ȓzt3#íՠ/OPDMGpct{tee!L{r>,?^2WZC7<'P6\O¨1(ʧ@[t v$rLJlI`9 ؁KO[:+gL/Z9%gچǞg6Ƅ&u'm(h -k;ɜU 1q,:/hp@jP/|-G,Jg.a eˡvyb$UJ^L s`Xzv'^JSDXRܗ_ޒfD@'0gɊ9ކk{!k?lŶuSboϘt ?mc )=hz"V% s ;(s]{,5Gϛ0yR2@8],-0Z9xUԇl AG}4A` Yi 3v٭?X;"ݽV ɸUeW!-ř"+XcS. o&?>r%nQQu{CnM ւprlܾ4iWw! T@R=1ȤK+\8&[cէ侥<ԃ0!S3N8]c4ުg?C$ [nU\$&n & st䁄7Ɗڧ!pyP.%-r$gBoG(կCPGۀܓݢm( ڸb<}H~LVDMC=#b!Zf/p TBz An!Y!~픛zcy̘jI@0/f#> 1v;nˤ$zH(r5h#_+I]bHև _cǨ6 W4f5ɥP N2L^ 0M @I>?~@dg!ؕďuN#]n7ʻT\psܵ:3+K3NIfOOt3B֪fQw[~NC$,GH\CYm[3}RAj{Dg{68,̦tQ.r>#b*}@yfB1ϝZaQ"`6R-cOEJʜ5"`Qw$K_6AßN^ ͟Kx(:۵vc:Yb=}['Aeߑfieq Hރ#Uz':Ę 2.Ӹ =~.Lu<e/eZMp2 3q$!#)#{ࢆ ߟ;w1^ٰ ec%=F_5#j.;LX?yk1LWbV^_[C Gbe؋m'(yYzElᄺJlJ2i%(auݍ~Ș7|W 0&Xo},sEas1I%TM%JQDXeKy{n|h/ `~HOGBec6΁WUl*DLU:d>zBȲjI],жe3X.B.o&Y/U뙤@[+I‘Y;q`0 $r5{3T`2= hRaB)H9c4.R as ԉ =A`ơ9^4&ᓠou#eOWֲ:h(]e;*~cU^8 cۡѰH B6'5cw?z٨GpN_rs8ec.T54>CfglЖdQmwX7Ȓth+%y2&ǸU0F&&4u=vZyxULrqyZ},Z«cHz[sJ?ģPVk\z-2M^8[=qSZ=~?%>9ڣ@>í"@JOw]n! 1 U|+ \+Įkb-76 N0ƒO<ئH)<#t92{ēj_@\0m|~Bt\r/ QU EJ闥CvV ٶ ?/;݇6k>D@&|LCw"=;g+r5 ptީ.iȋpY27B[Ip_F5Oއ Y>@T7ϛDqmksw%.6_ncS9g,:?YPyf8y2LG*6,I·Y>BQkd-rBfm+%Ъܣ7~"(GKJ\-ӏq `)dleʾm.'G[ ͩ )Ҩ7|BwSZ of=3[V^n!홛Ż# +n7w[^HK,p-ghǣ(R&˖0ac 6QR;1j^^4g\VR2b:^pvܙu㏃t%SR]neg>t"爪/Z=έqxe~}D Ÿm*WZ'q.{ddT =KepoJ5?jڸṔk/-l}*"KDTMP]p 'sFͷn9 SrQPˠ,Zfr1/12XD x 9\+GZ }OT/)d~&ehVbYBz\lC0a!-N5/piEA~8 7' 8SGYJc࢏C?E'W&Z8&"``{vٙ4r'%gNx aa`{:1 v<]Ż"Myȇ`Odh)0a`xcSO܁ԧWgg   Z7oՁ$y&Z &)nCl`a5HK/Fw6?#gm)NGZ8࣏fpH"^0H͑T q]! 0 p27 'K!d\ZF,Зk\Ct.y%9pw_oMGJ%mou?=7:ULNb2h92usMƛTM#mVX0kHxi4}ޅO/w0S]S' *T-tJ Yzf3ҁbim)ZW\ {Eҹ4UF}.QI0-z z뮊2ҨAkG1f?Niu4n Y=Ф%Z7Q#"!=BvO LtdFCOCmCe6ILFVS}ER21 ǘ6j%3Z9lSW~F:֘e|&]:e}Kd%?zF♲B.ܠ*mJS֦HzMiq;&GZ6m M;Io`TAGT4mHM6$2%zqRF3"= -T\KD,cIɢ!&3Ƙ\W:ˑReRzz\kdЋ> 3|McpцJT QF2^D"%qU4(Dm5ÔoהK( ׯ+fZP_@bM!^¼y#ķZݠ:87pH/N #Ih ^yxَHqGZ[%KJ;XE姑mk ~Wsn]LF8¦V<&RXo>Ey X4А:P@L0?Q]g:b.v?BNV&y$Z ܳMD= q"/5"ScH t{h׳b:)hf|f UE RP3˭tfy|;Ҁ2_V5UdHB cttEbce:?\ak`SfEs_~XC{cٮKh\30xr[.LN H$ %Y5.qo? =$hAQZeH*H`1-ȒL7q$7|s5HN ,$^ޖy;(y*w<uȉ]YK̄ht%O8i<$$fcB͇ڌ w-Z ,X H i*i. *^g"N6󈙹S^sE@_ C/@=,edL/vjr9Z.ϰ@^P@JuS~WD׻clD&(sk<򅥂h"|훀V`֛t*E aW [a"/;sˇobt>dMgvQʓ/Kz䮋 @qC܃;Wjh1̬62كEfvM3I#{me`m4W(~ЅSc^5#Wӻ4 imw3rp`#DկQ"aH*Xˣn:\LLm lź,1GYo/sFaӏ=.eRy?|fr>f2+gQs`:: D;mJefvb{?P`^敁.Ib5%͑Ǒvux\zS6{3wShINZres;!]1nrvl#P8k<\/n*(C'\;4YK ssG]D[ PGn-NHH]F`H C\BGR,G>|;#[X:GO?,E+`V,ܺOTj`QS~1,=MՌ ᒣPH4`9dMw xTJk ].vzQUS2d\I51mOpǐ<Wo(5PfPEafd. A-v绣O0-:Q fپ[?O+F iEhuȕ$89[2ЀˆlU|6.!{^+>p)./R¬J8{,II:Q_SCˍ}&;O\-cf~Ya1-Hl{KrGQ/T_\lH8 7BØgZ%^YUh? Zra7NE#}?33Q%$SJ6S[xn"e'0q}( ZcxBxfIZ=͂ǺehܗSSPܪ趄vTѕm 2uS52]?TL\ɍgO*S' r(m(Z.I<d,GSIG('7xgQbC~u޾B흧Lb)453i!*}.CPig 2dvO9 'm ?o3Uʽbz-{nk$(Ah"J?7ѺNnc~z.S<5鑅/S0F&I1P], :/%j10Oz "P߂}rqn`^i{P=/{:T=ƌXb-gs_!w.;[gR:YMny:'U.0 w5()4:2I!xtCtdLljtK1y|t39#&FSx{1רmCr66+Obיp*(jH0廁e#qe͋qU WB g*YZ:uU^uW}rXۑ.NbBƒRL)NqDB䈘&ũ{)U*dn8_RiZ7D85a,қvtL:'nzjkS+_yXą;P@ށ59U 5M9 "~'j`NrRs_k|rdWx'LY E;oӕbdÖ0Qsӌ{v6LKTpHcMd f5't:$}-iʝԛ ?:eehrxH~#*Z2 ~~j(qSRg-WޯzU +-f@`t.=؎W>"Ȉ_KՆb"01[N?b0S=]=EjEܯ74$UշhL6PD!ƸVۇU^mT䨣YBwzǞ[;RIzWt5W}[:vbӧ"Yڳ zdL=^o<#yis g!Ket&uWz^^cZ7B8J6RőcYw L&83>*`jRc-f'S w@;0wjKU*@YO2e$`nWk3 nUs.ϼ6R;Bl|7VE nۨ-ЁBB28yj6J3Z?Mac=+Q3!E:*)W͎Nh7{ phԑ]XwBlz-vK[n[~ݣ'@ىz75`ʛ"EpNDYƂeN$/՟ڵDچ M]=IA"ziRgFSv|;',\VB͐zĚkG\O)UOJYR:?PSɑYQц!R0A.2X(z)Q+ S⟏ywf~CYX$8=XRdL𪺣w3-K6X)*o"|.^g(R2n%1jf`{NT[\b@JxLdзr n"gJUՎy=go R?|nRjY*ӟm~ G$Oj<2w>O7ڼɮ=H<jrHo8W33dvT02GNJɇ%5*!p*#o/t4Ayx4&\F&&hi5x&Degdq4% Ms<гel!RME.wq:N5sVۊlŜD`>I oSV #(Wr|F.L<6b#έk÷,Sa5W^,Lb;COW{#UF_ݣ|[$Z_Rm/_G)< &c:ws#uýʭT0a`恧5>j3n 20v^D<ʉߏ~2PP)s|!`嚁p yN/\! f~:ֲDD8-f<jfOyKe[00RtUhCdIK(LD؊~exJ,)FDI/ cGuZ{,~$ *sM `( \K~uؿ&)nrTѫ2ޑv91Yg/rs>.;¨a{; <4[?* `ü-yՔ~j(cZ=:)y4u_Ҭ\15̺ E,ʄ3ioo ym^uFiQ.?CG09 IC2S[I(ah%8{\Q=F 1 hIgwR+D+( H#>H]I)Pb)C 1O@8 #MLuvo*h#B6tV\ d@Sw "=sxw5u#8 U"kX,66(ԻsN&x8K9_n KB_ˠGzǤ7,l1e56gi!^c1@me%Q`ow4)&NvDws@b@ dL?A.lzT +ڵ6t/SWWhbr1 |CG1]RuHo_7` P~[f0w{Bgn6waKNSy(:oPi潹OC.6LW+Ǯc Z `k%(tsɫ N ڦ,)4)zsU\0f'ؐ5fiQ2iҭx|E}i854]Ҋ0[<[B3\OZy kΓd'mzɷ*Xlq^D%hkJIhsW^} Xy4CbP1NndL󉭌s@5'+Wme綛q8_pׄ(^"k?\,ww4UIl8x~mBfw^3+1#^ɝ uGIߓ \w(2\Mr;~]iH8/Q"i%N#le7kXv4 F3Y"rӠzᔨ"# ~G7x^HBi·`xPgo$ _;22Ŭ==lW_+EF9<"`8+:ͶaHЕ7r{S[{B~ aN/&4~$^cT'`>r~ey/ߛ2z48 p}Z@ ZSilA{n8BU׌({|{ 1_T(f\#wHMӂR'3'I(XKCN'5(ԹC[}_%۹ѮU `Jtr!Sb1om gGcp 7k >Gd;U(QTWԺ%a!JJ)ZTY7<>YXKa6- dQcplD6gGV <膵ERI|6m#H)׻SR ݙnZ-;`29a+ٙsri?i+YD*5Fkmႝy. ~ǘzvԠS ~exr:_fʡ^sekכjwA !\Fcwv4zYS\7bYdv n+>[0zNE_h*6TfgButV akp(_'J]P|Jjߐ_*3&!hmgL8\Im eg y!]J,1L禇\>;#=8,0TA~$߅zN-n]CA Y{v x}i&,AEvhKx:uY:OG7-ҏ?oERfwHٞ2Hz0;Y[6D"yɇg tGC4q#YD'&=?3"h6,<&LME:≇ר*׻l9̴oA&6C̪HQk"D1)щ+ƄȈ*pn$7Rs'׏kp4@*Ts9>Γx1!3rKnFn Y}\ҙaimY0hgOkmV".IW'8ĭ58rx5"7׶ ] ~inH*iv: Q:?HNea~J]ʼnqXaY[r'j2lYQڿ mSveJ8d(W]Tg9U=K;LwK7-a40! h%bLhX;2VXK <޺RsiFIKH>MBmrP(JR$gjc^QVH3b.8I}Tlm`4TL@gjbq 5#\❴I(_&+Vk>Mq<*^7㶽'$NOMsRĉ]n߬Q9ך|1GF y/d=/?\NQF(-LQJ~Mj LHJ'T6g%٢j_:`ń <`bRj<6acC/BїzRU)ֆz5-ĵi,ƻTzmNޖ ҉0X-Uhm.L)rY@ `^d [[՚?)?،NLC ֵ (BD@.NJ-V,=lwu9T*ALqIXQ܍f_6T@+Ek) B\n-klpeigBgIz<=6&Qp䮬&>=s"".EIX -jX=͍RͳyLx| lF9ҼOH&(cj1Rܑ2nʡ k'T=FDH[ތ5Md ] X%1Ӱ~ZeV} A@:x%{ԦvGDq2*5T L%Bg*JA`|(|G z0GQEq߈VQPa8> u|/y*AO/? Lxۏ١3ad@ݔmq ~%* QԌՅI9Gf2boWJSK?YB{<= OHqNڰm/[C0(+82{8hϱVez?3@k7{G:\tXKrTm8 Tú!ףE^E=ëR}*ƖIZCUV4Ѯ%@/D#,"9 xRUs^kӣM|75]vŢ6%0cg[]g~z>8IY'HljiW+u`ܾhJ3-hNbh*;,ݢ}+l ZKBOqE7gUml pRI lgt0FKxѶI{=Έ4d.Ȼoev޻ƫ?(G2*Z,үlau~2o>@Hc*}!zܜ* a?C >d7ch)sb1q&E '_hw_HOzmW-E|Nх,a" 3(ۭ~bLFN;>uúC'"E; 2A%w`P7s7>hADg '@tՀ;OZ5~{ Xsd=@[8 R+is}Ujܑv[H4`}2 d;$ Yf؁iޛ}ia954uKD؝J$o>Ӎw(BQƊ>};~?f2EρA᪓;s7D03R3f *Ɨ( !wS% W6Lj9=IQfS]Zf .?6ާ-1{#uEdѼXxm{? SY׷:qOL#A wScLeHwXBK1B6B.gҞMY(y$@-Ϳj6 %Fբ+B"9 zb8Z 5$cd9 4ň2^}9z;#0~l# \ġ<NRmC~Ғx{Vg=YA4`De6:GS:F<aKa#!u0TBBZB [?"H[r2(T-Y`jeCMHC׸ q`9YD =QW@D)gc!t(!DC})d{`BE50p}Y ӳ |X>6)|YbXNdT6R*qEe1`ϋ9Ę ºZU "uM:7C\SG@սv%G?۷`w]&ąfSA~z;rg*0fxl\ 8΍+p:u(2ػ뗞!# 6']Yj̓< :'ԩ=aP̟\PfGРIcHxuES@ցG:c2W}!|-neB}NJM]M?A9f~Q cV[Hq[<\E'g4C2"*@n]wFR(<0Ǚl%t;^FKhYnM"YveW18V-REݕ. ~KvO)5jbql@$[~H=DlxȠ’,]Etu^5w%p!Җn<'`$/qAyb}df̀gF*oc)%@--|Ʀ -*aD@rN ڮ腄:pjJSg_6AB_؈kUwM_W:״f4]zPWegzY p*?$A{و@Xs)~ҋ6_~.[?E0)_naQY`bE Fۇ:/v0@݂הR*vб N H'5󄬑-xV$t/,#c1c$j1h^i_Z4%ߨC$z+ kFpʹƶ=f0|lpdc6ʚ$fhjN|\}P)_cxJXmY 7iK[.VNm {uO~?539$HDzy6u`[ [3\t!MzÎ'Ha&jz#fLׯFgW;- A`S -8BaL(͗Bg5ouSp@S P"m~#:|x`j:;rƞƺe~Sq!(ќErlY8y_7;8yC>dA%k/ygB}\yxJ>?vo.V 4P븋V;`J)H=KQ3PMIX$]{$fo_NSd!Zh͟SG`dL4J2, !Lᙄ͘FӔHE@UQ{Yi yA{RfAW\ PGAzmڻ)DD'NMm-K:l_]Rh |1 X^N鷶96 8ŤRpW|OZ~Bt@%RթZ}7ӭ \C_x-K\z mȲڊ|N 1趁0¡내)IXqTÝ)7td%UKM4+ |/{cLZqR{ et(Z8p<9F7dbyg 2 u\m4" R'!,[[ӕ9n}Ӝ] { am{t-LpLխ_/f oe?6˚$0RbB|}W1(tKjPmH#|"/@wQc;х5\K0kBP"W ǎ}u iw0T5ap.0,&ֺz{fLȋ7CB[bV [WB9}pw@!/ÿpGڲSͮ 9f5ˣ^!W2!5  035_ۓx(0{>}wCK~ _ttsJ߼^ U9w:_,4p̏H=}HF<#gNJK5]d%>|2C5 .'3NJ(z=^$L=ak!KHDn][ۤζxru!,{je|~"4ikV7T`|4P9.aD:J' ?N\I{ @ a ]LK.&J n9'O7a_'gmk3#y60v2p;J D@^`x*g"2u~】+uFBF nMhCHL,~v7\GFaSr>H]-yBjG.G-k ]QMpueڍGΉVT9%ai(扱e;H95\]I,&9ٰYR*34%G x{!n<!,ThФKJ8? rZ)p&aU[5(=%"iǘ6gVUU1BuY=,I<*2F5ojnke/PPDLXNuV{ǞWgXT02ˋ9-ɝG aP*a}X=#RMحmY.v_#e"7xKa5ȣldQwK/[6dM9 1 pBˬ& ZB/dr ^ENa)`?/^FkcӀM=]?ѡ>=5\~Η  !%-$hyMsev~f鮘/qY)M(P%CGأaˣNy%JD$Na!P|yx 㧦Y4Ƹ칀NC!睉}8_ɣq[nڛx $UÂdX89hKL|4!sl3!G %枳˧eY3}QsӶF>w:_]-P1(<59~hPΟD"nV]s{]W<}pMd:[o:rՄ̎տ!2ulB%:RѢodߔ:5-on8}Y Ñ_SS-U*kN <4A_eBF"lbP8!<[2>V'%yI倖%@oEll0cz@0zpDݯ]C3 #%)ڻCHw6Ӗ}^ŷBWWFxs- 233F"A%cKr&j˘UOBv^GY(= /m8!n[GCbzc OH|I$ /3E9c ðx`~-)7 & zrvq]C'bXȘ쾌Uma)t=3-5Ut&%~kAzӬ6Z]yK;zRrfAZ,Zn)-Mu^D'u{`汫>HZX]?M2E21ٹ3[Q[H& ; ̗67T7fa_5-G=WsJu) P!n- ͩjY׭mS6h^Fa-[Ai|fã8Y칚J+]Y`<nbV{Iђ;QzsPu]PNUx=V>E/i9P:]vw`^A}RKD[n_tɔ a`ٕ*B7#jvg]_4# kR.m>܀ .΁$ׄ>LEk<)e1=\s az͌$ZDMgW?8"6Ȱ@X1Gm`OZ#l!װᚬdS=k2P%)x(5HHo4Y(&]rTj$qގŽMy`.p}Uŋ5iN?̹Fp~* oAPJhueXFQ2^I؏)x@àH? Kۗr6Wt䒍zrݝ;g& F;JJ,7:e4p= pJ n1'!O.͙6ŷTn:y$ d[zRTGA$o{'E D=,q'/w>>1}0H։S ׏!ryr)YڱXfRr"_-ȗsF/S9~kݸƒvAo.RYxtX&F.SGi]ce 3#}$b~m=M,}Y'0y~YJL!BHhήkO}+}hS$YK^DkzCj4g)x49=E*X?g Đ첣;فyC=ݫ,!00U4zѿvꊽڊ^!?QI.}ߙ"b V ^9^Gka gʫV0ZArѨ&Gx-Ai%D" s dˆJQVzA,Aή <ԑ|kLi|{y]poC}3Ԍ7fFCM'M[i?/Vi'ݹp͊źp'"F+Є"Uy 7f?@OTU 3ѦC7˨ "˴T~L(ڒqƱF"ޙ Ӿ8zStH;\z};nȹEJセn~j캝thm m g¾/{Gp ?^d,rVWppAެ;U Ht,hL vIM#~#79̐( h{Zi2P\ljVr*Kga EPZR+t1Os76|rDVXT+Z;,q43vAJ=ZI3Kl0}8{kv59S~|Div.na UP8}iY1qЍZmwLzc_GZ=J>0X2s"17?ëJ)}ޢ"1SЕ|6ܘ q J`?.J$ |8*?f'DwJxn9|]Uz^\ydx[l֖J+ &Vݲ\PCv6(2L$ $e(d%K`z-sV {lyl8S@o]<f>r'Jj[>Z[E 62z/h-'+ϋAei>;:r=B܁ "fK-̇FLũnBu(Tv<BwF?6s!BTH^Td4 _5T%Z`lkNFyX%轓 0*XMH.> _lډCW#gb֟r$#\ pĚPb5M{?:bkMq~9_ p$$@*$~x+YSw1^e 4`VFuX:naY]]I]|?p3tD~<6D㰏,e pow<,tk ]WWK0VCHiZB+D3fb6`*#ʅ[ ZX⁗f?YEra\ehrJ=mط\ʒQ<xگݵ0j#*@5rEHq=`9!N\_&$?]=f'8ڴ/޼], XG.D/y^os!_9_XJ-Cj`)iWRo}T ape-PڸydzW=V^GnUD 1!C}.m"9Bd\`tFm W*s"FmϋLo`~-'V gZmA-8J_.hq<}Mv3 QAwlh+ UqP YHh߸2-skLQt9JGmmSJ&q 0hпs`G7'eVDwϚxmUN} vf mfDžeй;T2'a??іBW/㬰? 0Lt ,S(G .ML]^0@;N0]WUC, TJ0 Kb]IOoKq ˴L^|*/oDܯ)۝ p LնdA|xV:RznVj^Tw|;3Hd!`'\:}WuD@e;|5~q:f!`fAN urFq >]R͙ĭA&$(lrGg_1h/»y^S/̨;P7ԝkj;L3lhHpvSFj,+xigjQ @F2i0z:[l~/D^+_JBd1gQ񆲭tެRF ]{Y2,5-`,׃*M.5j.6m5d OG`t۲&{gGD'I;RivMqF2dN%4Q'/sѾc#v(L/U'+ȓ]p 3~RdLg+ݠPgWwv۪؇>( [CKq/2r,zZ& nsۢμQ|zq5^Fe3[ihgޭA5fVPjıp;vNH]b7ep{.Ո\Áp!n/މAh%e<}Np9 ~m&uKxmxX!!p#>號>bk\@"jݴ7VMLhƃцR,ގ?[q9oE;.-/U4!U m-U4 N7$XA %3Rhm@ >?BjgB-$X]yFwAb_$hI)5/ux/^wܲ,goQxw}*y*_P'z2'?QoT.R Cѵ(f2pUH* &/Uq(ҼPnۣ ~S]P>AP%+sj׭0vAHtĠ!yEB:)R)*f^pQep#z+'7- SOO)y xbFxIA"~D%+?p*Kۛۀr7}tVU|C c8!3?> ES`r* K8y6ia#p2lKDӱPt)xzlz70adNA;T }ضm A*+"Qx[aApMnRhkN$-Y%a 24 -SGC?Lcn@–"LWIJ~[W|&E>y}ϨJPx-jH3K@6RT02"âMZ84{A(з /S*qnEXCqt^NJI}L_(H|P+V?5v"6A$7pD0FȏDTޮ"/^cf,S LC~D A8`뵵"Vs]WE9i< (n;gTQ:{aA,lJlN0q{u4#@WVz/A}Ka^Tpؘ; AGabmz~Di:Yɝ)n7ԊbFD?0 6Xނѫhj>x犩إ}%΍Kk&΂ ,f&k[|f[fD0SָR4[vKHL6``VWø/ v^[ < /vf*Ӈj)mPٷTp_ U}FI9uF_\d᠛E7w6j3^]FjUr9j s"z "x@zKL2fBD\WU[s3Ub DBF\}~k&?Pu'58MK1 MRr1l&Y{V}#]8P;9$ I$u'AL1R 1QȝDSY'Άg N(.-MƙLT7t#D퓕$H3&ttAXݷ+@LM|[QJQ8aƍЋ+^hnUuvJ_[6mX!A Խ)O1檑砀v <(w|0e+*ROw:._.F=IUIJd`O,$ݑ6kt:AH-SD orvmNRjڻe x e@K2s0&?6S=5x!^ n*OMlx/[lS?{FF)ڲq꽜ˁ&%)IµiҬl˷%\ѯ;*UjÃɐa<^\4^&ya#P4FL+N׾K:=0#=pdYd\#ETyo  5$l)P&A8*ܤm,2T0ɣ hvOV*RPc~5$e_X-x4:G!ٟz^l:J8?m _(y[=#\Ymٜ[5=3WvA_4YA+=]E/=MZ^oメ~ .A%tv_M_[U۞33"*Cz!~*P Ϻb= E>O`;if/lslwn .ONb-f`VJGo}$|t-\OfW/%DO~x8/9]W&rdVu8<2yȫFyXȯ!VU#&Ϯ#u QF<n%f*6aFh`χu񛔋<_*oێsB @QAEA}tFcA$uDE4G.n~"Nbڈp &/v8y ð Y s*2rYv]+e`)p%\ec5SLS +`2yƸ(\/!*n&3U#v64^D)$>Jð~6*40]qy@] ō,XQ!4?M5쪑&|Joaֹp;6^A4PCG\$7=83dҖ )2_7Ɂ& Dj@Cn-.+ȑcO*;>&uY HUH7YD0wT:d,ak6N ?j68S PK? Q1sz "BWeQҹ Couq^$MI.AшK 1:v[ӭ@.a\fU={&"h u"?Ac@. K&{ʬPЩ$qj<}}k(r]&Y;94d8[; VTO,@K#:@p$06 =@bMnօlơ|iv'@)6/qI$RѹL/aZ]L ^#CԄlP$)< .yExQѓROƊOWL`B Ys>7$>V\楛mX t6K|=AN|+7n=徎)ml"[Ose@B"v.?GهAS4vEȰg`ѪFFNDm80ʸ=Iq:,QsC]tQ\NB'fڌc+M/BE\n^;Է *Ԃ; `0w[TM5_ ٓ )'Pbj#Jsn+<2IyAwMqJG9 ~CY C;(gREiBB:,wH٘iMzix<:ɿNwx2a6wtt@ե UbTJ$͸-jLdjY4sj>yӥfHzu\(})̈́tٴyaCGCLU3j’uʫOz| 1asO6.v7KsmAULS_454Y$++g$krƥW1cm^ 댐 IC_v ŒCKTIfdE]ᬯY\݅e+zK->$Ch.xin4/?W۳Jzfcv= Fwv(]QZ!(0 k/ztL  >6Y !j}ǘtBO񄛑e48 TzlnLw\&/,#ö6s6Aki`%׽BUYTE0@6ZvߣZ^ҤvV =7^t@9F&L#>y ژCGiST-~]5f$b/1T>(5t"#aZ{@s(fó1/go,x%u!X;wkRRf7 1JNQ] {_닝3 @n nkU_ŹM"7 >-w7* [Kr.zѼ1kl)RhG Teժ+[`~4%:Hֿ UU-kL ݠpeM9 ܓ7~L| hkl)k*p3 ڟ'Lcܗ$I!@XXHTٱoNǻz|4 /n33QWrsV7_ Y|A[_rp!xTqE&-+6w| >&-YX UrFBjS#+LefdL]g 2OF,c5"9E osT53%#>Dj8-65@>/6"!^o ~l! wpJ\G^aMK,Hq--/FiOu 'kK`C(ooTH۱/ѲƤҐe>b!e\ CȡJHT[ /{ä(ƭ s w,OINkeBW?ل瘻cmXMJ {xeXvUF&}jSkrhTV9#"DYTHOE- *Ƕ= S8:MC ףC12|;S30f20:Y^KA)~VaK?a܌L_OlKC;WcPiOT;CDB.m槄*r||cZ7-n|WvsÞhBg*o.V%M?>~_m,OI| QBXױ3Jr(~L ~T_ Bf<J;+W &' cw#b2DV9]G m{\m>Hi}FhR Pi!"`ƨWIGQ&^OkN~51vim"Ƣ}V_$]Ws tp8,B%U\RJ٘b[!"ɘ % $|xb7D45ه NJ7{[шHi}sfIEQ;OjܽMn{G)yuU:UcXu:Ahκd־>OtKiI ڌYcGɪ@ 8~ iHf")[` ƃ$?eTUpfT{iTm}5*eUj:bM+GMԷx \řicl)=IP3zX lOtuaՇv0UfwEI7PWٿ J߱CZsqpnv>$l!c"  &^)oЯ씴,`wE¯n/R{QB6 SRЪwxDF`E>HeBK( qZTT nt`K%'" 9vF>DΆjE0hVvsPLdؑG2S2Wpމ;3td6|A疁di:> vW?C\IJlx'wHt&է&7(ؖfőN8Ke;3OtcĽLy&*AC\G%XLЮbo12iB @ecų歕7JI egщzee,HO*Ͻ/x<)JDpc+RQ̴[8vkA&Y$G^cFR:<-8s8}lo]J{ErOBn?GhZ}[ wH"Z`kg! 4΢Gpmfc#BCTrp"`٬%IAWaEԳ TftjFͽ+I]ul*i6wfFio՘w%!E;3w,bA.o ]NB/\h jKJ}}!T /Fՠd.ӹ ޯ]"wnN&Ze64A!m|,ebZG-/q)7߽;#Gc*_H,Nhway9R9R'VY"d pZg0]d[[@ _&E`'+KYpsmhdwH=9̩< eKlgk * C8 i0?[r@.^};j:#ݏ, Q &w"?qǼHFقߌLj48N7.;m7YJ`2U"d|BL51bp*`hӿ. "E'5ԙǵN:TVuDOuNTQPZhP%;rVK a"n cU<Еal![e8S֌VwTڞӥ#\a B!wiغzRCLkDNp&w]rE]bI} e+΍/"`玲S/ Ԋ]5 %UBq~j 8fnUsxL} C~z&j& 5Hksɀz[hp՜ˎ_>sHi]2.l@&zj~CGkn GAqj[dp'+ ?BcJeu'E6ܺt;FZ4T=}*fҩVb,=۲" Ƅ9.'}`/< piSDy/Pn-?q44TuH<;Qt">ܥm_%3<z?tHAK(c&> JOtTZа+sMzd%FHsP~ؚsK2'0;J&) Ŀh & q= nfDqY 'UDL-{d;)ְ&RmJOgI  <$b%.c]g1t}Rgz) %][*4#5:Lj|!̎ώ$:+ *aee)U&c^amLzR@4{ qqH(6$ˍC: ձ< 6p<[c\mdEKN\.lQ."-JQ?vޖTPtڿmM0 9Ci\eݱ=hL6֕4&ٜLek ̤۩[:UI4r񤯁,qOy1%Ia%wT^QL)IӉjPKiF~+='5ʫ9'e{_Nb$c԰LV PjENd4Z%?(sJQR 33u;q `gYacTB 9_֩{X"G3ԧ|nwěo6o֤3Yh+ߥ<|B6_QDf=spfI&Kl{cW.|u4§HaYKMWs^I/$(B*- hrml[V `LTrp?c^U"$pӄ2 (!T y0UHo8( (vy +v> Y||t{i$*s˂M7:h.vܵn(/RtG jǷ0S~.[s,#IWϻ7:'~m=KeA'uB2[;%;~;(dX B/2v%(a۶;aPgoi߾t?2G e$O#ʬRº8 "@E$ZcZZzdDfe+w%S#`}8~ѩEJs|p h@U!_Tbjp"Y7zG(w%b󝞋@Q}?.mw>a2&/76ՍY"rZE/C"EƚZBo{ehŌԂ_u&ń5+"!T\3NL/=Yu-C (f I;|fXQ 蒝8{&㊕ŪJ0`(y l-|K*1=ud\vi%#nt$:hq(A&N!w*Xxv unl"KD2 [61J? \^JFYN5VY] hb 3&U<˟=s,)VB'El/q|IzOU g#J hASW">͚{E@AJvC7Cztuj_.l^3_3ͧhh<&=|VwtL/d*&ͽy2JNLB?>GWwv2V>|}' U,&i-Gg XK|2KH . &ӧWw#A DUXclrt.c?gaoUQ:! `&'q10F)F~S&}euX}G|ۤ 0.C@$c>a!hg@7ΥQ4֓c)ݵ)W%k(I_4C:u F_Y4T#:JPsɖ!Sw- k7+n _g\%J7L> oL##Q,U(j*Pض>[BdL]Xn, X_!p ;2Ls4(Û89lgE;s܁92"rbdw[k{2A HɁ{`Gp~Q}E6Hpar L[corNg.ʑ{:zdÇ]n?Q[Z$fO ҃#Kr‘4 - 0'*{}lcSf@5i,? Dj?lZZTH+)( :.$}"# {v G@ 9|Kژ7 W1TOzo\srJ{wz?¨Au1`!5C)d`R( 6Iٶݼ;2ʊfLyDMw&7s /fY'[vDKr re7'U)aG-]Ƣ]\zj&oc m? K :ѾPr{JB>LtTW!|,yسhڒg@BgOXF?) 䛉rɩ&؟[.SRZA9 dV5,bEmMy+g^y(bP #3LY* <ݔR78E;i.· /.iWeeP.N]FBp˹T- R\3!~.