selinux-policy-devel-3.13.1-229.el7_6.9> H HtxHF\P ?*}}aqKDüWZ)ӄؾu .ek0ca85ec385ed6a7a2a5c94e7e308afd3da16d3c6>˓(&˸j1F\P ?*}}AQ_6Kew==Upk8݄:.Or>: ST? SDd * ?pt  XNN !,N +N AN N NTNN`N   (8 9$:$> kG kNH NI NX PY T\ hN] N^ o b 9d e f l t Nu ,Nv 'd w (Nx >N S@Cselinux-policy-devel3.13.1229.el7_6.9SELinux policy develSELinux policy development and man page package\Psl7-kojislave01.fnal.govoQScientific LinuxScientific LinuxGPLv2+Scientific LinuxSystem Environment/Basehttp://oss.tresys.com/repos/refpolicy/linuxnoarchselinuxenabled && /usr/bin/sepolgen-ifgen 2>/dev/null exit 0p R^q'"-%$#5-3z+*I[+b$"""/H(7?#3J2*G"&'KH>()O63>)j&0h&H// =/:*8"-%FX n'4$7-#3jMw0>w09!B4%48*K66m3-4('<W -* .&.z.^-2.&3&l!*%Q$$FA":4955K*)-:pP9o/UG6.@)>-(252215<$?R.@C.;E&7e+4 7Fl%4^1a.OH$.>6 7=b,t2615w5O4 ?;5RQ#/@~!8}$q06(4N6j4 "-&h7%=$6zLa,I,g#1/(076E+~47,8JC95F%3 Q%!-S;Q5'-&5%8,+7.ahA;HBjHS6,1o"40)/`5Q 9?i6./&95754,!1}'$4.38A-()+CG%0./-4>679,C:p/#0r" J> +w$2; E{*yF`*c/0v>7l)4QQ+01 0)-y8.' 0Y8e>g';6(:60+(yBG".K')\.k=6@,6_a).I947Gn*I}/2')q!{2 &&.*.LN(C$#-3U)I*A19="6V9<7 28BF/<260'(#@_-.K:`6&SW.&,9! &3XP0@z;1E31d$)00313|01(12RV'&6^.'0'22D"2D)f2D)f2!(+J-=C7..*h0xI!& ./.'[EE>h0(-&'W/.U;0AG0J,$/b=8Ez2 M)B'(7$6<=677\6S6SS''g37K)&0hN3!Y1I_ /(()4& $p%/BQ58f'$#!r#BZ--I0;;0TBM)H#0& $%./KJ+6J2r.- 4.2-03-@V55.1.5-7.]/7j$S5i6,549q,,X-J*,+=F0="274:..BCr>*A25G?//-18N%0i'2u(-*(})+!+y() +%$\%B=BW#-'8?9.$:04490#"M.^(Fy27.'q)IIK S =s + *U/V("3^w-:q6A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P \P \P \P \P \P \P!\P!\P!\P!\P!\P"\P"\P"\P\P"\P"\P"\P"\P#\P#\P#\P#\P#\P$\P2\P2\P2\P2\P3\P3\P3\P3\P3\P3\P4\P4\P4\P4\P4\P4\P5\P$\P$\P$\P$\P$\P%\P%\P%\P%\P%\P%\P&\P&\P&\P&\P&\P&\P'\P'\P'\P'\P'\P'\P(\P(\P(\P(\P(\P(\P)\P)\P)\P)\P)\P)\P*\P*\P*\P*\P*\P+\P+\P+\P+\P+\P+\P,\P,\P,\P,\P,\P-\P-\P-\P-\P-\P-\P.\P.\P.\P.\P.\P.\P/\P/\P/\P/\P/\P/\P0\P0\P0\P0\P0\P0\P1\P1\P1\P1\P1\P2\P2\P\P6\P6\P6\P6\P6\P6\P7\P7\P7\P7\P7\P8\P8\P8\P8\P8\P8\P9\P9\P9\P9\P9\P:\P:\P:\P:\P:\P:\P;\P;\P;\P;\P;\P;\P<\P<\P5\P5\P5\P5\PA\PA\PB\PB\PB\PB\PB\PC\PC\PC\PC\PC\PC\PD\PD\PD\PD\PD\PE\P<\P<\P<\P=\P=\P=\P=\P=\P=\P>\P>\P>\P>\P>\P>\P?\P?\P?\P?\P?\P?\P@\P@\P@\P@\P@\PA\PA\PA\PA\P\PI\PJ\PJ\PJ\PJ\PJ\PK\PK\PK\PK\PK\PL\PL\PL\PL\PL\PL\PE\PE\PE\P\PE\PE\PF\PF\PF\PF\PG\PG\PG\PG\PG\PG\PH\PH\PH\PH\PH\PI\PI\PI\PI\PI\PP\PP\PP\PP\PM\PM\PM\PM\PM\PN\PN\PN\PN\PN\PN\PO\PO\PO\PO\PO\PO\PW\PW\PW\PW\PX\PX\PX\PX\PX\PX\P\PY\PY\PY\PY\PY\PY\PZ\PZ\PZ\PZ\PZ\P[\P[\P[\PP\PP\PQ\PQ\PQ\PQ\PQ\PQ\PR\PR\PR\PR\PR\PR\PS\PS\PS\PS\PS\PS\PT\PT\PT\PT\PT\PT\PU\PU\PU\PU\PU\PV\PV\PV\PV\PV\PW\PW\P_\P_\P_\P_\P_\P`\P`\P`\P`\P`\Pa\Pa\Pa\Pa\Pa\Pa\Pb\Pb\Pb\Pb\Pb\Pb\Pc\Pc\Pc\Pc\Pc\Pd\Pd\Pd\Pd\Pd\Pd\Pe\Pe\P\Pe\P[\P[\P[\P\\P\\P\\P\\P\\P]\P]\P]\P]\P]\P]\P^\P^\P^\P^\P^\P_\Ph\Ph\Ph\Ph\Pi\Pi\Pi\Pi\Pi\Pi\Pj\Pj\Pj\Pj\Pj\Pk\Pk\Pk\Pk\Pk\Pk\Pl\Pl\Pl\Pl\Pl\Pm\Pm\Pm\Pm\Pm\Pm\Pn\Pn\Pn\Pn\Pn\Po\Po\Po\Po\Po\Po\Pp\Pp\Pp\Pp\Pp\Pp\Pq\Pq\Pq\Pq\Pq\Pq\Pr\Pr\Pr\Pr\Pr\Pr\Ps\Ps\Ps\Ps\Ps\Pt\Pt\Pt\Pt\Pt\Pt\Pu\Pu\Pu\Pu\Pu\Pu\Pv\Pv\Pv\Pv\Pv\Pw\Pw\Pe\Pe\Pe\Pf\Pf\Pf\Pf\Pf\Pf\Pg\Pg\Pg\Pg\Pg\Pg\Ph\Ph\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\Pw\Pw\Pw\Pw\Px\Px\Px\Px\Px\Px\Py\Py\Py\Py\Py\Py\Pz\Pz\Pz\Pz\Pz\P\Pz\P{\P{\P{\P{\P{\P{\P|\P|\P|\P|\P|\P|\P}\P}\P}\P}\P}\P}\P~\P~\P~\P~\P~\P~\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\P\Pcd065e896d7eb11e238a05b9102359ea370ec75b27785a81935c985899ed2df6846bbdba1149ef9edd39c6f18d37f29e5ed9cb3670521f142ed6d7d2bf9f2b8342d2c3aa4d008aad3243fd00e4723033e27e253289356cdf2cf9ec46135a8327bceb4f36b0f077b7a232a94e214b3b0a5a85152e4d89c193f92ddaba3ede1ad61127f15b5bd012543968a79fd1c226ef3c44024679b1482c174b7d1e772011c64abf296b53f2a0082b83fe8362e4ede55d336b7270c1a734847e68fd0a9cc28ce3c1cdc4dc2a4c342ba5056b8ce56016ecf7b80d75f72560bd933458eebf64adbf8c946bf659e7e8f4767b51aec954dacc0a150f413b45a3712b04bfd34a49c2884f27513ddaaea9effad96dcd151473562269473ea4173750676ef6e97cddd2410ce2237fd434eac4145a8bee99bfa06e89fb00a5594951900afc7fed175fbfc7e8ead05a966c4ca348fe2f80ee1a9e76a512a0f70a97f4dd88f188744b02283b3701f13e0eaff2a34cd83f6d23d06d92f0c3b6633e7d3bf512dfe421046f4c1c3cd901f4506d64403eb8cd01879b1d5dfa78d24c1798a5beef4a04316bfecc07fac1feef27c962c8769fc7d9ba6867efbbf50d8ab63b445885a867ef94d481eafbbab04982940e2861621d42e48a4fac762113a532be1b4eaaf00ae8340a04a727d30b3feb84bf527996c503a20daf558f98f840cc4d29a0373db4afb451ad313410a298e42c07fe01e6d0fb1c458a26730247fa00a2edf73a4de7cd1f345f0a76d788e6903f0318308dd4761656b31ba8807eaf552b5c5d1da172dbae68c4ad40e698867d0f1fd73c15019c209a581730a3442cf7ab87b44d659bdc674adfbd4e0da800b490f4c7037946fcfcee9c85eebc752ef34702d00c4f7a8141446694d198ea02a3226e6cba40ade81e6e69770dceb9bcb88b275406f7cd9dc1e3bd59cdeb1710241f61ef1991f55344b2720f6afc265382fa282277e5e4a90990fb9ef37a76b4fa13702229efbd19b6bff6c34fccc08beb964cc3331c2113e1938b7f943678036f9b77de6d47419aa52815ff80178613456c7cb8cd070a17fff603e02b2177fdd592244f8d0464a5770aeb4ca1507849837586eee696acfae9493af6135579ec187994ff5839b1627462bdd777571c85b017bb75a416d06df037e09a05871cd258067969aceb8567a2763d2379eea550eb07af5e1abda30a78ef44262b3b8a1961630add3e8b98164615dd2bbc08b1d39acce8e130011b2c498a618de80c174f59239bfdb13753b0f4be2cdd634428b3f21ded3f139af8aa2687c96128a0bcbabb6593a937d080928c919942eea72b29814271b368c81f9a63312631807a09236f025d93000fa56845ec1575af40922f9c3d91928dfb397dad78f7b43ec8d284c39d8559bf812f492d3dd2d4892da049d3138690f4d76c78c071c83064538afd49ac674fefb0b3fef84e7f6c18e0d9948df3067942d1ad8949983e01baa62311dfa969fa3a8cd3aa53a4dcf8d06dda9b36dff299449e2abce98ea80d1101e9969ee24c5c42312aacf6f0e020c51ded32972cc98a6cb3d62db913cf7e7a542fa54eecba91a9c3a8f6507e58e48bb6f23f786cdf11fef9f043c60eb4e4fc389174331971e323e18a9218216ec5b7710cdcef6ab9dc0956e4da03992f6663fbb6ac5dbafe2a0921b667b58b1803c17c13015485b383c9ea84d27e3c35fe146582b441afe8b97a5dd48495299536d8bdea70b1952378f30adc779c340636db106a06e7805f5da4e21dbbef4c9a7ee11d667ff195d0a8f6a2bd9c5e88ee05733f640db6e307138f377c9e148efc228a59a07fac88488a3a0a27ab45ef6cdee81f772143c0ac54f7129a558fbc81baaae9c624636f9571853ed43feb4490027af53ec2b16d3ea407e6408b39a230119b766a321654af5e09c1c98c68ef01588fc6fe4d6d6211981d74ed395c32dbcbd2f528d450564f93e3f3c9f5105ff2220d7ef6bc2009e1af004303c261cdf4d59d9e03807c56b4b843e8d06191093bbd656e5878dac02f16e5ec675a150d191f6e51db777c1bc2e0a50c034947bea0ba1cb2e7340ec56c0391e99ce066953d3c23a9fca4a6ae1fbd428fbb6a33c5ef4aae08bc5b8cc8cde2e4d68aabf6308c6398efb9b86821269a88f12f1e98150d929f302d7efacfe9376bdaa317b093cdce8caef2440648950602273b1e25663888de24df60a63eb4a4c4e341a0ef90ed519bfe697614ccd41877e0b3ce2ea034c85ad122f2fe71f1f1f88c9303ae5b9820f7bf50b91f2e3c45e17e858ef070d5aadc226ca7011223b934516179d04400e8a2a97a186e80ab704cc9e32a26b6fa8d60a5dcfdf4d4b2fdc6e4f8d5b4267039577b9da3b69095ee7bfc59970c5160f3c0eb7c9eff9fef70e1e5f5abc0c3b0d9acfd974cde51fae117fcf304a9e36cce6b24a288b3b557eb06e3baf73fabca7a69208448a2ee81042b57593b60b663d735ed3e434ce0b823b5fcb1847ff79cbbc9d2eb9580f27b2a1702a90c2f396785ae9f4089d09b74c9f310210b65465ea6bb22fb2b4f964d96a14edd10457752f75bbb7601557c55813bb20acf7ce2f5bb7c40bcde74a86b81e5e4cf0132d1259a91037cba697cdb7de18062c27b3dc9cc53c899b2deeb36debe11b50fb096c7b8328e5824b5d0b9a99908fa118f123277b2bd318f38a1e7f132ea183c5b3fa3cac8456a2eef9528ea0a30081658b55197c53b1b35072eac426ff6cd95f0a9475e5323cc5edee619a54fd7402e04536b751777b1db849271b11fb3961fb900b4c81ecfab51c65400956d705d767c789063b74ab67945cf22b918dcd18d971529fc6061d72dd3b153507ab605f359dcd9e27c964c0f2b55dcc35db9548f4d84503b0b22385ceaf7a2cef7db5bdc1ba9613551c70f4795519d0d948c8a44d353f4dcb8fa0fb4ffa7b6d46d65c65d11a2e7b099fa6602f12e5a39c7d15809caa627ca6b8bad90dbdf4889b1544f62d553ea8f5f41776c4cec6422e743b6548c1f7369132e5a8d8198157c4bd5215a7b92837b4611906564104bac77da443f181aaaf061a19c36b259e89f8130c1f4e290befe85dcd43176dd26a022976014e0ed3a10e7658b024cdea17aefe8b4f0ac0657a1f607d06df4daa0b435313e263350cd84ed175f43ffac5d4bade15ee075bc7652fb51339e1dc095aa0d3ecf12229f14dafe6a673ee79bc554b41d588ddcc464e0a4cbf08b3331d092a583bcab94fe1095b9c401467264d0a49e0422a2dc6d294dc0a7408b852d98a5ed96030990be8e0d6856376a35de427e76389abb2df28e8d1172dd4d422f22ee06eebb80bce183c67eb2e66889d81cda77d6a4aeb1e8023e0c8c40a469b7b1bd9e869896e50c4d35b3f8ecf07626ae329469388c7c0f715c9bdc940447137c4a271dccec5696de0345b7d89649c5e865a40d8b254a2f2456040c00b32bb04146259b94ab3667668ea62bb29e195f896d64f7c79a0a1644e7f14a8c66f173716df49e8c46c2855a13d5700f7da217e00c9cedfcaf2b9b9c453be504b66a88d4304a56664395d018c10181de058c693c6dacc8f724c3fd44499785284ade5d607c358ec81bac770ba3d2d067b2486743c72e9303bfafd5a39c69b3a95120ed4e3facd7e0f7fc4e3609d9c3442cea667f9de5ccc8be344fc6db168f70206f5969592e4fd9a42cc62630835f3616c5169dfe5cbe5adceb462772af67699af61437faa7782ad02b57e3983d3b0a4eb97153505940292acdb3ef7d5f1cd1635c8d2899670afc286568563ac6899241f02cf560153d5b194a5569267cf8746f7e600b81f8acb47ef445c50523b1a510e39b39636bd6033be12bb8b0bc28f82115c84763786fd78462353eb5e6e04cf367f208478b683454b848972dbfdf308cfb664964581460d8cff6a5841cf848a4c43c389d4fe8fcf76c284c97c270ce75b3dcd0e7a9ba5645704cf22d5ba12549fd521de7fadecdaec425dff7991f3346dd59f66a1822905557320b5bbc22e8286ef9d2522838fead095df9c89c18ed3d501eb37d5784429384206580f1360818e4ffe897aad88a933e172c411d443d3f5413ae27fa8d2bc65054985202ba1f1f98e2e9a35561ee222e06a195d9a97ca7ec95cd66afa24c930069df2932cad92b7839582f7b85fd557ec47ff4a91c83bca31a81936ad5d8d4cad5cd17d2de540aa2b1edc4e207f8b8f875bb4ad3e6757f3a0214e1111185c181c39b7678792ccc32cf86788fd66573be718bd05053564c6cd935343e5899ca0a120ad0174b8324c1ae1fc7b7183e1c7976ce4b18eb5aeadbddb0b6a6003843acd7c1d2761f0b8be1e7360bce59025e3dd3b7313bc654cce56c13a8f99ff3df1244281c3a6e53501dc1e3e3f5debd302db17c31a0883060a45b385cd6a8ffc44fea377d4f0cdc55aec6cdb23174f2507bafc2065e49cd6ca1067001916683b41481da48f3590c84456fc2f1855b238ae8014717eeccf6d1231dcf568f80896521bfffe45e3a6f333f3a773c3f77dbde893b642088e44578ad46b295fb34654bec0fa2d83c286df41d0f06b9f5850d07408be08496c65c3fe70ce448e41cec028bbb077648bb53846d3bea9a72ada1a6e6bc7adfdba61e3b9047a62ed1f56c52eb60c739a4e36b79d73f0a1fe909a399145ca442bf1e1ac2502a3504f13535ac8eb4e14d2eeffd9adce9aadbfa086c48aea5a0581829eda2ca3e3bea80a4da8ab45f924152b614beb72f763cbf8aed7ea452854ac8745f649cba0d4f671230605a0418d04040d07aa759d3703a50190274a8d0249bc04d67dbf5042b1c7cf4051728d57cdbdcea8aa3b158f1121cfcaf054789ed4114a0350b60101f7d8faa1b5a13f23742ff71380cb846668af5c61b883fe69eb094fc03e5fc25e7118564ad415cdb6d0dde8c4f8d3dd162c36f3ad41fc86591ea5566fb93b582fb7d20828def463ba2acdeb13accd2f4e7819456ec252f7e1ef6bd6520b5195650d5ed88db3c39e986631477f0cbf9c4feb2baae487f631c1f620d80d29ed14b0fd57d17507df5fd234f985e0499ef79600cec26e0e2189e4a5602209b06b1c1f6c4da9a12cc996078d934f7077d293b4a279ae72a75d6192a351889fc97cb22b0515fa3ace171549a4c980177c1684d23cc20194d89d00c29976bc3a7e61e1db9d25f8909e6730c35c4fa57e749e2238f072e7df473a4d1b78ebf585bde91aa70c6548d3c9e44990a3e84efac13f5396de6530870f1b98a55ac5c633a3c44490031e2ab0a5f000da70292a359c6c7a139f6519c7f5938435e541c73fde79f70600b8feb6ae9b8e27f8da6d7716a55e639610069e00ca0b8264718a1b34f2bef9229db29f8aea6fbcb8f0129b7e12bd69eb875f6bc7403602456ad5bd32f8912b90400e6fac459d43ba51e7764f5a47d20f2d3652d230aee69f1a43c3403b8e3b71345dce1cf3ebbf32c3fc332349e33d1ed732b2501e5cb3cc422d8ae28ad39448aef1a7fc547a69f7f4bc8fadffab77825d0489f30ea6b423ffb39016422f99b3fc8dd790d08db146397122a3008c199f9b2e6b8586215214d1083d5610bf58a38e0df501eb5e3c2e5a8525cfad01f9a65e3ea933dfd46a7afd7f3a55998850ace54c47f46baf9fda7bdbb723a0fd862fc7146add33bcd03bc40dc46ea954654875a83701008616bd3789ff4a2456038893c4cc2ea7fb93a6965f91ae47aeb8c897ba919c4abee7c6e616fb855211b082d705dd2be08989e76ada00fd0142962575d54145c471628ca2d4de8a7c775a476995af1cbd7bdb703370f815699abcbda6a14ab44bc319d79377bf2529479e02c937d925a48afc496c465e94c3773c13d420c2cc0cb7a5a05fea55779d92e18692d8b3de1717f4134ff6d2067740802593a21fe5586a3dd2724e142230df5bc9c7009e4785cad8c997404e184d02913ba5dc0977355971741d49685f08f88de3ab3462de9c8b5f9e7b80bffa644a772a1cbc68f1ed25687b1a67fe8b80aff317d44430a7e2e8e45b71f1479f971c013c85f753e6fd0eed00f0d5a9e19fe922be5cf752ce8035cb880a85fec339b79fc7df583bbbb4e49cc0f2ba9565477915b71b20b3d337b21d01c16992d41a420a6db97a42396c247de44c3a4d34a8e164c597254fb256c044e019cf8fccd3c8e2670f46a23220c7a8136f3ba7d12224b6e9553a0c09a5ea63d8bb75a819b7b9127525717a2fe8643eaed1f837168b90cce58762e64e2db84e835bf14a958b2cd01c6b04df98935750a7eb0502c34fc0a679b71fd61b5fe7a530d4e228d9784cd93adc32d270d52ba6039aeeb6805ab380b358192234ff7db2eca0e5dba93cb1697721b9bc24237eef0c9d571e279723c23bdb6fc1faeb056cfbd46a111bb3f0f880d455ce0f7d6cc3b5e7b590d47070550cca55ba3b59df53b6ebb3117853ef589746566db75c4f70faed81009745fc24edeb061cd21dc1a664be0d66655abd4078ac279821b0ac862c20d28b11736374e651c9a677d48605f25a73f52c461db52cd719775a557b5a247166fed913fc85b52e22b0e7b9a68de6c9c255575324139b663143005fcf2f06ff35e6c97d2c744b8530647161b6690e3c3bb9761e117b6833f2584d579fc024e528cc660726b206c87b0eb96cbf1b5e7a5bcdc8797484205e6a7836ad095298afe505e22145db0b554753841d17721d7329d91b2adcd85997f539f4eb022a498936d3c4bbbec2a267328a99b4413858eb8531781e4b39770b569ea77aee8f9550fbcbb41cf91cb54533b2b4b0f5d2bcd199b2790690b153733b91e7d7dd82f0440d2f967a8cc2a522e8a36b5f046d4dbe92cd20f4c654c0b3c40d67c83eca3e6d22883565d7d4a9e4636ec279e6c37d94590f5d162422630476ec615a8f20fa815c0287876ec3b3a7201ffb2e9dfa039c3911b1242720a94c2c45e0e99d03485982bde8506374571863c90cfa226ad6c626178803441c96d1017f520ed578e98ffe0ac98e0e2861beb4b4cd897f557fb626dee16b10f84ae1ca23f898e25273913eff1b3b112512dd63007953c51d70fe9208649bf10d34178b98de151654a57491bcc0df4182eb9bb7b3f678f0e9c1549a93037127a397b9ebafeafe1b7188d8cb3ea5a5c5eb6b980ad7b10b291051ab47d915eb66b10b0c95223392030960b0dba8c782d992f7e7e71d28460fa55d8787d7373fe8ce27417158414afebc0b3d3ee1c1e809bdb5c420bdb286d79013adb21b66cd39c37397b4a153b860f2443cdbfd3cc353515d5587281d1c62ddf46b9e31c94975d4723f8e2803f73b54c16af1ecf9e318162df51b0c0afd955886817c41273fbbbead003c489349eb4dedcdb2fe26ed60e6fb3f00092e4101b1fd42f5cbc79f8b47615e1b828622187caa21b26836d75658c395be54d710aeb3e58d3f73330cd044aed3f50488fb1d8bbf94b23ded2dafa4ab948c0b836a2be1fae1800d60b00918c67a6a913252ded88cb89118ee7d670007bf39cfddb81ad52d553b79093fbe48ac2251ed76f6e1195f99172ab44a5bfffb7d585e49317cb3da57974f27503f174cbb531cdf93edd8bf479336c6da53bdd2cd0ab52eeb184c5b0929bcf6454747a88121e3d8c92f207a014d7b0d03065ea64af4b0aa104e7c82e926f9f4b2c51ba859bd0b4af54c41c7d64d0d0da42ba2a47731fe150b2058ccb58c99596c258407cb4e19dc551027f84dc9b73a34d805b95217a5d352671fcafb68dc550899ae3c59428aca70f7aca770e3261811e6f721004ba8eac6200f93df6c0697511ecd181e2c1a44c64114b637cea74d5b859dfaf1bf4df0c4c7bd3def13bdeee97678f6ce2db81ff81c8de99c3b340350b9be6c8ceb348ff9e0fccbcbda1ca591ff2486d88d4f52c2b2734b5bb96445a0f2b051e966d215bb974f3c69da0f56a51e6ad3d7020fb158ff03e40a107a22bc8eae5021ad3952764931c4decf76c858c38fb88baec32011569e44eb072f92a906bc26e647466f31c2ad3434be7e72f77345e1b97216c00f56de8dd2a05f0fd45bafe3e499c3c3b61afad2050d178f5f75db84a0a1422f5f49f9a2f52614e1bfb6c7f63af410133004f4ffb6f954654224ab8ebc523527036e29d7cc9147e7676e5f9b9a20ee1f73b0ff75e06901c803a268ab3e09aee843567ed4eca61b9915106ce16d42639fe6320c35ff30f05a7f52fb4df45ec78c0fbf9ec4e7fddd1854c9fb8f1b768ae8734e2f64b3b3d9707002f1a829f684871ebe35634bebb503ca799e10d8a0761635f6ace28db4ab7042fa342515cd4ff9612a54df86453526b93a557fbf48b6469012b018e27b1d8ef1764ad9d4586b14e94fb8ebc4e16ed2aaabc11c200c59e805cad7f0a087d6ad8a6f31977c106b30caf7d09072a43dc278a1737f48004df74a2b5c2d5a5609adfd6293ea1d228b1ea06ce1e283442bf4988d5b0a7b6ebe817073ef38af5f50488f637033f7c4f257fe32d5b3587f43c355d46a63cb2d65de2cf15dd04169e7fca378c8147e3c08375ab3544049231bd5449410ba35b992c8b69a4545b86adc21877fd0424fd0b777624ab15cc2a069afa61e153ee411567d96182f72fc05b489f614349a2bdff972b2381e0df73c62c64c02681f0968315e2c2c41ea0b7e502c81dcdce97e31d98f411328259f3477d23422fae9a2f005545c072bb5217e6dee81ee2d7e57f10b634af709050bd651460898d7d014eea2f852908220a8c4c5d89c587bed9036de2360502080a292cbb389486b55928724c375338593b4d8263f21b46867d5621c575ace7f47dbfa40d2374bd1549bb8b6cec9e8810e46c6199d8f5e9b991d37ffefe585a35a4d804cfe1d6d34a6b368d1f0416f17d754e8d774fb2b203c86efda71b1f3a29e7027f060a34164545c852325251ccc2772a41ad6709a4743a98d264807b9f674021e26fe7d2a4a156af8e8579a3da84da3768cbb8865cb846f42777b14be9003b5a0adfb09675af46b834c64b206a3cc71cf8d52046437bd1c4a426f25000551e5113fc0ed474e84a3f665bb2f7247ed8a1df903fdcd283db0d1e16015ac9ad134d382ce13172fa4b2dfcf8204b40d2ac91de1398adb52364875902a32d736b2516333f81eb3d4191008aebf8abbddec0bc6bba11e580e4ac774cc4a47e9fe3c969b053a42a849a35f29d763aa791c2ee21763e9b0ed83107ad1288d69fd4100680197461d9e604f794681f0d5b863ead6c8b7b991a2205ee81c5c30e3c325a32a5b53d60f8d16c267148dcb4c27afa75e886607ff24d06fab94f2a389b86d248fba96556f0f4a48702981b7a50c19868052f9857d22c1dd4ba8782dbc5d4c98fb054d713f1764b26c6789622bb6140e8c289c2f5ddc8b421e4034ee2c6b2b196564cda8cb015ee1ed0b977697f75d78190d7200cb386bcc10a20911f0851fc37fb9a947a0f51d569e78f52a5041a0b3cd0ef3efe26e45755c1835fa5e2d4c5cf39054e7480e04dddb382f13ba7191d82e6a3597dc0ce376955af43ad9a5869fcaf31ddfa00da54cbe5193c47782d8cfb260079dc81f6806e4b2277b452a518e9b786346fe597922ad593b8fee0d966292a89f6e7e233f08110115e3b6dcc22abf960a672d8cb54a772fcf3270b3f341f614a7f85c813777b83d02da571e2d9a7ecf0a6069ac5c5a3a1436ca622a342e822787ddfae0da306943171932f1831b0b178cb4cc2c197c8738d7b0caba0e7ab61c939a2be4294ea80d29575ce5f709ed4179e9d65a69a2218f4bfd8fd6ce145af929670679c182bcf82f497150f277d203c3a7850de614a64dee808976625f1c82cb1c58af464e39359d97af157bfdc8d4963074a6020cfa7e4fd86c17b484d466d04945edb41e1e691d3a0f50b611fd33adbb7b372be12c312f25df56c4bb26f8e3e078982620be87c566320a497ee84112773b99bc253f1e951ce237afd6c3fb2ec3d16188a84c11b84406bca8d91810bf2aed905f8554db378ed0abc538bc7f4d416c8d5a72084d5274a409873f89607c52329a08b1fb8dfce5445d724be870d74be5b739e74c7641342e5b274a65a357e7c120564a817054c2b41d3ab5b79641faa865426c44fbb7e8bcea6b70238ab7949f7eab68fc54f85c12f3cca9528cb147b99ae5856f5932151c3dd77e783cc69a9c2ce155e8a10a59c134c5c12701b5862abac32b4b693ef8816f35ff941effc299ea3d360fa5f58641903b617035cc5c17b10951b80df8dc9129e3029e8ebaa762e21541cc8f686d8aae85c6a73c0afd556b5f01577a4d88f308832da35a418e1eed387880a1a913a79ae096e768a1cf756e7bf9a68d68078738ba38cc1adde1d79b1d43b794f3d3a5aed045ddb73d940b28a21e657b84777810fd2e3ff2d7fe4268d0f1befe07ee9d9f386c94badbe728c6b01c03aa817f7b3ff75472fd9d84bd227a0262026d2818b6e1fcbe1b2ca51b5091c716993309fcd56a9d8d327bebefb5ec462d8c82cd9420de7565e19821d72f3b08055afe474590c4ef04d683944e94992e91598823287508339e65c2528ab1d539bea4bc7947f649f487e0be865c50376830c0a143110991460539ac04ba8809b2834b434ff6cd6c64c070dcacc4b66f03fea0174e017fbb67bf7ed0e370a50cb0dc7c08e68bd8a5401fdb23f6ecdd9e2c61bddc0c09e456147dfe2ae74c7feccb2c3065723a9c1d421fc3ed78e34b544fd4e12a029f59d594a355427a8f8c736ad191c87ff02dc5201758b7e246355f2b31f52de1b1ab7212cb272d7644615b51eadb979d8df93c71b0720e9003ae28c16398b9b0235d493561c77155e22c4053810442182e488a3920b88e806dadd45a41d2bbb63c640fc78cecfcc4bc015fc54e41afb33ef0d8368938cb9a3899e4d580dbfc98830cee1ee09078eff379cc2e35ec66d2e53a1454570b31b6e4d39014a707c3d086e6547545e1697eaa1a29c0f78074c2b7fc8b7a90891c72a3e9dd96f05e61656311fc7774309c48a25f8c8699856282263e0b2c77fac98c1accf87a6c3f75a49c52aa7eccdf6be2a75973fb858d6bd3735b3f374aedcb0764945371ac835d619e655e79c0ed32d89b276975483ee39b4d5dd50c1641d52bbb44738e58f26fcf195f5d8789b761ebbada38bd8fed97950198b9acf6119ef00471c30dc2e4003731e0b64d8dbcbc413f5420084961c13dfdd6d4fe56bc78be29a75acc8f23a74e4c3c005468656c87c5b69c046a660823e1fa3f6339a8b97cf28d638c89a0efef087f00ddaab83f9ec0764268db3c9007bde40828153af2f69e5fd4e45618b88127b885b3bbd9e018641b87462ee4928ea74399d5cdff960414529a4e64a3818f876f8ad81f4ad9baf10765c3c7ee6f704f56430885d4926b23ad06aa5d4d2619ddc469bea76607d5d9e86512e2c7ad28b9f200545f49e4be50349c64f3a13be317fd028e4d297c62147fc19b146807cf9edec5158a489f00f1139e0e574bb015a02a0b4cabf39e5ddae9e37192a958cc2b1ca0a6eab245e69f6871b035dea7cb4230700aa43f8cd972861c447832305e64cbc82e2cdc5bce7c9df3fbbb3ac9b5d721e9563f859a5fac480e5334c7bd1541012f09083fab1d079bcc9ae7b98a41921d37bf90dc5e27b2aa4d9c01ffd897133e4478995b1b97da3647d1438952ba648d58d7e9e85ef41b450e9005e47f08e0c095f1b5ee4f18fb5fb926cab8ad898916f00d1abc79aa6915de53e6f354157af456fe1dcc31920e3058317c9b722babc280e2d7fcd9d9d6969c762a82283fdfee8ab5c1f45dad01b7d0434481a128a3a73c068b0d3820992df2031e17ad2ca3252095b222d9a3efdd72588372282a90c3cec687624f95e1fc5f1b668a3109c913113d88a326107fea89f6f745fa425fa120f0046be432f1b6cffa87c9cb23f358740c506aafdf652f63ad5b466e1a528e0f743fb660bbc5fcc7c0bc68de7c103d9dfd546a9633cb58cdf6a9a99581f78eb23e51d52cd39e3161f9a4ab13d65d1295fc67cf73d3321bd590d806ea6b6060bd2571532fb4ca7f7e4efca968660858a035edd9554eb246a19e9c959a5158ff284873bc41d314681e6686110fcf4d1997c5a0ea3e50d3cbc58315672ad95b331e1c935e49f61b629c82eb2c091a3a9de313723dd1dd1abf8c85b63cca9c735c1bacd4e88d196198a3708de9a1982ae98038c7a601f3bc10933ff0b0f5e6b22f13bbba527a06a412de71b62400329188274865011246079e43d037a0bfb02b69908595976ea59a4e23134aac3a504b06e3ff74f3f9c295e90606c572f88309556a92d935db1fe66f8e82c5afcd97564af7423fdbe2d2cf495d77f2bbd6ad0699b2e9a7e67f2c39db94a14ff6d70e2232b6aeca75a3aa091393bab3b7d4cfe005295684ba5c8a67cb409c61e7bca86508a2525f93523c4147ab83372a8dcc845a71c590c822fe4d9a4f51fe1db604d1ccaa3751457b52ec89112c923d90488f333088fe87efd0688038ba006d9c1949554c478cd4848fb3f79d811ad09500c35542ca09ea1dbb3ccf9666e75cce28cde21af6160bef111a7662f83542bce03e1e12fc98bf108eceb9f611c8a83ae7a7fcca82cba58aa6ab866be348c45b1f31685de05c3e1590f6cdacb39f652ffafb7a5638a63d42097ab57d500d500cad11be979d5d6b00b22cdccf093af4ffdee16fe8580851422415d115909533ad73502098078811b5d55917db39793594f2b906751e5547a1b0c5a642339f24ea3361e246a29351f50dedabdf7e5b86c33392318c3884ed6820b0da5a2e935ffcae244e7b1c38a94db83291dbcd88e1241392d2568c2b80d492e9b362d4b415ff5de5d7ce81064d8f758e45e8b14165a3168045c80903b58e2fce56008aa78c2a31387627a10c300b5b0b7fbf2df292986ab91fc0a27b7a338e1e61682b3385f634d8b9695578f8a288f8b55c23c9a4ca063e85354e6d8b1b13b6a06095ccf4a17fc7dd0bf5ca5f2ddb46c5690a620b94aba4d4522cbf48a5811c3f093fca2071955372185e1b80db6ccd1072d134bac4459c6fbbe05c957f33739de91a8eadbdd871c34cd952271ed4a935a8b38bab49fdef2ee4f6e381b112ba5275aeb92dd446a5b11733a109c76568d8ce1082902dd4adb43392e3e8a352e504039b7b29e3b3e74c5d9fd7ad4aa260ed7789754547bd44883b6a49ba450939efde93ab27e70a08511004f7c1e52c164c1b06f851ea7529ada8a28df02053f46434cf399f78200164b646036d83c935c34db01ce0c2e67e2364e8f9cbb0cdf747b019351795083c326ffa5961c155737502f905bed6dd5c06645fae8b1de48eeae426eb05e195a605dd0b0a8268c2a24a4dd48f44b06f717c73d18cb73e39dbb0753fe7de507dc3338de6eff3a4a6767990d9b984c1e5fdb6ada3b7a9922073b9a828b1b7f70d726f3eff633cfa166c890bc4537e3371eb87d5ed680d9e7b9b03b90ab39c5e5bed0a560449d0ffbb373d7421576cc467e0662ba38f2618d86745d22f6d9fd04c40f3d5d00ed84fce7d30a0f28e5df38076cbaeb762b99be6916da2eaf841d1eb38b293a442eb3278f52cfc4caa7ebcf5b07058b561efeb29edfede4878f8142f5782e857be2197c81c4352ca9dffe2a0f738e3fda9c80862d6f3ba23adea216d508142ccb34f24dfe22af8a18cda697bafc4bb00e2f2c493beffce35f2046b8ea8f47a460099a46d23b4f708308fbc7c7ea45db97120580c6aa3b5bc27e4bf428e84dbdf5f6d8a4040a0c3916a77dd6c17e643ae52cf988c80054fa096d437d0a75954bd06182099f68a7707e92c0c964b5c66e9548f4cd8a548d3ab414b2d40e303042cf413ef9c28dbde88d6510ff2f61cfb1c63a80e129de6c4463e59e6b27603ca116200dfc39bbc18e7b77828fe39fecb07f405f9241ea3e1fcc20c2817bfa448ab8d923c8016af23932f7dbe0ed9e93daff27f1d97388da92cd305509cec83ee2e56b84b04613bf5b9c984db7a3b6a4b5bd3083bb5c13dd66ffd641b890e0c644a03ffe938555c1d16f3ac264f0f34861c39aad509e7c78a0b1cffd59b9ee36918dcd90c342a12b43a1f0c232b36f29fa9dbe41d94e938c44cefd240cfbd4e3f030cb6eabdd28bec9552e7eb2a2b094acd8a376982e528b83e68adf204274e0bcaa8939f7e875922bd787d333993cb804152a2c49b4252b205b3bcf847afb9bced035d36c27b2be1b54358916e1a9a20d9e4b848a2fee86a6c81914398420b1a840599efe6cddf457479b3bd49d19cf739d332f3d6550e212acacc4a6a98c6729c58ef682af35bfd26fa00d1ce0941a7c1e79230b28caf6756e0c77b1cabdd6c4a27ef6787cf6fd11479989f27e748b2db39189113cf2f4e6ec96d684765493f6b9c6d2ab87c1ae72fd5ade735d3449026531289e70ef34d0797aeccac74d90cb6514abd34b3dcc0a6dba965b3b2fd42d53c6af71dd797dbc598be90bf081f11d156402b8a0d1780e7142902259028956cbb3ad62f05103baa2977a8ddfa0ee5f63472394ae80b2c3f0954bea3ec0b5eca087bce8b29dedef1cf708bc15c5ec82490b907a7064ae2ec09e041352bced46a90279f1ce8cbcdc678518b746e0a1c349378aba152511991c1a3c49d33e6375f89f4bea0e2589d8a11a961432244c338173c732b4a1ea5f5361beb39ac133cf31bad9426f585b4e746f264b9c5e73a3fef113ab39be8827ad17880730b8f686ca9104be0bd4c7ed17d910b831820ccdfef7023b495be57f1d0392bf695c50ec0bc5fdb53e09ca36ee6f58b3334ba4968ff23c515a5ad9d2e8cd58a56ac6b841a75ba76248836e37cfe5b12e27710a74ce237298d9e24d396c9efaf21dec8d1a8ab6b33a7d3bf8a218422f172891a36370a17737ec9e4d688f35192ef9809e6e6c71504c85e3096a7561cd08223329bd48f6e760660c03c8cc46dafce49fcc9a5ef3e807b652c6899af26d97a2a467ae8aa460c31d6519761d2791b741fb067fa8c4a17fb57feb8af0fdf10b72eb7558d0fbb01f8cca279893d8dc3e1565213c5af5663bf79f73b67292801ad32727fbd99122dc46c054dce83d9413db31d9c535fb00104bf89a64e52e7025203e520c0d961c598cd8e949a438b2d7665789a705799f5abff9c0e70959468769a70de81173c8e6321b681e69e04d5f4a60e0bd01c64ca1b556872ac0873942ddc299e4493c4fda4530a0a5c99e11d4b10ee5068ffe3f8d51396474e79c156ae42df5db2098a538ca805cbec5ce3ff87f2a3ed9fd43f7d660c945dbbae999e21b96ab63a3026090900f19e4489c812f424fd9607a640c218ae1229a9798797809242864ebb4b0cc25525f8a623092a3a53600c9a1f5cb88a497a9af55cf47121fe05eb4b67b125c7641a18fd14a0c13fcea4cab04ecd39ba12f84f7916ea94f733073bfb163d2a79372a6e93e21b8a63476bb9ef3277c28207ea99aeefaf4faa294b8021f85e60df5f8e8c38ea5f3605a8e20e7d6e21a135df65939558ee4e2faa682b5bde498dd7b735e115c96d5540f041fd907bd20731a72d53473f15750cc6d058e962e6cea080717d7e293b1c3f1c7efba32a50f350b3e8abab96432e80b3ea164fb707e7b7d4d7b65d27913f9773dfe53d16fbddd51d5ead095b9b60ce60dbbf8d4c4ccfb5e62dcdc35665a1b62811938bf892b8b8b46bb03beee246223280797ed7b615151c3218b7f946d7702c57b040e51abec09aee8ad65ea9d2876802a973d9bbd7405667cbbb503e50f110c9da89e6c5458cb48f0c680eb3eefaf7d05224353492971d9654c0faf99da0611beea46fcd7bcf76c3c8b56c8c017cba5eaac01078533ae8d272fc02888bdf122ccea5d7a0382560d39f0ab3ed2a89057c6916fd196ecf07490df224cb5cdc5464fc90b3066df25c8be6044fcd12b55a819ce6edce5621ddd5c83830fdedb7388d78936b999d9294ef8ea4bbe31dab78f9f50869c29bdd50c454493e906bb8a1fa77abadf35d57a263f6c809b641a89796d7a8d0761b39bea9c938155b78befdc6eeb9f4520826993fdb9293537067150d2da716b12bed418b1faa1190230ad43f7ca0a5f717520552a0d1b9bf7c172f0952d2e29892c4c9dc8cc8292c3c3ed7b190caf6ac73c502a8a30b778d80c6acf77cd46c197bb8ce2b86447dc459dd6b56673f55d63d0b0b13140e57ab9f9a41f162d896572f2c77cd749f6f47b14f0a1e61371b2cd7eb0fac4717bce61559303b1f701f37aa14931cd699417e06f6a66ca8af4445bbfb17ca815ca1375e59f151f701ec259f4b592ec34403c24effba2ede3112f5114647688d17e11f98b3176b6fd01d653ffce1520c04522809effdd43727224007b365acb6c355d3edf7facc62d7ba4e7c775aa517d5ad87b2fd87c7b601040e89b9090d6cec942d4436f750d39f10ab436091e8548aeb48a7b55d23be875d72c40cf48999d1f37b50d36ed96656bd0c2da19c739c5f276c7c2481b9b1ecfb25c63144512c903bca9cd9d3c6ff666a6efaaecf56de538fdf4022d8179720b0502dba26d060d76f242bd5a4230d8b4cc9ef00d5bd00d977530f3807480060d48ebe1adb76ff93a6395cc5f989f9855725d247968d949102060163bda22341352d21c16e28bb64408416c692ce5a1a82e92399d4c99f24e243f8de2529815e2cbcee3b614e1d6e011b7fc6b621dd43180ee567f295c01828db85107d34e251c04328dd567e014d56705e934ef6a65da2f26cb15e991ca2a8caa59bf5ae5746461addd6a1daa18b1015a4638a2668e53e6fb5fc4e081c0170907f5ee90336ed9a70bf0e21536ec5b87626edc84958c05af4f52468c700afd1f13857da42d1ac9fa16ea2c49687346bcd4fd611819e6020d626a8a9ff28a22bdd3a6c9b8bc200e880901720d7de51e2b90b78bd64c27f865a40b8b9bac16db96acfd60629059038d25c185f541295ed3cc78dacac877004a136374aa051690295bfe0fb214f7940aa118747810ea7afbd27992bc2f7d462eaef8d03aa2665d5339c2ddad92de95a2017fbfd24a58ffef936d1d5150262a5ba556f051e63b7a1f932f7acb31ae482c6880eeb0f69c1bd3c19c4f3e0bfcf427625e6dd4cf4fbbe2d32d065659d5d861bee6acfe740b195178e512556ca71877fa7326d3c4c650adaaae794b2922d5b3d6c4f013cc56e08f8e93da5c453a7af459cb6ecb7b8779fcf3e00110cbf7360ab0337f80464d8cf22c2eb8cd086d7619b89b2f11f90073e489da5da608d80c828a7914bbbba02807f8e46b4f737677ecd88e87f5ac3864cf51612104016c9205283ee9c655036016b51b6f9cbc2369864064f0b2f524f7ee1c237fcc8b76e145065beb610a616e7472e56c745b0aa5e6b5262f29f52fa079e49f97bf125ccb64c7739f41579014d80d8eeda737487c5dce172fa34a43fd8e18896e956917bb4c9cf5235480440739abd8bdf1eb282dfd45822d05fad52dbbc08c782550489bd48f56f6d9f52130d84c99ca14b441160653ff9cf19a1dd258f387aa287a430a5b27f004db8cc39f45a497cc9ac1d338ffc50ef1d0938c4a634a3d065bacbbfce1596129e36236d4db4c3bd3b99a45063abaaa1f87898a49162ea03cabc1c4065b462c2104e47a10ad78d162b713fdc9ca96b7c042ca83d29b55045639898d46b0eb5099f92a1876e647b243b04ac0831edd78e45c78db4c1204351d026e142d786826068bcf02a939b98ce0904a9aba3553b22a4519e496b1ffc2c2c3e137eb2208e1b0ed0d5133ed8a8fb1b382663f109d775661a3f1a0884f493d96f4bc51ecc9b29f07aef655257e6d66b7bcf4e2ad8f7f2a7c00401e5e9f8c85532402adb492def9f7eb7a32c49c646b2721bff65cc154a5949b18002632a5a99dddd2390223a138b54ccf94ba6c1e96ff11f8334bbcfb5c8cab050a14c299bf527ca540469434fab09709c52267dc3f4065076e5befc82952e9abb38e516a049b090814d5c0f441020592749ed0bcb26271a62fd94713ff120d2a6ad024993d0674501e8f06bfb61ec590e9444a9721ec0ae2e2314e3d9ca03f79e850c5f3a7d26462a4a8c68fbd4b570367c429f4f5b1a89fcc878d4dcf552a9da166ff49fc3b8df0ce8ab591e1ead4eda8688881a292afb1432fe08cc159b6f7df4d38a4ce2dfef5ca8e7188014727bb97df76e10b0e4317f8541a3da1f716cd81589e323c21797c6c11fc7706201ddd777b23358ea920e08b8855d51cd2c456f3675dfa8a268dfba8be6ed6717ba97c95609f89a19a598394dd085b48633d63a762719a881f3d96788b0f7b2a91cd0f35f13728abb42ace5ab5a69cf178331f5fb0672587aab7ec9dc37cbb27a47921a85ff4036824959f06dc60970d5ab1b96b8adaa980713cbcf1871ed6d5ad8cbcd5a8e42790cdb9dfd448321485d1aba7e7c4049ff7e30640ec598c92f1ffce7df530e0891ce9b15123a5b0d5690e4182e031975ef0566e08919433c0f06b55a9e08baa657e54182ac4be3ee40651836e41c48a6fc8185ab001435a2c3f9bc64ab44e354e6e49f0b9d177723c510b929870df67e11d9e04b46183a6f17245b32cce1ee6f898948c877c1c1f5647fda801f97c1349e395941c95be6b530b5a90b11bccfd24826c1730a87f91f472aae4dce17f1dc1915dab9f67e49265a38ed62a2a14e656cd8c10ce39071a5209e916fab6ed4f67927bb509712f22cf9d669038f42d805af601278b786fc9ab447ea2d19aaf015a2a573ef1cc56cb92ca60086360b6056f3a6adceec66e135af477921be17345fe3a9e381c185ea7b9c8c47ad66f459803c01711cff504e255e0ff687fba714e999cf6706a2bfb5eae60b707eb22ccfaf6ea6857b169010a738fd5210ffdbcde23fb6b6750bb6d562c1137fefc446ae346e5890e6721166955333170c866b9be51745597c61c3e3a7cc10bf4447037bd48ef419758fbcc1c7471c085ac874d35d1f9e2c5afb20a244466376e1866c16a8727eeed5d353afa90ff1811aa945e991d92f634290d90a8616e890cf62d4efb7b5e1e6c56b435e30845666d48afb04385a696588f8e6a3f6598ca8039c31cbf683d9e3deae344b2ffcab0ecfccdc26159fce67a472636b480b0121c15479ef2f772e1d9f51b3a5344679524a8a5d2ed87641677ed2123f2e4007043b5b1602a23316f781d08dd03d2ce1aac739bc87279189a3ddaf4925c13796787b92af571d7f10b1077a135d9d9a053c15028d41e1a6180c930b6a61e01c13ddd508587c28d6241c16dc02fec4c15a96f05e6b09b54f4474a0deafbd26c4c6a581bcfc348e253cecaa7383245321dc3898e90ca9f97b1751fe319cd8692483252f50589333cf704e41d8384e6bc4a00cd6a6f2f67cbdd9c610c97c6ed0d7a6ad5e9735f9076631e06c2d6c36dba787aa071052ecdab99fd07afa86b7fb8fe19a492048620cd3c37556b23066d71340c23f67da9cc60d576d6943e1a5f7c4fc2191e4d034c5874874d08121ac2484900516042821d1786e81d87e504391366aee22d85c67a468a7daabf79b97ef875212c9894d279dafd4e5ca191c560e97f3a59254e646a53a9d6ed8fc05020706db650bcadb13aa3d2c012213763a8576cd31c35bf09c275df57a1513f4864db0a2307e2688059ae013330decd5f374621f4ead58d45e126cc39bf35e8482d69e16c72a996c1c0359a1beec8730f3e1491f3671308350f4157ab4978ea132a34a317de75b249c1c1d98dd955507e64af42b1a34424764bc7a0c56e9666d5c2e825eb76c58819303f93eab73ee424fcffdab631f68e71c1aace895a0f4b2f698ae945af42894019813fb53181f621922035e78581142f2dbe461f06f91dae1b1b2d944c3090e88b3b2650764459efb24b1c436c960be881f31d6906740baeccab3e28669a3fef92c86a6bc6a24e964f3984ac8082266730aed1a2e527b1116445aa8ef67796164a8a191b26d0de8bc41cf2dd0fdacf7fd7b6c2f9b946da477d1774cc5296a8b670b6ef0604877b0a6f6c554a7fadbfdd65f3c7a668c08e6f7c6a25a535759b2ae1bc36eb307762e02441b1664c3cfb563247ebd005b35e9ed7b48d32cd1e29a7f736132d569d485db7b1808e7f7eb56c02da060ed1c98bcb0979783d8899abe7cafc93a5900a2f09a74c7b80524aac79bab12106d8f90c48281189a8cb055fb7f33f701222bfe1838ec532aee16786bca239208b8f8c17d47a4ea424d296e824b7dd29c5eaa6a854f10c5a715a13726b4a9525144482cc37a9b936b3183db72cb4f298353eddc712044e7727f0229088af5d617dc09e25e57f38bdd09ae4140808835f19936ce48b5d3fcad345362eb45a7a2f0cc35a5dede4529d12183fdbf328bf23613daff64c710a010232a92535b2c8fa2319552b6efa677fd4843cb6dac3a0123bf161d522a6457c8fd9788952d3d669c1395982c08db63af38318a16e74815a8b0e67601c55d8e1e2b0d11f7bdd40fcc53e4eb623c2a70744caf0f0c2e1a02e253d60c95907fab6d321860f50da0fd0ebda471be28da3e5b6b60c267df9174b9d9c58bb09bb9273b0267af33632800214932661c9799e067935c5932d057ae830e7ceb1c4d69f42a8ca5f47e43e26afa222791475e178248987d9e092f18559fbc4354741e2c5ffbb1b144cb9c3ce0a90510711c8372da11389941954f97c2a77b689c1b6549a7c96b3032ba6385032c33cc0db74cd2ac679c9c357caf86284877065f58119b9abecf92fcf849a7cf3b4f4799227243aab6b12d75a0081053e5df72b8103e740f843bdc82d2ee3e8a5b44061dd11e26745b20e85c037364630a33b67fecb2eff72bd56dc1e86b3d35da341d65f2f16209fb5c9e4db3ac1f10d1a8f44f41105f491e7a07240716a7f12dfa5f3b9e6acafd7cfdf4256f62551dd845a00b6e29be7f4ffb4048dda141a2a0416aa6ebe9d6d3a5848cf0b5833635852cc28aba36231bd95114f7a08a0ed7e3b4a73f964830fc231bdd2f20fda03fe9272e7116715a701911e12989d583bfa43e3731c8c71702d692bb3f18ebde9c6d9cea5f6ae22b479cdccbfb6cb73ec752d166cc0e34ef75615d3030c8f5af64865622752f963b14e4ff24d72f4e539502b2c4d661f15250fcb548dd6f2bc4f8f973c1b366e2e1b899109b21ed62531a0ee07b7516c43f069d6fd1c711cf19b0b616d538d9f0d7fafb48f75e4576a4bda0f5611f269790088a5f84059a33c4a1bf0791f3a1cf35189a61e91f25668b79e9b7dc0db70ce58f426522a6d4309c79d2baa076505ea94ab385a552b7eeed50123ee42f49796b4003322604120d65b4b7e6da7da536ec15ef5e95c013d4f1245e3163d3d8cafc8accc14f7084946c662b9cf3cf64edb6a5c89d80588a48c51eb0a81bfd2beeaba2c72a5fc6445637015ec7b431465f28c35271d06bc1ce88a4348dc9e6aa24c9513227369d5b7701dbab1e1d5c61d85d4cf7547414827d17f0199c055bd604523423a586b624ae196c671c85d2c681a01149bef69665156bf200cd2a77c5f0acfe57d9ba5f43ffe3381927bbf5d6d0da13da4e515e795e887a4ec947fa417cc997e460ebeb6b2f67f376cd7596b7b5343958307510c0a62769358422d90877b3f868dcdcaecb088dcc792445d4df2bae96cfa51e42092fb92b72e6051f57325d2c86e1ecf9ca2c56de3a3b6b0d69409c363e88ea1b4dee721a1b76c7a9afdd18e53bd27b0a710264b6cdcd534091ef475aa36e93dba18dd9893713e5b76e108e08632ea67eaad5b871229c3962f23b85aedf033593528987bfc912558edda23b23761d907750cb0be0e3a01b22ef4189cb24a2b7f84e25084e4607592909760567e6779111b7849951475a1c94ccc2be94ed4a7e77f04245ed1da83055875f89b3cf7d19f38593231d55fe7aa33b97b18c12b1c856ab87cd31c87525a837e38af8b935894aedb3d09bff376fe4ba7c6e574aee8013bc7943067d0c8d2923704760a35f086b537681a1da84c2bfdaf020c1274450f299f2a5c8d80fce5267fa21642d3f826247e7d44358ba76dbea2b55fbc3f5067862ddbe2683870329142124fd9aa007d5453d72e176238bfae400c25115f9e6af270bf9b06c66a733cf8aaf1b69a4805da5c44cb207b80e5e21edb001da648eb84f2c8bf5b54fbbed6aff4c7a6daa2621dfcfdba2c84a312c1e568d4363b0416e24a769f2f634445843e200ea541369892fd6f5f25a71f9bf8be27a5ac831657049bad0c07d06c6ac6cd6d435d4a95c6eab85c34cc5faf3098ab9b1b2ff3e084b56fe26582fc43c7b5384aedfefab65caad2f24d9c4c98b857719943569d14625c55aa0726749b9dd25d5585aefd1c68a6b15276aff6f268859afde47170950cac2bf0515982817d9b94afd379157d092f7b9859a7711dca0c98a332df0061413dc57ca31779471a43ad9fe6581c6088a7fd899756bb3a8725e554be19b01776d12a52b861e0a4c6aa6cda60e08fdbf413601f1c13c15575a3a8ffda25ad6239a136d3beaea44efd52ddfbb80d9223323ff77352dcd6ee5bbe477729ef58b7f938e0ad8fc305eeb985cd0560c1076c340c868ea7d59bb45ae507e799a34fd6070a5154096fc54078d506a637e5687af6e7e3d3af718573d4be5e6e53c070b8dad63b30106cd85b832a093d9d829a5018ab8b6ba38fb89b0db0bd435303b4761359f791abeab20f624fd4d9238bccc5593acbda3eaa979069310b37c207515340909621c023f6a841f67799af201376d25cf734b1df8003764a4c2cbdb8e638df3c7e6869a3e79acc94c9c51c291c237a3f47ce47210d9cc770e65a2c6cdc50f8e0c2356d349ea5796ec0716ee4c2970d6e7a9ccf68643846dcb6a6ae4611f259848acabcff7bceb595b4721a0e14015146cbffdb42d725efe340582e325f2dcc30c9fef1bf70648dce8a4010b90590177b7a4fed789f4b29cf1db777b4441e86220626f9465ff0b373c5d12686d830c96984fce9949e3d1a388682bc92c763c7ecd96ed4a47e6af0bc31d6d9bb760372c8fcf3d479b6620b241a2dce690e35353f15d3a19d023def92ba08a468fd592c4181c96747c42e3a9c0918b37c213b49494dada43684a692e7ac8ce9797737654d96c1d0310a73de86f6e78224cc1a7b7408c7de97167a4ff1609e4e361c691bc17fea1cfe40dd7b4a025a1823dfe6493384374c10055f917009edce29726fcac8b307aee130b7428ac003bffc0dcfc7d32dd1fc93a8f396a2f163acd0f8fbcf55ed5423c428e38c23f3eb330247ff91eeebe4c989d984deef23ec0be595d7b987bcf474b55881a9388b69cd4e16374858fb4b2d9ce9002488dc4753e31600d12d3568eac52bf6587ff3c56c69ee7376456e0c509b16bba3004935c9d03f4cfd84860a9d9d5450e1622c46bdb73192c087f1129afe02caffa74c7dfd6d655bb762f1119b7985bf60a9675508291b393f96547fc1a6c6caaec72ab3fec25e4bee209f8955d11a00b48c4de2e45b7ee18efef58f9225995d1f6dcbff3049d286015b46df0aebdec5884b0863873c53b0914f5458e547e81e039d6335c304c11a9dde1011eb9c66b645a10bf679e80d2624f931463f5dee6a2c45bf8402af29b0ed55df81d414e055fb6e9d8f1d0b3cf74f621b90d792784eac1d6cd571d8e3cc604d9079ac10a599bfb8796ccc0e5b11332f5176edd71ba030669459c1ab804388097feb9b3873a3856a40309f1047531c0a6c418326a9af5750f049d49c21ebb48c6809023ff35f06fc37a954ed7c1e5ea76b071d9872b5b2bab5ceb4e8016f062859c4560ac39d5760f28e6088338378acfcb971357d1c3e4b42595546eae226ec5c8eced629265fbeb8fbe44278baffa500aff602369df953072d5887b8aaea336d1f83f381d87ba93489fd71a0cd1b7c5312e726072261fb404254e997fbf470bd5b6b8cdf0c13f9c5b6cb3cdacc67010a853323f316fca8dda8c9bad092453cb33a93bc24ff0371a0ae39fc71a267efed8951892598ee6650762d930fc335bebf2db481a183dbc21f56dabf4fc5d3c338b1cfce350fd50e0705d45d886fc78ad3565c9cd2d5f8ab882159264cb87f403661eb77509769bd994f1e09af13d6e73a51b75d80981a315d491687889b125a9a4dc5b370f6a32d4356bb36418197c0db88551c70963d7645ef76bd285be885a60be4ba80f623bc0928598921f798272277f59e0c8b173f12ad0dce52444edd75693388423c4e778661f20bc33a0d388a86c5db76b4e80ffbddbf5eabb21c36b1c1c343bb2abcacd9a62e971292aaceaedf24e61f77795b2671c4821c2788ffcfa1fcae8e808d0e8c6bd0d41aaa42cb6054330794e0faea5de056f703ec71d293164d5aeb46f921cfa16ffb9a6918e4a96e2cb867613d747a9a22c07b54d993988a38bdb6b4a8810011d1a069bb127ab8f11a28d4a47259e5cb8577bab3bda2f9f0035868684cf3ecfc1b73c8e7475f76080a65b0f175c0d62d07b041c216bf2e64890e13e5bd40044b32dea4091bdbddf0db75ceb3e62f320d7f68b35f4f194cf37dec4f7bbcca91870806c614204c71158f1a784f6baab72fc3736ff25cc3d261c0afb6a3a1dafd6781e1c5c2fb294d9d63a02e26f64086d750a4d70a5aee46c1a19847db326064538cd4f29947a11481804bc306ceab47fa725f424a3cecfca1cfae272522911a7782a896bed5949035c608e5ba0046ac67c2d36ee8e40f59c3ebc7638172968a5a85015a3174479cfb3e297a7b912a6a88943933d95d63da3800ac23d7d7486c36aa6e7a743424f95efc6e33548d9af9cf0a94f0c75b82de1fc28e6e7a64b74fcc5819742331a6e683a6ff33ac34214cade2ec90df0d57ac6b63ad4f279f92641eb75ce0e4e99c14dd28759550adff9cebef62524ff8a834a54e0ff6bcac1611b4f39acd44f6dc0895efe9c13403e2ef5b0dca633054d3b492753db2b638ce700e2b09b369c63fa8ede3fd87adcc7ec78a86c862d358528893712982b663b8f603265bf510bd288be4ecf823c3876e2a9ad0e9d17829e29ca6046d08134ddec45c7519bf8b2d1b5f2256edbdc1cfa4f0e720727baf80ad598aec05cad61dfac92d2c64594b40cbe35c2485fd811d1bef3ad2a7d7d3c887613aca7e70540821da307cf9b8ad6149d61d972000cc37b35f2d24a5ff2da77bb11c2c74447be5a42599f1fcfa6a0cd30a67942047038d53344893e1ad92ae792b553eef887605bcc4785dac6229555fd2ca96c47f06e634457286c6df430cdcbfac7790150f8701370482b1861b7078f6ebc45ec5fb8340a56a9ee43b943be430372b02717f988dcdc977dc77cee096e25495e49b4896a2d39945423917147d3ec1aded4e939e3a25268c633c1ef357373f9b6f6cf738b15f57418b1009864236fc4b4e16d1d2eab93f9b1545d945d855b2c388e4ed4e43cd56d6d199770d8a6d1407755ee1319844c9643cc5c2572234b5a50bfdafc4ecdb36da0d5083eeec8e1c003b5f15fc7825fa440886a67f6d289bb7688df96f15f93924ee84dcf072253eb21a418e3afd962dd35344c7c0d7e1edd94b30b7267535b4d9e54ecc4621e3925cb0a76cccef15a92dd8ce528e0e2c9c588698cf377a5fe3adb2bf0acde2c1fc3b91d1a06c8c0b04bc1da3bf6e117843ef8a69c79599a8795e47d1f839adb25ebc8a4d2cc226111e42506b52d0672d8f64784c56f2b5dd34decd819469804c2ba68fa543445338ac8a4ed69ec8dca1168a2d09142b86c16640bd27922fc5b55f27677476e549c471375906433050b03ac80b50a4d967c83e39f77b0a22ec553edd0ab418f1745e386576749a02441ce6d42185a3a9e43c3d27c70971ff7928bf7ea6f3331124d5abd972b3e4c07cdaf4e1b402122f7ba43a5d01f568a3562f68b803508385b1ebac0c83985ccb7a8646329ee7b2de4a974afa5592a5cbfac86cc23e2daa53dcefeff4cbcd10ac848dfeb58b6fa1380f841a9a48096b61be9297cfce3222b8f8ef3ca37428a7e4f26291f59d0a23cfa3840497b142d73e2a0cd1fe55b4e5b04c7495d0399eae4f7121888127c6b6ef434765a414228bde669faaaf84e89423f10e697d1ce15514a2c313d18ae269be206765dc5500825244da7826685f92abc78f6ff8f942403e259ffcde0f06d905b9e5c6b8a103b64e22602637b03eb580c338f2cfd246a138fc94e2f98d7b057d50688b905c3718e672356a0cdaa235744b7c729d1a2f5b51654318a5f1f752dcd046c785d524de72820b96f012b996d1caf6c337b85d21b73d1c2a1fe953cdb0205668cc70b28e1dc2d463dec0813d8dac2989112645f0a02742e4d25d5dc65afbbd74226c2c8dea30bc0b5a7158c5796b3938857aa8bceb089b2398b512dd5fa854ed4f01b50aec0df05e3a61735d7b55442a8eaec2a7c8693b4a549326ae4e051da416c1bf4b05b3689d4adc48445b24370e42b27ab78e0078add815aee48584327bb999b93a0dbf5b8a0a98fd9caf4b12579345d785cb1bc2a4303b8eb36f7cf335ce12bc50232d2ed40e1729bbffdff70379d3a7c5abb3fa34cd2cbe06f04d1a177c7e944dbc20774593b1e25af304fbcc2c1062bbd3224e42a9b458ca3452ce7b046f4eb04ea89a520ff6e35b254819bd71b5d9fbc7828affbf38155159b1b74d7aabaf5e496412f965b5d253fe385128f19adbb519aea7d8635c10164bdd233bc45a5fd1dddbd496bae329d0803a3adbbead6fff58e9eb44a0197891cd66cc7bc9739710654f53811794ea75647d3e3806812af08dcba883ab03013d699ade1b3c66b222d1ade8eddf2c0e2b5a166d5c7006b5c3c32c8a686247c9e1ef23e35b57aae0530e8873bbb09fa5aca94262e0e4667e5d2d1248139c2595d7b8a2024106c10d2c7b7e0a8c8ca2c1f936e9acbf56231f52db7931fba400893b880844ebb4f7875b993bea5335f9c80018b6bc7e82a3a723356d7c69b04736a43e42435cddf7064f0b2fa93bfeb65d9ae75eea8a43188e75387b74549ecb6bb1cf55ffe795ea6243cc709693446ee93f6a2864421dd98342b5507a8da94152b070b83f4e0f475247afa6169297fb3fef7e2d5b1d9db6d36e230ac97822cfd75bd51c00292ea6081225e062e7b523b663e0153b1412cd4279244b509eee1bb34281ac1915a073ff75ab960ae2ecc766e235450c48fa85545a26798120ea1a132134847618011422a71a546406103c1fccb9953f31a43ac133e9bfe868f238820b4dd1b4c9fb3e336bb79af895c847459b6a6d84bb2d98c64a058046212cd093df4794985c8834c4f896d2ead510f349adbfec93f16e43088c046cf7a0bbc44701cf95983b0db43fe0278c6565e20d8ada17d024ce5f13ff888946b9dd2390645ea780e3d102b723e26280ce915acd92f5386ec222897218dccf8949cee6c4ba171f1887d68a193d4fb34edbf7c680f9ded0d2135c9dc71ba3ee149193fe342f9352256051ef96efebfba886c4449f1d11d2c389bb6ff9992cc3589272dd2b21b8f8ca43f1cbc4f9e34208ea98b2f15cb9753100dbb8d01b1eb7de76dda83f4b6e86f007fb406b785e8a06769f0dca22c58bbbfad00c7b44f4488b12d33f7d9bc7d00d3f07015d97d8e7097eb492e45ea7bff380a05c922158cdd44a04bc548df2c7fef887f4c3a007b7e44ef19aa65f4468342acc1f06dafcc9a8a6ccc0b3d6cb293013c403b635281698e3f4f584d629e9d602d343727c6b905ea5ea6ca7a5fc1cc2ab58e2dcf472c2f23a84913ce9a0c5ba94c0ef17457fc75d955229494aa8133934660343b3002441bdb5c72909bb3794e1df75719fa2dce8ce4273a87fa94532f541ae4cd119b5c34f2cc180e75f37cbee224a4e77e563d94e1cbccde20261a047ce2113dbb90c3775d6daeacb12df1465b7d5ab75c79a900b71217bbc111222eb9cfc73b718d57ba4e9ef6d714939ccd8b48ea4c1a8cb73f1868f08880ac354c805ea4d4c8841715bbf2d9aef0e8e5ecc6b7717894c104c55b04fe89d109ebc9ca3c03b9c02a38b55d4b2f004db86611b969dd6c676ec603feb4055595143ff7d49cf07b34d71d510de25ce908e0267c74ac3822e8e3b2bf25a6185f404135ddc0c69995f30b5bb6e478a6acec60e8a166babab003f4a0e5266d71ff348b0ece7516118ee1c2037a7513bd4b7dc06870f9e1202e8cf55d1bf486b46d5e4d99027c3f133429b18c50806f9c1b2636b3df71c153ce0b7abea6dac15acc944e54f5283efdb04fb36726179a4cb91823a1e147ce9fcabe278ec8782a4e75e69d9a1e9a0784911bb892dd0ef281a6742d0dabaac299cc8f363d777c6a82881adf0c446cbc54474a9c14b9ecea1484c47ff0b5c94fb3cbdf85c8a72620be2d58577c421e6fb195c4bfa23a38cc5751df0802d14b3cec6e98e4236e37f4e891ef4cfb181cb63ee6500f3db9722acf3286c7d97043d4948c15420d402b9c2dc02fbe35ca159122e8e44393fe99060c769ffc86af644f35cd07c165d7ed2a516e62f81bb93d9105af3e1a40a4652ae08db238b9b06099b4cee261dd2a41e694bd58620db7b2f48e9b71a2f486c3889aecdb6ff0ae04a9b2b9f973a09dba459b6473ccdd3adbfb6021d0de0efe52b5147f0f6c2abdcc8d5866ce2e4053bafea01dff0ae93b0a2a03d1cbfe9b1004ed697473a084775c37ba69267f9c09588f035c383abc5318d240aeefa067014e578ac1d6a9043e6beb7638c531145aced81672c65fe0fa3cd44977d7fc60cb69777e2931d2c451c38a0943c8d721d61f0e75ef606ae7f7fde569223b34697d0984b6d2f4a1d8cea64a519e3c1f0ee3f717a2d9d97b09fc3b7d56fa9d392d861c60137f5d530d6c60eff163c14a0a55f3910ad561e0eb5db946fe535662f007038838fb433bd5ab9a3056d15a29137702a85ba5b55b08f422b2e6473bb09bb8c845e39025ebad54854f08e8b10ddb7ff212629be07f508be1b195e5874a3778f06252fe6330048eca3e71a4c44a422bf0cba6249342ff2afa8513b32413b01f5b8fcee6dca3636fb942bed4ca5b86b31de25bd7357e9c5f90d81d8250d491a26230183d5642a8e2c232f7d35312ff4c4a7c54c1670e76c11863dce4bf13e140f167729d7aaf4b779648d6034455ed6ebb96b1ce168abb096a55de10d43bcd3862718b3dfd7f759924c7031c568ee58108186fd1923c926336cae4fd5b98e7f89d2ddd2a2546cd2013ff562705e9f1ef6e3cd28946ae92cc383ae57b15eb59ce41fd0b9abcc54154fd8db3c1c6d7bff2b478d384d16b5fdd726ca09adaafbd39e1c972c6ee23112c82c55a7fdaad5b8e305be7320241fce7d1eb7815605d67c6508b82441a201be1150678fa3d52373fb3294a01f6407727c84df96c051647ad9f900644c876bd8ebb6eae29bd39cf80eb068884ea7b74777b38a602117d93f355e5c1fc310bdf076fed74cdfb9829bcda9899c0f310a549b4bda99f5b18fa24f2d833b0c1b384375aa9f058a00aae2949617376645b30b6af00284e6087241f9217742ecc0d507f6be72d2fc06c230ca63731fa9fd1bb903b22189aefc3239c894375bc0723b1e488cae066c7a4d9664f551b18ed62ee7d287d202718c6de0472df964f336daa139a58f564e061b9515bfcbc8a2c361dfbe0ffe31937fce22664b28fa5b73b98f51818a10f9cad110670eca8516801f960f46192b3c590e77ae4db76405bc1958bd9724c8a6719c4c72a804890c53d4a1ed8164391c83be4c5b8b85a453dde468d3b2dd2bebaf0d206a448836596b5d7d14c471c088755363ad5350ee1dc9b645577dc727ce60a470175841bdbae62e6852fac70b975419a10a711dbe6b251ea8e7fe93d41edb7310b6b180a532eba4329ecf3ae66b4277df2520503a888d430549a7b37e8c83618a0850e9bd0890b273f9f116c6dc1575a9551147cdcd021ab21373e0cd557c413dbddbe0bc5fe90965257464c1616b79e68e7a1e75202fe0349d540e4473cf56d7b5a31b46a3c533208768ae10210460ac84f3ab384180ebe6d3fc1a9a04780df766ccaacc2c68ac8967fa2fd77132b2c730557617615ef9c4e18e50526789e8858147fa661f302692344c9f4e5e746e95a2d8274f70b303f93e55691de56f305d222c5db06ef4312bb9591c16b49b099ac84b59696dc78d8dbf4208b11cb6eb644b811d9195d4fa9f8bca64bc38504e9c4d235dc9dc7c2e03746cfde8cff94aef2e59162578cd4ee860f49bb3d75df87390e403e7cc5089f53b5d4063efccd0d63f9176f1baa6f9a6d5625398c26fd3805ee5b009bff3d4f3222389ad05be3734f555ec18535d4d6f7394a7ad60c2eab17f0714771c1a99c9151162fa3ead54513d4ae1c7bcd49faf7451d17edcc8f49598245ef6da634b77d1367084ffa232cfc1dbdc3572274e5a50d99ac9b14a9858e4da90af5e517d8f0510e87c8ef91f3184f93027b7448f5b7c0d8bff43d61c66c3d9d3b3f2f558e02b6713313e8236228bfa64c7eb27e47d684d3f0551331d559f2fdbbe99c2e2d4fdf86a7bec8d3c66d878fbc810b395b8374e45f720052ee38a119a45e430a059b993e9e71e9382013e6b0cae210724940800ea0f7b8d7b57610ac0c42011cc8ca188c679239813b029968360f80528b58e12bebf7d3e9175ca7aeb4600903633cd6fdf8d1618729113589308b5e0c3d42a7894963238e643a74bb65d907f70c9733f5a7f3bf12da28765d9fe0d7a430e8a8c4260e7558b5491966dcf01d21ea118b6eeb86d3fe7bb066691333c0ce439e2b90324e15974f2546b4052eaa6d85eb834a6d4781824391967dc3f3247ecf94179bbf476d50ad242798fdd8961f30a4eb863f14c58503afa832b499eeb644849d0052bc8bcbd98a30a6f71fd816f625860ef3355e109a85a3946f7de93e9120719025bc158005b96353f649c45dccba7faa42e22e01d4288e959b32dcd26e093323190dae84365ac09e3d494ac518d531490d7e9ff19ca8b5f70452f88fb4d51116692580a1210550fef5529268362e5c798554bac09eb6a1d0ba2d9cf99d7c504e5ef0b50543d0d668f65c43e9c9587b57ff936c71bd8c65153ca1f511962b93d777a8b69b26c0afc1c86e9ef42e1e1888d5c334d725e82bcf438049b6b390dae514c517dce2d7b06f9a62688a6337783700a85025000669bf72f68730573a9b8c2f1243c62d4043b16f80245ad66e4852dac115f1171356652127b8ecc56979f2c25d847149ea641205c854c6c15799690c336380567511855e3f2e8125358aef7960e731c944d4ccf05e80efc3242c9492a65493060fe0163572bca861a8c01beefa195e30e19efefb7bea1d533528ac0202d53a8f5286700fc5da7ef41a1b49c8b5fbe09a98a32a13a693b9a2d5fbaa4a69cc8f6d0b6d62208ce53c0ca61c7ed95a875735347a8d4fb870630acf38e84fa3b0619f99879c4cc50f5a09bfc30e55c50f5e110fa43e27742bf524f0b7477703ea64af77953bd1303e19c58bdb314654b9a01c48f9cecd2f71760976813b2800da0b841df7b30ace3a679788e398d9ba12992144ab5b3616cad095ee450a407456281e197ac34ce0e46ec0aadcf244cf3fbf7e8653495ebc481a476bb4f5bee463f0507bbfd0baae63e4afdaf09560765377ad1f81bd1c5c2cad7d791bdb6a3647b32789d90bc450690f8f9d77a4ace571143fe0304e66879a4bdfbc4dc87c437a83cd06a0d6050445add86923fd6f0c70abe553a8ae27f9978a3a6b7182264b686e57004e1f8a566577bdc3d13c1f7bf7bf69656a44dcf4e1c8775043be26fa3ed717b042a3f1f7a7f558de854a2f85de73324aa6dab8c205c8340a1f6de3fa456dea670a2a904361fcf0fab3842da40367e0a99dba148eb38e806c9621e33e0445e5e726bb0af16a14deb9a72e51eb553874a76c73a9e0a90386742f60281cfb2d1fa9438e3e7f34711dc84fb91c37d9845154ad88d92e8ba23f6fff94f05350128c3a2f0274414db5d89385d8d078e0f25991e9bc0c0629f0c8b431081feabf11019c116dfcf0537c70b51cdaeac76ead266dbd8a18fbd76b5ec107e69ad8ab6d62d7c082dd281353d5e687a6654de02de0b44f3ebbff730e5428d995abbbbc5956dcae7cd755df8e703dc85f224400af9fc8dc0e11f98d39e7343ae22023b29d79f85495bcac3a278a6e87abac41a15e10e7de48a2f18fe5a06bc1d1a8c5fa67affcb5f7ee4cb74c625de14dd6bc7c9ac5d190e7388ba22712be9fd65c3d53ebbd29426e4f535e200927f41b0f099aaf1f4f891d20c9d7599c4096992d951f247c8ac62d3a8a5f9b3f9effe2934f6a344b495e1816d085ca4bd131f4a0b575e73f35d969bd9c9f7981bdb5092a8cbb5e5777746b06723bbb4cbf5f80d6901c94d598db873ef39fe8a3f3122581e24a939491515331f67647bd6ceae572a43a3093fab51dba60f8065a6924588fd4fcc60e29c274ff0780759efbc8a9c09b2d62a365123e573bdbfb7e0331f9aff8997be4f29419a09e92c0c0e15331c474380986a56ace027060264415550435258aad6a8e17c8306007d9aea71dee969f8cc6817c9fd6a2f0b783963f1c9924c0ed615c37d70dd56810b1d2599ae8b71abee3a1fb0f1df452fc7d22633a793dfdd92de598aa3d1e93d4d583d4542669b37e9bb416e34039b79b3b45c82f61062ea544f0c9e1ec17680df6f60d2d8a9c0cb70a30943338e683a62e8c37983ed9a946519f8d8e9459965f15312497840cf74169baf18bd2cb5a06c91d80061620d6dbd7335265ac61481776587fc369c26e4bd1dd22af35d51fb2b2ad8cab572360f5836af143bc80a8ccc9d074832dea8b2d12783529aea8797ac83c6b81c9f24d4c64285f777a1ba3c99c8505a233ff8d868ae415424bc90eb943ccb3fa10de47ad3a33733d24693d4e9d6a05d988f1ff675fd570c163c3d38bec15d58fcca92cd436c65f1e568a7c83792a065fee0efbc49b52ed773f5c8e6c358fdeb62c25630e607d93342c9163bb822724db8e29caba9aa431b52a8a69d42b647ded6ebb280a3dbda63de64dca30cd5de91fc33e5ec36fd9689ee6bfd99b0d8ff592eb5f9d3bae9a3cfd25f3812ee64e9faec16e738522857c7b03f37c524f6db12074f5fbc73d394d084cfa61f2d3c5b4f8e4aa85ea6bae523d3eca28d9dce489d9991eb60d4e5f6d23b56a8b7fa20d18dc01a766d495ac45de7a69016bd9f247b5f69e524d8984c3c8411b1dbe1165332b1bdf0a01c1dabde82e47cb3963fa1098ef89607594ddbb1cfbf5095abe0fec55821cfffcb00ce54682a9472ebdc23906850493f89abbb4b3d5daabeb312199015049f3d37b7a0776e6141115c26553df71d026e99d1ef30e1587d4f1ed6cdbdea204dd32b93ea789221c0f6824b96fb952863e47447219f548addbfb5fe991b8bf9ec6864ccd8b4c0942123d14a61168e4027c0edf7235b56b110dfb6c3565e8b62a82762b3da19f538893302d972ddfca02798ea404103193f1c9c35d85880776eb3502b656ed15c6114bf0a93aa5eaa24f20d30eb3b941786177093d8888b18fc60383ac3b1590c7dfba088be45da026cdb40bd8d51813ded3444eb8596d1599d7459e1a28c81b54903f4f2a19dc61cfa19d9e222db8208f9ef0b00da027547c415b66c566c42e6a121e0a6ef1180209fd1ce9997833efa96f1c809673015f0a9af286c7602c291d84da34b4d7e647047a72e8e8303f445c57bedc6acc5112b816035887466671df5cb98886276b35e5b35fa084274b0524284a40d6def4a0e53bff4380adb2d4ff771f7483ba02b537ef60dd1bbef818e7ca4d443a1d3c475d6f497fc0e017123d766d61a3e7b269033bdc2c9bfcf1f6c17157ac6d210f6afe70d3b6aefe890bc747d150e461e8c20227fa3afcd16f69423c4c019d0f0172f5fadeb9cd3c3981a5f3be163d3cfeb2e7c87e143d251f984396197d5505583cfd165f85d8f3ccfbeb0142be770fb0819073de06d141c5f055b9e70633b6aab39e5c1f637425884d70f45130731466719106065f3176992ac8d96359246236f49e8de831f97a6365950d45afb7441dcd28634b05301e792bf504f352dd7b4f9a9219ff97f149b34669647559cb891f86a397a1c1c7b704a517be62ffb04477a4e36673797af4a0a21d3045ae02628ebe8875f2b8dd4cb5a0a6bdf1dd6f8a32388773952388775f4fb6ba54c7a4e7429bc3d5232f5dddd99cb159db6a2e4d275128ea210ee641f38263fb9e1648001f3baf35a174edd3eca327661e8de7d9ef5d82c093c76b52262124c220b802268a0799885c77f8d5db1dbf7a3d63c5b7607ba0ca04170d85d592daf0801833f4766065cdb401e0789ab76a57ddd1a1cbbe661f42bb078d0a038249e296d7dfe9ff53064d963b8ebb6fcdca28afc90414e1fb9991272d32ee70b5c2a7e7f125026b772a6725495658fb60b767f8b5362b31f3c646773837bcfd16d97697fc32129fc5d0b82554a641a154b04f61da1997a5193025c627d84237f024bbf629cccbb86876ce8308f8ffc7c48dfeb772097c86fe952eafe984812baa5df37de2fa8c23caa12262edf5595d525bcbeb4dc12f4413b15732811ab832495f297816ec5ba2784d9476b16071f884f4fb6b1d8beb202c2afbb6896bd855a456e57c9a60c3488f5c10a56c93bf53f2d2e057c12b2ae6dafeca8c010ff143647815167fdbcfdca754b41536193192e34a586b229e4ee009497cf71e9ee4612ee27176f622388a44575f0480108d26f41d0acf536a1d331fda672dba14679d7edb8b30dd88ad89d2add4f781cc163cae63b276fe33476ebad50cd032e22339cfa7496db5a9f2a4ed4cf5ce09c624b458153393db7925a551ddd9bffb3f9138a9d2f0abe076fe703083b1fd4ec42d54e6a9f5ce6e1b8ed307ca8ed1b965b280918e7054d965ac58d99e2cfc8f6ee0ce46d92e223b0aa27a184e95cfe598fe221f7bfd57e44482a35837c55aba83c28888bd265c077df301a6df7673b53464534e547c38eb825c51b75b1fc7ee743d9845b81f4b0c977c7efa1001bc9b040dabb196dc561ba13d36c035ffe90614c96d4c6df9b358f46d2f7128cfea88049758334208328e8bd2ee8de117759942e24e8402564bfdf26129b108b0a2119c572b5a7a95a8e1f46779e6b5a401f210d2f7ff62251170733e0a07aa360988135008c6fda6330113c789b1726aecd4803a737ee48365e3081d89dca33855ea1bfafc213d5464572dfe48034f3467bff41fa180c6c2ef912e6d3c7f4ff3601dfe6d1e88a351c7e5185500fafd247f92c916fe8af0c7d5053e45833fa328e4422ff12074d0f7970869d1584fe1545c6b560db2eb9f340e92cbcd6e7fac9f0aaacc8d0d0aba62b542028756f91877a91dbed8f6ef22ad58b88ecf3ee1a2a23f0026420218a122aa616690fa254680dedc2d3819d774810917590708ccbb73e7aa1f2051998e214adaadebf68abe8c0d48d899a970122f7b9153587d5ad26745a6eb155b63c9deb4b8491e565387b9b7bf7e7b2f1d36c3419fd2ebe31e80e0c9fe5ab0c5d23877454aa1e98d71b07375399b6ed468e66be6c3ddf02f782989ebca3d27ebe3cdc2d2f391f6b72e72458a61f9770d76f6e093525c768205896d41ea28fa2ef2c3dbb563c90d604fc837c971f0480f8bc7db3f4e1d7715be4ca309ac92251751516a419b174a9971f79365fdad31dac352e4fd3078c80e264c19ab661d0c530a1cc6391e53c991778c200738308cccbbfa660b7d7a2041e6161eb8ea4f6a127a17ef5b5b86443f9fcd0f95333c9810997bc80a73f98791c27be552914b4656f7da13668b4302ae7631ac6bad03651e4732683fe747142e4989db6786bd3c8ad927e39ecd8db9ada11ed4c585ec2d4a2778fcd3a9991f83d391ae2ed233d375f3d7bb26b98d94676414b3805de26278ed25f026f31ff2fdbfb7e26a59e05d637e72e41589202a5d150e7c31296b128928595c740c6909868c1b2faac8c427120b19dee058ccb55321c08d5fcdd827341b10c0d38fdfc98a96016ce126ef909d7db3f74be475580d79b2cef073752af4a3f42e258603831a5e84244fcd7be7160fb18df44bb873de22fe41bf410774d8a93deae8350c240fc72a731ebcbf07d47f9c93e5c4d76e456537b83b1167f202e0d15f20129d516f1474bb60ae52f57c67cf80bdbed742f72a99b0e242c73c6b79617527edd928b41f2e836d5537a043f864a7403f95be2a759ff4b2821e8534c93e1f23d4defa3ac01cfd1c49ba6a30e68d2d77494419ce889fb454670316eab0c0a58f17360da230c0d788f8eb546b2ef23fd7e7427ecb152814d3c26569f9fd1f5324a344092f6e226b9eea63a406090df7dc55139804f1e360c4307e6c701fea763daf77dc699a2a3461fe10662598414b78560238efa77e33767b44f9fa76d008ccacfb5556579710303ebc51491c30f9b06237aebd1def638bd3f1557a02a1c01a97d3ed0cc9a57c4c5a149aadc6f2e3516304df203004f08b21fcad0e983202543867a492bae4af9e0a146a8d5229706b2d11b3e5063d315632aeb2f0099ffa8faf17a777a6c9e1b0b107dc548fc4a6f5499cd27b045fe5103c4675a5eafb7662a8fdc2a361b29580b15b9af10dbc3492d8f13cef35f0180c9cc5e721699b180cb10140d12bc11a6fd679b4e1ddc8b58760396486ae791c3e8525aca02dae6e9c0a44a3a522f2718cb80c8db470f5c64534472232aee434bff493782c6736be7d8ffe9c50f41fdd9f7d59403d5ddbf84d6ec190502497f1e0e09c6f796c3feb8379aef4dd1e5a084ef730f233f991bc5d11cb5b64c8c8a6b5948db9002355075b10e11b1a2533f81adc24de5a4b9ce6b185afc9e2fc1cb2171ff8e2349fdfaf80562adc78fac74863bd8d5822f280da740d09d966c5255fb1142416a7443932cc3d2258f73193beb8fbda3244ee93c1bba3672979ad67ae27ffcf29682dc3f2adae52ef41095152ff4b14bf2b7a184aa84a44b1205d8f3042c733b22f3296dacea9d4bf42e88b937e1502ffce787e830ea833f5c70eff5a69f3ef5c173c749f502e29a863228a03ad49afa84a7bad6b818d741dabb8279ceeeff46a66cdf2dd4c06970a1910ba0f2163a45bca5ed954b03b86ada9d114df5adbd67a24bd25d42ddb8e6b21c820786b6a3e836c8e11880096c88a76e6b3465b2d61fb111456da58dcbccf7b19b300c88db34699a9ca265599305c22a780e0e1bed18fec6aa777cbd0e9969533401615f79cacfe402f11629b8122175a8367c1d105de7f6a1cb88225f778cb322e41f990c6409fe24b6ef4b37780c99d8068089bb3a4b778ec63c80f6f8d03343ef3770f288c724cbb375f1269b1c06cc3fb0b9a69c43ee05525c8e2cae1c326fa4713c68d2cfc23641507addd49be3af9d557b0be1597fcb7a681dd73bafa132de4a34ca6486127234bd0ab6c050df98cf6b0f111f7500652ca14cab4a41fa2d18f1c664626ba70f874a8365ea64d1e1e8a257a1d313a6b652cf6db617dcd22d74378159ef1ce25258c76e1e676aad0722a01e30db706e67788d558e44bd0fb600b177d88096f96dacfd78b5a7997b9a3ae5a4edb6a36cb3618a4cd76d2647302681fdc242673350f2f044f4cdef91c7a5b0091ee7c195e0268af5ef300a5c9fe1406579ecdcb0915397d14f82ed2bc55f8de4e5abcecdfbc41f9e80a83a072d01418a2a544f718ec3d4f6332d1bb2aebb00c6ca66b9999e6bd2bc490523859f0db1dea63779b9f1f84d52cbf3e7dcede8214080c6b54916f512426bc9447266897ad4078118867e0d6746cd99378ff539066b246ecd123bcb3597c4acc172ea13c1e260468fe12b1696ba737e1984e9b593f774c3db1696be6964319b9f9388707bae3ee0858528e3658741dc271e80974045f3ccdcf5c271fa4458e81023f42761c5eb37375dea4e4d4d8b1de0b4724631cb35b0043e7ac67c4edf767115670eaf50370af4cd2637de6c760e5750b8bda3c5351c16a9a5ebc02e2ea24cd10e9fe31deaf0e250d869f933642bcb9da2dd7ae6d92e3c3242c2ca4908bb60f19d68897616973b67dd1f1b037c460f7181782191858f2003a4146daa41901058972d7baf5088dd5f89f294ddf5d0b6af191f36df14250213469c2735942e825ae6d36406817d2ec872e739cc1cb9f0bee817e95e37bb38c24b9bab958654afa1a38dc4c3155c37d1310f014a5860de0637d0a48d23331bf8afc9f5cef164c130ca4a472b360b92d4552f083d6ffc381f8b033bcc0550c42ea706ca15026f0d4171c06e6e3ed636e2d7cfa92856ef967342076d612e419457b0667c8087f01ebfea10184cb54e7c6df803d8878fc04ec7e45e1705072d1a554a5ead50980fc7dc0443a2f51f64bb73fa10f183be1e8c4368441ddb9cc5c47845c02ab67194a7f27a109036ef7c44c33ea236f799350705cf63fa5a8ed6d8075b8d483c41a589c4ef7efb716cf495f839a1f22ae433f35d4c5abbe7bbcec3a78ad021babf3e0b9ff84130557125622e93b0795670617a426fa536430d1dc22c79ef99b0474f5fc4a7812efe5c9e2e9f1a23edfed2340ce460b118525836600127c410d977d7f2e9a89a6b571289479ee50ec969a026d8054077f783ac7038fc45f1d7972c01d4ff6811fb44dbad8a5de90b39b8a8c055e25ba81b4839725ae5f33875d468fa381a5866ebfa41f21cf2bcd32c0a3e171ca4cd5ee36fda6a7de9f0c630430e796fcae444eddb481d8c61f7c1c1a6b6b6df269eb1c69ddb5d6e2c4bde345e22546ca393c69f48b4d52019f1cd025393fb97d193b53654aa6bf784c660040145a5d5da90092751a9294b526d087323a04313b76cbe6447ab73707f48abe7628a2d8e2b0a5de8dc8e7d4baf10cf6fb714170a8d0e808f9b00d1e3796967ea69bbf899bb84605751b423872250ad5e61d0162613a0876f1c0aa27c7c9dc629bc9ef8fdbcd6abcd26fcdf55e0bb080028cb3de1e3785a3320ee1652bc1a553fde8f73da96ace4c55e5d140bc4211918ed8694dcc5d974ff47276c8c157260e9099cb8042fc9f9a258a6a107023ad1f91a1cef61a74521564bee71c2c055606b183fb3e5f02c21d21f45d8c3dceb63edb8779d4e54668ea48b3d283b141db2e76e2cd4f4f609d47125519bb969771a27a129d82b326cce960126a21be34bcc01bbbda81dbdfc70e2cf40f79d3c7da6f29603a5e52e7f968c8bfc4709adfad10b5d2901740c54625168f306997e9ff6a4dd6b3089030fea08c28cf13a58a35e43883a9feaa5b6552041142f20a916a2b4bb0c0892a4ccf1a8707b3bd537b359cd86f831c655102f69601746ba8a29cd9a089cc3796df03360f77c6727dfe70cf7bd1ee97bd070a1b8ff7798ba8dc2e1ca6f09c1ac987da350d1929136cd346b5347b4aa00aa08b1707ffd7ed550b167233ae883db4791025d4d3f0893cae53d0ee29569290f29b0f73b691f05895c9a2c40357ea89b2fdebe78c41e14f014919d17cbe67b0fe6fa854d65c7a2fa0804dd88d8638caa595e49d2bcb1eb6bb45aa447c4f6ff29d308b7785fa01213a796bf7f61237c38b7d6fa76cb760315659cb37e2c88a9cfa7d48353a5e160709aa599f17ab5076cf9010a1aff139e7d908e73c96c1eeda61568730981f77f749455f6d4efa787d9fd40630cae5ce4d302f7cb502afb8a092b1a0447db8c42d95be45ad25ca5db36cd0f24768173e21b968e7f38503c70bfe56101b8152b3e1a32d922a58fe48f8fa01802d578ffce70178b29fcd877d58d2062a166933fc33d52c611c44d98beefc7a2ddfab7b17a455cabf8acab61554a4c1e649c4d228fea931d30314849cb63eea6684d5410dc66d24fa96739949aa615777b13a0849df0f9b95023bfb065c29379f515d4eb24965f0da79ebfa7af2b3852ee22611953769bc08b0df17def102abf69d9e9d2ab0854760e6ee324c6d35d804f0069d65636227f3004c20e2b74a1666b877e0701f933590c14a0693251fb7588d16d011de7e13d98b07a9935ef81774938d1f8dfb137ef0804e32d54efb3566ef86664a6b8d78d19ff938ca4e067e6c9bd56a635ba2884c97a074fd7e5d32a98c6ac2563323e1d7b40da5cc1f7a66385ef4badc4fb28ea729d6a406b13db81f59251659084f059081828fbc0a287f21a7481d8dbacdb4cd8714741779ce7f0b10d23bffed168fe6f15298797240be1ab25efd139f8f6663e275121659798aa25963f01fb9366b0eea86b68b02f48c74ddfd8f7d326a5bcdd419a78d76dc27507ab0aa42971abb2fb8f1b624d62e13980139cfdec46acd5a48fcfc5b86a5e940a9849b14c16368fbd87c5fb40b8f410d515fd63ddfc55c529e5871a4988f6b1478222f54769ccbe8ee2f3b735fa774ab209ee535a968e7f5c73ae0b5de7c384522f475b368931a1de116ed780a373343da60ddf436d33d075b54dc44383d1b526a931061cebb55f946b2b415547f11343fb2be1233678bcf7d349560ff71b11f5ea8eef27435e40088394228db93f8063dea3693be95fa1569f3b3c91b8b67f0b77d4a7523cf67d842d97ff491ac1842f40f10eacde168aec22d2d14732daa332ab4a4c30248538e83dd7afd1ee5d712876feaf7825829e2e7eedfa51679ab1d7c340f9d40420378b49fc3fc42f72a9a0ef50bf647469bdcf7149a89c14818c0ea9b5fee05682c065ca8a9032bb556e10a0a2e7d508f1d60276b6a8186759960374cfed62f261cbbe8b3e77cb01b01c412d961c16cbbff5ec6c655a18f3d99b0b8ba2b4aa9480d626d4534cf488116b5b194add0074a593366f9f4c8ab554393017f7dbcff227adc4f71578342e2d84814a1c949f6d51703ab19ba4460a1548b29a5b52b5214a1bed29e9cc43e8b0590aa3070424a755fbeff2c6ce21c722042d196d7192681845c6f898923b56e5f3a7370eaa6dde6d978e89f788d512a80fc498c33ff338ec7f0c3c600de2bb10c1afe00f096a9ae8df2b5e49cab7828c8b23e925e8b46f8ae63e024d51c5cce6b972e070373aad3419669fce258a3be7b3bbeee648a0c7caae41e311bdc63f25a49691a192ed222014d0071e3d7c64e3592feb0806efb75f5e4af2e6fed4d7d0bd43c4a7c60c815cd80ea50fcf42c7e4f1db51cf0abc3e13f4bf91a41a4fc3dc846fd52471628de83030a44e40e76462c6e3bc2cc3561cfc80134e7d03d955e9d64080cb8010b54d350db79d3f32b95068a570ea03232c72c60631d150f317724b11b487dc910d98e2cb9460ddd235a8dc716278e888689c0d5f78ab3b58c904794b17c4bb64d3d6f28dac34b8a9ee8a1dc6f6bfd1c2e413e4b24ccd3543f6eb8e1b962cf0657bead354f86f08fb83acf0f2d15cdb76cebfbe9efddee249045cc81f0360110d2c9c77265cacf1808e1c01c426620d8e9353ff01078bb31d4e49983b38764b57ede033442be57fe2e7eddbafccba9c67435feef3aa6476bb9f59c22a7186659791f24ea5aa27ff0350e301a756fec499d85eb9faf9d230b40f3982dce8192896f6fae40e80b9e7ea12c5f4d0a31070bfca4ab36898d33f2d5f351ce8cf7e17db47b09b29b6646db4334883c7dead3bc7d0ee01dcae538c3d49b1714f3c113d06102aef49d645173306c4f207ec6eac2475bc8fa26926eaab8daa466e6c34ab10668fa741b86b382e92b2214397f748cd625ba2b58e697d0180c69fda71d034cc0670d4abb988426bd872fd41b642ecbfb6be68dfa4f340707a6b6409871faa6e3067219f101d3cb77ddfff917e482730104661cceb733c1c8990e16b5508a890bb1f9e8d2487295eee1701bcac5abc493de597d5d9cba5cd5af580949919869f4f652c32fabbfa516fd7e11158d2757bcdf0f755df173d3f8a550f91664ee1fbfd1fe2e59ae2715ff9aeea4f6e5041aa73aea79be007519d9e80f3fc68f329869d7f478fe0119f2111f54df2cf7b560fb1b47165ffc114f5cbe2c2859c07c3564d638cf9c85c5b84afdc9e5adc2978b62752b13878a63ee99c68d6b79db08bcbe71bd7d43beac5e3096a2c6a472c0df4bce2087fe04ae6fc39eff4ea505292100fa2e449a20358a447dac2e932e04d7d18ffdbd3f64116e120f3aae0392e635702f6ab8282c7bedeee6904bc2880bd57531f848c8fa136e125585af4a7a7f206ae99a126a67330b01e99d67b16e0f0f06f556418d3eaebac9ecaf854ac4e450620e22a388b25ae4efdcae411eda11fb962a74e49e12de23e88b8e6e8c72121502ca28ab80ec0a5022692b0cc5062a8d2bf2cfc2be101cb922d31a3bb9f5171d85a0a03cc4c51d0a2ce10fea4c1355bb710ada6ec0f11b69a74187f2b1c63f9ba776ee670eedb92f052f1e90992332cd3d3da29b248ecc997d73887e3ff12e12feb5b1939f61c73c0709582ba97883728722837edd1db6f102788d29df604047d15a1852a5dd7fc7c74f30d392c0a8534255713cca7653257ce25fdeced943975bb6ba8593235be0f4f199d174f7843c720ccc6baf0215e17be990c8d2c9236224392020c2760c7d5610f539f02f2d083e892d69f78c18e755a0f356d6c90a8306674d83c32907c66a654183ed03d261ae20ddc26354f38aa3bdf0760380fc09bd7f12b225901dcc213c71318e05bbebd80f524cf5061ec623cf5bc895b4a6077976a7ddfb9c0cd3fa783259354b6a2d9f284552ed221b78d0b55e8eae65c02003e58fb60c50bff4d44d5bbf786a3f5cbd49c3cc914fc3c602d082d7557c3f7ab7ace38536e001bcf52eb0ef80154322b310e2ea795fe7333d0ba333dc1a7a853d0b9825e34ff5cc055917311b257cf36bf141a2decab2f2adcb50466bd0432e09ff47d854ff60e1443cc6d6dacc027bc112c705ab3b6d6c3de3ef5ce27d4d129fdb066237160be102dc61a8690c459a52b319c974404180caf42f8620ff20f9681d46a8953f4291f3de9ff279d00cb82789f9f3390a83d0f9d38050aec674c5c92bff62cf37d43b50905fbfac7db15ec9b8771850627e1f9e770c312d2138fe017e607b8c1642c6193e31f193b69ffac55c595da60862d4d14c2cfe9a6558b3398ed59bc10b4a1822dd6fb02884f6d44ccefd2acae2137921c5c0e61af9b6845095b45d27820b326e1306ee3ae43d05624e3e2bb39362187700f383b59c51594cb7ae9af7a6e004d2ae29e9ed089968a55efcaa2f352623448f5c54666a6b57111956291dcd7f5a4d181bca27e3145020dc777335c5250af53f8800e58796c059c6977c4f1b8cef9b12103cf9c39370af2ebd9ad11b66de9ec2d3451247e2f3f3002408fb776a822a58c313e8616d49869e70d2e7926ab78c4f2c95e286db19b74770a15064005f43ccac5d10198033f1a16ef1b73e2fd166acebec28a489847a9ec8537747b5c83997872a38527282e648560e37180d3acab42a72ecac8dc39a281f1c19b64c8c71eb8535c29c8f8b60a4aaad677de1e20a0f21a524e0bb3e1e91926c4021f3070eb5de9d98a8df57c41452f66e5ce73d7900307c01ee5e45201abbbf8f49bfeafe78720bb61856e7752389ff5d32b760488343be6f700a1c9e55fd535ec4584387630c08a2a48f89f1e7efab7c9de516fa1771def7e4dbac84f8db1de0015aafbd1f2d74e64e65fe58fc43a361506578af56139aefcae540f5ff015076b7336d5ef721d339c3edb3f54a0bac0f82e63cf9c1121397fb5abb17febc0e3c0acb838d464681e2ffd6d72819fba2d563207621ce08ee5421e74da75fed5eb0c36720ac7bf257418746f2b2c0c9be338ced8a733833fbeee05906259c4d26b6769ed477ba6133cee26d58d44738fbdaeb8df99a70d00195f6aa67023b00fa611d4d09cabe9af0010edd6aab27dc4e4815cdd63292e5edb1a572dbf1c307cc0127d6ae1a2edfd548dfbcf3360079f6cb5de7778ead94d8ea779f40a51468df59c9f68f9b642929d27db1b62b28faa2f28889ef015c1b547c2a7fa8b98ceff4c4e721b8d7caac45aec0866c1e62eda03a822517e99d42a6a679d36aea470b4ae2a2f97fef10c28943ea9861b09ba728bb660b6bbe5b2f052c88b744bf24caaae05561feb1a5735f213b9bd71892f0188050dd475e72c9740ae547d17dba345b4fafa7aa952bd9e0639a2d3566ee4e9ad19515d523d2e4f36d26ff1e7ef1b609eb3b126823314ba667be6d09e7c435b4d6e68e5a8f1345e55f2a71d50b8b8b105b87c9be2458431d77b36ccd6f89235c8512dbb2d57f8c59f560879332543b473d0d19165422d731c2350156be4658e3d17ab99a5e2816e0bfeb8868a7cb38627522e5d2d86b7307a41f3ad81341c03ca0d7e571b4dbebf47d47a90638207314b6b00686d4427b56330750f0121d400e9d590df382d206d0d812187260693fd726374ab708767b3ff731a9774e56647d00e850b4e31e47f422588d47691d26fae2c91a9cec647376c3061b1a41f12ad3ea960b18424e474d5462a6b43b3b083d7b8eb3cd3e3fb8ad176138ee32c53af44e90cf24ac6d1b3f3a0fc446c2b2d7211c2136b646c59ef7a8ac5a4faf92f201651879cab5905e6c5ad9b39ee8b357259ac5051ca342f48cb3b5f641e6cd4b740095645d8343e36752b1b57a0f6e303a6a7cf32fc24a3870bc0e3897e96712d82a1225701f8be67aac7299b091e2048947f23a93c985b761fb16454f89dd5cc893f1fa3aa7bd95015c9da68d57bcc35ea31bf25d69551683c6931093b2aadd0f37ed9acf6a408ed91f11101f562a2e2c5f16fdecc66dda489676775b1a2d62b09fe66ff297ccccf99f5aaf8488601f66f11b9cfdd0d91241fed97d3c0088963cfbe070f039e5fcac771780e6b2b245be54f17cfe37e425c0de47acc34e25519300a8afff1f835d63680fd56064190b99b6b0c723e7411d0b183ec38d0aae036bab9785586d3d50a0d062a3038681769da5820da23528c36df7f3c9a828fb0adb085adbe1892570135b9fcb61d795502f612507a641afe9b2b2b93310408eab6a1a581f107de5cf9998413d3c68d6243afa58f2dff4bbb6a97c5c6cfb5f9dc23aa7393ff18ceadaf4bbc3deb8791ab6744ce12d16f90fff60c7d88ad8a30b82042edb1fb6c6411d873e295d3e86ff5ccb94ca3ae8bd5f6b6f6baef56ff9d9f00356a9eaabc41f2f05d94fb7ec0f69329e3ec74e0900a2d326d76e99ea7707e1ce2b7c9e6a3f47ee0d8ab2d7f8cc651eb5cbaa2c6b617062a51b3ac075fadbea8b53d0b781e9091901c608a42fa6a2fb46fa13663a7273defe1808c6027a20202a7fecf228e09b6dc2cc97221bfd0ac131d90c33861c5b993c7248555c7a15c9d90fe9a3214a0d3d43efaf8cff196df2dd4d116b18330f422f44364c29c0198437378bdc402c079cf7f67027fa945b4782c2a06ec557cc466964d2bf2cf0ec14ebdfe615cfb1133491ccc415e202f1ab98e3c738ea119238f3ccc569ff46181e0b82c4db4e1d997566979b1005abebc940acb548ae12b96ad19af931e1cad7869c80dd8228e000126b3b93d629afb1aa9f487a25701d6ee99e4cf2f5b9f207f73e11763352830ec4e195996180fc56c5d84d0615352894cf5b67f2b1e91974da5e501a8b09f090edde5e77c5366c947b3a2746ce229b5754f6427e403fcb271e487fccf3d74e0fe67009ce4d32c4fc1808882f1d4b65436887c30ac2a06f8c8c8f48d1dc75e1446f6e02f13305f0ac1c859912dab3370f14e7959902351550bd14b3d5b84eacd3998c630db20e49958f0d8366044fc900284d5e8db58504fbd6975535a2ee1ead79b6cc88bc6831f661b1fee9d97dcd7f598338c12befa546a75c7bc86c784b367da4df13f70a59c5bf9933e95654b7701b41963d33993a9e0f46e7281411e4e7a3b97906fca7bb82652c94025930124c911c6dd1333e8f7340448aa6fbaa75ba9380a049b41bb86262d4921453133dcce9bd98da9878ff74c6a6ae2b40dd06c1d8a963ad52aef1b26f73e9c57fd52286f2bc6ce8df8781d3c4c68912a05deaf4ef510089374b5a3ea63672190ae97c9a0c79dbd339b36ca5abfece9fbcffc1a6564735f8e5b7ea9ee50b7aa3feee252816e206a7ce1ba545a90f74a20711c831a4554a7c53288733fecbbbf9f48d272d6b65926e6491c7204b34f76048735d6256dc1a9ed16a62193ef707a785456133801b11691fdd576103235c6ba2978ab05ae19878ccadc36f9574c97ce3a5bc3aab4ed3070dbb7ebfae002d7ea4c48794deab0502b6dbe03c1a49ee52728fd3ec92389993e7464e8d8040e60b211d75bcec5adb4a19ca20af1f2232c652fc25159e12e858f3d07f08910093953401a8f70c11236df7992bc2e113e51b20b22a2296639fa6133b6015f802d66852bb2b4b698f1e8a81a76e67687d0b8508a371a3cfb18254265d57413dd9aaae3742eaa265f3456bf9dbdfb08fdf6b477a6a10fdad90e7a3355697aec35bf22a8f84b655ed7fb307d0489142c045faaa914e81c608e59c6f88b82749d9567c46aca74b4e1978b741a44795d277cf7243127e1597f2e5a3ae676b42c162909e2acf12f010fb756d886355f41a24888a64d5dd10af3515f3001e6911908bc84e293c988afbdabb7d440a2ec3de96ec06b56b4b9701e95e5ca10b6589c2733c81269da2cfc17b3d47fa89dd30503200099ee675147c9e6f97da5e3a7856a4decc4b8c165c4ef804f41c533835ac27e46741496675a2431086b71971f0d40370dbbb119242adaf4e729ddf8d1e04b69a669486aff6a0ee039a66c9961c66e0d6d5f78f3a1fff5432c41265936aea1995776862f892861c937f5904d376a339dbf99a02cc9cff84c27f206c5afe488c953a574c797e99f22b5c917e5fd1a90f3c17a4868d0688696a13dc911ff02f1ad4b6203e9d92f77bbe78470dca7c72009d61b3df1e7871b60921a0d54a6ebcaa148260672a3aedff2f9764f8197d9a0b6c934cceb6820a41476eb1b6a9110af53bb182dbf95046145f6bdf102b1cfa86a5afa8b08e603fc927f0460fa9563545c88d7ca5916dfdb5c9b6c767d520679e66bf673ec64502185615b13d9a131fa4651e5c8b40eaa278c771c4fef3acc35ef76d167f79eb68279911984ac9da9e54eb431dd2340ca6c72e04c2da65412db02aaa3246250c507eb8ff42c1d25b629f9340317ce8b71eee0aa0c015b2b905cfa739bcb9db63c6779cbf2a576a132b4028bf070686f89adfaa5ca91fade9b6f6b4df65a63848c502d2d24b94201e4713ecd2aafce1b7eb28ae4f96ab46476eefc5392d6ba2fe7220eb3458363b121c138d122a188c3dc60454f7ef6fbe7479cf56d1a20347d7960a7330ee392fbb02e0d5b59f7881035d8439568b8f438c0d91f38b1467eb4194f28f7a1558882f831aa7bf0679b0059c10180c66abaff9d238887a05ff23493cb18235efb163adc0a06a2c8099bbda391161ad30f52ab2c7627ab44e1ec88fcbfa08277e4418a7a2286601e56877d6269595c4885c64ea809e9c121caa5532d4aaeadb9e9e6651be49f25470bb0dee83448cd59ad75f4cdcdf2d6c3346d6065ca27b286622eb28fee3ce4399894dfbd1846725fad67fa2b818870e0aad72f9499e1fc776431e6fa6a6858f5c6f1f0b56126e8f912a126053d445f27429a596842da82b1c3b8308ffab9ca5d5c88a2d39b0f44968b0ab67222c6b93f8cafda69183c62918e96bd5d949173c140d1f7d0d256ab50c9fcdc61c725a4a1e1f4639c8363ea53abc87a8b8696a1b8dfd51814f19a6bbc18f5c567ee8d89e0a85879c50fc1ac149cba1e9453d5d262d272c3a76a0e254872e1f54e8fa6da6c8d2220605305dc398214609f1e31edd55c8185c46fc00880f28beba2b50b042b26b20d8fd7f26fd662142b0440addcbd3a64e6ee99bb583676f96927d779481a0647ae6a8cc059d35daea794868326bdb485de1940b2a0c5b90489666a5ad85e2a4c336c730d0cc6280111fd237f90c67e4f6815889ffd803bd9cce441ac59e2aadd6e546f9ac17507798d056b2a421d381866b954c30d33a932a629b67e2745913efa188f9bbce163bb69ed44d12c9167c406883793d6e073e31f74637aa4a17c5c1e67bc663294b8f573ebade9b593b1f720c74cc001f07f29d1168caf61ed84f913f70cfa5c6ebbade99e2d4a5a9b2a872a1b1fc75c65337ddb01ea09c027bb0ab8c5bb00cfe363edbbcaaccd3b997cf926dd2ccdc64d98cdaa4389d8e3c46a789810929302c1e8d10c233932e1144928018bde47eaef06a82746533c7a4b9f1b8253c9bdc89e63f7feb3bc7ccc9aee795df2fafc139fc21ea9013ba3a3c248747fa68bb7210b8557073f3fd7cfbcb3a57eab551aead27af9f716c1d528efcf4723c5755ddd767ba5543f9a7b1c112d10174ee53670c3efa51b94b73a0922dd298c2ae4bc7585bafc8404413f0042165cdf82fc68e9466646ef85d2a9b52bf523fe8094b7dd275c84288aa10f6fe14c5dd5f3e8b2e30e2f182083b5a1f4b0072bb58e0004fb9868578a1e1fcb8be370bfec6c5b2d0318eef1e9bb50ab89fd834ab0e625af5527a5e6f82f8a3a405eff949692ed2338cb902ca715293b77dadec10b53bf024f432daa9e080dd7f2810c25b850e8c2e0b405d1375275fa5e832390fdc7373e6977f682b358897fdf88ccd4f323356b80cc556eba9346d54c0472b377c06d453348058467141f388a523f6ee723496005e37bbb98d321df49a1884bc3561c19198cc35f2ff429ea6efe3161f569f92e1da035ff641f28c04a0a8052136df82f8b0447529ae3e27f8a58912e545514146409666760f5425a3225a4c26c143794808a9cba3f10821c3a9a6a419e06c57f5a6dff47370620808ab3cfdb8f2aeaa4c2eeb90405d1ac832bcc1a55bbffa814c3471d27765a5ed6edb3566edd96e20e6f108402df41b49faf48b75484ce9d37936b2f26672e80731901740049f18de88bd5eb2f58dc4afdd7a8f9198992edbed64c2602373c57e2c06bfddc03177ac292e562cbab5e054acd21318a4a10a4805330476c9099e3d7660d79a3b2b8be3c14d05fe246eb1c9964761289d097f71472a6beaa0127023697956632f8ba77250559a15ce9e7f270e6eb1edb62586cfc31cd4fcbed345891201cb9f2834761f84bd88f6ab147e6b3f1ff90139f9c6c4fcca9dca67f6f4474b102eb1d4765f13ddda3746d54e44bdd32806a9a8a179baf0f8d75593777e79ad9eb9a370db4ce21cf5fc496d6e521ddd7f2e86d2fce6bcd92f1dd8028592154f1a8734fedac7795d4c039d5ebd66d4ac8475a137ed935f20c7fad6ec11db1f86058949a36165489f84d9cda1b1bc1d4e247187d32e953e61716bb585c1d0454f7b965292fae8b22536dd70cab60356d1dbd744f7011c840ea57f5b80a17340138bbef39b38a34631fcb4ae8d262656ab1557b3d74e09da980adc68b54c5eb56ba9716374b1522367425691f578ca5d4cfdf22220b7694610d9eff4fad493158fdef22d1c936252b49153004e8c5ae8b53fc55dfc7aee6769d559dc6d0a439d4d709b116e3abb4ead94bc8cda7b0bd12c0a96a151ff242377453f06983beb82d144028101cfc7cb7b12abe9a1ce9de7f714f1c7c24357c98d11145b5a768f01b6e6f2bfa3da6a825728ec4d1186fb56378be287c83bb728ac1f2e844241a0d5cc98b9aab6996b7ecc14b7b499624b294b767111b76681e3bd0002113c7e3206caed1bbaadf9f536c32c97ba20607bd2711ce7fad2a83149529b060620ac3c8be317fcc60c721d23665f16c9e7eb87b8e591da318ca5d60a8cd6c7acc1d3c2d7a06e4483f0186f62e2ba305649189c5e53605892ca44ea79e249bc821f3e82e1c1583e7aadb19f0c574c2e138adaa6efbd425980613fbab36ff49733b6179e15246bc89971830913c0c225e6fd33bab45f351768e60d9016b5dbe6c9f4cce77d160878dc2a27e19edca99840bc821a66df08234e37b482e1cae6644af512098d2495c11ecb228a57c43ec86768f732eaa843d810a0faa286e1fbe63bdc46bf9e852e349d15c0a170c8fffabd3dc7839f6a8190b7184ec66bf453b4eb894885d61e9e21438073e1729f784790935607c7cfded186c2a6b134916d591421f72aef18288cd68f97f0998c659a81d73526766309ac0300415da7b642dfe8ba7e3c9c37af67b4893f119f69985e1e16f4bfc24a1dbb04462575658584d7a752252839e0787f818f41901f5080e1d52f35e165003d5c0f8281cca9a45dc44769f5665d33df75ff7ed753aecec1308e456ddfee4dfb559bb6fb36cfa647b5777228cee24821962f8350ed090a538f12a50724188e273c645315f4da6267f040104edf9029bbb4da1884407f8437f5d1665d870885f1bfcc6b28d3f367465ef32dae8fdb43ffbdeaee77e4193482563fcd3d841e2003850e5a4adfab4a1dab93d42a9d707cc91f5b78382bd068555baee3664a461831989b94c420c1bfc0b53e8e4a1b26a67764ff9d721bd676265bfd2d76548d3ee2aff5fa8c6f28673111195dd8108568c5baeb5928123cc3c1b07c07cfdfb5d1b71a90bc96b083b75ada40678238949c508ba6ce3af28e601b3ff5c087f63876b575fd2eb7323053775f5487a6dabf336946eda37230d3afe6a75e16af37a9193bf5ed51d5efbe577c4527d4cf0d0b8fa8a5f15c3a0c86b2984c2fa556522afdc5cf3989be38b3f1489a775cc80126f4d1a8441834285954db30d2035e886940aa2254c6a7fa3587c874574b47e8979ae0986eb3088e01a1a670b2d7b5f7f042960fea80d5a4b7db00cdcb715765d11897aac6584687657e883a35e36f6bb2e461ef2ffbb4694e11a41c08e8059b623f10c48f63c62fb5a371680dbcbaefc2f43d32e52de3db301729a1b604cf905eaf28e369efd2b04c8a6bb11d60be37de8897e2fd350db4d073e1e0ecdc8d430eadbcce1c2f9483546647d3dbd75abeb905506182853505c63ed3e3fc8bb6c544a55ec2358f987e91434db7b3b17e514d2f48f7319c7ef30eff72cab9a0852645eadbe45f34bd141f5de7b6dd367854ba7fd6658e0ab2ee66dd20f2bbf921f3cc5a0563ec062df41b6c9a4aadd81c262a9683ed1f5beed2cb04acb8ed18581103daeee290630e04d67226f6ac86d5c680cd7cf4c79256d383aad62adb72a01eec6d9f098d5ce17185b645b64c52293358623fcb8c77479dceacd1f35821b2e43b825223eadade6c6fb97aa9226edb450e9c188133f2b5ab21b3600f488f34a18db510c4fb0c894345fc280833c53bb2bcc559bc70effc2b5eca18b6d2a609fba4f8f44f77c93b8ef7d642011a633d790ec454d67642a944ad1d2aa5e96bc51819452dbfd7177f3dd9e1579be6ac226caa88435614d0c29b519def4c5f36f85425bdaf8dbf6e858cd02aca16c6c9d82a0f18c5090080164047f2e975e9ffeac708d3a2b8be97695b2736897676ed49b9dfda9c890da00b0cb6da8a832264cdb48d8779e719246a6a830fd4033094135fd6b9e636240a4e0349526f4536b5bd4b736cdfcd46a88de2344fa8db7a39fceb5b724a9376f7e51aa417f1a10baf63cf530a4e759c4be80b251ee82cb392bbd7183039d952a0d4d1ed64f506d9efe23b37f970187481518b39553343e89b89c2f6dcce66804b8d45e1d55ec1dc36cc679e462ef0170344a83a53bc23044a873d608da8320ac65e235db368ec238efc73a0203508252577fec225b42f66ed7935d065051184cc0371494b774893d57f30bcfbd03c7ab000091123fb60fa23dc7977917000d8e9ddab549cbf957485e17c342807ad67edd3919d1d5c4c847c8eb7c6fb1b6b756bbcaac63bd1cdc9f8d96cc9f91fdca6af5f66e6ddb2355d6387d4229529bedffda6fe0a77c0907cdfcf445c8c720eff421ee021081d34d0b73b54b3d84781a1ada9dc628a4b59f6253f1a3cff7e82c31014abdfb9015711302df5363c688e3232679cfe23c0b273f68c0e161f6548b405e8177ccef5ee92b215d98cc128ec7997bc8f7197c143accb3c720c1f4ed2e331130e4a70df1d89d4ac6bfc50c642cc8cc1b05040cae31594015470b104163e85a9f519ec28427b47a3a8a0b92dac1276436acbb54bac573e9b83af6955baa5e254871e2e681ac5f42219834da9a5411d59f497c6df3a89b46399e8060121f44b73ac189060dcfdc7e66f426462aeb94eb0d7a16135d140ece4e04fab9f317cd83c2da92777bb26d75957c8d170caff2d1572dee417551be25c2b0446cb6bbccead36a25e3a2f523bc9b6fe3537b3fe0aa0918ff2e90d41ab5d8203c9701bc04cc8b426fbb2b25601df442b472e6b5d3c2dde368e1329c36b3915b82af2137dbe48a5ab8cf13af4b255dbd31ea11473575a63c08ff3d36ed69a0982b7e2faf71b27cc091d7944b25c30144c6f1e98e0ff646ca67f3c1eab89ff4d3cfbdcf15e475bdc50b64f802fd83ffc56f99177e399c256d93b6fe616073e922ccea2b52b84eb6e9ed064f7acaa2bf7fec7dd2bee3d796bc0744082041a06cf8f1e45dd44b8bfc02b1a584fd52817f2c16f6d26828f8fe32f5863cd938c5d2c7cab425f6c614225dbc671e97634e210c017fa39c3f630c22a6c1ac6673903e55c2f09c09aad4dabb76072ce6ae8beaf03e48c627465dda54afd436d47f007c5b1c7b52cf55830d6a3dbcd561bac52be9e131182f46854ba40f55c86c7935413f3c9ebaed553f9b9fafb964f0c5a03ee454b8a21bcef78881b1dcd9e4f0944f5e0dee6770f7d32e058739d6a63eb6e264ada03dc9a30d0b1db52bb8d96dc1f7c6265fd93ec0da79c5898fbf9ebb3dc1bb2ffe8ad5eb8ab90e70f448d5fe3fad48c56d1bfcd93dd5b11f413eaeb15c0056ce58e6652cffa6da783774a82e27db165d9d836346f72747d8c8d85f9487e22f9fdd22afb05e33f35a5cf7168954bcfb11617d30de40fa8ad3c2f8f52d1728c2fcf55f6d1ebbd74086b553b14dd513b6350e3a768b8678ca52b18189a5b85564134db150477a016b7824e73e59449451b33fddc3fca5183dc7d9a198d69544c402d09a96e837c02247e4a6130d6eed2a9f2b30c3f738c35d70c85248c3b057359ed5ea1cd52b3d75eb9d54174e6a28ee2c6111a86baa9775f96a245abd0122b84590b748d11e36778668804478853cc95a6b177be3e89ad0d4dd55cf07353cb8977d3bd98060e117840d167f0db84d406970401cb2938b18074c16b36f9fd560d2658a28f3aee83ffb01f39fd96972dbcddd32018d34891143f8288664e979993eba480034fdab02115f30ad476c5814c52236c0351dce3f0dadbe16ad102d558e58e46f4de316d601f1eb8559fd6e7fa0da2edaa56f5a01fe1666e4700cbc5dc1ef9f7674f1fa53a82de533f9084a762ef55562b17634c10f12f1430c0c7be8aa9798546cd20c5eff8408a3cb350afaddd7ee636cd8ec151e393db773f5bbd9e176a34373d86ef942dd0d79b9e271371ed04fc6bee281bbcbc2cb0964bfde1e396a4c18625e8e24c29951cbdc14718e6d5109b0c08565d7735b9bca70a223539dda13c5e09eedc6ac0cfbf99a4807070785cf8dcebbab95d7a05ef72583571f7cf3444111c2d7cf6631862d9975944aad75d7121705fae35559fcc29c10be0ef7945100115b9f3c54195f6ba9878e79c64132a7fe77767413faf8cbbecf2ff69e85ec340b5692343cbd35c12b18aabc308b5d49214f95c8abe9237658b6f43919438f0789c7154d639c21103181eb034aea16574d9b6b961ebaa798d75ac2904f37e5a683dbb687f10e0818620bbadd332c64b26e0a1f4c6f64cfe00b35e9c5c8265032b1bb6ba5b13d924d0d200a10249cf5b69919d56f2f8ee7d0400c4ebf7153181646511f2519b3bca740aec21d724ced7aa4b820ab901cdfea9c89112d9e50021c63c6707ad027f5ca0be19cb4de574ebbafd938b3e9570d8be400d97da0ee86ba610153c7075ffa8b175ef3946454d98d904b82ce7ca96ff4cbac78721ac8c31f05fbb8e42c55b32556888450385e3540e73d58af2f6078582f2e941d213a237de856139ef5954f8af94fa85a9ece6f4b649d63fb0284a9c4fd576ad72a86371c8e8b2f43c27ce93027d0c7593926a6d69e87ea5795b61888c1aa80f605d1ba68fb1af27697f8a409f800b9405fc44a2b70c283d640d237b73b444da8326e7171c2f699e87c63a02d79cc10e62da48ed2f97597ab3c57c2944b11186e1df36974cc03a7c87606755b499406d36a35de4966e5a983e8cf04168af815d21fe1af84864fdbc6fc0b1a881b7f266d8cf96c7b67bd124bb3c785236d119466f2ff51edef931037f4fda1951cc8518579c4fd97d9e6e43c8848d5ec133e47a9aa5bc6f49295e63884fcb22e77fc54e4941241b888a31aa59e107b714f37d474deb8b9a62bd3a6e3867e6b8a972ffcbdd03d0c48345a50b025da83de2dd8136643c674915030edcdde1db0742a3f69d8dcbe5f87362de6cad7bb3b395799a1c98d7ab4b909d19699256f2e028fa054ce49aa8645a150c2dcf0ebbabd87f87c14285b7475ea9fb1a2b772092d94e4a2332122b14c958c48dc2d147d4f797e5cbb1ade04c953f37555803900b7091ad9c274db66dba1ad056534beb09ff8030ec81d88848d7089d787aaaf897a74f9f91692557e5b306cbc359b986356bdfe5682a624c554dc42f3e521c76711beaa01733ba252670a55910720d4e62e0d294f49c7a5be941ab31619b07f28784a8196105c38585c29fbdfdf32b29c9dff18edb10cd5d176199bbec3d9c4b2eb6a5ee2867b255ad92ba3774d2356ce55e4ffee3c5cf8fceed59dda03fa9cda4bd1fc8f7005e2d9b67b2b729af552856a2d69a43380d8e3582bf5a0844ad15b75115a79b3c343c898164ca54480b7c4111b33949585bd30e2e660344012ad27a9e85fdf6ce509e07ea1ad1d81816db8e485d029101155c57641e2839a65c77e5eb43ccd16f81f626bd74c084bacde9e7716266b39a463ab4a1f2055fbdc00c20ea10db76139a5b90e106bfa4a51f41d475c303d094b6aa0303775b834388fee4d6677e18deecb5eaf8c3d591d3cb4c956ae34c7c60fe071f5d3f19cab9a59dd9423c6e88af1fa1223501da07cc214b18724ec1c587951ba0b1dc970bda7dc0ef804fdefebadee0965e023312ab274d01ff551753dc0b7afc85e10b68a9f56428cc2267fab541213b3fbf509cab4daefa4c984e8b1480724e2e399e42086c67fecda7789d5c380e0f257e6e475c63c832aa4b17c31f83ba5d7ca5db9fdc57d4dbc9e8affaad3b65d1b3c4bf0b75df9f602ac32d1ea696219afb6952a294f4b540cce84a33242e065c609afa4e97d83aed8fbc70e410bb4ac1e64656c713f72378bfbae088c13d3e8e1fadbd2f5cfa1718d26c9376cb66449aecd642d476cdd411ab79511ea6608cfc1686b83d4ea4a0f8f197a759b62753860ab0c47b8caa719338d29ee89c6953ed4beebf5685b8b2ba9eb59fcefa66329670c5fe2ca4435c41b5ec4bddd9a69aa5727f8c7026cc337e7f5ea2b85d3e6eadf65d1da59921e9601684cbd6db98176793a8a778e4f97171b0a271463c772de46a0436964b32a57a00ff7e9b78ca13c743767b460bedf3a1d701196e2a87424a7fcdfaf115afcf9476b7992addc11bf5dd4485153818ddfe711c3fc14fb30aa9336100044e5a37d30d6d246459a6c6c38a28b0ee36c5f4ded811a115f23d4853e71cfbc48617fc8d469baeafc65234b2284f93d2a41953de6549f9c41b571867bbb6ff418332d3cbcc109f85d59203bc4d222a70ef70373f65e9cf0780289af7a3d8d168265f3864c5d2e933bacfa2424be11948b89596109584ca6e8ee0144c3d99a82cfab8846844f118601ab906b0b44730d79c9169db3822060b3fe635b51c060ba336c774dd1a5612319c004cd5a626743a468607a7cce9fd29ece8b85e868444b17ce733e80d2eae2e43585ed707a50ce1b2a2173dceff5f35b4dfeb79a69e18ae83d3f8445f0dd7f896096bd7e10383a59f95db4cd85ed6e54ca1cf899e13cd8fcf8d894fdde52f8598fb1581db8f2da9bd57d644127db11aec8803135259c6cad21a3a8cb51b86f5832f74d2d7da4c00ad6e04975e7986d4d7f5182ad6ac51225ea5bf595012f4da7a714ff27a654cbc5614843c848aaa8d1e71be240742e0225408d964430303d332924cf588f4c0bfb75f32c2907095476f00465ce5377a0864ea08f2916a2194b915e61d9829ba0af574d7d8d4fc61be6557c49d9b1893796a674dcd4a2d0ab1540da21721f9ba2889d40d11d15a03f47fb9b4758fb5d396fc3ef09dd2eb17340651bbd4d4d302171b64a5d134a14c2f5761d69baf6e087645f1569ae3c9430bd62569a771c3c9d386357852630d14d59bccaae73e88e79fd335da885dbc26e317a560e886b46237a9bf974c90f17e8d1a3193eb8f6a8a4085fe6afcfc6625155f230cf95e28b02b2aa25a07dd2b9402a7e11a026050b95f200b7f559706d39de6ea5c6a3290939e06c2dca3293634d1380cbea8776653dcd705517ec2d729f81f6402d57a065a801fad2f4c318f858e12657835c6477ac3168ca4094abd3e684a49eecb3f72361e2950d32c7279a81d3d6a36479bb03f1ac6bfca0e129b096f3fc11b1a31322a3603bdbcf5f25ef6983aabfde61dbbfb31aebf6a6438c0de64b0fb58146993c8339ed1575816a6db7850ad758ee3d1b493442e12deb80ae936380c081a69dfbe7b86cbb28d5c225733e9c7e7674418cc7696f6bc482688210a51cea3c76ba11c21c21d75191c1f92f2834c1a9f9c6d1be9ad98508e7b4876621c126d0a3b9432e15f6aef3241bebfc3cb8f2dab4b96f97a61ee2e7312845d3614d817793f6c40190d7b17ef2b7bfc8ce665fc927dfd178722fa98d37e58d5c3ea763893f1f46390b9e412bb7b986e6f26e6b4998a7b7252bee2a919d92a4f63bcbccf52f7a4236cac4964dce74ba8572e8481de412bb53a0ec1667d3f64526bce5b1d39b5a49449f20a6d274d55e60b0c722a8c3606a1aed9a73738d634bd51a4b4be81283351fabfe38d8bc07b96495b56be9c69adf49958224936770455c97be2e895476df55af2d69e308a5b1f898d2d60896055b8f95f99cda6c961be77245025b3aae7411644fea5d5ed7c0f9fb6a9d48af4287b4be060236cee349ec67d4e94f6da473e30d4d406d95c62c1e7814aafe12b62e4ebfa9b4421b156a67e6743bb98d4bd17da6eec1e5a6591e5b6215675d6704257ca0cd1f71717e12fb61f365c8309df3e3e7646cf2ca5bf8fbb0e602e769c5510b11bbf114744ee38b80e0200a059a64daa7b699ea04851f976a7ac131cc0e2da1375524def3476375b4c4fc0e8e9e114f8873394b2ae418d4bff3bb202b523d2b7c897bbbac4f2af74dd5887ca6f5bfdc6a379332dd8f0a6a3b5792c1f1921642c1498dc23802f39f4e43e8f51f3415daa93f1985ad00c9e8768cad571d2016f57b05337882a38ad9f4470d205b1eb895de995fe90369bf0b6c0d73c5923465938cf6750d0a46ef63875d8eb0958c48459bae7ed3d0e6f1a4ff0c876e86f23f199e98d6fc6810cc76de5161e8c5d2e502ef34cdae2115a05ce7760248fbf9d29f89d80de97a7c4ce37d6999ed4c65057c55aa5b6295e0897474a4abd86b58a630b5519e24a96a9c36481adf71ef824507f25f9c01a6e39074e0f00dafdb7da29b02548c129eed0f20b79b112a64e73ea9f6beecbfbdac88cac419f91c685e36f599e7419d1b68ee540daf765f2281a336d8d5994334420ccf21ac60cde19a49d0df073a40445ecdd194aecde7a0c42d2d896a031477712bf49b2967b5d1a24f133bb7553be28f71887bbc6f8b5359c45887ca6a95b586a04bae80994c31d39264e90306f73714ccddc98ab09f33d46be27789f44508d7a4e0294ddb7a972022adef1feb4bbf80b6acb41388b29f99d86196551e89be73d3fda6fbd1cca14dcc0044a97c9e1430600238a4ed27cb144440da1d6273ec8750b8d8035c7924a123c47777a396502a8ab6b7b98c93fe28a08d8377a606e099c8ad9f42dcac63554b356a129a9e9573fcfb207b27baa436c6d4ddb4f8580d914a1263461e304db5e0815f7dd9b755db529032597b77050aa6c653afe3f7d7eac9e3df2d52b926639aa3f51d8cd5471da36ecf408bd859ce900e439901bd20c3c1bf000f6e62cd234e5fa295118a5b5f55100702fdafd43a7398894f4a3dd4f74889d27294143d5f3609d97ac3323c6f3d6ecbe990dcb5d975358f54153f286e78c8cfbc76cf3e2540614252d267ac9327d13fde8abc4b282014be61a11450aa26626c478ccab01c380f39cea9dc5d67501ab68b06bdcd6440d7ece6f784539530afbb27edb7b1a83bf6576ec304ad3538edd4a02e1fe9ff821eda6d9c8f6eb4ebad0d80fc45576ab4426f0b390ce9fb42312c23430d040d85efa8cde8e1a3c47a082d33cbea897edf90b00820032156816c8cc1218b9cbc41108f910a9a072afb6d94c20b5daa083a8c6f1e49570a82b779b06e91e01eeec67ad5fcc586401c91030a8300014a92973e2b4653816cfd1866ebe6a07b7b9050176f3f0fd7deb7094b96dca67a7fab85f80275b5616414ba3d11bed295420cb62860d5a01fe557eba85cab0dfbdd4ed1d7f30cdc0540690d7bfc99ff1e5915e91fd99a5b94d2d26eaabe72c2e727cb88748e83899ee6f2f6efac8eb7d66b7578fa17671b4b70ebdf40a36ec697ece2a6d2b170bd083c0efd515b81acdf56c750064571d635ad50165f1e98519b12655820ef9393b33d71e037d8ae46f6e9ac84b732b21008111b16796ea62181f264aaa19c362b426516c97bbdbbf0b0da0e47f805847067261b62d7d699124645c6a6a983565815e6de4fbc31263380b6dc811fa9d4c1ed15690b2dc7c1afa5a4a810ee69bb8759c898287630273ba24ee35f314790e09d865d2e82dcacb1ed2ef7614e2bd9aaaf2c7b1fd1cac6b3b56058d33a13e5d998b5cec54b5968271a32ce79f80118678f2978011bbaa86de2c5579e966ae17c6dd435279303fcb2d1cfdffafded27c921d1feea042f83e96f01bff7fc98215044eff87f28e65559c9b030a0676eac25552b5961084f162e8bb638d52c81b091ddbdaaf684c6f1cce30ff4c8c60f55148aed8bc5894c22114a2f37c483bd9d9eb809a483f918cd901f9c48251f8dcb19f35d61bf1105ec96e66f22601575a5abeedfd08dc5ec6669790c3b47e557d391adfb259ee0c86566ea1c4a93ad18003cb35a752e91df73a688cd65b92b754071ce3f6328f76c6d6f455eae1c4cd80e2b05cc183e1dadcd83deab48dcf62d191e0f69e1ea30f050b80640b70c4fd455fbd6649d36f54adb32a85ed69d81552ddf2e2878f85120b57279c645236986f1affba9e034017145436f7519e5681fa5b9940890979fb54be43bbf9e849d75e8ea25ed50446ff61641017ef0810d40603e6626a836deb77d0b23929e849d75e8ea25ed50446ff61641017ef0810d40603e6626a836deb77d0b23923edab1ff7eb6bf33f108e9ac1a08eb16c954b88a844e3119adf5950b44014eb611cb6f5cf19bc18ac0560bff08c21e5a715d9e488ed7b90715ddbb518fd57060e234489f88176e66bd858291d9de7054c6bdcedbb9f19ebedfab02d238b3dad79ac6a853e324ff7c5e92f5e9bbbfcda63466ec3e8a17fd9b3247f183465e93ca372fd5afc77f0d7f38658bb86153e8c7472376a5d735412237aea47881eb714ad1ffba188101427d74509d8786310f1e0793a251f31819283664626cbb6286bcdd109bc3de5bef59a8492c6f849e7cf1c2a665d6b5844e749d36a714fc4eb8f652fe79b889ef808d2d515a143bd50327674d18780056158238e627e37eaf784b4505976a7c3561f4c11d3d6507b4c18b802110be70e1266ecd65aa25fca9510137f5d6822f4308c7525d307bc5aa18c4a8cd6450e22a5d3ff8ec4fd0e0db96029b188fe909be6889a961ab6d53b11520bc8ef965b7387b554bd7c482b02b0f4f80d00110a008aff7aed1c6d66dfb2edfa2605d155c2d97a1c2877fd1bf4d770e6708988dc83ba66d6a40a20293dfee564ed40c41d5e541c2997e512019841b0b19fb878199014dea84874d11e319609135d4251944a93718a1549871f86355fe0d12397a1e4e4db62d46514798e653a11b107fa6d6cbd7c1d4a8795f849809cbf723c6b3654d1ff2ac20fe4e91db0ffb8387d06864cabae9e45d13b197ef3dcccc6b0296da09999c1156c66710e48fad121d7a7eb3f20a9281c83c7715e7f759dd2b11d8da24b078973a81d23f56a3cd370391c47ad7ea923f5233254b2c62a41ea39a3c45f364074338dbc792fc2c11e46cd8506f84eec2d00b8b7cd076d84a54a4e74dfb2af63dad0b61ff21f4f95994201c284fe8f586948c544ff57e966e81d01c4e3d56cb060111b09771b67ad0ce7c76f75907623f84b05a05d45611f5bc55eab02c151e601843afc2885ab9824b294c7d32e6352066793e8ccf6663071d70e16fed8696139a12f8dc737261cc47235f1f6043d92c85ee5f87b03e8429e9657bb9f64a21db6c7e0cca7c1f3ff6a65af73bbecb35b1a93de7ddc539df9a5eb5dc9143c8d61b9b80d5cf522b829938f539a301cd22e79e52f6213df15534953e17076aff00521a5402e73915fd843905ff5a92e6db5564e3ddd38febf2dc5e8b6c7840d556c9d7eed953dea0cf43b01fecc45edfa2a8e9b2cfb89d9914c4b70c4fd455fbd6649d36f54adb32a85ed69d81552ddf2e2878f85120b57279c6e7c423abe1e9634d96700d7f81f819054be5d0517297a93f66600582fe3e512e@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootselinux-policy-3.13.1-229.el7_6.9.src.rpmselinux-policy-devel       /bin/sh/usr/bin/makecheckpolicym4policycoreutils-develrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PartialHardlinkSets)rpmlib(PayloadFilesHavePrefix)selinux-policyrpmlib(PayloadIsXz)2.5-82.5-243.0.4-14.6.0-14.0.4-14.0-13.13.1-229.el7_6.95.2-14.11.3\@n@\aT6xT6xT@S@SSDSg}@SB@S>S;S:@S9XS5d@S4S2@S0@S,)S*@S)S)S&S&S"@S!S L@SSS@SSc@SSnS @S SK@RRR@RRJ@Ra@RRR&R&RRR=RʚRR@R@R@Rv@Rv@R@RR@R R@R@R|@Rz/@Rz/@RsRpRnQRi RfhR_@R_@R[R[RSRNRNRL RIgRB@RB@R:@R1R-@R-@R(r@R' R%@R7RRNRR@Q@QQdQQ@QQޞ@Q@QکQکQ@QzQQ4Q@@Q@QKQQ@Q@Q@Q@QQ@QQQQ@Q@QQQ@Qzl@Qw@QvwQo@Qo@QnQm=@QkQfQb@Q`@Q^QZ@QQQIQGQ@j@Q9Q8@Q4Q0@Q-@Q& @Q$QQ@QQ@Q @Qh@QsPP@P@PP@P[PP!@P8@PO@P @Pf@PPqP @PP7@P@PPPYP@P@PPPM@PPd@P@PoP{@P{@P@PP5@P@P~P}L@Px@PvPvPuc@Puc@Pr@Pmz@Pmz@Pmz@Pj@Pd?Pd?Pb@PaPaP[@PXb@PWPS@PQPO'PM@PIP@@P>@P8@P7lP2&P2&P,P,P*=P(@P#@P#@P!@P!@P@PkPw@Pw@PP