{-߀OebX7*b/(vsAmC) I[Uλ^bFNQbDO0 䳎 JTxdPw ɭfm#odѠ\p)FYdDE?BN33w 1u"AhootF w 5a+gMQJu1Ue{& P"@o/w.1ߟR(2 O\4áY%0fό47M)jy\4u=U94٢ZBD  3m?w߳ˊB⟮Cê)%iM48fL@t`0/4cNHp%ʧ>,[//iU2 5$4o O*v&W<4|?Qd^jQ_LH+U X{`ܖv{j܀L_ ͘hRwO2;!}ZyDuZo6xLB^Cf(* x4)GId3"c ~׷C2U {m~OR~꨺o3ܦ3OyY퐒m_4IUhd>S[7ZDƾ]rQ7ϔ)gӢ|g-jCj3sj'[JJo],z&4jd :j6G&K?:H䐤p^ȴ*1Ԡ b]{f!\8g>7jh.݈ v<73Z[Tr{[~mR'xWR6'zW r ];N\EZQv\m0oHcYK%cEڼR(f.xT:6nznf= r8 m+bFg %ү>O a2l3UC7F8C'I3yJhHIو Kt #{ o~9\ $wN[}Ś{1; =+o)pgj03\M3bgqS--)rYneri=.8[daL#HXq8_'}gO<d:_s_sFL=b2y֓$;X/bIjxFYck"oS~yhVV]*n }T[ E0K  D='cNJVDn) T.xSL^ 5E4=i.3XG3 2h^['~{.6َx>bBU@'?j(S,ڣQ * 1Tn$nlob[e+qm! C..q>\B3C%t?ɖ!ԨXg 5ą1IDҤR/X${[ƫ?VAU)9wjo I} 'fqጤU&sX(؉$iV#hNtWp1QfTChjcOߖ,Od*/4yHƕ6.1F㩸ʼ6 ӺkmrF[KoR<ڿʗ1-jFTk+ D:q:Vk8O4KVF w~$+D>:D}7m;%o9ecA\_1{/[hd>|ԫO^g(5i~:fp)^mWot(X85)Ս}knn\\Ֆ?\TŒx9C[a-5gF~71,! gmHGƨiGl`<A01rjq:5 j]VDݤrw֭;* c3Nn Ušz(30>m-z@c_d <#Lۃ Y0XATdX;0kT<2߲Y瞒8įw^}e,u$ +p{:cq7ka(TwZy4t!b_h􈀄-0@%岳bfU`:LT4M9|{vA eJ][ЅzKm!i:-0_T RNZq'ھk_X*l,py"mijmV"hcc!Cu#:*1JssJ*䓹h ݛ< f{YJf>?2?Zdp$u1߷Fv']r FR=~'⿛yUM.8c4[*XM:a-1|nv S6"G6m.xw L7X&) sERϡ?Q8T!чf`eѐ i [*XSnx&Y@S5WA`+lF3#4󽠩˷Pʓڙ˭U,G$(-W0 4 <+<80 0g_%d:2 N:]81'!(Rrw.3V苰`w 4n6Wt tp "‚ɯ S6>A z^Z $rp߻6kL*"Bv 1~27g@C"h"LߴRΠR"xڧp?,UMMs\o?E|A2EΦ.c%-pP.(r;H*+8h`T8PTcvih:D;5"iZ,Gd0} yS {nFU`u̫+`al˫{mcΘRˣcur}j>$6jhwH!;:rlGcTUy~xveN$wS7D Е?s me@WMn}Qs=9]O@4Sv Rv ˧H&DvAԢ&" ȢT ^3- xh$-j /rN-m V)AGG15E=g0hOVt/7'DX/|+10/u*GYC>>@![ Gd2:sr)":q̹nvuϪݳǒNZt?S+Caなk\oüS9RsU-1C$@%I7.abH1H[PHCB ۷\? <C{hQ~i+C8>"iJ& z1 i g؟x J>V)W!>M\,T'Kw޲TcJ qU+++:[bcl]w+Q{<O%`dͯ_g&[ac/̲ͱACі,Z;pJr()/l6H[1xHEpW{zuDp_qRȔ==z>RS_ԖTt"|O9PT /Yiu8F,Zf EyHNLe_U 7ڛA0zt䭋>8!p:;宑ǷUK95G6:%x\ۋe˜U>wMڅk%ѿ}?rrt0:*#Su{gfhk!'d_LjG[Q~M=qxC^H`0n:̛az|2-ޣ-פ"MU+1v翦bwմ=Ⱦ_S<ӾU0aqtͿO*|vۋ;V}p)w$L:"_{;PwBkG)Nls1!2k#4eÐGr~C kuLc'ij~S 73UzbI_x!%A=wۋ 툮ǼdKh'hIo aZL.K+coN7%>V& y*ma> vh->cEڌI6֍-kZ~5yk(#/VϿ|w9@ hxv[oݢG3 MS/ݭY]jzEu. c0o0*9HEgTxd& I)rV"[֩~?8ioLL\KKS}ntb'V6z?dѨ+q- rL!X^p* ~QnÅYX<- gHYRHb,[?/d*J-AuC=mU>xG:Hz! '~DTlfXm8clFCA!x2 F,Dћ~l P_Džv)\t'tBf^Jդၫqq?K-UQ _ʀ.Uن9E@bg썛-}60 4yGU,,8:**!Bphxòp6llBǑTn^6p$Jv0|;d u>R a6ݱxj'yە#\᤻(8O BgAN=0$MXtrޝ F'*}9 pz ӬnSw-t 7dp22V{3"x]C:1Cm]JkJC4`-LyM6Og3.rPƁ\bC,QZD0_8\(}_>Ս!L֖&Lmjԅ1JHc[OX_Vr/ F^ W8 ÿ(,/qe)H@oٯ8Gt; +[@0ߓ_ӝV- eϫ.$ϔ2@ 1JH,>ud&NW`)a\s 78>IYoօ\NUn!#Fz$?{ fR>̝klHzAh׵ۯ 6p g J%I,EF~$jr0>@Q^\ p%ᆴ:@T bFtH 6:Z+vhyGѸ]֟9@4^H dQ{ qqt3f uCz\_ vV}~OaAIiS(wh;%;fnӎ)T!b(5,E|j|m(RUMCPKcэuC5qP(iRaR%FKzJKXSߧh`#aUIn δJ g;Fw&B8++{g!7] E`W\۞>.tL^vV`Y9sS]Y2Ԫa'3*DFdAINVTTg`+^U ?.(ex"WKx Eqy=;tZ|PDЗ~KT~+ F GJQ7|@PǙjR.<(=%O +\J\|w/^ovH-ߧD_C^յuLy$hg׫ӤV*NKܣG0WDs6.fg "ZhQ՟2vwƒ6|cM ǹWHSkP:)~BB)"< hI]_V崫QJo/2 ƀOHa5. (uk ʝ99JUnY$fu(?M/OtE]$2'!ݸJiO!ؕm{Ƅ!Uk"C ~rNk %kq{(tHP/ ~!wW +Ƕŕjx_́[c}t"aؘ I~< ea!rnë} `nfQM)׾baث7~φ˕8 32r$餬EJ8oXnzY,Ӎd{#EODe1{;+wRoO\|uڂ $CxkskB230 K`͗zM6/bK;/n DFmɢ<ć˧ ]a Tl2sFQeJǐ`VC"AwX%JβN%'c*9)gqu+޴$N]ʓD}?1=ŢqfjnЁyu ="CcZ`_;MT[OcIkfF_ͻ-"( bk(t]%3DL ,2yu7֫,9aB:A!*gAtW7C8)™BP4ag$#{$V ML|@8 ^ \e0E:]+$>puzH"%'/ؑR{{-Pq|+­ZjeSd#E߆QTݓ#yv(fo'Rܾ0.".6V¨CW9ӊ#4Ί٣ x(uDO26.AJ&c$-eFB^L7xی"2J5hUM{l?061,zJ) @%5ٕ@-}u0ofz9rta,D@G2 6`uPLAW M`?(Z4䚮SLw`;EVcj-]݃2)U5PDu:nz PRؚ/'<#: dja(Lu:~ djc;(fIu,o}sS2 9p[ 1AzW1^.8Z~` }ƯF4j3朔yC!nEUx `Y^Nw[f4}`ySf 3`YqE>clr>"BTRLH3 w5/ܿM.#KfTۡ-=w-D~o_YihD.TU1D H*o)_tr?w&~haO7qE(l3*"loÜm2=iyX擊'TǏn*J&jp\9/ 6 (8d%$2/>؛% N\+e\!db(iɔp \a,J==g^zOpa,+íO`x, hW&,fuoZ2uL?lxQpaF* ψ$lw|«1= RIl\ynŔ<76W ^`'S^ XV9F#yL?nj v x*z_SPty=Us.72@YW cQD ml~[&ܑe ˆu5H!fF)ed*96=! ֜;a!qQތ!2i.j+״Anjْ>g/UVLsSrȆF?{ \:!,HULn;u@/vM%u@'R4H?KԉіhX@#^/0a%ÝǻDM: _#J GS)>%>h @I'Vh-WXN+Nզ}pgs%|P1C}8ZEh8W~.5 ֗jh ̻B0}Gю%tN!Oj54mUt+Lu{@9+se LEgYo7 bHq}4*g6wj"wp=Fk=z 8ZWCaRՐ VmN I}jVB)ı(IM-"cF8{Ɋ >fܐp;_ d)h[K)Z*f_APex~ܛAyP,(ð"#rV-fsvK{ $$8R7L&8xvbzDN,1pfф/"5۬] E/ ?Eӂ] >~~ wwAnB\ Oe+ U2,w|.qQ-̥\.b)DWڗe{:* '{O40/-ztod<΀9#'ckUr3ܚ,z=?h ;Cw.oua>K $ <(٬jj0vNv "8z#O7n7qLp|`uZ/NPI3F̆*xAOPYMo&ie^ =5M-8MxLz]A /\te^䞖^ tYŹg+m(¾jڶiEa?KK, y3 {jӀ3?!e ;MR $tsd ߐ+ْ2u=-MxdGAoR|PJ:r' ˾չo;0fvcBl<658%HM$G*b,Brf.~èi)+9 -B3Q@vl#>2-(v2bS BV/TO@-gPt'_6~Q^_h|0A$^n\͈=Hc.9Eutd[ҭ<{3oK4#-@ZY o- 4XtA#spm -'|j>_1F 7Ӎ0V)+t&Klw9`ѭU`_EFP&MmΞ2*+HIF !x=ؒW*K0àI?kCtʎph峲9-i005I}aCi[)`;geF)r}L3>ɸIkUQf9aDXO$͌ =7p>k!]⁤]! '!}}]E{o:Krjk}ߧ5ht*%c'T@ŕF,5sZUc}cƹ`Aщչ3l -Q#(Qv4!rrV[R:%zPTIS&ˣzj+w'8۲@TY^O4EE(}UZĖec?BkW}+RTq<~ ?o$r_nT;|>rbh*=*B` XGY1@0Y4Hg`QB5tʊ6Hds&2t؀턖>X$ay8 > y\h ߲q\v,ɹ傄b><4vVxxHHֳ`6*hi2yk2Π6hUܭA\h!\2-ӌJ $|މ>ʏ}.)+~6bBbU[ePjZfanK.~tI\qe7O.%*ƺއ 6q}cLYyB~>)bh;@%dT05nn1 I=ݞ+2N eܗ ĿzvƤc o7ΥHe\ʠhp|_[ŊMκ qĉ=?XK=wiYaHJM\Z>^ V)"İ%oփtUJlu'&z̥ԅQ|Oam{00źok5#쨛-ڇ!94:N% I:PS@eOgfK-/5{9a(_sk?u(>ۏuػ0| A\qV0MN)~jDΰ!o%'iKkfm!iv#zcVJY9v/基w0I'c9 5R?Qo7jJW7n` MCRc=mv[K;c3fM7 ȼf k8I˃K:=o5Ii$YlZaXrONW '-Ћ1ΪOAu<^ 6vL.FevA{M &[A4ɬK6 HeK3`nft ;q VU#roUv#-O B/Ϗ'" ) _P㞘B= #)Dˉm+)z4fIש];}LOf"YE#eLZ_v!֡N,L_Gê8љ&mgH'قBf|s<)ś H-^:6w򕽨' [)pu22jrJd_)+_Ȅ&.XTy<9AxM edԋ-G1) dx%utq" O,yw d =]Te8}g<1xnz+$6Ϻ=Oꈄj;ƛWiQؒ@M\с i"֍zs5?ńy]K{rѭ9"A;{W+#6U|WϜn \[*9}ƈg.q!t7vJwwL8+iۮv.{رJғ`flY%*ltE{2JpD =@@_c\!x]xC61nyƉ{Ed;:vZi*ڎy9+!.M#G@liAhB>רcAI0 T!%B^t!q\id΃6xIƐ|*"iM~'!(ݒ;ӧV7I9dfLx VMiWR;?K!kR[AedM 4Fj6bY΁O%rUǸJMXfG1eƩ HQ4LQ% Ie-U7A]s>1 :-HXzr(@*}#减 H~]^L~Āe;\v|Ơ8L'"o/Lm.~jD%*ݽ %4T-g|}OGy~ˠ]B՛LfrއM>%A;@Ws.ޔN5o~F+as4Ϊs2My8>l>$mV7<E`lmx<ʛ+E[x|'IHh!9$Dz_~{A4>W(|8xKjGF[8Vn2Cވ̌򹃚?oZCBKYiPg7[7AdC!9Wh a&FAAra)|nכ jL?1*XLCj@2pq$*`i `ю^`AYos{@|0ZJ8bGrM+~uBZ(&3,<ږ@dC8Ua*2tə^%+..Jzt 1e)pUSPP!*8*L_k ōJrsl%4ٶ b{W58 Qg0cuM!#*#',Kj_/Yӻ\*eEIC0TI`#}|9*sz&θ\gc@τ_7.fA#p׏S=>9iyLadžk"O;eʣGg|nZQ. ѹQtܨbe{\kbsӿF hO@9ÆW/Xt{!#K:.$9c^>/&ʉ5ʨzh/Q ]g+tZF :~+m)m{qnX_L!$i$.-$ 8k]ˠ4~#&C $@ xGt-vۋ(1yqi6:Jl2y/+cç%m:Nu ᴌRRk u ;~gズ8/ױ=ܟ[Do-WO[tn6&[M-&3 c@k3rygB3H~z*ȦW(9=G)΅DM±'66JY+9֎X˛{Z̊r?DrU+B`oQ3 ڶOR41[|?$!@2bfzkxYf[Iam$q^͕2oM'?<%0L pn\GA,rPhHtz w8z68m —. j+]elxMQr {%v(6a7m-j-˜7 e1EiU>"doGqz ȥͦa|0v-$+T klF㈿iqpPrljZn}xTn`U{ sX.%>ϮHo6D5!\Xe k8A!MG;/Ӓ84:`Ņ1 /)$ܦNR&:F 63j!1 > zp3 ~mO9(Ĝ_hHv[ Og χPI+nw$t{N^M?dj{TAN[mN=7Q2cY-CRH.C_%cJm.R<0!Q:K>:e)RJ˼gΧ#VT%ٜ v00,'PR$c3fپJQ>3zy) xTc$Ι~C#,ϲH-LH}9nIE%' 7񴜯AMzٳ3aX@T#0T⍥K'7[hsOsrS|7JPwu+l#M e뀖 *Ʈr򁢜ڮNwl/|:S3jғCC("Oh_{]*&mq.̛fx,(raBυ,~3nCkq{Mdk_Fs LvoWm?200 }Wc 쫡'0/V H3HEQPO̊[̏`%#GS&G^fx( 05iX|H|{9O&ש=F%%zʀg ;3 `kG5>|9owb/ A/-]yþ(Y ͎]sHnDԹp[v‡ ^}F#$a2k"S*bZ_줁p UAV3u,P3\;|/ )b+d:=yQC`ɇ%IL7̫mwLJtMK˛l:_:#Au e=p6/٫-`7P٘Q]˙={xii ;c?!fo$SBwcgwyDZY׶xD*ncM%h3T-ʱxqA/ 5MowM0hW_ mNWŨ6gLLȣmzƶ_Apzv߈㹼U{{IpN65ӔG{Y0 00S^AJf㦤IUyaA̐x1׈w +Y=޾T8}?(":͓cn^͡JAxdirH61#@6'q菪3e@2z&gZ}=suFf*w*ӄyӕ]X*Oz}!Lx$tQ; :ҁj$ Nsw 8V;ꤰzCh) Pwv<@sÅ,iKTz : o.w\cwb9jmmܗ3^n,%(dgu0c% +ӟMoǞDS&3F cWq Ǫ7CXS*SoE!. KeC;uၪ<ӵJs`0lʜKԣ2>lV%VdxHWz TXEivګ! S S~ۧ61u󟾍 5yP M?f . 2o_Ќm ]U#K0VoB@`b#֖9c6L?tRHY3O2q QknCNKB{Es:n,%ils#@V•t8ǃjh4h\7 hL&"<"h"4Ufp6ۘ jd<¢Ժ:iI,og0)ܴ^ڹwhg; T,wx7 m& ?.NB S4SA9uwt| mi=D;p ¬;jڡ`EJbjPLm-aknFnߖ{q<)l >tQy.b 'y " 0ˋ=p7`,L Hw:S+т=] W[k_?@) ;09x /-۝?lrPv&L&ZN@z},J蚝䮌5/'{e܇cۍ [撉 |cyɎ[=s)J% & n{.,%h,k`/v$ZX s_Jbj:2<̓g}[$8/|De ߆';;1⺏ߊBcwr|] `x;0;(/׳xUʯc9*hz3Nᗂ y5G|TCU2|t h'[~8wrf.mϭU^EX+^}-֭{H9F>Nժu0_{ na16H;R,*$gҳUp"kW\>89L˶zֆP~M QR2/+ceWH GZTAEµ]pVtNֈ΄I 2nUM+{Y ́I{bB 9$=3dRHO+ԊXd?vD#3[YW1X픗Z;N﫽”Ȁ\Ţww󉋠,)u]k,u h*Ş,X2WɣLAfزYr8!*(eG~x`G+3}s1XB8w!,~ܥy u|_^#(HgW /e_RlB2 оzk!k9q&`pRѼR|D?or-tpдbì*0u5 tI$܎)!JK,bjGD?%HO#ͱEx͈|"3 սbd|l#LtaSm:>x^rc1x{*UZnؠߦ:HUd(=v<U?+$B M`+P [ӧe6EO[³y24L/9E,U}dL; qYFeET .X FRrn(@{?Ih2?}4.jT aQ 3Pi-ߟ7przH)O]NC|%uE0Q㨮ĝPoC5[~f_#! L_/Q+MDS܌A )W)('vTPrPP-AمS*Nae:GOG7`la%[ %i'`Yoeؑ+Ws;86ň2O1!DZPf= \0A2pA2nT# hdAJ*m@["ap}q_&45/pD7ybيVr{ !twjBk!T>kwA{(YoG9uL?KC[! Tɛ8`WRa_JN)xdbjtw9_IK` +[o{uPq|T _*S÷4e6'T'_ݼV䶹Ҵ/}/mLk$̠dϘ|8`ǃ8hȸsq(>m1\i]s3tKKkEa {jۃ{61U@0s̚j ʖyPxiqV:D?:ws"-k9̓!ŧ$}FhN||"Y%{c?Y͜6d2h,̌;Un$}:CҠl8`EU/U@m3bqEޱNT;1}g#Lbj?H(Q[ͳ+D2 @MڄRGym4[qE ٜŽ~ؖՒ/?$hb}4)CE5A'eF]yDtK"OnunmdQn> %Zf[4p%3mKЦ භ"4 5":|,րW*Tfij0 COg:bWg[h4';hcDrvFҰ]iD1fTbq?4hdσf+ F_tVjʹlhfr^/]k(\rK~<3G0u=Iq%E,[BJH@XoE׆c*!S/dtZBuϋp/сlCټ6{|,5nf좾VOܗ'ǁl93(.v 5MBhGg]OʏXaណ!5B)t!} Ρ,sbRk.?h-Jwl&C -DK8ظD}P1>v86e[ ܵsT`c[%ETY|z4+ uj9֦=^ o݅kcX"جʁ:- 'EjfJW:h?h5+ ǧ-0ŷoQ7{(>Zf-q8PhMMsn?ec"k\i쉁1e&aԉFU|o_hiG QoҶ*^̔--|HMf8ޕzIZ \>)aIP%Q0 sѕ 9p'4t17Bbg(gD3u;SOY _m85 GkEv;s% ;lɂ &!94(9?]ƒB Bs_fHYg$wI%'eY6%M2<dzN}hzB[޷*\u @=# ?b<| ;ͬ; <- ;|"3@9)wr}%]8UpƧ[^;ݡ*52^qtEciP]"zg }agZ~z+GKO ou{Y^?+A~ 0,I^%Qb&}7 $bͨf~ѲL*鵙y qx<=CǎL~YȗcX-ÓZ?93& qxy@@L ' 5 +MBQP<ѳVsgHL G[XqZs`N;GaSЬi)FuӁcShqҡmQ iQ\FTqˏi|Sηo(Q-R՘Ư|m]D3Hkk>6WT?cj"!\I$am" }<ͦ h.; 4&y? &?ْ?I Ɏ猂T1~s[hѷdҠnN 0]JȗӑGyhDP0rY.YeM[~:ZɟwŽK9˜R3ha13>Z+~Q5Κ?H0ٱpUCsY&d [(NWJzQ7p&e[^ xIl 2DuERPb܉⣹Rs_&Tb\*t,¯4BHH'2D~c^Pުھ2qrF5$i, ^r(I'rŞMaZ+t ޕ}ܒb@XX8\! z yN[;gmL5B5]BrUW괡Úb4X te!uAeۼ$AWd|#S0Y}?\7=.שSÌۖ*M,yc[9Ycx*!vk=*]lT\ǻ&Pיq 'MeR9}Ŏɱ؛hI]ߨZpj,7]%D{1bzdqY L kf-Bxlp%8<ذ }DBE]4X܄&UlQ}xǹ :'6zHiJFvRt㾐H:JvԺ2+P{ܓYla-ř֔?ASaS t +g =.W5%rH#~PgLwWnUn>̊{ٚ^XhGE '"n i)>]x Ĝ$F1mvi Q?,K[+=ayN)[lWvU`@ۄ 5PVPkumFtqyB&<$9RE)JJGĂ|<Éc Z8\ ol`0.Z^e2WjaQQ1 e[ҍTVxwg2[=C|;w|@gY{Xu-E %H(⺀IMnV&8]XwB}ۄcGG/٢kOfTkފ03}Ҋ䇋}k)S o\CW0jy2ź⹭iHHoO\ 6g4LA,4TMA0e0? )7q"Q*'lOnC};CZ& * NWĸ E Ev>ꞏJ] E(qSS_r v p M.Gcѽ'\8lU"RN#ÜTA|{ä{j0¦x--!ɨ LC2#.R)?l'(];`aj&Av>`+h 0*1a0{y8LH_j 9wÂ̲V/s:P?< 2X_P޾2ݟױH.Lƚsu9:H9a!7'$ub7v(J1t2ИYݷDaqfQ!&5{v'm4j5}0l[oa%Xd3o]"*~ :)3nzj~*3a2'rvGJOJE ueQQ%\h$xPeRSo&Cj.!4經p8pZk,0KOK/c4xX#;Ө(1?mhyNs]Dy3HG$ae@J.4ď? r5r`Ueq%rrPyFYAˉ"qXDWnp*%v 6u [9& 9C1B#lhإc|gh~vdIg.wٿoܫ* 8^X?:\ǓϯkbڞKAT&[r2bIDRs@um= Z B %[Z-mՒٔKFjsViRg/%p|?bƑNFC:1MӀ RjDA8F~?g#0IaeQ,7!rUpa7^c}X )9c؁ WSv> r8a r\3(kVerrlê) 'ĿZԙ(*Xȹf`yW+䉽Ib%zF屪]Ty\c"AыU` V6VF05jvU)M+2UsJ F =eb5oNF/XK5+Y(Zx&ՇS6Ci2)ve;xÏTվ݆'j%H>esźf~h *{zd|&/g'zqkGa.pOvhVȑ87!WY4Iop-]?IO6S>b-N^R/Iz2CY_jxEmDDa>i8_uQ~%d/+_q^Yjcei+ @4^!X K(AdBLi2gرlՐI*h,"3*f]a諁uBM̔.G^vnh@6 =D,K96Ʒ0EyP 0hq$`FFs"vzMk̍1lg-ioN&HU?b|6_H d./t ۳$7Ur"rL׫r.fֈlI@̌\ஷ+])#y)Gy[OdR+yI ȋE7Srb}BoJŕŷx|LjofZ=.BX*ZOJI7 聍w}=8X&(8H[^ۄ|i[3l`4e8Hyv0* -ҙ'S!Yl˞|wԃ(ɫP! cLyѓ0CUiĢ!:#wA; %%&ĉ֗BjJQ8\%46_߭h=Ntj[¼%Oα 8.[[p/N>Q½7tS_̕S;j3O -7Q<gjhPudOuc"PWYʃęLQ Ovf=KZ+~e"Up< HBI98[,z/>Wmr}+fuvI6Wʖ }줗7h6T]zek3P NvȬ3纞ц Gz+׸OPY˵S6hJ^KˍP rvU's497dZ}@]=uq:?hkkvTgPXH)Ž~<4d ɠYHay̲&7^ oes /z2hQ[NXVݩA̻$wGoY 26 8ˎg.*6V=^?d(fJ@V`0Z,] W-)\lTv8L{ 6|U-0 Į *eҕĥ=~ װ!pV̻ TZm-rW?_|T q9"!!,\J5lHq B a,  o5y*ũ8*fR,&5|.F-Dz-;AiT"&lJ/G\9,6 N2_Ly |/5N"j9o8K3xwwCbK 2Bh⭗TXKC&kױh5؞쓐Y~Z-~өiʼ71Ʉ9Wg l|! 11=xusXVZd, FJ=RV+M c |T',=Ifu!H$,CV(`pVeXTDHyPPmɖh@~\3Uǁש $?$vS;,x-v 4 epIs vZ6Ltiw1,E},SK+Y6i8 "8ԫojϕ ٌ98QJ: đndXkٵ4R'!eZcUc#۵Y@Piڄ4Ȣ}^=gQ{6R OynNsʶ+%b8-# Ԧs%k/5c$ E\DW"} &DL~1$pZSȃ )?@J3 V3|X_&ދT(BR0hQ:}@.4) 3em( IP@K 5NB/95ڐV~,DJ{آNtg`Ty6 ]Tm1:v5hR젦ByͶOc鍂ӽv{´5GAۃDwi/cX6ط,O ?lGs+AA]VBJv9,Rc$J!u ו VH$a22AkGVe!L%0iƒra^v"4LGl r h*'1_V }IB ݾGEWHH(i'|pD5~u8 <\j Z5FWSr}fP"`j#gK;cs)mj{b  yESgsYD KI<8"HP|]h7̰SCQMmq`ꆵ>;ZLS:\;NAU+MggMUPq3d"ûҪalfsU0lttWX ŕM /\`)z|h-@f(gztyen6Z|0>.o[!t.bKU|y8ΌUO^[wR Z']Et0i TDk}))6NfDUZW*EF^ ͺX?G\ئ7 GI _{&Ry%^R  +u5I YjA\o"+%d sec%ȦDEHs :~/- ҟJ0*$W`STd6h5ϋ?2}6r0` C|a?ЗVǽZ[F|V܏K_e-wc^Ðe] ȤY܂ 8R&D=OތqJߵYU*qxcD3::"wݷ!Ͷ_)h>N\?.0pJW2݄4>#Ԣ<t{ ;eI[uMׂHpnvs p(`_/n]:! ԞbNFW-lMz^\",,~WsӸĺY+ oHUcNDjF2S <,#0+"kMS.a{9 rB9('u'B?dzߢ=i.k{Hh]h =vW#ԃ=7_S_k'iߥ:tOO#Bt\_J7pٍT)&\;G+Gh@ -zbE`PZ*,%mΊ;uP勒鈄Zp3cgֶa ^F"t6]<1oc:gyӞthn5!h?q,vl"Z׆XP+aOc4Tp Ǘd3^ ަXcaQ zoڍsyd>^hרS{Ĺ=1ngJN+;V/,@Yx0ٖц$ fw"#_Hf>i˽@;^&6BwmHF$h*\/M͎S&nO}eR(mv򯚴($~@}b^Y$!3Gs0$@r ;;$ ߨo 0Cp"35nG,& HOt .~1Z 0j( + Ν#^Oĭ}ZytE챦FcyNӧ&~{٥3KMɠa񩜂̲Qz 6 ֧ sT:2zR2"uM䭝 ?~e'>7NL5/glBT9Rn[ApRV7Vz=o#g$/^Ɣaa2O*{Q[hb%̡`VLS8.ɴ JGUL+O+noѼղ |$?#lR m_ ۋah,hO"_Cьx8W`\ay$teʢ{3J>@?_#%"f/=^E"* Ar#ּ:IvFh%'_9e Pjq+Bsqث $U\<|~%"ϑ=X.8X' U`HJ踓)0fQa>E= P6~E(X$?3K藪KerWzhur7̗ٝ{v1 ;KAH菉tm4%9İإW`pvPKL|`,%lUry /N)i-! ǷkUk@ F(Rw(=|D=EVYx@5`v3KI)tr.QVCbF&%V{W?|k!0q\LuN> J]XPF_6$uFr) L1FlFH{e%E1 ?s8IKMpYGcM-? G#ޑLJ$fT'ջ%ݛv//7 7Bx;&6,"3vuNo|RqQG8l7YQ>_v%E\=xS/R=?@`SW ǫvȮܮtZ\߳yH [73|3/>F |4(DT h_=j4n^bqwޱ6]l x-SѪw Bj07|9!@Z_ h jB4D #N H`/Yt'0`6Z *1/-U!bc@S":{3uF$3 {W埽OШj,#07CKgښI.}4؏"7Jf/i@B.}':KA~ZgەPY#F- POG7e ˁ@(S+AvQ#9.{yLE[$%.cz % c؝OP upArٸa]w2JJ YT \Rf(0UTa:@iÆhuE)ы  9-ARdvvT4sih#3u ץٽh>"M1aOGHbVa89A4aE̺V^AT1 c@Vy (~ Y.;O %ӕ# EhE8e-)R}g{a癓u-joZz|y(kju5Ɯ7*Hm,4 vǂ=q!E$N8}COݤpgm`6uȖ2 7 Ӈ2"u,,%F"=bQmpx*>w *+*҅A֔/VYxhCY'L93 S?]jjIBZ0Չǽadqwu,ٞG ߶ %LOwf*Pf5篆U ;R :b#$Eh׿V@`M/gc''nnYT7^i_!<}8Une?r&vtZk&>r eM-'A7t;T2ff Jq_Jbmԕh.hZ~#hZIp( J*dόUttoQvlƶ֠: u&b[:А_<ľ3%bz]6X3t$^l{_"Oړ{AQ\ c+|8dS?Di4P,37![޸৵0}^w;h"jgBÛ$cB-K=g ,,AiP6;4O&IvF f@|E?&=:kCY5QGVΊDgILO K'HEaHFv yoGO#*]bx[[?|6] `̶I]rd{DvyFڊ>]U@4+bQWq\]"8sym6u?'\<]޴,ivcr I!=X™y˼ 1l;m;ByiTI?Quڰj fJf&ik0$vz?SRP mj$.0@Y,U:7&胱pW$sv[*ۅtBՑ%~Y dGtZIiF=' neca[pȊ8C.vAtӖVyitms!BG (r!]jV4T#?Mg*)|yWS]<7avvRg1 )qh4j 1"fmRSg OJq2lZm,++"JIйvJ4~f)+N:rT:5kDe籂v~De?AJk iӭaIlD,<ҐqWI1^,=%j@v`#4$VFgd:TPdz?,Z+~tD3=ȩ3)";'6n 8 B0ΦB(VO㵅ӀuE/ k U}_*Cjѭ)+z5ZbVk u=]] kQ{.m?$)U苾鈛G%͸lLDacydn7mHlHϾ>]H"X z]& <"u^鮨T%-myYo(DߐW2YnȆCɾpnt@0>ᒶMyngsWe sNvm3-?3_B7_]Dgz$sa_׿ $ur4mMgKN O2?㻍:yPqѦ~vU `˵yG) beǥNԦގՓe+Q*s2i"tѧ+ |?<)pWa.(mR{a#onoa͆Y5\f~Nc>c̢[q7`a1٣BF`u¨: sak3414v6uLJX_iDaW-(Uχ@,9m|JSD@3eZ{ubtV혴H[Mn˲'3Ұk๭[Y0R!`͟ב @l1VAWktJߋo0׸q/x#cf.9W/\G6@QmLK{(;NO^_R^||Q"c\1-XDұ/D[Ⱥ낎]]@KܡGSRA6@߯y!ʋ"Ex`!;f"6m!ҽ~ AYQokrj\ux3yFMD P:gͺ.phaTO4*tu]ڭ4EUm4 MRx1wj3φ4pJfփ1AES} FtN#UEP `Z!jHa8^+3pS-rƧ`g&$r'o5GԠ?G.:<]fT %,cjM-séН".Qz;Xs+JB#OO03س+y_n)ߕQWaV s=_uDm-C+0НCc~eiC$5rȚa%H@{#[G~ݒڍ{ sފDɨB1sX`#0`s)GKR_֚&UL3yǞ 7M 튌B<*֕frTXԒ&.ަ/r 9Lp=3BWwbCkupЌ!'