@NNU@NNl@N@N@NåN@NNNN@NNN@N@NGNGNGN@N@NNS@NS@N^N^N @N @NNj@Nj@NN$@NN@N/N@N@NFNFN@NNN@N@N@N]Ni@Ni@Ni@N|tNyNx@Ns:@NoENoENiNf @N^"@N\N[@NTNS@NS@NC@NBrN:N98@N7N6@N2N.@N*N)f@N(N%qN$ @N@N7@N e@NpNpM@M@Md@Md@MM{@M@M۝M@M@M‘@M@M@M@My@My@M3@M@M@MMM@MMMMTMx@Mx@Mv@MlMbSM[@MRMQ0@MQ0@MJMGMGMA^@M>@M9u@M6@M5M4/@M4/@M0:M,F@M$]@M@M9MMMMM\@M M M@L!L!L@LL@L@L@LOLOL[@L@L@Lr@L L,@L,@Lډ@L7LLLNL@LΫLeL|L@LB@LB@LB@L@LMLL@LdLL{L*@L@L5LLA@LLLL@LcL@L@L@LzL)@L|L|L|L{@LvW@LvW@Ls@Ls@LrbLrbLmLk@LjyLe3Lc@La?@LZLYV@LXLN@LN@LMxLMxLI@LH2LF@LEL=L=L=L;L7@L LT@L@LL@L@L0LLGL@K^K^KKKj@K$@KKK@K@KK@K]K޺K@KtK#@KKՀ@K:@KK͗@KŮ@K\K\K @KKKKK9@KK@KK@K@KKKKrKK~@K,K,K,K@KK8@KKK@KK@KqKqK}+K{@K{@KuBKs@KqN@KjKie@Kf@Ka|@K`*K]KXAKTM@KPXKEKEKEKD{@KC)KA@K;@K2@K0K/c@K+nK*@K(K"4@KK>K>K>JJęJH@JH@JJJ_@J@JjJjJ@Jv@Jv@Jv@Jv@J$J@JJ0@J@J@JG@JG@J@JJ@J@J@JJJ#J@JJJ@J:J@JJQJ@J J J|@JzJyt@Jyt@Jx"JrJrJq@Jn@Jn@JmJhPJeJ\s@JW-@JT@JS8JKOJI@JCfJCfJB@J@J@J?r@J<@J;}J:,@J7@J67J2C@J0J/@J,@J%@JJB@JJMJ J dJ@J@JJ@J*@J*@II@IIA@IIII@I@IIIX@IX@IX@II@I@IcIIo@Io@IzI)@I@IܑI@@II@I@I@IԨIд@I̿In@I3I3I@II@I@IV@IIaIIm@I@I'@II2III@IIIIIIII@III@I1I@III~@I}Iy@Ix_Iw@IuItk@Itk@Io%@Ik0IeIcGIa@I`IVIO@IJ;@IHIAI>]I= @I7@I6tI3I-I@III9@I9@II IP@I@IIg@Ig@HHH@HrH~@H,H@HCHHH @H @Hf@Hf@H@H+H@H׈H׈H7@HBH@HǶH@HH|@HHH@H{@H)HHL@H@H@H@HnH}H|@Ht@HsVHr@Hl@HkmHgy@HcH`H_@H^>HRa@HQHQHO@HFHFH$@DX@DU@DN@DN@DLDH@DGwDGwDDD@@D?D?D;@D;@D:HD:HD2_D1@D1@D-D+@D+@D'D!<@D!<@D!<@DDD@D@D@DDDDDD@D@D@D@D uD $@D D @D @DDDFC@C@C@C@CCCCCR@CCCCC@Ci@CC@C@CtC@C@CC:@CECCC @C @CعCعCعCعCC@C-C-C-C@C@CCǖ@C@CáCáCP@CP@C[C @C @CCg@Cg@CCC!@C~@C,C@CCCCC@CC@C@C@CZCZC @C @CCCf@Cf@Cf@CC@CqCqC @C @C @CCC}@C7@C7@C7@CBCBCYC@C@CC}@CqCqLukas Vrabec - 3.13.1-229.9Lukas Vrabec - 3.13.1-229.8Lukas Vrabec - 3.13.1-229.7Lukas Vrabec - 3.13.1-229.6Lukas Vrabec - 3.13.1-229.5Lukas Vrabec - 3.13.1-229.4Lukas Vrabec - 3.13.1-229.3Lukas Vrabec - 3.13.1-229.2Lukas Vrabec - 3.13.1-229.1Lukas Vrabec - 3.13.1-229Lukas Vrabec - 3.13.1-228Lukas Vrabec - 3.13.1-227Lukas Vrabec - 3.13.1-226Lukas Vrabec - 3.13.1-225Lukas Vrabec - 3.13.1-224Lukas Vrabec - 3.13.1-223Lukas Vrabec - 3.13.1-222Lukas Vrabec - 3.13.1-221Lukas Vrabec - 3.13.1-220Lukas Vrabec - 3.13.1-219Lukas Vrabec - 3.13.1-218Lukas Vrabec - 3.13.1-217Lukas Vrabec - 3.13.1-216Lukas Vrabec - 3.13.1-215Lukas Vrabec - 3.13.1-214Lukas Vrabec - 3.13.1-213Lukas Vrabec - 3.13.1-212Lukas Vrabec - 3.13.1-211Lukas Vrabec - 3.13.1-210Lukas Vrabec - 3.13.1-209Lukas Vrabec - 3.13.1-208Lukas Vrabec - 3.13.1-207Lukas Vrabec - 3.13.1-206Lukas Vrabec - 3.13.1-205Lukas Vrabec - 3.13.1-204Lukas Vrabec - 3.13.1-203Lukas Vrabec - 3.13.1-202Lukas Vrabec - 3.13.1-201Lukas Vrabec - 3.13.1-200Lukas Vrabec - 3.13.1-199Lukas Vrabec - 3.13.1-198Lukas Vrabec - 3.13.1-197Lukas Vrabec - 3.13.1-196Lukas Vrabec - 3.13.1-195Lukas Vrabec - 3.13.1-194Lukas Vrabec - 3.13.1-193Lukas Vrabec - 3.13.1-192Lukas Vrabec - 3.13.1-191Lukas Vrabec - 3.13.1-190Lukas Vrabec - 3.13.1-189Lukas Vrabec - 3.13.1-188Lukas Vrabec - 3.13.1-187Lukas Vrabec - 3.13.1-186Lukas Vrabec - 3.13.1-185Lukas Vrabec - 3.13.1-184Lukas Vrabec - 3.13.1-183Lukas Vrabec - 3.13.1-182Lukas Vrabec - 3.13.1-181Lukas Vrabec - 3.13.1-180Lukas Vrabec - 3.13.1-179Lukas Vrabec - 3.13.1-178Lukas Vrabec - 3.13.1-177Lukas Vrabec - 3.13.1-176Lukas Vrabec - 3.13.1-175Lukas Vrabec - 3.13.1-174Lukas Vrabec - 3.13.1-173Lukas Vrabec - 3.13.1-172Lukas Vrabec - 3.13.1-171Lukas Vrabec - 3.13.1-170Lukas Vrabec - 3.13.1-169Lukas Vrabec - 3.13.1-168Lukas Vrabec - 3.13.1-167Lukas Vrabec - 3.13.1-166Lukas Vrabec - 3.13.1-165Lukas Vrabec - 3.13.1-164Lukas Vrabec - 3.13.1-163Lukas Vrabec - 3.13.1-162Lukas Vrabec - 3.13.1-161Lukas Vrabec - 3.13.1-160Lukas Vrabec - 3.13.1-159Lukas Vrabec - 3.13.1-158Lukas Vrabec - 3.13.1-157Lukas Vrabec - 3.13.1-156Lukas Vrabec - 3.13.1-155Lukas Vrabec - 3.13.1-154Lukas Vrabec - 3.13.1-153Lukas Vrabec - 3.13.1-152Lukas Vrabec - 3.13.1-151Lukas Vrabec - 3.13.1-150Lukas Vrabec - 3.13.1-149Lukas Vrabec - 3.13.1-148Lukas Vrabec - 3.13.1-147Lukas Vrabec - 3.13.1-146Lukas Vrabec - 3.13.1-145Lukas Vrabec - 3.13.1-144Lukas Vrabec - 3.13.1-143Lukas Vrabec - 3.13.1-142Lukas Vrabec - 3.13.1-141Lukas Vrabec - 3.13.1-140Lukas Vrabec - 3.13.1-139Lukas Vrabec - 3.13.1-138Lukas Vrabec - 3.13.1-137Lukas Vrabec - 3.13.1-136Lukas Vrabec - 3.13.1-135Lukas Vrabec - 3.13.1-134Lukas Vrabec - 3.13.1-133Lukas Vrabec - 3.13.1-132Lukas Vrabec - 3.13.1-131Lukas Vrabec - 3.13.1-130Lukas Vrabec - 3.13.1-129Lukas Vrabec - 3.13.1-128Lukas Vrabec - 3.13.1-127Lukas Vrabec - 3.13.1-126Lukas Vrabec - 3.13.1-125Lukas Vrabec - 3.13.1-124Lukas Vrabec - 3.13.1-123Lukas Vrabec - 3.13.1-122Lukas Vrabec - 3.13.1-120Lukas Vrabec - 3.13.1-119Lukas Vrabec - 3.13.1-118Lukas Vrabec - 3.13.1-117Lukas Vrabec - 3.13.1-116Lukas Vrabec - 3.13.1-115Lukas Vrabec - 3.13.1-114Lukas Vrabec - 3.13.1-113Lukas Vrabec - 3.13.1-112Lukas Vrabec - 3.13.1-111Lukas Vrabec - 3.13.1-110Lukas Vrabec - 3.13.1-109Lukas Vrabec - 3.13.1-108Lukas Vrabec - 3.13.1-107Lukas Vrabec - 3.13.1-106Miroslav Grepl - 3.13.1-105Lukas Vrabec - 3.13.1-104Lukas Vrabec - 3.13.1-103Dan Walsh - 3.13.1-102Lukas Vrabec - 3.13.1-101Lukas Vrabec - 3.13.1-100Lukas Vrabec - 3.13.1-99Lukas Vrabec - 3.13.1-98Lukas Vrabec - 3.13.1-97Lukas Vrabec - 3.13.1-96Lukas Vrabec - 3.13.1-95Lukas Vrabec - 3.13.1-94Lukas Vrabec - 3.13.1-93Lukas Vrabec - 3.13.1-92Lukas Vrabec - 3.13.1-91Lukas Vrabec - 3.13.1-90Lukas Vrabec - 3.13.1-89Lukas Vrabec - 3.13.1-88Lukas Vrabec - 3.13.1-87Lukas Vrabec - 3.13.1-86Lukas Vrabec - 3.13.1-85Lukas Vrabec - 3.13.1-84Lukas Vrabec - 3.13.1-83Lukas Vrabec - 3.13.1-82Lukas Vrabec - 3.13.1-81Lukas Vrabec - 3.13.1-80Petr Lautrbach - 3.13.1-79Lukas Vrabec - 3.13.1-78Lukas Vrabec - 3.13.1-77Lukas Vrabec - 3.13.1-76Lukas Vrabec - 3.13.1-75Lukas Vrabec - 3.13.1-74Lukas Vrabec - 3.13.1-73Lukas Vrabec - 3.13.1-72Lukas Vrabec - 3.13.1-71Lukas Vrabec - 3.13.1-70Lukas Vrabec - 3.13.1-69Lukas Vrabec - 3.13.1-68Lukas Vrabec - 3.13.1-67Petr Lautrbach - 3.13.1-66Lukas Vrabec 3.13.1-65Lukas Vrabec 3.13.1-64Lukas Vrabec 3.13.1-63Lukas Vrabec 3.13.1-62Lukas Vrabec 3.13.1-61Miroslav Grepl 3.13.1-60Miroslav Grepl 3.13.1-59Lukas Vrabec 3.13.1-58Lukas Vrabec 3.13.1-57Miroslav Grepl 3.13.1-56Lukas Vrabec 3.13.1-55Lukas Vrabec 3.13.1-54Lukas Vrabec 3.13.1-53Lukas Vrabec 3.13.1-52Miroslav Grepl 3.13.1-51Lukas Vrabec 3.13.1-50Lukas Vrabec 3.13.1-49Lukas Vrabec 3.13.1-48Lukas Vrabec 3.13.1-47Lukas Vrabec 3.13.1-46Lukas Vrabec 3.13.1-45Lukas Vrabec 3.13.1-44Lukas Vrabec 3.13.1-43Lukas Vrabec 3.13.1-42Lukas Vrabec 3.13.1-41Lukas Vrabec 3.13.1-40Miroslav Grepl 3.13.1-39Lukas Vrabec 3.13.1-38Lukas Vrabec 3.13.1-37Lukas Vrabec 3.13.1-36Lukas Vrabec 3.13.1-35Lukas Vrabec 3.13.1-34Lukas Vrabec 3.13.1-33Lukas Vrabec 3.13.1-32Miroslav Grepl 3.13.1-31Miroslav Grepl 3.13.1-30Miroslav Grepl 3.13.1-29Miroslav Grepl 3.13.1-28Miroslav Grepl 3.13.1-27Miroslav Grepl 3.13.1-26Miroslav Grepl 3.13.1-25Miroslav Grepl 3.13.1-24Miroslav Grepl 3.13.1-23Miroslav Grepl 3.13.1-22Miroslav Grepl 3.13.1-21Miroslav Grepl 3.13.1-20Miroslav Grepl 3.13.1-19Miroslav Grepl 3.13.1-18Miroslav Grepl 3.13.1-17Miroslav Grepl 3.13.1-16Miroslav Grepl 3.13.1-15Miroslav Grepl 3.13.1-14Miroslav Grepl 3.13.1-13Miroslav Grepl 3.13.1-12Miroslav Grepl 3.13.1-11Miroslav Grepl 3.13.1-10Miroslav Grepl 3.13.1-9Miroslav Grepl 3.13.1-8Miroslav Grepl 3.13.1-7Miroslav Grepl 3.13.1-6Miroslav Grepl 3.13.1-5Miroslav Grepl 3.13.1-4Miroslav Grepl 3.13.1-3Miroslav Grepl 3.13.1-2Miroslav Grepl 3.13.1-1Miroslav Grepl 3.12.1-156Miroslav Grepl 3.12.1-155Miroslav Grepl 3.12.1-154Miroslav Grepl 3.12.1-153Miroslav Grepl 3.12.1-152Miroslav Grepl 3.12.1-151Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-148Miroslav Grepl 3.12.1-147Miroslav Grepl 3.12.1-146Miroslav Grepl 3.12.1-145Miroslav Grepl 3.12.1-144Lukas Vrabec 3.12.1-143Miroslav Grepl 3.12.1-142Miroslav Grepl 3.12.1-141Miroslav Grepl 3.12.1-140Miroslav Grepl 3.12.1-139Lukas Vrabec 3.12.1-138Miroslav Grepl 3.12.1-137Miroslav Grepl 3.12.1-136Miroslav Grepl 3.12.1-135Miroslav Grepl 3.12.1-134Miroslav Grepl 3.12.1-133Miroslav Grepl 3.12.1-132Miroslav Grepl 3.12.1-131Miroslav Grepl 3.12.1-130Miroslav Grepl 3.12.1-129Miroslav Grepl 3.12.1-128Miroslav Grepl 3.12.1-127Miroslav Grepl 3.12.1-126Miroslav Grepl 3.12.1-125Miroslav Grepl 3.12.1-124Miroslav Grepl 3.12.1-123Miroslav Grepl 3.12.1-122Miroslav Grepl 3.12.1-121Miroslav Grepl 3.12.1-120Miroslav Grepl 3.12.1-119Miroslav Grepl 3.12.1-118Miroslav Grepl 3.12.1-117Miroslav Grepl 3.12.1-116Miroslav Grepl 3.12.1-115Miroslav Grepl 3.12.1-114Miroslav Grepl 3.12.1-113Miroslav Grepl 3.12.1-112Miroslav Grepl 3.12.1-111Miroslav Grepl 3.12.1-110Miroslav Grepl 3.12.1-109Miroslav Grepl 3.12.1-108Miroslav Grepl 3.12.1-107Dan Walsh 3.12.1-106Miroslav Grepl 3.12.1-105Miroslav Grepl 3.12.1-104Miroslav Grepl 3.12.1-103Miroslav Grepl 3.12.1-102Miroslav Grepl 3.12.1-101Miroslav Grepl 3.12.1-100Miroslav Grepl 3.12.1-99Miroslav Grepl 3.12.1-98Miroslav Grepl 3.12.1-97Miroslav Grepl 3.12.1-96Miroslav Grepl 3.12.1-95Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-93Miroslav Grepl 3.12.1-92Miroslav Grepl 3.12.1-91Miroslav Grepl 3.12.1-90Miroslav Grepl 3.12.1-89Miroslav Grepl 3.12.1-88Miroslav Grepl 3.12.1-87Miroslav Grepl 3.12.1-86Miroslav Grepl 3.12.1-85Miroslav Grepl 3.12.1-84Miroslav Grepl 3.12.1-83Miroslav Grepl 3.12.1-82Miroslav Grepl 3.12.1-81Miroslav Grepl 3.12.1-80Miroslav Grepl 3.12.1-79Miroslav Grepl 3.12.1-78Miroslav Grepl 3.12.1-77Miroslav Grepl 3.12.1-76Miroslav Grepl 3.12.1-75Miroslav Grepl 3.12.1-74Miroslav Grepl 3.12.1-73Miroslav Grepl 3.12.1-72Miroslav Grepl 3.12.1-71Miroslav Grepl 3.12.1-70Miroslav Grepl 3.12.1-69Miroslav Grepl 3.12.1-68Miroslav Grepl 3.12.1-67Miroslav Grepl 3.12.1-66Miroslav Grepl 3.12.1-65Miroslav Grepl 3.12.1-64Miroslav Grepl 3.12.1-63Miroslav Grepl 3.12.1-62Miroslav Grepl 3.12.1-61Miroslav Grepl 3.12.1-60Miroslav Grepl 3.12.1-59Miroslav Grepl 3.12.1-58Miroslav Grepl 3.12.1-57Miroslav Grepl 3.12.1-56Miroslav Grepl 3.12.1-55Miroslav Grepl 3.12.1-54Miroslav Grepl 3.12.1-53Miroslav Grepl 3.12.1-52Miroslav Grepl 3.12.1-51Miroslav Grepl 3.12.1-50Miroslav Grepl 3.12.1-49Miroslav Grepl 3.12.1-48Miroslav Grepl 3.12.1-47Miroslav Grepl 3.12.1-46Miroslav Grepl 3.12.1-45Miroslav Grepl 3.12.1-44Miroslav Grepl 3.12.1-43Miroslav Grepl 3.12.1-42Miroslav Grepl 3.12.1-41Miroslav Grepl 3.12.1-40Miroslav Grepl 3.12.1-39Miroslav Grepl 3.12.1-38Miroslav Grepl 3.12.1-37Miroslav Grepl 3.12.1-36Miroslav Grepl 3.12.1-35Miroslav Grepl 3.12.1-34Miroslav Grepl 3.12.1-33Miroslav Grepl 3.12.1-32Miroslav Grepl 3.12.1-31Miroslav Grepl 3.12.1-30Miroslav Grepl 3.12.1-29Dan Walsh 3.12.1-28Dan Walsh 3.12.1-27Miroslav Grepl 3.12.1-26Miroslav Grepl 3.12.1-25Miroslav Grepl 3.12.1-24Miroslav Grepl 3.12.1-23Miroslav Grepl 3.12.1-22Miroslav Grepl 3.12.1-21Miroslav Grepl 3.12.1-20Miroslav Grepl 3.12.1-19Miroslav Grepl 3.12.1-18Miroslav Grepl 3.12.1-17Miroslav Grepl 3.12.1-16Miroslav Grepl 3.12.1-15Miroslav Grepl 3.12.1-14Miroslav Grepl 3.12.1-13Miroslav Grepl 3.12.1-12Miroslav Grepl 3.12.1-11Miroslav Grepl 3.12.1-10Miroslav Grepl 3.12.1-9Miroslav Grepl 3.12.1-8Miroslav Grepl 3.12.1-7Miroslav Grepl 3.12.1-6Miroslav Grepl 3.12.1-5Miroslav Grepl 3.12.1-4Miroslav Grepl 3.12.1-3Miroslav Grepl 3.12.1-2Miroslav Grepl 3.12.1-1Dan Walsh 3.11.1-69.1Miroslav Grepl 3.11.1-69Miroslav Grepl 3.11.1-68Miroslav Grepl 3.11.1-67Miroslav Grepl 3.11.1-66Miroslav Grepl 3.11.1-65Miroslav Grepl 3.11.1-64Miroslav Grepl 3.11.1-63Miroslav Grepl 3.11.1-62Miroslav Grepl 3.11.1-61Miroslav Grepl 3.11.1-60Miroslav Grepl 3.11.1-59Miroslav Grepl 3.11.1-58Miroslav Grepl 3.11.1-57Miroslav Grepl 3.11.1-56Miroslav Grepl 3.11.1-55Miroslav Grepl 3.11.1-54Miroslav Grepl 3.11.1-53Miroslav Grepl 3.11.1-52Miroslav Grepl 3.11.1-51Miroslav Grepl 3.11.1-50Miroslav Grepl 3.11.1-49Miroslav Grepl 3.11.1-48Miroslav Grepl 3.11.1-47Miroslav Grepl 3.11.1-46Miroslav Grepl 3.11.1-45Miroslav Grepl 3.11.1-44Miroslav Grepl 3.11.1-43Miroslav Grepl 3.11.1-42Miroslav Grepl 3.11.1-41Miroslav Grepl 3.11.1-40Miroslav Grepl 3.11.1-39Miroslav Grepl 3.11.1-38Miroslav Grepl 3.11.1-37Miroslav Grepl 3.11.1-36Miroslav Grepl 3.11.1-35Miroslav Grepl 3.11.1-34Miroslav Grepl 3.11.1-33Miroslav Grepl 3.11.1-32Miroslav Grepl 3.11.1-31Miroslav Grepl 3.11.1-30Miroslav Grepl 3.11.1-29Miroslav Grepl 3.11.1-28Miroslav Grepl 3.11.1-27Miroslav Grepl 3.11.1-26Miroslav Grepl 3.11.1-25Miroslav Grepl 3.11.1-24Miroslav Grepl 3.11.1-23Miroslav Grepl 3.11.1-22Miroslav Grepl 3.11.1-21Miroslav Grepl 3.11.1-20Miroslav Grepl 3.11.1-19Miroslav Grepl 3.11.1-18Miroslav Grepl 3.11.1-17Miroslav Grepl 3.11.1-16Dan Walsh 3.11.1-15Miroslav Grepl 3.11.1-14Dan Walsh 3.11.1-13Miroslav Grepl 3.11.1-12Miroslav Grepl 3.11.1-11Miroslav Grepl 3.11.1-10Dan Walsh 3.11.1-9Dan Walsh 3.11.1-8Dan Walsh 3.11.1-7Dan Walsh 3.11.1-6Miroslav Grepl 3.11.1-5Miroslav Grepl 3.11.1-4Miroslav Grepl 3.11.1-3Miroslav Grepl 3.11.1-2Miroslav Grepl 3.11.1-1Miroslav Grepl 3.11.1-0Miroslav Grepl 3.11.0-15Miroslav Grepl 3.11.0-14Miroslav Grepl 3.11.0-13Miroslav Grepl 3.11.0-12Fedora Release Engineering - 3.11.0-11Miroslav Grepl 3.11.0-10Miroslav Grepl 3.11.0-9Miroslav Grepl 3.11.0-8Miroslav Grepl 3.11.0-7Miroslav Grepl 3.11.0-6Miroslav Grepl 3.11.0-5Miroslav Grepl 3.11.0-4Miroslav Grepl 3.11.0-3Miroslav Grepl 3.11.0-2Miroslav Grepl 3.11.0-1Miroslav Grepl 3.10.0-128Miroslav Grepl 3.10.0-127Miroslav Grepl 3.10.0-126Miroslav Grepl 3.10.0-125Miroslav Grepl 3.10.0-124Miroslav Grepl 3.10.0-123Miroslav Grepl 3.10.0-122Miroslav Grepl 3.10.0-121Miroslav Grepl 3.10.0-120Miroslav Grepl 3.10.0-119Miroslav Grepl 3.10.0-118Miroslav Grepl 3.10.0-117Miroslav Grepl 3.10.0-116Miroslav Grepl 3.10.0-115Miroslav Grepl 3.10.0-114Miroslav Grepl 3.10.0-113Miroslav Grepl 3.10.0-112Miroslav Grepl 3.10.0-111Miroslav Grepl 3.10.0-110Miroslav Grepl 3.10.0-109Miroslav Grepl 3.10.0-108Miroslav Grepl 3.10.0-107Miroslav Grepl 3.10.0-106Miroslav Grepl 3.10.0-105Miroslav Grepl 3.10.0-104Miroslav Grepl 3.10.0-103Miroslav Grepl 3.10.0-102Miroslav Grepl 3.10.0-101Miroslav Grepl 3.10.0-100Miroslav Grepl 3.10.0-99Miroslav Grepl 3.10.0-98Miroslav Grepl 3.10.0-97Miroslav Grepl 3.10.0-96Miroslav Grepl 3.10.0-95Miroslav Grepl 3.10.0-94Miroslav Grepl 3.10.0-93Miroslav Grepl 3.10.0-92Miroslav Grepl 3.10.0-91Miroslav Grepl 3.10.0-90Miroslav Grepl 3.10.0-89Miroslav Grepl 3.10.0-88Miroslav Grepl 3.10.0-87Miroslav Grepl 3.10.0-86Miroslav Grepl 3.10.0-85Miroslav Grepl 3.10.0-84Miroslav Grepl 3.10.0-83Miroslav Grepl 3.10.0-82Dan Walsh 3.10.0-81.2Miroslav Grepl 3.10.0-81Miroslav Grepl 3.10.0-80Miroslav Grepl 3.10.0-79Miroslav Grepl 3.10.0-78Miroslav Grepl 3.10.0-77Miroslav Grepl 3.10.0-76Miroslav Grepl 3.10.0-75Dan Walsh 3.10.0-74.2Miroslav Grepl 3.10.0-74Miroslav Grepl 3.10.0-73Miroslav Grepl 3.10.0-72Miroslav Grepl 3.10.0-71Miroslav Grepl 3.10.0-70Miroslav Grepl 3.10.0-69Miroslav Grepl 3.10.0-68Miroslav Grepl 3.10.0-67Miroslav Grepl 3.10.0-66Miroslav Grepl 3.10.0-65Miroslav Grepl 3.10.0-64Miroslav Grepl 3.10.0-63Miroslav Grepl 3.10.0-59Miroslav Grepl 3.10.0-58Dan Walsh 3.10.0-57Dan Walsh 3.10.0-56Dan Walsh 3.10.0-55.2Dan Walsh 3.10.0-55.1Miroslav Grepl 3.10.0-55Dan Walsh 3.10.0-54.1Miroslav Grepl 3.10.0-54Dan Walsh 3.10.0-53.1Miroslav Grepl 3.10.0-53Miroslav Grepl 3.10.0-52Miroslav Grepl 3.10.0-51Dan Walsh 3.10.0-50.2Dan Walsh 3.10.0-50.1Miroslav Grepl 3.10.0-50Miroslav Grepl 3.10.0-49Miroslav Grepl 3.10.0-48Miroslav Grepl 3.10.0-47Dan Walsh 3.10.0-46.1Miroslav Grepl 3.10.0-46Dan Walsh 3.10.0-45.1Miroslav Grepl 3.10.0-45Miroslav Grepl 3.10.0-43Miroslav Grepl 3.10.0-42Miroslav Grepl 3.10.0-41Dan Walsh 3.10.0-40.2Miroslav Grepl 3.10.0-40Dan Walsh 3.10.0-39.3Dan Walsh 3.10.0-39.2Dan Walsh 3.10.0-39.1Miroslav Grepl 3.10.0-39Dan Walsh 3.10.0-38.1Miroslav Grepl 3.10.0-38Miroslav Grepl 3.10.0-37Dan Walsh 3.10.0-36.1Miroslav Grepl 3.10.0-36Dan Walsh 3.10.0-35Dan Walsh 3.10.0-34.7Dan Walsh 3.10.0-34.6Dan Walsh 3.10.0-34.4Miroslav Grepl 3.10.0-34.3Dan Walsh 3.10.0-34.2Dan Walsh 3.10.0-34.1Miroslav Grepl 3.10.0-34Miroslav Grepl 3.10.0-33Dan Walsh 3.10.0-31.1Miroslav Grepl 3.10.0-31Miroslav Grepl 3.10.0-29Miroslav Grepl 3.10.0-28Miroslav Grepl 3.10.0-27Miroslav Grepl 3.10.0-26Miroslav Grepl 3.10.0-25Miroslav Grepl 3.10.0-24Miroslav Grepl 3.10.0-23Miroslav Grepl 3.10.0-22Miroslav Grepl 3.10.0-21Dan Walsh 3.10.0-20Miroslav Grepl 3.10.0-19Miroslav Grepl 3.10.0-18Miroslav Grepl 3.10.0-17Miroslav Grepl 3.10.0-16Miroslav Grepl 3.10.0-14Miroslav Grepl 3.10.0-13Miroslav Grepl 3.10.0-12Miroslav Grepl 3.10.0-11Miroslav Grepl 3.10.0-10Miroslav Grepl 3.10.0-9Miroslav Grepl 3.10.0-8Miroslav Grepl 3.10.0-7Miroslav Grepl 3.10.0-6Miroslav Grepl 3.10.0-5Miroslav Grepl 3.10.0-4Miroslav Grepl 3.10.0-3Miroslav Grepl 3.10.0-2Miroslav Grepl 3.10.0-1Miroslav Grepl 3.9.16-30Dan Walsh 3.9.16-29.1Miroslav Grepl 3.9.16-29Dan Walsh 3.9.16-28.1Miroslav Grepl 3.9.16-27Miroslav Grepl 3.9.16-26Miroslav Grepl 3.9.16-25Miroslav Grepl 3.9.16-24Miroslav Grepl 3.9.16-23Miroslav Grepl 3.9.16-22Miroslav Grepl 3.9.16-21Miroslav Grepl 3.9.16-20Miroslav Grepl 3.9.16-19Miroslav Grepl 3.9.16-18Miroslav Grepl 3.9.16-17Dan Walsh 3.9.16-16.1Miroslav Grepl 3.9.16-16Miroslav Grepl 3.9.16-15Miroslav Grepl 3.9.16-14Miroslav Grepl 3.9.16-13Miroslav Grepl 3.9.16-12Miroslav Grepl 3.9.16-11Miroslav Grepl 3.9.16-10Miroslav Grepl 3.9.16-7Miroslav Grepl 3.9.16-6Miroslav Grepl 3.9.16-5Miroslav Grepl 3.9.16-4Miroslav Grepl 3.9.16-3Miroslav Grepl 3.9.16-2Miroslav Grepl 3.9.16-1Miroslav Grepl 3.9.15-5Miroslav Grepl 3.9.15-2Miroslav Grepl 3.9.15-1Fedora Release Engineering - 3.9.14-2Dan Walsh 3.9.14-1Miroslav Grepl 3.9.13-10Miroslav Grepl 3.9.13-9Dan Walsh 3.9.13-8Miroslav Grepl 3.9.13-7Miroslav Grepl 3.9.13-6Miroslav Grepl 3.9.13-5Miroslav Grepl 3.9.13-4Miroslav Grepl 3.9.13-3Miroslav Grepl 3.9.13-2Miroslav Grepl 3.9.13-1Miroslav Grepl 3.9.12-8Miroslav Grepl 3.9.12-7Miroslav Grepl 3.9.12-6Miroslav Grepl 3.9.12-5Dan Walsh 3.9.12-4Dan Walsh 3.9.12-3Dan Walsh 3.9.12-2Miroslav Grepl 3.9.12-1Dan Walsh 3.9.11-2Miroslav Grepl 3.9.11-1Miroslav Grepl 3.9.10-13Dan Walsh 3.9.10-12Miroslav Grepl 3.9.10-11Miroslav Grepl 3.9.10-10Miroslav Grepl 3.9.10-9Miroslav Grepl 3.9.10-8Miroslav Grepl 3.9.10-7Miroslav Grepl 3.9.10-6Miroslav Grepl 3.9.10-5Dan Walsh 3.9.10-4Miroslav Grepl 3.9.10-3Miroslav Grepl 3.9.10-2Miroslav Grepl 3.9.10-1Miroslav Grepl 3.9.9-4Dan Walsh 3.9.9-3Miroslav Grepl 3.9.9-2Miroslav Grepl 3.9.9-1Miroslav Grepl 3.9.8-7Dan Walsh 3.9.8-6Miroslav Grepl 3.9.8-5Miroslav Grepl 3.9.8-4Dan Walsh 3.9.8-3Dan Walsh 3.9.8-2Dan Walsh 3.9.8-1Dan Walsh 3.9.7-10Dan Walsh 3.9.7-9Dan Walsh 3.9.7-8Dan Walsh 3.9.7-7Dan Walsh 3.9.7-6Dan Walsh 3.9.7-5Dan Walsh 3.9.7-4Dan Walsh 3.9.7-3Dan Walsh 3.9.7-2Dan Walsh 3.9.7-1Dan Walsh 3.9.6-3Dan Walsh 3.9.6-2Dan Walsh 3.9.6-1Dan Walsh 3.9.5-11Dan Walsh 3.9.5-10Dan Walsh 3.9.5-9Dan Walsh 3.9.5-8Dan Walsh 3.9.5-7Dan Walsh 3.9.5-6Dan Walsh 3.9.5-5Dan Walsh 3.9.5-4Dan Walsh 3.9.5-3Dan Walsh 3.9.5-2Dan Walsh 3.9.5-1Dan Walsh 3.9.4-3Dan Walsh 3.9.4-2Dan Walsh 3.9.4-1Dan Walsh 3.9.3-4Dan Walsh 3.9.3-3Dan Walsh 3.9.3-2Dan Walsh 3.9.3-1Dan Walsh 3.9.2-1Dan Walsh 3.9.1-3Dan Walsh 3.9.1-2Dan Walsh 3.9.1-1Dan Walsh 3.9.0-2Dan Walsh 3.9.0-1Dan Walsh 3.8.8-21Dan Walsh 3.8.8-20Dan Walsh 3.8.8-19Dan Walsh 3.8.8-18Dan Walsh 3.8.8-17Dan Walsh 3.8.8-16Dan Walsh 3.8.8-15Dan Walsh 3.8.8-14Dan Walsh 3.8.8-13Dan Walsh 3.8.8-12Dan Walsh 3.8.8-11Dan Walsh 3.8.8-10Dan Walsh 3.8.8-9Dan Walsh 3.8.8-8Dan Walsh 3.8.8-7Dan Walsh 3.8.8-6Dan Walsh 3.8.8-5Dan Walsh 3.8.8-4Dan Walsh 3.8.8-3Dan Walsh 3.8.8-2Dan Walsh 3.8.8-1Dan Walsh 3.8.7-3Dan Walsh 3.8.7-2Dan Walsh 3.8.7-1Dan Walsh 3.8.6-3Miroslav Grepl 3.8.6-2Dan Walsh 3.8.6-1Dan Walsh 3.8.5-1Dan Walsh 3.8.4-1Dan Walsh 3.8.3-4Dan Walsh 3.8.3-3Dan Walsh 3.8.3-2Dan Walsh 3.8.3-1Dan Walsh 3.8.2-1Dan Walsh 3.8.1-5Dan Walsh 3.8.1-4Dan Walsh 3.8.1-3Dan Walsh 3.8.1-2Dan Walsh 3.8.1-1Dan Walsh 3.7.19-22Dan Walsh 3.7.19-21Dan Walsh 3.7.19-20Dan Walsh 3.7.19-19Dan Walsh 3.7.19-17Dan Walsh 3.7.19-16Dan Walsh 3.7.19-15Dan Walsh 3.7.19-14Dan Walsh 3.7.19-13Dan Walsh 3.7.19-12Dan Walsh 3.7.19-11Dan Walsh 3.7.19-10Dan Walsh 3.7.19-9Dan Walsh 3.7.19-8Dan Walsh 3.7.19-7Dan Walsh 3.7.19-6Dan Walsh 3.7.19-5Dan Walsh 3.7.19-4Dan Walsh 3.7.19-3Dan Walsh 3.7.19-2Dan Walsh 3.7.19-1Dan Walsh 3.7.18-3Dan Walsh 3.7.18-2Dan Walsh 3.7.18-1Dan Walsh 3.7.17-6Dan Walsh 3.7.17-5Dan Walsh 3.7.17-4Dan Walsh 3.7.17-3Dan Walsh 3.7.17-2Dan Walsh 3.7.17-1Dan Walsh 3.7.16-2Dan Walsh 3.7.16-1Dan Walsh 3.7.15-4Dan Walsh 3.7.15-3Dan Walsh 3.7.15-2Dan Walsh 3.7.15-1Dan Walsh 3.7.14-5Dan Walsh 3.7.14-4Dan Walsh 3.7.14-3Dan Walsh 3.7.14-2Dan Walsh 3.7.14-1Dan Walsh 3.7.13-4Dan Walsh 3.7.13-3Dan Walsh 3.7.13-2Dan Walsh 3.7.13-1Dan Walsh 3.7.12-1Dan Walsh 3.7.11-1Dan Walsh 3.7.10-5Dan Walsh 3.7.10-4Dan Walsh 3.7.10-3Dan Walsh 3.7.10-2Dan Walsh 3.7.10-1Dan Walsh 3.7.9-4Dan Walsh 3.7.9-3Dan Walsh 3.7.9-2Dan Walsh 3.7.9-1Dan Walsh 3.7.8-11Dan Walsh 3.7.8-9Dan Walsh 3.7.8-8Dan Walsh 3.7.8-7Dan Walsh 3.7.8-6Dan Walsh 3.7.8-5Dan Walsh 3.7.8-4Dan Walsh 3.7.8-3Dan Walsh 3.7.8-2Dan Walsh 3.7.8-1Dan Walsh 3.7.7-3Dan Walsh 3.7.7-2Dan Walsh 3.7.7-1Dan Walsh 3.7.6-1Dan Walsh 3.7.5-8Dan Walsh 3.7.5-7Dan Walsh 3.7.5-6Dan Walsh 3.7.5-5Dan Walsh 3.7.5-4Dan Walsh 3.7.5-3Dan Walsh 3.7.5-2Dan Walsh 3.7.5-1Dan Walsh 3.7.4-4Dan Walsh 3.7.4-3Dan Walsh 3.7.4-2Dan Walsh 3.7.4-1Dan Walsh 3.7.3-1Dan Walsh 3.7.1-1Dan Walsh 3.6.33-2Dan Walsh 3.6.33-1Dan Walsh 3.6.32-17Dan Walsh 3.6.32-16Dan Walsh 3.6.32-15Dan Walsh 3.6.32-13Dan Walsh 3.6.32-12Dan Walsh 3.6.32-11Dan Walsh 3.6.32-10Dan Walsh 3.6.32-9Dan Walsh 3.6.32-8Dan Walsh 3.6.32-7Dan Walsh 3.6.32-6Dan Walsh 3.6.32-5Dan Walsh 3.6.32-4Dan Walsh 3.6.32-3Dan Walsh 3.6.32-2Dan Walsh 3.6.32-1Dan Walsh 3.6.31-5Dan Walsh 3.6.31-4Dan Walsh 3.6.31-3Dan Walsh 3.6.31-2Dan Walsh 3.6.30-6Dan Walsh 3.6.30-5Dan Walsh 3.6.30-4Dan Walsh 3.6.30-3Dan Walsh 3.6.30-2Dan Walsh 3.6.30-1Dan Walsh 3.6.29-2Dan Walsh 3.6.29-1Dan Walsh 3.6.28-9Dan Walsh 3.6.28-8Dan Walsh 3.6.28-7Dan Walsh 3.6.28-6Dan Walsh 3.6.28-5Dan Walsh 3.6.28-4Dan Walsh 3.6.28-3Dan Walsh 3.6.28-2Dan Walsh 3.6.28-1Dan Walsh 3.6.27-1Dan Walsh 3.6.26-11Dan Walsh 3.6.26-10Dan Walsh 3.6.26-9Bill Nottingham 3.6.26-8Dan Walsh 3.6.26-7Dan Walsh 3.6.26-6Dan Walsh 3.6.26-5Dan Walsh 3.6.26-4Dan Walsh 3.6.26-3Dan Walsh 3.6.26-2Dan Walsh 3.6.26-1Dan Walsh 3.6.25-1Dan Walsh 3.6.24-1Dan Walsh 3.6.23-2Dan Walsh 3.6.23-1Dan Walsh 3.6.22-3Dan Walsh 3.6.22-1Dan Walsh 3.6.21-4Dan Walsh 3.6.21-3Tom "spot" Callaway 3.6.21-2Dan Walsh 3.6.21-1Dan Walsh 3.6.20-2Dan Walsh 3.6.20-1Dan Walsh 3.6.19-5Dan Walsh 3.6.19-4Dan Walsh 3.6.19-3Dan Walsh 3.6.19-2Dan Walsh 3.6.19-1Dan Walsh 3.6.18-1Dan Walsh 3.6.17-1Dan Walsh 3.6.16-4Dan Walsh 3.6.16-3Dan Walsh 3.6.16-2Dan Walsh 3.6.16-1Dan Walsh 3.6.14-3Dan Walsh 3.6.14-2Dan Walsh 3.6.14-1Dan Walsh 3.6.13-3Dan Walsh 3.6.13-2Dan Walsh 3.6.13-1Dan Walsh 3.6.12-39Dan Walsh 3.6.12-38Dan Walsh 3.6.12-37Dan Walsh 3.6.12-36Dan Walsh 3.6.12-35Dan Walsh 3.6.12-34Dan Walsh 3.6.12-33Dan Walsh 3.6.12-31Dan Walsh 3.6.12-30Dan Walsh 3.6.12-29Dan Walsh 3.6.12-28Dan Walsh 3.6.12-27Dan Walsh 3.6.12-26Dan Walsh 3.6.12-25Dan Walsh 3.6.12-24Dan Walsh 3.6.12-23Dan Walsh 3.6.12-22Dan Walsh 3.6.12-21Dan Walsh 3.6.12-20Dan Walsh 3.6.12-19Dan Walsh 3.6.12-16Dan Walsh 3.6.12-15Dan Walsh 3.6.12-14Dan Walsh 3.6.12-13Dan Walsh 3.6.12-12Dan Walsh 3.6.12-11Dan Walsh 3.6.12-10Dan Walsh 3.6.12-9Dan Walsh 3.6.12-8Dan Walsh 3.6.12-7Dan Walsh 3.6.12-6Dan Walsh 3.6.12-5Dan Walsh 3.6.12-4Dan Walsh 3.6.12-3Dan Walsh 3.6.12-2Dan Walsh 3.6.12-1Dan Walsh 3.6.11-1Dan Walsh 3.6.10-9Dan Walsh 3.6.10-8Dan Walsh 3.6.10-7Dan Walsh 3.6.10-6Dan Walsh 3.6.10-5Dan Walsh 3.6.10-4Dan Walsh 3.6.10-3Dan Walsh 3.6.10-2Dan Walsh 3.6.10-1Dan Walsh 3.6.9-4Dan Walsh 3.6.9-3Dan Walsh 3.6.9-2Dan Walsh 3.6.9-1Dan Walsh 3.6.8-4Dan Walsh 3.6.8-3Dan Walsh 3.6.8-2Dan Walsh 3.6.8-1Dan Walsh 3.6.7-2Dan Walsh 3.6.7-1Dan Walsh 3.6.6-9Dan Walsh 3.6.6-8Fedora Release Engineering - 3.6.6-7Dan Walsh 3.6.6-6Dan Walsh 3.6.6-5Dan Walsh 3.6.6-4Dan Walsh 3.6.6-3Dan Walsh 3.6.6-2Dan Walsh 3.6.6-1Dan Walsh 3.6.5-3Dan Walsh 3.6.5-1Dan Walsh 3.6.4-6Dan Walsh 3.6.4-5Dan Walsh 3.6.4-4Dan Walsh 3.6.4-3Dan Walsh 3.6.4-2Dan Walsh 3.6.4-1Dan Walsh 3.6.3-13Dan Walsh 3.6.3-12Dan Walsh 3.6.3-11Dan Walsh 3.6.3-10Dan Walsh 3.6.3-9Dan Walsh 3.6.3-8Dan Walsh 3.6.3-7Dan Walsh 3.6.3-6Dan Walsh 3.6.3-3Dan Walsh 3.6.3-2Dan Walsh 3.6.3-1Dan Walsh 3.6.2-5Dan Walsh 3.6.2-4Dan Walsh 3.6.2-3Dan Walsh 3.6.2-2Dan Walsh 3.6.2-1Dan Walsh 3.6.1-15Dan Walsh 3.6.1-14Dan Walsh 3.6.1-13Dan Walsh 3.6.1-12Dan Walsh 3.6.1-11Dan Walsh 3.6.1-10Dan Walsh 3.6.1-9Dan Walsh 3.6.1-8Dan Walsh 3.6.1-7Dan Walsh 3.6.1-4Ignacio Vazquez-Abrams - 3.6.1-2Dan Walsh 3.5.13-19Dan Walsh 3.5.13-18Dan Walsh 3.5.13-17Dan Walsh 3.5.13-16Dan Walsh 3.5.13-15Dan Walsh 3.5.13-14Dan Walsh 3.5.13-13Dan Walsh 3.5.13-12Dan Walsh 3.5.13-11Dan Walsh 3.5.13-9Dan Walsh 3.5.13-8Dan Walsh 3.5.13-7Dan Walsh 3.5.13-6Dan Walsh 3.5.13-5Dan Walsh 3.5.13-4Dan Walsh 3.5.13-3Dan Walsh 3.5.13-2Dan Walsh 3.5.13-1Dan Walsh 3.5.12-3Dan Walsh 3.5.12-2Dan Walsh 3.5.12-1Dan Walsh 3.5.11-1Dan Walsh 3.5.10-3Dan Walsh 3.5.10-2Dan Walsh 3.5.10-1Dan Walsh 3.5.9-4Dan Walsh 3.5.9-3Dan Walsh 3.5.9-2Dan Walsh 3.5.9-1Dan Walsh 3.5.8-7Dan Walsh 3.5.8-6Dan Walsh 3.5.8-5Dan Walsh 3.5.8-4Dan Walsh 3.5.8-3Dan Walsh 3.5.8-1Dan Walsh 3.5.7-2Dan Walsh 3.5.7-1Dan Walsh 3.5.6-2Dan Walsh 3.5.6-1Dan Walsh 3.5.5-4Dan Walsh 3.5.5-3Dan Walsh 3.5.5-2Dan Walsh 3.5.4-2Dan Walsh 3.5.4-1Dan Walsh 3.5.3-1Dan Walsh 3.5.2-2Dan Walsh 3.5.1-5Dan Walsh 3.5.1-4Dan Walsh 3.5.1-3Dan Walsh 3.5.1-2Dan Walsh 3.5.1-1Dan Walsh 3.5.0-1Dan Walsh 3.4.2-14Dan Walsh 3.4.2-13Dan Walsh 3.4.2-12Dan Walsh 3.4.2-11Dan Walsh 3.4.2-10Dan Walsh 3.4.2-9Dan Walsh 3.4.2-8Dan Walsh 3.4.2-7Dan Walsh 3.4.2-6Dan Walsh 3.4.2-5Dan Walsh 3.4.2-4Dan Walsh 3.4.2-3Dan Walsh 3.4.2-2Dan Walsh 3.4.2-1Dan Walsh 3.4.1-5Dan Walsh 3.4.1-3Dan Walsh 3.4.1-2Dan Walsh 3.4.1-1Dan Walsh 3.3.1-48Dan Walsh 3.3.1-47Dan Walsh 3.3.1-46Dan Walsh 3.3.1-45Dan Walsh 3.3.1-44Dan Walsh 3.3.1-43Dan Walsh 3.3.1-42Dan Walsh 3.3.1-41Dan Walsh 3.3.1-39Dan Walsh 3.3.1-37Dan Walsh 3.3.1-36Dan Walsh 3.3.1-33Dan Walsh 3.3.1-32Dan Walsh 3.3.1-31Dan Walsh 3.3.1-30Dan Walsh 3.3.1-29Dan Walsh 3.3.1-28Dan Walsh 3.3.1-27Dan Walsh 3.3.1-26Dan Walsh 3.3.1-25Dan Walsh 3.3.1-24Dan Walsh 3.3.1-23Dan Walsh 3.3.1-22Dan Walsh 3.3.1-21Dan Walsh 3.3.1-20Dan Walsh 3.3.1-19Dan Walsh 3.3.1-18Dan Walsh 3.3.1-17Dan Walsh 3.3.1-16Dan Walsh 3.3.1-15Bill Nottingham 3.3.1-14Dan Walsh 3.3.1-13Dan Walsh 3.3.1-12Dan Walsh 3.3.1-11Dan Walsh 3.3.1-10Dan Walsh 3.3.1-9Dan Walsh 3.3.1-8Dan Walsh 3.3.1-6Dan Walsh 3.3.1-5Dan Walsh 3.3.1-4Dan Walsh 3.3.1-2Dan Walsh 3.3.1-1Dan Walsh 3.3.0-2Dan Walsh 3.3.0-1Dan Walsh 3.2.9-2Dan Walsh 3.2.9-1Dan Walsh 3.2.8-2Dan Walsh 3.2.8-1Dan Walsh 3.2.7-6Dan Walsh 3.2.7-5Dan Walsh 3.2.7-3Dan Walsh 3.2.7-2Dan Walsh 3.2.7-1Dan Walsh 3.2.6-7Dan Walsh 3.2.6-6Dan Walsh 3.2.6-5Dan Walsh 3.2.6-4Dan Walsh 3.2.6-3Dan Walsh 3.2.6-2Dan Walsh 3.2.6-1Dan Walsh 3.2.5-25Dan Walsh 3.2.5-24Dan Walsh 3.2.5-22Dan Walsh 3.2.5-21Dan Walsh 3.2.5-20Dan Walsh 3.2.5-19Dan Walsh 3.2.5-18Dan Walsh 3.2.5-17Dan Walsh 3.2.5-16Dan Walsh 3.2.5-15Dan Walsh 3.2.5-14Dan Walsh 3.2.5-13Dan Walsh 3.2.5-12Dan Walsh 3.2.5-11Dan Walsh 3.2.5-10Dan Walsh 3.2.5-9Dan Walsh 3.2.5-8Dan Walsh 3.2.5-7Dan Walsh 3.2.5-6Dan Walsh 3.2.5-5Dan Walsh 3.2.5-4Dan Walsh 3.2.5-3Dan Walsh 3.2.5-2Dan Walsh 3.2.5-1Dan Walsh 3.2.4-5Dan Walsh 3.2.4-4Dan Walsh 3.2.4-3Dan Walsh 3.2.4-1Dan Walsh 3.2.4-1Dan Walsh 3.2.3-2Dan Walsh 3.2.3-1Dan Walsh 3.2.2-1Dan Walsh 3.2.1-3Dan Walsh 3.2.1-1Dan Walsh 3.1.2-2Dan Walsh 3.1.2-1Dan Walsh 3.1.1-1Dan Walsh 3.1.0-1Dan Walsh 3.0.8-30Dan Walsh 3.0.8-28Dan Walsh 3.0.8-27Dan Walsh 3.0.8-26Dan Walsh 3.0.8-25Dan Walsh 3.0.8-24Dan Walsh 3.0.8-23Dan Walsh 3.0.8-22Dan Walsh 3.0.8-21Dan Walsh 3.0.8-20Dan Walsh 3.0.8-19Dan Walsh 3.0.8-18Dan Walsh 3.0.8-17Dan Walsh 3.0.8-16Dan Walsh 3.0.8-15Dan Walsh 3.0.8-14Dan Walsh 3.0.8-13Dan Walsh 3.0.8-12Dan Walsh 3.0.8-11Dan Walsh 3.0.8-10Dan Walsh 3.0.8-9Dan Walsh 3.0.8-8Dan Walsh 3.0.8-7Dan Walsh 3.0.8-5Dan Walsh 3.0.8-4Dan Walsh 3.0.8-3Dan Walsh 3.0.8-2Dan Walsh 3.0.8-1Dan Walsh 3.0.7-10Dan Walsh 3.0.7-9Dan Walsh 3.0.7-8Dan Walsh 3.0.7-7Dan Walsh 3.0.7-6Dan Walsh 3.0.7-5Dan Walsh 3.0.7-4Dan Walsh 3.0.7-3Dan Walsh 3.0.7-2Dan Walsh 3.0.7-1Dan Walsh 3.0.6-3Dan Walsh 3.0.6-2Dan Walsh 3.0.6-1Dan Walsh 3.0.5-11Dan Walsh 3.0.5-10Dan Walsh 3.0.5-9Dan Walsh 3.0.5-8Dan Walsh 3.0.5-7Dan Walsh 3.0.5-6Dan Walsh 3.0.5-5Dan Walsh 3.0.5-4Dan Walsh 3.0.5-3Dan Walsh 3.0.5-2Dan Walsh 3.0.5-1Dan Walsh 3.0.4-6Dan Walsh 3.0.4-5Dan Walsh 3.0.4-4Dan Walsh 3.0.4-3Dan Walsh 3.0.4-2Dan Walsh 3.0.4-1Dan Walsh 3.0.3-6Dan Walsh 3.0.3-5Dan Walsh 3.0.3-4Dan Walsh 3.0.3-3Dan Walsh 3.0.3-2Dan Walsh 3.0.3-1Dan Walsh 3.0.2-9Dan Walsh 3.0.2-8Dan Walsh 3.0.2-7Dan Walsh 3.0.2-5Dan Walsh 3.0.2-4Dan Walsh 3.0.2-3Dan Walsh 3.0.2-2Dan Walsh 3.0.1-5Dan Walsh 3.0.1-4Dan Walsh 3.0.1-3Dan Walsh 3.0.1-2Dan Walsh 3.0.1-1Dan Walsh 2.6.5-3Dan Walsh 2.6.5-2Dan Walsh 2.6.4-7Dan Walsh 2.6.4-6Dan Walsh 2.6.4-5Dan Walsh 2.6.4-2Dan Walsh 2.6.4-1Dan Walsh 2.6.3-1Dan Walsh 2.6.2-1Dan Walsh 2.6.1-4Dan Walsh 2.6.1-2Dan Walsh 2.6.1-1Dan Walsh 2.5.12-12Dan Walsh 2.5.12-11Dan Walsh 2.5.12-10Dan Walsh 2.5.12-8Dan Walsh 2.5.12-5Dan Walsh 2.5.12-4Dan Walsh 2.5.12-3Dan Walsh 2.5.12-2Dan Walsh 2.5.12-1Dan Walsh 2.5.11-8Dan Walsh 2.5.11-7Dan Walsh 2.5.11-6Dan Walsh 2.5.11-5Dan Walsh 2.5.11-4Dan Walsh 2.5.11-3Dan Walsh 2.5.11-2Dan Walsh 2.5.11-1Dan Walsh 2.5.10-2Dan Walsh 2.5.10-1Dan Walsh 2.5.9-6Dan Walsh 2.5.9-5Dan Walsh 2.5.9-4Dan Walsh 2.5.9-3Dan Walsh 2.5.9-2Dan Walsh 2.5.8-8Dan Walsh 2.5.8-7Dan Walsh 2.5.8-6Dan Walsh 2.5.8-5Dan Walsh 2.5.8-4Dan Walsh 2.5.8-3Dan Walsh 2.5.8-2Dan Walsh 2.5.8-1Dan Walsh 2.5.7-1Dan Walsh 2.5.6-1Dan Walsh 2.5.5-2Dan Walsh 2.5.5-1Dan Walsh 2.5.4-2Dan Walsh 2.5.4-1Dan Walsh 2.5.3-3Dan Walsh 2.5.3-2Dan Walsh 2.5.3-1Dan Walsh 2.5.2-6Dan Walsh 2.5.2-5Dan Walsh 2.5.2-4Dan Walsh 2.5.2-3Dan Walsh 2.5.2-2Dan Walsh 2.5.2-1Dan Walsh 2.5.1-5Dan Walsh 2.5.1-4Dan Walsh 2.5.1-2Dan Walsh 2.5.1-1Dan Walsh 2.4.6-20Dan Walsh 2.4.6-19Dan Walsh 2.4.6-18Dan Walsh 2.4.6-17Dan Walsh 2.4.6-16Dan Walsh 2.4.6-15Dan Walsh 2.4.6-14Dan Walsh 2.4.6-13Dan Walsh 2.4.6-12Dan Walsh 2.4.6-11Dan Walsh 2.4.6-10Dan Walsh 2.4.6-9Dan Walsh 2.4.6-8Dan Walsh 2.4.6-7Dan Walsh 2.4.6-6Dan Walsh 2.4.6-5Dan Walsh 2.4.6-4Dan Walsh 2.4.6-3Dan Walsh 2.4.6-1Dan Walsh 2.4.5-4Dan Walsh 2.4.5-3Dan Walsh 2.4.5-2Dan Walsh 2.4.5-1Dan Walsh 2.4.4-2Dan Walsh 2.4.4-2Dan Walsh 2.4.4-1Dan Walsh 2.4.3-13Dan Walsh 2.4.3-12Dan Walsh 2.4.3-11Dan Walsh 2.4.3-10Dan Walsh 2.4.3-9Dan Walsh 2.4.3-8Dan Walsh 2.4.3-7Dan Walsh 2.4.3-6Dan Walsh 2.4.3-5Dan Walsh 2.4.3-4Dan Walsh 2.4.3-3Dan Walsh 2.4.3-2Dan Walsh 2.4.3-1Dan Walsh 2.4.2-8Dan Walsh 2.4.2-7James Antill 2.4.2-6Dan Walsh 2.4.2-5Dan Walsh 2.4.2-4Dan Walsh 2.4.2-3Dan Walsh 2.4.2-2Dan Walsh 2.4.2-1Dan Walsh 2.4.1-5Dan Walsh 2.4.1-4Dan Walsh 2.4.1-3Dan Walsh 2.4.1-2Dan Walsh 2.4-4Dan Walsh 2.4-3Dan Walsh 2.4-2Dan Walsh 2.4-1Dan Walsh 2.3.19-4Dan Walsh 2.3.19-3Dan Walsh 2.3.19-2Dan Walsh 2.3.19-1James Antill 2.3.18-10James Antill 2.3.18-9Dan Walsh 2.3.18-8Dan Walsh 2.3.18-7Dan Walsh 2.3.18-6Dan Walsh 2.3.18-5Dan Walsh 2.3.18-4Dan Walsh 2.3.18-3Dan Walsh 2.3.18-2Dan Walsh 2.3.18-1Dan Walsh 2.3.17-2Dan Walsh 2.3.17-1Dan Walsh 2.3.16-9Dan Walsh 2.3.16-8Dan Walsh 2.3.16-7Dan Walsh 2.3.16-6Dan Walsh 2.3.16-5Dan Walsh 2.3.16-4Dan Walsh 2.3.16-2Dan Walsh 2.3.16-1Dan Walsh 2.3.15-2Dan Walsh 2.3.15-1Dan Walsh 2.3.14-8Dan Walsh 2.3.14-7Dan Walsh 2.3.14-6Dan Walsh 2.3.14-4Dan Walsh 2.3.14-3Dan Walsh 2.3.14-2Dan Walsh 2.3.14-1Dan Walsh 2.3.13-6Dan Walsh 2.3.13-5Dan Walsh 2.3.13-4Dan Walsh 2.3.13-3Dan Walsh 2.3.13-2Dan Walsh 2.3.13-1Dan Walsh 2.3.12-2Dan Walsh 2.3.12-1Dan Walsh 2.3.11-1Dan Walsh 2.3.10-7Dan Walsh 2.3.10-6Dan Walsh 2.3.10-3Dan Walsh 2.3.10-1Dan Walsh 2.3.9-6Dan Walsh 2.3.9-5Dan Walsh 2.3.9-4Dan Walsh 2.3.9-3Dan Walsh 2.3.9-2Dan Walsh 2.3.9-1Dan Walsh 2.3.8-2Dan Walsh 2.3.7-1Dan Walsh 2.3.6-4Dan Walsh 2.3.6-3Dan Walsh 2.3.6-2Dan Walsh 2.3.6-1Dan Walsh 2.3.5-1Dan Walsh 2.3.4-1Dan Walsh 2.3.3-20Dan Walsh 2.3.3-19Dan Walsh 2.3.3-18Dan Walsh 2.3.3-17Dan Walsh 2.3.3-16Dan Walsh 2.3.3-15Dan Walsh 2.3.3-14Dan Walsh 2.3.3-13Dan Walsh 2.3.3-12Dan Walsh 2.3.3-11Dan Walsh 2.3.3-10Dan Walsh 2.3.3-9Dan Walsh 2.3.3-8Dan Walsh 2.3.3-7Dan Walsh 2.3.3-6Dan Walsh 2.3.3-5Dan Walsh 2.3.3-4Dan Walsh 2.3.3-3Dan Walsh 2.3.3-2Dan Walsh 2.3.3-1Dan Walsh 2.3.2-4Dan Walsh 2.3.2-3Dan Walsh 2.3.2-2Dan Walsh 2.3.2-1Dan Walsh 2.3.1-1Dan Walsh 2.2.49-1Dan Walsh 2.2.48-1Dan Walsh 2.2.47-5Dan Walsh 2.2.47-4Dan Walsh 2.2.47-3Dan Walsh 2.2.47-1Dan Walsh 2.2.46-2Dan Walsh 2.2.46-1Dan Walsh 2.2.45-3Dan Walsh 2.2.45-2Dan Walsh 2.2.45-1Dan Walsh 2.2.44-1Dan Walsh 2.2.43-4Dan Walsh 2.2.43-3Dan Walsh 2.2.43-2Dan Walsh 2.2.43-1Dan Walsh 2.2.42-4Dan Walsh 2.2.42-3Dan Walsh 2.2.42-2Dan Walsh 2.2.42-1Dan Walsh 2.2.41-1Dan Walsh 2.2.40-2Dan Walsh 2.2.40-1Dan Walsh 2.2.39-2Dan Walsh 2.2.39-1Dan Walsh 2.2.38-6Dan Walsh 2.2.38-5Dan Walsh 2.2.38-4Dan Walsh 2.2.38-3Dan Walsh 2.2.38-2Dan Walsh 2.2.38-1Dan Walsh 2.2.37-1Dan Walsh 2.2.36-2Dan Walsh 2.2.36-1James Antill 2.2.35-2Dan Walsh 2.2.35-1Dan Walsh 2.2.34-3Dan Walsh 2.2.34-2Dan Walsh 2.2.34-1Dan Walsh 2.2.33-1Dan Walsh 2.2.32-2Dan Walsh 2.2.32-1Dan Walsh 2.2.31-1Dan Walsh 2.2.30-2Dan Walsh 2.2.30-1Dan Walsh 2.2.29-6Russell Coker 2.2.29-5Dan Walsh 2.2.29-4Dan Walsh 2.2.29-3Dan Walsh 2.2.29-2Dan Walsh 2.2.29-1Dan Walsh 2.2.28-3Dan Walsh 2.2.28-2Dan Walsh 2.2.28-1Dan Walsh 2.2.27-1Dan Walsh 2.2.25-3Dan Walsh 2.2.25-2Dan Walsh 2.2.24-1Dan Walsh 2.2.23-19Dan Walsh 2.2.23-18Dan Walsh 2.2.23-17Karsten Hopp 2.2.23-16Dan Walsh 2.2.23-15Dan Walsh 2.2.23-14Dan Walsh 2.2.23-13Dan Walsh 2.2.23-12Jeremy Katz - 2.2.23-11Jeremy Katz - 2.2.23-10Dan Walsh 2.2.23-9Dan Walsh 2.2.23-8Dan Walsh 2.2.23-7Dan Walsh 2.2.23-5Dan Walsh 2.2.23-4Dan Walsh 2.2.23-3Dan Walsh 2.2.23-2Dan Walsh 2.2.23-1Dan Walsh 2.2.22-2Dan Walsh 2.2.22-1Dan Walsh 2.2.21-9Dan Walsh 2.2.21-8Dan Walsh 2.2.21-7Dan Walsh 2.2.21-6Dan Walsh 2.2.21-5Dan Walsh 2.2.21-4Dan Walsh 2.2.21-3Dan Walsh 2.2.21-2Dan Walsh 2.2.21-1Dan Walsh 2.2.20-1Dan Walsh 2.2.19-2Dan Walsh 2.2.19-1Dan Walsh 2.2.18-2Dan Walsh 2.2.18-1Dan Walsh 2.2.17-2Dan Walsh 2.2.16-1Dan Walsh 2.2.15-4Dan Walsh 2.2.15-3Dan Walsh 2.2.15-1Dan Walsh 2.2.14-2Dan Walsh 2.2.14-1Dan Walsh 2.2.13-1Dan Walsh 2.2.12-1Dan Walsh 2.2.11-2Dan Walsh 2.2.11-1Dan Walsh 2.2.10-1Dan Walsh 2.2.9-2Dan Walsh 2.2.9-1Dan Walsh 2.2.8-2Dan Walsh 2.2.7-1Dan Walsh 2.2.6-3Dan Walsh 2.2.6-2Dan Walsh 2.2.6-1Dan Walsh 2.2.5-1Dan Walsh 2.2.4-1Dan Walsh 2.2.3-1Dan Walsh 2.2.2-1Dan Walsh 2.2.1-1Dan Walsh 2.1.13-1Dan Walsh 2.1.12-3Dan Walsh 2.1.11-1Dan Walsh 2.1.10-1Jeremy Katz - 2.1.9-2Dan Walsh 2.1.9-1Dan Walsh 2.1.8-3Dan Walsh 2.1.8-2Dan Walsh 2.1.8-1Dan Walsh 2.1.7-4Dan Walsh 2.1.7-3Dan Walsh 2.1.7-2Dan Walsh 2.1.7-1Dan Walsh 2.1.6-24Dan Walsh 2.1.6-23Dan Walsh 2.1.6-22Dan Walsh 2.1.6-21Dan Walsh 2.1.6-20Dan Walsh 2.1.6-18Dan Walsh 2.1.6-17Dan Walsh 2.1.6-16Dan Walsh 2.1.6-15Dan Walsh 2.1.6-14Dan Walsh 2.1.6-13Dan Walsh 2.1.6-11Dan Walsh 2.1.6-10Dan Walsh 2.1.6-9Dan Walsh 2.1.6-8Dan Walsh 2.1.6-5Dan Walsh 2.1.6-4Dan Walsh 2.1.6-3Dan Walsh 2.1.6-2Dan Walsh 2.1.6-1Dan Walsh 2.1.4-2Dan Walsh 2.1.4-1Dan Walsh 2.1.3-1Jeremy Katz - 2.1.2-3Dan Walsh 2.1.2-2Dan Walsh 2.1.2-1Dan Walsh 2.1.1-3Dan Walsh 2.1.1-2Dan Walsh 2.1.1-1Dan Walsh 2.1.0-3Dan Walsh 2.1.0-2.Dan Walsh 2.1.0-1.Dan Walsh 2.0.11-2.Dan Walsh 2.0.11-1.Dan Walsh 2.0.9-1.Dan Walsh 2.0.8-1.Dan Walsh 2.0.7-3Dan Walsh 2.0.7-2Dan Walsh 2.0.6-2Dan Walsh 2.0.5-4Dan Walsh 2.0.5-1Dan Walsh 2.0.4-1Dan Walsh 2.0.2-2Dan Walsh 2.0.2-1Dan Walsh 2.0.1-2Dan Walsh 2.0.1-1- Allow gssd_t domain to manage kernel keyrings of every domain. Resolves: rhbz#1665815 - Add new interface domain_manage_all_domains_keyrings() Resolves: rhbz#1665815- Add interface domain_rw_all_domains_keyrings() Resolves: rhbz#1665815 - Allow gssd_t domain to read/write kernel keyrings of every domain. Resolves: rhbz#1665815- Update snapperd policy to allow snapperd manage all non security dirs. Resolves: rhbz#1661158- Allow nova_t domain to use pam Resolves: rhbz:#1645270 - sysstat: grant sysstat_t the search_dir_perms set Resolves: rhbz#1645271- Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module Resolves: rhbz#1638257- Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging' Resolves: rhbz#1638427- Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t Resolves: rhbz#1638257- Fix missing patch in spec file Resolves: rhbz#1635704- Allow cinder_volume_t domain to dbus chat with systemd_logind_t domain Resolves: rhbz#1635704- Allow neutron domain to read/write /var/run/utmp Resolves: rhbz#1630318- Allow tomcat_domain to read /dev/random Resolves: rhbz#1631666 - Allow neutron_t domain to use pam Resolves: rhbz#1630318- Add interface apache_read_tmp_dirs() - Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs Resolves: rhbz#1622602- Allow tomcat servers to manage usr_t files Resolves: rhbz#1625678 - Dontaudit tomcat serves to append to /dev/random device Resolves: rhbz#1625678 - Allow sys_nice capability to mysqld_t domain - Allow dirsrvadmin_script_t domain to read httpd tmp files Resolves: rhbz#1622602 - Allow syslogd_t domain to manage cert_t files Resolves: rhbz#1615995- Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs Resolves: rhbz#1627114 - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t Resolves: rhbz#1567753- Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs. Resolves: rhbz#1625678 - Allow chronyd_t domain to read virt_var_lib_t files - Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333) Resolves: rhbz#1625613 - Allow tomcat services create link file in /tmp Resolves: rhbz#1624289 - Add boolean: domain_can_mmap_files. Resolves: rhbz#1460322- Make working SELinux sandbox with Wayland. Resolves: rhbz#1624308 - Allow svirt_t domain to mmap svirt_image_t block files Resolves: rhbz#1624224 - Add caps dac_read_search and dav_override to pesign_t domain - Allow iscsid_t domain to mmap userio chr files Resolves: rhbz#1623589 - Add boolean: domain_can_mmap_files. Resolves: rhbz#1460322 - Add execute_no_trans permission to mmap_exec_file_perms pattern - Allow sudodomain to search caller domain proc info - Allow xdm_t domain to mmap and read cert_t files - Replace optional policy blocks to make dbus interfaces effective Resolves: rhbz#1624414 - Add interface dev_map_userio_dev()- Allow readhead_t domain to mmap own pid files Resolves: rhbz#1614169- Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket - Allow httpd_t domain to mmap tmp files Resolves: rhbz#1608355 - Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files - Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks - Label /dev/tpmrm[0-9]* as tpm_device_t - Allow semanage_t domain mmap usr_t files Resolves: rhbz#1622607 - Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t- Allow nagios_script_t domain to mmap nagios_log_t files Resolves: rhbz#1620013 - Allow nagios_script_t domain to mmap nagios_spool_t files Resolves: rhbz#1620013 - Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctl Resolves: rhbz#1622197 - Update selinux_validate_context() interface to allow caller domain to mmap security_t files Resolves: rhbz#1622061- Allow virtd_t domain to create netlink_socket - Allow rpm_t domain to write to audit - Allow rpm domain to mmap rpm_var_lib_t files Resolves: rhbz#1619785 - Allow nagios_script_t domain to mmap nagios_etc_t files Resolves: rhbz#1620013 - Update nscd_socket_use() to allow caller domain to stream connect to nscd_t Resolves: rhbz#1460715 - Allow secadm_t domain to mmap audit config and log files - Allow insmod_t domain to read iptables pid files - Allow systemd to mounton /etc Resolves: rhbz#1619785- Allow kdumpctl_t domain to getattr fixed disk device in mls Resolves: rhbz#1615342 - Allow initrc_domain to mmap all binaries labeled as systemprocess_entry Resolves: rhbz#1615342- Allow virtlogd to execute itself Resolves: rhbz#1598392- Allow kdumpctl_t domain to manage kdumpctl_tmp_t fifo files Resolves: rhbz#1615342 - Allow kdumpctl to write to files on all levels Resolves: rhbz#1615342 - Fix typo in radius policy Resolves: rhbz#1619197 - Allow httpd_t domain to mmap httpd_config_t files Resolves: rhbz#1615894 - Add interface dbus_acquire_svc_system_dbusd() - Allow sanlock_t domain to connectto to unix_stream_socket Resolves: rhbz#1614965 - Update nfsd_t policy because of ganesha features Resolves: rhbz#1511489 - Allow conman to getattr devpts_t Resolves: rhbz#1377915 - Allow tomcat_domain to connect to smtp ports Resolves: rhbz#1253502 - Allow tomcat_t domain to mmap tomcat_var_lib_t files Resolves: rhbz#1618519 - Allow slapd_t domain to mmap slapd_var_run_t files Resolves: rhbz#1615319 - Allow nagios_t domain to mmap nagios_log_t files Resolves: rhbz#1618675 - Allow nagios to exec itself and mmap nagios spool files BZ(1559683) - Allow nagios to mmap nagios config files BZ(1559683) - Allow kpropd_t domain to mmap krb5kdc_principal_t files Resolves: rhbz#1619252 - Update syslogd policy to make working elasticsearch - Label tcp and udp ports 9200 as wap_wsp_port - Allow few domains to rw inherited kdumpctl tmp pipes Resolves: rhbz#1615342- Allow systemd_dbusd_t domain read/write to nvme devices Resolves: rhbz#1614236 - Allow mysqld_safe_t do execute itself - Allow smbd_t domain to chat via dbus with avahi daemon Resolves: rhbz#1600157 - cupsd_t domain will create /etc/cupsd/ppd as cupsd_etc_rw_t Resolves: rhbz#1452595 - Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645) Resolves: rhbz#1452444 - Update screen_role_template to allow caller domain to have screen_exec_t as entrypoint do new domain Resolves: rhbz#1384769 - Add alias httpd__script_t to _script_t to make sepolicy generate working Resolves: rhbz#1271324 - Allow kprop_t domain to read network state Resolves: rhbz#1600705 - Allow sysadm_t domain to accept socket Resolves: rhbz#1557299 - Allow sshd_t domain to mmap user_tmp_t files Resolves: rhbz#1613437- Allow sshd_t domain to mmap user_tmp_t files Resolves: rhbz#1613437- Allow kprop_t domain to read network state Resolves: rhbz#1600705- Allow kpropd domain to exec itself Resolves: rhbz#1600705 - Allow ipmievd_t to mmap kernel modules BZ(1552535) - Allow hsqldb_t domain to mmap own temp files Resolves: rhbz#1612143 - Allow hsqldb_t domain to read cgroup files Resolves: rhbz#1612143 - Allow rngd_t domain to read generic certs Resolves: rhbz#1612456 - Allow innd_t domain to mmap own var_lib_t files Resolves: rhbz#1600591 - Update screen_role_temaplate interface Resolves: rhbz#1384769 - Allow cupsd_t to create cupsd_etc_t dirs Resolves: rhbz#1452595 - Allow chronyd_t domain to mmap own tmpfs files Resolves: rhbz#1596563 - Allow cyrus domain to mmap own var_lib_t and var_run files Resolves: rhbz#1610374 - Allow sysadm_t domain to create rawip sockets Resolves: rhbz#1571591 - Allow sysadm_t domain to listen on socket Resolves: rhbz#1557299 - Update sudo_role_template() to allow caller domain also setattr generic ptys Resolves: rhbz#1564470 - Allow netutils_t domain to create bluetooth sockets Resolves: rhbz#1600586- Allow innd_t domain to mmap own var_lib_t files Resolves: rhbz#1600591 - Update screen_role_temaplate interface Resolves: rhbz#1384769 - Allow cupsd_t to create cupsd_etc_t dirs Resolves: rhbz#1452595 - Allow chronyd_t domain to mmap own tmpfs files Resolves: rhbz#1596563 - Allow cyrus domain to mmap own var_lib_t and var_run files Resolves: rhbz#1610374 - Allow sysadm_t domain to create rawip sockets Resolves: rhbz#1571591 - Allow sysadm_t domain to listen on socket Resolves: rhbz#1557299 - Update sudo_role_template() to allow caller domain also setattr generic ptys Resolves: rhbz#1564470 - Allow netutils_t domain to create bluetooth sockets Resolves: rhbz#1600586- Allow virtlogd_t domain to chat via dbus with systemd_logind Resolves: rhbz#1593740- Allow sblim_sfcbd_t domain to mmap own tmpfs files Resolves: rhbz#1609384 - Update logging_manage_all_logs() interface to allow caller domain map all logfiles Resolves: rhbz#1592028- Dontaudit oracleasm_t domain to request sys_admin capability - Allow iscsid_t domain to load kernel module Resolves: rhbz#1589295 - Update rhcs contexts to reflects the latest fenced changes - Allow httpd_t domain to rw user_tmp_t files Resolves: rhbz#1608355 - /usr/libexec/udisks2/udisksd should be labeled as devicekit_disk_exec_t Resolves: rhbz#1521063 - Allow tangd_t dac_read_search Resolves: rhbz#1607810 - Allow glusterd_t domain to mmap user_tmp_t files - Allow mongodb_t domain to mmap own var_lib_t files Resolves: rhbz#1607729 - Allow iscsid_t domain to mmap sysfs_t files Resolves: rhbz#1602508 - Allow tomcat_domain to search cgroup dirs Resolves: rhbz#1600188 - Allow httpd_t domain to mmap own cache files Resolves: rhbz#1603505 - Allow cupsd_t domain to mmap cupsd_etc_t files Resolves: rhbz#1599694 - Allow kadmind_t domain to mmap krb5kdc_principal_t Resolves: rhbz#1601004 - Allow virtlogd_t domain to read virt_etc_t link files Resolves: rhbz#1598593 - Allow dirsrv_t domain to read crack db Resolves: rhbz#1599726 - Dontaudit pegasus_t to require sys_admin capability Resolves: rhbz#1374570 - Allow mysqld_t domain to exec mysqld_exec_t binary files - Allow abrt_t odmain to read rhsmcertd lib files Resolves: rhbz#1601389 - Allow winbind_t domain to request kernel module loads Resolves: rhbz#1599236 - Allow gpsd_t domain to getsession and mmap own tmpfs files Resolves: rhbz#1598388 - Allow smbd_t send to nmbd_t via dgram sockets BZ(1563791) Resolves: rhbz#1600157 - Allow tomcat_domain to read cgroup_t files Resolves: rhbz#1601151 - Allow varnishlog_t domain to mmap varnishd_var_lib_t files Resolves: rhbz#1600704 - Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415) Resolves: rhbz#1600692 - Fix ntp SELinux module - Allow innd_t domain to mmap news_spool_t files Resolves: rhbz#1600591 - Allow haproxy daemon to reexec itself. BZ(1447800) Resolves: rhbz#1600578 - Label HOME_DIR/mozilla.pdf file as mozilla_home_t instead of user_home_t Resolves: rhbz#1559859 - Allow pkcs_slotd_t domain to mmap own tmpfs files Resolves: rhbz#1600434 - Allow fenced_t domain to reboot Resolves: rhbz#1293384 - Allow bluetooth_t domain listen on bluetooth sockets BZ(1549247) Resolves: rhbz#1557299 - Allow lircd to use nsswitch. BZ(1401375) - Allow targetd_t domain mmap lvm config files Resolves: rhbz#1546671 - Allow amanda_t domain to read network system state Resolves: rhbz#1452444 - Allow abrt_t domain to read rhsmcertd logs Resolves: rhbz#1492059 - Allow application_domain_type also mmap inherited user temp files BZ(1552765) Resolves: rhbz#1608421 - Allow ipsec_t domain to read l2tpd pid files Resolves: rhbz#1607994 - Allow systemd_tmpfiles_t do mmap system db files - Improve domain_transition_pattern to allow mmap entrypoint bin file. Resolves: rhbz#1460322 - Allow nsswitch_domain to mmap passwd_file_t files BZ(1518655) Resolves: rhbz#1600528 - Dontaudit syslogd to watching top llevel dirs when imfile module is enabled Resolves: rhbz#1601928 - Allow ipsec_t can exec ipsec_exec_t Resolves: rhbz#1600684 - Allow netutils_t domain to mmap usmmon device Resolves: rhbz#1600586 - Allow netlabel_mgmt_t domain to read sssd public files, stream connect to sssd_t BZ(1483655) - Allow userdomain sudo domains to use generic ptys Resolves: rhbz#1564470 - Allow traceroute to create icmp packets Resolves: rhbz#1548350 - Allow systemd domain to mmap lvm config files BZ(1594584) - Add new interface lvm_map_config - refpolicy: Update for kernel sctp support Resolves: rhbz#1597111 Add additional entries to support the kernel SCTP implementation introduced in kernel 4.16- Update oddjob_domtrans_mkhomedir() interface to allow caller domain also mmap oddjob_mkhomedir_exec_t files Resolves: rhbz#1596306 - Update rhcs_rw_cluster_tmpfs() interface to allow caller domain to mmap cluster_tmpfs_t files Resolves: rhbz#1589257 - Allow radiusd_t domain to read network sysctls Resolves: rhbz#1516233 - Allow chronyc_t domain to use nscd shm Resolves: rhbz#1596563 - Label /var/lib/tomcats dir as tomcat_var_lib_t Resolves: rhbz#1596367 - Allow lsmd_t domain to mmap lsmd_plugin_exec_t files Resolves: rhbz#bea0c8174 - Label /usr/sbin/rhn_check-[0-9]+.[0-9]+ as rpm_exec_t Resolves: rhbz#1596509 - Update seutil_exec_loadpolicy() interface to allow caller domain to mmap load_policy_exec_t files Resolves: rhbz#1596072 - Allow xdm_t to read systemd hwdb Resolves: rhbz#1596720 - Allow dhcpc_t domain to mmap files labeled as ping_exec_t Resolves: rhbz#1596065- Allow tangd_t domain to create tcp sockets Resolves: rhbz#1595775 - Update postfix policy to allow postfix_master_t domain to mmap all postfix* binaries Resolves: rhbz#1595328 - Allow amanda_t domain to have setgid capability Resolves: rhbz#1452444 - Update usermanage_domtrans_useradd() to allow caller domain to mmap useradd_exec_t files Resolves: rhbz#1595667- Allow abrt_watch_log_t domain to mmap binaries with label abrt_dump_oops_exec_t Resolves: rhbz#1591191 - Update cups_filetrans_named_content() to allow caller domain create ppd directory with cupsd_etc_rw_t label Resolves: rhbz#1452595 - Allow abrt_t domain to write to rhsmcertd pid files Resolves: rhbz#1492059 - Allow pegasus_t domain to eexec lvm binaries and allow read/write access to lvm control Resolves: rhbz#1463470 - Add vhostmd_t domain to read/write to svirt images Resolves: rhbz#1465276 - Dontaudit action when abrt-hook-ccpp is writing to nscd sockets Resolves: rhbz#1460715 - Update openvswitch policy Resolves: rhbz#1594729 - Update kdump_manage_kdumpctl_tmp_files() interface to allow caller domain also mmap kdumpctl_tmp_t files Resolves: rhbz#1583084 - Allow sssd_t and slpad_t domains to mmap generic certs Resolves: rhbz#1592016 Resolves: rhbz#1592019 - Allow oddjob_t domain to mmap binary files as oddjob_mkhomedir_exec_t files Resolves: rhbz#1592022 - Update dbus_system_domain() interface to allow system_dbusd_t domain to mmap binary file from second parameter Resolves: rhbz#1583080 - Allow chronyc_t domain use inherited user ttys Resolves: rhbz#1593267 - Allow stapserver_t domain to mmap own tmp files Resolves: rhbz#1593122 - Allow sssd_t domain to mmap files labeled as sssd_selinux_manager_exec_t Resolves: rhbz#1592026 - Update policy for ypserv_t domain Resolves: rhbz#1592032 - Allow abrt_dump_oops_t domain to mmap all non security files Resolves: rhbz#1593728 - Allow svirt_t domain mmap svirt_image_t files Resolves: rhbz#1592688 - Allow virtlogd_t domain to write inhibit systemd pipes. Resolves: rhbz#1593740 - Allow sysadm_t and staff_t domains to use sudo io logging Resolves: rhbz#1564470 - Allow sysadm_t domain create sctp sockets Resolves: rhbz#1571591 - Update mount_domtrans() interface to allow caller domain mmap mount_exec_t Resolves: rhbz#1592025 - Allow dhcpc_t to mmap all binaries with label hostname_exec_t, ifconfig_exec_t and netutils_exec_t Resolves: rhbz#1594661- Fix typo in logwatch interface file - Allow spamd_t to manage logwatch_cache_t files/dirs - Allow dnsmasw_t domain to create own tmp files and manage mnt files - Allow fail2ban_client_t to inherit rlimit information from parent process Resolves: rhbz#1513100 - Allow nscd_t to read kernel sysctls Resolves: rhbz#1512852 - Label /var/log/conman.d as conman_log_t Resolves: rhbz#1538363 - Add dac_override capability to tor_t domain Resolves: rhbz#1540711 - Allow certmonger_t to readwrite to user_tmp_t dirs Resolves: rhbz#1543382 - Allow abrt_upload_watch_t domain to read general certs Resolves: rhbz#1545098 - Update postfix_domtrans_master() interface to allow caller domain also mmap postfix_master_exec_t binary Resolves: rhbz#1583087 - Allow postfix_domain to mmap postfix_qmgr_exec_t binaries Resolves: rhbz#1583088 - Allow postfix_domain to mmap postfix_pickup_exec_t binaries Resolves: rhbz#1583091 - Allow chornyd_t read phc2sys_t shared memory Resolves: rhbz#1578883 - Allow virt_qemu_ga_t read utmp Resolves: rhbz#1571202 - Add several allow rules for pesign policy: Resolves: rhbz#1468744 - Allow pesign domain to read /dev/random - Allow pesign domain to create netlink_kobject_uevent_t sockets - Allow pesign domain create own tmp files - Add setgid and setuid capabilities to mysqlfd_safe_t domain Resolves: rhbz#1474440 - Add tomcat_can_network_connect_db boolean Resolves: rhbz#1477948 - Update virt_use_sanlock() boolean to read sanlock state Resolves: rhbz#1448799 - Add sanlock_read_state() interface - Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026) Resolves: rhbz#1563423 - Update abrt_domtrans and abrt_exec() interfaces to allow caller domain to mmap binary file Resolves:rhbz#1583080 - Update nscd_domtrans and nscd_exec interfaces to allow caller domain also mmap nscd binaries Resolves: rhbz#1583086 - Update snapperd_domtrans() interface to allow caller domain to mmap snapperd_exec_t file Resolves: rhbz#1583802 - Allow zoneminder_t to getattr of fs_t Resolves: rhbz#1585328 - Fix denials during ipa-server-install process on F27+ Resolves: rhbz#1586029 - Allow ipa_dnskey_t to exec ipa_dnskey_exec_t files Resolves: rhbz#1586033 - Allow rhsmcertd_t domain to send signull to postgresql_t domain Resolves: rhbz#1588119 - Allow policykit_t domain to dbus chat with dhcpc_t Resolves: rhbz#1364513 - Adding new boolean keepalived_connect_any() Resolves: rhbz#1443473 - Allow amanda to create own amanda_tmpfs_t files Resolves: rhbz#1452444 - Add amanda_tmpfs_t label. BZ(1243752) - Allow gdomap_t domain to connect to qdomap_port_t Resolves: rhbz#1551944 - Fix typos in sge - Fix typo in openvswitch policy - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type - Allow sshd_keygen_t to execute plymouthd Resolves: rhbz#1583531 - Update seutil_domtrans_setfiles() interface to allow caller domain to do mmap on setfiles_exec_t binary Resolves: rhbz#1583090 - Allow systemd_networkd_t create and relabel tun sockets Resolves: rhbz#1583830 - Allow map audisp_exec_t files fordomains executing this binary Resolves: rhbz#1586042 - Add new interface postgresql_signull() - Add fs_read_xenfs_files() interface.- /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type - Allow dac override capability to mandb_t domain BZ(1529399) Resolves: rhbz#1423361 - Allow inetd_child process to chat via dbus with abrt Resolves: rhbz#1428805 - Allow zabbix_agent_t domain to connect to redis_port_t Resolves: rhbz#1418860 - Allow rhsmcertd_t domain to read xenfs_t files Resolves: rhbz#1405870 - Allow zabbix_agent_t to run zabbix scripts Resolves: rhbz#1380697 - Allow rabbitmq_t domain to create own tmp files/dirs Resolves: rhbz#1546897 - Allow policykit_t mmap policykit_auth_exec_t files Resolves: rhbz#1583082 - Allow ipmievd_t domain to read general certs Resolves: rhbz#1514591 - Add sys_ptrace capability to pcp_pmie_t domain - Allow squid domain to exec ldconfig Resolves: rhbz#1532017 - Make working gpg agent in gpg_agent_t domain Resolves: rhbz#1535109 - Update gpg SELinux policy module - Allow kexec to read kernel module files in /usr/lib/modules. Resolves: rhbz#1536690 - Allow mailman_domain to read system network state Resolves: rhbz#1413510 - Allow mailman_mail_t domain to search for apache configs Resolves: rhbz#1413510 - Allow openvswitch_t domain to read neutron state and read/write fixed disk devices Resolves: rhbz#1499208 - Allow antivirus_domain to read all domain system state Resolves: rhbz#1560986 - Allow targetd_t domain to red gconf_home_t files/dirs Resolves: rhbz#1546671 - Allow freeipmi domain to map sysfs_t files Resolves: rhbz#1575918 - Label /usr/libexec/bluetooth/obexd as obexd_exec_t Resolves: rhbz#1351750 - Update rhcs SELinux module Resolves: rhbz#1589257 - Allow iscsid_t domain mmap kernel modules Resolves: rhbz#1589295 - Allow iscsid_t domain mmap own tmp files Resolves: rhbz#1589295 - Update iscsid_domtrans() interface to allow mmap iscsid_exec_t binary Resolves: rhbz#1589295 - Update nscd_socket_use interface to allow caller domain also mmap nscd_var_run_t files. Resolves: rhbz#1589271 - Allow nscd_t domain to mmap system_db_t files Resolves: rhbz#1589271 - Add interface nagios_unconfined_signull() - Allow lircd_t domain read sssd public files Add setgid capability to lircd_t domain Resolves: rhbz#1550700 - Add missing requires - Allow tomcat domain sends email Resolves: rhbz#1585184 - Allow memcached_t domain nnp_transition becuase of systemd security features BZ(1514867) Resolves: rhbz#1585714 - Allow kdump_t domain to map /boot files Resolves: rhbz#1588884 - Fix typo in netutils policy - Allow confined users get AFS tokens Resolves: rhbz#1417671 - Allow sysadm_t domain to chat via dbus Resolves: rhbz#1582146 - Associate sysctl_kernel_t type with filesystem attribute - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets Resolves: rhbz#1557299 - Allow user_t and staff_t domains create netlink tcpdiag sockets Resolves: rhbz#1557281 - Add interface dev_map_sysfs - Allow xdm_t domain to execute xdm_var_lib_t files Resolves: rhbz#1589139 - Allow syslogd_t domain to send signull to nagios_unconfined_plugin_t Resolves: rhbz#1569344 - Label /dev/vhost-vsock char device as vhost_device_t - Add files_map_boot_files() interface Resolves: rhbz#1588884 - Update traceroute_t domain to allow create dccp sockets Resolves: rhbz#1548350- Update ctdb domain to support gNFS setup Resolves: rhbz#1576818 - Allow authconfig_t dbus chat with policykit Resolves: rhbz#1551241 - Allow lircd_t domain to read passwd_file_t Resolves: rhbz:#1550700 - Allow lircd_t domain to read system state Resolves: rhbz#1550700 - Allow smbcontrol_t to mmap samba_var_t files and allow winbind create sockets BZ(1559795) Resolves: rhbz#1574521 - Allow tangd_t domain read certs Resolves: rhbz#1509055 - Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db is turned on Resolves: rhbz:#1579219 - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp Resolves: rhbz#1574418 - Allow ctdb_t domain modify ctdb_exec_t files Resolves: rhbz#1572584 - Allow chrome_sandbox_t to mmap tmp files Resolves: rhbz#1574392 - Allow ulogd_t to create netlink_netfilter sockets. Resolves: rhbz#1575924 - Update ulogd SELinux security policy - Allow rhsmcertd_t domain send signull to apache processes Resolves: rhbz#1576555 - Allow freeipmi domain to read sysfs_t files Resolves: rhbz#1575918 - Allow smbcontrol_t to create dirs with samba_var_t label Resolves: rhbz#1574521 - Allow swnserve_t domain to stream connect to sasl domain Resolves: rhbz#1574537 - Allow SELinux users (except guest and xguest) to using bluetooth sockets Resolves: rhbz#1557299 - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets Resolves: rhbz#1557299 - Fix broken sysadm SELinux module Resolves: rhbz#1557311 - Allow user_t and staff_t domains create netlink tcpdiag sockets Resolves: rhbz#1557281 - Update ssh_domtrans_keygen interface to allow mmap ssh_keygen_exec_t binary file Resolves: rhbz#1583089 - Allow systemd_networkd_t to read/write tun tap devices Resolves: rhbz#1583830 - Add bridge_socket, dccp_socket, ib_socket and mpls_socket to socket_class_set Resolves: rhbz#1583771 - Allow audisp_t domain to mmap audisp_exec_t binary Resolves: rhbz#1583551 - Fix duplicates in sysadm.te file Resolves: rhbz#1307183 - Allow sysadm_u use xdm Resolves: rhbz#1307183 - Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Fix duplicates in sysadm.te file Resolves: rhbz#1307183- Allow sysadm_u use xdm Resolves: rhbz#1307183- Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db is turned on Resolves: rhbz:#1579219 - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp Resolves: rhbz#1574418 - Allow chrome_sandbox_t to mmap tmp files Resolves: rhbz#1574392 - Allow ulogd_t to create netlink_netfilter sockets. Resolves: rhbz#1575924 - Update ulogd SELinux security policy - Allow rhsmcertd_t domain send signull to apache processes Resolves: rhbz#1576555 - Allow freeipmi domain to read sysfs_t files Resolves: rhbz#1575918 - Allow smbcontrol_t to create dirs with samba_var_t label Resolves: rhbz#1574521 - Allow swnserve_t domain to stream connect to sasl domain Resolves: rhbz#1574537 - Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Improve procmail_domtrans() to allow mmaping procmail_exec_t - Allow hypervvssd_t domain to read fixed disk devices Resolves: rhbz#1581225 - Improve modutils_domtrans_insmod() interface to mmap insmod_exec_t binaries Resolves: rhbz#1581551 - Improve iptables_domtrans() interface to allow mmaping iptables_exec_t binary Resolves: rhbz#1581551 - Improve auth_domtrans_login_programinterface to allow also mmap login_exec_t binaries Resolves: rhbz#1581551 - Improve auth_domtrans_chk_passwd() interface to allow also mmaping chkpwd_exec_t binaries. Resolves: rhbz#1581551 - Allow mmap dhcpc_exec_t binaries in sysnet_domtrans_dhcpc interface- Add dbus_stream_connect_system_dbusd() interface. - Allow pegasus_t domain to mount tracefs_t filesystem Resolves:rhbz#1374570 - Allow psad_t domain to read all domains state Resolves: rhbz#1558439 - Add net_raw capability to named_t domain BZ(1545586) - Allow tomcat_t domain to connect to mongod_t tcp port Resolves:rhbz#1539748 - Allow dovecot and postfix to connect to systemd stream sockets Resolves: rhbz#1368642 - Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t Resolves:rhbz#1351750 - Rename tang policy to tangd - Add interface systemd_rfkill_domtrans() - Allow users staff and sysadm to run wireshark on own domain Resolves:rhbz#1546362 - Allow systemd-bootchart to create own tmpfs files Resolves:rhbz#1510412- Rename tang policy to tangd - Allow virtd_t domain to relabel virt_var_lib_t files Resolves: rhbz#1558121 - Allow logrotate_t domain to stop services via systemd Resolves: rhbz#1527522 - Add tang policy Resolves: rhbz#1509055 - Allow mozilla_plugin_t to create mozilla.pdf file in user homedir with label mozilla_home_t Resolves: rhbz#1559859 - Improve snapperd SELinux policy Resolves: rhbz#1365555 - Allow snapperd_t daemon to create unlabeled dirs. Resolves: rhbz#1365555 - We have inconsistency in cgi templates with upstream, we use _content_t, but refpolicy use httpd__content_t. Created aliasses to make it consistence Resolves: rhbz#1271324 - Allow Openvswitch adding netdev bridge ovs 2.7.2.10 FDP Resolves: rhbz#1503835 - Add new Boolean tomcat_use_execmem Resolves: rhbz#1565226 - Allow domain transition from logrotate_t to chronyc_t Resolves: rhbz#1568281 - Allow nfsd_t domain to read/write sysctl fs files Resolves: rhbz#1516593 - Allow conman to read system state Resolves: rhbz#1377915 - Allow lircd_t to exec shell and add capabilities dac_read_search and dac_override Resolves: rhbz#1550700 - Allow usbmuxd to access /run/udev/data/+usb:*. Resolves: rhbz#1521054 - Allow abrt_t domain to manage kdump crash files Resolves: rhbz#1491585 - Allow systemd to use virtio console Resolves: rhbz#1558121 - Allow transition from sysadm role into mdadm_t domain. Resolves: rhbz#1551568 - Label /dev/op_panel and /dev/opal-prd as opal_device_t Resolves: rhbz#1537618 - Label /run/ebtables.lock as iptables_var_run_t Resolves: rhbz#1511437 - Allow udev_t domain to manage udev_rules_t char files. Resolves: rhbz#1545094 - Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin. Resolves: rhbz#1567753 - Fix filesystem inteface file, we don't have nsfs_fs_t type, just nsfs_t Resolves: rhbz#1547700 - Allow iptables_t domain to create dirs in etc_t with system_conf_t labels- Add new boolean redis_enable_notify() Resolves: rhbz#1421326 - Label /var/log/shibboleth-www(/.*) as httpd_sys_rw_content_t Resolves: rhbz#1549514 - Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/ Resolves: rbhz#1463593 - Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_t Resolves: rbhz#1463593- Backport several changes for snapperdfrom Fedora Rawhide Resolves: rhbz#1556798 - Allow snapperd_t to set priority for kernel processes Resolves: rhbz#1556798 - Make ganesha nfs server. Resolves: rhbz#1511489 - Allow vxfs filesystem to use SELinux labels Resolves: rhbz#1482880 - Add map permission to selinux-policy Resolves: rhbz#1460322- Label /usr/libexec/dbus-1/dbus-daemon-launch-helper as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled. Resolves: rhbz#1546721- Allow openvswitch_t stream connect svirt_t Resolves: rhbz#1540702- Allow openvswitch domain to manage svirt_tmp_t sock files Resolves: rhbz#1540702 - Fix broken systemd_tmpfiles_run() interface- Allow dirsrv_t domain to create tmp link files Resolves: rhbz#1536011 - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t Resolves: rhbz#1428568 - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries - Allow ipsec_mgmt_t nnp domain transition to ifconfig_t Resolves: rhbz#1539416- Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t Resolves: rhbz#1540702 - Allow keepalived_t domain getattr proc filesystem Resolves: rhbz#1477542 - Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t Resolves: rhbz#1538544 - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t Resolves: rhbz:#1539416 - Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t Resolves: rhbz#1479350- Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets Resolves: rhbz#1535196 - Add new interface ppp_filetrans_named_content() Resolves: rhbz#1530601 - Allow keepalived_t read sysctl_net_t files Resolves: rhbz#1477542 - Allow puppetmaster_t domtran to puppetagent_t Resolves: rhbz#1376893 - Allow kdump_t domain to read kernel ring buffer Resolves: rhbz#1540004 - Allow ipsec_t domain to exec ifconfig_exec_t binaries. Resolves: rhbz#1539416 - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock Resolves: rhbz#1530601 - Allow updpwd_t domain to create files in /etc with shadow_t label Resolves: rhbz#1412838 - Allow iptables sysctl load list support with SELinux enforced Resolves: rhbz#1535572- Allow virt_domains to acces infiniband pkeys. Resolves: rhbz#1533183 - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t Resolves: rhbz#1535133 - Allow audisp_remote_t domain write to files on all levels Resolves: rhbz#1534924- Allow vmtools_t domain creating vmware_log_t files Resolves: rhbz#1507048 - Allow openvswitch_t domain to acces infiniband devices Resolves: rhbz#1532705- Allow chronyc_t domain to manage chronyd_keys_t files. Resolves: rhbz#1530525 - Make virtlog_t domain system dbus client Resolves: rhbz#1481109 - Update openvswitch SELinux module Resolves: rhbz#1482682 - Allow virtd_t to create also sock_files with label virt_var_run_t Resolves: rhbz#1484075- Allow domains that manage logfiles to man logdirs Resolves: rhbz#1523811- Label /dev/drm_dp_aux* as xserver_misc_device_t Resolves: rhbz#1520897 - Allow sysadm_t to run puppet_exec_t binaries as puppet_t Resolves: rhbz#1255745- Allow tomcat_t to manage pki_tomcat pid files Resolves: rhbz#1478371 - networkmanager: allow talking to openvswitch Resolves: rhbz#1517247 - Allow networkmanager_t and opensm_t to manage subned endports for IPoIB VLANs Resolves: rhbz#1517895 - Allow domains networkmanager_t and opensm_t to control IPoIB VLANs Resolves: rhbz#1517744 - Fix typo in guest interface file Resolves: rhbz#1468254 - Allow isnsd_t domain to accept tcp connections. Resolves: rhbz#1390208- Allow getty to use usbttys Resolves: rhbz#1514235- Allow ldap_t domain to manage also slapd_tmp_t lnk files Resolves: rhbz#1510883 - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t Resolves: rhbz:#1508360 - Add dac_read_search and dac_override capabilities to ganesha Resolves: rhbz#1483451- Add dependency for policycoreutils-2.5.18 becuase of new cgroup_seclabel policy capability Resolves: rhbz#1510145- Allow jabber domains to connect to postgresql ports Resolves: rhbz#1438489 - Dontaudit accountsd domain creating dirs in /root Resolves: rhbz#1456760 - Dontaudit slapd_t to block suspend system Resolves: rhbz: #1479759 - Allow spamc_t to stream connect to cyrus. Resolves: rhbz#1382955 - allow imapd to read /proc/net/unix file Resolves: rhbz#1393030 - Allow passenger to connect to mysqld_port_t Resolves: rhbz#1433464- Allow chronyc_t domain to use user_ptys Resolves: rhbz#1470150 - allow ptp4l to read /proc/net/unix file - Allow conmand to use usb ttys. Resolves: rhbz#1505121 - Label all files /var/log/opensm.* as opensm_log_t because opensm creating new log files with name opensm-subnet.lst Resolves: rhbz#1505845 - Allow chronyd daemon to execute chronyc. Resolves: rhbz#1508486 - Allow firewalld exec ldconfig. Resolves: rhbz#1375576 - Allow mozilla_plugin_t domain to dbus chat with devicekit Resolves: rhbz#1460477 - Dontaudit leaked logwatch pipes Resolves: rhbz#1450119 - Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon. Resolves: rhbz#1507048 - Allow httpd_t domain to execute hugetlbfs_t files Resolves: rhbz#1507682 - Allow nfsd_t domain to read configfs_t files/dirs Resolves: rhbz#1439442 - Hide all allow rules with ptrace inside deny_ptrace boolean Resolves: rhbz#1421075 - Allow tgtd_t domain to read generic certs Resolves: rhbz#1438532 - Allow ptp4l to send msgs via dgram socket to unprivileged user domains Resolves: rhbz#1429853 - Allow dirsrv_snmp_t to use inherited user ptys and read system state Resolves: rhbz#1428568 - Allow glusterd_t domain to create own tmpfs dirs/files Resolves: rhbz#1411310 - Allow keepalived stream connect to snmp Resolves: rhbz#1401556 - After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy Resolves: rhbz#1507089- Allow pegasus_openlmi_services_t to read generic certs Resolves: rhbz#1462292 - Allow ganesha_t domain to read random device Resolves: rhbz#1494382 - Allow zabbix_t domain to change its resource limits Resolves: rhbz:#1504074 - Add new boolean nagios_use_nfs Resolves: rhbz#1504826 - Allow system_mail_t to search network sysctls Resolves: rhbz#1505779 - Add samba_manage_var_dirs() interface - Fix typo bug in virt filecontext file - Allow nagios_script_t to read nagios_spool_t files Resolves: rhbz#1426824 - Allow samba to manage var dirs/files Resolves: rhbz#1415088 - Allow sbd_t to create own sbd_tmpfs_t dirs/files Resolves: rhbz#1380795 - Allow firewalld and networkmanager to chat with hypervkvp via dbus Resolves: rhbz#1377276 - Allow dmidecode to read rhsmcert_log_t files Resolves: rhbz#1300799 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow pegasus_openlmi_services_t to read generic certs Resolves: rhbz#1462292 - Allow ganesha_t domain to read random device Resolves: rhbz#1494382 - Allow zabbix_t domain to change its resource limits Resolves: rhbz:#1504074 - Add new boolean nagios_use_nfs Resolves: rhbz#1504826 - Allow system_mail_t to search network sysctls Resolves: rhbz#1505779 - Add samba_manage_var_dirs() interface - Fix typo bug in virt filecontext file - Allow nagios_script_t to read nagios_spool_t files Resolves: rhbz#1426824 - Allow samba to manage var dirs/files Resolves: rhbz#1415088 - Allow sbd_t to create own sbd_tmpfs_t dirs/files Resolves: rhbz#1380795 - Allow firewalld and networkmanager to chat with hypervkvp via dbus Resolves: rhbz#1377276 - Allow dmidecode to read rhsmcert_log_t files Resolves: rhbz#1300799 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow chronyd_t do request kernel module and block_suspend capability Resolves: rhbz#1350765 - Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label Resolves: rhbz#1447278 - Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables Resolves: rhbz#1491994 - Allow svnserve to use kerberos Resolves: rhbz#1475271 - Allow conman to use ptmx. Add conman_use_nfs boolean Resolves: rhbz#1377915 - Add nnp transition for services using: NoNewPrivileges systemd security feature Resolves: rhbz#1311430 - Add SELinux support for chronyc Resolves: rhbz#1470150 - Add dac_read_search capability to openvswitch_t domain Resolves: rhbz#1501336 - Allow svnserve to manage own svnserve_log_t files/dirs Resolves: rhbz#1480741 - Allow keepalived_t to search network sysctls Resolves: rhbz#1477542 - Allow puppetagent_t domain dbus chat with rhsmcertd_t domain Resolves: rhbz#1446777 - Add dccp_socket into socker_class_set subset Resolves: rhbz#1459941 - Allow iptables_t to run setfiles to restore context on system Resolves: rhbz#1489118 - Label 20514 tcp/udp ports as syslogd_port_t Label 10514 tcp/udp portas as syslog_tls_port_t Resolves: rhbz:#1411400 - Make nnp transition Active Resolves: rhbz#1480518 - Label tcp 51954 as isns_port_t Resolves: rhbz#1390208 - Add dac_read_search capability chkpwd_t Resolves: rhbz#1376991 - Add support for running certbot(letsencrypt) in crontab Resolves: rhbz#1447278 - Add init_nnp_daemon_domain interface - Allow xdm_t to gettattr /dev/loop-control device Resolves: rhbz#1462925 - Allow nnp trasintion for unconfined_service_t Resolves: rhbz#1311430 - Allow unpriv user domains and unconfined_service_t to use chronyc Resolves: rhbz#1470150 - Allow iptables to exec plymouth. Resolves: rhbz#1480374 - Fix typo in fs_unmount_tracefs interface. Resolves: rhbz#1371057 - Label postgresql-check-db-dir as postgresql_exec_t Resolves: rhbz#1490956- We should not ship selinux-policy with permissivedomains enabled. Resolves: rhbz#1494172 - Fix order of installing selinux-policy-sandbox, because of depedencied in sandbox module, selinux-policy-targeted needs to be installed before selinux-policy-sandbox Resolves: rhbz#1492606- Allow tomcat to setsched Resolves: rhbz#1492730 - Fix rules blocking ipa-server upgrade process Resolves: rhbz#1478371 - Add new boolean tomcat_read_rpm_db() Resolves: rhbz#1477887 - Allow tomcat to connect on mysqld tcp ports - Add ctdbd_t domain sys_source capability and allow setrlimit Resolves: rhbz#1491235 - Fix keepalived SELinux module - Allow automount domain to manage mount pid files Resolves: rhbz#1482381 - Allow stunnel_t domain setsched Resolves: rhbz#1479383 - Add keepalived domain setpgid capability Resolves: rhbz#1486638 - Allow tomcat domain to connect to mssql port Resolves: rhbz#1484572 - Remove snapperd_t from unconfined domaines Resolves: rhbz#1365555 - Fix typo bug in apache module Resolves: rhbz#1397311 - Dontaudit that system_mail_t is trying to read /root/ files Resolves: rhbz#1147945 - Make working webadm_t userdomain Resolves: rhbz#1323792 - Allow redis domain to execute shell scripts. Resolves: rhbz#1421326 - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t Resolves: rhbz#1473303 - Add couple capabilities to keepalived domain and allow get attributes of all domains Resolves: rhbz#1429327 - Allow dmidecode read rhsmcertd lock files Resolves: rhbz#1300799 - Add new interface rhsmcertd_rw_lock_files() Resolves: rhbz#1300799 - Label all plymouthd archives as plymouthd_var_log_t Resolves: rhbz#1478323 - Allow cloud_init_t to dbus chat with systemd_timedated_t Resolves: rhbz#1440730 - Allow logrotate_t to write to kmsg Resolves: rhbz#1397744 - Add capability kill to rhsmcertd_t Resolves: rhbz#1398338 - Disable mysqld_safe_t secure mode environment cleansing. Resolves: rhbz#1464063 - Allow winbind to manage smbd_tmp_t files Resolves: rhbz#1475566 - Dontaudit that system_mail_t is trying to read /root/ files Resolves: rhbz#1147945 - Make working webadm_t userdomain Resolves: rhbz#1323792 - Allow redis domain to execute shell scripts. Resolves: rhbz#1421326 - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t Resolves: rhbz#1473303 - Add couple capabilities to keepalived domain and allow get attributes of all domains Resolves: rhbz#1429327 - Allow dmidecode read rhsmcertd lock files Resolves: rhbz#1300799 - Add new interface rhsmcertd_rw_lock_files() Resolves: rhbz#1300799 - Label all plymouthd archives as plymouthd_var_log_t Resolves: rhbz#1478323 - Allow cloud_init_t to dbus chat with systemd_timedated_t Resolves: rhbz#1440730 - Allow logrotate_t to write to kmsg Resolves: rhbz#1397744 - Add capability kill to rhsmcertd_t Resolves: rhbz#1398338 - Disable mysqld_safe_t secure mode environment cleansing. Resolves: rhbz#1464063 - Allow winbind to manage smbd_tmp_t files Resolves: rhbz#1475566 - Add interface systemd_tmpfiles_run - End of file cannot be in comment - Allow systemd-logind to use ypbind Resolves: rhbz#1479350 - Add creating opasswd file with shadow_t SELinux label in auth_manage_shadow() interface Resolves: rhbz#1412838 - Allow sysctl_irq_t assciate with proc_t Resolves: rhbz#1485909 - Enable cgourp sec labeling Resolves: rhbz#1485947 - Add cgroup_seclabel policycap. Resolves: rhbz#1485947 - Allow sshd_t domain to send signull to xdm_t processes Resolves: rhbz#1448959 - Allow updpwd_t domain auth file name trans Resolves: rhbz#1412838 - Allow sysadm user to run systemd-tmpfiles Resolves: rbhz#1325364 - Add support labeling for vmci and vsock device Resolves: rhbz#1451358 - Add userdom_dontaudit_manage_admin_files() interface Resolves: rhbz#1323792 - Allow iptables_t domain to read files with modules_conf_t label Resolves: rhbz#1373220 - init: Add NoNewPerms support for systemd. Resolves: rhbz#1480518 - Add nnp_nosuid_transition policycap and related class/perm definitions. Resolves: rhbz#1480518 - refpolicy: Infiniband pkeys and endports Resolves: rhbz#1464484- Allow certmonger using systemctl on pki_tomcat unit files Resolves: rhbz#1481388- Allow targetd_t to create own tmp files. - Dontaudit targetd_t to exec rpm binary file. Resolves: rhbz#1373860 Resolves: rhbz#1424621- Add few rules to make working targetd daemon with SELinux Resolves: rhbz#1373860 - Allow ipmievd_t domain to load kernel modules Resolves: rhbz#1441081 - Allow logrotate to reload transient systemd unit Resolves: rhbz#1440515 - Add certwatch_t domain dac_override and dac_read_search capabilities Resolves: rhbz#1422000 - Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain Resolves: rhbz#1412072 - Allow nscd_t domain to search network sysctls Resolves: rhbz#1432361 - Allow iscsid_t domain to read mount pid files Resolves: rhbz#1482097 - Allow ksmtuned_t domain manage sysfs_t files/dirs Resolves: rhbz#1413865 - Allow keepalived_t domain domtrans into iptables_t Resolves: rhbz#1477719 - Allow rshd_t domain reads net sysctls Resolves: rhbz#1477908 - Add interface seutil_dontaudit_read_module_store() - Update interface lvm_rw_pipes() by adding also open permission - Label /dev/clp device as vfio_device_t Resolves: rhbz#1477624 - Allow ifconfig_t domain unmount fs_t Resolves: rhbz#1477445 - Label /dev/gpiochip* devices as gpio_device_t Resolves: rhbz#1477618 - Add interface dev_manage_sysfs() Resolves: rhbz#1474989- Label /usr/libexec/sudo/sesh as shell_exec_t Resolves: rhbz#1480791- Allow tomcat_t domain couple capabilities to make working tomcat-jsvc Resolves: rhbz#1470735- Allow llpdad send dgram to libvirt Resolves: rhbz#1472722- Add new boolean gluster_use_execmem Resolves: rhbz#1469027 - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service Resolves: rhbz#1468581- Dontaudit staff_t user read admin_home_t files. Resolves: rhbz#1290633- Allow couple rules needed to start targetd daemon with SELinux in enforcing mode Resolves: rhbz#1424621 - Add interface lvm_manage_metadata Resolves: rhbz#1424621- Allow sssd_t to read realmd lib files. Resolves: rhbz#1436689 - Add permission open to files_read_inherited_tmp_files() interface Resolves: rhbz#1290633 Resolves: rhbz#1457106- Allow unconfined_t user all user namespace capabilties. Resolves: rhbz#1461488- Allow httpd_t to read realmd_var_lib_t files Resolves: rhbz#1436689- Allow named_t to bind on udp 4321 port Resolves: rhbz#1312972 - Allow systemd-sysctl cap. sys_ptrace Resolves: rhbz#1458999- Allow pki_tomcat_t execute ldconfig. Resolves: rhbz#1436689- Allow iscsi domain load kernel module. Resolves: rhbz#1457874 - Allow keepalived domain connect to squid tcp port Resolves: rhbz#1457455 - Allow krb5kdc_t domain read realmd lib files. Resolves: rhbz#1436689 - xdm_t should view kernel keys Resolves: rhbz#1432645- Allow tomcat to connect on all unreserved ports - Allow ganesha to connect to all rpc ports Resolves: rhbz#1448090 - Update ganesha with another fixes. Resolves: rhbz#1448090 - Update rpc_read_nfs_state_data() interface to allow read also lnk_files. Resolves: rhbz#1448090 - virt_use_glusterd boolean should be in optional block Update ganesha module to allow create tmp files Resolves: rhbz#1448090 - Hide broken symptoms when machine is configured with network bounding.- Add new boolean virt_use_glusterd Resolves: rhbz#1455994 - Add capability sys_boot for sbd_t domain - Allow sbd_t domain to create rpc sysctls. Resolves: rhbz#1455631 - Allow ganesha_t domain to manage glusterd_var_run_t pid files. Resolves: rhbz#1448090- Create new interface: glusterd_read_lib_files() - Allow ganesha read glusterd lib files. - Allow ganesha read network sysctls Resolves: rhbz#1448090- Add few allow rules to ganesha module Resolves: rhbz#1448090 - Allow condor_master_t to read sysctls. Resolves: rhbz#1277506 - Add dac_override cap to ctdbd_t domain Resolves: rhbz#1435708 - Label 8750 tcp/udp port as dey_keyneg_port_t Resolves: rhbz#1448090- Add ganesha_use_fusefs boolean. Resolves: rhbz#1448090- Allow httpd_t reading kerberos kdc config files Resolves: rhbz#1452215 - Allow tomcat_t domain connect to ibm_dt_2 tcp port. Resolves: rhbz#1447436 - Allow stream connect to initrc_t domains Resolves: rhbz#1447436 - Allow dnsmasq_t domain to read systemd-resolved pid files. Resolves: rhbz#1453114 - Allow tomcat domain name_bind on tcp bctp_port_t Resolves: rhbz#1451757 - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process. Resolves: rhbz#1447669 - Allow condor_master_t write to sysctl_net_t Resolves: rhbz#1277506 - Allow nagios check disk plugin read /sys/kernel/config/ Resolves: rhbz#1277718 - Allow pcp_pmie_t domain execute systemctl binary Resolves: rhbz#1271998 - Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl Resolves: rhbz#1247635 - Label tcp/udp port 1792 as ibm_dt_2_port_t Resolves: rhbz#1447436 - Add interface fs_read_configfs_dirs() - Add interface fs_read_configfs_files() - Fix systemd_resolved_read_pid interface - Add interface systemd_resolved_read_pid() Resolves: rhbz#1453114 - Allow sshd_net_t domain read/write into crypto devices Resolves: rhbz#1452759 - Label 8999 tcp/udp as bctp_port_t Resolves: rhbz#1451757- nmbd_t needs net_admin capability like smbd Resolves: rhbz#1431859 - Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t Resolves: rhbz#1431859 - Allow rngd domain read sysfs_t Resolves: rhbz#1451735 - Add interface pki_manage_common_files() Resolves: rhbz#1447436 - Allow tomcat_t domain to manage pki_common_t files and dirs Resolves: rhbz#1447436 - Use stricter fc rules for sssd sockets in /var/run Resolves: rhbz#1448060 - Allow certmonger reads httpd_config_t files Resolves: rhbz#1436689 - Allow keepalived_t domain creating netlink_netfilter_socket. Resolves: rhbz#1451684 - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files. Resolves: rhbz#1451318 - Make able deply overcloud via neutron_t to label nsfs as fs_t Resolves: rhbz#1373321- Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files. Resolves: rhbz#1451318 - Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/ Resolves: rhbz#1448056 Resolves: rhbz#1448060 - Allow tomcat_domain connect to * postgresql_port_t * amqp_port_t Allow tomcat_domain read network sysctls Resolves: rhbz#1450819 - Make able deply overcloud via neutron_t to label nsfs as fs_t Resolves: rhbz#1373321 - Allow netutils setpcap capability Resolves:1444438- Update targetd policy to accommodate changes in the service Resolves: rhbz#1424621 - Allow tomcat_domain connect to * postgresql_port_t * amqp_port_t Allow tomcat_domain read network sysctls Resolves: rhbz#1450819 - Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options. Resolves: rhbz#1415841 - Allow radius domain stream connec to postgresql Resolves: rhbz#1446145 - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit Resolves: rhbz#1449977 - Allow glusterd_t domain start ganesha service Resolves: rhbz#1448090 - Made few cosmetic changes in sssd SELinux module Resolves: rhbz#1448060 - sssd-kcm should not run as unconfined_service_t BZ(1447411) Resolves: rhbz#1448060 - Add sssd_secrets labeling Also add named_filetrans interface to make sure all labels are correct Resolves: rhbz#1448056 - Allow keepalived_t domain read usermodehelper_t Resolves: rhbz#1449769 - Allow tomcat_t domain read pki_common_t files Resolves: rhbz#1447436 - Add interface pki_read_common_files() Resolves: rhbz#1447436- Allow hypervkvp_t domain execute hostname Resolves: rhbz#1449064 - Dontaudit sssd_selinux_manager_t use of net_admin capability Resolves: rhbz#1444955 - Allow tomcat_t stream connect to pki_common_t Resolves: rhbz#1447436 - Dontaudit xguest_t's attempts to listen to its tcp_socket - Allow sssd_selinux_manager_t to ioctl init_t sockets Resolves: rhbz#1436689 - Allow _su_t to create netlink_selinux_socket Resolves rhbz#1146987 - Allow unconfined_t to module_load any file Resolves rhbz#1442994- Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type. Resolves: rhbz#1436689- Allow pki_tomcat_t domain read /etc/passwd. Resolves: rhbz#1436689 - Allow tomcat_t domain read ipa_tmp_t files Resolves: rhbz#1436689 - Label new path for ipa-otpd Resolves: rhbz#1446353 - Allow radiusd_t domain stream connect to postgresql_t Resolves: rhbz#1446145 - Allow rhsmcertd_t to execute hostname_exec_t binaries. Resolves: rhbz#1445494 - Allow virtlogd to append nfs_t files when virt_use_nfs=1 Resolves: rhbz#1402561- Update tomcat policy to adjust for removing unconfined_domain attr. Resolves: rhbz#1432083 - Allow httpd_t domain read also httpd_user_content_type lnk_files. Resolves: rhbz#1383621 - Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t Resolves: rhbz#1436689 - Dontaudit _gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t Resolves: rhbz#1425530 - Add interface ipa_filetrans_named_content() Resolves: rhbz#1432115 - Allow tomcat use nsswitch Resolves: rhbz#1436689 - Allow certmonger_t start/status generic services Resolves: rhbz#1436689 - Allow dirsrv read cgroup files. Resolves: rhbz#1436689 - Allow ganesha_t domain read/write infiniband devices. Resolves: rhbz#1383784 - Allow sendmail_t domain sysctl_net_t files Resolves: rhbz#1369376 - Allow targetd_t domain read network state and getattr on loop_control_device_t Resolves: rhbz#1373860 - Allow condor_schedd_t domain send mails. Resolves: rhbz#1277506 - Alow certmonger to create own systemd unit files. Resolves: rhbz#1436689 - Allow staff to systemctl virt server when staff_use_svirt=1 Resolves: rhbz#1415841 - Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context Resolves: rhbz#1432115 - Label /sysroot/ostree/deploy/rhel-atomic-host/* as root_t Resolves: rhbz#1428112- Alow certmonger to create own systemd unit files. Resolves: rhbz#1436689- Hide broken symptoms when using kernel 3.10.0-514+ with network bonding. Postfix_picup_t domain requires NET_ADMIN capability which is not really needed. Resolves: rhbz#1431859 - Fix policy to reflect all changes in new IPA release Resolves: rhbz#1432115 Resolves: rhbz#1436689- Allow sbd_t to read/write fixed disk devices Resolves: rhbz#1440165 - Add sys_ptrace capability to radiusd_t domain Resolves: rhbz#1426641 - Allow cockpit_session_t domain connects to ssh tcp ports. Resolves: rhbz#1413509- Update tomcat policy to make working ipa install process Resolves: rhbz#1436689- Allow pcp_pmcd_t net_admin capability. - Allow pcp_pmcd_t read net sysctls - Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t Resolves: rhbz#1336211- Fix all AVC denials during pkispawn of CA Resolves: rhbz#1436383 - Update pki interfaces and tomcat module Resolves: rhbz#1436689- Update pki interfaces and tomcat module Resolves: rhbz#1436689- Dontaudit firewalld wants write to /root Resolves: rhbz#1438708 - Dontaudit firewalld to create dirs in /root/ Resolves: rhbz#1438708 - Allow sendmail to search network sysctls Resolves: rhbz#1369376 - Add interface gssd_noatsecure() Resolves: rhbz#1438036 - Add interface gssproxy_noatsecure() Resolves: rhbz#1438036 - Dontaudit pcp_pmlogger_t search for xserver logs. Allow pcp_pmlogger_t to send signals to unconfined doamins Allow pcp_pmlogger_t to send logs to journals Resolves: rhbz#1379371 - Allow chronyd_t net_admin capability to allow support HW timestamping. Resolves: rhbz#1416015 - Update tomcat policy Resolves: rhbz#1436689 Resolves: rhbz#1436383 - Allow certmonger to start haproxy service Resolves: rhbz#1349394 - Allow init noatsecure for gssd and gssproxy Resolves: rhbz#1438036- geoclue wants to dbus chat with avahi Resolves: rhbz#1434286 - Allow iptables get list of kernel modules Resolves: rhbz#1367520 - Allow unconfined_domain_type to enable/disable transient unit Resolves: rhbz#1337041 - Add interfaces init_enable_transient_unit() and init_disable_transient_unit - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd" Resolves: rhbz#1435264 - Label sysroot dir under ostree as root_t Resolves: rhbz#1428112- Remove ganesha_t domain from permissive domains. Resolves: rhbz#1436988- Allow named_t domain bind on several udp ports Resolves: rhbz#1312972 - Update nscd_use() interface Resolves: rhbz#1281716 - Allow radius_t domain ptrace Resolves: rhbz#1426641 - Update nagios to allos exec systemctl Resolves: rhbz#1247635 - Update pcp SELinux module to reflect all pcp changes Resolves: rhbz#1271998 - Label /var/lib/ssl_db as squid_cache_t Label /etc/squid/ssl_db as squid_cache_t Resolves: rhbz#1325527 - Allow pcp_pmcd_t domain search for network sysctl Allow pcp_pmcd_t domain sys_ptrace capability Resolves: rhbz#1336211- Allow drbd load modules Resolves: rhbz#1134883 - Revert "Add sys_module capability for drbd Resolves: rhbz#1134883" - Allow stapserver list kernel modules Resolves: rhbz#1325976 - Update targetd policy Resolves: rhbz#1373860 - Add sys_admin capability to amanda Resolves: rhbz#1371561 - Allow hypervvssd_t to read all dirs. Resolves: rhbz#1331309 - Label /run/haproxy.sock socket as haproxy_var_run_t Resolves: rhbz#1386233 - Allow oddjob_mkhomedir_t to mamange autofs_t dirs. Resolves: rhbz#1408819 - Allow tomcat to connect on http_cache_port_t Resolves: rhbz#1432083 - Allow geoclue to send msgs to syslog. Resolves: rhbz#1434286 - Allow condor_master_t domain capability chown. Resolves: rhbz#1277506 - Update mta_filetrans_named_content() interface to allow calling domain create files labeled as etc_aliases_t in dir labeled as etc_mail_t. Resolves: rhbz#1167468 - Allow nova domain search for httpd configuration. Resolves: rhbz#1190761 - Add sys_module capability for drbd Resolves: rhbz#1134883 - Allow user_u users stream connect to dirsrv, Allow sysadm_u and staff_u users to manage dirsrv files Resolves: rhbz#1286474 - Allow systemd_networkd_t communicate with systemd_networkd_t via dbus Resolves: rhbz#1278010- Add haproxy_t domain fowner capability Resolves: rhbz#1386233 - Allow domain transition from ntpd_t to hwclock_t domains Resolves: rhbz#1375624 - Allow cockpit_session_t setrlimit and sys_resource Resolves: rhbz#1402316 - Dontaudit svirt_t read state of libvirtd domain Resolves: rhbz#1426106 - Update httpd and gssproxy modules to reflects latest changes in freeipa Resolves: rhbz#1432115 - Allow iptables read modules_conf_t Resolves: rhbz#1367520- Remove tomcat_t domain from unconfined domains Resolves: rhbz#1432083 - Create new boolean: sanlock_enable_home_dirs() Resolves: rhbz#1432783 - Allow mdadm_t domain to read/write nvme_device_t Resolves: rhbz#1431617 - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content Resolves: rhbz#1383621 - Dontaudit domain to create any file in /proc. This is kernel bug. Resolves: rhbz#1412679 - Add interface dev_rw_nvme Resolves: rhbz#1431617- Allow gssproxy to get attributes on all filesystem object types. Resolves: rhbz#1430295 - Allow ganesha to chat with unconfined domains via dbus Resolves: rhbz#1426554 - add the policy required for nextcloud Resolves: rhbz#1425530 - Add nmbd_t capability2 block_suspend Resolves: rhbz#1425357 - Label /var/run/chrony as chronyd_var_run_t Resolves: rhbz#1416015 - Add domain transition from sosreport_t to iptables_t Resolves: rhbz#1359789 - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd Resolves: rhbz:#1332803- Update rpm macros Resolves: rhbz#1380854- Add handling booleans via selinux-policy macros in custom policy spec files. Resolves: rhbz#1380854- Allow openvswitch to load kernel modules Resolves: rhbz#1405479- Allow openvswitch read script state. Resolves: rhbz#1405479- Update ganesha policy Resolves: rhbz#1426554 Resolves: rhbz#1383784 - Allow chronyd to read adjtime Resolves: rhbz#1416015 - Fixes for chrony version 2.2 Resolves: rhbz#1416015 - Add interface virt_rw_stream_sockets_svirt() Resolves: rhbz#1415841 - Label /dev/ss0 as gpfs_device_t Resolves: rhbz#1383784 - Allow staff to rw svirt unix stream sockets. Resolves: rhbz#1415841 - Label /rhev/data-center/mnt as mnt_t Resolves: rhbz#1408275 - Associate sysctl_rpc_t with proc filesystems Resolves: rhbz#1350927 - Add new boolean: domain_can_write_kmsg Resolves: rhbz#1415715- Allow rhsmcertd_t dbus chat with system_cronjob_t Resolves: rhbz#1405341 - Allow openvswitch exec hostname and readinitrc_t files Resolves: rhbz#1405479 - Improve SELinux context for mysql_db_t objects. Resolves: rhbz#1391521 - Allow postfix_postdrop to communicate with postfix_master via pipe. Resolves: rhbz#1379736 - Add radius_use_jit boolean Resolves: rhbz#1426205 - Label /var/lock/subsys/iptables as iptables_lock_t Resolves: rhbz#1405441 - Label /usr/lib64/erlang/erts-5.10.4/bin/epmd as lib_t Resolves: rhbz#1332803 - Allow can_load_kernmodule to load kernel modules. Resolves: rhbz#1423427 Resolves: rhbz#1424621- Allow nfsd_t domain to create sysctls_rpc_t files Resolves: rhbz#1405304 - Allow openvswitch to create netlink generic sockets. Resolves: rhbz#1397974 - Create kernel_create_rpc_sysctls() interface Resolves: rhbz#1405304- Allow nfsd_t domain rw sysctl_rpc_t dirs Resolves: rhbz#1405304 - Allow cgdcbxd_t to manage cgroup files. Resolves: rhbz#1358493 - Allow cmirrord_t domain to create netlink_connector sockets Resolves: rhbz#1412670 - Allow fcoemon to create netlink scsitransport sockets Resolves: rhbz#1362496 - Allow quota_nld_t create netlink_generic sockets Resolves: rhbz#1358679 - Allow cgred_t create netlink_connector sockets Resolves: rhbz#1376357 - Add dhcpd_t domain fowner capability Resolves: rhbz#1358485 - Allow acpid to attempt to connect to the Linux kernel via generic netlink socket. Resolves: rhbz#1358478 - Rename docker module to container module Resolves: rhbz#1386916 - Allow setflies to mount tracefs Resolves: rhbz#1376357 - Allow iptables to read nsfs files. Resolves: rhbz#1411316 - Allow systemd_bootchart_t domain create dgram sockets. Resolves: rhbz#1365953 - Rename docker interfaces to container Resolves: rhbz#1386916- Allow initrc_t domain to run rhel-autorelabel script properly during boot process Resolves: rhbz#1379722 - Allow systemd_initctl_t to create and connect unix_dgram sockets Resolves: rhbz#1365947 - Allow ifconfig_t to mount/unmount nsfs_t filesystem Resolves: rhbz#1349814 - Add interfaces allowing mount/unmount nsfs_t filesystem Resolves: rhbz#1349814- Add interface init_stream_connectto() Resolves:rhbz#1365947 - Allow rhsmcertd domain signull kernel. Resolves: rhbz#1379781 - Allow kdumpgui domain to read nvme device - Allow insmod_t to load kernel modules Resolves: rhbz#1421598 - Add interface files_load_kernel_modules() Resolves: rhbz#1421598 - Add SELinux support for systemd-initctl daemon Resolves:rhbz#1365947 - Add SELinux support for systemd-bootchart Resolves: rhbz#1365953- Allow firewalld to getattr open search read modules_object_t:dir Resolves: rhbz#1418391 - Fix label for nagios plugins in nagios file conxtext file Resolves: rhbz#1277718 - Add sys_ptrace capability to pegasus domain Resolves: rhbz#1381238 - Allow sssd_t domain setpgid Resolves:rhbz#1416780 - After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk. Resolves: rhbz#1350927 - Allow kdumpgui domain to read nvme device Resolves: rhbz#1415084 - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization. Resolves: rhbz#1146987 - Add user namespace capability object classes. Resolves: rhbz#1368057 - Add module_load permission to class system Resolves:rhbz#1368057 - Add the validate_trans access vector to the security class Resolves: rhbz#1368057 - Add "binder" security class and access vectors Resolves: rhbz#1368057 - Allow ifconfig_t domain read nsfs_t Resolves: rhbz#1349814 - Allow ping_t domain to load kernel modules. Resolves: rhbz#1388363- Allow systemd container to read/write usermodehelperstate Resolves: rhbz#1403254 - Label udp ports in range 24007-24027 as gluster_port_t Resolves: rhbz#1404152- Allow glusterd_t to bind on glusterd_port_t udp ports. Resolves: rhbz#1404152 - Revert: Allow glusterd_t to bind on med_tlp port.