>j2o6zyŁƥfPPL{ԟMPۥC׹r;PZj k6Y6VFQI_]A9#b!EڏsG7DXg\*Kv,oïg#`X[>j\$u)a,j oYY36fFDw1I=N{az M@ ¾'1 W%;zFX.XDnng'hpm,Gs%GEbN<9BZy3y 1E 7/| ")}@~Dm(gpZ)y g' l<7P/(ɩ(: * fEH jW~W:h¿Q '`Sc ski$oHsڀLGfw m{eEzӠ6tOº%mw/߃AZքgա߈+O%B 7F|P'2_@!KijhlCk _<٦z0H4TU7 {'J]X?+fWHX RE&Wt4784C>DlG>R M[ Aݺhk3'Ҩ1=|yP0}Y/Thđ= 9ǽvD&>a0T =$THę^c,RavêzWV{$Jj 6/,u7} wDXGh$]*/~%8{0DfdzyVo@m:꣍x]V?4[։OY2Κb i-Yi 㪅H~j=D&h7EC6"+ ֜,ӍbƋ/ijQȆE>Z_MOӷ{ ':@*NO5޴cTiU2L^U l[QZܧtU 4ʲ$@Lev]Gjt<-EngEj9bBYlg<0ͨye8PnN`\9"~O&508x6̼fW Ku SłWό 6\RFR%}*dJUyG4h_L(B`Т_Ԯ&6r? vwpksXeNg)nr&ljqJU4c;UJBbӒ8 *1n"Mwy1[8-ۜ6ksTh3c" r:?tnYlV?t{8H;H|',[F,:z 5s{ȧCdEEk,?1>ѓxJ3N25I =PhqM)U$]y?[a|f4A:6I*#{cf M)^_{yb˜V  ִembスJ^xGgxWn~&ݚ!X2xޕJN}$ X(& \{cqDZ &2W8 {*sUqpFPͷRH}Oc vzqd<*L2]Gi& IVspi CrG+;D ETX qVs5\rFF%ƀŏGYRɎ+\Mh=cv^=|Cymb5٧d<`?*Lp;a u-l}?ν= UZ^E;B=IKUg.,9_ /GcZ0ξ>L<D/쪎D:[Q}gKTEhTBwzw/ }dl P,ΐXde!Xp Z 2E A3hueQ.5rVWߓD6Wt?(aaAI?GPq:fv]&S7B.*[gvy`$967Dn[V)ܥ@WTO/1/ܤiͰĸ:ء4V%˳ܩ@3Eꭞʾ;t|h-#Z1Qb c!E}$ yOϑ5ېtGBTM-0|1~̮1w COj)ᆕ'2cYpG!EYJvt65:#?gYn?9/bE{TǓN>j܅-AU5 8AAovȺosBtdLh#'C[W ,l}x&.X.;Vl_K ȩ>,?=4> ㋵2JOS䐙!*؄tTd>븩d{xqGet%?ssQgIz]qϋԅ!hp(ԋeHp2Krty9(˄5qoZ]I]WyG([T&XaMq F8U|4З21]3!}Gzǚ[oS#]D:&/>u5,'bXJtWo)E5p ?ܯ .|Kadb8qɰXBا:#^DjX60?ޅm$JxTXq"Mamc۞~P% s'*Gc\h}Zν/Q^_ZQ*̍ynAj}@s D,L_oW'fWHovlh00=4wQ;SSl+-z""gY1uOuڢAp&w YLΨjs/ \J~:syr~0Xm cʸ'4Zw֯F'߀2dpJk4 ""2bcv]UҖ O0 EX%q=_UN^uJAjr+sUePrSyбЙC?̄,AAJƒcs KjMӝ ό53r-7# A !@&Y[}7FFsfIbز ڧĪU1񀡢le "<=C`4U%8ELq ;p\:er)߯ڕh!1u͑SCp8mV)&ZNT:@^BMoQ,[B@6h!P ?:iE1xb*C0~fߝj6Ŕq8@VL>޾JʻE+``T1CZj5֨;͈ݩ=\pPL| e*%VAJ 8Jrp6 Gt˄3n\`q0)j:[uh@۶[ ȕc#ەꅓ,c;`28!]k>qѵI1jό6@b)!|$Մn^)Zu%GQzЏ-ASu U_;Q2 E,Т[8K*]B}l At7+Fz,~7S8?4Qۏ"6Q=ҏ=RMj//DxB:p,:% ~D@_"頌w0"xAԅǔ^y8(W Z.le-.jD,,>iwTXleI:/%&%G=xYmh\NíL&c%S [u޸8$OFs/ kpMw@XF^ +Ѡ-[O1]Rv UaugNjT@joNFɀ!VwBsOVw;9 F8Ȩ9BY1  V(^H#+76p18YfC0#yZffuМ^s?t>ʮ:W|}Pnt̺E!ƶ5]$ %i1`j`c-Qli*myW`hvb~_'T+t# <-8!iE 6@%"s(ˈ]TZ-]D=X=lmmRnR"~^mI&w"8p|:܀Ѻ9ވ-)*_4E6 ;QĿU]:f~t䌭d_L$h(8eHgxD0]_"a6jC9(ԕ̗%LT-1aPT5;z;G,sog"PsRm6F"ċ>چsc-aef=Țzt}ՠ0UPgz L6Jic(*}T5Oq:YZ[$CT放w,/z:T2_Qg7Hj&*e!6 %Tgӱ?'ԽvO"e&'ȮPʏ;~ 29VHNu r㻵_mv@0gz}ׄ79IFϢ3s/o*9 " >8 cZ/^Ɂ)JUS/%#R"uL%+ w ?; <]'aR:JGŐݖL /yR TM.`cPds 7*vK+ k_#ZF0!d":0!Wl-`m9u37bʵ+F?kbJ0d6^>CYo/Z/ Ux(R> Txzci Q~0aZYBlzRܦA12q(΍ d&'`Jt-A_ B!fM:P=X T VfnI OPP Пn\ؤxdBP ޕKwp.rXf̏~HP}eN,qT82U3QxNxphZzrS/Ssј݄P6/'Y'b}&S"hwvy ^o|"ԯmr3ӋĜ)B hx,=ZSg.P^ s٨cHϞum?Hca jVm4osr%d<&OtWa=U~U Ͼ``GJJB52X#+2מOP#\I :WWZʇ<=M'<@3t K1: S cTڎ ΦۧBliLN30z&+|Vu/-wo\=#11eLdzIg``]x)H% 4Z5ldLsoƫ?HDOd~yʑ.ah)Bv;7_Үed*{ CP`BVwC{-!d"DaYcDD^S_0ia% E}?j},?>v?iGt%JU4NmoWPT1y#_^tߜoܿJ8*)* 1/BN4Nk/h| Iݷ]4^dv(%fV&#@Ç"BH(S1+֪݉|;cfG KH=}YXh;B")Ybu1;᝽ j::.%Mn781Ea|9$|fַ"Fe5ΛRPAyĄ']^^BY̦uJBzVE>eGYZT21xL5 <4-eUjn%U<\ 'LNCᝂ)MM.|OS3(Apb6EC)qGcA`= r0׺nDtM+c3J.Hη*R];m预vS +M4rmcW&Zn1){Dk1E` Ecxw7nHlFHsB7'+_C"< YW%DIq5o`J~oE4۰i"Cnq .`MϵwaLO~ƳvŨʢ GE ob4ʦHѯ్al߂j8c74X'q|6/WSI$K;{ .0eqAQqQS1:X Pz{%DuU] dIN5²Mnʺާ|}Āc|jlQP8t(;TUm@:~ 1YrDgF =PH˃9$3GtpPkkvs3 @Ov!/x;jBoM̋v|aa@T_~ӦP@V̏~nX.2 6+[ b!3}QE*MeFA 2\*+W' u<5=c &cL%T+S*Hv{AQc6- Xw.A悲GӝeU vz+bB*`/0&}=5V.@cKpX}<4'i*%c|vʮLڹءb&teAɲ;:,{%JFRPY&ޠ'ȺbNӖ9U1WVyFRο47%Kl{CXTd&uÑ&^O2 M_3a}ɾ!1gU vַM!} wKlxL\ToU}× [jc=`ܽbE*ifT>o,siN xSMj_`_f<8('uC$EV+q.4@l[;h 0(`\݌[7' 8FUcS{}W9=J)3oCLA-L:yܽ13Cp&f7"ײ￢4&^m3PFt|Cz. 3M0 Ґ #2#8P Qq!FWܸV}o ps7XM)Tå':fU63zP!Ƭ77mP"zEh[qHYlڠ/MʤTQh*FE9C'sz3BxRБgwEj))p% }I&}FAp [Hڲ(T,Y-s gUL5`/yJ<ǑyI%&H]1h1d'6 }#y3QK?曔Vvr4U/^8XKIDtxsGO&ik?D,M_AٕC*yT,D^E :|(b~q9BZ/`1Q0Q!W]P! HCU|U=L}S>jiR_6tbfAUNEGP|eYr%"'[ >XoDpߤCx1ʥ]|>DadÝaO@|LwS.N[϶5%MyriÆZƲm+zNUC9-ZoK9LY2#0!u"DK9ΒQ@tvbT4]΀G Ni;xy`VQECkƁ/bG(S@w ,2{ExdTAXY^^2h֋8;̀PO8 <+nf 93\E(lddbX0~hW $b;{RQJyZx?! [?[fXHk 4Ccke80I"[U"89z۷{ʋrAGȐaqz=6=sӟ[j"iJ,:>X/Kr;+g3'Dxv6"8Kf!3l&&U^8>5~!2*a VO=B=T~?tajnQZe>`%{=rk/m~'К, 190-%Q{7e34C% 7BjtL R$=6#Gds\LggYcciШo'y[p~Ц,CP@p& X1r{!@uT0Ϡ0z%MmgnQh}اU=(=b5!DҘU81)'Nm5K|L'!!tG9f6l_bP'+CٚȏgPq+ U[dc~ r(!Vrԟ:?s#N>b03l\E>4MF:dZ4&*f73)x;?U@wЗ0+T9eALtG(u]+ymm7 [eͭ. L e`fhXnGЀP}L`+gE:Ep;t`|fͫr*!q<Q)c%`Pa6I|^{h|vsAǩϤw2_XɯoG!5ٷ]F p ,q U4J`#&w*GJPP%oG譩emB&cSf7J7$kf_RZGGR\V. sU{b;eE X7zCWt7g\ ?> w> -aI}s٥`<[soY{Mr1Ph[D.Å&< ­t$^?<\YʵFٲP;eמvzU=Bu( :iW/LXN/ Y%}a\uWC;kfUBbL|S:Cٿa.3#^1xQv Bq*ƘقJzH͹u~EtV]wc<=BVЈ)8JE+K fmS(wN@ΧgJF 3MW ~94f ӷg󻫳fbAY&5YUdŭWg\zLQ1Sȯ'Ar68gKWns؞`v3T$'/|c]4)蜕pZU.X{؟;:L,l*i}lhO#kc9JPZ4Z Vc 1^RPjO k~QaBõ);(z3ns?,>8YHZ_-DD邺R)WY,-Izɟb|&lh3-?О5>\Iz'u mv(%J9X+0>96EpZșvcfLsVdq*9Bϒ maCA5\ q_WjZF5AhpQ&jl -2uW7$=C,9ر/eMBLX>qެ#:gs( ODx 9}n*rfI#))4"+ :TIIoXtqן7y+Э]暏,I*&~gtI#m$0ZmU t=QRPftEc 5 zLN8fBZΑW`:h=`"E X5draª< =0뚾K_62*],e) "z&S1~nǒBx[;?cd Fƕ޲Dr`:ytryxYԢAe&o2+_HϱPTk 4ϴ]Q+Xj#jP=aP }DV[_CgZ7bэZd](,>YO12hS3yQxcDN (U4u)iYX>L*,J~XwNC}? ={>|rP=񹒩Rg}y M[C_ch!T[GqaaTY)`:=H.I&BeQ<8$oޑ2dhcL apFs"j5.䌍eX?e'Kvn[jWA?#('Ozud:bB<݇Mʩb%([x1zbt@EuH)o杹U>.T ,†MO_a8aOfFu0"/cJ:4'06fS66V@^Ď|ȶ]ZDz#k.EFֿL0;Hes8 >ٞ<'BՍ_Z;W[UzE2Q"Fdh}Hlmmכ3+H}Hi4I ɷ:rT=K17xVo WF:4]:+ N!f_C>)Y#u+Gz]mk{eOlJbqQ56iT>?ye-ܽ|\ 2Ep* I |6|6j!_Bd`MUaOq(8(~zq ?aYJ`"Yȟs$4rFvXz`p95;lZ+?o)$ G׬R'?3%(N!x5!uZΩgS~&.: |7SV|wmQ{foDtMxfIVe@\}ՈP3a o!a(  lV /2 m9o+b |aç\e khpb& ^%zJ 3 V@ßLh89t?v.0w>Ʋ:%fk0Sw Kc.9`\(^L)5w u0:Z%m2 qʤACl^lt*z ׉̧;=ͮ~Mx?GwyOFL- izܐٸ+y4@w$O͍ ]4++gL^8ǂ~מ繰G bGSf<CEB7v^fo&e$sܺ0]3'lX \sc&p̸=6똴6/_(?ۄ]Cz6gůuțv21_C|N ԆtV1y$ZB|6U_'޽4^RaKtˬsx4fdwdmu>}o:#P@Hu0`Lt (ULܕ`$) |?2]'(]1M`۔y-)&TՎ< \rhW-m\2JЀW"XfKy^a,9VTَ O| Lj)U_uRy#\봋~;zwk\hקb-7ZcaZlN2QINȐe/l=5ݵTp?LĎ,gOFtDz|]!]ē zw )޹;l"4EP.1]Oz{]V`靮@ lMdzk ړa#pRW%S.ӳ3 K>5S$QЦVԆO?#ƠCSM7l|vtVh֜n6a_ vSK0=) >TXE'SReCk.cfLC6540Y%)La6Xl)m]Eafuz81o\(p%w{m7P#8KMlz@_LSmPYw3 %_t9NVK٘25s*VubzknΩG kTZzl.zʫ'p뗀S#7oz]Sv{k5,7ӭ=oRYc3p(la?b%` n=%:w.V1$.S,G!#g j+rR|Lf'unïrĻ/~dޟyGyusB\8V>mɰsq k7"UOLvwr2kO#(r5E YUuĝb,LhN\@aR3k! 3j)Cf Pj^GnՔQk!+O}tR0 * av3Jז||$@\=*#tfm,T*9\ ^:\paؘ4򠄺Jbzd95"[$%{s4{ rE-e(޸iӕEu$QbW/*4ƙjPͅwl,7^^!c-ud|#}ےGߊ%?q_saˆX}kl. XGِV*CB<ބ=àv^@ݭ2_ # >S q9ٺ&x@ZdN^lh)GD٩d<_~E]#{,)cR˟V)z& '-9&7wŸX Kt7áٸXg:qd*g# iDk.D5m9^;9޺AHy54c@Nҷw w7FZkuuNJ Mi i  mjrt5aS=Mw`9,ɜF?*(tĚbHAJLRkZlgHh'L ~:qx?i 9k+5MT%'ᵫbءubwLy˗ù &W^E>DǙJY+}n,Cv!o2dkQfƅ5A k1ܸJ_]FMYT /JF =uz(cI+..U*[ex:ې( 8ut L-,e5-d XaU9jHr#AJ$xg CAiǣ'ft-j=LRNL qp}BBU^}>lن.cK=mJbDžYf%<3M BQD0EgᤜJւԩ9Gyhu8Ơ@BTmoN4 XȐW}KDU #gP4pQgx3VNDiGWy?OJv(զ3&O˪AV%jlkh^U'iCv5nDWULAg@5>1dw$R#m…2#>x3%'ذRKΥu-MEkJFO6RY 1cm ?[~N{my}ղJ;Cħy=_k٭ciέ^o|o(9hXUYlر F akA5n!#zZ@Nz9gR~uƙR+QWrm GArjͮ ǡ8xa?nEpi incT|k}vi UavvGkf{,'%|q>%4Qҭ[+M%XM߶uW0 H#`j=L>E*V[N<W~̎3we췑#eXGZd y$0[Cҙ^*(nv!aыџPodLMSIVM6v+8l{H~G> ӄ(5ܮVuv 7u+PV2eH{"k_PR<:%gsYקBſ-rЋMzNz^V%*qϲz' FE//sNCR~IzQHRwPߣ0"k3)}E͈|vL W2BD )@B?h\8 NG3_0QCI^jhKf/Y}/ӳ&m Gނ5጗`fݚϮC ۊXУZPHJjգԺ=j&Ϛ O܊M˿a8-;É۱LXZ_cI]IdR-ۇGN\x|&Q „{ߥ'ʎ02yey=b"*s^U$tU6D!;BЍb2^q; uc7fPL5Tu!bJ [kRRZ b0,fϒ7p#:FAQ}ЧǬ-H%>Gf0+jLVwL3cM /R.A:-hGj?[0T>h1}Rn>٨*DWBq&Zbrη@- IijfNu Ɵ:]::ŬŧG̩,ESziQoG HQ tse:i4U}is μ1mh328[iǽ_qcIquVp^:y'Ü%UUxlӉu|ZbC./GW,ڳG+<(c[G~E6حu{ *!3aNzI<}=u\l'B&˛^ ,#MX.T_rژ 9j񽖍i:Rrm+cBc&Fڻ,8^#ۜzϔ} Yd)jKN=UXÖm(^C05Y:d>feZakve_8Ónvr,<[ (3  W5x܀pv7:8j'*dL }-,Lf%ޔۮ,em.@݌){3IZs.HiOzMa`plZeK#]Su]Uavwhq^i4sp6f rزm7=:jS]AI=~SʻWMvi'5DkzB][dvSO8`N=W9mDٱ? 5R2{t.D=  gXs ]9ZTn,k/j`lGG- g7 pciez(,}Ti> hcX2ؑ1%{*!B @h3T(*{v֤~< 9xS K sx K>^aC`̏[䏇K_!M0q ~By7oM)l-$FT‘+\-pN79dd0V3.1F#P/HN#[dc O56>~#xSU( wR4sW K"87^z/0teDLx*|xteu :_/,Q9fZE:bpa"XqP*dV Z P*uff2 Oڭns(HJY@&Bw"B"F;S߷YTUY+Ev *E1S`NR+}-u|JC:|iQ_rN A?f! # 50ah̚wI󏋻ypiѾ"FHRc-t7zeg䒡=KkE:^>hŬJU.4&WEsH)zxߡd]QR#\/31?[ot4𰕴u&t4%DŽ>:5,"Fî%=^a])4πFT l cP ff"6. >fҲ9V0MVW;ro'H!]}72/m)OqBmz" ("M~_mݫĂӖ^6&ݲQCW<t=e鈇u.VځC,o"A-p=3BIrO%tYS;dSAt_dI)d_ NW]Rc:IXJ8Gti%] @0ƪ(&"u)iOYcAq;ptKtN95j"ݰ[ )7$DDATxmaWFTd$wnM'H;)q +6;+ُhq˚__2:qp G&k0ԉ{ Y|PlN|ׄ{g_ s ^^L*N h)Ci~^hX{z5q5Dd5`.o3*1tt-;zHyPDRsU3BgRf]f9.EVcP|rwKx dX4V=/ǯUgU9BĴHm`B%UhjOE&l#4ҭ{!X8[NP-N*)iQK_vt/^ґK aZk9x/ФL G^B/I夋}"0=CY<jU.~6ބlYZboǩaѩDC}r*5p <ѩ\j+rbx4U+v(4| ru|`N$@K3d1u!hƉFѼ"\'2}bК}yOX] 7(4f4`FKi6: PЊ d-첅`Fs3 Y<06Ԭˋ`m8@m$aå[vWvMU%:z$X~8i)S[I'FtF|?\t7eu >a]"\OO3^$ (AκsYIiƫ$YkR w 7;:)yLj+sy%\v=׆f|i>ů'=7(1N(M)\r?i 8S5ue5|٧I{p]h+N2p50C3N}^#}=8 T1.g|:*_TXMu`g34 ^l7^2z4Gu hL!Sjs@I17QLɥ2L xOQ ٬"F_?Z+놨G-0aƣ;K==À]*fOt YÊ⛨rF@6'?J ǔx1ZA|ob # YQ`%⑗,(;ihns}a sxA:@shv,)o]ep*Ȧր¶@JSxa60&;j G]_Ii]J#kbƧqKJ^ǡoX3=9s,-;Na 8a8CMv7/5F/d y=MМONAӜA>Wh>1^ G  WV#O(V3=3|@Amn!.7o)Sbvιr,Fd QE[-9&S@lW1%e"GpcҋrGC+~dAPYXIHZ 7bZ\C';B(AȥgKX-d6\r?&*|CE?rP(_tB7R7Yꃾ^l`P(Rwp[NTmC:R"}Zf'2kiDf狣?:X ̟*,Yrw'|9: p;E@>sno<| *G_xij4` ( _:oUreG)reƩYFZMQZ$1j߮HW2M+&sɿjr^RPbظ~RJ{鱑rD8d)NWg)#ћ1k)(?8#XpO{@.@ĭM0rqm* _?ESuR*L[~i%Z9@K@0&eM$V)g8LJz? U~|vjP  //4%P#n<մ';s`N4Hrky8KqP8r&-PT@kL[S31t#-l4QDLG-'L,dXn -^ډ$jL. gDC]E" QnN 1%/Sp.9>H ^䁝Y < 9-zo\Hu֦5l1}i_Ń8Mm!]_I"항\NRE|Z/C DUb lr 5Otz'kKi)YQ׈\-y8.fADBl}_JC+|% DhG0 x4M'&_w؀<~Ay /z?bJ^6"L+Fǟ1Gg7]vs ?h J(j4K-@&$rY1YWϩ-N oݩ{Ng1K̕XN+IIA5`'7A;8_6.%8m1Nn!@%BKkR}^KԻ/cksH|U0_ 4e2,"%`eg:)莋z>"ƭd5ioֈm>_*@&S`kV`ɱ  l?cE sE zF0bA:s*8'5%Օ'= fҐwmOs̡?*"MVbFn##(;6YBhA yЅw_wSʚ'"4),idžl5Y^?A[Y}+nBmL+GKdcvy޲Lڏ*\[OZYH_ HӸ e)S(TX~AFwhV]ZuZ|icOϛAE ^rXB{IDw<_C ŴFjْzkI!mAN@CIPHa]ٜm`Cgδh/@ gy>sg_\Z0+OR^Թ/@5 vϺH~k4dZR:=Ə7%\硙²cuY%)UF7Y8~Q)Lf1 C.C3~wtd6vɹ|]AaycݔZ e!4GԘJV봇 "ը&L'ʯ2 57}, ?:0< ,cykC=x eKO*HFyצE1Џ TEL&Mg1[n(Hgi@cACcg 7aW( Zb``Nw"ׄu_$@qڸ! 'GU'4F.TNzAJ3d9m8vmO7/mwT5^-$?.L*w !2ps7:n'W,Ũ,ԸQ-4J(2O?ѹe*%v.'$ _͚O=Љ (lߩ˄G+DE2eLV6'xԖ7u ViO[ Д))`0|WTr!\̷j/ۗ F?9V"MS@1'Mk|Wv BLXeIDca q@'vAW[+7?#0緑T>\BK$CE.5- 4SL!4`tn|]:ԿxFXL s?&x61$O" dR]茲_cL{zk4Px.L.[e).]^Mf=;EMY:Ydml1%;oDp} {mAsXCfWo`Zy+7Zjqv x 0 ROp/P;lLcJ "iJzc2F ;C)qHHRy,mՈ] HS7Mmk*H` ndD\7Em( + 7Mp0 g֘} 6[$B]s'%w% 2Ri kbzHRL0$vOX,*~֙ A8[}ѵ`pؖ*&x/x}3.>51C+HnMoR^|Y&MDX#uZɚF3B/^*~|ʠ& A z"27U=g iuXQ G_MG\ k|q35# mn'D(2Y6fբr_2cu˺uL6'"Tx]Im俧ȉBldtN|?偭ˇ nax}B&ɫ uaE%ص#T?_>c}Q3@{_j_H۵M,ps{yKr_tr̀ tH5x1С`o==mX :f ZKr$>E9P_1C^D@{ژ +T#x1K g?9;u&kHOCQ )Q.)/,5Q$ &QG@O0^իk &Zj!#B.js\ˣom~ּp38qHc4WvG˶ 7>E \rf0 7x[vIv*ޟRF aOc?#*cFGZwEo"*J)ϴ8|(sXxN#|v 3Bn܁NylePë&E@0vq.JH}xT+ŧ_M^Ͼ,ai 40bDE,ʧdN2c.xO+?78p77(;ES;UBYy|ptaM:DPl{D>e7\֑8›&S64s?<vUoͲGB9Dz{a'7]4jCDp"h.0++c~* 炆[Bc+6Ld6s\ 4)w-=7=O] \R3χ~nMVv{nn$>baf: a]rNXl\ -J}jX{kׂ诞Z":DdG3RRϾˀeΩP!{)}<*0)s{ńnNDgZ 7T@|V% 45 l΅RUBPL 1][,5hn혏Z]..g+ta)ȍ!`NSZ۠aq[^J/ߣ~1F5 h>C5燛 ?[J'z+Y3Il2a ` s@΁#~OWџ)giY <އwİesp(Ht4^v >6X_0a'(DLL᨞mǿm|ER95`K}?YHKϒTη@%cZt"tquW\4M̓-eJ:ҨZsט\8Fcu=q3𧁭@,.m4 tFi(mӾޟnCHF7 зSl_+8\ Tж4@\Ѯdhh=-gՖ<JwZSTMNu7Hu{ t<'X-& s zBvΘ'A݁ VCE&^ ;U,9j=I]uUfWK[6Jv7>i 'G L)9i" YK(͎[^ \;??.#%SSrűEs>C(0 "x,c/|Q aUm{iD|j @k]W$#crGw'੼;Ht^RcC"=EvhSԭ"64KZسK QM?k wH!B]"h*2mdNp.*bnO6jj^֢JN t+[iA? 45($L Wq^SN^)0rWQ(3²BIj }ҌM({dTtN'Ɯt@4BvJZKP:J=fs.;27e6d Wݬ[v).8C*#eƋjN=cTiy~ɋ0қ|w%o=+lTP>I1$!Bњ !ֿ>hFhl 6Aό֮ WM6wC6+ud`>MmNY4_2kD^kX}r`ѭ7p2~nmM lu|NNqEYӕPȑ.#ZO>/n5}]š+ͦj;/:1$Mc! 첗K܇ K9f|tytݫt*;bTjRJCl(,:wNH09ApqD6bi^P@c1/Kx1|POZCeЧ]F T0dI֢خ[9 ~ Ct$<<Vu!'}g02~@MFwf V-Dǚ"B:QX?yyj=F,͍ËH=U +(tƍ=6lMbXØv.p~ s'6H,oAxIrJ,M6r)mݻj;e}J˭:Dfi"zv&ujRܙ^עX)JƏ?OypE 2'#*Z٭0w؃'y"<sֶ+*oC@t?/yDĊ`a|9#;N#A"Y,t{հA1Svh,Yi]k#!Yz~-QפQ)D יx;B$amKN)pGkTVG\d5A"u6”~&g9jYnnD > zP٨3mCpG L'Qg>DLL֟ÅR\ưq__ysBD]z–$0ڊٶW:k$8j&L#׷Ha܄8eNt;xxAVN? yWǭ7`8`[<[x⛙;0Gh ,޲G{-g aD, 1x:ρR1iD-])}̩V. T]ah~Tefo10Or]5158PSB6-/?Fd،+(hDڭ[Xs̠8њJNHhgrO5¢͕%#({OA.&@MZ 9~ MK2 /.'3LBx4.%SkA 1?S)ٞ^\6ҧkÓ~L)d EWO'gUqx7dT lxB!ҷ<Ȅ{ٍsbDgp@-rMä$FӄiU ?y:z00D%Z Z EJW[lִeaAGL`wD5uR\F?v!J%o \G_?F`U3Zz^xz`QRyۉ,QWlЗi %GY'[s _ ulWE0&C,+֮QiY l9rp[yz:/On=UPԴؘG\%gf$Pה(FLr˝AUI[W5ɷHW#8.yB+5;5ivL-'Ԅ*szLsP?Rl*q߀O#Gt$6)8K wWRㅖz<_v=vg&\rLѭ2 ̗}&k%@ HF9nn([5@6i~/޸ +gW ~TLZ| M0,(3-"i*Ce|m`9*Y">ewrjF<^ "N6(` r+9Ջ}'Dj@*'2Ac_Z= iOW~?{ؽΉzfnBKH"t|viR&*cP.] (ELW+`=ŌXXl9.b8&T;~b#OAx& Ő͋^-2=&Fz#]pfa"&Ir6>fcȾhߊQxES٪&$qw<嶪C۲T@[߁U7z/Fa@S!y0}|ٿ~}m@Z1R"HV5vΉ ">iwm, J?8"|%dOף}b!nzfIGNԨZpݏM~ILV ơP\Iv:\Iq{׍G ~-K8T3 w-kcwU ottr,?4\DP \>' J+_dn[|g)h` MZR;zOsz+ZJ4NMac~0D{ s; &{r%l ^]O(ݺ㿝c9 &l9yyԭul4zNE#S/ L~ϭT8 5uPծIEO-p^Cۊ ,n{aY3>d0qqE=ڻ;[t&Ŷ#f>?V]+ J3fH9Ia݋D |aWs{6oP롢ehb6mb$eOVѹaĤ%UWT?XQ1&$%xQC$;ŏENJn^T5ky=0O 4.{)nkI3zYDZ@&b*-˰rN/͛;Ŷy _캔Ԗnm/?[nbs4 y՗Y˗*cWϬRGJNFu5L%=bW(#sK4YDXYbɽ@eG 2yPv'swghgܒƦ6SL8*\EFHD1٣ÄwȾ'9!o #fXirZ V|(897ʊJx eOq|ǵKbؑEj֪K)'(Hx{"wZ C{evGiܾ6Yk`N qk;xO`ё([ >zzPkP.x '冂KAH[Kfn$ԙ>f|P/!$ x7'3Ll2ZKъ^foo 7 +>#Dxa^ֳNS2玳N˪$@e =}-jOQO_Bh?aw M R iCWM텹EM[k+E>Z5tL6bM*]kA1KVpK|0QU#\ՠn ,!i: xG>-O M/{(Xn-̞1}??u11^8%uxH/JW2MFH-bՐ_ jlhM8ێK䊸c/ X>,Ps&3GkE`/3؞ g5N=uE[;*8~h9 /6yt2~Q}tVO:R kY.Ijym+^u֑&鞻zUMw7M PAUb7IH!XӔPF"vi((=ڗV:[ Bd9`!׆B˻pb2/)^`̪쓚T {--WXߩmi)Qf: !4 aP˓Y@QK>?Kgk`0EW?~(I +tG&!=U@"@]?jOYEdeHan}~%X̪~8EB۞.`~7,E.qdHNF*@35s <;v?Y< F?[Y;#*o̴nzQ!߫?+AW:qO6+D+\qk٨+I)HxFt ے֌ӱq> ^snKяBδIm.N"T5,p)sln$vŨ/7(j(x[=?/ Q؟b}A8ۧryv/,Ns58)y nQ\Cw7g0M1&&:ӝ/J/ 5ѩ7nj=q5hqcHj}T0# 'ڛ!H%s(2Iz*1`m"wsGs  *5z?5zK$C"Ϙ[I< f =F%s1jF:BmFbIZjJ1-Y[1iIP^*r.R  UzKHa܀!|_#JA4,lݍ"&:AN17'łcQm~T%!&QH2 3.;BY񗦢g$1R€B}+n6exnd Q3gğaFd<㞬 2]=l^ hSqꍴ.UCCmDLd %,D7"yE L`jZ:u؆N|@̓bxO]?]dZlp1u uw*|j|(7;K8g /,ݔSt?B)S͕Zq- Mmtmm496lc `_FVܬ\Fz m1ʜ,2K.a_(΋GƑcu&Rh?n :T:Z٦ q녈xhFP r"ͮk mש-\h`M@%kV\JF~9Qgdy.Ȭ;>+MI,=.MU4l`3 oe5mZr٩?lR|K}#%"8#O6n(SؼOHxhoӫnݫe8D`HOѠ[5p7Zw\{~1kmx~,Cdnz-[{8s֔":e.*6hզtGH:g\@F:'iv>\-BKְ4Ւ1/Nr?\% \[vOcV]A+6{/UAbC6wa ) *lԹf0$QЅzc녖dw:G8vPtِ*λ%V==R& ^T f2OWyI!d/o l#y3=K)hl_ eEiqH^uFCI#4TgJ|.&irq>ʴ = sr-77{juiIkuA(/ؗJX,h%IHBY^kp}u b,Vd&GH<'MjN)|K7z4#+. %! q!1W|_7͉fBߑ[@1j bR M81iALcl.3̷+:tY+z[:Rӓbl4j~ xvě}&mZȴŃ uhk=0Xmmma)Tp/2|WĜRĎ͐ѱja:?b;H5y--E:IX>Ah)tOd!X_-x3lґn|uXd_lreLt5;ZD%ȩUr@ =N9gc3`ȴ4U7%7ʩ_nkvn)~|,&ޝ0FA88eBC-rg&*^>)O3n,>M1p yE tRn&]2tn7ja/Zd2πAa7%^PַZ62o\3MJD9pM/jKn>Y)" `ɑtp{R:!wLcZO MS.:ywwI $7k‰QUyn;>_x8\ٽ2!@^޼aۭoarXEpTyϬRE }ϸ [ 2p`?.m=I$oz=~ӻu/g&eHM@;Ekk*x[ɪԘFF)\%z=yT# L'd|DVoa,F"zH<= Rɭ qr\\@sn}CfQ}}ƼpIn-2G֔Y 5|d?R3Б,/tVRD;wpZto`N H(yAnC ft"W=YD:BBUā h1y}Pd'J o'IЅser-IWu*0bq=B;K7C!M4^㦅Bc;hj 5$Ɂهv'\'3:n+ h*A\zƑ $k rd[F̮[hJ"CN{28&B)э ]W$C赎,1ϘߘAlj ܻ*٘[KY]ͦPӝFk<{rQB0'RWwo:e-&aӉؚmjv9c0/7_/m s敋T+tV%5_Nn:75ڐGZAi:p/dŀnNIVd }\D#JX3tEemV~O\{i)G%P| ?7"м,4-C i)I 4>& YAYpEǞ6=q| ƅRRWkܬKSG}P-2/1iS_oB+Cga_j? }'HB(gDC)c}V9U.'=-}..6c3d" 3tQ¿(kդW 4ZD-e dA6oX q\. UI^X (VA\X"i#N)W\餭(Vm1} [Ì*ݔ̬0w~2Ė{E C)0PAlQ@oc,R\!mK't<(ꃂ-P+ḥԸl2GZ*[uP@<'3^ 4fvEQW~"Hйnki6),7! 94@CgOn-r᝛ju֭*E;l}@/^%n2_ biYDC}8_Vxv;PdlxBeېt}l nv#Y֥\-gbDߛ a/8Ѣd/uG[:ݏ,SE)ۄE`쁰[i0=~ {R)J.ZV@dKq\4{N<]3Ҫr5{VFSb*k.MVZ4I ֒W͘3ߖ H}NvAw7mM/YOsAE]kRK*5 ӼSp(U{q6G@h$)d )o$WRuPz;vbN!O4$@‘Ȋ׬2@iauv1T#=`f%{FiC,J_|SUL>E)ӊv_J@hr .;KLfrbI|֫ Kuhi&TeZpvg>EKsgj(o@ ׫Iu. y;g+'㨤0鲁L8&NYLɹp!^_64;« o{Ŝ˽`'3J~. IV1u4 hL#}fB<nM5iʒ) _I!0eR6FO~9P~h@ F }߰wJaAr׻5&DOK'ʋnuk9,H .[(/ZK&%awNdaEM"S Z)h[ܹ)Rw=Rƥ%ol'E/Z^*0 ~$qIcAR9LX+1@=դ|$͔CϜz8*gYJ=(Al.1Hr+t'Wj-Mշ>l#X+MGlOpB;5EG$mڔ!7Jd `c{lCnZt60"F9 "';!g,. a .tsUx* ͒g>P~tek'Th.\@iQKuLD]f@)L! ܀,p5Cyu+X HboZ`0Xe)F_IS`qwV~όѬL B<).7|h0F3fiZ$Uh~)0e:ll"fȩa7*V!O t' ( nǁ<&AX]Aj]]XD.Q}z{3*dO`p?St~v1޾ `F4CDBU:a$~s^I5˟:e {S{6rk B.ICFCky b |<1'ך˫1w'!=14 T*|1/tu཰Ƨ&OidY“vfXڵ c.24wUG̗mпJ]ZU׺ P v|]ܤYѹaAmѐߖ|ڮ,,~t @AfSWQ ӹqtQd%p; >$'㬶HLn6gP}nS(rM^^ ҿPa —D8c. Y ЉTo8ėr iA,<9Au+G5 T :&fx:Y ʹǥm+ckV`nJKUݢMv|*NE[\ E7퐛yzu@K@REO(6-|h,*Y.@Q-aCG\~C:uN9KK)5V\0o>yV+|H>XJ-/ٌS5h#)7GOM@=KqOC!Ix]VEq]D U5`K| _83 bBg 'n,g2y^^帡! {^¶xMR]>ڕ4&']Ͳa8Nq'YIu(L띥V+;8ϓ7'Vo::eKAXf qAn(ܓj<ݼ=IS */هPxqXj#r.‡V#Sy54Ngҷʩyxc#=a*ET \Iw _0'Ff9:ueTt_l47jK|J[J崄~X5,XڐK)ԕ\%1>z/J, -Ϙ2qB*֦bX }%$vT6S:2r ov 1Tudir$LԜOнK4H&?'[ O^41)Is\*Rղ]^1d``ݤ(Us^*fr5 gL "9~l4Ls}S0t;'l '4{s;]D q@ I=՜&DZs.CM8p+ YNc3SY&w~;lŵf.}NO' E8g @Wq M_!?p54r^ZY OZR/-?|$θq"iyݙ9^%/)-7*X~8==_k] 1!Mlɹ5梨z=fh{ɀI$wy ow:ڍ^*G C:㞿|+&aұLy*NS;l6+1bex,iĄjsa,=Kh;4 {竽'.[J)ע9d9u-\jMwӷ=5ZCLTD5K.;K>}LiDwM9]XrHHRy,3s\f"}Bۼ "sҔpq?_quWM5h2Kd8N4-C0U:$I]Kڃcx6+\-xz:5>ʶVqeQ@z" Ih*uo)ROx\Vk?2y,xnQz~ۡJz94>tRr`2}D1` ,dwzvG KO#蘭lznHS1茖Ws[BN:WO ,g%W#Hgw.}}(8/R_{E& A*&pCM[&-1aeci]'+m5E>j^cCfү,MmǣfE QUH裍:ճ<,.x Ɋf& "jFN"Ԏ:b$VcbskCIlDF6]i Ro)C{[&!Yh:GwC^V_IZ-[[xpƊ >@[Gfl29za:MG42:6$*Wwj~|C)GwbE*F3i eڲީTh:!OZ\jwƨS'w{r2eL^c_ ݡ?@:yQ70nAp//z嵯׬YP+[tۏ>еD|mV,8xyu6DСm*HAgUVF@+9\T(}])w[0[VO,OBQ8F2 ' vy4E!fܦ7FPp͕8 MsS>NHo<ԡP>ҸT()[9M=n }=2kGw"AU 72?Q,NmziǓ#:I[C7SF" i JM2,9N K%Ӽ48aDFP\.1#0A'FS]. [E9jOc$k?~8][::^0 sYhlr! VKǟULߢ`D#IٟnL >8'RP YRoL%O/J@G%$+|bYFYA*H,Vo#ޓY9!$cYS lJ3TcT蔲j݇+TwVS$bL #T(\K-Bp-W'JAN@Kr< ,n*2g&爿\4B^>ͽ5wf;ŜWƷwekd.'yk/݂ru)9g&;ܯ\9o"s 1i[\>SSVr"\R.Teuem.@l1`rfY֟cJATOg6yphVaՈ_9j Y%n/#v;5-)P+؈b"mVmCkܜeHCdr]3PL/T(DXyUS 뺜kTywVVn%UOi۸,UJZԔ $rLm|OhH1<`I<]yql#ڟsJW G b %J-RG(g9<" R%iŧsL2O\-tѭ&^xVzې@%":;+.Vm J .Cu/g^e'-5b[tI;@AٰRY6?*1r/+iׁy. $$:gkOPZJn L(sKu 2C:ΰZ:h]>3o3+ml>\&%xP*vդEf0OzO$\ohyJ2c 䡇BKߏC֮g~!U%%x3½Ĩ(J8D2l/7GЧ's` >vvc7}~s,vfޗ41v a)?? D晒z"~f߅:iR圿 y yd:N7Jw@W(cU\|>A'RG,aw i,1ℽ;8<Cj@ףXoc1,UvGֱgdZT6E ,(S"k4i= -1>ȞtaTEoʁ _2J*FD9pק9'QL'Sɑh9ƩBԄi b+7=7|/&Kz6Y\[] \-Z3iخUV( ;qx\o"g|ك%-RD1SJ0B* qm0ֺCXZ%2Ki8"Z=am^:>gٟvMgɄ~c%X1o.$˪O/Ͽ+DoPUQxz!KT™P8Ƙ'<ĸ`A /xs4JQJF9#0jpC@bfOJ#JH+ i{r_/gĞff,Ae/jȯbz && v5D*3_sIg^ˋP[7KY|>||dIHt1wKOᏙQi-yZ[)݅Ιs9z\&r#*=Yg |.`u]_dٿgxj*h5=#^<.%)SP˪ތ,)== [%n\O@֣Q4 KVώ/Ec++98YB\i Τ.Bi +gtG^1]N%:UfQ2nf09_({u gro2*^V<쿳FO48:~ju\sTsPs'>;+|90sN QsJU1dCFGMSo {0*6~2IϡGr#e0]9-# @+q58H0P#AU%Ӷ!䊜ܯBMgT`@G5MeULg2mLp%1O$mRj8-͔.c ~Vh{29/WBUWV|ڶy @wgr/zA&$#/MK?6ԕ_B(T#LTYB22bsSdNۋ %^g)oB 'xvwl|O%n/WQfQE\{bpj'C䪺H<Jǿa\!{|6 롄V?Uk%/6`Fp_:7:tCf⾖Ei¤xri7L *ﯳd{wE(_*j%Az |/ׇ5g _M~p$?%0&N޽$9J zў] z4-Brrv#m 7~P~k_!{Ujd쐑7-sM[uto)9ʁ7”yE ꢦKuO5bo9#̦|1H ًb XOp6%YW+$kPjpBv܇.?ܴ?Ziu^"yįangEUZ( 3fAmFz SY$R&?:įHgqew _#V2+ InoeU; O}mЈ" S8攥^ݵQpot;?FpEcx' HPDruEgxc)iN01qHnl< '2ɾH'2XoOPjti݊k{# %aLcfOO|lvq!={qxfej|;QSR]Af2* 2&jS~1sgSpoKSt0PZirA fB'gPo]1['Ѻw[)? nL!o6L zZfn(jaBGXl%Gl 9oXfή+qgʏ`{dbBPZ+so`7"ZzV$kuw(a-fkG6s3Zf|g,yHfbF4KssDJq)CQOӡ}p;N= ^2TXB34=CVv7g7[ldz后im‘W{&[ّShRycɠGܶx\7B# ~H`xiA9m@//"0h KXݜC?n n 'W}~3b +stX*lh?/"{e^l]y)=ȡ;e*qvc6/@3`Z%R DVp}^ hy-XCVT.(CNH 3}kY'IbU8:|́m.5d9e\ 4ZwC7V8 Lao>x/l3mxzXjo8fȂH̥+;y`H~+hp<[wOoj؍AYxoBZR>^3?IMaMo@aɫU16wZO{jaL[i^Mh .[aîN{{Ba$ bBN o'[.TO*¼B^$dm$ۮ|*z&ׯHZ{£?)ݵpwma9[>k™j2ENjXlrG2U= Ǿ?^),9ր{Zdӹ!֯K{K ?C]G`C'qj. 2ILPDUۛv35 ȻMRFf';S.=V:Χ|>KHk*΅/Q[d\/P{1/IoJH[@\mWo+Sbk"U;A}Uă ?j p֞| ]UnP8>0Q(HHϠ&4˟+wtZŹP<d*=2ENh̰z uHKJAHt#!#F'M%>dt \Jk12:eԛer3YN0 |h D"KM85۩B(MC8L޺\ n#I'ŔǴGj=M-CGX 5;.xRbE)L{&șfN귶w]fe}]4_xw(WUA:QQ?NQR&ޟ#"bܡip ̷̟W(ssSHeWݸ^8u.5Zsͅ޸jVߪi- 6.g4'4sw=yw̙+gH^)8Ԩ?oAK Uh}w9L2U쎼sV@m+۔á\$sT\c ԍwH|ޑfPצ[Gt1cdMZFì?!%EY=@svƒla=,_ B=q 'K 0hYr!MilpG^z%T{qЀ@jY0oZ}Ĉԫ=vȑKL fu.K_ }K,&/ e7W Rtx랩65xYU'rf`ٺ?Эg;3CY]{ 4vrF ]@-ID#z[Z.j ,^5=繼I#CuDŕVYs'_|PM<ěŞzn>mRx &g9[-ecl1Uq>!Hg@ԁN ϱ9"3TL[| 8fXdo.)i!nr&CVvqĄ(/yLɏQc6w S7g$"4ud|5=M֞$˵߮szRsL{"EuGZ!4o˲N"Cwm OJoUGw Kβՙ9Vi;ΌD+@mє£~gEOTcD&@QmI1]M۠^н8S&"63d88mg6TS.)eFqYR|P>^#`ss(?oDXOl 8ΘgBip.ھ=> 2,5Ċ VrQ8+kw}b?1QPy#%S+/,)4_,d<>0&J/P L /=H7>V(Gg5w!2˭"O9"(F^C wHbhZ>֦^Pacu*MQ%, vbVr ع%ۡ8uVm,Ew۽Wס+fpl@"Z36X^0 VсB% .N70nf+oG7˂p[$іdW]m4)ڛ-ߴ#9nwo,fSS H \8" ?%ώOz;,0߀)cB /[).l8; 9ښd՘E^Bic &\^eo /u㹲s0wjUs_`Q a.5 䤗= Hɂ"'༁8e>^mL=K[/V^^ -iM_QdSn:t @pzeb F*akG#[Q0EKw`uPaXS1ly^x%>d,$et)C+fwiK }$ZZ}itD2|*`~yTU:S$zcm>9 9"W!Wk,Ju4M4˦=eV5z <+>1f%tO\&P@8#oa(`pŔ]S*TZCA),e\uc%{_VV0?m_0k{is7qGAǣG\swdE]]DE&O'Ph\MǀYg7~@8ibMORCڠfw V2*)LӚ_p4I՟ߤ!`G>5Y+DR}(Ǒ!hJ<2 +U?Mbd8m`HTK w>5M^T4=s]nTyJt׫QI%F!pIB noXqUXnA8= d87(`@ 1T3r1t Qj+ _j=!yCpQg! Ūv+xNSA.aGymڇ鴪ށQE6w7# Ƌֈ0>Y s8Iz9 h=Iq9xj0YV :,]>?5*nrM@䲪_|)KcryuoEU$([%$V$1"9lO۹AK1p|H]w/v¬E*lj=*=4X|4'Ϙ7*ߓ@O>=]JH*wgZYuEN~y/8߭4}cԤ~ 2]hWe@LK^2VG-AKF*q PDfSgiڱB`ZqqlaZ6#8 /Pl7<,z8K{.1T@j~!_l3Myf 7/ =tj c6`(L`0|{ 6C|95J L<F^L!6m=4Ԑ䁠e?9vVe??R0|K˃~D>,\ְ|fE&9<~@r?v7 ~-Œg@Dx M +FRҞ!nu'N}G*sERB'2lOt N_\ri:LM:`iSF>! t᳔s'7>`h7(ZĘS`9~{b.Q:RSRM84њ%ZrRRq7vaJRM `ǬD=ᔱ05%@Wx}ްÚ(`MKLxHIaqE!}9΢ki ʜ=bx"<;vMj,?kNr@eLtQۋ`5T_s1FӰ 1:6S7"!D n"B ΄^ E !jYKOS%<Rks8F)D(M`#OlX0XJvɩNԹ,2l/V[U7~MH,TQP4;r+<FWɇhX%x( fYrӿm`eE5Aomd;9%f?+ӧ'l (V-srSܺeNQ(h A_% glA9dofOb~SMԦ2|G~&x@O1Ho4P(8`c,-N=tUQfBa,X'=q$n+=Ӗu9 Ip{~:Y$wAPw{q lexX]%:e7z_5=>MGǗI?^!Xo /~wf8x0@tX2Q4b\?o2PN?r(zԓ\8P XbGqF:H^:s`7KR?;T O7F68,n.^F8|P^mH\ܢ:IzQw%Hc՗pxEl15mh)IKJѸv#d&ƹ0 nǸW7#'U8nŋd;0(!KM* (fV'lMTM7rlֳ P#g>McӲqjir5F/p [րtnf2Bhwn GD%1uDbLm0DZ!f0BD!J?KN}>%erF&r)A9Kۮk4ͥZiR3CKR0+k*X.r'UB _/f&?v%GUt>]?@[ߕ+v,M!dV6}kBx+3Eq }1 XÖn،~BJ6W=\WFE/j[ô":;8~xxO6@'aB0f1k!f m(KNL4?G/7bܱsFV MVe?h^B_Td\ѐtNazJ*_d_"}hHR@ˀܚ*°b5U!Jk'EʢU%Nar,pE ǎ)P!x3lK'Rc bATVsȨzlC> +p"mѬiՕ=&3PUc_ht 4'}Z@?JTYSH+d:Vx_3;`7B ZX0ҹ2[j͞}> ؇Tip5"[C]!(,gkm ?z ƪbe^|2B؊%Fヶ(ckst/e*SaЦL@vRB**)}~ dzr%w_Ob Օ~⺀ d$wͦH@SWk_Ny_Vc$C~[Ϩ%Wg, 4ÜmHYէ 3YxXAڬ2ɹ-CK '1uwtJH %3]Y>P=lrM͋vcqGA|`J J K;22ɘv.UN Occ hT#m7gf+^SW.o{<^Q5JVCބ"AKJUnz1" EgA$6 us@=azQJ]CobEu^̅N=S孻) z+4hc;7q5ׂ5S:h1@ mQOٓ?qZB7q2C^/ QorϺl+9 ;g8|15~jy]b_%3 0* 87'@s/d*'3*„rQ%OD"Ae /2`?(\^*\H8D5:{;{z)W]<^$A$Es9Ϟ:$u\3 j h͍,eA]P1 6BnA*J^>I0N&{g&5n` x 17$vjd|掭|)>%4)X n,Nmoe2·0b}zac#Mx$IfKS8:D;2[96pN#6@#ށ(`qW_xF}[|0%aEޤF.?hNDևJLk- v69i5t\r"ޙ|B=NKUwd o;]i7h g61 ?j|B&+ K@3[ObYF3B&dA2ܛWӾ͢Y(Q`S=F8e& &&y쮩uŧH:cF{̈䄄0Vޒ{D2HmY$G'ɽ%|y^9@~3NY#y,yy\[6Zf%JpjO4 &7T!9ܬFW68D泤5]K 䚑Ou1+ E)zLE z4s|`f5o}8PB"ޫ_-gܱ-zPw= y2a Hhs*ݤ9 ,Dž)ǂtHǹlԝ7=o>e&tz3߆XS{1O~H='[S؈KHJ@<1$Zid[h+}~[1tu%ssK' +ix27$l 0Q.gYNc[V. ;>\'M^JH`ov2F\ 1/J %oٕ?u,Ubz~0x6O= ($sx MkN:xaa-Dyl'ЗHQ@t<>i?cޑ?4B_|2/:KR<Fг dN(WvI9H2/\3WMPxo@uSOqLrM3ZH(ۋǫG!JTO7 z*+J_vp.Iṳׇ߬[6ɩ2 ?2^oxQ͚۽!s>|K^!t+}lKzgoS!pofCW޴YShm"}U ʬq;KyPo@3hȐ5Da Epv1)XWFKoH| /R g(rsIt+{x\a{zYe(Dz湺-Cg㗔U?*Q P0@4Ѳo4Vuf4fnN4!SnbwZ(SB1 Ζ&mCEo3ɑq`XVLXb,0e{M&q埬,NR`ojY?z:+´/ch5}JXӠR*9 ?]a%x|TBkafmFǩ x z! [ty~5ΆN,^كJuԙpv·P|$^(m;%ބjzY#m6C_7h7G7pzDI}u<{7 Q)ۯ}/kɺSʲ;IE̗r$ɰg-| /'?sFq 2:K*-p{%ʐbfujN;pI8(BVXTҀ@>҇YhkUEKTϬ dAwJR}lcUޡY(:AԀôx1@S~&g.2vxeuXRh+\6{) )KuxRs^ͫi{|!"+W_%bbm \+zJ_FCFLzJk"@V338D2(0]o3M_PNށ&#u,vɞq0mtiSBBUļ-LJjǙ\#vR@БۑݗG1UhєgaۺL*K+>qPQB`i|,޾bߌ\căU G@">\ "qKkA y.f­Hϊ?4BtH dqr?0+8*$RoH,SsS]gK>r7&^ /\m۟u|R9_9Dml!dQONtŖ8vY=ZVpNRIkt# i(=j[iB~/I1>qH}?k|Rׯ]ٝK_t/aJ/$TF 8&rB >|]2>P:QcIc߹^%NHO*UASgM_9}֢ܥ TfڃǦXlI !ĵ C@UXjdBYYi2,?]5y}nmA˫Em uff7)\Vhs>nSޕ;Xo50R@r iiz bnsuDb ܤ"zED~~+'/:crx3eG 6 0;scPkD ^ҏ|'>+3νW?Dz<CR?$#XE^C(F@Qn{|o~^S$a\2C_ ̥ofJ9.DPj 3^Į 7Vр,"?)n3WTUa)誱LT2]f|Lιj:( mEy xpB3#(DjbEA+Oqf=6`朚@DkD|'E2AӁHjGB~j]}HU8Teuw4/GW0b u-Lͯhr@ {F+RP(l6CGS[R4G_EDz_@"#`Q:(xq4ıZn>$É=Ԇa+jKG 8`^cIr@7(cһ$Hٰh[6Mnj3H}s#wkrLa ܬJ J'$Eg{ʉqw;N}O[7i.M~ g}ujS&Pjxyi/@6(A P~|S\~Iϼm"P&y\KBMJ] ),DUއF:~3& `9r$ ^ܕÉG-.T'A [% 'Q3AF;Uvnoa}5p̌8Ahqwnuqj(CUFZU6>3UoZfcM7wڜx{y(qB4u?)vy.)D *zv[Hۋ ~[=ZAj-t&IHFCY0Pp .U @J{ &!0R>&Qp7:.|oN+ܯ*B &ُ+J9K@9ށ#{ip2Ϳ?] {%ǧO 'Ӄߙcqud&uS7Oj,(r#Jxq|{i % +;KAqSrEaUrEÈ%i7ny!"Ӫht=}.81*]׀Hb,3I|5Z@vHGѬVQ$Mĥ{C1ɶoWu3{Te@_^4,V<ė+BAHJ 23dѸV.YY÷qcnI۝f'w%©>؊3oSr'x8M'y[HaU\ ŌWn.mn D d:7M h)twjpMdLKcVHP=ʾtne,|L%G GUe=iyQfY͂vfGLDiZgܗs^.;*peB]MB:R=gEܥO2L4hag2QsHQd,i?BDhf>NDp1qyzb4R=A6ҩS<|~U$!B$Ff@(/ M#Kfqю [NP*x-l',O#iy2P(^gTJ1XohrNUFph/$1t|H!G1ĕG Klޖzto<+7N_xG pcl|It)bN(,pk(%-/tc4nFc&2m\dv>YޓiJ/.uMIX]9%ÌfO.{^ L?Auķ#;[e m^"U9N17(>̞ea讂iMz=V0aoOk;B/<wn0-YVXAqp-S!_J>wjyF"Z4FUbBz#|du^zAIcQIVsxޅױ6jI4& 3[ X6j= 8̶[@FBP JV?s?+i%Wni}7j=.o1} p~!dn [C )ѻfܱ\ K2 n=W$Q?qH_'l8B^[؂6;kaan} 7>e78A): ;ʥ,ەSE]8sh୏@TR෕ 6O8쪻aNŵ$jd* E||e Ҧ]'`gl&V=[SŇ^DbHgU|N8Vd$^2 < =pfLMG4O̤sְ"-zrɭS.fك{MivPok7s+bzIkAzo]E#6z (~!r.J Ȧ f Pu=.Qwi1< [T>)B)@#jtDԾCGm\0vi{Gx Thx1_.xOw?5 -0WRIHCyDg)?X6𘲉G݈)%y4nQVK; /@p dӿi_i4RCFgi [2,  ;4XZMkEu U0vΪȭxxV7Da[GE I2hLnˍ$!uk 9 <:cD9 496) ZiH68*N\s.$O〨vP@ IU9rB5mV(diS_Kw[rh"&_F`n]UX^Bں P*7\ 0O:#rM>1ng="|E s]#!Tm e㤌/V=a^뭑ŅW9|vyIo'ÌL_ `(XS+q`KϬ,=*XE{%9j}R OnP|6׆Q(X'L%vy`of]{iܻͮMַXIHᡏ pӭ݀P~>\U@I,}ʿp2(ʛ7b 7'r%'/n /oZ|;SR 0{fo8mu.!EJë絻AڙH04*;5SoNa}:|U ,CCvA@v3IXU*cդ3 s9>"o5|:|Õݦwٛ<1Qeo"Ew623| y?Oz8{ K@{úzA>gDŽDžIX ,( /#oMY(7AU` 6 B;q s I!Ěj:%!Uaܤ%K}4<z+ }xzEn=C?=|fnj'<{{?eipflqeCEY}q&pю3B~N]56c[fc";7xˌH>4,{<ѭ| 6@y,!{/+Yy0vByhQ@Ȁ-* _l܊"ն3T{!a F&~]P9ePx}xEɫι^5,ӧ $O+~B{W\~*yŅ9Wp`c <9 NUe],)oⶁU oٺ(䲔 'A o]MF!W=&Ygu@x?snݖh M M u0OZx,x5vot+@+ b0 k7Hsn촊lUbոM,OĴң̾? mN bLr4}JZ)v򊽆@fYvGeM]5.&2=k?u(v<|/Yh/JQ\)~` uАsL~CJO8wdDQ8)mpm렻*bV4Tv9iܨwcDӚ&O( >涞pN.{M@!ށ7k)khD DY{%`1D/=[ + k,lZ J)ưy @ԧ]`T߱6oϵY_}wq;xi{JD>P>qY/c~e'-jN5Q-rq>ֶtuiFM+WQFmuϲ;tP`'PS^-V;Z&F8 lK eF&xVqC/y+r_eKΣ 2C_H#x<\3~$N6MeB!(:ǿNo/0N*szDGk8_-aavv;c9Du-`)Oֽ)oc )VWU:3.~o֝p=XγFagJj̔1HF]w:Qdh"]ؓaGIv?cٞܰ),.М~Jf(Z2MizF=@ \F3mA C] ïSOD 6+I# #PG>`P_IhF"ْi:CA NvNX!5RKWL5q9XMNBHFL !GHoI D~%]tR" TEkeo90n@`iaNhL!}dF+{} ]u 1 #SPb2oL ~Vs6귆Fӝ9O ?O :`YֳJϻ~(ig2[d>+o;M\ qjӥ j*A̠.^>Ll g,P' eM.kbw80߯C-xr9x:(S/D nV~+Y1?ŝ>s<^0XEFyL8Bm_.)M< n.ڸXN{ؔR7c@Lf.^%ΏןA}% hk`3Ie_U9@ K#ȳtp€abuRezgn D`,8D؀anN9[V7Z*/rIRH=ړ:+4eGH)O kCPժ?EF ~ǰn&,OD`+ 3aa\;@hv.(b"88 Ýǜ/ډ[Z7FsD3 dgx|} PuE`b&=o{+4f»$Yl ūv׷q]~,ԫn|ULZ$ctc35wU?ۻvưV Kg 88b=к_' '}"Ǿ%:O%ZI IV3nr|>фAY_11L%{ۅ\.lf6y,sڮzI2ôQ,HVin"pm"ZuD}VzU-,[("˾Ty !(: p]eCVk0l|IҌrj%7;շ̐Vlyz|9ތ!<_\x% Ƶ<0xŊZaxóP-^dX bnc }9d 7ok8.OT{^ͻlL7Ǡ/*_P9 [CpRrxFoӀyI"a~[v:|ž_vgMDb(㜱U쒬H}=4\S0$)QLg_%8xnnV~y~J)"}ͽ!sw>SM !*i+\.OI\X5zT@NB9@oz(`G{KY:H >Xʩ~Bj팛ʰ" ?)N 2Pkh yDIފ<{cTUqhwkx5'{ <ø_oiUp r }@P<J;U>9xX&yϔ03!W_>l $lSr(fտvd9闟EI`>ȟzieMb%v<Mw*A0Qyߺnk\NiH 1u{͇ɇpw =C̥*GomʳS[>ɴγ]׫`ola+![LxnytZτ0{J{fpʩTߌaӄe߇! ^<ț/} (V2+pmva4NМKрRDIQo?=5;kEN޹W7s3InX/(#i__rUmMv'%j`ԑ u,R3%B)$ xCB6"8z)ޙ}l&(e{<̍.`ϯs$KF,#OU~ bp\}"U>@v#Y~5Ue3O^/y8gp,N jns%0DR;6 nr|kQ:|ߺZ_( : q.DK=,BS0R.Cdhe=ÚI"GPӣ ex$B+U0TמWrҮG(S?ҥ]l򧮮~{r j \ ^2X<sOmQjTv$C[clڨ΋; "])Lz9xhoԣ@(WWʌ)e{V6PVQ_œPY "RA$ʶ\#5B.?_ȵ%j-hf.92)S7.o}P-*|R|s\ nڒHoE|s.ovW]Ufv( -!FYú{ @\hLwW"n(5{z~`|in7'I8 6:ɁPԲ.`c2Z YGLCl)'V?k(iʘmp0Ra/pVwdRVa#"C]Dz]zgK,d-P;ǡ3$pLHR΂5wDǭn[*<ѽN۪U C^{UM`]F5 neF- qxi}1Qۄpo2>,oRt@f9],+ 0u̪߀MbT}Ą<3K=LdU m >l a%/N r^=/$edB>yڭ@RI$m0f=(m]5|7ZW2K)n>OB\LJM _KKX%(?ۑ# V(EjnFFG1#k6-7ЬӶ?:jiM%?H@c]yk1^;| $)p vtr)/{j,-FWT.;;LsW}"!_ .,)S:DfV[MQ7y #  MYPAA^W8(-^U汋m62?B|jw4CB?/gŒ 2a2fݑv!@a$g'-TnDٸh=.Q m k$Ujf0b蘂sƇt/8D~U{bY6wsr~.Fy;uCAJydq- QO^W2ְL^ȞBT6l,E XWS@KF~vd=A?@ M§f6d=uBpD=܄ l#{"]ߏłGax ǿ)`']^>49~+GAbdC˜W6U%,t{cIN775쫒]&:vi\Iϛ͎MHVE8P}T8L}o"'0~]:|n Dáu :N[ 略gګFbU\A- ZZ|Y"y ;af#qׁ2^kyBgV37|sjI79na8@@xdRuݲQ6ĿDW%4*@`c߹n+'(S!^b.džm~U CfxĖ#tՓ&t tPt@Sq{E`"}8HW,1y#(>\hdY(.!z+>(K(&lh+64Zv(GT<ޑ{F&&xVYD̍~9<8 L7t1,`]8D>{Cwn]z>TGwsiu:@>NJf랝1ש-u{3te[>5*ELgӂ# P^yʮV#xnDH~^q= }ďDzt:,HomAK]C)VrE.C*}q!,y ш<͏0 9E;@ 7Iyt6/4Mg*y(uBlc|*E•`K6 2re[=Nl / 廞O~arb3xbB^uaj?b1,jUfL sifJŇSSZŅĉ*#SVC8= ySɓ:ɮMMYUy>L iv 3&8\qp,U-Y\glBo6'o&cMkµ"'|h@ږff۳:^ͻk zN |kڻe:Ȓgi+'1^lPۜID*M/޲bĺ3H[׸0a'|O'H]=;$9N)0&n){%TZ}CMr~d@*u d:œP92PR#cVѾ3l׎2[V1[k7\ Z#s+~ * gb9$cњxK])I&%4}&?lnQPZOʰqpa$S+qt-07KSPˣ85Yv ش rS t?]uPJ8dgKiZ dk+'@7QUVӱv>>DKADkkjfR+V߈/.ivP%KP{GnCK)\LJ`EK)݁@7@&^ t<δ]7Z dU{JH?-H.=Z߆3 b+Ez 2vs[~ ͦ'%=*(iAj:, r]cpz(_fpA^vs+CJQ;0 r:Կk87K,vcX4}Dtϩu}Hets[wÐ25VXArעeى\UzO~8g"z$ >0Is%yTSޚaz?Ȗ#q1K!q,srےtB(bz*4gϑAqҠV.z!`S+'k:-_*+-&X/NޓVDhT{ Org y>@Hy>R :àcE}y X߂FG}kL7ܞ9 )aehL( r( !W$y%zåVD,Xj6m>zMd}}^4F\|qDq 8 pmBZH_VolTyvw:W]ŕ4KѸ3}i|gkrѰZށ@g9&^H$ŚZR~jN֧k:™YNjb`;Y۞d[v4LtB2$4q$0IFYNضO$?uH:ikuq/( y)AA3ᴭ^v?mPN9aDa_>}Ǻvk± YQ.\n<)8Գ-غBUō8їt<)"'PPG^%!VI 9Yr~ w` ݗPV}'9*$뎰:!