- Allow glusterd_t to bind on med_tlp port. Resolves: rhbz#1404152 - Update ctdbd_t policy to reflect all changes. Resolves: rhbz#1402451 - Label tcp port 24009 as med_tlp_port_t Resolves: rhbz#1404152 - Issue appears during update directly from RHEL-7.0 to RHEL-7.3 or above. Modules pkcsslotd and vbetools missing in selinux-policy package for RHEL-7.3 which causing warnings during SELinux policy store migration process. Following patch fixes issue by skipping pkcsslotd and vbetools modules migration.- Allow ctdbd_t domain transition to rpcd_t Resolves:rhbz#1402451- Fixes for containers Allow containers to attempt to write to unix_sysctls. Allow cotainers to use the FD's leaked to them from parent processes. Resolves: rhbz#1403254- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t Resolves: rhbz#1404152 - Allow systemd to stop glusterd_t domains. Resolves: rhbz#1400493- Make working CTDB:NFS: CTDB failover from selinux-policy POV Resolves: rhbz#1402451- Add kdump_t domain sys_admin capability Resolves: rhbz#1375963- Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access. Resolves: rhbz#1399250- Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning "Access Denied" errors to DBus clients Resolves: rhbz#1393505- Allow cluster_t communicate to fprintd_t via dbus Resolves: rhbz#1349798- Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package Resolves: rhbz#1392010- Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device. Resolves: rhbz#1384488 - Allow glusterd to get attributes on /sys/kernel/config directory. Resolves: rhbz#1384483- Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros - Add selinux-policy-migrate-local-changes service Resolves: rhbz#1381588- Allow sssd_selinux_manager_t to manage also dir class. Resolves: rhbz#1368097 - Add interface seutil_manage_default_contexts_dirs() Resolves: rhbz#1368097- Add virt_sandbox_use_nfs -> virt_use_nfs boolean substitution. Resolves: rhbz#1355783- Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t Resolves: rhbz#1309883- Allow ftp daemon to manage apache_user_content Resolves: rhbz#1097775 - Label /etc/sysconfig/oracleasm as oracleasm_conf_t Resolves: rhbz#1331383 - Allow oracleasm to rw inherited fixed disk device Resolves: rhbz#1331383 - Allow collectd to connect on unix_stream_socket Resolves: rhbz#1377259- Allow iscsid create netlink iscsid sockets. Resolves: rhbz#1358266 - Improve regexp for power_unit_file_t files. To catch just systemd power unit files. Resolves: rhbz#1375462- Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain. Resolves: rhbz#1331383 - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service Resolves: rhbz#1206525- Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm Resolves: rhbz#1331383 - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t Resolves: rhbz#1206525 - Allow mdadm_t to getattr all device nodes Resolves: rhbz#1365171 - Add interface dbus_dontaudit_stream_connect_system_dbusd() Resolves:rhbz#1052880 - Add virt_stub_* interfaces for docker policy which is no longer a part of our base policy. Resolves: rhbz#1372705 - Allow guest-set-user-passwd to set users password. Resolves: rhbz#1369693 - Allow samdbox domains to use msg class Resolves: rhbz#1372677 - Allow domains using kerberos to read also kerberos config dirs Resolves: rhbz#1368492 - Allow svirt_sandbox_domains to r/w onload sockets Resolves: rhbz#1342930 - Add interface fs_manage_oracleasm() Resolves: rhbz#1331383 - Label /dev/kfd as hsa_device_t Resolves: rhbz#1373488 - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs Resolves: rhbz#1368097 - Add interface to write to nsfs inodes Resolves: rhbz#1372705 - Allow systemd services to use PrivateNetwork feature Resolves: rhbz#1372705 - Add a type and genfscon for nsfs. Resolves: rhbz#1372705 - Allow run sulogin_t in range mls_systemlow-mls_systemhigh. Resolves: rhbz#1290400- Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261 - Fix file context for /etc/pki/pki-tomcat/ca/ - new interface oddjob_mkhomedir_entrypoint() - Move label for /var/lib/docker/vfs/ to proper SELinux module - Allow mdadm to get attributes from all devices. - Label /etc/puppetlabs as puppet_etc_t. - Allow systemd-machined to communicate to lxc container using dbus - Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579 - Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579 - Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579 - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t - Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383- Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t Resolves:rhbz#1366915 - Allow certmonger to manage all systemd unit files Resolves:rhbz#1366915 - Grant certmonger "chown" capability Resolves:rhbz#1366915 - Allow ipa_helper_t stream connect to dirsrv_t domain Resolves: rhbz#1368418 - Update oracleasm SELinux module Resolves: rhbz#1331383 - label /var/lib/kubelet as svirt_sandbox_file_t Resolves: rhbz#1369159 - Add few interfaces to cloudform.if file Resolves: rhbz#1367834 - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module Resolves: rhbz#1347514 - Allow krb5kdc_t to read krb4kdc_conf_t dirs. Resolves: rhbz#1368492 - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run. Resolves: rhbz#1365653 - Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together. Resolves: rhbz#1365653 - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type Resolves: rhbz#1331383 - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init. Resolves: rhbz#1367834 - Allow iptables to creating netlink generic sockets. Resolves: rhbz#1364359- Allow ipmievd domain to create lock files in /var/lock/subsys/ Resolves:rhbz#1349058 - Update policy for ipmievd daemon. Resolves:rhbz#1349058 - Dontaudit hyperkvp to getattr on non security files. Resolves: rhbz#1349356 - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t Resolves: rhbz#1347514 - Fixed lsm SELinux module - Add sys_admin capability to sbd domain Resolves: rhbz#1322725 - Allow vdagent to comunnicate with systemd-logind via dbus Resolves: rhbz#1366731 - Allow lsmd_plugin_t domain to create fixed_disk device. Resolves: rhbz#1238066 - Allow opendnssec domain to create and manage own tmp dirs/files Resolves: rhbz#1366649 - Allow opendnssec domain to read system state Resolves: rhbz#1366649 - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs Resolves: rhbz#1366649 - Allow rasdaemon to mount/unmount tracefs filesystem. Resolves: rhbz#1364380 - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/ Resolves: rhbz#1367520 - Modify interface den_read_nvme() to allow also read nvme_device_t block files. Resolves: rhbz#1362564 - Label /var/run/storaged as lvm_var_run_t. Resolves: rhbz#1264390 - Allow unconfineduser to run ipa_helper_t. Resolves: rhbz#1361636- Dontaudit mock to write to generic certs. Resolves: rhbz#1271209 - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t Resolves: rhbz#1347514 - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain" - Allow modemmanager to write to systemd inhibit pipes Resolves: rhbz#1365214 - Label corosync-qnetd and corosync-qdevice as corosync_t domain Resolves: rhbz#1347514 - Allow ipa_helper to read network state Resolves: rhbz#1361636 - Label oddjob_reqiest as oddjob_exec_t Resolves: rhbz#1361636 - Add interface oddjob_run() Resolves: rhbz#1361636 - Allow modemmanager chat with systemd_logind via dbus Resolves: rhbz#1362273 - Allow NetworkManager chat with puppetagent via dbus Resolves: rhbz#1363989 - Allow NetworkManager chat with kdumpctl via dbus Resolves: rhbz#1363977 - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls. Resolves: rhbz#1322725 - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t Resolves: rhbz#1349058 - Allow rasdaemon to use tracefs filesystem. Resolves: rhbz#1364380 - Fix typo bug in dirsrv policy - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd. Resolves: rhbz#1283134 - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t Resolves: rhbz#1362688 - Allow dirsrv to read dirsrv_share_t content Resolves: rhbz#1363662 - Allow virtlogd_t to append svirt_image_t files. Resolves: rhbz#1358140 - Allow hypervkvp domain to read hugetlbfs dir/files. Resolves: rhbz#1349356 - Allow mdadm daemon to read nvme_device_t blk files Resolves: rhbz#1362564 - Allow selinuxusers and unconfineduser to run oddjob_request Resolves: rhbz#1361636 - Allow sshd server to acces to Crypto Express 4 (CEX4) devices. Resolves: rhbz#1362539 - Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-* changed to /usr/lib/systemd/rhel-*. Resolves: rhbz#1363769 - Fix typo in device interfaces Resolves: rhbz#1349058 - Add interfaces for managing ipmi devices Resolves: rhbz#1349058 - Add interfaces to allow mounting/umounting tracefs filesystem Resolves: rhbz#1364380 - Add interfaces to allow rw tracefs filesystem Resolves: rhbz#1364380 - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices. Resolves: rhbz#1362564 - Label /sys/kernel/debug/tracing filesystem Resolves: rhbz#1364380 - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1357857- Dontaudit mock_build_t can list all ptys. Resolves: rhbz#1271209 - Allow ftpd_t to mamange userhome data without any boolean. Resolves: rhbz#1097775 - Add logrotate permissions for creating netlink selinux sockets. Resolves: rhbz#1283134 - Allow lsmd_plugin_t to exec ldconfig. Resolves: rhbz#1238066 - Allow vnstatd domain to read /sys/class/net/ files Resolves: rhbz#1358243 - Remove duplicate allow rules in spamassassin SELinux module Resolves:rhbz#1358175 - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs Resolves:rhbz#1358175 - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1357857 - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data. Resolves: rhbz#1330464 - Allow gnome-keyring also manage user_tmp_t sockets. Resolves: rhbz#1257057 - corecmd: Remove fcontext for /etc/sysconfig/libvirtd Resolves:rhbz#1351382- Allow ipa_dnskey domain to search cache dirs Resolves: rhbz#1350957- Allow ipa-dnskey read system state. Reasolves: rhbz#1350957 - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file Resolves: rhbz#1350957- Allow firewalld to manage net_conf_t files. Resolves:rhbz#1304723 - Allow logrotate read logs inside containers. Resolves: rhbz#1303514 - Allow sssd to getattr on fs_t Resolves: rhbz#1356082 - Allow opendnssec domain to manage bind chace files Resolves: rhbz#1350957 - Fix typo in rhsmcertd policy module Resolves: rhbz#1329475 - Allow systemd to get status of systemd-logind daemon Resolves: rhbz#1356141 - Label more ndctl devices not just ndctl0 Resolves: rhbz#1355809- Allow rhsmcertd to copy certs into /etc/docker/cert.d - Add interface docker_rw_config() Resolves: rhbz#1344500 - Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t Resolves: rhbz#1355632 - Allow rhsmcertd to read network sysctls Resolves: rhbz#1329475 - Label /var/log/graphite-web dir as httpd_log_t Resolves: rhbz#1310898 - Allow mock to use generic ptys Resolves: rhbz#1271209 - Allow adcli running as sssd_t to write krb5.keytab file. Resolves: rhbz#1356082 - Allow openvswitch connect to openvswitch_port_t type. Resolves: rhbz#1335024 - Add SELinux policy for opendnssec service. Resolves: rhbz#1350957 - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd Resolves: rhbz#1350957 - label /dev/ndctl0 device as nvram_device_t Resolves: rhbz#1355809- Allow lttng tools to block suspending Resolves: rhbz#1256374 - Allow creation of vpnaas in openstack Resolves: rhbz#1352710 - virt: add strict policy for virtlogd daemon Resolves:rhbz#1311606 - Update makefile to support snapperd_contexts file Resolves: rhbz#1352681- Allow udev to manage systemd-hwdb files - Add interface systemd_hwdb_manage_config() Resolves: rhbz#1350756 - Fix paths to infiniband devices. This allows use more then two infiniband interfaces. Resolves: rhbz#1210263- Allow virtual machines to rw infiniband devices. Resolves: rhbz#1210263 - Allow opensm daemon to rw infiniband_mgmt_device_t Resolves: rhbz#1210263 - Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file. Resolves: rhbz#1350756 - Make label for new infiniband_mgmt deivices Resolves: rhbz#1210263- Fix typo in brltty SELinux module - Add new SELinux module sbd Resolves: rhbz#1322725 - Allow pcp dmcache metrics collection Resolves: rhbz#1309883 - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t Resolves: rhbz#1350782 - Allow openvpn to create sock files labeled as openvpn_var_run_t Resolves: rhbz#1328246 - Allow hypervkvp daemon to getattr on all filesystem types. Resolves: rhbz#1349356 - Allow firewalld to create net_conf_t files Resolves: rhbz#1304723 - Allow mock to use lvm Resolves: rhbz#1271209 - Allow keepalived to create netlink generic sockets. Resolves: rhbz#1349809 - Allow mirromanager creating log files in /tmp Resolves:rhbz#1328818 - Rename few modules to make it consistent with source files Resolves: rhbz#1351445 - Allow vmtools_t to transition to rpm_script domain Resolves: rhbz#1342119 - Allow nsd daemon to manage nsd_conf_t dirs and files Resolves: rhbz#1349791 - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t Resolves: rhbz#1346900 - Allow sssd read also sssd_conf_t dirs Resolves: rhbz#1350535 - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl Resolves: rhbz#1086240 - Add interface lvm_getattr_exec_files() Resolves: rhbz#1271209 - Fix typo Compliling vs. Compiling Resolves: rhbz#1351445- Allow krb5kdc_t to communicate with sssd Resolves: rhbz#1319933 - Allow prosody to bind on prosody ports Resolves: rhbz#1304664 - Add dac_override caps for fail2ban-client Resolves: rhbz#1316678 - dontaudit read access for svirt_t on the file /var/db/nscd/group Resolves: rhbz#1301637 - Allow inetd child process to communicate via dbus with systemd-logind Resolves: rhbz#1333726 - Add label for brltty log file Resolves: rhbz#1328818 - Allow dspam to read the passwd file Resolves: rhbz#1286020 - Allow snort_t to communicate with sssd Resolves: rhbz#1284908 - svirt_sandbox_domains need to be able to execmod for badly built libraries. Resolves: rhbz#1206339 - Add policy for lttng-tools package. Resolves: rhbz#1256374 - Make mirrormanager as application domain. Resolves: rhbz#1328234 - Add support for the default lttng-sessiond port - tcp/5345. This port is used by LTTng 2.x central tracing registry session daemon. - Add prosody ports Resolves: rhbz#1304664 - Allow sssd read also sssd_conf_t dirs Resolves: rhbz#1350535- Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs. Resolves:rhbz#1331315 - Label named-pkcs11 binary as named_exec_t. Resolves: rhbz#1331315 - Allow glusterd daemon to get systemd status Resolves: rhbz#1321785 - Allow logrotate dbus-chat with system_logind daemon Resolves: rhbz#1283134 - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files Resolves: rhbz#1336211 - Add interface cron_read_pid_files() Resolves: rhbz#1336211 - Allow pcp_pmlogger to create unix dgram sockets Resolves: rhbz#1336211 - Add hwloc-dump-hwdata SELinux policy Resolves: rhbz#1344054 - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t. Resolves: rhbz#1121171 - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd() Resolves: rhbz#1259764 - Create label for openhpid log files. esolves: rhbz#1259764 - Label /var/lib/ganglia as httpd_var_lib_t Resolves: rhbz#1260536 - Allow firewalld_t to create entries in net_conf_t dirs. Resolves: rhbz#1304723 - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals Resolves: rhbz#1288255 - Include patch from distgit repo: policy-RHEL-7.1-flask.patch. Resolves: rhbz#1329560 - Update refpolicy to handle hwloc Resolves: rhbz#1344054 - Label /etc/dhcp/scripts dir as bin_t - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals. Resolves: rhbz#1288255- Allow firewalld_t to create entries in net_conf_t dirs. Resolves: rhbz#1304723 - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals Resolves: rhbz#1288255 - Allow mongod log to syslog. Resolves: rhbz#1306995 - Allow rhsmcertd connect to port tcp 9090 Resolves: rhbz#1337319 - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove. Resolves: rhbz#1262483 Resolves: rhbz#1277506 - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t. Resolves: rhbz#1301516 - Add new boolean spamd_update_can_network. Resolves: rhbz#1305469 - Allow rhsmcertd connect to tcp netport_port_t Resolves: rhbz#1329475 - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t. Resolves: rhbz#1328234 - Allow prosody to bind to fac_restore tcp port. Resolves: rhbz#1321787 - Allow ninfod to read raw packets Resolves: rhbz#1317964 - Allow pegasus get attributes from qemu binary files. Resolves: rhbz#1260835 - Allow pegasus get attributes from qemu binary files. Resolves: rhbz#1271159 - Allow tuned to use policykit. This change is required by cockpit. Resolves: rhbz#1346464 - Allow conman_t to read dir with conman_unconfined_script_t binary files. Resolves: rhbz#1297323 - Allow pegasus to read /proc/sysinfo. Resolves: rhbz#1265883 - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals. Resolves: rhbz#1288255 - Label tcp ports:16379, 26379 as redis_port_t Resolves: rhbz#1348471 - Allow systemd to relabel /var and /var/lib directories during boot. - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces. - Add files_relabelto_var_lib_dirs() interface. - Label tcp port 2004 as mailbox_port_t. Resolves: rhbz#1332843 - Label tcp and udp port 5582 as fac_restore_port_t Resolves: rhbz#1321787 - Allow sysadm_t user to run postgresql-setup. Resolves: rhbz#1282543 - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script. Resolves: rhbz#1297480 - Update netlink socket classes.- Allow conman to kill conman_unconfined_script. Resolves: rhbz#1297323 - Make conman_unconfined_script_t as init_system_domain. Resolves:rhbz#1297323 - Allow init dbus chat with apmd. Resolves:rhbz#995898 - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t. Resolves: rhbz#1233252 - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Add mediawiki rules to proper scope Resolves: rhbz#1301186 - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Allow mysqld_safe to inherit rlimit information from mysqld Resolves: rhbz#1323673 - Allow collectd_t to stream connect to postgresql. Resolves: rhbz#1344056 - Allow mediawiki-script to read /etc/passwd file. Resolves: rhbz#1301186 - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc. Resolves: rhbz#1344505 - Add labels for mediawiki123 Resolves: rhbz#1293872 - Fix label for all fence_scsi_check scripts - Allow ip netns to mounton root fs and unmount proc_t fs. Resolves: rhbz#1343776 Resolves: rhbz#1286851 - Allow sysadm_t to run newaliases command. Resolves: rhbz#1344828 - Add interface sysnet_filetrans_named_net_conf() Resolves: rhbz#1344505- Fix several issues related to the SELinux Userspace changes- Allow glusterd domain read krb5_keytab_t files. Resolves: rhbz#1343929 - Fix typo in files_setattr_non_security_dirs. Resolves: rhbz#1115987- Allow tmpreaper_t to read/setattr all non_security_file_type dirs Resolves: rhbz#1115987 - Allow firewalld to create firewalld_var_run_t directory. Resolves: rhbz#1304723 - Add interface firewalld_read_pid_files() Resolves: rhbz#1304723 - Label /usr/libexec/rpm-ostreed as rpm_exec_t. Resolves: rhbz#1340542 - Allow sanlock service to read/write cephfs_t files. Resolves: rhbz#1315332 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added missing docker interfaces: - docker_typebounds - docker_entrypoint Resolves: rhbz#1236580 - Add interface files_setattr_non_security_dirs() Resolves: rhbz#1115987 - Add support for onloadfs - Allow iptables to read firewalld pid files. Resolves: rhbz#1304723 - Add SELinux support for ceph filesystem. Resolves: rhbz#1315332 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) Resolves: rhbz#1236580- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added missing docker interfaces: - docker_typebounds - docker_entrypoint Resolves: rhbz#1236580 - New interfaces needed for systemd-machinectl Resolves: rhbz#1236580 - New interfaces needed by systemd-machine Resolves: rhbz#1236580 - Add interface allowing sending and receiving messages from virt over dbus. Resolves: rhbz#1236580 - Backport docker policy from Fedora. Related: #1303123 Resolves: #1341257 - Allow NetworkManager_t and policykit_t read access to systemd-machined pid files. Resolves: rhbz#1236580 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added interfaces needed by new docker policy. Related: rhbz#1303123 - Add support for systemd-machined daemon Resolves: rhbz#1236580 - Allow rpm-ostree domain transition to install_t domain from init_t. Resolves: rhbz#1340542- dnsmasq: allow NetworkManager to control dnsmasq via D-Bus Resolves: rhbz#1336722 - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te Resolves: rhbz#1333198 - sftpd_* booleans are functionless these days. Resolves: rhbz#1335656 - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t. Resolves: rhbz#1335828 - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus. Resolves: rhbz#1336760 - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t. Resolves: rhbz#1336737 - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain. Resolves: rhbz#1264390 - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t. Resolves: rhbz#1337061 - Revert "Allow all domains some process flags." Resolves: rhbz#1303644 - Revert "Remove setrlimit to all domains." Resolves: rhbz#1303644 - Label /usr/sbin/xrdp* files as bin_t Resolves: rhbz#1276777 - Add mls support for some db classes Resolves: rhbz#1303651 - Allow systemd_resolved_t to check if ipv6 is disabled. Resolves: rhbz#1236579 - Allow systemd_resolved to read systemd_networkd run files. Resolves: rhbz#1236579- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus. Resolves: rhbz#1336760 - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t. Resolves: rhbz#1336737- Allow logwatch to domtrans to postqueue Resolves: rhbz#1331542 - Label /var/log/ganesha.log as gluster_log_t - Allow glusterd_t domain to create glusterd_log_t files. - Label /var/run/ganesha.pid as gluster_var_run_t. Resolves: rhbz#1335828 - Allow zabbix to connect to postgresql port Resolves: rhbz#1330479 - Add userdom_destroy_unpriv_user_shared_mem() interface. Related: rhbz#1306403 - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments. Resolves: rhbz#1306403- We need to restore contexts on /etc/passwd*,/etc/group*,/etc/*shadow* during install phase to get proper labeling for these files until selinux-policy pkgs are installed. Resolves: rhbz#1333952- Add interface glusterd_dontaudit_read_lib_dirs() Resolves: rhbz#1295680 - Dontaudit Occasionally observing AVC's while running geo-rep automation Resolves: rhbz#1295680 - Allow glusterd to manage socket files labeled as glusterd_brick_t. Resolves: rhbz#1331561 - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content Resolves: rhbz#1246522 - Allow stunnel create log files. Resolves: rhbz#1296851 - Label tcp port 8181 as intermapper_port_t. Resolves: rhbz#1334783 - Label tcp/udp port 2024 as xinuexpansion4_port_t Resolves: rhbz#1334783 - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t Resolves: rhbz#1334783 - Dontaudit ldconfig read gluster lib files. Resolves: rhbz#1295680 - Add interface auth_use_nsswitch() to systemd_domain_template. Resolves: rhbz#1236579- Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs. Resolves: rhbz#1312809 Resolves: rhbz#1323947 - Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144 - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t. Resolves: rhbz#1324144 - Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports. Resolves: rhbz#1324144 - Allow prosody to listen on port 5000 for mod_proxy65. Resolves: rhbz#1316918 - Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled. Resolves: rhbz#1309454- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs. Resolves: rhbz#1319442 - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap. Resolves: rhbz#1296640 - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits. Resolves: rhbz#1097775 - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution. If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t. Resolves: rhbz#1262483 - Allow nsd daemon to create log file in /var/log as nsd_log_t Resolves: rhbz#1293140 - Sanlock policy update. - New sub-domain for sanlk-reset daemon Resolves: rhbz#1212324 - Label all run tgtd files, not just socket files Resolves: rhbz#1280280 - Label all run tgtd files, not just socket files. Resolves: rhbz#1280280 - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody. Resolves: rhbz#1321049 - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets. Resolves: rhbz#1318224 - Allow prosody to listen on port 5000 for mod_proxy65. Resolves: rhbz#1316918 - Allow targetd to read/write to /dev/mapper/control device. Resolves: rhbz#1063714 - Allow KDM to get status about power services. This change allow kdm to be able do shutdown. Resolves: rhbz#1316724 - Allow systemd-resolved daemon creating netlink_route sockets. Resolves:rhbz#1236579 - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used Resolves: rhbz#1065362 - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t Resolves: rhbz#1321943 - Label all nvidia binaries as xserver_exec_t Resolves: rhbz#1322283- Create new permissivedomains CIL module and make it active. Resolves: rhbz#1320451 - Add support for new mock location - /usr/libexec/mock/mock. Resolves: rhbz#1271209 - Allow bitlee to create bitlee_var_t dirs. Resolves: rhbz#1268651 - Allow CIM provider to read sssd public files. Resolves: rhbz#1263339 - Fix some broken interfaces in distro policy. Resolves: rhbz#1121171 - Allow power button to shutdown the laptop. Resolves: rhbz#995898 - Allow lsm plugins to create named fixed disks. Resolves: rhbz#1238066 - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777 - Allow hyperv domains to rw hyperv devices. Resolves: rhbz#1309361 - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780 - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/ Resolves: rhbz#1297323 - Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib. - Add support for /dev/mptctl device used to check RAID status. Resolves: rhbz#1258029 - Create hyperv* devices and create rw interfaces for this devices. Resolves: rhbz#1309361 - Add fixes for selinux userspace moving the policy store to /var/lib/selinux. - Remove optional else block for dhcp ping- Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks. Resolves: rhbz#1263770 - Fix context of "/usr/share/nginx/html". Resolves: rhbz#1261857 - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics Resolves: rhbz#1270344 - Allow pmlogger to create pmlogger.primary.socket link file. Resolves: rhbz#1270344 - Label nagios scripts as httpd_sys_script_exec_t. Resolves: rhbz#1260306 - Add dontaudit interface for kdumpctl_tmp_t Resolves: rhbz#1156442 - Allow mdadm read files in EFI partition. Resolves: rhbz#1291801 - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid. Resolves: rhbz#1293140 - Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs Resolves: rhbz#1293140 - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface. Resolves: rhbz#1265102 - Add missing labeling for /usr/libexec/abrt-hook-ccpp. Resolves: rhbz#1213409 - Allow pcp_pmie and pcp_pmlogger to read all domains state. Resolves: rhbz#1206525 - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port. Resolves: rhbz#1275246 - cockpit has grown content in /var/run directory Resolves: rhbz#1279429 - Allow collectd setgid capability Resolves:#1310898 - Remove declaration of empty booleans in virt policy. Resolves: rhbz#1103153 - Fix typo in drbd policy - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp. Resolves: rhbz#1134883 - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files. Resolves: rhbz#1293788 - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern. Resolves: rhbz#1254188 - Allow abrt_t to read sysctl_net_t files. Resolves: rhbz#1254188 - The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system. - Allow abrt-hook-ccpp to getattr on all executables. - Allow setuid/setgid capabilities for abrt-hook-ccpp. Resolves: rhbz#1254188 - abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling. Resolves: rhbz#1254188 - Allow abrt-hook-ccpp to change SELinux user identity for created objects. Resolves: rhbz#1254188 - Dontaudit write access to inherited kdumpctl tmp files. Resolves: rbhz#1156442 - Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables) Resolves: rhbz#1291801 - Label 8952 tcp port as nsd_control. Resolves: rhbz#1293140 - Allow ipsec to use pam. Resolves: rhbz#1315700 - Allow to log out to gdm after screen was resized in session via vdagent. Resolves: rhbz#1249020 - Allow setrans daemon to read /proc/meminfo. Resolves: rhbz#1316804 - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg Resolves: rhbz#1298151 - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution Resolves: rhbz#1236579 - Add new selinux policy for systemd-resolved dawmon. Resolves: rhbz#1236579 - Add interface ssh_getattr_server_keys() interface. Resolves: rhbz#1306197 - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106 Resolves: rhbz#1306197 - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used. Resolves: rhbz#1309417 - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t. Resolves: rhbz#1293788- Prepare selinux-policy package for userspace release 2016-02-23. Resolves: rhbz#1305982- Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902 - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols. Resolves: rhbz#1242506 - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba. Resolves: rhbz#1284972 - Add support for systemd-hwdb daemon. Resolves: rhbz#1257940 - Add interface fs_setattr_cifs_dirs(). Resolves: rhbz#1284972- Add new SELinux policy fo targetd daemon. Resolves: rhbz#1063714 - Add new SELinux policy fo ipmievd daemon. Resolves: rhbz#1083031 - Add new SELinux policy fo hsqldb daemon. Resolves: rhbz#1083171 - Add new SELinux policy for blkmapd daemon. Resolves: rhbz#1072997 - Allow p11-child to connect to apache ports. - Label /usr/sbin/lvmlockd binary file as lvm_exec_t. Resolves: rhbz#1278028 - Add interface "lvm_manage_lock" to lvm policy. Resolves: rhbz#1063714- Allow openvswitch domain capability sys_rawio. Resolves: rhbz#1278495- Allow openvswitch to manage hugetlfs files and dirs. Resolves: rhbz#1278495 - Add fs_manage_hugetlbfs_files() interface. Resolves: rhbz#1278495- Allow smbcontrol domain to send sigchld to ctdbd domain. Resolves: #1293784 - Allow openvswitch read/write hugetlb filesystem. Resolves: #1278495Allow hypervvssd to list all mountpoints to have VSS live backup working correctly. Resolves:#1247880- Revert Add missing labeling for /usr/libexec/abrt-hook-ccpp patch Resolves: #1254188- Allow search dirs in sysfs types in kernel_read_security_state. Resolves: #1254188 - Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs. Resolves: #1254188- Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs Resolves: #1254188 - We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes. Resolves:#1261938- Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t. - Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions. Resolves:#1266928- We need to require sandbox_web_type attribute in sandbox_x_domain_template(). Resolves: #1261938 - ipsec: The NM helper needs to read the SAs Resolves: #1259786 - ipsec: Allow ipsec management to create ptys Resolves: #1259786- Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type. Resolves:#1261938 - Allow abrt_t domain to write to kernel msg device. Resolves: #1257828 - Allow rpcbind_t domain to change file owner and group Resolves: #1265266- Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. Resolves: #1256459- Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it. Resolves: #1230300 - Allow qpid daemon to connect on amqp tcp port. Resolves: #1261805- Label /etc/ipa/nssdb dir as cert_t Resolves:#1262718 - Do not provide docker policy files which is shipped by docker-selinux.rpm Resolves:#1262812- Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager Resolves: #1192338 - Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem. Resolves: #1238079 - Allow rhsmcertd_t send signull to unconfined_service_t domains. Resolves: #1176078 - Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t. - Allow openhpid_t daemon to manage snmp files and dirs. Resolves: #1243902 - Allow mdadm_t domain read/write to general ptys and unallocated ttys. Resolves: #1073314 - Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t Resolves: #1176078- Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. Resolves:#1250456- Fix labeling for fence_scsi_check script Resolves: #1255020 - Allow openhpid to read system state Allow openhpid to connect to tcp http port. Resolves: #1244248 - Allow openhpid to read snmp var lib files. Resolves: #1243902 - Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe - Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t Resolves: #1243403 - Remove bin_t label for /usr/share/cluster/fence_scsi_check\.pl Resolves: #1255020- Fix regexp in chronyd.fc file Resolves: #1243764 - Allow passenger to getattr filesystem xattr Resolves: #1196555 - Label mdadm.conf.anackbak as mdadm_conf_t file. Resolves: #1088904 - Revert "Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc." - Allow watchdog execute fenced python script. Resolves: #1255020 - Added inferface watchdog_unconfined_exec_read_lnk_files() - Remove labeling for /var/db/.*\.db as etc_t to label db files as system_db_t. Resolves: #1230877- Allow watchdog execute fenced python script. Resolves: #1255020 - Added inferface watchdog_unconfined_exec_read_lnk_files() - Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764 - Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764- Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file. Resolves: #1252442- Allow exec pidof under hypervkvp domain. Resolves: #1254870 - Allow hypervkvp daemon create connection to the system DBUS Resolves: #1254870- Allow openhpid_t to read system state. Resolves: #1244248 - Added labels for files provided by rh-nginx18 collection Resolves: #1249945 - Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db. Resolves: #1252968 - Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution. Resolves: #1243431 - Allow abrt_dump_oops_t to read proc_security_t files. - Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains - Add interface abrt_dump_oops_domtrans() - Add mountpoint dontaudit access check in rhsmcertd policy. Resolves: #1243431 - Allow samba_net_t to manage samba_var_t sock files. Resolves: #1252937 - Allow chrome setcap to itself. Resolves: #1251996 - Allow httpd daemon to manage httpd_var_lib_t lnk_files. Resolves: #1253706 - Allow chronyd exec systemctl Resolves: #1243764 - Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t. Resolves: #1243764 - Added interface fs_dontaudit_write_configfs_dirs - Add label for kernel module dep files in /usr/lib/modules Resolves:#916635 - Allow kernel_t domtrans to abrt_dump_oops_t - Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override. - Allow systemd-networkd to send logs to systemd-journald. Resolves: #1236616- Fix label on /var/tmp/kiprop_0 Resolves:#1220763 - Allow lldpad_t to getattr tmpfs_t. Resolves: #1246220 - Label /dev/shm/lldpad.* as lldapd_tmpfs_t Resolves: #1246220 - Allow audisp client to read system state.- Allow pcp_domain to manage pcp_var_lib_t lnk_files. Resolves: #1252341 - Label /var/run/xtables.* as iptables_var_run_t Resolves: #1243403- Add interface to read/write watchdog device - Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde Resolves:#1210237 - Allow apcupsd_t to read /sys/devices Resolves:#1189185 - Allow logrotate to reload services. Resolves: #1242453 - Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device) Resolves: #1244260 - Allow openhpid liboa_soap plugin to read generic certs. Resolves: #1244248 - Allow openhpid liboa_soap plugin to read resolv.conf file. Resolves: #1244248 - Label /usr/libexec/chrony-helper as chronyd_exec_t - Allow chronyd_t to read dhcpc state. - Allow chronyd to execute mkdir command.- Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t. Resolves:#1073314 - Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if 'dracut -fv' is executed in MLS. - Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if 'dracut -vf' is executed. We allow it for other SELinux users. - Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode. - Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling. Resolves:#1183503 - Add support for /etc/sanlock which is writable by sanlock daemon. Resolves:#1231377 - Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet. Resolves:#1243775 - Allow snapperd to pass data (one way only) via pipe negotiated over dbus Resolves:#1250550 - Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.- Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files). Resolves: #1243902 - Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device Resolves: #1238079 - Allow lsm_plugin_t to rw raw_fixed_disk. Resolves:#1238079 - Allow rhsmcertd to send signull to unconfined_service.- Allow httpd_suexec_t to read and write Apache stream sockets Resolves: #1243569 - Allow qpid to create lnk_files in qpid_var_lib_t Resolves: #1247279- Allow drbd to get attributes from filesystems. - Allow redis to read kernel parameters. Resolves: #1209518 - Allow virt_qemu_ga_t domtrans to passwd_t - Allow audisp_remote_t to start power unit files domain to allow halt system. Resolves: #1186780 - Allow audisp_remote_t to read/write user domain pty. Resolves: #1186780 - Label /usr/sbin/chpasswd as passwd_exec_t. - Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds). Resolves:#1221121- gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te - Allow pcp_pmcd daemon to read postfix config files. - Allow pcp_pmcd daemon to search postfix spool dirs. Resolves: #1213740 - Added Booleans: pcp_read_generic_logs. Resolves: #1213740 - Allow drbd to read configuration options used when loading modules. Resolves: #1134883 - Allow glusterd to manage nfsd and rpcd services. - Allow glusterd to communicate with cluster domains over stream socket. - glusterd call pcs utility which calls find for cib.* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.- Allow glusterd to manage nfsd and rpcd services. - Allow networkmanager to communicate via dbus with systemd_hostanmed. Resolves: #1234954 - Allow stream connect logrotate to prosody. - Add prosody_stream_connect() interface. - httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t. - Allow prosody to create own tmp files/dirs. Resolves:#1212498- Allow networkmanager read rfcomm port. Resolves:#1212498 - Remove non exists label. - Fix *_admin intefaces where body is not consistent with header. - Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config - Remove non exits nfsd_ro_t label. - Make all interfaces related to openshift_cache_t as deprecated. - Add rpm_var_run_t label to rpm_admin header - Add jabberd_lock_t label to jabberd_admin header. - Add samba_unconfined_script_exec_t to samba_admin header. - inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t - Fix ctdb policy - Add samba_signull_winbind() - Add samba_signull_unconfined_net() - Allow ctdbd_t send signull to samba_unconfined_net_t. - Allow openshift_initrc_t to communicate with firewalld over dbus Resolves:#1221326- Allow gluster to connect to all ports. It is required by random services executed by gluster. - Add interfaces winbind_signull(), samba_unconfined_net_signull(). - Dontaudit smbd_t block_suspend capability. This is kernel bug. - Allow ctdbd sending signull to process winbind, samba_unconfined_net, to checking if processes exists. - Add tmpreaper booleans to use nfs_t and samba_share_t. - Fix path from /usr/sbin/redis-server to /usr/bin/redis-server - Allow connect ypserv to portmap_port_t - Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files - Add support for openstack-nova-* packages - Allow NetworkManager_t send signull to dnssec_trigger_t. - Allow glusterd to execute showmount in the showmount domain. - Label swift-container-reconciler binary as swift_t. - Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files. - Add cobbler_var_lib_t to "/var/lib/tftpboot/boot(/.*)?" Resolves:#1213540 - Merge all nova_* labels under one nova_t.- Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins Resolves:#1233550 - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/ - Add support for oddjob based helper in FreeIPA. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add nagios_domtrans_unconfined_plugins() interface. - Update mta_filetrans_named_content() interface to cover more db files. Resolves:#1167468 - Add back ftpd_use_passive_mode boolean with fixed description. - Allow pmcd daemon stream connect to mysqld. - Allow pcp domains to connect to own process using unix_stream_socket. Resolves:#1213709 - Allow abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add support for oddjob based helper in FreeIPA. - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/- Allow iptables to read ctdbd lib files. Resolves:#1224879 - Add systemd_networkd_t to nsswitch domains. - Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization. Resolves:#1130675 - Allow NetworkManager write to sysfs. - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission. - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types. - Allow NetworkManager write to sysfs. - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. - Dontaudit apache to manage snmpd_var_lib_t files/dirs. - Add interface snmp_dontaudit_manage_snmp_var_lib_files(). - Dontaudit mozilla_plugin_t cap. sys_ptrace. - Rename xodbc-connect port to xodbc_connect - Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports. - Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot. - Dontaudit chrome to read passwd file. - nrpe needs kill capability to make gluster moniterd nodes working. Resolves:#1235587- We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem. - Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so. - Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password. - Label gluster python hooks also as bin_t. - Allow glusterd to interact with gluster tools running in a user domain - Add glusterd_manage_lib_files() interface. - ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid. - Allow samba_t net_admin capability to make CIFS mount working. - S30samba-start gluster hooks wants to search audit logs. Dontaudit it. Resolves:#1224879- Allow glusterd to send generic signals to systemd_passwd_agent processes. - Allow glusterd to access init scripts/units without defined policy - Allow glusterd to run init scripts. - Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain. Resolves:#1224879- Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block. - Allow samba-net to access /var/lib/ctdbd dirs/files. - Allow glusterd to send a signal to smbd. - Make ctdbd as home manager to access also FUSE. - Allow glusterd to use geo-replication gluster tool. - Allow glusterd to execute ssh-keygen. - Allow glusterd to interact with cluster services. - Allow glusterd to connect to the system DBUS for service (acquire_svc). - Label /dev/log correctly. Resolves:#1230932- Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs - Add cgdcbxd policy Resolves:#1072493 - Fix ftp_homedir boolean Resolve:#1097775 - Dontaudit ifconfig writing inhertited /var/log/pluto.log. - Allow cluster domain to dbus chat with systemd-logind. Resolves:#1145215 - Dontaudit write access to inherited kdumpctl tmp files Resolves:#1156442 - Allow isnsd_t to communicate with sssd Resolves:#1167702 - Allow rwho_t to communicate with sssd Resolves:#1167718 - Allow sblim_gatherd_t to communicate with sssd Resolves:#1167732 - Allow pkcs_slotd_t to communicate with sssd Resolves:#1167737 - Allow openvswitch_t to communicate with sssd Resolves:#1167816 - Allow mysqld_safe_t to communicate with sssd Resolves:#1167832 - Allow sshd_keygen_t to communicate with sssd Resolves:#1167840 - Add support for iprdbg logging files in /var/log. Resolves:#1174363 - Allow tmpreaper_t to manage ntp log content Resolves:#1176965 - Allow gssd_t to manage ssh keyring Resolves:#1184791 - Allow httpd_sys_script_t to send system log messages Resolves:#1185231 - Allow apcupsd_t to read /sys/devices Resolves:#1189185 - Allow dovecot_t sys_resource capability Resolves:#1191143 - Add support for mongod/mongos systemd unit files. Resolves:#1197038 - Add bacula fixes - Added label mysqld_etc_t for /etc/my.cnf.d/ dir. Resolves:#1203991- Label /usr/libexec/postgresql-ctl as postgresql_exec_t. - Add more restriction on entrypoint for unconfined domains. - Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface - Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default. - Update policy/mls for sockets related to access perm. Rules were contradictory. - Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow r un sudo from NRPE utils scripts and allow run nagios in conjunction w ith PNP4Nagios. Resolves:#1201054 - Don't use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead. - Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type - Label /var/lib/tftpboot/aarch64(/.*)? and /var/lib/tftpboot/images2(/.*)? - Add support for iprdbg logging files in /var/log. - Add fixes to rhsmcertd_t - Allow puppetagent_t to transfer firewalld messages over dbus - Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script. - Added label mysqld_etc_t for /etc/my.cnf.d/ dir. - Add support for mongod/mongos systemd unit files. - cloudinit and rhsmcertd need to communicate with dbus - Allow dovecot_t sys_resource capability- ALlow mongod execmem by default. - Update policy/mls for sockets. Rules were contradictory. Resolves:#1207133 - Allow a user to login with different security level via ssh.- Update seutil_manage_config() interface. Resolves:#1185962 - Allow pki-tomcat relabel pki_tomcat_etc_rw_t. - Turn on docker_transition_unconfined by default- Allow virtd to list all mountpoints. Resolves:#1180713- pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t. - Allow fowner capability for sssd because of selinux_child handling. - ALlow bind to read/write inherited ipsec pipes - Allow hypervkvp to read /dev/urandom and read addition states/config files. - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd. - Add glusterd_filetrans_named_pid() interface - Allow radiusd to connect to radsec ports. - Allow setuid/setgid for selinux_child - Allow lsmd plugin to connect to tcp/5988 by default. - Allow lsmd plugin to connect to tcp/5989 by default. - Update ipsec_manage_pid() interface. Resolves:#1184978- Update ipsec_manage_pid() interface. Resolves:#1184978- Allow ntlm_auth running in winbind_helper_t to access /dev/urandom.- Add auditing support for ipsec. Resolves:#1182524 - Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t - Allow netutils chown capability to make tcpdump working with -w- Allow ipsec to execute _updown.netkey script to run unbound-control. - Allow neutron to read rpm DB. - Add additional fixes for hyperkvp * creates new ifcfg-{name} file * Runs hv_set_ifconfig.sh, which does the following * Copies ifcfg-{name} to /etc/sysconfig/network-scripts - Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t - Add labeling for pacemaker.log. - Allow radius to connect/bind radsec ports. - Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log - Allow virt_qemu_ga to dbus chat with rpm. - Update virt_read_content() interface to allow read also char devices. - Allow glance-registry to connect to keystone port. Resolves:#1181818- Allow sssd to send dbus all user domains. Resolves:#1172291 - Allow lsm plugin to read certificates. - Fix labeling for keystone CGI scripts. - Make snapperd back as unconfined domain.- Fix bugs in interfaces discovered by sepolicy. - Allow slapd to read /usr/share/cracklib/pw_dict.hwm. - Allow lsm plugins to connect to tcp/18700 by default. - Allow brltty mknod capability to allow create /var/run/brltty/vcsa. - Fix pcp_domain_template() interface. - Fix conman.te. - Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc - Allow glance-scrubber to connect tcp/9191. - Add missing setuid capability for sblim-sfcbd. - Allow pegasus ioctl() on providers. - Add conman_can_network. - Allow chronyd to read chrony conf files located in /run/timemaster/. - Allow radius to bind on tcp/1813 port. - dontaudit block suspend access for openvpn_t - Allow conman to create files/dirs in /tmp. - Update xserver_rw_xdm_keys() interface to have 'setattr'. Resolves:#1172291 - Allow sulogin to read /dev/urandom and /dev/random. - Update radius port definition to have also tcp/18121 - Label prandom as random_device_t. - Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.- Allow virt_qemu_ga_t to execute kmod. - Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean. - Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs. Resolves:#1113725 - Enable OpenStack cinder policy - Add support for /usr/share/vdsm/daemonAdapter - Add support for /var/run/gluster- Remove old pkcsslotd.pp from minimum package - Allow rlogind to use also rlogin ports. - Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t. - Allow bacula to connect also to postgresql. - Label /usr/libexec/tomcat/server as tomcat_exec_t - Add support for /usr/sbin/ctdbd_wrapper - Add support for /usr/libexec/ppc64-diag/rtas_errd - Allow rpm_script_roles to access system_mail_t - Allow brltty to create /var/run/brltty - Allow lsmd plugin to access netlink_route_socket - Allow smbcontrol to read passwd - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it Resolves:#1140106 - Allow osad to execute rhn_check - Allow load_policy to rw inherited sssd pipes because of selinux_child - Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS - Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly - Add additional booleans substitions- Add seutil_dontaudit_access_check_semanage_module_store() interface Resolves:#1140106 - Update to have all _systemctl() interface also init_reload_services(). - Dontaudit access check on SELinux module store for sssd. - Add labeling for /sbin/iw. - Allow named_filetrans_domain to create ibus directory with correct labeling.- Allow radius to bind tcp/1812 radius port. - Dontaudit list user_tmp files for system_mail_t. - Label virt-who as virtd_exec_t. - Allow rhsmcertd to send a null signal to virt-who running as virtd_t. - Add missing alias for _content_rw_t. Resolves:#1089177 - Allow spamd to access razor-agent.log. - Add fixes for sfcb from libvirt-cim TestOnly bug. - Allow NetworkManager stream connect on openvpn. - Make /usr/bin/vncserver running as unconfined_service_t. - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain. - Label /etc/docker/certs.d as cert_t.- Label /etc/strongimcv as ipsec_conf_file_t. - Add support for /usr/bin/start-puppet-ca helper script Resolves:#1160727 - Allow rpm scripts to enable/disable transient systemd units. Resolves:#1154613 - Make kpropdas nsswitch domain Resolves:#1153561 - Make all glance domain as nsswitch domains Resolves:#1113281 - Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active - Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t Resolves:#1140106- Dontaudit access check on setfiles/load_policy for sssd_t. Resolves:#1140106 - Add kdump_rw_inherited_kdumpctl_tmp_pipes() Resolves:#1156442 - Make linuxptp services as unconfined. - Added new policy linuxptp. Resolves:#1149693 - Label keystone cgi files as keystone_cgi_script_exec_t. Resolves:#1138424 - Make tuned as unconfined domain- Allow guest to connect to libvirt using unix_stream_socket. - Allow all bus client domains to dbus chat with unconfined_service_t. - Allow inetd service without own policy to run in inetd_child_t which is unconfined domain. - Make opensm as nsswitch domain to make it working with sssd. - Allow brctl to read meminfo. - Allow winbind-helper to execute ntlm_auth in the caller domain. Resolves:#1160339 - Make plymouthd as nsswitch domain to make it working with sssd. Resolves:#1160196 - Make drbd as nsswitch domain to make it working with sssd. - Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working. - Add support for /var/lib/sntp directory. - Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc - Allow winbind to read usermodehelper - Allow telepathy domains to execute shells and bin_t - Allow gpgdomains to create netlink_kobject_uevent_sockets - Allow mongodb to bind to the mongo port and mongos to run as mongod_t - Allow abrt to read software raid state. - Allow nslcd to execute netstat. - Allow dovecot to create user's home directory when they log into IMAP. - Allow login domains to create kernel keyring with different level.- Allow modemmanger to connectto itself Resolves:#1120152 - Allow pki_tomcat to create link files in /var/lib/pki-ca. Resolves:#1121744 - varnishd needs to have fsetid capability Resolves:#1125165 - Allow snapperd to dbus chat with system cron jobs. Resolves:#1152447 - Allow dovecot to create user's home directory when they log into IMAP Resolves:#1152773 - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t. - ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. - Allow nslcd to execute netstat. - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability. - Allow nslcd to read /dev/urandom.- Add back kill permisiion for system class Resolves:#1150011- Add back kill permisiion for service class Resolves:#1150011 - Make rhsmcertd_t also as dbus domain. - Allow named to create DNS_25 with correct labeling. - Add cloudform_dontaudit_write_cloud_log() - Call auth_use_nsswitch to apache to read/write cloud-init keys. - Allow cloud-init to dbus chat with certmonger. - Fix path to mon_statd_initrc_t script. - Allow all RHCS services to read system state. - Allow dnssec_trigger_t to execute unbound-control in own domain. - kernel_read_system_state needs to be called with type. Moved it to antivirus.if. - Added policy for mon_statd and mon_procd services. BZ (1077821) - Allow opensm_t to read/write /dev/infiniband/umad1. - Allow mongodb to manage own log files. - Allow neutron connections to system dbus. - Add support for /var/lib/swiftdirectory. - Allow nova-scheduler to read certs. - Allow openvpn to access /sys/fs/cgroup dir. - Allow openvpn to execute systemd-passwd-agent in systemd_passwd_agent_t to make openvpn working with systemd. - Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files. - Add auth_use_nsswitch for portreserve to make it working with sssd. - automount policy is non-base module so it needs to be called in optional block. - ALlow sensord to getattr on sysfs. - Label /usr/share/corosync/corosync as cluster_exec_t. - Allow lmsd_plugin to read passwd file. BZ(1093733) - Allow read antivirus domain all kernel sysctls. - Allow mandb to getattr on file systems - Allow nova-console to connect to mem_cache port. - Make sosreport as unconfined domain. - Allow mondogdb to 'accept' accesses on the tcp_socket port. - ALlow sanlock to send a signal to virtd_t.- Build also MLS policy Resolves:#1138424- Add back kill permisiion for system class - Allow iptables read fail2ban logs. - Fix radius labeled ports - Add userdom_manage_user_tmpfs_files interface - Allow libreswan to connect to VPN via NM-libreswan. - Label 4101 tcp port as brlp port - fix dev_getattr_generic_usb_dev interface - Allow all domains to read fonts - Make sure /run/systemd/generator and system is labeled correctly on creation. - Dontaudit aicuu to search home config dir. - Make keystone_cgi_script_t domain. Resolves:#1138424 - Fix bug in drbd policy, - Added support for cpuplug. - ALlow sanlock_t to read sysfs_t. - Added sendmail_domtrans_unconfined interface - Fix broken interfaces - radiusd wants to write own log files. - Label /usr/libexec/rhsmd as rhsmcertd_exec_t - Allow rhsmcertd send signull to setroubleshoot. - Allow rhsmcertd manage rpm db. - Added policy for blrtty. - Fix keepalived policy - Allow rhev-agentd dbus chat with systemd-logind. - Allow keepalived manage snmp var lib sock files. - Add support for /var/lib/graphite-web - Allow NetworkManager to create Bluetooth SDP sockets - It's going to do the the discovery for DUN service for modems with Bluez 5. - Allow swift to connect to all ephemeral ports by default. - Allow sssd to read selinux config to add SELinux user mapping. - Allow lsmd to search own plguins. - Allow abrt to read /dev/memto generate an unique machine_id and uses sosuploader's algorithm based off dmidecode[1] fields. - ALlow zebra for user/group look-ups. - Allow nova domains to getattr on all filesystems. - Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes. - Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket. - Allow rhnsd_t to manage also rhnsd config symlinks. - ALlow user mail domains to create dead.letter. - Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. - Allow pki-tomcat to change SELinux object identity. - Allow radious to connect to apache ports to do OCSP check - Allow git cgi scripts to create content in /tmp - Allow cockpit-session to do GSSAPI logins. - Allow sensord read in /proc - Additional access required by usbmuxd- Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems - Label /usr/lib/erlang/erts.*/bin files as bin_t - Add files_dontaudit_access_check_home_dir() inteface. - Allow udev_t mounton udev_var_run_t dirs #(1128618) - Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it. - Add init_dontaudit_read_state() interface. - Add label for ~/.local/share/fonts - Allow unconfined_r to access unconfined_service_t. - Allow init to read all config files - Add new interface to allow creation of file with lib_t type - Assign rabbitmq port. - Allow unconfined_service_t to dbus chat with all dbus domains - Add new interfaces to access users keys. - Allow domains to are allowed to mounton proc to mount on files as well as dirs - Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories. - Add a port definition for shellinaboxd - Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t - Allow userdomains to stream connect to pcscd for smart cards - Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix) - Update to rawhide-contrib changes Resolves:#1123844- Rebase to 3.13.1 which we have in Fedora21 Resolves:#1128284- Back port fixes from Fedora. Mainly OpenStack and Docker fixes- Add policy-rhel-7.1-{base,contrib} patches- Add support for us_cli ports - Fix labeling for /var/run/user//gvfs - add support for tcp/9697 - Additional rules required by openstack, needs backport to F20 and RHEL7 - Additional access required by docker - ALlow motion to use tcp/8082 port - Allow init_t to setattr/relabelfrom dhcp state files - Dontaudit antivirus domains read access on all security files by default - Add missing alias for old amavis_etc_t type - Allow block_suspend cap for haproxy - Additional fixes for instack overcloud - Allow OpenStack to read mysqld_db links and connect to MySQL - Remove dup filename rules in gnome.te - Allow sys_chroot cap for httpd_t and setattr on httpd_log_t - Allow iscsid to handle own unit files - Add iscsi_systemctl() - Allow mongod to create also sock_files in /run with correct labeling - Allow httpd to send signull to apache script domains and don't audit leaks - Allow rabbitmq_beam to connect to httpd port - Allow aiccu stream connect to pcscd - Allow dmesg to read hwdata and memory dev - Allow all freeipmi domains to read/write ipmi devices - Allow sblim_sfcbd to use also pegasus-https port - Allow rabbitmq_epmd to manage rabbit_var_log_t files - Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input - Allow docker to status any unit file and allow it to start generic unit files- Change hsperfdata_root to have as user_tmp_t Resolves:#1076523- Fix Multiple same specifications for /var/named/chroot/dev/zero - Add labels for /var/named/chroot_sdb/dev devices - Add support for strongimcv - Use kerberos_keytab_domains in auth_use_nsswitch - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to - Allow net_raw cap for neutron_t and send sigkill to dnsmasq - Fix ntp_filetrans_named_content for sntp-kod file - Add httpd_dbus_sssd boolean - Dontaudit exec insmod in boinc policy - Rename kerberos_keytab_domain to kerberos_keytab_domains - Add kerberos_keytab_domain() - Fix kerberos_keytab_template() - Make all domains which use kerberos as kerberos_keytab_domain Resolves:#1083670 - Allow kill capability to winbind_t- varnishd wants chown capability - update ntp_filetrans_named_content() interface - Add additional fixes for neutron_t. #1083335 - Dontaudit getattr on proc_kcore_t - Allow pki_tomcat_t to read ipa lib files - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign - Allow init_t run /sbin/augenrules - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces - Allow unpriv SELinux user to use sandbox - Add default label for /tmp/hsperfdata_root- Add file subs also for /var/home- Allow xauth_t to read user_home_dir_t lnk_file - Add labeling for lightdm-data - Allow certmonger to manage ipa lib files - Add support for /var/lib/ipa - Allow pegasus to getattr virt_content - Added some new rules to pcp policy - Allow chrome_sandbox to execute config_home_t - Add support for ABRT FAF- Allow kdm to send signull to remote_login_t process - Add gear policy - Turn on gear_port_t - Allow cgit to read gitosis lib files by default - Allow vdagent to read xdm state - Allow NM and fcoeadm to talk together over unix_dgram_socket- Back port fixes for pegasus_openlmi_admin_t from rawhide Resolves:#1080973 - Add labels for ostree - Add SELinux awareness for NM - Label /usr/sbin/pwhistory_helper as updpwd_exec_t- add gnome_append_home_config() - Allow thumb to append GNOME config home files - Allow rasdaemon to rw /dev/cpu//msr - fix /var/log/pki file spec - make bacula_t as auth_nsswitch domain - Identify pki_tomcat_cert_t as a cert_type - Define speech-dispater_exec_t as an application executable - Add a new file context for /var/named/chroot/run directory - update storage_filetrans_all_named_dev for sg* devices - Allow auditctl_t to getattr on all removeable devices - Allow nsswitch_domains to stream connect to nmbd - Allow unprivusers to connect to memcached - label /var/lib/dirsrv/scripts-INSTANCE as bin_t- Allow also unpriv user to run vmtools - Allow secadm to read /dev/urandom and meminfo Resolves:#1079250 - Add booleans to allow docker processes to use nfs and samba - Add mdadm_tmpfs support - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t - Allow vmware-user-sui to use user ttys - Allow talk 2 users logged via console too - Allow ftp services to manage xferlog_t - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies - allow anaconda to dbus chat with systemd-localed- allow anaconda to dbus chat with systemd-localed - Add fixes for haproxy based on bperkins@redhat.com - Allow cmirrord to make dmsetup working - Allow NM to execute arping - Allow users to send messages through talk - Add userdom_tmp_role for secadm_t- Add additional fixes for rtas_errd - Fix transitions for tmp/tmpfs in rtas.te - Allow rtas_errd to readl all sysctls- Add support for /var/spool/rhsm/debug - Make virt_sandbox_use_audit as True by default - Allow svirt_sandbox_domains to ptrace themselves- Allow docker containers to manage /var/lib/docker content- Allow docker to read tmpfs_t symlinks - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets- Allow collectd to talk to libvirt - Allow chrome_sandbox to use leaked unix_stream_sockets - Dontaudit leaks of sockets into chrome_sandbox_t - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t - Run vmtools as unconfined domains - Allow snort to manage its log files - Allow systemd_cronjob_t to be entered via bin_t - Allow procman to list doveconf_etc_t - allow keyring daemon to create content in tmpfs directories - Add proper labelling for icedtea-web - vpnc is creating content in networkmanager var run directory - Label sddm as xdm_exec_t to make KDE working again - Allow postgresql to read network state - Allow java running as pki_tomcat to read network sysctls - Fix cgroup.te to allow cgred to read cgconfig_etc_t - Allow beam.smp to use ephemeral ports - Allow winbind to use the nis to authenticate passwords- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least. - Allow net_admin cap for fence_virtd running as fenced_t - Make abrt-java-connector working - Make cimtest script 03_defineVS.py of ComputerSystem group working - Fix git_system_enable_homedirs boolean - Allow munin mail plugins to read network systcl- Allow vmtools_helper_t to execute bin_t - Add support for /usr/share/joomla - /var/lib/containers should be labeled as openshift content for now - Allow docker domains to talk to the login programs, to allow a process to login into the container - Allow install_t do dbus chat with NM - Fix interface names in anaconda.if - Add install_t for anaconda. A new type is a part of anaconda policy - sshd to read network sysctls- Allow zabbix to send system log msgs - Allow init_t to stream connect to ipsec Resolves:#1060775- Add docker_connect_any boolean- Allow unpriv SELinux users to dbus chat with firewalld - Add lvm_write_metadata() - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type - Allow pegasus_openlmi_storage_t to write lvm metadata - Add hide_broken_symptoms for kdumpgui because of systemd bug - Make kdumpgui_t as unconfined domain Resolves:#1044299 - Allow docker to connect to tcp/5000- Allow numad to write scan_sleep_millisecs - Turn on entropyd_use_audio boolean by default - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf. - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo - Fix label on irclogs in the homedir - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix - Allow postgresql to use ldap - Add missing syslog-conn port - Add support for /dev/vmcp and /dev/sclp Resolves:#1069310- Modify xdm_write_home to allow create files/links in /root with xdm_home_ - Allow virt domains to read network state Resolves:#1072019- Added pcp rules - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6 - clean up ctdb.te - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow certmonger to list home dirs- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask - Add sysnet_filetrans_named_content_ifconfig() interface - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow kerberos keytab domains to manage sssd/userdomain keys" - Allow to run ip cmd in neutron_t domain- Allow block_suspend cap2 for systemd-logind and rw dri device - Add labeling for /usr/libexec/nm-libreswan-service - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working - Add xserver_rw_xdm_keys() - Allow rpm_script_t to dbus chat also with systemd-located - Fix ipa_stream_connect_otpd() - update lpd_manage_spool() interface - Allow krb5kdc to stream connect to ipa-otpd - Add ipa_stream_connect_otpd() interface - Allow vpnc to unlink NM pids - Add networkmanager_delete_pid_files() - Allow munin plugins to access unconfined plugins - update abrt_filetrans_named_content to cover /var/spool/debug - Label /var/spool/debug as abrt_var_cache_t - Allow rhsmcertd to connect to squid port - Make docker_transition_unconfined as optional boolean - Allow certmonger to list home dirs- Make snapperd as unconfined domain and add additional fixes for it - Remove nsplugin.pp module on upgrade- Add snapperd_home_t for HOME_DIR/.snapshots directory - Make sosreport as unconfined domain - Allow sosreport to execute grub2-probe - Allow NM to manage hostname config file - Allow systemd_timedated_t to dbus chat with rpm_script_t - Allow lsmd plugins to connect to http/ssh/http_cache ports by default - Add lsmd_plugin_connect_any boolean - Allow mozilla_plugin to attempt to set capabilities - Allow lsdm_plugins to use tcp_socket - Dontaudit mozilla plugin from getattr on /proc or /sys - Dontaudit use of the keyring by the services in a sandbox - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t - Allow rabbitmq_beam to connect to jabber_interserver_port - Allow logwatch_mail_t to transition to qmail_inject and queueu - Added new rules to pcp policy - Allow vmtools_helper_t to change role to system_r - Allow NM to dbus chat with vmtools - Fix couchdb_manage_files() to allow manage couchdb conf files - Add support for /var/run/redis.sock - dontaudit gpg trying to use audit - Allow consolekit to create log directories and files - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow pkcsslotd to read users state - Add ioctl to init_dontaudit_rw_stream_socket - Add systemd_hostnamed_manage_config() interface - Remove transition for temp dirs created by init_t - gdm-simple-slave uses use setsockopt - sddm-greater is a xdm type program- Add lvm_read_metadata() - Allow auditadm to search /var/log/audit dir - Add lvm_read_metadata() interface - Allow confined users to run vmtools helpers - Fix userdom_common_user_template() - Generic systemd unit scripts do write check on / - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files - Add additional fixes needed for init_t and setup script running in generic unit files - Allow general users to create packet_sockets - added connlcli port - Add init_manage_transient_unit() interface - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t - Fix userdomain.te to require passwd class - devicekit_power sends out a signal to all processes on the message bus when power is going down - Dontaudit rendom domains listing /proc and hittping system_map_t - Dontauit leaks of var_t into ifconfig_t - Allow domains that transition to ssh_t to manipulate its keyring - Define oracleasm_t as a device node - Change to handle /root as a symbolic link for os-tree - Allow sysadm_t to create packet_socket, also move some rules to attributes - Add label for openvswitch port - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label. - Allow postfix_local to read .forward in pcp lib files - Allow pegasus_openlmi_storage_t to read lvm metadata - Add additional fixes for pegasus_openlmi_storage_t - Allow bumblebee to manage debugfs - Make bumblebee as unconfined domain - Allow snmp to read etc_aliases_t - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem - Allow pegasus_openlmi_storage_t to read /proc/1/environ - Dontaudit read gconf files for cupsd_config_t - make vmtools as unconfined domain - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig. - Allow collectd_t to use a mysql database - Allow ipa-otpd to perform DNS name resolution - Added new policy for keepalived - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd - Add additional fixes new pscs-lite+polkit support - Add labeling for /run/krb5kdc - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20 - Allow pcscd to read users proc info - Dontaudit smbd_t sending out random signuls - Add boolean to allow openshift domains to use nfs - Allow w3c_validator to create content in /tmp - zabbix_agent uses nsswitch - Allow procmail and dovecot to work together to deliver mail - Allow spamd to execute files in homedir if boolean turned on - Allow openvswitch to listen on port 6634 - Add net_admin capability in collectd policy - Fixed snapperd policy - Fixed bugsfor pcp policy - Allow dbus_system_domains to be started by init - Fixed some interfaces - Add kerberos_keytab_domain attribute - Fix snapperd_conf_t def- Addopt corenet rules for unbound-anchor to rpm_script_t - Allow runuser to send send audit messages. - Allow postfix-local to search .forward in munin lib dirs - Allow udisks to connect to D-Bus - Allow spamd to connect to spamd port - Fix syntax error in snapper.te - Dontaudit osad to search gconf home files - Allow rhsmcertd to manage /etc/sysconf/rhn director - Fix pcp labeling to accept /usr/bin for all daemon binaries - Fix mcelog_read_log() interface - Allow iscsid to manage iscsi lib files - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it. - Make tuned_t as unconfined domain for RHEL7.0 - Allow ABRT to read puppet certs - Add sys_time capability for virt-ga - Allow gemu-ga to domtrans to hwclock_t - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages - Fix some AVCs in pcp policy - Add to bacula capability setgid and setuid and allow to bind to bacula ports - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t - Add access rhnsd and osad to /etc/sysconfig/rhn - drbdadm executes drbdmeta - Fixes needed for docker - Allow epmd to manage /var/log/rabbitmq/startup_err file - Allow beam.smp connect to amqp port - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t - Allow systemd_tmpfiles_t to manage all non security files on the system - Added labels for bacula ports - Fix label on /dev/vfio/vfio - Add kernel_mounton_messages() interface - init wants to manage lock files for iscsi- Added osad policy - Allow postfix to deliver to procmail - Allow bumblebee to seng kill signal to xserver - Allow vmtools to execute /usr/bin/lsb_release - Allow docker to write system net ctrls - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix pcp.te - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl- Turn on bacula, rhnsd policy - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl - Fixes for *_admin interfaces - Add pegasus_openlmi_storage_var_run_t type def - Add support for /var/run/openlmi-storage - Allow tuned to create syslog.conf with correct labeling - Add httpd_dontaudit_search_dirs boolean - Add support for winbind.service - ALlow also fail2ban-client to read apache logs - Allow vmtools to getattr on all fs - Add support for dey_sapi port - Add logging_filetrans_named_conf() - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring- Update snapper policy - Allow domains to append rkhunter lib files - Allow snapperd to getattr on all fs - Allow xdm to create /var/gdm with correct labeling - Add label for snapper.log - Allow fail2ban-client to read apache log files - Allow thumb_t to execute dbus-daemon in thumb_t- Allow gdm to create /var/gdm with correct labeling - Allow domains to append rkhunterl lib files. #1057982 - Allow systemd_tmpfiles_t net_admin to communicate with journald - Add interface to getattr on an isid_type for any type of file - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory - Allow initrc_t domtrans to authconfig if unconfined is enabled - Allow docker and mount on devpts chr_file - Allow docker to transition to unconfined_t if boolean set - init calling needs to be optional in domain.te - Allow uncofined domain types to handle transient unit files - Fix labeling for vfio devices - Allow net_admin capability and send system log msgs - Allow lldpad send dgram to NM - Add networkmanager_dgram_send() - rkhunter_var_lib_t is correct type - Back port pcp policy from rawhide - Allow openlmi-storage to read removable devices - Allow system cron jobs to manage rkhunter lib files - Add rkhunter_manage_lib_files() - Fix ftpd_use_fusefs boolean to allow manage also symlinks - Allow smbcontrob block_suspend cap2 - Allow slpd to read network and system state info - Allow NM domtrans to iscsid_t if iscsiadm is executed - Allow slapd to send a signal itself - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA. - Fix plymouthd_create_log() interface - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container - Allow postfix and cyrus-imapd to work out of box - Allow fcoemon to talk with unpriv user domain using unix_stream_socket - Dontaudit domains that are calling into journald to net_admin - Add rules to allow vmtools to do what it does - snapperd is D-Bus service - Allow OpenLMI PowerManagement to call 'systemctl --force reboot' - Add haproxy_connect_any boolean - Allow haproxy also to use http cache port by default Resolves:#1058248- Allow apache to write to the owncloud data directory in /var/www/html... - Allow consolekit to create log dir - Add support for icinga CGI scripts - Add support for icinga - Allow kdumpctl_t to create kdump lock file Resolves:#1055634 - Allow kdump to create lnk lock file - Allow nscd_t block_suspen capability - Allow unconfined domain types to manage own transient unit file - Allow systemd domains to handle transient init unit files - Add interfaces to handle transient- Add cron unconfined role support for uncofined SELinux user - Call corenet_udp_bind_all_ports() in milter.te - Allow fence_virtd to connect to zented port - Fix header for mirrormanager_admin() - Allow dkim-milter to bind udp ports - Allow milter domains to send signull itself - Allow block_suspend for yum running as mock_t - Allow beam.smp to manage couchdb files - Add couchdb_manage_files() - Add labeling for /var/log/php_errors.log - Allow bumblebee to stream connect to xserver - Allow bumblebee to send a signal to xserver - gnome-thumbnail to stream connect to bumblebee - Allow xkbcomp running as bumblebee_t to execute bin_t - Allow logrotate to read squid.conf - Additional rules to get docker and lxc to play well with SELinux - Allow bumbleed to connect to xserver port - Allow pegasus_openlmi_storage_t to read hwdata- Allow init_t to work on transitient and snapshot unit files - Add logging_manage_syslog_config() - Update sysnet_dns_name_resolve() to allow connect to dnssec por - Allow pegasus_openlmi_storage_t to read hwdata Resolves:#1031721 - Fix rhcs_rw_cluster_tmpfs() - Allow fenced_t to bind on zented udp port - Added policy for vmtools - Fix mirrormanager_read_lib_files() - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files - Allow ctdb to create sock files in /var/run/ctdb - Add sblim_filetrans_named_content() interface - Allow rpm scritplets to create /run/gather with correct labeling - Allow gnome keyring domains to create gnome config dirs - Dontaudit read/write to init stream socket for lsmd_plugin_t - Allow automount to read nfs link files - Allow lsm plugins to read/write lsmd stream socket - Allow certmonger to connect ldap port to make IPA CA certificate renewal working. - Add also labeling for /var/run/ctdb - Add missing labeling for /var/lib/ctdb - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446 - Dontaudit hypervkvp to search homedirs - Dontaudit hypervkvp to search admin homedirs - Allow hypervkvp to execute bin_t and ifconfig in the caller domain - Dontaudit xguest_t to read ABRT conf files - Add abrt_dontaudit_read_config() - Allow namespace-init to getattr on fs - Add thumb_role() also for xguest - Add filename transitions to create .spamassassin with correct labeling - Allow apache domain to read mirrormanager pid files - Allow domains to read/write shm and sem owned by mozilla_plugin_t - Allow alsactl to send a generic signal to kernel_t- Add back rpm_run() for unconfined user- Add missing files_create_var_lib_dirs() - Fix typo in ipsec.te - Allow passwd to create directory in /var/lib - Add filename trans also for event21 - Allow iptables command to read /dev/rand - Add sigkill capabilityfor ipsec_t - Add filename transitions for bcache devices - Add additional rules to create /var/log/cron by syslogd_t with correct labeling - Add give everyone full access to all key rings - Add default lvm_var_run_t label for /var/run/multipathd - Fix log labeling to have correct default label for them after logrotate - Labeled ~/.nv/GLCache as being gstreamer output - Allow nagios_system_plugin to read mrtg lib files - Add mrtg_read_lib_files() - Call rhcs_rw_cluster_tmpfs for dlm_controld - Make authconfing as named_filetrans domain - Allow virsh to connect to user process using stream socket - Allow rtas_errd to read rand/urand devices and add chown capability - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp Resolves:#1051497 - Add also chown cap for abrt_upload_watch_t. It already has dac_override - Allow sosreport to manage rhsmcertd pid files - Add rhsmcertd_manage_pid_files() - Allow also setgid cap for rpc.gssd - Dontaudit access check for abrt on cert_t - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind- Fix semanage import handling in spec file- Add default lvm_var_run_t label for /var/run/multipathd Resolves:#1051430 - Fix log labeling to have correct default label for them after logrotate - Add files_write_root_dirs - Add new openflow port label for 6653/tcp and 6633/tcp - Add xserver_manage_xkb_libs() - Label tcp/8891 as milter por - Allow gnome_manage_generic_cache_files also create cache_home_t files - Fix aide.log labeling - Fix log labeling to have correct default label for them after logrotate - Allow mysqld-safe write access on /root to make mysqld working - Allow sosreport domtrans to prelikn - Allow OpenvSwitch to connec to openflow ports - Allow NM send dgram to lldpad - Allow hyperv domains to execute shell - Allow lsmd plugins stream connect to lsmd/init - Allow sblim domains to create /run/gather with correct labeling - Allow httpd to read ldap certs - Allow cupsd to send dbus msgs to process with different MLS level - Allow bumblebee to stream connect to apmd - Allow bumblebee to run xkbcomp - Additional allow rules to get libvirt-lxc containers working with docker - Additional allow rules to get libvirt-lxc containers working with docker - Allow docker to getattr on itself - Additional rules needed for sandbox apps - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled - httpd should be able to send signal/signull to httpd_suexec_t - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.