`([dAFS=ź%{bf+V*8l; ~tJ#T :=>?Bsp3qo&usZEMY$"Qnz^MSdݸVٽܺ­ܠS>iCmzeyWuZ.o1gmz$2[<ʳwmJ?y1, 7'͵Lt^ZJDƅcGm*5Fl Y& @|M<%5* Iґz(hFG0JS1wg3M8ƌuJЊrO"`^lzfZlw#>QfH፮/1Hi9&h|mTQS3[ ValڢHwE\)$v_ݑ,15cJ 7SpVj+I ^ځZq {|ve> ToSF}(f^L%frKe\{?pPwüE9!R0:UDl}t[UkiW<KbP| ,gN9gx2b7ۓ+F%` 7E #$)0JF:Bt&DßzH0uVϠ]>Ũ Rfo* 'm^S1S4Qo:@S"\Xbfnfoi/Djf /7C ֏r.ǵn$*n[nAU1@Iˈ9cx}a ~X^#͟QqsT㟰v4Qe{齚7rqԅzY("G`=C ?+NiMJ=X8'}x ~+ˡ\:ږN:Ux&-i.IJi.'sֆaT% (ˊˎbW/hI}[.p@uQy>NO W#Hj=像?FRSHy @~uMuX\aGӶ}wŹݔ)Y.oK2FrvzNP`\5 SD1 z][e'yr7s>"}>i0sbi'! w{xr~ raQ^0Trgm:᫄Gt%RX7/asݢ^fY,KujqQ1.eEo܉(l٬gzo ^ ?H?.NK+Q[t9!F9]u1و8 6a.|i] S'h&%LǛ;oNftlxC&H/!X{ۨidhskp_˟J?xs"K]F7h/q{=)_'(Sf`^zwM?;lh~a y\T KC6_1Dگ:;S'"vܴiL;I 1`TÙؓ.Y<*Oz<ŽzC' ?M4cMsƧbBDO,!=!bDt{(MI6dx R ީhpsUdMEL>MSl=SHDבcK[Kz\@<{0G\[#!b9eЇ^'gdgd.hml8X fL}${ؙ~*YSvAuu2c6QLO YKd7ƻ"X?}"^LF.:e7 !)l>\O^2S loP۳\LB% X6Q=qjjJ[vaDT_x2v ڂ%|7^VeGh P! bo97`Že}$ቭ9-M_1JG]{<, 8)&8e+}v=8&&0JR!ɝ&#"GֵR'ʺ|M^A#l\Gh%뮕MmɾP݈%TGφ16tާ*YQ_Bvj}Dn8cXʙe]BBI1>CCHp-.ZI-ʸ**ZSP{®'(o{L`S;BYjJlǓT D}%rcŏ\0}#}т %BXz!g&'u+g8ȁ&ağ M`T@c5v-S YRqW}yzjjuאd.2T[vBt(/gÅ5c'4V #S U@Hڽ~u3uN⽻WK¼>'Lí6gP_#xN,b>  pMf7}!'ud6ϦJ@l۫i5KcMt~1nv>/k0rK %Ҋk[܄&;FjV7,kYS*[Ր/DL]a#~pEbGt#G&RÀ̎ƈ"Xhc}FMUPV(KWY2(pyR}?: h 4劎KW |p~7'&sg m76ʚ#BAzzB!>>zd5,tV]ڣ,fDݑ|bNtoj̢"9YCUݭQ8ATOs ;hݨRb哾[reHҔk!cVCğ0" Āc#),gzgľR gj-W ƳK|]Dsgrz -°w?Miq{߮1hߠ^r] b$po˘4]ѦC 8GfPڢLי!ХIioZՒEq|l {2#R6s]JsIk 1[v(۪54A e7zFb5HZ`w;i^aJ*!,6X-v>z|jVmԏ'3~(MYU.7E^MP5@#(kv>qz3 bN7PH˖:xX?6 qTQ}4? HC^k-z" YRѮĊwY\Q߬]"h2v.gy"4.h7SlHn^Ͻ4[1 nK~w⓪p by 忌VS2 nGU{{sEB8umU8,mB>:E8(|YCT/uAZP!/ی vm{,:#O ]:j(GqF,V[g4?1U3i)a\APv_K g@dĒpՎ|kQR3EvA` {_jf;]۳W>/j58eXHgEsK?ix Zpm[Qʇ&H=;'6fMBۋk Fwm\Vںb=-'JXHj:%_P !h`Rj}l;/\ZsPa,a'&Q$p,jʈWFKYL%m 4T(Z~TUh ֿȗ m;IԧMV*Ћn =]|TKU0Cpe4 \pr-ZӻoGC-Ed̆ڮljJHd0c^k#zZhl&tl:F.th}p2Г+kI JW_#4wz2?.*£I ڡDgO.WQSgy܅ tBj64x.;O ۩6YNԒGy/e 嵎6|ŰY1qٶN?~ֹXU5Fo΃AՊU{:Y$~~arp0yUWzu~R8~n:1)܏q 6.'%yi4u7b : 'zDE<@2$5),h(&-k"?W )I0i'[Z!VNp>ڀ_: _TI!1fH`Nv]>'Z "cB'4$ń s9í*Ib/n0ҋ2w0IcQ_  /Rz]$J֛h i9I*{s.M=O9l.#bu;d (✑gUܠ (C)1ry(M3[w؍`Zdfu=LTZ@E5MMis.<`hP0SQ}iE[Sl,[ɯ38 c@s2ME*].V:]1GNys32%}(=3MQ!R'FsOɀ @$`=2N~u# Ns4EU9Sr܏DM-v&NÓ|gA[`LtvXY:jN˘5[l1fn L}%Z tR"4vTVoaDH oOCsÖT#2JM٩6ot$HuYo\ 9ϟV euIzCuOw#;D{sDlץOSAýU=Qj].sTi N3<9_D1o[gTbom5*$ }YWPJq ;J[e !1`!D z'9-+= JQ&T(ߡ6<8a1’ R`?@/ƍLgw"A$kj JhZd4wOdE~ڱzHޱ{ځVU6i^8ArަlNVkgr<x]J~HĐ6Y>{ݛlRh؉0Ћ`YJ́Ez?7>,%6:_A'46B_j-9zׯ,S>$#NryPϪ£?4>\O>JEt5c>"eѵAʷ Rtàe,2դ[ 4D6 hራ68û6i@d$'TW$mSW&k 뙢\IyDv.t& 'vnT't>F3<,}jjycnjNȎ V0ׯ"@YZ7/S2B qk@-fOsd.UjwSN7 |:XO (Ӈs?% 8ؗwzm38RITI?PgGQ$VKJ8ɨ>%c񩢌" ũ,NJރq/UQV -D>+☺giі#@N;1wgߤg`qGNCtiju݆훵 } X[JcgTr+Ѓi#0!?7>_A, &䗃ȜqBP6̋OPj+0f K ; q7fk;F2p`"|'{8Q N3c} kGBP?Va7LB}% M YZԊfp|A} Y$cR*CoǤ:Lc9<lEۗqdzHEnB_ٞGos93_isE*7Y耲 w?:9ebTn)n2G$n[HAJ8AulN9&3RzLBU{%F= W6ڐi6FBʵ$ <R-/ X>Eư  }OfAc#\ԧb QLX*Z>%D(Y7׉4HZʺ~fm֦U%wE&>s\[W`D ˌ=8C>}a ZwY',TyrzwQS"pRzŝJJ-?bdg] e#c߻r9< W=xX: Zfhv^* ~8O>5z4H1] V,z#Sh7`4ӆ/m k }oiu71気hhTA3sH(Zi7}>Y5V!?4< R1 Io]ip@H{-'Y$&7e+Ֆ,i3ğ hG̸CEK#Өh8hc -G`[v@v}$8o*.*Er񊅦VX!Thy|Ezz&"F 3ʓ.uT]F٧#Or_/a d;! ͯҫˆ1o:Q8٢uK>T=PO!o*+ԯWUd~Jh0۠~Kj-/MDCZL2s@1Ў)X@G\^ͼwC}cIn9\@a~,L:y1goI3Av>nbB2,`ԭ?5>7yEqֵV193 bX!eXRPJhre_!R6Qs~w*Zp #Ԝs3z\(H <2X`CF䆍NsNeZx0B ?DHo1}b14l vg> N'j;= _%aJZ7>S#'%Kk6 5>X?''g&Ӡpq)[?~+uPmim݉A-r)?@a<\W(t&RD#~V&eGP]¯z3^{˰N yxK m"d ) _wݙT=Zp}skjF_Y8,Dk /($yqpU6%Q6[AdEE^7z6A.$=i9@:ߨ؉Vy*`&gzOA(vJX.2lYpYfJ6-R%aPx4ć6~9b#t3TR,2IFJAj7YU _% ,.@w=? =\1摔H/ M0!3P m3]xyM4|Ӈb}a|HN]⢥`4E*3{<x~D50˃Oι8L;~R+9Ua(м:킦} TƛDYq l/0Y!0@)~@ uhL >0NWto۸2՘qv@@*5QVAXVBSwO+p𛦂~4u\qv?k&noUD5_5fl&O`p?xM+6z6xw}ʝDcKhY]κD+]1Á$Vp:uԯH'ՓZbz :Jk_pQ-?IEaXj`紸ۇJv1~|Kt "ߖBx5 d&vl \9a=U|{ ɠa =HۜmM2&z*oTjnumΔM*XY w0_ZGʁe(hRE/yJ8lSj_":wb` Bj҂OƋ`k_p(q,% [R\Spۉ &*#L(FTGb3JQmJ-O)p!3k-@Q:>b#9TuIL8p"Z7Ewtu3Rxٰ1ͦѼ*mfИشM<P(L^Sۿ׊?YbM](B≯v'\X36 4]WH0b(C%̋"$$=1D\Map̝B[6JٵqfM@^h{,Dհ;̓P676kcn`)r@?W$ؙջɊ]~vo q!N/ gDWRqfӍ1ZHi^8V4k Zś DgElPmb?. s, ssww?Zpؾ#WyG9m})MQau3nOV\NkWifFoA+My@Ё0N*|jTFp8n!E2:}='*1WhHk)Pat1_=,m=^cf%M=-M:8< wKueuPB^W:N%ZN{X% K!:X!Ӥ8:eW:_AnN:l8]TS[j LSw3 Ubح9(C4} J"}}QKk79ւsGt#%a61"EjpԘ%I4'!&m_!a;q_wjuI _obWV0uc[3zH8F9|fCQ*=!z[߹yu zdŔA跁./I@1ƻ' yH}Tۤ wrH\!\6A\ꉏӚg^W0agt \&coZž<1b־dxgGOnej8LJ>'^I}TYƒe/]8L. >V$WSd;.tIJ?q^ k9\ywyXFʉ@=;4V|$Gr؏ߎvi(!\0J1A%X.]L;9w~,ikCir5{=6d=غYZONQu;#3뤩J=? n7)[Y׈bȅwRzdo\;)cW\=ßipQuI0ϥ+o bPs4cu!$Z0g &uoD6oe'6t0’՗R61k7 )EݰwqW_ήnHk1SN1\,cʨ#gR4 kֹTo H6v|!<-\zQI|z`~DhJ,>_?5? w b<{xRM$OYL1I܏!_8Ol312p[l#^Hx#LkEra#d;I6R̝\q¼`تA%έ˻-cJ 3J4Tȿ_f T,B=e_P_yDB '# u)p<+k|x rk@ $UL)0msʴf[3]u6z~_q2kώ`zϕA;2^/$`؟cNÊxo(eɻOJGU$/ٽfU!;#[[ Oƽeؽm { &ɿry,:89}1+Ge7BW=yhጤ8e7ཐZ&H2yZ&\Δ&T9,x#,ťWzE+㞍4_=gN7W1Q-z7A U*DUF %v|:Z%"`jnV|U$.Ln@h{hߊ/AB`M8PKv7P ]-ÈaoOqך|j Qh{v9hF%H>12NFaIFԱG֣cQ棌*ֺouʊĉ㗴AU{(EߝۨWHz|/5.qD6cXSQ- tREI$5% ae^Uy& ܅͞NM>ke/AY1>8)ٖt*֜i-%2 V{^& , IpFfR8h_p,&D‡@Y*Wn1S 5E]q5Kl=ȊK9C-!&g}EUK#+G.5ӗ0;P,Y<^xzscBAՑy.x@ e HEx}ۡ/b`9b1SpfHݖ 5Y:1ffN#:o)h};]u>ØAݽ3B8@ ϛm0|-ѡߕO\t&hN}7{Ksӻ`du:0xW4Öbu ͵Ǒ`sa:gh`'Z{$zj质Y&@L9z.nq:"7iʸ聱(P Ɠ(G̾z`,,U3 cć0^F(Bؙ9 _zF4=7(Q0U$פswm ǥQ~<"-Mh ?'fTH#?xޔ ,Q܎fd^9?FVSnnW^c2:VK<U@Ɂ-xx фp/o4Rk$݅kZd0cc7 Sy.fb%cT$43rbDMƯy2bM{>_\ɯB{O F'u|O|-TȐ`U*Rac3 HЋfѱesN-?LCRko9`S\Y5߯l?b}xミk;@ ]x`d+mHK(@Ov}A{:yT_0 zÞgNYliSj$IɠM&"baGv#e<,9±㮁gbfMmq 7VDGZ0^)=\yR:ܕlx9YyܺvWti|t$ F) +3z| $4)(@+FYn5r Z $؞T5psnVOKBޥ}UEj[Q@=2{NF i6@n O0Y]OV]lَlO_n6MPQ94(B# 9Nj36@/J#o"nE]r T`LΤ Pk)'Ho&Z}+d&C  0MpF@R {OWkx}08^o+)gg) ۜm6xz>Tsou@sM(#y}1=y&v! *~Amq糋3d2gOt~BpbO*3g2 _@H!b'k$ߓyM;S^1޿&-sne @YF 1Ulٳ#;pL!Xtsж1JZKLhL9w1V]r6V`Oi`aLH=d see{SWRFGUm2<{x4c5j@E!VbFƶkZ&0rAZ%il{bD*xGo aƞ\XrK7=WُܞM2̰Ż 6o~uݮ$ྙc~!'HcUԩ)Nvu@cߧstbb`x 1q$b禳lʋ̦כ:Xe\ob~1g(i%PCWwjz݌DShdM!A]˿l]}MY*kګmn wmdRkIju1Iq_0,f)@-AAmkNw߬rIϨfL0W|Ff&5g 5qMMcA֤LI}ǔlƋ Q$+(ƪ0 % _h,)M+ mae6*XaoT*#Qkp!_95[}K0P+wV}+JV_SF! (X^S&K׀JJd!5xU=^ eӴFrES`wC:u_~@uܶJnv lҧzL"+ؚt! W;#al|F1T=lm!y$oVfXYdl-Uk5LW" t{֍ZwW0'XS-üY9?Dbdхznɕ7lP10>Tj{ƨbAC2g`OIvFg)=iۢhF~ )7"@}و({K[HTe[62$U},敳*b5eI[j5c~a!ؐ1AT%p*9`eƂl祥J% i3tG<6 nn1|9nu)]r`hc_+]3U&7u|@~tE#5PՕ#zTK2TJ`[]%+ +G\ e9*KK[2 S (O[|b4>MG]: #A[eԩ:9.(0ωy&#m0W\oÏCӽ2f}Xt$yP&aF%8P'6\87e3VAO +jcrMf=n1;iTX K'u OlmJ2ؑĉ:m8~/0fW\\w jﺨ8еP{!E\SQhL{oFJa emI]WmW1^B`DZїI-Ml:h}_$! 3~ƿ3@oG`iY35a61E|C]Oq#cTWsi!'Ύlوtej+=#%/uo13&hp!B~b[ϐ əh@_:v2PT,eƮKqK@ .ixH1<šOӊʖ78~DEH;LJ^}ᯨt1,;Z(cf+,Lġ5A08Avo0 8gɯᮡhێIK `S"h3.'H Vq)ǴfIiu#Ʒx*`O~޿WwasFY_0zr19舤Y$砈c;.A}oڦ( ]$Ǩ 81:09VT5AO8`6[o?!uֵ!+{X1!=ZxWxS"$dT·2 *z o<C |f]/!(=aB]:dnIoR0 1p "U8if)|@P쒨Alq Vo%W mbRP. 1 E )w^csa`*a)Gk&`\2H=iOHбfxIoFRH3}u1Ru.eqT%hG;@_6P#֧ reb* ΃ѱ6ʹu+1hf̝qE?3sI; U%AFOQO`jcx݂T F.,2 luq$^ڈ[ݻ Sj0b{fXo}05 gL fy?9a> 䶮27"FY ;|KV0Q6z&W⿼̅ UWe 7v@W\u0 DUU%݅tI֕Nv$ #NUB.UQl{xNFR{ *1C!ΕGn:1;;%T&4 /?W6r:j(ECGp˅OomX ;ag5 6(7rXAЕ,Z3{U~װ]/Ly% KYK_YS(̛ٝ$ \,u9N0'C c.%QtDSK ', i ` m7= ։i?ms@|1e=>=! ht 9 l#/$" ?7i\Do5 zC e'X*<3(s} ֎8㾘q&dzCFg a^ .H;EDcf8NKD!x+I(d26#?H^<1 ,U2cd axuh~3RlĆw7T0x`i˅DĊdt i|M4TL_x 2svbF!6!8GA ޾Yk/8f tE ?4h =UڽAؠv2qEȵ9go)7qQ!ƙY!gJ̷:0F4 Z:MA|Mbh7~e;,>%,%e!pGH WOSƛˠ),L!  f7$2ykJ;1 uz逷=UX@"|U'N^;wsVv/nP0gam`R 3*? #̴.mHR} ZKNgԗ$-GuF*G\tuNSl*OH/WP=u%YR AjM2R$\[MdzmDVb8C*$ q-MBF~ԧJXխi?X If:UXFeΊ1[ ˨ l,>azbcҟA;L5j5׍T:z2lhkQreR&R$FlT}wnZJZ^ ?f(BCBc疀Y  N9 f&օbU"VWGU h&Y}F*+z/bAGAik$kXag'0@$97֍ϷMq(NY`*/ME6kVń5GC u_2"ف)Y`s#tptG\',ϭmwVyt9d'8פ/ӣV7O;2RPm~i;g-l ?<}^{HN'tW_ꠥLY?v՗;:"Iu= SH9YS}y9L\b+;OPa9Sc_ʯfDbc M/UV86zA@qfVL "fXpXTEL.OE9|k) ⤄7 !% Ў.*E> C@j%F 襆VViw\!P)%`lܖb/^b0rǼ>L]?\4QhY bEڕ.^PJf9D ߏ {7!NL.oo:!Ҥ8~26Ktp:rШvn!09 p5v!HQlPk, yٺrX8 KW6%r؝Oa&z9PH右>|"o?׌ᐏȼ,EKh&/~UA|_uH<Zٔo^MX\WN-oT!"Ya+D̪YTY)KDzr* /fכk$iAgk7c) R! 5Q u U=V;hY^%ʣ}Pvǒ%Ŕ2 d j^M#A3 EqpTAGS v- Z`ܡ,zN;\vۡ O3!E.Գ|Hh75)ogH\z X vDz =ݨVNr G .o̪UI5Ehp;yy?$KeC+I6sT!{yXvu+9A:8~[xSD=CCoRJ$V'# bpܝ =eH*MҖ$KIW䞚#iO0IKQ`t+2C2H"s5KV/0{Ȥ#\yڻq>9.}ӵӅ ? iT:><-zЊ/{@EU4M6]NجMxAYEQKw`nY+(ҳbobb2Xl, U^WT9 ܭaU V'd[s{\"%.:'35 ltGPImMdrQ fȺaNmd86Sn9'?:,W??e֌ULs+0O'Tr .&ø@~Z.+2a{h8aT:Y:J䉀Y cQR nvVɂ}8B&qh 9$Ȉ!&~V>Lj͎zCEWp}5yZUR|RG\y[`,F|4X\jE"P8Cy!٨=>#R5/C~!ּ֭JzCXw=EiկY*%&:`zi} 4Y&/25%LH!A#`k[VJMw!~~|QE4A;QP.Hrc @T1)9};ǯNLjmff́8N,a`iK@Z’$֟z&]:q5WY?}557h-D%gQK3r!iw$;Yﱻ͔Pʣ߷xzB->=<;;(Cl)O`&6C>r@F)A,$D"!)pEAڅn6m[$ v7ã2!+ú%`3TH{)>asx9þ7]Y*j%31Osl&jU*Ƕ?rr\$"qm0+0!bVs*LC!I88B;!U%MxBqm r  s,]X,PkQcr |`)g6֤MPL53ܥ#WZЗi61QJ+D{NF4c}s5tn ٝOlO7kh91z]d&W0t+Ҏkd61UMR=VaօGW}O ,xKӢF[Vxfk ќқuǾay]LDoSO#Ax( 2I#!M/SyUބ@{ow6}_cѣ[pA/wQ8OkV ąN3:c;Ok>[iT.X)k9&޺4&O0Q[qZc? s5boP2 >^HKR;*vE*'pe A8qzMژv XԞ"y~4_fA̛#Vf;1p`8xxBvp;٣_cEڬѻ Rp uE_`ߵ@m0P /1{"?ne)[ĞRE> I\tȄe.__";` P%ᶊƒ ;էG( tPL!O+"$։Kxp39$JD>+er1/XZi&;ŚAd|'sPܤG+#˩ؤp9=Fv͖Z|f׋`@2*EilLKHN8sxSx ҽNJ_g>BQ8Y Kqu_Z`LĤEOxMVf/x7j'm46=D+ư.V¹ht7fVq[ {a ;?~q7sT ơo5||fszv NgC>h4'Jf_q.TYG8km2K+t'ZVoV5@1in}gYE't^;kqܪ:j,!LE\GWO OA:tvN0P( ;{- s8># vdfr2hwVtgd&ziݧM'܋ mM1ZHWp-a#a|y/#"4qA/%:&bՏӌcLny\#T}Ld3IBl e%fmdm5wY_YaDQu(vv(o4Y>8'כ- s'~R*VsS$+Y*yYaC!ĵWdT Mh!4a:OCY[Lj?89e`3^*a 8|棤_sRXvPۅg&ega3W n5 {Lbѧ z&%z6}_Ay[l8k(1'k/oP<% :jn*IeuKP.ԕ`ҙ,.piiX vSBD0bYpZIx<8B}1kiKBUԽb9-"E5t5V>޺E1?i6 nKӛhJOG6UB}uA?JLٞ, "|޼'68o!1.Nr@m;:NݙͶ}G6ܕ5S34H8lMz(|0vt.*6WE:!K܆^u=(ܸq!=G㞞Q$C|xbRM#R3u"vo.0ȭ1aU0]-McH8\o -)`rj\] XQ7*3~9Kҍ>[JEq(ndKu8AÝ9ܷ g86!>[-d_C,oםPKu;M 839]ChXIAwUzʚ_Ǥu )]tVn֭_w> ulwgÇjn ɑ!$rEښ ?tX*l+d}N܊B{ zD$|:F^xBdPTd5<4?t>ᠶTP{:%*u_/!:򳠌RN$ tYgEP3DR93N ?48XuYNe|J0ITH*Z*!b +Uzbp.nwznC c(CHקߒ~/ |6'qxg[_3E;.1Xz,ۑ`kmG{)O G[=9W$K1c&x1ȮN2->6"HƤL>t]kA#$N& '">QMPQ ef%zzY@7YKIf:-[I!7ϨlzJHDݺ1? 8+dR)݀gX|0hzzX=- B"`VX՞2wGa-,,w(t8z&G˶!"#'Grs950UbeXda&Oai(e&U V:UvTS[WPRXCpPsЮ_׀>Qdk[OG9`hEqy5LoŮeB`J,EYMc?W%yk QʱW!Mؽ)($\+ћ TÙ\f*JA\$^X wWd_έc!-(L~eJ+t_݈o7mi["!PE2jo:ND~z}:kף/X!WN{Ώ+#%\'$3^7fJg:̆!UB&L|tQCW+njjxԀJ!%R%%%jWVyN,/J2fBčŇkRg\EB3v9hs+`Ĺ@1`Tʘ-O׳'ý.\=y7ib>6F{4r=R O+PX{ivcoBFܧ>zUҴq0{ݲ sgn7d%(w#}}ZEWEսy9e:M+!hv( z b'$`tp9:+#IgĨOhd@\iHtn"__C"op> cyo%SȿzT3c JK4*ȓ[3-8 b 9LPkB!!Ql^pj !??7K=(Q2#GM\WY߷ m8A6躁Ijp=Sh >cWQ|Hb.ųG(|* ]\cq 8okؠv8lUdA?yc"P3^KJ3]NB=D e ܗT]VtYקmr9ݏx~6>aM%u)!ru#찎CbEzv.SmK rJψaF. ڂL`H_t:qCg0P|T5EЛp/pGq9Բde SkO5Lg'ǽ?/ZbVJ\g_x%kzI,J&k,2r'ĻCzS:Ru)Tj~H\b/h:ԣxcATLye.Vkr>2.sL,qd5h+$맘wp'"_hS)F<*b! a\SuusA\fs9 qur%V@Gs>boD%kR̺T{JhG?WJ$D3 w< boQ ,vz1 7A턯񎢒TP5ހ4 hwD2hD ,s!qOyc 4xX& CU1vљT&ZcgykQ_)kЛ-3uvod,rO;S|Yo~!x_ܢR1%BcޟB}!2-j:Wd]l'-Bde*jb NrYYDA5~hxf;+8ѿO)+u ijEד$"z/j65hLjv2oM ::J>[hGt[x6NB Y(1ݓ[83"܏;M<6?t-8Ңl@q6^C igHoAB4ED AFٺ7淃= I@]Qyטkj \"D <H6L#V̈ϸk#ZG{ 6蛙r8i>ǁζc"֛עK}W- ~ٸ\7 IN S54n#ba'EaM;:j$ 2 ̱|c=UuX.9 T93EHI\k-xCZckθM6=$Pl]Yz>wN̷dۆļJ hk8V$ig@0E5=c01mZLQ/ʆJNbV0)dHC DƱvfUhP1"#du нk΂{d6}4@w]:?/}ļ{?@Y_/NmjmՎT79pܟlgXju@hJ'F@sewS nu }@ :LS&+O`çv3Dfgy1~G)$iz8 qy)[^f_ ϭmv$׊퍃钃\}|]tP0uM$O|7n ]Zn%`X؂GBgbܸ%={xyj& !އ qH)zVPn5-Ny"U(Uk(w qΓ9|ulϼ@BQNdjvn0z3e߇g6aZ^ xF-Jisyq}tDe6oh{!p 7ґ\><.$>oȡ_سGs@ }ݷB(Ş%I2ft+Uů K /!k /, &kwat3诊[)kkZKW#VHk8լ?"T{OOmF?zM"ks0%Lp;lYWڻ 0PKs̸tfԿ`rf.h?Y5+I8l[+o9#un +5h@S[ì0=;od298aqV0P8]$fKIjFa;ɛ}j܄Ѡm3u9[iV*, t ;};Z 6D|> SeD|Ů%xAӠy8FM5EPuą(PTV4~s91d:nأ)g5k ;#_,Ϗ;ul<<ۘF lg{fygRC,K*/R!-.t##D|MFϑt?Dq#Y*K!CZl$,%J,?v[uo;x"Qb펬>$C/# &O)ψl$Mb"a*Qۼd,?K: R##:/k_πgAY4 ie6ے!ĂHŮL$7 {C"&~V=fkM ed%6@_Vb3g}1&XHvc=* o:G*:N2,Ԩ;y9 yUrftiP׹3BJ#c"ygThAUJ1W{3$Dހ̮?0QF_av!</գǽqؓvtײ˝^rQLɆl,9 d\c1fAPf//o=NXP1 BQᤷC} ,FF:a|F1Rvȭ4[ϓ.1((s>0ӟSq60~nL/)J5bjwN|  3b-ם 'skb;^*Mtde8{),+u_ZKKbBL|h?asK'Jc%BP+j .٫g")]~@\nHotIe.;a.8*7z,T=nKX.$թaKrm@'\J? wwF4$yӧILTg#qnJ4=Me"yarcF`jaO ڲYcO!$K[dH2DoK r`[Ɉ_E˃&!lr(֛]{ǞƥIm+'%V5nPy VZPOjt, (m/c4*èTpؕ3dy^Y"(7NCoeg/8-k tC^mtBb DWt8~]I xj9I3|<3zsslY [Ơ+O+D}b_j_a \ *a5}+哩 ʉ u8}&dsTfE/ UKvfˉ}^~[yNR#ѸRخXb>+Yc_5+[vڽtO @.{u(V=]e%|:a!X.QRGׄLw0֗'h-J*/.#rR#ط؋P 9ŢYUǐLj9x&G#4=dlv'Sb [C%m36Z XL`y.Qf65Û(~Kxp$)d3M;7=b-T;% 3TjWCoRuxGɐKS~iH{%%] Wj[ئZͻ|~O;fFѫY1nb>}vqNJW9!RU7i\G=yb_T/ 곉7x\Kٿ"C2+?afAU{E8p*z s,js3FRb293hp6<Yem!ټcSqi`-昚 ;?FZH3Rv˱Im5rJSLJMIEe%T D( k}yN{yQk~@=aHy]'/My ]q7qƖdQC[UUjW;e\@WyTQͭ# y=dC߹縉V??S"\]G>'z__P5bnx[;..;.cq|j)ZCAK獊*n7pTM2g3SZ'S]hf?~G8Q^[8%jg=󶶽=[ =^["nlK^2Ϳύ5G 7׭sdXI7Ys`=v{ʉęG.8Ib}yŦf6^vݧ @|*8OHr"?hZ TWq 7 I]<{XGB>Sg\eDx(Id}bfc50r]/1K,*`@=J_yy]>vZ>:ߎOjvJHMuS'UPJ2!<N_||l mR^glR9Y׆0Kdޚ7L^;yb4椇kbhS"#cT53fry=שP#bRPIjT@)o(;fIF'=jgDR>ƚ*ޕ3+(#!;wdiBisuQ>޶^8ssz8I /+h VMFG?\$61F3tS~GQ>A_wCF$ߐU(f\*CWC4dMUl+z/.EGVM\'`m]MlDp}TUy{$4O5[w9r~Ų ǔm;7q䎘\ʧ[)9=gvq!gCICI_; J'7pOH&?]o:gE2F]he)߾LBv9M ỳIXU bO;5i߁չOl<Ͷ.53D/R2{Yp16`4@kd՘T_g_΃jw=XHI!5c0?( y!C2r8Qw⾥ܨmF÷C&g`ba[wEW@g .nc1P uQaP},rC+\ E}U k!I] w3^[s=ျYVPi> {@̀sĬ V"XcImQw'$)čLV} #>((ah%" 8iLkyξ`|'y4(-l4G^lJNy-3}a:MX )WH^mu|ߐMIhi{ S/) a*G3 X?5@[0 Kr,M1f"A/Җ $ˢpg.kpm'|q B'v2O+Wjh:j,st)xqN\1@R_nD/ $ץ\ke??PjqϙBqA)E_Nar#~yb|"mm o,5Ёi->g%`\K0& ۻn2N&6. `gAYIό'~Qne-̺'aY"&9W򥷩nN?,[˗hrU@ǧwg֯UKU"'@/Hk:?EADi9րO Zލs8:ަtsbkx$0?tN]Oٷ‹ښNVZ">56i~X Hɔi@o;aΖ 5ˣt~eS-=T%7Qt8>,PKF,0Wxt%4q>( /Q}ƦqI&N.检9'qHK"!~ͺ?WG]iw}h Ǧ3.hȄ/Fe[:;[zwNh~ͳ ZP6ۘyz/}m&ձ?_F:Mjyzy,:gMvG]eahhaK_h:b}9tnjHb?UbF,IN:KĆ-2VuOnej'hC +HY .$T2wOIVKh2 cNy@Gr#l]˼^Rc=$=YfgMܺG,v\uGPTP紪t3йk=a?,0锄{u ,F}V%0~CLNی= _Txc@:]ec1,8#'N&/]*&j&#EL4hs~n*$usN~[OZ_p8 n=ZEiFz~c Ҫ7%3OgCX >'x)l/3cz{Rcr/P" f}&JjzOUT_2bȚ"Z #@n_춿ј?-#QLg/c9gWb?w@ک bH4pWn3j!Qm4k/EAZ-浵#n6.p AҒ yoU')*ѽ}9t-f.u1tr1lOYh~Xr-ȽGa:*kKfHk<^љF<]w1aXYVݱ5? tG2$ Ə{0Bs5oMU7Q MPwS2T3*$5#!VV*':f z9}xI0ܔu%jSJπ,р-Fҍ"R^oL4b|1rQtJWQS䗇c;3D.dEfBv:Oğ ~X9γ/ TzE0,֍%Z~lQBV:3x ^ 8Lu=Xؒk)FbO兂ŽJ9+h)K?A!P fo5 dbиt^ #Hۡ"81g$kl!U)cL1W `ZVUP{N"8nPƊ"ns:_%ϥT,~Z5Vx\^I籗: UM:1lIx^Ic_v1A7#:3ߵq;2 mB˒ \}V;ˡнlyLKOxzM*w՛{c -t a-.;IUVN&-=a )O>q\؞Sw9.K >Z bwꩃs @$%\"m?4#JvggLJL*t8_2AcNq˫0+ip`CmO2p 4-t`#f \ĽDݡ>Fa]TɰX#sCn4Y@N 4L*u%(5)$5ry}m9+X`uLm7=_~w.ډ]" &ו*y s@ToN.O*tNi6#>J11bb.[]VbY?~)ޑS0-&=ET~GB.@y;n>=amT'} R:*QP0U"bcH7pQ>['&5mVҲSq'"6QUP'm4Ayv jw"CDUѦu\?y`=zjVc~cjR1(ourL0eӨi&ӛ3ǫA5ؔaAtt/Ҙa޶q%XXZ]JӓkA#pud IJ?Ht×=zj5V=CpJ2?Q0@ݦ; ;77-`FB+u#SVЈ0MxS-SǽGGmar^IcM FҀ׬,z l!_ȵ4}iCt; Ol+RjCDׯS&i?EIv;:C ۍAEI7qHSf8/R מUhS&*!KqDuݹP#"^᳴?|sɚi _v$$~x2wp蚃k$iM`dߐu.QKړlSы.(Vq5[-S\oFxtBNSL9 /qjzg{n ݸ6JUnUqJ~g,)lir-i4sCKZ&o ARshġJ,;fyC9N# <foi/PYYɶx#+tlRz$6+ 14c TՖ8zTx y 2IRJPpCRxt /bK}K}Aem<K$VkJ)ulgIaiBݒ뮁Uq})֣$A&jG>b[Kn/Z\[yX?'*x39|l,t~}smWc\O!AWw'-PCm'M40SRz UN%rF5޸$C_s ȣw0#D) Sm%)Sx7r >Wq˯`[HR n@L۞Qfq}alS!BV@1Rm?̮r2:>d ř2b@!L~0U'`y913Re?ybГm t̶l[Abqw~q-Ʒp;S4d5NpP/Wydd K{#V@([Q`*@ `0m4TrM4ANouX6䌹 i5- ywn@rLRORֱ /jʐ[bM{DtFP"(a7]-Do:NJ׉[[e{-n3L Igߪo4W':ƽ^OB+-S[ KP5ĕq l89P4>H85}6/ekå8ώǐT.}lW;v\hE鵾z5Xb0LI耻f&%UpBH>@ |ҫĴ5A-bIyF{dF/D|OMRd@d*dc[Qgd ߆G|^sALMw,mK6o%Jf^|wߋĵ-K Ó&y.NxXK` w 0$.m51lw0ߡ5-Re"=q´'y([BS1l юpK|VfqO}R9t'm]!#Kdf[P |U-(I*鶚! 7L G.#'fmdK'DAW ;KΘ0[+;OxPGacp>/ TC/56ljK#4fФ|wp #k>,[6vsӰ-q?m@x=2W "W蘲XjGӈ>b1uiUX q`CFѓrұ¨I7=u&pg)TnWK1]oY⣏wȱ"YVC#|mplēr=oE^^({\ %睮nc`H|YS!QxEb,{0 ȰoT- *Jv7٬ͺHrRءtu:ci1T09y hKLeŐζfmk_*~luwJt4ߥL~< }=9ڳ%!xT}kxHb 9~)-:KoI x#?&>c^'Pj 錔AW^IɼR̸ْ-k$Uog-!8M[Pl")Y{ƩhWwiR'6Jr QkJ$^d=#'^!6ǏuҌhWiU?"J4 ,V1 rMznLMƽc* `FU,ΝzBq~0:xE,ғ$6 /ɖB˟ Tq|/dDs_-'>Jg3ruJ '~2~D5 xSCgHZ;spB'c{ ie.EFW͍8Zr%Fkiޫ3\5 ՔW:~Xp]e`k4`"3hOEp%P-)ʋ5Ο'n \Ŕ6$۩SM r[Jr;ʾ31B~$cqYd+V`\+L8c@KajCҕE|댏׆65!hJq]:.nu\ҪJZ+QM$-N4оOAwWc*k,X8}u\$Tfrʵ2xk݅ܜG+!% B?=ʭS!2œd7z؝YW@N#m˫P~K_?j:7O;_ENz.?U WZL\Ed>_~Ml+0)ǥ"ne]{0$[k^HZWa=1$rG~Gү~tr)v2֔RMS^h8"o< P43 [ZC;ɕ2zgBe9~. ?ΐ]NG3+ Bjަ}vFuvI1g0JHV/j5dT!{zP-m 6Wm.#qU<8\Y%ޗHD/PuB]86VHۦV4C'I.#;t粴 *.>li,ua @xO-zz H7MlԓD&y aLԔT\W;<us2z.ixGIemb z=DJ +JF/*i_)+k`zf3C' ?q/ "VPg`P ٫S9y9},&K2&Ҏo]OH%omzb 鳌(-}(;DS}L^XkC -ylԍ6YX.>TΫy 7 pOG+fʘkw}Gz`j(`O(Lm(:QW% $&2vPP'[Ѭa{q@Qo Ѿľ,ڒJj_m$5*ivƞHNBtRHc}$γ]tGqV,ͪ6PpsWzeTsmR+*GQ* EctcJ'}$8T+Y37T6*;d F&Qmgt>NՌ[cZM}J|OvC.Tr(4yy,r\ #<媭o4VQay/"%8}Aj6GmߝKB}vhp!HYqH^f%sv ;(:L6a8'lxӂ1/Qha:G0lp>ua(h!Kb"t|{jAEo iSRp'%V.!6+ЊO`|T_.չ屼[9tRuHEW@!墪j+}w<)R~!9gʹGgUM c>y27ѝDiFy78;՚p3DSXTz 1 W;fҤ'Bq҄+G?΅syęFD!UXX ȍIq^E:H xN*74F5k{A{d[unj40xG',HgApʿdYϝH!xUZF$̛߯-~rdj19moT5&3]ڄҸ8B:YKm0H{r01ZqI;v=&ֹ~_do4 ũ .xO I^G+#6f-aXI.C secMdi)#L' yDXRݧ:7mo V;}उ飲"!~[uwV SZ:3 &;o.d#+.Bdeݪ:wx+įÌ \x)']Dj ' d5@B%AJZ*`b /?@'N*'|>U>c 0Ĭ4:;#!])I<[2@ͯ3Pbf*/k5(bT]4; {GiN{@iף.pҩW"`sW_0ּ#_fu\yDCvrFDᘅg ٳ_ܢdLqa1 1(ˆ(^Rw3%h+-\]Qu{"̻P[(D먥:[~AeiL uV+{xY+>&uzuތkۯQmEoE]LhJ"OW B$cx& lo Rz(~@ Y?Ú} KEE5,].itgJ{,{w F `|9X]ԏx禮GWZ)VP JkA ȗ_ms7p'=`dcPbjpї8Tե!jm|ʷ-FdC v)oqX& ZCJ4Ju}DAqPiEk$cϴ^e?jSoͷː96M2y_OrFec;21=-R쾐gG#RW75 9^}ICCM8T|A-oZ1?L_1ca 6|,Yڟ3T+\ ~I5?BdJg#m0H_Bare,Z!~s,~- C*еHi]bN˖&U,pڣ>NToF}2O͆m'f:TW:IqNcV,ƕͭAHb!, 8֢ %FA"~lHwlJl=aSG&/%d`3ҧZhguC6Q< "4F^s(=֔qi3[f;rʎm0ے n-"-wQ,/P4'w2ĉ?6({䡀^No [p[1,2 0#jKjy`BP8Y3Z0Λ{mX&$OdeG+\L81y& 0⬁B1Y|)/agG8azBC憬Oܹ@zwF⩧ ^0myFP=si2. QwE9!\%]#~jgZU6^˵Ъ&z*Sä¼5+ӳly|mEu*!'6E!gvFsshGrjKA@.kv绘KNH[]V}pDaWow` sCXoz1 w0%KzJvf6GfW"Khl}\BM)b5ژ-I$pY(.||FnZ,! W9/@K3#+Z uŎƚrZCIDjW_Ur]彷CdNEhk8"W(p#Z [ tş( i\~Xʲ}ǀ1TYuVPݥS7E،JLœkFjcO<Χb!W[aȵe|;]=P4X;+hڎf׭WDܶ1menk}Һ}Hp8<"VXv})͇8ŢZ v՛zLaJg( BլrHPI=PLMMZJV#˺[, );(͟j4N9Cc`ܴlãw驏4 qg)(&?H, f>.9I6ی*-`Km#B)gϏ@]U@PX+P{J|Iuɰ$]׷9<(=f0~,zh1лL l9qiz4.5h\_-yzs`j(LEЃ):dCW BP&J'&bxR p=ٜ5F\ts]H]DtE~{@ <h&vMBrrc+tO J?ATWMCs 8$n6CrƑz4K:9s + zqàtz[A}`an+vt?)egyɼZ\/1i, }n(ΦwHd>If2QAJI%2zȨ-JqKv.l {pb% 7a +=ڿ(՗(L~M2?&3ý$M( qk=ka&3FJ:To!NД}aPD.4!{ 䖋H:q"_%;~txjb*KJO瘗qxxT=$_|ԧb)}\H͎ HȦ+9N>X>7(nXj+ Yv }>/fjKYQE}Tcx jlgiy3l 0Jei@ @$bkf>fbтgJ,#G m:D AhwV,Èuof87)8 bjW~OA zcWx~ϫs߾Laوci_:@6J.,(v8/ X/sRA&.N6҆x<!ݕ6q9f$B9oGq2+,N}pȅv|{,HkYw^ǺbBQ$A=,WQfjW8,h&1OR7}Vxw@`|zY0Bn@6qs1C wX^N_̜XХ6<& Q%lP՘oaƸ4d8v BI=~kZK,S o*-Tu_i7\ՍO'XjjY6ApeM+j=sБ=P^锗ZT0l΅k IxΝ:ct| 3 fAi (A;ү3zYLv?%rbLnHfp#Q_T1:a_V޽0 |;1 Uz‹QSk$.{[@5ߤ"pt( !dK,JaWACKXg,6ģb<0g~YHXF>|W(DBp$دWFusHUx,JEMbERtʋΞ6@׷WCfx yI$-$/xjR ;%O"@h*`[+ezjz%+vhHUx@(VU6zTؓ4otZ{桩ʒbpdT⿄, &Zrd[<[zޤ fgڎt8Eաl'i a2} C=[;y^()ɖL(&=?q_6WB1Ί?l9XK^9KDc̬Y{YtB{PtD'[b\)p 5M f'`V$A&=Tr| C.[u WcI@E}kۍ"uv4h/?o1]] NI x2@L7uBlLdl#ySX|Xn _bт.{JݸqT,kZwjbb >fegi\0R%45dbc8r&[ b# h^tMgr+(bM̧3.W3pAC;8Ц[>ʕepbWc(ǪQzG|Bc!mwu&t4;d G6죖hƭ{;=z *GN~Ή4nHNp#olVpK]MDnZ;\'^%c-F-ަ{(AYts7)2 %l#boٝQkZ#I$&ubgZyM̄ANيH1σ@3l}ˣ}7ڛ/3]kFV٫+!s_D)WZ FYSYWP |k@؀J8)yh֋u]D, h3,>G#D1 e *]qd{`=kU@ 0^kޙ*H bEۡ TiU<`ѫwV`03ΣioA۝]m}S$E_ٌ`4<P֤eGr;ZKel,#>)83,]0C}{zPxS* (6"0sFH͟(HK&n mc0!6gfu ;R)+᫸> 1Mv3vظXUR쇵AE\AT$qRue݅V";<"GE79t+FŲRj ۺc>fp@gJ\ֺJd_ 0&4cͻ3K=тCntO|C!/.wX'[#606kzdrwO_dJŲ;YċVcCFa>|( x-=hokq嬻%h%jtH)xt:5~? ;, fBڜnmq#`ԛ0f?Y<>BXt9M51Ž-z냰? m!Ր$}N•);yzH`hW .%AĈG% &0g}qcS6XF\`[dzg}]R a5_8Cm`h}8$a|fh4U~C+j&k{ k"-չJ# K3ӭnB}3e-Jܕȗ}<ܚ ]=$C.fGPSu} 3"Ovo ndme@84% {U{JMת |T陷3 ^ڰG+벃Op!<:PI'&SI;).3m!j>WD0gڬ+Gf/h$p&r6[>s*” F|fRt / p٧}(U^ƁBN(  P&̊K9F c3cWMWpVF@C>y nMlABHyuep5BMw/`njʣoiOI+*6d74S*h䲷el?(0͝]W{dBZ ++!]YK32_vr@gn[q+KX/J#~.A0L߻d&( Wg*ET=D-߈НΧf0us 0XV99-@7j]D@ykCh0"E*l輺N*Czoh 'IFt؆؍gGl1(À1:H(701|$y(z6$d'$G+ߢJуRnUd)"U1Z+tib2I虶7gAq扏='< 'S2P6 $nwywZOӔ̕IʮD Bh*UqNJt-n|jxEi{Es}&<$8pGWM}tF_5-[%5|l2\&kmtw`SبI4_W= ;n+ tH&^yrQf3:**U)^i]_f5j+< lY(-_Ƹ.0;G㎋Γv e7/eVsB0}V!woٛ\Nwc' / `ALO_O΀'upgf̎tLc_%\QfȺqY#q[,>/K9 sJS0/AP+Տ8_ʙX ъD_Hn(Y2\H]AV'81m5($ ח:OZ!9/Qj7e~,/of>!p/3dpXD h8*VsB*['7 q1 TX25J$;ER$T q NC# w&f}=g1O _Ƀ]!Uo]PraYYPdl`f,;; zwb|h0nCQI]~إK7#<1d/!RbMiBYRHIDy??mtQ(8_5~=[DJ&Mշkm g5̹zM.,e}0!߁y͓oczyjz07TY L֓ @u0w@Ϳܸ FoEn=h[ @ڈK1b<2z0^2']rZL0fyfφ ))n}+4UKS &j\uځ !U#_{ޣZ5emW kQZH$,D!8Qv;9#5]CX1s"a!JklЁk8^MC3vP!z-XTIZᚏE]ڇ, ?Q߉X{ imb1δPk:e Wo/"Y% %)|+"[%{MlY4qo,P"CmW.~ 5LB7@M#ѝZa#<7kh%*"%EuΘ `Uzㅇw]L|Hkc>Z8ٞnSnjH^CiF xJ_LQ!ML1qc*?V3,9TqCݑ 6ut#<СRzOfu>:6_ #)7Sѭy٢ :t0 U(Ȁ4*izwKk-CRd֌VpJPKB֖͍Fa>*J#qn7PC]c}.>ؔk&xR)RjU p$#  YTPmtO?bra>dc&q  ؀*1’Qn,!o[%pJ6)ni[^/!JO}7~N.|YfT$~f{}wt$Q+DHG%߾<ؒ}ARѦ]{G|PIb8kat>A3.!FSʩ2ܵlS\,ˬA DhY%`޻hK8IWq㓚ILCFpթ2:'+>ZLzҗ_x<]V n ?s-`rE-dGK 47hfIӳ藲Vft/Tc5Km65.TUWl##C %qIG( cPQǿps=Xs7g(5h$?ޝqFZrM*UlV`)aƒ-%$%#RYsݽ%_9ƚksq56[4_iadmK[|?ԍb:A"ܕA!u!Pƞ!ӑV<]{$o|ۀЅkx@ #C 1b%$A3]zWtŕa t۩D{0ҊX>f  `Sw;]6n[E 3A2wMjXP={I?G~=p돲=rD*o Ca̍L @>t T@)LR ]F9ר|K\}jPlGS]Y΃F&fB(#0WA`Mc.HYU9d:~(m;ZJS=[c%vE(2D[浘xKL|l(ZYo(iZO~*Pt֔h*!ǩWǢ!8#6^ 3%/ɖ3V2O O2C^F,Q x&QdL}<"&H%}2Psz|ك9 #C!#Jm*!ڝmL9m#STg<ˇdKrEɯIk|T* pMU4/+'2]`\LJ ɽ H^Ou%( 0JoEW/C\fD~&s4XY5GoϒӍEolAja5!K!)gێ&lpׅ^ywɣ]0w38Ok7)0$!'bj?Q܁c -E"60kk+d0ڥ!EQ%G!״kWN`&rcJ3~ո>Q9JhJ.SD1ճIwddՈFۈҼ}䮈};mWnښN Qu'YMc3mhPW.۾h%MD_{Ă9WI~E1 aZks]dA_8T> g-p!D{rGYĜ=}Y$2 MHG lB=p vˈ:[y$`=5@1j{.&%H2bQ9x 03kytoLwĄdFⴃ6t:ﮛwy3%![ Wsf Fm`Y^~Gמ j9R=[Fs ϼ_xliVC!IL#I{`4Ԧxʍ~kb~dF؛Xko]uI Fk-рv d=>?=aqj1;9{qCժFXƱQЄY ̐W1djujwD<82`ٝae|EDoI2hnCEn#'1IvdR,|$i>nfs\Ch?3E~3"IbqVcVT0"[^'?3>^ؾX*Ewin{$7oq \]Fo :bc\.]0K  oi⵸tx[)Ǟ;r(xO*ŪI_HqWNKC@bvO #Kƚ}>;t 7Pٵ:%CII&7\)"1ԑ'`CH&Ȝ'pdfqϽled-li 6Ch<؊Dm~>R{h/34巎cTy04E76/DJZUNIw~ KUwJ0/b$K U/"Q!89sp4+<io&rva)f^ *& 2I (]%'Z9peҚhzg.3f#'D5e0k+\+De_p@$B su}!e-S}xO9Ez*`:鞾@:~o Q @X)xRsIW6e[H7PXJtẁ^8`l6](7 x"#&j@P+PkQ$Tsa˰徊0lGWf?Z8g亾#hB,NK9o8FZd 9G6*4TUdEYRH M[FFatWl4,Rڧ&9T [ k7ć{DC;LPLN>7Ę`-ާ!L1pb~֫T\*NJ“h3o\2C,ꂜ1KX} 6i,YBr9=Cl7bh>4p|:xk#,а 7EG7+.2*10=Ό@blIPx3J}=3I Jt .+ sOjP^v7n$D C|K;hal'M|N5Xa{[=r}ӺƠHi4aP9肺 {ihu}/):hd.S9Ukq37-CEpvuCeZ^Fo WpF=fb" DU<]of˃G8!TI*Zu23w H#bcwZ=K8OlZFk:48)Gֲڠ2)Tm^>) H՚H2` I[vjӒh P,)[./FzC`uʰtEŊ| cqܛhj?^^yp3=;r*_Z3i_w 1Ұ:Jfi#Z\"K _Z~K n ,p}V`n6U9Xfvuz&?HU6huI~xڄ^7؛/Ĩȥ=G {uj n2ƴ^HDge,!N[u87.tSO;iaSd$!qD E Ň8ɘ̲sj].q+!{ luY!VՏi{d ?:t >E:Jaae+grUBଁaIz3Qo("TT>ifO\ȬwORA.SVKq|^.f[\=hu\ML,͓dw`Na~L~'/+ /Ӭ@嵂De˼ Tu bnQIˌ&WXj~ȓl+ZV-@8weӳqD$NpJjo1hC9 sUp{51ٷbR,˳ Gv* [r^`M|"!*z }?붙5[2Nw8dM2jA0E~&mLEY0LOU}W fU'oG R PBԪm-:[$%F*vP;dK3R2-ЅTbcrG],׷=1(\܃"aMģcCL/ KQj aBO[f~3_F ŀ*+XR#[@.$0ͻfNg!=HXd|WХj. "vCFu>:L'9_4tfQt ~t3ch"UЧB@=f+, C]`S4F_ Ay<e7?V6{ۜbv#c}߬¨M=_wg^#15,=3⇧hM̔{Bm4{VM="X8+Wf&e&@(/>wfe} lqH0أJn8K9J"GlЃ`{-=,;CPW.n4WKVtay u2&"vz>[_XAN%_ّ@ z+W98)to*s1_ SՃWHibK%DN(A7afֿ_Dh^Q փFQ^ yۜNjȥ2Ny};BD'Q^X]11f|(œ *:M,^U|ݯi*1п<ܲSA5Q)at" PJUfXb~5i)\[]ܠXiS}ҲJ/s ?8 oZa`1ct\COY5~SZ @9& ?%}Xz-j!(}&Fl+-D.􏴆ïxUgt#[)e 5I Y[ӵsx-`2QJJv_opC/ 8@v붎%ImKb /9]RVHUQ󢘼&=ft T3@8c위zR+{ ʑ-ϊ2&fo^߹Vs,\]?~[H U  U lAgF{ &_\"&]T4ǥ:>4v]i+=!ׁ2)M\:jCafnrldAN85Pӎ"28bm*{R&{ ]P+Dآ[0:zKj`b6S"!>e&UdiM9#T ]?[iFoLԤzܥ/|¾lM>bEIT ,zs{;<16y 5oHg@g(ayB19;}X$X[{HoDZv^+MH̠'gڠc:YaDz==pj'tPv+IDmο( JPMP- FphfeX/ei,z8vxxwmͱ/㥈%o'.~i+qݣJO|Ӂ]| a嗙7@xY,\s4Jc;UYRA)tٶs(p&:߮ 7> MoXL/ٖdfS3oC?cy5I5?ySY̦bvr7| evA0Fk*-"IJ:j2 Ҳ/.4—ê7+v ?*meGچBD-ICG`vT]SÂ!Gm!m/`O 1tZWW= B<*x"&,8{a9SNQK!/y$&ۡ Ҙ3hDJkq*[)j:rߋ:NYon6vر:p1 p{,2@>H[4bzBb -@b>WIWdh8_SйJA~Vf7\%tS@Jj-xTd,bվ&)!sP[lcMٕ "Rϵ49 ~mlA&cجL1t`t4YW]V6~t&4Kqۭ}!9:ARݎMJs_Bi)(gcmII . O?Jb9LVUS$EXC4 d@l.~W ;>|;gʏpz7* V'\jy KKn9 ]>x. '1_b?$`9M}:bq ]oݯX #& #%kkkS09{'T>uJٮ3m%ktztoCcxe&VqNt&:0JIg^_;G4ymi:eKA9ߞ>]t#rCtYZ}._Eb>܅ÿ@O (pj Ʌ'54r EFF4?QLi5lj80S,jRd -8Yv^=2Η;uHDrX%I2ސrXÚp; g]Atbh6P2ꕂ;91w3i]lzxdN;F͵\ _83Evkeb~ ~#2b|{zЫ<$F o;` %3u-T~( h(NOҌK@d|c~^Īs7[nK5Cb.L+wZj4NSqnePY`@q&LC*NdZƍn]rV% ZZy?0)")2ֵ(5?3!\0EzXIʄ6"Zc/w9$;mb@:#NzU6fiϨ%XޡQSL[ d&N=/``-fSz_ߓOW j͠Lbza^J/fBu0(f\--a>O̚+-x wlu#Ҹ߮i:oQ\ʼn$Þ8DՃ?wH8'+ól?*{&2+gE9\S͏c V&_fYU&F?6.kDsk>H/]E6/Bz`;И7'3ܝrjD "Vh[~OD ~hgGCYFf^n)U"a%'?R?sw'r#dU \"ۚՅ)h9R26L[ZG4F>cG)\A>y/p/^*/*34` >o*Ϝ{KADAt6e/'W2 ΂| |1CC<4'u2mW1@Myce !{tʃMJr]*oг#WFH: 'T_XAn 4w~A]fJRMEVgOsTR2Laz;ya<3 3g>͙\˖6 -X^a9GY#+?@&C u8.õ qMWHh˝,TUۤguդMۘ^G梖wVw Yq|/^*:ݑ>yvXà)ht.i,ZDc5b3n ك7:f-" mbp7fg:q[.4,_aial_?0K`oKdr畄-6AS7lDރL'{]ot6?2R$L/GQ7NVJęnfH Ӛz̺7x+ړU&:OڗBa@: `ƜdDSËd (Ft\x?+gK⑒ЅO)%!G2Zwf&}ZD~NLZg|֡ x]Zk }(,ta? yٰ`^{7(ҹϛUYck͎Mh!qZnX[giD[]Tp@~zG ٧^yM!`CC;u uA[d%c׆֜rƛF6@['?ù٥F"&fL/-N^Ѵ 2ImbSnⵞN M\4[[}#X ie[`\+âHxL`~}Em:c%þͨ7Ke8]Oy$"`^N0/_nC'<(r|Y.|ŁDT|q+uK12?g/U4E&dw<q׸ pԘRvp[ꧥLzc-8GYĸ ΂w2$h#{M׃ LgceHU3ՋPaF)QpR[KpGUBIxRgTr @·oQ.FjqiW%$kS]#Eտ!9Խ@Z<Web Tdk?ɦ,Sec\hv?i ߩ(뇶I Y"Z@y1d^rphȠ _|c"Fhˆ22{"bKSKor5?;z?zuZއKҞ)l˪FN2*NdϿ]G}Uu|ݸFWہ@PD۲f avy7IuG qų+:oj'G=Vw3]Ҝ#ܼU}*4#) +Ƕ0{ߣYBfϰX*Ï3/fi7-0Tc 3 8MhD/bVI4KN)h1}.QW_]r9\d uAQwt M;,_τƎB {oPan~QyjjiǨDwNr|;q`Ok JDN -k:90=ԭVq} *a°y$ K*A%~>>yڔf)KQmpUoMO8?pjw Q:X:njXG ˝q+CC)>qS3b={DL*}zu ֆ,^T>I˒ %^3ʚdr*Ì'%*މe&*fB >,.z4YOtK}F߈gӿ^ւ4Aq#qZP'F_`zŊrpM6 CzwuZ-3(^'MF-YTx!6)F088=iCӫ嵠a*n,G'd1{ZgX]_TJD`t k[Q:ő60 $%*R,>Z0xBOq>UAkg~g#KnPZqJޝkZ1렵7| {rM(aH>wN$$t;m9`hJiS$-s-޸Gڗ,)؈c.gHD9مe}x 5#Bw՞1 eGl|֡OL"q(}?*ݏAey3[`mŸ'Wꂤh[}xad*h/Zg;i{lU,Cz=FM&@jGq 0V\?@Cw-Uokl-0F|VOn j /f%(kC^ejqB$PPfz_sgH3V%6{3U&&}3Ώ'*lb 8;b;Z=X>MFH+nMe}>F9O̰r[4st'2DlWlߜ4-e'z#L" Q 8T$.֚"'1l< T#w]ja-C@ {D S(by_}67xDh}n1@LM+ܒ GotGK8*_ter77v߈KZDhDmu<#.u%ũά"S`Gwsv26(^k=%_.5b#HH[~< `37UjCzaw+XÈPkMX C[9|яZKUCg>%v㈼F0?G ƥO o?t5\wC SÙƽDžk]#SbwKZ)OQ)d3[o:^<^U/О,zBiy^VpNw6@*r5}&My*9#%>dL$8/VTmQ5#tIhotWy1ݓ.?f$]7Qovt=hʠ OnFNֺvv.A?7Cɱ9m{Cܜ`Wc<~ß]߁~@×p@ "h}+c X]aEVT 5\ nޔHb|6vjI8@xds,ΘT;OLy ۸6ͫ2p:8fbxAE @WT:TIּnS1~ID ʼnX-4 >bKt~ƏZ'a->vZZ1C(g C i@q,Q`qBٌNVd݋B1!:hP6 mH2yQ00&wx RN CWF(f"RX*_Y{j ;%4h "rI,#D菭 /)||B_FKe+H&K$^ISu y%D(p Ѱyg;gF>%quRmKʝ"n mD.{ߣXNchq_oqW/q0vOv2qCHЈ^%&\i̟icMD$ fQ1 KW JjP>yC8]ޒl>FAf2ʝ!Kx^L .MqoK9]؇_^Nʑ[9o,@.uj ސs.' ;Pjf`%SM5FJ%x X54.HM9rO. %FLkhi YrdoY ipL ^!56{3蒁͍)VKq[pq\f-ϨEtŝY@or= Y( Fzg*.Ӄy'ќW+7?S5~ݓx#&Z:3V\|I0뱑ũZۿxyZDl;Pב|WG#*ZM%=: G 39wG3@ ө䳒g 'VinITVw'笝g!!cse%=W٭]B>*pn{IhxDsqw4AޯH87O&o_dnjl>eQ ;U13Y虄c9_χ".TqQq<_*W$_@[ACZۇ1QKH&o*Mφv\X,vΩ8?p]Rc$>Pk'|G  \Nm|A?j%4r@aVQ43l0~l=j>|ض<W5J): eUV6CWOWN!))=y݅DV<+5TIX6glP Lrx80L#8`Rb4RsZ$tU-Ymm|)$Kr>L'X?;$xbfB w(~~l%T}<6~ˍZ`R8EۋC4K{=Ad;XԺ:XgaXy>k f!h UPq>&@$Ȟz=1MV*;ͳPd9 qYə&FS'#BQoqЪޜOb$,%i%-Z4Օo2oـO!LDtZHP[t`z6٨szkU˛zsW$:*Œg@OpX&x۰ Woj`gOҨrNhYW-?R0;$dz_AVK򈂁H?!h-Um nrlQ[AAz o o뻑==a0 4!-dN5~W;H1)[-cx J핋Ct]ºU s4V=LcȠ+p) 7|C ]C//B!n3*#ƪ:kTG zTCYI6UD-!b Ď!)W_u//ȿ ِg?dC Òb17\h)Hl/mv8ƴuEZWNFBb.5'`t.n>bñ"kO!2Đ[jWMg#=t2G;Y$2R<8kFGWkU1Q .1y2lL9%){`9's#N~(䳐)^ͬ遴9 Ϸ{õJ!^X0b Lxhթj@8ϜZ4K+CR;!DZ ">"Ja ;Zh_=+pϣZ̏]*6#nI%T)wa9KbH=knzeN"DCPz3jN"YPݙЕmVqKީ g@nfcd\kHH wUybOc : ];C޷/ܭ?$Q>UR,.'fnA/Ѻ7&]G.=usClعSb@e_{$Dl N~}ZMP5u9b㭛pȆdLɫQ A{!ߡ1,p*FS_ sb4Uye/ٶ">{6_YH79^%>!ng4^FqT#-9+YJUxt|GBs5"TVo$ZHV.$ EzItAJw8Qb/eQV0cMaO'gݙѲ؞'SĄ +}2?2kH/ubS,&M]\>ߧ xjYkv=5 Ik6?wVwSH2w5&-էWT#H%gb /zmSpz!2V<9rƢw: MZ4QJZlRԐו-Џ %|!>gqPY-طPiXM!s3Vi0 r,`Co<otZV%quLb^pe&[xYӏk,dx?g\MJYL:ZŦgՁ=R`f<_· ./r|{ѩVm6Qj3ߗ+Drx|͞_|Ȟu&֐KVk1GF/)zfE~5H8'J VK- !zIφ$v⨇dP5vQp[ݬJG"ⓠfD((zwZ:ONCsZ,f^kwasdD #{bjm(2B>D@LTBi6EdkpYv! 'k}ɚhL+]W2kD /u#rw[~S_C3*x@aN/*\2m?DFB{X:<5Gɢ@. IG,eʏcbldZsib4&B!_2>E'ԓ4ꏯ\8Gg'O¸!%n՘ζ!l%8rQ-\C\'9 u@9_T{eKF<" <1^>qa}$ɷ_>q2_i'v^] ?NuR^Ta5:*EW|hǜt#Ɩ醌zYFᇺ2r!A8Ci$.^Y},Wu} +?N9;r7 kJaPd>ҫ)*q ŭ^1S.uUz|MU\1\O=g㩣-.ޯqb}ګ,,3{Uѯ!_&H'|sLbHcPv͕ͭ=yA&)1L :NWߞ42uqu v#VD$a ƌd-Ƹj< F07j[FkaȺW=pW+uKׅ-`iT{& _a9L HjdG4Ӓ׏cr0 }pG+-ыPM2Tc#&B3KQ_Qw,'~F}k veH<#}@ ;ze .%܏<5FՈsET{@-UbS>׷R)H\n&ϵ }XF,[0&m)-x% Ѝ;AodcC.cy;_/}XsI_JGNzfaXjaд1itx/$Btb[\0 .h'D-{h}(lG 7yVHP0?*%2 k0b~jh Q V@2L[RgFnu5'qӾdY #cIA7$_m:EՇ^EuU9$MRvtC Oo* efah)*(T1RJ4~ށjLrDk; Y3귲j&`qzL.S i1F/Ww=80Szv3VE'G\.4!"/f8,IjŜx}؄ v1r,JUKXv=e;]%ZjoY`H)0g bS5&O )dEm&>8y&byNB6׮B!97 P]\1E&f zmbJDw(jJN̄=;gCR,s'ufBB_V}&7M̅Wӥ:eoInE XǯJw i5P }tH9j!LyGw>ZgH{p&e$ ݭ'F2oQ$? jxDV7G;fZ^$0X㻖BfIpCǾ7\ 9T?!KׁkHuɎwھlu٤APpeh6>N21P롃8Nꌆdhzj oR)!ԉ{Ǟa x 逈N1Bxj l#,-ՇAHB8=ޑLxD30g]/IEDdzLXЊJ=6Ps PP9{/y!':sGE=  ynl4PCNGEq`'a(w?CwepAoό i*Ka^41#w.7tty~X%"b=qĆJa|X0T! nr֬^#1\W\ư̚4-c",V 8PGZm|$1/61 eITTFUdw"mgԹ4s4wqcbnf~Wx +"Z4Z4(6GK,+KT]==S%ʭL]חY%%[xctI=62>5Օym 5t6aT ! @{Rz,ӊ0 %^'r6LVY[ridٴbRHr3̝ԑbD}mJNʼnk z8P&=# i!:Ž5?Ugw9 Cm=ο k|"(ԂzJupCxBm5ǃ0iwia|G$v1W} y'>n.;lDN&*?8=^tEO}BN ûԦ sm)ȳY§ǒ{ im<鯭c o8k]aeD.lˠoiΥi l$1e)itd5p$HY>z'wqlˁˇra-KT5xey>ݍޯQح)5$_Fk>58D.