- Add neutron fixes- Allow sshd to write to all process levels in order to change passwd when running at a level - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range - Allow apcuspd_t to status and start the power unit file - Allow udev to manage kdump unit file - Added new interface modutils_dontaudit_exec_insmod - Allow cobbler to search dhcp_etc_t directory - systemd_systemctl needs sys_admin capability - Allow sytemd_tmpfiles_t to delete all directories - passwd to create gnome-keyring passwd socket - Add missing zabbix_var_lib_t type - Fix filename trans for zabbixsrv in zabbix.te - Allow fprintd_t to send syslog messages - Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port - Allow mozilla plugin to chat with policykit, needed for spice - Allow gssprozy to change user and gid, as well as read user keyrings - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly - Allow polipo to connect to http_cache_ports - Allow cron jobs to manage apache var lib content - Allow yppassword to manage the passwd_file_t - Allow showall_t to send itself signals - Allow cobbler to restart dhcpc, dnsmasq and bind services - Allow certmonger to manage home cert files - Add userdom filename trans for user mail domains - Allow apcuspd_t to status and start the power unit file - Allow cgroupdrulesengd to create content in cgoups directories - Allow smbd_t to signull cluster - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t - Add label for /var/spool/cron.aquota.user - Allow sandbox_x domains to use work with the mozilla plugin semaphore - Added new policy for speech-dispatcher - Added dontaudit rule for insmod_exec_t in rasdaemon policy - Updated rasdaemon policy - Allow system_mail_t to transition to postfix_postdrop_t - Clean up mirrormanager policy - Allow virt_domains to read cert files, needs backport to RHEL7 - Allow sssd to read systemd_login_var_run_t - Allow irc_t to execute shell and bin-t files: - Add new access for mythtv - Allow rsync_t to manage all non auth files - allow modemmanger to read /dev/urand - Allow sandbox apps to attempt to set and get capabilties- Add labeling for /var/lib/servicelog/servicelog.db-journal - Add support for freeipmi port - Add sysadm_u_default_contexts - Make new type to texlive files in homedir - Allow subscription-manager running as sosreport_t to manage rhsmcertd - Additional fixes for docker.te - Remove ability to do mount/sys_admin by default in virt_sandbox domains - New rules required to run docker images within libivrt - Add label for ~/.cvsignore - Change mirrormanager to be run by cron - Add mirrormanager policy - Fixed bumblebee_admin() and mip6d_admin() - Add log support for sensord - Fix typo in docker.te - Allow amanda to do backups over UDP - Allow bumblebee to read /etc/group and clean up bumblebee.te - type transitions with a filename not allowed inside conditionals - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7 - Make new type to texlive files in homedir- Allow freeipmi_ipmidetectd_t to use freeipmi port - Update freeipmi_domain_template() - Allow journalctl running as ABRT to read /run/log/journal - Allow NM to read dispatcher.d directory - Update freeipmi policy - Type transitions with a filename not allowed inside conditionals - Allow tor to bind to hplip port - Make new type to texlive files in homedir - Allow zabbix_agent to transition to dmidecode - Add rules for docker - Allow sosreport to send signull to unconfined_t - Add virt_noatsecure and virt_rlimitinh interfaces - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port - Add sysadm_u_default_contexts - Add logging_read_syslog_pid() - Fix userdom_manage_home_texlive() interface - Make new type to texlive files in homedir - Add filename transitions for /run and /lock links - Allow virtd to inherit rlimit information Resolves:#975358- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t Resolves:#1039879 - Add labeling for /usr/lib/systemd/system/mariadb.service - Allow hyperv_domain to read sysfs - Fix ldap_read_certs() interface to allow acess also link files - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt - Allow tuned to run modprobe - Allow portreserve to search /var/lib/sss dir - Add SELinux support for the teamd package contains team network device control daemon. - Dontaudit access check on /proc for bumblebee - Bumblebee wants to load nvidia modules - Fix rpm_named_filetrans_log_files and wine.te - Add conman policy for rawhide - DRM master and input event devices are used by the TakeDevice API - Clean up bumblebee policy - Update pegasus_openlmi_storage_t policy - Add freeipmi_stream_connect() interface - Allow logwatch read madm.conf to support RAID setup - Add raid_read_conf_files() interface - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling - add rpm_named_filetrans_log_files() interface - Allow dkim-milter to create files/dirs in /tmp - update freeipmi policy - Add policy for freeipmi services - Added rdisc_admin and rdisc_systemctl interfaces - opensm policy clean up - openwsman policy clean up - ninfod policy clean up - Added new policy for ninfod - Added new policy for openwsman - Added rdisc_admin and rdisc_systemctl interfaces - Fix kernel_dontaudit_access_check_proc() - Add support for /dev/uhid - Allow sulogin to get the attributes of initctl and sys_admin cap - Add kernel_dontaudit_access_check_proc() - Fix dev_rw_ipmi_dev() - Fix new interface in devices.if - DRM master and input event devices are used by the TakeDevice API - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev() - Added support for default conman port - Add interfaces for ipmi devices- Allow sosreport to send a signal to ABRT - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t - Label /usr/sbin/htcacheclean as httpd_exec_t Resolves:#1037529 - Added support for rdisc unit file - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs - Allow runuser running as logrotate connections to system DBUS - Label bcache devices as fixed_disk_device_t - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t- Add back setpgid/setsched for sosreport_t- Added fix for clout_init to transition to rpm_script_t (dwalsh@redhat.com)- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel. - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on - Add lsmd_plugin_t for lsm plugins - Allow dovecot-deliver to search mountpoints - Add labeling for /etc/mdadm.conf - Allow opelmi admin providers to dbus chat with init_t - Allow sblim domain to read /dev/urandom and /dev/random - Allow apmd to request the kernel load modules - Add glusterd_brick_t type - label mate-keyring-daemon with gkeyringd_exec_t - Add plymouthd_create_log() - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6 - Allow sssd to request the kernel loads modules - Allow gpg_agent to use ssh-add - Allow gpg_agent to use ssh-add - Dontaudit access check on /root for myslqd_safe_t - Allow ctdb to getattr on al filesystems - Allow abrt to stream connect to syslog - Allow dnsmasq to list dnsmasq.d directory - Watchdog opens the raw socket - Allow watchdog to read network state info - Dontaudit access check on lvm lock dir - Allow sosreport to send signull to setroubleshootd - Add setroubleshoot_signull() interface - Fix ldap_read_certs() interface - Allow sosreport all signal perms - Allow sosreport to run systemctl - Allow sosreport to dbus chat with rpm - Add glusterd_brick_t files type - Allow zabbix_agentd to read all domain state - Clean up rtas.if - Allow smoltclient to execute ldconfig - Allow sosreport to request the kernel to load a module - Fix userdom_confined_admin_template() - Add back exec_content boolean for secadm, logadm, auditadm - Fix files_filetrans_system_db_named_files() interface - Allow sulogin to getattr on /proc/kcore - Add filename transition also for servicelog.db-journal - Add files_dontaudit_access_check_root() - Add lvm_dontaudit_access_check_lock() interface- Allow watchdog to read /etc/passwd - Allow browser plugins to connect to bumblebee - New policy for bumblebee and freqset - Add new policy for mip6d daemon - Add new policy for opensm daemon - Allow condor domains to read/write condor_master udp_socket - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift - Add back file_pid_filetrans for /var/run/dlm_controld - Allow smbd_t to use inherited tmpfs content - Allow mcelog to use the /dev/cpu device - sosreport runs rpcinfo - sosreport runs subscription-manager - Allow staff_t to run frequency command - Allow systemd_tmpfiles to relabel log directories - Allow staff_t to read xserver_log file - Label hsperfdata_root as tmp_t- More sosreport fixes to make ABRT working- Fix files_dontaudit_unmount_all_mountpoints() - Add support for 2608-2609 tcp/udp ports - Should allow domains to lock the terminal device - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - We need to require passwd rootok - Fix zebra.fc - Fix dnsmasq_filetrans_named_content() interface - Allow all sandbox domains create content in svirt_home_t - Allow zebra domains also create zebra_tmp_t files in /tmp - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services. - Fix labeling on neutron and remove transition to iconfig_t - abrt needs to read mcelog log file - Fix labeling on dnsmasq content - Fix labeling on /etc/dnsmasq.d - Allow glusterd to relabel own lib files - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd - Allow ipc_lock for abrt to run journalctl- Fix config.tgz- Fix passenger_stream_connect interface - setroubleshoot_fixit wants to read network state - Allow procmail_t to connect to dovecot stream sockets - Allow cimprovagt service providers to read network states - Add labeling for /var/run/mariadb - pwauth uses lastlog() to update system's lastlog - Allow account provider to read login records - Add support for texlive2013 - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - Allow passwd_t to connect to gnome keyring to change password - Update mls config files to have cronjobs in the user domains - Remove access checks that systemd does not actually do- Add support for yubikey in homedir - Add support for upd/3052 port - Allow apcupsd to use PowerChute Network Shutdown - Allow lsmd to execute various lsmplugins - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too - Update gluster_export_all_rw boolean to allow relabel all base file types - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling- Add files_relabel_base_file_types() interface - Allow netlabel-config to read passwd - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr() - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling - Allow pegasus to domtrans to mount_t - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts - Add support for unconfined watchdog scripts - Allow watchdog to manage own log files- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory. - Label /etc/yum.repos.d as system_conf_t - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t - Allow dac_override for sysadm_screen_t - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file. - Allow netlabel-config to read meminfo - Add interface to allow docker to mounton file_t - Add new interface to exec unlabeled files - Allow lvm to use docker semaphores - Setup transitons for .xsessions-errors.old - Change labels of files in /var/lib/*/.ssh to transition properly - Allow staff_t and user_t to look at logs using journalctl - pluto wants to manage own log file - Allow pluto running as ipsec_t to create pluto.log - Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files. - Additional access for docker - Added more rules to sblim policy - Fix kdumpgui_run_bootloader boolean - Allow dspam to connect to lmtp port - Included sfcbd service into sblim policy - rhsmcertd wants to manaage /etc/pki/consumer dir - Add kdumpgui_run_bootloader boolean - Add support for /var/cache/watchdog - Remove virt_domain attribute for virt_qemu_ga_unconfined_t - Fixes for handling libvirt containes - Dontaudit attempts by mysql_safe to write content into / - Dontaudit attempts by system_mail to modify network config - Allow dspam to bind to lmtp ports - Add new policy to allow staff_t and user_t to look at logs using journalctl - Allow apache cgi scripts to list sysfs - Dontaudit attempts to write/delete user_tmp_t files - Allow all antivirus domains to manage also own log dirs - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Add missing permission checks for nscd- Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Add file transition rules for content created by f5link - Rename quantum_port information to neutron - Allow all antivirus domains to manage also own log dirs - Rename quantum_port information to neutron - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Allow sysadm_t to read login information - Allow systemd_tmpfiles to setattr on var_log_t directories - Udpdate Makefile to include systemd_contexts - Add systemd_contexts - Add fs_exec_hugetlbfs_files() interface - Add daemons_enable_cluster_mode boolean - Fix rsync_filetrans_named_content() - Add rhcs_read_cluster_pid_files() interface - Update rhcs.if with additional interfaces from RHEL6 - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t - Allow glusterd_t to mounton glusterd_tmp_t - Allow glusterd to unmout al filesystems - Allow xenstored to read virt config - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label - Allow mozilla_plugin_t to mmap hugepages as an executable- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp- Allow sshd_t to read openshift content, needs backport to RHEL6.5 - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t - Make sur kdump lock is created with correct label if kdumpctl is executed - gnome interface calls should always be made within an optional_block - Allow syslogd_t to connect to the syslog_tls port - Add labeling for /var/run/charon.ctl socket - Add kdump_filetrans_named_content() - Allo setpgid for fenced_t - Allow setpgid and r/w cluster tmpfs for fenced_t - gnome calls should always be within optional blocks - wicd.pid should be labeled as networkmanager_var_run_t - Allow sys_resource for lldpad- Add rtas policy- Allow mailserver_domains to manage and transition to mailman data - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands - Allow mailserver_domains to manage and transition to mailman data - Allow svirt_domains to read sysctl_net_t - Allow thumb_t to use tmpfs inherited from the user - Allow mozilla_plugin to bind to the vnc port if running with spice - Add new attribute to discover confined_admins and assign confined admin to it - Fix zabbix to handle attributes in interfaces - Fix zabbix to read system states for all zabbix domains - Fix piranha_domain_template() - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files. - Allow lldpad sys_rouserce cap due to #986870 - Allow dovecot-auth to read nologin - Allow openlmi-networking to read /proc/net/dev - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t - Add zabbix_domain attribute for zabbix domains to treat them together - Add labels for zabbix-poxy-* (#1018221) - Update openlmi-storage policy to reflect #1015067 - Back port piranha tmpfs fixes from RHEL6 - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop - Add postfix_rw_spool_maildrop_files interface - Call new userdom_admin_user_templat() also for sysadm_secadm.pp - Fix typo in userdom_admin_user_template() - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey - Add new attribute to discover confined_admins - Fix labeling for /etc/strongswan/ipsec.d - systemd_logind seems to pass fd to anyone who dbus communicates with it - Dontaudit leaked write descriptor to dmesg- Activate motion policy- Fix gnome_read_generic_data_home_files() - allow openshift_cgroup_t to read/write inherited openshift file types - Remove httpd_cobbler_content * from cobbler_admin interface - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container - Allow httpd_t to read also git sys content symlinks - Allow init_t to read gnome home data - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it. - Allow virsh to execute systemctl - Fix for nagios_services plugins - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - Fix hypervkvp.te - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Fix logging policy - Allow syslog to bind to tls ports - Update labeling for /dev/cdc-wdm - Allow to su_domain to read init states - Allow init_t to read gnome home data - Make sure if systemd_logind creates nologin file with the correct label - Clean up ipsec.te- Add auth_exec_chkpwd interface - Fix port definition for ctdb ports - Allow systemd domains to read /dev/urand - Dontaudit attempts for mozilla_plugin to append to /dev/random - Add label for /var/run/charon.* - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service - Fix for nagios_services plugins - Fix some bugs in zoneminder policy - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - glusterd binds to random unreserved ports - Additional allow rules found by testing glusterfs - apcupsd needs to send a message to all users on the system so needs to look them up - Fix the label on ~/.juniper_networks - Dontaudit attempts for mozilla_plugin to append to /dev/random - Allow polipo_daemon to connect to flash ports - Allow gssproxy_t to create replay caches - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type- init reload from systemd_localed_t - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd - Allow systemd_localed_t to ask systemd to reload the locale. - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory - Allow readahead to read /dev/urand - Fix lots of avcs about tuned - Any file names xenstored in /var/log should be treated as xenstored_var_log_t - Allow tuned to inderact with hugepages - Allow condor domains to list etc rw dirs- Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Add additional fixes forpegasus_openlmi_account_t - Allow mdadm to read /dev/urand - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it - Add label/rules for /etc/mdadm.conf - Allow pegasus_openlmi_storage_t to transition to fsadm_t - Fixes for interface definition problems - Dontaudit dovecot-deliver to gettatr on all fs dirs - Allow domains to search data_home_t directories - Allow cobblerd to connect to mysql - Allow mdadm to r/w kdump lock files - Add support for kdump lock files - Label zarafa-search as zarafa-indexer - Openshift cgroup wants to read /etc/passwd - Add new sandbox domains for kvm - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on - Fix labeling for /usr/lib/systemd/system/lvm2.* - Add labeling for /usr/lib/systemd/system/lvm2.* - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules - Add sshd_keygen_t policy for sshd-keygen - Fix alsa_home_filetrans interface name and definition - Allow chown for ssh_keygen_t - Add fs_dontaudit_getattr_all_dirs() - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys - Fix up patch to allow systemd to manage home content - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled - Allow getty to exec hostname to get info - Add systemd_home_t for ~/.local/share/systemd directory- Fix lxc labels in config.tgz- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper - Allow tuned to search all file system directories - Allow alsa_t to sys_nice, to get top performance for sound management - Add support for MySQL/PostgreSQL for amavis - Allow openvpn_t to manage openvpn_var_log_t files. - Allow dirsrv_t to create tmpfs_t directories - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label - Dontaudit leaked unix_stream_sockets into gnome keyring - Allow telepathy domains to inhibit pipes on telepathy domains - Allow cloud-init to domtrans to rpm - Allow abrt daemon to manage abrt-watch tmp files - Allow abrt-upload-watcher to search /var/spool directory - Allow nsswitch domains to manage own process key - Fix labeling for mgetty.* logs - Allow systemd to dbus chat with upower - Allow ipsec to send signull to itself - Allow setgid cap for ipsec_t - Match upstream labeling- Do not build sanbox pkg on MLS- wine_tmp is no longer needed - Allow setroubleshoot to look at /proc - Allow telepathy domains to dbus with systemd logind - Fix handling of fifo files of rpm - Allow mozilla_plugin to transition to itself - Allow certwatch to write to cert_t directories - New abrt application - Allow NetworkManager to set the kernel scheduler - Make wine_domain shared by all wine domains - Allow mdadm_t to read images labeled svirt_image_t - Allow amanda to read /dev/urand - ALlow my_print_default to read /dev/urand - Allow mdadm to write to kdumpctl fifo files - Allow nslcd to send signull to itself - Allow yppasswd to read /dev/urandom - Fix zarafa_setrlimit - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add additional alias for user_tmp_t because wine_tmp_t is no longer used - More handling of ther kernel keyring required by kerberos - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed- Dontaudit attempts by sosreport to read shadow_t - Allow browser sandbox plugins to connect to cups to print - Add new label mpd_home_t - Label /srv/www/logs as httpd_log_t - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add labels for apache logs under miq package - Allow irc_t to use tcp sockets - fix labels in puppet.if - Allow tcsd to read utmp file - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys - Define svirt_socket_t as a domain_type - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t - Fix label on pam_krb5 helper apps- Allow ldconfig to write to kdumpctl fifo files - allow neutron to connect to amqp ports - Allow kdump_manage_crash to list the kdump_crash_t directory - Allow glance-api to connect to amqp port - Allow virt_qemu_ga_t to read meminfo - Add antivirus_home_t type for antivirus date in HOMEDIRS - Allow mpd setcap which is needed by pulseaudio - Allow smbcontrol to create content in /var/lib/samba - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts - amanda_exec_t needs to be executable file - Allow block_suspend cap for samba-net - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t - Allow init_t to run crash utility - Treat usr_t just like bin_t for transitions and executions - Add port definition of pka_ca to port 829 for openshift - Allow selinux_store to use symlinks- Allow block_suspend cap for samba-net - Allow t-mission-control to manage gabble cache files - Allow nslcd to read /sys/devices/system/cpu - Allow selinux_store to use symlinks- Allow xdm_t to transition to itself - Call neutron interfaces instead of quantum - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t - Make sure directories in /run get created with the correct label - Make sure /root/.pki gets created with the right label - try to remove labeling for motion from zoneminder_exec_t to bin_t - Allow inetd_t to execute shell scripts - Allow cloud-init to read all domainstate - Fix to use quantum port - Add interface netowrkmanager_initrc_domtrans - Fix boinc_execmem - Allow t-mission-control to read gabble cache home - Add labeling for ~/.cache/telepathy/avatars/gabble - Allow memcache to read sysfs data - Cleanup antivirus policy and add additional fixes - Add boolean boinc_enable_execstack - Add support for couchdb in rabbitmq policy - Add interface couchdb_search_pid_dirs - Allow firewalld to read NM state - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files()- Split out rlogin ports from inetd - Treat files labeld as usr_t like bin_t when it comes to transitions - Allow staff_t to read login config - Allow ipsec_t to read .google authenticator data - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files() - Call the correct interface - corenet_udp_bind_ktalkd_port() - Allow all domains that can read gnome_config to read kde config - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work - Allow mdadm to getattr any file system - Allow a confined domain to executes mozilla_exec_t via dbus - Allow cupsd_lpd_t to bind to the printer port - Dontaudit attempts to bind to ports < 1024 when nis is turned on - Allow apache domain to connect to gssproxy socket - Allow rlogind to bind to the rlogin_port - Allow telnetd to bind to the telnetd_port - Allow ktalkd to bind to the ktalkd_port - Allow cvs to bind to the cvs_port- Cleanup related to init_domain()+inetd_domain fixes - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain - svirt domains neeed to create kobject_uevint_sockets - Lots of new access required for sosreport - Allow tgtd_t to connect to isns ports - Allow init_t to transition to all inetd domains: - openct needs to be able to create netlink_object_uevent_sockets - Dontaudit leaks into ldconfig_t - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls - Move kernel_stream_connect into all Xwindow using users - Dontaudit inherited lock files in ifconfig o dhcpc_t- Also sock_file trans rule is needed in lsm - Fix labeling for fetchmail pid files/dirs - Add additional fixes for abrt-upload-watch - Fix polipo.te - Fix transition rules in asterisk policy - Add fowner capability to networkmanager policy - Allow polipo to connect to tor ports - Cleanup lsmd.if - Cleanup openhpid policy - Fix kdump_read_crash() interface - Make more domains as init domain - Fix cupsd.te - Fix requires in rpm_rw_script_inherited_pipes - Fix interfaces in lsm.if - Allow munin service plugins to manage own tmpfs files/dirs - Allow virtd_t also relabel unix stream sockets for virt_image_type - Make ktalk as init domain - Fix to define ktalkd_unit_file_t correctly - Fix ktalk.fc - Add systemd support for talk-server - Allow glusterd to create sock_file in /run - Allow xdm_t to delete gkeyringd_tmp_t files on logout - Add fixes for hypervkvp policy - Add logwatch_can_sendmail boolean - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb - Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add selinux-policy-sandbox pkg0 - Allow rhsmcertd to read init state - Allow fsetid for pkcsslotd - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service - Allow fetchmail to create own pid with correct labeling - Fix rhcs_domain_template() - Allow roles which can run mock to read mock lib files to view results - Allow rpcbind to use nsswitch - Fix lsm.if summary - Fix collectd_t can read /etc/passwd file - Label systemd unit files under dracut correctly - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh - Add support for .Xauthority-n - Label umount.crypt as lvm_exec_t - Allow syslogd to search psad lib files - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files- Add policy for lsmd - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory - Update condor_master rules to allow read system state info and allow logging - Add labeling for /etc/condor and allow condor domain to write it (bug) - Allow condor domains to manage own logs - Allow glusterd to read domains state - Fix initial hypervkvp policy - Add policy for hypervkvpd - Fix redis.if summary- Allow boinc to connect to @/tmp/.X11-unix/X0 - Allow beam.smp to connect to tcp/5984 - Allow named to manage own log files - Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t - Add virt_transition_userdomain boolean decl - Allow httpd_t to sendto unix_dgram sockets on its children - Allow nova domains to execute ifconfig - bluetooth wants to create fifo_files in /tmp - exim needs to be able to manage mailman data - Allow sysstat to getattr on all file systems - Looks like bluetoothd has moved - Allow collectd to send ping packets - Allow svirt_lxc domains to getpgid - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff - Allow frpintd_t to read /dev/urandom - Allow asterisk_t to create sock_file in /var/run - Allow usbmuxd to use netlink_kobject - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket - More cleanup of svirt_lxc policy - virtd_lxc_t now talks to dbus - Dontaudit leaked ptmx_t - Allow processes to use inherited fifo files - Allow openvpn_t to connect to squid ports - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert() - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files - Allow user roles to connect to the journal socket- selinux_set_enforce_mode needs to be used with type - Add append to the dontaudit for unix_stream_socket of xdm_t leak - Allow xdm_t to create symlinks in log direcotries - Allow login programs to read afs config - Label 10933 as a pop port, for dovecot - New policy to allow selinux_server.py to run as semanage_t as a dbus service - Add fixes to make netlabelctl working on MLS - AVCs required for running sepolicy gui as staff_t - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC - New dbus server to be used with new gui - After modifying some files in /etc/mail, I saw this needed on the next boot - Loading a vm from /usr/tmp with virt-manager - Clean up oracleasm policy for Fedora - Add oracleasm policy written by rlopez@redhat.com - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache - Add label for /var/crash - Allow fenced to domtrans to sanclok_t - Allow nagios to manage nagios spool files - Make tfptd as home_manager - Allow kdump to read kcore on MLS system - Allow mysqld-safe sys_nice/sys_resource caps - Allow apache to search automount tmp dirs if http_use_nfs is enabled - Allow crond to transition to named_t, for use with unbound - Allow crond to look at named_conf_t, for unbound - Allow mozilla_plugin_t to transition its home content - Allow dovecot_domain to read all system and network state - Allow httpd_user_script_t to call getpw - Allow semanage to read pid files - Dontaudit leaked file descriptors from user domain into thumb - Make PAM authentication working if it is enabled in ejabberd - Add fixes for rabbit to fix ##992920,#992931 - Allow glusterd to mount filesystems - Loading a vm from /usr/tmp with virt-manager - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device - Add fix for pand service - shorewall touches own log - Allow nrpe to list /var - Mozilla_plugin_roles can not be passed into lpd_run_lpr - Allow afs domains to read afs_config files - Allow login programs to read afs config - Allow virt_domain to read virt_var_run_t symlinks - Allow smokeping to send its process signals - Allow fetchmail to setuid - Add kdump_manage_crash() interface - Allow abrt domain to write abrt.socket- Add more aliases in pegasus.te - Add more fixes for *_admin interfaces - Add interface fixes - Allow nscd to stream connect to nmbd - Allow gnupg apps to write to pcscd socket - Add more fixes for openlmi provides. Fix naming and support for additionals - Allow fetchmail to resolve host names - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te - Fix corecmd_exec_chroot() - Fix logging_relabel_syslog_pid_socket interface - Fix typo in unconfineduser.te - Allow system_r to access unconfined_dbusd_t to run hp_chec- Allow xdm_t to act as a dbus client to itsel - Allow fetchmail to resolve host names - Allow gnupg apps to write to pcscd socket - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te -httpd_t does access_check on certs- Add support for cmpiLMI_Service-cimprovagt - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t - Add support for pycmpiLMI_Storage-cimprovagt - Add support for cmpiLMI_Networking-cimprovagt - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working - Allow virtual machines and containers to run as user doains, needed for virt-sandbox - Allow buglist.cgi to read cpu info- Allow systemd-tmpfile to handle tmp content in print spool dir - Allow systemd-sysctl to send system log messages - Add support for RTP media ports and fmpro-internal - Make auditd working if audit is configured to perform SINGLE action on disk error - Add interfaces to handle systemd units - Make systemd-notify working if pcsd is used - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t - Instead of having all unconfined domains get all of the named transition rules, - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default. - Add definition for the salt ports - Allow xdm_t to create link files in xdm_var_run_t - Dontaudit reads of blk files or chr files leaked into ldconfig_t - Allow sys_chroot for useradd_t - Allow net_raw cap for ipsec_t - Allow sysadm_t to reload services - Add additional fixes to make strongswan working with a simple conf - Allow sysadm_t to enable/disable init_t services - Add additional glusterd perms - Allow apache to read lnk files in the /mnt directory - Allow glusterd to ask the kernel to load a module - Fix description of ftpd_use_fusefs boolean - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t - Allow glusterds to request load a kernel module - Allow boinc to stream connect to xserver_t - Allow sblim domains to read /etc/passwd - Allow mdadm to read usb devices - Allow collectd to use ping plugin - Make foghorn working with SNMP - Allow sssd to read ldap certs - Allow haproxy to connect to RTP media ports - Add additional trans rules for aide_db - Add labeling for /usr/lib/pcsd/pcsd - Add labeling for /var/log/pcsd - Add support for pcs which is a corosync and pacemaker configuration tool- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1 - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown - consolekit needs to be able to shut down system - Move around interfaces - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints - Allow gconf-defaults-m to read /etc/passwd - Fix pki_rw_tomcat_cert() interface to support lnk_files- Add support for gluster ports - Make sure that all keys located in /etc/ssh/ are labeled correctly - Make sure apcuspd lock files get created with the correct label - Use getcap in gluster.te - Fix gluster policy - add additional fixes to allow beam.smp to interact with couchdb files - Additional fix for #974149 - Allow gluster to user gluster ports - Allow glusterd to transition to rpcd_t and add additional fixes for #980683 - Allow tgtd working when accessing to the passthrough device - Fix labeling for mdadm unit files- Add mdadm fixes- Fix definition of sandbox.disabled to sandbox.pp.disabled- Allow mdamd to execute systemctl - Allow mdadm to read /dev/kvm - Allow ipsec_mgmt_t to read l2tpd pid content- Allow nsd_t to read /dev/urand - Allow mdadm_t to read framebuffer - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t - Allow mozilla_plugin_config_t to create tmp files - Cleanup openvswitch policy - Allow mozilla plugin to getattr on all executables - Allow l2tpd_t to create fifo_files in /var/run - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory - Allow mdadm to connecto its own unix_stream_socket - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now. - Allow apache to access smokeping pid files - Allow rabbitmq_beam_t to getattr on all filesystems - Add systemd support for iodined - Allow nup_upsdrvctl_t to execute its entrypoint - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch - add labeling for ~/.cache/libvirt-sandbox - Add interface to allow domains transitioned to by confined users to send sigchld to screen program - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs. - Allow staff to getsched all domains, required to run htop - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Add prosody policy written by Michael Scherer - Allow nagios plugins to read /sys info - ntpd needs to manage own log files - Add support for HOME_DIR/.IBMERS - Allow iptables commands to read firewalld config - Allow consolekit_t to read utmp - Fix filename transitions on .razor directory - Add additional fixes to make DSPAM with LDA working - Allow snort to read /etc/passwd - Allow fail2ban to communicate with firewalld over dbus - Dontaudit openshift_cgreoup_file_t read/write leaked dev - Allow nfsd to use mountd port - Call th proper interface - Allow openvswitch to read sys and execute plymouth - Allow tmpwatch to read /var/spool/cups/tmp - Add support for /usr/libexec/telepathy-rakia - Add systemd support for zoneminder - Allow mysql to create files/directories under /var/log/mysql - Allow zoneminder apache scripts to rw zoneminder tmpfs - Allow httpd to manage zoneminder lib files - Add zoneminder_run_sudo boolean to allow to start zoneminder - Allow zoneminder to send mails - gssproxy_t sock_file can be under /var/lib - Allow web domains to connect to whois port. - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t. - We really need to add an interface to corenet to define what a web_client_domain is and - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain. - Add labeling for cmpiLMI_LogicalFile-cimprovagt - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules - Update policy rules for pegasus_openlmi_logicalfile_t - Add initial types for logicalfile/unconfined OpenLMI providers - mailmanctl needs to read own log - Allow logwatch manage own lock files - Allow nrpe to read meminfo - Allow httpd to read certs located in pki-ca - Add pki_read_tomcat_cert() interface - Add support for nagios openshift plugins - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab- Make DSPAM to act as a LDA working - Allow ntop to create netlink socket - Allow policykit to send a signal to policykit-auth - Allow stapserver to dbus chat with avahi/systemd-logind - Fix labeling on haproxy unit file - Clean up haproxy policy - A new policy for haproxy and placed it to rhcs.te - Add support for ldirectord and treat it with cluster_t - Make sure anaconda log dir is created with var_log_t- Allow lvm_t to create default targets for filesystem handling - Fix labeling for razor-lightdm binaries - Allow insmod_t to read any file labeled var_lib_t - Add policy for pesign - Activate policy for cmpiLMI_Account-cimprovagt - Allow isnsd syscall=listen - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler - Allow ctdbd to use udp/4379 - gatherd wants sys_nice and setsched - Add support for texlive2012 - Allow NM to read file_t (usb stick with no labels used to transfer keys for example) - Allow cobbler to execute apache with domain transition- condor_collector uses tcp/9000 - Label /usr/sbin/virtlockd as virtd_exec_t for now - Allow cobbler to execute ldconfig - Allow NM to execute ssh - Allow mdadm to read /dev/crash - Allow antivirus domains to connect to snmp port - Make amavisd-snmp working correctly - Allow nfsd_t to mounton nfsd_fs_t - Add initial snapper policy - We still need to have consolekit policy - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow dirsrv to read network state - Fix pki_read_tomcat_lib_files - Add labeling for /usr/libexec/nm-ssh-service - Add label cert_t for /var/lib/ipa/pki-ca/publish - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant - Allow nfsd_t to mounton nfsd_fs_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow passwd_t to change role to system_r from unconfined_r- Don't audit access checks by sandbox xserver on xdb var_lib - Allow ntop to read usbmon devices - Add labeling for new polcykit authorizor - Dontaudit access checks from fail2ban_client - Don't audit access checks by sandbox xserver on xdb var_lib - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream - Fix labeling for all /usr/bim/razor-lightdm-* binaries - Add filename trans for /dev/md126p1- Make vdagent able to request loading kernel module - Add support for cloud-init make it as unconfined domain - Allow snmpd to run smartctl in fsadm_t domain - remove duplicate openshift_search_lib() interface - Allow mysqld to search openshift lib files - Allow openshift cgroup to interact with passedin file descriptors - Allow colord to list directories inthe users homedir - aide executes prelink to check files - Make sure cupsd_t creates content in /etc/cups with the correct label - Lest dontaudit apache read all domains, so passenger will not cause this avc - Allow gssd to connect to gssproxy - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS - Allow systemd-tmpfiles to relabel also lock files - Allow useradd to add homdir in /var/lib/openshift - Allow setfiles and semanage to write output to /run/files- Add labeling for /dev/tgt - Dontaudit leak fd from firewalld for modprobe - Allow runuser running as rpm_script_t to create netlink_audit socket - Allow mdadm to read BIOS non-volatile RAM- accountservice watches when accounts come and go in wtmp - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket - Add httpd_use_sasl boolean - Allow net_admin for tuned_t - iscsid needs sys_module to auto-load kernel modules - Allow blueman to read bluetooth conf - Add nova_manage_lib_files() interface - Fix mplayer_filetrans_home_content() - Add mplayer_filetrans_home_content() - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t - Revert "Allow thumb_t to append inherited xdm stream socket" - Add iscsi_filetrans_named_content() interface - Allow to create .mplayer with the correct labeling for unconfined - Allow iscsiadmin to create lock file with the correct labeling- Allow wine to manage wine home content - Make amanda working with socket actiovation - Add labeling for /usr/sbin/iscsiadm - Add support for /var/run/gssproxy.sock - dnsmasq_t needs to read sysctl_net_t- Fix courier_domain_template() interface - Allow blueman to write ip_forward - Allow mongodb to connect to mongodb port - Allow mongodb to connect to mongodb port - Allow java to bind jobss_debug port - Fixes for *_admin interfaces - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality - Need to assign attribute for courier_domain to all courier_domains - Fail2ban reads /etc/passwd - postfix_virtual will create new files in postfix_spool_t - abrt triggers sys_ptrace by running pidof - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it - Add passenger fixes needed by foreman - Remove dup interfaces - Add additional interfaces for quantum - Add new interfaces for dnsmasq - Allow passenger to read localization and send signull to itself - Allow dnsmasq to stream connect to quantum - Add quantum_stream_connect() - Make sure that mcollective starts the service with the correct labeling - Add labels for ~/.manpath - Dontaudit attempts by svirt_t to getpw* calls - sandbox domains are trying to look at parent process data - Allow courior auth to create its pid file in /var/spool/courier subdir - Add fixes for beam to have it working with couchdb - Add labeling for /run/nm-xl2tpd.con - Allow apache to stream connect to thin - Add systemd support for amand - Make public types usable for fs mount points - Call correct mandb interface in domain.te - Allow iptables to r/w quantum inherited pipes and send sigchld - Allow ifconfig domtrans to iptables and execute ldconfig - Add labels for ~/.manpath - Allow systemd to read iscsi lib files - seunshare is trying to look at parent process data- Fix openshift_search_lib - Add support for abrt-uefioops-oops - Allow colord to getattr any file system - Allow chrome processes to look at each other - Allow sys_ptrace for abrt_t - Add new policy for gssproxy - Dontaudit leaked file descriptor writes from firewalld - openshift_net_type is interface not template - Dontaudit pppd to search gnome config - Update openshift_search_lib() interface - Add fs_list_pstorefs() - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18 - Better labels for raspberry pi devices - Allow init to create devpts_t directory - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18 - Allow sysadm_t to build kernels - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18 - Allow userdomains to stream connect to gssproxy - Dontaudit leaked file descriptor writes from firewalld - Allow xserver to read /dev/urandom - Add additional fixes for ipsec-mgmt - Make SSHing into an Openshift Enterprise Node working- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime - with the proper label. - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files - Allow systemd-timedated to create adjtime - Add clock_create_adjtime() - Additional fix ifconfing for #966106 - Allow kernel_t to create boot.log with correct labeling - Remove unconfined_mplayer for which we don't have rules - Rename interfaces - Add userdom_manage_user_home_files/dirs interfaces - Fix files_dontaudit_read_all_non_security_files - Fix ipsec_manage_key_file() - Fix ipsec_filetrans_key_file() - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t - Fix labeling for ipse.secrets - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid - Add files_dontaudit_read_all_non_security_files() interface - /var/log/syslog-ng should be labeled var_log_t - Make ifconfig_var_run_t a mountpoint - Add transition from ifconfig to dnsmasq - Allow ifconfig to execute bin_t/shell_exec_t - We want to have hwdb.bin labeled as etc_t - update logging_filetrans_named_content() interface - Allow systemd_timedate_t to manage /etc/adjtime - Allow NM to send signals to l2tpd - Update antivirus_can_scan_system boolean - Allow devicekit_disk_t to sys_config_tty - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories - Make printing from vmware working - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes - Add virt_qemu_ga_data_t for qemu-ga - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both - Fix typo in virt.te - Add virt_qemu_ga_unconfined_t for hook scripts - Make sure NetworkManager files get created with the correct label - Add mozilla_plugin_use_gps boolean - Fix cyrus to have support for net-snmp - Additional fixes for dnsmasq and quantum for #966106 - Add plymouthd_create_log() - remove httpd_use_oddjob for which we don't have rules - Add missing rules for httpd_can_network_connect_cobbler - Add missing cluster_use_execmem boolean - Call userdom_manage_all_user_home_type_files/dirs - Additional fix for ftp_home_dir - Fix ftp_home_dir boolean - Allow squit to recv/send client squid packet - Fix nut.te to have nut_domain attribute - Add support for ejabberd; TODO: revisit jabberd and rabbit policy - Fix amanda policy - Add more fixes for domains which use libusb - Make domains which use libusb working correctly - Allow l2tpd to create ipsec key files with correct labeling and manage them - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files - Allow rabbitmq-beam to bind generic node - Allow l2tpd to read ipse-mgmt pid files - more fixes for l2tpd, NM and pppd from #967072- Dontaudit to getattr on dirs for dovecot-deliver - Allow raiudusd server connect to postgresql socket - Add kerberos support for radiusd - Allow saslauthd to connect to ldap port - Allow postfix to manage postfix_private_t files - Add chronyd support for #965457 - Fix labeling for HOME_DIR/\.icedtea - CHange squid and snmpd to be allowed also write own logs - Fix labeling for /usr/libexec/qemu-ga - Allow virtd_t to use virt_lock_t - Allow also sealert to read the policy from the kernel - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content - Dontaudit listing of users homedir by sendmail Seems like a leak - Allow passenger to transition to puppet master - Allow apache to connect to mythtv - Add definition for mythtv ports- Add additional fixes for #948073 bug - Allow sge_execd_t to also connect to sge ports - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files - Add networkmanager_stream_connect() - Make gnome-abrt wokring with staff_t - Fix openshift_manage_lib_files() interface - mdadm runs ps command which seems to getattr on random log files - Allow mozilla_plugin_t to create pulseaudit_home_t directories - Allow qemu-ga to shutdown virtual hosts - Add labelling for cupsd-browsed - Add web browser plugins to connect to aol ports - Allow nm-dhcp-helper to stream connect to NM - Add port definition for sge ports- Make sure users and unconfined domains create .hushlogin with the correct label - Allow pegaus to chat with realmd over DBus - Allow cobblerd to read network state - Allow boicn-client to stat on /dev/input/mice - Allow certwatch to read net_config_t when it executes apache - Allow readahead to create /run/systemd and then create its own directory with the correct label- Transition directories and files when in a user_tmp_t directory - Change certwatch to domtrans to apache instead of just execute - Allow virsh_t to read xen lib files - update policy rules for pegasus_openlmi_account_t - Add support for svnserve_tmp_t - Activate account openlmi policy - pegasus_openlmi_domain_template needs also require pegasus_t - One more fix for policykit.te - Call fs_list_cgroups_dirs() in policykit.te - Allow nagios service plugin to read mysql config files - Add labeling for /var/svn - Fix chrome.te - Fix pegasus_openlmi_domain_template() interfaces - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks - Fix location of google-chrome data - Add support for chome_sandbox to store content in the homedir - Allow policykit to watch for changes in cgroups file system - Add boolean to allow mozilla_plugin_t to use spice - Allow collectd to bind to udp port - Allow collected_t to read all of /proc - Should use netlink socket_perms - Should use netlink socket_perms - Allow glance domains to connect to apache ports - Allow apcupsd_t to manage its log files - Allow chrome objects to rw_inherited unix_stream_socket from callers - Allow staff_t to execute virtd_exec_t for running vms - nfsd_t needs to bind mountd port to make nfs-mountd.service working - Allow unbound net_admin capability because of setsockopt syscall - Fix fs_list_cgroup_dirs() - Label /usr/lib/nagios/plugins/utils.pm as bin_t - Remove uplicate definition of fs_read_cgroup_files() - Remove duplicate definition of fs_read_cgroup_files() - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd - Additional interfaces needed to list and read cgroups config - Add port definition for collectd port - Add labels for /dev/ptp* - Allow staff_t to execute virtd_exec_t for running vms- Allow samba-net to also read realmd tmp files - Allow NUT to use serial ports - realmd can be started by systemctl now- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid - Allow virsh to read xen lock file - Allow qemu-ga to create files in /run with proper labeling - Allow glusterd to connect to own socket in /tmp - Allow glance-api to connect to http port to make glance image-create working - Allow keystonte_t to execute rpm- Fix realmd cache interfaces- Allow tcpd to execute leafnode - Allow samba-net to read realmd cache files - Dontaudit sys_tty_config for alsactl - Fix allow rules for postfix_var_run - Allow cobblerd to read /etc/passwd - Allow pegasus to read exports - Allow systemd-timedate to read xdm state - Allow mout to stream connect to rpcbind - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki- Allow thumbnails to share memory with apps which run thumbnails - Allow postfix-postqueue block_suspend - Add lib interfaces for smsd - Add support for nginx - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t - Allow pki apache domain to create own tmp files and execute httpd_suexec - Allow procmail to manger user tmp files/dirs/lnk_files - Add virt_stream_connect_svirt() interface - Allow dovecot-auth to execute bin_t - Allow iscsid to request that kernel load a kernel module - Add labeling support for /var/lib/mod_security - Allow iw running as tuned_t to create netlink socket - Dontaudit sys_tty_config for thumb_t - Add labeling for nm-l2tp-service - Allow httpd running as certwatch_t to open tcp socket - Allow useradd to manager smsd lib files - Allow useradd_t to add homedirs in /var/lib - Fix typo in userdomain.te - Cleanup userdom_read_home_certs - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t - Allow staff to stream connect to svirt_t to make gnome-boxes working- Allow lvm to create its own unit files - Label /var/lib/sepolgen as selinux_config_t - Add filetrans rules for tw devices - Add transition from cupsd_config_t to cupsd_t- Add filetrans rules for tw devices - Cleanup bad transition lines- Fix lockdev_manage_files() - Allow setroubleshootd to read var_lib_t to make email_alert working - Add lockdev_manage_files() - Call proper interface in virt.te - Allow gkeyring_domain to create /var/run/UID/config/dbus file - system dbus seems to be blocking suspend - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need - When you enter a container from root, you generate avcs with a leaked file descriptor - Allow mpd getattr on file system directories - Make sure realmd creates content with the correct label - Allow systemd-tty-ask to write kmsg - Allow mgetty to use lockdev library for device locking - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music - When you enter a container from root, you generate avcs with a leaked file descriptor - Make sure init.fc files are labeled correctly at creation - File name trans vconsole.conf - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow certmonger to dbus communicate with realmd - Make realmd working- Fix mozilla specification of homedir content - Allow certmonger to read network state - Allow tmpwatch to read tmp in /var/spool/{cups,lpd} - Label all nagios plugin as unconfined by default - Add httpd_serve_cobbler_files() - Allow mdadm to read /dev/sr0 and create tmp files - Allow certwatch to send mails - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow realmd to run ipa, really needs to be an unconfined_domain - Allow sandbox domains to use inherted terminals - Allow pscd to use devices labeled svirt_image_t in order to use cat cards. - Add label for new alsa pid - Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition - Add support for sshd_unit_file_t - Add oracleasmfs_t - Allow unlabeled_t files to be stored on unlabeled_t filesystems- Fix description of deny_ptrace boolean - Remove allow for execmod lib_t for now - Allow quantum to connect to keystone port - Allow nova-console to talk with mysql over unix stream socket - Allow dirsrv to stream connect to uuidd - thumb_t needs to be able to create ~/.cache if it does not exist - virtd needs to be able to sys_ptrace when starting and stoping containers- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms... - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets - Fix deny_ptrace boolean, certain ptrace leaked into the system - Allow winbind to manage kerberos_rcache_host - Allow spamd to create spamd_var_lib_t directories - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs - Fix vmware_role() interface - Fix cobbler_manage_lib_files() interface - Allow nagios check disk plugins to execute bin_t - Allow quantum to transition to openvswitch_t - Allow postdrop to stream connect to postfix-master - Allow quantum to stream connect to openvswitch - Add xserver_dontaudit_xdm_rw_stream_sockets() interface - Allow daemon to send dgrams to initrc_t - Allow kdm to start the power service to initiate a reboot or poweroff- Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Don't audit attempts to write to stream socket of nscld by thumbnailers - Allow git_system_t to read network state - Allow pegasas to execute mount command - Fix desc for drdb_admin - Fix condor_amin() - Interface fixes for uptime, vdagent, vnstatd - Fix labeling for moodle in /var/www/moodle/data - Add interface fixes - Allow bugzilla to read certs - /var/www/moodle needs to be writable by apache - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Fix sys_nice for cups_domain - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Kernel_t needs mac_admin in order to support labeled NFS - Fix systemd_dontaudit_dbus_chat() interface - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Allow consolehelper domain to write Xauth files in /root - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Allow consolehelper more access discovered by Tom London - Allow fsdaemon to send signull to all domain - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Fix file_contexts.subs to label /run/lock correctly- Try to label on controlC devices up to 30 correctly - Add mount_rw_pid_files() interface - Add additional mount/umount interfaces needed by mock - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk - Fix tabs - Allow initrc_domain to search rgmanager lib files - Add more fixes which make mock working together with confined users * Allow mock_t to manage rpm files * Allow mock_t to read rpm log files * Allow mock to setattr on tmpfs, devpts * Allow mount/umount filesystems - Add rpm_read_log() interface - yum-cron runs rpm from within it. - Allow tuned to transition to dmidecode - Allow firewalld to do net_admin - Allow mock to unmont tmpfs_t - Fix virt_sigkill() interface - Add additional fixes for mock. Mainly caused by mount running in mock_t - Allow mock to write sysfs_t and mount pid files - Add mailman_domain to mailman_template() - Allow openvswitch to execute shell - Allow qpidd to use kerberos - Allow mailman to use fusefs, needs back port to RHEL6 - Allow apache and its scripts to use anon_inodefs - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7 - Realmd needs to connect to samba ports, needs back port to F18 also - Allow colord to read /run/initial-setup- - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock - Add virt_kill() interface - Add rgmanager_search_lib() interface - Allow wdmd to getattr on all filesystems. Back ported from RHEL6- Allow realmd to create tmp files - FIx ircssi_home_t type to irssi_home_t - Allow adcli running as realmd_t to connect to ldap port - Allow NetworkManager to transition to ipsec_t, for running strongswan - Make openshift_initrc_t an lxc_domain - Allow gssd to manage user_tmp_t files - Fix handling of irclogs in users homedir - Fix labeling for drupal an wp-content in subdirs of /var/www/html - Allow abrt to read utmp_t file - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6 - fix labeling for (oo|rhc)-restorer-wrapper.sh - firewalld needs to be able to write to network sysctls - Fix mozilla_plugin_dontaudit_rw_sem() interface - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains - Add mozilla_plugin_dontaudit_rw_sem() interface - Allow svirt_lxc_t to transition to openshift domains - Allow condor domains block_suspend and dac_override caps - Allow condor_master to read passd - Allow condor_master to read system state - Allow NetworkManager to transition to ipsec_t, for running strongswan - Lots of access required by lvm_t to created encrypted usb device - Allow xdm_t to dbus communicate with systemd_localed_t - Label strongswan content as ipsec_exec_mgmt_t for now - Allow users to dbus chat with systemd_localed - Fix handling of .xsession-errors in xserver.if, so kde will work - Might be a bug but we are seeing avc's about people status on init_t:service - Make sure we label content under /var/run/lock as <> - Allow daemon and systemprocesses to search init_var_run_t directory - Add boolean to allow xdm to write xauth data to the home directory - Allow mount to write keys for the unconfined domain - Add unconfined_write_keys() interface- Add labeling for /usr/share/pki - Allow programs that read var_run_t symlinks also read var_t symlinks - Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports - Fix labeling for /etc/dhcp directory - add missing systemd_stub_unit_file() interface - Add files_stub_var() interface - Add lables for cert_t directories - Make localectl set-x11-keymap working at all - Allow abrt to manage mock build environments to catch build problems. - Allow virt_domains to setsched for running gdb on itself - Allow thumb_t to execute user home content - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000 - Allow certwatch to execut /usr/bin/httpd - Allow cgred to send signal perms to itself, needs back port to RHEL6 - Allow openshift_cron_t to look at quota - Allow cups_t to read inhered tmpfs_t from the kernel - Allow yppasswdd to use NIS - Tuned wants sys_rawio capability - Add ftpd_use_fusefs boolean - Allow dirsrvadmin_t to signal itself- Allow localectl to read /etc/X11/xorg.conf.d directory - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors"" - Allow mount to transition to systemd_passwd_agent - Make sure abrt directories are labeled correctly - Allow commands that are going to read mount pid files to search mount_var_run_t - label /usr/bin/repoquery as rpm_exec_t - Allow automount to block suspend - Add abrt_filetrans_named_content so that abrt directories get labeled correctly - Allow virt domains to setrlimit and read file_context- Allow nagios to manage nagios spool files - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6 - Add swift_alias.* policy files which contain typealiases for swift types - Add support for /run/lock/opencryptoki - Allow pkcsslotd chown capability - Allow pkcsslotd to read passwd - Add rsync_stub() interface - Allow systemd_timedate also manage gnome config homedirs - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t - Fix filetrans rules for kdm creates .xsession-errors - Allow sytemd_tmpfiles to create wtmp file - Really should not label content under /var/lock, since it could have labels on it different from var_lock_t - Allow systemd to list all file system directories - Add some basic stub interfaces which will be used in PRODUCT policies- Fix log transition rule for cluster domains - Start to group all cluster log together - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update - cups uses usbtty_device_t devices - These fixes were all required to build a MLS virtual Machine with single level desktops - Allow domains to transiton using httpd_exec_t - Allow svirt domains to manage kernel key rings - Allow setroubleshoot to execute ldconfig - Allow firewalld to read generate gnome data - Allow bluetooth to read machine-info - Allow boinc domain to send signal to itself - Fix gnome_filetrans_home_content() interface - Allow mozilla_plugins to list apache modules, for use with gxine - Fix labels for POkemon in the users homedir - Allow xguest to read mdstat - Dontaudit virt_domains getattr on /dev/* - These fixes were all required to build a MLS virtual Machine with single level desktops - Need to back port this to RHEL6 for openshift - Add tcp/8891 as milter port - Allow nsswitch domains to read sssd_var_lib_t files - Allow ping to read network state. - Fix typo - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them- Adopt swift changes from lhh@redhat.com - Add rhcs_manage_cluster_pid_files() interface - Allow screen domains to configure tty and setup sock_file in ~/.screen directory - ALlow setroubleshoot to read default_context_t, needed to backport to F18 - Label /etc/owncloud as being an apache writable directory - Allow sshd to stream connect to an lxc domain- Allow postgresql to manage rgmanager pid files - Allow postgresql to read ccs data - Allow systemd_domain to send dbus messages to policykit - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them - All systemd domains that create content are reading the file_context file and setfscreate - Systemd domains need to search through init_var_run_t - Allow sshd to communicate with libvirt to set containers labels - Add interface to manage pid files - Allow NetworkManger_t to read /etc/hostname - Dontaudit leaked locked files into openshift_domains - Add fixes for oo-cgroup-read - it nows creates tmp files - Allow gluster to manage all directories as well as files - Dontaudit chrome_sandbox_nacl_t using user terminals - Allow sysstat to manage its own log files - Allow virtual machines to setrlimit and send itself signals. - Add labeling for /var/run/hplip- Fix POSTIN scriptlet- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp- Fix authconfig.py labeling - Make any domains that write homedir content do it correctly - Allow glusterd to read/write anyhwere on the file system by default - Be a little more liberal with the rsync log files - Fix iscsi_admin interface - Allow iscsid_t to read /dev/urand - Fix up iscsi domain for use with unit files - Add filename transition support for spamassassin policy - Allow web plugins to use badly formated libraries - Allow nmbd_t to create samba_var_t directories - Add filename transition support for spamassassin policy - Add filename transition support for tvtime - Fix alsa_home_filetrans_alsa_home() interface - Move all userdom_filetrans_home_content() calling out of booleans - Allow logrotote to getattr on all file sytems - Remove duplicate userdom_filetrans_home_content() calling - Allow kadmind to read /etc/passwd - Dontaudit append .xsession-errors file on ecryptfs for policykit-auth - Allow antivirus domain to manage antivirus db links - Allow logrotate to read /sys - Allow mandb to setattr on man dirs - Remove mozilla_plugin_enable_homedirs boolean - Fix ftp_home_dir boolean - homedir mozilla filetrans has been moved to userdom_home_manager - homedir telepathy filetrans has been moved to userdom_home_manager - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd() - Might want to eventually write a daemon on fusefsd. - Add policy fixes for sshd [net] child from plautrba@redhat.com - Tor uses a new port - Remove bin_t for authconfig.py - Fix so only one call to userdom_home_file_trans - Allow home_manager_types to create content with the correctl label - Fix all domains that write data into the homedir to do it with the correct label - Change the postgresql to use proper boolean names, which is causing httpd_t to - not get access to postgresql_var_run_t - Hostname needs to send syslog messages - Localectl needs to be able to send dbus signals to users - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default - Allow user_home_manger domains to create spam* homedir content with correct labeling - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working - Declare userdom_filetrans_type attribute - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute - fusefsd is mounding a fuse file system on /run/user/UID/gvfs- Man pages are now generated in the build process - Allow cgred to list inotifyfs filesystem- Allow gluster to get attrs on all fs - New access required for virt-sandbox - Allow dnsmasq to execute bin_t - Allow dnsmasq to create content in /var/run/NetworkManager - Fix openshift_initrc_signal() interface - Dontaudit openshift domains doing getattr on other domains - Allow consolehelper domain to communicate with session bus - Mock should not be transitioning to any other domains, we should keep mock_t as mock_t - Update virt_qemu_ga_t policy - Allow authconfig running from realmd to restart oddjob service - Add systemd support for oddjob - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd - Add labeling for gnashpluginrc - Allow chrome_nacl to execute /dev/zero - Allow condor domains to read /proc - mozilla_plugin_t will getattr on /core if firefox crashes - Allow condor domains to read /etc/passwd - Allow dnsmasq to execute shell scripts, openstack requires this access - Fix glusterd labeling - Allow virtd_t to interact with the socket type - Allow nmbd_t to override dac if you turned on sharing all files - Allow tuned to created kobject_uevent socket - Allow guest user to run fusermount - Allow openshift to read /proc and locale - Allow realmd to dbus chat with rpm - Add new interface for virt - Remove depracated interfaces - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t - Remove some more unconfined_t process transitions, that I don't believe are necessary - Stop transitioning uncofnined_t to checkpc - dmraid creates /var/lock/dmraid - Allow systemd_localed to creatre unix_dgram_sockets - Allow systemd_localed to write kernel messages. - Also cleanup systemd definition a little. - Fix userdom_restricted_xwindows_user_template() interface - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t - User accounts need to dbus chat with accountsd daemon - Gnome requires all users to be able to read /proc/1/- virsh now does a setexeccon call - Additional rules required by openshift domains - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work - Allow spamd_update_t to search spamc_home_t - Avcs discovered by mounting an isci device under /mnt - Allow lspci running as logrotate to read pci.ids - Additional fix for networkmanager_read_pid_files() - Fix networkmanager_read_pid_files() interface - Allow all svirt domains to connect to svirt_socket_t - Allow virsh to set SELinux context for a process. - Allow tuned to create netlink_kobject_uevent_socket - Allow systemd-timestamp to set SELinux context - Add support for /var/lib/systemd/linger - Fix ssh_sysadm_login to be working on MLS as expected- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file - Add missing files_rw_inherited_tmp_files interface - Add additional interface for ecryptfs - ALlow nova-cert to connect to postgresql - Allow keystone to connect to postgresql - Allow all cups domains to getattr on filesystems - Allow pppd to send signull - Allow tuned to execute ldconfig - Allow gpg to read fips_enabled - Add additional fixes for ecryptfs - Allow httpd to work with posgresql - Allow keystone getsched and setsched- Allow gpg to read fips_enabled - Add support for /var/cache/realmd - Add support for /usr/sbin/blazer_usb and systemd support for nut - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t - bitlbee wants to read own log file - Allow glance domain to send a signal itself - Allow xend_t to request that the kernel load a kernel module - Allow pacemaker to execute heartbeat lib files - cleanup new swift policy- Fix smartmontools - Fix userdom_restricted_xwindows_user_template() interface - Add xserver_xdm_ioctl_log() interface - Allow Xusers to ioctl lxdm.log to make lxdm working - Add MLS fixes to make MLS boot/log-in working - Add mls_socket_write_all_levels() also for syslogd - fsck.xfs needs to read passwd - Fix ntp_filetrans_named_content calling in init.te - Allow postgresql to create pg_log dir - Allow sshd to read rsync_data_t to make rsync working - Change ntp.conf to be labeled net_conf_t - Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it - Allow xdm_t to execute gstreamer home content - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp - New policy for openstack swift domains - More access required for openshift_cron_t - Use cupsd_log_t instead of cupsd_var_log_t - rpm_script_roles should be used in rpm_run - Fix rpm_run() interface - Fix openshift_initrc_run() - Fix sssd_dontaudit_stream_connect() interface - Fix sssd_dontaudit_stream_connect() interface - Allow LDA's job to deliver mail to the mailbox - dontaudit block_suspend for mozilla_plugin_t - Allow l2tpd_t to all signal perms - Allow uuidgen to read /dev/random - Allow mozilla-plugin-config to read power_supply info - Implement cups_domain attribute for cups domains - We now need access to user terminals since we start by executing a command outside the tty - We now need access to user terminals since we start by executing a command outside the tty - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen - Add containment of openshift cron jobs - Allow system cron jobs to create tmp directories - Make userhelp_conf_t a config file - Change rpm to use rpm_script_roles - More fixes for rsync to make rsync wokring - Allow logwatch to domtrans to mdadm - Allow pacemaker to domtrans to ifconfig - Allow pacemaker to setattr on corosync.log - Add pacemaker_use_execmem for memcheck-amd64 command - Allow block_suspend capability - Allow create fifo_file in /tmp with pacemaker_tmp_t - Allow systat to getattr on fixed disk - Relabel /etc/ntp.conf to be net_conf_t - ntp_admin should create files in /etc with the correct label - Add interface to create ntp_conf_t files in /etc - Add additional labeling for quantum - Allow quantum to execute dnsmasq with transition- boinc_cliean wants also execmem as boinc projecs have - Allow sa-update to search admin home for /root/.spamassassin - Allow sa-update to search admin home for /root/.spamassassin - Allow antivirus domain to read net sysctl - Dontaudit attempts from thumb_t to connect to ssd - Dontaudit attempts by readahead to read sock_files - Dontaudit attempts by readahead to read sock_files - Create tmpfs file while running as wine as user_tmpfs_t - Dontaudit attempts by readahead to read sock_files - libmpg ships badly created librarie- Change ssh_use_pts to use macro and only inherited sshd_devpts_t - Allow confined users to read systemd_logind seat information - libmpg ships badly created libraries - Add support for strongswan.service - Add labeling for strongswan - Allow l2tpd_t to read network manager content in /run directory - Allow rsync to getattr any file in rsync_data_t - Add labeling and filename transition for .grl-podcasts- mount.glusterfs executes glusterfsd binary - Allow systemd_hostnamed_t to stream connect to systemd - Dontaudit any user doing a access check - Allow obex-data-server to request the kernel to load a module - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info) - Allow gpg-agent to read /proc/sys/crypto/fips_enabled - Add new types for antivirus.pp policy module - Allow gnomesystemmm_t caps because of ioprio_set - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t - Allow gnomesystemmm_t caps because of ioprio_set - Allow NM rawip socket - files_relabel_non_security_files can not be used with boolean - Add interface to thumb_t dbus_chat to allow it to read remote process state - ALlow logrotate to domtrans to mdadm_t - kde gnomeclock wants to write content to /tmp- kde gnomeclock wants to write content to /tmp - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde - Allow blueman_t to rwx zero_device_t, for some kind of jre - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre - Ftp full access should be allowed to create directories as well as files - Add boolean to allow rsync_full_acces, so that an rsync server can write all - over the local machine - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6 - Add missing vpnc_roles type line - Allow stapserver to write content in /tmp - Allow gnome keyring to create keyrings dir in ~/.local/share - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Add interface to colord_t dbus_chat to allow it to read remote process state - Allow colord_t to read cupsd_t state - Add mate-thumbnail-font as thumnailer - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data. - Allow qpidd to list /tmp. Needed by ssl - Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18 - - Added systemd support for ksmtuned - Added booleans ksmtuned_use_nfs ksmtuned_use_cifs - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow - Looks like qpidd_t needs to read /dev/random - Lots of probing avc's caused by execugting gpg from staff_t - Dontaudit senmail triggering a net_admin avc - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port - Logwatch does access check on mdadm binary - Add raid_access_check_mdadm() iterface- Fix systemd_manage_unit_symlinks() interface - Call systemd_manage_unit_symlinks(() which is correct interface - Add filename transition for opasswd - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow sytstemd-timedated to get status of init_t - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow gpg_t to manage all gnome files - Stop using pcscd_read_pub_files - New rules for xguest, dontaudit attempts to dbus chat - Allow firewalld to create its mmap files in tmpfs and tmp directories - Allow firewalld to create its mmap files in tmpfs and tmp directories - run unbound-chkconf as named_t, so it can read dnssec - Colord is reading xdm process state, probably reads state of any apps that sends dbus message - Allow mdadm_t to change the kernel scheduler - mythtv policy - Update mandb_admin() interface - Allow dsspam to listen on own tpc_socket - seutil_filetrans_named_content needs to be optional - Allow sysadm_t to execute content in his homedir - Add attach_queue to tun_socket, new patch from Paul Moore - Change most of selinux configuration types to security_file_type. - Add filename transition rules for selinux configuration - ssh into a box with -X -Y requires ssh_use_ptys - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated - New allow rules found by Tom London for systemd_hostnamed- Allow systemd-tmpfiles to relabel lpd spool files - Ad labeling for texlive bash scripts - Add xserver_filetrans_fonts_cache_home_content() interface - Remove duplicate rules from *.te - Add support for /var/lock/man-db.lock - Add support for /var/tmp/abrt(/.*)? - Add additional labeling for munin cgi scripts - Allow httpd_t to read munin conf files - Allow certwatch to read meminfo - Fix nscd_dontaudit_write_sock_file() interfac - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling- Allow gnomeclock to talk to puppet over dbus - Allow numad access discovered by Dominic - Add support for HOME_DIR/.maildir - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain - Allow udev to relabel udev_var_run_t lnk_files - New bin_t file in mcelog- Remove all mcs overrides and replace with t1 != mcs_constrained_types - Add attribute_role for iptables - mcs_process_set_categories needs to be called for type - Implement additional role_attribute statements - Sodo domain is attempting to get the additributes of proc_kcore_t - Unbound uses port 8953 - Allow svirt_t images to compromise_kernel when using pci-passthrough - Add label for dns lib files - Bluetooth aquires a dbus name - Remove redundant files_read_usr_file calling - Remove redundant files_read_etc_file calling - Fix mozilla_run_plugin() - Add role_attribute support for more domains- Mass merge with upstream- Bump the policy version to 28 to match selinux userspace - Rebuild versus latest libsepol- Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Add labeling for /var/named/chroot/etc/localtim- Allow setroubleshoot_fixit to execute rpm - zoneminder needs to connect to httpd ports where remote cameras are listening - Allow firewalld to execute content created in /run directory - Allow svirt_t to read generic certs - Dontaudit leaked ps content to mozilla plugin - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - init scripts are creating systemd_unit_file_t directories- systemd_logind_t is looking at all files under /run/user/apache - Allow systemd to manage all user tmp files - Add labeling for /var/named/chroot/etc/localtime - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6 - Keystone is now using a differnt port - Allow xdm_t to use usbmuxd daemon to control sound - Allow passwd daemon to execute gnome_exec_keyringd - Fix chrome_sandbox policy - Add labeling for /var/run/checkquorum-timer - More fixes for the dspam domain, needs back port to RHEL6 - More fixes for the dspam domain, needs back port to RHEL6 - sssd needs to connect to kerberos password port if a user changes his password - Lots of fixes from RHEL testing of dspam web - Allow chrome and mozilla_plugin to create msgq and semaphores - Fixes for dspam cgi scripts - Fixes for dspam cgi scripts - Allow confine users to ptrace screen - Backport virt_qemu_ga_t changes from RHEL - Fix labeling for dspam.cgi needed for RHEL6 - We need to back port this policy to RHEL6, for lxc domains - Dontaudit attempts to set sys_resource of logrotate - Allow corosync to read/write wdmd's tmpfs files - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set - Allow cron jobs to read bind config for unbound - libvirt needs to inhibit systemd - kdumpctl needs to delete boot_t files - Fix duplicate gnome_config_filetrans - virtd_lxc_t is using /dev/fuse - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift - apcupsd can be setup to listen to snmp trafic - Allow transition from kdumpgui to kdumpctl - Add fixes for munin CGI scripts - Allow deltacloud to connect to openstack at the keystone port - Allow domains that transition to svirt domains to be able to signal them - Fix file context of gstreamer in .cache directory - libvirt is communicating with logind - NetworkManager writes to the systemd inhibit pipe- Allow munin disk plugins to get attributes of all directories - Allow munin disk plugins to get attributes of all directorie - Allow logwatch to get attributes of all directories - Fix networkmanager_manage_lib() interface - Fix gnome_manage_config() to allow to manage sock_file - Fix virtual_domain_context - Add support for dynamic DNS for DHCPv6- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch - Add additional labeling for /var/www/openshift/broker - Fix rhev policy - Allow openshift_initrc domain to dbus chat with systemd_logind - Allow httpd to getattr passenger log file if run_stickshift - Allow consolehelper-gtk to connect to xserver - Add labeling for the tmp-inst directory defined in pam_namespace.conf - Add lvm_metadata_t labeling for /etc/multipath- consoletype is no longer used- Add label for efivarfs - Allow certmonger to send signal to itself - Allow plugin-config to read own process status - Add more fixes for pacemaker - apache/drupal can run clamscan on uploaded content - Allow chrome_sandbox_nacl_t to read pid 1 content- Fix MCS Constraints to control ingres and egres controls on the network. - Change name of svirt_nokvm_t to svirt_tcg_t - Allow tuned to request the kernel to load kernel modules- Label /var/lib/pgsql/.ssh as ssh_home_t - Add labeling for /usr/bin/pg_ctl - Allow systemd-logind to manage keyring user tmp dirs - Add support for 7389/tcp port - gems seems to be placed in lots of places - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus - Add back tcp/8123 port as http_cache port - Add ovirt-guest-agent\.pid labeling - Allow xend to run scsi_id - Allow rhsmcertd-worker to read "physical_package_id" - Allow pki_tomcat to connect to ldap port - Allow lpr to read /usr/share/fonts - Allow open file from CD/DVD drive on domU - Allow munin services plugins to talk to SSSD - Allow all samba domains to create samba directory in var_t directories - Take away svirt_t ability to use nsswitch - Dontaudit attempts by openshift to read apache logs - Allow apache to create as well as append _ra_content_t - Dontaudit sendmail_t reading a leaked file descriptor - Add interface to have admin transition /etc/prelink.cache to the proper label - Add sntp support to ntp policy - Allow firewalld to dbus chat with devicekit_power - Allow tuned to call lsblk - Allow tor to read /proc/sys/kernel/random/uuid - Add tor_can_network_relay boolean- Add openshift_initrc_signal() interface - Fix typos - dspam port is treat as spamd_port_t - Allow setroubleshoot to getattr on all executables - Allow tuned to execute profiles scripts in /etc/tuned - Allow apache to create directories to store its log files - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6 - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM - Add filename transition for /etc/tuned/active_profile - Allow condor_master to send mails - Allow condor_master to read submit.cf - Allow condor_master to create /tmp files/dirs - Allow condor_mater to send sigkill to other condor domains - Allow condor_procd sigkill capability - tuned-adm wants to talk with tuned daemon - Allow kadmind and krb5kdc to also list sssd_public_t - Allow accountsd to dbus chat with init - Fix git_read_generic_system_content_files() interface - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler" - Fix mozilla_plugin_can_network_connect to allow to connect to all ports - Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t - dspam wants to search /var/spool for opendkim data - Revert "Add support for tcp/10026 port as dspam_port_t" - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6 - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain - Allow systemd_tmpfiles_t to setattr on mandb_cache_t- consolekit.pp was not removed from the postinstall script- Add back consolekit policy - Silence bootloader trying to use inherited tty - Silence xdm_dbusd_t trying to execute telepathy apps - Fix shutdown avcs when machine has unconfined.pp disabled - The host and a virtual machine can share the same printer on a usb device - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob - Allow abrt_watch_log_t to execute bin_t - Allow chrome sandbox to write content in ~/.config/chromium - Dontaudit setattr on fontconfig dir for thumb_t - Allow lircd to request the kernel to load module - Make rsync as userdom_home_manager - Allow rsync to search automount filesystem - Add fixes for pacemaker- Add support for 4567/tcp port - Random fixes from Tuomo Soini - xdm wants to get init status - Allow programs to run in fips_mode - Add interface to allow the reading of all blk device nodes - Allow init to relabel rpcbind sock_file - Fix labeling for lastlog and faillog related to logrotate - ALlow aeolus_configserver to use TRAM port - Add fixes for aeolus_configserver - Allow snmpd to connect to snmp port - Allow spamd_update to create spamd_var_lib_t directories - Allow domains that can read sssd_public_t files to also list the directory - Remove miscfiles_read_localization, this is defined for all domains- Allow syslogd to request the kernel to load a module - Allow syslogd_t to read the network state information - Allow xdm_dbusd_t connect to the system DBUS - Add support for 7389/tcp port - Allow domains to read/write all inherited sockets - Allow staff_t to read kmsg - Add awstats_purge_apache_log boolean - Allow ksysguardproces to read /.config/Trolltech.conf - Allow passenger to create and append puppet log files - Add puppet_append_log and puppet_create_log interfaces - Add puppet_manage_log() interface - Allow tomcat domain to search tomcat_var_lib_t - Allow pki_tomcat_t to connect to pki_ca ports - Allow pegasus_t to have net_admin capability - Allow pegasus_t to write /sys/class/net//flags - Allow mailserver_delivery to manage mail_home_rw_t lnk_files - Allow fetchmail to create log files - Allow gnomeclock to manage home config in .kde - Allow bittlebee to read kernel sysctls - Allow logrotate to list /root- Fix userhelper_console_role_template() - Allow enabling Network Access Point service using blueman - Make vmware_host_t as unconfined domain - Allow authenticate users in webaccess via squid, using mysql as backend - Allow gathers to get various metrics on mounted file systems - Allow firewalld to read /etc/hosts - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t - Allow kdumpgui to read/write to zipl.conf - Commands needed to get mock to build from staff_t in enforcing mode - Allow mdadm_t to manage cgroup files - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files - dontaudit ifconfig_t looking at fifo_files that are leaked to it - Add lableing for Quest Authentication System- Fix filetrans interface definitions - Dontaudit xdm_t to getattr on BOINC lib files - Add systemd_reload_all_services() interface - Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files - Allow accountsd to dbus chat with gdm - Allow realmd to getattr on all fs - Allow logrotate to reload all services - Add systemd unit file for radiusd - Allow winbind to create samba pid dir - Add labeling for /var/nmbd/unexpected - Allow chrome and mozilla plugin to connect to msnp ports- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file - Dontaudit setfiles reading /dev/random - On initial boot gnomeclock is going to need to be set buy gdm - Fix tftp_read_content() interface - Random apps looking at kernel file systems - Testing virt with lxc requiers additional access for virsh_t - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container - Allow MPD to read /dev/radnom - Allow sandbox_web_type to read logind files which needs to read pulseaudio - Allow mozilla plugins to read /dev/hpet - Add labeling for /var/lib/zarafa-webap - Allow BOINC client to use an HTTP proxy for all connections - Allow rhsmertd to domain transition to dmidecod - Allow setroubleshootd to send D-Bus msg to ABRT- Define usbtty_device_t as a term_tty - Allow svnserve to accept a connection - Allow xend manage default virt_image_t type - Allow prelink_cron_system_t to overide user componant when executing cp - Add labeling for z-push - Gnomeclock sets the realtime clock - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd - Allow lxc domains to use /dev/random and /dev/urandom- Add port defintion for tcp/9000 - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API - Allow shorewall_t to create netlink_socket - Allow krb5admind to block suspend - Fix labels on /var/run/dlm_controld /var/log/dlm_controld - Allow krb5kdc to block suspend - gnomessytemmm_t needs to read /etc/passwd - Allow cgred to read all sysctls- Allow all domains to read /proc/sys/vm/overcommit_memory - Make proc_numa_t an MLS Trusted Object - Add /proc/numactl support for confined users - Allow ssh_t to connect to any port > 1023 - Add openvswitch domain - Pulseaudio tries to create directories in gnome_home_t directories - New ypbind pkg wants to search /var/run which is caused by sd_notify - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans - Allow sanlock to read /dev/random - Treat php-fpm with httpd_t - Allow domains that can read named_conf_t to be able to list the directories - Allow winbind to create sock files in /var/run/samba- Add smsd policy - Add support for OpenShift sbin labelin - Add boolean to allow virt to use rawip - Allow mozilla_plugin to read all file systems with noxattrs support - Allow kerberos to write on anon_inodefs fs - Additional access required by fenced - Add filename transitions for passwd.lock/group.lock - UPdate man pages - Create coolkey directory in /var/cache with the correct label- Fix label on /etc/group.lock - Allow gnomeclock to create lnk_file in /etc - label /root/.pki as a home_cert_t - Add interface to make sure rpcbind.sock is created with the correct label - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules - opendkim should be a part of milter - Allow libvirt to set the kernel sched algorythm - Allow mongod to read sysfs_t - Add authconfig policy - Remove calls to miscfiles_read_localization all domains get this - Allow virsh_t to read /root/.pki/ content - Add label for log directory under /var/www/stickshift- Allow getty to setattr on usb ttys - Allow sshd to search all directories for sshd_home_t content - Allow staff domains to send dbus messages to kdumpgui - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t - Dontaudit setfiles reading urand - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir - Allow systemd-timedated to read /dev/urandom - Allow entropyd_t to read proc_t (meminfo) - Add unconfined munin plugin - Fix networkmanager_read_conf() interface - Allow blueman to list /tmp which is needed by sys_nic/setsched - Fix label of /etc/mail/aliasesdb-stamp - numad is searching cgroups - realmd is communicating with networkmanager using dbus - Lots of fixes to try to get kdump to work- Allow loging programs to dbus chat with realmd - Make apache_content_template calling as optional - realmd is using policy kit- Add new selinuxuser_use_ssh_chroot boolean - dbus needs to be able to read/write inherited fixed disk device_t passed through it - Cleanup netutils process allow rule - Dontaudit leaked fifo files from openshift to ping - sanlock needs to read mnt_t lnk files - Fail2ban needs to setsched and sys_nice- Change default label of all files in /var/run/rpcbind - Allow sandbox domains (java) to read hugetlbfs_t - Allow awstats cgi content to create tmp files and read apache log files - Allow setuid/setgid for cupsd-config - Allow setsched/sys_nice pro cupsd-config - Fix /etc/localtime sym link to be labeled locale_t - Allow sshd to search postgresql db t since this is a homedir - Allow xwindows users to chat with realmd - Allow unconfined domains to configure all files and null_device_t service- Adopt pki-selinux policy- pki is leaking which we dontaudit until a pki code fix - Allow setcap for arping - Update man pages - Add labeling for /usr/sbin/mcollectived - pki fixes - Allow smokeping to execute fping in the netutils_t domain- Allow mount to relabelfrom unlabeled file systems - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working - Add label to get bin files under libreoffice labeled correctly - Fix interface to allow executing of base_ro_file_type - Add fixes for realmd - Update pki policy - Add tftp_homedir boolean - Allow blueman sched_setscheduler - openshift user domains wants to r/w ssh tcp sockets- Additional requirements for disable unconfined module when booting - Fix label of systemd script files - semanage can use -F /dev/stdin to get input - syslog now uses kerberos keytabs - Allow xserver to compromise_kernel access - Allow nfsd to write to mount_var_run_t when running the mount command - Add filename transition rule for bin_t directories - Allow files to read usr_t lnk_files - dhcpc wants chown - Add support for new openshift labeling - Clean up for tunable+optional statements - Add labeling for /usr/sbin/mkhomedir_helper - Allow antivirus domain to managa amavis spool files - Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool- Add interfaces to read kernel_t proc info - Missed this version of exec_all - Allow anyone who can load a kernel module to compromise kernel - Add oddjob_dbus_chat to openshift apache policy - Allow chrome_sandbox_nacl_t to send signals to itself - Add unit file support to usbmuxd_t - Allow all openshift domains to read sysfs info - Allow openshift domains to getattr on all domains- MLS fixes from Dan - Fix name of capability2 secure_firmware->compromise_kerne- Allow xdm to search all file systems - Add interface to allow the config of all files - Add rngd policy - Remove kgpg as a gpg_exec_t type - Allow plymouthd to block suspend - Allow systemd_dbus to config any file - Allow system_dbus_t to configure all services - Allow freshclam_t to read usr_files - varnishd requires execmem to load modules- Allow semanage to verify types - Allow sudo domain to execute user home files - Allow session_bus_type to transition to user_tmpfs_t - Add dontaudit caused by yum updates - Implement pki policy but not activated- tuned wants to getattr on all filesystems - tuned needs also setsched. The build is needed for test day- Add policy for qemu-qa - Allow razor to write own config files - Add an initial antivirus policy to collect all antivirus program - Allow qdisk to read usr_t - Add additional caps for vmware_host - Allow tmpfiles_t to setattr on mandb_cache_t - Dontaudit leaked files into mozilla_plugin_config_t - Allow wdmd to getattr on tmpfs - Allow realmd to use /dev/random - allow containers to send audit messages - Allow root mount any file via loop device with enforcing mls policy - Allow tmpfiles_t to setattr on mandb_cache_t - Allow tmpfiles_t to setattr on mandb_cache_t - Make userdom_dontaudit_write_all_ not allow open - Allow init scripts to read all unit files - Add support for saphostctrl ports- Add kernel_read_system_state to sandbox_client_t - Add some of the missing access to kdumpgui - Allow systemd_dbusd_t to status the init system - Allow vmnet-natd to request the kernel to load a module - Allow gsf-office-thum to append .cache/gdm/session.log - realmd wants to read .config/dconf/user - Firewalld wants sys_nice/setsched - Allow tmpreaper to delete mandb cache files - Firewalld wants sys_nice/setsched - Allow firewalld to perform a DNS name resolution - Allown winbind to read /usr/share/samba/codepages/lowcase.dat - Add support for HTTPProxy* in /etc/freshclam.conf - Fix authlogin_yubike boolean - Extend smbd_selinux man page to include samba booleans - Allow dhcpc to execute consoletype - Allow ping to use inherited tmp files created in init scripts - On full relabel with unconfined domain disabled, initrc was running some chcon's - Allow people who delete man pages to delete mandb cache files- Add missing permissive domains- Add new mandb policy - ALlow systemd-tmpfiles_t to relabel mandb_cache_t - Allow logrotate to start all unit files- Add fixes for ctbd - Allow nmbd to stream connect to ctbd - Make cglear_t as nsswitch_domain - Fix bogus in interfaces - Allow openshift to read/write postfix public pipe - Add postfix_manage_spool_maildrop_files() interface - stickshift paths have been renamed to openshift - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes - Update man pages, adding ENTRYPOINTS- Add mei_device_t - Make sure gpg content in homedir created with correct label - Allow dmesg to write to abrt cache files - automount wants to search virtual memory sysctls - Add support for hplip logs stored in /var/log/hp/tmp - Add labeling for /etc/owncloud/config.php - Allow setroubleshoot to send analysys to syslogd-journal - Allow virsh_t to interact with new fenced daemon - Allow gpg to write to /etc/mail/spamassassiin directories - Make dovecot_deliver_t a mail server delivery type - Add label for /var/tmp/DNS25- Fixes for tomcat_domain template interface- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes - Add attribute to all base os types. Allow all domains to read all ro base OS types- Additional unit files to be defined as power unit files - Fix more boolean names- Fix boolean name so subs will continue to work- dbus needs to start getty unit files - Add interface to allow system_dbusd_t to start the poweroff service - xdm wants to exec telepathy apps - Allow users to send messages to systemdlogind - Additional rules needed for systemd and other boot apps - systemd wants to list /home and /boot - Allow gkeyringd to write dbus/conf file - realmd needs to read /dev/urand - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded- Fixes to safe more rules - Re-write tomcat_domain_template() - Fix passenger labeling - Allow all domains to read man pages - Add ephemeral_port_t to the 'generic' port interfaces - Fix the names of postgresql booleans- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer - Move netlable_peer check out of booleans - Remove call to recvfrom_netlabel for kerberos call - Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules - Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface - Allow rndc to block suspend - tuned needs to modify the schedule of the kernel - Allow svirt_t domains to read alsa configuration files - ighten security on irc domains and make sure they label content in homedir correctly - Add filetrans_home_content for irc files - Dontaudit all getattr access for devices and filesystems for sandbox domains - Allow stapserver to search cgroups directories - Allow all postfix domains to talk to spamd- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check - Change pam_t to pam_timestamp_t - Add dovecot_domain attribute and allow this attribute block_suspend capability2 - Add sanlock_use_fusefs boolean - numad wants send/recieve msg - Allow rhnsd to send syslog msgs - Make piranha-pulse as initrc domain - Update openshift instances to dontaudit setattr until the kernel is fixed.- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd - Remove pam_selinux.8 which conflicts with man page owned by the pam package - Allow glance-api to talk to mysql - ABRT wants to read Xorg.0.log if if it detects problem with Xorg - Fix gstreamer filename trans. interface- Man page fixes by Dan Walsh- Allow postalias to read postfix config files - Allow man2html to read man pages - Allow rhev-agentd to search all mountpoints - Allow rhsmcertd to read /dev/random - Add tgtd_stream_connect() interface - Add cyrus_write_data() interface - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t - Add port definition for tcp/81 as http_port_t - Fix /dev/twa labeling - Allow systemd to read modules config- Merge openshift policy - Allow xauth to read /dev/urandom - systemd needs to relabel content in /run/systemd directories - Files unconfined should be able to perform all services on all files - Puppet tmp file can be leaked to all domains - Dontaudit rhsmcertd-worker to search /root/.local - Allow chown capability for zarafa domains - Allow system cronjobs to runcon into openshift domains - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories- nmbd wants to create /var/nmbd - Stop transitioning out of anaconda and firstboot, just causes AVC messages - Allow clamscan to read /etc files - Allow bcfg2 to bind cyphesis port - heartbeat should be run as rgmanager_t instead of corosync_t - Add labeling for /etc/openldap/certs - Add labeling for /opt/sartest directory - Make crontab_t as userdom home reader - Allow tmpreaper to list admin_home dir - Add defition for imap_0 replay cache file - Add support for gitolite3 - Allow virsh_t to send syslog messages - allow domains that can read samba content to be able to list the directories also - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd - Separate out sandbox from sandboxX policy so we can disable it by default - Run dmeventd as lvm_t - Mounting on any directory requires setattr and write permissions - Fix use_nfs_home_dirs() boolean - New labels for pam_krb5 - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0 - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs - Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles- Allow realmd to read resolv.conf - Add pegasus_cache_t type - Label /usr/sbin/fence_virtd as virsh_exec_t - Add policy for pkcsslotd - Add support for cpglockd - Allow polkit-agent-helper to read system-auth-ac - telepathy-idle wants to read gschemas.compiled - Allow plymouthd to getattr on fs_t - Add slpd policy - Allow ksysguardproces to read/write config_usr_t- Fix labeling substitution so rpm will label /lib/systemd content correctly- Add file name transitions for ttyACM0 - spice-vdagent(d)'s are going to log over to syslog - Add sensord policy - Add more fixes for passenger policy related to puppet - Allow wdmd to create wdmd_tmpfs_t - Fix labeling for /var/run/cachefilesd\.pid - Add thumb_tmpfs_t files type- Allow svirt domains to manage the network since this is containerized - Allow svirt_lxc_net_t to send audit messages- Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working - Allow dlm_controld to execute dlm_stonith labeled as bin_t - Allow GFS2 working on F17 - Abrt needs to execute dmesg - Allow jockey to list the contents of modeprobe.d - Add policy for lightsquid as squid_cron_t - Mailscanner is creating files and directories in /tmp - dmesg is now reading /dev/kmsg - Allow xserver to communicate with secure_firmware - Allow fsadm tools (fsck) to read /run/mount contnet - Allow sysadm types to read /dev/kmsg -- Allow postfix, sssd, rpcd to block_suspend - udev seems to need secure_firmware capability - Allow virtd to send dbus messages to firewalld so it can configure the firewall- Fix labeling of content in /run created by virsh_t - Allow condor domains to read kernel sysctls - Allow condor_master to connect to amqp - Allow thumb drives to create shared memory and semaphores - Allow abrt to read mozilla_plugin config files - Add labels for lightsquid - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow - dovecot_auth_t uses ldap for user auth - Allow domains that can read dhcp_etc_t to read lnk_files - Add more then one watchdog device - Allow useradd_t to manage etc_t files so it can rename it and edit them - Fix invalid class dir should be fifo_file - Move /run/blkid to fsadm and make sure labeling is correct- Fix bogus regex found by eparis - Fix manage run interface since lvm needs more access - syslogd is searching cgroups directory - Fixes to allow virt-sandbox-service to manage lxc var run content- Fix Boolean settings - Add new libjavascriptcoregtk as textrel_shlib_t - Allow xdm_t to create xdm_home_t directories - Additional access required for systemd - Dontaudit mozilla_plugin attempts to ipc_lock - Allow tmpreaper to delete unlabeled files - Eliminate screen_tmp_t and allow it to manage user_tmp_t - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors - Allow web plugins to connect to the asterisk ports - Condor will recreate the lock directory if it does not exist - Oddjob mkhomedir needs to connectto user processes - Make oddjob_mkhomedir_t a userdom home manager- Put placeholder back in place for proper numbering of capabilities - Systemd also configures init scripts- Fix ecryptfs interfaces - Bootloader seems to be trolling around /dev/shm and /dev - init wants to create /etc/systemd/system-update.target.wants - Fix systemd_filetrans call to move it out of tunable - Fix up policy to work with systemd userspace manager - Add secure_firmware capability and remove bogus epolwakeup - Call seutil_*_login_config interfaces where should be needed - Allow rhsmcertd to send signal to itself - Allow thin domains to send signal to itself - Allow Chrome_ChildIO to read dosfs_t- Add role rules for realmd, sambagui- Add new type selinux_login_config_t for /etc/selinux//logins/ - Additional fixes for seutil_manage_module_store() - dbus_system_domain() should be used with optional_policy - Fix svirt to be allowed to use fusefs file system - Allow login programs to read /run/ data created by systemd_login - sssd wants to write /etc/selinux//logins/ for SELinux PAM module - Fix svirt to be allowed to use fusefs file system - Allow piranha domain to use nsswitch - Sanlock needs to send Kill Signals to non root processes - Pulseaudio wants to execute /run/user/PID/.orc- Fix saslauthd when it tries to read /etc/shadow - Label gnome-boxes as a virt homedir - Need to allow svirt_t ability to getattr on nfs_t file systems - Update sanlock policy to solve all AVC's - Change confined users can optionally manage virt content - Handle new directories under ~/.cache - Add block suspend to appropriate domains - More rules required for containers - Allow login programs to read /run/ data created by systemd_logind - Allow staff users to run svirt_t processes- Update to upstream- More fixes for systemd to make rawhide booting from Dan Walsh- Add systemd fixes to make rawhide booting- Add systemd_logind_inhibit_var_run_t attribute - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type - Add interface for mysqld to dontaudit signull to all processes - Label new /var/run/journal directory correctly - Allow users to inhibit suspend via systemd - Add new type for the /var/run/inhibit directory - Add interface to send signull to systemd_login so avahi can send them - Allow systemd_passwd to send syslog messages - Remove corenet_all_recvfrom_unlabeled() calling fro policy files - Allow editparams.cgi running as httpd_bugzilla_script_t to read /etc/group - Allow smbd to read cluster config - Add additional labeling for passenger - Allow dbus to inhibit suspend via systemd - Allow avahi to send signull to systemd_login- Add interface to dontaudit getattr access on sysctls - Allow sshd to execute /bin/login - Looks like xdm is recreating the xdm directory in ~/.cache/ on login - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald - Fix semanage to work with unconfined domain disabled on F18 - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls - Virt seems to be using lock files - Dovecot seems to be searching directories of every mountpoint - Allow jockey to read random/urandom, execute shell and install third-party drivers - Add aditional params to allow cachedfiles to manage its content - gpg agent needs to read /dev/random - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write - Add a bunch of dontaudit rules to quiet svirt_lxc domains - Additional perms needed to run svirt_lxc domains - Allow cgclear to read cgconfig - Allow sys_ptrace capability for snmp - Allow freshclam to read /proc - Allow procmail to manage /home/user/Maildir content - Allow NM to execute wpa_cli - Allow amavis to read clamd system state - Regenerate man pages- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild- Add realmd and stapserver policies - Allow useradd to manage stap-server lib files - Tighten up capabilities for confined users - Label /etc/security/opasswd as shadow_t - Add label for /dev/ecryptfs - Allow condor_startd_t to start sshd with the ranged - Allow lpstat.cups to read fips_enabled file - Allow pyzor running as spamc_t to create /root/.pyzor directory - Add labelinf for amavisd-snmp init script - Add support for amavisd-snmp - Allow fprintd sigkill self - Allow xend (w/o libvirt) to start virtual machines - Allow aiccu to read /etc/passwd - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes - Add condor_startd_ranged_domtrans_to() interface - Add ssd_conf_t for /etc/sssd - accountsd needs to fchown some files/directories - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit - Allow xend_t to read the /etc/passwd file- Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t - Add init_access_check() interface - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t - Allow tcpdump to create a netlink_socket - Label newusers like useradd - Change xdm log files to be labeled xdm_log_t - Allow sshd_t with privsep to work in MLS - Allow freshclam to update databases thru HTTP proxy - Allow s-m-config to access check on systemd - Allow abrt to read public files by default - Fix amavis_create_pid_files() interface - Add labeling and filename transition for dbomatic.log - Allow system_dbusd_t to stream connect to bluetooth, and use its socket - Allow amavisd to execute fsav - Allow tuned to use sys_admin and sys_nice capabilities - Add php-fpm policy from Bryan - Add labeling for aeolus-configserver-thinwrapper - Allow thin domains to execute shell - Fix gnome_role_gkeyringd() interface description - Lot of interface fixes - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files - Allow OpenMPI job to use kerberos - Make deltacloudd_t as nsswitch_domain - Allow xend_t to run lsscsi - Allow qemu-dm running as xend_t to create tun_socket - Add labeling for /opt/brother/Printers(.*/)?inf - Allow jockey-backend to read pyconfig-64.h labeled as usr_t - Fix clamscan_can_scan_system boolean - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11- initrc is calling exportfs which is not confined so it attempts to read nfsd_files - Fixes for passenger running within openshift. - Add labeling for all tomcat6 dirs - Add support for tomcat6 - Allow cobblerd to read /etc/passwd - Allow jockey to read sysfs and and execute binaries with bin_t - Allow thum to use user terminals - Allow cgclear to read cgconfig config files - Fix bcf2g.fc - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains - Allow dbomatic to execute ruby - abrt_watch_log should be abrt_domain - Allow mozilla_plugin to connect to gatekeeper port- add ptrace_child access to process - remove files_read_etc_files() calling from all policies which have auth_use_nsswith() - Allow boinc domains to manage boinc_lib_t lnk_files - Add support for boinc-client.service unit file - Add support for boinc.log - Allow mozilla_plugin execmod on mozilla home files if allow_ex - Allow dovecot_deliver_t to read dovecot_var_run_t - Allow ldconfig and insmod to manage kdumpctl tmp files - Move thin policy out from cloudform.pp and add a new thin poli - pacemaker needs to communicate with corosync streams - abrt is now started on demand by dbus - Allow certmonger to talk directly to Dogtag servers - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c - Allow mozila_plugin to execute gstreamer home files - Allow useradd to delete all file types stored in the users hom - rhsmcertd reads the rpm database - Add support for lightdm- Add tomcat policy - Remove pyzor/razor policy - rhsmcertd reads the rpm database - Dontaudit thumb to setattr on xdm_tmp dir - Allow wicd to execute ldconfig in the networkmanager_t domain - Add /var/run/cherokee\.pid labeling - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too - Allow postfix-master to r/w pipes other postfix domains - Allow snort to create netlink_socket - Add kdumpctl policy - Allow firstboot to create tmp_t files/directories - /usr/bin/paster should not be labeled as piranha_exec_t - remove initrc_domain from tomcat - Allow ddclient to read /etc/passwd - Allow useradd to delete all file types stored in the users homedir - Allow ldconfig and insmod to manage kdumpctl tmp files - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those - Transition xauth files within firstboot_tmp_t - Fix labeling of /run/media to match /media - Label all lxdm.log as xserver_log_t - Add port definition for mxi port - Allow local_login_t to execute tmux- apcupsd needs to read /etc/passwd - Sanlock allso sends sigkill - Allow glance_registry to connect to the mysqld port - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl - Allow firefox plugins/flash to connect to port 1234 - Allow mozilla plugins to delete user_tmp_t files - Add transition name rule for printers.conf.O - Allow virt_lxc_t to read urand - Allow systemd_loigind to list gstreamer_home_dirs - Fix labeling for /usr/bin - Fixes for cloudform services * support FIPS - Allow polipo to work as web caching - Allow chfn to execute tmux- Add support for ecryptfs * ecryptfs does not support xattr * we need labeling for HOMEDIR - Add policy for (u)mount.ecryptfs* - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache - Allow dovecot to manage Maildir content, fix transitions to Maildir - Allow postfix_local to transition to dovecot_deliver - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code - Cleanup interface definitions - Allow apmd to change with the logind daemon - Changes required for sanlock in rhel6 - Label /run/user/apache as httpd_tmp_t - Allow thumb to use lib_t as execmod if boolean turned on - Allow squid to create the squid directory in /var with the correct labe - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com) - Allow virtd to exec xend_exec_t without transition - Allow virtd_lxc_t to unmount all file systems- PolicyKit path has changed - Allow httpd connect to dirsrv socket - Allow tuned to write generic kernel sysctls - Dontaudit logwatch to gettr on /dev/dm-2 - Allow policykit-auth to manage kerberos files - Make condor_startd and rgmanager as initrc domain - Allow virsh to read /etc/passwd - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs - xdm now needs to execute xsession_exec_t - Need labels for /var/lib/gdm - Fix files_filetrans_named_content() interface - Add new attribute - initrc_domain - Allow systemd_logind_t to signal, signull, sigkill all processes - Add filetrans rules for etc_runtime files- Rename boolean names to remove allow_- Mass merge with upstream * new policy topology to include contrib policy modules * we have now two base policy patches- Fix description of authlogin_nsswitch_use_ldap - Fix transition rule for rhsmcertd_t needed for RHEL7 - Allow useradd to list nfs state data - Allow openvpn to manage its log file and directory - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly - Allow thumb to use nvidia devices - Allow local_login to create user_tmp_t files for kerberos - Pulseaudio needs to read systemd_login /var/run content - virt should only transition named system_conf_t config files - Allow munin to execute its plugins - Allow nagios system plugin to read /etc/passwd - Allow plugin to connect to soundd port - Fix httpd_passwd to be able to ask passwords - Radius servers can use ldap for backing store - Seems to need to mount on /var/lib for xguest polyinstatiation to work. - Allow systemd_logind to list the contents of gnome keyring - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL - Add policy for isns-utils- Add policy for subversion daemon - Allow boinc to read passwd - Allow pads to read kernel network state - Fix man2html interface for sepolgen-ifgen - Remove extra /usr/lib/systemd/system/smb - Remove all /lib/systemd and replace with /usr/lib/systemd - Add policy for man2html - Fix the label of kerberos_home_t to krb5_home_t - Allow mozilla plugins to use Citrix - Allow tuned to read /proc/sys/kernel/nmi_watchdog - Allow tune /sys options via systemd's tmpfiles.d "w" type- Dontaudit lpr_t to read/write leaked mozilla tmp files - Add file name transition for .grl-podcasts directory - Allow corosync to read user tmp files - Allow fenced to create snmp lib dirs/files - More fixes for sge policy - Allow mozilla_plugin_t to execute any application - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain - Allow mongod to read system state information - Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t - Allow polipo to manage polipo_cache dirs - Add jabbar_client port to mozilla_plugin_t - Cleanup procmail policy - system bus will pass around open file descriptors on files that do not have labels on them - Allow l2tpd_t to read system state - Allow tuned to run ls /dev - Allow sudo domains to read usr_t files - Add label to machine-id - Fix corecmd_read_bin_symlinks cut and paste error- Fix pulseaudio port definition - Add labeling for condor_starter - Allow chfn_t to creat user_tmp_files - Allow chfn_t to execute bin_t - Allow prelink_cron_system_t to getpw calls - Allow sudo domains to manage kerberos rcache files - Allow user_mail_domains to work with courie - Port definitions necessary for running jboss apps within openshift - Add support for openstack-nova-metadata-api - Add support for nova-console* - Add support for openstack-nova-xvpvncproxy - Fixes to make privsep+SELinux working if we try to use chage to change passwd - Fix auth_role() interface - Allow numad to read sysfs - Allow matahari-rpcd to execute shell - Add label for ~/.spicec - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it - Devicekit_disk wants to read the logind sessions file when writing a cd - Add fixes for condor to make condor jobs working correctly - Change label of /var/log/rpmpkgs to cron_log_t - Access requires to allow systemd-tmpfiles --create to work. - Fix obex to be a user application started by the session bus. - Add additional filename trans rules for kerberos - Fix /var/run/heartbeat labeling - Allow apps that are managing rcache to file trans correctly - Allow openvpn to authenticate against ldap server - Containers need to listen to network starting and stopping events- Make systemd unit files less specific- Fix zarafa labeling - Allow guest_t to fix labeling - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean - add lxc_contexts - Allow accountsd to read /proc - Allow restorecond to getattr on all file sytems - tmpwatch now calls getpw - Allow apache daemon to transition to pwauth domain - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t - The obex socket seems to be a stream socket - dd label for /var/run/nologin- Allow jetty running as httpd_t to read hugetlbfs files - Allow sys_nice and setsched for rhsmcertd - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports - Allow setfiles to append to xdm_tmp_t - Add labeling for /export as a usr_t directory - Add labels for .grl files created by gstreamer- Add labeling for /usr/share/jetty/bin/jetty.sh - Add jetty policy which contains file type definitios - Allow jockey to use its own fifo_file and make this the default for all domains - Allow mozilla_plugins to use spice (vnc_port/couchdb) - asterisk wants to read the network state - Blueman now uses /var/lib/blueman- Add label for nodejs_debug - Allow mozilla_plugin_t to create ~/.pki directory and content- Add clamscan_can_scan_system boolean - Allow mysqld to read kernel network state - Allow sshd to read/write condor lib files - Allow sshd to read/write condor-startd tcp socket - Fix description on httpd_graceful_shutdown - Allow glance_registry to communicate with mysql - dbus_system_domain is using systemd to lauch applications - add interfaces to allow domains to send kill signals to user mail agents - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t - Lots of new access required for secure containers - Corosync needs sys_admin capability - ALlow colord to create shm - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific - Add boolean to control whether or not mozilla plugins can create random content in the users homedir - Add new interface to allow domains to list msyql_db directories, needed for libra - shutdown has to be allowed to delete etc_runtime_t - Fail2ban needs to read /etc/passwd - Allow ldconfig to create /var/cache/ldconfig - Allow tgtd to read hardware state information - Allow collectd to create packet socket - Allow chronyd to send signal to itself - Allow collectd to read /dev/random - Allow collectd to send signal to itself - firewalld needs to execute restorecon - Allow restorecon and other login domains to execute restorecon- Allow logrotate to getattr on systemd unit files - Add support for tor systemd unit file - Allow apmd to create /var/run/pm-utils with the correct label - Allow l2tpd to send sigkill to pppd - Allow pppd to stream connect to l2tpd - Add label for scripts in /etc/gdm/ - Allow systemd_logind_t to ignore mcs constraints on sigkill - Fix files_filetrans_system_conf_named_files() interface - Add labels for /usr/share/wordpress/wp-includes/*.php - Allow cobbler to get SELinux mode and booleans- Add unconfined_execmem_exec_t as an alias to bin_t - Allow fenced to read snmp var lib files, also allow it to read usr_t - ontaudit access checks on all executables from mozilla_plugin - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode - Allow systemd_tmpfiles_t to getattr all pipes and sockets - Allow glance-registry to send system log messages - semanage needs to manage mock lib files/dirs- Add policy for abrt-watch-log - Add definitions for jboss_messaging ports - Allow systemd_tmpfiles to manage printer devices - Allow oddjob to use nsswitch - Fix labeling of log files for postgresql - Allow mozilla_plugin_t to execmem and execstack by default - Allow firewalld to execute shell - Fix /etc/wicd content files to get created with the correct label - Allow mcelog to exec shell - Add ~/.orc as a gstreamer_home_t - /var/spool/postfix/lib64 should be labeled lib_t - mpreaper should be able to list all file system labeled directories - Add support for apache to use openstack - Add labeling for /etc/zipl.conf and zipl binary - Turn on allow_execstack and turn off telepathy transition for final release- More access required for virt_qmf_t - Additional assess required for systemd-logind to support multi-seat - Allow mozilla_plugin to setrlimit - Revert changes to fuse file system to stop deadlock- Allow condor domains to connect to ephemeral ports - More fixes for condor policy - Allow keystone to stream connect to mysqld - Allow mozilla_plugin_t to read generic USB device to support GPS devices - Allow thum to file name transition gstreamer home content - Allow thum to read all non security files - Allow glance_api_t to connect to ephemeral ports - Allow nagios plugins to read /dev/urandom - Allow syslogd to search postfix spool to support postfix chroot env - Fix labeling for /var/spool/postfix/dev - Allow wdmd chown - Label .esd_auth as pulseaudio_home_t - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now- Add support for clamd+systemd - Allow fresclam to execute systemctl to handle clamd - Change labeling for /usr/sbin/rpc.ypasswd.env - Allow yppaswd_t to execute yppaswd_exec_t - Allow yppaswd_t to read /etc/passwd - Gnomekeyring socket has been moved to /run/user/USER/ - Allow samba-net to connect to ldap port - Allow signal for vhostmd - allow mozilla_plugin_t to read user_home_t socket - New access required for secure Linux Containers - zfs now supports xattrs - Allow quantum to execute sudo and list sysfs - Allow init to dbus chat with the firewalld - Allow zebra to read /etc/passwd- Allow svirt_t to create content in the users homedir under ~/.libvirt - Fix label on /var/lib/heartbeat - Allow systemd_logind_t to send kill signals to all processes started by a user - Fuse now supports Xattr Support- upowered needs to setsched on the kernel - Allow mpd_t to manage log files - Allow xdm_t to create /var/run/systemd/multi-session-x - Add rules for missedfont.log to be used by thumb.fc - Additional access required for virt_qmf_t - Allow dhclient to dbus chat with the firewalld - Add label for lvmetad - Allow systemd_logind_t to remove userdomain sock_files - Allow cups to execute usr_t files - Fix labeling on nvidia shared libraries - wdmd_t needs access to sssd and /etc/passwd - Add boolean to allow ftp servers to run in passive mode - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with - Fix using httpd_use_fusefs - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox- Rename rdate port to time port, and allow gnomeclock to connect to it - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda - /etc/auto.* should be labeled bin_t - Add httpd_use_fusefs boolean - Add fixes for heartbeat - Allow sshd_t to signal processes that it transitions to - Add condor policy - Allow svirt to create monitors in ~/.libvirt - Allow dovecot to domtrans sendmail to handle sieve scripts - Lot of fixes for cfengine- /var/run/postmaster.* labeling is no longer needed - Alllow drbdadmin to read /dev/urandom - l2tpd_t seems to use ptmx - group+ and passwd+ should be labeled as /etc/passwd - Zarafa-indexer is a socket- Ensure lastlog is labeled correctly - Allow accountsd to read /proc data about gdm - Add fixes for tuned - Add bcfg2 fixes which were discovered during RHEL6 testing - More fixes for gnome-keyring socket being moved - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown - Fix description for files_dontaudit_read_security_files() interface- Add new policy and man page for bcfg2 - cgconfig needs to use getpw calls - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt - gnome-keyring wants to create a directory in cache_home_t - sanlock calls getpw- Add numad policy and numad man page - Add fixes for interface bugs discovered by SEWatch - Add /tmp support for squid - Add fix for #799102 * change default labeling for /var/run/slapd.* sockets - Make thumb_t as userdom_home_reader - label /var/lib/sss/mc same as pubconf, so getpw domains can read it - Allow smbspool running as cups_t to stream connect to nmbd - accounts needs to be able to execute passwd on behalf of users - Allow systemd_tmpfiles_t to delete boot flags - Allow dnssec_trigger to connect to apache ports - Allow gnome keyring to create sock_files in ~/.cache - google_authenticator is using .google_authenticator - sandbox running from within firefox is exposing more leaks - Dontaudit thumb to read/write /dev/card0 - Dontaudit getattr on init_exec_t for gnomeclock_t - Allow certmonger to do a transition to certmonger_unconfined_t - Allow dhcpc setsched which is caused by nmcli - Add rpm_exec_t for /usr/sbin/bcfg2 - system cronjobs are sending dbus messages to systemd_logind - Thumnailers read /dev/urand- Allow auditctl getcap - Allow vdagent to use libsystemd-login - Allow abrt-dump-oops to search /etc/abrt - Got these avc's while trying to print a boarding pass from firefox - Devicekit is now putting the media directory under /run/media - Allow thumbnailers to create content in ~/.thumbails directory - Add support for proL2TPd by Dominick Grift - Allow all domains to call getcap - wdmd seems to get a random chown capability check that it does not need - Allow vhostmd to read kernel sysctls- Allow chronyd to read unix - Allow hpfax to read /etc/passwd - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them - Allow rpcd to read quota_db_t - Update to man pages to match latest policy - Fix bug in jockey interface for sepolgen-ifgen - Add initial svirt_prot_exec_t policy- More fixes for systemd from Dan Walsh- Add a new type for /etc/firewalld and allow firewalld to write to this directory - Add definition for ~/Maildir, and allow mail deliver domains to write there - Allow polipo to run from a cron job - Allow rtkit to schedule wine processes - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label - Allow users domains to send signals to consolehelper domains- More fixes for boinc policy - Allow polipo domain to create its own cache dir and pid file - Add systemctl support to httpd domain - Add systemctl support to polipo, allow NetworkManager to manage the service - Add policy for jockey-backend - Add support for motion daemon which is now covered by zoneminder policy - Allow colord to read/write motion tmpfs - Allow vnstat to search through var_lib_t directories - Stop transitioning to quota_t, from init an sysadm_t- Add svirt_lxc_file_t as a customizable type- Add additional fixes for icmp nagios plugin - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin - Add certmonger_unconfined_exec_t - Make sure tap22 device is created with the correct label - Allow staff users to read systemd unit files - Merge in previously built policy - Arpwatch needs to be able to start netlink sockets in order to start - Allow cgred_t to sys_ptrace to look at other DAC Processes- Back port some of the access that was allowed in nsplugin_t - Add definitiona for couchdb ports - Allow nagios to use inherited users ttys - Add git support for mock - Allow inetd to use rdate port - Add own type for rdate port - Allow samba to act as a portmapper - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev - New fixes needed for samba4 - Allow apps that use lib_t to read lib_t symlinks- Add policy for nove-cert - Add labeling for nova-openstack systemd unit files - Add policy for keystoke- Fix man pages fro domains - Add man pages for SELinux users and roles - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon - Add policy for matahari-rpcd - nfsd executes mount command on restart - Matahari domains execute renice and setsched - Dontaudit leaked tty in mozilla_plugin_config - mailman is changing to a per instance naming - Add 7600 and 4447 as jboss_management ports - Add fixes for nagios event handlers - Label httpd.event as httpd_exec_t, it is an apache daemon- Add labeling for /var/spool/postfix/dev/log - NM reads sysctl.conf - Iscsi log file context specification fix - Allow mozilla plugins to send dbus messages to user domains that transition to it - Allow mysql to read the passwd file - Allow mozilla_plugin_t to create mozilla home dirs in user homedir - Allow deltacloud to read kernel sysctl - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself - Allow postgresql_t to connectto itself - Add login_userdomain attribute for users which can log in using terminal- Allow sysadm_u to reach system_r by default #784011 - Allow nagios plugins to use inherited user terminals - Razor labeling is not used no longer - Add systemd support for matahari - Add port_types to man page, move booleans to the top, fix some english - Add support for matahari-sysconfig-console - Clean up matahari.fc - Fix matahari_admin() interfac - Add labels for/etc/ssh/ssh_host_*.pub keys- Allow ksysguardproces to send system log msgs - Allow boinc setpgid and signull - Allow xdm_t to sys_ptrace to run pidof command - Allow smtpd_t to manage spool files/directories and symbolic links - Add labeling for jetty - Needed changes to get unbound/dnssec to work with openswan- Add user_fonts_t alias xfs_tmp_t - Since depmod now runs as insmod_t we need to write to kernel_object_t - Allow firewalld to dbus chat with networkmanager - Allow qpidd to connect to matahari ports - policykit needs to read /proc for uses not owned by it - Allow systemctl apps to connecto the init stream- Turn on deny_ptrace boolean- Remove pam_selinux.8 man page. There was a conflict.- Add proxy class and read access for gssd_proxy - Separate out the sharing public content booleans - Allow certmonger to execute a script and send signals to apache and dirsrv to reload the certificate - Add label transition for gstream-0.10 and 12 - Add booleans to allow rsync to share nfs and cifs file sytems - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it - Fix filename transitions for cups files - Allow denyhosts to read "unix" - Add file name transition for locale.conf.new - Allow boinc projects to gconf config files - sssd needs to be able to increase the socket limit under certain loads - sge_execd needs to read /etc/passwd - Allow denyhost to check network state - NetworkManager needs to read sessions data - Allow denyhost to check network state - Allow xen to search virt images directories - Add label for /dev/megaraid_sas_ioctl_node - Add autogenerated man pages- Allow boinc project to getattr on fs - Allow init to execute initrc_state_t - rhev-agent package was rename to ovirt-guest-agent - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly - sytemd writes content to /run/initramfs and executes it on shutdown - kdump_t needs to read /etc/mtab, should be back ported to F16 - udev needs to load kernel modules in early system boot- Need to add sys_ptrace back in since reading any content in /proc can cause these accesses - Add additional systemd interfaces which are needed fro *_admin interfaces - Fix bind_admin() interface- Allow firewalld to read urand - Alias java, execmem_mono to bin_t to allow third parties - Add label for kmod - /etc/redhat-lsb contains binaries - Add boolean to allow gitosis to send mail - Add filename transition also for "event20" - Allow systemd_tmpfiles_t to delete all file types - Allow collectd to ipc_lock- make consoletype_exec optional, so we can remove consoletype policy - remove unconfined_permisive.patch - Allow openvpn_t to inherit user home content and tmp content - Fix dnssec-trigger labeling - Turn on obex policy for staff_t - Pem files should not be secret - Add lots of rules to fix AVC's when playing with containers - Fix policy for dnssec - Label ask-passwd directories correctly for systemd- sshd fixes seem to be causing unconfined domains to dyntrans to themselves - fuse file system is now being mounted in /run/user - systemd_logind is sending signals to processes that are dbus messaging with it - Add support for winshadow port and allow iscsid to connect to this port - httpd should be allowed to bind to the http_port_t udp socket - zarafa_var_lib_t can be a lnk_file - A couple of new .xsession-errors files - Seems like user space and login programs need to read logind_sessions_files - Devicekit disk seems to be being launched by systemd - Cleanup handling of setfiles so most of rules in te file - Correct port number for dnssec - logcheck has the home dir set to its cache- Add policy for grindengine MPI jobs- Add new sysadm_secadm.pp module * contains secadm definition for sysadm_t - Move user_mail_domain access out of the interface into the te file - Allow httpd_t to create httpd_var_lib_t directories as well as files - Allow snmpd to connect to the ricci_modcluster stream - Allow firewalld to read /etc/passwd - Add auth_use_nsswitch for colord - Allow smartd to read network state - smartdnotify needs to read /etc/group- Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory - lxdm startup scripts should be labeled bin_t, so confined users will work - mcstransd now creates a pid, needs back port to F16 - qpidd should be allowed to connect to the amqp port - Label devices 010-029 as usb devices - ypserv packager says ypserv does not use tmp_t so removing selinux policy types - Remove all ptrace commands that I believe are caused by the kernel/ps avcs - Add initial Obex policy - Add logging_syslogd_use_tty boolean - Add polipo_connect_all_unreserved bolean - Allow zabbix to connect to ftp port - Allow systemd-logind to be able to switch VTs - Allow apache to communicate with memcached through a sock_file- Fix file_context.subs_dist for now to work with pre usrmove- More /usr move fixes- Add zabbix_can_network boolean - Add httpd_can_connect_zabbix boolean - Prepare file context labeling for usrmove functions - Allow system cronjobs to read kernel network state - Add support for selinux_avcstat munin plugin - Treat hearbeat with corosync policy - Allow corosync to read and write to qpidd shared mem - mozilla_plugin is trying to run pulseaudio - Fixes for new sshd patch for running priv sep domains as the users context - Turn off dontaudit rules when turning on allow_ypbind - udev now reads /etc/modules.d directory- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out - Cups exchanges dbus messages with init - udisk2 needs to send syslog messages - certwatch needs to read /etc/passwd- Add labeling for udisks2 - Allow fsadmin to communicate with the systemd process- Treat Bip with bitlbee policy * Bip is an IRC proxy - Add port definition for interwise port - Add support for ipa_memcached socket - systemd_jounald needs to getattr on all processes - mdadmin fixes * uses getpw - amavisd calls getpwnam() - denyhosts calls getpwall()- Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there - bluetooth says they do not use /tmp and want to remove the type - Allow init to transition to colord - Mongod needs to read /proc/sys/vm/zone_reclaim_mode - Allow postfix_smtpd_t to connect to spamd - Add boolean to allow ftp to connect to all ports > 1023 - Allow sendmain to write to inherited dovecot tmp files - setroubleshoot needs to be able to execute rpm to see what version of packages- Merge systemd patch - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online - Allow deltacloudd dac_override, setuid, setgid caps - Allow aisexec to execute shell - Add use_nfs_home_dirs boolean for ssh-keygen- Fixes to make rawhide boot in enforcing mode with latest systemd changes- Add labeling for /var/run/systemd/journal/syslog - libvirt sends signals to ifconfig - Allow domains that read logind session files to list them- Fixed destined form libvirt-sandbox - Allow apps that list sysfs to also read sympolicy links in this filesystem - Add ubac_constrained rules for chrome_sandbox - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra - Allow postgresql to be executed by the caller - Standardize interfaces of daemons - Add new labeling for mm-handler - Allow all matahari domains to read network state and etc_runtime_t files- New fix for seunshare, requires seunshare_domains to be able to mounton / - Allow systemctl running as logrotate_t to connect to private systemd socket - Allow tmpwatch to read meminfo - Allow rpc.svcgssd to read supported_krb5_enctype - Allow zarafa domains to read /dev/random and /dev/urandom - Allow snmpd to read dev_snmp6 - Allow procmail to talk with cyrus - Add fixes for check_disk and check_nagios plugins- default trans rules for Rawhide policy - Make sure sound_devices controlC* are labeled correctly on creation - sssd now needs sys_admin - Allow snmp to read all proc_type - Allow to setup users homedir with quota.group- Add httpd_can_connect_ldap() interface - apcupsd_t needs to use seriel ports connected to usb devices - Kde puts procmail mail directory under ~/.local/share - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now - Add labeling for /sbin/iscsiuio- Add label for /var/lib/iscan/interpreter - Dont audit writes to leaked file descriptors or redirected output for nacl - NetworkManager needs to write to /sys/class/net/ib*/mode- Allow abrt to request the kernel to load a module - Make sure mozilla content is labeled correctly - Allow tgtd to read system state - More fixes for boinc * allow to resolve dns name * re-write boinc policy to use boinc_domain attribute - Allow munin services plugins to use NSCD services- Allow mozilla_plugin_t to manage mozilla_home_t - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain - Add label for tumblerd- Fixes for xguest package- Fixes related to /bin, /sbin - Allow abrt to getattr on blk files - Add type for rhev-agent log file - Fix labeling for /dev/dmfm - Dontaudit wicd leaking - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it - Label /etc/locale.conf correctly - Allow user_mail_t to read /dev/random - Allow postfix-smtpd to read MIMEDefang - Add label for /var/log/suphp.log - Allow swat_t to connect and read/write nmbd_t sock_file - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf - Allow systemd-tmpfiles to change user identity in object contexts - More fixes for rhev_agentd_t consolehelper policy- Use fs_use_xattr for squashf - Fix procs_type interface - Dovecot has a new fifo_file /var/run/dovecot/stats-mail - Dovecot has a new fifo_file /var/run/stats-mail - Colord does not need to connect to network - Allow system_cronjob to dbus chat with NetworkManager - Puppet manages content, want to make sure it labels everything correctly- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it - Allow all postfix domains to use the fifo_file - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t - Allow apmd_t to read grub.cfg - Let firewallgui read the selinux config - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp - Fix devicekit_manage_pid_files() interface - Allow squid to check the network state - Dontaudit colord getattr on file systems - Allow ping domains to read zabbix_tmp_t files- Allow mcelog_t to create dir and file in /var/run and label it correctly - Allow dbus to manage fusefs - Mount needs to read process state when mounting gluster file systems - Allow collectd-web to read collectd lib files - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr - Allow colord to get the attributes of tmpfs filesystem - Add sanlock_use_nfs and sanlock_use_samba booleans - Add bin_t label for /usr/lib/virtualbox/VBoxManage- Add ssh_dontaudit_search_home_dir - Changes to allow namespace_init_t to work - Add interface to allow exec of mongod, add port definition for mongod port, 27017 - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t - Allow spamd and clamd to steam connect to each other - Add policy label for passwd.OLD - More fixes for postfix and postfix maildro - Add ftp support for mozilla plugins - Useradd now needs to manage policy since it calls libsemanage - Fix devicekit_manage_log_files() interface - Allow colord to execute ifconfig - Allow accountsd to read /sys - Allow mysqld-safe to execute shell - Allow openct to stream connect to pcscd - Add label for /var/run/nm-dns-dnsmasq\.conf - Allow networkmanager to chat with virtd_t- Pulseaudio changes - Merge patches- Merge patches back into git repository.- Remove allow_execmem boolean and replace with deny_execmem boolean- Turn back on allow_execmem boolean- Add more MCS fixes to make sandbox working - Make faillog MLS trusted to make sudo_$1_t working - Allow sandbox_web_client_t to read passwd_file_t - Add .mailrc file context - Remove execheap from openoffice domain - Allow chrome_sandbox_nacl_t to read cpu_info - Allow virtd to relabel generic usb which is need if USB device - Fixes for virt.if interfaces to consider chr_file as image file type- Remove Open Office policy - Remove execmem policy- MCS fixes - quota fixes- Remove transitions to consoletype- Make nvidia* to be labeled correctly - Fix abrt_manage_cache() interface - Make filetrans rules optional so base policy will build - Dontaudit chkpwd_t access to inherited TTYS - Make sure postfix content gets created with the correct label - Allow gnomeclock to read cgroup - Fixes for cloudform policy- Check in fixed for Chrome nacl support- Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_overide to communicate with users TTY's - Allow svirt_lxc domains to send kill signals within their container- Remove qemu.pp again without causing a crash- Remove qemu.pp, everything should use svirt_t or stay in its current domain- Allow policykit to talk to the systemd via dbus - Move chrome_sandbox_nacl_t to permissive domains - Additional rules for chrome_sandbox_nacl- Change bootstrap name to nacl - Chrome still needs execmem - Missing role for chrome_sandbox_bootstrap - Add boolean to remove execmem and execstack from virtual machines - Dontaudit xdm_t doing an access_check on etc_t directories- Allow named to connect to dirsrv by default - add ldapmap1_0 as a krb5_host_rcache_t file - Google chrome developers asked me to add bootstrap policy for nacl stuff - Allow rhev_agentd_t to getattr on mountpoints - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets- Fixes for cloudform policies which need to connect to random ports - Make sure if an admin creates modules content it creates them with the correct label - Add port 8953 as a dns port used by unbound - Fix file name transition for alsa and confined users- Turn on mock_t and thumb_t for unconfined domains- Policy update should not modify local contexts- Remove ada policy- Remove tzdata policy - Add labeling for udev - Add cloudform policy - Fixes for bootloader policy- Add policies for nova openstack- Add fixes for nova-stack policy- Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain - Allow init process to setrlimit on itself - Take away transition rules for users executing ssh-keygen - Allow setroubleshoot_fixit_t to read /dev/urand - Allow sshd to relbale tunnel sockets - Allow fail2ban domtrans to shorewall in the same way as with iptables - Add support for lnk files in the /var/lib/sssd directory - Allow system mail to connect to courier-authdaemon over an unix stream socket- Add passwd_file_t for /etc/ptmptmp- Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK) - Make corosync to be able to relabelto cluster lib fies - Allow samba domains to search /var/run/nmbd - Allow dirsrv to use pam - Allow thumb to call getuid - chrome less likely to get mmap_zero bug so removing dontaudit - gimp help-browser has built in javascript - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t - Re-write glance policy- Move dontaudit sys_ptrace line from permissive.te to domain.te - Remove policy for hal, it no longer exists- Don't check md5 size or mtime on certain config files- Remove allow_ptrace and replace it with deny_ptrace, which will remove all ptrace from the system - Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;- Fixes for bootloader policy - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore - Allow nsplugin to read /usr/share/config - Allow sa-update to update rules - Add use_fusefs_home_dirs for chroot ssh option - Fixes for grub2 - Update systemd_exec_systemctl() interface - Allow gpg to read the mail spool - More fixes for sa-update running out of cron job - Allow ipsec_mgmt_t to read hardware state information - Allow pptp_t to connect to unreserved_port_t - Dontaudit getattr on initctl in /dev from chfn - Dontaudit getattr on kernel_core from chfn - Add systemd_list_unit_dirs to systemd_exec_systemctl call - Fixes for collectd policy - CHange sysadm_t to create content as user_tmp_t under /tmp- Shrink size of policy through use of attributes for userdomain and apache- Allow virsh to read xenstored pid file - Backport corenetwork fixes from upstream - Do not audit attempts by thumb to search config_home_t dirs (~/.config) - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t - allow thumb to read generic data home files (mime.type)- Allow nmbd to manage sock file in /var/run/nmbd - ricci_modservice send syslog msgs - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly - Allow systemd_logind_t to manage /run/USER/dconf/user- Fix missing patch from F16- Allow logrotate setuid and setgid since logrotate is supposed to do it - Fixes for thumb policy by grift - Add new nfsd ports - Added fix to allow confined apps to execmod on chrome - Add labeling for additional vdsm directories - Allow Exim and Dovecot SASL - Add label for /var/run/nmbd - Add fixes to make virsh and xen working together - Colord executes ls - /var/spool/cron is now labeled as user_cron_spool_t- Stop complaining about leaked file descriptors during install- Remove java and mono module and merge into execmem- Fixes for thumb policy and passwd_file_t- Fixes caused by the labeling of /etc/passwd - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide- Add support for Clustered Samba commands - Allow ricci_modrpm_t to send log msgs - move permissive virt_qmf_t from virt.te to permissivedomains.te - Allow ssh_t to use kernel keyrings - Add policy for libvirt-qmf and more fixes for linux containers - Initial Polipo - Sanlock needs to run ranged in order to kill svirt processes - Allow smbcontrol to stream connect to ctdbd- Add label for /etc/passwd- Change unconfined_domains to permissive for Rawhide - Add definition for the ephemeral_ports- Make mta_role() active - Allow asterisk to connect to jabber client port - Allow procmail to read utmp - Add NIS support for systemd_logind_t - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t - Fix systemd_manage_unit_dirs() interface - Allow ssh_t to manage directories passed into it - init needs to be able to create and delete unit file directories - Fix typo in apache_exec_sys_script - Add ability for logrotate to transition to awstat domain- Change screen to use screen_domain attribute and allow screen_domains to read all process domain state - Add SELinux support for ssh pre-auth net process in F17 - Add logging_syslogd_can_sendmail boolean- Add definition for ephemeral ports - Define user_tty_device_t as a customizable_type- Needs to require a new version of checkpolicy - Interface fixes- Allow sanlock to manage virt lib files - Add virt_use_sanlock booelan - ksmtuned is trying to resolve uids - Make sure .gvfs is labeled user_home_t in the users home directory - Sanlock sends kill signals and needs the kill capability - Allow mockbuild to work on nfs homedirs - Fix kerberos_manage_host_rcache() interface - Allow exim to read system state- Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t- Allow collectd to read hardware state information - Add loop_control_device_t - Allow mdadm to request kernel to load module - Allow domains that start other domains via systemctl to search unit dir - systemd_tmpfilses, needs to list any file systems mounted on /tmp - No one can explain why radius is listing the contents of /tmp, so we will dontaudit - If I can manage etc_runtime files, I should be able to read the links - Dontaudit hostname writing to mock library chr_files - Have gdm_t setup labeling correctly in users home dir - Label content unde /var/run/user/NAME/dconf as config_home_t - Allow sa-update to execute shell - Make ssh-keygen working with fips_enabled - Make mock work for staff_t user - Tighten security on mock_t- removing unconfined_notrans_t no longer necessary - Clean up handling of secure_mode_insmod and secure_mode_policyload - Remove unconfined_mount_t- Add exim_exec_t label for /usr/sbin/exim_tidydb - Call init_dontaudit_rw_stream_socket() interface in mta policy - sssd need to search /var/cache/krb5rcache directory - Allow corosync to relabel own tmp files - Allow zarafa domains to send system log messages - Allow ssh to do tunneling - Allow initrc scripts to sendto init_t unix_stream_socket - Changes to make sure dmsmasq and virt directories are labeled correctly - Changes needed to allow sysadm_t to manage systemd unit files - init is passing file descriptors to dbus and on to system daemons - Allow sulogin additional access Reported by dgrift and Jeremy Miller - Steve Grubb believes that wireshark does not need this access - Fix /var/run/initramfs to stop restorecon from looking at - pki needs another port - Add more labels for cluster scripts - Allow apps that manage cgroup_files to manage cgroup link files - Fix label on nfs-utils scripts directories - Allow gatherd to read /dev/rand and /dev/urand- pki needs another port - Add more labels for cluster scripts - Fix label on nfs-utils scripts directories - Fixes for cluster - Allow gatherd to read /dev/rand and /dev/urand - abrt leaks fifo files- Add glance policy - Allow mdadm setsched - /var/run/initramfs should not be relabeled with a restorecon run - memcache can be setup to override sys_resource - Allow httpd_t to read tetex data - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.- Allow Postfix to deliver to Dovecot LMTP socket - Ignore bogus sys_module for lldpad - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock - systemd_logind_t sets the attributes on usb devices - Allow hddtemp_t to read etc_t files - Add permissivedomains module - Move all permissive domains calls to permissivedomain.te - Allow pegasis to send kill signals to other UIDs- Allow insmod_t to use fds leaked from devicekit - dontaudit getattr between insmod_t and init_t unix_stream_sockets - Change sysctl unit file interfaces to use systemctl - Add support for chronyd unit file - Allow mozilla_plugin to read gnome_usr_config - Add policy for new gpsd - Allow cups to create kerberos rhost cache files - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly- Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten- Add policy for sa-update being run out of cron jobs - Add create perms to postgresql_manage_db - ntpd using a gps has to be able to read/write generic tty_device_t - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev - fix spec file - Remove qemu_domtrans_unconfined() interface - Make passenger working together with puppet - Add init_dontaudit_rw_stream_socket interface - Fixes for wordpress- Turn on allow_domain_fd_use boolean on F16 - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Add abrt_handle_event_t domain for ABRT event scripts - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change - Allow httpd_git_script_t to read passwd data - Allow openvpn to set its process priority when the nice parameter is used- livecd fixes - spec file fixes- fetchmail can use kerberos - ksmtuned reads in shell programs - gnome_systemctl_t reads the process state of ntp - dnsmasq_t asks the kernel to load multiple kernel modules - Add rules for domains executing systemctl - Bogus text within fc file- Add cfengine policy- Add abrt_domain attribute - Allow corosync to manage cluster lib files - Allow corosync to connect to the system DBUS- Add sblim, uuidd policies - Allow kernel_t dyntrasition to init_t- init_t need setexec - More fixes of rules which cause an explosion in rules by Dan Walsh- Allow rcsmcertd to perform DNS name resolution - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts - Allow tmux to run as screen - New policy for collectd - Allow gkeyring_t to interact with all user apps - Add rules to allow firstboot to run on machines with the unconfined.pp module removed- Allow systemd_logind to send dbus messages with users - allow accountsd to read wtmp file - Allow dhcpd to get and set capabilities- Fix oracledb_port definition - Allow mount to mounton the selinux file system - Allow users to list /var directories- systemd fixes- Add initial policy for abrt_dump_oops_t - xtables-multi wants to getattr of the proc fs - Smoltclient is connecting to abrt - Dontaudit leaked file descriptors to postdrop - Allow abrt_dump_oops to look at kernel sysctls - Abrt_dump_oops_t reads kernel ring buffer - Allow mysqld to request the kernel to load modules - systemd-login needs fowner - Allow postfix_cleanup_t to searh maildrop- Initial systemd_logind policy - Add policy for systemd_logger and additional proivs for systemd_logind - More fixes for systemd policies- Allow setsched for virsh - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories - iptables: the various /sbin/ip6?tables.* are now symlinks for /sbin/xtables-multi- A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit - Allow colord to interact with the users through the tmpfs file system - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files - Add label for /var/log/mcelog - Allow asterisk to read /dev/random if it uses TLS - Allow colord to read ini files which are labeled as bin_t - Allow dirsrvadmin sys_resource and setrlimit to use ulimit - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first. - Also lists /var and /var/spool directories - Add openl2tpd to l2tpd policy - qpidd is reading the sysfs file- Change usbmuxd_t to dontaudit attempts to read chr_file - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains - Allow pppd to search /var/lock dir - Add rhsmcertd policy- Update to upstream- More fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git- Fix spec file to not report Verify errors- Add dspam policy - Add lldpad policy - dovecot auth wants to search statfs #713555 - Allow systemd passwd apps to read init fifo_file - Allow prelink to use inherited terminals - Run cherokee in the httpd_t domain - Allow mcs constraints on node connections - Implement pyicqt policy - Fixes for zarafa policy - Allow cobblerd to send syslog messages- Add policy.26 to the payload - Remove olpc stuff - Remove policygentool- Fixes for zabbix - init script needs to be able to manage sanlock_var_run_... - Allow sandlock and wdmd to create /var/run directories... - mixclip.so has been compiled correctly - Fix passenger policy module name- Add mailscanner policy from dgrift - Allow chrome to optionally be transitioned to - Zabbix needs these rules when starting the zabbix_server_mysql - Implement a type for freedesktop openicc standard (~/.local/share/icc) - Allow system_dbusd_t to read inherited icc_data_home_t files. - Allow colord_t to read icc_data_home_t content. #706975 - Label stuff under /usr/lib/debug as if it was labeled under /- Fixes for sanlock policy - Fixes for colord policy - Other fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Add rhev policy module to modules-targeted.conf- Lot of fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Allow logrotate to execute systemctl - Allow nsplugin_t to getattr on gpmctl - Fix dev_getattr_all_chr_files() interface - Allow shorewall to use inherited terms - Allow userhelper to getattr all chr_file devices - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t - Fix labeling for ABRT Retrace Server- Dontaudit sys_module for ifconfig - Make telepathy and gkeyringd daemon working with confined users - colord wants to read files in users homedir - Remote login should be creating user_tmp_t not its own tmp files- Fix label for /usr/share/munin/plugins/munin_* plugins - Add support for zarafa-indexer - Fix boolean description - Allow colord to getattr on /proc/scsi/scsi - Add label for /lib/upstart/init - Colord needs to list /mnt- Forard port changes from F15 for telepathy - NetworkManager should be allowed to use /dev/rfkill - Fix dontaudit messages to say Domain to not audit - Allow telepathy domains to read/write gnome_cache files - Allow telepathy domains to call getpw - Fixes for colord and vnstatd policy- Allow init_t getcap and setcap - Allow namespace_init_t to use nsswitch - aisexec will execute corosync - colord tries to read files off noxattr file systems - Allow init_t getcap and setcap- Add support for ABRT retrace server - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners - Allow telepath_msn_t to read /proc/PARENT/cmdline - ftpd needs kill capability - Allow telepath_msn_t to connect to sip port - keyring daemon does not work on nfs homedirs - Allow $1_sudo_t to read default SELinux context - Add label for tgtd sock file in /var/run/ - Add apache_exec_rotatelogs interface - allow all zaraha domains to signal themselves, server writes to /tmp - Allow syslog to read the process state - Add label for /usr/lib/chromium-browser/chrome - Remove the telepathy transition from unconfined_t - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts - Allow initrc_t domain to manage abrt pid files - Add support for AEOLUS project - Virt_admin should be allowed to manage images and processes - Allow plymountd to send signals to init - Change labeling of fping6- Add filename transitions- Fixes for zarafa policy - Add support for AEOLUS project - Change labeling of fping6 - Allow plymountd to send signals to init - Allow initrc_t domain to manage abrt pid files - Virt_admin should be allowed to manage images and processes- xdm_t needs getsession for switch user - Every app that used to exec init is now execing systemdctl - Allow squid to manage krb5_host_rcache_t files - Allow foghorn to connect to agentx port - Fixes for colord policy- Add Dan's patch to remove 64 bit variants - Allow colord to use unix_dgram_socket - Allow apps that search pids to read /var/run if it is a lnk_file - iscsid_t creates its own directory - Allow init to list var_lock_t dir - apm needs to verify user accounts auth_use_nsswitch - Add labeling for systemd unit files - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added - Add label for matahari-broker.pid file - We want to remove untrustedmcsprocess from ability to read /proc/pid - Fixes for matahari policy - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on- Fix typo- Add /var/run/lock /var/lock definition to file_contexts.subs - nslcd_t is looking for kerberos cc files - SSH_USE_STRONG_RNG is 1 which requires /dev/random - Fix auth_rw_faillog definition - Allow sysadm_t to set attributes on fixed disks - allow user domains to execute lsof and look at application sockets - prelink_cron job calls telinit -u if init is rewritten - Fixes to run qemu_t from staff_t- Fix label for /var/run/udev to udev_var_run_t - Mock needs to be able to read network state- Add file_contexts.subs to handle /run and /run/lock - Add other fixes relating to /run changes from F15 policy- Allow $1_sudo_t and $1_su_t open access to user terminals - Allow initrc_t to use generic terminals - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs -systemd is going to be useing /run and /run/lock for early bootup files. - Fix some comments in rlogin.if - Add policy for KDE backlighthelper - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems - sssd wants to read .k5login file in users homedir - setroubleshoot reads executables to see if they have TEXTREL - Add /var/spool/audit support for new version of audit - Remove kerberos_connect_524() interface calling - Combine kerberos_master_port_t and kerberos_port_t - systemd has setup /dev/kmsg as stderr for apps it executes - Need these access so that init can impersonate sockets on unix_dgram_socket- Remove some unconfined domains - Remove permissive domains - Add policy-term.patch from Dan- Fix multiple specification for boot.log - devicekit leaks file descriptors to setfiles_t - Change all all_nodes to generic_node and all_if to generic_if - Should not use deprecated interface - Switch from using all_nodes to generic_node and from all_if to generic_if - Add support for xfce4-notifyd - Fix file context to show several labels as SystemHigh - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs - Add etc_runtime_t label for /etc/securetty - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly - login.krb needs to be able to write user_tmp_t - dirsrv needs to bind to port 7390 for dogtag - Fix a bug in gpg policy - gpg sends audit messages - Allow qpid to manage matahari files- Initial policy for matahari - Add dev_read_watchdog - Allow clamd to connect clamd port - Add support for kcmdatetimehelper - Allow shutdown to setrlimit and sys_nice - Allow systemd_passwd to talk to /dev/log before udev or syslog is running - Purge chr_file and blk files on /tmp - Fixes for pads - Fixes for piranha-pulse - gpg_t needs to be able to encyprt anything owned by the user- mozilla_plugin_tmp_t needs to be treated as user tmp files - More dontaudits of writes from readahead - Dontaudit readahead_t file_type:dir write, to cover up kernel bug - systemd_tmpfiles needs to relabel faillog directory as well as the file - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost- Add policykit fixes from Tim Waugh - dontaudit sandbox domains sandbox_file_t:dir mounton - Add new dontaudit rules for sysadm_dbusd_t - Change label for /var/run/faillock * other fixes which relate with this change- Update to upstream - Fixes for telepathy - Add port defition for ssdp port - add policy for /bin/systemd-notify from Dan - Mount command requires users read mount_var_run_t - colord needs to read konject_uevent_socket - User domains connect to the gkeyring socket - Add colord policy and allow user_t and staff_t to dbus chat with it - Add lvm_exec_t label for kpartx - Dontaudit reading the mail_spool_t link from sandbox -X - systemd is creating sockets in avahi_var_run and system_dbusd_var_run- gpg_t needs to talk to gnome-keyring - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd - enforce MCS labeling on nodes - Allow arpwatch to read meminfo - Allow gnomeclock to send itself signals - init relabels /dev/.udev files on boot - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t - dnsmasq can run as a dbus service, needs acquire service - mysql_admin should be allowed to connect to mysql service - virt creates monitor sockets in the users home dir- Allow usbhid-ups to read hardware state information - systemd-tmpfiles has moved - Allo cgroup to sys_tty_config - For some reason prelink is attempting to read gconf settings - Add allow_daemons_use_tcp_wrapper boolean - Add label for ~/.cache/wocky to make telepathy work in enforcing mode - Add label for char devices /dev/dasd* - Fix for apache_role - Allow amavis to talk to nslcd - allow all sandbox to read selinux poilcy config files - Allow cluster domains to use the system bus and send each other dbus messages- Update to upstream- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild- Update to ref policy - cgred needs chown capability - Add /dev/crash crash_dev_t - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability- New labeling for postfmulti #675654 - dontaudit xdm_t listing noxattr file systems - dovecot-auth needs to be able to connect to mysqld via the network as well as locally - shutdown is passed stdout to a xdm_log_t file - smartd creates a fixed disk device - dovecot_etc_t contains a lnk_file that domains need to read - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot- syslog_t needs syslog capability - dirsrv needs to be able to create /var/lib/snmp - Fix labeling for dirsrv - Fix for dirsrv policy missing manage_dirs_pattern - corosync needs to delete clvm_tmpfs_t files - qdiskd needs to list hugetlbfs - Move setsched to sandbox_x_domain, so firefox can run without network access - Allow hddtemp to read removable devices - Adding syslog and read_policy permissions to policy * syslog Allow unconfined, sysadm_t, secadm_t, logadm_t * read_policy allow unconfined, sysadm_t, secadm_t, staff_t on Targeted allow sysadm_t (optionally), secadm_t on MLS - mdadm application will write into /sys/.../uevent whenever arrays are assembled or disassembled.- Add tcsd policy- ricci_modclusterd_t needs to bind to rpc ports 500-1023 - Allow dbus to use setrlimit to increase resoueces - Mozilla_plugin is leaking to sandbox - Allow confined users to connect to lircd over unix domain stream socket which allow to use remote control - Allow awstats to read squid logs - seunshare needs to manage tmp_t - apcupsd cgi scripts have a new directory- Fix xserver_dontaudit_read_xdm_pid - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. * These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t - Allow readahead to manage readahead pid dirs - Allow readahead to read all mcs levels - Allow mozilla_plugin_t to use nfs or samba homedirs- Allow nagios plugin to read /proc/meminfo - Fix for mozilla_plugin - Allow samba_net_t to create /etc/keytab - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t - nslcd can read user credentials - Allow nsplugin to delete mozilla_plugin_tmpfs_t - abrt tries to create dir in rpm_var_lib_t - virt relabels fifo_files - sshd needs to manage content in fusefs homedir - mock manages link files in cache dir- nslcd needs setsched and to read /usr/tmp - Invalid call in likewise policy ends up creating a bogus role - Cannon puts content into /var/lib/bjlib that cups needs to be able to write - Allow screen to create screen_home_t in /root - dirsrv sends syslog messages - pinentry reads stuff in .kde directory - Add labels for .kde directory in homedir - Treat irpinit, iprupdate, iprdump services with raid policy- NetworkManager wants to read consolekit_var_run_t - Allow readahead to create /dev/.systemd/readahead - Remove permissive domains - Allow newrole to run namespace_init- Add sepgsql_contexts file- Update to upstream- Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on - Add puppetmaster_use_db boolean - Fixes for zarafa policy - Fixes for gnomeclock poliy - Fix systemd-tmpfiles to use auth_use_nsswitch- gnomeclock executes a shell - Update for screen policy to handle pipe in homedir - Fixes for polyinstatiated homedir - Fixes for namespace policy and other fixes related to polyinstantiation - Add namespace policy - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts - Fixes for init, psad policy which relate with confined users - Do not audit bootloader attempts to read devicekit pid files - Allow nagios service plugins to read /proc- Add firewalld policy - Allow vmware_host to read samba config - Kernel wants to read /proc Fix duplicate grub def in cobbler - Chrony sends mail, executes shell, uses fifo_file and reads /proc - devicekitdisk getattr all file systems - sambd daemon writes wtmp file - libvirt transitions to dmidecode- Add initial policy for system-setup-keyboard which is now daemon - Label /var/lock/subsys/shorewall as shorewall_lock_t - Allow users to communicate with the gpg_agent_t - Dontaudit mozilla_plugin_t using the inherited terminal - Allow sambagui to read files in /usr - webalizer manages squid log files - Allow unconfined domains to bind ports to raw_ip_sockets - Allow abrt to manage rpm logs when running yum - Need labels for /var/run/bittlebee - Label .ssh under amanda - Remove unused genrequires for virt_domain_template - Allow virt_domain to use fd inherited from virtd_t - Allow iptables to read shorewall config- Gnome apps list config_home_t - mpd creates lnk files in homedir - apache leaks write to mail apps on tmp files - /var/stockmaniac/templates_cache contains log files - Abrt list the connects of mount_tmp_t dirs - passwd agent reads files under /dev and reads utmp file - squid apache script connects to the squid port - fix name of plymouth log file - teamviewer is a wine app - allow dmesg to read system state - Stop labeling files under /var/lib/mock so restorecon will not go into this - nsplugin needs to read network state for google talk- Allow xdm and syslog to use /var/log/boot.log - Allow users to communicate with mozilla_plugin and kill it - Add labeling for ipv6 and dhcp- New labels for ghc http content - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy- Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot- Update selinux policy to handle new /usr/share/sandbox/start script- Update to upstream - Fix version of policy in spec file- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs - remove per sandbox domains devpts types - Allow dkim-milter sending signal to itself- Allow domains that transition to ping or traceroute, kill them - Allow user_t to conditionally transition to ping_t and traceroute_t - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup- Turn on systemd policy - mozilla_plugin needs to read certs in the homedir. - Dontaudit leaked file descriptors from devicekit - Fix ircssi to use auth_use_nsswitch - Change to use interface without param in corenet to disable unlabelednet packets - Allow init to relabel sockets and fifo files in /dev - certmonger needs dac* capabilities to manage cert files not owned by root - dovecot needs fsetid to change group membership on mail - plymouthd removes /var/log/boot.log - systemd is creating symlinks in /dev - Change label on /etc/httpd/alias to be all cert_t- Fixes for clamscan and boinc policy - Add boinc_project_t setpgid - Allow alsa to create tmp files in /tmp- Push fixes to allow disabling of unlabeled_t packet access - Enable unlabelednet policy- Fixes for lvm to work with systemd- Fix the label for wicd log - plymouthd creates force-display-on-active-vt file - Allow avahi to request the kernel to load a module - Dontaudit hal leaks - Fix gnome_manage_data interface - Add new interface corenet_packet to define a type as being an packet_type. - Removed general access to packet_type from icecast and squid. - Allow mpd to read alsa config - Fix the label for wicd log - Add systemd policy- Fix gnome_manage_data interface - Dontaudit sys_ptrace capability for iscsid - Fixes for nagios plugin policy- Fix cron to run ranged when started by init - Fix devicekit to use log files - Dontaudit use of devicekit_var_run_t for fstools - Allow init to setattr on logfile directories - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t- Fix up handling of dnsmasq_t creating /var/run/libvirt/network - Turn on sshd_forward_ports boolean by default - Allow sysadmin to dbus chat with rpm - Add interface for rw_tpm_dev - Allow cron to execute bin - fsadm needs to write sysfs - Dontaudit consoletype reading /var/run/pm-utils - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin - certmonger needs to manage dirsrv data - /var/run/pm-utils should be labeled as devicekit_var_run_t- fixes to allow /var/run and /var/lock as tmpfs - Allow chrome sandbox to connect to web ports - Allow dovecot to listem on lmtp and sieve ports - Allov ddclient to search sysctl_net_t - Transition back to original domain if you execute the shell- Remove duplicate declaration- Update to upstream - Cleanup for sandbox - Add attribute to be able to select sandbox types- Allow ddclient to fix file mode bits of ddclient conf file - init leaks file descriptors to daemons - Add labels for /etc/lirc/ and - Allow amavis_t to exec shell - Add label for gssd_tmp_t for /var/tmp/nfs_0- Put back in lircd_etc_t so policy will install- Turn on allow_postfix_local_write_mail_spool - Allow initrc_t to transition to shutdown_t - Allow logwatch and cron to mls_read_to_clearance for MLS boxes - Allow wm to send signull to all applications and receive them from users - lircd patch from field - Login programs have to read /etc/samba - New programs under /lib/systemd - Abrt needs to read config files- Update to upstream - Dontaudit leaked sockets from userdomains to user domains - Fixes for mcelog to handle scripts - Apply patch from Ruben Kerkhof - Allow syslog to search spool dirs- Allow nagios plugins to read usr files - Allow mysqld-safe to send system log messages - Fixes fpr ddclient policy - Fix sasl_admin interface - Allow apache to search zarafa config - Allow munin plugins to search /var/lib directory - Allow gpsd to read sysfs_t - Fix labels on /etc/mcelog/triggers to bin_t- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp - Fix xserver interface - Fix definition of /var/run/lxdm- Turn on mediawiki policy - kdump leaks kdump_etc_t to ifconfig, add dontaudit - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap- Allow groupd transition to fenced domain when executes fence_node - Fixes for rchs policy - Allow mpd to be able to read samba/nfs files- Fix up corecommands.fc to match upstream - Make sure /lib/systemd/* is labeled init_exec_t - mount wants to setattr on all mountpoints - dovecot auth wants to read dovecot etc files - nscd daemon looks at the exe file of the comunicating daemon - openvpn wants to read utmp file - postfix apps now set sys_nice and lower limits - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly - Also resolves nsswitch - Fix labels on /etc/hosts.* - Cleanup to make upsteam patch work - allow abrt to read etc_runtime_t- Add conflicts for dirsrv package- Update to upstream - Add vlock policy- Fix sandbox to work on nfs homedirs - Allow cdrecord to setrlimit - Allow mozilla_plugin to read xauth - Change label on systemd-logger to syslogd_exec_t - Install dirsrv policy from dirsrv package- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it - Udev needs to stream connect to init and kernel - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory- Allow NetworkManager to read openvpn_etc_t - Dontaudit hplip to write of /usr dirs - Allow system_mail_t to create /root/dead.letter as mail_home_t - Add vdagent policy for spice agent daemon- Dontaudit sandbox sending sigkill to all user domains - Add policy for rssh_chroot_helper - Add missing flask definitions - Allow udev to relabelto removable_t - Fix label on /var/log/wicd.log - Transition to initrc_t from init when executing bin_t - Add audit_access permissions to file - Make removable_t a device_node - Fix label on /lib/systemd/*- Fixes for systemd to manage /var/run - Dontaudit leaks by firstboot- Allow chome to create netlink_route_socket - Add additional MATHLAB file context - Define nsplugin as an application_domain - Dontaudit sending signals from sandboxed domains to other domains - systemd requires init to build /tmp /var/auth and /var/lock dirs - mount wants to read devicekit_power /proc/ entries - mpd wants to connect to soundd port - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit - Treat lib_t and textrel_shlib_t directories the same - Allow mount read access on virtual images- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs. - Allow devicekit_power to domtrans to mount - Allow dhcp to bind to udp ports > 1024 to do named stuff - Allow ssh_t to exec ssh_exec_t - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used - Fix clamav_append_log() intefaces - Fix 'psad_rw_fifo_file' interface- Allow cobblerd to list cobler appache content- Fixup for the latest version of upowed - Dontaudit sandbox sending SIGNULL to desktop apps- Update to upstream-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access - dovecot-auth_t needs ipc_lock - gpm needs to use the user terminal - Allow system_mail_t to append ~/dead.letter - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf - Add pid file to vnstatd - Allow mount to communicate with gfs_controld - Dontaudit hal leaks in setfiles- Lots of fixes for systemd - systemd now executes readahead and tmpwatch type scripts - Needs to manage random seed- Allow smbd to use sys_admin - Remove duplicate file context for tcfmgr - Update to upstream- Fix fusefs handling - Do not allow sandbox to manage nsplugin_rw_t - Allow mozilla_plugin_t to connecto its parent - Allow init_t to connect to plymouthd running as kernel_t - Add mediawiki policy - dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. - Disable transition from dbus_session_domain to telepathy for F14 - Allow boinc_project to use shm - Allow certmonger to search through directories that contain certs - Allow fail2ban the DAC Override so it can read log files owned by non root users- Start adding support for use_fusefs_home_dirs - Add /var/lib/syslog directory file context - Add /etc/localtime as locale file context- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user - Turn off iptables from unconfined user - Allow sudo to send signals to any domains the user could have transitioned to. - Passwd in single user mode needs to talk to console_device_t - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio - locate tried to read a symbolic link, will dontaudit - New labels for telepathy-sunshine content in homedir - Google is storing other binaries under /opt/google/talkplugin - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15 - modemmanger and bluetooth send dbus messages to devicekit_power - Samba needs to getquota on filesystems labeld samba_share_t- Dontaudit attempts by xdm_t to write to bin_t for kdm - Allow initrc_t to manage system_conf_t- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets - Allow confined users to read xdm_etc_t files - Allow xdm_t to transition to xauth_t for lxdm program- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home - Allow clamd to send signals to itself - Allow mozilla_plugin_t to read user home content. And unlink pulseaudio shm. - Allow haze to connect to yahoo chat and messenger port tcp:5050. Bz #637339 - Allow guest to run ps command on its processes by allowing it to read /proc - Allow firewallgui to sys_rawio which seems to be required to setup masqerading - Allow all domains to search through default_t directories, in order to find differnet labels. For example people serring up /foo/bar to be share via samba. - Add label for /var/log/slim.log- Pull in cleanups from dgrift - Allow mozilla_plugin_t to execute mozilla_home_t - Allow rpc.quota to do quotamod- Cleanup policy via dgrift - Allow dovecot_deliver to append to inherited log files - Lots of fixes for consolehelper- Fix up Xguest policy- Add vnstat policy - allow libvirt to send audit messages - Allow chrome-sandbox to search nfs_t- Update to upstream- Add the ability to send audit messages to confined admin policies - Remove permissive domain from cmirrord and dontaudit sys_tty_config - Split out unconfined_domain() calls from other unconfined_ calls so we can d - virt needs to be able to read processes to clearance for MLS- Allow all domains that can use cgroups to search tmpfs_t directory - Allow init to send audit messages- Update to upstream- Allow mdadm_t to create files and sock files in /dev/md/- Add policy for ajaxterm- Handle /var/db/sudo - Allow pulseaudio to read alsa config - Allow init to send initrc_t dbus messagesAllow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr intd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port- Merge upstream fix of mmap_zero - Allow mount to write files in debugfs_t - Allow corosync to communicate with clvmd via tmpfs - Allow certmaster to read usr_t files - Allow dbus system services to search cgroup_t - Define rlogind_t as a login pgm- Allow mdadm_t to read/write hugetlbfs- Dominic Grift Cleanup - Miroslav Grepl policy for jabberd - Various fixes for mount/livecd and prelink- Merge with upstream- More access needed for devicekit - Add dbadm policy- Merge with upstream- Allow seunshare to fowner- Allow cron to look at user_cron_spool links - Lots of fixes for mozilla_plugin_t - Add sysv file system - Turn unconfined domains to permissive to find additional avcs- Update policy for mozilla_plugin_t- Allow clamscan to read proc_t - Allow mount_t to write to debufs_t dir - Dontaudit mount_t trying to write to security_t dir- Allow clamscan_t execmem if clamd_use_jit set - Add policy for firefox plugin-container- Fix /root/.forward definition- label dead.letter as mail_home_t- Allow login programs to search /cgroups- Fix cert handling- Fix devicekit_power bug - Allow policykit_auth_t more access.- Fix nis calls to allow bind to ports 512-1024 - Fix smartmon- Allow pcscd to read sysfs - systemd fixes - Fix wine_mmap_zero_ignore boolean- Apply Miroslav munin patch - Turn back on allow_execmem and allow_execmod booleans- Merge in fixes from dgrift repository- Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0- New paths for upstart- New permissions for syslog - New labels for /lib/upstart- Add mojomojo policy- Allow systemd to setsockcon on sockets to immitate other services- Remove debugfs label- Update to latest policy- Fix eclipse labeling from IBMSupportAssasstant packageing- Make boot with systemd in enforcing mode- Update to upstream- Add boolean to turn off port forwarding in sshd.- Add support for ebtables - Fixes for rhcs and corosync policy-Update to upstream-Update to upstream-Update to upstream- Add Zarafa policy- Cleanup of aiccu policy - initial mock policy- Lots of random fixes- Update to upstream- Update to upstream - Allow prelink script to signal itself - Cobbler fixes- Add xdm_var_run_t to xserver_stream_connect_xdm - Add cmorrord and mpd policy from Miroslav Grepl- Fix sshd creation of krb cc files for users to be user_tmp_t- Fixes for accountsdialog - Fixes for boinc- Fix label on /var/lib/dokwiki - Change permissive domains to enforcing - Fix libvirt policy to allow it to run on mls- Update to upstream- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t - Fix /var/run/abrtd.lock label- Allow login programs to read krb5_home_t Resolves: 594833 - Add obsoletes for cachefilesfd-selinux package Resolves: #575084- Allow mount to r/w abrt fifo file - Allow svirt_t to getattr on hugetlbfs - Allow abrt to create a directory under /var/spool- Add labels for /sys - Allow sshd to getattr on shutdown - Fixes for munin - Allow sssd to use the kernel key ring - Allow tor to send syslog messages - Allow iptabels to read usr files - allow policykit to read all domains state- Fix path for /var/spool/abrt - Allow nfs_t as an entrypoint for http_sys_script_t - Add policy for piranha - Lots of fixes for sosreport- Allow xm_t to read network state and get and set capabilities - Allow policykit to getattr all processes - Allow denyhosts to connect to tcp port 9911 - Allow pyranha to use raw ip sockets and ptrace itself - Allow unconfined_execmem_t and gconfsd mechanism to dbus - Allow staff to kill ping process - Add additional MLS rules- Allow gdm to edit ~/.gconf dir Resolves: #590677 - Allow dovecot to create directories in /var/lib/dovecot Partially resolves 590224 - Allow avahi to dbus chat with NetworkManager - Fix cobbler labels - Dontaudit iceauth_t leaks - fix /var/lib/lxdm file context - Allow aiccu to use tun tap devices - Dontaudit shutdown using xserver.log- Fixes for sandbox_x_net_t to match access for sandbox_web_t ++ - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory - Add dontaudit interface for bluetooth dbus - Add chronyd_read_keys, append_keys for initrc_t - Add log support for ksmtuned Resolves: #586663- Allow boinc to send mail- Allow initrc_t to remove dhcpc_state_t - Fix label on sa-update.cron - Allow dhcpc to restart chrony initrc - Don't allow sandbox to send signals to its parent processes - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t Resolves: #589136- Fix location of oddjob_mkhomedir Resolves: #587385 - fix labeling on /root/.shosts and ~/.shosts - Allow ipsec_mgmt_t to manage net_conf_t Resolves: #586760- Dontaudit sandbox trying to connect to netlink sockets Resolves: #587609 - Add policy for piranha- Fixups for xguest policy - Fixes for running sandbox firefox- Allow ksmtuned to use terminals Resolves: #586663 - Allow lircd to write to generic usb devices- Allow sandbox_xserver to connectto unconfined stream Resolves: #585171- Allow initrc_t to read slapd_db_t Resolves: #585476 - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf Resolves: #585963- Allow rlogind_t to search /root for .rhosts Resolves: #582760 - Fix path for cached_var_t - Fix prelink paths /var/lib/prelink - Allow confined users to direct_dri - Allow mls lvm/cryptosetup to work- Allow virtd_t to manage firewall/iptables config Resolves: #573585- Fix label on /root/.rhosts Resolves: #582760 - Add labels for Picasa - Allow openvpn to read home certs - Allow plymouthd_t to use tty_device_t - Run ncftool as iptables_t - Allow mount to unmount unlabeled_t - Dontaudit hal leaks- Allow livecd to transition to mount- Update to upstream - Allow abrt to delete sosreport Resolves: #579998 - Allow snmp to setuid and gid Resolves: #582155 - Allow smartd to use generic scsi devices Resolves: #582145- Allow ipsec_t to create /etc/resolv.conf with the correct label - Fix reserved port destination - Allow autofs to transition to showmount - Stop crashing tuned- Add telepathysofiasip policy- Update to upstream - Fix label for /opt/google/chrome/chrome-sandbox - Allow modemmanager to dbus with policykit- Fix allow_httpd_mod_auth_pam to use auth_use_pam(httpd_t) - Allow accountsd to read shadow file - Allow apache to send audit messages when using pam - Allow asterisk to bind and connect to sip tcp ports - Fixes for dovecot 2.0 - Allow initrc_t to setattr on milter directories - Add procmail_home_t for .procmailrc file- Fixes for labels during install from livecd- Fix /cgroup file context - Fix broken afs use of unlabled_t - Allow getty to use the console for s390- Fix cgroup handling adding policy for /cgroup - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set- Merge patches from dgrift- Update upstream - Allow abrt to write to the /proc under any process- Fix ~/.fontconfig label - Add /root/.cert label - Allow reading of the fixed_file_disk_t:lnk_file if you can read file - Allow qemu_exec_t as an entrypoint to svirt_t- Update to upstream - Allow tmpreaper to delete sandbox sock files - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems - Fixes for gitosis - No transition on livecd to passwd or chfn - Fixes for denyhosts- Add label for /var/lib/upower - Allow logrotate to run sssd - dontaudit readahead on tmpfs blk files - Allow tmpreaper to setattr on sandbox files - Allow confined users to execute dos files - Allow sysadm_t to kill processes running within its clearance - Add accountsd policy - Fixes for corosync policy - Fixes from crontab policy - Allow svirt to manage svirt_image_t chr files - Fixes for qdisk policy - Fixes for sssd policy - Fixes for newrole policy- make libvirt work on an MLS platform- Add qpidd policy- Update to upstream- Allow boinc to read kernel sysctl - Fix snmp port definitions - Allow apache to read anon_inodefs- Allow shutdown dac_override- Add device_t as a file system - Fix sysfs association- Dontaudit ipsec_mgmt sys_ptrace - Allow at to mail its spool files - Allow nsplugin to search in .pulse directory- Update to upstream- Allow users to dbus chat with xdm - Allow users to r/w wireless_device_t - Dontaudit reading of process states by ipsec_mgmt- Fix openoffice from unconfined_t- Add shutdown policy so consolekit can shutdown system- Update to upstream- Update to upstream- Update to upstream - These are merges of my patches - Remove 389 labeling conflicts - Add MLS fixes found in RHEL6 testing - Allow pulseaudio to run as a service - Add label for mssql and allow apache to connect to this database port if boolean set - Dontaudit searches of debugfs mount point - Allow policykit_auth to send signals to itself - Allow modcluster to call getpwnam - Allow swat to signal winbind - Allow usbmux to run as a system role - Allow svirt to create and use devpts- Add MLS fixes found in RHEL6 testing - Allow domains to append to rpm_tmp_t - Add cachefilesfd policy - Dontaudit leaks when transitioning- Change allow_execstack and allow_execmem booleans to on - dontaudit acct using console - Add label for fping - Allow tmpreaper to delete sandbox_file_t - Fix wine dontaudit mmap_zero - Allow abrt to read var_t symlinks- Additional policy for rgmanager- Allow sshd to setattr on pseudo terms- Update to upstream- Allow policykit to send itself signals- Fix duplicate cobbler definition- Fix file context of /var/lib/avahi-autoipd- Merge with upstream- Allow sandbox to work with MLS- Make Chrome work with staff user- Add icecast policy - Cleanup spec file- Add mcelog policy- Lots of fixes found in F12- Fix rpm_dontaudit_leaks- Add getsched to hald_t - Add file context for Fedora/Redhat Directory Server- Allow abrt_helper to getattr on all filesystems - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so- Add gstreamer_home_t for ~/.gstreamer- Update to upstream- Fix git- Turn on puppet policy - Update to dgrift git policy- Move users file to selection by spec file. - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t- Update to upstream- Remove most of the permissive domains from F12.