[7Se-|| ɫ Q>477V ɱ`ӍjjVYhE5NW;\pJ7"rYؔcqp-v<EFVҟ 9'}SIcsS֕\ź@ [:`d,NMFFG%V{q6pjF~4(2mXY=´G҉Z୧B+uMiK.p5߽& N'uYeIX|+ܣӡ4x<ꘖ\vYJa0"j~U3QAChw!LM+@B#@a+zqn娪?3gx.Bm_Y' Y_]]vџa6ŝ@/2BS*wsv4_| F󦠖+-;9ϪE؜=%ojm0 ntL\h&8lIm2q9yZFe[O~]E-w Vz]R曾}l+D"TyYݲzE#R-#'ep $X& GH14Vݟbw40zE/<|o;uo>M8*/$Mx?űyM VԔ&~1~~ oa(q߰޼. LfʒNduz21ՀuAhp]'knI<AyĽ1EP@mֺk.GW96*6~x]Ie꾃-T2^W,[˛<e1 `D?~f+P~ކ;w" >\_}:;`ǬrD/a;5^.ArfbfX^a)q磰m NxŀfwCk<@°_gf^Rw@.p,rK.xFڡjc!Fbп$E/l1#XR 0rv'7pe=~f|ZY[x(E$S)݋hA x8ZM-G3l_+42yYna2טk]:d$ bskiPqt(<|ӐK,pkcwCU!"r^"{i~c~tYviBr-PrCk~V-gpyKy98ΩU/GxPUmKr{v@r^ȠP)#ݫDMUqR3,dreA`|$⬊p}XۡOY^iS``ᴉ ȵw$è!0ͮ<e9HMո2:/r$H!eZ6SS&oTBRJIzIB1q+ i}BA|L#(J?װe]\@@aD"bg)EPaI:/[ N ɪ׎.UʓDf=h:ch7dQ׀R9th9#V@QE ;9\cFc}?dL0ZfU9-)Ղb*MlJ]$Yor aBS1[bcYPI7_|J5 L e]!==o^N;&tqFi^-v! t\c%$[P̅MUǻڽ z5,޽) !A4۞c H-߰iTd^1*zՐGO[A|d3DRcuRU7_锻ϯbsWvRWο?\XiB)~>r+|3jjt|hs`#xa0@D]f`N.XAr R=/F/H[6'a 'Q9toZT>z|w< ݄1TLЛSAh@`GvngZjeJ Q"wmdZas[42{=mJ EUB ]"=ʇCG0wk| 8ܜDp\֊ȬY _xP؆zAZ1 OM p2XRRRpɣQ?>ψ/1pڰ iEA\V}4YD P}Veej ettkf\'h;R\6jKW0õۈ<{ՠ<$rmoiOpf@ }⯿9٫Hw jbhu8&w." ;mvn0qQ-WRX}wޣ. ,cu;`y4HGx0˚t(G;#:Zm9iWJ9 !B͆/Sy;̓e>ngun(N7cӞ][&F>_Zm_=Mdu0{- ƱǗ[윑nZO(_XoX3^u\"Aߢ#u>6.^'+?rp@k|S 3^hu7|(ZOd`f&F8Ÿz%!8;e}NSoLgn\ۘMnQd5TBzU2}'D{ܹ+)W"ՈsvB՘lMnsq\kBT~F:TB5b z9Zi&EB q0z0!* ,֜d4K)։<x! ,!893'9Uރ(@"Zt)6:J&]*xQP&d/Ol63$@[ܰ0,/{N"Y$zU@^db@gu5{b]}4_|ԧ֬;rt}UIҘ,Sb rbgw~OsS)5c[Eڧ]Ci%\"Y Otя[0<2^Eb@&c 5"&Q6p wf~Tܨ`2@Lu yjVAr`C~FT1ˇ/n\\c|K O,gbvQ#yaF3cCGbX(ρ4־̤:Q&\,[?/Rӷ XʖE/dJX.ػDvA@PDJ3_f a!6j [a׹dVt)}ee>Đ -ZಗNE=H:ƥM'jvOþS=|Oհ uLEꔗU\;xZۭl/\_:Q>8dֿ{=uZL˙|AMK+zPS0`6 kyڰUM2&qLQÂ`}:{3M[%}SA=q%c vz.tzK-/ЯĞwE'e3e_VQ"s`q1)='NFs0ЧB'+M 2`.>/j$ars+򊢌_@bۦAD=7kg@T-gh&$\SG46I4a߳ӧȧd:t'T/P3FJIF]'rt"?wL0 |0z]7IW.=(4s4rc%Yi3sqG=w{_Rsa,le#T{Λ^{=O!84ߔ$iXEAdvyĉ#V֢KDuN&/, ^|-FA Nzxkƾg'Z Rw#21TkY}v$ euA SYNqm {He97xxQrǍgEH`iֿif{GКZscuClvW;ЇW6ʎ?P¥'Qbt>غсW+4WKSh QP{ E^XM\^<3b* { %PnO_A\jdOE }T,xA=%d#f~ gܟKmm.fU0g:##o_(}@ZyLVnXuaT2VH\&"*s|SwłoٲU& Je#o:5.Ka+ ,yn x:LbnSO)]hh벒s|Ehv2?ayr8 "-n;$pbnVȨEઌɃ-+܎x>S݅jI/ !wmZD\4; ^A QW6,)iڵA(/51y*2vFdslˠ ''Puf;%;[q ./tP:NkLX-Ccej<Ud͋*5 (&ֻUle;#&<ث2q YF2B6"!D*B&N,0/wS"V;HDj7M#N/.v 2u]w\f? RP8WĢ[ Xף@~w{r}YE I`!W[U^$尼sʭ[Vx;F@WrՖ5gϙd*J u<+HO)E ~'F4fyV* :#ӡXx. pt4|ys0 ԣ3l/sOKрXո'QI4hw7rIT9<aͳ9[6Aw׉?@rMQ*-+(HbrQт}_%lNL+' )x@)ؤZ^&sFlvp|==PM9%c+KEZ =R! mgF$섫_GSi9+İ JAЫWoØmJ:%__ôdX,Pq(7>< oR+ 0F3~9\=Y7-hn6И0y?gL&5n/*tHsBh<_;p*m8 ,T02zbͯhc *Yi@s+X}ܛɣO<{H,M=1 z¶MU(2l:fLLpZz/-GCImuv >]`ʅt)HKnZob$tO[D%5d`aMmIZΪqhdjnح0[TAo|4(U1QCmPA{E^APtn{ Da)G'] ~}"tZ:$-8Nq+qAyx(7eiTY׸;\!LECygZ+ !L,q]蕱Pi[r _ҏ/A[ɸQ(vdBn-GJ_7*{@Ӫ<NjMFǍ,0/BEp^=)19z/mI*[MtX׋+_8㎘:>OxFX,z }\AE'Ԏ%S79CUsЯg4b[a,eD=M!q8h1}bZ6Ru oЀ(HxzY$=Zh'9_DK 4vvF@[jND_|Եs:3ȅIBRt_,|ˤ Yg偟T jc׾_$a苭cq#0aENwDhnI{4#QZ4? j㣾f 5/,͉LEk+/{mjB:ph(VXqxzP朤䰦f-^ȕ>['(Hc5GFI G2`^)@Ov.h£4:+ʑ_ު'uG9htG6>dG1~H'dc''=.0WIf&oG}p^)W)o;M F[y+.b&<׸{{R< .s-+܌E=b-aAtm%zM<}s05uI>+ʯE*\z&d>QD>}G& K [,@&^yi;G)`]34h.4Cz8X@5?M(r*ۊZ`Z& e{(2HgiAOn'K/&6gy9`lC#wʏUUSsHK=#r:duUq'JK @߱ <ʖl_w"x}AKW [D+&c_1),9YANņ(C"R* ( Gl4!lr߬Z5YUpi+Be?$F+z@ufR(fD͜BlƩCw͕9 z:m/s>LC-yIHR*|R-VLLaGo~ dѩПFl]҇Wvu7R( 2>A߉IOwWX"wY;11g8:7m"=7ca`16)ƳhiCc֛.J g#Uۘ?QPJP2u;f7>a>WC֙,M]U[LJr$ZI(6-p mI7g4b\JK5<翽e7J۞ W?< 8 PiezB+UK f3T,MfМHͣP9=a>͏F>ry~g2=71Ӄ 69`CkC@q>s{쑍I U>vsC>UDpc"˝`FJ3\tlD܇\`: u>t_^ٍ5j1݉B!dq?h>]vgZo^nI6m@l/hDI.4VX:Y5UHs#Ɗv}Ӱɨ3e%.PT£N`hɏT_Ŧ{0N/cL Y VRFl Ͼ~?#U/i2 |vF+u+mH 3&RNLyxsfwܪ`8Ğ3Ruf9Us:*Π#ƒf`G%eɒb-T1tb0-l{ *Vջh(N^4g 0!X8F*'o³  v(aam&=%hHz&BYP]Uvpj*TNG%U-9B0ٜ ӛN؎\uDXJ㴰A d}Tc%* Kx"#Jƹ~DP9W'"Y8ȗ3Ps$?F 1C*:@!^M)$G4%)%NGB#~ ?s[H f~m: dy2N֐/A%ykxdo犫JCxD*Nu C ė(?`  pE.|6â w:yEo.MnVleCr#e#ڇ4 -1%7lϨ6a?x[Ŗ g&;7p*#jsۗ$h^ C`ߞwqc8ȥt2Xnc_RʵS~V{枵1~:-5>:{n qeZ? +4Kp$aFz( ;{h1/OV$^/U|cq"T0@kek7x /,!jy<T2qi1q&z40(}Q A%_7ǰtq$t\Òyi}e,}SM8Tֺ ;-# 0W =VT*Z0Gd&-B%x)y G!jhE>i];Nt?\nb]2PdDj*2[Oc`uE]^cgިXUp=Ȁ֦dӖgca ؖm V)F)+LQ`,*FlYhˏJ۵y/}hD9NNİM\A9;X MWG韯Jp3~!>}>F`\A_a#eJn5+7{K<$pܐ̵ȅYw42ly qj+`tpe}T]RPAR[|~̭h(34KOM_2J[X:<- e]H߸Ƿ`?`]1.f}F$%p*瞀o-\%t3'3V-p8lmcYn0WOPh9ꐊ{b*4.-ieM=&|ܒ8Svj緛Q)&zmsϼ!'X~=AV1FY^0dVz0{|9zZH<hår_{;B$mU9{-(e*|vɮqTZEop&Ǹ)NiʆHv"8\iplm†l2R$򣪅N6-V#tWG#>tLj@I4 扸)~7u[_~:J]@bQZn 2UcYuU!'fƍF$Ik+gl7 eQ؅M;Uݘ|dh CmPqJ׫uIt(4bb_ P]-oIyL7Ś' jVZiw=;nV7gM[(z.Qv7K=47.T0oDQ}T-JRE >M!ʲLG93n!|ܔ%HSgE(^nje&'e (A э5% _HFB[*&3"^#t{f\yaz:nl,*ܑӿ*#Bg=n# %臹^L$3?9{xu;תh2 m9xIni9 $Jto:4Ey0UQnȔ ڵ?P LÅTXnbo(7}t!C5qg\cDxE`ܛztiiz_`Bh/9Xn+cF$e5R[!ߺ?RQ3u!)^ yRSvT?Vuk9zNfF@8zV0Y:UY({)'z>-Qq=f8]~ 3% <5-]4T QE蓥`~}d~2E >IO 1VQoA 2>(QL\hTIG"@RIUF?JۜeN 8) aԡKȋz7[?VQFz5FPʓ a.~?[+LsJswxĨ*21ng?;B7V\.I8wۍbIp,ri5YVtڶ7(oh4zIwЬX?| .)lyvK Q~~%i{1zcSYGF) qzۊ#R(Ψ]tvEfҶ `=bDwI1y]軲sl[$L|u d%3C sha#yuuz}gF .`7<_d{{XD( _Her܍')?rC0s!iw. ). '‰OxtTqܻAd"&/i y3urտ@/{t  I±1s0<͕BYq:Fw?%{>_>M84OTͩ#JYfޘv61v0>%d$/~יA1躩TI' S~>67ðo%iöϽǣe;,1ͲW6eKQ6B-ù4# z?vz,3b"S^+l[VpɢdsgVFˑ?l.hzPq6N2j$#$;Ý.^&@!!8%;*#nHw5[ќ^,O I ڭ]ٮ= W -<4I+lv˖I(ɳ`X K2Z̟d@ j޳₶U0t8DW6oEfKz4\+FA|VXO&0]ؑΙ hs iQԷb2#¨n'u:CČ=66lʹu2fڌJ:_L`iW%! 7tfa(9RDaW|b %E"UD#J]r~ɫa ;\O]=@i\jaQ6["%v[DOaesme8red|Vc~.\_{y@TDrF4ƒx~x+clDC>D$ג^Rvc OgX~( ;_:H i");bm5Y';:͋e@Z>CduEhүiȨO52XvEX@;5`:;Sv}!_#;YwN;Y$;gבa`81,\ cy&╛,ogw &}_ڝqɆɺ!*0%p2B؆t J|Ϳf~vٶߊ0h?O$]&?`"JU?i0YiZ=ul9 ؂4L}h_Rg@ H?{tNE HpgXikw ;=HFr iiX~"I%Gj>&iVz:%eTyn'<:~ۊŋK|#ō617+(ƉO"^Q}SaNը/Ju(+͚yy;4qFd9ŞDCQy~@+ ZMD7K2Ԫi<" igC"P_%8ŒqKv*67i(ŬcrA.5PH 8?G $OphD̤ɅDom@%lCGoGSAv;8fT. q93gʮ]eVUڿl?K1Q bc12EZG|XT¯augt("IPqo.[͂r yKqkmWdGo/7xW[[/W-/II.Mv< 5VecIH[Ii׀MjxEu.eXDZlpgb2,2҈g$@8]ο{.]a-LE9QE܉cl\HSxL3HW-L &qɻMrޚFXxZx+t_46j$m9#= EkWىsFQ[wޚeh8~aKq:Z{Kg^7//O~A CKGp:3cUzzӿwD> HLH&BsbC&"DFi)-d0N{=1tIq^9i#8aZu+6j>ڬ11fJrxSTDhhH/&V.5q`S;eEi"ƈl&26aP9*'u،X''!5ٶ_Ũ+Og1!U"'ՙȯ,(]-6}{IGhldaPYE _BGWf#I8TӲY{oCW,=l(3 =.n3 Ji>a[epM˚R`SH:?{d[oޡ["3y9h ~r9 }ڦF1C@6|y**?^xHo6ZkO@mAƑ<nZI @pN. *_$iʹkyϘ\VҌ6+ec%~d}"o,? ڙ;7 1x.PZ#zIz(xY^L}y@ZaŨ"ŹI/ݒ'N6!G{mF)aDGyݪ< 1ف=AEVV+їIXtnchhC8.c3Xrkڄ5%yp//$S.k"1((v *=xjR* #zz?ɺf>J5)~{Ͽ3{:ػ?0i=+z-i^mB9"S_wH423˚rXicoj z #)d+ W;$ T|DW7F9nCsTjO e?dL/i*־uݓ},q*5Y_FL.)9Hs [H6ؔ6Tsvj˜$&N)6lXì>3vsbXE G7S<;[{R_1+ vf &危 2F.P+PQP \x\B-]xoڙUV$ҹ..5 ,s[:| z.Tz`?_>Ӥ6{ S6XB` )Ao<͕Byk!Ï gkP_n@!}i!M8\hbCM?3ߌB1!OY69Pb^lǟy$!Ĺu Fv.le6j;Tvv!D Q2DRD3_Pj!5 &^j&yWk i TI`!ͫ ۊGc0Z(\6^(Wk3'٢P[R,ObU;z}4&E6vzF6!rܺ以S)L,ku- SC&O5o]"W&1S_% >9\eh5WjJU0`vk0Q^p7Q+.#ŝ+ rӽ;7;O2 .K*,.Qܑ@5bRCߦpitjnoH>nW jD`~He׊xK?hO6ٻԃިIM03񍈛U9![mc:}bme!XH#<} nvslX*of!{vS_}p|8h5MWB>c^d&)MEFhU+өU|q,5yajF4X1U pIٳ, ˺cSW ~^UGMk :&ۓUĕa2iU#K\󃹨o0ƥ͘"J7DPC.bbkˣl;c7B:e5= 놁mt4&{D,@ÐkRufߒ̢Uz*&`p Az~Is!&qvmZـ 84=#-{Gw"Q\K_AlQ[Q?liɿKA: NMEM|$X5աEqh՗?Rw֎/2mB<6(E Q전S,_~c(8$ndf0[ӥ(4lTs͉&W箪wGad& 5 1KN ޜ*_)_zC:Gݥ'DmK(0^I7< ڝdY`CW3$pR:F.Xe.~Oo5MpPK"Z|L<7zhF]P4yOJH_6P͖;i%h>Y>B1C˿k ͵+#"oJ Y~az#%E(&i0ئc"fЩC c.(l*vns-@Y : #GfWO&i!wѦAI :+Dg*HP=VFkb9HI[?襋u.'fGr %")]Ӎ]!"zq+7k ]탑9]0fT8V>e 4bFZ o͈ L| wC%?4x??Npn %VI:-(z׎WvlH7#{҅XFӶ ~6_Ky`HI:gCAs;UOumfgW0PoiɆ>}UZYHNZM;?td ;ȆAWԣVLj7i lmc/I\avDu;HcC;{1N~ eɷ$lxÙ5"ZAN+M&}#<MD9Àf &} $[yf];ß<~; y_g|6!7^ta\fU {]F8O[ĩzqawE.Zs5Y-skЎ0u+& SFuSl&.SOJ һGa崺 A6r:W+P߬=Y0PͦI1"7-ev 刽sm`;7ң%Jg`Bp]LRf fHV2z_?ʱvdg~>\R|N`.Gѷws-XMNISקԬvpMDT];_[w"2pNSsM VRi7m'/r>Fk蠉1+q= Yi QKrB1V~8ZP_[_%Vd5صbi!1l@ʆīB]e ߞiv +$6#w^h2:d@3h%IՁF[>Ỳ'X}ϡFְڳ& &O1Mr2˒`6RTY0f o-ě ӹ$2/lg Ͼ~:Iqn|*XV,nc)֬"9#iPU̒bM8A*F)rgBN=X]%+ ,-/k5o.IQעmNmYtyn Λ0w'(LЭ c$*T) EMBڃT!fkMm)[DE6݇@iU3 8簌Dvͯz< Mz%o榛+]]Cs_ =p45Bs3SKv}rc?Up 5%2}#d{j~oӠMM('ZXTpDL!]:VIX~ EUvj NLA  ["o#{ifJ+j_E#BR_ U0;w?kph1Z˝G\~9})&F וU|LK'%N\U.JR0J=rv;SW&k`LXbg֥ ]6=Mg,'bh*@< SIaf_߽Y]@S><"d~dl ս,C =ʩ8-\ܖ*-sXdUוNo !?ݗ>G\m+ͯHtNcX/ xDH`=j0ߊqxƊw:2{hId^Jwx~ܚ?⤥ #C<;yz_#;W֞})yʁkr kO Csnz"Ex5ˠ=mޫc5|2O1li=b|}9{:*_6%E;)OU;L},¾JL\2`}8@VcTQ5 d~ Z /Ć0 ȫ*¢Z[A4hG Ata|BO`Ɖ-C>pxh5أvZgt<Hi{F`Ch2JoB'k2?vR1$zPY<;~ƕ=W|Q;9ѣjN⚷ W%M;)+ _aa_ ۤz#ۢ%3 }RޖBdгHԸ?sp&ve5ۈ"p~yv+Z,Z@9F0 (RF`}ASi}Ȭ:Hʚ8=HX%2kG(d>9o^_$5mnX=tCx79NU1Xᇒ_!^VBVnMvFNZLAOV p+MJ}|Q$9E-9r}tV" 59^F]ap@[̆h;3xr?HI|y/VZ3".9]nigv:e C|gWNLjަy v ujT~FQAcvك5 >Ps0G/5`B*TBjD1P̥XL̃oe ů,p͛dv_mi5^sAll(D`8GBwhُɌ^h65 ݏ+=7s/+z4պ\lsعm(V/)"?j:PAcb3){ks8ʊ3 *+geQw/"T0EAZoB^i,tW-M^OSѯcytJ?Z5cY{yu+*]4@XWg! u~UwPU ^8O1h'55ݣ\}M{4kXs@ X,tkҁPʏ2)ZsJg`Dn8kI۫Z{bSQcِ/VsO'߶Tԡiu<=ܣ{,iً6fE5 |}uZCv|[ ԯfu-Q+ZOoxa5WC3ur|Txh! l4ֱo0%>mHDŢgdFں-&ᑶ%L+ M_7P;y!uG;" s(ˑ9Ava)Ny+?LS1i;lD2|> dbB~АGPҩ+Y%om+TpKP;"VRԻnhKW47tͻQ_#aK}A"BPeh=YsytUTetiD-y.f#Ǩ^@M!aP ~)E9-fs/7JH.B꟭z8+-|ӣ#% D &m_\~4͡ NIbaٔ_E;pSm^7 9cOdn9]g5r ag\5\OsC;/F|F\Z{SknGOwY1l"5%/;=BM Ύం0G{moR+`؜qwj/ J'(7\YE*&^X2n.Lcck0>J >ZnZdWB7Y$h` Fp2g?puRKoU.$lAp鲞/#Q@N-BW ^1jVeT4V<8(2FK^#$y衽fðsQ֞ȸntN^4yO}w 3'WD>ʹNw&yڽ-/VMo$9ȴ0ӛi|JPPgZ4;JEtn>$iCJI$>-wt $BGځZJs7@/&)缬щβ»ٸ)ʸc #6?kx4Xt3b3`K;z9ujwܯɸa6. ԧҬaA iqN'у>WK%&or=@1jG&ߍr[$ŏ/j܊)igM<׈2Q%<؊/ꖯ/5D;}}ļ^hS`n F۟_ 䃒fbTQu#R/&B *}zʎŁɄa !۸9<:WNjDPkť;~fȆnL `= V"ః6ft;S<wndƌ>gq?T,!-I4!QEi6gB8շo^g]1z_ =ISPUc^T63ӨҍX!1ғfT噤APU2x5&H*jkd5_r[AR?gf tz9ٮ}6G}sh!tW~TN\)V>?Y Tl( 2 Fy9E( ސ|UN.XbRH?榉MSXS%L.Ih$iֿ"Q9U,E!+ lә-1bȲ(V;Ӿ ~4zOBck-_0c(sE^&Ul5$U0b[nr"_-3)WgqgxylĿT|7e4d׋ =8gۇW&ei29+RyE0"5v` X4RHwp%Uf 1Tהm|iѠnhKfOhR{l(ר 73~_ ɰR#evM&Iamg2Za[эI Xz7pT"2(^#V+ ϣJGxb" *Ϧ+gt3h+wHjJZgGOLuiFcYk c'H[agi_9X!Uu;J/_5VW׽ c~OP6^~E2AvNez }Z"d$UFГ, ._)Ѷz O?dRq D t tjF[ĄgAྺ9@q3q>3*jYϗ#b}7w~.hѡMKV9a hj~x(ΔۄyQW3Cb0,m?~rɻ&{{5T}`KhEsl|>9@}joGBb)A'z{ wAF7Wʖ#z0ِI,[065q5e1nשWE+`aWai;pѣ ӹxL!;T-_`yI~hL#W'rA. DBЍӣ^!`1_B5\8Ȇ8THFv SQannLě͌yiaU ӡvK_[IQ}/S2sW6&S?n qpx\;o^v'v/6Ȇ>PAɧANv7LUMlDsʥS-p!j~Km"&co[O8vXUD[m@pAH\&VF,0Q+^@x:&e(,tt3<Dzua,"T3r6QI, \)g۫;#: 8Y8縺flЃH*6oojo/9DF {8t'$kT׊LN(0 ;z2OU]з;ƯhlW⭇dJZ)ah;X!" m e?;lfg([ۍ(lӔ)uw'>3tzwnP,EJܨTlaLFǦ>'GMr>ex,Up}[\ ,D}@z$GQ~Q=yTDvQ"վjۃh& BF:Eߜ DCJST>澤}ʪR">=ՇiNN1b#ܹ7׵$<4P̨$3L!1Y 3LmJN>/1lB%0tbAqgVhlScj&K|L#UN0&(|Gn,-ie?[!rdT]d[Pm'֥B5Bղ$SI#zsf_!M$)${Y2@UNH!n`Wl4 ϵһS.|'#wNeiT8E_Ȃ^~=s=!%wLsHrعsyyQ,.c1}sQ]]0Bd0E*'ᒐBICq$'.~A 3h/HYW oT驼(F0bS᫴XG<,w@8]=LVX5 o7&pXoCgb۹%_jJEwEH鏶8 o}# z(e\َr¹Q ]d|b-.e)MBCCVLhs*,uӋ?Vud*iLk,GXi rl5M=(qE`6?.m43gֱGeALLF i/fPV<(ҒGxCqkAJDd1ơͭ ī}(ZjRHe#BK%?-rjέ::0ȳchAdž"4nL`F:B Wj~m]o,pPYWI5ố^3/VE׫%[&u(j?%궸#)},|5~ F&E̜ 9;@.7ĺ[Y|G4WBi^: Ig0>+R'N@JmY[:J)7>s',ɘ$:$CKq, ~ֻSFIڷ9ЮoafsWeMckWl A, Q0DSYz-ڶ͵OvȎu2 }^0/3X9J-B4N{zCy9cU"hĹ@dY+c>XY%w3+`}~jv\>F NSm0}t*D^Ti bFz-qNˍQ~$u 9KA\afTeVS݇ܬ@cRr򷯲:WuIZ*y\^ſGkkxK^[QR\AEz ւ5-s FbN]#7O#u&za `#-XEAqѱ: W2Ea,/!Fhm!z+?g #4ՠ&Wuz%L5gK| KU zo9n)B {+5q *Fs`X( Oa/ )[qFL 2كoD'+ 24ߍ+xԺGY>ct㪈1'sGe_VxT%[jvYkØ Tx$ĕrq; ?ljkqdC7vnb1E{hokW~ L[abjm-St.HvoigXX ؂i2G _MŒOPAV靰`^3&-&٪0B0FY[t7nJ(/En,/T{Z;a^(&ńGb,d2Z"+υQAt(r/4 r*e,{zm5H6 CNaz t$EO>AƱZdW #p//zrw>w"#kd3{ZiC勸/3h4:/pYvms&ڭZC ai_P.T d=e~2=(SacvSV~P@Qzo"ȩ\賟IhKRTs14n(31n YrKPcIɻ҆d9s,-Ab֪Vrz$NBHjӂqFa}U,;X|N)'ə{D(|$E3BUYn8᲋Jk$-Ae$CMt,;&(ps,(*e_ u"K4 K$-YJqW"/W7yߞb[ r>cvfkcdDp|UQDiW+ob荔90[7g+8(7o/; BnnfS /psX>vlM#mA_}f(\T1orHPzYxqLi|Q Mn(L/)/xGXﳮgX@F-ώ\b;4d@nTaq_t/ݺB&c1q|lDQaăQ>B~fGzzy^ALdl"IPb1ɐ0i);g{/qx kZq,81@9y~d.0I<jBGhRd/'bMBA}nf&^\pjXw"O E7R'YL-)+QGnԼՅ9͠y뢸` <[{k.gGiUbvjlmAtsnM#@eo~Sb?' 4W󙾱?GTpNXz˽;(/<_ Td0qa-,M?@T"b0؊<~o 2%e* X#U4R 2t )) 3[? H!;{xxH^;Jl}3ZZ(LZƾt|yj 7} ;0[Kx:rZE-@-G =KJwCubH>-*徯5SQzZ9:xIKBD3ǹy@'p?@ڠrό B4H#ԑ 1p}vE)B#KR"er=,f{$%;gKO<'[aWaOn.ߝ 3a1JIcfE铳'o.@,~nb~nc]"OE&)(M+p[WI.7bԈT<()կT%n\@p<k*]+p'o$^, TJmAssN@my9NB,:}&M^#c\/ |/ RzȊ^~;469MԦ~rn)3[qePB&#ڶȺxCBᬭ>d'LK (D1Ha7H$QFH{8{V/I!A."XAcꐍ65祐͞ uh:mc YOegX>՛5U2,0 |GSLbs d{Ӷd(N6v0!wp9{2kLO,GxS^hJئ{ %b^K9z?^fۙXK^`p]nYM !fg\*>+6W8BrE^$D_mYr!.Bucog0HqQ[Q,3(D=a4?I`o6c*|[b["!34BƏ:}W` ڸ6z~h*it~~n qUGb/Vm3T/H(>>F9A-:ǿj+]w$Di !z"|Qs,>tt][HdZ7]y#OWGjq=T԰i /x 25JG.y_CJ;MB@ c'`H)32![+x%~e1%)]]_G cw~`JN?u | <#{*Zjm4"|ɶf]7*Ubws۫ag=7;Q 4 ]\w'SQΔ9Ct u:n!d!f"2_h {JtS]OO !Q! Dr瓐pĒV|eU+?ojT·i!J*l8Y9d Xlktd )R3@wJ&< KOV(088úbFٞz Qc_prK$TPЯ瀼NY]+OKmR-F|(Bo ۦ1xtjbQ(Zv+mD,dY}//Y/<jgK8YhP˷bۍY-eB8pZ>aL8Dbwu7c^sQTaq%\5|{@z%oƕKX6>ݙW)~sXM88G6!Kaւ㽜F<\_2Aqqa^\Tc5lg<>[އ9ںr'xobz-$;,;`55 Ny!Wynv17P͈o!am xuO=<eBVkn`20GUށU/v|YzF2[P6 *? >-T~ưv|4>vBY@?6@1s^#㡴!GWoAb $DK+sZ@>HĢ)H ,qg9R(R\8nu^?VY7͢ZINpl=}e_ [D[4 .^Rb@tSε?Ѫ,D՚N120>omL.v GJuutF!ڛT'< A/ 7<>kj%{΀^ujF\dr*wRW^T^*kPlP"E ʯMqSRp6s(DPh,bC-FĐaMt,X>wz3 KbcnF0wb@a H)(xK'Sep7zؗ 7I,w\? { $U jCrJ*7о,垈42ҞX:Ea(EDn~" ҟ@Wo\egxC ZGmOW4@c孞Eb8K/)Taz;TNvsNݣ75l+ ~y4HGi>oX |thl^OʨzHF*"]틒1Da4nAKg}#G_0Ok"Z؅XQO/s)軙@`ZB@мzO IXC9&YE31 Dф\7sKX52lւIDn@dy:HU 9CrX1#=#V"Hiff璾e^eOНjҐU0# {.2m'W , &`-I9;sqؙ MzRwb5h1 v3oEbmGA,&r<,Pjz Ofil.0|f:ؚʄ{*ڙT]17jҰ,8B[4H4zŘvďA { zg4yD58Ajt?g]Hg/hxuƉ&Ľ͕3~C{S[ &6|ds{A Сovi3~ʿӝH>KqU#Z $ńkvU)pd(bI*iL&`#|[ܔQ K UPtNQ@+ڑxvfa% %Aa'H  {CVYo_o 婴rZĎirhd풕V*tmռ[Qm9AߕiD˖ȞyWz) 3fQq,D(D8JޣJJkޚ1#L|PNZw*ef. OOT ACoCf6Sejt@˂/"=y/Bേ . yceRJO@'Xaxzܧv:eg/SNdg1k@~`%5+W*y~7:/$ޚM U1H%wah_5u~0Zr]':ν[܆Xf0CR ]:wm@^qVF\Qo?r$e<'o'F >$OLwz?'7=M{~8&?S Vخlo>38 80 S|=&HYRqɱ<b;lV Rh^z J r#qn=.0Ր,dq[Ds XTk }M"tߙ &xK+?[t}oY\М-{y n[R2lYVaYmB[; MW1|݂;h>x."wӻa"`ҍ]&c$ Ʌ7Nd97QKb:ffQр('WcKɜd `n<zW~|W~RK~܌FN*(6rpU37$!Br8&~ݾ$e;63RyF;(Q>($Yq)P,0pDo#ġ䔨qZ!{cBvUwK?P١_́} u%M"~-п\FQa+g(~AU¸%;y\rzܛ6| ݠsa?m!||K-N _j ɒvIDT lvh`Y\a汖". &jI5]v`[+ ;CW/%-#ϩΜo0F]@Fp9*gU2"bkD6ud=M ^II%&P1]t"64DX?b!jhzZ5..=rg,\$^63i y/e\ wZ%pLx-CopnB'hF-w;}g5P4o7{dK} j0PZ#C+;\ѨaVRu\[0ìP 2qR!- P9 Rn漉!ې)hT^7:۫}sMW @;]a.v9̀H`3 Q X7u?a@n[4<ʃ2C5!6b!hgVu7rh 䗓̈v ~'={_% bPh뇒iqDJV{u9ԗ8NmG%/w` zen!4#M@9; ) HOd1 e_Y/!se"sۄӸ&ȼ&ȏ!C̍uߝؙ ƭ  C-BqKmlZxsPY&益@'].')#ńY O~dd.:ی"dF _RD[f$W @TS* * !