- Add cobbler policy from dgrift- add usbmon device - Add allow rulse for devicekit_disk- Lots of fixes found in F12, fixes from Tom London- Cleanups from dgrift- Add back xserver_manage_home_fonts- Dontaudit sandbox trying to read nscd and sssd- Update to upstream- Rename udisks-daemon back to devicekit_disk_t policy- Fixes for abrt calls- Add tgtd policy- Update to upstream release- Add asterisk policy back in - Update to upstream release 2.20091117- Update to upstream release 2.20091117- Fixup nut policy- Update to upstream- Allow vpnc request the kernel to load modules- Fix minimum policy installs - Allow udev and rpcbind to request the kernel to load modules- Add plymouth policy - Allow local_login to sys_admin- Allow cupsd_config to read user tmp - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t- Update rhcs policy- Allow users to exec restorecond- Allow sendmail to request kernel modules load- Fix all kernel_request_load_module domains- Fix all kernel_request_load_module domains- Remove allow_exec* booleans for confined users. Only available for unconfined_t- More fixes for sandbox_web_t- Allow sshd to create .ssh directory and content- Fix request_module line to module_request- Fix sandbox policy to allow it to run under firefox. - Dont audit leaks.- Fixes for sandbox- Update to upstream - Dontaudit nsplugin search /root - Dontaudit nsplugin sys_nice- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service - Remove policycoreutils-python requirement except for minimum- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)- Add wordpress/wp-content/uploads label - Fixes for sandbox when run from staff_t- Update to upstream - Fixes for devicekit_disk- More fixes- Lots of fixes for initrc and other unconfined domains- Allow xserver to use netlink_kobject_uevent_socket- Fixes for sandbox- Dontaudit setroubleshootfix looking at /root directory- Update to upsteam- Allow gssd to send signals to users - Fix duplicate label for apache content- Update to upstream- Remove polkit_auth on upgrades- Add back in unconfined.pp and unconfineduser.pp - Add Sandbox unshare- Fixes for cdrecord, mdadm, and others- Add capability setting to dhcpc and gpm- Allow cronjobs to read exim_spool_t- Add ABRT policy- Fix system-config-services policy- Allow libvirt to change user componant of virt_domain- Allow cupsd_config_t to be started by dbus - Add smoltclient policy- Add policycoreutils-python to pre install- Make all unconfined_domains permissive so we can see what AVC's happen- Add pt_chown policy- Add kdump policy for Miroslav Grepl - Turn off execstack boolean- Turn on execstack on a temporary basis (#512845)- Allow nsplugin to connecto the session bus - Allow samba_net to write to coolkey data- Allow devicekit_disk to list inotify- Allow svirt images to create sock_file in svirt_var_run_t- Allow exim to getattr on mountpoints - Fixes for pulseaudio- Allow svirt_t to stream_connect to virtd_t- Allod hald_dccm_t to create sock_files in /tmp- More fixes from upstream- Fix polkit label - Remove hidebrokensymptoms for nss_ldap fix - Add modemmanager policy - Lots of merges from upstream - Begin removing textrel_shlib_t labels, from fixed libraries- Update to upstream- Allow certmaster to override dac permissions- Update to upstream- Fix context for VirtualBox- Update to upstream- Allow clamscan read amavis spool files- Fixes for xguest- fix multiple directory ownership of mandirs- Update to upstream- Add rules for rtkit-daemon- Update to upstream - Fix nlscd_stream_connect- Add rtkit policy- Allow rpcd_t to stream connect to rpcbind- Allow kpropd to create tmp files- Fix last duplicate /var/log/rpmpkgs- Update to upstream * add sssd- Update to upstream * cleanup- Update to upstream - Additional mail ports - Add virt_use_usb boolean for svirt- Fix mcs rules to include chr_file and blk_file- Add label for udev-acl- Additional rules for consolekit/udev, privoxy and various other fixes- New version for upstream- Allow NetworkManager to read inotifyfs- Allow setroubleshoot to run mlocate- Update to upstream- Add fish as a shell - Allow fprintd to list usbfs_t - Allow consolekit to search mountpoints - Add proper labeling for shorewall- New log file for vmware - Allow xdm to setattr on user_tmp_t- Upgrade to upstream- Allow fprintd to access sys_ptrace - Add sandbox policy- Add varnishd policy- Fixes for kpropd- Allow brctl to r/w tun_tap_device_t- Add /usr/share/selinux/packages- Allow rpcd_t to send signals to kernel threads- Fix upgrade for F10 to F11- Add policy for /var/lib/fprint-Remove duplicate line- Allow svirt to manage pci and other sysfs device data- Fix package selection handling- Fix /sbin/ip6tables-save context - Allod udev to transition to mount - Fix loading of mls policy file- Add shorewall policy- Additional rules for fprintd and sssd- Allow nsplugin to unix_read unix_write sem for unconfined_java- Fix uml files to be owned by users- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less- Allow confined users to manage virt_content_t, since this is home dir content - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection- Fix labeling on /var/lib/misc/prelink* - Allow xserver to rw_shm_perms with all x_clients - Allow prelink to execute files in the users home directory- Allow initrc_t to delete dev_null - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead- Update to latest milter code from Paul Howarth- Additional perms for readahead- Allow pulseaudio to acquire_svc on session bus - Fix readahead labeling- Allow sysadm_t to run rpm directly - libvirt needs fowner- Allow sshd to read var_lib symlinks for freenx- Allow nsplugin unix_read and write on users shm and sem - Allow sysadm_t to execute su- Dontaudit attempts to getattr user_tmpfs_t by lvm - Allow nfs to share removable media- Add ability to run postdrop from confined users- Fixes for podsleuth- Turn off nsplugin transition - Remove Konsole leaked file descriptors for release- Allow cupsd_t to create link files in print_spool_t - Fix iscsi_stream_connect typo - Fix labeling on /etc/acpi/actions - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed- Allow audioentroy to read etc files- Add fail2ban_var_lib_t - Fixes for devicekit_power_t- Separate out the ucnonfined user from the unconfined.pp package- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.- Upgrade to latest upstream - Allow devicekit_disk sys_rawio- Dontaudit binds to ports < 1024 for named - Upgrade to latest upstream- Allow podsleuth to use tmpfs files- Add customizable_types for svirt- Allow setroubelshoot exec* privs to prevent crash from bad libraries - add cpufreqselector- Dontaudit listing of /root directory for cron system jobs- Fix missing ld.so.cache label- Add label for ~/.forward and /root/.forward- Fixes for svirt- Fixes to allow svirt read iso files in homedir- Add xenner and wine fixes from mgrepl- Allow mdadm to read/write mls override- Change to svirt to only access svirt_image_t- Fix libvirt policy- Upgrade to latest upstream- Fixes for iscsid and sssd - More cleanups for upgrade from F10 to Rawhide.- Add pulseaudio, sssd policy - Allow networkmanager to exec udevadm- Add pulseaudio context- Upgrade to latest patches- Fixes for libvirt- Update to Latest upstream- Fix setrans.conf to show SystemLow for s0- Further confinement of qemu images via svirt- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild- Allow NetworkManager to manage /etc/NetworkManager/system-connections- add virtual_image_context and virtual_domain_context files- Allow rpcd_t to send signal to mount_t - Allow libvirtd to run ranged- Fix sysnet/net_conf_t- Fix squidGuard labeling- Re-add corenet_in_generic_if(unlabeled_t)* Tue Feb 10 2009 Dan Walsh 3.6.5-2 - Add git web policy- Add setrans contains from upstream- Do transitions outside of the booleans- Allow xdm to create user_tmp_t sockets for switch user to work- Fix staff_t domain- Grab remainder of network_peer_controls patch- More fixes for devicekit- Upgrade to latest upstream- Add boolean to disallow unconfined_t login- Add back transition from xguest to mozilla- Add virt_content_ro_t and labeling for isos directory- Fixes for wicd daemon- More mls/rpm fixes- Add policy to make dbus/nm-applet work- Remove polgen-ifgen from post and add trigger to policycoreutils-python- Add wm policy - Make mls work in graphics mode- Fixed for DeviceKit- Add devicekit policy- Update to upstream- Define openoffice as an x_domain- Fixes for reading xserver_tmp_t- Allow cups_pdf_t write to nfs_t- Remove audio_entropy policy- Update to upstream- Allow hal_acl_t to getattr/setattr fixed_disk- Change userdom_read_all_users_state to include reading symbolic links in /proc- Fix dbus reading /proc information- Add missing alias for home directory content- Fixes for IBM java location- Allow unconfined_r unconfined_java_t- Add cron_role back to user domains- Fix sudo setting of user keys- Allow iptables to talk to terminals - Fixes for policy kit - lots of fixes for booting.- Cleanup policy- Rebuild for Python 2.6- Fix labeling on /var/spool/rsyslog- Allow postgresl to bind to udp nodes- Allow lvm to dbus chat with hal - Allow rlogind to read nfs_t- Fix cyphesis file context- Allow hal/pm-utils to look at /var/run/video.rom - Add ulogd policy- Additional fixes for cyphesis - Fix certmaster file context - Add policy for system-config-samba - Allow hal to read /var/run/video.rom- Allow dhcpc to restart ypbind - Fixup labeling in /var/run- Add certmaster policy- Fix confined users - Allow xguest to read/write xguest_dbusd_t- Allow openoffice execstack/execmem privs- Allow mozilla to run with unconfined_execmem_t- Dontaudit domains trying to write to .xsession-errors- Allow nsplugin to look at autofs_t directory- Allow kerneloops to create tmp files- More alias for fastcgi- Remove mod_fcgid-selinux package- Fix dovecot access- Policy cleanup- Remove Multiple spec - Add include - Fix makefile to not call per_role_expansion- Fix labeling of libGL- Update to upstream- Update to upstream policy- Fixes for confined xwindows and xdm_t- Allow confined users and xdm to exec wm - Allow nsplugin to talk to fifo files on nfs- Allow NetworkManager to transition to avahi and iptables - Allow domains to search other domains keys, coverup kernel bug- Fix labeling for oracle- Allow nsplugin to comminicate with xdm_tmp_t sock_file- Change all user tmpfs_t files to be labeled user_tmpfs_t - Allow radiusd to create sock_files- Upgrade to upstream- Allow confined users to login with dbus- Fix transition to nsplugin- Add file context for /dev/mspblk.*- Fix transition to nsplugin '- Fix labeling on new pm*log - Allow ssh to bind to all nodes- Merge upstream changes - Add Xavier Toth patches- Add qemu_cache_t for /var/cache/libvirt- Remove gamin policy- Add tinyxs-max file system support- Update to upstream - New handling of init scripts- Allow pcsd to dbus - Add memcache policy- Allow audit dispatcher to kill his children- Update to upstream - Fix crontab use by unconfined user- Allow ifconfig_t to read dhcpc_state_t- Update to upstream- Update to upstream- Allow system-config-selinux to work with policykit- Fix novel labeling- Consolodate pyzor,spamassassin, razor into one security domain - Fix xdm requiring additional perms.- Fixes for logrotate, alsa- Eliminate vbetool duplicate entry- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t - Change dhclient to be able to red networkmanager_var_run- Update to latest refpolicy - Fix libsemanage initial install bug- Add inotify support to nscd- Allow unconfined_t to setfcap- Allow amanda to read tape - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi - Add support for netware file systems- Allow ypbind apps to net_bind_service- Allow all system domains and application domains to append to any log file- Allow gdm to read rpm database - Allow nsplugin to read mplayer config files- Allow vpnc to run ifconfig- Allow confined users to use postgres - Allow system_mail_t to exec other mail clients - Label mogrel_rails as an apache server- Apply unconfined_execmem_exec_t to haskell programs- Fix prelude file context- allow hplip to talk dbus - Fix context on ~/.local dir- Prevent applications from reading x_device- Add /var/lib/selinux context- Update to upstream- Add livecd policy- Dontaudit search of admin_home for init_system_domain - Rewrite of xace interfaces - Lots of new fs_list_inotify - Allow livecd to transition to setfiles_mac- Begin XAce integration- Merge Upstream- Allow amanada to create data files- Fix initial install, semanage setup- Allow system_r for httpd_unconfined_script_t- Remove dmesg boolean - Allow user domains to read/write game data- Change unconfined_t to transition to unconfined_mono_t when running mono - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work- Remove old booleans from targeted-booleans.conf file- Add boolean to mmap_zero - allow tor setgid - Allow gnomeclock to set clock- Don't run crontab from unconfined_t- Change etc files to config files to allow users to read them- Lots of fixes for confined domains on NFS_t homedir- dontaudit mrtg reading /proc - Allow iscsi to signal itself - Allow gnomeclock sys_ptrace- Allow dhcpd to read kernel network state- Label /var/run/gdm correctly - Fix unconfined_u user creation- Allow transition from initrc_t to getty_t- Allow passwd to communicate with user sockets to change gnome-keyring- Fix initial install- Allow radvd to use fifo_file - dontaudit setfiles reading links - allow semanage sys_resource - add allow_httpd_mod_auth_ntlm_winbind boolean - Allow privhome apps including dovecot read on nfs and cifs home dirs if the boolean is set- Allow nsplugin to read /etc/mozpluggerrc, user_fonts - Allow syslog to manage innd logs. - Allow procmail to ioctl spamd_exec_t- Allow initrc_t to dbus chat with consolekit.- Additional access for nsplugin - Allow xdm setcap/getcap until pulseaudio is fixed- Allow mount to mkdir on tmpfs - Allow ifconfig to search debugfs- Fix file context for MATLAB - Fixes for xace- Allow stunnel to transition to inetd children domains - Make unconfined_dbusd_t an unconfined domain- Fixes for qemu/virtd- Fix bug in mozilla policy to allow xguest transition - This will fix the libsemanage.dbase_llist_query: could not find record value libsemanage.dbase_llist_query: could not query record value (No such file or directory) bug in xguest- Allow nsplugin to run acroread- Add cups_pdf policy - Add openoffice policy to run in xguest- prewika needs to contact mysql - Allow syslog to read system_map files- Change init_t to an unconfined_domain- Allow init to transition to initrc_t on shell exec. - Fix init to be able to sendto init_t. - Allow syslog to connect to mysql - Allow lvm to manage its own fifo_files - Allow bugzilla to use ldap - More mls fixes- fixes for init policy (#436988) - fix build- Additional changes for MLS policy- Fix initrc_context generation for MLS- Fixes for libvirt- Allow bitlebee to read locale_t- More xselinux rules- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t- Prepare policy for beta release - Change some of the system domains back to unconfined - Turn on some of the booleans- Allow nsplugin_config execstack/execmem - Allow nsplugin_t to read alsa config - Change apache to use user content- Add cyphesis policy- Fix Makefile.devel to build mls modules - Fix qemu to be more specific on labeling- Update to upstream fixes- Allow staff to mounton user_home_t- Add xace support- Add fusectl file system- Fixes from yum-cron - Update to latest upstream- Fix userdom_list_user_files- Merge with upstream- Allow udev to send audit messages- Add additional login users interfaces - userdom_admin_login_user_template(staff)- More fixes for polkit- Eliminate transition from unconfined_t to qemu by default - Fixes for gpg- Update to upstream- Fixes for staff_t- Add policy for kerneloops - Add policy for gnomeclock- Fixes for libvirt- Fixes for nsplugin- More fixes for qemu- Additional ports for vnc and allow qemu and libvirt to search all directories- Update to upstream - Add libvirt policy - add qemu policy- Allow fail2ban to create a socket in /var/run- Allow allow_httpd_mod_auth_pam to work- Add audisp policy and prelude- Allow all user roles to executae samba net command- Allow usertypes to read/write noxattr file systems- Fix nsplugin to allow flashplugin to work in enforcing mode- Allow pam_selinux_permit to kill all processes- Allow ptrace or user processes by users of same type - Add boolean for transition to nsplugin- Allow nsplugin sys_nice, getsched, setsched- Allow login programs to talk dbus to oddjob- Add procmail_log support - Lots of fixes for munin- Allow setroubleshoot to read policy config and send audit messages- Allow users to execute all files in homedir, if boolean set - Allow mount to read samba config- Fixes for xguest to run java plugin- dontaudit pam_t and dbusd writing to user_home_t- Update gpg to allow reading of inotify- Change user and staff roles to work correctly with varied perms- Fix munin log, - Eliminate duplicate mozilla file context - fix wpa_supplicant spec- Fix role transition from unconfined_r to system_r when running rpm - Allow unconfined_domains to communicate with user dbus instances- Fixes for xguest- Let all uncofined domains communicate with dbus unconfined- Run rpm in system_r- Zero out customizable types- Fix definiton of admin_home_t- Fix munin file context- Allow cron to run unconfined apps- Modify default login to unconfined_u- Dontaudit dbus user client search of /root- Update to upstream- Fixes for polkit - Allow xserver to ptrace- Add polkit policy - Symplify userdom context, remove automatic per_role changes- Update to upstream - Allow httpd_sys_script_t to search users homedirs- Allow rpm_script to transition to unconfined_execmem_t- Remove user based home directory separation- Remove user specific crond_t- Merge with upstream - Allow xsever to read hwdata_t - Allow login programs to setkeycreate- Update to upstream- Update to upstream- Allow XServer to read /proc/self/cmdline - Fix unconfined cron jobs - Allow fetchmail to transition to procmail - Fixes for hald_mac - Allow system_mail to transition to exim - Allow tftpd to upload files - Allow xdm to manage unconfined_tmp - Allow udef to read alsa config - Fix xguest to be able to connect to sound port- Fixes for hald_mac - Treat unconfined_home_dir_t as a home dir - dontaudit rhgb writes to fonts and root- Fix dnsmasq - Allow rshd full login privs- Allow rshd to connect to ports > 1023- Fix vpn to bind to port 4500 - Allow ssh to create shm - Add Kismet policy- Allow rpm to chat with networkmanager- Fixes for ipsec and exim mail - Change default to unconfined user- Pass the UNK_PERMS param to makefile - Fix gdm location- Make alsa work- Fixes for consolekit and startx sessions- Dontaudit consoletype talking to unconfined_t- Remove homedir_template- Check asound.state- Fix exim policy- Allow tmpreadper to read man_t - Allow racoon to bind to all nodes - Fixes for finger print reader- Allow xdm to talk to input device (fingerprint reader) - Allow octave to run as java- Allow login programs to set ioctl on /proc- Allow nsswitch apps to read samba_var_t- Fix maxima- Eliminate rpm_t:fifo_file avcs - Fix dbus path for helper app- Fix service start stop terminal avc's- Allow also to search var_lib - New context for dbus launcher- Allow cupsd_config_t to read/write usb_device_t - Support for finger print reader, - Many fixes for clvmd - dbus starting networkmanager- Fix java and mono to run in xguest account- Fix to add xguest account when inititial install - Allow mono, java, wine to run in userdomains- Allow xserver to search devpts_t - Dontaudit ldconfig output to homedir- Remove hplip_etc_t change back to etc_t.- Allow cron to search nfs and samba homedirs- Allow NetworkManager to dbus chat with yum-updated- Allow xfs to bind to port 7100- Allow newalias/sendmail dac_override - Allow bind to bind to all udp ports- Turn off direct transition- Allow wine to run in system role- Fix java labeling- Define user_home_type as home_type- Allow sendmail to create etc_aliases_t- Allow login programs to read symlinks on homedirs- Update an readd modules- Cleanup spec file- Allow xserver to be started by unconfined process and talk to tty- Upgrade to upstream to grab postgressql changes- Add setransd for mls policy- Add ldconfig_cache_t- Allow sshd to write to proc_t for afs login- Allow xserver access to urand- allow dovecot to search mountpoints- Fix Makefile for building policy modules- Fix dhcpc startup of service- Fix dbus chat to not happen for xguest and guest users- Fix nagios cgi - allow squid to communicate with winbind- Fixes for ldconfig- Update from upstream- Add nasd support- Fix new usb devices and dmfm- Eliminate mount_ntfs_t policy, merge into mount_t- Allow xserver to write to ramfs mounted by rhgb- Add context for dbus machine id- Update with latest changes from upstream- Fix prelink to handle execmod- Add ntpd_key_t to handle secret data- Add anon_inodefs - Allow unpriv user exec pam_exec_t - Fix trigger- Allow cups to use generic usb - fix inetd to be able to run random apps (git)- Add proper contexts for rsyslogd- Fixes for xguest policy- Allow execution of gconf- Fix moilscanner update problem- Begin adding policy to separate setsebool from semanage - Fix xserver.if definition to not break sepolgen.if- Add new devices- Add brctl policy- Fix root login to include system_r- Allow prelink to read kernel sysctls- Default to user_u:system_r:unconfined_t- fix squid - Fix rpm running as uid- Fix syslog declaration- Allow avahi to access inotify - Remove a lot of bogus security_t:filesystem avcs- Remove ifdef strict policy from upstream- Remove ifdef strict to allow user_u to login- Fix for amands - Allow semanage to read pp files - Allow rhgb to read xdm_xserver_tmp- Allow kerberos servers to use ldap for backing store- allow alsactl to read kernel state- More fixes for alsactl - Transition from hal and modutils - Fixes for suspend resume. - insmod domtrans to alsactl - insmod writes to hal log- Allow unconfined_t to transition to NetworkManager_t - Fix netlabel policy- Update to latest from upstream- Update to latest from upstream- Update to latest from upstream- Allow pcscd_t to send itself signals- Fixes for unix_update - Fix logwatch to be able to search all dirs- Upstream bumped the version- Allow consolekit to syslog - Allow ntfs to work with hal- Allow iptables to read etc_runtime_t- MLS Fixes- Fix path of /etc/lvm/cache directory - Fixes for alsactl and pppd_t - Fixes for consolekit- Allow insmod_t to mount kvmfs_t filesystems- Rwho policy - Fixes for consolekit- fixes for fusefs- Fix samba_net to allow it to view samba_var_t- Update to upstream- Fix Sonypic backlight - Allow snmp to look at squid_conf_t- Fixes for pyzor, cyrus, consoletype on everything installs- Fix hald_acl_t to be able to getattr/setattr on usb devices - Dontaudit write to unconfined_pipes for load_policy- Allow bluetooth to read inotifyfs- Fixes for samba domain controller. - Allow ConsoleKit to look at ttys- Fix interface call- Allow syslog-ng to read /var - Allow locate to getattr on all filesystems - nscd needs setcap- Update to upstream- Allow samba to run groupadd- Update to upstream- Allow mdadm to access generic scsi devices- Fix labeling on udev.tbl dirs- Fixes for logwatch- Add fusermount and mount_ntfs policy- Update to upstream - Allow saslauthd to use kerberos keytabs- Fixes for samba_var_t- Allow networkmanager to setpgid - Fixes for hal_acl_t- Remove disable_trans booleans - hald_acl_t needs to talk to nscd- Fix prelink to be able to manage usr dirs.- Allow insmod to launch init scripts- Remove setsebool policy- Fix handling of unlabled_t packets- More of my patches from upstream- Update to latest from upstream - Add fail2ban policy- Update to remove security_t:filesystem getattr problems- Policy for consolekit- Update to latest from upstream- Revert Nemiver change - Set sudo as a corecmd so prelink will work, remove sudoedit mapping, since this will not work, it does not transition. - Allow samba to execute useradd- Upgrade to the latest from upstream- Add sepolgen support - Add bugzilla policy- Fix file context for nemiver- Remove include sym link- Allow mozilla, evolution and thunderbird to read dev_random. Resolves: #227002 - Allow spamd to connect to smtp port Resolves: #227184 - Fixes to make ypxfr work Resolves: #227237- Fix ssh_agent to be marked as an executable - Allow Hal to rw sound device- Fix spamassisin so crond can update spam files - Fixes to allow kpasswd to work - Fixes for bluetooth- Remove some targeted diffs in file context file- Fix squid cachemgr labeling- Add ability to generate webadm_t policy - Lots of new interfaces for httpd - Allow sshd to login as unconfined_t- Continue fixing, additional user domains- Begin adding user confinement to targeted policy- Fixes for prelink, ktalkd, netlabel- Allow prelink when run from rpm to create tmp files Resolves: #221865 - Remove file_context for exportfs Resolves: #221181 - Allow spamassassin to create ~/.spamassissin Resolves: #203290 - Allow ssh access to the krb tickets - Allow sshd to change passwd - Stop newrole -l from working on non securetty Resolves: #200110 - Fixes to run prelink in MLS machine Resolves: #221233 - Allow spamassassin to read var_lib_t dir Resolves: #219234- fix mplayer to work under strict policy - Allow iptables to use nscd Resolves: #220794- Add gconf policy and make it work with strict- Many fixes for strict policy and by extension mls.- Fix to allow ftp to bind to ports > 1024 Resolves: #219349- Allow semanage to exec it self. Label genhomedircon as semanage_exec_t Resolves: #219421 - Allow sysadm_lpr_t to manage other print spool jobs Resolves: #220080- allow automount to setgid Resolves: #219999- Allow cron to polyinstatiate - Fix creation of boot flags Resolves: #207433- Fixes for irqbalance Resolves: #219606- Fix vixie-cron to work on mls Resolves: #207433Resolves: #218978- Allow initrc to create files in /var directories Resolves: #219227- More fixes for MLS Resolves: #181566- More Fixes polyinstatiation Resolves: #216184- More Fixes polyinstatiation - Fix handling of keyrings Resolves: #216184- Fix polyinstatiation - Fix pcscd handling of terminal Resolves: #218149 Resolves: #218350- More fixes for quota Resolves: #212957- ncsd needs to use avahi sockets Resolves: #217640 Resolves: #218014- Allow login programs to polyinstatiate homedirs Resolves: #216184 - Allow quotacheck to create database files Resolves: #212957- Dontaudit appending hal_var_lib files Resolves: #217452 Resolves: #217571 Resolves: #217611 Resolves: #217640 Resolves: #217725- Fix context for helix players file_context #216942- Fix load_policy to be able to mls_write_down so it can talk to the terminal- Fixes for hwclock, clamav, ftp- Move to upstream version which accepted my patches- Fixes for nvidia driver- Allow semanage to signal mcstrans- Update to upstream- Allow modstorage to edit /etc/fstab file- Fix for qemu, /dev/- Fix path to realplayer.bin- Allow xen to connect to xen port- Allow cups to search samba_etc_t directory - Allow xend_t to list auto_mountpoints- Allow xen to search automount- Fix spec of jre files- Fix unconfined access to shadow file- Allow xend to create files in xen_image_t directories- Fixes for /var/lib/hal- Remove ability for sysadm_t to look at audit.log- Fix rpc_port_types - Add aide policy for mls- Merge with upstream- Lots of fixes for ricci- Allow xen to read/write fixed devices with a boolean - Allow apache to search /var/log- Fix policygentool specfile problem. - Allow apache to send signals to it's logging helpers. - Resolves: rhbz#212731- Add perms for swat- Add perms for swat- Allow daemons to dump core files to /- Fixes for ricci- Allow mount.nfs to work- Allow ricci-modstorage to look at lvm_etc_t- Fixes for ricci using saslauthd- Allow mountpoint on home_dir_t and home_t- Update xen to read nfs files- Allow noxattrfs to associate with other noxattrfs- Allow hal to use power_device_t- Allow procemail to look at autofs_t - Allow xen_image_t to work as a fixed device- Refupdate from upstream- Add lots of fixes for mls cups- Lots of fixes for ricci- Fix number of cats- Update to upstream- More iSCSI changes for #209854- Test ISCSI fixes for #209854- allow semodule to rmdir selinux_config_t dir- Fix boot_runtime_t problem on ppc. Should not be creating these files.- Fix context mounts on reboot - Fix ccs creation of directory in /var/log- Update for tallylog- Allow xend to rewrite dhcp conf files - Allow mgetty sys_admin capability- Make xentapctrl work- Don't transition unconfined_t to bootloader_t - Fix label in /dev/xen/blktap- Patch for labeled networking- Fix crond handling for mls- Update to upstream- Remove bluetooth-helper transition - Add selinux_validate for semanage - Require new version of libsemanage- Fix prelink- Fix rhgb- Fix setrans handling on MLS and useradd- Support for fuse - fix vigr- Fix dovecot, amanda - Fix mls- Allow java execheap for itanium- Update with upstream- mls fixes- Update from upstream- More fixes for mls - Revert change on automount transition to mount- Fix cron jobs to run under the correct context- Fixes to make pppd work- Multiple policy fixes - Change max categories to 1023- Fix transition on mcstransd- Add /dev/em8300 defs- Upgrade to upstream- Fix ppp connections from network manager- Add tty access to all domains boolean - Fix gnome-pty-helper context for ia64- Fixed typealias of firstboot_rw_t- Fix location of xel log files - Fix handling of sysadm_r -> rpm_exec_t- Fixes for autofs, lp- Update from upstream- Fixup for test6- Update to upstream- Update to upstream- Fix suspend to disk problems- Lots of fixes for restarting daemons at the console.- Fix audit line - Fix requires line- Upgrade to upstream- Fix install problems- Allow setroubleshoot to getattr on all dirs to gather RPM data- Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform - Fix spec for /dev/adsp- Fix xen tty devices- Fixes for setroubleshoot- Update to upstream- Fixes for stunnel and postgresql - Update from upstream- Update from upstream - More java fixes- Change allow_execstack to default to on, for RHEL5 Beta. This is required because of a Java compiler problem. Hope to turn off for next beta- Misc fixes- More fixes for strict policy- Quiet down anaconda audit messages- Fix setroubleshootd- Update to the latest from upstream- More fixes for xen- Fix anaconda transitions- yet more xen rules- more xen rules- Fixes for Samba- Fixes for xen- Allow setroubleshootd to send mail- Add nagios policy- fixes for setroubleshoot- Added Paul Howarth patch to only load policy packages shipped with this package - Allow pidof from initrc to ptrace higher level domains - Allow firstboot to communicate with hal via dbus- Add policy for /var/run/ldapi- Fix setroubleshoot policy- Fixes for mls use of ssh - named has a new conf file- Fixes to make setroubleshoot work- Cups needs to be able to read domain state off of printer client- add boolean to allow zebra to write config files- setroubleshootd fixes- Allow prelink to read bin_t symlink - allow xfs to read random devices - Change gfs to support xattr- Remove spamassassin_can_network boolean- Update to upstream - Fix lpr domain for mls- Add setroubleshoot policy- Turn off auditallow on setting booleans- Multiple fixes- Update to upstream- Update to upstream - Add new class for kernel key ring- Update to upstream- Update to upstream- Break out selinux-devel package- Add ibmasmfs- Fix policygentool gen_requires- Update from Upstream- Fix spec of realplay- Update to upstream- Fix semanage- Allow useradd to create_home_dir in MLS environment- Update from upstream- Update from upstream- Add oprofilefs- Fix for hplip and Picasus- Update to upstream- Update to upstream- fixes for spamd- fixes for java, openldap and webalizer- Xen fixes- Upgrade to upstream- allow hal to read boot_t files - Upgrade to upstream- allow hal to read boot_t files- Update from upstream- Fixes for amavis- Update from upstream- Allow auditctl to search all directories- Add acquire service for mono.- Turn off allow_execmem boolean - Allow ftp dac_override when allowed to access users homedirs- Clean up spec file - Transition from unconfined_t to prelink_t- Allow execution of cvs command- Update to upstream- Update to upstream- Fix libjvm spec- Update to upstream- Add xm policy - Fix policygentool- Update to upstream - Fix postun to only disable selinux on full removal of the packages- Allow mono to chat with unconfined- Allow procmail to sendmail - Allow nfs to share dosfs- Update to latest from upstream - Allow selinux-policy to be removed and kernel not to crash- Update to latest from upstream - Add James Antill patch for xen - Many fixes for pegasus- Add unconfined_mount_t - Allow privoxy to connect to httpd_cache - fix cups labeleing on /var/cache/cups- Update to latest from upstream- Update to latest from upstream - Allow mono and unconfined to talk to initrc_t dbus objects- Change libraries.fc to stop shlib_t form overriding texrel_shlib_t- Fix samba creating dirs in homedir - Fix NFS so its booleans would work- Allow secadm_t ability to relabel all files - Allow ftp to search xferlog_t directories - Allow mysql to communicate with ldap - Allow rsync to bind to rsync_port_t- Fixed mailman with Postfix #183928 - Allowed semanage to create file_context files. - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t to bind to reserved ports. #149030 - Don't allow devpts_t to be associated with tmp_t. - Allow hald_t to stat all mountpoints. - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts. - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of /etc/mtab. - Changed the file_contexts to not have a regex before the first ^/[a-z]/ whenever possible, makes restorecon slightly faster. - Correct the label of /etc/named.caching-nameserver.conf - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src hit by this. - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed xenstored_t rw access to the xen device node.- More textrel_shlib_t file path fixes - Add ada support- Get auditctl working in MLS policy- Add mono dbus support - Lots of file_context fixes for textrel_shlib_t in FC5 - Turn off execmem auditallow since they are filling log files- Update to upstream- Allow automount and dbus to read cert files- Fix ftp policy - Fix secadm running of auditctl- Update to upstream- Update to upstream- Fix policyhelp- Fix pam_console handling of usb_device - dontaudit logwatch reading /mnt dir- Update to upstream- Get transition rules to create policy.20 at SystemHigh- Allow secadmin to shutdown system - Allow sendmail to exec newalias- MLS Fixes dmidecode needs mls_file_read_up - add ypxfr_t - run init needs access to nscd - udev needs setuid - another xen log file - Dontaudit mount getattr proc_kcore_t- fix buildroot usage (#185391)- Get rid of mount/fsdisk scan of /dev messages - Additional fixes for suspend/resume- Fake make to rebuild enableaudit.pp- Get xen networking running.- Fixes for Xen - enableaudit should not be the same as base.pp - Allow ps to work for all process- more xen policy fixups- more xen fixage (#184393)- Fix blkid specification - Allow postfix to execute mailman_que- Blkid changes - Allow udev access to usb_device_t - Fix post script to create targeted policy config file- Allow lvm tools to create drevice dir- Add Xen support- Fixes for cups - Make cryptosetup work with hal- Load Policy needs translock- Fix cups html interface- Add hal changes suggested by Jeremy - add policyhelp to point at policy html pages- Additional fixes for nvidia and cups- Update to upstream - Merged my latest fixes - Fix cups policy to handle unix domain sockets- NSCD socket is in nscd_var_run_t needs to be able to search dir- Fixes Apache interface file- Fixes for new version of cups- Turn off polyinstatiate util after FC5- Fix problem with privoxy talking to Tor- Turn on polyinstatiation- Don't transition from unconfined_t to fsadm_t- Fix policy update model.- Update to upstream- Fix load_policy to work on MLS - Fix cron_rw_system_pipes for postfix_postdrop_t - Allow audotmount to run showmount- Fix swapon - allow httpd_sys_script_t to be entered via a shell - Allow httpd_sys_script_t to read eventpolfs- Update from upstream- allow cron to read apache files- Fix vpnc policy to work from NetworkManager- Update to upstream - Fix semoudle polcy- Update to upstream - fix sysconfig/selinux link- Add router port for zebra - Add imaze port for spamd - Fixes for amanda and java- Fix bluetooth handling of usb devices - Fix spamd reading of ~/ - fix nvidia spec- Update to upsteam- Add users_extra files- Update to upstream- Add semodule policy- Update from upstream- Fix for spamd to use razor port- Fixes for mcs - Turn on mount and fsadm for unconfined_t- Fixes for the -devel package- Fix for spamd to use ldap- Update to upstream- Update to upstream - Fix rhgb, and other Xorg startups- Update to upstream- Separate out role of secadm for mls- Add inotifyfs handling- Update to upstream - Put back in changes for pup/zen- Many changes for MLS - Turn on strict policy- Update to upstream- Update to upstream - Fixes for booting and logging in on MLS machine- Update to upstream - Turn off execheap execstack for unconfined users - Add mono/wine policy to allow execheap and execstack for them - Add execheap for Xdm policy- Update to upstream - Fixes to fetchmail,- Update to upstream- Fix for procmail/spamassasin - Update to upstream - Add rules to allow rpcd to work with unlabeled_networks.- Update to upstream - Fix ftp Man page- Update to upstream- fix pup transitions (#177262) - fix xen disks (#177599)- Update to upstream- More Fixes for hal and readahead- Fixes for hal and readahead- Update to upstream - Apply- Add wine and fix hal problems- Handle new location of hal scripts- Allow su to read /etc/mtab- Update to upstream- Fix "libsemanage.parse_module_headers: Data did not represent a module." problem- Allow load_policy to read /etc/mtab- Fix dovecot to allow dovecot_auth to look at /tmp- Allow restorecon to read unlabeled_t directories in order to fix labeling.- Add Logwatch policy- Fix /dev/ub[a-z] file context- Fix library specification - Give kudzu execmem privs- Fix hostname in targeted policy- Fix passwd command on mls- Lots of fixes to make mls policy work- Add dri libs to textrel_shlib_t - Add system_r role for java - Add unconfined_exec_t for vncserver - Allow slapd to use kerberos- Add man pages- Add enableaudit.pp- Fix mls policy- Update mls file from old version- Add sids back in - Rebuild with update checkpolicy- Fixes to allow automount to use portmap - Fixes to start kernel in s0-s15:c0.c255- Add java unconfined/execmem policy- Add file context for /var/cvs - Dontaudit webalizer search of homedir- Update from upstream- Clean up spec - range_transition crond to SystemHigh- Fixes for hal - Update to upstream- Turn back on execmem since we need it for java, firefox, ooffice - Allow gpm to stream socket to itself- fix requirements to be on the actual packages so that policy can get created properly at install time- Allow unconfined_t to execmod texrel_shlib_t- Update to upstream - Turn off allow_execmem and allow_execmod booleans - Add tcpd and automount policies- Add two new httpd booleans, turned off by default * httpd_can_network_relay * httpd_can_network_connect_db- Add ghost for policy.20- Update to upstream - Turn off boolean allow_execstack- Change setrans-mls to use new libsetrans - Add default_context rule for xdm- Change Requires to PreReg for requiring of policycoreutils on install- New upstream releaseAdd xdm policyUpdate from upstreamUpdate from upstreamUpdate from upstream- Also trigger to rebuild policy for versions up to 2.0.7.- No longer installing policy.20 file, anaconda handles the building of the app.- Fixes for dovecot and saslauthd- Cleanup pegasus and named - Fix spec file - Fix up passwd changing applications-Update to latest from upstream- Add rules for pegasus and avahi- Start building MLS Policy- Update to upstream- Turn on bash- Initial version/bin/sh  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-..0123456789:;<=>?@ABCDEFGHIJKLMN3.13.1-229.el7_6.9    develMakefileexample.fcexample.ifexample.tehtmlNetworkManager.htmlabrt.htmlabrt_dump_oops.htmlabrt_handle_event.htmlabrt_helper.htmlabrt_retrace_coredump.htmlabrt_retrace_worker.htmlabrt_upload_watch.htmlabrt_watch_log.htmlaccountsd.htmlacct.htmladmin_crontab.htmlafs.htmlafs_bosserver.htmlafs_fsserver.htmlafs_kaserver.htmlafs_ptserver.htmlafs_vlserver.htmlaiccu.htmlaide.htmlajaxterm.htmlajaxterm_ssh.htmlalsa.htmlamanda.htmlamanda_recover.htmlamtu.htmlanaconda.htmlanon_sftpd.htmlantivirus.htmlapcupsd.htmlapcupsd_cgi_script.htmlapm.htmlapmd.htmlarpwatch.htmlasterisk.htmlaudisp.htmlaudisp_remote.htmlauditadm.htmlauditadm_screen.htmlauditadm_su.htmlauditadm_sudo.htmlauditctl.htmlauditd.htmlauthconfig.htmlautomount.htmlavahi.htmlawstats.htmlawstats_script.htmlbacula.htmlbacula_admin.htmlbacula_unconfined_script.htmlbcfg2.htmlbitlbee.htmlblkmapd.htmlblktap.htmlblueman.htmlbluetooth.htmlbluetooth_helper.htmlboinc.htmlboinc_project.htmlbootloader.htmlbrctl.htmlbrltty.htmlbugzilla_script.htmlbumblebee.htmlcachefiles_kernel.htmlcachefilesd.htmlcalamaris.htmlcallweaver.htmlcanna.htmlcardmgr.htmlccs.htmlcdcc.htmlcdrecord.htmlcertmaster.htmlcertmonger.htmlcertmonger_unconfined.htmlcertwatch.htmlcfengine_execd.htmlcfengine_monitord.htmlcfengine_serverd.htmlcgclear.htmlcgconfig.htmlcgdcbxd.htmlcgred.htmlcheckpc.htmlcheckpolicy.htmlchfn.htmlchkpwd.htmlchrome_sandbox.htmlchrome_sandbox_nacl.htmlchronyc.htmlchronyd.htmlchroot_user.htmlcinder_api.htmlcinder_backup.htmlcinder_scheduler.htmlcinder_volume.htmlciped.htmlclogd.htmlcloud_init.htmlcluster.htmlclvmd.htmlcmirrord.htmlcobblerd.htmlcockpit_session.htmlcockpit_ws.htmlcollectd.htmlcollectd_script.htmlcolord.htmlcomsat.htmlcondor_collector.htmlcondor_master.htmlcondor_negotiator.htmlcondor_procd.htmlcondor_schedd.htmlcondor_startd.htmlcondor_startd_ssh.htmlconman.htmlconman_unconfined_script.htmlconsolekit.htmlcontainer.htmlcontainer_auth.htmlcontainer_runtime.htmlcouchdb.htmlcourier_authdaemon.htmlcourier_pcp.htmlcourier_pop.htmlcourier_sqwebmail.htmlcourier_tcpd.htmlcpucontrol.htmlcpufreqselector.htmlcpuplug.htmlcpuspeed.htmlcrack.htmlcrond.htmlcronjob.htmlcrontab.htmlctdbd.htmlcups_pdf.htmlcupsd.htmlcupsd_config.htmlcupsd_lpd.htmlcvs.htmlcvs_script.htmlcyphesis.htmlcyrus.htmldbadm.htmldbadm_sudo.htmldbskkd.htmldcc_client.htmldcc_dbclean.htmldccd.htmldccifd.htmldccm.htmldcerpcd.htmlddclient.htmldeltacloudd.htmldenyhosts.htmldepmod.htmldevicekit.htmldevicekit_disk.htmldevicekit_power.htmldhcpc.htmldhcpd.htmldictd.htmldirsrv.htmldirsrv_snmp.htmldirsrvadmin.htmldirsrvadmin_script.htmldirsrvadmin_unconfined_script.htmldisk_munin_plugin.htmldkim_milter.htmldlm_controld.htmldmesg.htmldmidecode.htmldnsmasq.htmldnssec_trigger.htmldovecot.htmldovecot_auth.htmldovecot_deliver.htmldrbd.htmldspam.htmldspam_script.htmlentropyd.htmleventlogd.htmlevtchnd.htmlexim.htmlfail2ban.htmlfail2ban_client.htmlfcoemon.htmlfenced.htmlfetchmail.htmlfingerd.htmlfirewalld.htmlfirewallgui.htmlfirstboot.htmlfoghorn.htmlfprintd.htmlfreeipmi_bmc_watchdog.htmlfreeipmi_ipmidetectd.htmlfreeipmi_ipmiseld.htmlfreqset.htmlfsadm.htmlfsdaemon.htmlftpd.htmlftpdctl.htmlgames.htmlgames_srv.htmlganesha.htmlgconfd.htmlgconfdefaultsm.htmlgdomap.htmlgeoclue.htmlgetty.htmlgfs_controld.htmlgit_script.htmlgit_session.htmlgit_system.htmlgitosis.htmlglance_api.htmlglance_registry.htmlglance_scrubber.htmlglusterd.htmlgnomesystemmm.htmlgpg.htmlgpg_agent.htmlgpg_helper.htmlgpg_pinentry.htmlgpg_web.htmlgpm.htmlgpsd.htmlgreylist_milter.htmlgroupadd.htmlgroupd.htmlgssd.htmlgssproxy.htmlguest.htmlhaproxy.htmlhddtemp.htmlhostname.htmlhsqldb.htmlhttpd.htmlhttpd_helper.htmlhttpd_passwd.htmlhttpd_php.htmlhttpd_rotatelogs.htmlhttpd_suexec.htmlhttpd_sys_script.htmlhttpd_unconfined_script.htmlhttpd_user_script.htmlhwclock.htmlhwloc_dhwd.htmlhypervkvp.htmlhypervvssd.htmliceauth.htmlicecast.htmlifconfig.htmlindex.htmlinetd.htmlinetd_child.htmlinit.htmlinitrc.htmlinnd.htmlinsmod.htmlinstall.htmliodined.htmliotop.htmlipa_dnskey.htmlipa_helper.htmlipa_otpd.htmlipmievd.htmlipsec.htmlipsec_mgmt.htmliptables.htmlirc.htmlirqbalance.htmlirssi.htmliscsid.htmlisnsd.htmliwhd.htmljabberd.htmljabberd_router.htmljockey.htmljournalctl.htmlkadmind.htmlkdump.htmlkdumpctl.htmlkdumpgui.htmlkeepalived.htmlkeepalived_unconfined_script.htmlkernel.htmlkeyboardd.htmlkeystone.htmlkeystone_cgi_script.htmlkismet.htmlklogd.htmlkmscon.htmlkpropd.htmlkrb5kdc.htmlksmtuned.htmlktalkd.htmll2tpd.htmlldconfig.htmllircd.htmllivecd.htmllldpad.htmlload_policy.htmlloadkeys.htmllocal_login.htmllocate.htmllockdev.htmllogadm.htmllogrotate.htmllogrotate_mail.htmllogwatch.htmllogwatch_mail.htmllpd.htmllpr.htmllsassd.htmllsmd.htmllsmd_plugin.htmllttng_sessiond.htmllvm.htmllwiod.htmllwregd.htmllwsmd.htmlmail_munin_plugin.htmlmailman_cgi.htmlmailman_mail.htmlmailman_queue.htmlman2html_script.htmlmandb.htmlmcelog.htmlmdadm.htmlmediawiki_script.htmlmemcached.htmlmencoder.htmlminidlna.htmlminissdpd.htmlmip6d.htmlmirrormanager.htmlmock.htmlmock_build.htmlmodemmanager.htmlmojomojo_script.htmlmon_procd.htmlmon_statd.htmlmongod.htmlmotion.htmlmount.htmlmount_ecryptfs.htmlmozilla.htmlmozilla_plugin.htmlmozilla_plugin_config.htmlmpd.htmlmplayer.htmlmrtg.htmlmscan.htmlmunin.htmlmunin_script.htmlmysqld.htmlmysqld_safe.htmlmysqlmanagerd.htmlmythtv_script.htmlnagios.htmlnagios_admin_plugin.htmlnagios_checkdisk_plugin.htmlnagios_eventhandler_plugin.htmlnagios_mail_plugin.htmlnagios_openshift_plugin.htmlnagios_script.htmlnagios_services_plugin.htmlnagios_system_plugin.htmlnagios_unconfined_plugin.htmlnamed.htmlnamespace_init.htmlncftool.htmlndc.htmlnetlabel_mgmt.htmlnetlogond.htmlnetutils.htmlneutron.htmlnewrole.htmlnfsd.htmlninfod.htmlnmbd.htmlnova.htmlnrpe.htmlnscd.htmlnsd.htmlnsd_crond.htmlnslcd.htmlntop.htmlntpd.htmlnumad.htmlnut_upsd.htmlnut_upsdrvctl.htmlnut_upsmon.htmlnutups_cgi_script.htmlnx_server.htmlnx_server_ssh.htmlobex.htmloddjob.htmloddjob_mkhomedir.htmlopenct.htmlopendnssec.htmlopenhpid.htmlopenshift.htmlopenshift_app.htmlopenshift_cgroup_read.htmlopenshift_cron.htmlopenshift_initrc.htmlopenshift_net_read.htmlopenshift_script.htmlopensm.htmlopenvpn.htmlopenvpn_unconfined_script.htmlopenvswitch.htmlopenwsman.htmloracleasm.htmlosad.htmlpads.htmlpam_console.htmlpam_timestamp.htmlpassenger.htmlpasswd.htmlpcp_pmcd.htmlpcp_pmie.htmlpcp_pmlogger.htmlpcp_pmmgr.htmlpcp_pmproxy.htmlpcp_pmwebd.htmlpcscd.htmlpegasus.htmlpegasus_openlmi_account.htmlpegasus_openlmi_admin.htmlpegasus_openlmi_logicalfile.htmlpegasus_openlmi_services.htmlpegasus_openlmi_storage.htmlpegasus_openlmi_system.htmlpegasus_openlmi_unconfined.htmlpesign.htmlphc2sys.htmlping.htmlpingd.htmlpiranha_fos.htmlpiranha_lvs.htmlpiranha_pulse.htmlpiranha_web.htmlpkcs_slotd.htmlpki_ra.htmlpki_tomcat.htmlpki_tomcat_script.htmlpki_tps.htmlplymouth.htmlplymouthd.htmlpodsleuth.htmlpolicykit.htmlpolicykit_auth.htmlpolicykit_grant.htmlpolicykit_resolve.htmlpolipo.htmlpolipo_session.htmlportmap.htmlportmap_helper.htmlportreserve.htmlpostfix_bounce.htmlpostfix_cleanup.htmlpostfix_local.htmlpostfix_map.htmlpostfix_master.htmlpostfix_pickup.htmlpostfix_pipe.htmlpostfix_postdrop.htmlpostfix_postqueue.htmlpostfix_qmgr.htmlpostfix_showq.htmlpostfix_smtp.htmlpostfix_smtpd.htmlpostfix_virtual.htmlpostgresql.htmlpostgrey.htmlpppd.htmlpptp.htmlprelink.htmlprelink_cron_system.htmlprelude.htmlprelude_audisp.htmlprelude_correlator.htmlprelude_lml.htmlpreupgrade.htmlprewikka_script.htmlprivoxy.htmlprocmail.htmlprosody.htmlpsad.htmlptal.htmlptchown.htmlptp4l.htmlpublicfile.htmlpulseaudio.htmlpuppetagent.htmlpuppetca.htmlpuppetmaster.htmlpwauth.htmlpyicqt.htmlqdiskd.htmlqemu_dm.htmlqmail_clean.htmlqmail_inject.htmlqmail_local.htmlqmail_lspawn.htmlqmail_queue.htmlqmail_remote.htmlqmail_rspawn.htmlqmail_send.htmlqmail_smtpd.htmlqmail_splogger.htmlqmail_start.htmlqmail_tcp_env.htmlqpidd.htmlquota.htmlquota_nld.htmlrabbitmq.htmlracoon.htmlradiusd.htmlradvd.htmlrasdaemon.htmlrdisc.htmlreadahead.htmlrealmd.htmlrealmd_consolehelper.htmlredis.htmlregex_milter.htmlremote_login.htmlrestorecond.htmlrhev_agentd.htmlrhev_agentd_consolehelper.htmlrhgb.htmlrhnsd.htmlrhsmcertd.htmlricci.htmlricci_modcluster.htmlricci_modclusterd.htmlricci_modlog.htmlricci_modrpm.htmlricci_modservice.htmlricci_modstorage.htmlrlogind.htmlrngd.htmlroundup.htmlrpcbind.htmlrpcd.htmlrpm.htmlrpm_script.htmlrshd.htmlrssh.htmlrssh_chroot_helper.htmlrsync.htmlrtas_errd.htmlrtkit_daemon.htmlrun_init.htmlrwho.htmlsamba_net.htmlsamba_unconfined_net.htmlsamba_unconfined_script.htmlsambagui.htmlsandbox.htmlsandbox_min.htmlsandbox_min_client.htmlsandbox_net.htmlsandbox_net_client.htmlsandbox_web.htmlsandbox_web_client.htmlsandbox_x.htmlsandbox_x_client.htmlsandbox_xserver.htmlsanlk_resetd.htmlsanlock.htmlsaslauthd.htmlsbd.htmlsblim_gatherd.htmlsblim_reposd.htmlsblim_sfcbd.htmlsecadm.htmlsecadm_screen.htmlsecadm_su.htmlsecadm_sudo.htmlsectoolm.htmlselinux_munin_plugin.htmlsemanage.htmlsendmail.htmlsensord.htmlsepgsql_ranged_proc.htmlsepgsql_trusted_proc.htmlservices_munin_plugin.htmlsetfiles.htmlsetfiles_mac.htmlsetkey.htmlsetrans.htmlsetroubleshoot_fixit.htmlsetroubleshootd.htmlsetsebool.htmlsftpd.htmlsge_execd.htmlsge_job.htmlsge_job_ssh.htmlsge_shepherd.htmlshorewall.htmlshowmount.htmlslapd.htmlslpd.htmlsmbcontrol.htmlsmbd.htmlsmbmount.htmlsmokeping.htmlsmokeping_cgi_script.htmlsmoltclient.htmlsmsd.htmlsnapperd.htmlsnmpd.htmlsnort.htmlsosreport.htmlsoundd.htmlspamass_milter.htmlspamc.htmlspamd.htmlspamd_update.htmlspc.htmlspeech-dispatcher.htmlsquid.htmlsquid_cron.htmlsquid_script.htmlsrvsvcd.htmlssh.htmlssh_keygen.htmlssh_keysign.htmlsshd.htmlsshd_keygen.htmlsshd_net.htmlsshd_sandbox.htmlsssd.htmlsssd_selinux_manager.htmlstaff.htmlstaff_consolehelper.htmlstaff_dbusd.htmlstaff_gkeyringd.htmlstaff_screen.htmlstaff_seunshare.htmlstaff_ssh_agent.htmlstaff_sudo.htmlstaff_wine.htmlstapserver.htmlstunnel.htmlstyle.csssulogin.htmlsvc_multilog.htmlsvc_run.htmlsvc_start.htmlsvirt.htmlsvirt_kvm_net.htmlsvirt_qemu_net.htmlsvirt_socket.htmlsvirt_tcg.htmlsvnserve.htmlswat.htmlswift.htmlsysadm.htmlsysadm_gkeyringd.htmlsysadm_passwd.htmlsysadm_screen.htmlsysadm_seunshare.htmlsysadm_ssh_agent.htmlsysadm_su.htmlsysadm_sudo.htmlsyslogd.htmlsysstat.htmlsystem_cronjob.htmlsystem_dbusd.htmlsystem_mail.htmlsystem_munin_plugin.htmlsystemd_bootchart.htmlsystemd_hostnamed.htmlsystemd_hwdb.htmlsystemd_initctl.htmlsystemd_localed.htmlsystemd_logger.htmlsystemd_logind.htmlsystemd_machined.htmlsystemd_networkd.htmlsystemd_notify.htmlsystemd_passwd_agent.htmlsystemd_resolved.htmlsystemd_sysctl.htmlsystemd_timedated.htmlsystemd_tmpfiles.htmltangd.htmltargetd.htmltcpd.htmltcsd.htmltelepathy_gabble.htmltelepathy_idle.htmltelepathy_logger.htmltelepathy_mission_control.htmltelepathy_msn.htmltelepathy_salut.htmltelepathy_sofiasip.htmltelepathy_stream_engine.htmltelepathy_sunshine.htmltelnetd.htmltftpd.htmltgtd.htmlthin.htmlthin_aeolus_configserver.htmlthumb.htmltimemaster.htmltlp.htmltmpreaper.htmltomcat.htmltor.htmltraceroute.htmltuned.htmltvtime.htmludev.htmlulogd.htmluml.htmluml_switch.htmlunconfined.htmlunconfined_cronjob.htmlunconfined_dbusd.htmlunconfined_mount.htmlunconfined_munin_plugin.htmlunconfined_sendmail.htmlunconfined_service.htmlupdate_modules.htmlupdfstab.htmlupdpwd.htmlusbmodules.htmlusbmuxd.htmluser.htmluser_dbusd.htmluser_gkeyringd.htmluser_mail.htmluser_screen.htmluser_seunshare.htmluser_ssh_agent.htmluser_wine.htmluseradd.htmlusernetctl.htmlutempter.htmluucpd.htmluuidd.htmluux.htmlvarnishd.htmlvarnishlog.htmlvdagent.htmlvhostmd.htmlvirsh.htmlvirsh_ssh.htmlvirt_bridgehelper.htmlvirt_qemu_ga.htmlvirt_qemu_ga_unconfined.htmlvirt_qmf.htmlvirtd.htmlvirtd_lxc.htmlvirtlogd.htmlvlock.htmlvmtools.htmlvmtools_helper.htmlvmtools_unconfined.htmlvmware.htmlvmware_host.htmlvnstat.htmlvnstatd.htmlvpnc.htmlw3c_validator_script.htmlwatchdog.htmlwatchdog_unconfined.htmlwdmd.htmlwebadm.htmlwebalizer.htmlwebalizer_script.htmlwinbind.htmlwinbind_helper.htmlwine.htmlwireshark.htmlwpa_cli.htmlxauth.htmlxdm.htmlxdm_unconfined.htmlxenconsoled.htmlxend.htmlxenstored.htmlxguest.htmlxguest_dbusd.htmlxguest_gkeyringd.htmlxserver.htmlypbind.htmlyppasswdd.htmlypserv.htmlypxfr.htmlzabbix.htmlzabbix_agent.htmlzabbix_script.htmlzarafa_deliver.htmlzarafa_gateway.htmlzarafa_ical.htmlzarafa_indexer.htmlzarafa_monitor.htmlzarafa_server.htmlzarafa_spooler.htmlzebra.htmlzoneminder.htmlzoneminder_script.htmlzos_remote.htmlincludeMakefileadminadmin.xmlbootloader.ifconsoletype.ifdmesg.ifnetutils.ifsu.ifsudo.ifusermanage.ifappsapps.xmlseunshare.ifbuild.confcontribcontrib.xmlabrt.ifaccountsd.ifacct.ifada.ifafs.ifaiccu.ifaide.ifaisexec.ifajaxterm.ifalsa.ifamanda.ifamavis.ifamtu.ifanaconda.ifantivirus.ifapache.ifapcupsd.ifapm.ifapt.ifarpwatch.ifasterisk.ifauthbind.ifauthconfig.ifautomount.ifavahi.ifawstats.ifbackup.ifbacula.ifbcfg2.ifbind.ifbird.ifbitlbee.ifblkmapd.ifblueman.ifbluetooth.ifboinc.ifbrctl.ifbrltty.ifbugzilla.ifbumblebee.ifcachefilesd.ifcalamaris.ifcallweaver.ifcanna.ifccs.ifcdrecord.ifcertmaster.ifcertmonger.ifcertwatch.ifcfengine.ifcgdcbxd.ifcgroup.ifchrome.ifchronyd.ifcinder.ifcipe.ifclamav.ifclockspeed.ifclogd.ifcloudform.ifcmirrord.ifcobbler.ifcockpit.ifcollectd.ifcolord.ifcomsat.ifcondor.ifconman.ifconsolekit.ifcontainer.ifcorosync.ifcouchdb.ifcourier.ifcpucontrol.ifcpufreqselector.ifcpuplug.ifcron.ifctdb.ifcups.ifcvs.ifcyphesis.ifcyrus.ifdaemontools.ifdante.ifdbadm.ifdbskk.ifdbus.ifdcc.ifddclient.ifddcprobe.ifdenyhosts.ifdevicekit.ifdhcp.ifdictd.ifdirmngr.ifdirsrv-admin.ifdirsrv.ifdistcc.ifdjbdns.ifdkim.ifdmidecode.ifdnsmasq.ifdnssec.ifdnssectrigger.ifdovecot.ifdpkg.ifdrbd.ifdspam.ifentropyd.ifetcd.ifevolution.ifexim.iffail2ban.iffcoe.iffetchmail.iffinger.iffirewalld.iffirewallgui.iffirstboot.iffprintd.iffreeipmi.iffreqset.ifftp.ifgames.ifganesha.ifgatekeeper.ifgdomap.ifgear.ifgeoclue.ifgift.ifgit.ifgitosis.ifglance.ifglusterd.ifgnome.ifgnomeclock.ifgpg.ifgpm.ifgpsd.ifgssproxy.ifguest.ifhadoop.ifhal.ifhddtemp.ifhostapd.ifhowl.ifhsqldb.ifhwloc.ifhypervkvp.ifi18n_input.ificecast.ififplugd.ifimaze.ifinetd.ifinn.ifiodine.ifiotop.ifipa.ifipmievd.ifirc.ifircd.ifirqbalance.ifiscsi.ifisns.ifjabber.ifjava.ifjetty.ifjockey.ifjournalctl.ifkde.ifkdump.ifkdumpgui.ifkeepalived.ifkerberos.ifkerneloops.ifkeyboardd.ifkeystone.ifkismet.ifkmscon.ifksmtuned.ifktalk.ifkudzu.ifl2tp.ifldap.iflightsquid.iflikewise.iflinuxptp.iflircd.iflivecd.iflldpad.ifloadkeys.iflockdev.iflogrotate.iflogwatch.iflpd.iflsm.iflttng-tools.ifmailman.ifmailscanner.ifman2html.ifmandb.ifmcelog.ifmcollective.ifmediawiki.ifmemcached.ifmilter.ifminidlna.ifminissdpd.ifmip6d.ifmirrormanager.ifmock.ifmodemmanager.ifmojomojo.ifmon_statd.ifmongodb.ifmono.ifmonop.ifmotion.ifmozilla.ifmpd.ifmplayer.ifmrtg.ifmta.ifmunin.ifmysql.ifmythtv.ifnaemon.ifnagios.ifnamespace.ifncftool.ifnessus.ifnetworkmanager.ifninfod.ifnis.ifnova.ifnscd.ifnsd.ifnslcd.ifnsplugin.ifntop.ifntp.ifnumad.ifnut.ifnx.ifoav.ifobex.ifoddjob.ifoident.ifopenca.ifopenct.ifopendnssec.ifopenhpi.ifopenhpid.ifopenshift-origin.ifopenshift.ifopensm.ifopenvpn.ifopenvswitch.ifopenwsman.iforacleasm.ifosad.ifpacemaker.ifpads.ifpassenger.ifpcmcia.ifpcp.ifpcscd.ifpegasus.ifperdition.ifpesign.ifpingd.ifpiranha.ifpkcs.ifpki.ifplymouthd.ifpodsleuth.ifpolicykit.ifpolipo.ifportage.ifportmap.ifportreserve.ifportslave.ifpostfix.ifpostfixpolicyd.ifpostgrey.ifppp.ifprelink.ifprelude.ifprivoxy.ifprocmail.ifprosody.ifpsad.ifptchown.ifpublicfile.ifpulseaudio.ifpuppet.ifpwauth.ifpxe.ifpyzor.ifqemu.ifqmail.ifqpid.ifquantum.ifquota.ifrabbitmq.ifradius.ifradvd.ifraid.ifrasdaemon.ifrazor.ifrdisc.ifreadahead.ifrealmd.ifredis.ifremotelogin.ifresmgr.ifrgmanager.ifrhcs.ifrhev.ifrhgb.ifrhnsd.ifrhsmcertd.ifricci.ifrkhunter.ifrlogin.ifrngd.ifrolekit.ifroundup.ifrpc.ifrpcbind.ifrpm.ifrshd.ifrssh.ifrsync.ifrtas.ifrtkit.ifrwho.ifsamba.ifsambagui.ifsamhain.ifsandbox.ifsandboxX.ifsanlock.ifsasl.ifsbd.ifsblim.ifscreen.ifsectoolm.ifsendmail.ifsensord.ifsetroubleshoot.ifsge.ifshorewall.ifshutdown.ifslocate.ifslpd.ifslrnpull.ifsmartmon.ifsmokeping.ifsmoltclient.ifsmsd.ifsmstools.ifsnapper.ifsnmp.ifsnort.ifsosreport.ifsoundserver.ifspamassassin.ifspeech-dispatcher.ifspeedtouch.ifsquid.ifsssd.ifstapserver.ifstunnel.ifsvnserve.ifswift.ifswift_alias.ifsxid.ifsysstat.iftangd.iftargetd.iftcpd.iftcsd.iftelepathy.iftelnet.iftftp.iftgtd.ifthin.ifthumb.ifthunderbird.iftimidity.iftlp.iftmpreaper.iftomcat.iftor.iftransproxy.iftripwire.iftuned.iftvtime.iftzdata.ifucspitcp.ifulogd.ifuml.ifupdfstab.ifuptime.ifusbmodules.ifusbmuxd.ifuserhelper.ifusernetctl.ifuucp.ifuuidd.ifuwimap.ifvarnishd.ifvbetool.ifvdagent.ifvhostmd.ifvirt.ifvlock.ifvmtools.ifvmware.ifvnstatd.ifvpn.ifw3c.ifwatchdog.ifwdmd.ifwebadm.ifwebalizer.ifwine.ifwireshark.ifwm.ifxen.ifxfs.ifxguest.ifxprint.ifxscreensaver.ifyam.ifzabbix.ifzarafa.ifzebra.ifzoneminder.ifzosremote.ifglobal_booleans.xmlglobal_tunables.xmlkernelkernel.xmlcorecommands.ifcorenetwork.ifdevices.ifdomain.iffiles.iffilesystem.ifkernel.ifmcs.ifmls.ifselinux.ifstorage.ifterminal.ifubac.ifunlabelednet.ifrolesroles.xmlauditadm.iflogadm.ifsecadm.ifstaff.ifsysadm.ifsysadm_secadm.ifunconfineduser.ifunprivuser.ifservicesservices.xmlpostgresql.ifssh.ifxserver.ifsupportall_perms.sptdivert.m4file_patterns.sptipc_patterns.sptloadable_module.sptmisc_macros.sptmisc_patterns.sptmls_mcs_macros.sptobj_perm_sets.sptpolicy.dtdsegenxml.pysegenxml.pycsegenxml.pyoundivert.m4systemsystem.xmlapplication.ifauthlogin.ifclock.iffstools.ifgetty.ifhostname.ifhotplug.ifinit.ifipsec.ifiptables.iflibraries.iflocallogin.iflogging.iflvm.ifmiscfiles.ifmodutils.ifmount.ifnetlabel.ifselinuxutil.ifsetrans.ifsysnetwork.ifsystemd.ifudev.ifunconfined.ifuserdomain.ifpolicy.dtdpolicy.xmlinterface_info/usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/html//usr/share/selinux/devel/include//usr/share/selinux/devel/include/admin//usr/share/selinux/devel/include/apps//usr/share/selinux/devel/include/contrib//usr/share/selinux/devel/include/kernel//usr/share/selinux/devel/include/roles//usr/share/selinux/devel/include/services//usr/share/selinux/devel/include/support//usr/share/selinux/devel/include/system//var/lib/sepolgen/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz9noarch-redhat-linux-gnu  directoryASCII textSE Linux policy interface sourceSE Linux policy module sourceHTML document, ASCII textmakefile script, ASCII textC++ source, ASCII textASCII text, with very long linesASCII text, with no line terminatorsPython script, ASCII text executablepython 2.7 byte-compiledXML 1.0 document, ASCII textcannot open (No such file or directory)?`7zXZ !X] crt:bLLl iF_J5׽dJTp)gR,鋐C\Bդ &Zv%@G{-% /me6yD vM_\5;!?8RGP, "`0ND站q>+%xȂ7jqʉD+0KWE(#Z^yAwj#VQP?JW0֯Ch6~nC Sql/ʴ8ig[3Q &spm:Cg?賺r P}eȼJ~o˗ Oz3b&l|Zxi h_#|И'_|S|rUӢk?^2S"RP-rFdSʹR6!;yک@=fu;qiW1x?Uy_۷,t^t¨~]n) MDn8($5ҚNV-8/ N,KWX}`/щpTz%]_ix䛅_m3/EP0{&„}DJc[PiVfG6κv! @W:B^-32!# p\s&ǞUtwDp/E{QT>:4w/!i&;"XBE sDG"9ϪOmAT/u @O̕byɝQ 9ó (=&6JaRU؜kP,jϔKQ-+!Q$u~I9:#?{!#1 bM,^a1 Ixk_Ħ3?~\$YLՙ G<xFY{ :!?Xpg XfRk VO?OphU~5j‡~Hqٲ8P9K\;!q1}c4}w5- kncbN{=R(pr"/\Gp*n=w ,5LAgmSY'>,6h;ox]Te}ke23hl b}ZxaPR=w„f_U7긅E;6O}O yHz0J65 ~ ;vt~S%N~* 䤴f7RĐg_FTxOg+!!_"ZQ=f[c1XIT~ɞ/>p#w ;z,nBaijM!!^6iӅhk?Ⱥȧ\6v.}sw\7}pgaցJE4۔<2TlFfaE{'Y%]=@lۇNbRyeY<7o2DsAKg1EtM '݉Бk̦]HN÷0YA))S_\h XP1 24TcWw6 94`*&d)*~21??" AɣyכVC.ǖq=K]ى?f;dwKy!`H]O6O5'[})1[(qB+@pm0k>tۗGr?Y&C'II.OW<[g>flz#Z8 8E6e`甌nW,tӕ-FКk \I<2JkDPIRמ%qTAiߔJueCv<|ugJ"8lNk Zr3 dQ;?kf42P}G83; T/uы0teSF V,oCk zKWrziT '? * ƙ d.(RpSY(\Q>)d,Ii75z s亖'b/ )iKGg? 5y?ƍ~\R Z'DȋE?K*[6n?ϖQiC=Tb92 n^꾫 I$г64+iNYsԪ|բ].-Cvڭ `Z`#pCjOlͤb9=&s?L`UOHlTT8^Gb *3[*{i>a8a8 490ac\-p0OE۽f›v_\j'J|oٙ T>^;8jaO 1Vz. &;mYd]Þ/:eհ45 (>2 )e-{ wÅA҂:ն.Nm~##\aF-.?9d\EywHD߼VCj2dg2j0>,oM}JаVwN=ˉQ+6=O=*R[qgGW}_TE~=@fbgAWp7}T!E(ȮA !G+ҍ~Nk/8+wlN5p͂ի!U<E$|U`^t~]0ڬJu[(gl:&vhr6d!R 0pūoxY#Tsq痿*aS@+!~KCe%xzv FaqźTpceEVRTrYO d8z 0"#I|{$+3"cŒaҟcU ZlU[/7 K;-Wp!kçt 9|c.~L{ǻi5IMf<{(h ީ2 kJp[bQ3Lf1Kz~3DX"y4*SװyL! p{ȥi8`#C6Mpjsa1+UڷN_YÓxO~KY(ݖ/#=ڬrtxbA_ւS;^n'.lPx@G'K0&Gs/Qx(*q!XRQ6*}Že8\NFy:Bx"ȇ oJ&c;S:0{Ban IOr#h*]q{@-"_r,Z[2YA͍H5,T{@d3!WJw|=\aajG$Tm4eˌ[}q9drR ['Y:i]l.+pJk4K51m*8ϣ٥e R2fk@ `gfR|H[D2 4)XNR 4t@5bt Z;礽:}4Sz83 7NS4Fe Y7 GD^pHo[BH3g'֏cL^T,a3뽱vWIi!U-S PVm_[xxMCZUk'f}pmsL{*~'l AN2 r%ow0goHĤ{ad/4} }KZ*EHuMӮD*Āla@˙XOg~lj`w{kQiI4g[CsFώh#m:]o@V̚\^2WB3lDFz I vzad5;t%'x9zp҆%g.~vtݹLjgB1%53B\ӌ\ɣ'LTa7UtEs",0O I Ųu_ #sRZ9wbT %9M%"E`l 1=.; \ bzoo|%{m ]fs őFԽM\(j𽬒JwgwLב=,B7-*+Иv,큭aԵЊp+lW8Y h*ئJuX^;Ƴ1W9;(ugF3xjtXbo~*Eza[FVSC{Hz+Z48r#/}-&$82zh ![~`lJk\ѴivHڎ#UF9)IeV SdІQ:~7*sXWU0x^ O:e0XHh[?y؂Ylbͅ7S>Ѿ]֐t,2"37o!T2&Qۏn5G=F&ܪojZ>68#Vxp~u#~l V3ؕ2{R]!%X)j곓o8JpAooЙY7/Z͇W4v*V 3p`dc쇈6G}S ? yc%;kLU!Ja9k{l-\f{ghqొbo]Is%!vCK5UJ |x]gCl mΊ6d!ŤrEy$T("?xFq3Ӑ2 VC;"\UBaUQ8CwaEO.iuOb^bYCXzx sЙhg$Bww569P ң0na|7k5Z0@dbOĚ<{6pwW0>ppbq!uˬ.a?nWkM$U:Yk-[ y4}e's{`hgxY#ԫ/yg=85[g|U%bNu!]-mFjv˼6$14ce2Pl$I ~2-i%ee@{(KڷU`c^+Me< xӅQg@%ߌT=u.aޜræ}-u)+ I?6yT C19N;3mx|kO/Z_{aߞ7u'bӥBfVi bVi`rp:_`읧 CMpn֥+F^ G/!DU+?KgD/+r c.fm+EWaegVzg+aZ? |_~L'9J$kol$~&ǵZF5;f#r2BΓ Z/+A%s+q~^x5,!8G${`[& P_zf͑VcA J,:_QȩkEuDLlyp#vbWK;uko_N5U2du}HΊFw\Mf**"էl]F>"ڨhvwo-Q% Rjugo5+p9DZb `pL06bAex"dʝY_~ӓۧsV7+,S\ttmF_)f{(}pWqĜy+ddչ{a3cBa`">fYpȉoG-|Հ=1p[ի_ 3gBoUC/=zu?YYl0~`ޠ7YYx8 ~TIV ;}CF]ywB{!Us*A"$ųVlnp]E33 T Y=Fg񽧐]wTEi6&ۄ&7P3֯vI=sg(z |65(/n=]AW+u} [7ʄhFЪbR&3#+BԹ٣oAp9+|TËgHb8wī|Vro4]<,l( G;FQdJHtQ.p%">+3@w ҧ}e)nge=5+[}3dܫ'6ؖ(8rbn-Ek#y`(Uَu_)H}l3~$5;^qwf. ~647wkYM4*A9he^6Sy}$1*nj$S$OAOi@` [m0soFj+^K3wi֤qLUv*qpzHb6HxfȌGt/T;ESXu%# (U-'b. 6̣"aniKL 8쭝 Y]LSKUPo(iDB 5 ܓXEAɍ}y|))<'TݐyT:ZJIw4x?>>2x3IM+JU=D,IE_TI֦͡oqZ.g7E*Bl1Nqx u(rx=-,^hҸ;(+6!nP*)4$~r{ΆY}ިPf dX ~#S%ą(vI)!Woˡ8K3GnO )PFfY-WPc&Y%a~Qr\e>k!Asɇd,n0&/ i+u!/Qc!>~>iҎ;I6$7!ZqqQ'[?@+NMg#ՌxX`#}L>(%`Pn̦G4[-K:sH$SURz!ɯU(Z3:;Rx@M?9T`=Lר0"2j,>_̲bJG3Ί;f? =e\Y l09_h=g|I:Vks^άs6s0޼bbvR%g->ҷx_>NU"+el_x_%M:(%;Ejy>W|4%aRYl"GD,:qghp;(rfWb@aN70ZvgOKBꪕۀ'iOYvE׍>DՓǥMd& ̏! Ű2|wE(Z_ouBDs|'6p e:Bsf{,+uh@X3Lmgay0c[d/RuǛܭ,Ƅ1$ᤓ(%mrh vQ=-1b260ek3GlA pO0C.b]s>P\܌N!ɄʣsR Z6{+b^kJ~:4B y.W/w O{ihvov:f自xdvڌK'W>iCUb [9ˮVj~}jw$JH@bZ^Fl>+2*}("E2/>랺 W+^C\){ $BYyJ"v#eb B߬yZ^Aj BlT5G)UN:|>[pS`ejڋ8a%hP<|vzHJ.<{U~:==Y*6W+kx)y_Dʕz/@)/.OV @ f uzR99op^yMU&3i I ~N4dD_CV&V8Z HI+ǀ>ˈ~Ȋbr++7(#l߾+nўSB9$8S<4XDvc-RXkP e3I(>2טR3C3̫Gz4K0.KGڼzN`y6Ň˳*bm+97|X,ݒy+nVq/vD| rWxDC* ¾|ȝ{E!r҂#L% e`(>u"s89YUk܇t\Rj8JZhM/%D^)N|᷻c-@OAkj5::=MfoI/LQҬ_:j g;Ex_}QNO!f?X?]&L0u\GTZ[;ުTCkhgL>-dzuLR3*#8 akd%W\-Ey=h䟦Ɠ+rîL51?zYJFndSm ll؋1dqt {etM ȩu! J@ekOZ G oP0d08By +.b`t/IhY1(j81(2PQ3H/Ga[ش"]U O 鄶xfSR$kݳ`y>h2yʄzYѬoR@Ls95BQ v- bs~qeU!i@6+` XZ)&F qJgS2 E@J*ԒRi 0-)\$$:p<ꦦ;X!›Jܾr$ݹu-u@#p^0ANJ171DH4vo+A9ća/]6_}4 DBfV\Ȳ.W!޵âl(PS~xxdI2z%MW@˘ ̌Gp 1oDN 6%@+ȢJ>&d2׻'!ee(.z\&!%U+@sc`XrZXãr7(uC/6^ >7DŘ"Q.ct@KE%LET7@z?ei*3Bz\RQ㴟z}KE,Vr+t3g '#}CPtJḾ߽ǀֹ'/ >_*Wʉvv<]XQt/!$.@[ P%vZiD '4\L#!FC:Ϊ̡%^ #6ƭ4}Bo!p0#5(9FBLAÁa4H-KdާX7*C ;IdQdEIn/l=eQ+f,^P-R,H ]a2d'`-|Xeƅ !s`O~`{xAtv [7:j)$I jGnI#c9-Op0{wߵo/#ꜺggzS$Y5Gdzu=g'OccLlG7/ `0veriߢ²mlG*C׮_3jSEk*q9@CYG < L9%TRF3`^ H/Ub)luyIEC$*gTkO^4K6[z*<T~U!2@zˇi"Z٪عO犆4K~*~@/Ggd.LLڴA[ٓ5c/Bn,8[|0EbIldg<#$I: 4#Jn 讽-BHP{mklU{{e$ yĝE1,M@Voژ|ƣف_ Იa5cČBL N9PyۛЧPKh==?k.eMALh㳞.}tby} @-u"'V*,+8Xf%@0e!eg5 ~wb'$}˗AMgQ`wŬ? A:[l'UDxEo鼾F?! Hp`h a1=c6FIH_Ĺ9~~b8ˆLDb"V#Ms5?cT}gC_P߲{&l*,!mgC̿VmK3̊Y'5}RD o{*[]!=\9 CGb@7{ bq 6 /A+:r):\cp.fI,v+ ;\DYIrafڛw0Fm}.EW̥E}AaQ "ڽc \?J%'2\3"x21'}~r+תvaE<֝ ﮊ5̗ Gʮu/\Sw3ʱ dwbc" ɨ9dVCyl] )8#jӊs1NhErBKqcU@f6Ϧ1\@YI6&Ceg5JV7`0d> UA9܁pLU޽Sq.*rPݯAsWLO ܨڦ]\Yd*bU !L%Ԗ:<ը^Xuљ+HN=I0%OWxLĦ*Ǡվi'B+3O(SkZ!cvr@D́k,HmeF3g@\-='\7k%=>O1>لz'Oy^9l/M1S \G q_Bz]o%A'k<&#pUXrkDFrpL4yWKjcB͒gpnצ ƿSLXXb()o:|t' Y&E0bhW!evrIɢ>),^xB;Oq{{l0>B7,@ ntS^2Qg9Q3x4lMzW>@ޅ7Zwƌ3hZ1߃=FWF3WۥRbҫfQ"~| vN-WTo!X|!U‰~.U.x)K`~-R)s)f?O^QChŬQ}Q]z)]' 5EB}O+8 -R+opB1c8| ?s[ՋQ(ӰR ;cՕ햋0EJ4J,J+\FŐD7Rə y= K% Or9 ^ɋKX%Uۭ]e83躺`qH|[~nQ%#ںLr%OHmV8` Նrf2^`;# 8DsUz^% WF>0Wui+]@RaaoNa8 6IහLmM 3S̏bm)\_ Ӂ!gưoeu(y`-L1gSccP ]FOqK)_$bQSK%8B /r9{N!`2De#{e}Xb{q{$@@hIf Y$|iC" jf ^߭}MXS 1#\ڃwF5"iD'UQl ._*YbNN[)h~j/Iml,cѲĆFu4YÌܕ)oi|F]cD9@6) CCB)V*gj%)3d_]tV^-ֈL-b6O4AL n?˗k>p@n4~ϭ}gA J|y+1 d ,;,^:QL:`^OKǯ8Q_)&eG\B;(7 OJ;~'H^Mm+Pr8_d 8^oy͚{a˜l)EN`_vn(QReUIKv/z6pbAIomef·r^وe?9E$IQu-a2˭ҟڑc#:| .kO'E@M%M\}96qM4%<8WnI`q܋54eU#gRТZ85gv~;6qTo+R OOvbdzpJh/7F sG3[_PxI#*^`1w6iR\ =vL̍E\0c|4 9pXf˾_nZ/],;v/BbCTl Q͊X̺P4B MZ;Lx7̈́F_J>XPwt>12$-qMb1#󭯄CMⱘ`U[)zU>a'D[Ág.F<-ìu㱀OsfuO'Y kOdobQKJyWh%1m,Ilm6 tYq:(΢Z/4-6c>#\;n^6~$ULڙ&xn8/ҲE֎w;/6Cki1|QzȎbl4xZɫoq 1RF0aÌ!}Hoo__$rg֚{e4+#U-Q:-3o0cփH7:PZYnik}h~_5bsI-BD7`BMڊ"3қ8#-COE*UcʌU Zҕae<cˣ^ö55}=l˩ieQN|㊨[*(sc$Yksp<ٲ*6)cLхOAP" 0Jq(F>@;Csc9p))5 V5nO'p(@S$3U|=Q+je}u?著5~  W.FNP!tuzyα|Ød>a==}mS LXXw[/r'@/Қ ۵rU^?H }KV(+L u'x%nu2fbFjiΡ6"? cFNIb%Marj(~|0w,xp|gTy-:HX*sGI$[u*1[[h R6Q^: {T_c5bӢCm ADH֯ Lޙ7QRn,R Ҥ+-|uSlĭ A $Ln?TWnV~>wY2v[ї`mt7±auQݰIdNȊ=70vBKk_Y x vg%]1`9o$:'YFjdǛgx QGl~ 8/NMXTOQ]l+nyvU'~=ɬ̾iXHfoW{}%9!|#%a4..OQ9g]~v5-dsZ:ņZpV:B+ Ն8aOʠY!~ObYyr9:({f0 |t,kZخ UJX4 CrgQ8΁✡/FӸ\CWa8Mc]f~< ?XkIE(rַ(-b%a h0GV^=csm76 S0Pa2eQA}gEbѭ0gD]ZRL ߠh>nۋBdˍ盱P|y><țqX5oK oϦl_*kl^ 6Q&rk5i[ae-ӢBEɞkݛ@|ƓY \P`CX/39^U(> lj:xŇCC?7lv`lHX_ fsa=҈_s$ؓ_ I[ӽY0D'+Vp <ɼnZ%ӫst<_ڲscP/C)@[y (L{1T5BD@ lQYO86u(@OrҚoIøR༑(l$ɀqJ7Cۮe`$1kGeh_r c-;bOuAVGBzNwV05}0xKv~Vx&ƛJg?1K6lX@>0<ʱ]"+W/;@33 xxrJR BtDbHE7;Wbj{lo\L'QH^9T[⛏.Cx^,`}mwf(?I Ĉ_~g3SfRoT T 7弳DKNk"3 ނE:(ѭyCj!P{PӰr#NEe0oh>iaT!Q'`tϢiz)5٥{ y.`uT,glQ Ұ="LEʰ+:k ,8j(;RKU_?JVbN+`=*enby鑀1NhYҏb@2ۂ' kaxc KXC3 ](X-eNl1B-)O6fIs֑۳]P~v"\]7d7$g8fb Ϣ~yo(fKw7RaY%zt5R]XFĽ (v!%!EFՐJ[7ȡHϼLʙLMqПbkJN'7y lIrg)%0ai{P68h7kˇm4>p _;ՙa~(v/$HR2Quљ񱏄/[5S2AM/_ۮ?^0BZyT?2bӨEExdxPZ†H[g4t(5oŃ,1 ͑gAM 3A.G.qf0 Y+_uShYF'[r^@4&}ƙr'vYA pr˰5X03 &r-lZ<1/Z87sRV]w&mW.t[ľ۷%7keCyqdS=F J}5&jW@X݂x\ZOO7P\HAM@yB1WϜϯ;~b [ $׻.wf-f0"L׎T!%ϖ).Iil9(|0^nOřUP ]ViVVhĸ~0y6ADK*Gic69"p+kcȷ%BӦroj"lлC㻃Q.5Y62dPdn) m۫0<8VƼa}V:E/Z^ >D'[LL/ev%L}>>\.<^Jݑ vҿz]rmI|00z {k`C&=/e([?4 u4z˜5j蔸Lty]np%MJp`!+INN Hfh4D 8Jc zu"Bu:(a@ҌBcM^,^)Yi`kr$+u`!>ٷZ:y$TN8[m֭qa/MA4k4w2sz+ /,wƿ{]r`fЛ9}4c=rG^PaGX]]Q]4)?%0_hwJs ڦsCQ|jZz߫_c پ5&՛"^u>HI\-tz9\XƀWtZOʓ T|  F@k#=-.1e˅;XT0[;f8đ_Lu/v1cȆ(\Vã(noHC Y& l9ÓV|C lz[pmz9%-|%5,ۤnfm3fChO _+By c0>^{Ќڽ"Pk0ճqe@=bó_`*yM5kLba!y&]<Ԇ"?cv^`\w/#`L 1M-9(/e p^ڳz ]WPv-Jky|֖i9sWT"aoܣn%Q=߽PU,ZBמpfQ9M'в64[?B?;ŒA2U1a=#٥Oo}0ZPR Hr>hja܎&qEXt$w DU?rJ yM1O~PQ# ?\Lih}w 䫚̽#a5ЏK$|~ۚ yL#Vc޿O$ xv|sGوF,4ol7b )R tљ{%똿|45'~#qZ3Zt]{(-]uޕc[2{Lbtu.T`k=Jj"OarAY\@e,X A6Bsb!)`l./g2P ≲S}-|7@0oal࢐0 KD0S^d$HPU'Lct| 聂^ňFe`}b"E';ᤪ3\:Q՛s뿙jR7o+B;g'V;v9[wֽگJ^/cUOg2!=`Hcp҆/r!!|6 #'"5 /RjBO ꪰΓ@24yzPcBzDqXȷnaosQ]A#Nq[L//F4&iXi;=1ԎDg.©,G<:Bt}y*9U@0ЍU mB ĵගK٭K1OKgftI-?"d0 r|;鴜0]SISf@idT3x| Ge59qNƥBzv#| " @pNbp[zY8F!8tfQ? etb'8 vY(XSl Q=٠ 8o@EIc=w4ܧOp>;A&1N:$u?1YJUv7B -w^Ǯ$Y/|<* #dsҖ4ysgYQGPO.6qcZO޴$\EEo/ aX Z~0juֽ8>%_b0_ J NʈcD eSgz]RhR! nI0w,gSٍz)֚^GWX5fYI:0{`ڕyf 'c8$9C[=VY.:.tK5B*WB*3gv%Nbx)/m3=r{MqwourE` cnEԵM7 JnL_b>DK|daZug奛ey;s]m8\c?"Ljr aR͹rX[~v?l0`?K?ʒyt>E tg)J+*{gif;ǥzpXh9VȰv֟687S^ecsՂi0+MYt@06iqDJ|]V'9 B,-RhBc&\@x[YC 2nc bPX:K%+4i,VMGB7٣ހUN,]S,x`_%'rmڐ=pN;` N3 q wJ9m&-c583?X2j(iXcJ'yrNKaMlf*^̀q>d$7i6InۀEw٥.7[8 _P(bZZ^F\MТ|S-x7/+{:@ZdiT0_ꡙeq츖]N'RR۩NiHn#pD _g5'h_] QszXʨҬ9l.G{n`$?%2HL٬~xNgadq t8Qhg7f1xGjj>Fgy(InB>uƝ@u@ޟD)D,9.>h ePCȤDyZɠ>F \OS6>rFlɣ%j*mk+1n䌗݆ϛ΄zvZ ĶYiH'i;6#}ȲujxfL 4^,B!n11z,~eN5(=ߜG{aqR-h4Bň?u瓐MnRpca%uQocT$ցvKKuFPQ?(}&!O[51I6mT\@noC ߥL9; &nx]vl%L M%Ŗq6g2pE:]WX!E,+OC oa{H ޣ@Zo:KƱDc۽ڵ̥|P+}-pբ??'t4~̔jԛd!~-lӡB\숎йûTj;tO(81;@Dvp6Ô)eMWl~@ ~b>-0_!-Ip0+E$$g[TwWOV~+E]洬C/tjPDc ήK3s.`š} >_9QQ/7"#XFmlo@7]CjW)/Z':[5 CF5d?xәiR*ih(}vŕɄ1DzߖsN;YA笣2=#Ű:`P 5@tm AI69a!paJaX֩[1'@#26@7%Oڅ^OD>H5|-8R31eT;8히H Uz^HiE-C>F#49ރHp/h'(M> " SW\TbD/\|Q]{m[SzZm_{L# XrɕPY %)#Ѽz,'ԼPw ~ ;XB7*wVa\+c7 >'+M_͏w5l4bΰm|Q@Xw{`o{32JMOSO y}n(޽~0(EڔelN1L|l5+-GrBd9&~"X=!Tmz/qqR"`;sEGauNGB8䦦7qԛ|ΐ|{YLqH'sr)r,[?'62l ]m"s"36 q}>n٦ѿS\%WpT핺4[].04OԭMʕ- H-srگ4"H7^c3}_wKL'83bS{|x?2s〹PW^=8V,3V@8?`c;sgJ)Zⴅ!n y}yn?`m6H {l=-,1rX@Lìx3d\hv@'D G,m>(Go]~3[Fh>J\\q9t uk'z8qT )%Ne:{[]FZ5-;&,w9;wagu!#qz"U.WzxI 3.Cџ/;L窩6GhݖgyDMPW(}#|Z[)G+J1㥅ywoJIoK dbV H4ÿ[WӄKXNT<bSﴦ%#a9ԗqy  g yt}ܔ^VgȽ9%MKW//7}\嶓0{}1acZr8%Diłyݠ;˖ !onGsPT2a֥謲Bh,azĤ=X_~ ➹4wad|ﰚ)"82aq@I,yxz yI-bOcJ^)&HNMC'Όzg$F~hˎ1{]&fvOnb^gj:`ܸ:D\WM.SLJxB[Q~])*kr0ˊz w^}@Qt қS/8ϣ)}_I1k])i``a$4ÝV4BpJs*8>8MT3LRNPcA\98amSI15䁸Iq<8V*{]ҷotld3ge}2q Z6&6kȢҐ)Q3u:8Gr4 Ĉ_.X9d@Pt{(QyKW)I$d>u?|ٮ1{(_{L ]r`ρ!C]nB;^yo~a/қ)/b0v0N?|ZA-~}_M#DY?,_[+ښ'|V?6vum"7eR.u8~y@A0/w-*v˸^ڔ g˗T:j1Ylt:Uz[w=v96%]#/ ?il#%!oJ1.#nKe>Rej:J *20(ynh v mh_}  3%Cz-:LgY iOJ;[VY>*r}d^.*wVi} }U>a"Ǘ ;+#Q~@XW svaR2rެ(ֱH%:vPکPKPb;)NAW*-ߐ@Cr^ax,쩪3[!PBћr dbr((s{"lEYʲ29♦4EL+ه}QB$?ްZ@9jsdsyAғ.^}ͮ45c_.olnH@C2S0Xw4X;]jTHx'y ccD'#}]#$C8c'0ZD0O,_͂έZόIzͿeu2/>䛙@j<=AĺEY5KM>wpWF=Ku:5CuͤboԗyS"!d{PB-b:}ǡ'ͧ VPvYA g ?vѨ5$@̰9{,wʄC=(Z5gJ_kGf(_Y~JĆBXX|~M+M1:6ܥ+/\,dU_#O=O$}QÈk ѿ?8k'[FU{yo(aFCx7}9Vk0g_tKl}/g 5L!*&6*S~f'L@b#F G'>|Bd¡>@H̬`d;QfXv &8)4vfz3pM*'~9zzy">x. _#ОL{IK`S]c|SY2wܛȬm}s+ZEqlk)k8kr |wtלcBPT'C"\;;<'L˹rΛd?z.zYCEDC~;): 0x%ғPV3I[S`AkH0pT<'? m?yr̪O+QnMƉkI|Oōw*"踫Y<0uv)ݬƬpr*Tp}.Z#h" +eTeVLbu5uO+E(_.4 @N4)\\~2^r=R޹$Lp%қtl(M?v@z9P9D;ƀF,"q5C1]?!cݒPŠqMYNgi`%{הx؆E HW\~v>gd<4|xrpK)F(}d\jp7C cuv2⽀W,zfП^n̝PZGc S%Qh{vti 3 nD=P'޷,r|4ϴDdMI k8v@YkWn׍wΟgFL5ƻk vsD7d6^Xx :'!2HMB XivjVmvYs @3;Ȭw|U%r9t V;X +ܛ#[hq{,mHxb:-3B25|nƭV2/q L?mKxإz?Ǜ2C)XA4 v2 *;%G?v}Y80F St-yHʵ#^eM1DYEu:fR&T[drOHo!$,}d`U_ RVˋ,:٬8%>&feO-w*!/g5$4נT@K xɤ]c\zFaY3c-S Rx4i6@C9WCbU_o띡3!x-2O1:tڌPa)7822nVƵʉ%Y KU RbG{ę=;sL!<|oi<^+Ft˵<_B؛6ʹKl/0 Dq#ya#uH"rʸs%oqՇ"/ /Ҏ?)˜e<є1SĈ n4U ] ^ͼf\k+"h-o]jSSPLNgۨ5E?!+CLF`ԌPJ2@) =28[Qö2,ȍN[ oD{^~>x&bϙ ޻r(s $ k@r>8n[ ΋=dgye*M+•02T _jB6\-)v\f^*0Hu4f A4`#xphh XZ#6M'R x m9(N$Y9}o8Ml5e7C$ dxYv3:%q0[9DGMV=&(x[E$j4oD) vRꬍ Όp2f?ek鼦t pǐT{"Ӷ*k˵z\ip6tiH HZ%H2g],z[~kuVfȳOaSZ+DEQye9% {*,^ӓE5x"ZwYm*uv=?\fpj;k'TVG>:M2k҅HW!IO#>8hz --lUVIljz.^B| paq ZЙN 'W][h*p'~Y ZG &l`%DV`=`i~}z[}rnӰҲDOFۜjlm*{G42 R$|p]D5;ڛք~L*C/I~J̋MPzۙ &"DnI Ƨ4XQ1tZ% fƻ |&.pDa@L20 vsh K,mST8 !|;ǿ[{yU?]G̣uH2+*^4?Qz~ZC ݉pϘ |gR#w.|G~ʗ .lN'͂1,n7ҥ@󿤾ϩpa4{}]r w*lcĶeA?#rzX,8!obHZR2g#Hg93{,G_&Xeɤ{}Lu4 yK!twSxwLS98: "Pՠm~3)G{l*j 8'v$9qTlD2Ud4n'#h^dG՛?,γvcq%ΰy83e tfIXr6+`[Lޫz0"x܇6V +\ ;Gr4zFeSn4tQ5< [N1} 0>+J^) O!mс%ݒ0O׈1\.=7iaCIk.J|;LOc#)ܓK 8(z9\khP͏'2(kk"Xɠ_ h.RZr=B e)0.R}?_O5c@-*/"7(>NC2v[5{>E~@^P{CEM\ Ѣٻ ò = 9^.ITNh[NǠ.3U̸)jf7:m5 1Cq. ,yܙ:㒅a@\\yJn[EgJE{- n$FËDKm+T<죭T~?tT+aok [BcExi8p"9&D/Dgz`=`(ɾY#-ῃ҂L Cm"~z΄ZfE]oQPMuŞٜ K2_N q'v 5/ 5!.` ^dNJtI7^ylzuD~6 \d i̟fnx06$Ay<~OB3ege= ` F;l:QO#QJ`; 2 NYtJmY@$53֡Y9Q􄸮AP0/s czv9|jG:u9)MCM_Fd9ID8k , .P Gi% щ ,ÏeIOGs(k)UnPgVIQ_&gq²sk0gvzO;{vm^juwk EP<ʞ%.vK\O5ATsHŞѓBٟi~UDenolQ`f}H~%^1;%wX ķ;C銊+Ne蠏 9+$XT䶨e\fO1brLGE_|¨d_H(Cð0Rn`c4k*h[)=qRu>ަk('K}8g07C#=GG Kı=e%{.:DZuR{  F^rt9mNNF\?6D~L=E鸵j]"8f kYgMJvji aw"tk~~o"2JOwF!k =)>=&;8@(-^znH›2\.ր|aBFı%(36*Ew?2 j EcM4{}º\^c%Xj&[>P$f4ghֈJ[4g|NJbk^f-KqZY;c-V \k:T&'nf"iʢ$.!Ʈ4(WggyNv9$ vxp^|Th;J]MUr_pgg;U~?&|< ]M?%y4{2 &ABB{"<#kYfwùqH~ʌO "s{sdAYb QWukȖ6>J2ˑ?Co&-`)L%7#)QWwp^b(7M[=i)2qP i43fcI[{ TqYvN0zA9A Ȗl9-f- -11^SX(N/ D:,?=ɡ=D.3>v\ /sONڼ"渳=L(%=?wo9kwP#':@EᘔVVDiR4U*e `)i pLoDYMg!RV ӛWi}fUօ74IQ"#Zi1M" 誁7eV=)]eUgi6BU@mOPM_TmB: {hjOYRΡ| $cX6)֧}S.rlEk)>fu$ks?bHN;e%ȄzdFb2c]Dk`QC\ c$PK$ٖL,&<~_Zc`IQ/XzQqJO [YBsڀ=I$e_~-<c@3tI9b7MB~{>{l?z)52 myOYA1t3.5B?u"YF>5|Yu-z"C:Pu+'-ݪŭÉBsE_ pq)0ۍfVE]KSysR<vSJ yt%YE&"8F"X6ḁѿJsKV:z\%,f%c&Et]Y?=Jnl?s[f$qjO9k j>RJ^,ݺ1NM@3sb?%PWxVJ?+< _~(C&h%$m%C`$9鱏Xj>-57-TlB:u [az(6~b̚IQ.Z/I(I!@kP)^_HIS2VQ#1;X{w Փ hc/z0ڵ}6N zigc t:èrX$L{eL!MOGg p~EQ(蕅_nE93''#L@B͛✈gEϘkc;dY.D;*'e.x$s.A#Pƾn54gP6v-bñѮ*Pk9 + P~E,ŅJ0*m 2a ,NZ>]CѶ^8+@vOwר^IbA(!梑%BȄjc9E ^X21CVef U+,VЊQݯnyC~2t_ gil*ev 0+F!EKg@GˋI)*3+P-2bѺ'e .}]]cԌvz4FaSSBGi,!max;o 9Ƥk~:5aA@ Lp">Ln)φ3QC=׭" ,k9B[z!Qhnf:gv" 9vQ~!2myŒ8|tHϵ%mNy1SJͥ=%#cKpP=d!l 科˝Yǎ٦trZ7}ok;^k\͗Gi<*.dÉۡQЁ&Sq795.sM"yR\va]QF0Iƒ m.ʮԮB=jZnR{^xWN+9l4F_'QTJgsẻg(Z0Wwq:~o94 ~}4D]\2&ohY/U~RK/HKN-^tK<rLw27 R\!% Ec s%`ZL(EQeX|hO]iEG5 xi=EK|f!P,o;j+g˞]wUz] J^LXuQi5=nR'v$@_З>,p729-J`֌ZLֆi?eb&όm˒ST]{cʤ*';[TLSz"[-OEF\neEz* D<GX+[WolV;z{O({,ǵD$EH5,8~Q7ѝ e@,Evz /;9дa}.~8u8)A40F}iBcjFbc-%x[L?e葮#e/ Gm/,!R*:&%MQKՍ;!U݉%a1 ;F<)/ǬXO8)_[FB(,pvˏ^n]Qbk?j v)Z uL{w4,SWkY)< y<=IN )hX$ܯJhX6W Z=N=}l }7CWee&~X :'Z[gHl}0%qwPo]"nrG#V4hS)G鎢Q]K/yԵ]b?spj`i72,[A'X1~"2A>KL^X-H 4(yZyXWbok_Axjk:9q/͋Fz`.BI;u>P*]Xu# /\*%~ @fHh@2sA,;M/!3$MYҿfۡ$7QGK'Ryt]uVUe.CQW0Eu]j$T"86KY]!ʮƿ -_r =s݌K 7Td $K&5 _~L+Dӎ,H}lh'#A-7C%7U&}3*s(fC^>} a 3 ߰|R1O')if42( heE(]gė!1s F r]YjڹDzU]!ۿzF[1*İ;fG\&cu=7C|L\(gW4T9*Ƙ}BIsjԠUpy(]ծu:MG_ypBy.S@°e+~VVN憘nt?glj:,%J-kC2CuRԑqg"|4<ۅxhQqs=Aͬ+b( a<ǨSAJ2-kPm~)h&X^< $;#4 = .'.M9}x@%*m߀.[h: UeJ<,Z;<#S˿e~(ptg~)pF6RF+3T QvăP})DQrh~ */vO"2f>u.pߧI JD<4>9-Z##0 }1 9^Y͒ymơ6^\[ yq%MЎyc )vΉ)'Ty53 zg/87Ht%v$d.6} -ǩ^d8rvLbv5e~+hj܈XQ8teqVҡ=t+BV C~ 61٭E?fm饜J64AkɒʉDv}'FCUerB!Oi `R0¡w^ O$\IbaV: m|B=AMiٽI!yWuE$`T:Z،/t)xngP,N (r/|yeRbZaIgi>ZY0}uURڤ c>a| Z%7au0Ҽ1n1&ǭsgUWčXs%cV 6CXcNavw03-MlVX>u 7ߝ)d?q~/T] q+{zl)O{M2Їa{>k{yRG۠W['Yb`O(XVښ K2 cIbDpw+'Q}&Xzue=rF[T3M+,^JLY$j FK!Z=^ۡG2 "µfl}f/V3@@,1sj8]g 5ty eZZRh~2OM; l[gUw^` H^C2/ (,偰=zShqgMUc og&?f||%)"%H[62KO?'<4W:$7wdCTl} w+I v"' kй}=SDױډ=/%hDtb$kDύrVWh'd\庙SD-Ht@J9[𯻄NCZ"5f,(!'T䰘 Qu:2IêYiol\P^=(-U?ag]є %{'B}yFCdY BǕ(.lyrB|?˄|Vl289JlC0 -fՐD'AW!"Pt7]qe0$<3ʞj`A0K&ўؠӺ3j3 匬'}1+W}N}(je@ͳ[rȲ,]>B+=yTLeȐ o T# h_~S,p[;cD lV&@E"q.J㉃&@v`(pi΁}ZwG1]D-\G ӕG ս''9:$rsI5'KU9ne|҇eQj\SA zR5#MM`/_Exl7 *CA5m I+`X08(!#\ g]EiSjSM8yK{3nmloHEXXm=Y En=N]jm?bOt6k0 w?B8!p%JدriܞQH6̔8,hmT *W$Q7 7eyd/ᥞsDY)5d kt,1v&(֮_|2>Fw7'ؚ㕞]fP6ĒF-bZC!f(" q* yFkh9s~$"1[o-naTY`4pɺWFSR$}Ƨs{jsib'kZ,P`{(O Q43hշ Q'Z$ w:x?>PSԲ#C6H{i:g?fv2zMkwx۰>/<+ CI'ؿX>2(~"6j'=@/og X_mzN[>Cgf2IN E*˞nvﴠ&/&`ף@,;oOä8QM~"EQ+ 1ͬ᭷^o$=3Wxvf+.k:I* !/xZc)]`hN[A]; B 6`+]gAv+@O ^7 Ch䷜h,4v Ѷl{ݗ0XCuPfbݜu&.Pbr9Ȉ;왋@I4;2p} !M_Bװd[[w8/ZO zy XKJ|BdF-blY)>I\%t%A'̉n|z" u E!w&Uf%nVJ閇2c[(D͋KΔ&)M׏@~i"taT큮vsWRխYU~6<)D)oFXpv,' Zr7)7Ƕ"t@66zaޒ :/%o?F'ߧjHǒW+5"oƭ4<(pA@Faqӷ~D&[ш@G\B^ ]R&´b4Ex1E{f1Un\lBיKcr#i8L8nWu{U ({PbFQc/x ˜~Ee^0lxl cDpNڄ߁)+lOru]qYUڇs0$O`i54A}*ŔUJbSZ{NڊC \xd|W͋t*F (@D~ԁr+pkIZ/;^a]Q~.ha(By}sK8R{͓DJ#M-t B8䵪s91 %P5.K;'KʣT0t{8 "F8|$!ɸ^\73_p JFGm?;gߋV1, % "!Uy\mn S,< Ru#/1Iڽc~7F6|I7xSXB{ɱr?aUo&880-$/RƊߋ$L"[+k 8ꛙ/8jyz~oAʗ;0#QAl`EXGc#f=v-ga`Vv%A1{|*L HJ'"| )Im?_3I8=SKBݔq8QNXckфJ0Vf ~eg(ce3=b]c9kVI= J/^Z{@Ltw{-6Iϖ3,H`#::`ٳ ݏ n|ᛓz-;B=o o3bQEwJR. $րfe?"L+F7t7YoOx5%kJ9T_+ ϿmeT]vU:f\$ӌ"\&(VUkAZQteṬ̎0qd2F<$PVt&it|msZ?h@IEBȵf1]I\IOVH-6-eȀ{Qb!h{ t*WLb*öGGzϤ#9-BfSP\]luto< Eyzz߆ 9]qڷ (Mto$ڬ~?>F+/ gČR@;ؔ_dL!52B{ BOn`fQܕ~wD+i"ΚmPtuKgϵ(xh2OqgDMo OL|Kx{fw{R&.T%aOiV_ZPGf K;9?䩎](c*R⸆;8urmӚWoM8oZJ͍6,ڲ,kH71(t-ԭ[hhxw'yc 9ϸXƂ,N=Ұ əma߆zE;oFKǭ#$:e޴zV9JjBĤ=HuثҽM*+^WFv_R], >BU=-%R:znnaKp7Akq~,j}Ox~T./SilS79@]9h?svرܝeA-1DeKqtxLw\z$ a7R!>̶J&7W5K8O7[nD*Jkބe;p Y@FqЫޭd_Yjeûi)RYQ_ ύL` @%kGwihs ʃкH.m " l{'C3 DxĝS ̪$[;7gN޴2A%Fdz r5àW;wY h8ul'5a=?}8؉HַmN~:0q`RHή˸܆h\oNŌ Gj N{#[Xӆ@rYbݭx/7#1ڔLiw}? [*v5?VY}1$=uP~Oʕ̫M(R̈=ʓN%ʑs})ҩo`$!fR;'F`pJPSﮎQS6>,2j *X N$Ia-AS  YR8u0ir5,q7 ʚY "B,~r :q,qN) ľcK_#,#| d"U.*7Y{K"Ma0T ^yDo;f{lS zI}*x ,d FR,Hp+O _N*U#[ߠSH _nuE푳<#KŤ̒o& O"Чj{[v=P/KV]L!G (0]}݉A5olVɐ *Vaq_Z5.|UX"Y ĥjN7lK%NBڲDWH$(dٹSFIpBT Kvjx<xH/+pH+T| @ҵT&'LHK{_8ª]!?M/Z(JE7`)}ߜg D6K)K{6 w₟֚ͺt΃D{;L5HhS#v": [J]t V pp/VjjA&7]}u~l{P =Ii+\9|PJ. o:Rw %v0ҙ03EPF]YLN3 ?Gp`HyŻZoQ4Glg8<4N ~aFM4&e1LgP,)@Im5E/\M7`0=9֥ZL} Vvwźփ6wTR L?f&ی}7dۑFJA:ͼ@b,j/ϙK EeYw*sE0{&E@_ED]>\jNsaqFn쐛jHx&n v$l~I3|$}[cmAT`3~u2<6)]֗nralAcrH1>:z u%5(ߑVy 6l0-/45׮tnl(ﶾ]~V-Q實0,l738 \6$,QAxdw9BlS,ٸ䟴znkEZh,U]2ŋ &ts/4:!]OQm't%& [ᕁ!7? A4C!ɿe# !g "~ׯxRƐjS=G[M)U |ԟy]7d:EުԵF=.*8ofZʂ6Qs+~˼K~yh(c.\lu< 6禔ǯSi-X;ֱÙ:jgOTލw 4hZ;pu)zv6Nto} 3^4(RhL\٢Nvݰz4+[@LXȻ0 p`CpRymx|G!yGz(X;#S T'FC×|t[f$#̪Cש{('O",~ i4_kI,d`:Vʼn /Hhs(ÝdjGRAյ(wBZblLjƅHްzM>Kq-&(b+|_4?r}kAJ}]Ƃ!1!,2˸!5aVl}}~*kړk -,eb>ҳflX9NF"L~P!AxľAҲ%ɍo:$%=~n#Eéf7( pJ{RɆMV5S0|Y^ e%yRä] p:~,*hWF#üHM/+C:ס|"7:AsIXѽ$#D)mu/>e*-[[F)!hоu}%,n Ҟ?\(݅'wlUF:=vp諭%Q1?ϤDM454!A^X+!"#RE]iF5Vj$t6`}| bz0C ¦F\BӰWvo}#O)HAo :h1_Uپ樍Zcg16$ȪCN\]]?y_icgդ[20+hIAlJУnehdW¥n=h\wEl$CAx?QS %*߄`ZAFn.g6<1:nٖ51KM qKi%(4eӸ3x7Ubخxԙby [q*<*klYaJlJ5EȓNg}#QCRb:~He)X*ņ։%g!,kygd &2%Dv@-@\8&kMۏL4A4D kIXn%PQ\'3f>惆cňETg=KHPZã\\MAy[eD{CL 4^+jk@b; ܌j"⭊Ia˿?"EY7(Au9&if;S6]O]ěHjJ=y|)'#O+3'0MO>· R֌RY*7 n"g[=@Bc۶J*5wJr* c)qDO$)(ٹ gU=$ڀ+˳7@)C>l 3K_Q-H!mn&yJWߖ>~)dlBVhV;TBla5 +-3fm32Q9mSްdBXFާUh&֞/cfgkulocK-҈3+hB2HPΖ6 0~_=I3ĨsgnqO0Fbp1S;0KM&oB%VGYQ,ri Ey&}W&}V ?GJmc5RȺ 8'ptF';{iWtfnjq:59dQ3,M YwN"=G&VT A&ޞ?5i4 z^Ң'S!7<[^X<32$['drzqe2~{3w0V;=2ě[Ռ#PY.w8I$ %y+Z)r^:ؼcoPֵߢIA]æ|6^4ulj|J$Ѿ9ӴO7^U\P2s,n!z% !K9i#84B4D>:5 R evxê&tSA(M3_]/$qFM| ċ[`)(.;yu(nJ Fk$dۖ4OT>13#IW?JQvPȟ2W9y}C&1nïWޱ(-`>͖7'ZuydV.]riṭ cC)At'މϳBN4t8q[ ,> 1kL쒊֘n>1Hz*)ڪ3YZCF@$!i)RNbĶ>Qh4qL;!(%. (KZQ>NN$B֮B"m#"VTٌ'eO0Ҹs^Y~5{Ll`'fէzUd<-PU7b%fdޤU !l2o37hBw̽6~_Pn#1 Ōӣ{I*%u P_IJ^x(~I&&LY1d!}y:Mmƅ/:^@ |V-!Auw0 e -\E0w~F <9h|;\Ht񃋕pn[]< mKv!uT ka.HZ[U{tdWUA(n YYq^H̭1^51sqR+P{;_] 0ݲGvxq.e^aRy߈Nr.X>Kk^򒯤A3Ԛ3-!Ȝxlɝ[wX?ʺѰ`_h|Cג7eVktI$ 1_$a޾wpdڡտ8S@,]w  'ϊ2|jOV.֠g)v}bd8Q"m=l8rosؙH9NNF1_\iH -=pif;CCt)$u IXQu5sK0舠FF|kKB F/ڥXzE Tx7bɭPŜ,_yæk!y3;\UuJ+տ P=y6ldojKSxDM‹28R;Jh.ʺsꔱ">u0,fC>|RM{\w--]˽M!g57x"Ys}lV3jk&=sL=/jTE<[aV֟NyMcփ~~ ]n Н>QKiy-~;0q Γ0NIAkrpY|' )&PxM;8!tా_Er;@2gWˆNc=I{ 1InGTA_~D⧬BNr}fϾ*tIA7Ͳk  KNO2iJ_iaX5n3 RipZUo=8M['q ER#vүlp3<^ѹGHo셱fNR|ERBy- F9ho>H ;qn c~6`x eԙ W ,]'ebU`F Po|z6$mpK\Q@t_3K HDM3|FZȮPV/uO3B*BS~-s]\ܤ{&hA=j&hy˻\dZ@H6X}urT"B?8A<}^L 3eAEO}B@lxVnsX3e3tʠ]l,t\jaz_uJ|1N3BݮXTo \"l|  RM/J.6ɣOVxi4$ ň1۰xv^Aރ) x3uZ  >gA[Jp΁9YyLO}uDƭ'/?:vj׎uncoX }րF"~ޛ6F ++pS%l״LB/drFgbs;wɌ5DX%sc06/ mtl,٭`C=~MU% E0 0sDXgvr×K&iHʏ? Ơ3M|v(OaD^N\yc/ u)砂GnAv6cI0$<!-Mm <$2LD*/Sr׽_N&]MN΀+V9Sp"D=`݆fJtLVֵ^jK1rJAs2GEA0V?T}e>f ?۩/zRI8Gn޻ж l%U7-\I؄c~-0K{{ŗc oh]5HݽW}uJQyYȷsX[$Ŷ\ %O`:gR^l_Q8. v4UsϢs1i57EK0' -(˅Zbo*ĂJIp?2ϓCGBFgމ|h߂iVݹ@>^]M[*`T1r*v58 +X)"%.=Cr~vO0NmzYMO A咬?~PRtŝЪ HJtc^Xb <*Fv-%@ҭlmE@ȟoub2fIPVC=vqdfAp]I~m2Yez k΍)vc;Y1 y}Ab }2PkJ{JˈN [Lw { ~8. ¹[*! 4-pu]dCxW{ 11'2>&΍ INΛhA U3*UL δ嬲pW&@C^S;vDX`v웞*dz8 ;`.:=R'r,m'î&>i%6ҏd) 5<))ܮ?}3еI7P&ݓ>'qlroj:&XiO ^nԛAcm܁)p8YOېt*5"BOy(p#>)ǎbF"]>\&NF@ s+ʑa@Z)MJRƾ#@&ķv]#.NInOij$U%!ĊqS9 9 c`)vvn$ި"t3.Q\6yiO>[%vw1Gy1`KqƘ R o-΋W!Z!\oD[b8CąT^DIF!ݮ7(p%nYPÎQ:MC5.N1>@o9Zf.̸t9ojb'ܱƗ` &D#VB⯅WbccPP?P#AwHu$$B M4xV:McfMߴf)~Ou j;eA, < I^4 Hwn8^bmU׻A QD~4̫w"JTe$I;[qr(ppqa~>zl]}KIH ÉN`Az͵"4ŵTLDMa;݂}X7GN G[9dca"#-S|Rs4d%[/o֙S1Ke((zjoEﾨפ/@eX!˦OKDA 5 JDCH0ClDvG=Ē:=LgeqG< ͨ1% $是} +SgIכi. (<ucw}CV"aY,^mi")uI Hnu|ժ>%@'m6Iz+M1\^5Xק+)kJ櫑.FBId73 Ge,>=fA 5g[nZᐂN~&}du㧃?KP?:QeŬ2I;UCၧYQ5|:%ևW1bԾ'P6| m!YZe gCb6H''kXukh.]@ &h} f͗9:bC5mkF6# Ab\)Ml1_U~Eص&e S^)ޒ2 svyB42?.lt)]\ƨep LTC.<'#\4s8ߘ? :3Ke5_ QT 85<[( ϜI&<4#fؖ}4]>2`RJ~.ɘd6NV΍ܵ;&6t3AH)lΨ͟j hgb{Zl9`q!z<@$%EI,͎ lŶtMYkVr1iQ&󷑞"cؿ^%t{EK>ƷGeLJ9%PbK`vϲIzdI۟e6Bn&ᇊXM3ڹ)9t3ɢ=MN"I]ci =G:Xe;LW_k\g8@e(v'S@H[K'|&tp6մ?ӵ:*?bd8'lz7mN!+)=3=$`.trM:0` pߍQ;&:!m}P=Ptޝ<N )jDY;vaS<1L g?!#o90Y{R಺ȡĆA*l@8"VWv;(4> QU'NEU z=,Dz7Nm#<;@mWw2֋ERQm7-aЮXK*|VeHCwNQm~stD#WCvq|CNݪ?C 9ÚK6~ӧO%5ş[n4iO b:d^eƐ~\~6>ƺOTNH<4RCpl &P:űa&L>CS)'Qc/_.mzNWi }x-=1/[&#Vihe8 (V^z6hxyGMihA|F_FYH?sNe?ǤĴs(<9|TTL!fxwbDó^Ү寴5,^_$z هJV;fʂp߉u]ep;_CD߾tʎ?gґJg'FS A()&PW[uTN,/eBK"8J:ck+TIVTK\ X+ ! +v:֫l.:;Lg08-Cbq6*R&R1QHDTքP`;fJELY+ʔ4m8oQ ptBş^i*`Y1"! #Z gMӽ̙֔$o:uk>yYLLcK&t3nxSr/:1UYO)ȵ? F=0ໂ!тW4a\wsp V ИM$!Ns?g"" VכT;x\ 6WsL)LK7ǟuPDv z-÷PB]x[lsQշȗ^`ӶX0s "a|M'N~nv^vv-iʔyR y ߈h60$&6H&*G%лBqs &7!K]>?hG(<2ѱ@IS҅.^H33Z]^Qq2O hF3)jKf'zT&oel4+Om]N)w.+ip bgs]:BLfltAQiD[}LnDYE>񷜈R~LiӨMA;&ݘV˳i㺙fʹKFk`K}kcZ:JjM hQ"%%Imw\ATȐDeMwP&8\;v|IOq+TiB$y^F(/ G ]> o^w!@:3{ AΝeY/3lZ5is`}(9亘RTK:)'|Cm7C!*i`)&<֧(iš]Y 7ܔ^)#]CW@JԞr&K/z!ا2g̋noJvNd kDEQ霋8sr9ŸiMz Zm,pmݒb蕁DiZ*0]8!oTANS}f'PUM&dc|'ِ́CQeɴqxO c줫8,k$LЃfA:±^GL>@8jKTVƂ F!M\<ѽ~}V_D$'=w-k7 H%>ԼZ Rm)61w&B3Ij[\. x9Aϳ0,-JqQJȧ}–<ӐF%z}(BӐQ7QCSR~%iny-n"1ݒ_Gh Ec/y9`*I%rD%^QQ,.øITEGvÓfr# Wrq'ӈ`seM|Ǥ D,&i9 NSH9 Bie̖!Lz^/jfSjߔdZIv0[K6EbpLzWW=Fv..V?=$_[싮+A[#xۘ[{o$W8ӻ|ZcYH҇vPJQnHU/)Va],Փb.%un|(_/{n{\͝ ȿ h/mām;ro(rpq~͡ߴ q6 qHF#g+^6 UI7japen.4Ȧ&@:K$VQ_7^4Ә`gM614#$ W]mj(*VJ]_DiAK|\ !xkzA߳:6ʲiI 9MlC4|9lf\VAQ%U+k6'$I4B$TxaVUD9xzR)7;&]j(z*[6Ѽ3#Îh,E Ch&iϓה}ؼLe=/-F*Yd$:`B!Aẵ7 aζB.z_ xⲯu}y@D 7%_0<+bJU_NE ?ƍqgS[`*AQ:kҴP-c}1q}q2Iq`Ew'[^>SP7B3D?W/71tRJ-ͤ?73KcMDcg9уqE1#+`n :bf >p[5_kWv #斁x'TszFPH.kb> sH!5'3t N4$wl}/e/6XZvPN)㿡؋}Šݓ*RϾ $j~C^۫p{W+ HسKZEPZ.YÈ0{! u/`4;$ԸB CmO!(Y-_rٗ&j&MiLUu`aMHlY"*S/g«u!8\ImNN(&{ΒqԁfJ{}ilrn[gp`9\j0XA!x!SFŭ}BxObU:;}Qws3M'#.C PH% đA10&Fј5q"ioW/ d{k}GC|͒+aHtǮNoߋR:9)0_ ;7t3B]whS[" DL{Qq_cf]4Rs#N 6xsaOh7\&OL* 6kHLC٣+-0$%#BHܢ:-ɉyVKBj6%,;-a_\+5؉ ++N("][*? `͝<àsX Rp„7 ?T ҄-FFף%Poj~EO.c`d1SzCVdR,w?W\ϟ̬Fj?џ|"t'Mqu(|2{DNYX)Ұ 'OmK/u+pH Agڷ`@ڈ|2Т|)yrT爬xh8jH63VȾ▕\6Iѥ$>mkZ#U9mGNhĞpeC ^y$?IKw:5j}Q4i\x8 tN}!]%RO*o`V GtMfZegb/fsyTR G,1"by_@cWB*+۪_t 2hys[Ȼ7l#V2ɬɝnJ]Icr-{L>px 6GqJpqà;Xlr r2'f9P uד.+]HZ^*oN'9(15ذtu Cħܱ7r7Qg)AJS\nZ`gN>iS恽!o${|M1G,Pǰ# UI<| bu' !z. ̩pീT@iw߸>0j+Y6ْ𗖇0qE@Oě,/yYu p󴃪#e E/c!(bN 9zl*^f%ڻM #Iyw)(H.pCT6JՇ@K4ݑJ]ox`K J2BQvA5(еz5`@GbW{YyAPz|yGqG ş )BwDs8w-:/l=CЌ!BytI)Rkq_GsZ,7*{{N5hIHPr:{,`li4} >#:qsx<*89KM< Ѣv-B!ٳJkǧsQs1nIy=/j] zKi? hDyhvGV[&M  \jKO%_1!( lUA~{Bo{r[r&xH;ӄ}ixVŒEU׉3O O)4??5'4 IYP[<=24ՏBr[ʷȣEoKg ;eN­DxE:/9|w$iXa~9 C0 C{Hkʍ+_ߕc, 2=̀&P3"٘uւ㥊jڞw`9@$áfomL BgHZ2vPE! è.L1V :MYCm/ |%ؑ=Ф =^\i,#\?vZ7C?%nh a<XШ^1hW<4ZSI6"䄞%oWnNީ 659hˉ'{Ty.zJ_< \Dކ2y ķ=iia11EkXlJic'|5pLId%-.A9R((9CtܟIw+8}e#$Ђe.H+L6l;OZ_ŀ\c c[D:Lk(h*P|Rt AN`N3ZN~s iG㤼HGX՚LMJx `U6fT~ ]!Z$Z:OTy/n Ɨ}7D@@,sF)];} g*ų|Ώ`08egif@wHI Mi7+1deS_OI+6k**D5 Qʌ( ǡT2CjK.S!~AsO9~,MsxiO_n5)[{ϊGZd6#Yq/h2G6*[f[u1wGVa/3_Lr1F6VcҫguME_y6H+gܔҢmi޲9070O!gg>ut5 !A!fm7PkG<\%Jр ])PQ,]֦Ug3@HUL#̠o)&l?{635m#> м .¸Kbv5]rb:Bb$Zk|pqkjr>i`n&$6d5XA[9<[_Jga0{1;h0h 5r &z]ķjÅFF `̭`2ߐ;[<ȁUA {_BN+ޭT38b'+`yи I=9E` VXiP4NIuMѻ'K3n ރrBgzU眴)Ѐ9vE@Q qc+*X3&9} oRY8#=oY1kIKB-֚ 4ټS՗KʭGbRۅr~cTQ3YB]RVI=8D(=OPKA4{\nf8t-{FK|14 SjJw>%1;>MV{Mk N6TP#&iddD'iBA&'';@*rR(ZqJeS1gm_ӵ8_=6oJjj{xI%{D7Q^pQЯ 耬vR@ICm?<̻䢆R5k Ly LEU-#J5_rz>}_H!8B +}ݾ'+НU3c8d(< & *r$ b a߿zK!?Quq$5'`ƧDT~7G)똹`RSa2Ѩ2‚G,|El~̖B,0nUaAldY< C*3?Iq$nh6;Y*Y3f@f>cE*c*m@3x\L@yl球9m0lgw PC#,Og>^. Œ|E ZI#luwRJۗp|^X{><5ud$eq9Y}-z1苔aD) p6H>糴^znW ;^]TddHL0NW֏;{be\͝_ ew2 JQ# GmB_ Y.}V3rN凇~UzM-}SadZx*'nõ&{u9y(Bl 7~]vTu}6˾/`')"NT(o[]ʭxw~C&x_ẘ<|7v7N`fD0pjCQYF:DV "@6廐!5CY(ZۏОhG&HV/U_w,(j:t/)XbQ-({qa.œ)4nj-@&Qm&b5 _d8|QĒy8qXnҭmX[ ڄ[Koxz)AyA~NTlO4n.YeQb\OIߝù`V:Dum"|n=cVHӣcp!N5W{;mw{aƇ?gg13֞Ze\|,Ǹ knO]g^/ F4a\%$\ pmM[ ,z8JNH #˟o8+8 vnN^Fpe;o *g.맖TH*FǎHFVhŕΜ5G H~Ll?v|Tst),rr,'x^?$SM/;P^V HJ-[>ǩ{&;zMWOddDJs^3Ѧe򡘉sOU俾³4,sɫƉn):ҶM f8IQkL<]z$Mnޠ^*z3PY?E?6ՐBvz4CFV΂m-@TvEoO$$TC$*tw{r-7m\ݢ/ C+dVG\y G|:5( 8 x9gg2;_VB sz|IZ@X3Q++Pcy"?X58UN&1WjQk̊0I;miq`+g(-]aCËg㹿Ў}h4eb_`M^j\@`>b9Uhy)i.c.;2ĵNr0Z:vkDkXbCv8F/ש*}{Ä Y^xm) R'(^_=> ʉމ0ДPx@^g<-0<Λo)ūj .*@X5lxϺJ\,ΆȀ4v}!Z{V!g@d; O>G-?\fA 0$}EAcQ9Rze`x}[Yw͈*CJt/ηm)؏SZ*^[\X&姏sB5nF7GAIv{d5RBT#VSu uc θqM='NǮ49WI5؈U8|~EMT xcjt%_)a@$ ) Kюvsg|Cʳ6‘B޴gxW« ɜ~̘-s-ޮEQ^ -xI7o0Y녮N ɈjuZ[Sd~vbn6 p$Q^ܳJ PŪZVIBՔk-3Wn;A:G;S~*I~ir{~'\:öloԭ*Ne*|u[a)1ev7cN wGzT;~ S5ul2#`F* 8iS&=L goF^lcŸc15(߸SE"AI(jxO z[;cmNqfM:&]|> kE~) oT ~:d0Fx3]x>g^M K:>&U%NJC"2E?`u F$"]Dwd!kR{Mٝ%*w#ggG /4"pcK mMBgh Ц' 5%I:=3Q򭥱EfWRj8pqg=O]~(YM-Yy8#0/VrCbV_M YX "E ]nw2VIu;uk, 'e~6xfVUFI7::_By&:Ga~қEg?*DAQ+,/pSp/نWw+9ٓF,YQ9e/!hr4<ʔ*e&5L҆Ʋql]cVE { ?•z-^oc( VDBv@!OLκQP,F_%Ka!(# |vc7?kjϬA+HKJjHUvߦ9 '9L8?-bDSz+mgSj9L:sol`&q6&Ngx]I|2/uTlQ$-t*.`|о*4 XQVQ Mq}gBR޼qkm%g.1f⩏Ri6RՄdozAZU 8>׀O(E~:zP'uVfTgZkq_N yv+*elHtuE!_1'G`d1mI2k$BЦ>I8;7%8OKB[od*m \nvˬMصHv532oÏ|0NÁT>!^-_VJM<•_GѾVw\?ҍ_Dh@ĄCL磦 _F̗U$5%ϠJ5w^Nх/ľ@ĥ/Kϭ0t\yQ#wPo S$|>u\'# q_~ c.u{_Xoh=чzKI0M A1\%\.\?SmoT5>J8<WwNkh;$\^Ѫsĕ=^\z.5#> MZ~K /\Hyа1t x G}NU3yԲbXΣZe`Ӫ~ u4B3cۃRMP52")k`) 6 1$=| DԢ6̐Vl!2F?CʎXՍ28I5!. :NWl|k`G5!鳂{Ie2Utku |LHR>Pj#g~`g'h rkW=(yQގU~ʢZkܬb$x%:Akɶ5y:%BJ[uҐ^v㨩 k rBth0Z<ڠZusJf5ǿ0YL,}<<Ҡ|e9Y.ix6 \ I/B/V*p~q{`YOsh]L&O[QR-r])Ye ,i]z,=е:֦nC#}7eszsnE/,]p~4"BmEMBvB[o^ճH7y<M^TNb!mZr S,.]iH*Rm5ڸO <)z9X AIQ2SDj8s銢/WRI)l]oP.uXF~TV?xPP8R+ w*C<)Q [//KniZ.b\2&v9v]6Bߺ\6%i`hdmO AZ {qvUʕ5BǤqc5t'TA.|}bh\?cFkPu&!P(R|+3eg$$>uid`vƣ[.WލwX3z/RT>́UBR{k ׎ۖe?]E,;m-Rb2)T.UaWfUL 4)G{}ʧ𮭼u@nd__CyG3Sk1=qV8MVMl[="Ky˰ww1l|#C8xUQ47^2Qķ18kd؟YƼTM.;ouf`d-,oʇ {ڙa cޖ9䔍̀!]Ԛg쳋7(>sYu*X8rM N;'X楃K2˫ N8@60l/o8]hu`fkBNmc@Hl &E'>@ٞo^"xH%=t8?Ku3z>Z$g][[gPQ zezhgLV5 )~vxR}67|i7a˔#T=NcpoGZ%^'.޽Y%6Ho$N]$:C=Wfa'3,Nʱǵ jۗwoeF\%w}Lya:8xyvV©یʤbCo}ww ¨\{dP| L'b+27%Ք}seA|2šcxؖŘǔ84j6FS7UG/-q zt?;j pS400 Jh%큎/SMtPkL+a?3b\a"Vk͸+^e 4 -ğHw +00%]k٦㊍ ]ȘaȡSS =CΤ:LP|gȞ.HKyLι?mZMy2ǍYC(& Ww?ĔJ?VGc]ʬY zgJv'd7@ WV)iB}̍N_q]s9gЛK8(&cEDj"&!ŷM!':5)'/wc5qx٣ jRE4wWsiM(<9Yνq|^;'d7Dw35j԰® ђ5CNC`n$nkV]_1xYm>U?n6f2"'(x+3Np0֣pCD(JJ_iG&Sveqo|TT.TX?2ԩiN,ty( &z]⌍q/WDtNKla3LuTܵ@(/ibFCqwbkMіۢӁxGf_v6%3vH̑ЦovpԦ[C9nRӊ_6gN@fJ_>7 N(Sx`HY^}T@bcr3=#mPA\mǒ[d&kw*ݬz(ƛn/{6h(w"u4ɍL>L8ڕAhB|Ck,6,c ?@MWi^< y5~YǢ'GyY簾 #Cޚo8LA&:3985lzhBc{i AWɶ Gxup KD&[Yr_yBۙKEuRrYFt%'>. 8aΈ́ؐjhB7.Y(ǣ^gw$jqZFǼiP^TR\B!\ -މJ~S,}`^D%ǯ;#QjeWJ\Y۩ZɃ[/s쀴f dq->\ O刔Ro_U.\eR5a;:ƽwA}FaXje5!*[h+=%)}8fTs(V3ڳ5=3{F e.Y 04K;)IT~C̓mݫ1x*xm@,X[CS"tomd=y9!V% ;z̔jE+"&B+y_BSH)+]X-HGw7o;uE 0q~f>HȨ&Kz|N5J v"_>y\Z _`ᭂLJOtxܺV+x|\EE>ܢWY(x_d_ k}:G-<l(7ńx~F&w""{c59("u2ΠbbVjp֥v ~-'zS@hҟZ<(P+_by:tope1<_F!cơNEȰ{c8* ꒞G$~&V#؇ [ 6tqm:`5VG Kz?nNUhpñv17DlZpUӄ^GqB43. SUM߯Dvʂt+GW|gTZ]jɟ`1\+@4 >BY -24צnY^АMҹ^Ai =c3';BeWv|Y~8C@miF‚žCwT#K!6 [Hző6а8S㘣FIÎZ!ktd XiK_DWy2ܬ xk4U.x.Cod'ˌAܔic^jk+gGYP6_:6~yd~^;Iw^'v)>yy/% L L"@=]UoPA @ |;҉ElysekdA1a桪Vp\⇗~䦂De'5StpnYd:E9VNbm9W Ӕ)cnZlm{ x0>F! _΋@Ά?NtދaعsxbqS[Xs鴞V*Oemp{tO.r\%텽T3]?6i}LdLKa)z>6-T㲦._ҒgIޓ~'f]5 `yIq M(y xDx:gƮ Cwt&҉[M%b T_5cm}O0$ 8$3VݜkKAMAfXdaxb9zuBQ?!7) {."+&69=I(#/~7/$_C |:_8O;qʟ(}zroT|5xl*HûŸsinlSyGIUK_nb#3pIt_YCQ9hCt;J7?mJ طm')b Yn:RKɝ W[q m4~%;k4 5='"X&Ԣ@|r$yR5-Fy_OmbIIlNXg6.0Kݥכ֮;9CLXT:ĹGKY&;j^HrCc z^FM\RIApn5zB!#֙ D' VhVWZx;_I( Ӯ<dzTsntŐ`:/k-e04j4;B}̻- ӾoV}F*vX73oduh?##ym$]G#@{1*jFBKc!`} lY&+Ջ5+.ajkE-ǿ2(>=Rt~[B%SX6s~>:cczh`bfц_Oׁn^^k1)\]sz+w"xŋzf0@N4"F>_; z>({t.L4cAdiM P3Q07=Ԃ2\I_}dǃ+; 9 ơrs8#?}TiQ2u]RA/a3gax$d+ &#m̿>K^؁x J_E2Bc٫&&a>*#8~ MD"G-"ýgYZۄe{2FE+jLڋ˯d--sQg?j/B$syUaGʼ3q_j愧Eνu~Na`:w,DyʻP)Թ9$V3_ž9p #fo[TۈU_)) /QCґ gîCeLU 3(Ip[(&rT{M$@.^I3qVuLg|0bOvF| $S5f in\f1k.'"x@dyp`rK tȗE_غdfVXM'$`>9p=8cMFəGМ.!l0 !KAE^2u-_a+くMP7XnȎ'E2 )c ]2,$@+Q3*'Km\Zh(Ew+[SUD\ γѺu}~j3$a h]›q, <ioߴ `Lƹ`ڝW fJ,OlMC!O3Sr{SG?GDzH@9mGiDOE mQ'r6׽y_0%bﮕgz .raЀPi *vh pKdzݺCS?;(`^ڟЄ\E@:5&QJ13oKu-l;Iu$&zF! \@`9m|Z78ty$[Yz& sC`͘Jy'@i!R=2$hZ SP8 Mq't|u<抶@4}tzNl _ @"DwsY |؛}!z]ӬzD`;z tFOIg +X7s$M8I$@ƝQZp~.Aہ~zX/6)ٝ*y'SN$<^7I7 }PPp_ L{>RFPp~ENY'* mJav o7 [CL/iN .mc ǘ$uu·ɥTW+̼ =mFm}92mh)oGNRJ\Sں+0q/%`1mΜjբӎ4W=JxvNH`9#%+Mrg++E Z:'~я%q%ysۘR$&60K_ƛT*fz6):H&?~ /'۫0>A~njb\8J@6N;JC2LtS#; <-( Nnc:RSA}8 6" v ep)ҏ+z@:-KdGJIX؛V~_R?@[*Ɠ?3J12$\" }F@XRxqAj 'AtEg3˭c(*yt~ӖΓ{סJA_d*|z5bWg=~;/fKY57¦L޴=deimhvgP>b *~)Pn`zA4 Ѵiȷͅ$8kUtDh~m\t30ՠ"*ˈB~?"-ػvdacC(n9[9,$ymL٦[RӟA+ryܙn- Mm>BUᰀ . d.EoeRSr$fl 7)$R˶# [,0ߞWiֈ(5f+D195vr"RgnaEFշm|q_X׌3L ׳o{K9j$PuA aJ6V0đĿ 4BUrm7e?cqRKkm-ԓ U+37f4`sWnpr)<_ x8TDO;Jn*u9B&4ڊ\p]:pͫ)B?<{wc>AI&atDp1>)zNQ3)` }҆/]!\ VPUٰfz6bԶ웅?3.Wr3A|!\xG,V:5ȁXM*e=ԯ.G e] hv*5߳,y1mjLzPlhs} O2Ia)bn;P vwTLeC T{muY$\Y݇2#9$H< oӜJ21 (ٙ0wz"i[]?ӼjfMo0ō g!f wҰ $4њzGV[PZe֬H"(}~ߩ"iЈC /0IX`"ʔ3$)pV1p8lWz-5<1#7dǨMV\N2Z6 SOI"46;>Ӷ{` Lxjd'U:MCa}J`Yu i !E 0T~57+Lnq"uKaz}r4\*9|K<Ξl8QX8wa8}9ьM\baݾ<܎L`v͎=_;P4%Ed[kuyMF1">u@H  \io +H=.#+/72{~AC a r;_;ΰn2\O(M^DyoC Dbc_4}kS^(dQm"Ź$yrޚRv tv ]= <=I54{;@Mk/XWu#Ffք,@ň5tD]O{bylUS<viگx]`{QYj%)v#5~ͩ@;D'?W'闆 o ==f}位b_~+LgN Q@*ve_ȲP;ml0 a\ۿصwQqBO:^L?Õc݋^Eÿ$;0U-X̢>X% g uuϼzKҙrJU^ M㚙\,30);?xgW:8O)b9'.n3EO]a6<0ܒNyb8c [jN{4*(aiLI2[24KobJ7HX~i֐ SPy۩zXvjݒ=|Ju?s~Z:;Pd?hah5"p$tpw@_ SzM 802h+٤hA-99Rx*d\_t>m@9ѾCŊ`R*)`66]H䅃,7]JTf=Ϙ y*Uа]0)BgNlő6PE_[| ~o˃7Mvdž[Z v~.2?7RmRAơT2W_&xat6cL^);WVx[~HAgs[5t.SyJ7HLb -N; %FRn؂⾤Lo|CJ|KNF(m*K PUP?to x] 8HHR4RH$8Tc>Vk ?h ;#P!Bڅ'8 hg%\IқKWeȓ!/e8f 0e^pbkRM40FOb{=~Bt;I^:uV81 "MrW?C]~;,{5n6 cUiӭۑ^ ->8;hr2@?I)9%L@@Q nzM\n@H#7MۼeǔJMR+GG=#Ez#yi[H8S@Jw[`yJT%WJۡ$%%4'\% ֩ pXwf{JZS6qi9H۠ϡc-㽚b"7~wA! W_')(pr"nCDeaX[Kzjw`?XBXaUDeP'(~ϜuQTǂݽ43ale?3="}2B ,L8yӀbp}voϫ_Dʧa3֚Je7j% d'=*D"G\9p* vG5ˍzDl;c:B }?GA'OY>p) JmMx=ВsM\~`XiJ;D^dWJ' Ⱦ\{,:]R;-+2;0PTZf|1L#J Q7P,{}` 2bڹ~sL?ޘDS.1[В*+Q%fQZS>vw _w3`sWTG Fٴ\&3T_v_ͻdFZhe*-\ )YQgNu~>~8)Z5بo\<~ -y$Q*ߖ@rA@!.z EftM[g˨EԆD V Ͷ黔TME!e4)E~$絟}y#H\@/(&Ec)|ty:HhV̓'}04[12,\bJ:EAW%Tъ' !T9 EԻgv\_d3oב֯8Z?_2f{s SO3ˇ7| :iћ~Z`c ,Rc6# :gѷ03~mB`f]f)EuNF ا#bt49q 6PC>$WV |^Hq(ڎmFD/ӭ5DWXK; xZ6.Kus}n/;TI#1Y|$"i <-@7TR¸O6ԮfB9_>IS$\Ka]Unoz4ujz|ĺ8EΧP?  Yl2:0rHC_1XiU4aQ5n_ϖg. Y.JZp~Dmh iﰞcIC|/7N,`dWa1 El[7>>YȹVP<cb@=څT ;Op<]! 7'W9|wRqͱPrwse?+܉DX^ǵA%>0 . =9@T4g2Zjņ؛`ڟ2H ^ bu9 +梈 2dj^7P֍8p0y(؞fJ#Gеy3u'gKcFU0;TS1*Facz nw8IW ؘХ K<>Dة}#eu\B1ʋ0VAμ,%q7(ܺNh mTjg{ %RI@mI4*XJFPJcu'aU~N홽oLQ#z8voQeFV!4oc hNVb 8Z %go:rf⟘Qm4~{(ƻ_[+W hRP#\=&nE/hY-'q?%Gy,g`k# jEQݶdHsDKm}h( (`FyC)Eְ.NbYh,ىxG^h^3Խ^q_ ۆ٠57{`߃ PMfD- O8y婙VZx ߝ/לIs{%pnzhقjX-PeEj bd`#2O]~Հ$l~Sw/Z"ﲠoCFiRoŗAoئ =|c>KZZAgǻ{b J#D!n;xlj6M] U9ʶyMfUPġuD [8}#(w s^Rۂ] "Y\z%d| BXV"~ ?01¿FD/^UYjWˠw-!Pq-@,ւ6r\b[{4S@2OyRY]zn&Kk紗 EdcDFEhc%p{iﴋ=7Zp &)T wp~7 #(]˟2[7܉hAx!-W@Оuq,Q*OG|j6qa x]lLSͺBQc|Fb݆CT4v^B~M]_1H*0Ԑ9ِwqvLjj~*-e@K)SiKgCn,S!oMJn#I*&yrA՛otP/&e|ECQ-S_\ȨJ ^W:PdF3߿ǡ6:mQ'9<>%_A{-hwR$1M W͗ìb9Zn(%IaeHIlصAmW>%Z't{2OLM+M84t'!y*rɁzjN3>Cd1FZkjjZ[ܵhTA_w9С(86㮨QghgCL[9ZGuzff8b,5P%Ck/soÁw=lZ+Pdz;dGFqyRl~ݩ^O>#G|ȡp#"!8{@f (rEj+#*?j 0Ew{Kr T &MUJNJ K7(sr01}ʈNCvVd^4@˻t8c/ʡlJ&Ix#WE $a%T}!98Tݻ{49y5AF' ]+ѵ-D) FeXB:%/j)k8!?z(Rmw훦8y÷ k{hvIPj_-=UeBR2z v8Ni̮L$=%QwBUŊSn:de,\6ɣ6Vy*Tsp@"J܅*7g< X ё@$rĹkc+S,F`vFdNguٸ[<vQ#+Z'ÑʴD$Zwu19M SU{j`'Hb8.&=?]30DȗPܗ#U1͐kʤ(~wi5Ϯ_i囦<ea@hEqNԡ ):ݩzo"p]szb6J3cAK5 uzΜ9oQ9%^e" CxyԻk7~6ϣ'>DV -3N-:OQ[4Ua'ĸfVWW(xgDnJ9eXu^M${AUW ὑ5#NWm+Z|h`lg|V xlC"(?Ec iFйW(-pwvAkψVۘ basR"cLo٫!3E r0;d$.s2\m6:g:t-f5 M><2Q]@@*OF6*-ͱ'ƶ+;x񄰋׀<Kd!H Rn;Ќ8kd.6Gpm DY}'h2exh.T)MY u Zx/edMuGx xfF1zVf"A^*ؑSȄ/x7!p_R4Bۋ"?!#o# cy8 3,Y[,$ꁢgԇ>8TN_h8 CUa\"Ra{oCFr*@L< hÇi'[U{49Pɩh < )pg@a෈3@A=QgTseٻjz\%]_1]Y#BʂGL_,iA.M^@! T'1h8ub׋v6|v5#C$(^w^F>*߃.U'{}7k7C WH8>XG.{z3;%V6@C#v9++8WZCŭbVM3nDܘAʀ+j.#xͳQ$*&Q.?ɻ~2uI z,PitS6'IE^O pKmǴ_)W?yI]WCתpXzϼOVʲzˉiӛ9g;+Qc#agC4tD/@Wsz|(r z`kI}ަ!`y?-_YEѣ-nh4:[`G!E>L6akhP5VR*oZuklF2A|{5Uv 7dGBOkso 3`n ؜v#:RnOba.r`꤯p|v0hVtDy 0MֲI:w Sv򂏺͋Ц!{~-~()>H#"K K#<=<G&wwԹ^X Ep4 .qI[:>l+Q>V|ٸSXԥ`'t'#2[*.8HU.H^m:M3aR%pdB@w> (iSEL!2"!_W<\E;L;3JA\m"TИHu?NN˪'DȓrNU@;8{\;E嶤Pk/ra]-ؑ6 fbFa`8YA(SL.$^8 .ˈ 8) ["=Сh⋝ ^Qvu̒1YFBV7qE @avĶA~Rh9xHB!xy@sK&Lap62d #=YB4`١ nz'kceV?5=|&z,X 2 mm v3 bA&?=!]Nyb<^^VExvc% bP,ɪ)h5'OcJ!7, h9 j@!Quoy4p܅܅U9`ntEJ& 7a |Uoh~:8?0ܮ=/J"+) yOt$ɰ X#z-Pp0!l_͸UOzT c[*޺Ql~,L$! Lq@s-O* 5?}o쯨,5 \,Cw5e`S s {~PУaOe99@1q]͉}a8$8 4E۰>t )Z^J8k+i4 ^'t\1͚R A>σK ύ7s2#אZ?>O^J3f)nJݥ`jIg]WE%>m4<^~ D!Tvlj> e2)1rw}=b,w8u90|41pe@LZD^oǔŇ/_iy)NRig:Z~pnp&@!jIM$ya{;'j8jȗ%l4 Ȁ9]ڭ]gf#!4 @r0lJU3PA5|@'VO90<:C!$+NPwBcyN,P88eI¯-jCF>GO"kPhRDghqS W~yZ3XYiT'EJ"SIɆ2車YaKU!d CQ'XOL5ŕ?W!aIcA2uQ="o(E5%P^1K{Q^k mu柩MԵp&WG"b=™7Tn+։pEU/e]Eڢ$'V9YNf^ҧg ǭ1x<7"Pa8wO=|tUI+h"qNg]io7a{o\ވ|SHqזaط|o/҃RjI2*S! * t[?0DJkKgb'겫ǒwfRGOxdIGƌa40>l`{(IT.ȇ⺨K9+5 <a/?n0|)? Hs{)+~f4GSfI~3QClgKv "{uNiu#EP d8(/Ԕo{^8N[8RϠP z4i՘Sz`2|`7sBnۚoQ1t ]郅H#~]I~D5n5D8[a_(O a*b%z`G^+:`,? c)AM{iCQZ^>7Zu$Bg7ўobwY5th-X*qA*sp J(4 ,]IٛG%hZ4#u|{lI8kq5&VT:e}3^=z߃z1cYƯBsG#JuR~!4j,3+1;ҰŋiÈlssqڙn0>_0An3H9,Or_ޗV 30ԂOrs3OjY>q4w <{aǒu]wyj3{!|}4N gqHeݰ$<}Dt&Ā i W-H2; @tjk a㭝齕 R*:b%^ !64xs arKI=&N[F܃UrХ2tcd~dX'ʈ<^G-Okn k]Lnz/ /c8K )?"EnQߗoᰶ(zq $4pD']T<$t#]:-i=WWp^},n :3Þ[M僐KMË@`aX3Zjjo*sa1!:K[0 w4v>qIȐ^hqaxz"ƢUxA3VoQ8t܆!j{~V ($%g }3;K<$;?z37zc g$Sq( `=Z H|MOG[9K|yD1d8y `@܏:\4+YrQC{}*Ik8熚O=R1`<a"W.<ӧGy3f|`[ kHK2zߥB.9U[UQӳ5٬+\ IW0& JWZr{I fϓHF'xobU ëM9?0R4֯{i saS*9XО6ߊ >< d{v:,q0 3 Cl+4M!kΆLǴ#KNR SLP;H \dOM5HONZ&Tn/\>&=W#t5֮f91 k,nQqn ;2ӺCKnD1ÐQԞGybtډ\\\(ċ~ {e,(m#e= ?[:̬R7DQѠop()N˵E]4>& ^5GyʠgmWӌKa6އlNbfr "v2Iڣ1 I7F#DDРX2S:og#%_@JbœwP皸w"\;HctI6U$SD ꯺&ܿ]{2:>`'0N㙀M_|mVޗfѼI~3KrJ1/mfy5'ou?Fx?"D<Ƅ< t+J(8mF׳AZ,vvLr O* D؃j8c=lO5MbEZ̠3A֬qLUXM@vW@WtTtv{Fڄ 5}"gMF7)_goa.3tr 2TO~PP{i=iGh'prkxn4qjפJ?A0d]V|> =*Nձap!V?Kl͎8PőtbAR.<>:=]Zx@K|S# s(- !>[NB'wP,/5'4%_eZ[MC$c̏l&Ci}܄r̗+/5p{зSh-2խ2/IEk*O ["D/ϴX|;vN([Τ8缆oE'} yI~mN:gsW֠ngC~EiG[{+ݪ 1s˗m٥&sHP,ChFu=?5G&T[&LO&T Ֆ5ĝMáJwXYDzb"oWD}3 忬VG7Bw~\&V<I]Nӫ)ĮEMhyML& ^ C8pC.8Vbh;^ia*b/da/وy!AġH3O}Xk6 2=~]cl.gG6y!Qj>3K|$տkDD v ?F66P d9x$#siM~d8mJpZz "wQ/U$Gw/ i$e:Xw BJjs|?_:63}9ro#M^7$6A%AzJSFj*~+rXX9cۏ'3A/Stpk -uɹ]Ðć1jAPX Gm5++:?َbgr%`# eSG7;fX|K5*~A^?ͭO؅6hhe`p`j'8-FT>m9" {M X(ўaJ0)-%B!HX0Kk *~34'3l&!goPy-z6'g0M&T ChMMXkϛ&\aq{du PaۇE8nVvLScqn >|oIJ4m^D.*q99"ۄa Xܭx_~ T< > AĹ(/BzCY@~dǤEɑL&nafWںJTB{?U7$EN54PoC',`ZHUanyK' ¹V$wL74v?H̛k]5 M4EmQ Cچ>i礻]?m45Hʏ .wA`\ut(Cgē<̟E=j:>XU蚔ٽî9K.$0qk}E$k kG8|c[O`|H}V:J43 CSdhGVѳfz61 @Xf9v|Ne@ru^{.'H{p89p d _H7}jt0F__8q:wRғ#P-?"0wDֳSw!R$.7j3F,NѸom5uT4dNKMjxunЧ$US.Q[rӆ\ٸ$ fQ1N zЬBuæ N W%\ L!h%ǂ<ĦI< KQ(F0BC9Ctpl|5$ \@eSad#E){A?@5z =؉/% ;\7~ٚ5:4r:W&%%ĜvH`؞U$c+>Nz9 .֍prT~_HsgI`wr58D&X(TeY}@SXGM \BѕI^cà ^xbbobRHSZgjJo;>_M_ eKH:e ax[ګM=@u?؆ZԐ+/1I[14ީ18jت#`#,hka z%lԖroB+,cA۾>VvrM{D If\B=vjo%uM76hQp ZEu Ǚ^T]pk_!Z3X\M8 #c ب YGݞr>eXnǝ'>QQ-~9GSu(t7MAR8,( @tfCP72Kd˻Pq\!Vz@1]q ߻ }̼14:c`8Beui: U^ud/&TFO2AVn~5_VL E9y.ɟ##o1=>jA2e)bL!Ǿh滸N!/J|6'i Q u1zroE@f̦^3Ě8erKg.uc b"{5 XY`MS*cmU 8;FQR5\IET=Srwʲd}f1eNkkOϪh7TP`ݱASMD'!#4[,%}T@_ꉀnN<&`X| N؟EzQf>YYĵDxiFA 3YYQ!#s#sRZ:|S;xp?%^ TYC9ԍbčK O.XƂHR&DPѼbT)h&͟h57ZUu˭е3>R$|u0b;%#;oURPw۶#uV@MiS '9[i)oso.)u(^NH`pSpèh+$A߳*>p%:dMdB`n!,XUYtuwHT%t;j!}]0:x]P`ژ[tmV/a4$lro0?7itvBE9|Y-k˪EuRh\e*Ҹ1b^pye.&h%BOܛT:h8k42'W3ɦ }AJkY'Jd_`Zu#('7Y7aYJsI8`>홝*^ -rV Z1I3RwW4^g9},-/R6Ǜ*taXEI(֥Xa0v TF< iv j\xB:t*/$2vz '!9d P<\}yR;V1sޭ]j:;GG^!;eCONa)Dpg",vwaˀ<\S Hi1 Y5Luka-eFg| 3! xF}PZ'%G 5=J3Qh[{i(f2f꜅+ cBw ɾgTUiNX^,Z(^4P(z`R_ﭵ#S=y%攖an|lDlfJuq5&ȎPr jjvuB| %*ZH\R6wygaȖb>W)3"\4969PxXwXAM<*)И.DP:Tz^' ޖ:j !Ec+q.' MRH: ƁWP|UOݐqKRgH$u਄4sm_Y•IMiHʔ AR:L\4⹊\CNQPr|tTꪓ ԆH"*tҙ!i8vztB2:~K\3GTbUz 'j><xޥإn[e Ue6;15b\UD'a^f2'R vTwK0.2=X^LƴM&_YSF90.sGO@#}W=/5IaFmDSJɽ4cgh cɥnohbe7/{D(vݞ9Hܱ_HRvJl3:>fn!?f Rd,,X;_Ԣ$9`r muHʸ@>\p܎7y%k'wE]/"=D }Gcr&="6T3gpJoYaEIeGċU2wwɹJPҦ -d#1f22ĹQP"nn&@CgRQF#S !f 13A!l| ӷz#2K3O: 'ǔQyZ_,3*?β;Ԭ$.4.`R<\2j;& ĨLKD-"Fռ1wGA'dsEL/G{êȫ7V K'NZ*X<噪B3yWtCI>( 8^M {L<;fIT2o% oʵȥK)L'K8>SXqD1V]vPqRS!w.Pًݞ:s.׵]B-sdd"J/ߡ.t5GIWP~ٞ/VA"/W#Vabr + [osU-qQk3-\zWYp5٬ 9Ɉbϲ`}nlh{~Q̳stPpA'"k6T%;!t'l\ӝOി B%+xnYKVP*֑p!1.ޟj gpWa mSc )yL'Pd646y|{A֨]Cj,T,ibkY L(䁧0)+i>Ŏs7ݚ#U)?;)]%M /z [m=BoDyЕi]9A [H4 yvNEccU6th[,cn:][Xfnfӳy}#~ONqn3}O^<\Sgؑ*HK/圇 ~7%)3K$P Fo1ų ~dI"Naa xDr]&|!ѫ].}*@V޷6x3ILɹ0!<1Aإut6+W9);dh4z ]I%)k}CVubSj#9ZũQ3l̫V։ãT`:ˊ <w`T|FF$aZi\z~7ކ? W1đ1e2Zڪo^[C;M+^=̣q\73d͙j@rR2o<8C5QC_x o.p<2DIޭRhYPx_2~nwA|:G拯2˓nC!F01p˸{kaÓ(ԩ}y%0L֍TP 3`ܽnJn ԖUa8G-8a[orȸ0xuʇ[P:{Մ9o~Zݫo_o_*wɪP{MsSBsW@ «.W=,v4/Mj\wf~L֣%',:6_@c-}m9m~]e5JH[a)LUW2U, C_y|R,Ԥְ6!6M<7nS8-Gj-āV&* *-NJPn@ENw#J(=Xwn";"/~)k*FS)JV(*ւT-1D5wܱ0ȭEA)#J+ՋT_v/5)ynT2z|߂$p`@9w^:S hdđ;/mvOȨo3Rt"͡ z>9+6_5:Pt}U+*ql ک"$ [Qhp['&ApE)+ud>gHXח`۴f]~-EOty~5|#2:ējfvN<}uA: QU]_&}b.wok:,f%fo$1uP }W".s˿@KxDksDAgN 7ތ5ޥI=b$r-dGRL ~"fXZ^KF& L2T9,-aswNEY;-7MvPdCT|Iq4GbPG-Ђ% 8]a@U/ %_(gcwOjH'vduр.Q7;jMGyf֒_^-mWM{4+LnC[$wMz%2qP܅y%3m/T*ߪ 3yZNN_fJ>#!Ou}T%)JItׇkoäNw~|(f<3ľj5m̊]|d J?i*.~R8,0>HTOG*o >VgN*(ߣ@ [kUw\(ц[\3!.>~9ƉHvUP *^N|Ԓ1#+.sIJo^H 1?hxk~ c>"mrnofI=#qHދOD•A>}i $F0M硊s^80#x^\{: |]x>0+ыbI:^o3k_Gԕc CZ8E嚳vQʿɈ5%4ͅ>^HkcKHd{8RpZR7YlkBjeX}Őyx+.`=ŶvWgG4/}̵~dZ(;ϊh!2ޏ#i\+G:}-t,U3t5DX#M$0dR=w/dF1Ѕn`A,=&Q@$Q-=9ߧ/ ^CpT_> ʍYF?KhV\2LXt-<"9D~ Kޭߎ2u8H:?ű)w ;r{! b餇-h>(ˆEajbhr94]5:3BHJP 5ftօnSx :or=g4^S~Aj$i ! K{eӜx[6ʼvBT[7j; p8R)l(x:Z,5ѿ9SI x9U_o|ҡ֖[p3,u0mޛx| Uw# @yŀVt(2kU )ɕCA>?k"ZY;N6%3>F 3KWnZEê 1͜ ю-HDžVsLU%-(؇J4'Ch9h06mVSqM 䦎W̏rآ.|Nj/SXz__T3S+ 1 0-@5\Oie8a\Z} HljaC=I7̢?FW-0됪$7 zGkX {\SX^&H}2{19EKިY#BgCVV*؉ 9#%!dAs6Xg-oX:tP{? - $̷ \/4?HmJBO\zQ-% TRjżA.abް%"Qi.`j 1y 0GId* 1IgQ.ڂ8=:J]Sl+ ߿4O'o LT-NT8۝x8ܴT(r$iή-`WVbU6RTA~h݀7DJ)yBPY}OaSO%-KN(V;H7-|EaQf+%*wm' VdVL\Z+!0 )Y#Aӻ<ޣr.SV ?Eb%8)'dL*m/7ԳpZVr4\y'ť6o'6=wmѿA<^TjU,Y\j~X@ҲhoXyki Sz&u jcXNWC _1&Ru`ЙYzƍmu. m9@ qz'%t {  Ѐ:oMscK>s)~S/cC'eqr|= */|Y^ʛ{n匄Fli}yr?C5M_*o|Ȣg 憾N#WץT zdLVv{l?Hjs/뤚p?[62h:X !όT)u,IʓoL7:U!f'րAM_b]YIZMaSxQq􈉘|]M.4ߛO 3^vؾ=dU,I4:=qZ耾zYD5JH4Hlw6nUS P= mZ =p?GS w ?}[`]s$ Gbpij[{fhg;#4Ca;:m! JҤRfw6GJύx%TX tT(Lӻj~n1`S# AnӰ+'< %pG"iw2u!(U ?wP߬C~XT)2<e`bhNMGqHj_zŻߡO})b6I$|f'|S~_?X,@ScKK7tCê.>r4,%pq Zv6$FxWN8}=Ac|r18O3"x.vڒU.pK.:,u5Qp݁{&'>5@O_*) I]²&hM;_fzӑ 7A6`vĖ4B2U ԠS!I3~y6ŕVif w_0ĘQb[s8Ktu= J+!V יjd<,X6!P0LA5FW>v9?nzx"tZI|x75q 졠|1!Wts?JU>zADn6 . ."/՞ 3-^E[ uVI$[=Aӗ(MDL ϳW bVTxY܌k@fq@@Wn*vCtp>_z@ip1z萕OmAi';4 JdoR'^U©j}N{į3JAN^㭸b 0b3c*5Q[-le|ߎ";3W󘥬+ߟ @S)$~r( *ۄ`NJ H`Q[cjx-ʦkz6zWyH g6)C&4'g.YSD; {&4;q|UKs(Ɩlu5А­5N0F}BE9F+9uXſ՜ODRj!rѸ'-PԿ-Gǜr֭:2gr~ \W%!M}lf\≋< M=^Ts]Iڑ KE{f$B>+|^7G~зW2坐t1vdyQ^ ?as)'!JGJq_'wZ =kZ"L7 w^>B\_Y, iĻ1#$ͮ-<`mOtDHlA.;tq̇]>=o!|yQxuDʈ5JoacP tPYW"v s FM\ӊ{WYhuR5,jٳckfOm *0T1{oP mQ%5 CQQr!hR2qRpg*$3ZcHSwy>BrVME#!yH&Ga+ܠ$w/vX|,O[#d3y֝p[`$;+V-EWJu5=G@9ɬ6LVqY=^Up]VYBS:dIJ[u _klc $!%h'JIXrm\]̾{.M_.R Z趫~÷|zsLJtJn]͙Q yD,U2Spq*Iұ`)"H LYvE95AR2`-$U;m:h{kV1}S<ǬGnac"^ۆ؝Pz:k@t<|on[oWűN@i\7D"HT )o/}$ =Xk3%l3:WV 0)k[$aQEaM3JA#_XWt$I{`^w)0AE sC~@؉TA[&^7!knhV.TcDC ;- !t?5wJ-Ŭ9\>#Wܭ\^0+khev T±!-x ҧJS 5QŝWW1أy}qU1L^Md teiwu78W^La^TX`i˝Q e|GjJ _wI0Evxh Tq q8^!h§] eJs*DžZ ]qװkNԊw făR1f,mVZТ5g2a 㸟!)}R*f"ccdΦ>LHFXᐚT.kИȅk$գZleG /(?p:n\јS.:/%Aňg͈⛥[ ܟ^pfXX} V;\U*ExOlA0:owÞ28w\Vߥ$( ;cTj{Co8Yg'%wH}u ys+`M7t KF<@Xԇ/69GmGVX~'Pi <(Tt!=yISKK+]g6X߽LL:ˆ .,;0[!:j{%lԏpϪD W`GW,h3ˉV$T0tN6hƿ2 $UˬTl˔B&wp`:*/^L]=|n3F$3!>aKU? ý-8bi߉\׏9KY6s,@.ʱ{H) FsEWr*]3V^40uvtNFH=Syo{;<ߴOO_)U2L}7?ÍZ*Ըgon4 /fE~,mX8lNiҔX@eL3\A>S+XqӦf:.<9Qu7+Q8jc2&W~ʷ?8}z5Fa/Uq*y͊}Md?Vr"cI 5g5+´rziꅛu=ֶF-p:rz*kōZ hcxf87KPTOk '&|AMO^dCi񹂔H Vpf nz4E4X}HCTGe7i*U{]f>3W崌Hit珳B^icf/E4dM]MuZ6$P%MT=q0Z7!k޹27DDƒƩ#9# oD`Uڊ.I bFE#  iJw R )u7&Yh;%0fBӱh3O 2L6p3ny4sSRqJDJ(cJ: ܛGAk,6(YuuP~o\F~hk`;Xd1֭3X)>M.b$4yAUZ 3F' 1dF?;.ϫI})!C>?8 "Fs=@ՃHHᚏМ\銎9'$GZ$d]ugجMyocn¾rKihlJʎC$| $NAap*GoXXwC& @3)r=m$ᑙȤ9S!_R<?mu ;!_L54ؑRl&i-'7Ny"%zck{,Xd=wic1Tn7 f ĸhN&%?pq&J0/knjqDlp8鱊<,T8~|u:ּ^nxkM6 w)WO[LN0,gWB`r_Ka=r a {vyKp5Ȥ/12+[ 'ȪȽ-lOװMaɯ4XF\gO(]M5A&q\41;S__G-зܫ.WA&"%T*"l.(g mο2ؒ%A֐=7q)[b+ft¼ggw^CdB_xv6 L.1+GX1!LrAk4]>4f@T5h_s߮f~\N1Hxl ҟ Ư%ceÓ4]Y{iz"QvŚ|Q1_8jCSAAľ浡Q~bjf/J9K2C#=x0P>%29Ec&2eTap Hs?iD,S>s-9^Dwj4γ׻8EӞ td#RL2{@gؕe=8-2؋ @ζfA?nDM\cbgZ٭:jޅ4^;dݒ^%G?(d|VQ-M)H3)w=sqLddj?,D-M|nߚpӮY?S뷰SKMLM^+u5e%^luq0l-fʶ/Qp +Әt.2S]O@^n i@h[8qЗCRG󥅌qiQQpp[@>f}g ;C)@HiIU#f'10h|4BǼϵޛ/1u&͍Q7)ckw;0ԛɱ4Xȧ]XJ^ ~nA}7T OtI_6~m}PP;"8GHܓ\ZY%f̱9L'N\`9ޡ:=SeS&5P&U7ܿO 6O}}%˺ _:븍v:\F}a[62)d6; ;VIx pwf9pE2K*a5Ycw;SJW}u{8]1۷戨 v˖sMBy ehL5*.׉N=U7a=z$B&ɼK+!rG# ǭA†_BlQU"ėwKxr<H4Hk}njϵY5+/QuYH/  zS( |yt G Ve'RPl%;ۧ!뗙ep͠0AB!R,鹿ؤ]B,FN.+M֖ O8Q[Oݹ|ԝ),TQrNWht (t[/lo~&}/ gM-dʃ T/SDB" #L[G׭7dC%\To{ũ5&9gtiY /N|(gx%ܖL>ceR_媦pGgȶJ4l)-eN a6qeBSͺf dy\4ڛ\DHMu+̉j}g(5h%=,YtL&@w̗hFF#sC)m[5-m55VXk.H"o@pp SY%_NduB-Siu; v. Z'&SCbqݝE~/n?aȪ[0Y ;,RWٽ[@cg:5GL}FL;|[>D-+vmfh# '`ujp{&R L}ac@yᖹ≯ïQaʟ.'MH~C7Pan'[3mR'̚N|[F9yދ8c"6)w4D׳3_UIȢ<bcMS,nsBfcC}>j0l5%+XL-#*e 9sȻqzg6f`)U",W1e8ʞr =Q:5Ԅ *JCQU@|\|Q0=GĢ.N~&l**7J$HݝYb0@[St(}&ՁZ`Y;FTύXR4 kΊԳ1F 4#FyOr:ͿߪF2 q=_.o45_,W:ćXC7T4*apN@bF CQ<3^7|_R_US V㸱$$akSj@ ЈRpxt'a_ @;`O<‹eA൚@n3vcj=0KL\ɣ@;-I#f$ .&iW{%}$)z5z/zs]˹ 0Ng~qxgBtw֫mK_]Em+>*#po<|9f*ZU\(YKB|6$dUeNs wqm|Xג6V z1BDzcפ9UѰXH!HZLOɒˉޥ8VlVqeqd/;H\5Ù ý ^<숿s;‘' GwE?mQ#(Np[.Y m-Йu5nAU`V`4 ]\)e}ޤ4'[(IJՍmEpfD~>=>W)jr&V೶9kIuzkPu%el[G4Ni:7N7hT8~E>FK0# ;NBj_+v|Yr3a$eک`-ve0U~\Ӽ"!W9$+R{4nnY8[Jbê#uJ<6aV6 BPh{ڿ.@`gˈI8i8ܪ`'zI5R%ۼj? '"eT (OQ I{&NcrM8:o?-g׀o\tKہtsur_y(o?|5}e١?Qf\:mO1 ;SRd榙Y=X' եĤڊuj$It-q W/L8NA ԏЧ m \uC"2E_[$Cu_ə髕NJ!(Wu86j&8NwaO!^nb" %Dz}բi,R@ vm{TJzb@Kk (HS =A18ZT&qiag҄I5StZqZKJ~ׄy3[OTsT4En ަ ?SZJ q6337#h֤>9/+~&Y)/GYxRp!t"/k~&=׭ i9L7)1,)P/TM26gRLQ7+/J4')ֲj~S8 C#ڵd'aIKUYj.=]Jih%uy-o\bd|!le|A ݟ^si}$>-!98\i:oRpqݾ"sŘ -+ҢO%X }.;3pz@}SvDGS$(qZd/V |[LO }Po` 6*L*8 5,h̓:3xDBzDV VhXJ'~eX2l@OȯUd'*pg6筞kdC]5ӔOVԮb`ebj*Zvdqr?~QǸ%hDTgs"MxlBT+oUnWf?v4!]cdQ I8{$Ě|чz )ۃRIȕ݀{h=5T&:CJut'NN ؋3SI0f>u Bi ',ox$SQ)ޑ:*Yy{S'AKDȪmϱ<(xTWI($? QD?=nW7Imc8Y" :XũXZ/hՀFDcprH]f*<5گ 7ќ3g$[eL%J/@?˙/fu]d |#x 0|jtt>Zۉj;L XGm8ۡr+{aTº5&6 L`\UDP릉a;qy_2!= ,O"P R{+F_1/ݭQtsC= -vA^اi(D$Эu;;)lB'm#Q3D DHr _0|DœSK4cVtu$4w2o_RUH1shTyAR.&>t岣(V<"M)yYDmX )B2 ^c%5ss6y/h6ƭ}(y"|$rðMŽPmQ]Z i@-ג9A/EՓԶІ4:S%F]6\zJ'E16Mϕ$1 Vn]M,MKlټi}ޛ#O"%p9_{ޗv})l~f%a׭$- &.' W$e}?~Fswq},> nڬ1L6~)!??@WۚCsՒjwx+ɏ9fZԎ`n0V߯ kp!2wF^?4on 3xZ4uhݺ .*6uA@zo1ў2![=r`t[UϚDYoZV]{㠬\ {TÒ3s{5pH#.dm,?2 |_ئVpθ&L`Ivr<ȇIn j|q{vb䷧:_IK61E d"'C!S;iPu&ε &5o&+QYozǿx엣f 2$3fE," Rʉv`_hb'k3V O'豀(k)iPeʆ*_ilVF@DSkt@Ђ.xA;͡#h fQc(骗PG}lkb$ʴamc"j@c* $J彆X1HFX".re"MI_g!aL=k9彞{|@uCs>hKk]X39.9\4bc"T˷ww^INsbѩ,q{ i4пV2OjWl8]>m3WC%R}:[(ITL aKdk6@}gM%XxD4V_ 2ڴ.-q/L2edSiiz /)k90 }5VR2Ο H1}N<'_xړ6nŅP4#mx}L?fTiu6@T?9o2$~X8UmłGK`,#hQV15ZdYX! |V.=\K_Boϳd4qzM%PMoyBzlKX5uK|bpmPnuS(%;Y[?[eCcW>A<4ڕI s+X=qMUHR`>)8^( G/¼ΧV`,X؜=HrJsBrϒ뽸-K)A-Ň^~ JhKcTLҲ16T~6ZQ)'#A7a~> ūU_yHVi>}i6@eu8%d"6֐rc-lGDw{h&8Q}GU {}4-{4y3(/Z4P!mc 0m;'}A@ǭV@,ưuVh|q̜ y='x3/$`&Z)M uR-t%٥PBdEs@gXqHDֹػ1ȱmN=w~rXqjb% HXA Or>@"rm5ZL~SG亻^mГ-qj<îӇI^os>[_=t֍3fGh8&2jCά4&u>Σi?A4:p2P| ,!SBc\. hȵj`$2 0 (gm؝ml8 2zuukR4b;w"2x$/Lj\Gwӑb.X=#IQy C"*% {*idWMEIv\F3rDMӏB!zVAj[FmHT)}:R=6=(ɔJ*( 7@t?9!:-;ɉ.>zR[qރbV< h9D\) t ){IBtd%BW

x9\ ½ n5 $fTÔ[cVΨNɫyYK[ s`dHf9 @*6k;.FS^*[ JAĉ$+5d h $@,p #jMbA|"xtrWkNqŽ%AnG67|Jz B(U8oІkE̬xҁu Qg<)CRO92 5uږ[7w҆{zwXsmb䊬Y)It.5aݲ8.,)}&cjF'/t#ڬLa!~|HH?!5d%-ُ)Au77 P;>Tx{ U*v7Y5 9 m%,>ל,J|>ۥB`b.h`b (}ٟ\{D ߻O%݉e_$i' )zxhVPt.dGtyo\)Պh6ltGvAj/ZYf@=~Jn[׈qhQ$nOޗ4s\s'0|:(<=[QڂgeɛDqь4k|˵^hP\9xv.cHυS7?`jzr`Zs7n U7Kv5[T$X`h4(;Ӟ~88O S^pֳy0|f3Ρ֕w#{'##1Z^] J MmȇNxj3/LmmkK(rS(-Fr_E0o=&}Cf0DQ;WŒ_((]q7'Ku";7T^:|i\;QxXndyf|5tI,M0#/҄lMωA_Ar2ɷ=;ijQS4sLjrqXY?FLpn]0p; ?˓ ^6$=459NL`̱HL6{(̀ FU9h +Sp[E{uߒvg&;Et-1DM*Wft;*k)h[Ox/C^1IJSL&cU M᠛DgVNXh᳐I}b@۩qc>Al=xJ vS@U~ngkD,%B+@En=:.< tmv)p2?PD } '<ãW؇N5>a'Il)pu6r\fEWW ~Kamzӄg߿)0źII~fvE uOsF:R,b#!e7nxV]_W* *FU}c Y0d7ܓJP[gS|%665ͅOSwݒ,Ą'vvqrd4Op2 gز3 z@b\!>r $yYkChF-)oy5 s%Ռ߀Q`ir˘DRjs8me'6.bU-g *H=x l{;g&3]kA28Rqh,($֚g"1!{q6~O?u*;tƻlU;2R҃S +\6^D`^gDp9O+UnOQXROoz%)3p9iˋP gɟǸRƌhw1fmFr Q"X3lCR s3TuwK FB5è `Kt_u#4EO٪U|CQdK\(@Ȯs)m!*ڥ$0cʄ(SUF#Xv?H|S-k,-ki7_XfI,l*gq@X+L}:;Jt鄌TbNiZT;M]$yI:wRƒ*S?q,?$;bhKMmjE >X` !)𰸠rfOg:ZQIy0ga<ً9GYF[j$(Y7RTG$ut}vnaZݯ5(#3c -O"4 A/Aj(K)Z ] RwD9#Q4 αVfGM6:g\ Yk $Gg4`ᛚZP J9І[DCJw L P`S 򓼹 ${(( k4:90@Ƭ" ø``))g]ELٟZ&"ߔ uD(gU,3x?Y_ܤKgnI@ 2kðACNWn{ƝOY֭VZo15HІU+/3ړmV̶b2Uy SK;w:18۩4-BvZsBKO|D|Y6EC?\5u%x R.M~@;}H\_\&YlC +. T)?±=Ǫ <_f$0XQ-C C,DS>YDkTkmoDhLA3Uod^"ř١GmɧƭTBh(R(s̕e ud3-"N^v`+3ql]Tt?^WRr=#bZ) K#qQ_e`q-6`Rcg\}^;v z3o O2S˺Īh[ N_jMVǯgc\[l8vfU`FpݤR!8ޥx_M7Zx& &ŐĮS xSEcOQ8RjEL70l!KXq;/2# K`Rҍ}!e OTL{jyW/pR gG]ǎ6)u6DQُ߂!9?R0z{<ܙRjgzK|l6e!xGD)ě^-9u]R~ /wI[l ь׭rL~ZE,?&jM?N ݔ&`Hl<8[ㅾU2xik-OUA%`𾄘 e{aH*O+<;b [[6Sd+P-M $"ШZ":o,zM׀?`s@r>s!w1ro̾+\KS(~Wग़gY4*Ƶ(r OuLhy l&h5S8#r,OWom@ѶÍމW..wV@eo(`i4X 7Ma$dos!$Q z,D/^.<ǣhkI[ͷ3"kb&%+eypQ8FOac8Y}GM!) -d kJf{S q)ɸ{km?E(`S[ !못.Y.&I۶D[X0z`[ZA 5iY*guÔX#z}1|89-4 qMee!{>6\vۺsջI|Du^ś? l1\*a#%j)h1/wdw%/Xca"F%uq2ՋD+DSn5{a=~sͲ1˛!ugیeފJtyK5$r 9U}'",p;D%H!q b򧪧ÝGY"pHS&j줁Fƭt/Dt%s`gg*cxG&}D@!PUGT,SLc`m/UpL]L'TҌK>Z4<8%!A߳ADR0)zs-^lcpYZxLQ[5SE|,iG  Tigp%'odu_kf9?IdO/S)n l~N ℴ`U8nԭG4%ܧ"8b94]UN*} ڄN篻Kv\T~eueX6ÿ/uvidnI&TߞBH˺ =JO̙^jY5+ՔrPlBA(Yx'cƎ¡wma L kJ I} <:#*Pزқh_*cGQKh{t6(G[wt]JdYٮo~vBGVl817h8IJ{m&ӗhSƳ+^4jᓺ2K}~^wkN _j_rU*۫*qpS;X} VHx >, lNmUD-Eܿ?ӋW_n֢ Ag:*SufTz<9x~zϤN9v *nsׂN/ӿ_|ף @2Z6j9Ixv˲oA~|Ǧ#̤1 JPw雓ȟ;|?Ѿ0YVdtٳNȝC*FI-ej,Q1>$vz4} IUy& Nsϙ}]ߎ6 -rpn4s|KWhz ˖B!,Dkgdᑯ}q*;.zF0JvrLm!Z%&;Sx$S콃yTRDBKĞu]ww‡\ZwW=Kt/{+fnmkIo?1Xx6<13 ?9=K! IA܏B}Uʽ(3W! 9!R:Х[* {N9q=wY =m z_!C]yvFb. vaَriH-%&"tG??q|MnO<5JUcY)l'J_1t+#%Exd#hܴQF;?N+<9Vlm^&5gQ@\ɼZ؝YiK* ?jy^nHXTRDCǤv4@T!ʩf+0-ԯG!aZKd +}`Y6m'p/nd;λ2&`?|kL Vw!6*\T5{>t6FF:M\ۯD%2b ,쑵!Y#9C*`6Dk@ e{#DW0&rJN%Tӈ:$ٹnӃܸOsbsGJ&(`3 )FRXf* r #ꭿ(}h# цpFA`5oSZ(UHJ[E,Z\= a95/͆_DR;H*И3=ʓ9oոl,72(ΑyT=12E dqa xcߛ l͌K}'*hz'SZx)jzh .l%׋ zV"U]:=_>dZ320(7yinyt j잭O&i|(a?;xQC~{9BFJ|H0g!_h8vl"oӐ{Irp=:&̱<.i cLhGPaEm|F2Lc1fC|gnDQuz'RFLĝyR6Pd53etVf+|phlIq|jMʼnBg*]Y*ǡ;ؐ o'huǤ9d̞1`{<*^QHf6,h6!s EjkjP)?#8G}9s0\Z,My @]^JQ`2QX&TIl1iE°[m,\d"vsy#= qƉ&kߣ Q_ιLKyhH1F.`Ҩ`+ :"F4K W7x.$uoLk?Aq÷}jʎRBw6Pq0=!']Ϫ5=`L]j*ڠ-e܋G}a5Y7(k?QeZbzs*=׵P޴iNfaRaQRo]$,\BD*]aVPRed`)#np{6IXDƟbs9רjVd[N&d$q0^3L:mA3 pY4BM/(+X=)J" \\3ڷ_-C):G!|u:}R>Ğ;]'efM<( \z2>.{Vǵ'ۻ +t{hT-ݮhM޽x \̽ BL$SȈBdr[ݶJDUJ IC/JpwS.iƳq\dAnH<&w06``ּ:Tj{'^5ֻ\QN rGɢ{ZYDųW7掽Oj>s5h'i;6)m&CM5nڰYvє6=EpW@F[=^Qy*d#RYq$ݒ~*JRmMAM鹘;ZYİ|eDP3$eQXLx@_¥ ֕nzgO_쮼6ץYleۀ!=]~P,.+|y4 V0$Hk!%x75RV30qV+Jm`zl*q?W7GcֱO|]A,OJ:"C;q F'%)'>R#S«2 g:"VQ'ovN^ mE"_Єme!}'AReG=%gq>k̳BʸB |mԅ,QOs r9mc y 9dO5 j = *cN|& .q%ӥzY^/z1d,?:$߉elb{8DPU.޷<zi g.Ã_c{9 O<ƻ/;Kg ƾPW@ 'z譴D>߳BUAa#)IY1ZlV*-,1 Qt^>ܴ,wPH#dNu$emOBhWy WQFnFz%~x/卽o/[5x}զ ӗϝ 1׆ktF$f?u.M>}$B^GQ q)v q!OH&o92^a[*>5?+H VHjqa^gB)ri-5Bf} m/o71! FrB91//e*x)o +fX§,J[`HCs~N+w5$aU=F>3/Uc]I jCbC$:Mgە" }s¾uׂ0nhwЕ:S˧"ďW!@ ']=)EK2V:Kg}Nlix-iHGK/fm*Y0鐫s\*OMq`{rVU5 i.K=Eou|]-\AQm1M'|mJzH2'){xP/G!_N<_* (pA=Eo\% RQ-щ+! Lpqrr";}Y*$wS~wܬ AcxbEdc>S6E[vv[&-@cltVzet?GV,;mSkHoyOۻ^.\W / TX:iȓҾ=RPQK,86Gb{i-=y46&2ޮUծ:S/f.vB.bt*s1Zxnr<ϰx[>I2bGݜ;`ΰ<]cO7@ɿCiƃ̮3|Lyt0CKZ`)ӍtT\vۏ7'/WVg\ }sLh6~?Rzb\_SA 2/n~lD0SnmlC2D#L#ND7wRuHW@]0J13sQ[}kC>̀O\b' <QiyJ"F^!yʶ{,#GaM2rJ4A#R8|KH{}N`1-ҟft7_s'+UH@CXڟv=Gj}}ELg C^$٭Na [4?-!3,^s}wEˊ-|;] \-aj{g1p_I\Դ4>g!ȇ&=%x !m)wN4K(cѽlǷ1qMqb۔85 H(3o<1+>ʉdޜ "~Īn10FC>);' d;$e" m=wΌ7.B.ڵĤI+ehHA yNr7.\oCxFՀwn-st%C)m&è0ԏxvfxk[j$.H^4s`&'_狫B]/l+ p=l\P+/P =Rެ>-]UyY:*:P-=` ACBWkA ]@~#\@yY؞Zn@ZOAq|4hq._Xs0]SG0b(〄 1$q6 deٰz>_B!)-HR(2G}T-i,kXHYPq[Jw[2<7UM&Z5sK*: NMME5*U5.*OR$y誨-Rz n_Y7q ~6@JR F;8{W0YI;;u_0 9uTdwq %bA@:̸BIg r\ I[,1;pR>B؈bRmϔ}7alI՜BR:clD$Xi%GZ[Zr8'a$B;!L.-F_z?'cFa\=#dJ0?[G`Y2gcJcUHR2sU3S)ng|n!*3î.s ;rV6p ˍ,!D=è g,gchRAK@d bi!qo=D"\YtZa#82yȴr  gŘ$ U ޾` +s|VNQ!1M%Cݎſ~ ڐ*z5">nFt5P4w]Py\٧ ~ԃ"je`BD.N$ѺF~)\$C"qcnS)S ketv??);UW9'h.MFr)R`N+6[>%T#GXw_W`tom3?BI&({10$.)JEBzC!qgHh-ͧ|`}ΓPq 7ԗ SYFjnY ,A#u[ekc!TÂ:敜nxIhLxE+E@EP+:nv4L]R%TE.g˺NE Z6ݐiu7.N59 ge^C4K(vkP09E=<lԨ8낗p%{"ղĒl&In)oVtP9Y-M: FFNc831MaS,0X[_` 57Kؔ=]AV26I: czhcuv2ɽFSc2WA{jArգMlQqY!Xnn$Kr.wS5 -5~%'=$8NŹKrɋ>՗ϗUZ!f )F%&j?@#Mjܡ,O|?h=W䋖Þ';{?8\cI_42W9P ) )[2̇xE%&=۶2MO3~&NNHQCh{ER l6߬/GUK(rL @:58N6ȳ0c]^M *퍁q0xyV^%Q#0.Cv!%_ǟsߣ(1yɲ&$YJd ֜024vP 4Thx?BYgΠ2 ->*JfJr73, WRJO*F-2 Ӭ5TB/^.^T' نzXY2&'J߲ebK{ /-\gJ_4ag<|t42O2κL02n:<2(qcKYfp4e',d$JDt~צT-ˀ -"zⰄno%ݷ´ -Ķ+v*1Z`8@MJsFF1Rjej|(#Q&;jمu^ M\9Ɨ 2aLn5äMlŁ,ؔ(Y5mqK zSh].,%;/w}no!s@k49ĊwDȈ􌅱:./.o=N 8ς[e>潲ː%'O>Twf/W+ѧAե՞52 TU! Kzvj M;Q&W_ښY5 ^_Zai)~xFVg@ǿ8 k6֋V&Q2]k'ry~4U2*Tz1S b} 5Q!w>VH,{, ꗣP'Δmjr61dޖp$Lc',M)lzU8.P=3k D[U?C}{X6tra*ض~d*MCA/Wv~m9DY46VJTGc= tWAX/lZ&'T?V7v:ȋz1 H Ǔ3Q<ҾEbҺ5~q3P p$X]DqN@gŊ7qUiPkXB!5-C~(2=|fu{v5?NwYhjz7n"a =3k9Wm?xOoTlSz$TONB"R\e;[IX(ü3Md^;(7lT#AZli\dj{.e/BtJx JUAIϝ^5.>M!e@!0q*In=v5}xOgȫL1ANs_?^x@peۍQT$tv߄ cxw4Ұ1IF>HbS"0/dfp68{gU>)/U `Ե41ANĎYת烒 |P1bf{ڞN&ՀK f dq-mW5fUi)@22;D`*QY|(? hE_6u$Y^׈l2"K\D U3/QP̭WZCŢ {co陘J7?a'x'ƠcTkb2$8z}]#X>Byilc7|C߲F~F'Rl+tyxj =u8M}K~$z#i%"9ذDf/j)@]3=͊zR[D wM;=@=N܈ƪŁ&Y[8.٨tv4ӇĶnoq+!{a~E2gc|s/dK2OFezO4`bes녒Wˆ_}twN$wkexPe3Z̶2jG `GMRޓ$4&T}'@hcjk|kLɶ&?p$-t zYpP1-zYww*|OݑFw[coS 7-D:6| ? !-p(T}Qw-^$̀# ᴣF1{˹5X\NpCpLŢr)$ /MHj"RY#Bjg~9*mtc)z4FX3郦'XS5񶿥n6&%xDl ateFWL|2yy`/˰^$jyVHQ A+rx* s_V LEMxgU}!N;RzV#VR9hsoO1ӝ8DI?b 8Ēlz6jkjz3&]ӄh|1Np/$Fmr*QS6Hs{~|̾Su9nVN cݲ6GSˋsHjU):e kd묿d"oO#Fؑ ތ -wZ jPe!SrJmu J}SՋF(V6Ű9լȗfwލ' (葟a3x*i@[Dd0PHKw, 6xaM,2E]W\u.!h!(W,R};Ĥ)~*K%l(6%VrYL Iosc\qK=0ͬ;"ءC Wji y i8qp[eTu<V9}I m%$u9=tjHf?S/m6̮4&'tfq's86{! ޠ+5׏N1 g#4tU)_U:EK$1 nx밧3ƺ0*|c(EȠѶ[yY[%V$6oe+?*^uM߀ 48t2$z$YA+UuTT 5IDW1f1@T%ĚJ0 0P( `hۯ%)"nOâ0m;Z ^S*<ٳ0t)U3G-%@@PCq7ѧBCiXfF^+S⫊ٳ̮ E .FЇjnCޔ89 Jr* 7 AB3#,ɔOz]/Ǩɉ;GfC #+J!6IAYIfWSBhxh=77򐝄~B'ؗ#BK%D i]xQSHmq~ vzsQ14qg Ԣg(Dp#Ҏ,'&!-ՈY\mqj14 [2c^XvDs+xo Ŵp1Q/7WBcʲ䟞rY!9 Hvz Ihۣ) "=ߓG`gz5 &\aOW۔&#+t:c Vp8{1fH X=3֨gfQpj}, uxTX:j ^Xewk-Sɇf`Sǫaw5ydmr-M_qy[9Pn0ni0Q(I ҌiXV0CZ!U}ej BoydRł)}Y)㺙jAIea9 3 u M{.1'ЎsX矀/=C/[nP唣YHYesͪo1G)?~_p@]CV rhy<ǽ Ta:(Vy\l va*^&σGa 8VSa J&/̓ `gCs) 1aҪ &ײ{=U] qd?N2H(;>]^ 'يƐZ8{DmJpw:2ƼkQ]JP"-л78&`1v; Bī9 'k: :8^rFIq+Eams8#r>yW?MHj \=7>k3$eeؼ]Κ*cɕjfsrk]JlZBNͶ6 Te~E7FX:ea^߽;I9-z2ieai%3|fu<yY`z-|U~bOi(>DQ <AD2eeLҫ MbR?z/?7]r.ahw¸2W]֩]ybC3q!|eh+h뢦 puF?5q U-JElk W+ E],]q6&`[ \E\D!tCՒ;^_UЯ1Y޷=67o,ZM VB#(Γr1TT_"İZ;˖BJ&eQTSh-xcERD77xHSϵ9LIMmäצ{)Cc5x[dz9 B\B4]T9غB\i#[yj K*' e?]2O_Uy`vfNꗝ,d;:|@۽ͭB^?qJgqXH.ZyF`>9閡O_-plS>NSdgf!`Blu=* s="ƫ# 24n(dT5_( 4-\әPˎ0.A'2i9̈?,1 ul(l-$#hgwly]"Ҿc_,TH /6Y&͘!]#OSIWZyC IV"Pz.^;idt: IF.2Y%̎OՂM[H/|1Z=}Sg VEtu$W%s&y_{U̾653oi*?܍ǚD ,= jWFsCaY ~9U :ؠ?v 2%5YT!_בPXg- VWMfrmԐu\Ї(j5VLTy;r: PrY5%A$.WJyBuA-.u§in\ٲɋ/q1K /9TC:taэrF7,p_(P1BzwEy|?6r5,M܅+d,|_nWѥZ>s鲙P!3$<.E #W s SDeDLt$p|.ZPiu]R'ڟ$IzsIu0scut3ZJ`~%զb,XeDf~'U"F^&nG|f`TpXnP!`cRK/ܰGyѵsef`ϳmiA%UcDw'2pIGdU&eCyOpgY@!/Kx$ݐ4^aX ?g U :H)PI[ aԜP{_F]E˰OٷʵQb CClB쯢kі (J5|y>(<"EH18iޡҺ~&vIϕ [{W1а]2|bJr%ZGtBH%TAdp2*mRǐۦzv;F~ 1( p0%%Sr [clZa-\8 s^bn0}tDLEr|Xki_YwpisAi[zkDj󢧓ϭF8pך&_. ONQtmd:FrƜY,'Gѭ1. @[il!i[%;/`unڑha9:4plUeOzjv$$<żCsDjg3CXe@Ar\uf(i%k,ZUE19ހlX1i ʚPmhL@/ւf 8hz>Zʊ6}UȜ]xw{  {U;GCn4m$Hy~#7H= >p3H!HˈG < f~{2 rPE2zt u޷ 1 c-h#qдB̞0~|AGӑ.B634az4Xy S<տ_!LӅwEq-E9 $m(zLHTw#3X6\)'m>qIL5᧷ʰ%̭*0b q_^jX] V,^oV\dD$sowo6sX4Uxgep[%B(KQ!~I <Ʊ$VXNn˄q/Ȁgpp^iקuۖt qnaU%|w5;YX(=G>E[j6M0zLAOVtAϦ޾ݎْR%NJ>㩮o;^ %/A;0bk+}Wu/mըC3톬?>SrKl&tXxĽLnJEXSso ;Ra/SKd*&oEƓlpA+Fl9k(ݒ m@ؼ{dr.,WǪJJ1/ZyG?Toߴbԯ:N \/ȁ'قc8IY;"Mک,< ؉n+GFV-#s'b_*["1.5gGA@t#+}\C)C9lHnWrE퐤҂}E4;8c`q"ziQB"^m [d!ID)I,ޞe{$"7s)@aS v21ßADB ![Tvz5zG_?ttu k7rʗ ?|݃V.HU/0uü{;r]ٞ/n4]8db-$o/tDM,Ty (]ji{E?eM؛P{"B+tDn=%&F] p\ O$JNub_ IP+A?9SAit[&z.P Z=ZstZ~$G/#KfTpEݓIB!DW.O| Pl;oD ?_`SW[ ܻ3ptV~w>,H^LЅ? i*],)Tl{Xi6j!aLKW?3A[0B@rfv-'|9U2@Ie5q%K7晛)n$%QPz#>N1dge\wӒVXRNm. Mİs9F'+0-S<x/ؔrȵ@;sC!93 t~<:煌p[Eu;ϔ,@W̯{Fv6l^Gbz8D7E8O LԎ韝),B~L]w^y|V l\^jkʌľO?똆DJi]=j9;Ԩ_`8fSX YS.d>iE/QD,6wF3_+rkDv.YqWP GNǎPe6l EPU] Ĕ%:}<& L7pk:8~ zBYo"ǣsR  3wϹxz  X+.|\mc0QpPKeNZT2HjdgkϗU9L`@/J\[/2NP;-Oq7&UfizH-Sngy2p3eq8x5R D 5-ZMzsn?FRagwmw8Qy@> ?C\y^ 18kCZ02Hj•dWG;y%`M1:yN]xu6r[tip5]ұ|Hc:y= x |:civ0.Pq32VE)^xb k:7[VЀrb$'ݑ-+7-ir+4t=t}.ҟoIKPK,pv cŘ[b]1?Q>iQ %݌a!je|ePO ?cWƎ4cHbrvBdN"M{Ծ_7Y*m55a}w9Tw$mj"yL:E]~JO^/Z߁5^@Wp/fѺvKx1غ ?V4H`^Y& * ؕ4w䛡q[,JþH#HQt0\]&*vͽtmyф[>e^m}XjfNHAls${%gβBftY!"Eh[B4>kl.p4". 1G4ͤ3#P L$1^@ rԿZ`Y(˓~vk@v1jbRKhI"^\ӗn_gE]ϥ{np hz*} V&dNS}9†E\ٻh\f{wD2Z-O˞k7`Gg?a'ы`iKY<hsZz( 8{ pIg&cD xzb-s*رP ;4$ΞSN9Ggh  ֟:k'mp̼RB}'51KaoS4l 6&k { $ E:`0׌+' p-@A3A~,w0^06cTqzq֮3 .oi>1G[IZ6)&KC˱S>"HL 8kï%񚙒j/RYC@Xo~]?@7d:WJB:\x%p/h6Gy͢8~MMqbj\Yj =ȯ5| T @)3aiŁEƺ=[c<%+rϚec lj` uCCZ+Ž-~()cmnq.'L>~CW̎Gq.ݭ0`0P&'K}$2^-ѱK7X>( Λ <ڽ _vB4+ŕof5% ;ZcA}'6oxҙg>TptָSݡ~4c^sRVr6!u`*@ ?f?g1&B<\KU7Xn@O )뀅?F gЪ8S=W↨7W?:0n[)HqǞ>O):R/EXa`j դjGgfyUwV^ېl-޿ )Dž3g7䳋NdP]J51+A"NV? ̣0gT:G!^q3MߦօxL2^nq YٸbJPBd2j I m{5.IW#r*44 f3:qiԽ]Qk.A 5L| eRCd=Cۑ e{?&c>6CģRW"pQߞi8x|-O|PmDtJc|R71bOP|-bW-HVz+ɰOQ"[:; 5Z])Nm:{j!dϸEA $r`@+cYe, b9_9xu;Ϯmb`n=b*Dh,nЛL>a/α(`1(LaV@l]\x7s+FqcDxMeϚZ9i!Ew仩IYڝU ^`8AbN92v_܂[xTM"e+EYp gW'b H zc9z^\dǹ_"De6> :|xƅo'Ss J|DA?op,x0W3 ^zA<?{dPw-X+ e@4H#&8A Z3󪵥)2YT1r @2@܅`#] 3V$, %G7nKL* m?Ȅ# dtf1uVla$bU<.a=ZLYƐTFQ ~ǟhQ;A8 w6(j;)Ono[-kU.F; 8 XfrQeb*<&JCu+mX/fԞױP MχTɰ^TDErmY=s2MS9TJ{]C `Ae*AS:Ǝd玾)۾JRNsWTV$i,DPcTh( (f.]Dg }ҲCɛl򺋿Ϫp}1q\Hڍ`sL!~68LE~7!# Em^-毟Fc;%{lfwGxHc]C: 椫[u5uuV$Riߜh5 Dt4Cay|̅z"LL=4ƪ6bӦxAQMx\I$*C#Sifp˓)Ȁ%6['A6<ъ=.VMw g*? 2S٭*R\Y%Us; 32F*ʷ9eU3J&xnjuJ<+zr.)$kA/CI;sS2:0B׆ֶ`AR_i NIs`:C2PM]XMDX=<ʪ]PFJhmZq '>̑2QF +w*´LjEx.ݘ!h Y+F[˒b (4K࠰.r^B?$,RېLJv I=ߌ6v\v[ktxBL)KzD v ~77Mɫ$J%췘>;ʁCO"ʊ°+J*aC&(8. wKJ1F%#WF-/tq.$[6ltE+GP_P{}/V}ZCD='kGv;TieKĸfz(cڠf9kޫv 51ꟓONe44_H٠wExxJѢn:oDvz WXJi5ҋrOi ˟smod6.1/E;gTy;.Wޭ"6A0@hUH&[eޒ) ] 랭uq,׼jM.qX!XX "U |oW|fߊ H"pt4NQPG=Ggp(<2ъy?o,~Ãm|]ȷOȆQ64嗷0rӛm,uWS+z4&Xc=ޤϟY$򩷛; PppGs1&q^uZR B]\%=s=w) ~R >=&<5L&h?FX~u=h0E і!VD,g5d'ۮ T^.I~^io7u }f,Ax"̃ -'Yޥp.aH-<\"T$.yGF&c3Gel Z6E )c #:y-r>XZ6ub76M Qlt1᪕o(\ UĊpqziVg~[@jXi!Xp:H7>3< `A0U!fflE@^̵Kqbu[4$~vbdSL%~c F~-zĚrSm,ʸ'!Qir|zà/b c'Lf슯Ek}Ʌ^c%ҍӑfM^O#x:jV惵$TYOYJ *֦ʕ)P+:@]Z08a"w@ t`6m~Yn,ρ2X(V6 CտQ%w'4 PrfA ʛͦx\pO1 <_! '@|Cv\\\+#5ŗ4C\[?xl0/XPƙ{`JIZ:f'l(7J${]ΤejRJ$̐*.`EFuw>Sn`#qh҂ˡi'Z*k($W+ZLg.(Z.fUm2+g @l4?1 #CNXûƸ^2\lcS|MZ8o7T;fuːНK*,~M.)ڛ3xą䷵p"E;@~ꆰdVNz-Þܭ*bt'IZ2~@0 A4bFTP: BZ}$i |GiL7hyHbDIgD!5TaT5F"zV}qjq!sA5)>˄W}Giqt4o@g.QpS鉲TkqR5owW|k._Dtԍ.`MӉk=d3c 1]]J5ɨ$|b#p= gKELYF! Qdv%*uF z˛y6I?n~ s x^(=>J X2GOԙs=V1(5Yip[lޏ2]Ėб**:)Za r;6pQ6*1) rl-j{y"|T d yG-Qݠ?枒&E]WK2n0@x?B\O| U%k@Om:Fӳ5"=&S* Kr[,Omx:y{6៚{RJDA[̮4{vl~Sx^uMzG٢jڇU"nhXTBGK Vp8heIEڻLסM)4 iϔiSʲG|M+îiVa6 xc/(>,z%vaNQVF/,HirZ :;q7-v4âΣs9 U!dAsNOk$FJ (;c\+}o߄R'JVWCTW:&qǫډ&.%2)TGρ,9PPn|_J9N.V&, {N ~{؜_8l*EV褰dMWVb1G78F_a1Y3kFa "rZkr538ĵf~!T4ܮQ 4Fh~ّʯܲ~Aѧ!ImNG5wr t0-{BLY_f%W ӞFN*)j&fO'v-m*oK/"xl+'a_2ǽMLt4fIa0 7Jc 9cZ/71,Zd6Kmt9@ҢC7u1:.ާΎv6b/JC0P"G]WO[KTxLjwaO"ʋR_8ȊV'cI 3⢜U#׵{"Uu4i{r(Rf3뚐W˄N#TkV}VqDXCS/+st ;0 ŔQ׭FGE0|-[[N,f9I1OxxQah~/qZ[ %D)ݳ|@Rqx@`tpڄ1CWj9Fα(aJuXࡹ!ڟ1}h$,w9y6df-xb9& h+1'og'tTÀ==:86S[GԘw0ڤm$*'R}s,ʊ _ /`t~ _ç9q䂗]=iEƞ\bޤ=eJc a¾(*+4`siB\>Yvgc_0[??a~\fE@Vk.k1:N5rV# ȼ\_Urѝr$^(0'ס۩dp}@{{Z}ˠ>5Z@Ctܶ>h%o/!J ܓ]UFM/ E@CW qS592'v;P CsmL󋦬G~)qTÞhՒ9~Q̞lchw!+v`&6毅纼-y2.yuMvmY$yn~+6h ~}كQ9Er)-PEu#$*rIlaPI*>tjնf>2ai-C1 g?RuDzR|ݿOtн%VȪl4{2pq4D)B=Sૈ8 :I\i!^ٵ5 KLI& zy~>ŽOl"$ "EFFLsiq41z K<[|^pt@,luOϲn̊iN$vLJTy< `ruj=U7v1g%$Mq3ڬ𽋸%[>^gp` 2k'BjknWp/|?rG2 7.\eWZ2;9a/p ,ѿ B-MGɌl R9hjȄ9No~]ӎi"&>7rvxc޲󃡦D5N@ :~:nNcKJ?5 _r})&=$xz%8(=Ss^:,S,JOH X2|f[E86q.;}S%ʵa{8-`{Y~"?E#򘱘BPf"q8̓NM]pG;tǤVj"O?D_d@u#'F_Xnp4= 2>D0ܴ)ԢxC0 _T8|.ްGBSbf$^gZ$5bc>~/FW:kyS.ƙlBk?}7 wIBXYrkILDyQ1Q7sTb=KzA|G.AAdy:2JhLC }=ʴQ$Klts!5d;{:&U: Z3F"p- 10QYJPF_S]lFbDrotj F,9s:$ U#Qp0ywrMݎ1Zz]A=5Sy"vԏ($4x{(kz0I_wEACM,b,t C˛F}33~B6*oUtQ25$UOCMUE8 X5;n+N˞[iu?] [֚i`ߩd̔ >.x=>蘉Ѧ˞IVy+]|_La9$52ё^]fgOMx_ +AoS)H0= L-}@CG&-\PXCDJR xP<#0ugT*Í}C&AEėkBh;k0\c _͡p-,mݱq8E`63gYB9meQC vx zx]f$ ="aJW1浣pKW kj*ߌĦS4v'szϴ[> =')Jʛ @RVP5)P+\p;-=z_b>YG;5*|9Nq8'Ph?L+G«KSi\ 媋NJAP~IvJqR%N ϰh[b[+ ɨDq~N1RXSpyAWzeNq1落H1,:QhSJe=ָ^}.k^xd|=jQM-I}:0[<] `o0$lr[xp7> 2ԒwYl5]E"*0}jU)5gO&ɼ҇+W$(ZZϬNݍy ; $+/xԏlFr@UmZ6C{ĊRas戀 Uיd.֯klHSL.,u밳uEf1^t7l!xZ+P8C{e-69jK"z$155 ɗK'jk.V7NfR9]pfog ږP6 {Ap`Cq4 ct,^ /ed)9 ??9&WjBarcP˜l?V+2t,|P}q IZ$E\̄z1N rŸNCcoGA|BLMAڍ o1&CR՞^:#Z@I[o1ޙ ;F6*\Xe=2{\D2FZ (~Ie|/>ܽz-I1g-hNyY]]<3;rηXzbQ/ ܏y *MZLk*58*л?{EH r2TjN9`|<<%?e<=Z:Cnh^]g+83AB#h l+u҅}T0ǖU#|`oU xf[ ]v !C 5Piz3NV) (@,:=R>15LT/ _ߴ( ߸h$a;W޸2` l!ƹ_cx7hb A)S֛,vH8Nb1 CFN,~'\qd'B7_)RNZүE)~uq2+"rnR,G}d '9^fTjlGwqtqU;YL(*%wpg ϚBI3 S)sL/9x6pUEKڵEƮĎW)Fᤵi o|q2n;EOw^(C6[kc8KsBd6S >kҐG0.%WjᷤJ,:-o {Gkt⣘:xC}a66,#E}n"(hOZ#*>Ǜώ\m r:O 0vg B޽'&TڰᴖL)[)66lEUKۨ?O9`EFqbv» 6/@e<2NO}"$mo+Uia6q,xvgbϤ !VA6i'e%Y&!ojМue5 Cm/MW 9V X ;y\#Eт+VDV7o9N|d7 't )xv h_9x%pG6ˍ}jI$R/ء<H12"/n @In Vk+d0^3JQr򋁒Fϼ^®PyT{sŵ)98H؛v_tz&4XQVafiv~ht PòՓŊBQK]CxWdy}vQ#S6 ;D!#f8;Os$B֭6jQe5qo&6PMYl h/yW_r`01&5{|}aǚ0-z$By21{RB@IĈjNR2ȥ:9m"6疋6*weiR:f֑I5WH݅el4Lg@q|:=ejG#&F+?.s6?'s,"Yt5xU3Ｖ؊if3X3%Ȓ2V*SW~#?4I ЈX:L;XNհ(@A.)zDj(&QXn X0Glhj5 VL_S6>4r0Ai4s=wlyNOJ-,W7/S^b<֞jyaue%}?#";g,Vy'9DvF?=:m2|@ `n[#YVPRu$ _ [CR. 8~OAM؊?xϬzV+'_vf)$\BBf }!RHKZm 6GGQGn>y uV|4_(O@&vWN-Y莄͉RyA!j:Wm^a*֭fV44:2',z̓w;Mo(tɆa}[B]pVE+[_W_$ ?Z$N>\>\Wk>z_glMF\Đ+ZX=[`]O=UnZ&%Hd *R$e,Vm*' _xH^l& m{k8#bWg _zLd;~0b0O-кqMuv#l뒄,q'kBt{}b9gW_1^%!xmmpԀNQƳLno݊{m.IR.oT4zrl;s;y;뻛yD폊 )0&39P,ݩRE0ܱ5" G28H﷗+=2:>Me(oSĕP:D#aCxw_7%GP$T1ED9= f[k| |n5,ڡk0$ʢhnvsZ?)7y?6O7,.5o[Wxp F'L 7@_=]EC4O>+ ^zu5vƙJd;ty9\h (Jm)' ~Qmo-_%k2V)|f*^x6qBʸKV ʈl^*J0kXo36sDd1(9I0=AQ7,̯>}zw c?O$²]hGo{w,̆8 D٤ ]٫`bݝ@~?)#͗6,keG±yw|-yp$ u?=;¼D9\r؄xY `V7:C^2T!e!@ ͖˭j~ic5.E&ǥA_KV*P8"PT֪x38J ci00dCpt5+͉ $gdtȄj8^^h+p|ZlJt]ӧj|.m@t "sYh|bjL b;lkCl-uy $B֏'1&/$G$ECQg>kͮTi]P`Tg·~P)~%3dtCJڮ`H^]ҮXwnvJLZnnXǁF7Aa~#pD$rTpdˇc07K2fI%| #=& Lq0ZLG|zTCcX\a{U|rDN`X6b&%+?3<īP}1 ~ l3kږ1{g͗_/%U|ȑc|`(",J]e+U_^!rXgڠ@zki Lý}"PC2.E4!il'$]+ qcr60 g`+=$a9V${@peƴs9_^ńa,evmRjwD9Snecy+h5(DO&c~Uu`ygn\K inj*'vb"d]O%9Xn6j)u ɥ乻B`{Dv lR?l22no/Bm& /QݑT+F+Wʦ{̈́+sD3 @mD@D6B<[}B h;sVLd Gmhf-&~.b@=7:efa։0g0;/|؋LjMjsej[-<(V6_|,|yd.-# %]l}"}L〰:kT_ě;%j q#﵆匮+Bțd+)P!ozlx,U B]htF-Vybѐ+UlSGo Ne9H6.#b[0ê-#5O'f}-rRREz_d3jw:jPa3^*r09($g$oWV9U Q Pi܉}MUY4p+Լth~%*dj)%r܋D >lx=i!![0sQri͛ƾxfKg#G 0L"p[fϢO@7IҿM&Xwe%Ɇ[,q~+rWG mkɋz`3Xan^hy)B#bifH\rWG-4S 0qw6^ULO|a/L(u:sVr #| }}*^O =]k:&*ZfE};'Xz9Nx95,jCr8b7m$+^6R9 4 ^b gY,?ZK 53gqiM- z (C +R1f*C.Y8xw媰|/<8bZB{__~?d݌Ğa ;us@? z}+-xz4Ge`˷kˡ`;":>9D7=w[`3QS^ bgyVF޿P3H}<@74DNb3ppItO&&1Uo` JIt.`Cx-dwN-2t $iI2 {mrΓoW-zCwN{2Em ى #ըB6ܧ_u?v>Un t%\yh%{G4k.:B،s_S'4\o=2 Ok g@eUs} V P[ɉ yl&Vkp#e"xuQjEtCkBл6󥵥-/9cK"Xz7]EP`/= oN+S7),ҹzU-)P&o+bɞ,Ǝ:c0 wV2 8.[?-WJ$fy<P~ ")&<N}]SɹKf;N ; Q++PBDuPטPUfKX'[0x}W]`! {>֐=#Q:Fy:LENuO%0A0%?\c> w)|2S  #Ȧ}* m,y>7|n5V+EpfU _.;lͭ8eJ[Z3]F?w^0fq9@ܙ)S{؊>$ʣЮ3Aql!Ϫ_O!mۘ:qT⹬hxW2SP,q&Lssw.R4Sq;}󫙛)]뗻W.RK- LJ68>딌9Ҝ%G VIhŭVx܂;&cw6f@6cp 4FF[2/H 0 C'LO~c&H!7oEX%qqEg pLD\L g1qlp{@~e8~>)s^W-KK~E$^3:M9F-qӚFZx9 O㮗nMeV2JOz"qk=VmN**- m;G/^4aC>cnPPPvqD?ң g|ajB_P3a9g@ U=*Xä`*C=LnÿnYT5堤 (cb2 4bq WN^P:.>x2^2T}EmCvһoTM3U`0 o"j 6~LG eDh UQ^iN:iFz{1ЕVZ(QģQe#rW{zuIb:AR&pӪxh ‣F+ϔdPXXenc 2P(DmlB3]̖^H21OC bmyb85̰pPrLIr@ T&S_ zvn5҃`FWqiE+έ[8IҷZ+njԅ%%οxЭ9Ħx wyXWYɧtz ~/nO2 e!nΑ=XNLG> VgToL%AU mLA2θӆj8h"ۤKFͫm)%hiSK/ 4 BZ~΂< ޺(?Qti&mcη̐47w}l0s2N/`U`J"TuTB/E_pDSfғ9iJ_jq(k3u Y1~'@OQ'y, i?WƑMŦSEթ҂ ؞op\? ndz"1趐Oy@t>vNKh>0! .x9˭`Tvo݈e!xW2;oc=iadZ\ϊ͌lǰdG-E,DމUaZS+eOZDHB.#r@ى+ ŶH;XӑBR]^N+:8(,3AI|y`%j3 gʨ@E%+R켈< ^JwK0]hyv#Mǻ復zܐ,*N7:*}8:^hkpmr 3l H'f n嗗>3S_CtH]dSilP &҅BX)}kh!< P-/ݣ6mVu> .h OտpC3tJ<*ްw8aeO4m7o XV UNv%Ɍ(.Iga{A>־ kS# Dv=<O dn"xg5R˖BZj+ lN y'Б)]ґG~Dt. %Zvh~)C`"̂^6NA<$g׋ҺcS_NJ{3suJ{Vdž&a>ZHg2c'` 7O[ANbl7L`aJe?Rʍx=xLx]{i_J!ȮYS^V1nOTe& 5:775|u36(,ZmtG?=)+&k{TنAG\E,j8r"C'"AVD_#*lfѢah#7N3צykжa@h=>wl=kdh)>YV4$ J޵Szؙ"ۖyC: gL>?nT0Quב w@$p8GT58SSfvp*2$zE;:*Ky*|D6(5󏷶<5la=PA.Κ qUɂO)DDYr$0%י㿷 }R.MH%FP"Df6TƝ 䖞9kӚ:=hԮE\¶@%}-%3c%X=lMrCAd 'L|N%[̹8}j=kSѡ~l;!-uM ,J=G˲ɨԘoe#ηntO̕&,h~r(uUlJ&b`6+h|rz6c 8mph*'RO>\ d#4 sAEc,W.z_K*7GdXLzA_qOAae^{Ȱt|=vb 򐙽F7]M`tN`VM3օY?ɼ<=fI()#m~uʸ#xJ2qGs^vzK$x U"$kDˀXR:CAvvCNkK?| `"ZOp4!]/'1=׵y`B9y+[$+O/ֹ}8P- C@:mAײQa2Z R~|GXMvg +JQ +gjYzap7suF[@{e^\gNV.+,nn |XXA,YKRbmIQ7i S_#STs K{y勬_ MfcR!bph/ɽ kMH9ϸ1{m`z>ΨnHey^dŠ`gN :+v4RG`;g\F!R ӈrŤ p;ʭ^=}u7&İHutQEks]l'H1UxAd#d#$5%OxI;*IkAM+Q(H9Wy>g/o7 mPsC;NQ^LAs Q62Ă '|Q;u4 tP!EG^2F)&HKtWل:j:3dˌ;GzE42r&bY2$x:SbU3jjWbr:@ߛs exiJ.aG`qU.O&<}+dܾBy %} ?oŧv0p*#TxZ\Eu@`\5Ϋ zŊA;IV53|{ f.w.rղ%#>+M~^:ݶuzꈰk_իo}`6ᄖ*OHqCe2l.PO}yؗ+Մf ݊nRWN80Vq277C/U %"2]b*kטO^8,P#B.D iR>Zc~åuW>՜=4Vۂo[B\V֏F?Qe76"'XnT-ougo `x=n_*Ks+&$.0ҽGS6?@FNp.'1bGi{# EFH'5a(b䈿WaG#DY_\mvI PJ(L~^I0\>FK~nXCdꐸИL^IiׄےZܖȵWН}m;}@YF?H'S,,e^W8ʓ4h^wV{Q14,H;&07 ev'ZAF} yꀷԭ@@0<1~nC{UC&Rmoz^Ot$lH!ŇM=|TZNn3)GcXgs}ְhnh:6ߚqX~juV~:$(; }w4ew_s<8)_/)3=6YdplȬc"|T{x郐3ɸN'{A{EviK⩅Q= Aʖ_݌#Kh1 FBq&2< E/o1)&5:G\v^SJƘB9}Cj%њ,֛kxM}N\?C l* il&Ιv2C^Sǒ{-'jAIT|ir-H"_Zn]QNȧt+;Wk]TA1ae*r33E6B`5_h:M o}0>i()&Sxfv9'b&z\] _Oz_ƙ,rj0ayQ3t2[-tsA򳕶 b]ToKXtӱ5q. w[4Ӛɨ 11*H~cA`Y$ӏPA|5(Qc_o<%Xtsz̑g͞I@/>`{ -.=O1u&È+OrFqwcD_M-^ԣߧxm`øVG#٭//wI5xz gSn((Ilܷ ۰ƂNɒvW:Q~ۇ>GQ93;6EK sp+{|c^KIڍWtV F,GG0.y$vOT 5IQp Q$BY}Dd{b>TFRuVKWW>Y *mZͪs砟>0R x[G;TesKPy-[D"7l7*R; G$~sy"c4Ц|Q'XaIH5%Cw&@cǵUtͶkὊ,P>f;~x/dh_L! #+%]@9 f3t~pgnL6CH")ޣVs}k5C^1喀N?2AleoC 5VolyP4jS S61B% "mY?luVk&;r5A%Ж@2ohuAY~"ZVbF7;#nP@Rz2 &/t֝G@l&JY0E:GD6>!ݐ->EO>mZzbW16qµb0kC ¶;SPŦƪ>O,"A;̫`<{'2"QdԇS t8b'ߣ:0xpT/i*-&̦ڦM`OH` VݤtrK-S@!jz?]mK  ͕doO$[92t\:x4x57{] XUT ]P[dY<2,U$Q<e+M+I*#R[WE! 0>'Sv%VNa<.v3d5ű%OzE᷑s-6xޮ7!bXu`>pE24gNa0*4Ɣ+Vy"{X5p=CB1s29+wT{QT"'_6˄,#&ޫjcvHw$B1͐ .r`ټr/hD<4 w>s_2^SaJ޾7kK>(aAi[8 !Ⱥ!T:,&;hh<ݳb8C]"']jtX"Pin6,MnMlEkT"h4`zA"1.-?TE_nB Q8ao,ƌ_!v~6NJ%oḦ㘾 ˂pz_WT1P$ž,yȟ?58CV:+KOe$ E@aYfPGTZkr@Q q^F:M< |Inc*ʅ>N7DcZ/ђjXGD}3> )VNi ԣ߸VM4ΔJkxO>dj>^WPU +ags`GjJfCü\v1QQ{ጴŬ: E tü+UKkoC)'SY沤T>Frh o8reU[oaO[ZFm{tOVN^K^gr]Rԣhf) 2~b16b]cd7c ^$lZt ( #P?T>Q)uL_:} ,b>l$!98m3.iNYҢ}EEQ"4}!گKo]۸*<(ӎ zQ36,"J] +y;Zdڱ͊uQK𘐠]DRm!௮sa猕sPq +520Crm婝(x<"4Kxht+2fב",e~y^Q|5T/*}BD7/E^}jT2~ 5&sHlDMjU& &=,Z`M މ#{AI c j/a?lrX.G6rAS*$a:9<{ʘD*d ߇TH Ƚ~ hx"B!zc 'ay%,*yB:$Z%yik[Aa%^ 0Vk'CqNxrΦCEߌ]u*K|q#Jh--袒+ftyn- Y]erlbٌ^ 2,cN5rxe?uPo_+q9 5CD13rjYLK])nO~[ߢ|YjLN>ALG!dc-K X{qM1"~? Mk-_SEݜxp$xb8:puiꌧnٹ z,0{$uب·nj}F^&MHܓߙDsѪQҦOZUSaȡgy)G%q^k>b>N(4 i A49 '׆d;94wZAc͑0p.]I, O h>Ntt]~6\Kk7݌Ubӡ&5Uk8 Yx ~7Oy,Q.P@ydCjҨzܛcwB=] ] PR`Ifan?B/ ?}ny<_֯'G.~w3óD./™nWx}!AH UL}yyCɺ㾥Y\1/)I=sɋntܚE(86%k.Mw6i6A ´2߮ *WL,dÌSiGHej s3rBUcBf8I|.#:/tQ| h̐k4U!?|bl]NW+ӭ@q_T:7+ڥ)TSk**pa&-ld#Ji0UUQ{!w(6[Sq|kAVnu.&bW,8l 5^|Y!2e$bUċPML*wOϢ>z,)d"8{4-x©sJ|{8USഋH9Q$=1̲Rlǝe.K#u,7Hb{] վƗ WH@?ʖ 5#G,ʍkƹTimp7 f\~'-_"ဗSMΐqDD5c.|NAl/3 nX( OR /_tڻ#x|YQՖֲ̰ 5Iǥܛa`K DKh36 Iwh/B8 ˚Y0^ KtGi ^ǧ|iXOލS#کegƓևֵ~󦞡vhBaL&C(sH~p #RpUcm BoEo/2fM.+ r)qh Eq:fR$Eheu)؝BUiGm?|k@I]н_gj%ޕ6Q(N5۰(Gd:O4Y8 A&a͎Y2ǮG OD_;(5[I['#ƅwK+u2zMX0e4%G$ !piQ.܎ϛ3o3Q`vH$d|$/\ڨ9[Hώw2aZJi˂'3T<]3v1U mБtM_=5u{S-' ^QN̟V½ܻ0/v(i/whF;RXͥ=-q&J+ Ϩmr5^vŨU‘rX7BQB; TqDÃ8Lt?S\2Z|2"v?}kJ_W-Ƽ`!b,0ZLѶw<aY;<V=u $E3:T= kt^~C;4Vx;ǡSŗ/Z\eQ GE+)}}BS w{7ℴ<5 +zy9毜);iIۙT7-!nڋ}0eСfr-/iݗ%Ӌ'@KX/wRJ+ɛ]T:7M<4>/I.oU^aq#;78˞B^n-AC6mP•1I(،x"\}*CJh嶫(Xri,pT`b $x,Š@B8Е. ğ' 6GQe}i0`EGɑ?V:pNUzCKnvE/t7πJk$~W21*0_Z{!݇DD˨$'Ξms|)P"VRr?Xof FQ.yD/PV1W1&-65Ł'QD)LJ.+ TNc΀cidV4#h r+Y%R>^O@pGKk&ӘX#GJԣ./M ~-^&}G A-y&4n!ҡ(JF}ׄpI$LlJ|N;ThWzh\R#),Re3DU%FnuĠDߦ74~6 kbaWIv,k&YdUs d>7)c+#bkH&lR!`]/ ҝ5aBYۡ6xj@z/JZ!lDu^fq#{;b2?+ T߭˜F_hJΎ;R{PIݓtޫ)=V4 ji*.֗8 l2DwQSheޫvko>{5Sʕ,63\ 3qzK*NlR<9={헢+_UM2duu(%/g"#Le4.J]t]TPdg͊gs' XzJ#\Hd_RJ0&aME2VmoMOnx=}=\=f9S#tcx:=xl. 7*DƸCqw/ev ԛPˆ_He_BIk1A=1* biU1 3@=uA}Wa /V!%i ilF2mi뵈LR4)8ͼ4NuS<:f8;U4C-tkΰ\R9ZC-/~BH6 ՜ͮW9TW:dx\*\]\K'G!RooZ)Gjˆp[lب~ T&6+d*YFVbT)nVe^;=/֬g,؜aXW9G!ȅyKpYst䃾apl^"ӟ-nk5;Z:ܑ!,:X. ;!G ^'I0 0^?D>,Fr[Rf«ܭ;X@tT|y|0 : Q.XEHDŽiR$$ې2$L"BBkC3a&K'(IߣIe[)\O\[M4bD@3l=VYY6Yr0ͣ%ԫQYSN\GEMJXg,2{x<}ܿy@ v~-5`>̽!u:Vo6?X.*IoK"J({J< Y (`7y~#XѺsac\|/Ԯ-7H[ިۮp_Q! B:{-:UI2uFD;.Rǿ\# HU ۞VbSYp:igch=EH֑ͭJpa`Pd|`W較y=>F5 6WdH]> 'i% WR%00$ ʪ)pM\yW٦-ktc-Gi#8d.')JEiĘp%Vd wz%fP9vp܏ /.?K5fG,k=`2|V~HU:JEN’DE=$϶1hCqk GBͮ!I 訮r䜄o^&ЪgGԒ"#R|@GmQ qgGtcE-dBY*[0=4C=Fi]Zo)DU<<,E|K$lZ(|@-I8RVlOZ'2.D\c6Q- x)qvnXjݐGPrFNXq_6Ǧ;Y6NpփRlc VvWeOwUua#5 9Y٥bS Y`!lNRXх} LUW0́zFCR5 XqxRapGٷxĂj> 4_)=Q+4Z6[nazI/|KY$ ~ަ㰧0ѐӭJ1TBY:՘bf=fbA^>lJ{m7Hx@~bW?H_HgsqK}5dJǼfCLMD4=K f,c[Oh۾Upy/BIڞSeބ l Od+0N/u!R4ԇ!߇ w%u (Xel15#)4qʵb]N)"92ykGCi^c7p4F%u4%I$AChqEoA㕵,;CMGi;$IaBͣ`#xyAiyMVYl6㙎Ԇ5j9fk>s zE~SB{Hх3`jX+ZHãX^㨃¦2E;)j:7 (B|쎷 =xY1IPiĽB S6c$|$K'QfI̼TQADby PU cEPx?B"jI.Տnv$dW֑ vH0g醝؋] IfEӸY{J ч4##/uĠK:{JE/sٺ }IN[V>.a^q+Esޒ#Fu0ZsZK<sWռ68jywj+#)Җ930AK* -eK2P|\;w~l{{qXJ-DHL4` {s̻+a2nrh-V}\ÝވowB=T͐ǓݪѺI @g'ȠE [>|Z C) CΎ#ӑ [ U܎%(evOD$N x:JzojaQy8Cl.97 :?'qШ 9sFf D[5ڌIFLBdy/`M~{džjT?uJa&AUg8Ps|7M|(I"E"PZ553Ļnn[rud"%N.Cq|? ✤t eR64M$7c@'x>ުM5$I%9#\0rffKԬ *7kR8$M_ѱռ 3Qkf]EU1ql@kwM[ .z#kP~=9-ϋcA-ZY~>P<;Q}~@-m116l0:֭f.+\4q0_cgm`:Φh&iPVW}9-9i,A!eVQ(MONp/ G|OߤˮZ*D7_@dL5eL貍ףtg; Zس gtb; Нn_ |XNyGY+Hk%$i)LIٶǵ螤<1&…ceӱS5pȻK"5KsI~ZEȝNo6ƺiOi&b taWBs x͡{@,y;Z!W70rDy>7˽Jx))"@OZ[{_Q+ 9/Do gA@*[ u -Kgh+ugu<.oryj63\_y E'=@9+b\rACl ڧE~od\]ߧ9v?+V,7}/hs(q .T702%˥vݧ3v+u ̱PEUAhzoq^]~7ɺ}+)R'r?sRvΕ0 +GɛluSS`z9? C*/>v},:Q:,!2\iͮ%HA(H@ʌڥV=e_ʰb3۠G(-R-{@\`W`|,ϞCAS-_<~FZ1 sj*4&H*O=7; >.1 (-ؔ9FMIdR1xJZg=y,b͏NWߔ3.+Q>o!y?d5xړl]k7&6`3y0fZy*>K1Dt#\ 4 )yތ$,4 U7̕ߠv:dݺBIS&yq6Muܵ%Y+(]P9^5buJC"9N%egWu@1kÝ!)1a^x8siY~;*V1rɤj;Y)p/:KQ k7]_x,1&yg@>ۆfak ^"&:8k fs,>ViCؕBi !&7rޠ'i8p{2S#>q|eHbp>dy1AfT+u^ PNEE$tU*r@iFq! 7{ uY7] 2>W)$F msO< adZiTi,RK Q!GzJDdJj(?>ut K~-?M?EaG&JA3*۽WõO  +,09;`I|`BGjkՓ:`_ :g luގg@vKh߱+ZRfEJcm (ޥs%hUY(kEUs0ߢ4HrJfhDb8.Qi_<1[h:Ma<ŶX@-^$!"\ a^ VMDL(FO ’]ܽ'W5@jucslQ:w:7W{>*<|",ηgk4lΑ`hM eVLp jP(+ԫ+ͥ0gbi *b4! XĈjW7ྖ3"PX}x/!wRvb;#Snecq3FូV!,eQAZofmSuC >UvɊ}B;=:)e>ˣ}9Gv:]h7 ξ`h}YSb.]]I}BIկߟ|Mp-ʳso|AL7 /v0ďV[NRYf5JL9Z)-_43B:Όm`tfz`{p]UTu.xOR[υ~P@](,fc:dxQI?l5" m ]`>z^@bB"h}Y;4y{"z/؄!|j~ H$4'ٙx_{mN1]"t?bޅF)!kiu'ngo˧buf  88A%<j@_ Lq-wc|e dwOoꐲM$[iAFsyehF I]{ްĽ$CJf`y%#-T&0‡g=潟 \(p8F#g,_~^` !hzKj'""\l:z=&'$r ur$q#Oҧ+lNxj3_ESTDB y0”b-LԹ{Hp`~z(^”mJlj͗t ;_::ב1dO&P[\E@IFmOFڣیmL-YRQr> ;w*˾w\1`#ױ,X6vSRi(e/;ݾ©^_˥I-C^ Zy2+0U-SK3Z&&cEF%$I'k`3qfs1_L8QqPĘe|ӏ{%l&L5Z/%5@ óZd}8F$cl1dh*I74m<x9kd Az aWn5vlhB~g"7 1(C$&`8W!̺E{Ww58v %eum=ֻJHD}S*Tg'RE"IgelJ"t2́E14yǟʬ*_>iϫzN>Ga7,NSz`E(Td l鹦Aj/0UV]CLg`;Qjus宷>mcKf48WZR9;C4?u77f E2C9kw`~0xlz{U/TmR׋l4SD9\x ZT<[ɞ徜#?4 ,#^ #OK/OP!b3n5JgBՉh xeQ|G7ƽmFuX"ӂK}٧io?eJ˞Cڥ?KC!yWuYܜU䅑4U+ڽU#B`?O!e'&Ԏh^^>P7TQ1u}9J,& C8$'DEgQW B+&UBNZ3 XpN1Ji ):`( ^YҒEcBZE#Ft#S0nF뷬0mXoHw85U%"k-ԼW?fUxTK ĺay}ߡ?"wVVd gز3c?JB.:"0ULFpݷ]#t|vscRZ|u^t.7է(=UpEP[P䈉@l_B~}q,N'T}}GON70V!|3ꗿŦA.?7^߻t7V0|␔8[|l*@ƱUE-< `ߓ'/P E:b"14#qO4Wy"UN n%( + NM&8*\6sM8>BNڠPgH42f!hvϰNJv_Uu&zy{DcXGlfj{rNTIb4ZD‰~ړ\K?%F2z6('S U)Ёt?.JUsjCMaX[ݝŰ-9ZW ~⼑9;+ﺴ05(7'%V Yv56EBS}_fX@V :BT'? 8`S-@Aq(o~1/>`o/̶`be9zh@R D8%*w =|+ n7!REL:hN$t2o1b2Nr4@ /s\%DP i#dѵqǡ+>TNM(x\)oRq54FBIʗ_`ޭ"@|B _÷7BJ^iC*D\!6x( bÇ=6}?*oh$irӧیM GUe>6@giqYQ%7m&7ωXqq()ɴqa4B+# Ggh+oP81o%<ߣ~=!c&j,˜9kuk+<b5;%ڎp ?9KE&Z GDXg r+uϔ(tDT]Dj5]U3E KF .Kov6ly͵*O"\_!5y=HlكP9t4Zv4a/ {sߎwq[nW}եd bwH%=!C_%9QwSPHmyNR(tC)ı3KAD[(UWcZ"L}nApa($~yrU-[gc]N [Ek;f@woNP0oR-rx?*p_'/bguE=~]Jl_u Phqoz#n:F<|w}RRNaR뤠͸n,`yg-yԾ 觸wLf#b9XSEYZ~q gt˗|[]7@PψW$6JFz{sMä́i"4Hhw}ASbMJnc;jFAՖ U^+`%|nh]8T-ΘQ[>7gCǰ\^JE%tD$f 'nu.ਧhwNYΥ kwB;NWv74pV|\jvČph& TBaF#X!ipRѦWNr;E(.+k$F0V T巔f ˇt;P[O鴒9@֘,n6ϜgϩMs!cIXVgC>Lh3pU?To=LJG>9[]%+ؚDIiiI|(#KރN*-g&:I&hB˄049W,jXq5tsXǹ*86e&1'j!Df+n\P, ᐝfqkD(5š{uPno92H7Je8zۿqtƫд,Z<19bRy-Tܡquӟ9rMv αk<2jI vY]ztX.QwĀjB{W4IVN^oyAjTB=lS쾭 JNUc05JycwU[W6w d_dZtV\<bc|nc' c#⎘̩iBY.X"-g&CL]odppEu}33 JjGR9ۜ .8J|)z x:*=ɛsfrA5ֿ"6 ꆔ@EXᱨ0Qvtpy p;+VIi!Ug^}vy-g@iŬ%dcuB6EP+h YJB&\VbG';/z"M܁\aqlUxt;KS.k$ʞc\=c3NgVh΀׳QˍN IsT'p,ܚ] " Kھ{i2u]| o\RRCOʒCA?}R2p)b o~.yM|P| ⇰` 0ҟvD V'$T)oH{8&ޮv3~4꩑QꌏEydg{6y+uRra'%̃ӡXvW O`ݫ|Z!;=^w?{gXa2wBUT-99 oЯN ;F,,mܰ {=Et͜P1[aMYq1leu\" C!'X{`"ͬ4Q>ׇ&E4@D{DEJ<7H_ W1Ѕ¬{ՄfdN<9(Bβ"sa(\,k+7:vIǮ!q6^{&_.A֊8\0tYE()!ub~+Xqq Dsy2ϖNYk+] Ŋ\d'/5Yp"yiK𺫜`>mb[/l< Dws^_$lM'#eF0b є}6q* xeDu~fJ/]6+AgzDקҼ:?L0x}EhFGґEos?eɶ6\Ѓɱ%~ZU  fj?$YRZD*+n3 u!3ǻ_W`ӽ&Iew|~TfѨ8^ځF\D ˤd"f%r7O3: c.|Xa&68lzq9k 7q ڏ;0i,'|]& 1jU(X]1/-nDad"Vw[?Vtw`8>K3.4jn(Ծ^Ie59e<v77KxrK[DПr*5+Eiu T;g# IaCiHݨ\kĿZ-Ě1kX6Q58/bt,XHaaACH&3N 䒾9 %f+ ]ׂ̝M[\ {emI>I< U8W/…6Xճ_(*ؚV%7geB,6m06- r7}HhNI!1h0?R)K~cxtM0:0+d C (܈f«5`890s5qWsZEU]bIED.F3X F %Y@L3->d:R)("Q7Fv?Q컋YV?aq@:ic)Q:t59uC} ݯ'\3M-`K'tNyQdtM9h 'tVCǂYG^OWqq=&v(Q+NEY7 󎭈RZ BIeۼXKqá]f`i2RuVEMU=|oXXER/ SFR_YOc%A<0$$D#Bг8&mG,9S˔/7dM0TYu;nǧ);]#_9@&/ġ?}nTq'B|"NKV1#_}.:MfsAl@N_=~]շH@!{L/Vz[zBG?m]H=.⒢l ,:x>&7y|SQR ҙr*<`~' ⰜքɟOY%>#Mۉ{ ĀG3b'BυϷwaBaO,ӽ_IMjx;k`{g4_ZoT:PQZ! \T =\QRs]LϔLWR9%v,ښOUZ`ް;feJA蚋Xz"tY k<.A jyuեdT!Fu-~ 7c}`dd"lc;\ \ b g Mm ǁg;`쇦~ܓl7>GWUf X&0(|e )S@+e46ŠksnYD5*"`˔GD/ws╾ha>g}$Q=O7K{۟N2f?v'b. [ؓ2 HZ:f|b=~|Vբʇ._Fj9qv]4.&39#9ƜB3 (5ҥYF![d/x?33o|",gj']cO+.&^ew5j'~Ր'5U ǤW܈ͩv m-iC @G`vЎT8MJˢQ0hn5Jo-K5fUJu;%e{\ހJDafhNH7aU6!8#-߶qJ]5k.qgꝗ+ea>WK εfz^bSt^;c9mDЄShxC^*0rߌq|H Rbr_Kݹs>uy.q%+㟇F2 SE"d4 ?ɌDatO͜ǰo@gɑ0ڞuw1C9zm: P]FBs.u'nj:]w0}I\?]L=<٨UttF#kSw(3-֝ˍҡj1'$oROʒp" nٺf6[SQjoD"aU|mK" TA͓>7 H/) xP9Kw|W@~BYEDry>8OpfdQȎGm i┸xssXcL<8QL:4 uQ*L{]n A6[.UEղcF_O khq~K1ࢫ`ۜ7ojqr_m2( )zK6\~^LvGq{H8R~_Ah HJ4t +~J4S)))~u5 1&i gʹ6k7hLFA,خCU1VO~떿#㨻yw'GͬU:{u_>/9-M-gH(3MZ|^3TZj;''nH#i3EmܕwB)G^ <<ۏ/-b=_hǮdK/? TXT' um_EKwqeͱNN W:oM[%z*%@U㞚,{8B۳bXJwUT.9"{>%v\$خ5qK<%IΪ*ao<̢I觛manT!| !!3pwsV{z8zG gREN GngK=QXP7gZ8iSЄ^ۖfe߻j*qr -9E]ürO,%g̬,N'RBDwݒƤn;0$,Z 3v!, ޘv'kSMs627>S-/m1G #Sfs]+ٛ84y2&ۈ̾5xۘGݜ;6 EN}mQOT ;Γ5oO[:] \@TTQCEhIp8Zk3,LK:3RCҦ:`)ԽL?|W?&*eCkR$g \y 3(%&$S`>֖JWW/x"ܚOQ|||Х1V^L`TqBnrvORi?֖w7Z)Eۑ]F6sՑILFv} ;Ly3# lm'D_jKayl٨ȏ$2&8LIa1deLCt3Gc.7k9޴>x!MQ/#g[j-0[?9׻S43tja &+`O EF&LÊ/b[ѧq*JI="q^H/&bY I5َW,EHBQRM w^tG,*.UuC!$w5w1IJP %z~4h0_]<V~ Yا$T)"AP"Zw 2! qq@u: fzN1!yWnFD]v 1."=x6aG]OK7%+"^Ic;zohVw;ǗյIDM,៹Ki,4uwi/\ z*,sK3f뷳.JJq'\WtWÛo/׼eTAƄ "t9t nZr7>BkmA8fuMST+ Ҟ&f};$hbb+8ޘu3eq>>IR2&_1lݑjv0D@+UmÀy <Z%G,i6>&~B3l/%LkDpqՏ aϡ1eSf~YME. >mz)sd|T%ʙ>`X{h[$)((_ X/W47+AE{[ߕPHWGV9lGg%=|yd]n$u^!­0y_ BYZa5{]P''?thⓐZZL|vRdz;oz5hu<~]UgU+c@r^t׿xsdʼwrfجMs 3-`u-|{k*>ڷR[T?Ǥ_҉^V/^/}^mhć."55c=)Gy2fa<(?uW{ZD|]$ ೇRмpwɟC h/?qt:&&B6j)ퟟ @$mxDIʥ/'."/q'c[o`e!<-Z?~xiMC^ *cXeYWƆb@$TS*me}M$^`?0$C +A͏֪G:L8&qR?I,_2}6DB5 W617*P(5U=P+Mo@Ih8ks,NI;"I۽j5^Oj /A\ l-@@YAch76ߦ9yI5/_u+]ZY7-~YoMwy>zk<ƫ.^!U&d́7Om#,?blig77:0,+؍P(Fp~a~(--qFgeYL6" ߺ>"1>/CxCz>k[{P^n%`0ptb^:@!&sKTj4 ׍PoI4D~3@bմbZ@xV+/P">[& onj6s[|$>E>:l$/nP>&A]SJ2G%=7NxZɉ?yjo@lԠF"'-1`l q=Ȇ(י_ n8Ct$mLb(S(+O?jJsECQ0[3'U/dnļ+e]ݳY֣`fR W6?{k%&YFO kfMkJmRͻe n?xoVq<]|ܺ}/y7o5e7q*kq_e~ŏlӊj2L'"8C;* x:v;*`ggpk4CC qs}c췑AL]<&<yB=O38haʕE2}2!wR GH~HK~#پshYD̆u|< NKWX D3}n_YPqOf:6bsN$lJՂ.Wk f<8I;{1'P/[N:Pp­jnޥF'&.7GAnV3P Dos$pNī\BwgR,v{o -=uYݟ\j[אԮtұf<凇1rKd $ukn9.JtAѻָ|YMIJ@x6[yFK&(`cYT-a1_6HaELd_Ug4l楪?;s)oZ9ۆfU92"9HE= MZc^f;.gAZ633guUyG.+2E5D>Y]T?^ ~%>NXmZkv7B9 j AUѱz1O2jM1~tcQʬncG޲VhrN sօݽ?]H$J}5^KTJ8 Ϥ, ?6*[!S>|5=h ;A(7-Czyw{\ Թ˳ S ⪀$VŰ솨[ϴ~E%}msig2v뺪Jt@''l}NڷS{y&AJـJ3g̬GkAl:r ?T>MJiˁ 4=$>eH[蹷" KB7u"#7BtbA^w'z8kQrO2@P[})SEJn~%LO0& ݩl ~ff J/}dA5`/b(jpr[ão|S/vV?&f:)vaz lV/qP1X+EH{ `N,'Χeo-t>v ru$) 2wZ% ao#GVJ#ػf@녓ʾ@x`euT_?JAo V rkk'x!5}EC|aܴ.aD  Osu43ׄt 3tA(r[rݨW[ei:z)翊űb"TR༝{;e> U-![ĝ& ɐq[k JS3K+3ç)3_a0R#a.;h_v-yyFPL 0\Dk l>&A&eNAY6˞+>gz<6&,i\uJ ZI-8Rɵg 5Lk?xaͯ갑'X=,1T.Ldepv-$`hxG>y}/R}QxxR&b;"V -2WV7/V|!PXv;b:{m.Go;吲τqG5 KRMo Ã5 V>$‰ qe'xz -aB88RQ[U_)tvo!U6"S@LNQrg ӓ:{~G-J0N(n OBt/Z`NTl+{|臺VHHփe*,< hmi0_#q/D uλK/t9My MBfb=Pom62T zh1%0ž_SS?ҕ"|r9Po\C2v@Ⴥi!_o׿HbAC1z@A. ?oڥ={,(zNq͙=1FOAE/#K*moZd+G"&'Mtшˇ 6aQip kIwq4~%]wcq z%i v zS Fa,X~`1$A9k8'{9v j0BT7'&r7-RIF/-slk!$S96DM'f;ZO=le_|*Ɲ\[33dSdKHrFgBdtLj[ɤB2/_]۱/[*([_#Whm}.Bc}Sip=l|JےWNB ]0jKhn;_[&I֠ 38|KDh.D4MѼg5E_hh,%Y׌HsP탤娬|P"C o*\m._r˲Wk{7kn0+%G^!.4=,[',Z9j r kθVZ#de3ge iK+(Ti_Z:  ݅ljQ+?]96ǽV楤PմJZpkڍXʸ+Q&[Ez\ (pegl[ 7\LrodeW @,C6OUhVLdk}.D'٨1SlIJZqn~h?@o?7IjSskY ZiMozS<@P;|e^ 3-}۹=T| V *0IojFsl) .пW6@Sr'eB-լ}B"PI~G{K۩^{e~*(HMwtQzy']zYoëy$C˭R]p M+pLqABZ ?M"{ x$\UϘn $6ꞽ-vPl1q3pLQWp?ta=6 114j4& L ]󟰐Q6}"Od+Nӛ#}f=$҂7_K-!,Ɋ9r4 UQ9PDԙZy%!HHbQ~{%EqNV>}YuzFbD Ԯo+t'mWesʕrVj\H9;"u@00_nРi#"MlBlNl|;e$U+5[nDN`63+_9%цn R"8o|ޑ BfܴF f%{F 5-zֆf~XQg,\,ĮzXeW}U-ώEAMǒ9O(MK}Bɣn촳k\TDŸp9ruey$Jɩ`>9.s!zkS!o$($O#hMlwM{bE(^.;/\DtX)7[eVHx[VR'XuLtp"N`x"{x(rcq_p"9Qu36utϻo7BƎ bˆVfT\e&9OPI8Ee?‚(<9ґa=›&Nΰn|6?ph}QQN)Uz 7űxI@g>4"wƌ<)܈W@/LO~)缏31C$9t  ,y pY)* Lf~`F)1N7\sSor04G(&4b.[UГ8wt J)3{(L'mɫȺL3 WYxm ([V$2ųܝ{]=Ɗi\8/pޛԎr ɡHobSρ-[ѡ "ͰpsBAs 0|ve!EwwigalNУӷay&tu{*Җ z\Aq~"ՍCCZPpxw8eayK)LEA׀te\?E^7Q* SBV [lo }ŸB.<>>wV^RCߩQl/m951B #8Ds὇TXEY%-K4{Z 1~kHC$2E qA4×Xa1:BUxX(zw+X`Ndbix fdzs/WPQ(|: a~I D*R^^k%z2iNOnA衇P^~)úF~Ps\0S^fyA;uLDTzMֵ~~@ķA5m̨ vEݠ'n~:o<ͩN֗&{Kg;$AoJ/HѾMn&_FӪ"욂B.C8.f¿BPĘ:Q76VZi7`DeU4vk@)/j{@͠F1T2-)HZ.1.mgh}ڗ*zwoϐ\?j8a&-'=#f' n;3~EZ*Zyv^$xT|`3M2۱#8d.Ԯy@`o|smSDz3ޑkًL.rgyUZ:M":S1ŒlncdzuUQՠ8ZxȕCď،]&pD"f~rdɚ|*e]a~%ZϕsYG8ɷ݃4/yrS vjuO':ᬙD~sJ^X\8.3z;ecm./W*_ZM FaSCֶ̹BJ7k|Am,e >ưwڦ151 b " +`#ç%!΁+N/L9Aq>XŒɪL@ EܝOy,qKp -fix+?16px_E^؋#Z# 6Nz!? IB9r8|O~i(-]HE '۳iWN[aQMͽ̧Z)~?_JZhb W, e*! ETAYH]%"49!cxw;I>pbNWTph4KRNKT<=5Yϴ; X 5P)JˎOL95|5C6uX՞Kj$چ{$@,it^۪ERΖkzFTɿyB>%*Za= K-c~ol8.+;CZ " +_,0~ ]ҞBfeqwԧ.-i@N&Q!=Q~M",}?d8!%I5hn:2#j rib50V3.{~b"o#ϭ; ~LQ9_64Ng J~tɷnBpE 4POᙧo%xNBIAA|Zn?p7Dd}rUr~IRNci4.߰hKpL5 {EH_VRT.. :KH45x^1oN(G̃F 㒺`[ԦljWM⧒4  p˴pU+v- DJ༛e\/xi[5~/s~y='GSvhBM 8{x#F;խP2pw,rO9s#>NԑgA| 3 ` G;)?1XD8Z$+6 G?w_# 5Mv?uP]chmڥH IZMYiUt]^LxI)i~fA6QT'Rl>ug>nkR$oB$Iqb.r,J 'Tm%4;>%Qɑ2C&}'lXA#6BexTgN{*]U;#71 cIa;$9L6y.2%:7OXcgN0_g\FSHaa dҩkg3M6izov{P5[G%҂ZےpP{4YN5cJR%H9-C2&L%CXESLUz81 U լ= e@UE#= /0 3Ow <{6m3z,Zჺ(w_8t\q[m4h&1B_VDeta[u ]'yYѓD &g.At#>'_v0J>H f$r8] ^.`PBM`@d=u삂kOx}<7$P'L8|-Lr A vt1ѶeTxM`@]%}lZ\S[.96Klv0" "v񶗰)g ꙥP1))J0n|q P1Mv Ăv `_aǪY5"Ab .L`"!^lƓa6ahSQeBD$H>g;F-)A"[@TStU'P⡦ާu)I=\z;6c3\*O[P%08Avp RN3ips:tL}Tj03bHNخh(\0kH 3M2ANdkqW-ݝ7\fJCj;&)t,8c5fE@!Eq#67DjT"a%M{Z&ס@9~KҜ][,bW Jp*X%b%;f{w yh'OL-p E_sv~77I4.bj,n4),+'gzĺ0 99vk!GEx!&ʨiQvDpZ.fir !?愷l#g89FS, WhQg&O_[ðk|5ٙRϚ _i<ʽix*vrvfW\4$2YTlj"VV; ͪߠ(^oE{9UuC#Ĩ+N-D3a(*y+:ʃz0ałZ|1\dZJ%l`X4cԚKPs/Wy.hC_ ̖j'̃-pO~ci-oʔaI0zz8?1@J ε"42pi#G.ZƷo͸%Y"|scW!g`ߓS?i&v0v5/O c^k, MGwbF1y*:mL\C*P#JYB:XEj8Ѭbl;~/EÖjgxثuddҙ#f֍>k#oYNxbYZ\$' Pa orύž4.OlB5Ò?G O8]4c+H'{4!tPrb,A.2/u}1co`UJ0^Ӎ:ߐPrSǷ9;. I;X&Ճ EQKX epQ2rݻDQ}퍍*A& ʳ !/ʰmDf+ +K 63G&/HjYȧD=\' W9uf]؛ASJstbOi2 m,.Zg(@ jE٬">gV?&̜^p.dyY3׽'vmJɭ0I? } $jrmi/Y3Ķ|$̢or@="U,5l0Lh\Rى7Ռ b9auf4|xJaާ|O sZ,QD"2`7&M֊ǎPwan=28Dg_UK8:Uv>.-٧XP/髷jw`lbC)<͑Ɣc֟:3.KT I˳y_czMi >`rAŌDP Jq=QA2;. u nEAs5Y3|./ƛY{/ֻ5@֧LA^騱с#2;#Fsx@Px3g%JoBX:c6^*3Y^We6;H C6*]isqQQ>-u LK8U&9>P(Ove`;Y}^@)Iv{ %XC $L;w,hLH KaXJi0^1T$3d!\>N$/AIY_7 )v<+غ -2*-B!u1MeÖ"g" >أRFsCFys2 ғƜfH&e#H E 7Y8[-2/C eVuH[s *գw-RUE-'58ZS̅Vk=*׺W蝣ߓL,0!x|V%'>zr+"J"&D R`{2. Ua]acaN0zhD3**V}2ՃSTâ3 )A T3[S()d7+ =մԖCߚ|AJgAH2%鍎S!|c^L3zrS3\'PݣJf An] 3yLMe˥(~`%ϟiJ*VWOEf98Q |kף{{oq/} H{“m3]a&9* rH*@3G:[`vebNc3ۂj=Ckh6>rMAqV4#EFXт_1jz^{ǂm-l-ZHMlQF+q&VŰAiUD3l0{u[;Aꚡ$6zBmXͽOxTQ =W#*DJoJ|PM+e~g@5 fsFm9Y&.!-opҵT3Wq 7@w `5ۛcɍ>%},z bzZҜϜW${H TY. 5G 1^ Ҭ~g A^aO,,u푟֟1&`?1Xj/Ø#' zF@{{T -S[H[]Fu DSFYSF 𸯲Br:hÖضԖJӬDyT#(`J7t>LXWl[ccl}fJHAHh濶 )9c߄ ;72"@ݸug* $H (?L]N7Yi*JJc:(+`mf1TZKd4F\o9FpWhQt};GCr;3@ů]9xm`븮ۀk /".pn85HۿG (cտ#!yV-(<R9%Н`5@VI8H"Fw8r* p/O>b;Ml?!E$7W[H7nȊi.%6 F/>V r*dC%'"S|MW+c \/G*FA}uhdP6e&)j( @O:ޚ&-7sbJ HE/?iH,mFYd hlݓ&w5C3 dIY/T}hZݦ#EM1'ܹ>Hw­E}& L< Qg.&`^X99Y@Ïe쉚g^G$SE OFM#F\jF_YDG0! Ћ.SW.Y*E3)|/hiG?GG*"sw>_L>/lAjv:is>UlmI%93 88¾Oi'QHe^{ZJ̴#SZ_l .oMh%;B.Zpv 7w%z#7愮&> V9wx]h!i3Ʀ(~<>~Diy!~R%*quC\u#NoAuɆyUbτ ORn+%+mм32uGw-D2z?]/`j`|Yk94}p7Be21ƠKq G$a+_H2]ɀ\,v6sqcέhr/N{9@0pv2VyUJ;p-[TeyQH4J_ZY[c] <^V+&iYe>5@1Z!-M(Jc-TmEѱ4 To+Zao%G"Y4>ؐtfveyd8@qYH.4CK[3_~_ R0ਅ0~OKqS c!)>EI ӿ <;n0A!!WQͼ$އ݄NG;`P:auFy!o#Kw] 5l ydeIB5т3% ];ÔP"ۤ<#'S42licPUaz؈pLBU|i4n S +<%m" 6/P+ŝgi?3%K9\)@V+uN#oI]"{<__ϡ'S*mov7t 'YOrz'iof#%՘s~ .3Ǧ1H6O3D[ OBzc. J;D4JU'B"a HXXqGkt|9Y?7Yz_`?W D{e `7E˗)тˣ$M_j9M~fy(x-B"MBcPhV|6,&>Oemqs|5y bȻ!G𱃘 wع Z9+O\f,˷`P|xa1&tڥfkXF"yjf E ;ɐ2' dE 2Oq8`41'T4A>Ô}<#pUT"Y$@0̈́~!ahH =W)^X5TIW]DMysVb;߾ġNwo0}3S͵v<<>6\~G[_-l Y䚓Jj@x򦙄{]q^NwZ  u S{ 9aF1_u J]BRF3Z=1tilplpF00J0ACU!|)Ezm3nC+}| ǃ_r\ zF*\N_9\ռVg.[&'_TG>K =;"<$ (}y:ר,rέ5%҉gNL*ݸ#YmŁ +ޝuӭ\qV'O m|2ÕFuoJfha . tOB;eؑ=vB; FY#ƜS@ӋPW037fտӷ-NWd RE^ɿS6}E/&ԙ,aU'|^3.E$Rg3$3O ?ḳگ3r%8OelI; ^9P].@Aoy~"zgiq2i@`uET" ֠Kxz"k\E|^JɍEuI[zQ~~xsD[ }@L/- imB5ДbA#oFe W0XI҃BJ|tz eFzl7MLR??zأEeGzY;*xm0#̍7OE{O1Prrwjc봴Q }™YY^?v0X#yOtF G@p//~ I072?>?/p:O*vi ʈ Б)$ڏcϾJz J>&jXh%mr[M{BO U)M2 +L ;x2)DY!$3Kx``:T')p7ޛ^[G?Mc08zFe8 :^~]H؈Ei<:0SQl퇸f/Jŋk4MHŐS;h\v0bF*s$۸}wP[ 0E[7A}tk2QS6恭V0oTX$=|޼ }V _>[AﶳaU[ZgBam2`q7l¸gId]e618 $gjƠEݮO{ ~BF~s%sn80i\#F>Ru*扷誜|5 e",98Z ^ Z@ծ1,Cl1 ҶIAj y0lO6Ehz3TLY-aH:CrS'X_#/*$Tl}3X`[u% ~؛@@G6+$D_aLd]|M!XaāORDˏ0he=+^rqx: ::՘!g^iʶbM{;sbJ ݇H(vx-EEGNWUWiBu¯q" CI<G]Yʸ[㒔xbWĦw8 r;UBM<=IJ 4%4 b" |}8/}X@rxҀEYH@3 k!n|G$! 5_Lo^._ ۆ5jp69#[&akuYxs7.HQzbrdV)uW"V9ZMn RCYpWYׯ`xw\RVaCX#w2e3j5Q5؂Fܒ npOϸ=)0ŝ16R%LQ&G~9@ pU@""/J C~nD#HwV~{Qs]k/Q+B""9`\4[(Q;㮱և#.OdpmLyiGyQJQ;Bbo8yrQGVc v8g| O]gti$M!RpF}<{ YCDeKC`p+C2 Xfdwu"C"~<:7~NԻծr <;c5uFI,R"4%"|k5E֜IICM`wn%O&3]UJÓ`iZZɳ+rc4bm:H5p|QYQW{ EyAR ]S?w8鍖L*I#`YBBff4irkDNg⊕^{ )qְK ﷘yͻH'*-p_ACiDZxڤiKA1s~`8wYmWՂdžۚGnIJPd_߸G*늃S qOP:R"Va"DM t);h:(ub>-&a],9* Jy4U`f"hˤZ-fb B<ڜ{8`ȦqY_Vw]M@%[%$_ɔ[eGI}.O%=!٧R&p GUY|PŁL]g[Tmtɲ6=5;3{= 70 WB? ÆeYlhK« v<H_-s 5ReSͣJHH$ J9"@ѨmO B c5Uq-hJ]CB-']H3ū tI )LmT?]BY.zP2SkI0Rq\"!čgZ6kgO{]~rV{g.o!Z& Hd"l#lcS7½f it2yyK1]{Ƨv;cv-sa` +[oϔ_|>!m{-I$=ٕ 0%9 i b^],U<򬚹i|n#'&Ϫ:|`9T_(CIzפ]!rgk86=1&j"y7$fb#Z Tٝ-_\΂kkM;ޔV?? 'R囖M,Ԝ/Lblڭ!&S z _֩7aE*Yc$_O`]`-'-ufuB95v >w>M)t+|,cn I7QPP~7bmȁZV;d7~&K׍޿ iw0-7ʧ}Q:Ys=A#+FΏkDr/ i #BDuJ-#zN&3TZm*^J+axUyI*l*V;2"%AoOJXa)8L!䮼7`3׆ #n0uNaYȘij_yaW4;8vK:/ rvo4e>q=(%FC?$w;ЁXbErA0T_]{[GB7.{VY@:qf k 6z)3Y26LX&6l|j,,JHvnK:Se?EPy}}>`r 枟DhH=@/0@' Wj%puwޚb0|5ka/_sGfh?Hځ$0jNw"zR9B47eY%1]2a'<&λYmX ^Z8Ϙ#8.pi+3m~hW3H"$B0jm9`hf0~Z8ɿ*4aI03}e[^=3XRXOf;p m?uW2,?R/ݫbilRޙ Q:(座4فqa]!Iw]. OO6euEϞ+%mrs@3U|*';[A_3즭lXA$F$}YVl+?Xvhu=(2Q@o}RȴK)F<0"f1F{S3Y+.|Dk$ҹoTG_j+ͧؾ1zqd9\+;:Xa&q΢.ܜѡ;( &46jBHq.P5Gz2+jYWHX C\y9G~䅲棞$@{TAւ2ZHmŸB;g#4z#iW~{@4bT VdӣŔWD[YҪWGDEI7n嫋6KC5īa;m?aw-S OrFd)p\xdՄʘh`X4u^5is癡!r@'_[/xnۍIsCmJGeDff3u9aA7;bE9vqk,a%N/uOK+ RwQRQ2$Xh$;N!gFK>KP;"W)G$Pln]'oOlNq:YP$c3kC]Ty@W{clKOun~چ02^S(iD~8;VM 7wLOkʅ/\!Pj1 St]~ J8p|k l~XЎZJ8T ~ts`DLW}S$ ʯ!UϗXYQt)M7Sd!Y[T)hQk}ǮxΩmWcM'grgϷ9& ٴ NǴ12$v 7Rʱt ?p&&+ĭI%GPOs¡9`>*aQ৩ݘ4'! A<sۼ̸*z'S}}ʝ;/C`G?R=ݸɖ65Ƙ{CMJT匁\wx ;džADW9S Gs>/OCI'#q~Ktsz(grKٷTr0wa-xMoiԛc>EyJ$g{Tϟi|! QJtp6__߳P6n|SXA5d,W1%)z BCԆ(l `>ct:9N#ƫꓐ:CnoyŦ"ZNs)_rȈ! % q|Ewq.):{~1XhMug'qkb>e]ϾeR)8( "[$bV`8KvfJVAÞ" 0rO )\9}L-Įȟ}Uv4@jMKS3."E]IMv8Gm:MaY,w YjI)D:_IjJL݂!k{*m #EnyB *@كu`h2ԻKϷ>UA >.6 #8eQ] N-NGgEv*f"w1τ(,Jl"n,E;NG0Tw7vE]O@kE9b͒Q+'tIJqhudD<>>\NNF}_S<|ql'' qܓ?SP4U$(pjaf32g1 >In5QEƠ)i&"{ciuTviDEea>#ݾefر{/[C.aUE~8M O QXc7M!0>M"ЂѨվ>3I [q\‡Ut:l3>%}Fta*.F`kT8LrY_4kb2.6ZhL匐7OjAOTQc`Ұ >0[}!4ʤmaZqx}IiQvdk )r3(ЂW,y-IJX[r::5w{98|] ;.x2FyeDJH@vyR&t0n,zZg8̜+DN8?%ِl­{A^(4#c|)j4YA\"n݌T٩3jnJU cH܁gu ynKIH!ּLZbk~ϊ?r \e3.?ԝQLA~AIg*^D@%}L-@٫V-7>3q\Ƥ̷B@+jQ.IerX:-ǖ[\yvI]dqox:.˸TR|.h晵qEr RΐRi?iq kE:z~98k^vƑ j40CrkmYuO.CΒF{S4We M)0Ba?ei>?;յ(]B暮}p>*{#ؚ~ΜCGZ[Ȟ@K7R 3o툹fN 9 s8 l®]Ѯ#M.;PUfmqS>)ƠŪ[xoJP5 nUVY޳~ݔ <)3+ҥJ}EvQ Y1oWF'=9zӌ% n>m{!&⼮,ѯf8ꛭ_cFQ EHrpVKy:/8Z")6i[F Xhzc1b E8ۙWs#3KFq1-QuDxSfK?OЃVcBU! ǽ]Qi %_Um?X=Fo5/[S լ5pX/Knŧ"c-AdE5 T{PdR_aӧ3k(fBhP[v,uv`z@%c`cajP0uKy5VN%V`fĘQq̤3moDI<7szyD>ɋ]=o/3(j^MƝqU9S5$iף;x&8qet3e ȶ1 ᚱ<z.93Eȣrr*妞_@m6|MhA _k`tY"ˬH?rgEG4_۫iJ#WWQ RMG_0X,.iQ|#M.G.6`)6rI5n5nw @_\p}_ 4bWE&z^rv ֭F+ٯ+{׮fxdK0Isg 8*؍V1[𛓄"o2גKt_^ Dc8H,hofw/[)%QޗHSIYG {>4QUvN@YcMo9m|jhZ^w/-2_<[̌30kb{|QaԕDmy}L0%RTQ݄c#FǻEy=̳ÖSd,V ϞF*kQ ݌j k_aJㄟq T772>a}}c2pj#vW&pM(QsiݽkLj5<7?MnrOʳExgXڶD̄E?+t)UPJ6eɤ@ uთcz&<7FqL*QJAWf u8I \jZOql+V+վk̈}=>3Ṳ܈n\w{g{$DgQiGp98e"#cNA_غs7=ra|B =XAJ5,;0UyߙW'u\ܭU>-F%l{n#WG5VxN$~B(DwĒj" 8>9%@l[fS1ХXy{4Si(pߠ@T$ Q(x`a}l0tE]B\M#!zNb)-G<P}<3{bF"P%),p\Ía!z&˘q{F5}\P{8AF<ȣ\/ת:MģWobj1)9?CuJՏeZR/^ca%P)AGIU;3#NqK_W~S"1TaE6a65Ac>9h)dEX*Ke`h*Y2jyÀǵ&aڵ{\DO|u>D4oceRU!,CI eFi6[*JC;bٲϷJf`ф1wy©Z]bCJMъJ A1U^Y`'lpCXW6<5a48e! ow|BV]fvOIө4dʔypA 4|s0Hg2OV+~'Mv[~YRK6Ȳ:^V9RqR<.u<0ۺn}I(żtj6/ů@bqawբ,/9Ӈ㉘ggB}ƅ} !:/M;si(%ihpBlp%p%o^l\$ F\"Dݞ%sNa?Q, \ˬbt+R ?E,QC`%-"oz/p{~*On,T9u'T!W'c)eplC X<<=+3;VDm)*OqLCyэpS uLS /٥Խ~b:OEۄP;P"yCQCEڦdjӎl`W۶) c|ΊÆ=V~0Fȿ6AIt_+"3j 55ER-1(13 X̕ 6eQor G{ݏtTѿzzSN~ d[74kǰ}o|p4ldf4G7'`~v*Yfoev ߸~UHva5=Kxcu\L 7L=;y#@9}U~#yyUTuM#zwqzGHiۏy[,(>UNx{2;F՝tK ò‚dI`0H 4 ^l SA?:+ItSX )Yܦ+3A~![v SgK\AA}.F驍?14$/Xjh=+Q1go߃^°@0H-0R[88FN ~C8jH% c.ϐ稺0Ta{{W@ۿUtAdo,o`IwZCi@{5: D=BѤ,ո!h(G!<=qS nT1*4,'.Uã$A͸h1?lX$; 2߹;oW,>%$MZ5VXY&smvN @3}3gHIcm]$Z6G q@>衳b2BQ\S!9=G?:o@Kwo(l5,8V}p1uEeneoͯ?Ό < 6(]8}ɆEPr\2|DBnǑO+!Rlϣ@?{_k7K~)> ԓ+SZEMW#N% { w(i2~\9j0)a&}+T#0Z!]fgXN1ȠsE/<pi}k*{Wk!N"kprqU0#9_#ZPȚܫwjHc>-Zo3nV -9ʊKjߡf0PTbƆWզgk: xmOQ6 X19BݺDj_LN*NRߔf=8ļ`%Q7>H80g7p͋5:]NJ6IQwH%ioU=>;Im1#2we9`ye6fSC/ n/*c>%} D B_ piVG^\w%d ETm @̀Fᳮ8 G. T'}5Tè5'4m/ ҅~Q7@­wvesO $ž򃳂+u2X҅6?lD-^FG#zP+޷hollqFx2uDbUU8Ia('cr _<"i6'Gl~1ǽ"(i 2ZYNSs[Хy4 A,#`럚͋KoNnEU>ǜ-G#OrSsq@?XQD|Hmq(h6 sg=,D&٘:}`,P<`u|}+wi@* OGEkl%f@xdh FUiTPFyϳKvp5kvo[ӨI oHx58AQ{?CD_3^PCiJs: έ2MQ $$Bv} #!L c r 4oiiz6"5 ٍT+ې7Q;tN,SڇmϵTSiXO("іwƷ"e[*Ej- K:[˽Mb2fyX@ 6`+am|};m1:cE{C6dDM ɗd dwnڧFci.Ht1A3Z.z~JI,,!h [y$I,MX_G&@e~As`aU_0%"1%c}$m9!U*DX#LQ"taZp3fnϲѝϭdrBihgpҰ)rh\*BYC2y5}F݌ي~=:TY1i%6w )Yz*Zovor6`\ʃub>?g}2+TXwq+9D)P*u HN=B8 qC:[fna5] a}U#CJ )f}'5r|_Xҕ`'0j82ҁeg'<͛E[(@`Q~C(7ݥ OUK o9D{wmdDi~N[c$*m}PlS|pM8b+*Wo~bZ@]ć[;C7-l*4 'Ak򃁊}"KHU cUuDRXљxO! {Gjó3A+ 0gE^κUg7joe8O6a =GF*OI,W;-w.76@^_lTUV <=IG T)j4ζԇϣ}1ژhX. hT,]r ezZ,#1e?콬fБ%@{ʀ:3@0!&0^1G]'^U|9V!׹:#htQk[ h~(#h7F&XGkxI >B#ھú0me\#3My7&>o$h⋃KڸKt"6t2;,2R[)BN3y-/& 78 Pz5ŮG]׼a$sqHl1lQk&v*DGX)AKn<˒N=uʳ}{Ȭwn͙D{6$z<iزF kc^$JOI-x/CӠCs@V|GF5 dB@ ;1^XC)Mx">+klj'RjϗeԎ[KKBu'* t<|kMT42WFc~(O٢`[)tr + ^m^{ L2~`v QUMTN:5,M՛ [{^nW3|l)]ȇ\ܮr {mVRCZڋ>v|R@~&t⩫Ql8#O%ޤ^/AD5beк2RR'o2@2XNxV~u ] /\SAJ J`)F n tV=Pf}*@|I氀yQJ|smƊYZz .3R\$b >=XZy쮥 4 $Wvh`Zk*AV9'eĶ1gXệ v"46I=S~*JťYȫngO*i 㱑KW[9nlCה*ߌFjl#_ެ."m|:_(U-}";/yV >| 0C7YqNEYsZ";j}@|˴1˳k L ]TaMY6wټOA4r!ۋ==!aDfHGpr ȋ{jУ XG '?}%sx[H)*76j(3kw8{!;/Nѣ0;M$+6i-0fy:r罢k~ a32k7SooV k2Rx؋333{.e :oLrWYM^[ߑ\eFzxG|(P57>k`?W/5BtL?օ2l'y ؚj|` !D'WK/'Էh$Pdyd417ɟSKGSw;3|u0c{PeTMxߐ}guJs~v"(( 3#pG8x*8ݵKWqnڗ]V m4+}if*@!(N(@Ν莶szLf|X}dvS @C(n" _'a%iQiQݽɎssBBYbaR jp/08RkkU< uQ! Q2xDP&)AS¬R뿸?)6-|䏾!$$pQM:.EvѠ39| 4 ZWSŌMܯhM E kArHcFOjej=jpsfTi"J'g(|˼d#Ke㡅IAE INh4UMجQFp 1OFN5le|&yPٲU/Otd .}? 23n}Gk KOMhXV %82/DjpO;oSFXRk4)#Bk|Z6Úx ?Ctz{A O(ً|g"#mrL"87YI+"•$Y*g(-07c5>8ٳ+wj[]$VY>K\6uM{0zm1d>V9EEg-FsZ$V`Rl밠с瓖?s'&i}Ņ^DT g+se"EVy-Uz1OIE)ke'(ΖAHӰ.!8ҼM4 ] RQξt8?t,?kvCpa?8-{]7$TUSY9-5ZB !lJ^ְ!Q!k Lxuxϡ_FǡFDb~+WR÷⚇:#Ve肕'>X^_5}+v6L9 ;!BaNC$zKCXiFI>]Ğ}>Xs+Heb>[AiXHP/R[3}44(ұc$e^T5<=ZrP}Um}|[~ٗ疙;$A[ =HkVK@UFdJH%íOp:"{<:tPK**aaXi_-Aa/ -TH> j $02Fbþek_#^ءT;s 7W;)Wd<8i_ _H5`IwÖK`aOm/r4[l-Q KKĥI?OOŽFy\bg3 r5 w7czӬ E0ف fX1%tB"c6iyH"ٜU@=Asԉ0+@xkvƵRc K*)}f O/ƏYhOf4[`eӽ XџAxk|id m:t/Tap^J70[O]pD~xw~-/]6/2\|W/%0Im#Br~bOw [)L49oND6H:'6Zu28,̙c*S֥ \/Dg q(d$ KjE5}b6nJ;(<@$'3;7; A4ͧlW걿Mނlph ~P S{a-씃Qkޛ|?X4Ws"CT), z_*E;#NgIl/gVAQT)M\$.X?o4ryМ53݀si]R&R^: oN˖>0~ Aw |5&M z8(R}-҄Ϭ|>Xkps;0uݘB|Kͧz lj~5I, Cf: Qq auf GG +y^~M=\U bDeNrxGDWf)k^=>?gE{_ŠR뗨 rYM7eϨ~j-sIis5-[vӶzs,5-ΣblYZhsJi5j16JzctMԮ$v6# )51Je凂D)^pekW&ច~.Ef(ĜpFu`ju . Gojb&HkaG|L_ep|TX W 2Q=],ܬ׃dXI^lR.)&}([t6mxu6yuq"tNGƊe5ͩ,E=Kmt;L(}g~Rʥh*~.K(%AɚvICY>dRicR!VvlA 3KEБM늒'Ij薘Z }|bCxj G!3Hl#q8\~V\u Q)S;/_2,])ˢ2Nm-J#Mjvnp+S@%Tj_v svʼ *߂"0$04<(].QeN? E '5Z̊yf yŔ|ND. hڎ$5D$;ESk+nn-:Dsڈod7@US-^0W# 3ER_ qQNȦ2QՐ ݔB;{)+؍"ez8'B!Tkp-$p7/p;8pO<3J:1j[W ^KݍS2[Plh"$oRzPфriW"IMb?ˑ[Z*92]rtԮCϬk!̈́U)_6-o궬z=ٔ)nGU msJuQUK:]AT=~²P)1M A g)j>A־*kyU$(i•lS)idX1.-T{= A<{Ek= n,d9 }FU?ޜHb6NX:^@kDQ!\; x{`YiE .߃DL`cX@{&k; ˌ^_IT_@%Zv<++cJNd]>.!ig21bʠAyMo6E y.m~*Q|׫STOsrP3 @C9bCu_vY$LX UNOЬtXIB5mTۉfu $JEv8wWҲ]cD ->Ano,@>ioD!) }IK9,]q _ލ&5o6OZ$E Q*\w8-O&ѼDM%  V | DE &v75?DM.Ϙ t ^JR1Dw}T^ѝqLt{T!خ,&!06WX}-\-EX/l1K,&O3WHIChGw/>xp!@%2?wǓ#Atfu6Ʌ۶ߺYUqAat"~闭 &kIFh ƫB١Onkө%,# yeXس,f a\hkD\<ݷdO.xYۀJn0,YlG{sSG +I9&Ti+yi,P25^)RQ>;)(GY펤׽|Ü-hHde.Q3bfiҟ(F fjG2a[2|z%- M˟rwLe&tT$ņ'Yx-hm/ nscT"NL!ɣo8u.xPmRyws~{rT@bSJ̯ k$@mX[.Kp[7>ycO5`H=r,'sgWHpuF7!]Po{WȜ'9=4O5_:*j"ҞqHUh z_<'̸=;M 0{ګ1ek;~ 9u8=€kUyNl k ;Ƚݾ^h4&k f@|viP수Χ9|XMQ&/M2 @5taZg׏ۮZ$OzON.Y9ђ*vyPpm?fwoPcB,g;-.Jl?xZF!JhBjsUӊFz/=q7piDZ4߱ۇF(K,d[po;P\ ) IE3Om('Sn O}+YNp ak|?Jbvc qj>w+k_5G *dOzbN<OAUˉZqᵲ͞j{20^G|]oX)7\rˆWN3|ͧ\5 FOPd'Y?"}I\l/YEacŧs$ ͪNuSi=xPBi_ajS׮ϘXmM~/Z(%"d9[z5ӺL &nǁ]  0Xg4c_TDE8R($^ͮM lIxmkNN@sk[a7e1ϰ! 3!.6oOVt#s9~2"xszͣv4ߞ]NeM!˳OϠε&##n_)o {%/becaj tڥ9[gGS!K[翖{(iӇPu#"Y!t%ԗ@Wi=k}uU'$q:kLq$WJoAS!)i#0dF ]a+q%] R2)Χ6OvT='X]7Ӽw:*$ z A:[0:{o5FT>,=ɞpuǬs { :(vZ.{ˡ4`!o#3)Gkup.ѹjsgÓwE>v hjx]VG198AߏA1uJj(.bFR1hU/[_R':YI)mMra v'Kü)&9 v-Q X9v`x_|qjmƖ!$HVcDXQu&lBYqtxU3MA HhAYӞHND;9))A"FT p=DT ßZTfB:C+;TNh‡dQ-c`hZwc$ŔQoA DjRΐ]c#jTڄx1ʆfGAcw9$ou`YW&|M49b|"E( Wnq"3%ftKTxznTFe祗[Krčn*[!2_ܰ,F.;] I *o"ӨwKP"֩S~ﵓlc cO$IvlWW^}aM계)Rqc"o͏~=?j׍=Nr>:j2r;s"=rcD1"bC"Ai 09W^LO1P+ȩbx(>UㆄRg{"lFKe~_߅=PrYs]J/ p9BZB8ti_.GB,9m c1)z;O`yQ] x$9t7SN "4ok[Qd a13"֠` սؠ\"ڀ PDu 8TVQc#.+ISZpyR6ǡHX/r8clhĎLlb3'I1ԭr\xN[OZsirЏ(-ԝO2| >~{,~n:֪JD'J8a+ƚQWOcts?e֙)fuQ|͐3^1=~LhCxQHlDȂ WuD&T aNP=.Eq;rNftR@7)Vvg#o*:ٹpf!prA7U)M=wf 4n\_͸*E5phz¤n8E$ĝ54.C y^,1H~^j=ΥD6 aNPVz-ی" K%hp=~2d7Ԡml>^B2yɞc4߅ ~U-I֮9#ƼBE$NvA} g nŁb?ӥ˫.CÙv8 OsGj>(s.ԖF4qYõ$ EjwGDiGNi:(o,Y uoaſ~Ϝ>շ۾{gХftuм >T0H;'߮}=h3~ >-^UB,4MPh!9nVlF9_C55!ITo_&jsVQ2MQx!&-o +c8Wd7Ohk8fs- #rs&iKF |2~v#xf3 H)i9zӍz7jW8'tݩ +Mု!}Cw`xkdbs*ϝZK%G #S3EIj! eZcA9;l`l8KXÉ:MP#w1-%?Zoq&=^?1b ˛UXrUPKBZx]x2LEAWO=‹ iVr?RׁqF&3Y}$zV10MDCmΤ0v5"e"|.tXTXNK/3XKmLx..кXX>x BՂ焀H&PH/CC)ᾱFIk7~WsSp:,_ÂmLo f蓱gYFY}/z6W\n[jj򦭅м 8gN";5vșӂzԕPd cVoV5PR37]A+N$ Ls%]C^t0'UADi `Wp.&+9 уtt[fsO5\HwCm Hɔɿ/."D`O֡MS>i;km-1)cr~J&e;Qޕ*5›5#vJ()5PfDXwe;5,>}dH.D{s *#:b܉J؎j8{K H7ȷk ?WޝU>UDHwO)P3!q̹{w^Ml] ŎozxR G|u"ifPê>*}ƙ:FGo'Ibb|CB# +|nGYo+<- iOkiD9ߟ+hBJ=^}o}P〆QD'w`MDO~4$XCχU~-"1%.9ijyddQB8S|Кggwo҂8Gwc%tX%pϐ)K.֦p:?s(a?2|l|(ΜvFQDup &6=YW0K lj\)UڋkVǪy|ހsԪqbQ>L4K[g6lсfsh:6Yo\%L!Ð4-D 50N^gmCW{n칐&DkF|EkKo2CX₺je]Κ_>y0 &26ډp"߁4Btt QqB:8H%ɗρ8+rTMusrev6xq]vG,u .ԅQ=)߶ U̓1ƪɦ݇pG(m\|LO89n(,y7n]_O=Q!0>?% :Sh3wO rN.?uaghE ϮQ**T -TSn)pCSbc7AZXVd+u7?JӞf}",>!T& yϮWhRW*Xg<_0`KX-q)ak퉂{ZJ߉i2Q"rPSDZN*0:ZXgCx?žI:u!ʇ@vt +6i_{5lejF&~ez˹ 1P6!1rc^sZWZrХA]<,} a[7QbgEpѱKztk%DAkXwkS`TT͙O> Sjl>DzQA'>#CT=h+=foP4\vDi YݭV\Û9#Y`IhY k+5zCi{YAazd[TPV{?*qF`7'$5X`y?$'+zA*}ɴ]ЌL<7d|zʤ5 I=qJ5MPzBmNՃ1k,dd7 r- z&kemj)%xə-PE9:[i 8ZdGg0D!M{ex9 etVRnKwOچ!B*+ל`mEl劤奄4cmϓ sPRo9[n*qڶ8ƚ/f|m M=sWéd$xE7)L9$Mu~rR:JXS0!KszbB}(?3fViMcJoG9 ƣ9 E&f۵.p{obtŬn|vc{> NQ_+CesXYui+[qUɷ ]LȜ4Hz=Fy}[R9Ԧ2 4룭7Ĕl ȥct \^NJ }h.rKޞq L]HQ3AQI=?EXOe)-,)!#ց7Oo{#]<{yB_F2{*ұ.yD}lcFGUP_-x"e0Pčq ad34$JvlbkXB'T>,&/ٟ0ٳ@(B4I\:\*x!s:zA'is%3v/6ƔyJF}P]֤[4%r/=7m V?_:b ^=CpNʷR^P#H׫c#BH@͉9k3_p D/l 5N%LN1/P;tݠFeclx։E-:uז%anFo(;!H$,ˣR8/Grtz+d Ag,殫ϘR%ET9&Y/ٵ>$+&婼4DL9[P_>85vYCOq +%!KE[˧VB*ȝO[ YξG<xL 0uUpQ2 }"mBZ(*$RzTN&ݎ.fI)M{>0kQU\*{ IV"Ju~4`ؤ?m6gtHd,eEO\A b8 9 €Kv4Y^84f )C{O(1Nr* `+)/XWS% ZڸqPoK %GzzUY9r\I8Tےf.Vz p, ؓ=Kz] ZaLB>2%KK VHrPڽ佰(3h"S>;\\ xK7Q˃1f`&/{cPQ*az::毇6q% - u;ͶYAꃿJv I/0+ DT?Xz _L_r П#Q dɇ(U'ŨmA? Z#B0S̩vc-q_"ӓOCy m wX!K/םp>ʜ@gyy:l͆!nI.QN;oY̙X_ NqO7u"gnЂXklbm7q8S1Edݤ n BdUv@F7N-Y}єO>;~rZqFї13QʣAAw[jA[x {aB]0-4KrX;̂H_,'T|&hd{Xj&[4dn!3 Ky񄺣TdX-1 :M=ChY:+sݷm>`Ky%? x ':!%&] AtGScijөb(<(΋Jzj'L7siERgx=V,m4ۢ%dAQMx.Vq Gce_uګA$EaSEэsu PJ^Σ9Cmw?8dyk66ZšLϴQn%řmq,/[;r&hHl*i^Q~9/$[K4%ZL䯧Q{۽{qF X`s+سZ[)}B@á;_kF(5.gchHN;KӐ퀳 %ej6?90ׇY-DۉaP (!w%_~`]uFv#/X:{V6mzId9"H|{?Aw= $R3z.U&ID)w^'2O}N98-0: գ#`d=7xp4z!C-x-V0+gd$PVڙ:4wى<(A8?@nS& Uz4"Rr[l'{??o)d&(~ooufTe(&J8T9-nt̵̯s/Wx/娏De= +Jwv>]aN5A`.`bT7P4P ixEP(JMc?yBk_9ͻxFsr&TI@ /lƔ^ (AKc XΈja__E9Eyd>r Iۘ*IHpʉKf7N& [23gcSSeQ ^aI1 87Av'A u?D ?!IJ0hc]@2F~.rMl0 eS\c7ڍpsBfzvMcqWCOK+hVi]<n Ld2-sU6'&zZ>Gp OǍn}uFjmWN1y6輀2v%x{ĠiX(Q . G H{1;nDsj> j&id#K;cf7D`JU' +$\; F8GC'(tc mjFU0[pnD#v "噵,mMip4`Sƒ `ܐ쩱-ax5H]nط p j|M[")u`FD8J:Hň|)dhEw! *\&v]`1." X[1Ǩa_(뾦PX)yL+F9$xu*wN>籦`cʋr՝w3aH.㽔%h˹[8u;]WVdW0>NS1$ꖩUlGV^ JyonW03rZ>˺w` Z1^kΗoxWqI ~4y6/ ͙MP*mƝǑ[dnIxcI 4 Ļiߎmo0\.fd끔Y6sk 8el@P Tn?.ma!U:[*]mO'!W\#y9Hˏ]QҦNMQHn[uLuYte-y'ž;\LBM $v`^0bE3 {3Kn8Xs@x9DSrs9K@SܪiZk]kA_=tU+r]y@!j5_gw0O˖EonQH3JK0\V E[*`mrK˿Z.nIt$5czf Y{ך5iP] 'ǜ\<_zp/ &鹤/k:>X*j qHQ3biR`޾}tFX9he]g`鴔l߸H nM3&{A ɋ,#OC\[ek3Ɠ] Sh%䚩1]ln_" ]/3RBp{QQm~-{NxDm ?E,Yya0>mK$)Dx\TPچ0P/->%-^^ΟgoiN3/-:;@ܭ  ;M>m\XcJ3 m$әI1GaED*Ŭp '^PƉ)w[iG hr8kP/"%Z#U̺ ӯ U_/% |Cwzf8oT<Qo^cLI+p_CJ)9>QeYw`<&'Ө%oe-I Yoᓢ^&-oZY_pP9zVr {z[_a4E\Nv.{k:]_(z;ͩ 7q;56 !0 $=-FTw#c>P3pa[Rߓf,~:1,T|KeDg%XaRO$/[. PSC]Ʃ|Q2 blgUk\v_F%0Arٚ[w b0\zFŇ&դ+~ .S2m) (Dז5\<;;Uo^"\|HQK'Z-SԃHIKV(dm #7>ѿw]x [ɗ>pG i2؊x\-HCFUAjr5.]igĺc-b-([:߷h?lǙ:,M3_\ۍ\0輑1@QTQ *ll4@/~pGuce^:RÔ^-:26;&bw/lOC}ȑ7g~E]ostv;4ڃD:Gx2t 2R-ńۋYLVLTk4Mxh7y5Twշ? o~^Ysj&6oO'; Ϩ[ڧq%NBSE+A9(8)m ++up5ljA$O-&(߸7mGd(WR|dqvG"o-#y;c` .Ajb ܲݙ"G=үr nxIn-e\1*qO?B&CH&3ačn{lPz;,4KgԱ @0Ca;/Z}2E)tU?z&V2[)lA^POh#V2\L؀ >nf=$U j `S*J =tT t 1ByuzGާOEа4SxRDS|GH]+Ukp?iNݪ\sxJ\"ִ͒>wrVD;3㐕"BW䮭 ̓?G6[a:)ohe7:m(@K>]v$zX>3^} KU R=%=\*h |~84{x!J1qJDfp{U:A fH5~j fO0)wq]ϩ-0<!ad>n&w اyԉ:E:/ G8gӽX_g:t C.PowS}10TClu\h.Py(b]bn[ןe-js[PCoM赍~M3 O븁Wi3G*%D=|8%u E~WD0>v&3MnhC#@QԿ ~9LHa2S0$z,$/yP([ "f^FLr'֔Rrau0ٷoyOc[>$)V?9.4Qwop <}]`<;W%@u_RY#di3wd ;L)myW5.VOo./[oLNO @ݚѝ=#>B@m %:T\lKuw5&?؛j)WNՅ< cǾ␵by={L%0O΄PCvlF 퓓izzܡ`H'IɚW$/zRN4&Q,K9dm $ŧ}0`3y Z%bz (wn)\P7i>4(}lP@UioK²;26qenorXJtL12KkO!)_5_fٵk[KǢ{?ztަpj_+Q™A< zT.G#@Œ`0խp7ids ^-md?-T͗e=93&'uR;YK34ى?'5=@\}CXGSK8fB?9sO wFO`LpvӐw={e국}3)Hݐr~_ߔdp3r:qAW*\:kjq`^_U5*#94PM9*m^٧{&v ҉;l la:Zd!kqkjY:>ғ**}U>@_;=wP<2Or:CH "&oF ;ToKpE2qI0"M':H3A15ՑLuO7u bݭvX3kBrY2M NJ/?'Zk  +s牌S= Oc[4zĚH9Z@5KD>m ]z}<:QVu}j\VlfLw fww5ޛ8{ }mFU: -@?]Bo&YP!Q-kcvU$UI9V̈!CX 4|a_"lh1q6}#L-PT0wJQӵpݽYeYhXk¢M}'EtN(5Q} _͵AAЂzc,)rX{2Yx73g_ğs<}ܠ",fnl8ũL5$C|-Q+z@Fui:6N-.nOD}dz0 0JLm\) Or@v{%,оWzݨnL mAB4=^A?#hVP^Y-z{ocqG3ِgqCgށnJPR-UY^r06Q6%<Bǐ" ӆm2"ͣB'iiAfMM_}o彌Z:j ?i HXdQ!x"pޮ\@Fge-;9l7>LF9jk6Bdt߳ATRE1)B*GvyM7 YrXq^0@U矷f)XI2>j:d6ֶۅ\n4nf5>1~IiTs +X俀鐞.u4'S^:4^v#bTzY #n{47mZqh*]ze#$ޮ"9.5+2v QMT'87QaQg2E ޴zzXEkJ{hDI*]h|ѩG\^4jo#׬qpIjI*!udt $w={tzj>7>`AMw iC OiHӋBbgQ%w7|DDFhB ktJYn#{V=>(j<.̘  }!h.K^|ޮFr\U׈*!q~>~AUgH0^t.S?Eh Ѥ_W.Sƚ&VCq0|Oӆ|ϸ@meof濼YDnJK=05װtdM;լ? 9nAưKDSS 4vcQd@H@*ѥ=rԿ_#AFEJ QST=VOb_mJ^Yy#La , |pfYtxp+c>D_{xE Μ|T%W8 _y |E< Ljyؤ &.eB(~@x!c˶-$/-zAU߉9,b$('X6 >!T_5'p^wmj]p\bɧliڧPeNQQ&XcAak`ή*BUۯ,C4)O`HG=4h.t:uD3D!@PA PDhŻ2AR(z HKǐ2=Aqp"G3 l j%tf,O V5lҷVt u?8ro-ήm=$$;[$0u ;5悵O[-p=Ф*J`t^ksN&z&{.lo[_׻yd!+n6(V\4aA9шeJעJΛ,6P&fkM4蚐e׬㣀zRf-SB9 L4V5$Yuo5n"52KSL5mT_"5_D Fc*Ծu;: I6Il{nc4P,eg+6r>ERpu#M'"^ea1ۆBd(]Te7+1+g0Cq ޭq[zi' ! *"EqہTej_eBK,>-7EPK/RSv¼tBzk'ni/}ZC;pclV!.1%.+ʬ:g\l:L_N|Z1+@1DZvZl-y1/n%\>qDq0vӜO:.i PVvv?ZO&*;'{"(~]jqu 0u̪@ܐGT="zȓFYM`c - _LQ*I<}`Ms,慘-/ӱ-ڬ%Nb@_"#C bK; ut-YpIau7Qٶb;^{'\ c/|{ &P*>jK[%הּQL%if&_ƌ Ձl#Ld@'zjSmV:ώJNi=XC~~g_7H7<$ڨ~70#A o' Z$Xp^Q-RoH [N@`f9RG$|P.!H]"*?!)jC Ȑ7h+v.kvÖJZ G^m0v{4"ֆDlr (L 2NIi t*gFO8[ovu64j5 ZA{@vdͲYEw?1xy;EiIC]CP &\022"jϪz Բhܡ?((lO3RD.wC ['fi[vδg4ھ?cgԦv.Q N)} J:ּ+G Ь|*8F_0 nA3kG ; Uz4@Nt tk,\=͔ζ +&Mمxا/sNQ}e1'0._=˾O.{&![/δhC%3 x׈ˑWiRC hT ڨQYrǕ8CvUpbXiO@IܶHBYPN- E;@3GNiow}'YQOX=lښY '!};{;BFA´Xآl q38 2WЎh:VSREg"oI bx%Z|aU=ѫ?6 }՛09K~ț,V!1Lb4a9(eTͶw]bPxKũs6r%8pHNrr$3}.*L Yњ-3'K3j׵)yo_^t?ȎCx{͸wR]CDL$#}l*[c_K ̗ 9 [o;hk+7 (I_fFw/PP |USsRՖe2E2&"-={$ l~i[/IChh5fl_*,KKixˌhmCn'׊9=v`RFL]U,==]nODEKT4lye4,za5];HRlDXn6ܜz$Ǿ斡EwuWx^f;슭5^\|N|lYJHt lFX"D %WJj'#V܊z4kN͂W4".o` }" σ):& 4]NeO{=QHG@ *dXm%f.,.EJU$#Mf.=%oCS9)h!Zm 4?EMeȝ* \82Bݎ5׌kۢ/˷m%!@771 b'Nb)yAXm tE&*Oﮋ)rQC}ϚTPJB0mX*,휆ZLKp?u{[+fhY~\'yثDV,"ۇ3|}UO(ݩlU^]23_W 0J:t'^OF&WTE3o(faBA=+6,&\p_o+ONH!yƁMh{X5= b/4'|cбJ` Fm4FƠ@7;8E*eQJfY+gvLGKPZv*>/WdMi;֛:Ɓ`M[Y(H02ٲʪɟ o0׵[qAa&7d,Sql@}+Rr31cd0e+:tIN U\kMs=iizݑ es#0,z']Rl8Y)df={r"a0trH&[j:|Lc Z[wQKW_s?bT+|-WZ9)nUnnY :v t!"}Ѯ[z ]f_.iuIHi2Bc[@E+Nk}qWlL]x 5M"ˤ^QaCDt0]a!L+I3+[v="$6t6WYRtMp_e8L,'45; `IxB۽_5oV moYU-/|dAeKܨ?pde \Y ._vQX3t}#S+6{;*U~E X#cO6ܕ>1{@2t=^q%@_ݣ{p@[pgTAMlL=]q[JTs}1,Vp%9XW+á;wSl -B yE 9*na0Ϝ%w憶 U+=ΏDXHxp4^kf Z7:-6ۃӅvA*Bj3m:QPQGjbY3ʸ+$[Uљ;5*m/dW?V9W3om2vNTdUtcKH9ntk@,l $o~ dseq鱮Y)B$yI iPGhjbit*!]=N~ _xĶ8hQWM)=QĖ Wmy=G#Y/]êbS3茲#b3ν9ga-I.$ T!p7tvl+yQGA v*(G1njゎdHY3,'hĚk M|tfcPy+9W\'g{t8.>)k>ₕ) ,׃LdINS5NvFo  Qe>i @mr"/2=V.ʨ`U{'-xj653)ܪo uD z%|K֏͸f1փ?1nޑ2ǵQJB5&DjKAIjQ+,w cn3)"(jc#QE@Wַ~(6}Wh0KCOG6RE ;T_U|1-x#/~;#34?QP''Q/Mp]IpdH} I\G_X+s>a(j|XO{9owS .Lf (HG >$N ;]͛7&_&[8޽w+؜{Qu@hYT^:!\9$f'Z| M*dǦfY p$pX ٻG>c^`a]WνHn7Qg=qOWY̳/wY1Q#SL \ ՝ -gNrڋ0MO@R0Z m쫏gzIծ!}cb8V5QE.]X1yТ&h =%qyv\O6{•}(w ~ELB3P>.-GQ*O,+2(3J0j@Gp!InGVs̲"`'Ю :\me!~S„>ͯs6ct:9$#=13~+[.m},/E{4Cܶ"֋`nC7Fu e!Q礧VWOz SK%\rˤT涸0 >Z6K나^:GP*(-F ! 7mJ.2/'g/7O!I) ϻg_pjE{N'J$Q"-5E.PqG~RW?0BQ1$kPv``MVzx“{ճ\;d;ԕw |;Se`wDx9UyH f@EZMer-3+S#K8j#x8"kS cS[<:G^p@r(JR8{ݎ>~dafKQ =%Fs/ L a$\ٹ.H7[–z哹Ɂw͕ݜ4蟲78=8u )rtʯLعgSq65Rr+;h? +6Ϳª8\>/NJsqטzT2%!mx$ܰv`R@Tp/.5'8#6Zr[5c;qћh_by9w7h:SO;4%N#>ΙeJKs!H3&XV':I֕e#I&?4Xn2a@$Zl^aEs3VF# SI9Y611蔌E@T6ʶ|kK1gw iD:1gi[VWϥ6Q1fr[̟ZԓW3+HBq@./֫X;z@.ʵ&PHe^ ձS4Vs;o]"Hb̚Qι% |L\4D'Mڙ]lDL]Ay 3V2חY= 3}ݭR}r1(q LFs|WH6A \l$&ujSwFx9 Ypݛf#~P>;blG#V$ɿ&IyXvv|ܢv)"UH˵~,bXk&_4S + { V5i<2L~Z{{Wqbbɥ,S)`.kk~ iON4AŽW25+ʨGAe j4c -_t}cR,BU7N\s}޷A$̒(-y͍ ->A͙tjSI8wyPj!)wޢ|2pv *1$)k\WqP2$ `[InE]|pi~|6231oy]Z\9i# y"x0^ \xTk%FmMPr~n٣3ql*}W@Al> wڙON|iJJ[A\P#ޭG9WjGyS1aX#XVHD!=nU,~;X:Vb7hK,ڊݿYuMoޘ},dvH^JYmJr\-7Ah&D\L-G#Oe۔I0s%*j5;eyYSC,\Jr U.SyvU)kU8~y$ٽo9cǗ@yS|ANa_r787ʎ8 W7ؚ~]ut0Aںkdkk(0)$hӄ;t%UF ʾ Ǹ̈Ab͸]Eub\b4gh: CG)?9l|{w1<*J>ÆT0TqxWتYOi;8&e!7HTG'Ș%fMyNDobee^jKUSc >qr؃] nʝWkF'03 iYĤuM]ՠ84۔.h#%?2qtYiMxXRHRyIT[JRu+ezC-ʩxJ 3Q EӦ M6%y+x}Za gIO7jԍ8r3{I[GnuxvgXq1$|IxeuWqFv`E83&%.6qF!I^K6FH >deV6߮zaD5^0/4HJoV1;tpgqoܲ6"j# ٜVKSR3\"ZSC)_-.gI#)Φ ōׂjS.g/jtӉcdLX~KiFcS3OdOl D;}4 )::kA=y3ƼC\u* t&ƪQdׇJJDؗ#9P&za9ƳxS[=f4y7Un pF=86 q^qʕ-@rlt[bvBc:BC)z6rn @/g8+u6g `Cu*B;d>*cSφW6:}5-!~_" Y/UgO{m>zR1o.%#qIuS$@x$&| 'd_s8(81]e9``<ڃi-6ovs( m(0OD('0t9(vpiҀ4߅Y dZ,z0CxSLr&^Gku,,™Z+ (r}hb;s-h?ѧ5Pzˉ1+u&u)Lh{pוE'EϢP|ާ";&(pƴQg4҅EgRNDW!(ɷJw3W8O^9w^|ZcFBv4N3crl? mm IJLߋH?hCD`)_xMrn}NsRj С 4qIڵٴ| aLilg )%}=1|w@ U?|;h Cye3puNХtfkݩ i?oQXGGtzt6p꧛[SK lTm{r4b|3*Rx鸑I95 zНgw*R8stW<栏'/aM{‹.,<(Q.i7|`4XnHew-*GL^"!̲@Z >3Suvw0ڠFK=P]C6<]7b GZC- dZ:%tȼMHCо[U'ahA>_~x]Qm9EfmHnpLBE3BYn\H,)> zm G9k OԴ򌄸Y[;VjQhչpA8\uoFZ;6 ZFj㝖(I $Q)adž?)5jޅTͨ욄HŌTҺ4.喤Ҙ'i.u4zU`V{\DͥFwU(.3\fhld߰Ͽrꅠms֗`!COѶfcrу!Z#'(~Z z;UD{,gCb^} js'j͖is7 \MŃA<awi[Bjbc/ F3+o'4mY2nXy h0Tȫm!74+"!41ːx+x/qx“9KR.焙f>vI@) 'ao{SFh>'Ӣ/ߖ7z\yKg2r"N&I,7v$+䈾L2>aA?ޗ-+{2MoG*"U:Fi߼20ĢS:zo^.?ܱd[|R I>9ؖƈL`pp;4qFH)ARHXoeeg&

SʖUGޒZ/GSz[ 9+2w ΙJ/@6V#xϮyܦ-q3ضn`^”zZ;-zv'ɬ,Ar !kdn(>A>ŧV˅'җHׅN"3 EyJ <-' *D۬YRHZCnGKd'/M@ 盂)$dq*:̒>&%k*4{!2i6>uœ7Mi4R tN +ZαQɢTo:{= 9$P>`9Cd>q νA 7\|δ.>{rc3?Γ: 9mYCUu/im\QxdFBM%]0bjiwylwB-jX? &ĜA[!nۿ%jc;װbxa<> (NjmhABm@>tËt[2g1rzՇD\<)3='!laiQfߓg;pOӇ&kIp-Uy5Fu@Ai1xhk $@%%g5GʛD+w5ӛ"VL#&:$h#r+T#^ iCT(vi*y&o;=ls_a4 xFk6;ZЌ<]0; IYF3aʧ$J*5Vre~}6`5n%Wxk"j0W<|.Ӯ+[B6ulSwH ýy (Q`tcӼ8#lf#0rӴ3d'م_yBQV=mļ`~{ȟ(&z $_Ȅ\b l NB qaVܺtf|^'5bw0DŽf, FP6֖5t$gaףCe;Vv HG%vu.@ta uWGyik tH< 8~9je)^@Hkpa TQ`y)thNU#gMKݨ=lv0MuQ&% d|M`J=|!tL\$M<^pzA"m@M'E~p8}tCu}9uK=GF`?;=H4>,?B { ԇlP³ M!x JIrț7jiHKQS?C1j<]Շ-^2`<=7 xLmم۵ljvK8fm*_ה913ւn`G!$iIQFxwGO}Õk>AF&/i:f0*KHGeN%]`uh㯈;uQ+p{`fv~.8IH܉$Z,1Ynɒs Z  ʄ(®D<=GJŠK@'DH]bt~=&)EK_:=pK߰2T+bfB-/ä Y?0zkb$$+Nfǚu&UAjNMN%ݾ[I!|q|eڢTϚ)=EuIg_}æn_/4|wi_.tnU!2跽(F$^JNpU}9.e`[+я$ S/2kZe&&Dqj(U$y>g`qىӭA8m`Z?.o;UڦH95BCJD=PKL^sZ 1DsRcm2YO14bƨ6*t}B9u Sޓ* pR~e^aHs,贷 ȓmhyp[Q}:>"LxC I̎Bn@PBmFBra.t#.'EY!e}q7T*(vpY+#vGK'K݃fKztiEוJv"BýEdbJ֣[3މ  S`SLPe{W+3&rjrht^f>}$ JW~{ )="HӚ0AidC gazL|6`ӗO|rY: /b9ZfgH\OӪxIa]ʧWevdxyuy}v*cj*bZC D1% kգ,ݥ6yGUU'>ޣ*aeDm?|B["4pt>0%cL<9Ƒׂp}ڲp GsQ2HܵhRyf 1z<(:W\ &Ma 86] R5ҡs5~Ċׇ/^bas'hZeQueHV]tr0fu.C\ԏ&p=VW;fʕ:Dm:4y{s{h %`|D75Hsk20Pi}.eSEPUaрT΢q6`N0ڙ{ApM8Wm`Bө*%Qz\E¶*yTvDŽ#R˨) e*dzTjbɰpݲ1ld!#C0|s^har$R}n'-fD{,$U ~ӪU 9id"¢MUOqY# I[0IVJW>O%Jhΐ >RA"WN4;F85_Lb\mPY(PÉB͸?N#V3oHV)*>w8Ţ+2{%ӊ Ҭys5sXfyOz)[Yj&GuHKla:ĭM.yjhkvm3{q2i v,ʹڅ"? <<*,xZTa!:KzC巈hIDNl=~FwWKlrch7G v폺$pO$dY􋢒'sBhiNz^sly҂D~gU%ILct/{A&6_N]Z6¢ѪzL$gD1+s1S{(;SV=R=OEo՝g=EԬ<;H^/t)QorJEPN0@3$[j"P F8:vm^MHףN\D5Ym*ZeKnJtyUaHk 9Z<}pZ<+Xyq Վ&%;:p.(Q5(@eߥF j_< $6iyc[v1iH45;d *PNa!~{\^F[K\bg:t>ػ8J~7޽D_/M Z)ahӵE3qVZo71x%ΨZ. 1^Qf=;i7V3&*n\6f;}E) I x0I͛œ(V8O@$7'OC 'U_xn*LxV, -W(xҔQTKBJ4@/U:xBζ+;5GvRXu߼o6x VۙԻ(3(gx߫IXҟJgיlIb9p?WCY~=I|4{a,ڲmbJ_1s ?’{s̸ fGd86zG\cv@20ӋJFbà1(RsWӰ;O#P+/Q#pWf03>bu3]Wnޟ~G Ep_'su {xxFtyC#4̜\Mɹ)xgԀ@̿}Y))unj| 4dZz Z_ !8c[~g5PfVy j]R;# n)7NʆrZ.B~{`^X}8BUs{L<ҰBr5P>U*?Hltf[pl, T;,6'X93XQe~}!"Z7M2kiΙQ3Gzzmzll$xj˂\S-SR{>m9cտQ[x%Sl2?<(1 ;=KP`v~̟=3ş*Y!4&i$_#OYψwjv%hs9KL2.ڎ+-5epsӦNj3mk/O"U})-'339\ʣm`g( ׶SUY0(xԚáX>O|HRU!EoFXȲy!n ?l w iy,6fa_#5|Ska50zčZfoڑ`P8!;FEh˫Y<t'0ZYx&͸_a9W j1LD8vTr+0W }+YՀ|pE5Y}$U>8~id> :,ԀŲlP@tZOoޅ*in޿CKq/eqA%O 6mZ$'U*E[Q~x94a)i" xP Cݒ:hN0[IHs]w 5 vX*4Ԛ:JP!K3mHkA}1ySoZRH$1pO¨w]V"S/HqZD}S\샽]u Whz0}e2װ_y(UJH:8Vlo$uL]<zuDGHݮ,wlo[P.(X\RF*%=G\XKa\K ǝaE t)ꖑ^FWI^x^6.}y:Iq1JWxĶ#R*}ίwJr47ЅH/*Ht;{(w"=-^zưvD;= ЭFҮG1xM|"}~ 8= SFfgåNcnג&ݿP0xÝ*pumH6DܩdSRӓP7 _,[Y)BX, ;$w.R swQWNpDNh$g@n-Y@/Z\i,$>knHH-?8J| t(:Mk r9rk1GOb5t kAyFt(fbo! \ ZfDN;qg}i)vV*==q^IQ1G*i[䜕tN8S}~a!\T0 F]$"t<CM%r@- ' :AR} n}៉eԶK|xEk+3wxl(*C~2nd*F~ %'+cpX \[1y"oWIn9-^lJHw+ZE~NYѿSFD|˩^"c"Zs1V{-w\/qd,Cmi? i06*Vnx73z"fm:0AЊ5o솓5b 7Qp4c-_v۰q9e;Ν4#ݒY Y (y]>a (WqIk(؎?+`z ,CO(+O=7 bj _2 GKkl>ctQrQ^fĶn9:UܪfB%͒IC|A,;~m00d gy4If([p *Ga͛ܙ4L婙6X^P'4 I-ITJϏh-80x- <]L#d$7/y8 Ikl?Z|B^|f1T;`jUS Gm%O/XSI9$:/9u,J }ت恴q6ԹC6U9̝ΰ(XT\.3-dy5yَ0<0~[?)ϐmu7:z )M {Fs۲+w)K"frOlu2Kb=PN,~7HWd7DA&p ^|R*J-AnIbDGXׅP尧وv1+[2a>ڨԙEh J*4Epo 7fVJs(Gj*^GT\w}3ne-&yEcA^EXϡ:L,C*s} }g:)jyuyYoOhxիrg9:[n; [!"jҠmbVk$s2\rk {KaI ferxj3'\AfN LR6%(-hp(97md0%`OzeCl >_^I=I-mb\;*Fq>`sBQESqVf Akۅ\n5Yh*e#٢ؽ,fp~9B;B?U:?^@WK%/]Z]ھTV`XaT"Ԕ"4TZ@-ȍWd&J`ʑYj415 |Km+ bꜾc՝Ngރu<#EV7d:Pe TS`PDlCdw;zo]pC6էf?;*ݪi&S=ɫϙY Y>JeqqJocA;hU~k)!oD $^ 5xgn zR `4^=6|~Oå:EzNcxȪ M"C[z(BKsr n~l  2Fhtq& :mH$n$B_¼#, q# A-SA,G}| L(:S#r0,v<-ZG d՝zZZ~]H2eYZ\ ZUԑ %Dh$<8 t`uE`~> ֍UyEl8Ck+f;se[9'-qitd9{Nk߁ O,kRAI0i[+)kؼ; B\<,vӮݱ[Ň4MʚGĨ]Yne.ed+Km()ʅu%TV3]|9]T8w0h &R.CBfī2[ƄI@YvX{֯J`U?ۦxnk*nuY)T1Y(Jt"D.n*~oEeL8K8{H$}/i軒T_F!*X 1|<G]Bj?QqJGnu)crM7>GAȶп| C ʸ4&p„7ʄ̬kwzQ䅤_T4 Ā7 ~ wGR "Jn|\`Č)SNN#ϜvL:?=Zq`īЋn'pߓ{fOC~#A[4T ` s&6]M@'YGɾk\dcisc5.ɖ:3F۳Cna9Jj}h!Ҁhɘ R+3rf+ enP'cMfՙ,pAfm"3:_G3U+,ș=`#(ʲK.X_#wE0耾üY]O'_S>]X$‚ bicM`݉~2)u8۷R2-c PПN:tJ+@,PMsh;^&2Ҳ(Y)b^dCVj| àYHOy˔ DC:3 ,X 7 };.h;,#ygDW'˙\d3z-` '^+(Y*⫀$3_E%/Ky&_`UuyNT9.^Tiq3}f?e2ڝA1IۇFo!-#b<^<VSu`EĽ+> Cbb /k!.y%!5O!W#)-7˧tP*|:ٶWDQtHQiP@mWGWg43=z{ɏM&RwJEi-Y$ qR4Y+M/2Ũߑ6ϑjq|}sǔjZuohFu(0fʋɲa!I/CMAuCl[brlD`(*Ya/ AuToy. F imc8pfP{R#$ɍܿ{p2kQUD:p16W*л}]!B(Gh:45]},['}&h O6mQ^aLg ҃>i3n~#r`oמVe D0'?H_$Bthm~@YmpAIJ>, .wfFy:נ($Ӌ4oZč\ZQ9l E֝7`.14`p͋1 ).Y՛{WC:~; 8h6|fs EͷVDõ;ϊQօbVGFA5\=*t#g J^.)~H<^Mbc;?!E']kbA͙嫄֊tDX :DjF<*; iXCm:ꂵ-j/ K[×۝xSōܑJD@ Fm#: 6?FM NE6FѫBC`A7V4)S B^`2mx_qںnoR- LR@W[}02Qsz-n4=`76 $@DEF<]5#Bޤ ٵ[3_=hs\`>BxԱ X׏V?A9ˆB_ BNfbxNd(wRuS"vJLq|)Q7NƤ;G %ΪT. h{zاBppKpS$a[ w$ xrA/پy̸w -rJˌrGc4sԐސ 'kjMd(STO\ܥ+k779yCS(&YªxOv[.-ʉs<3h5j\hYU)A '.WaX:۟>_ަ:Hh1b:;H{CwrC {7U!VZ'|UipdtI2lG?dg!t$ca ǹ+Gqqaf2cY1F>5,:4eUML"Pq 5|ׂF FGRZ&/S<'n9U*m=HOFlQP7(-Q[ţo?B:/ u۪JjÝOq: 駩%P(bU3όEyi~EXI~9iO3E9`܀ų!wu` tFl !j\2w30;W3,{bz^&Ma !SIɫfo~О&WT]9 [?I <)VY$h_ 4zYK~0Z[S`w^IͿPpuoCM~&U̫3'i 2C6_U6wm+sQ/unӴbxi]_. pzztA,J$qE4 ]N\M,?J47 j1m$4f*+3JiC$* |޻8iLjaPb^oȓ9^d0Nuzņ.ae3k3a|Hy>>bj[:U\[D9.37҄)dGT(4e΀GO3Eb3S.r-PC:/ f)l|Cώj|R-o8e{xQBTqBQ[T\#+wt4G >rѦfvaN[D=[ aB1jczzPfb$VHfp 7F"Z`7TEUV"EᘭMM 3Û4eι75$`fXԀ(L8tMmE[sU?ǝ?J-"jR߬僬XcE>w",GUl~ne j)!@HNfmGarбo0f~tx`e!ukpHNDWޫ^Ґ9A-6(7"84d-}VjwNCud &ŝӾ4T~dz'-[+."zvS~.b53ؙ$g`)!P 7bZ+Vey) 6AK2>"=5u4*NZ⏴-.)643썪]nZZuʓYc+Z.5|FIU V7']8 õS.#VJ"$Pre;߿v S'3A]ѝ]j%3Wm3>` nA纥X$4U[lP_FΥR&yʯJJ@-ѯ-eʀޢr8Gn?[y*qN{͊nSĬwUǸfz׽b|$VT{'bMKЪ6MjmuLsFGL7qةI!hdL qobqJQ,?M.ZԕsQ⋞KN;hIEaa?{|<ٞX^#bp[K.v&+( c^ ԆR!2\_Iҹ6!̮ ehdܹ?Sv4]NY,u3o@(qNi,prW֦%}25<1tr#Iu5} #bYFbϦ1Ta?_(J 5Q. sK'".wܤ6bAA)E"hoؙi4g'^jFDǻ>4Q.pB5A2p|d\X|^@gbzaG6}}֬cI?]f2!ބ;]چޱدuFw~bSU{}WF K"o)dTaݹ]XgbGS0HОwKL%>wh>l I֖ HG /?o/RUqJr,+IS *v/?B V=C56C(˜ &k+IVu5ΈB`[>9sm;<:'F3J)zj: J ʻ(֣S߉$M U_\x +CNF_)KxmN&|-g Gi磸ܺ5ƨnfǤ]nPH7D[}#UW ڲ+x&yZZBpKB9.[]R˕R3l~:KR}rJYC18ytoB#ey&}?pbhJ;~"Ν`8$CkՔa5 AБv(bpJxx1Ͽ 1&ҩeUtK}ge5 E˶ڱʭ+k[{sHWaGg䢡 zprL4)Gұ!{nڑ91m=XzuINjg\a>v (f%C&U0ϳzĠoFqWP{!̃4~f?2>!fN}ۤg39*==\^x-p)r3-LBiNTN}'C8U̔|SG^xwk+$fX%-jH "JrRLB:0YF~PK~Hf#8BWۊׁy1צ D[{j̅Hx`=& xi}i{o.& ܘ<9QA(&h*gJCU>G޵vU$MEBvhiʒ/d5ߤw(_ݖdHr2.y( zz @i H^PK<_R1l(Me֑T9{tߖg׿9r3xsc%o=c*+:)5~~d&nOGcǑt+YN\bcY8x4G:C-B~HDb TQV+ IX,2᥿E?\ɴ{|O+>l,d"2Ruvz\dF.I=rs  tlSW$0%ֿ%IEfkH2Ă/ә9:2m ˙kk~LI[T.}(WɚJU$Z 1\xI5O7jDlgJ:Vmmfk@[ 8 )J(1pQ2\ NʚmLil9ٔcF\/UbRྦྷ@~V$ jѴẙԕd@x 1a3V*~BX,E}%)sKlM@͒%W&ޑ'X.e^FhW,by|0} Dï7v]BVL^\"CaAA;!ljQk'oWũO#m-3hVi/wʎ:[!XR" \ g)|(p 7cSshu" .g*$cƒv3/wflv#2ޡڻeSiPi{>KG_וڙL(Dռ(=Z÷Щ;uyGvz?JZ*kope/1CB WPSx<1l<̇{+=>CXV&_H;Ug|!޼Gi%)@Ô0? ;F ?y./$nnj *MͨH n1͕ۙ t ) xE|YyrciUҡ)O %r(Y:cx B~'#JO6UK.gгJ>o4~dOYRGsi)gn3XrHP,=󖸳 IZU1岽RʋoA ?xj[{I^;(@y {Hwt{/ BjEX5MSR0k?DS{bAX([ t'\e*@TjC\WwHH!F\>ڙŸ4zrGBξԬkV9am^Mt(`#5Hp'ʑЉhE*,]xG ''勌ŨEyЇ pdAn%O;yxI4- JK:U*$oQ kn#M- za;4%8URN[,>DzTm_TW!Ѡ4ԃM8/p؏8 dvX̒[W10Oz˨km'lLPFlV)G'׉7' ZIN Xnkwp7&F9+ii|w) Ŏrz7a4JUNle!UFFYPԉt('1E&=pv4Zmi'mF0*"gXm3>\)jG𔹩Fl s Tz1uK"i+P=fȹL\kײe3r AڞhL ŀx\^RBԃ%ϻS/WtRp!/ MNHEe`?id3:e_-Bp )wfj2y OJp*( c!q% Em:Q_/413I)ȧiD*5O9Ƶ H=^q~/wUeO|eURSdg} թ6=fJ}Z,!0mNȾUԪi_+) (f@FrRC|yb&QRD2W;Կ#CzxDzv8bwUrQ,9xn|jzաDFX'Uio; xE{C 6SɷWY1S^<ůJ Vo|J LZ) x팔sB@gQ>>}yW i_ҐvӮb KȐMUAe =H=tq _K],uu6_25 XL0I:Im7k> )bF 'QhrDLMdzZW{W #v:櫃Vak\(50؅I87G&I%1B7ЬAzUA@u06u1"]຋Z/հ9A| qq;oLG 6SNG<N.v,"i3)$I6Pg62 $RTo+u_ 3*ŀ%H[#γ%x؛KK(ᆫy@F 4ToL]mJ?aq k΅{72.B2Xz.Ӝք4Y3jt'JwꞠ̑[=۟ /t D=.4I Ѯ> O Me%1FI> ,xrFaɠf}7; +TbGɥ⌉NJgFjk _3.(SCX/F 5W EQ~\X Dѳ.FLevj7SSEҲ;,;4N_d^fjRAqSo!/|eǑ*ZݭI3ҥõB?+] -&_6Wudd%4&S!aȔŘa&*uY]Q=c!jO&8AVIe$ʂً^Ԩ#nY1R֠gYMYrd\5[ܹ΂*׏[+M+{ "; piC郫Q׳Ĩ yJD Y,$r Fw*GC[1.+w>[>UuU߆m8q^PH5H5Ou^r=An!T} K4qܞ|8/d a a2J;Q㌐]̬k:q;5oԂ -,z6A=U.66EL2/z F.8&ӳ~EjQ8'q'!lA%רے=+Nx0η ;]j! {bqpθTnq]C ԩ~>}{v p3D@ӛG^n`OFa@ Iw869oic9v 5 l$r=~MTZ=! ~N,{/=tDv]eF>V= !Lu)y%T`rzNO6<^N#`uE^(!Y'q{Ijf1MѩAd\aP@q"j^I禢Sj'XИjA1co 们4JILQK^6Ysif̬?.w4{)IsrU@׫ =5ˍ қCk3Oe3\l=e2ŘĽG?vHNrz۹%Cr1Y>@8;pf̷Hn.ؼTYQiHvoV4ao"\ mBO4JTWU`<6̙׈8F 7La+u,e)w l8tDFFh"u!zoCfțiNrf!=->X[_?T^XHnxV8&H]/ĸTSjct^7$鉰@&xpH  DhQJ=Τs뿙Ƅt./V(4Y]`~Ύ".eZx6,o`M%v^Ibyo}y LGi_Ʋ>Wp3Ew_3}#1aZb0Mb4Sإ+kW?MyH50Gx8tx< &.>eDMl#UCLPMz'"؀6 8LbiU:+PEN j9k X,g oWBFVZC?U߶H'ضQ+sg%Gޞ+1"% =9|զ"4$vPts4lrL uZ a@*3Pٗ^79\BN$EET)%=WST : kyukf~IҠΟ[=diu׊;/^&Zl.Ձ0ٴB@}PeJ1C*IN4SYw=mChOf8ԾJ*hU}ЪD֚VLF1wt '[8րR:~3{C 8"O" 녮 Q>B[X#A_"Œ$]/)) }amj4iq.NUE3y*7U{~M]Q7b$|*nFQ1c/YwwTȯl]9N>I&*:C/(LV^lxḽjQM#qAw[oAk0Ԃo&{tӞ'UmNvuK!9T7 !fZ&J0Xt],gaTU9@hmGPep..覷‰pcD 4uB NRm&o$b{Z{7qFC6jJ=ݫ9# -Q7;sޓģB iBΉDs&x'D^YŵAbN؞|^:}O/M S9Ghڭ>QT*Ab+$ƈ@9@9t2ulNN X@noWqK5n##Gb8SA_Db}hv}4 ]pVA @WgҴWT\L 0Nz!Jz 3p}}cmՈDUУE}+ב"4quuFm)Ƹv RQm WD5nind&԰y(&<7/r֝M&!ؑtw ᮿA-orí#6'3KP)㭋'ܚD ,j(WoVU-S6nuJ}0r\BVR|bƩX o(|lL!@ J< m Lu`& v6p(wԣ\$~Y:gG]V?q5ø-2dPBA܆Tg6;Lw0⼹B@7e7d["=kR9QYZBA^{wwMp \$:ʅHW _|*9|0r X}!?̟o!"yq-o[rڭ\=q+n"h]{Rs@\b#`S. D*T/z3V7$ARKk1_{flgq~U%w|)ZBeg&(',LvAh2Efc|ϖ'/5|ҀygBywS'`Zu|ccq/B@-¬8s,&>LVk#:[K.LlE* D)?>${qa$O7bo+NDם @׋ٴյ@mr14\pneй~ mev wI&iB47Ǡ P47XTOݫcGѣϘv`x7P|tȅx(u,Y(Z!y-,ƨ+F) L*ER)B`Co:{/$~$ LnQ"_@4chY0Q&ud]luC-Wo$=|F/䩛sU/ @j1ԀƄEQXjgjeƶY%ɀS"t!0vhx,@Eʋ2,hAV/jr<ܜ HSWX|ee?8P/G&E c'et /~#3?$,7V@D,FI p\şDv6y?:%v\@xg@`;`s×0{  4 0ޞY>~C:7I/P.gSHo*R{y0;~Y٭pp\( 7.v #&ze1^/q?Ζ9$Yͭ*'ULD{}>urj#Wlgy0s)RzCL|6W%R>\dy9֦ 4gUѬՓ?_[NGt D9Hh<2אZq1kG>H#[=<I/K PG IaӰcE&Bx;H8,X3@,l|of3̉:5K5>TWQф#0\Myp$V $4K[q}V93Smxhj%%Na:jdo"K91lIq $®҇}u4a%4zx0֟|{e!]5xnk[#`X 㮐6{kHRV,; CD TfKn!]LU *Ǹ7v7u_z NvO.nl`.[/ :q'/躙+:ҎJޔGRroО93ƈIR-ot<K"1Y-kQ5$ Q& Ÿdg+|C(p!}IC{EIx A`_pKļיQ'w[8וB/˪Ќ γ1t{n>C }[yboR|>%wnǴRwYo!/s2عB sHA]?ͯlywxٷݾɶ?јOg; =?ǗxMTge.Ebz;JzjU!|N0|sQ3j^^6qϢ~ܤށ'5CaՖ" L!ߗL]ifC$u'upII 5_? 4p&"bBߥE&I|UhFDK洭tΘZI \uKzvS;ľ?_VEr"IML@n+;#Öq;%bD,sKyV?z-)IyP\ Qb!Lڎ}PśYϾȫ"F¹a)52v'9O)׏4vuco:R_i%Z$K l*y)+7KrBo2;)069T ܟҗu)Ǿ%5VgRkgT4b;DqYMLgP2xz[_;se:2.B%}!ȸ 8ۮ6jw'nGHWChseSb tRa-ao?v( 2~We]SCp~i\8zb }.r$ iרy&.]i-3.Cv9-oQ+kR/":MA@(b_.}zZ&oQѽKc">a;n)7bҝvg[ 4UyV5"EPIy;@š2~fҍw5ד7uS9^$)f7f`Osu) X9s&S Xi8;IOFsm<毒OMtY47÷9(Өqz#4]24L8C1EedJ50Tȃ%6q @Gkr,z) FBPYP#i1`dN$F/pm(M0四~$JV%[c~$2 /y֨r+vr}OIM1zy0q("QN jni\rgE *pJď<{(No29Ow59 -ڥ㕬n9S2XDp->.*'o1j'[isN&<o$T:=L-@*6Czƒ:Y"9{xm-颀v qNZF!Q ڥqÄl6,n% u K'՛ \..%Z!l5 G.e?1;1'_dW/@("D/ANͱebҙD>:̼!,#]vRhvGnp %P^WKɄPsbmBܔ9g련ɳ-GXe|닃V0y.$ܐuh$Hx./<>,paRV=yOXSctQE#43bVf}9J]x=_ av]Ѿ.iyn6¸=BJ+;0N .1F* _Q|1Ƹ 3XF?ŬzAq/E;>E|G, hp섋7x¼u+c Lih=FdCrߩ<#؈ۜl#`[J0!,\qɹXRKʾvܢsc)}(w#0ЩJ)mٚZXE( ,p[67 )X\cjBP-6e(bI##@:m4ƥ9d7r +]UXHX$=>>9Sa`.;<cO\T># vRDlv]!W,{F6GOؓqT$!/_z}fBY%`R, @6YiȰ#֦aϙc+eP4yͽ`"efLX&e؞}[h"p}s i? էh9po壕Ӆ썥y v604JE8WI;~5b\Žz=fm"ʊ=A#>˺*(g+|hsf?,WWفso^`sAy'M@ÕS*Է[P3dđm 5euPV@\/L疾# [/叧P%0`(t%"9O(14!˶OmЫyʓޜ؅Q2&2w"0U8vAd6p,D׋\#m`3̘O 7GV{) |/ ZMP00}OVǏO۴B)㊒@ʉ֠#.^XT+> \F,I,|pYpYw{d{ov?)UI 6hۛ5qM[պC#2`1`\Ԉ @IgH>,+#4%rf+cyX_Y!Q[A6Lζk;.v_3͓A 4BHy>g1+I=$[Px2u^x)!rvFbٞJds]}@z@t鉿e]t$BkL:`"8Pa8wn'ѨNeE$ٯp v;nAͥ\>S[s}6S*pD}xߙg<)l7$+Iߴm# ΋] q DsOUXlpq0OFqHC`>; %qMWm<NViE)v)^NB"*Nrr664QGR\&:bZjKkA>DB=%><Ϟv"䛹%gzE-u`%bkF# (6Er|UDY {DDL_'_ ʄ(E$lX`8ǔzZ07ԾX$J $-j!Pဤр\dP.G PDRNK%:mA!޻ eaN#A&z 0F8^Nۙ5@7:b y7m˰b+cRram劒>_gga1( ovŗOX0{rM鹖w-/íɤ>^"@u QaNJO!a#uNkTL`j {$-u閰j,䙃5!ݪ 2sT:.Z) S%zo„}rm5D. -?7Jb;O!W!³ѵ"iioΈ`+pXIryD|X jMEGCP_wloW)gJߏrzʉ lz--^7'K sGoLnZDYJ'nå :jN(mau=#mivA,02@L0Ar_[1M[ޣɺR(V]6_Yd0Fj h`eT}%(r<yWנ{cC9Ǩ틓|&ً oX/La!T]J S?FͳЮ`ЀKEe2î~O5yqSe[ͭb%KD&0SM4l@S:{L8OBҎ A-Y$TvrVdl %@b;㦇| 7ݞE!WZyAGJVڟVmLcMz9je7էt6. B38g / Ѧr!\q..KҹZ5ÑEӂm^6?{@^,D)$ɠ#5yof"'eXSIkgk# xz_2 ?Qu><ަz@ur9VB[BhĆ3z  ^\ vt눞sGQfwm`&(jEFELv-$sARC+"HFyWh~-[18k|kʠ)6a= wx_xȕodx$f6 AtGٛZ+b8q)]Oַ'YrXoH=Lx rp@GVy=3&0"R&&y rDcK?R l[i6ѓtC@Ǫcma}5U#`aJP5]5ZD.6C. g BJ*'=__ MyEKPjX wgid$ O.VU7Jg:]?G`da=Rk#1ecRjeP?Z|Q]ޯ8o~w9Ke(yq~.݊cS3B\N;`<̩+$v>!{/4 5k9Le:`u×lO MA׳8wd'TڴxqΉ d.\Ɲ 5 Rr_uϛAò.+mbKhZ1"znP4e6!賊4=n_-Sb3*GB̥5=g&~WNsy~62D6d_@鴼^/;m(K>Cm52"p\ՏA:&h)$ ;Gkzk#]^dDw*nLr,tI쏹{հR*d2-*<4BJ㻒;6Vvb3Yao`]؅ Z(vQh^(J+CY9soyIrZL+·2λMH%^*PWs\1p~?|&wcH.\.;/U:ofRgu7#N5Qȱ:ްz'V uYGAGf֛?~t34jߌd=ɉUӦf="|xxϚZ+L yz. f bigґ%ӿDd:@ӓ/"˿n /F(&L85F3I~xԄ/ Ni'GH9=FD |JƆQ=LJJ`8Tl~/"cy4PGclq^Ї2D\IBk~-oǫwցmϏ`7q`&5X'dO\@1@Y׆iRw+4>p>a &mzk?3* mW D2< .T.w81b\И V`*}Hßx.!k$|⹙/EvtGnv=wKXnSW>?k2[jJ="7AKpLtl1eO8V,#O)zr '%kA]ÑN&=T14:jSP1ţ.j*o*u.i NC|Lp[wꍍ; 2< !)FIj~-Rl>{kb .aw*xe퀗:cQs=pi}wet4';ye >`>k:7O[&rxdw[܉2YSK'ܗ_WGrR3c$r9`)gE][ "1rYz#'p)†Ņ`Dۧmv+p?*-D"e6c@{cTՠxaoNym(2Ǯ-eFI]J²p+̃;&?fBTEhſu7ǒUqiU&r6";aNR3H%xZ^-5X5*ȤOk}ۖK׼8q:}eSz#1WوC_Y,C]dmJL Vg6qiQўagǥӼ(ڬ:0OQ=0۸LɹecAϻ9Z݀]1~{ uo?k{k>^1Dnۼ5ĩ2Λ}ؙBM.m>нIf~0jv\gSe1vDКUf|ޯ:!P$.\찴Wۆ\1ig?bj)} #ىYHh Ɉ`kg6_]æhsK_T>86)[LzldځEe%jRxڎ]oٻ/o 8S]4emk$MM]h+rʻ(m ʹq%pID*cwσGJUrXwQ\(fT,@ev}>vKT'ƞhإm) nM+~a>nKm}*{kN~=hZ(V$''nuq ?u2qSgǥDa yR$AlcwI#SMwn6P_Ʌl6\|'n'UzIJOj8t=֧턬 WT$83 ;km5Зh*B,'k}p @Ui[Z %Y'Ee ,.LrWQpfnKao$QNĄ#Nt濺\h ,s. E^fwKTtXbv(Y=`L9:bgז9)&'R| -'۱m:<՟,Kq> _&rl$rJ2Sm2AG Ϭ.ma3mE&d‰m d/ PoGgާrLJw %ĴwƐI\)ai%c*! w,4&'^ӢK`M P`=ܶ9~z}^ @<! BX 6Sr2$qim"KtAsZ"Tx΍;dktbs$lOe|cof H=y"!,hv^i {(΋OIg|ő%jѻhyļd Vk@V7΅3nnGoj4]=/`=7|}^W'fNzDB`; ehA"I,f줫^55<5bY;{E逢xWu]RNF u"۹m5?*aik[ᔪ]ŧtD 8< γ9`dTEsj=V5tk M>8ʅ1ϦgIRofਸ਼a=zU.$pz#z<ڶ}pzaQՑacZeaƕ[ `Ȍ{Zvo{<;WUG+$Yel'Pj7WfG꩹kN zNb_:7_?D䦅㜵C4M$Q>!ͱpnZ ͢:UX {=dPY%To"̷=rl͌JEp cI]@Fc@[Pd>`Okm*ObvlN~T:Y_Ҋ}˒Bv] ;tΟjͰNqAj3. L9ʳH> AԚ zgw|Ud2$ǴO+B#' bI)/\(aI9b-iVS$X^KNh#`7%>y š$m#b1d`gCH,s~y[;̍xEh4Ҏ6Dɜ4ZMg<ꕁT_@$bθ'0}[w +&9_й>6_%+XLNzdāM.ed'G]8ʟؘX@I].r?[H*X-O_e0c@mytzR+G4`$<|l #g6F e J1݀u]yMNmGCQP\+{&|]xp*s)ԟ,Vq;ujl/mvzC-D6řXY )8C^r2 "⹌t/7?&g f~Q`RfG5STlQ(5RƖkwR& ':湝z1sT6а{0A< ,-I'eFs G#%D`ylMx:NxZ`~ 舝~NOggR@[4_t$iij^)/Ζk\nj3}LXqF~5-H%gP@dwv ?s)<SWk=}NŸfeal9mL/r$+}rլ: o.S5H—NGh諂k{%ɺSq%oH XDIܭި%S}De5[rV8xL>+ӉHZUf6$vl6Pνtd=%-x쇐o&T/\t(gQKBKfF6H=9O6!pn9%./ żm^gDמsC€nJ,-ÀƷVNQKb:W6oj C7)_Uh#_(bL18PYv_`5&p9N{,O"ȕ$&Z:{&>m&=hg]JŅQ+ /f48AYpUS.sd0;br NH NLr\$P5*P𰉔@^<.;sD]>8Ǣ& V)r 2ܮXtt`?%;r}#ƮߟYU.+l. eӬ3^u;E+u^H=H^PP /zFlzٌfr`&Xzۓ (j{Zϔ2Mjh@uReW$B`>L:t#^8w REok kJ>}X2-#1.ެ j5c߃Q=ݬmL.jB, '4/N)3ДZo tN#1<.ٌub0)vr*>Y;6@h*qԵ+ǂ ~C&C<>pK9ubP݈|;>Ÿܻ7Ad2· 6߻uFQ6*P ^.fa1$CFN +YL±22#YbfT <܃'2j 5x԰ӀN\gA=g)Ѽ26+Gܟeq=TErR}#pq{W|Q} 7ϧ{|JN-dfGZFǣel*fEi‚#Ik~.`G|Kd̥ꌘn_3L1./6G^pQ KfΞDmcҀ olG˚)> #KWx| h2-;3Y.L*S١$IA\+#LO-nQ/~_aA/$퇣..T;֪:M JtȻ!V]FE0y@6̄, {LoP&0ZEi:H^gŠ}&,VͰvQjʝ%>F64F,+c6ysh6>r+C׺FNbi| 4>-)e,w4/VnίY1`N߇3F=ؿR. 5fϚp0[!C<LC̒ }%&We}{nlBJe+EH ,]*`n1T>K=+L;fLԄTW s˞g'E3 _$,ODu7g  JP2'z B xqij(42z#02sfدSwߠUTIXIomCЈAOY'V$Q?hD_%U_gFlSv G"ћN5%<`1_!"3.JSb7Lj ]'&)h urҙfx>&DWhoL eN`'%X0u2!YFj|cRA D>cM Ǭ$a_gpַUw4֦Z(jב)KYg݁Vo8 'BH N"YK;*9H&q*3! WX3{?>)kcAVhɐiHA+X2ɍI Z=Nst:ع©o'>r)MP-zhh^53pq/gA^w'k=;xRnf}b7nC\$4vc\NyҩoӘMn+Dc0=' Yg ?N 'A$KkfJ k1IrAplK{Aɱ;,9ïbL+$'a[ {F(t/i ~GU%F9B׵ kQ.~B|ɥWXpۮusfZH;GFmCo3/%PDvnP# 5Uw}̊\0һun4nZ]͈Q|%>A%dZ S ~rNfVMnNP- QD{%&DfxètlW-pOb f舺Q]"4`q*˛duHsG"3wC"00%5m^崤1-Ș ƑPIU,qMG2O>i.7PȧZ5yT;F&c,A\Skih`[OA_\_uhx }u Cޭ?3=*tLaƹF7Ý  g2\&dsRjZ't tnLX_U0niٛ4dlISq1?--rQ}n@wqʫPJ1DF=gvUgf`nBJz_J>7CбZRH Tg7k$/ 9gHPM_uN~̙,~oןdjKQש9އ81qF*| EϨQw&&/4 7#iu9oo.>[;ԝ3t)=F>vLZh?Ӂb 05MEc!0dFNKپJa:/K= unEHYLBOJ(? f.OmՔ4WKBe.DsM%]1&PbJ!&m5I3QO} UlB Xq):3pqVj2E:1KX+Q_9S (e-nh@l4cHz M4 g# GG?g h0U͊:>J*['0F\LICSTZ|j v [1f@0&onC2IAO;Eq3[ ֮0s1QRs:9I79%EPE_kjۏ6dνG M{+P#»dsNjuC15ϓm)+ Di\&/7kkf R2EpGn=Qd69!T,ij|\}ONjB`D< IAēDOduk%ceEd#]r(˞ *5ZqE-fh_6Ge B#:xٿH.\8a#ҩq<aMSG\(=J }zNvc |08l.۱+[0U힞I}oE&t= h/v+ux66M+dFACH.ƭż^hjs龴e^kB5QJs;6W7D?4J]GD"y<w[TNoi7lI`tfx[8rEra#Eo\HCƄZɆKd3zv:s$ݵ? n u@VaT* ce;#Q^o?v6:ݧc99eY_P+bCn3Qˡ!:xsQviB:%'9PnJ}Z}Jf0L{gHOW[5[2v8:" G UV 1DgڱMYܶ.2ԉXZ rC`,թj.*- MzHާ({a>*p$5α%4-ǙmdrJ0o !2XԷ@< YgM0ZDLF[ڟ ?5\ZEg*!UZcX<@:':''a̍dbmd0{7\[&Zˁevgu~ccH8^.&*#zޫc~ʞI`E)*jձ7~."}eFc@oa[-_~fJqk8$JcJG&)6`A(Wm rjwυM\`2`s95hFpuVy;M"]bkj(gEDXdi Dzrϧfpyd %Vjk=<[])ꝡA2zmμ,fO46Cy\[(8/8$ϙL>Iz>kJNOsY#,PlRGk`RJ+k=S\-= ]׬6詀hK!TWSׄD隮V >U񤂕G47 0!~z& `x]a$av$ ќilWbw "e3z5+ † aSPY'jY p_$?E ASZ? ߁boi,Hsթ8ht"m0#SA,"OYe?F/N}@+b7=!5ȀNֽOzx0eaP>B\1SzpS\ҷ<U@eյ,@E鲾Kw{"!h# gg>^9j?ɸȄ@$`B7 !;UG6V@2^a:y3t52df iu!IV2ݤ|3["UP.ao:њ_e+S2vqs[ŜiMդ4?q9xVx@,$?P'e~}rClπlQbQI4~I`G&4Ơ؛Oh Zg{&քm NMJ@ʘ\ݴeewJOk4eoeC(\Fgi 4=VRM~B7c{0bqad5+=m`gS+ LRڞHg!~=1qfI$ZF&qAwsJuq-RD(ĩ1$!@̊I1#Ti]^=JL31R^KI5$fYv ;P#)ӪW"_DOQ,̸+UZN?}Aj"0l'c`ɬSymBDa?]%E!dkƘPqfKq XYޓCTL2D8N": SɭWmNh6lX^ஷ拱?48 S4T:k7mFة4}\2@g߉-'rSbQ:y)bC"TйW9a,sI&?!o‡G؞@r$@D)^C\ ("2+KY묤PNPVGxd|X1ϛ(I-xQ7 @ $Ģy*$D:N/[r˪i㓜B-)Q~ʊ4D9^3<@>JY%uCY, 4Z+~0Ya3ETd-jFw4Υ/pNW<d,`0Z6R ꨍ#QF$i%7Jls^E8 .7(E~Ҁҭg(%n2e\\8 EaA s͕~Ҕ"Ӿ٨o%pR(SݧRld- Y ?8‰T:%@ 83oG\ с Y (.*`vKy5ݮ/R&7qB'2OߊbhRRas;\9ݪa?[@ĽnUB8T3ד[ x}~&AsϢbqQO0tĥ3@o!$χ yKZZP 9=A6 4w .]"n LhG:kӽF(v8 7 JnHTDZ9@|@̛֒x].$,I9ו<·ε;(ebf#d1JkW1Sv`36Q( kM%|\ɖ%B2 DϹRqcCsCsec Sy jF%D`t"}(pj|"M!anLpë KdT75!Tjxl gгeэB4#t4{ WØ8XQ6Dʈa ko5w]~3ba̰ _E?W3M~EG{[\oj^'PC9__E,H'`#Ye3tl.퇩Mw;hDVwJNN09%3}%>s aY ڙՃybn$|?/Ӌ{ Sj? ѫX; ?睆~l,N/C@QS!O}Ugh#.6l2m#>sijbc5>yIl_Cymd,ӍpU"L`suu!p !BK0xv[qaټ;ZR_y?HW;tv'8- eW?:2a{ҽy~]v;lKJ͌ՠ'*v  R9ɬL=jVRBJl@!I¥tepB%;F`ӓ {a \{YBNU0>bNwh5@(VUT^QVC0@lz4n3nB[ c|jEp `=t[k0bbe de'sV @8fzL`G@"w`j@nf~+hR] HZA1 zNoyU{*P([ܣX_r& /N;?7^eݨs+FsiM(U!!^XN7[J!e,e3VTcބԐ|w1X~G!sHSc%ss͇L]?(YWvsAFicD>VHOQaA9Q#a4LJ#F.QTpQ\cHdM}mJcFuc+xKs2,=-|$HQcs0#~- &-NjXy\vrC*܄7>"^xcbJ^b0"+:]R'5mt"縣e.'Y4{Tbc]%PdqQZ9MlgL2'DAb}^oV'}ngD8o2帡8e7-S@Cfߧʧr8+ߜuQ! 3gU.=o2n߃rx\eJ4a>=i T.7k1!45'MEi4Խ1&髄S\na+/g*5)2]fiCSrnqRUdSD>8F LCA)%)2־\ˁgi_)M>ܮ랉$W)T@dW]"ԖMu2+B^!"DgTh"U.ٙ(H;V-O[Dz MLC`ObYͣ©S-h9wV*RQ@-aԎgEr[9x^^^׭ɕ v"1B( 0T&1R|wzbȥ]b{ kb6U*ּMXWV2?˷PqGj-VΏj0));4p/vr'ҿvtWi?L*fC~Cd"pZ&G2OFXCc,w88/ -Zm6;r*no.Ơ8P;y ~N==pWwipkxǴQF7QX8 JaqD?߅OSigEG*m9ܩ)I5UKtO[SXY&!vCQ !TV:qLZf0WvSffFش*X>h_1զ~X",}%29_;(>.foChru4!lvt\KkRt[_VҬB<5z]_RWMDlmߤZя0 ui 8gL֏ }}j ؚkuE#קSU~*(L|s/~S&#ʙ:f>Gygئ%2~]to7ҥk[8Ud\?E#G=T]!ō7 jK{܃!<0 dc8ɶB5jh9mR5%s7 'Ҍ{sht2Ɛ #h0o+ag!Ȩ'4ɬ_tɵEm-L%Qi4JҲq:.x]pOHm? 9A֋軺,DrpW~ϒyujj.҃'kxDق/NHz/țgFUXS/$ YR8'%1߅Z8AÊEҡR:\sƁwCڑs?lQ5..Yfs0fWV#.%5?SЋ<`?w8ZQr)I\XqU+4mNn毅cnEƣ}IAZT0<.ƾ+V);oTYQT~(;9}6wAT1UA3N۔\&;j_W*YxIE>2^|zEH).qxdHUi1,žd, 9]ulpZQW9s>c5 p-ڍ!6S+5E3Pdf-pP. n*6.66Ed { %% I=uzp*YaZkihӓN \_~q6BGECwv$qLCK$S{`릨T{:8RB 89\|n[$҂^ebTM>rj~qv8 \WRdeqjAo$ǣgN~ͼ7#Yh g>cL1x`©́ջ}\6w@qB< %("OmiD7 Ak9Z~ZՄ``jƬs%YO4{+袊Dݱ.ٌZWo[+&wxy0ISC0gC1 }7^vmѾd$50c'{ހ^]H{Yy%8ȕ[ Tspw2u jq'n p-HO&al?fӹ&ʎ 4VQ9V R(mio|A/lP{34zmIxYae$Bۇdػ7if1$s=C ZvP:6XCаJq2c v𼦊G#''G=׊ANn!]̔}Xs4!U9,\uyqNóuFO+nb]DEf!, 79b="lFB]_04+o|츶{|FSUuFOOM˛F" ӇȿvKnxűWi՝,DWu[ѠYЊVR=پfjS|PO+vv|)Pob#*&L8orrrҗӽq/H0?z]̄bU6Rdtoէl 6q$ğe4xGmg~&<4|`Gr,$x*ȗwي.^Qs0OKPKcX Xne!=o>P S;2!(ieYMaܵGzoV<ƿGu?; s^l%zIlk@cws鞿t;МוPnC0 @RNnMeY9[Um6鼯\ce3›Y6MI2pJޡ$Q@(V`! _o3,XQ$g kXW&/ABCr`ĉi9{0ges<-8q35AUYPK @DnTiQw{4FéMpK?VZLۢKj,KjLh\o1u~ps 8+wvE|кY(Op ]O]@MpR*‚6KY f5wynPur<0@\2*]a6@QLjJKƀw{Ǯ*,,$7[6a5 G#wZ/6i+k/QN]XY#׭ۋW0Kѧ%$˲ZZ2:ORL@6Zht$c0OHV 橑t_]JEA^*6] ;PN9ݐZ٩9Mu+4[0P7b Og%Xh=$uӓ,J'QK 6np0u|גOwIysZ{j| +"@_ɔ[rvkdzb[Cs.O3:*d<]g'K;z?LHq4ZHV6գ |) 1^7#q]8n 'h.xx_̀g],\rSє(Fux\]e*͒'=̧R=7Ə(Ȇ[[ Jܻ'L:K4p(f^\8}9Q,(8^L#>'* 2D3zNh)8`~PcAhD(?5F%j/:} !DmhFv?dF¿0X}kCx9A~vw0Sd0<{"x |7ww+ػTf7lx佷K$zS-P:1] 'G}r zʽ|B Noш H۟mr iXs9vgL-*S}/IJ5k]Ҡ$@ly~\LFM>r% 34o-$Zr#:k@#$'#]e6U;rWAِT9 A*lʡ؋vo gZ)zCxڄQrrP>gIxNA"}AIR _wтWڲ5Ye2Dŵ~ ']mŮ~y|7ylsEE`HNBnKY QT诐 Qx7GKoT%`CaKK&p,=/9X!!@#`{2XՒE 90X;sIY7r1L/zس,;̊Xe5ɻ J݅m-4i}1vdGT_ҶLxu4ZWf4 }V^J;-ޮg`bZ3 |ʫ+, fY%+q@.7rZw0%dҞ ?B`{쭏|# x. ҡ#m;&R Oׁ0*Kc/Z0,Ԕ ~ MU3#d&1_z.5`jLH=O;,TFöL{u^zQ`B{E{RP1MWq.}=9YF G1Vt$kvt,8 >f.@򜝃Q~7c1ppSԥ5:2BA'Q84 _#S[܈,N0zǺORAC6/) 簄:OXDG@b~}oaIBGcv?Hʂ*< :;|V,fO5jOT\>ݏHE4C7hߐ^RAM]9.SMh e4 7г ^GhYd;W Lx 81{-֤gS{6=7wPrلdrZ2YA#)-]E:Tlm{XQN^S"ǒl(f-kxUea-xBc q[WqE[i<hlU4<퇰 Nm}TD,E83!A D:_>Mzj){.7 -Z&Nfn*W`#[k}vkW՚L6O+I!/ ?%vb*:ǻIç=K#hicQ1 X^F+0&ih0=RXx:g9/S*&wW4γWijڿ65ª&dʑ0a wNgʳ{%J&F:ٙf>Yw1}BXnyH-wHvag R_Er|P G}RG~Rʼn');PV3#tS-3 S -1ơBW=[PBޢ az{>]Jx\z (Oa[Cr ꥁ+MQd:H){ݘxdcN>!k׊ M"䗃/d^Zq^F6 re[>L@%[֫JSDqV\%P,k1}b92c3'CYJ va?¯Sio6aіy^!gsx" L")dbͺ"pYr.1PW` 3s4ukocֳq-M^]Uzl\ -[`$<dži^KSLd FAJEj :HyDSm_]t輚أ#U_ӌ׊a-=M%Ҳ}|Rioү\ pOWd]/?MTU]NkU@Xlh( ͕,ޑ$"aaG}zHU$e] 6*o~nx~cW3w+ ^KwpĞΚJo מ;;n^kj?7:g;D;8j*5P ~qRf~Fz ZMn'GhU?CNGЁSͿ5u{CwcWtCfė `2e,0DD'St]BOM[122A넊72 "^ct^h=7Oi@ό4< Dd7axӠH]ܴ싏^*OH!S ! ɿ@=@8k\S_ xLFƌ "{q,h"/l^?jϱ?y~qM9aLz V"ۙ=H zHEy}O77L~tj>;J#Rpvwbv%kχc' n.beu!F]/BkRg/ RVpt5Ն!Tن |1L لn) m8\6j˪˱|/a)w0I-#' < 6 QE'S(XsluS4ɻv)n^J #U$|Y귻XPm=$اBl׈Ӌ2"v LHɥ0cSG5 br[Rj¿ji9*a ^W0TuZ'oTYb 㡩2.jhv)rl"պܿ;rN&B*( ,c 擁K -;L}`Il1{.W2sWF}N- B'%2Z)dz ٲql:NCF U$P)ٝIJysNd LXRd~ᄘ>uol54cx$<2y 1885P[ꘊݏaCb \.v-Q ĉG#vKgezI̹(azOb򅍯t{.+9sOR Яf-EZ@5-6$e !< xe; Imזg_MUUq!]8jk}iKT蜔K+ WePxB&v\rĎ m< -?.bCcN>&x;q5~WXzJ\pAg.)u~0F-'/έhPseW5@z7#SvF- Ai'1˻у+wh}Uu2Uva{016y{K֧ [E`_6u).@V @=v,ZaB'|ő (F,zϝe7V[՘ |iM{ݹuo8֞᧐ 5f th1 =H7"qǾȭf72dY}V#Ӽmr7T}.׭lޢG1񹊟9T|ʁhW{}۴$SH`iOy(8oY%WJ}ltW~g_JJUS/ i=̮J렸ޠ֛\Xٹ ð 蕍t_ @$p*KfyUa%!'RӀCk_5x|R:/v#Lh/6kul,,,9:o]kK!]GZ`xH9z7nmHȈpZ:RVӨ[xҁ_لq+Sz]41f*:3JF"Mv"t)kviv,$D]#e$^KЌvv'v=ΪQаhyDqzȸӔ :Ίs!aXzl,ϩH ̉Z?0pu~rtuɪ/6~?qq$8:?$Q]V7$xukEm:ャ(v/usr0t57 pe]΁=]h}OIMIE qkvagwuwlk~yph޺"N˭,d +94UM8Ś?j9-yJPCM<%"kf '*Bx 3('W +LXx_sVY%DuIE7/MW08p*7hդ^~x KI|C>Ը#ɉK/OЯf7FPcH[Mx?y`avәеgrc8Ƿ+]߀\8DQFBD@E~0@1/-2<>6tϚhb6 fۓQ hV%8ͧD{0w#h]p'!QQwƦ' @>ljzx?_TE]SoII)sQ}sܥV,~&BWh/-P-c#+0`BJmT*tK_5A`f}UF8$e@VdvwV=cĦ$(դbƃFZ{>֞hy|H]rD SglV9Ur26tih=6!Ƶߘier(J!$0Pw׍`e`3BQ0X'6 `J(?BOVT11yizsgNΣF/wIG[ s4' ' >^ӗI#1[yJS@TSl&ܣ|swiҔӊ!g1/)<` _`dIk*,q0} \c?_W$ C# )RQd+ A[U|`͐RP rs h>^1s. RDJ.|D }ͪi ?-\p?{{}`ۡcu#kP|_{׺DcI$8錜MTdB P:]4X/q )J#f@[|B' &|R$J&! - #6c;6aGd `v6fV) -;]Kfb4…G0\"Z5™wlVqFsdgS .N^{k]sZM]d_˰&TD+NN7zfӰxN j%b;`AEK4fĪKl~,u2|N@ E9v[:-}K 9;`l;B=_tB3@-A^i2Cef2"i#]@&y‚^ :>A"z;6?byvd#2}{A',,, a'յ~wɩBp <[_PxHo FLʛb4_@ ~=М/4s`+Sv!_.BQˠ.R/d쮂o,Py5|xi*f埳Y Z` |%_NnG]&u1h0 &kV`#:|ݺ, yΧRFr@HbLfT@M$NbE2R䁤Ě+#jUhĚd]rB7?nE۵|'C ګBFaj$i=8/M#;CnrT` 2 O0 uq5OH}x-ֵݲGX*S&!恘q}c,tf]*SjmLRLBA88ݘovdܝKi1l Pa,,?̆'<hY~yAmQz ShjY'^l cM uFʈD%Ǟ:i̷ېx.-.) ^0A iW!q Ҟ^2O4Z祝!I}pp&9 \h=xjpcqbE' ci@p>S'ct4K'rs]Re*qB4V$bդv1A;#~ܤ78[?\(>T?QS*P?iKHU4OGۂ_|X[R&*! THF/ml 'h!'YfZPI=.nQA?%|'6 /[ 1xube} hF+T"u֣~u|+2c:*]r흧 Ild~rWS'\_] "/NW=#(Bx7IpIݭCCn7踎3=Sz%rL˚AO Ű}o {b~X%ܴO1 5b* $>x&(l^QޡXZHOD/#)Gslev WҰ3ֺ\a4RjQ]4[d Dz%Lw8w *ǁ9uxe˓J]ń]ԤZ÷ݢ!5 ߑ l+ 7-$LAǮ [#Κ{ 3v&:52-`wj{[^:*E3KڲϵV,5B%oÁCz(a҉6i[6Ɠ4,-~ L,} S"&fܩw 5ׯ4ٽ9NÛD 8r]pO錠Чj<7NArQ޸+ <#kNXwxd2:{!-6*I8S %cA@ѯ4K6-&{'̦^ Ƽ`֣R3.O8Idv~r I^ڈ3Np[NYI1Nu5qYZ}kFEF0$[ϋ?rWiTƽA:+9z2agf{[t߉ . -nJ-Ua `2o/+҈'XVN rcl~9yta>I?C|fQfc4[Cvngv2+d˱N㰓#D\HXƟ0Ok!4$CpbgQgWqy ˄~ejIOpoYjMQyΫPM:iv\5 8ށJmVh<Uf8`wx_oѦ1Xjs_k2K\hZq(3@ ػ  _K.yeZz-{#M+[:t2xLmw j7 4j~;%Pz=cUj8:&_ ;)Na&,}')F%^Bb6зJkY&J̀$J3Mif62KdhFk2ŷZ_@%mB8xqꯨTw"M4ZF4ô_8mwt A̓m!bi;^^\8zWYQݯQ?4e&c8>,7ǿT9AZ*ΤUjhr 52dIeꐝ:[73!k%vL*MΟcI*_|D4ZsڜyWO{,ۋͭm$&- H w< $^&) fu6\ngQ'5%)y]OH>~c~RͿYU}LUi#H@DªU$ɥJGԎ-µpʔ'BL\<}Tėޚħlcjm%:BRIETB!ܛmX2O+}ûaҩz~ 4R$/wi1p2]J3Ib% 9L;t4Kr[޳d"ȴk}[TbE '750 ?Ƭն@ށ.W 75[.֛BK)U l#-~_d lA^Vᗹ\hgHVӤozb؛b&GszP,tAI`*nʫ LYSz'4bNd1-{QBwCmz[*2Y{ecX$7B>{iRLfԩG⽱.6B[U KPwwF-g΋#$`Ɇ A PbOu|\evN[u5.J!M234Ի9"|M+?!1Y\&̔ޭ }!}x5PpsS=2_:Yek0)Fv)$!\I)nckU}cbD7>cajAe.r.2}ou!~*D.~TBKxvUD>*R/$V|:::_h>ڪ԰u'0RA:\V,bZ&RT%=9x7hd؆_+@}qdRMwSR{31iQU}nF?]GSBr~!g9MZ"can@' d}ሧ)8ʈ)*/ umFW)w(B>=@z΍k#u|;}iW]ymWrMHUW ʒ$1`㜺 E$;iʂ5u%p-ےa[ ʔJ!klHmzBs +'odLcV^d^^ԘxgSIEs*剻K i|n^%%8|vL}`=4{cu{Wyd ٦K/>XvԭMFsgSHuT? $L~Q5fnmF>&@nQ$ f'~b8Vtg/|(;V0tR\K! ytKu4=w:9 wךE&Td@sS"(w> YA4$P>qPVz\4gy!,}cx6Xuo3O{at1z ?zUR}r٧pnB@`U,5]$|1 ׈Lufh-n%dzC1O2R*7r&_`1O;gPf㿀jeo GisxO&ѻ /!y3!2;(`Ib?&,!_7ձj{ZʼnNh)i=/s\ֿ ݝh 0Z5Q8J#y ơD]ѱb\R+6Oh;%xsLg~[%#b%X+t*j_jD|:a̷s[P ٚ "I$(N=Gi6 JjYp%ƗFu@tܢU]¡yGXQ;uc_Yd.4$?*] x;#lm1JD2V?-Qj,ʖ\'UwC"o[~21IjL- ûkg  Ro+LмC_ܫG{sסH:k0,h8o $Bẇd+Y+V3mh+\iWatPt LH2FdfJɏqV\O]9&s NRXsk u 7_\ew92=rt%en~jѳ' V]p~aZ! N#׬hB>or0-ؾOwovmh)|gdSLЅǏ $Xr=gr6a{bgϫn3YVzbUhFD&D,2fGZR*x,dsy!V 5O;Ɩz,6.%j KA6xiW~Zü5b$jҪ6`l #}`nKҚTW(_mFuݏX"Q{|y!kzh ~&;ʉ}(R ސK(Byl#?޾]&Q0U&T̂{v c)LV-I^U=&Nc7ͧ5wdWɶwщm(h 2ELâ`wVڪ!)ĎCAV.>{hCo.]F_JXP J6 =t?a'^=Zsw oWULݤ`Ik3~ ^> y|W2jWqT+,X>ު})ln4j),?\?;#i3U ?!{iDKКdw4-ouWکgEDEG>43O~LB>=24 2"a? |ΥoDT…&9,*%G>EJ`/_}\H%bh4jIʵz(܆e0դ,@B9f|%z"w Iq LM6f=uڸRkJd#yale-h=`-ḧΌxcdFO+~} 0c8CiTnhǨA>q%Rݵb(=@l:7/fyb @@ۏ¾',|a:dt=/Uyw/VͯIڬ.!R[ڕhgğwU)+퇕oh'Ɋ j !GGe}G,4tJRܲ.P&e s6dEjNޚwvp+uqAaoiv[\Z;W$?E 4Q!@HN- N_W k)vukR9_2+'E69ofJ`2`#(gVaД]B dBW{2]_ۍ6ew3QYh :xY:Կcl=&qS Y64|d=Vfёi¶VƃMB>GS9:^KfuV z.?*|FKvM/:P=P/LA\f/:q|g"9 3;qLL4DnF5^ d14B眢YVPM_)ӵM;W7͖GX<Μ5а/KW` ݜtF3 ׄ$7?Ҧr oo^#Y?8gy"(`fc`N;Qy斗]^={b8|püni mHoqL7ړ}L7?rvH~[<ۼD!_WXy|MhtJb˜Zݞ)aQtAϔ Oox;xY3- Ǒ#0v j`{碹R~(jK3i.Ɔ+ajggR*2YĨ{3rI5o}a-<9J3HM_xosePzNzV=7i 9hYb &t?cB %ҏك&9d34SD /qZui'DzOcj“ #DZ7_?a+ӗ7ԣ!qF8>s\܈j@#c7NTizD_ (N&L3ٛ$Sg #/[|.%H^ʠ *_aWQz|y]|yu ֊eJUv!erj~S zVtЫ{䛿g!V6Vku%LgˈLeggSR?ر7Ӌ R"`!ͬhcP>$껷hTq >M G\ f;j0![*ԂOo|V 7e _0}X-@/-?6ғqP1]5y| Yay82TR;IJ#P\(_G; ˣwI(y`M͓Vcĸk+|UW3Cq3xgGYGǐ:}[DFm.`LE洤{v9"T2pn99Q/S քRv٣[ƞĥYp ZOV(PfQZܑۤ]ꁗWgKkAB t$} Ή`u{ _Z_W;̐3rj}G IQ?q8in" {kO 6TۍHͯPN @mkg5S$aJ<+E>t=͡}@5:\oßHFPqCHX1\CBwDoU?f֮1Ƽ6:v?]@MH=[cH$W:ĹH 7>$XSE\{jTNA};AܧhbXVҗJQQͥNt#ȊZDG۝pϠ3I Z:/Xy-< : t$&.9_3H >™J92d6:8X6?^?$fֳkmH{jE#}DΩ]#͂lFK=['|zaFj:CJv{B:cK҂ *hVc#.530QY8g0HUdw+M#7J% lS^&拪5޶!DmT`+wi қ%04UѹTèYO7az>[\4$ܫQ~ : -BC^~[AKpQPt[&u|7ovzdx4ٵiT9ַko6NJ- rwR8%&/ڶn /Ԟ83Q4/y?oյ.guE/|{;]qým_RRf J%x_;(q Y iLԻi`,hPaҐҢYsg=Y'^2T7~71w8(g-_NdiD(pJXu:YB&BgJ8I4ðeGFziG/]wBcdc4nz$ɻkE3HX^Q@@1tL6?-g/1?*Lg ODcl8MIp7T+JD nPX^\kIJD1ϻKa䘬%^GQR}}^)Vt_F}G"jT3Hܙ-Re-ў41~[t1,p@Np۪mJCvҁJ7|u&_VĶ}(%Dlwr ZD?;+dG?m1Qh (}0Յ׏3/cLo ^H> sjjavV,$Qjz@Xݯ=!ȭ\1plzխP_]n273&Fb ]iHP6{k!9KYuzy u7kFw@4ϝNW8ɓ`giYtlHi~3^Uqyp~yTe_a|ոT$#̛nku_ D|dƒڢ-^O c燔pb_qz`cr5T|Spp6wboߟ>gvO-8(ɩ,(mz+c&[mz3R Bk-iv۾g w=V?yz%mz) Ɍvhn_Fڴ~Ӏxz pOG]'p lc$'fڞ ^oJUa ܓJa2"E5ta.^oxo}Υ"Uaf4,F(hNñNzvsݝӝ;q1M뵸`GnՊێ*XS(Xrw}$X]ͳ׳ ##Ldݺ}Q|~lwo5tq'8tt9 iexD0U(>~X = ~ BM==C/^O*Rp xF{ogY6zZt\dܺ5C2V@iՎ />IQuS]$Mݪg^}+,4zʕYlta8EtX=v濐%8_q".^pz]/YΡGUGqkܯ5Lٔ(,#P 9QF;gGJe7Z?Ulϫg:nU P7u'CQc+)*$:Ae3h(K`hA5oN 4tlDEv7cq$SGƪ(ܒBCٱHmX@ۭeΫ-ۊnۜfrF \ X&(n(ːZ8p-+KNƲ*H6ͭqs_J-'Q6rlbHpg*<5/=ɸWko3%sB>|.d3Zwcۓ n !c𽿒m4E]aǂYLlM<}AXq\H7AaCP%8m)3o}AmOA3Ǟ` jkGTa !il$Dgl"=k8h{I% ؃oR_~k 9>'gC/ύ #KnC0 di3ovBiW9-)NwROȰGCvDkp:2^yֹ )ѩTk5*6JvpE'֛e[%r=Q7v4eY;"Rr ۿh8 p_h3gֶ[e W]AI /~evkyl0+C4\G5f}Wu ?/4rxԥxSॿxC,q) IM?ֆ\ 7UR3lU>/I lsK شw|[|׏Aٔ:\R~B FA0"edR 9;:4 [j~R&pѤ3vQe~쎐;b[g9}:n1Ʌ"8k\4I[KTGqӝK=7!7O>?NJf bdU8#f>3x#$]-.@JܝwHADϖ 'ٸ3? X?%2-G(p p. IHvi64dWqb;HAe|ӫV2<tb#Y98Kަp 7zsm#h`Hg)0R#Mg~!S45je SfK̑Gm)6xZs3 @K~_`D8!{!Ү삏ig/EӖ:@wyVGs*N"=#VJՎkhp'Aǿgs|^ cM 1jPaKcϠE3oy0uسWHF۟z}2:X30ɸGB)! JRůpm֫ѾU9cl& s5tɔWEt ,r&_t%hGھڡlbFgڮQ{⧝/X '/sڪ̶ EuS0V~#,]\nKK/KcbDBdN7~/w}A%X (ɢaS mc.}pUe ;A5|xKoN=?0d@tUne\演z1!:XHvbʌ*VQ1w᭧c(d=ήU\S- ߽&t/EFq,-{ǁYmU"Ѷ&XW>o;M(n(˒8Oq7MDZQZ =ڋ2YL vV9fɦKʩ]WJj*[O:@**,e"ci:&ETE,.z _9}?X@m>untppI5Smp]{BFijI>6tgkY9./lcY;~}u&F y]щ1 ?N@נnO11־a,3a 3/!|4Ub%(kў9Yd & *KY^2Qj"=~+-סduz*qΐ }㯟=)4E[7^;󽵀e,#8O-'{[80vw1Bny\rĜ}+ڄK6]TFl?eOݪCZRbp0QázVnO' :ijܝ0X>&Ώ߉#"~~}g;[-g1ւ_5^`1Rӭy6vƟԒ*œQc'L(Ht +"i[S ڮ؛˄)+'LFxLrrQٿJ.=Qqؕ~# ]]nI@AA8Nʶ޴ / 8 fuTXeTD?0nt4>J*7㟲(]i+|7.plNFWFNGͼTFR(lԹMtׄ[>|ש[o*jJiI"L1C]fgJUHJ:[<^G'Jߖ46JtfG3}=uuqs `_RЬ${D<_Hb'5ReNп2Ap<94B0$Qr0q="G"|ۚy(Mwxc $ NkCYLGZ@ag&06 :ڻlsz?e{1K(t{"!Gaޠ]Ū=,@ieR躀KOSˁ=YlJ(DSr<@!!^6- g}w*cZ5S빺\qwUϦOgBmN `%(~:7;t7r֌?aaܿV׼z Qm죄 oYpFXcembQ@T=хÒSijRe3|.)% %MwVexBY}n- 5umq"77V_\ lKx2۪֜ %3":T.0E3H=ջ.>d2en8,Bg [YR;>h<]16 ;A]-n2%MfSaրt9{x +͇>IcfiB^xTf B!p#kT ! u2jOCIp t6Qi;lRbJZ?ehMw+Q w?ut;+m? #Ѷ(Ts=D~MCFr4r+Uhٛ8d+8S@I|yIFrf5zhN!z XC&!!C\{l]_d0=B,\)yMXfjᵤpO7D-#j[QàKf~hv>7{1bϷbZm]0^a?ݗ*͔`$TcB%|v|/zT֌vBhp̺y;Jkʽ;cɈ~+yE&ijz4"MdĆvlj/ړz֍04 ̖;14HHw-&~KD*CP>EܟT@rH#B\bryHX=}WE{u];N ~Jt9i5^~kP_ {VZ|sxe~c4bY9fbΠ%4@vx>&𗟗gIx7HSnEq%Т}ϙ5Uљ,cjR I]Ъw~,11^9 5^*Z}ϜrxʛGIS;V}1H^%b+ b`5(T彪Vfߵl.:֮{'-GbRW=G{2Yi^tI_J̭a5WVz8COߧpOfU_e7aMpM\x=QK@T%aockXC 3>We5Y'8"FHOA&NCGpRximFx@@=oJ|)"R.~e3r HАʭV!ƯgՑho!UόUКg;C!cf[Z<K~:t J6s׬!ZlH[y7(mtcEERP݆[ ^?gT=RVR:w+*pCm?&wjgӽz*Rc$nkKKuBA`wrEjԧTѵ=k) E@t%1+Oeڨ].^M{>z *p@tId[nA$#%̢ߚF~eqYAWX񤙹07jy( Q@|C7Jr7E1s5f5>;#\+Sa/R^ M׹Wz8[]O3!/`n$2K+%([ߨ)3{{;`EH5'R:5mcVĠ1Ճ19f-vL:1 $_X8s:O>I⏲x~fc&PƌWmJEͽUX}w{,AA ڭ'%>wye FT"x#4zR=TK3SqS/Lx\x"Z//DxfӬ=lo |O 4[gh2?^n}"$ζ+F''>4~^ǗK^X#BqJTY7Mxf[nc^@w[ۻ&}ݶǕWqPU 1)| KPZuҕUͳ[xeԻ~՛ Ddzh++L6>uڹa:PI&CT=j%oY.1蘌x60!Ixy L-G;)e<*l8ūWbn,ϼmۍM g޸Dh}yt^oBҒ~o}iгRY:u<|w ᚁ/Wӿ$%In.4ihO L g!j#j~Xeq7-пN`%H|sa ԰(rPyZoxQ:8R)SݵJ%tuGɀ nAx1$(sfMЃXEvg̋Ko`g}%ME trkAxRTpT'=l !C ǾshRTфC=< W*@zK4?*{t$/l,U'szتh8 5o'j2s'Q遄BԳrqßC~VS(ɏ8%n6 ƞu)B1gjOIYkάN2o!λ3΁["ojT -<%sȔo&Ǹ0]ϱ5&ų6Fyu]iB u}.7s_ijҍZXc#JvSd+Tn.BԃNʭ\$%G\gT \ w 4r%C]j^{> ;F}טT Jp.e=zupEB|(WLu|6rM$u65C睈??$Q:ϫ[ 2e(=d ഴn] S#Ix +£3aVwfRZ@ #@{L2-l|M<+> HS.cؽgykRk.踯a0@Ul1Kă'AbMZ=wvw'Kug/C\Sގ1= S7ɶV1'ځՍEh~mB 1cFx Tp#jxjQPֆ{2Sέa~ #$֌# eQ 8z?|"h,% ={{6_YF$uJo$ҡ} >8F>q/2.߶-/ODoESLb$ϐ΄,k^c*i+5)1ueލE܂~d{kEXv8>3tJ;GLerQ޺rd/T{|Q*ԹŲ)H~Zɒ4=#Xؾ@ktFT"|Q|i>*}^z;˜kt&3i ҭSdb-VlP^N9 B,u+N{ :>l@q|0aE_ł5aNa~(*~X;"0>\ n>O̓T+V]vSHx@>2,I6x0/4r_Α80}xh)o>s "dd0tY:K$771"anrɬ@{^*7F vk qwW6a@*N҈F4TnTw>#yWtR}Hv.Y%ůSdRolIť^t.DŽ骂W ꚉ|RzO+su{ $y ҍm \+0c8ctsc_94CsQe˰6N8O'G;dY 7E}"0Zފ|_z;&x"gڈTn)6qqq!JME7Y5%6+Ol:8Vcxㆋ6̏XH[lBsCBDRd]]#y5(EnVM*%lK`vSd=yݲ"^)υ98 \G*Qv* m45 .0Tam-,qi!ݐ86}^#٣E/Oy 0ɼ&)-D[> DO&ջ 9xC_<Â}N?, )=9a<-kI8oT>Fv>w%Ȝ(NgARIȺV !;V!7@^Xz~;-e #u7+d?^a].3plۍ]+*`lIb>pαhgΐ/gOoy&)A/:P;-5^,"!y~;r?ED(.7" /c%bm땷X%7P^-,Ha2]u+WusWB !K ޚa!h_:!ozxOr,(9^WǵF<м ʷo^6Y=m>8~Yԩi! }nyr {P =mcVa=X[av]1zC]|713nA9V6m =Zr~㤃[+mZ0 O%Qx/P.nmtGq8~m[XdӨk=?=%U$ɸ>1#vc}SOt-b-g!l>M.E\< t;)G20-0xSB̌J +4rK#PӾƣL~VR$e S!YVYFAHewZ'ሚ?,"UGO^ߐp0L"Nnd/9 VljЙzJB7CRפ؊ PlN[^b]F/goPM= V)'g\¿څs U;Vhf(ZonB7s8mgn'1%œ!Ct.A?6a-7/ra$MN@F2 {lIo9u[8`BmzZ6HcLRAd'Wxʏj6Jea50JOe튶N|߀R^9ՑܴTO5rz]X};nvh3J8Ke}i`W!᷃3|b^iH#5Gc,g o'ŤXLlI['iYbŁVP18#:mZcfEњlLG!QH& e{(SKv'+ו|t-Q-͎ 1*~Z$֏#vFUk3׿4f(ꭤ͡)ĞYɾ˜4d@س]2M5(׽H !4,aQ7;‰|IPc-b _~Uw*z!af R0bPah}DH1d/A%B+. !#e^DMBxYWN>,M黯 T2~'qu~_+H/TJ/?|Up|9 Kag-KavomY'RX z6@} Q(3.s>$VkpQ+4%OL~MZoZKe9Yhv?G(b_^ QuZmOo=g:Dr埑6u+JV/.d~QT1|b+7}U.+:Ze܎% MѓۓQyk~,vz'U`-mvC,:Y,5zծfM?a2æ0 th T ޙ~e.4%y-\S90ɫ}<7BC>\8zΣjmO6'8u2M;AP}7%t7bэoYV MEGl1)$^llЅ :JYhS~vPY CˬgLM1DK|TH׀ԚRE\3 V9H(GA}i͘пK`hQ/JNKUʸ8{B } ~}㹘&[9, ףROr8Dnn9׮ D2W-ϲvJA^Z~L_R7f{Fg(D"Oųfu' GA2B8m&=_,9jX;vw+J]w-sDxm*TN~m{o%uLzX?ᡊ8]Eg {sO.JZS-}](LfHͷ̲~-.q-9Dx?+u";}#Om )DNW}c~4a|.Ѿ0gl.s0$#],*ʹ4P{(FwwQ] ½xqB 0^(кEOb/cuLalRB0n:e~8LC dȇEp^>]N4w*/|&2J-n*x:GOCZ#uK [qrnw1暅{9 eH !l`&6,b7&^w<} (pܵl҆P,ckyG5W+Ta<*?ڃVJšnc4ſ(H?~[PxY n# F^\'$Sv+}~]z_.er Bznl3iMouC#.4G_Kar1#b\߲)mwkF,fȑǔe֞M2M*ދ=Wn3Ƒ~-!۵P.ZNh\JԘm|xقgW?ؽڵE _M@ &Z6tItQ}Q(72'Q^__̌e%^cw:$Beӿ@ic4e˪I +8^o멉_齐P^ɠ@g~ qg|ɧOix"-$@o?k$LMk|'leߪHqqe9Lu=ٶ?:;4>_D GN'; \n@ ЄDf1GԲwǍ[9OG0]ApR@ʶXg*>]Tv&4_ӹ#QK@t)rln"5 |=cڂ)*!I5@Iv{-ddH{M\6KqA>L`i5كhi 'Ǩ)O"n#IF@AW_Fڸ] H@(DiqgcttwP;wc7k^ZВ 3qѧmY^5%kIg93\ib+0͌[g=#PO0 dَ]~>3U䚃\I'BKΝw,sM{֧f;K0Qh% ! g4M^ͽ p<+RÁlV Q E_tL 4眡Lj1J8KQ NHKgB5V8QB@1LV!Ŷ_LJcbے1aOfj9fZ0ԧ˫{*q ~7֨zAǽ.p5`x'M<41"#Ageh 0sUy3>P]МnbowT UO,Fϼ%B@휑B">e">SYhV4V*b-#›\ ֐}ƦzZ-$Nr3ͯ0h=GM.8PxIz,iՏ+Τuk4զH"? bfH2IY>إ݂Qyp6l0Z`h"w{n$1bW[W~EvIg ̗o1a]'O< c3NS_L?Bd%Js/Y|}q6^9913`/ pA܃[ϡxvt A+mHH< AbDؐDKV(}EӪq)*w %=7bV۴!Lole+ 55gCNF䍷8Qg}huֿ#J?QÏ5k=HuO;U`~X$rIr1-x{uֵBHLZtG~ӚC5URTfRlfH˕&;D !|_9,ݮ &̙7,!G9!סl6ơy7I_v<\`sr2 Qn{l{RS^4OKoxfa2j*2z/qJNKLA# jۈl;t:;PP"k6fO1W3;X1G4u$0Xn+qFt›zL&_ ;p)}+:_qΓ4yMҪmN:EX$IhKy/)&?Rdyߟƹ- VVS?'bPHPHŽX"t(Ĩh7Opgd 6/J{[^T1n#y M*kFJh g*EіO}!*>쉙W4= 1s JNSp@P_5 cfU@ ӛJ9s`YxجƓțUA&׸=D܂6pL3>V?(n7 U`[VxP[X-yc*o|շfZ[HTg;Pmm_uD_*>L,٨O.Rya7Ub8 ŷ0>&P1JӁD c5K8)5MvT7e i:6ФF([~Y!ˡ)n'.U}{=u¡Tˇu}[-6O&` D4܅m2e(rr*Z!\:!CӣۘW:2$ Pӌ3 U/0Lzo]p!z9=L77͆KԞ{h3Ax9RjzcDL,∄c#z3jRMEOG VgffY #.WDŽE E>ҧu WƍytE89{&l ɹ,gk9# 4yX{@ aOήn ÃE֙r>W쭱W|*ViVB9}w`G/kdЩ9>_~_UU6yi;4oo*2:iqq0VwrOCqe9I$G׹Oa0_tL'Bo&Ζ׷#T/Ñ֘œgK>bU-C =JyzT&9?s ;Zl kZhiSt}"EO.([Jc":$MSXXpeA!GW El^Ž.o}x|^.0^H%Ai􄅋a%AB Q\Y`mh$ bNwlbOb Rs:C;qz /gߊwHl?_B] 5*Snn!~APϤ!$VS/5K;J8h0,d+4R?%zKT gHI0FORn2ms-yuW-Y=A*" 3_}]VQ?ܕDgWV)'1%l+ 8uY'HOv+ o;/ow9~LOiC܌F,}e~f3κ%vq "x^vZkj%hA,CeC~_7b%b*Zu:8nqo=:vLR3/@,@o^|ԲfX#„ł"@dz``W?cĥRFZjen3x}--ݴ%_hxCR? q޺mDMfV, 9kÈ u{Gk޸`Av! ^U(&D*#.2ݻ+-Z{0 {nOCuD|^C+z '2 {i5SmCIۇ2/OW.L4 "8hT}=G^K!xza%;XmQ5-__d"G w)mJء&AIJW$ o mLbwXZ=XȵM&sAa6@ujתk4ByANI78ݹ_>ig|Q#fI!g>K,7gns!٩b:[jj@k07q_D_.}V4%c7w`=Gm Ϝܤ+B_O7˙vcXdjƝDF[!5AiGZw4.2/|Gx1ݶj\G$?IȒahDl Y1G=Y`(L]:J"lT`[SEVdPlGߎTﴩgylPpMER;Ez=p=>dv9 |<fawd'$eX kOUoFoeWPx9i 쿱uWM[Bچ^.X-DeqSF.q@ M);lGI2u6y5 ~($@Q:cl+KT XAFl6dFZwl;#8hB6@rbaY9;מbHsDvmk@~6G$KGj QCP~6j=/I=et;t.F̏] #=PrCN6{\'OF?Ad:SQk$ydXSi℁MkmS+e'{[Z{=m5 ʌ_L*1[';s]?w-ƞH)ޗs3&Vla<,bD>b`EouE@e{E7 tdk ;2C[3CǦ9DJp=0 e3 &}SP7?k,ה:|}Z h9yz`{ni/RHTQ3ugu}hvźmPVAYU;OQZ@ Ջ/2v  j[!YBhr;B4&qrZpJl(<B=ijߚ@XrZ OC7l< /IP똧EiǾ8P0ַg+8aj:V~k#BNtIwɧyװ8[Kp 0?)zv .zw(a;k|.