ڳk=-g7BtR rqxBЍ5 FgJ; .ng$7\cKAnQeBk5 G'O+dNJDdؽi,H ~r1BMەOzOEPyԳP!K/=* ]0RVkөٳyNu?K[{q Ezc81IϚJg#bĬu)s b`Hx6?ֶn偉d:)E4 p˒c,I3`@#G 3;q2!;ЕXGn;|ų!1Pk3͇IY,S)#§A1t߂qdZZeMؽ\#lMܡ X wk5yXUƃ!CGo<\EQoEƶyF+,}b :0eUGRK82GvQE-5*EICN"NຫQj,>]jQ_.dأ \Me$]7/f2"4(+ '*5]~ X19w%xr?W#ilt" #aص@J P_fr7)"{R=Wo·WM'M%QZÔyD|f!Afhh?Ðxh+'0Xn/)[jdϲ* 27rDT/28Rn Oy5^-@x .-+GAֈ_Q@Ull98fמģ8--07$X=)a ٺ\>Ri݀oOr!#}2q̠ d%[d>mT}i 0:9='fqf"kDw&.1`F[#ԎgqԪjцQbrRfݭ$hMږNkB˜\٢[ԺT/^8g~g5}ʸ7? 8 SēX6_"DU(ɛl_Z+Re3H2K$0>-]JlznR07CBvA`xCYo&YVBfT,cM~ʸM7AO`q+(zc8yk8yVs}|76`yӆP?7SPQw"qC!%elW6?O3S)jYZ8|4 72]+y@\n-*`a n̘`O&Զ)-os|\єۥ+4˩?Ż >+ +᝷īh/RjmE65aˉ@6RR~uPX yAD6؆L̑MCP徣lmdz**"r"O^E{Nٜu+XݨF9ǵr@w[%ϐgrKKLRW떚 i +!9#$Bm;+HšM g*V]>FݰvTOc4>Hb3k-: HU9~xPH-ǀ?~+\ylv ^86usHO⇨[ +o8-LDdx,ŏ7yuk"&'.ױ#-vA;˔˶\Ч䓒b=u%y3z'(N`4Ջu2Yi/qSدPc?L4WYh5.xV o}*'8$~PwgJ3郫%ˎ`WɌ G18wi;0*mA;?OZ= 2k$I,NK/Y 0rLhUHa:BY6ޏbʅ!GQ]‘ee2"7q|D0k:Ez dB fǐzUH;WE Tbg3cP*}NB~xnGͥC~N3]Y4iѣyXo͊z ҃`ʳ%Y5yV}?J-E" ::001>0`r쬳85<}E a" 5Na?%vpEE)}7 Z>!8TjDnդװ0·V{O8~31"#A5>C1#GŹ%u0bU.=é.jDU-f(tJ ߨ QM]U Kz1TC[mؽS:P7)nBf Er ]2Ha +?Flʶ[t _Tv!E )a14XqdLujt} '#et/p3,-⁙ލFMlBh0A!47`jF]_%yeS"% $wqL,lnZ Vc;3+dRD+f"x0nֲVC~&Ƽ\9^2C_^0ofV4 `A;RA,+;`atGNNEU0Xa/;̛r:,#ɻ`E|RAV1q?l󟛹6?-@QY:ZQD5}ơ&;݉,; KS+-_ }Xvt4d-qͣ 1S֚ύ CD{+Z!uͮ9K'ށC{L&HT9p1 +JE$T1fBCZ %$Նd7&:)u. w4pZ6H4+o 0]5Nݦ+OE Wjv&>}DVQE čF,HtƉIl͍R!q6 z7I 2J!'V&H6b8MiY&UԗRN#H=xc9|x9VP.[~(A\ߍFṬ-Jεo4{Pc. ىuO&$G&.(w.Z]d&_ AK0t=Vȫ Ю0Dbh9IҨx6q]KSv>C>b0)p’).N(b钾9mw¿?_AҒektFpM/ d"1 q1ߎ`N$=磍*$SՍ`LU` N56N՗S&b$iWDƪ_xyVMR5>{B"3^'sFr̀RE!@.$5%hq/ \Чb~Gi>ȸxߣ&~\1#dgu{ZaXbf;z [0 os}>3X{{>$ qR -U5P9yd|nY6Θ9Wkxl7sGW/L#c Lr%(-0[~uYSd"h7\h3 7u( W JF9[DM!ԡdl'qM*_xO˼A;#debbc>Vpubm9~14~׏0GذG۬o\e@.ĵ;UZ@Ez [QY%UXZ7>@%x7\\pg,8h TZ]|[^E-V3|,a. b!{Lٶ ݤ8*Ӭqٯ]cFj0XwkJRPgaM {&0Jo}^r۱`E?Po,Gzwyנ Qc+QOş>%(+:]0tm\+K1o,G 'W iɕ(/|| F%e F Y/Ȏ}i4K, |v SI؅i@k[>V^or0]9QuA8!~Yemnm5JU2[S35`G7HPpBlǴ Śm"dޮtM^|m/v6:tn.wׁ1\2YW-[Se#y{wojUfV2g#F BfYVB9^zXP"pQ%Aq':=7VBQ*xqLZE\tY 2x=eO%U;ޛ2fHdfNF\m`F.k}IIvmܫ&K-^Sگn{G1Fx7ΆZjЄri%Mߪ<h,Ķ.C}, ,<|R_/ꀱF¨zwtK2j-\zi]!N ~_M(ǀ :K~2I߱3`f pWuBP#kz"֐̿Nnp Wgn:r7oA@]0V<ǚbvwlCEEN?E$med"JG4;Dž[ʏ|D ܢC(`- ZC2Jᙠ4DZhZnN nt̷iSrW_ cGr% u9<`6LRxsD|i/gy׫' 5j76lu[긿If ~ŷ[4.R<"{pZjwԥ=,ۓ󤡬hh3=3/Y8Zoctk"EL jmzmWnBآ~A_YnT5ɵI@~C;Ubsi.2.og?G-DD=`qv STJ7yR;&+$~HԛX5Щ Nk~#N̰ӧ/Mz0,(_:;bwg^拌+a%Ğ\wd3ʸrZԚf$.PL[ T$HI&ZqZp 1 [ z0](;XLAO&PF"DX4}8Z'V֟vPӃCء¿`Qbr(!l}Iv^^,#i~BŨtss^*j@#!]"C f7,r/ ^'H+ƘGHo0)գd'?Ui2KxFwaz[&"].U(-)iiVeB~Sݰue~4LMZ'4 8] RÖčpϒ[țbDBJBŸXN v4g%u,JO9ȏZ@M`i ggȺ5Hh^8s4MaQ\7u9 RQzOiDž4AoQ'X,F 9@?WGKilKmK8"kڕfduNy4 IXaĉqKR{ZY`T l#eav S?6ͬ]Qg5h^njgV%*ʾnx{tޚLGi.W$uAI UÍ ߎbd]wK@E`n>o z Tߥ@T`%a|GO藊®%a`<`NxZCTQ qYشpSkk9b$B04i/ɺ X[|G0W_F.pA ]bdo˦S^eׅ@0̠#nqZaƚw5P3CT,yTn'@6|]KDKEeEx >mrU3w&ЌzN:o/25q>[ I2/o?+]{*=7&D PL<C)F ɣ4Oe#ܲH) F DKoԵ;Q찇﬈a}:-vLf)8 %1p=NU (G$*f hj= z3Z,S2 KK I[Ѷ[ǚ5^y5]g,4<ˈ8"3+> e:Be&٭!cSKS6,r݅ apA T+}thQ֦jmph+4GBGG ogQoHƗьa/|pme fLiY9|# x*,r)b[%Dw4J(I?-Rğ1%cDb0nzyn z-%C:3AD5| 4G(虽rxwBxкq$^^L~OLeq5M)}$yn7 1x K*h6 v8a_WQ3E xHr"[0BzGfL9ތnġVAnLӕ<̱r,܊cv[SdA<6upbk J1Ԏӊ!_gqE,2@lCFA= hwWc6x3sVBԔ.jq*ҀG9|l -BEӫvML0@w~rŤʠ2 &zp\j&!P"UbV"GzF,!YP|%/G%j1`J#H|%_7C,W 2b**B> Ǖ4MLы9-mcu}jk!ȱ# A mVT:֐`ԳP oaU Nzmf{^Y&lV҄VglPz-ƯT%;毊@d~W㏛d*ɥ!RрNTM&-[)%H>%.Oכa`T=*BvLCޝID`] IRN2^ڞLt.Py& @=v<:D´ ?ꌱ.1QTE;%iB08bKK lT{K>ql1bO@& ]$uuzs]f:H%L2LIW5$ &ԉhyˆR9 kFڃCt,:Gcx؀jj8Ns30+\ B.}NbDZo&_N8-/S?pma@lkJVM0Bq׿D xc :`:/?|վ#Eο",ۋ1qD^!WMR<2$>g5NY٥QAК~(_ƿEc Sz!#TJm*OJ7 q!]ǿ8:S{+G2?:Vl*1&dY6/TjzUE3AiczD* ճ)C?,EBt8:*&J SF qv`p;"bv: ppY 0ےZl;̤GLC^2!ŗ -8?y ?<^=IjqF'vLV߶ʞ,p#\V'Vwo^S{6Q~?]l M*MdVpmn[yJG5V>|EcNy12&; "NL ]})U9Ÿ+F:9+'c#ŐV;1 ]FcR/I#3u=Y<*"0L!>+}Z|_VrZmNi\U)_X|3dɌ/+5Ue?3%$XG 4"g#(m^QC9De9]U*|vG4'5b8wzs2isBbXu!X:/ЙUixMNL6.&ʾ(uY @PgB*Q+Ĥ(HzTjq"e@%Ϧ+[ҰeRhsLG Q]ł$yTkW.R(6 o$iGUXՖH5C0Avd.T[ghR<>*U^&#&~Wh]k?? ǦqØYTRH+飥D+V=ĒS|ʗ, YF JnFU>6j+K rK<ǁs?ٱO M8A ŷiٹ :A4G"|P z :Ǹ}ɇWb طp)d!LrUF\A2)%1I{4v Qw<#/G_+7ko[%XbV;.觿'|>Ή57/&Ӭw+bGxeh9vWaN`@=lhS[]b9ĄpTcu 4)tq<`h{lF8$/2m|c^2ڗf:5J@5`/ғy~Z7 qbxI}PU|aNnJFbW9惬s 9u'`ck? "nR$a!K._SreT }"ӺM3M%\j+0<2~Nj:F4ѻZMZTtS,o)O TmƱubJZKpPѸIA\m٪V Wumn5\$ b-{jήUA"3|*K {uufn.!< j  S_F։/ brFnLIpN*iAWأ za."%`Z">@8:aIBʒ!VJ/KSݪ]߯} ~wzgD 6%y'PP_ 0~ ^ʬI 2u˜gmN]wfLoa4۲HU3`a#x狐CȶwSCP<:K$Pc(_c8d2-pAIp?} - U,^` _Cy3F8–QS4#ֻuQ1T m3!&:^wY 0m^W[ bb\j@nnUڧd3Yd Ȍ+NQ̶r/vs\Z'!mhz73EiOyb<oz$ZadctrR5Y MS~-|Gd";5ݨc~̇ ÑWA% f?=4;#{eO4OZ6$dQx(D'9#̎#OD?}vu"(u(:T1q#ge;ʯ4C!q<s0P(+ͨ\f+V]󯈃"^Huz;y9J$ܰ$ +{$oJO uT wu/XsH$${ZTB!EFHV?O#ÇÛ olC<UA-rJŴUU0|&ҌnO_c0.+zu͛.1wLn~RvSk}uiܝ2g%*ɇR,Τ9%}#__C&g:I7L. *M'(`ݥ\<|=W_єaM1Xzu ڲ7[2 l? ^")y>Rl⯫EK3:]+Nu Es}`6g f`48*Z&+3Y)4#v6`i$JL!h,cU4#n|`;:(0^6ͲD=^O jhs历E<"ȋP"`YyJB`"a@fL T>r8 4MWCޣ)2 .{xՁF<OVͫ#6"Ip5d$KdyrU8XMŒښ);ռ*aЗ7$( yϼ' \n={VyoM0dxn[p}NpP!KB'| sَs_\+G0^;R"%ΟB=c\a㡷ˮ[:&Uăs er09}N3-ZyryTuM]ŐeA@V'=`aه8C/UzJjqc]m=!q=T{´ se7[[KqԀ%%pHUkϚ fk+vB39+Sr7 XQ1H/Ԋ5N3aPOQceC+%mW;TJ߳SE5l4c3fO=:l !vkgn^nJZZ~A#^7!Z|q*$yV}ǍcYzHЅزLz/҈z»6Ced/T޸%D('n> E+j`q$m,{m2m<&(S=\@}T"7#7ZT'_ׂOhz?#5X6+1n"5퀒B`LrIj!߿-m6J6 "5 ~ˬ̸F@`8Q??sÝ[< -Z/J)WHv uMR.CnҹgF1 t`p4[2m`:j,x=sس*ߢ\о%tﾤ9'LCŧ#qoiكs@t3mceo:Hf#?ySң·jWڅχ[3]D1`G|G8ܔpJi މEPq?U Ue-Rr73HRL6e[Mv֖]f0 @NDl%EcVWV8?~9 jQe 6U5޵w⇇NÄ&}(8vku[.]@cO5*s&wƮAI6ޒVR7]0|˭r .U2ý–pL-;-xV3]YVb-#}a.)Am}`ʭK%RP_TT+w\rw ?s$##plxY9NarVM; {K$3b'/AI?Vstb,IkȀ_v&& Y$F:;/]ͅh焭ےkE!`HI;sÑ?(͏_.t Eg%/2>`G:P; HrRrPKȔl󑮱FFn*^KT&c\c@1 {u2sj̲q8{DcZZRQO W]vݪ׀<{ꃤ.Iev5"A_Ԍ(Me 0$eڬA5* ke'i0.52N̠n8QBNh.Ļa8́-(dE,Ϛ(EOz]K_F>` /[1cH_L%MC(խZ"NqɞC8ތ)٨J;85-O;0$g<g  [$*}_EW[Tvam ~p2:Ngfna2i357,,az/]EFz do7r3?sԉ%M6Ft)K&&2@Q!/EϪO*Ɲ[j& gXZECy3J!cu)w2W,m/dxo:TVg9T0]Fs`!J]-{$#D~9 Yf,5O֡0}Bі²j{/_YD-XTa=*'#6cԀ6 ҔЗ]^Zv׍ aSñ-`}憎$mG`fק1ќOf$wW+^YtD>AO(@6:uԲ@+ac g, FDV7 ޑfV:BPze^|߮TVG;h=~"<(h] `;/6唺7R  !ñ[Їpcy c(ŀVs'J XxsN< {$샅$?ZS5]~HЮzj -F fTUYCRjn]DXC@ԟMg)|T5T le0Kr:!zMmھTP}h4̄Yx7}Yy YζطhLv7Eg-I\T$KLj8|i+HxfTйx!(; kǧT(P"ʉUB ;A:` >YINoj{8KI$%ȬqdG>.1BX+,ޒ Jd ):zEVa:GՒR{\Z R"\yP;iVHl>˶#߼1q^@WƤ̄:,{3o}m9`Tv׌ߝ0C|ϐ8~5pSzYk J /#f@60 jRPZMTlUH%_6z}mSH )Mv֦&!4#1*vKUe/>~HU,0Y/`,;uI[VJrȈoX\KB#m껩du= TMH(|W0:lBbjS>$,·I6-fVEcLڵm!:@V &_+~  -?5FW;zduѮķeЈ%;7{۵hhC5;!3 yq~Fs^z%#قq 7 'pͮ!c$OC -A1M(H6`wcos_?src mv 1ʩAա*vruuEn@LaƲgK_\sF,>sQA'=}ZXww'K2?O2徿TVC]CQ-y%Cȗ$ `R $›htRLb߃'z{3 jMW_OuX,h'] g=<5 \$afVQϒpN%>ߊV9c9~<"O `/+z8$E0jAjCƿeV^Zk>*qEg..S7X2SqFl1_")j4Sqҡ6,,? )÷7jv&a/(2!ot\XUr`2҉֌ xfz; @k߸hhYi*?bem5aiHbA%V!,~[/Rqk}K{m&YD$,wT go&N'6p"hc txu5;2Ƽ4lqBWf#El/)ż'hs1׆`_ՋՐ"8Z>̺Ld[+gB1WmDN&DԧސCjA zOKt5l^"9 (OP M6?TðZ!6ؒ۴t݄ogo~Pr u8coQ 0F##ACrWJvzڣ*<L'a/ U6ѳc\Nze'aڷOG^R~7m{t>f֨l;'QMnK*[~W!}Ru/%"ÕĝC?3L(jm+Y)_b`k]o,s*%~2#XG<酷a+bB T8G'U F0س|P$=;5(aީ,[O_oL%I\O]}^swCb I@Q~). )349%=\a %Dh!TNUg0⭖4 {!gae9dA :}|sNT+{?jV#|grhK0PY7>2LȊr8Zz~}' RN iA?CK @?mS "tby/ vw9pi_TVfZ/<64ى~}3,7`SFj.#OYz0y~U lPT7!2ʱ+PMZ)Ls #/?YwHX,|5(-l/|*,R]Cr8XgѽQ+.nЕgN7H𙍘!*],V[hUZ?$=(I)X,LbŮc0E[©<ð|oC0s`PtVώvzZ1cxWzڞ >Mirэk=l2lwk,!k3ilqk˕HX8a2M6P*,~X635wuB3(`؇*BR'ȷ+G3U-kY"AZ%^q i3 /ˍӋ?rݰe@@mJwf # EJXcQcZҴ 2|tqQXgY|~diһd{`RHr+!{tq*ɷl>=G mE'v/cV%7#"'T/shί,}ŶA&+vTʡsց c,_ulXxQ{Cp?G%7Ĭhk$n e[!F^!k,3Y-f@Zfk 7ߘodGa}ཅIJ9@b 懲yy5V:*77ڞq:P*yDBxaOmYSq+81s8`jqr7B=ߩ2r"p>x>7nﾄ8wfjaTu[fGpQS fp_Apɯ3ZI',y~J5ujH ÀzǖtN[MD?WLw1ufa.;@iS!^}]b3Qx`rJ\Sr:݌闱 ,C7!)8;&&U*>kc2h&"w0J-]fm8oDg0l9u-1^L/vn8 ft2S DaݚޛXD! #', ]J,]SMk$?7]W6ߟ"pP}mQJe; {{Io\p]Z, #<0* i9.9+~S2YmG!|]bB]MɄFXMvMĥ{q;m_L]yA aW㌻+jM]<]ZI^mb*Lhۦƽ%ǤS$YU:nz? :ƴxE]'nxnjfBݣ׫.B^:`i6>uHꝌX/ںEfzfu@G"ZJ4C,e~8I+; IUBv} p22:rrN8(ǽ磑~& ?;"y]݈9bRM5qtʮGΚ a/;z6(3xe/؊z[۫tShu1/]P=4o1Gt}(D\@Cxf2 `q?cpqp6Q| q^0tJDb60/e=jCM Wf # TțQ2}ܵ EA%;2-B 2ܯ썱iB-UMҢ\8MVPl,̜]~k}S`oE -O;5[#'xRAȝ.y\BjaX豞V &g\s VA±5aHadN! u }>uɤ|z@ح't"dXS> 8Ry2r3K =KU0B rf7[^8#9}DT952WR4WGma5>DW -=BDU%9iҩvT/lA3 '-^%B*{"xD `j^kS)vMVx8ڡ0iIJ'a8C|^dA&R| *0qg`B7fdն;cx/&=@3-\@obwaƿ6S9 p5(YD8@u[;onY Y 9>I8-pOoxxi ?6%G'1:P5 7iȓll)a&m(I{s[ىRmFO`iQH(ahU&tA2- ސ:Ņ56 ܝRջ&C3wHa pUbIxJ3if;hg .JeL , sŒU|Gn/{> #*]_.p'CSQbZ rՎvB,}llXQsȉ_: `b^tNoa9M y0?7"[Ϋ0?w.H~p G/N\/hTmI(l OK8uWb?DQrˉiZI<|몲itsGE>L:}:+%:B03}hxoROW6=;((.s(x>GuVȧGmܸTzS~"4yzyUtS>eη-ztNW]=A\Xcg=rmc#5Tf/&8/ *N!ʡCYuЮȸ5hǘS&=r`2֖ p^d n;"E7ܽ(EmrYx:]甏d7v惆IJX~"jtWrMt}`yO.5Z1SɊ2 .];Q .Ŋ4 s ތxݣH[8 xI z*ۖ{}Gu_綒/[sՠTrܐ28|'$Y"WiɳWjzC\2ƀs+)A8az է㷡4I]fj=FZɚ`0mGܾN9gFxOaGo0g(x-O!_ZM״,/^r5/ \/!6^GN)Î /SY 2'?U_Fw>;{92{`jKӏ?yS6."V6_Wq 3|h_6/ +8>̖,(*00>EһMDkvl~=͸7e+i>;GYiմ>f ñ'~L̵ьB˛N279D4&JlA"?KQǀiP gnFT򵠅ZVb:f_߂K:¬]XnKOSj'ϢV"ok`TзVYtȌ|ķfڌT̩?Η$I6C V3bOmbଢ଼\Fhw6xe8R{ E˰I&) +og#U v8]&7z?X]xY'=^Z0/ O 1P¹0)|IZ_O]GŀhGay5'mƍ(NlT\ȈyG`QE;rNR(-nIHA`YA7H[R"k\F'iEtsMEli4n*avM4[3_TCR,&mKe ͮ[ŭNv7 QZDNAէgؐoH.ᇦzg_:"QТu'=İKQ%ɚ!PcsbBo$ǾH0*ƚeǻlgm]/&.W &,<'#TԱ?l=b{)X`\WI͞Υ̸ԂS#klmz='1Gw MB+0(W1 iS>6_ؽYPv({5N](U7&n~J)nX7ˍEڊwA>I Je4=Lbe\H ihB+c =-Ԕ ,^BX=kr/c`NȦڵbȯO~1)6ul2P;nu<4^ie~s:qǎE+\:Êm<"՘d3lA%'wۭLA1Ɩs֬dƟ'DF?u (K#X!MS'Tfk}CxC ȍfn`,;- OZ Dޠr ygbh6Z vJ c;6N!^}Ĺwr:*=!$G@O{6N vD;,o |F-C]$JY\Erφy\j*!d4an) R)!ñheMMڻj p˫ևJ{{㙕p 'c<wB "vw D2 {'[bYwԷL# JwlXjlP8̵ݗj逑7o>}4; _{C@Z(&iiuDX̧]4/CfU\BzWUT#Lk\V~(nֳH{G8{YSM\;ېYJ*s(řz\Dgv:-`l0MvqWw߷Ii{̞.*݋DܒE{c frүe^㴒6ђe(#y'z SI'\(8$|~; " j/+d洓;{ȑ3ɰKᝈ~!MtzW0{k |DG"ymؔHv|23|sKRɄ@g^On;r2zR+8I-nZBN j & .Bn`)~f@7#+&/TȶMaWc VJ]lRc HSsX3%*+fOd@T$Қ| t_R;PSr# ŋy&nd5FJI9~pROǞe:jCva:8Tj6S-An嫧(Ƽ@7)T cm7Jw2áw81䋥ljniwva`&~IxQcT׋Ӻ~/^cwqWT3&91347鱦 5GK~EcPnmn Cyg 1rTO;ڝW~g7wǩ@D9 Γ h$XYt8'7jA^BCEgeyJ.y.oj7ݱgEV+m/2}y8}OEs_<ܩ2*_;w{]Qwh'Ҥ2Jr&gO|:-&ŦhwZZcq:E;*KSe|wpZ#`%`Y @nTg٢Ƿ+?%Zl'NNxG|ԁL2׵G.@lCƧĞ23lRMTHƑZhfS}$pKQ5B5`(ݑ>T/pgUę/}C7(I< i6v ܱD) B E=Zf@ہQpw&agqCx bCddapQ׻i UЩԔc$sdŵ?`}ڳ-XYcg|*|Lo׷XirS_YQ+t_Ư[0 Ssb wBL_yDc˅<.v@;N_Ǧ r'de 3E"X#r1&9`O?Bj.U ȌB#D`{Ga)vOk6g`@ò /g'(iT0[0Q lnK=R\$39D.&nx-DO'vՎUܥ?Ypw0ӊak-[OL[S˭iax07ּUK@h.]jwl40@L7G`.%AORgYY Ư-O[% a&UȾ{HrB<٣Lwc(.K9+7'UtA\ wz0Rv2+JPJ)%; /C݋}7Rw]?I9{~ⵚl^UfȖ|v9J.?aHwOO3C;:*,T`$CHDnzTI.qtQʾAh%mzJT/J@Lfx+^bIšk`|x x)M:zL' ?π)e>''fDpN|m=g'Bؙ  c~$"l;4ɺHQiT[2 LkB '7;?]=BϒF ,hVT~4BeN5{*{_3NQu\{JLTG5ҜR ۲$FdJJ+"_+|j>(fׯĜ@P%U=^5{RPtt኉rt%1<λ@h]ʱ@)m4z.Ps.;iCVZ H#_<Ǝ1XVK BP^.noj8ȿ/B=skɈ#b6!^l}y}T+<އ+2S ^mIy bsh4ؘT`j7E. *?aAQ{: gKI9] -FŮ'zCcT1`],xxe/S:vfY=/"DUrA $~L ~朣9W´LMIWs۵w?w)e`>D$|~S8ݲ-O3RH!YRwkX!XQc1%|[N y=_j>3 ^J+ǰfcch:w]i>SeFEE<e20=MmW$y`vYʶ54Q'MdA S/DeKޢ#]4P.)LMfg"&ak`*Du8pA>iRΑ~ST DZiCI}pqmZ:΀L<"\A?*/SuwE6oǣ{e-9~6 X d%s^[gk+ircP W9ƉY}s7PI$ >]G~y8Q[d:KjT框v.Z'Ǭ^ /UY׫v'QˇNO$[c9\tg nA%,r)!@L vm\pC4*f\sXj>л (FW.c(c|p&bދiBזH?a~-G=@x<_QroBXzb&.r \Z| 7# ځ_+kJ_ :-P,!eTYow;TVXrY߯t]gr^jeGA ITnãNC'f-U%z?nuKM=+w qwȜlAp𩠯Ʈ U#L0UB]ڻj 1U\Uhޒf˜`OXk7_`4r\%Nw KK,}z3EgQe]LR=3\@TXAWxZFֺ;W p*#%St% ٥Vƅ{<3>IF.wBW7T& GSDȨRwڐ$R `S[6:/6o˹o{r[3;9"?hVJn{yZ,&c|y]V łIc B$ S C~Lge_•W)ɩv%%iG糓D`xt"+xO_%fW oշk0ꌝWo> BkokېI.k~Ɍ#L;$89\L7X.艳 'FcN/bqDr›GQ8v# ݑQC{ e8,˥UxUi۾0fq0uC5mۑN? v/OS~"BmǨ4 d ACiWN+X=s ~Op[j^"@Po9ZMgRf6k {_}?X޴[Y+$tD= (Pa{ "u`>}P/I6gnQ8=ء0%$:eN%IH`{L@2u^9ڻLBdRސ"yR8,fC8m}̖#S?a W86AK6'7yRɗPAg!DVgZ!"jiTdEf>wFStK5c:/jR,o##Hj !K7b E6ONSE>LJS噯 mB`{9oo?(;nOR탂Lq$xnGYm2S䊭g+j? iJ 7:ګjB)p-P^}֝ rD7ܞ[iȫɰ@ T&^N/Fl[ ;;bcܛJȜ슸Y荄ۈ̯l&GmIH6z O]SF^p+o6DƳ6w|0_Hqe0'!D` =_ڬFu{hWpK7â[ p;q@Lnyɮ3]C,?P c C`1ƥ鼣f .2Iv˔Ϊդ|Mu4ťO)}]z0F\U;p tLFV'-l C i̴WaiW(',ttN#@{߽7pഐUqLPKiH2t_dH}J,Wv XzQn<:mf 6Chae@~؈Z ,puѻO}h&n|}UOy 0)fCq TXjb-8ɧ&'Ғ1.j%KKFSh25/8".f |ֺ Z Gx10ƍ-?dDKƣN|\IE$Zߗ0TH~ESgC] ov"WG|1=L^n1NA.;JqIQPzMGY .I1| $PO 3H&T ! !ڞtw5XxnV)"5v5q@~u;SG*(6sjbA͛^.3ic%Z5° 1sgIfl;̊P4<;^JS7<EJ0}cQ5\DHvV1 aHA/\[e`H8)Q$vAh>&=o7˷8n|W) FgቋP`6`7x$U[cION+;S<[tr[ݔZm\5vgccP$9ìs}u֣ڳ5#<>{FPu"#>$fH5Ay84o_hKkUNLJB1z\s)71%T"YM]($7v OGN "8iTA2WχhwvER=zF_ɐ[$DYHS*DةM]k`ocW@9/c$^ps;N=ɪ'GN\DGEDO`:nC2?C嬄T@O^T~+9j8J^(?d^YonK !~l "nٙB+))j -O#ޡkvhg/v ShfZS#hϨc 4;"4K {{_X<=O[Jl$P. A{ wM/9ƩT_JK7mS[ (Zb#gcU-K@BȮv`-\ NVJFD t@iԼC{zSxY2ȗ33ʱTE&پ.&} WVA<)~'YD]vYʀAd^.iG$BK`bV6 =<*\7:$L@hsR-GOS5]M ?nS{4!&s< ]DJQ%_y\}̉=S3ewdw:kb6zhfUFf. s|cfoctJ"a.*Iuכg)h8^{˷rSσO WA7})&2)B,(eXK 1Iq Ϳ Θy }:Ν- >d%lvRDzrQ(6|KhC'j);Lp@@s2Q:l k,Gll#Cj*~WPγ,BrxTё`-mg'Ƒ0U<|ri[)qns tT&u ?::z?C۟Y;Y/Mj\Q) ޅt7=M)m0^8(A\Wi0t}zJ:M6*nx?o.@|rA;Ě, 2I"NrfXWu#9X*F+ 14#?)`kļB;k~=rs{.],Oslk*c}){j Xm.vj|+!%ɫ_!N9#`mQ\j/WdžMD%Uw IHxګho?'h!ID# P[] _G ;|y4@=G*/˙_#];-Jpj>7CڂݎBQ7 g3\O.{?+(kFԷW3-V(תuSI= K5Pϸs:yK 5Rwh5JӀm{ 4d!B*T#ԪLNstX #]=$*6 ՋR)Y&^V W+bT0${EZU${G gn ŧiWzU?+!EŕX ڏ4bLI>n rRH͖ Xmj=6 @;rqHwg1? υf@.ݎ&0:Km}jW5𐷣mSB*߫رlA+tm׋)NVn=|s iw3H`&gPb~IIV #)0F̪#/Gjo V@<'.D`pN^w( Tn׋ʈ?_1O=〺# ?}w!nz>Q*[sS|11np#_(˅ѕ~*'uMدՐ%S61opMG ё`α'\YfRXvY[ڭR+t[ BS=)d ;*lߵ;Ľ._>KfBqxY (F|0.Ve%S61opMG ё`α'\YfRXvY[ڭR+t[ BS=)d ;*lߵ;Ľ._>KfBݶ#[8t`۾[$^SG30ǡ30'r^@㷄,CU^2wG svWMioK0t sS|1O~a5!+si25~[=>x<[jc_ޤal]ϨոAs>\o,R (Գӄ)O]>zME [tjB۸OދHZΒ5Oz|?tJ\ H$voɉbgjḏ{LM;< CFI;n!j:bXg*{}iMZB Z|QiKdGlc3ecf+!1 :_k0ゲluM1 25~_٣"GlA?< j5BuL[ Qk_8N2=(檢VS1nձ|-ՏQ)/4y2;$ $5 |DE*\qU^<I*G,([L["/AcX/hsx'uUA$3{)gh 7UOdC˜0s n7"h8x|;;.>e3o촇f[X>sNlm XG쿞a!(Dc-QFLDpXcXhe U,/g`EH%f3sJM6zCgyX;ôMwr&9:'5)jP1Z H0\i2:*ЉW]{f"c+0/:;9\g^ J8iʅ9(킺%^M.ja+CR\ mH/8z\9!?e _/S09'hε*C!lLbJㄚ+a/>\#hc:d?:dEqI-R+tIq2.ךA f:GeqCwpj3-ݖf%T. )U<}]~wZ!;T)T L:EU)쎳u 6JU(PҙZ\|QBҗSlJaBo9g#0w 98W<9ukhm[XGGj8 h޾|.㧇#; 6G:J$u)]"* f$+C.~\"r1 "_|SiwxFӶphy/*⟢"SS/LcDmv]r1Ge$$_\ĕKbɘ|~<W=. sE׺u/ݧB"-O ,u NxNsz)'_c^IPjE?w*h@DVM-ZJ=f8 vMbNLQ,j9Fa2|B}R\;Ȋo~R+? wʩن>>J0圱xO?%gZ@X5>J/)T٘\`N&fِ4Yԑ z ΗLyp(>rILZ55#y(PGojJ2WlhIuQ*ZcMi5^XNeׯG LɎIuAP0O l2<pǕիZ)- 6x\-j ftToE+bچ9WPJXKJ'y1/ࡿ$$گ*7+x!}Ft® CIC<[~| ?RXkvQT%hgpL>]2jKt!v=6F+#ԫ |u{O^9Za!.67SȚ=ݛ_Y%EKhH@D{`:ƃG&,I,@Q1 r(: YZ