-e S6ӳ9\o|LGSk#EйZ"Eua ߊCx>WG| ώ*͂Ɲ.P/o'V P$~fV,~$!6nӀTf'fV0,9TiGfxP7ӡs" l,AC_ `3'V||)| lt1@ՋY"T0Vsť֜ [_(6:zWu~;]^ȎU o4EV0mѱ<",`n"cT5X{Q)Ov\wm9?!3Oz;;~IjKGcN zȥx6OKt.Ey&W@  }e"QJGnYYж1Ȼ a{:XE (Tnr7WɌ44@+!o7;S!lu j );\73,LnP&Е;9|!Dt1si"pԿNMj hea9ҷQgfRVA@$AJ )ө%͆{w]#" r-tZ Q{HMT8@][(z2`|g20/t c`z ]wVu"0 V5eKn5設Zi8%L)yӁE'ֺI$ak71 WIPɢ(&P:zHMY~>M(0X낦*X1AI'uu*]ϸDl0{'պ~!N0|<”w r@ I ZoӢ$Dg~e%RGj( 4 ?Qq/jɾ$>0al-Fx$&ގ2:bÍ;|D HBq~-$~1_/C g!;ܓVUa#o{`ykhu07([3j82S ߸y<2^o6-@pM,W~ xߚKuTS-NI3KO0J{50Q1W&zH_?LG:v42Dt&a9#c1<0`'%?Gu:hM@Gw]AZ gʔf:?4zk+*o:c[/;i3=O.ar"0G=%QP(%ń w0"߽r[SB/k@y+;nv}1ۏ'(/boH;v$wFkSVdkenaңʌ8) Io:%mqWQ7#gׄZȭR+{Ж1e{yJ&IUͶFjR#6^^+Ine^t ^k1`+ Ȁߦo7҈'Sgs:Qj]!e} -x/ 8{SiwŔȉ@?c@Dڈ.o|ȠvB>]ER8}Kg?j%';IyĄLuk䀰fs1,&kquBHmAH5jQ*L^7^(] uX{YqD*7K!xưaF zJ_ZOoչ l 㧼;;?p-k]܈4Mg!-EӳI7gBoxqB wZ\C$8\FВwhS& 晟fXӦ7<_A@OyT6=V&jRn@7P/)S`řhUډqL_60ȣV?QZ yc J1,mP b \1Cnp]! .Zj Р{nԓ%pvp¯6,e&/yT,8KV|%\So9t_JU o vW/6 9!0Bl!sXǟw;Pe0f4@Ccꭕ]LaI6lBI@Fx%QX=eZ%t{2SGWj5 .5l>Ѣ EduTwHdz$|+S @`~ :8E$42Vfw F<[;vz {o)9>EtoZ@yrl^(l&p{K[R_ɾc}S[B Q3Rexm!9.,؂EIl(A'eʥ+Uo7:yV:wu!dtLF%"v Q"7ris/ Ylc̊w&=-Xtlf[d-&s'7/@?vyהx;ǥuk7 뫸G~H¾GA3ryhp@߫1)u#8}3w H‘<ӱ$^_&5f߄VOȃV]wIW0̈,5*5a?<., mMZT8QV9P3q}&xyu(pyLŜ)YLT@cÆ]M%ƶurrHHz XnJ,m bfoGLh)]ϲ2_n`fk\E_Шcv2DJis8'h<Т3z %QxqMd-=a2ZsdȈEC.Kԯ-{͚$m K'S8'y!f:e)lZX3%1$ `|OdU!0')Pg"v6pVR1 RRv1T;3{^dt+9ATw6/E&W$m|C=`;x I2[)׳mЖRzJM$X[ـjqG**zݎ>K+#B!mіy>Οl#< TÑ f-艋 4Ʋ7.6 إ ~1iohNK.( wS@5Y伬 3d}},ާcwrd+bPPnZnhfdg3=S3Gy]eV|Z# }srnC%tڠ=`^ץ:87\F&n4]^_& טRi<ꍦū˸gm< b64UWs#k zdnvyˀ8bVms|/SD,>C (lEIm]z,C|cj cǗN1۷] ;R-#HwyˠD/ =vjNxJö29b:cw|Ytvt~nt|K |xeػR%} +&mkƸ3\lz=C2C!MpѲTVl؁CBFwCqQ 嫍XJ1ZoRZ_-W$ qxK"\XzP3("sa)5SSJpshŦ Յ[ 려G= ö/rYW7 " SSK|L 5#Q5,K<Ha$[p 7D5MP MA8Vq Mwe+ʗ̮("<|W*D{'}QB3Jx ї^? (ϋSۛU(i#!P=,`u5r8|=H,Ves-G.ܶ;9OoƴU/ ZUg߈\rRl.DYbtk}4@w4=E~ClƾE[⫝l RE׻-7Al-x|˻ueO T2Y&~$6ʜg[gߴyRbCOq_[! Lhw[H#V;_{Z'آ%oMl %w_:g'#֏_g8,w!d i8t[5cی@iW6KjґePki;QSNnݓͯ %:6̓,T y̤Q8;FD2T1K)vAjD`vW'చ@WP^ԟYas~vTC<'lm$ ~5f1O\b-"bTMҊq u]$Y3AgCu#\ UJǮKvƮT$Ah{dz[q#2X4\Tqx'6ePh71_3o)W&sRNJcf&SUOAMc颵/mHTqhzRoeArb$ʁ^iQd>l1c#\B^ ~Sg{}l@ Id?3.G8{5#uVDKPxԆ>1[L})>>s6=_\pf$_=Grִr!f  ,G/XInj,2?HͶ#>-x ck ϬSфRb5O%]UK.ol;}UNDh$#otĴgO4k.9.SWV(k,KO[)iV6qhQGN Wv7XIG#lW +)sSǮ-juݘQM߆sHD >vMaw8pn8ΙhoW\Bٶǭ1C~dL`r:.j0}}QW؆[U1+ڍL^R\nJv{(LTX/N6=1ֲiG۔e˖X(ו{j)=`?KR4~9o8faTݔ7)F/DVo1rߙ>20A%r~.^s8OTH.- zd Op S'M%&70*C[li:׎p9/ Ӽ7ɑжBN=ߜۚ-=qyj-W3-7\gɐ*L(Љa;QZ>8|4iR!Z_0\Q4{qhNUm Hn.?l%hKZK+nr-q=F,pk2 5 ld*5tId~N#D;=phM)h;h"B9p%C&QZb,{/2 `Z ƪr:AfCVX1yAD! !k&|wf}&n$Lj_P*Gq >I(2@ U1xnM<`U'a؟ [2FzA .>H`+R<,e nhBmAs/HרM򍄹$AHH+Oˈ"jD|͗2NH shKAzraV&Jӏ/ ۳*}IR lme7"ԹCQ>#;7sm5 3ZSYW3Tmt$L݃*PlS"N]aܾ0 ?~"42%W4~Z`hdhȓg 3}ڦI`Ew) ㍤6ۇ@9b1sMYC|זJ/|M P},TiqLsk?7 #Q&R7)Ai$G回 hƷQK˗-)nTO]|t RkLL|[gZZh~Ka8P-Dr0gcE > UGo͎V2;zo8oA?:x&}~_Hmwma@4}]t6j 3kZP3ZJb$w`ٻYш1[=WoRK̗Z,ۦs8/3D5e|TBt@MH /(Ct,yX>9xIN6uhs%WK:̞1"]>u;I?ͦܙ^ 8.[ӓ% Ւվţ^I%&ځ3 VST 4Rc]讶s$W+PҪ!;0w{<>c[M-I|u|_̦dh.Y,SD7<PVC!!Xp3n)l mcQA KpMј;dLW .x#B1Ạ"Fn!_ba⍛ݹǰÉ -tB$d?(ȽylIZ.`D.]sC7.)*:K*Uc l$jj344 n,7` (oK+=hwdj5r/ywUdA$q3Ƹ1t ##eS7MW80+/LKt댬jHQSV/jWNl(-mK  T}<5ږ6}Oɨz¦vtܙE\N֙Q:3RLH z x6;`8O_wV+0dpԎߕ1 JmHHw <܎u9 Ck) )uxS~ehDT)zYj>g7YdI@'ٔֈ\=:?U1nd%=DiS&Ql8[e7?MEucx#ZK抅T](5jE-*m_&5\:n]OB-S)7΂f(#nَE_% V; rkQ FYAw}OnF< Gpe'}5%OH@!BUͲA?g3H. QqAxstU'?&e8~;YpYM,D/tCzc3E1RUbRG Ahp;PdNl|A;pƂCm w Z$ 4IN>Mi"ƊH=#aJD{ U ;~H zE\ѥ#>]$g䈨5zP=b>0drB_賙] ]ˬ嘫㔓}eU~'hreIU~ƣ %azuVg2L@/n^7=!Y ¡c&||#V[KQz^޶ Ұ.0@5C0A:FA䧍ܤՠ3廊ń%g0W()&[;A=ԍK&~/r5$bT:M["Zӆ7\4FPn^wundf+Qױ>U]TˊI+oHX:z|,+CBcdɤ!qsB3Wolsyv.䃛AQ~aҬ,fЃp{ 0|>UrFbMlU7b'^걈٣oNj&xLA~b=䓅i=@⭓W⟫=ݓ <}uqsЧ09[CpCL8iZ %䏘L(|; fs`TuK tXN r;rxUSC}%xN Zĺ'X:X"i,='"zo _!2&]ND*oQk..4FB"#R=+8渢S|@[ 8 Esd 8[ƾ(hnP}_#zqMٍi ,R  ܫn%[:,˿]ݲܘIӌDQ}ahY1=OO1K~SLf=u.W$?491dۂdxiK/?7[M\ Z߃ܺO 08.A2'o[?y7Mw4K7^ z_lgWu? fif9 P2&,pryֆIP}-؅u7y;p[,GvUd'zjʯ1^ըOcHPzrNy0acTY\ȯ'ΑYEϝEֲ=vY}+ݓH*39B鞧SoUBS[˾YŢ24 Ju*<$1tSz3ԾdddѹGYAՃ&,.bV;pGg!HGwlD gM.0ej@QLvί-ӥOǤ^Я@U7ޚ=nn'kSZ8'. lѷ/n]|xŸը0 v)hǎY3ͬ1rnidy.ynX2WuQv|r| >Iu.x -/ ڳsjK⁣]&F`xAэJ< ]|U3!T=+HLTԘA.Y[tm(- Io}g0&*!85ǯF!M0UD(i+/\2:E(1Jn'œ9II܉!ڂA+3f =Ņ́9F' :} iRj`:U^F#)/iL ] x7UJvy $2y]7wD0~]AʹܽriS2ytRL-.2pՐ[TN!0 )`$fW)40- o\ӖEJ}oQxMA&Z4AVUaoq Nkžqq]l :BehZ$~Y)`C`(e),0-w)Ym}G2L,tubS[L ^O~ʻ {В$K3FbV$2Wg-foluM|Û2Xr .׮.x;;Ty/-T0[]`QSc|bkX =Z&YK2w I͈pzb;Dwk5"oꥈ=%(a)֗w۰yo(a*ޒG `Z8u*'19k$I^ߟ:l1拰p%XȔ\ca9)BW2T \'7v_otC_n϶ U$d~)6Fz/rNoxNh[l284 yG~%1kG1⻷>Ca:bnN y)li6,7nR"7)8wPO)y~sJ3 .ݵ!G@e[S]j̦w0̗<ZtFT>ӎɇW:HYhj8LVza^c>ݼ5bdIǛǯʪ隟>YKIKvӰB&Aaux(LNbKtWbё w썊^Ȍtk ss :W ?!}uOBU|pZ?DR:-@Hm%vU4]_̜A m@VԵ7N׈П&٠m2ޟ}8-\|)Z%a?=(IOaٕ t9ֿWRlO] ^ W)ۇLVr`?y` henANr4}6JKcH3)efC;q ,y/a[GQ o~LR50D؊z0RdIS=u9O0[&[gOi/4 ` \ q,PC'x0M 0+k2 P ')%?EtFҚLUHPFPҪ̆LsWi: n|?m'׋y*!yru]QN|0_:a:B@q7/ h N?rsss]B0W̢!iŠS(֦QGۃC1):@TZy_s 2(4t⬞@C]q)8BuE]\d2GRAP/hM}Qho6>E$5j|) jegk;}C & "pۻQ30?+A 1-E_ٱUr˱"W3,"BX[Y +C#4wO2w*x[s hFO@}*NjΐKuu>@ 5oϋM<;I{ClQ;δ豂z׫-ʣTӖW.]cz7p!\^ *Y7TGo(5ӢM-b [ ML,;Ơ%i?Ű tS[Ca,c=7#%S$x~; @$Jtc96*Mƃ #1bݖiVjcv8BoB}bZu39 (Ar#IXX`pVoj/oFn+ktciM1V7҂R =ô-x%$]a8}Eձ';t=T&K}=3O!D\´X,~::E=GX\$x,w,URn/ޱ701;v x(N!PHp#<9?AeOywdfbNvHypn1Rt &EN1prKٶO{A&8ss0Xar.$}lۯ]Ƴ>%u;-;ȏ'7KOEF~μ@U<VG%6mi98V_`vY(HE5-{lw CL5H~WK%& bqmวZp!.aҸW?h+VE!PIOTH{qآ?`6-a8xȖ5*e: ^*n:iֆmUKO)6Nl!N+,.kt_xKk(( >n-]MM}DpJV[x$`ZKpcV$ԲCU1n:h‘`wߔ\<gXd[Wj4DEP0KKPyE&Q0|? *kUqk\HmR4a[qcj L߳Cb30#ӌ/*?!_gn:EUx@pב!llh4'ELR'!Yk(@ ][vo.qdq3kHf".YiWu  `R|Lʚk!c[)%_.8khJ8>=" ɋG; A?NAP3E?ݎTόZۦ4Tu4&۹c"ǍMg.-Li "oD!UX}cK5t54H/$ƒuF{=SxR2Z)=]kc%Zr)s;!# n̴^C=lR80Ji"g*~ sx40 '"209l 8"jn,thaZqB-,#+,3br3/e#J}GGR֩PY jVL4aLͻ p(@uf05?\3j#r&«]M_r2E-y.Bsh~KvzK pP%@|~~ό-5 `Tw <PrUbֈKïU„:$qzQoj2br7y P?Wb&uimk`oە(OP߅jflg"_JV+5ݥaawg cG)aR8O #ܴ<^B:*UGl\0m.!yRRC߾慀?MUlXau衠IlV-rڈ1Zl.~ߢLPpTUߩ.9 7pâ %A@7”;|gxLwLޒQEXMhavz<{bӸr|,_K+rRw`׸ǩ|͎V"lB'>pg&EӺe:M@4A)TuvhƔMk+liٟ]THQB3h%U bi(}b|: wSh K1%)#B N$^4XILcWfhFl)Y@ j $~y Xbwг?h&Xu数JPB ʽL#- .)$D#qۓ9YK^#x^qwf"cU`,k01j-ğ}YoU8dnWn%˕&<*3=R oRjc3gY/.A(,T8e]hIpw:D{ɛ:'xb?a)x$}%k/V1=K? #>QWjٺL:iIh$C0yqZO_,)Eͷ@Fact0fD7qq BRl:9:i,EtzoB"#`\n}/$,ߥfl㯴:\5J# g 0?*XSMeRÖ79zz]*HAYoIf\ǘ^_ܙZl=r5|깿LFlG"Ƒ*Ju r6N$>(o^/m #A$?my3kə3>x@g<q*'hDFqrLX9@jEf.īWq֟@"* )6T goE`wƛ ԠV 6I*-:31z~fn'%0&:4%N0GdI,Xi5q^& @+up.|Г  l(A&%׏Ԟupʪ5&IkhZt@c.`]dgڙABY1gj1m- YizydyFA?_~CaijPQ3/fjCuOXbH1V;nm#T\ͨ?LGK 2+e G%;  k< ^sL1&DFaNrMQI/=/fzK{\I!QazTMfzpe?34wDAF# wg_wʖ 6 ͋Ho3x[6!LS4kƞ`$ژURR͈ І~=>Zs2IfJscx_短V-󚪰IܥUq eu׈~mA=覇΂mН^ζ;}TO8Ԋ͓&}@ "ĦCǼĿd>oGKc2 ^@I \1.N'v8KȻ_KkUP-(!cq;7;_d_3ohj7zjwScn`˥i@`,$X+%΀/ i3#9?ȼL "41 muQ¾C90c dB3[Ã;ɹ-dY'Q,/0$ 1f2ԑki[RW55Uߺzů+vQdSi-8腏AN=:<֓AG)<={ 9o[AGԻ&0r"Ğ22 $,@ 2Z=X}%(JK/s dMsF17X&B7_H5(1˨CvOp=b2};{̂'h4KqE8.= v4~ܸv[]C7m53ӟ/n1CKjc0I&oW7ŘBj?[ !SƹO3 ^6j1Σc-"Rs={lkOOάNa: ?ے?tCUm]">[JX618+6:&+&W&e "o!['~7be0Dz !z|| '|Uw>kƖ0 fuphtE[ZEYT޶ {'#Dyb<[dtDW-DVB q=L^^DKDFuKn~4 Õϊ*QLVZbݿ|v'I26'Qx&Ym5 81/rm8!mpŚdon坏WӦQ~B99* .0R8= e^ Z3U[q5t̍^U ; [8oF#C#ҷ&"Eɞ;Ct{Xt%(YmnˤT6nWv\w`&?a^.y喨A Tя%[H {”wIVA/P}t_aLnUf M<#J@ mPgV&r?'>=F!yDy1y>LRQJͫ<1Ja+9Tc/r?E̍Ā53BSgpu=Ç8I5`޲T02 . \84{X\IaBblSߍ% @Q[:]|񄭾pR=ȳѭYfGS,3!ԑ)5<\;`jﾢX &&^q,hivB-cҲ/q*s G|VSe~4RՐܖ3r5wd6*'A:Q=]\N9h[醀־z[_0@4xXA%XH ݪ5l +:{]kXMy;[^w~媷r&}`d|%> `yˉ]0ءI_ 460 {]q@ZDxй8m\j9 ⪓E2iuvYhա@bgY/GǶX.&}zsRaB8?pOѧ!7tӁW  Huy)#5D.]V)vC6mFAg?nWCkE k-ǍCOϿxQtg0ݓ>R}G#^HL}ЮP.fԳ0 XyB.ǠfRzZGsgw8czr-Gv: >UOOjOQQud_@P4hh[ .6#q_'9RxT5f#qng9-B! l?ouiy.Fʝ,[^v;}^8[ǔ};ɛwȨ/kO4ʚݢ|ZA, myMG0L"6! F9G6aEQG&r!I#1XlYj`wRN,16v,wj2xgb;qeY^k;5^heaDFs' 99`dtjrF*Vz/ml%%vz9; nqתO@GM?,bIbt}BJ0ޜ,8ig3RN8S$%w{o.OxAGőa3L`IKhq\}N<98jΕ77bG>Z1];+2d<`=E̍j2!]_ $۽UnKyC0jyX~eG,TeB,8>쩞d,PU86]tmBd'6Z4k ;+[ᮣmZ0-&Zԉq[sB|؆GDˍYv @$I*hn"` pP kmuX>՝`y{ft?~p# `X嶺edYC ,#fkTw9 r +Zn1B(!(֙-Hz$Ⱦ !˧,uz}7"՞'d;O{ ?'A㗅%lYWsvJxvRWɿ!wْTN3oy޹$4 +6PkI/&L1c}φd)%]h~d<2zcʂr7"Ǘ $k_fQZVT2ȃ JP498y @Q=|)8<.0-R60Of ;wy FyG'yļJR3:E-Zm\AV@Ϗ&I]׼qm!FvԞ5`>@FXz`@9)M,~ *=bS@6%o\i5#3t?Dr_4-v("+ rq=E%rpZ|#yVo_YO(p}@5W1"ry;o! lBRR} 1` r[Uϲھ泾 ğb@ OLt*`]jКMHF ٰ\wjXӣ0Ny3B4̭`6)0 JGtFzD9@ę0/i3؉_-өӊ)?Ϳ|Z fx\;8"yB 4˺q!P< X!Dxr"O~DbV-E|Ȧ~]0pOjQuȓmMܐCzTJZrl ix&RݟJl]~Eon`WBJ~(#Ե>u!9e>#M.uǸ]-ڻB0Vt~c$@V)@q5@iщ\ L~UgNb&(Qw)uZ*B}OĄ;:RD@I:u}{߅ fҀ'n&n}Q] zpW7ޡ[įﰉvo50p uyz GdO)p7.־X'ckU*a]LcFY#󻪨ⱉf҉3uǣC{l_MaWoϻFd =;#Dc'@h81o_ ϷӋ艧Y̤H [y{]oј9Z].oئ+-G2&p#s9q #.MuSTZ[;!^unw2+3? )k\6>{+M_@DFVGu:W ǴOFrzGK.g~{1kK6@/Tvb3KnW.l ͍Nьq!_l;NVuT"DonK7fwy)تR.w| r0 $S87~u)8=Kmx]PK̾b$mD7mʛ5KuTJ5_֎J*< zHʳR^"\(j :#>zfhX/9*nix>Fÿ7}>L/J X Qf]>Ef ) P@l?Àak;4x4d7iG呌)OHW~=q JNŭ'b~ qEfԤ#ayVH>3H+/۸g…Pimq+- ag{H48.2M(1C|NJZ쿛{s~(y([褎our nF A!x;ScfG!כ6S K (v4+%'{X3Od.Ɖ[սGɱkPM_'5-G{S.n%>(:s18@ q"nK SYVuJ`8^kq-}lutDόM'tRĉC+Xuv_*Mp;1& Έ`UH|'99h;.,>o=Ҡ}먟+A~;U&jZZ+o"$jͅhH[UtP:/ hpg<־-XviBu!8ب7YwK;׳\-o&p\G솥t d@!FPZH5햕J騡S-D}Tm}ԡIh Ke\ɝ˘DېP0qe7{$C V@Tͼ.|ԆyN_~P]#9#g4q'prLXQRp)#79(:^dblj86YKQRs̫ _TwV&rL-J\$? #qg !6aI  9yD^LMi@f #rL~t [>1\Hc{b 0SbB2<܇bo#ʖB`w"eZ{7& 2v'D2jb9LKMwPO^aS{ڈxDKՕ-sl\xwuB,azQ^Ԁn@0j1!OiEzL|4'Ya_YcsvJ}iO @5*MߢC@<`1>fʏ`=akZ)TY2 _j+,u Ds+NaSd6b]@~8U(xu IucX+s=z_*2HyLF̒Ì: #{ EsxٜE=+q2eSea/cԧ_!HGh@Qy3hSkxDexfF+= ^UE=d m>#M̺n>;+1@a%O (v|nWZ6 O35tc.ѶffRhU1y %_FP|@jZH9RqxFWq64&uD/Rƙ9dy[ۜo]į)Wx]j`Сon䰦uJQl0[j= ͥ^JJu5̎a)蚼ڛQ5E/f g0 RsY==pW1̧ bC&_OE{EsA!exh, o #R=.BV])S݅{ Ao<894s!Pݏcvi t~l1?>-XT5 DHpjnY}i Դ{Gxy, cŔ^&ۃ,TF f79N@Hvđ1D19 A4Mb29@Dk[]=Xf94i; Ɵ6xv6HJgZNϵZuxJbPޟ\>TKcF&K.q,<)1`p눑0jx5J4LޒEH4ʠNdEM?=!aΗPVSriy)dӂYľ]6}j`SMxu5P2,^45H1҉UfGb{3峮6ܳQ|;tڣMbY<'V b\qRJ"r^2Q&??_.K3]$P*fVq- BZAY-̇;E%;rbw&MOd(q?ªtW# pw{H3" 9e"SU%$Wߏvq_=cheW6ψu6_"2^BU׎" ´i4Joa\k~覦Vt-uǠ\aReS F Wh3w;)P:844Nqt[z= ĪYv!`cۢ&qso{:A;yBB2 3F t+WndBp aQ|TEox D9d쯌 \-:nߧu}3GȅW $L593ȗ)u)Y?ǰxcV?`E9r!& ؗrǨ;ړ3jڀQc'5ЍU9먨3u00ҜZ̾4}Y[p;;TzIFa|*tE)Ysn@{m[xkiR# X+>iOYx3!Ʈ2حB >l)qj晑 u (C o ;uAh #da_bA_ѥyn-{sƙ±:H>s-YlfǓPGвN-=;ŸIsaF^PM88 b*Ag?ʫb.&a&R /89}bpp}p!Ě/sB}7=X}i8v:b{|/#CůSq>~&P p./( K}y%z,8m8]2y9ynqabF.FG(;HNR$%n|D_6[@mU8xLޫ !/:_GMGɢx[,JLDߜ2ꁦ@GlU~$'5 {J@aҶyNsSǛ 1sF(4 e3LNg_rqĬ.8N]htDQ/ޫ0^*R=߭$248|=^U~!a7䋙 Ez3DF>?hA x LfGqXFvԑ)5DUWkPWO` Uz 6<ڧϡΦ1n;ȎD{@B̜O~[ᢕF߸i@W+`6bu~\=I7*v+ lj ܠ/[F\MiP!.Z{ieb IB4U3 =P?hnF,ɣVֽXEcn4, Mx>/&?=?NWZR@[܏Cu8$)+#'ڊ.mf:r@S@/ |;ޣ[De}acρe6x'o.4J??lzV[@ƭ)ߖ'PѵX|.ɹ̈́q?? J ^]^:צv^ K5Kc?&!%e;1-dH 0Q WJTE5tZ?OǕ9Gzr8;Y=xj PȵDE`aa~,J 9_*;E;k)|ܯ|(%^ɸ7x%lTxo5_M珎V@OB# Ym(PN~%X&C=O~=o?4C8k( 8QɉP&gZ+6q0mɪn#B2V%ǖ98Zݚʀ+B3due1BK*U,^ o 12 NB/kwgz`''l1䆱1c]zv!Ѹݦg(_;PSr`Wzgӻ2F}c'ܝc.iF r)^ɺکa] u8XqAMz\\\[=K+!(uJxp̴3mdm;OSx[׻x^uޤ:lxd0>VprMG٠li'=t4.&ѦY7ap½ >HʰS#z ' s)&YDƟ7TٞGMo5sW`'|YӔV͗xM#yz$:&AXJDB33y~4-3x2RQt\"0'Nd:]~e4'şDO_i9wKhˮF"n3⍊̌hytmWyگq4Ud z=n4YSvaBzd#\[1PkL`,nN(7FT$۷XFOņ n_åB|Ojw+91´C FBB`ݳA+=%u%V3ZEx蜀vlx%VA\M iWAQ|g6p5ΥyBwG r?~Qmb4N`qѴ6^B·WȪnQa % jS{ކ_7n_M3u&فL57'd"ӖywL^6wt8Dd.>jʄ'U躚p% aldH_sx6NqD6K.8LiOQK AmW9KcM5ǢLY0JeXb\zris 8]_Gl;ţ+n=b-o*/&,=2.Q̓ ΘbrˀUĮﺆk3r,~үKWo%ۮWlI "4%LO&\UAZ!@!RI6ѱ$k7݊V9Tyi6S_$6,`\5% ZeZP,8#ETyCn@ NI9Y? }SabIZ1uJ b#j%7 Ni҇+"V̉؋vl QEiZhr`7)ƣ+䦑 1⍟Zk)s_PK%<9|HF?BUZqq^Emv 7-&yY]gWYBȨMnFrGZ4 &4k~9 ``kBF:1KK8x;뿩n D= dx .Ct-ӿ':c%@޴KCSfJ"DIs1czbz:mR} 6e]*2G؄;/box8erl$>n-N`~7*xJlb-Z" q{we*vXi)F hHjlnںx( `sĖOBEH,9Q/o"q[ ]]y[HȔ42_6E9O%ⵧ-cXv1R֭ F|dӂHz_Q!Gf A=6ّÄ#ۧg􇙻N5du7'!myF+y8q9)_},oPI_zKQfylAPӥ+d0uk; /jkBrPգWw\ȴǝA^ܭ21_N0Y͢,lo<_,br: , k RecV)+ 18'fW컻2-ǂډ۽2VґЊ:.lZfcC-.y`}Qe_Aԩu$yXZ/ =@pjX6(Z)""Z5&&xkɐ35uA!1k\j */1]Uv MoVM{kHzFSH<j2VG.ߜ~" ɷ \n?$AHs\Fj4܁.RSLNc}I6=ؒEzondC JSkY_6R4 ɚv7mPU#g"W=Tsg ܥ:zapco~JZZqcSMjLcZZbPn{:%l~)+bA>+Cfx*{\;QRxU_Ԯu@ŵ xZ{g0# ^«7㒎\ɖ J^PW>#iu+cpU8.Y%4a!UѶrQڴ fRSpH8{c4[ZjrmrL 4`+$o@@K\+,qͽAеLAf>j>$Vk))RnPP٧ohu=ЇO0ig 0P,!0XE"\GQfjU FGъr0( K}8,PY90% #ǯ܄Jޘov>Amu--urF7ZaYvu~kd8z#O˻@7R鲳{CI*ïQ:7c?`'c\[[AuR3#jq@':^>-H&GD{xy &xO{Gh c#oS fi31L9M%R1NuF[A,o.!@MǠҵSJeRq 1`^-Ex^ |cE74j|$6۝@b(Ĵ%ǮDQl\/`H햌*«Q<r:))9ۅ,-%áH/է:"QL'vh/ E7I*F&i PT˙;k`áһhlPKΆ4i[<(e$UTu5+X6&mʇN}e3E] P~,ZbY޻xx]h:8%ÓX }daRGc9va>>O*?ۭlx{`mـ&- OZ2%"G~:ݣIc@0 9\׎ RAT0I8P Ű $LLTfuf9YQPx'_:1bK%$ ):Kov#9 drSu[fZߎ`7f7Ѭ'$ [S(^%i2ݾt2qLv,܉x_=yuwb$#9R:];3+*|8+c;=$si%aҸ~>q^=Dm+q0>Cuib=`ePHh}b]Xl~-SA+S= $y&]# <׶ <fQIFɌ!: ljn1~ X :ў[pm` zp1|c O'rp:)FEȜ;WuG xCO0"C6b-+H5 x \ct.2$UB?t:_8vp#tm$l?*t|!,!HkhӈI 0 $$%"{/\^!"X1Kmu]M4](z <>j]p4X[ |*߆@?ScOeA'j:i N@Gedcf)DT[XN}K^,#MW<4a]L e[ ě\i&mMl>n=:ZbxCz8rc(Ar7o ;zjD9v c|D"_G}Oy gx_ưXu֦G`Uz*aB. š}?CnBƵm<NUm %سR xR7'>٭,"H!`4B^}O@8a$0@S˱=,M̉#'(d9Fv|p fv}Ř_ݝ-zC+9o1XN{]ebŖ];Җ{ck~xK~x2B!uQ4TEkKY3  K|z!m9QTCn͵}2uC!8ɹmH@纺z' H,/l}na9OR1U6ധÛL'Ā}R'_y|,R)Θе3[0Jwlr Ģu0?+G 1wfERv#׷x7+98)G #yT:Ati01F 8AϚ?)bn$MprCۢ ޘZo 9F\BwRC$~VI<ݯDɹ:(ƹ`Uwn)߶:mtA@Va6{"?W=01I(ŇCL@!2~ ;7пIjT )0{KΦfvcV\A޷X9 J6IdMVZZ@l.]N^1p K\8 3bZkG̨H0w-SJ(>S3+-ZiLy5F-Dj@^/y x^:,/> M"-55h/?AгC88P'Ӭ"3U&1 :8[ Nj헤Kr4mW`WM2E*f*~ ˁLrGS?X2[L_=K$zGP٫ 1عQ2ZT5?G`#S D GӺ%2`ଜBf۾`6ե8Ϩ}HaP$`q}&c[y+`6Ńv<_'y~m!rժa€M!˚ЙK]_VH8)r2J>fgfx`@.4aqH#RuW8l@A0IsۀUVOip/Dn,9_tWsC?Eh+/rݝWKǟNkRd_\U_)]l<]% + e! 2-TSj>5)/ޕ}@4"}+Յhl ŠPa0  gY rUAD Ba tꆔB#q_HqxXBB1}o?9 3ݪ ;JLz귆R9¼Su歌2"%̯MͺPoK4k w(.#E0fԛ3@3\$@ܯ-{YJS`H3.|Ϊv6˭?ixJz#0%<hO*ڍ*ӫ31[>3F(>f.Oq+2Wl<<3eeW$s-m3:f{^sY,QO7 #:²D4@ܜ S%νkyH;t60n_^t FeF}W ڤ.I(C?+qxk}P9gWqef$ʑeu1:YNdHLOK2yUQޓƠ@Jv2"mK|3D9CptM fI_HUҍIq=+p f/PU 8VL.{ӎW'xhIV ℹԟ&zsP$$H"zb- T6eͯWPscc;inZ~Ao+ruaZ C=!hjym; Oܮ/']c[EΦA_&چ.uo֘ {]>R$@),hfTm Xa\M1@'DsƮuRMoкg_ g3 v[ vs1 Smg-,oDBdq-gM~\͛`J=lԪf*C*,MھǣGRv a:dL#]5b~Ԅ]>.}*:؜ovu7km,EYdDҥaϵە1%gWL!3NZSonP$K8 &;/\3$iSQLA'9"K*oZoX:]x<$ /7brJ<ja?ƪ%d'*gW5cB5]p,I\<>2cFzN#C_lS40 ûfMׇ7,S Hvԍ(x_ZQ$\UݬYvon`i(*29Orb i)p ΩUCX|l@qD]L' 8q>j1s y[0-lxBqQ=@s].i?VM:h/V)UbZ*0+kCaED;Uq'h4s"aghi B:,y;dV"l"cBB4"\ǟS d8(}Θ] ԈEn[08cEgB>W˂C`nۑPGq4!H>3#sӌ5[.$kM8E!%ɏ)i%^x3PGI|*%N\+x%i"^wl+g`\nKYsaQjۯw ݋YηYf=Xuk{] IF6HoC7-+?i_/V0={a5Lͩ8EllgZP\#K42rZ=v4_r1t[ZFmuO./"}c_LAG4R ,t)#CApT5#q G2*QF&Q G/1Y)DN/,yBFu6"O> ~`H򀉠TS90B~u|dHb]ͮ޼hZLaY5"TtA&!r_y,+SQBC $$xC~uőhnIV~"JlK37jw|΃c J\:Z⹨ft74=(+FNu¯(xhª&Jj2noh6/@"=E=_VqxLJfJY)\B|m vL̦©Ě~RVkj8ÐAJ!L1%zؠOJN@(ÊG@>Mr>g8aKn65 c×J2/2\#ݝɅFCwAV$ 7UE,}x&WF1>o9n&W"k#\:`LeRHX%uWiy8ofm%FlEӺx}չ(Qje][ӆ`EjLPoB&Z5iEwe-BfhɷSl-\ BS(*i`Wd  `&W:x%t9b`NUq~$(̃ :LJ]ӧP'2G> SY̰yھJ\R͸ϭ"-tfќ7!C\FNoVEgr(3FW4mDk;R. )VIp"; ĺOSW7U\Aƒ9F:UOic } BLp8"8\0g)B7,kimTb{qG`9\\T=UBϞ'<.ؐzl7զ%r.ҥWE!bpCeڢ?:uD%t(74=qGd+݌ޮ1A*8 Z挏2*^^5&/h8zekK1蓱!Ƈ&?WSP5m w @{@`B^TX"d_xh(6GJdkGA?q]s0g5F(/$C@P>{>Ñ o&H$a(pKwX#1ߵ%]UdKwLk0XTg,Hij) 2}Zq'"io֦FG~E}v1 f 3eMTѩ*Lid(Z<(V$a[-&A)S.u<ǼД~d (X mNVaZT!]IDFLO[ͬrNqĕY.x([a䖉tS nZtqy1fcn6>Q) L0[5wC6z=BrPiV[+QYqvJ˘vAmֆ &ux DDwMY1L-0N~}F60Uݻ^ f,oB^5Q//\G' 1ۓ >ݱi^qZd]=n`B~> >G)Kt8ihQܠq7 n뛒ML ۱ؤk2 P : BSz23+ ]$z̓R7|`DS3A$ԩ`. c奭tgɽl7lV(? ӜmtgL9s +L 9Sᬷ4A03~-WmO,]gCcgQ\3#~B~?(}8`?N.Y+l` މF@7(XvP#R9S_./p#Es'6 V[cUe'5]^@fgaLƺ77fuBJ,:P5G?|̶[D ]yyu@jt͹^6CNz$&5FlR p'F<%ݹPs&sgn Jl(1qTT]wz '~h$ah9G+vRp?H!Hz O5E="K<g5UЗAfjT {_a@/1"ĆJ;i_I22b9s ZVz Ϫ(?\Y@`՟*Qd!;uvXmVB_5yj;4hΘ8a ͆ &OYƢa!S'T v4HN-", eqƥ,܂#o VIK9=^3Rǔv|ryݟQF5|}䀉ĊZ, eH (5@ IA`A>k^ꆂEzMv+qzJUFz$S1ӝD[Ԡ4epiKh7$]B3upaN, 2[x\j`$cgAP}!,JTTOBme"ʾ\lX)S ?lԘɯ1@d J`z.a_b@х?E"t|[( eX'!*%xyJ*!F?c|wVʰ٠hqVm3?+T͉dk 4W{́YO,̈́TQɩwtnϯ~ڈ7ᕀYpQߓ`8$O1W. ЀF9ayl K;ChVCޕv4 f&KBAAOot |`COGǎziy qL{Îq0Gz}1 %jwʙc;^Q WMnI3D0.|nħI}^3k\pe i𙸸6$"% O?vV!'M*C| I\|skigzcyhKG+M S]Y)mV3N,$}d+v[&h ?:V8E+6֘3J08 ɂ9yHhѼRզޒnA,rңD'ύ\bn =g<$|X5c\a6_g~d# H3 \1ӛNQH <Մ4~b%Τ ˥Bʎյ2RW(&kP/[kUand$DH37eĹ ܏YRkA &QqYŀ-$}Q쥦ddnt#ۨsiq/ibSe;5}|wԸ={VekY1N}R xST"^B0rljn!'j4QIwKHVӘ?ɈZvUPV*3]2 U1σ NCr)5/giBI(p$d?Yi(Rs?COYл; ^_EaMѸqf63h`Ma;h nz;`iJVx"'R,Qu!\f T4I D}\ ;&=b6~B `JtNdb';D鵈e C9RVXPcAݵ,(i/yqګAIJay6y_P'jSVM>n漐TgQiC4@)DŽkH#t+W0R"8 =m~9Х1)@GBŢxV}.Z̙$4d^a[ciZvI>~seN}?^w+إ_W^f3LwcmXvW:<8W-\p-Q5ߊA1֡n~Wzc`}{#{L_Tb-JQpX< s/dX”GQÂ:Ctjb2_:,pdȲx@lcU,qaAч(8 o1ٰn)'/N?A+YY3_FrBpb,h*u&`w*G-W U:C*y t%DҰLf-c^ i3y}?T0ft\A&Ñ+YFKʖ|Qno4crLoN45Ulqpp;4O9P=U](->sv}+C[yzQs08T Jn2"'՜3;``DY]TfEh*f'c1;ʨh u'oTW|̺ח? LL -Xem_$Ū˲'N ׸r=>ׂ3{;?t$L(t)駔B`+y"!)G_qBIõ7 )9O8·=aEn:¾/H˻?̺{0#xx&M =ߢgs6)leUp8G]kn,>%͎l`_BYM~4)LuC84fiO Gn@`o{V, \{󥮡z:-IF`$ t 碒DTn,uo<ȃhoR?|nVp}xNi-c 8 }nY Fw[}MUq)-l3wsCmdOK6yN3C*P ~NJv .S7!l= 8 BQE7;w+`"-C24?woɤ9ť9BmXf?UnWxޏlFo81QES%?y׏ب'P^rJw1JDٕ@>42ս̝۩Sz c#wi̼ɋh9Gu!ZNy<2_p-9 Q(h]IFP\ɐX&61ɗ=i'( 6:wⲆQf _\Y?8l.](A9uF-$8_[!L'V)nч>T0N~Hy2 b%$ӞF/yX9 B@eJ˓N#=vS)s^gg u _4W`aR._rꣴlՐkz7Q8b!>0?e;$ߪ?HXu$QN[=`K`4s` 5n4k"[)̟FѡcٳZWݙ񉽣ߒD}hjb$6ŞqBvI͍J2&wQIe|fLz>U]) J\x+.!z fzRhyOS16Sa3o?hKn+> ?cP1m(mq)4Oah%[n/ΔebHZ`9bݣW  hIJ/}I(B+K@ߓuy>kt /|(e.UYrAH EIa\lFq, aь÷1Z@OJ6VGvqN\ 9 ț@"ygnu])3?woᔸ7逊_"]L#,9leX +q$論gB"`J}$۾A m v|! WVpIv*IhE֬S!JHzuΨ(=q>)~έ.9?Sx`DXI3`ؙ噂Yt⺊(i{WH}P΁^dw/刅0.&d4)h0@$5MK= h0G`n&q[ +ldj mEjsɼnY c%*"1Hxl$mT,:&x(p4hȔi2c>ٯaUԧqpc<fGb.h'6NNL'TI`aG7ioX! smߣ ,7tMRf+w~[RIxڷfr:&j-d Ϟ3sgǙaX1 'NgM*h-}Qي&pΏZnipא쓽"V]lZ KJ53}^gB9Ew;6T _#0 #?̡E89bunAGl*SDu9h#fcB'Fa([]}wUoܝWI9weDU+GdIJO,6$KBjG3a]ft!.!+5qI " Fװ#剴#IKRcJmT>.č]E uӃxl3s{9b*~[]: 2`&CTA *D Y\H?|]e~ yӢ`0%䢕5Q{o-K󆳬4^v!-<F/e:7MwgLm{M"Ŧ[t:ɫuw*Yk$uhU,M6 Cd6'ʊfxcT̨ۂ'Hp>tP6@ݞp3s t]wm{%]tM(j7#RP-Պ!b>t.\5tB.&TTI7qVɩM Ϋ?{I׳kdV,Bp ٭Jn}ndќ{tnlhtj6G9TՖp+A5`,M䊋D2.g徛%"t2 (Yޫ\Ctqs?e'eChQĤy$W^w3JOYͦ=t@DžGd_W!W.|e ½"/_˗Vt=/HjZ)gO'ǐ1L)Z0|j:,_qWX ǝh+͉%J6e'xӤ/J#=.^W3;فщgsi;OЧW~L8{DD)\Ԑ;V^m1urWR:K#a"Bh =AK :lBw^ `&6 Ԇ{QG5[cF~`Ԗ(؈rWe=x*Э :,L!qT,`iKmޢ\TY[b\$A)-, @j-9 -G;ǐ۞ 5feDUli;j-KbU AbQ [ 2)/lx,t틂^\H&W%Zn (p}mhaD*Ǖ'p@v\7tt[2[)Ak}0y; e$xK…۩^%qIEzn*9"G.,ݛ庋|9Jqn_~/Bh0ց.5؞+m/ bGR>U qLttUZ,b žO_娅P=\^^7K`Jgn'jaHb8pgG99*iϰ8I]b6W'zL!$K Zf|$C !Ef[Y]yY{rl'X7Y_>0GWCO;6=2fe6ɝ#N/[Fa3 Q@fWyʹ"d,s4:b,mV2g*X-;}_p*m X#RJLQP55ӆS~qZUIU_@qG;ݗߚFN9y'iGI=UodCZ͝I3֪O|W㒽x!hJe6dq=„qϜ!DN9ZXm),:`^Utj}!MxaZ+M+`*!iBa3 B\Dd}?p3cH3DlsHA#I1E\u (>!G:vUgqꯛJЯujOQ3,M8b0 H81(CHOۈ2X758vF>K~(`X8h 066x\$K۲ .NAMC`6Cwstcf7tيVy)(V3\U0쁙ۥ ĺ89CNN80|ҦQc,|pinvma~cȻe^z;ZD&~ eq%"yo|!Mpwu,IĿ^_FVPJ8 XS̨zߺ8K`jaaq@wgKR4!7jH#'U! blQL߇}o3ħU(rDf8Nc6)_ dYooqfbZ9O%vjTϲOӝ-,˻@–:Bb6>NI;\KltP0 Pv]$3k2n `͋ϙ,Jfl378^UU(FB401QGs}יIFK_PXiǑ:2˛ҮKMߙ\gT3.l,}oٿI`4o>[W0Ŝ",A&эf^Azk'//A 潾ge<Ï˲MlT3֓!6_%?̔{6M]i bֿ8"[C|FG±F _B2+QpςKeST'J,H 79j&;db팽>vJ e3C4m"׿Eg&D&"l :6_"Gުjlr.^\ ꐬ66h'It>L=(Iw+pqfŚs4V6NΥ].-(sP`GIr'6ϖc  +2\2 s=s %1yUCЅC4 ^fGrX{fPp9н-nAB4܍sjAM# p23i^Уƃa|K `97nFwBE6/6濦ѕA1BcnPODy=)arK)_[xwx4uC"ɀAG:SvذAֶÜlHC9Ybc`O2n<9;[7kC꽐-sdXYJ{ۘ)ISVFs{şP#JiPY|7%noY7Sh`^Na"`,Si9Z9(CCv"j0߱?#ĻF7!uF(F_lJ.ډPA[AI 8]ar{V^\\z a=1𫧜+"ˈ7c^1}TTM~T=as&!mGDVLgޫYV` rG 2P|_F_ptUGxrEvtA'y5؀@gC$GfCVG 9)_#tHxUkf~|+ր"ep/QBƆ3[[ d_;X~**w)i7Vu# O']3ns`uAƼ%⺺sӪXa+e(xrl,eFo myM# aWi* Cblh.>Bat`ܩrvW.טZ4 0{mt,//f/3[h̠^,}En-mNo0)t[&&>:BxX&ƷѻGP 1^n g Ch 9SW=.>jbTmDz4,{DGq:иz^n*aMtTY`MLQe_EB|fCzPeAGͤNF_Ff%,eZ,/*2Z=bŃIK4*cqӖC-!xF?mᘜ7ݬIJ'9%@yER9TEa`vά[V)9Ig.6m1?VKJ z(WFПjC{sѬޭdfS}u0+G Z[ CQK#q缋&&I"ㅤ\qݬ:?#ش4Qo,e/)`X3/fFcmsY>{(Džx ũl,}nNTlJj=,?KnԤ3KzAn:F\j` $^gKC.]xf%CdwTQfQ!8ìht"%1nWTCQ aT*! }*y6pce2w`#,XVg"XUhDګ?,L90ZW.ѳQ3,jSZq;Ή#(×*;.I4 (梵@aR^Xk)fh l:/usCe X`:> *X]u|Ƹ+6vmѹr#0bCP䒈Edt16/|>ijgrRهdRѬ82>z)f`[;а=X/nw.5/:*o'Wj°n~㹺C\7l]>#KUka7Wn79XhYۗWpl/$߽ D = Y!.s4ȣ$&IJ6k}WF^.Dgn(r^8g/b;onrfE&&?#jdMo]Fo2( IW_f~?#FϞPHF*?18'@ZI,p-P 2MДgx:13PM9=Mo\.'H8:A߯(ڵ rG{=)ZbU~GKyS tS ͶK}uaRGF*<u."0x|;~̟,e2[O} +I8b8ec ~bV;/zQϵIv }&E.AcbԬn-@~j!1NJ@khH$ bkq[|jD p V1inK?Wѡ*YcHi\8G;;oCGPZnpƌtbGvf!OH`T*9-_7.)ʡej &zhK+qZlֹjI_s*[w*@$&i%>dkL(= Q0+8k~4IsEm }X3E\34Һl!}Jr2> (W\hgd^emI `Fn)%^<ưgl!F~J`’$^GYa/j|i7Qb&QWro5&u0MaN ʰcGa s9l:hu|$G/=Uo̔/GYp@ EK8? }ùKH2ez);qx&Bo#h]e5dW.r}F1mכi?*.wn& sAcd~]0jq2ҏcJ<;gMu Kqj2Ⱦu5hXl9hQ9 +:ŐB"mcEgi-%ɵG5Ie&`uںI(\ܫ~Fyh>(Pd:糇ߛzvswesC/2M3J5N&gVTutԄXd(q{Ie)~c>1:Mb+S ^O>?S@=pHY˨ 7FvߪL+}GUSh⬇}+S]ɸ HY]ӄoH?)%ߎ4]BdQxhe$?ɜo  X9 SkןC)L]e v6_9rU$˻d"!˔G8?!Q~j'N:.EG1KAT2e/vI5'G쁑h. L05K[v @۰ 5L"R tw[]8)츏&cpk)>+QrH)צ;cgQ$#ϢHS\p'a ޶R6,##DmZٛ)VG.=a 2R/Jq,.f_`PhtU T:mdZ.c:8`u{Y(3ÓYe. Kzf-eTյlh!˟u >T FIq:0ESЩwuɔT/-+t=g_tKAng<ߺ_ 3 iȫ*L3amVb̵%rqCtUQCWoJԆIz:B n7OBG㖉Ȱ{8 05\ XTe\VqۖFOb|gjAx}fJ-9C9x@J[YЇx+PX=FE-BVC9L"507cvem0t``J|vY+(OHtw aa l`Ip @ sۂII-p91pdӬu2vP=:h,rzL']*rk1C5֍%m8h!6m:Ls]c `yF\R6%6__ pLix&O]T90gh*1{1}gY1N$3[5 1صEul:p 4-kTt["P'2Cok2iYÿ uA s*KE2Ud 5fX7j5A"-ն(`;I܁̮J>Lގ)WWf #3Ji L^7-TzGD7-<4j9%Ne3F T6y|*Ln?3t|#< #5Dט!h-WVMhWQQnNo}׬{RM w~lf+;]h#cJЋp85Hó C9rt\%$n8=)F`%aɵa|?|~N>t9!?T.5@tوZś۝L M+J`*|+ÙSV6.%k VDFZ魹, ®,Ic>H758ҹ| i[њٜ|^j?R`vC7}%qe0b=*!PF=&Wz5*,¾n5ʝW/m cV뙶3eYH0.ӻbO=g" C;zChG?QƯHc >YcR-} aފf^ 3Eyʿ'! {BRXᗎaMϒAK9S#Ԅ@0=`~A O LP|IT86*b25FkJ[,\V|~ g\+O/rt=(g@[1u{EշB$є?xm9P<@~twHh.~u? 21HS_::YK0yQܢƣ/ֆGya=RMdtnrҫϜ1pP &tm[ɩ\LpW;*r)$V 2-hPHRj4'P?KiRxqe(0w!}nƎzc}A_AS% N8loH_ e΄`f哝h*h4?-G vDqwǒ'0_,l%HB,6w=3Lك^lL#ScīW\LyR=}z1oZ &}gžMR24Fӽ# עJ1IG鰯#ضg(V+y(| (0{B]P't]x3taqik3ZCIyAF}KB% 9cjtYTrVx6_ ϋsZsmXbwT;ěkz^|lBv~M:BŰ2MbOM, 4+7J? Iy;Qz5yrV~RxWÂƕ@o'Q6|LmrEeS`Ob\'̴1F9EKW.l{Ā޶.' Hv%mh'/2ÂYYx9㽜H]}N<{,k[ˆ~  ,s\<#t;1+CajĦ~Pro|w:ҝRrEe 08 [S5q*{!gLF[8f) tRi]4G}*j.}ptϭ3)X䘽s(J^!Uɇ(=x a:GERP&7a6Isco`}_.]$mNGӧT#x/0>y},uS"aI~g?xSN6\؞|c.>i^I< roq)YkQ6 NpNudgەB9:;|!gG% ]!/c]q&]Z:1.ip,7tZ>20E!%Wp>#DqJ=E'; p^| Ҿ c6 aO#' VP? )Ʈ @(A-dUl~d_m8J٪lU?L13^Sj_Yc\8>1bu>W 00 :2]eU?iN./*V/gu-*!g!(ۑrQZhZ(nWdM~((|r:6{QXYst$fF-*_4SvCX{ JKjGхůQr KX |f7HSY)>y{1x(@MFQDdgJV"-+OgB:R&*4]ҝs:]xLzCbGiΕyX}jHvRB&;64w64(AϱAENl*X{MzDRvJDÓT}nFG Дgr,|'ɞyQ݊Vr(_zASD>Gk6tUMZ ;+ h:Hv)Mboz2J*FKP<캃M_(6 vџ;)qu30Ch-LEּ6L.={?kb]^mOY~4t3?xuiJ)T2`uz~ 괳aԅjgy>9AXI mѭ>("6Goӛ閄k$snȎ\ tH70)!mf-}lF:K K󯼀F}4 Qym{d]vǹƄg xYyK}$rbAz8}mbCW'ڞHY߫}Zke fuPʔ|PYGYO9 Z<4[`"Dze{:Yd#zX>$dү$ӊ>{8piuZ@szJ$2V^oה2bzx63FU]q>[O<ا0V^W:*nWv%B$a{5 bgqzхeuj;*e*,4jSFĝaMHxYL]{'8g{AfB5- ~҇/1ns/%oRh !U s3Bv8y`"ՏF݇[kD)`JwoҶ@˼ky O'P ˩񝜪wKݝn!M{e/yqTtM`wY>vR}(0T*Z)R(C=TԢL 5iHl".0pDH@ٹ@^Յ#^PsokE(ARŲ& S§(/>C{it\_]XVuCd=-Dr,=M #y=U˜z E.U=OU+S=zFbK *a8Mjw/_<#dd#YXEDR`lmQQ-gP}LZY"Sj8c{Gtv^KO6n³V 4V>}nkQ%DZm+Y(ځAP]7YM |obO0l~D@eA`;!kBAs.5~÷'\;yuJvT9 / m|aia@#DP{l$٣y@@X:.ng7Xҧvvp9R!嘊Ei W J,$m^o (@q(-\?M.h5.,2 Ӭ eujֿX{שۍF0csp<'K7)VSb|5(::qJ"i>PXXɃ:}h.L` PFe[b_UI-RghQpe^Xk`Ol<(6u 3Tv= ,zXi=穛%.r|ۦo?t[fi)6~8v),A{D\ A}i)-oz&3|Slԡt%BXd1oU>J0KRXaϕ2 T276<Ō1'w [_f~ݠWSIcem@8Q(9&uGMl$.QнS%uy-U ƎC?b:2=%M(ywҾc87P:d kÀoh~R}@@D`*P\9:Mrn*~*Fzm59c'Җ&zL-)HE=Д1Deu;9GG&kr1N$x;` e icR3n9E$Y(f-UUzRj>ѫč(r#=~X@*̩l5x6а XmAY=)Z@sb93ZW=`ƕG( J Ǚ^x&48v/v*f }cmhԧ\ =sА¬uDoXFyWt.1LNBmͩ & ;Ru;xk1?G;Eo;cʣL/hͫRmc^=NJ|9"]K a>MVGϬW]yʅӸ:tr@Dtt 11^O"JZiGm@JqNM,RWmwIO~CF>rҢUwV'R5Mn~u, }p}4&kU`xY(-g`ī= 7^U;0u֜^m4C|α\Kd@DA3ױh`2\vPwh;$!h."CJFbCnv?'C&v^W5=/أQŠ?mӅ- ؔn]Ҟl.F3| 8ܯvQ`&YYHeOir GB>,(D>򇟳YW K(Hqcl($6 7Cƕ&SoT?}j](c`Nf;# hM%zXG4U[`|~'H_GO[J+Nt{I)= > R9警БMa_ZT- 4pTle៸Jr*:[R#V*\)QˏQZ Q UPo+o YDD:*1*xgoLo(caRo< w8@U$$jVMj9pC_|e'4`+ʢKaK mUvW@Q!O?RUc vĄI%vKmxp^q%DXqt&=L/IhOU&f {V_+ H3` yvCH/S?>qPv9%e6~bNHJHCJc 6ruk^d^DA=XlSǸ7'ДhL%/ "N21QT$ޟ7Pf+Kl#9 X ځ߆8)ͬCM1y8E0az6eOG5rbllYZmK WC ~mqSш*:E(YفNux7LtI?_"ݰy~K9 ߔtOPZϼ0O.Sr`f\+/UU5/&=0Kt>ҴDB9=tp<Tg CZձSx1'ӛe@llABJ=K+z(G,FXXjU-O1Jz1W#1_ lU.uCaIt%4^,p&C|v^I͒C V|2#3!eD|zf@39}փ&iu!kͲ}!PH #;2uޱ"ݿL`7-.eMDEh3*t)-JGɡ2mP&6>ǒ>G$UE`#A֑`L8{ IS.ш_Q_%DW:|sD5Cwhf/"?fq¥׹@ #e*k_F[YsٸBL0PsJ) 1i3I=n{s:~sF;b[\zx:Bm$mYЋ#w}я8e2yT=]}УKr/+F/ۊ/s xA{[OՖ{& dپxJJ]vS)5yDñxi7aSj5DÒtJt"Ù9!'9|jW҇ 璵j&R՚~ 1*a(z7^%?[b-S_mv},Zg0q),'+ odyfm=VU sHWs#ov0 G$!GgyUӰXk^4xe )Y~Y!= RGy9-jGN EqF^t*xD0!HHTT7'Z2t%QYGUđh`khO6 _]~_]d+$⥍6/xk!rtx+il$ +Z @wZkc'uvÈ6JK)Pqy/VS4MaiU ϴ~lyi:W )NGNŚ=߂B5I60!ǵP TxB0麟+$CSIb$@N+$9 m^ F43ucf l)*a[ukX',_{K=MNuW Ccz_Vsԭ} wC,K'AtNJ$ EHb_7EKt4 {Xv6c)b9;Dl\k]̢xWҐ/% %={ĦbՋ5O /-s#{u(8֞Z087z#<s"@6k͎+>c|SEٖݛ"g_iNd͹{j7xA6O륗ʅ6x=Y0٩{9B٩d}S~/õ3:k0k2̓ 짠v%8PqB@{-oc9&Pky .- µa~ f{LǝMjJUM)fon;c* u94BO,dp 6j,5/'6=>St Y޼b.8D;i]4Mn'%Py`3nbzix4#PQ 96cEOo mЪ"d(Lb!BJ{&Tc .ʹ[(1 0ݯp$2)Yžٚ \ pա%2OG/s5'L6$z{_-gfKɂ\D1yn!\Ah9$Rәs;U{Pʎ=*6a%džnOJi5+哳\>!@E-H0nږ4JVsnkEC/Op)=.~N?d + U_D,睩C~YHGF+)gby@ԃ掇+r؞//h&wE'[P_}5^eK 4 K%A8Bسm)/&n@2t:9pVXl^PĂs/>wJe&tڦC䟬O޲znTڔ53CL?0ɱ563-Xa>םRY7>bEg$y^܉,zNloDF6D;$qd=xx-i| , i xc;#/t*CFr>A Ӟ3ߚTDfkЧq2V>&I2'΀L.us-0)+YЇ:@mw%f,cE7nwץk-V w(|"08zPni?Q&Ғ IwuL ddsV]* ܂6O 1 ?h K d0u +ߙQicu(oM8 rI?+9)p<7?NB/³* X?Ļ5Aݶ=] d(nMXf/FUԱ·Uk$yL\qu&g=HKmZ HH;m*LB•. XN6e?J8/q0 aqOvLHYX,RrM ǯg< M#^c-gV-bYO|\kD10f%v#Dqc̪} .>8Iu8q:v$TMb&[h&-8Z*r>j^=MR16W08%97+#;Zйh2(5;SƱ#P5~3$>k`cc7bF ?B 'RAX7 XzUZY!wf^?ںA2Uz :eY/A$ΛZOFǝ,\iwH>1  eJ ZYO\Ww~Fy* j"k=͐? &r=Qi}6>/;SVx\IASR< &6@1ӇEwL~ǽwqJ3vҎ[%$:6~y*E?c+MvcDMZ:[?}eᝩ^7=UѾͪ1GvLf)@![2Bk_s;9ƨ@{$*~$H aOn:_2]Ǽ]FaCc@مB=P}Vb 2i+$ABFm@7gF`}m"|6l??viNnZuLU@ U鎉u ~ Gz< S 0j4)nXwP0!( 9cU>-4f+pLw&q+x36w5Eە4YAٺ"i[v1Y?+DjW‰oCާB+H1iojd]1ds\ d\<;ݣˉCt(XkW%Bt' vAITڸ&ݔo|<8Tc/O x8E-G=AL|dh-6a+gS4&5cȲ Aɓ]> V:*C4Qac&+A01fB%5$d+zC$CVbY!H,O$;KWSq2?!<ؒc>+mԘ7[S:aHUMhx)aM]F‰!Mjop,i?(r2"njS9vgoWorLj,lUުi=%e3xv&g )-}+83֗H:rpBF~ j>kn3 fI~qPYFgG݊M)r05-XܚTyxSKt)XBkc1%&=l#c&4~2P2"0%mKт(Vؙ'3S!ixϧ\vW凪0c*\<ȳ(GދզEIHH)'a)c1{HJ {p*rr+ŷEwFIC50U0h^0/0?8O+Ԛ]ɞ|&LزҺ|MhӅ |.!˅y2sE`$Qj&APrz Nu*FR5 S]Ch֊[%͛US&ց'8| Hι;7vTk@T0CzwY6=p|{T[UKH:,h;v;";[k=h/ʊ^ pZGϹmcfE -;MBYipf}izDyN !FkW_mPv"@u*zZw\)9g5xwgLU+p7|}v:~#嚤W=_<Ҧkrl<̀dwӿb:=doG{C.uRXbnƅ -/D`/ɠ&T%ŁXZP<ۈr)"IхQ:={}n)XX֭<90 i1]ԕ^35!m!@^? ޔ4|$pƀrAu׍ 5XRhwλٰ)}~hz1F!)h(Y}/481-''7R!蠷B( C׊(m( P\ur}`aY @.ThTF晨iE%JSNRaS5ДKpϺQ/\.U%$!Jy|/3p̩PlT;Pž=A_#VpM6N Y\fi{#H+TThz U¢\$**.8t; DY_JHR) g?^Z( B:zP࢜ڟRsR5*wM,$vyN"吰CUW9-&hRRo8 x8ꃑ?Er/ḱm :Ň~ n@]n䂚bh!ٲ>/=ԭ-giT`PS0bh<Vl$]; RbMZˑM[eHzPCA٠P}8CLwz}wb𯭴FN~/! qB@3]kT$DyCZuۚ P^$!\Ќ9E#Dl'Yir3jvm/_O@*o}/Kù`f=k9+ ƅCJdFDg'AB!-+v_234n?N誹mXzj,s@@i |؈ &idȪ&^zr/!76. ]faY -ĭyV gWNt2/c by [|*hӉ%kΫκ~.9j dBkgmkX7+n!.du v&8i(u8Cf+z@8`\VxKRI~:ȞH&aW좑e?"yGshXYY\?,2S|*f X`ZS1DPb#TE6;˗dje.6&DJCG6wtﺃň42fS索c\$t9%3 PhFU MQpze(NɶL<OVj%6%07p0֢㆝/#2s/֫4c@Oyi>U|ԏBap=x{ig U%T7*$58hxi]kfN8u8P֤`  A1\V _hZ,U+lZŷ$|YSUr+8wfn({3רzl>׷ky62#*5x'|V w9a.RIr dvˑ$u5; O3*5 Š7\tg5%`yVڵm@0?Pyecwi|C3@^gdOXJV篦1Bj\h҇w{ 5?׾Qݹ]1%\Za SX-KBcKYk[C D3Ac0"ح&0U=VAkQD(>tQ2F=j%T[<iu'efEd0޵fFC j6"9} $>gTO'I炍7@|(`o\B,L2ȶ,uթL_"ʎj=3lQ`C A߫9.O6UPi=M YbDǖ,q=ޒQEDY{wҎEMs '$WR/"= d5G"@ Xz{]=ފԊM遡^q'Bz%@V!FX%o[EpAV7 ݺ0<9xiY԰JuD'XX'x_{ZpƟ )ry|I?'jyL FZXe<,qc3 S@kշL7Â.>p^G9d249O el7"N;Sl뒘#4 jRz"rf>?i '_?w9HScPmVe>%53 q~>%)1ZII`/##!z~U Pqⰲ|6)_dBnL0عr sd̍3_p}3ō{.ݏ|^ўZ\ \l$r}֮!׬ zّ?&>ϗ{0>y5 LA(OLy8Z2+`ɵۀB(Y^1X!wC9GtuL5mD(8g_ߍ5.Ԝ]w Mʅ}R4HP{)eI'/bĕ ޫdB@dHPl7+RHau^FD< ǣ-@[lzbfzWtWؘ9F<`@蝤⼈2uwT<$X)*L 6' [$s_Bgs-%nhh0p5"w%c8 SRis=eLoi>48W7b 6RdQl PEUvu!8boB̍x*J/M f\D4P[Lٮy=d'!+QZe tedk#hU10=Pڇ @r,nوutXHZ ܃b7`^du@3"۔!:?6uV虹kuꌟ3Ea7Ps#x$l.}h'F.̀U>l$# .qE4ٿ{NWPV8;7 b1~(8jDIҮBX:B.]YhT}";>uU]_!j%i0kWhM}8!CQ:`饟g9ol@jEdV_ Ie.qQb5:& lyދ>Y972FDqE{{[Ct.헒cDk3GPoAs]K ¢7XrZ턤wDث~2@N\IU uH;Q{>9=*z3fJrɎ SUu0@GkCjP|:WQZr"7&3hσ.ZuTza%$x2W 7$ƴAq!"=Y6e $sLARHHFXv/'w򺙞6ծhr _O: F G@c0-N!>|ga%P`, þ'ZW#~jDw>5y{g#A:OX3#H_br؋?[ (G]Uk^W Y.6pE3Ih y@8vL 2Q9ؙPl>OapnS츆pŨ0̦6J]{}0m':u?L1rq-PVSc7 {$7|'zf %8fsiGsz̡y|0Fg筟?Gu: 1&X ѿr$DSKZq:4,VCTx\ gz \ @p G8h}Ya:Q/$INV>{C'X*7#oxN(ye$IqtF3H,\vB@s̨2"ΰ?U6V~D _4jgBIšڌMap 0zW`~ʠ, MYJQCa~jJc wM4 aDN:Dc%dtBj^D>wM?f#ԊD!6/C+>G  fBJ~Wuq%OtwaP!_@_2@VkJGM]k9+[W<{n&64vJ3}NC_,!/ƩWf#,$U|@s5@󎌪agv;Tjh><4NkM5b^]Mꁘ9r\3r1S8}#.mw-ڤDfϯ͓e<-CzZcK~~޳bqLW IQB2SPV%nݺ֛"a%ue ByV)+'HC ?]y엿1$Am8qr)LG;짐z⛡FKhˆrgg/vӖV>ѷ>~mS4m5)| Roc6yN?@d/:ER'ai}o]4awYL㰴Ȉ{-YF[RW˥/`Qu8+$V^ⳏjXA֪=R~ 3x&+p-Lr5OqBnׄF@L1+̪DM`Y87Y !bN^Uh:~jse?%@3DP; snL>?錳If"nv7Ytkߵ)i:?AxXf൷7- QU/4fP|Dm !:8"AJ-ם O ⷣ2{ (\;U50[="0chf@Ш5d6he"-8`&VqvV}T@c_2Hy"t5/m)z6̗uIu* ^ (~S,~,՟-IΖ草XJFL$`Cן4obݰ=eIۦzq}U!{/ƧOq!/ ҃alCM1rN.fC˦7RoPP8#ѯ]`}Њ>&Mz_;̘fΟrgjHPhRN |Oi`F5JSfgyqi[.PAa TԦ iLU\qBs֢"&@1V ߒ rI2DYvoD3K Ğ$5=VPIEY'޵8:i6_VKD|P!SVg2lmu$Y[n` 2 *Mz,Gk]ƶ*L/0`.D0MSNOYD+sg1P٨j;4\l\ȫq"XC[K`黏SJ&-rnU|Bc9oDS>f@kVą*Cyv#w>|Sb+9`vH#Hy1C2+/4yNE:kRio1Fq:$(8fVGPwcc$)Kj)٭)#RC npBg啫4$q;yp} s=c5:y[ #[(۝nx`?c$tn6GE/&PZIc}Z˓ǟZ[ qq3 B>jٶrV=5t ?Wa}/s0B}aeՠn)$Z) z‹2K=D&կȬYč e!FLV - {eɉ30@&ا~,|-޷J}MB4IzRWHʋ܏_N]tANIp~"G2fb2_QӸ0?i[3+6S&2t! 7~}(;+2^/#/bjΧpUմbbYn7v O-|jCIA"bdcZ+:(OCa+g11R.u/]uì+.I־oeG{4妣1BR1unZO֓=)݇u\Dozl޾zO z.c0Og򸘿A-#N&WYÖG #gy5CiGL~ ^"=hZכ elg' W1.q䨴K-?ojd/AV21Y;%iՀÏqk,8%K`N~(@k$Do#2 ƬEOr~bo]Y,* $ROSç8p$ {ڡT_cJy$G,׳MG#FCVAc7sdP,֨8*tX<.B2jS4[4Jd/X'&9}4c5Nll:>`C&S Ra矢Vyn'&F `#Îur_TI3$ !Fl,2m_H\\T7gZZjQyd;H|T2A}WZ 4cAٙ :y+pr%I?(ڂIG9Mc2Or,PCa5xY(,C>ӐJk&2JP63EԬ,k>M7p@3H *㛋U&$UTܐ5^j~jHv/LkºT &O~:TZ?<*'zńN#39_w%+;S#Ek׻\[N:[i/ٚ|-udc^;1vGU=yi1lc{:BϪ/ 6DZkTg2:'%2tۍҡ]Uj@V{k'7('ZwOb#/;:w[˰ zZ'$طJӶXroz04΋cf*"{5| m}`}ǜrCᔴ0)Bʲ$OӴMcXus7NDkj :ys,9$.A%Y$_@$LWev +UE%coWsd^;a ?!qo9X~6v'c6PHQ]S+VϿO\@QoM'l&s̒Ӟ6S0!Nǹ#*fɏVޭ/=NW2N7]PCLzO`{6jEgƪ K8׊5xutwv/OjBP(b,oh*0Iah3@aY٢gK&ݓsVz!O:>📮U8Is@F?!!nDz F(PEۏAרfw{ȏHג hphb ғ6}́ $L:fieAd'19H@kQA|)~SquMb !>gdMXϭ0X"e-(_,&,6 PhUcʒpԔ.9F#׊^'x->#=i|#GW[vP /\ ^kT*Tt֪#Mkt7ZQߢ^RRpJ0Ram'(u9iQ!$k#24vs]Od#Xb߻,Z/PvWDxv:(K' j8s;¦p9Rc$/z{|J` [4ܯB5k>gcRE(G Aq{aih-2>{ Z`1|4rؤ6G l"M,5@ye4ć{6i-X;zǑ#Ш@"U{2B1[Q}8P1P$HVwP +6bHISw@ O6u̾"g4` k%[xb$/]B"Vmn5eapTypd8"\eƒh,-`p; $ڂKpҔnz TigL=Kxܩ&&ɧ˝X^0(qY32 !'fuڄ @io^E"%bŗaxp2vA6js;枵^%X~V ȱ#l0`e$.iX1kt>M2_+DJXXO1>񼿓*FCrjD71-ĐSڒH#zVpf9GUsna-!H%B|s's,aCe?NBxΐb J-Z̎ؑ nshIJn.Af"Xcku9g61ݥ (uȞvLV*3DjXh7ud!7*} 2ΪxA >mGC]*kmP|ߜUCOiCzO`nbyO}UV}z~ƗаwlևJZmt/?=uFGscUpv1^NÒK{.'dhT`e~TPArАrT29ƭ ZZȅ'H@Hf(Lj!y[@BXYh =A˜3Up:j z)DYķi(l Si5\?1dµG(3rH͢"c)|7y/q|GV[yiL00̲uCi+OWӺi?: ԦFaQA)2 `"}O.Lf*]  T̃1,aM:J^?v j(Avy9Q\:|=2.|O=[<%c?̊H'cٛMw%yN3?G +@ǷƢ#UjU c#gV]&;譩W$g޽PDu6WZ܁ wz4RUK7e.Q]qB)AZ9SKm_ZIfhOр5J}j34=o~{L*.h n>UzdA`WV/Ȼ`=PYhN$]zW)oZݙP-+6Y,{0L<-rڿV P1T؂9qᆝ(eXݓ`:am(Zy4pvb-GvBIk+(\{kJI|h,b ec 9k K|Km@j}i8rt'S6 0/().5d>Ҳ;ⲱg'f,O؋jw~;ҝ,'L\z(3cn)oĨod0V$[1!D" ;LfӚ:Xlje$Avm;#Wѳ!O~c.\{zqe?tJ $;-9|-HG̮ϗG{*))W,%,vzﺻ/#h/%!B{c43Nʔhi+/gLGR(Agsm{%]3-Wm +X!n 1@ӹ6V %ڣo3#<8O_긆=cU¥Y;7|afdSKHjMR+4aTrP̿?3~4uČS1di#@R95/k\6WB$-mr>5OvFIZ}~ 3LB$eZ3R |vb_m Jbb ƛdpP!P ':,#)9VXo AY&sqi6)K W%dWWs qJX)tǮ]<#d˲ƹOT20ޑ[ehkX6b)Oag!K7!2{so;]ōR KJ /a_ܟ҈s'}vE* 1 *ûekT_-ԨpH/{H!ȣݷ`aeo)N42`A4ʏq줡| 6CaA'r]3( ']@H@3k^~\O9&cl]N=gEٗ!K[ZOF蠥iZyc6ZmϮBN(AP%KR/Tì d<%|o`F~(QcviS'o,f&I% soLp`Cb;: 3{r P)%E\tSjǙ{]S*GJ,7?ÌN-Bc% ~̪ĦF\vdC SݖRQ}kߙkw6T E:ZIZs{x֤xlko''m,5)ܰ ag)DŽ}`U n *[g)CLC_ jWTh=e}MNJV;ڷ "a:pwQD4R?**:V}s`3!+^+s _=-j QЈ鞻[H1_3;TOO{GNHAp I?,ńf؂OgDr]We,v24v}S-jwuvfwbzJ7I kY8(]@M@>]ɺdm;?mMյ u!cQy0JWE8k;qXo{:dhB}}%f+&ia`"Ww=>e(-24*f|IV"+.YZIܒ. ."yRv%Ov 6R|Nh0N>T8ae7Vi*x[pқL5![CZ,53DAT DqFãQ "_vF^B,HLJ-f+͊+MQ*Bd8/cS)`ɧI:a/Wv M\+漪j\pabUt cMj;Q=',%Ak2[L|nN*УɧVRh` Ӕ;t@Q>ڌ`'7V!da'wlµQd1i@El%7{trf7-^|4'" fW`rIKG!Ę!Iv(^zd$t89W. (5xp._E!+kZlD'-MK5!xۯ& 1٦*Ht>+Z˵8ILl-.4~Ɋ V/Z3̴bNJrLPea5 R\׭*|ЉW!"z貅XqNJS[ P=@XHs J2gd  =n l x]_ N|͹c*Jf'|( K{12€Q%"4=gV M6Q&AfzrץSbq6Жy@PwYꆖL_&R[ Ju$qBmF,0LnAV\|[Y:cd,c{@3 g`QFd C9fR)1D=p tl9,^iAOVM-ػ0e'ڕ&.N3uluۚ⃑ݠv&ucCTyl8>"xD`lcePUI`Kk9Kg`&<¡~u~A!f'@JH K _h= e@* 3(ʢ!.gVPI$jDVxv0 u0(`ќWY+^ fԠP=8JTAB*dËB<1ܸcV D6"Kڥh }+|[4!&-/ @t7~] /S`~p,Ѣyj7RFbTHxV7_?nWv [}V-² Mާ8?Vh\H4S'ꍙW|᪭CʼnE?Ǐyᑬs觯n~}i@#o"l.x<CPr.)3 !!Z6%* D4d[D?.ˍnIR3r!ߴ:n1SHRbѩ*jy /g8;n QĹ?YgN2'u[{|MܔPhf:h+N2 PghuFBԙ1JR&3˒5R{5'Z4H5nw#& 0c`{g(zI*d .;+r>-4-pr_$*i6IMlnǠ~foGߔ/+4y=J؈ ۔/RBSHlD*q[4=W&t~[!-Ub{=536x6f5GO鑂#jtNcL?$!]T}e-x%{ԲWJBʂ= wA& {iAucZ?汘crwprLLjkD7-0Ssv!}JW{gsۙe$ͳˌō|b><5bB)0ަZ\֢E&Y*o" Kn&92R :y`dc(:Fh ـ:k"X'z=-g71~jg^:i!6], @<ojJ:d~IK+O(ie]]N]\րSoLy;f(NY4͡˟E!twFմg`XtalVc.ꥅȭ܅>0I lE*B)֮4*~$5S/[oI}M͔Ϫ; J;>F gƎ ˒O=s # =W ^qrr#_5 2Eq,_Av[T¾FIWA:}HQ+X-:(l67Ҫd"ֶƺɬcVߘ:B-<_A1bIu;;lpogX+Wy%ؙD4fHN~e#]맭#l>&B&/K&b G۸ Dfln7in Cg\AtxƒIYLp@w SL#YMuTlmM5o㦨'Kp8`(R #/38zT6+lIc|5daA~;|-SV4zc6TokLhWY8㚎qV6>XnHR` /cⲷ+ڋn_!Kh{OE%ĺ.R5eQ $~Gj&9e֨/]}z˕s.Ѐ5["1t䒌p-" bP XA4E:Gz fyx(&ZMSbHm~^5y4m4X& wO8lw)rsrܕB2B8h#π?F5 mHusv&aIr&0gbSJ45 9m`y av27$BHɿ&On1|Q:oL{MKU8V`ӆ W*Ɩa6' ~SNbW8`2\Zc2ApA%2)ͩb.~} 2l,rϙ@7KJ(lWk-8*٧%a|mӲ8A?G򝲨eaK#h1f' KZv4Up1/8vK-Q>KZ#i-u|:Ea:wBz} ?W_o2B3l=KC@ISˆC`m+(213~:_O鐢_'~=9R6|=u¼JŮy"r҅XET>M^Sly ~C wIH ܿ :S ocH+O+]potoW>}O]Vw;*;6.XdK͏b8&Txv *w feM=TwZ-[rLDbr kf USq_ ۯs7 <虱!.Eh,!Y#k,M[[&A`rwcqo{tZ|Bh>̖"Ő?%tfɼMG{=hcJ"FFe}t(H[">.:Uuna qMƌ8ʹխJpN=PЊX=8 Gr]k>.$<B^Ks7okю&#G&u*lsV88*''ǧ?k<,bL #Ǟ<#6z ya~&/\s;z d)zN-LOqlڥ3J~f 7MIkvًZ2(t2QOu҇S.2VF6ȷ|ݭP8+vHLw1(Q6 3[H/! O gp8{喅$_soouK~$~nωJ:t\ q.`K||Qoc}+<'0^[oUj&/0yzz6T 𫽳,u6nL9|݊]äIV]): S_TzΨֲop6SO#K f}+M={fy^zS1ݜkE8.:>4*;7)rG9F.J+2 , H-tfܲF^+0hVm{-Gk;:HB& )7+O?%ue^S13F%͢t]!zp9`d0~( @G,6w1~b a_z@eBp9͕iFA=\l&~DV0(⹵/*'\7jبwhﮞa;1CM ;L!~Q;}+(q-\#Ǟ 5n/5=2NT,js_eVh-ξd1}Sc%+|w h h^_3-?e~aIpw8EoG_t-D䉹9qvaw3)&i[ b_0gnpt}O wb4pz|py ]fO 8pBh&wK A .:sB8ڮ 7MVʵ-ih$FwqYzMlO*[d!"pbe-f/u"mű"ӳr yR[}XJ-2ۦN:JunOkA'u<ļFd]M: SvdlAeN:p3~kV[|u-i5U/|q>9: 걄5ZwaJ VL8't;!h~!k7aMbu ~ێ3@A2GYx D~9ɀ;sZay@ E`q@0zW҅p)~}pDJ =1;ߥ6I4s3u}x7xQ!;SϟΓ"is 쁂7rXQ߃(jT6@ex^P_tN>a7~ׁ_oU!jz *Maxf47b|Cf5$h6OFWԴTM2`]OPD 5aCM˾/ד$u,F\P9l|i=Ru Xn|ɢ|1;: HcWdfU돵AIS{8Ba'cg 9I C~ ax߼]/?581yXKt<}3Pm]|!m PFneYiG&b/pz 0`gzDLUoұ۵V|Mx9mm~ZwԬ¦Br=HD:!SF`%4$+F ] CO6)Bbؚ@ϾyX4)>e7g+/C;fx󓘙%*Ul9OKmb2C*AHhxtR=i60Ge/ !⾔@@ `vH>aAqHl7֔VcX2vO`YRx re"&"krU1/Wע$+0C*<&*S eQeNOqtYupߐR-zi-eaQc5ԃ61M}k+eu)>B P~cb{Va"|?TwO'w"럲UÆ>~rE$̽Hʵy\YfuyQ6Hv͙_6γ|4LlyGDRΘp$CX/b­"Ǧ?>Loi&SyF~5IOa턚6I̼0a4x ** ~%13pC'o Aq(a#nw"*؆[䎋 JH9x@;#wX V^~#裛0ZM1ꣾCvQϒ ס҇!EqKhrBw#~[oAͦ{PfH7 gWh w@xd.>u Y^kmyxK/?["s 8ۄ7,jR[2K6{N7s|q. 7&Zl퀰 Yr8zvVCǥ4*XNf>|(1;^T{ۇs Inn25\q>I% 4S`/aNeڽf][4P ݻ6Fz溴 ԟKCN̘\2`v0}WJCVޙ.N/zQZưV' TQ&|[=ΏڛIb^$(xcuZp >LmRSK8C=;sɕq>TԧX`NS 2Udns%s{~\{Cnpqf EV!US̛X_ lS{6._¨IВ(63{njsisoqC~9>b0e5ؙW"ee~%Y,{ f 2쯄g=hk 2eSj#U5־U/l>{*`=[7 u;vg!74T;<. B> ԊKt5v~C28:w_\Uը $䍔kZW' -EWXh8dwU\{ зS 9KSW1BHs'ՂN)BPe?I_ >KO&q-nP&ډl8LWR"A)L:ufp㈆hisA];|tD˝γ0p*b5>XQtz 7YT C7cJ`hO9a\0r5gaŪ{i7A{amRe_;w\#94kd#%_7ڬ$pWD886Rw,܋I}3!595d߬Y:M@2*`OI@t TPa^iv # c1 ðb5Um7j$3tWd)Җ/LG dpmǴEmO֘TuqKbd|D0Kӱa5Lt!*`a;©W ywDmLFB[.<ġE f ^|ȃnMP"ǘ7}DmHEioM92̊9p秊`R *!k± -.EP :9We톙qE ʒ`/f'z&Gr;Zm\'&qX;y_:w~hl89A$juhN`)o3ٳ5\h[ǙkhT8+@Ļr[5c0\Tfb]*4c%2_gUt ^ n}Dd~ X;}wFn`a_a^Vk0-?\P)w_kڊJ1;QyS@)Qj_v-8%i2C<9ͩӀBQk0v `Tuc?Og[7uBasfY{N!zE^"[x\_63H$L2+ ?+XP% K7Ĥw!@F/7F ʻRij ՒhܠUL q b/FWx. 0jqsE-El%z]wQB&]6NЌ<`,,9vMrO^̀S;n+ըCYO)K\hEC^!H~6!$lLMtvcPhg'@C]a @NV:/;hT2_7RB`Iܖ#(p9 9-W\6IkN_naEk4\M!05jDf8<̽"%^7=Ll"/SN-"[fQrqGUÍq ~⟎(c z)u`-C &!I9ٓ`5a b$dhdQ*]dOO`@nLA"w/-X$uޭPAg&sYjW)ssbJw@dVs ۀ&rv*q;w7܄ݨxH/)NFD8 ڣv Ht= ?yʴZtc{]i[)W0y/p& ^OC!wwň#Gx#q@)DZpX0\YWS_icpcRl'K9.`}9*WĿL5vuad}!۞ݞh&Zk/ cqwXUTcCΝhԅ9i£Bh瘋L輜LtVAEƷ00$Tj:~>=&IOc^yXcPIĝ[;LYWؓLugBoY{IfjX Poq#kOe2gorr 맃tNQeƞ gp(y~HIT wűY?,Q಄rIՀ*P>LєFe`Yc#3Q<=Iܸ,*Ăqȏn)y~TưH܅ӬLS97^WxB#m˓6a'=]sHаtn7MF1x?-stg/3uEO`TADžժ{%UK6cR.P7v^ }ȱ輩Ϊ~vvjh}lw-ePSʖhDDhk%cUaS >nal[0EE. ,)ݵ _@LEIO>+jw,Wyְ6J+#x {esz9L|ɹyQ]> \I }0?+F,\6~ ~ MA3`JSLܯ)A n% 5Xߤq~AsۮН[׍Ul\Ks {iB; '_K? )+9Q;"X'/hf<ۭ"ĠppmO֎' l.t r3,q0IyU/!'v`*|mV;`0 ̓QEIBf,Elj{}+luB3h“J 9'qFД7>nRo$A>5k1Ĺwf=[L]xj9ݹ5ME+H^ Gyfξ{MNN>=F*(N:P $l0̛DC {8(|P%Fܶ|yY#Zęn-zZY 9&}͸-rƳ)pO J)6oQӧ6c7 v ݙx ' R-x$.Wn\d:!X:g@||4U6 3'QneT+xcN;`oLK1u`x@3| 95Nkꮶ_]Uaw '_r1<7+ TUoFhDﳌzJ:WHqRh. EohQZaafUgi4iI%o{!bף:Uq 6[}<(I71sÓԫ9GEs6*JbMDR:.j<_b,<#p8»O\?")<.i=yt`'9r]W6soZuW5N'C3F{#DTpnYQnLȉιF63zu+Gٟ,,FXH(a?POC°o0O >X?1A#(Ͷ~*;gy*-M\]KuD|ٯIP_h_.}9/ZX2lC8U )OC g7q(hH=$##KS=*k]8}µ8=C Q2OFv׊b^jsnP;n pL9Sm)  U5CzN X5J\f fb["B``pqVQ|9-9aL4,7b%DL2(̘[ytc0R19.(L1Af!e/IV+u [Ū޻aj"_M[2` F/= &=leG'˽fq.ZF_n{VBKC]~b6 GS 6q]j#yO8ũrɻ1jQ,Gk" ) \C#RuȑnWFa1'A^# I5x.E|C%H nȩ(P=&i&Ub;i}fHԯ1PM(]&󓢱W/.}tXz!" V{cUԙUxKc JyΡ*7 7dݻVbdq5Yԏ%[Dc-,I¹Ͷwt2?hU 0jaE hmesNbZ4]M=֖6'FUvh, O?l)ݥ{^lYb؃%7 Ru9*$J%WMȽj>J…gG;/WF(> T[Y݊D(:b45!YPgX}pn7`D:|cVys8)= g:1['dUz[ s\]\Ha9G{9X!EmYx,3x/trEG/zK?67KC@-1`HXŢJ _Kvad*Tay!VLw,>hX!X%7GC{}9dlGǹ)Gz MfPeڧQ4L/2ϲ55pU#<ЉgFa}9 a~f߻_1PF7;.hX*CΔ$245ZcU+LV5pC7U,U;9ٴ^PJ|lgi8*WVx#S&OZ2rM=.qI.sS Ko~2{ߞt S7lnS&jQJ%_cVI._J )xഈ-;(W~s]ڕkӉ`g1tFCYh^IVj{6 R#L~4aFLt$X5\D+C ,ǧuOG8bU!t[ QqH*ޯS[b Lмny e` Ԁ챒ȹ *lD}eg)"%NY&R}=8,f Ti8w2ylI\2{o:HY dQ߆'G񹬺fghlFAiqN;[ftiXW^27j&۫6ޱ\(Vcst3<i<]G O$%* ؈ kd<*c۹-:~|DZ-*lVĞBخDQLiV@x?U1gkﰗؾy" n%8q ~$E:ZGovA+1ThyA $*1aU:V߁MM>0['l.AfU H_ |YIWpϫpFCb.:GPU3^h~ȖԖٜ^8ͬ : _'ӷZK*tE\-""MxZGS8w* 7* ^! zb[[DI{S HV 7zB>mBT=_Q֬7:O WML p'%f))sjdZ <VvLKR̮]kTu ?5d(؝-׻Q6Vz{yiTc`.Qsj+k H 8S?8Lg^q+OUF k&̇@F/(]_La-\/ڱ_Bn 4͕.ʭNVM}SP ]E#_= |6+ar" S/!qjۡ=$:'}CGZ8n3?8'+sgNS"<]OOT8Ѩ,U6܄ͦ &4^B9XNL{ t uՖpڝ9]ۑ˨$^`V_'ץe{V1:#&m,l_Nf$9Ti]XӉiOEOȵD,]\&IAV\ %ߟx&hEp\pb*x$J5h}SCTbMJiF_f\@c1J?,8gG:,ۚdakP`S͊qBKTes,+p[5 y_-$gom<[]R){1'MOB qǦ 31vr9wYh&FG6`IhxH5hytbpN~͓k<ղ8вUBw[q@lb?QNrzK0x5[ ;Z(֗ݽpDoJa_E5,&Hhު>ΑGU|ZyxrCTFR=rG.&on'#Q1Cݳ>cާZȕ vIavt.9Gf1/:(p<A+Gf fdI D͎4&DCTiAA!BsUdr}#?Hl̉a Y?PD< 9#|Te AR7vŔ9xD'LBC*T%'n*h<ݠA昢djÕɾAWx ''xRV5#[[/$\y; |<~yƒ%#2niM;g.uѿOak6ܽ%`V~AxLOvK#3+55mHޑC%5ϪVʠQ%'=* B)oփH=3K7]o@En 'rHZϽ@0?2lZYmאl_DWRr g=ۣ:fB+7 '4e}GĬ\d1 h{9|QN Й`I?uZw+iKfyZ$@>fL(г1bX(+x i:ϳ tZ\3˽J:\ }rͻ˜o_eifڼkwgGwnF[wb)$S=1Nl=O DM'BbAȖ MNx3֋t.(}H}2q"J:;(+|`96/ mSyJ okO5yĺmi *[ ¾{$Õ"XxM&3cZD- OS)^JoڥE CVfB!jpcW+SQ2~V;S3/dlVHEacHYEi$d9{dz0W1ڲV^Hs7#:L;~GQ$`8Y9U̠Ѕ#d&|ZGlkURSk!çF:PL">e]IƏچ'~*tw[}:/c5fS(s_ME{K }ᏣS¦}}Pk}T/bkJhv1EFV,un. _hj=xIFL)m ߠp1`,>:Pm,-qBK4MS%$vMPYlR0r[;J]Pd]D.R jXF#2v~E=n3mDOwc:&+P-;^b!2#iȣ`Pw!imM@ xx|[;qç5}\͹|(Z jbֳ} J?aQ͕VZNl47*w|~54\9za9^@.nM űCHl07 QfOoAcg|$[[m#=7WeƠw ?J8Rf/uxfvE\7È4]m~܁]cTQ/-wфz8]g.ꜩ~sTtWrkv3a`'V/w+Y^{3Şg.!nFچTtax(===9qg[_i`(*+ 9y^sbmfC <]<uƝcgÞ{}g7UiFMY4$5a:Z\\aNS<]p߁LJ諼-9幔Nkn]XV:UEl$0&:Io G,23%wiܪj)] x&]gh&;j#9Bm0I8 fKFB$9%"4 y2:cT z&mflGGJXRJד  ť~N 4_f,lTx1OGd n/wî ~?_ݢk<'Rc Gb;ha陪(\KVl/uaXO5[O, ÷URjE2Hd"ܜ5v"DŽlmn%; g䁛SIxËLPdϛy [-)`D\ky+ T! Sv'JbRv8A23|lEULPяjޤiI؜JD]GڑTb1+׀f|/buVv]5M B015S>pq+;xX_A)h2 jU0FșplFٽC '͖p}BZ1H ORDIJ醍#P'~ U-ȐXPPBxrL)U(ϩ~ J>WRŒ݄6YewSRKFkPI(puIi|)?fqۯ 哸]+x P MLŲ-]3[.Ā^δ|]j~eRE*3eZ[H,`#WRd"!ov7 䳯'd]b. R1Y" 78if';y.tNp4Sa2 O($+O@0=½F53Mi[#p*Rbt_ZO_ѽp^kh(2%SH6%.?E:g}%!Dˢ`Q)k`KF(F8/8èZH}8cNJ iF} -6<$?J'-9xGXQ?M{&PC-{CeClIGU׌JAvLL隖ӭ}j{3SF~DlyN6&jDx"z_Ҏm`,9s&Zᨏ1wg`;V 3Eػ}:.<+}î!0H?juz/V8%L)94u4K^EhԜ\ڟ8QHR (x.4YfÄ_Rn>mqWЏQ{,)eXih'b-4%qJٍw保^,c(ߋ@z]EuV`zȗ[iP{큃5Ui|bD h:G6F\FR%Y:> z >Hvh#$1"̀e߅ nB0G\*amzx;-Q 7T,Kkq4fYeS*g6Dji31(3+@exBWi2u%in) ʤlt{/gBt]) $x`kr֨Jy#X,1T0x@?Ե|Xfa,:uU[kP8w$ŏe "jS ; 0+LX/=MǵX{ B97{D-.i) D`}MfX;Lh>ϟ&_e<0 |K3PM1X__L\ k TQByk˓x.x:&Ybt!>@ ̷C8mW4053z?ņQ1>s(Wۦq@,gCY;ٰ{SwgcѿFvr>n>;_@u7 -2Y/m>>*ȐT7t e730OY!p]'{h0Ïz#'@ SH%mp:}1g^K 6~.2({WTud3 7 ;IȨ6 h N9Λ.`&B3};Kohx ~B!IYЬ(جg$YVkr*z,i'ȩ\l}k˚ ƨ$~uh;=soU<ѻ6umbŔ|3r!Q!ʈ-]>!4FrDcz,}H ƒ/WbP67+ۊ#T,? qO63zYE'[cղE/>;FU7>F +P䪎:ȼ+= bGh)@fFPs(Di O1q"Pm~Jd$w'3F)<(9or?>%bhQ j$4DɜwK睒ru /(=eChf>E.lPE"Qθ>m]! o)f ţ`-<|vZRӯ]2zկav2klqꀎ+]6oꇵҠ~eRRZD/ dU[{ 7N[}GM[nG[̎Q77XG.c͔#c[J62462{-Y (ë"$MX &7?t%g3CDz:"6۵^BdO(Ro:CTRœd-[B}mQS.)ƕoFRfMj**oGI+&WIK[e 8_Cm./w]Jzy^7jM>9D"u+L@Luc>3Xտwn &e\WE;5 CK S[}Yq_!r*J~LA -0]"95,θÔgVǁ5sp)Nvw/F.n;%,#P ESai^7UfַzhC 1:L?T,eCE*by})(o-xFwR'fHBr*d@HPeA)0RU4WYyg܇Ŕk9nWr1*<3pAP=F MU2d-; ]X1M^.Ϧ ^Kc"; ^z۪@쪽Z0H0ULׅĶTp@8Ϩ>'5&x.FLL<wk(RhNqYjZ=Y04Bނޝov3dBm%lxE"5 cg&4dPQ$'$o/ +؏1Ll$\$hb#W- - [B(#.zсk(ZQѯ PS NŬ!;ro>IXT1|^-0K+"Ae{n|$ˆxa@ʛi91)̻ &I*c͢(A CsXk{lL$*̨xtEWяߪ,v‹JDI 4)0/hZ"F]ttZwL<"!+y-o\sL9pߺО`Ȥ\* K$jx*"ù5j@npH/C]*55FO+̔W BtmD^m,v:v6ghhuvcK\=~yjˬ(Jѥ/VߔޥZ#0?&ju_>b?z8FܩwHr%Be~{iyTMmPw$A^6LB*]sy0Zʘu`HTH+76bEe oSz\+A&p*YH*b_:dsW!)3A|XOh!KY;WK%vcꀢ8I l01~be^D#L=q^uYF}MjB ײBIu`GA%0wBFkwt |SOuǰM+tPlYUI5f쌑M'Z{PV4\EF@jAxYTTv7 GvJQ晣=9+矇V0UJ&1]F6lv H9Gv!6iYIɑؼXjg\ǼhbhIDbįj5/9>3::pg< Å) tv.Lк:X9EHt2{-a3@18(2&H?;Zm4Ng,ߴ@Mƣ ƑM.*$"uV@+f;׵YgoVV&5f)DeuM1bGxY ǽOLu޾y(S@ Ѫ`oc,<="2^̅>BmS hHd )joM3`dˆF.cg߾/~a1)aM,ve)OݔU' G_W/4Gqt$ddlKpl(0W$zq BB,\Yaanv=@҃w~άT2!x  4MoO Ӣ'A '3kdZDBf}w⨑ #AZ\l!]#`HL5 %ę Ux HF_/)`%w<T:O/AZ'UajyuWv́;# ɻB׾y[8@(;;HbvHA0.ty]c]̣S Y>EUc^zԃKmu; Y56zSy:;k17:r{%X)F=! ߪm]A}{A($jG&2L6nn7F2UOFoXGZĕVOSRu9^K5kO-rExjdb#8q#I-Sj^|OqotPNx/h_x>@VUKcDdznpGYb)s8RFj❉vZyy ; $%~]'aM2:=rķ[m {fRy}lu#f$Zs]V{8GR 5esIi}٦Y3^W eÝNPA[>%;5յnTE *YGcװz0 shRŻ\Kbv@dW\`/X7_aUy_{\c̠f:,@tgG5:~fN_`0 b $Uq'28ۚ^v+)ďZuauv =r7ufnN*Y#2Yso@K'upԳ1խuh"Cs_?ݶh`A^XLHh)% =7ru ;rڎ]r W 6AOBZvｨ3 vԏ{x=ݑ|%2~hx(Gm9N n9*FSdBc3@.n *X:{솫 mп8bZS 㜑U,9.Zx<6Iމ|&@%kd41N?]:~}vsŶ$0spנ_sM h;3 dw< \gm=K$([TȪ 04:)6ɖj\Eǒx11<( ?@CRіw<;]8$YW=4ZV.9bwߖ! y`5nAZ9rbr%BG&%Kɰ9> fw+fpB:?Pp}IאR2J:x4~rq:0vl}MM0&9q.APX{s? o9ָɁsaLd*=4ZrO ܯf$%:BxON )r$۹+٠H/R+}< J+[u7RHCq rώ.{.ȋz.|1m 0`V3V[%- IͰm z);5;5Y>YHrvd%qbvtiChcZ<) p@)&{t *_'Fv%[ ."mWvfg ,OA%Dn4V֦Oiwaݳq_0pP.ĭ$;{/;0Bo}k)ɲ,KeE {MNNNOgΏ3H)O"nJZHA&okPɧEMJbo%}Y*X)͔,"5Γyr Qjr1_)K_.C5ڊIPĺ"V=PT(>Tt =H [,x<mjVq>"/,*Z_D7Rl$F] ԊF苴!uv##.شkkՑc R].]}R[Vbܿ!{n_t6h=dm8Y, QS[:3b=h_.wK'qe rs R4MX]'UۓZ~AAwaOn%Hң*q{/tt7ư&t)fH=-GHp]ڠl+(ovTV9BMY6d$~+TA9齿wvYlTKxosMxd咆xoP;}Sqҵ :_ԣ\볶[qZ}Sp[3uyJ Ｆh%!2sBݱD6CJvv4[rF.J -xz32>E<n=А7A+ -r6]5?@z]  50!$+a!b U4m'j.GË HXŘ) sqȾ+-X>3WnQv&|԰.kRʐq{p'P@}'pG M!j-sX\$yCQ"G|%o&5j\I՜EZvϙٍF hUjc0ls}žB!1,MG:!BLb!tu=:m]22Ʀ}$ٺxKFSB:{ /_N$8gl52Z|I:dM9m<5;}G"ty˙s,YNiJ[T-D5o8S`O*œ˲I"N젳`fMaF) uv,uէ>7xN|IcAc;p&@w78, Lw3=w TXQ$6Vo͘.-_S\𬾟s5C1'7Vd"nUt6(ᯕ ZΞcv"҅FV l !n 9JD'XYL0. 4YzD-rIOrkJvOF&? kPX,<u(;Z9I[ЕbeB$~¾Z3A_֪z|]-EJ i=N)ˀ"i[YsY+ǎ}OMa l[ёnyVzfq|ڹƒGo )`!:wk]dRڌ`TsHBߎi|~ΜATDǏ[+ϦiE4jw(̜^7K-7U8Y׆$HdU%QMcuZ(80PUNLR9RECg&sI*o/ov\j ZެR$HY4aWPh3<Wd):Pg} g\ӁZg%v0Jl5XG/KJW`OzPWTcB7Y/{Po}bBRpPe[s:$]9ԪN^ʼn<)byTFS"`@>CVoLf+ʤS|1j8xnE:;{HRu0BPttKS3YCcwߙD_eբ3%B,YRv ;/^~ߒdB(5oضm 'r-gyryUU!E{N;o 'D6WnM)-xz^c삩raXVJhNcGsٿm#y xDs:ۥ9k^:&r8zBSR.u&b H_kʊv~* Z9jeM&  oGZ wK]3;z6ܴ_FSPI!ik,~ɑ?c Fz&V{3)w"7& #}6j]ē??RnzIZ!g*H}w^ao,\ gvef oV*XE[BЩ\ @2#( YP3rITCxwySw @ A/mnl`98hl+2RMCF6OvOWDEųIa9^ r)`=Q?oG )ߧ y1D7Ǘinj{ weɝc-2RdM*o (o`{k$্yZ4xtN MU-dQ(eLz}ό(j~\ub`PGr˧Ip,˗Q&QV?!lՔdJЕV^ 27q adS<BD"3VZvp9$0#$M" |:?3HMs`0Xh,n_ =!+=#bM3Ƚᆼ,5̋{H]J~D98oe/wE9)*B{Bk`}@rvK^#NĢL\9$Wá}]xV1ncglCtvљsrĐXfd5_)EVL]A=Vm1ڨ]iR{ sb{X-2|Cz?15lYW-h'k$Xzu E D[0@1iHbm6٬h1^mD|jmeT ӬF)ϑ ZǢit~N_5v/_4&A@[lȋ( 1>,3'Yɺ0a s6|B9H]Hfhs @1. mY 4z(HOT3iV؍ hLR/8t7A҂a_7*[ iE܍>^;r}+gU|afxЂ=d@>E(zqlZdZ'YwZ$^mR2Uq:tCsC~ۿChd{?p wNq}ȤgqQ%pKNgҎ ApՑQ ߓR!Jaĩ56uUk󒙄^w =ͰaPIJ 鈇@-|5xéGSKզ NGtO#7=Q ֒X=(ܷ1xQJQ\?e;G2Ac 7m p\ݼ#rҼG ISvu3-*"Mwa{s/Kܑ˅ZcJaIM}GmU?3nGa=_5߼ 5j'hzJH1^E 8bVJr>yT/d0(8j1'` vm 2/ ܷ_y*$*g{~w|N瑩CtL኎v}'' 8 Bx7,zɾXkek+dNkmO GW/Y2n]*n~Sq4rܱL?nHR  yR4(Y}Fr87 %dߣ< ͨEyKFAXCn)MrE@HS ́H;35,Ե:^Lb,lk8Ek6LDI5ڮwR rbQ0ɶ.yQ*^PܩʴأIOb' q?zfS!u 2: VYޕ(VUZeA5jVտQSkQto)sz^4χO-xJC%bA70|vcc8ٯ]nZd~6 m2  e^;KSqɻ~۔T&h-Őpj[(Z2`3wJn[^NPr "˓d9/]R.{$A5&ѮTLy/:ZL|R|S79ص Xa;| rE!e|iʗ%MF]LAWSQ3Ba裏;h&P))pp0-Ww/؎;V$6զTψMslr@?G8Wvi`|otp"cۓ"%6/76qoG[#'9jx.ݼQ ]vʾ'ao>$NEM / 0YtKfo/'hG=eLN|?;Ԛ͋>}PI 5QwwZ| )E7򒎿*[OGMK}өjLԅGA L~?,g␕smF)*D/G,:.(=kV+lj8(Evj`=fOZۼ:I,5-2%Cn3gn,zG#u$T-?&M@ ߇m#t \@s:y@.̸¬aײ:٩n7Cfhw$C6﵊\ VsM~S: ,(|ۋjDض8 47$^jyl4Zq )";Њ Nm7Otl|NĪHd^ >pԟO-뿃G8ÇuLbY*]5 :RE.f"kGb>C҆Rxe}2ADt 1j¥.9 ǧ_%gKWԹ+j3Lqn +}TDc\+F[kx=P(lX]o Jb'vQpK?ePqNedy[f~ pn (Mq!tA9# ڙ`ʦaUPzYc: (͢~;k>L- C35 n= R;m{u?]^¨P рaUBS(]尘\VNj1%pJ҆[^9 wEA )jx p< a e]+YD␪͸˗UR~ 1[ݯ6i wgnVr!0\hxhO6,x0vi٠ٵꏥ2DRi789t uv2tQ\|,|-Dh=e \`Ѿ^.#?AB[* ?ô.Nv;Wrzݾ9L}^O~ϐ֪J_)vn~9vBxE ^nPgnR.(9ax18v0R<_#5̈́GYt ",IYz4ɦO$ٯPv}3h1ojmi`]*'Xr0hu ~w {_ّnTid%F$ + %névO~He(Q {lYLd+򟉉,;Wi/OT% V}zvtRB9t^eQ 11{hf쨔i=5 <fݴh2,4"{߸pL$ qpsG遡< t+ Nߴ7AH= ifTz h. Y2pX;׸yVI|f)K{<_U\x÷~rv|{_<0J[If|X5Iɤ? Hen?2, C/sc\˪2p87j5~׾+ [[l}(բ)pΊI-0Nb}l,^ωܶ$y_#6e|bŷ:.ͻ+b,5yUYH Y;=KzlV*JG L;v~mģ rp6Iwt+e_i3V)ITvda!P8j ޝqWyv3Z3z$_&P*lftֱ!#+ nfWJAœذ_q}G`@Gn>Is54BDO`yvp=7qPzyE hVJ'Y?H=(]> p7c| ^lge^xSf[fp>G(_B G1U1{{}jro>}w [=v~I=4?+ݯ3yQCuhۓ ږ76_t7b*tgBYDn:%w/8fGݪVIPQ(>])!*i4\f~ijO \~nb[/Iu~"j9Bp$2@+@)(jvS71_mZ2Qz\֢^WLN Q F?=Nv3uFNX .@!w3 T|=܇7¥P:cI_q7Z/~'_ﮘPv)L +>3 (c=_DܿHjܣDmҿ~3Z3[O.uI/f>븄g"@{jـƷA:6sۄM^Vs(^~z7.#fZaaaImLgkMZ_: YШy2%hTFȗ\?[,=7 x}fcj"\v9nE4`$ ޫ $L~lw6'x40Oc,`dN% ޳$+:IpJH7Qۙ]GldQ:r\6&/FY[a|{ޯh0Su@-UA#  sF;lQmv$/!H2OW<-ķA^= ,΀fKJ@/d8,/j:J EVFS,NBxf8o8Q 0d;:4FN&kM.e!mT,gGi?NA) $RHlu -uP>t $]p-PVcʆmZcw]񘹬n^zr}:-%,)1UvZ3z"]VOMriJOD?N}<:Yp#+&4볢YSm^Ƅ40NNb9HgEE?F  "dײS+ Tl`EtEts" "\-&k*'뺜+9\WiD"9Hfi$ǩxm2&X쐵=H-`>ԋYʷCkؽ7gtQʜ%j Q!{)oͭo{b*.SrK0gFuW.mZQb2SV[oI-`'c0%7TBUT+:/"&Et,&jHAzFkDB~N&Bbk=OmZhOCerVJŅrqǏB wⴳ"Á:MX_۫$9.y&k;w7@xjHúdFV2W+ F F9eѦl܍|UmdGؚO4:'Ks4.XbÈ=m[GKfSHBtc_$ļ-aV;F2Ggj(/bc:w|R^gHCgޤ™B璾5Rh%F͐?ԋ,1ȵ-G].g5YzF?0c^4io.Zߔ5x/n+l ~g(F$@ O*+o󺋮l,qp+FWh,|?ɹ-٪~B}a?, (3^17ܶ#PEl9M Wr`8hTCaԕϲ{_|zM{?)h>3hS5C ̊zx\a=y_-lqpq?CT*k2 M*ԏ%gVRqZc<[TZgtGsAhF~ei){i`_` wy.2_j ?>־-`d gZ Xpgb@IfT]X9 'JPӈ+,ep5"kf"|9Dov/ ƂR#=.2roͳG <[_weXztZ$Vq,hpn‘uPjkOpw@;c2\TӃA%TZr&AZNXzh;Z<2'S*$RZ&MS3DlJWBYIAN*zRga,P[Հ]#CS,!6=MS6"ARnJA!tR%+tɩdkg1oobބKLdXo}wD-oWZfzBh cA˓dѐy/?OY@K Ur:!ry06~|p™" FLVǟ]rΖFegѱ}.t EaMIRl`+ >kUʭw͐}Z\܄;dXqk[g9۵Mz`L4\PC/.uҗ*E$. CMmQ:uT4NZC>El:%b|) kU墾3}Q)~2TƎ@r2q7 ;/cK]^%Dx τߐ^ N]6\M|.Do[BTl`w|IO46VI=DEXq tH $qם%*!# ߛNdUZ^wx5&E0fHtBa /Ϝ9ۆ\=%Ug+iҘ̑l:u@i?=݌p%DbrZ'C6-ǵ업 vCe}eD7QZ$<&T0N70eZScK@k|sMpDYMR[7iL!d#h^aQ"+h$M]B5h^.F;CJ謤ۄ”׃[H$mQ, M>ЊR"[F 8 sm u4HʽJ<"Xx^|tY? M0-7DKt)4$@#Lk/mE0PXCֻ>U3UgU$O˶lCvUVK Tf} 6V]Bw(Mou0kV'U@b-LgZJ=`+~p2U!G$iGvh#AWXqj4BAc瀣3j!gr -73^ښW0Bn& h: p }1Wt<x4LFs-23eILk,U3 {$J/Fr>r5m8Jmg%UQ`mj;(xT.-L/9{d`+#C}d 5)qPw|_Fk//DnrV#`Ͼ  6|7m+#0XF]Ԃ$?z:ZUd~mRC/T tg\)kk5t@EpoEl]uM`uq:b/k%rPcSnfpuU,}Aگ; "k3|A!P:͋Єuz&vv )~)N(̭fs_IkRS`Tjɋ^ |2SOZ:+_dM GZډd % bMwjQ&f.lu0H b'=gLzXMUu?t8ϊK&uW&> ?1!sm 66'PvZ.A !EXKCJfLYZ}VC7[ϐ#1]:T.4vV* WCQQ2W-!s6|`H.(4Mj}m3v1"^JIvZ(B\k1>Wg=25>QH%ynpA;*[ 4VY<ӣ> 'p #0 y"="%1r$9Z弢_6.]o3|Z<`U0xRMsiam f!t?8J >8JIǔu$L"]KրW^k9WsHl}-x"^A^.:ߘ3|9uX12\ w#"vQd665w;SM^PYS(TwP2E>ǘ$tOiǸ>X"۹Y]Oİ \e&-#Ƽzxoo!F1L8$f/w+)7E>M ߬o](tb,[Gd"8AOX ߫&j([碉a?(1Y^pUDj6O2yn֒MQ;?䪧#S 2醭sgő,d$l=ܼUP5\+Z"4M( }Svhs17aXey$w݋6PꑊdϦ+'+jXL]eI},^@HEf2QULO$IiwۤZE dLrrP V)%xP"g`" )$G k UW@\jFcԠiq6YEÛ':rʰD9#IΕҸ|ǂz9iE6M4R:۷xz &S`>z '`24&0~/OvPwf3C4KF|3:ұ >EIQ@]a,E|f}Iv#/áMm&j?xw8ӣZ;vߟ9Asi0,XP d=\ Wl\ܬ!OzV0j\  ܏/HZ INTUɘǦ$z!\AgZ9 eU=O Q9Ԑ!+m\V jO ~R%Mzt{| xk 搠;*\y*_ĵ';ZfB"]1eʌPWp2~u蝽NSҡ0_Ѱlj}7\F\4#JQ[mTtdQy\fVIA)L璄qKxsaFؒm>s@mMQw&qˣH7گuV|Aup^) gia U7n~WyLGc% xT c,eFi^f|Z L"ʯ\rbYF(FVWS.)ť|B*.Ժ`ɈRà8>&.k;@z.wɥ1"uB4#Ǝ]U\p[x*f'#sv#-5eA䖘=l*i}"M3d\1/IP"u;w;W^^?X$Tٺ{ˤ f&X\+YEK2R/b^"M&xzǶ#G+Nkfe,(S' g_bm\9 .qMDc- &KSKt߀e'Fz#ΜU{_\R&d9i'Wp]GwcP\Rx\|fz Z7 t{x9lC )_;=:tvF)ac DQ hk=~)҇t;)ǁi'kZwV􉋟+S.5 I$̣ohiv334EwbU(z9Gcz3)ѡ8t͗1^yUj;64OvH`g(uL)Hm"]4'F"|5EQ׹L|mjcIڄo?\^|-K1~c"aacａYM) யrF.'f H;^c԰dm.JO aWzٞe %$ұ -D/\ǐRr6c\-&9`RO])Aקf|n+6LN"~ZHwL\l $mu[Ov !WiRW;K5 bu3a 'KAȈsQm@{>]pc]A/FSj떧O#7z/-|I pb5ةVF iGϺpM2F[%X)7!όtxr ٺPs#s\G펍2=nD|(|w5Ԙ">si2\9`>HvgMqUP ??=#cKBIpsax%1 ~3I?W6߈VUrS2Կ?xHPm UR׏O'>ͳT:5 3Nxbz-q!;qQ֒*q-5`HġCQ5IaߛAH.Y"(kϱnFFl+X'=p}'8-fs*YP6*7L`MSU/w-vF<́C$-6X>cb %Z#9k|aA`4Iws FUgE@^]7tT>,\<\?UٳbcT* LkH<$f<>zg֊@ .cN̋N #8H5r:@& $1+>[fB2,_g)u??D3"~9\d5}Ľe<6ip9Tzs$7R?PK[ rKn4SP=|<~iӃ+2X-*3pG}I%tb"V-[:"r+0K-TDߋܶd,5^*)9&1oe Q6\Z]+uրvBN|9=-RB׾ "_7z6k[{|" liuAiI1 #%p3qӢtZ>>D%=FdJf>Ӊc_(Þ`K:%ɩgYD%a:UYO؅T,qGG0n3Gh䌂j:~`$1ՇIqFO|Cf8+ޫI#$;:JNfUڅ/G] +?IQ9sE$ަe=sh,͌I4|&/0 8TOw.lXQx/dӭUcZ7 #z.4ɔF(McKE9x ct]1#vb* 0!ŽrQE Џ>ƼIhos<̟$?VC~yp)Je8}&eZj+t®#VBiOu(n2)=e<]]|Ay #RnZdu4vQQ6ᨠ MĤ^nR{`,Rh:ĸkp]cDOBy#'XW3TVLH.=a.8h[g*=#a!OQئhI,eR Xf<<}NT6 >UaK[X+ [,u ȹ턆ٛeNV3V}bQWT^S4nZFpnKY>ruaU^DS$*" ט#!mLHW%=h{urv?S~Od%j`@f:|4]u{JWI>Գykzp!/G}8@ysF$Ut_!/ dfGx4 %(B$aI܍T( K{)/a|\`Ofuwܧy23(l%v f6 Є2D gP.B 뛩$,\YT`/b%#ZTQ?06ia([Aߥ:Z. ^\usR=d~F QTwd匊>rBE^NNcq*b('MJ;bqu֏mrw}Q08`} ! =4FZdW܈UgvJ?)'ysp-Dco Ff?dcqkIj77F&{JG]0q y?eǕxڳwY\9pbX.|Ù WRD XfC6$ݬggB;L8_5_彗5r ӱhW䋰'zhs_'nlUPOIw2³J#+1K8]caϕ/%Nmo5gaU^{f|Y`-K扟dz3V$4S_GjlvMbz iD*^l2 fXkqCl!BcNR=^6MϫG,^?Y7|6_T) ̈)C6چ*JFi/^$)pyDnQ"Nk= +~P~X %"0mI\'*Ptew%<<%q~Fdv;rݫKF-S:ݾگP]2*c*rol^>m=J.6=?KT@24P?Hw9Dg U"=#!ZCl\z"OzV8o"b*{_z;\-3~I`\[ Ò@УPFvŦ_mwtX} ,CP G GCctl\'AYٔmUI|ts1v6BFWx \[ Fi >@*̗O5cr aۻM<xGd2]c_f;70wo&ѕ UA&UXi1w'" ʄTBV'ί֐,l:V+zq Hيx+2~$^%[<0 KNߥFđ+sf+9)e=#p+u C\)Abަ8m:j݇na(,nHrUzy }!>fڤ4-AE@_L>QT#3q}#:܄}tb KpyA~`@( `[XWI/2x b;CA[n))n@pu&ώY[;$E҇,EUR&ke`U 5M.~Aig;wI fӎ H6kbDE ~Y˩6WP`UOed!sYl^[ 0ZSr25EJDڧAFԇ1gIBO99JzJ6mܽ{y"k(x7j 6?)繖~̕6.iq9g4SPj9;Om5䘩'GOg~z0 oCDlGq+9&k QWyUep躍Caf N9ى_8+ȬEA)m-P}F@ðC$#O !Qɗ@4\x;I>yJ:͖r?:0N/axIwVk3;༗¼qaNFB+Y 96Rrp܆aztuLxݵOb[ 26:e>.eD֐^-dP]0+AنtuC> Q"ݑIz*#p ߐoTLk?1GlBnX3^to =yI!L,+A/*sB7 [lÔA" 1Ii7T84e;͊gbzCFdE{2УgMBT,h9[µYhsy ^vGݛ~P&gymUSMKg)S]9Su#0RIɐezuep)y)#c|J餱lՎ`܃mzV =A J6Bi}] ijȵUXĂnwOq+O4%MNlz5?w [B7&ah4_wKqK'|FG*?m$4@Y9^5&M$3$OhU1A *jGC(v@h]QzAFxkΙn i'nԩ啞O/H,0 Aڇ@΢&fTUKrk[X)>aO~ǃAoױAty{b a iT$Xh8n =6 @9DMhOz(|dOX=ݙ*L)Slfъ %vƾf,ZSb)Oʹ=i#<1}DIH?H^ ;6dYl&u3[诛K҆Q@ K J8b/D0C p҈09)bv8IAkChsO8PIƶ;hn0+KLrEr,ܞ5?- ( k-x-I ZXp%"el!(qRm3h6K| -,mSF@gCA?)Ң!xpkp ]ΟȢ dV/цYrK|1r^襁+ZIc+y ݸ9܁#n,)ZӉ/[ɴzW|\<}j~ZLP:mN! c>H !#` n*"ڦ 0!=XlMC-= e/涐q+kSI0ƞvE;+Kp\TH1~Wak]-/6!vk*p90H'orЎNv7$.p j%Pbbܬ ҈~վ׮睭e+K-⤳0? YY|_m*kG4;l=#}B6JvF}85N 琌~.G_5^LlvLotn$;QI[x*Z8dnďsx%0hýe4d{ V3 I5OWj`5 lL À彁d 캯pOeߍ&IE\SԼ8aPQ Ky@P IrؙU%i j@~/S)UC%-/fo N{y㈖߉n0Xu`(,|+&b_%᯴ѩdK\DµYn!yb;QiիQ0."E箉 1<*q,,η#K6-7]υ^F…xq~|ygRtvyRMLBo4S #@&6fci z1KNJI]:dz )&FHj@mwGl6J Yv\o[x x$e4U[ۑ#ME؎:]Cܖ uj2n*~~;ȋZbe!e65jF?RZ [Jn"Q d)S8a3Q]dwaDJ6v`j V!̺ď-K'NaRtutݚPm:b5D@8,+@hsj}ӽCgD{o'_L::onmѥE䵜$؈:yӵʠG@@_,56 #*FhITHml $,Ԡ坛D<:]R5W_"[QoXOU lR V?=5b"ӶLY "o5dcXoѣ; ҲZ_2$eX>{]<ͪ+^O;9oq)nZ6 ~FE,/ҁݵK$E@)\ѼHSUn^Z{҉=Jkq?es؍]9"A+_cl+UO{ Gvxt}k{a ͝.`,Tg?jzyzE\԰HcbM9O5f!GJpsmYO]ܘ)JR[۞) L6 %k[9u2mQg$_Qh;^"Kϊ"p8>$G}žW 'Tr0a?1x [įWw $Sex= O.UA*;񳔨)j*YKGD?/ԝC>z!46Bw^:͠z_y} M$&+8$sQ (M9'ڴYHXԑq^aUҵDi&Jg3eN:.Q)>xo}_ᇇr!=Z)+$јHw$+=@羘4HH#t>$M@gX啇I.VSk!{@ @>ϯLz.l$G.Ȑ[\NM"lV`…s{b6=;|`Q>9-Oo>ZG|X# T@[q%[ܒ|1%#hM#R0nPOqL6z{W+A;ɼI∰Ɨ$6 's obLc=G> rJ"䥆3o (dLeZ?sG M; 0-./'?#ݘ(۽r\aljo.kS8hDs\Nc/Sf\Up@<6z^p}a`dL|Cҝ®.1s'#3.຺jM.g" VV1<0j6^'JbJ7)6Ԡh)d/8 . Tc8Q%X:KFeʛeXٺӏ"'υ:I0K8d˕d)sUi W8H?r0hQf1b.Y!)˳Od6iZg[SyIiEw*3<9 SznF䙏Ey4T4# pO_Ds 禉wW"^ʛdELx(yI,BSk8^8l ?sd "ԷH'ӵ,b!4, 0 ǫo~Қ{ 3ӯezq'",uF&Me=Q9utd=i r}'psy'ap )Zh#wcs\@!kzl5"ؼULJRD` 1_Ӑh4橑*̈-f#gc)0Q0iog؋tj$sXMdȋJ;G6٢O*Qfm^?ha-⼴eMBtM }]Y;P)U Ohv=]u‚r=4ae,$Z!;{(4yhFou^mf,g^euhKO. M߇>ˊނh#xPgOLImt=2(+Ĉa;m2|:8-*I?_lڃh6RGtPB&9rKu[xBfҘ7Sx eiG4}+z4B/ч=SQI&h>%ϵ:Ƽjhs'L C f5uaHBwl֏۫NDOAL/Ƥ+ ;aΨ|}ևn"/xʗjXkK YH¢5Y' ӍdN-Փ ]J6&D~9|^ě|Bwѡ6VGhk݃7hfxy`=EhzJ,qx-dK;P9L|P`WK_+`msUTgNl: אvpxٓ=>cH|+&3`I7+y $'YOP( b{; -›X(LBrFXm!\r}e&':pDO8'I' rR%|D%unSFZH!E>YczfXv\-߷Ds2-oކO^0`'&mZ| ) G>}~,@-JXg_i|f|2on;|iTF-TFjN'LʵzyްVXqZ6U#ơeZ=)(fjz>Ė:I!dKj57+ჀKRe7gBZ$gLg^omF@pN4Q'>LTq|>UH2E@pQddv<6> kv cFW'wdSk=ߛa]^uSEǽh-"̂+7#u) ȳD/m[|ڽmPf(NNd[eG@C@7;uH=Jz8+ |&D$h[+iM+VP$wB_'`m)LJ4 ^j̀?% -A ;,9tTdZI9+u1{ƕ]<cj꟱wđ4W*B4ֹЁj*?5>$Z"l6j6!9Q]R/wfѥ9hݮۙdDϷh^7t8dQUg<6ܶ]` T1琽J2F1#?&yIN%TWxPQ)w3d75\WJA;}N? ^Ńb/}CSdL|0'< yFI9V$4˲C&0 uO4LVqSxDHfؽkB@ fa(^P%OrkuF^fsW)nfO٧vGg*~Z.?,qŒ\_mɊ?ީ"𡩨nuB*d[+{ZUXx26nP4i߻ƧKij%rtIV9; Ncy6KUm5Qj:VC/,s)HE”l+'>ՙm_%]2Ż׊sgjC?WAP (읜1a{4!;_f+T(x ^Qbu AڕXaSC y jV~;"PE1:jocΰd~-/5HX0"ŵttMґң]"x`S1X`HX9z;*j;Fn[fea" ^Yi4jKA,uK)HT 1R/mI#R,xm۷plk1FHډe,e }l"Z 3թ qfڄ5QaY}45^1kGے [sZ}PB%Y#;AȀme*Q>9.5YAUW-R#4q҂dt(~мXT:Zus_!B 7uWcV{3=BXMt6"*M[]19VU5L^@E'P[X0-A`r'=j.2#g.IzJsGGFϋTY(n#>%PBVE"(Lhs jP|G rn/)%HՎίm;:jTnΎVRjM7UN8V}穉ح'4eEF="Uܢ+:)VC6|yd,RT*{55_FrBG>2LN(JbyQYKSNYp^h˿-[0s;x<Ry6GT$H(Y-*i hܙ_~]"G8`̿{6֋OyT{,2 ـ1wqN&`4xLM)mc^~F_Lohoׂum1Q47_3M c96Md#Ocb7aWyR.{=ďG^\fS끶uB6l~0S0mzXg9h(,P%w)+QzQ.g9$~::¼A-st*H. 0JuXHߊ,DK!ýѓ&JH,eY'RĹ )[.)TB pcN)`ltClر v{HnKl[}0(/c7u'2v9gzQ-84dަźOSq9T3e+)S-Ih/IXijѴV}d L6o cpW1C5q q<-eSbr%/ ?uce,1$ohji!6b۫R}qQ=SAErQ>f,Wݸ` +h7.gt(*(r2J%W~X@kxz]V*}OIf}#;zEڄ qrRn]6ƒjC@0zu>UmO⧝{E5mG&,/㈟Yy&w lv ,.-?gp}wJ`iUS4!n XY' أ ^ˎuY;c#kAw2PJ3|7~i$22ȼmM M.k0lWc칖' c1kpyiLا"aF9 ]d-ؒDYh;Ɠ1,$*7qK`yg ~H-ܚ;\- < (uЏ]ϛBթ^Ot5&|f.HqWayj0$4!<h_ >j-{ @Aʓ*&v"s7p8(6zb#+spvwh[?5*<œ\ 7+\Z=9X5:է' Bbz:0oQ-My{Mz7֛ڃ UBZNՇ?ALL!P6] vC4Upt8WkJb%[y:$Z8|>Bx5n4e\ +>T=㑗垳{7#3i1.f>Q] \ٕܿPE;PC4&\F AL{[6,TJ#(F䅂|ĔwԮLҿ\voFNHq.l-7d`<:𑕿]qB͘:}YIӤu2Y6G5֩-Zjc]܁w|i#c{m2'TD~E26[!8JBOMB%3rmJ Izhs9Bq7z&.BizS$GbADFNiʬo6a0~Ռ{bޅ\Ho.gLM&= HOE8ZYi,)1"I7C1<]'T 9լ2Z02~- -% $D_Y-?x D-eLmp=x`"i w5p­&)Q?iw$Ri{/@kIb/X>Pz &!'ƌ<8[m'Wkm I|?**Sȱ9Cw2Hm P23ؒAmޑw\Qi,'!(E'ritxg3s$\is&wX7.E*Qw>WڟN2ұ{+ Mr8|+HH#WJ/Icu=ESz3lBDS!ֱfnh&),N[|3zKq7sa2qhha|.o-\+Nj-iĄOeC3 )Dii caw_s7@=% )_;n^L.xB\MibEds'CP!KP]o.%XE|ޢR  k*x6OgCO _; QT0iJy&i:h)"tz Պбw{is;_̰~BoJ4 ̸_ty2&N0 -+_J󩞜[HeZkY(gi1H6(Q^U S50IT=%dcU9R?c#00ֶ=h=RV%^R&HH~I򿣆K oU4 &1Għ %Jlnay>>íAfb`iƫk,\ 4z7iE/*o#l|yߥ{)&NK엟吮]MTi P AGO"$0-4=BGҜ!Y2mJ7.95O;V0b7KLm?~, *T9!>U_ `Nt4%ufiU9ݿiaVM) 5)H @xʲx5:-$'p#elj>V8&?3dR l{h+-U qh.M/ lO|Uמ[Q!]dUO[qG~KQg]xh!D4JL7K%vj1( W*E OCe^{c܍u0T¸0Nq,B,3f5r/H|5,6ӑBP]z 9MƔȂRS[dAtԃ !F+FMaptW lF2)ȉR,=n {9K|ݸE9Ae@2.V'+7Mh3cFWuh Q$諈|qb)FP ]~Of|Qv Xe#jmK ,u[t!٪GQg^/hX5U 3 U_ ,#;l~n2~IF%XqN E#3|?Yr3#oUǟ,hrU\ʛ:;0#H 4<^kl/\P@HfA,$MrfјɾӮ!VLX0WpocjP~ڈX#s'OwJ=AC63b0CvXpE13c/6vT.hRnS=Fea5i0Jޫ@9*PW9a+e/|Ų_ B'*t&?#s%1,E=IN8w=%:Xa_T$!>ZI(3Bpg\7TsTZ56 ^V}[9/9jΕٮEm>6);s:ŒϺqxm ;\j粱R*WwQh5[q@@N0WHIA/qLƅBqt#@ 4]pmPRy>m\077nIO1qeW؉~f yQw@U1ؘ$LT Hcezě]H+n0 /h%gk7+Od>:gL`[:ӧb吞C(ft78h֊  .fyCE>z"dӂmx2UV;$q&'0)=֤ẑӀ|m@v:Cyg2=0~(s~dbxCIZ. ԆFv,cF7r߆m1gn/$ $ A@]ߨsp DY:;804$MMUz+[ `=l-2'g\οnmڍX83qAE]@a83pC8e@O0,kC4!NEuiEOY  H;#uCJL}#ƨ[-|44uuzvm.o(~~u_> bd 򹭻{-'GiwȎ|RV_P†JAtg.@š`-6ct@g+ofĸ'O4XЈEآJ|1tďeOޱ{{lJ. |5AQRN݀ |^59gZ̤ IVHNE햎+5I conZωk~֎? Er\0b&EU[Hṯ[= EHy127р$B74y?ɓShqA)Mvh~oFHJD.zX+yM(ڑe/DPuzM\>+)2|1~0]*b=1HzBG*oZ<=a| ח.ŬK*F-,&t!H@I $^p1!*k')7j )dX^M,u؍Nc&EDZK0w" *UW!t|"'tFx2"r7W=zFc$i#a7sB |1-9g@khC,->%,wh/(j`ۖK?:g>bnm/+i\J3b"T+ Ġ%#1$Tٸ)9j{+>c՛j$)-3-i?$B̥іe[Vs*lp> k6]%F^pM9QnaϰEn摌 Mޑ܇(f?ֶ&+I?!ȭpo04 AĐ #L-oTK8/0hh qO3%}/Yꑁulc6tލ2 2WC33ɨBC` l؆p4A֯e;l1PjOJ23߿tEɣ, s#W[S߇8mu5dbƵE%lr5O!ΞW1țl2c!̜\#4>q&&D󶦊7N0@xwPS{r+li4@=A39-Գct6b$YL)QzQՅcuV|=]Wݗv$ M>3/RixzLb_v6eNaM.L~KW&P-጑erk:y?K mZ:ϿX/xyִt!BDBbgkWg Kיʥہ @`s*g7~f]5^vI-b7'H}a CC׌ 츣3~^:QX* ֧H剥[qu`+?^p;\j*Q=LH/6~C̻#8xFaRʃКC<9z}D)TdJ^GEssC`6oI-`VP^,4Go:ܣ8&ǟKJp#S(eH S1O?|񾏤"tNشJ}3]^H*g,7=t?KcZk؁5]߳}WE ;%{$Z!|aկ-NZ?em̍ku)wmb~+Pb eMX)x5rͶUO&!IO _ N5tZ+˦ ەUj<ۇ ݉٪W)վm^dF$;+WZ @UWAt*bda9~I fߚO'߻mqp좓sOb_B{C>& #7' _iqA 3Ԫ kҬQ1>;"]laeW?MT3[?=p4K?9GH±֏L_j#,ݧ-+(e5jGI Wn{t ߃s>t`u-L_`ʏArHstiWU:PYQl5Z͹gkD(\ 1JL 8 Mb.j|ho贒hb@ #3u S_$ WzZIj!6:nI- w> x+ɟ,dBXtMvN^{po\ ! KLWvC%J$=.6c{ĖnӶްernf~'1)u: E'yDo8EjT'p30bCWWmJJq,!R>"Jw=^&rSMt8=lg OZK-(퉣R#򴒮oIOH$i;;̙̈́LWNuKUBMC͂~;3((&WVB/ֈBYtMmܺ r\h@hÅI6P53K{N H?FC_-mO7K`rpncZ576xR-Lum S߉S܏KP9 E\CYs06 _ tF(N46 Uߡf.E5]3i3]2&ԓW2,a-=O<{5q7RL%P8?:hY@V`3u ZU'KKv-HFiզ#5(#|jN)2TF? -7f^2\d{tp(xk0=h!K7;Q!bhԖ_Fc̚pJuR6aooRޗ;xtF%k>Wǘ쵈^Y/% Dr%( rarn1p<8  VlilWF3x@*m\1; yd ģ{}VQIY5\t؎➷Y?̈́؅1f<][aԉ4&ЋM ䷡q7]6$- t2,-9cԁVo('s}+~v U%W=FQ"i)#ZY$"%ꈂjֆ"f#!{)mz%̵9D;yY4-AvZ?Lo)җdW oFPM~*L΄ubTrr၈0W@ЍdI'odA٩6^ZucG,,sh3%SrR* 0 O^w9cݲڣH/`dԾemf~<%)i-jwf!ymÑD糼5'la1v:'LY}ME"BA|BK_=ZJdtr'uJWX[p5V/ )VrVNg^`_kf-DB%e';h'95^t>z7|sbl`.˛%|ddy PxvHf,hw`= xasR VWQY) 3 YE;s\n}ry9x;C_pT ڽ{zȎ K1]x٣zPУ˭Sq+w͔m'&ҶKcZ5 VwS5LƼ=7n~2pOij Z%9wSl0yqB$eS%!M=HC7ǨV}dqf]q8U|(2?~Θ3PՉ`,A@j`1zHQ;o}R q+ŵsm]+p%E w;6V$S8^]P&Pג8N31"\5?>,2=-# j,.֫I9Q̠ C!3FYV0 (%0_9kqFШ&zD͖x"WQlVёGQ."hBP}iQ( ky5~{?4]RnCJK)4)V* yE4M>K\Mr3@hڨi7MpYm\?Rj):۲yhn ܘNfX?.GvEQ©6S%|sc& PM8JzGNV(@6B,OM:JcvB00)d!9C8 M4H伥'Őɦw}q[{U$Kۛk)bT r6ϑu`?^qj (Cp=$F6C&1}>ʺZLilkivjld2 m'sǥ XpEPhJzsDz  &=$"%{UjK Z9LXr5Ǘ;ѓǷWQ03B饦#YP?WT]qzd}Ir@i/l(>N03լY&ch3a Tc- * ,"v/:C6H ʒ̱Mcx,HT} w{cIOdiI#K ;L7I9[q<"z`7XtM9#jz{$a5G+o<ײUsO/1VDmHM(\t|* ~OwY2ei+c:n_d0m˟}+umD.Ć9IT~(1| RfO< Ԋ&laL_rȇrUeAh~i@ڠ[OΕj諬dJj !0E!F^Aj|)wq.F5L%N)̘s}pE "i8f3ـ#Va܇ !C+qsEbX>9AJNg+جl&LXdtdRU }1B~ډʨw:siٞC-)A&KVw2%ON_$> C޸Hb@#(gk-"Ff^IJcK4A=3bxoM+Z0Z[bZ'i_KuإӒ$~ cqd8v Cwn PNQ/imW]M $}e!lJ5USˀ&o!1i_2Mp ~ pZ۸z[KF>;NݙI#y$Rq 2p1Wn-Ũϫ Apސe?CE숢A΃1[vӓW+gY2Iit7} B'tXOLug>yDGc4")z$4͊bgnE2iIrߚ'OyFCLQq׺8n~FPX&aYTMkzӛ _ +y~l131HFN O)p Wa u,v. 8^$غn۬v?rpq O ,2!̊A/c) 8yϹ ,49c2J sx9~֊(bC[7#gm;rCVFզ쌤tNgE'Si(#Y !}.cI~bu ?o]&ܝ̫Yƪ0%~֬rQΆ>t,Ȯ U[`b9 L4t_:RlӞY|j+Z;![קMO{Ta U>Av,OMX ~, 6eki0UD)$d=KQUVi^Cse)|{Bˈ9' +)@ΓV FEQh|vwFV!VGhTA= `81h8:s!Rӵγл}%l`wI_;$nf|~ i&L'܋#ғp֤}C8 ҤP=ևI%Ve(F (IEZ fNJ1=NTSPJ?OJJ:͚ %ҟv7Npw %/X-C _%lzu;\ƻy,üYi0"3Sho MK,ni,B龝Ϣb #_&DULsMJVS) ,cOfPػ3!FU7I+詌۠O SXW\YrcP%nW2+qCO+w >mS_IxB3mhݿM)D/KcXyn>eecEA4j0}RkæeM  F'->Ys 3/)DTREh$ri× 1Γ;ۙT(4!^v"gGvKp].5|J7nܬ\ȷޫ)@FPQ)É(T;#Ev%@siˈx m)mP+f.Q :H!ˋVTndG X)\ӹ88dn?cM[{/i!BdWn!\5p:n#WQiY ;>Pۆ[k9T:vRoN}>BUR.|kpDjrM@N ȉ;Kɐ9qWױ2^{[/ +!| IGەS~0l+͚Zʭ{%kwF\:uZS']6BݨT$rMӣԭbfsqd| ] BAL5tNҭQA|`w+q=tUz*}jU^=U^G:]L *[ .DtMuaVKcsmP̈́_t0f^Rz0u hx1~ZDua^Kd&l c)k OE``dTG_f38/5~7Hu9¨`s6L? $,$FBA"L:9AμVpVR  _Dϴ7mZ](#6[hz̳ʀ 򀣠}" OL"Vlttп7܊s^۲쟞gṝ>iֿ z`ba}XHg3wQJ:&Cz?,sf ;*eC 8:\NܠIk7dȋ5Rtu$٤%!5CN Iт[7ly_m传l67 7Xe$*J&[VU9AVTI]уSr!Z5q(.!Cc~2wz&"< NoEq RK/f-h U /5ٞg 00l'7 d 8 0@t2jEWs+F'e` ,Rw&(c,C=\oJ)~iTD}yӽC [y58 S0VA ދ3M ݽ0ޞ8"X_I ?JZx/ӏ+JO:sm@/qZ3]6|ҸGݥ+( -kwpyAaGlW ༈tI%%[>Wȴ]2?q?Y`Ȏ(PbH,cM2r"~]\s$p{uS$3obN.'y,?7Q.~"@PϙlmY#ф Ez x5bEŨ_pA u$!ϊE<fWO $|V"_?7 abC}NA!"0iۊ[~A]5~J$PR7mD<ӅGRgV) @sDu5rQCꅗKC36Q)Kn;ͥ]OqZ#W1}V(b։m j@+7.gC{ l 2Y܂qO {Q;'StL#}45Kfqz$S+>rJ &+iwHB`mZm#'ؖ\-6\@ڥƊh MNŸ́d#>ys KpXwǟ5*=a+3p}䬸>Cw5ʚ?c;8 U {9Hi|Xjt7Dy^4ƴd 9&,7ܰPZXi=Q#ovdc D (54gq~ "Uas6:ap؊U pĎ(&.B1[p$K:/X}ߝ/?ؓ6ǣ11l\:ާ Fs>q70¼y/zϪco6D3V!"C#| 2񄴱,.CF4FY b@wPTRS6հX13-E!<)4OÊ>R pEV Qs_0P)iw7lVtrV`Kʅ幠):~N@A|mSgߵY=[Bu!iY$ћ:@tK9>hx҆Q!>OGu? aR~R^Avk| ij@HșJV#'RU,3@hx&'sϹvRֵ/ӨPC3:}Whbo7K5 %M$Y{ӫ)ߚlx[rw6)FOa A"n8㐮?SS!)n&L*3݂ÐLZM?aOO_>yD.9ܴ]fD9UXMUh''?RAݓMp#HI 'CCV|KYZ<^^) \IRRɛ%qs/j7'u^鱩UncgV!NOSBBӟ;IPA$DG=G+ÚRa0Yߨpҁrw¤@"ޢ/V` p ! V XΗG "zŒUФdgmd j斃Wa1:0ԻӺު/46)8BT Y"*c f#ˠ\esGbcil7*I 2b}0g>3KD4$V8ƹzx!^\12;_HixqrA+" aD_b̤_~SLRpFF@N(VbgU8G/?["jkMϺb0pR@qfÓ3Vwƍ|D[]kob94nOզs\i[-CN"Dߣ?P[՗X0L1  uńɄ٥_rSwvFg6eAxrʣ. P+:cl73ΤG^py/]|2P/\OD$x5 6nm%p@lDA Dge/@ ӌQb'&^*jU9.u -ˈKHBjDzWN ~z8X5> z@K.5 !WQbޥƍM Ցf|2OHO6PJhHK.,bF©Ge;(}Y|̀seY^eYnVѣ7)ݝB:ENh4HIe1?>F5tp?QM9 dJ0g{vZ_@;{/UbC4` wP c;W)[cIK`>o;RnLF5ye==Bag[X~dPX Bp7x1c;ȆLu3"3RS} X.E=LDՕ6ն:vH!CY2Tf~Q1baOR*B81:H[ϷLrĶ߾2zş8JT]&8C2Xf@ idJ>ÆYx+ m^%8n{b哩fHBY1j_hzٙSp DE:\ LC/ f5G|L!uhy-?ƎI"A"M''anGp2!D}*7n iM&6.ZID_uYǚQҸ2or|{!9>?JqIʆcKnU/  5A*v8Hj|w eƁXH W k;zP9FpNvh87eb/fpO]3٤./ ozM Նت!^$t[EÙP?~4-6f}Ct o[2O˴VQ :j] ꨭ9Q% >بjC TxqlWnΨ!,p+Ub{+}vhf&_-gxbCXK~Ӫ[ #ܪLaڥ= ;Ǟ6h;1F]jةEQ@HϦϓomM,gxk+{MR.r,ΡCԇϪ郘cwUTxJ]j2F;+qڀ'ǘ 54Q(7똞ҪұT_$"Vu⚬Gvh `uVض5`Dr݆`^tSaM [HIԬdl![ 2A"uSW*W;:?;+HbL]5 L;}81MG l;0o*X094h\ jUĒ4;{:*ylqMۋNٍNIf,LggbQ| t5+| {FqQ.<%comGՔCf$n-8e2$ppPɹEЖq+_U1ui$ 4,?)r&{a?CIdMVWLݬܵ-1_: y- {A1aucNrA:i(|&)$Zg &n&k_!ܗ+4\p>/67)z x=5*S^2["ۀ*c)q R KDI]>9ϵ$}x>=cB/me؍J=v_b-U ~ΎB}|Ş;A\/xѪ̒Ͳ(8m< CGANM}D EE+N@0V#o4GvC_-?r!z4|mjFERGSW'@I :2(<阝k xJzc,Xޙ x>ps;f˫ΠlN$ g}m:bT2:9@X$O;0<1@p_yBUvpK+ 5ωwiؗ!bn; [9crNąK_cXKQfY Lx@c!p, iA<.=eflej @ZSi)c¿<=( D@-?]ucZ疼-}] )s,ϴz0 `Zam~'nG Tsdv8?WI6}oLƇt37QFnT 6a5n;~g"6eWᔋr2UW&φ~!ʱs'ɤ{ dn>rMXrv&gkkYoox$G׸b, /x=Nq[tDE3zJĪ"h[.g#~ 6LHZA#ywk).|o,0!,,WӃ/NH Ys:gڴOx ㄼyBc4&mK(injq[RQo yv{%CKduJw t~(mͮ|aX9dIh{E*jmp׊TT>, "fM׭F)i> ~sL{YRTBDGHlS@5%^QQPy<@bك(j2[%ٽP#4֧_<+) q06+5U?+PPcʙLO `Z;9~7=Dhq 5l8[44!0 Rvz( Yʮ3)S< Ðb0LNٙ0F,qf><$TT6B&thIaȋ/!>0fKR xr Uh7h/Qv]B>!_z!bip('cD4g"!h3)/??H!_OȓT%4¹7MPR7^sm{˻)"HK6EJS8?3iSRrn [!)+sulTjmŠl>@R`q_#rdgQ֨|6%Mt~~cQ@XYi3O_.)  ߱bbyhal?Ğ{+ӤaHn>qSGj!Nj'z$!%~pdwO fU.Β:r,J38fVLM  jQ(lhlEIjTN1hѐỳ;}9zQ.2ća:և+^wK|]gK\+Cf9Y"F_ a#}>yS'k:aጛ|,=E^YBs8WN Ye9jD@e?_7LC cQ)1qJS*lXk_/uaQ1d!wwb†g2w8iw,SuBPnP)ro~^~ay4J-.N+Wt8' 'Uh5dzFwBi-Y\LiK:, e-CNc4FQdYgi`}=`T+Qy5Ў@0ǰ]=S8==0Dь=B EY0:<&LX߲z 0X/QDsľR5 (NB:N{annT%Y4  Fy9?GJa,-8As-4}@Eu)s1@oR\eXBRZo)6XQB1K^Q8\ hMF{,Y!\ mSMZi 40iEdDN:F\N@S `,_O _+Af|;2.*,a}{1|,=KYr@ս_f\#MIp;x MWGȸNC"U$Ð#4WCt7jB?F,JDݱ~/3MA4, =3{Tt߃1N[_!2ۻpޤ7BA`#xbl"D$~#ƞ1>Q< -.&496$Y 4?&Ignw+?ݕ4Y4&I9xC_g8ɯl|0.>8d)/o3gf- d.+#2O-cƝkS׹Hޏ5=ɲRaʪxK26a(jG j!5*c?׽NΘ AG;7‘kuPxj 0Ë8 &9| 9Nt8R<|uDTu&jR0jHb٬hbg?OQpn!o1H dg-JDZW˰QR.`{2з!E??_k\ )*@k4.)z'`<.ڽaAGƠ%B=$M|ҤAmag4;)U9UtC^6-0f]1G'S9U:I9KA bN9*d9KfɛH! HJƛΡk {.UZ}߄A$YF_d6 _nGt=@yIVCZx ح( X6vj" \ +eWlLugARJQ 2--eFaO3|:Ie3ۛ1//\ND|\6SzPtzjgｑ?'+&e3,ah寇rb#uTT?>VQFȉH?^E9e.MD|BwpVւDC3{}eA#}VN5$28|A8d)X>Swul"3AH 0eg-Hb) =hK$3B"xZ M;(Sv]s)?- -n[vҗopvYl},X/zWAfzܭX,%r-vKbb@%^W NbUh]hh aI8IbT|(%.Sz- GS'GuM#R/ܦR` 9wbڎ %n5ݝlfݖRTg[_z^+(g2&kh^j{ڸW^9pJRxmd^xњ` ps /9ÊkmmWY1(p_lks~70d  ?dTnQ }܉O+5WW֗-P#qyo!qW{D}`)C,ׄ=u"@Ɋ^ RDGGA>>)giF,r닆ZagWF=[eqRW1 %Qߥ%UoWo ~{Θ4V>7arW Ttޱ۾"' >J?K/KTLˈٷz ˒\q`NC̉g`M;{n 𯬭>6 օҼe HBቈI"bf\LT%.֊$_e%AJՃ%q=mzL=) 4?Q7CI .ow yuF݌?̬ߕ53G$Q4 mB4Nh 3;$oL*LuCC5Ϻu!r5!LANB2G3vtʆYx"Z=FYf"up=].S11·Bk $ xldQV5bK '@0Yf~@b\B^mqV` '8Lh4acȵ-,LLzanX+̆H)ZK :T씁özӠLtԺXbIqpGKt'O.I^r{o܊*X$_^n%}WǟZ"4ϻRCfF`$z{D/i.QNٹ&5տʒwR\Agq4,jJqsL'8BdA(vfʎaÞݟЬ\Flv?Xdh!zAT7]Vj"tiЕ3X1Y;(B#Jq%[?nE;yApmqeJV Nf,W^T^c s GE}mO0̥97<㐵סwֿmK`Է) mEsY[r908L.]e.fj;,,:{z>Y%f+tBݞ !!of>$1V 8%iBzyu*u wXŎ8t-`yx r# Gܚl~"(8ɧNFR@0[Tolvv lGoΌ #?r[.3y.E;K{x $򵴆@+]rniNcLN߬ ,KG* qF?7.O`bx3<$*u}aVdEf.;"g\ҵsI?YL$!2'8a!~.|3~I*utƗ?@gЪ6$=˂.V<$Һ/&q@g쐝,QM`<`!:G EI9A*a91jiɗ}.)Z$" 7x1$}%3aǚi.1$MK(\yhy#[ tڇ=VV;lVOe+b, y8C!iEد9v! LO#%W"ebݴ=V55Cn:yݱ-M^V awSMUNlF5L~8 nw1tБ*x©;CAӜb|QC %vkͦ'2("38D0)tr8*=D jA,J5C=>K+vxL M.2mq3_6G]}o C3to*]I=1|3-jHac_ReFcV+0KZrKj_5A0?r/",=Dk 3}B!U=D ON0{h&MZOb)= d2ުWC d/aUv"ːSXaCgdrfY/l8R*FtqXOp@A1(~ R;R:}rv-͖|};g(wP?V O&=&׍"O?JE2rc+>0CFO+uΣ==j -@Z*9:3دNZuxɀ*K -&KPiPbPNN{r~blcEojhEێC=dOР&Fx5} 1av"ou+x;a("D|L [{c,#$썾7 h QudQ8rP~4[§Y.+:=c|,l~|j(oF`Ò5<κK?=KҴ9ˠ y,կmǮu& [ PRS4N2d/ܶǕק] Shu8!wKJ/OrԲ*ixn]cg;/ tZSS$H~^fc!rV~ ¸k"H'Pm0 ^GFkD#Jn8LûtDlۿZ{aC]BI4mmIA4B:U-RODrUǑ+?4]ЖwJ6np)'JC Csb`WKeN}m)[iӈTߏ".W㞸YH@Օ쭺jo9msI~Ry)wx%4Kbț/=za @>̉G t!r_V>g@<(N'Ai\&kJSշD0."kJbҫY޽Ιu-x9MU@rg pa~c!mޓ1 JHba. Z-y\-GFR׌uAϺ} 1z6z 3,ـn}\Lx G}Whq6mP[Χ5xF{)hU`o[Q̑፤m?шNnhꑤ@@fp o+.0yK{@0 4?m% 5+hjm;гl:++.*)O/!X: 8FJqT$ξ@;kc_-uu1} Bԓ|˴g3&o '@C/S)@3hyՋlD͂6hW71橎zd"wZ x`vˉ]D~+.tQ^tgY'IbRZckD?kxj!˃KԌ2Y6]'|KZX[Mv2]ci,HLr{cP_H X#\6HSqC鑚^cfYOu ѤeD%o%󰏵 Mɠ|knWńqVUΆ wƝaɜbSu|nݟ@gq.eΓHxeP)ZL@O-zMbak 9w-e7py_1I '{TDUxj:7ײ@ .!-5ez -\l<,E&+|^ V Y}4#HΚKVujIW<ڱNxkBKN{2VxtO¾@zW`wghD\Dp>Oerur+[O>SqES")3+!9YS@ aޜI ?P^?@99\ -mkvtԖ"/'ҐC!l"9 ^96~pfpY(ncZ2ź_f pR#>ұmg)`-o ˔x8LʑYrK0!zAf+#[If7 1_85, X5VgQ"Ph"i`rWOnJEaqdovڗ|Z pƼz܈|$g"F%A/YoSFa扅`$[a7QbK-ly/N!#;EL岙z":c a nct^U h&L6Id'A$Ǝ\:9 AkB_d/nEV̂sM; =S㷈bǕW|PIF<دQXxkV{R7!\: ĞZR3anE?BG1~_@ vkɰ]J"81YtED^tc8ǀ=L3}'x=qWQZ:za`}{ږꠣ/u'l%sRFן3g!ʼlT{;tR¢wxAgX9U.U14αTR?Kc8GC E4Zk PQ}și1ef7I;f6A򹘮}WT-I]oQZZ‰O "|j/]G[O<76=3/ =2"o*$Yfgx>-q"T+cR\߆uNpҜtYWB6GqB ) DP,o,(_mEM"l|Ytcbc\0{6`]?+Ȕt)+:_4+yF8;<<6à94:E9V'k\ +do_տ\Ţڹ 3[j6V3x7Ҙ0 P~Djq.J3 .=(yYx0nvЦ#O.6X›7uSVt+ {uc p6є$Q?I_i՗*6xN\8׉r2bg暟T7!p޵._93LI_7,sdw7re&oeնЪδCGTa\N6cVB|҅Uh*:Vba܏apCRA;s %2k-ep+ ؙ|I-ocE)đgu}UȭAg\=AXv#^U YF' ҧ` N~0=0<*NM$fqO_`ŪXG>8a? VRw!<~9ښqg=]YC@'\v&wOa >L|G71vILUUԤ\b .RJVpJvg Ȑi]N)u2*49vbgLa :WH YQuzdڼtP ¯e5/r\\咫EW[r lo]z#0O=dw#) a4tzU^пNAeV7ր|M$FtKqiAэ\MOq%Hp|*U;~R$_W$A k:hЃ_^^L tM'mfǀ=E}NJfArW> e|ه\ok=hE|]1_Ɨ%#%|.ڦ1F}kO"ƴ oKl־ޠ`mSӻ_?=9\!K&90wg)jPjNC9D8M_0Xr!X q06QԿHET;F QKi&EA(՛6$$߳8OLxkNԸ?D=ă`uу>8^XaVQ!=jKkqHߪrY;5a #''|oq0 w*b!u~or R^E!I Y]nu`ML^0U\>j<D5gϜ닣pDcW2a Դ6~|c<_ag޺x. %t<ǿtKsA}lUuD 'UYG/ݓS9Lt(mRmElXPFْiǡGg DG?#Z͋%ټ,&׿$|=KlgW*=B6"+%fVʈM*Rtmp7Y|*?3)zzz)V͹Gf]}MsH uBg:bPuۘ|NEgq^(dnQ֟4"Γ79o 3{P0Ŧ~s_+-s8M5J#A\Ί4 >:*$وe{/DꎻG}; $<#fэ:l+BQ%&v ኴ9DwrPxW*P^}uvE4zK,|{jC;p"G܈hXG" #/BE+vlAOzDE61Niy8OسH]1֜ -1+F'~z<>.B|tQӻ9jDOhlD7iʦk&dvq8_n},.,s2~Hf8umR|{%EYkBqFfyZau{Kڄ{s9v\V^17X`z7o&ZEt[DvQqU8^7f*Ӿ:*>4)(x7'+,q9M`-U夆V_rN:GqǘWwL!I:h!crVca&Vç,vFv-]r@B>i^x3t76~sLȰ ֥K)`qKk7 3݅AKW̶l. |~pg$ʠ4vϲ. S14"YR+Ⱥ'^aveDe>6 r~(:,eHW-g.9Hдit?_G[b!TfU[]mŪCy>,_}<,Oac&:L".rA*wnVJJccޝHbKgrQ:fJ]! xٳdUVxR񝘘F$A19܁5㥚Ww9wA}㴎}j'8 "R𼑚E%`ߢG>@̤J5kmz7~MLqvf<{էlЉ]W(Ȳ=s!D o5\$ی#Faivtme^AӲb?*يMVWoZ֚~;ӵ;B^K+'/m^qU8 =ITzenRٔX8.usy]z'FVF| HSkl |6'j9qHRA='&%A_#L\dE]m!v_F%ah@ʸ.XoQ| Z"tnk"O͚o~Zw׺ٟ}xIU[՞!ZX&M `0vρ ([zhi3ªc@nS7rθF 5:EA:lP7ja%=  hQm:7H*fzA ,>5)8kk*a%өj;j^+'E| mnHCnqZN?ndk F"mLÌp[KuG+4~_2օT!G~G=e֖G>wJh`uQ !(lz퀄NIg  4K -m0f'_f'aWH"5M&զ(!>NVoyllʫcr\\]z33SS⋔EY/nd2sZmF »1ȞT7:fyU ܆F fm.0j0ܲYkqȧSwB,zE#,Pb ]^,ޙQM}!XwFg;Rz#!EJ>|^``/ӄ,ASG4ɴ R $2ʸ}_SM 0e8`^6oZ1{sAAݲ FզBPrӊBF?}TEz48t@1r(nV`k7Rg,lkD9E W3"!V7:fB{7Jl`qv"ToF''Px)@vǽ>cMX(R%%u 7#Ϲ_2a7xN mvw~(S&5Ot)sVc3>o!Wݤ fP,Jvڭ.|Ȃt=;{AL'=ՋIPHUf'(BWӛf8ҤIEek4 s[$  zNhK,qQg<ecQs|#bw:i+eNo+(a,JoLAgs9B7cFI,=ׇqYA5Z XV$t;T/4 \竨G1`Sd]Lx:۞0bo>E ܍/xL,-ج!U'g%T-@}R&ݍ? xto??)4T͖8,FC5Tf.^eSm0bge0'7 A#y kR=#LdʹK;`4,OSsJFǰ nTio7v[wd}txv4& aٕ*V/2?ڟةx~?׳i (:n+U' Pۭ_(<Qa Y2wO7&NO2/\8,gQv v_%ߠrڜO0>mlŢX!TC՚k_ !s fц#9LY8de,)X!t ~hX)`\!mB 6[cS3^U4|U X Y9l흽 =gغ}`fiɒ#SD' m YkT+"@?#E[_FM1$A7NW"v mAw,>?/L}f}to'[0;$'-t"*8)qIV~;;>{yce ~#: 4'q^h[vGdE=rU{P bs_>|dϺMk;/[w\zFW{\eb?LAa\17>gk8QSz'; !$hH$x_Dtgp#+:Nyf)הe͞hrd0 /jQfa@UNTD@[* 6>ooLN=kvj1b>Xɶh`xDzI9D63[f.Q&?sU 魎D ųh9h˝Ha"rw| D/#y7gܼLKk$B1U ͝x&虥f19*{*{!џseY/nF@!k1y,qkK쭧]BD7`&*iH0?ae:^q$tC9Y6,p+Ց.A_Y=[9F-LJ,FJ~M m1bitaRXl,~[#"uU r~beI:6VpјKW~H!CuoJ&J[/Q2m1fڦEQ,Rօ;A $&1=/2;eRCZԐ>>y_򒃵*'hQ˙v{'-. ?9Vh5iZlrbK7&!֗o"2w1y^J-zi9#d"³PRrY$V]ؕ} >Yk/=݉jɃ?|rMʠ*`Mar / -*۝憟[p'es_}zܿ1F^j;гDy>k +vz&%GHUO2GN,Tnx>"a[OȞ\褀LkCg_ U'1.b 5|6UP³kz-WcG"f¿&LAg?yU`P:IB+>.#޻!0 @SM*g_ +'q|_QTIlYS:S,Tg(Lp 4@\lT#V K#L޹&[[C>u)>9"2m?FCd}6h%H嘧 6&z+VU22ELUQ2 cj3%߶ϓ IL?\j"ʓM.!,ks'HW[YB)ȳED;(L: a,FǙƉ0ljeK" J},?"NS?O,Jd@8_؇cdq 0F{UABSZNbN9Y5d ϺR4`gTsQV & KFu:1{ IOÜݫ| W2m4ymR2 Cxpa$\¨s9p|20‹ W87 #P] g)_ט12[̺DV'J%?*zVG/!)) ,,7ޝ:gv|K\zy(L?ᚪ># aoOcw1mm֝P.&!n w+pL" [;%uM9`Jի@#j30hP'5wV?D$*=O*֚,^危B&Q1MT?V65 𢰍 ＆ߢkn;3yԿ iwsYAt?E6\yJ;#Ф}0UgiY>fNa7;m= ɶ^^װMtW}A|=iJI!xSNCbV 㘥Gnww_%=0iuK:B!;L(t2/SZ9F3":V{yi5~jWO#vVQ[Jnep{#q)5iRb{:7 1W/%N`KMi$hN<>QV@7LIQE7l֠qk'n/9 8ht7>䚬1D$~힤}ڣqK6bV8ْQ )aPOA?}zxHQ ߞETdPjk=}I3/8'"hޑge }XS'5bnDEvriӇzv5RI @m7 %c HwƟT7 E"r;VrIx Ho]7q$x*x72s!4, <*ĈM,u ]2uHJ:'f|22' oSeX:&l(., Xށ4&ِ*lK@b6 {KIRy, 7 >qvY#f3,_eo[7L ޏ|i+M>18Y ?|9rRE#G1yNR3+4(#nLHVDB g7Tamr*zlHM]QX?P ؞=$qFE⡛PrJ\i"y/SerVI, *Ļ L4 Hǃ#12lם.j>QghJ}q<D8TQꡆuoH qq8Yc⭹!^v렓)u3" =sB?n|~݃?N!gA?svŽu%Vzb}>W #ܖAKi̊_2b+>TGt+"BH1LvW bG[iĪX2, =c &2%4wmf,͖ōblQk8җf qL:gҩ_^+$_aJ.8}F>pիld6TW7V 1^q:myM\%`j:^01ÇxPBu? Z$(DO?뙕{^@qپEJq*вoC7P0!=1洊phn{d`b ٢ M?P:qry"k(x%c2?h, uo6wət3kQ#p#/%j6 =d.(Pn5IvF'Sj&u pI2d>5qSRtչD b,q" p\闳1u)Lw`^]9WTwI2smM}2:*uoBkmN_l<|-BN3d4 KwEmcA.֨4r,ZкC3WrmAGu3n]d@9L\GyWrL(EY1Mo;l3!u9D,vao &-9X ЃL j TwRssuyY=-[g_;vk)m@ Nq֕,8 v1-X;/Pa0uc䯇7w|&\A{-oUMZJY _ߒeʕeC|h,.R4b6v'p]aq+ʰ?kNXN_u` ڜ**%4Bܩћd󃃌< EѠX@_|XҥGR`*YZ-D8O~ ٣4g"xӇBN.(` Ƞ=w^ |b:ۮFDv- ];sTK"ޙ0Rȡ.wM"@[Q2d d2=p,a7 9拇qvzjLMƭ:2L?Od vCx mL&~ U+k&&h@B:ojAPۜ@y7d:e?S\xɽhj6ԓ3# -+d(Vqωlx&xt =GN$AEŮC%$>c.f 's.%.g#sz<'26LL2J[~_*BSnj|81$& Ha-+./DD;k/ m@hdIJwNccLxg `:dVsS)*$bdRdvp>\nUG N J7h+nG.Qlq"ae;؝ ,3%| X0>{xw$(_HmWyJPOrWK7*aK􄚼 ~C 2;[*;'*l?`h'Hi*9\Dn$F:SH$D2HЭm"?eCHM >B"T [Hy,=T/'cAHC+3؉4 CzUz9K+S"$Q V`>2!چ2ypMgA^L ݏtچJ0[[~aZ'( _I:ezCC`q-Ŧ;~.Hh&"if$ ;N:.h\ʟ6}OdӝSG ~R",HMo 74lvOOx} כvpݤB)C?CY }QgD;,Q!Ea@mlH8ߦ#FV  Dz99_^N4s$l1,DcRho+m#Bc/P5_m{9-žӘhtL"L3[89#rq&?C@9X4 R#H;J*$ DDi,!_VO`g3 (-3CSWvԼEQJc+5'h^S:_#ia`^:: cx+xur TJqA'nK;)hlJ瞼VUfbBX4.81KzĘcǽgb6zPTRd}eI=MB^O6KxJM˗ %+մfyҭ搒),b$ȵ p\tlU4a0WĕgPL{40(LaB2R"X伛В.~5aW~X{=;mk}\k^sՁkc>6ńX;mmOO#}f];PhyN0P,r7 i;bP۽yJT1  Y3Y,^0󧻗N w1  ' X,OS_uwcT58ǼJĦ;S9PG-S¸2]솵F&ռFpyR8݆3)"onoDq>Rwz\uΐn=m7C/4H@pw"M C߇ZA&9.ϋ0΃uc- jБNlj:VٽpPQwڀAj/Ꝍ{Ea3[oh~I{g=r2iwMvrWAQDZ_Hk%خdIaW: }g(kVd|˸#ZndVz4͖2 xbA5/vfG{YU<&Bb|%p6* ~OQM7AzBGh G&,Yyw0 P'Rz˾|%u%j,аLr&7A:_X?vtt ,GMiP/- |n\N}Ԯ?pɓ8vu0ƚvLl̅ŲeQ񩿋wjP>u;̠<דtKZ'0ڻdǩ!)~$!3^x}㒤3pPk8Fyv(6NΘesiZGWTǣ6d4N2 ʺ i*u$H(mC mYbު[2˞a)>ݳfsKؚaI pE3k1KZFK3ˀ!( |]'UH+BNQW aq+&AZJ{[HOrit.)#f1hիeIZS.~8d vF"^v޻K&l}HD>ښP M> VwM,g2Wƭˡ@ MC$$B ƑW SUW9 5Ѵ1o ֣ڹeiϖV3spemi8ނ\zl^ e( #"L 捝sz!}GoYugkGW ǃymRP;dyD~$3| a:3%hsr%\C Cܭ:"ܣYS+j:w.#;oY8Ɯ՞P:`u*yS!3g,M\"f$J-m<a, ][Rj)&;q@I CG1SE_]VA~E@IR"oowdM{ ~ ?c3Ώpo+xbq#Y#׹% ں\5kd|Ęz ?dؼd㉧Kp^tG?κSktr}VRs%*=0Ӆ* , f:aZNm{Px @JG}t{R&gRO p6IXrƶ~Ϋ]ַY؝=O_6-p{C)j6κ2;8I Dt'?Lb3K십t ^gߡw'@E߹Ɯۿ6~KdϯfJ2*}bk]e7H { U+3k1 V0: TkKkhp&Jr[!8$p|Q*˕//g6z&ZT+VS0 ?pML !Cbjl͐¿`D%xJ,;?+wc-!#V ?Ub>7s"Ru7(c/+Z75g|Pi`@1VBa)Ryk,LeKȧ# .@[3~$JDshXK&{`̡ZZΉh3)6ؠp44\9Ҟ;k]̙@ nrWb:$p5cK5>C#2`i˙x*c[_p(^is"1xUn8Nkj|˪t. 2pЖBZ/B>r4K碾7&c6[bx=%a6fmϘE-mV.``sFDITc(?Y:t !A?72|wt77~ڎV$ 6%6DmOKWx  $`w Uݳu ]3l*@d `K']' V7%Ϥ@W:Pܲ, 46rF.dj KuǟQlRǕ3?u h # RHӂ~i7c;j4~Gs J~A"|سwoYOw6Y򯾤F;'{M:XIg?!`΂Af;TQ[XV Dcf&e}VjjW(Uo>wcEDI }}+pujM@A%?CUذ<*M7* .lT tMX$ucPФ0<mm~iIVx3`t|w]q`:vBos}^k9#|`|vVl r#XE(F89h D5t̑6ߋJ8z‡C I4mf?Jsu RDDaM> EIa19fN4~̑Nڴ.cȦi'e%KAI*$T@W_ C2p2vDCnj_RPɊV=t=#~ F:i 4ĉJn(X+M1÷~yM3K>PϕCiV,6 p=",q&We5^/]+d@Kpe56Ab)ݬr{Vi+7{mmM+z]_f)3ePP )Pʍ6d?paNN]@ȈڬO) <0s)6dFt^ o8JKLO]ޯsΠ{C/ۆOT-i"aى';MXr?,Qe3޻T R ũy$bś'WjwSڟ_p5ˊ8%1A/>u>K`₊ǃ k . t/6PMv8QY[B PtYG SˆKdFH>½lTjӯyJl~2ɔ:mvoCrbوltQtM. ZMlq c/.~Ȭ3 qF'6ᶼAʮ3KrFiav+(;K2*ź(#z+TNpC9f䪄HLU<2tg꣉SmzTk~vr#"1Ӈ~gYe懈 'a^FL49 %@6!0m=;L2Ӟoȯ ,{>Qe+rXqXGYCkzVvCEy-mp35bn,BIYP ,\>o#d员v`*p8SɯLMEj-ӲĒS!1+/sn5A(^z")"2H{e碪7шGI]9$ 2 1jm-gRi%lp4|%vѝBmG]c/n-t(P at3Ԫc33)8IXn^itTin]/cܰ+">#T %Q0^u-qfRՍDtLTnp>ejHQItC;pt! c(^uKgGlcaXY3r.48(L\"u˕j!p4`-|_24"r_fl3lrz ]48OZzyÀ1Qi+|J7Br瞙z@1k[)KzR\ 8Bfꄔn;]Ye,\!XwI>kR y&#bolk{t#(ϸ)hn`ʎ sMkjeU*~10,\ ʁRԂp(z/aɕi%݇nD v(Nq]4GmfE_4s(60h|2Tlxs$; # B!blI)σ/;сczMާnONbW<ow7yzEK4k -nAu 8#pv#&R`1rKMTw2)!o..2Lt ʢ!R7rY|?R*߇7D5ԨE=)TpØx +5NC]7.dَ*1j^D["ye!{x)7BwSAם['[Еͷ|WTҥO4L#[t3'&a8Jp5C=Ҳ"n@) spm4%[ެ@myDW)!t,am;;\zȒƒuU޹uAiT{lNWC'%|žI4Z[  %vޖAʼQ;zL /`Ch餡+L%9FQ׷o.է),=O"-G?x n<r?/bʔXtRa_v[pDLrhA| sHgY|!Y :ڑ"I/Kɦ)ٙ T+g,?_X]?H3Ap7ӂigyq (6C| Ryt ڽwz4 }n﨨 >reٖLH,%  RHv*3m~΄釗~d901pd;\sU%?x:;LTTf j۴([IA!z~C%UbcØ]D`}?.Z%8HZ8T|sQR})`@*+^ ROTmzs:k;%/BX{FD]e K8l AjBGrT】5()1_ekgwRj+g!*O<\uuO`}-f܍.ڱb:PM1J )Wva%_ÑdӟBr"MsqKs d}$yC0@>x=!J3<|lR i*/XzAX:Zk@3 :,,/%m6}ϷXue Cp?дQ'Ҷr; 'BֶQkUޮ#ul.PЯ;$Pڄv㯵IZ-.&O^J#"Y03ÀYp;\;\ֱFW:]ǁzB\7E-VFEz8zҝ}̏W+;Agkfӿ~rN|jG5VA)ÇϰIs!and54 9I@OiNШ ^!Q໻g\gAЈLփX` !6XT͠xxEvH͚+_/  L|5V Gdpg+O*{PlDR`"Zj-*qH E3AmEޘml;*O_kJ#&\gبPsC\4'd$Ɂ4x}Be.ӳ!pNe0^Hf}'ś6qm`lJ,2'<(ރ`đW5C~sD-(S6c |t}xP=%=S?6av <}D$ѓG9YmDV`,.=Pg^:,(}͉4M"w>p+nqgKǿZS\n622s+tSx7N}([OHY S#0ߛ2 ۿH wNʋe cEL麲n-Ǿ k|/ 5yNZ^9"3B8;^C4f4)a&p#CwaC:d4zB2MHQ:m4Dm2F&#_AlȫЈbt8a-v~j i l`AnMވ= k/ˑʧtxsq5B)vHw]w.sT6M<.jVsέ}-e zYD|w b#uM2.)Zf t?-ߗoJ^D2 1QZt I_,,)  , &?1Y=Q^ !X,[; 3RQ!!m!R/I⯺rh3P>XpY<>:xaqm@+"!I[ub<#SL'B7dek'Py*։n%M/2@⫩tҵaBDRyfw'g; U*pP!> V2#?w' zJY,v{!KJd(v&29)az辞W)'$A];h2e-oP+lx nB6DZe6rЄ䤆-c`XsMGc2; |fl!hq& Lm6xٯ2j{٘krl+En9r1kC Qk N9v&'du`B/Z@Y5[T(}*gax WAos,$O^vדzHj):p5}m :Dw? ,CpZds)[0:|& 1R3NHy~Kڨº 0_̫`-HOj˽cnxvG'R`3*VmPHzqNd>29?&ʧiOY1HvsEdd.$`zBo'` tAgb'+Axk bQZpR2V}z|P\13;Vw-`22+=َni.(Qy8КUnaEZCW dW4w;}3Hf-f>j Wy(τc=^C{޿m(.p٣0Pg0LjMJK{JĽr:ZJ(7*4É]il}+2j6Gb=E $C`n]DdPdžJӗ}-,v!u)e )_U ժ ӹqQqi$2ey?gj^5,]MZ:5 ؛<<]ڈb ֗o]y~O#d*` hx}hnp먴f>=]֢gc*[:A^!Ӕ$ i;ݲ$j%:. '#3ǝqM_YT*uh-Lҟ;S;:D}4M`kpY%?R#sO\|v#}LniDB*L+]{u]|M a{]\ët4&-H?0ak d]:.ҟ3Nr? % HK.ΛW7"'WHoK'֤w18jOhFbDBb4 ߸k`Ҡ*O dC-pn`eT->?xrbS+,̪1߷6$Ω=5\\׶2u$tEgcb4OzPadN~+~:R>*(ʹ-ծ=*#ոJ!P{r~J"y7H.@ FA$ز:Tr3_bl3]xWyn.$0eb| -"k(Z|?Q˸'#\Dyl:7r]@.FSjcp80[>MViXZ/Q[=QVL;6d&Ap5EׂNN+8E^; omC ngtJo8ϵw +-(P߾Y_][vj3#XX8E7;fKxFA;YQڗ.2= LYjP?TDЅlsVgo'Bb `)dNۧq9\ID}11"`4 0h91?=HGprRnQRM}kHyfz]a/*"@"Bn+0;)x8 |vݪ. H1KbQ]g~3Cd1ęl?KW-׮}`5F~+tO_" 5Z2$)VpR;WeXBd}3ɋQR)d3~eF:o޹?)JO fqCZ#0߬ifJShκԆ5 o xi&ōSkX4`|\b+WF/| S169B,jj z,Yw Qp n_ONՂ7QIJk6UճVgxt(&Xx vV >{R,gb͇xKCDt#^.f Qɘ& n!1zT%W&-9$( Q׿@y 4U-}OhLh95`t9o}\_Ğ-H 9eo}y8q81l_;vM)_u=/7f>)u*bfɬnՀ{VM7ZCs fvmAE[nbv(DPkL*U|}I?ҘA[$ ڕLXer~I~%yFx$z8V>%dYv:(HNŰ6-|8hc(׌TEV3)jnS:i|~})X@M:q/1ROk4J ̱L Ià~=PBjaϞRl }f8 lWO}'ua$4S釽b;>rű}n]zS$ca'qǺDث[x?t }_|? x8wm'VH$Ň2!+&HxDTެmhǭ!qcd<ۏQ.3:OoƮ'$CGlql"m_Z792MUbho^z9Cv05]d9UIiQHRz?*A=,h ,lTwzg~ҷًv} yWZK>{LGEG d qCMlRԳ+rad_1o eLF1%Ru 7}uUaBw8`jjHvs2g| Mƽ~TtI#)PPu d5'P^φ n\5!@9뿯 6DNNU{_C;hn@+kRn⻵A /3Q"q.)\@"J'q.W:_T$=Ix/I''`xUuVYz _y͕*3,KD }01.Egl]=^bۀYtT;ɏ " ~y̠Oc!Va0avpM!cNP#CLLg(8&w W(5O`):1b: 7騏F=I8d9GA3!s,\qZK*KX@KwǮ۞!$1$KVm WGwR] fnl'&18S]aFR9ɠ(/ٿA"a9TN-d01G 8iCgXWcN0doC/'fS.^Lo{>mG٣FίBvf@j#2""/QtPjP`sÚL,8iY݋w'*M`fr5Of1IZ 撍&{.W-zO@s;=lj;_kvܩS(syO./d&{vDu]6b`tأHb|}+y ׫$~1Ӿ0]E[ 0G; 4rK:) 6_\yF)u%0N^48skig` {ό : jhԮiy8I:\rrhXy?ӎ!):FWyfsEAkS6 6Dn , >SmbCqt5 b,&Pvu`ܙQO 炲D,fԟ2 fڠnDj9`s0Ff5iYP f/e抭kG êAq|>^4U ~?H*cr!׭| DCFgĠ6cp+)հBgJPO]` Fat@Tj`;tI~"DZCnrJQ9ɵeH ,jU`GMBH\s21bٵrJ]YA4ꩽ™ѰM]v 5%Ov=+lG]2&X!"TgRg}mS%;':m'ӏhtm;9CB6ܨGLԔ$d>;ǝwht}?Se`y]Fx'Qgh<3(KJ?YpQ NUcDMġzlU(+ꖆGMln0&'TՏA vG~ nFe!re%>@-M3_YS3FIX}iτyU/^7K&ϥzT#_vu0BU$+Xɽ+Aw!cfcOY ي+/XӜ9۶zy,%1_fʹdv]#ӭyvtP/{!h>* BՅ)0ԻhY!66rO.xݱcjefyH ;DJ%"mE㞄NAfHřyZ,lij۳`%c3[:'!Tu(Lj>~-:ݤpo~v9$p.hߪ)88x??oEbwG=iqW5\mCheԕ) ݱ~[ߔ""qN*ǗZnwI| #;&v"Y񵄬r=3S,~?p4)z\bSQ'BD+;h| 6Zo9q+UtG;"'|Ҙ+Qpn}e3AÐL&W'!{Woy} %Sƴʒhlf?^~7H-_\a}A;iB-@O/|ګ }ܗ9Bh̄!u\gĈĵ T3ݵ.'bnt9z^8 ulj!#5jz'wL*g*bH KӲ#G?snFY-p"-XRW Xd1dnp u pe('(ӊɦG0w^i r UZIP HApnŒ MLIr<82-+ z8tNr&}i!7dLJCˏgYD*˜ Cj_: -#ޟ=+H_ BTL0,'"W{^t0FҤ#=~%Se5vgV$Sg%/` {odY @Ma"&sR-L:ޓ?s$&ۿ1k>HCo6Q=ğ'92Nԉן+>pX*nqd%N̦ORAroQ(M&.|Qyqꪋz {Cp m;Z~Rmx$58hBߒkߩq^VPxa%![rQTc33}=#X !S iiH(rPA>O]ܴ/GWL*wCU{!M]Q2ybmTqg5'3B ~ (SC|X 80l "'Gʅd* }&`0׷*=aU"^"/Ӣl6Q&~Opg|^2ZHp5f٬BL@<3=$uPu)EU<g @M b+!Wf㠉udDV:3Owi&UgJqHDOqʌ8c iI*W$=Se,E$}W|[ qqҤ˴"p1݃UaFd5V9qW˾n2gGqQ4K T39Uw] gŶxd%}oN0\&39i;#d[]Єud\FhQR/ChۆPLAj'WWӾC#DΒPCW}RRRG'LP`J=?$ Li7\Ty 9DpSޗnnaPkwlyб)(_~3^b+ř(T `8@Sߢx6?bĢ dRUPk\UlGTQNB*g#73' t"Nq\6ٱ m:?;44{c& aY[\KScuzj+ AW~Q{gqb,|aPq¬A_yd`MRy#)>6KJq"DͨaKE]Z{LoE7CrT``|*HpBk³@i3rz;CR׺sffgKuSQs_PANUJ_t,Ê*],:M|4ڮ{)E ^CMN<^*i>0u`Go(}Q3Pitzסch56Q<>ti![ (d*M-#A@ut2 qN}WMDiX]Ԁ,ֻ#ݶٚ%_` := 8LUR7Rb)6[8=5 Ͱ!x9J5EkߑRK4J.S&gs`\Dgk'.H5C>]ӝ#߳{¡zFi'vHj,9ghz|&̡z6{F+YUȣ3%"--S/Q4y+S?|ՆT4 vOnw :Qk&/KJb4q!uu44;`f[_F" Ov+6뮰\!:糒ZlS 8YNkӻMRumBr >^2'T vPsd}#R.=]_I[bٯT-4@@ @6q~!9ݦJIn%^I~Cͬ)6Ȗ0蕘fPYѯA#;su6!@_5$#vafZ)r%wjfY8*K^8oRS +|YWv2&vA#l-ٿwGj5M@zcy/1my2 OѝNOߴ=^,TQG0⟪tp1p^/h3%NfVv{(M/ ؆Ct9`]6Kc62 M}J>Q~>>"He%]] ҋ9~ #Ȉ60A嚒pFYNdBZXWm4D$jCo .aQR;d&mA͞7kgx10}>rҲ6|pN/Q̿> FW'pd7WdeA@LL$uu :a&@_dE7̂g 15?۴RN k;& ,:>d0lz0<9&1ֲTMG V~?>·/1eSkn(x],yQ[h3 onA yn".0foH SM:g;1yf nu,m3Ws [4_V.1܋Fi< rK^NJӉgH1-t-S<}B%amMrΙ{LXE?B ,y.OcJ 2XX%Ԃ꬐5V-㨹h<0z{RUޠKڋO 6 ь_KpQG"<@2oލ{HP88lh!\HXs@Gy5̅m.:נBf8g)m3΃g>k3}z, q(>=v]XaGn1+BK|/n_epHh*ᘂ^Q.WBG13i"0Q~FBwLQ-+nFEr"Ѐ7+B-_&n~4>?uc`yT(}XDj'悠OѝAIfc%eY]]}|dJv0a(O<貾>^5/@OYq~D453ͪe,%^&x3Pv F_sQXYKTQ#jWC9!# 8iN! #0+^ XI gxXb8sk:׵D PXqzLM^ z_=SYȯwΚNgcqzBiprh v8fN#T/N*IfV4QI_ I죯{#0^dr.XE)˫Y"='l d?7&>WU5\29E{Y'kX9LSwL+OLw>SyuK Nր|u^=$d&40X5kS^~Q?_ufaKy6uݵkVtSf]A$0Bre=(a&#OGf LPJK(mf+trfqkψM `\5S5UV4F!EZ07O=n?7HH;;{nh}dF -˕ΐOo19B1 9e3cu&^%ȑ u/G^gݦ m>Le*llsDj$+{,t=&Ɍ{.iksG$YooF[s;5UsX#3 ҃vdv{o\o2#7a@8}%~ 3>B9XBLjoz e#.n39mx?d6(aNLho3y.XGy |pQCӟAqa,Q#ze38m٨!;F.󒍄Zfomm .P8Ր޷<74y4]C kDn ecP9`Jc 'hZ LdlY 2{䰄a6M8!)>#|;ؖKXNHg)`t^ OHj 颡izcCx;RcdrԀdgAׯTyR= +ޝ҉-N`4g \JEW(~Ejb$TSYc&o.'m+Gtyfz]&ks sx9uvDZ11e۪[t0$xj `/G+?Ui׏,jԮqIiB4|V4WnPci(]"ﺄm9Vy[Osؘ1aˑB8 R: N;r!ܡet?`f=?yVi&^5[NlқH58!٦;RnG:c蜽5G\C4lp3mP:IYvi}--9 _3qbJ׍\?1Yk3;n*I֙ZKCPMHыft|#.Yj/rt:yH!UDYAC eX/xr˪ঘ5_;9j ،Fh@ ju4fPrPrgŢ:ld1YA'E>Qr ۄ?Oݱ]Zᰣpx JBXN2[Y\ɪ~/ Ǝg یH| "%nWi F ݯgpSgGd(MrRqy:4M@%vH=Q]xX;{5١4<5\%[X3?`QBJ)u;Wpu*,@`*2l f97e~N|Rp/{FXI i{,2K[*i\~c1!4\YI|y}eT1 +ŘY d!6?uw;RyΈw\$Q$Ry1|zFbw lZ-R,PI9G@q\=DgKr5KJ>lgu৲V $Pdߧio*М%!8t>ꍱS=?|]: ΢#~3x=]Uj3ਖ਼ u{FhXL9WøUU Oэ3)?D'F?M3gR(LUh۳X:!W`gFz ;A}FIVͷҬU"?ʟƕ fC$o*.#ge)l.s̱>=v!Rc#uW,!;vr̦ep(m~6nO$i0ioE#j( {YYL&r:!/| VB' f˙8K-:8d ~}GEyk-~sd:h~ܒFa!곓Ke }bHk"ONaݒl0b:'C㲧mZ2].P2Gǂ,?oIyTyM9%BQY4_Bh}9 dȥm!3',;4%޴=p*Qet$||Ѵ ױ~մxX%ϿL] O#l~ɿNI?Um#;!TffҳWp*Aʱ"'{po4teBKg:jSI*D;y߈lxuG;Wdd5+FX犉ARVL[P[S}3(e^SDWl>sKLo-]]^ ];v&7/qDr퉶nud:P }`o \;IC x[-휤Ot\ݚE{M_(:잃KJ I>P]y3gP=;y"SʄTӋzSj%L;j)ov6 /vrsޓIi /E:`|pX,38#ɶ%grT  ~qpK Ջlj^O ʤ ltjk4漪տk:6Fq,#VOw Ь8 ٥EP>QGWG#/ 4Ϊ6:xU#Y[[_,Xz?:ޣIw訦ȂOn;nGã)|OGM|1g%8"yE!VhIaRc߂m EKB.w[T]Qeܼ$JQ`D7K&]]t|qTR&ȴX!)];@!?*=h G$O9?ϟtTdg屿@y;_r4g1? QJUr(!{<8X㳔 (Gay08k |9medf^ j?1agjTA7i[[j}cڴ:t=h~|43_rktz&8}܆Oi05eH G>^ b3B GY_gN~E]/sQ0t:j{L}tXW~ܰiͣOF1ƙ̰:$eE@p.7;@$@_&]|oD\ݟ:4AԶ'Qj'4#A\\h lVb j|yn,GbkERq2H2p!:dU>bw-^#W%8.Uӗk[H&8ݻspQLx tHF҄(F\|Od`} TXI=F#am5Cj5Gt1+gEx۝a@=ڍ@_m쿶v%Ǎn/^sJtCe,+6:4g 1a_AOʸ;f$`w$*(>QnAּ8ӳ3y,6qD02锔P)bMv`ibYPOO]hЎbsh`I/<儯=+:܊jC/\9]Iʓ7 شخ(TU|&,^m3m]Sp!NW.Cu— DE.fcYw>(M!*2]u*F2V=` t; FR_U5Ƚy$uy6:vI\J]P{^Ul|p͏z׬F0N8Oe'Rl[R9{jJK%L=STo1 YZ~G9OteOJ;79{=0&Q.Mn0i]<;U¥C|/n8:ՈYj}Ff n^:c1iZlqmuuFw𒠽{cyf R\L5Z`e99gLW(텗,֏IF`Gt?ٌ3[)l>.7R fkz`zV1h$[Z'@)9Ɛq:Ŀ>g-cN4=ܬuTkshbdQ~LwWs0L>5g `y}(EiBڂz :k{X?qA Ô` ݸJX"F'c7 <^R';7Y6U暨ە3ЋY#]yP*e [a3}Qn^$v3~号'UE^;]f}:B}\c|!VnhYp,F 6E04~zFZGnk܂׶E~Zbp$Y)A(KϐÀ0ڸ`s\o \4G2I3~@Db` c8+=GB;X.c?vsqsqM.e{b Gm5akЁ?mdW+j6篂P_gK~5H<:eaJ:a0߶ _H[oT" % I^586p)D ґ♖uA-eb4HSGej~(2\rp8jS@gEت'W!ؽ $k/[ڸU $jJ- i3:nU>ɱx?i#/yW=@91VBfh 6jץeM5Mt>iJîzZ'LOѩ-Pږξ"؋sC+)GM)Rߪz0)'>\7aݎZTD!g-UPCFU6}de(KM?ݗP٤pͫyW ;ҕs~&'StQq9>B;9&6UQ3.U#8Mr(!( I bs(sQF}y'[@0yAL0 ZKw̔''|֨+,~ _HZF)MzPc]`~$KFҤN 78Z݁.䆶[JNLi2…qocj~_na,嬺ܳa@O=n*k[,.1T™vD[bT7*Y/=xˣk~Ħ۸4^| >WԏGy@Aoߓ HAq{|T/o20B^-0(m~_Ӌ :32Kߞ6@P\ 8 W\b]zhHD*pwbOGoHHQ}; < %o;@\1A.y,):=5k)S*aT "nw/M&ES` i&qYCѸ?̡+(( .a G*$c(L!7?d-][CǸsy cSEv4IcJj+Rx@p偟 c#@/\OZ9*iڻ'S4K\{ZT@(Ͽ!o@F|vob˫nq uО.uoBXw| ɳ^|˵[p♚Xh 5nsb'hTO쮕>&1fumqqZ}~f%+'z7)B5Vա4.y {āNXOIc TѾm$%Ji^9q~3eY\pCf wtA! .@G,|@| |]9ۼ IXB$>fa=w=Hm)VF'/1e[E.gR\rTc'!|s˥ʿTwIWBD'vy9h)}ҘcalFY !cպ[_>J) DxàM40LM' ` >61'<;t z0r:۲4lFѬ$\1 :h #44$Z+( wNc.[V*"A.֙`d}-J6b4 ]NFljVx4N( lmK1s]ÿYhĕh9" O~kDWx1pB#{=a3A6!11ft(ɥ B0u,7SPsNr`)PxvxDNv+H!A` 'nu$6ED\"dYH-vLLCO K$ꨦre\ǰSq4Z jFx6'Li5AVz嬖k'-D>Q틏%$M;]B+<͆`~$ *V6ASI8q"v\S9w<=| l= 친k)*a_RIăOAD3Y/]uxmi3ʏ ޳ê-yrdpcsRv-C n'`Jnp9ró$c|]5HIQ?/v:_B9Py44,+zjMXބoKWFT//$ZAQ뾧4 6q{fA ?8|!ۉR(ɘv@g'DEұt cF\/m`RxU l*2sEqPJXKz[lq/-"GϨƀOO$Q~AeG@ۯHbREOlh*mIV(#t`זQWnҁG/W̸ؠ?vEB㠣VX+GZvVvNGRu8g=ڟ~ܣMP!N<.\Q "3)!R R <%I"ȕ:1%w 8ݙ|kV#un{d&CX &"@܊j4ĥ@ )س~-ns@fOU!I j雰Cvpy:@Ȏ8=B'+["D <R+hyWY*xTVM&>.&!xv<%|0) Z ʔ*TΊa0 2(^B1 XMgAóY^E̴)['\}FdJ8KW"Fl{^ůz0~\|zK;; "edv*Uhy7w`icXzkp[l+{Us7Zd(aTS},.foJqpD^R񡵊[.:'5^mBaɒï@>+u |پn(&uUٞuy5Km lܛPV C6n1;@3!51{R "V49w16 Rɿ-fCdju܅n39`Ũ=׬}K_AN,(P ؄Txp,Jtaߋ8,gmzep}fAaf| z $޸M '`KSZ]K3Gw*P{iRC*Zbd'vՏ]ˈE˚3U|C &H k?gYpG6el"լ+ؼTe\x6rJHXxY|dx iNvޠVf6X#/Qv31% M8aGDìlu=b{"OЕ7[X(1 =C,ixol}vz:RJiv*akz(cU4wz,J `U]eQI PG2z6}KI9s+4N|/jE~_rB,]%4?aߚL$?=Ur!l" rMpXNLvMզ4p#z*kTyA3\H&)b3 &m; \;?58GgQ3j0K1͕PSІ!R[eyU򙖃7ۉ aGmaؙJv]2?b.O@X|*>5ЬgV .xÚ9ᢚtASA)?̣$Ƃ(WߟMzN}ޥz8eʐDF[aQ9Xuq)hmAeWͪoE"ӥV@bdNT਄&xfP*z,\-HަƈkMc٥F 6:ϥ42Qߪ\ ,'r;en ?|mPOҔ'Nw5V[g0{y8K%]++$2= Q7 oA$YDWj wx~> )SIz5_eEbJ&YY$?e};_Mb6L<:_ 1' VKD~,`'{7W Uj`EeE-9cyĄ9uv#7ÿ0&/䮜eB7ÙŸ1Cca=Ch jhGdU8VA0D#[:VKQY' NRr,Ds.r*)G Z7iJOlsMt味k618AWY}&,Ѕl0CHrN"l H:x$lMf 1!N*(υf 1<sEM"T<,̲m P|qܦpl2UkAλ]DBϿp]|%#wk>ݛ0Kn!ӲqϹ?yUhw)J.Wk$v^<Z^#섇FTӎݻ޺ 2K^*-͸,Qxe7q1o#Of _gb;wxB^ o[1X$ z>&2w#ez 3setbLmJH:S?Uȩ̛XZw~t8SxNW^'yI [fS%eJac'2&.ZPt"P)w{RFPJGt >XREY>gU꣠!uY[2S\~tC-;kq(9ʁ;(6x "Bn%Q+9+Ozs<\N5.gߋ{8+J\ .} BBt5OZs.3?(F^f`2!qx kf{ξFu몔b""H+x6Ӭ>ml ]gHc2F-!^sl:Ig@bv%uzoBݥX[ P@64/Bjz?i^n>LO;DQ!]_Ix^]N Wѵ]9IJV a[+~1j{FсzhT,aթ) ((X ƆiD U6/2(tEkNntlaV/a oR::zǹ s`,}oKS-ҒE@agtjYfg]#@e *`iī 6dOP'>R'mh==lBn>fCa2;Kef"AqL@%Rlu-hFŁWE[mvM1~ jdX{֖`(cVLpս:"Kbh{m,߸J-(E_4 vp0vE(=&pl MP6kK? Q?J [_p.4uZ' `qߢOM/R$+'cO@@)54uŐ>Mks{=nZ4%ǹ0=Ge8j\&F׭~?6]7Tb4L`3hzw"M >fkv>v/KRs6&'%.KG/RT+}چ ^Y;ӭ\W%̜B .Q]m@ t: ]Ԩ!+CzO7zjDjժ-B%8! ̭K$̖͒AI;#^>$_a톂RhEQ#T}'%ޓH(bM6JӤ6B?̉emEGЁ 70IEukb`ϱwc%c9}iyJ[ T4 +JдTل)` P(Ue%1$RK3%847pՃQ"ЕmJݜ-eNV;('U*t5 ~ 4~UfI9huM;cwSz(@|-flaEȔKZ$/8nE DtQg!X, N%Wh52,R_zrO|UFQ=5.x- rMd%?2XTK24I{Cд> 9<1+|(2ѸuQɠH]zL:l^ÏF%ׇi!:]q̦Ly})bK*:^+Dh\1_fg߉4!SҺ 3 1pn3}r]:hM(4T;ZSb5=G(L^5P~XLvSv?oh1yeQpy]2Qy;aKA.Heo?a_3 (JđlL s5O1EpT6&?{i8kd~@%+>t } c\Υqe.jwbiI/\γX=6]U5mlm1;Q#ů?c>ãq2U~FWJ~Jd|\eD=.psk=@ByjŸrEg AJF v>ߦӿ^S?x  rdlSH 0^V&gu8_i_8e~6'5wt L@iȩq'Vl"K)aͩ꥟sPQ"~|8FõqnsL 2JR/E6HH!5 ԂXl$v)jH)0`,F5L4|㽆CLC7~:zNY4p~FrMS<^S+ d`ZjFq4ϝ\Hޠ%nlHIDaEeq,P(aOHii"UsºVd#χ]d`7᜝z e?nުcQ\jIUmN6濛ފjsnbEd[AC/A >v'1q~/Aym&!2Vz m&Xڃ?ᅋ9Pz -Tr"ߟ/0>^E ku6jYhΟɗ*k6CIŢo@; tܙ0Ϻ95$=Nbk ;AOtr_+soi)čFmgn>z|@"J (2֩Ošy@!Bx/> OtxB+b`|tiYi7~“T-C6yC- !Y.6>}@q}Ao/y@8V&} 5:hӮ=+owѰh>fr,| T4ô']Ej%gmZx'x ;avM__|MEJx/y\. TGgt|h=mW5˚D7HS@|9,Ojӻ hUVMQL],_`&;Țwc~5^y>+;D{"S\0'zS ;IQ3&g-?Z:^0o\}>ƊFZO[iXaRgdkßOF :6 }59$}k}*rTH/|,.=3]dl`4-儙:3aCݖJ-UAQv0sPoG_4;r.u {h0ݴ%޹Q$Qf<7KO?r.C:nDwEn|i JTUDТ&zR a$'E$&腢K*cu(pEgq5x?,vUMJYo˟YCp,} 6ĸ 5_z~'e'FOvyO?ҡ}U\y&o:9k0bFd/h]zh\*4:pLC>8F(?FO e^'g`9V)NeCo=ma:iOvPD8K@7RtʅlR[6 6ꟍ\a-f)8*p䷘F$lIgo5:| vbj5@L qX~sʣkȑgE8VR7Pܛ8%9Q ۡL7oNֹ0-y^(D&xݠh4*5&S*/[>r~ѲJؗ!Z#PW؁qhЕ?_PԈ} _JYUn<=7 4ІgN'Ήsi\X|WњcU>Ě"'լrB`~cO(@Q;f?={Wnv9z<ŚUs44dk@ŞFÒ,Ŀ7V+ռt:z"$CջS*OmR":ePL2@+:޷\` >~Pv42*VNX*bc[[7{@f~|7RLmqIvGUřoRFIyBgTz'\C)K^+ݤQ]AU6؍s:V7\Lfeߎ*i ?gA=Rn+N^e )|̀=5o1Qh%-`П-=~H4'0fX^dNy%LЀ?Aҭhƞt>#P)e;n.*D%yY+ ]ڋ >D+w`5>j`}8Eݿ ?1Q&W5[<ڟgi52FmcB[geŮ-::(G+Q g{Fs "^ t痉od9 .$[-k2|ԲpEmR/[ -/DR]0ThdRJ;=Fr)\7;B~MVT&rYKRCr?9`+(0ܯ9@e'A r])^EF%m6lu.nyq_^?f3 88ڈ`:D%#cmOeiF!*?tL6+^(A(K {V-ԓZeHU|xf1g䟣{aŒW~S.I b_|2-55|)_2aLR2rϻkq!_:omHl$a E -w[ bXaqW{𽵦:o0 /Vs }4Z5$_ra7\5>~ro^,v}Wȅf\qov Мh= >-]3Mg-Gڴ-%CN[*"z'AWyX Hx+}mƖ2 LXng9ػ<*HCXEChъ**"P ' E*2mh2C 5T%h:e*B!VV#]zx"5wRKKCc'K!I5eKQ8'X(QY⛥>/bJʈ/>#UeX^#屹TZLbtiɽ#,Sso#%lYF\?,#)G1SN? p!ZaH mdpĔfߊz#6[&-qM2Y|ڂG/m5`OXa'i4,xjȫb I3K^@ 5N'O4qЯx2lˌ(7cG=h Nѹ|l^> ,Fϳj?򴪩MO\{B#W|?LW/|hS}~P@pvST.9Z<ï |U-uv축>cV9Һu dPivO6X:SN?u2_Բ%'5#gСօW?S5<)0tnYnfa΄u`1S2@4*?%ȯm ~|mhF˻ܘ^-4TX7 H,İ>]wgk [9^u ?<{ݺǵ@8wդH9_6vnR&EHR];QsKv?2)OFνĴʪ&G՛yּcކ"RY-1& kUlmE}ݏ5Nh2ۿ!\زkpKCAr Vc>C'LHi}) `DLe=R?4¦,[# e~A##s);.^={P0Ck%̙bMHXi^,c˻ 񥧈dWߝ1lY\NJ#yjbanRjdw ѕ˰SNҏuB^CsiCZ/*@۬p(hpGv5AȞ27!!zՃ/0^`fϰAi*pXw0kzp0>*BS_t*z욙/Ū KoFt2ͯRG_zƂ= h3,ⷫQiyJR9[| Ƿ)M cْ @ UکϧO2J +4j7D605\I %Exx1@W=5T >oq2 ;#}fVd)&~@[o*rgSds H8IkAUԇļT0dCJ5O$zqȃY0Ld|#xmS%:)تkH k~6Zm"ڀH[ ;dMv~{%WdmFnHh[j۟+±uF|=_"3 (0h{,l*qYiߟ) u#E 8k^~oU'mbp5A=4/Kr3~0o?9l8qO&fkz𶔲c]ߎ(TRQG}n*S8mf}̓FD]x0@ˬoB\y UҦ */\`u- t=&(Yeeb+-j)Iy׀e_ dXH.p7T{;UWwi[ס{:]ڮT(Q<4fcKN&^~7dJ0:M8AƻV1 Y9Jxq|嬸4Aɞ&JA6g~Y洟V-gGoZbo#7Cְ[;RvЩ] ]u[7oXOһ4fb$RBM-f#2tc o(uI BF BN˹(vAD감^5-4t6E"@zz,6۲T[jPQ;NSthxu 0{n"c )fN/#\J[waDĽ0es~osdY*Z.4qe]j$p16q"kLdZc$ xK?Sd %$幷^7f2Q{ &||BC<pxtGoFL^+IK9.MS{:H1kR\RM+EՒUuwအ\=DGa6Ui~B4Љ9GgЀ+Zt4P@Lsт_'2`MA0/*Zk|e]N.w@n v0K=]ʰd4NL /)]Nx8?TJ:߽JZdžUc qDᅢ|QO.`a:~BCJg=p/,"gItpBLyu*{gFj敏iBJ 䥉uxk)tu!J8 *YE1Ր*,^'8udAͣ,3X:V{nd |~\T_NkVpuʫd<5ȍB9Ifr0ꂣ *_Y2Ⱦ ᰶO5)7nuGwzq*Rdϒ6Lc 7N̋些j} ?^+ya 몍8Z/+s]e]:}ϽAvT*%ahv]ObnqIV6/w Ml*?NFc3I-w#T#S#TjvSZ0˃M&'H%3zV ,p0F8:ZwXTمҺ2zQ*Σ|F2a۹n 27Qqs󹞁d @h4b>E% !Rbj I*}$/O2|jvjvAIJdT>}e|'8-NRqqp}b4PZIe z|1O_Ȍ3τa袒V {-R/dZpڄ: 3!KO0}*]h(sqdsb5H吤J<8hz /*[~Wj9s)2{\XeؘjfKJrlmVe~[qU@մz5@⇯t6k(La !-jlxnL?6EI2u\x~S "r6'8~ҍs҇aM{>T@#ᄙa }mh2&V2l !9S52 Ge 'kz蠵]jX L+Om (ш K_Qkmi.3^09LaKI;=PC;}FʴC"ͣ#%-Jv';T{[Xgjr0Uƻ`7G Y:?Z>Og~<#8)0'+jcWhPEip07[Xʴ7 '?°W&NzVVܧe_ǓDoje2mZ7>t zWw9΀rmxq"PGb,Kt>3qr^jKX̖ ~ ~p'|hl՚U$I=Xw۠-?m /'cTz=ɹ$`X(1(]JSJ7ݻV<)å$c3-1doƀv +T:/0ꏮ# SWQ(N+YdDm$s Nx*+T,C[u0yt0[qR{gP +6VŦ LS.E[H)dA:/W#C;6<ԸW/= p*Ϥ(m _x^1HRkP)[d-O N l[''QpŏEwiXFa]\sG!VVXcIsrq5R`qo=aL/>L~ɉ]j;?٩VaJ[iF9k:RƶG)Epc˻-y=ݵnWQRB_^e_L[-ʞ!KFWJU?QBcAO:`Jyq` ĪS tGz ~{@VOwR9֕A+{jı$ +%x"44쨣(=(c|,zޟ %6ؽJɿͻ;PR5ZEBn t  r %\h ).)BJxI 4ϯQDGS|ƾ顉b3A`J4`WVɪ'Li&=;{RlkotQgyl)vz}Cuǡp8.WdTO]+;3(NQ`KB5ecO3uNvFքsDޟ%bbnK#wKӳS+>IcieQU\PWu:S_D|k)0stN# y[ frI~8o{ſJWЙL0X"jhU%bΈ/e},h PG݁鋅$зxhXf|&~6$bE3 S.}iDoARG'zfHM!KMhld 0E%/1Y,ҷ#`s GaRe z]vt.QBYٯG37JVYG럚xcάuBESPw .PϹ= `'ѵ{Znr ѻ{!R rA?}/R\?t3q7퍺~؛j*fl&N1 Êo6cBq?4VvbgIj&SE}洏> yS+$._8NYѠ\NWNi'~B#h cňE|"@ ӝ2roV%oh{q_yS{dv ڏ,jo1\r3e_P. hPA2)`Ki &x@->>SC%:.͓ 婱~R>&ܓ8qUT$ Uɦ.ijzYGCp- `{f~?M#-~k&~8v n S=q^wBx]5pfNy\F>EWn Cj}/ Y1ֳ䖖>Kh{&ó"#C:Yp T`Qe:EKE<$UwԶ+?!OW?#e2uPtsgJ>E-˘ikt%2;lIR/{l*t&LE |S !$V `*Go0ds 0$Ѱ&.u^gMVkMI>XZN5-Mՠķ!Jc(_} 1 M*/C@,뼆5NC*+v(mc?gP6ȁ Bˬ/_6 yq_JndDH%$a9H<Ά`yas]0'aFPxgږWVC-%[ :[D,5E5 _[ZY$G)G=]nf[_wS%U;# k׍{=w,֞d[n%5$jڣ\jPIVv*V|[݈}=B\P#:qDPSqvU?^hu)7\`ߢZ8.L V,j-uay|ONuj 5ĩSo8Qmac !9on{AԯwmKT,'Q 9,r-7+rH}= " eo EgL߯UJƊ$._:`0.#vVUY91WVQhve rc:\Qr^p\MoA Α;8XqSfkcԤg\f˞]wTD\ 2Ł)![V̳cO2*]9ړ2Pΰ9ށ`cËMѻ1wqOC(w'=C65kP'_r;)tbO+ [ó5q[a'4z|_O% k;9J̀}A4OzlJ!+Ax]Roze ;_ҌpuƏ2D.}Cn¬}dn OG[߰V}PF:uf7:)6t L\AJ'ouKcsvu:DP"ߕ5G bJۈ#qFDZxIDfHe #G}i鞊UR-jufڟH `uTv!P{ *=A,{ r*Ӳ|*5Bf,fAjq'eU9D䨐upe,=dN] ^Jt IhiPT ۧb*5{9x8ȟRX]=A`ȗ5j>u^KEM J8D<XI#0J[jU)Yf;xgQ.tRv ih5e@tF1SwݩKi iE{\cP\ aΰ&+;ٯ(@[x.xpxd:*+=o Y5b=\ SH1UՏX<]MO? 4 "2Q_P1hlp0_{9ITgFBtR*ЍA#Pz$]7Ax]Α31߻=ew_[5JvK0@-c( {:B8 coٍ';޳P#mn%%jG!NUܷ w!#ѝR㿐x%Z2ɤf$^ȯHM"piMtǾ"tO<@1gIc7|˷Fa9vN΄~^9][(aV? PEd0C4~-do&'LYCp湭 +#!J@[cӔ/ԫ&%9rÜjEs.]^y| uem "yӝds (!Z,H?s!bzm̀PHIhP+"Ar5ki?͠e~ּk1GV }Cw Js+a?ƓRi8@/MPVZy$VN$:,=mlM&aRգ[_a,9cntM}Ce;YM,0FՊM~Y~JzޥD;"Dڷf1^%:D ,`dz^T (ݴu>*;Pko)ġo6@[!Y 40.Sf5{3Qn}&r'C,:eĎ]w-U|-Ζ,#X xR2fiX}.*v~$!41wV/:p2LW? AHi"$.`}q?Fj ET"d,?k*{Ȗ|>~1]9|*,QV q,ӕmP_^{zE`#rfvլPanE e6Y-&?cy9Bԓ X rfUON&C̟1uK9(RMtлw֛MDMU[뭚mEskRP8g^rSAwpu|uK7Z uP+[=``(0$(y"]M<ۧiɝ5b2k%bC[uK~qMw 8fA5PoR)4>ˏF߮k!4ٮVNB` :pXޅꏌѧVW2wR۴3ےƒ-ʊ?)BR?xWx72dlHEiWO hô!`Zёv_W>[% \@sj%՛돪x[NFJzںkܟEt|Aίܽ=wo%բr濔:e:nvh۳C\kz8k|5Vt>2$5M#(-,/x́~SyFN}$w_"8*XIޞEBD5т; ͮ%u;C (F<CNL; ?48HVK#yKAj~0654s/q{bo6!`b\`fCu |¡$L`.yUS%Jj$HqȖT]L'mo~ҏQOrxw'8d3뎠x,*#Ft-/ͯsex '{Ÿ0Dh`jm6ݫkCDXC~n# c i]CLNlE?b?.}+2埗3݆ic.!Sʟ-GU8-#F)n=s޹wc 95D2SbQ1zʑEN%LCvG4E@;.%__\4Qq i^3 %XGq PIc-z7wƘEXKqIUSt]O?lu2hfXcғjhV4c$\TDc Q`^tfry$|g0o+i'q:ž+u$+QwMeܿʦ!Cy1Ξ^!Er`O~#ŤJܕ Heobp}ml$&Go!+S Yȅː<s7E>Ugj~{7coįvܙc_zu!sx>Q,c41*VAm0F: J>!_1;PʴdwF8j%ռ'J-FPz2MX_xg >=_" 0np>Ƒ:% Z"=t`d.ցzH%baeOV;w9"ԟ}[v@fK mKs0J!Z0ܮo#cm#3WkED9hO"?WLf}7*\>dp_/͋N~CROv 2֤~Φ}}Jqp͂bIWAYv%m&7l].]P ڎѱOj8+lWؤ|»>*u^| l 'Ma-"!{uQW|#_C#(i~95h QE^X`!%E{6{ugļq󍅋*T|rPE迱VT7qC+5 bIڋV;#^LIm"Jѯʁ&(#ʮP[TϘiu鶝˷DH= ݂Zґ1cϞs\ a8f cGu?G*H› bFt +b4p,&5 x#ܶǴٓWcl9H)ҡn,g2;K/4!ċCQAhNT;|kZM~߉醡Hyys x7Hn~thu^`!j}α+~oOa<奱 xc<6z3 l*)D5eS`Wʩc *vm}ʞ ~ʹv} *ۻV^bw %(-*і〧= % nGx=vѺHIqv[|0S`g7#:w>{ ʸ4¤H |Ng,\n1rWFhcshaut[g&0?Ir(`ܸHյ_5.?eJhCQV:jbK%eB}"%fKd_ZHf8ݩv,EP+FOگ`m,C^ LH[h@vJ4tj/TMrK6E9b`=]glzwIQt&{.j,>+? .?>"u !n i%BI̼=:BXÔ 7u!T%w _@nNy=(JU;fi6.ibn6kZ\C~ۦ?̀>~!rId#*ɆnN+ힴnHȜ-zi˭Eɸ|>x^*h&Y&jԤFh2H[aP`/І j@ $5Ɗ] R >}>PعlsYl_SDjE;9躐TCm`K,p2 $o@ֱKڒh&r..[BSjY53v{˝OIE)^(8p*0ZNyQfeA#gD9E_`2[_Xv<#Aۼ^,dLP f#GL7WJH ;FDL->G lf M(_"gLbC8OF5>[RIb҉=T(!{XqBD)ځLhFi4Ҵ&\:X3B pUZO!Qy5JZnlᶸzD$EE~zJ(y8M!E/zn>mR^otq(}ۭٞ{q$%cN4aA1 2כ{舔8[ z)YUT-kK۟QhºÅؔ[Ӑ\c g߇V 0aS>n%rĤUO?Uc:p),i%KvD9$g_9c96/cެߐyNo-UU}Xy9D_CV[3,.. Bel`:\}䨐 nP  &6Rh>ña֚qǺVzxF3H^ wZ} #cg`^̦,Nټc8o[h! ,,켶]?KX䡹_S! hZa1)spƬTWK-ADH5y{RP յUlNWtܞxKD1O!d%(ô#ݐP., ru7f)C/'T"18Ql &9eU~χv:?ym@v|UIKߐ1*sJ^<Ez:*!fqiphLvl pԖ##lX!;}abn4Z !x#:P[h0vI_GK(}xB̢5498* ]MDA^(ycC"ZSBo˝WUSQ:jU} rhЎJ)Yr3(41ۼ(N 3^eҜ_k a~V[$zVEqVm<&S[Cvr9AˬU@ݬ&4ڽ 20>[AlE/V<~ K23C~adom+Pޱ<:L 'diѕ~.W(U\Ep5Py./o`j;7ݹ_ۇ&Y~+p?szu*,|p֛7T'4'?Rnl/\9 QS_܏k?3E0^ mj ②3gx [2*uIJK/U,]H{, -<Za vwgMkDŃZ٩Y@̓&,Q#P/Ԝ]%m*i07QoQ'(m:ya {g[#:fW/rj4}&g9Ҿ .~ y,A=Ű2@vT)4Z |D:A]PU[pMoc֜I0<5DDx'R Nᾐniw:ip\pG!6pe6,~X7ۻTAߞ#׵JfʏPύn`EU$-E2UW5(8+VSG2i)V?3E}ԙy.\N:FWv8+E*d _Dk╒c0˜'vc乬;/+q[X?uIj!O׋#S`vє!6=,*Иg׳4F8bxP D{^=R4uXfx~hhk< Z&tM8z1'@[:;1h$ӹxbxFȠubgNX&f;.TdBFBR{BōY]vߋj#=P g)ԧEAoZƲMCba,DH^.Z QS ܕjyUigk`b&)[ab3d@;FlH%- MEHwK< zO(H?s*9Y^obb7Ī42  ~EL,DJ)f@Qlzb4Iu^Vwع1*7^!\5ލ/YG`1Z^e,1NbHE~Gvȳxo#$.$U=^F|a rT/`͝ݷ_@D(QOyIRc+}Ln!j4n@Q^Rs緱%\ǃ?zW{~g$~;pBU:خRT_4:uogerUI-Vb$XLCYwn?ïJa&p6bľ#_%ߑO۾W;"(WsqqIk7jmaU"5jk$9Ha'V'7FPb8 X@>wT`,@/nc u:pd7}+Ǟx22{Q1_'l0-biaȓ9cR^ 5E׍ee-u1<2S6m+f,fM/sPPzF [NB(6tcTtW8] l=賽Z>Rl']L\FƿK<knSD㬓E18܎ 7t)4n%Yh^ܘ/iDjZ6ÌY FЗsd;%D Q0M*ml {T6Yyexa6*&'w雥!D$bFȔ{ϘNp7!܉<8VleÎArI1aVD E蔏5N'}>ϊREე"0؂z*~7ir^l ``A 9%d *tvA^ҡb7l_b_IWƚeq(^ډ+d5&|e/^R."58ʀ4yT6fmG6"r J{eA6 CVl~ ]?0sz*&h`ػ$Ղ C\5m:]@d/<N9fYt \2}\ב U q?nV$Yz,)2N 4Ӽ7 Z8g8< ) ڜf `R֐Oc/'Guw6_ZCu]U'BZugH>d)M_ӟ*s°& e@K?~, KXB_S,_#_wKQpiaV0ɪYQB]5*QRd:t)\iw1)?5G{#@l(Б]m1luf0nTi W*r!Q`ERHُcVſe5WX=9Da_C\~vQ "m#\ sN+lc5")H?U$\v5j>w&*HG>ґ7q1\@ #B#,p}@=#ui\˟G58h102T Qzz8A0Wl#\dc͞xAiP񄕼e_Up?(5lhh(FT =XVwrW!ce!20l".buD<9?_Evo-(y݄ibwuG!jYl> cwy|b>jgis'^c濫֭;!Cڦ?HdQ'jI 9_&cAv/!߱yv+ 3#\O}a:'WMvڝc,l m)2K >,Ӷ&ȓNJtx#BTk}dS=:Zʷ hdgC/7S6:J Z I4j3u2G'ws,uޓf+1*Il#A[G;3H $$QCDݱ3ȼ`ю ^׏S` _Sw8U{U'kPty #kTr8bMv! MJ/#o2}I Rh6QSqꬂͬGU#S:d^ Q̈́%r5]a'o|ĺa甁XvHr`\4*-@Wa4;W#P%s0쬍}0J1`s \_k T%;ړg% ``u,+w\MK`oΧ!\Pô Wψi?*R+:;Ćx*'UWGf2Y\$O $q.I[pKN'WNby2EsdouR',{4COc͝'k\RD&%޻h=b lNr?3/tc]^Ub ük#xp4K{y?ǭ!:h)D] q#©hwC]\4Eq8/1ɢa9)ulX~(Ԩhm2 u=/ zVYŽJ6}F[Qwdt2 z!˘I> $ah=-='Nza&2'|͛fV7ꕄP~H!-剳~({wM*?cN' DonC Xv5z]2L Yk6Q%_2O$9 Mt3 -ZPYc#̎ї^8.z \Rn邡@S1| >[ 6\*u N!L}X839mĞTOol YIݓs^;CXV+]/k^\#3n<ʭdJ-E+Q*ʚ+n-h-9vkMÈvlDF~JUH6liēN_zYxov_wͯ#}U 3D= j\mg>_6s/Q}_*snBz/B$V7*6mxpn)fAr Ht;,gfW.oim{$}\ A7 <Ț]݃+#v KK?[I ȲI\B0ݷ|D罻'fn7wv܌nR]Fæd8tF`'pn[̓#Q6HB!5JBb*&(]8wNhSU*AD2vOIa5U j濔u6дG+%[+ޝ)[iT"*zsB̳8n7'fv K?]2h_"S#z*qS6m7bۉ8 No]يv?9\1GvB6IpOӓ{EdGz9J8wJ^Ji8KjdFogU^|'iY]دyCfW$c5{*'B$5ħh6‡]u<ŏwXz`SYT狜}X4x7j5u-w-HSDE9a,U?i)oE{~ ٲ^iֶOw7B`0t/LȏmAj~<$uDkak=WL٩"F |yW}$sv+;9ֳ؋ԊU 1էS0B~Ԍ33T:TH`QׯP *S{($rGL|| @|Bæe:Lʏ N u:+lTSm!rl6btU%+*&n%Sy1DO\>W 'KV/cq%NS8zno),IʼnKM?d[I/P*ij7z·XEhp*{xZKɼ1Dīԛ Cf40$(5"c31>LslR;^"Yr }SI"f8 Z#QVB۴%p@Lz7 +t'+"}z (UZAH 萀=eSK$zkGYq&*.aFfv5=棊؜Ep U?כ7[-_;)Fml)<2ϗPC Pj7SR~')/4~_ ,W e'?>hJ9Q~HR}/D70\9_&cU<4bip"Xq\Nc|N&~GvtM#I܋slO2}_,"Hh=f* 5}f' E'_鞒|PjEO`pbh>&$1cDܔi'\Q.鸱'8]{C'e gY"pξ[_//)QR=EWS ~ ۈxT6ym?,6h prB7W?wixPpb{^Xu_]GJSyR?[@Z]b zQÍ< }Ixk7 =8JC;u9s)5ObPs:@~;]i4|XEJ:7f763"%+cUG#ΆW{]rj%7]!Rq w!,VĪGzODo{ S_/WD?5gKI |D:Fcv{byvW/y{BVIz[#8|Gm,pPYנ 1b@_JAt%GCrL"_ߍQ] D۝F)OƇJB g5ꏲqQci'v>heV:Xb]T?D .WE3U>"=&9lObRA-'^2Cϊҩ([@lPxJBv*b;$xb78HQx/'/܈j`ߝB _]65v߅5dҬ7HLBBU[,jfʾNb)AU!eN% 7W\nBhL6ZN䁤:.-yrC\ҲeW0X֞h7zaPyLlLzWٹ&xfFIOTC$.ts; EZ 6y֒MVLVKxYpgy'HS΂U 7Oms,B9ޑޤ4!?sCY/cHN{ Y(n!L7F:Glk%ztڗ<lV=T(U 1 ~W#y6m.|~ m|vl`m*Ŀ. @ʀYErՎ e EVcw\gsF˥*r|=Eǎ8'2{ @YpwI*Y^r%L~i+a>T'Im!/.l/ced+G¿lp R YG5|;m)$ժ кتxZ ]I,+o0գg'-SKCuXf (LT Dw'R RJʨQcm)CM~K@yYv`B븠$YFaQp46anYcRE/n L)%9c:4m؝S~ ݹ+'& =VO"O >Wz/,9iC%ş0S#k j3KAڞPtMyU=jX ZXT4s:N=`?^d'ш0<#z@_OgCPd&ZGK" 鴗ͶݐߛY Ĕh6y Uvq#v18uX% _umj /aLey V>YwUnҜҢpe#l}{я=,-.43 x$%vFl(-ac]vן@FO~ kiO>H}:!AQW,"wǵ:0-G436p8}]>2?qU. BXC#P꫰EuSq7I!<(u V\̘AgI 0*έީj Xm1A[tZWC^B:`XpN3nv]@W@%N"PT`=5TTzACDUIp}YwmrB1"W^d1,*yK045Whb1=VI~C*mH$1ÍQA*(CZ:gnUU #m7'R8ɿ2D}0X(2mF^ @ICc-kL.V 7 aTg2L?6!=8(4{hҎ*e3Š r\ $$/1y: mjGw^CbRq\B: k ,ھUā #P%^ڦV8= !?8 -*[2pڠi ,fUQoeG_ؒ7 ! _qتM,Fo)ڛ.)&~.ʭ2tWJZ{>kxuwZҽ7n);k,7mT%JEAnST#ZY&W]Cȡ~ae"hwR^\M19]Ƈ0ws>f7490[}aqm[&JD>6`yfw#yٛ'uR%Uk9acSu|XW eXkڴAvuŊB+hk>X{xu54(\(J p(l=ŀV9 bh"-.:8QAڕ]ٶ㬿v2Zq*9VvLlrk@xc;&X'1ߦ-H}Y&"FfwPj D*ioG3')&%hi'r4CSEjapr9'X;A[;o /MYTt+O_)F91ý䁳7 ӣg>CzF}'F{x>WC9״KE8^Q5][%3V#E`LzG`RXyXWPDܕ&ĕg23V+/9ӯa9B ̲YXmG0'VWr-nE؎+4<H*ީɊ rji$_;l5QѤ-AJRΟ@ǫL6a `'Kae [95cgdqo *Jy\;g10-J%0gtn +; =d3T R|mp ph>VD1Bp&&O~bHӐz yhj3:+!t%W0ʌODV5L̰=$=g뱛&,>aw_t4@)a<`:k| m\<~b  ß COM9o l"=fyT>y$&&#rdK"c#01|UkiL^uo[zzĺ^M0a%~}i=4g,Go .k:Q0J( CUtShDٖZ%dM&`&2f_?.M4a5$Um=7AK~Ll\/ izY PG5 cos/2+W>L0~]~z;ѼVuƜR۾Ϛ;98}t&KLeh]ѡJs3bՉ.J> 檸O 5W(^8qK1kz~ͪPE|t#ôt-*w:Cڟ0Y1dNGyQ*AUB`/i<3!@_}B|bH=skGθU"y6B~.Pe ,*` { L*qw6j=@a7Πz,8G ;2n!]L>0[?V!os:6HGaf F*zG a&ÒluV̠0{An;fOGe=EH%ƣ`T}(9@6Oնf!YP<ٗ%_x~'ُ5-δ&!sMjfT\?cVJ~s T( Mٰ,|("oH u6`~.]dmmKZB܂'nqGuL7i) Ḡ-«L-@F1Cdkhra ', "6ۇ @7ba)Aa=vʱ191$9X i򕘵)(Zs|N(բ,ގ 1(9`dѻauTtepK~c_bh.7x1˴ Ona QP=mSH,3J 4vlz9NvGVM+aA,eN[ mEcg۾5?R;ӡυv޼JCd|W;jN;b? 5xWx-a8F&ZX7fkJ洃WS)a|I! i~v EXWidwImS:}5h/Ê?]%|iϓ?yc0Uۃ B$;Q`.xWO[JGHsP?:qi Hya,A/Pۧ W0HoCM\XSdiLܸ7h-R^_pQ \T󓤾Vk1-z?Li0*@\B!kڧEC2]DR`Gr({EC\QQ'w'a~mܗ@ҪT"ǰ~OOռx0ZR /KLZ/6? B^F,9 N# ql rs+A'@ՀPD[Ǥ)2kq8M'3Ē]3_;5|?ȴS/xuXqEnM|jaCѐc˒ЎguG*D/PɡB\F-_\ه: U&yT)H);> ̟ `,iTJ) DkɍmXTZ@0nBtà)H+>̤ۑ6 նLcX9ygq&2ǿ`#no_m 9Oي(y}i)4{o|QEP/=Wɣϵcbn+0.Dy!hGc8 w"u*W—4ܵ0=*-Rɮo%JÓEׅa|2 +C& h<_"ҹx.u!+ڒ9Jƶ6zg$ArUl&0S[ȏЖ`@?@c08Wk0B#A2qcİPd חP_5̾2~UrCv Gac!* ^ȊÌNv0$:r+uXUO!eU%x[#DaSM@ sT|<[M~`lnDEmYu/ _ۛT] $]֭XlY18~&K)F[^ElP5A@vS :|iԧHR0,T>1{NՎ><\-S|$(VQS>d `"dڵo(j#X5y,V P{ >~U/wv nUn~{ h拫k~ɢ>HR*hU59xͻڷ }Kl'w1ڜ9jRZ rA0SÙɢgn]`wTB(~90Rlnlx ST@o +GU4]YGjh×  NYN~:ZsE\P1{yE"F}U!L¡60 $jZam/ wWVH yb~ O/ؓvn-L["̘2v&RM,6#LI40>_|#X;R@rt' X\GלZ¸eM"YSWk\n0[cPr;Cx AbԄV{8jLчispf0폀 ]0n,0 jOt?Ceb´d⁉sȥ].%joo|1(o] *ͩQ'6{b5o*a0ܑa;(0O$b5R7 %lh9`q{Q$OAf Jh?,E+Ndpst&{%9|Iw%f1|/OfG33{"IO9BHog fś`eu3bQh>: $4=5 j<ۥBۓzۃ̨oN`iK,n8ulfB$=LAqk.W~LJhVoeJqopC, i='+Rr~v:;C'wbywYxV>—1fAWh56ɩ~Tw԰Ʃ]:fͣ Ue% +~g qn||nC͚Չ~L}^m~bkL~a}SfRLGI.)e7!2Pzi0(`ՙw1p]j`vww{% ~G">\0 S~o%ppUmaʱ=͐d;*,@F8lfERC}lNY#{*O=`QEQ7٥!`+Act(G06)$e O14X7#dnTO-AE)fP,%ɲ.LLǮo[i]s>d:c j،Jvcǣg8]m5Q:F /dӤP`s#RS G9n;PR廀ie\9H3Gtqg[A4]i>1 gUY>y^(z:1PjVeT9R!swѥ䦁kBs:v*fZeP_%@mw4"e<nTw!sC|RNss0B{HRm/?6H%&^z=,KG;e .u^joVTׯyqj9̶q0j;>i<ɲnT]³ot^YlP-k&CiQ'>{χ#uTO:O>xZ&y*=*P]nuWkT9suW#վ7sF[_ ow~a2Oe`P,ҿhSu7C)&?^27hNY]*XBEv5<hlxW*FAyf5+`={e0+CnD_+ \FE;UM1o dx׫~v""qyo {aT^u^ͷbs-ZW-!F"*!D;a/^jʼCVʦƖg.Ȉ_eKCŔq789N;8NtZP%Dіc];uW:p?l,sM 5^xuζb c5}iK?7{%E/>vAlz~pG@0J;Vk'LvV7%ܘ{_{7{hW+vL_2?^~a*E b@~#=iAk؀>`.7Wfh'C@Z`a&"k>4bR*CXd1oJa АƠ,luR$b`ĥPw.%rMrL %dxsԝ,YYVtuyӳ3 =vunK p ;\nd_(k;%IZ%PLTNhj }XwH5[Ӿ,}G7lfi1PFDPi# -L}/)O(^P|j@jeb#Mt CdKJ;KAfW 0}srߊ7Rږ;*Zu`{K8\=]?^V#E;WIHf O؇jPÒM?BSɍc(DŽluʘbÉy{*{%(eH{a'/_?҆&hmł߯MHyl gU}IIiѸ@( ٫G7cTnl3 ])|G%WG#up+˼6JJx/뺚Ǣڰ=Bb) EU%I+%_Q2aWWj ’#>Әlefr[B$H}'VH|kX01&Gfv!ON8F&dAbc,Y겎5FGud,v&tm b.LY2-y2f'\hpԕ%v**qb``E|dʚɧC&=*XQ>Y%e #Jn_Eqz%Ns~R_e1)C2;륍u6΍ؑ! CZ] gvr>`vM Z >?x)TgoL89Tm g5h; g؏,BpdltN^=Ad+!/>Cp 2UB}ai\Tr9 }ƒFG75E$ǟ?[)Ac/B &تWNw .f-G+d*ac{bxJy&4%L f~q G`g;B托R"e&Fe%ٟt|b)hC^u$Za@!h?Wi FA2sc6 r,(cbnk<+Imw+ű56LL8VtZ@DlKFVwj0aDLwo3Tr4b<?G7`ݺ.k 35da@P }dfDX3 > g̈́5*:qjn2I#e. [_c\\ec2P[#@/|M2kANkb 7 c=l씙םqEV<|G;Y"'Y+0ݦ|pD4>w31b8[3,\#'vB'3~yidOErNjn~k'Ceͭ9Wj< IͧȬ8hvW6 .s-J|2`k*K@~j-ꄓqvL"aaYa'-#a?;F?ea,kiXl+lz6jc wͺ;pdv9cYlo4 k.#…7eltLo1`:=Ķ)GIl,1Ei4 }{&G Y vQd18:ŬcF۲\[ZFq5vTNK<,]q2z!99bܩ [x8O yulI,M=H "/ӥs!E, wYrʺ[MfŬf2Wl]&zN|G̗/qfzEURhlY&#$QZoH.`q 2dP0i[{*]l%+,A.cϭ?= 4bQ.EqskrgO|GLEe4g_*uw1q“yٷN)յ\LMPde5KV {Ÿo_P! <rՎ_J=COĂ[n?WW11dbbV~/G5WRQ\ݡ0[.[MzO%4 WQ.oGm/U'r텃N?,ng2wq$j l.z3~e)Gr8S4˒ɝLO[񭣙)ꢠTdGQTEC̍7VR"bʁRb9Qhtv..3g(N\51 EpD1A[+$\~܌U HsyϺ6GRØ[GW2o<2 IlUYKPSzDK}31Q%.rd-I6ѯAC$ӕXiĆ|bG>ul':OrYe*D8^3Rm;4ژ~,`'?23["3Ϯ_gcBR^__ "~( xp'rB]*;[7*R؛D̦O۟a N}jO"nJn1v\a,ݼ"tȺ0@@=Q"MPW4c7uHJQ५)$W@*|1^7y+8g_G5/d/垭Hvᒐ'a<) -Xkj6Q׷8_? Ԟ_c 5J)~ML|CϹ Gh^)daeY"`o$#j5,}][dW@.c{x5w'l ҏH@ĔUݗ/I} *9}O˶9 9kM=:cܹYv筼zwmt+_xJ4 Z]{˿m=JDO[_rKF %|,jԊ^+ I"IgʻuP٪}D߉5* bo[US? :[0רt~,z6̻wq!?\r}0&pW(- d ݯ_X>}O(A}tbi&i%-+1&B>nUoƕ^g1g8>Y6tvG'Jm-Xr26HҴlrXZjU/k1.sf5vvH[}ΖE0 `cU~A_M#3wZM_kݙ7+'2IU∀ .)uMɸoS`u 6t:9X=P[>P9ku؟T |߯n$0ӭR6&F|`O!-ZV]=4y@%)-ZnOQt1?obfKkؒNpLxiU5v {c \[=LUg*䋦T>y!nI;jq}uָzuk-$מB Q2Hfc?p2 ujTeP8'/5wRh.z7x G"hZƂn@{֖2'Fw^lQ3-vU&{|QʕOڮԨaCj4[= C'.)u6f#ɴUX׏v'ua˺ݗ%{$''fHa(W&(7_f;sPv7UiPV q)Jc` :f8v,dtCڳאCVXpk?#^XOw2aIb2w68Fpȿ.UV=cUVcus!c"x [c/#so%羒*nK(9|_IyDor\z%ŵ[rXo/?A5"$\74d4bsV B-py.v4$<AZU""!  lJzs'k&a˗i_^4y>kR*2Rõ>_ѕ}L@ljUu!^? I |#K2 )Mg /.!-T ?NA`o['{zt]'R٨׾Thmg6Q\PIrˀ=qF>N*>Jn2UVa(ߜ>:dϸyMqMq$@̎za2yQ"^)Sյ}v8@c_W  zOib@Ap㣪)2y1Z1b.477C_m [y% 8 RXaa?gZn07C+&Z+4 ig#$$\<ʚ)xd_8kK}Fћiړ_M ÇT:r p.NbN N.kƮoi[ RHV#šl;|Kk]1h;ET0Y,\f̮]M ˵\nl z1Ӟ@%T[wv.?Ct^g_ sA{S6ԊLuMmV-=N`p-Gt3-aU88dhϠ$l75zyL82tVdhB~km $l48zҹZn{Wz;En(EB]rFb4Q]%VbOdo#;o0ĶQYBvvմHe1OŹ&CB&ۇUD.hQ<$_'a.1& Njr8/{`Ks"Zpvd9 #^3vG=DYwR%ؔ lpiTg4An4zI\(x= \˾vJB<)qKo 1J?t0үCi7pmnVK66í~,1ɾ8 Z,T4ׁӾ(bQdxu)m 蜦y|VhyNieWk|Nvʐ1usssCjf{ĕ~c~h/Sf:CH_`؆&Or\{'^tX}e<2nz,x&b*|q01 Vbi׌mTPvPͲwH>{!@櫌yKB`k_aR-H.5x>@[ 6"3׹au.nFExbj>k3lřA:LPw\ux%?:*рlJNSH=^fsR[i뭮[iJec &QG^Vs貘\xK~M): Kˋ*~ 0!II&*j ]Hܤدy0 O,>Uioi>ï vFk4@ ReNd;8#n[z>4츿ƅro1bLKѲ^D9`Db|ѻLNBPS~R.ӥzp7YutEu;Rخ-8UW3 ڢ!ca4XDK6:NQŠ'ɮ/ckI'ُ&KikƢ W_;?OϏޫ x, 4y:^SDúW'ϰ_?ntMQOQ("D.ғ^5$Js3@o*O޾qQrqn "_;;%dѡdUs!r5z^4>% u}b cwq@5 /tt!߆f7h_ieUoPnk/\[g"e kA:t~pK:M5hLۤv{t# ~WbuA7Őh ۗ]6vmČ}[Vrn3x5\vt++@Q#&Qq7PʀB։NԐJ($*>xyAa5M'q>Қ鬎Ԑ6Z=߻$e2t|0Ԅ0ت*Rl_W$9n@[*X!\ӌvswekOA*J26{Ic u{cI%hd'j} (ksU|vύ%[DJlrkBՑja\1jȏ;I0 ;.*0.L2Lz9hP hۻp݉&Ȉ` Ą'}^hI;'"Z\y||sJѾZ1!^UJKM}\ome#ybdXDFuAV^܂7m+#cD,;2〹jaz^5C:ZEv$~eԡ!PrAB\h*"I}&hɒ. 4K>8ifu@;lFCXz~ON8JdQT4;KJ%;8kCL`o/KO:ˁVTp4ov QFCnT8#m)QMVP@*ZB e.J ooЗOg5 ̓ TCW:xнhݸ<·EA'uph]$ \2uK*ܔqLJH,ƶxZS+ ZjJ@}ߘgk}3l6 kOW?5,R:҃.Q՛Khh\IdO>ii WYG@s}Bsk‘2MYXw*U׵`t0&}CO{O`.@DԁG44 )Zï#E3T.cQD<'p// m`((C2w5#!L Z@Y6_1kmOLO-;;y]/lRKHrYYpr&[\@Ψ [ٽu +Uq 3̪t5c:VF}ם,;a:r4o*"ׇDs:=@ƺ$5 9z!ΕIwУD,d0Dc( HΪWW).ݏd%AA!$П~֕z2M_q2b`/1[j׻^CvpBnsL7{fŎ*+2a+ mMc1(|H@BTMՐ\pҴ2yh㥘-ީ~JPD𫴷P>kНE)dn\ X {x+a0N`q8x1&j8#*ue?Cj+IJӾsc3 R=h߸1q9>zNh|ʥ%a=ci5.N:0EIG`{֚9 U|cԹ{C7Cc[@"]AE. : D ˑ{(4#a =ZivlL <V>όYuʈF-+sՂfa_v2FuQ[KKb`KC?v#K&/.lr=lW e^hnP-\ #p$+In wS`JE@)](Q+ʚɒ3c rjoʼ-c;D\kb\) ' :z0=}F˲R#,raȡ:|T}r6;32Cxu&ϔ-+-7S>6 ;GGv¦BnIe.f$̺N`,'ljr捁?Q-O?WUj6Hu(e&/gDJJP-y/V*n`{(6kY>UhVnp=NB7F۹w[G/ndȍ q4Q-ř7XgLWَuHTx7(d R1S]4P@9xxC=+O&ogM,f4. "SJPo0|p;g x0a P;"9p|1F\+sl$&<9wp. ,B9:M n.6+Lߦ&`;{uOWY{ |CK{ j}GnJ15BDYi %YÞ\o(OOUɑq[*GS Pڨ]=,͏Wf=߯&J- %@f(wB7j;¦C Iidc4-λzu aQQ1Nh4B/װI,=r!xa 3MJaPEupvUHV],/zV|БLFkxolIH8 \+KiD~rmϼHwm o|2UzG'w9E(eR$Gd *TtX>`oj4T+{>ȠzT--L[`j xCxχfs{sƗ-̧M_Js5IvyJ0ps^vM}`Up .>ϼ< 6!0 Z{RK),GKkQ_l_=w`=xWqyO3rfwc3%NA 0Cf*RH G\( ArCт߰W(I&LlZO`<!V֑hմLi&pA:#|G/ޠu˛k͠~oR-SD@9-y* -p\1SoHX6 0 C*srJ~Lᄬ3ڀfUZꠛz'&=Nu%@ 6KTQOC//R2NC2 uEh\ԛN>}@&10 !j=1Pad~Xz ;1=j7#`/ PhWejOaV[(Ap ܖx_nMR3{2^u w!g_]U3y2!9Xe#{gk{ 񮼅'NQZ5 h/h蘝K~@X\Q;v(u|Lyou)[Z}7ۏa alXZ)W]\"l 1†HtB*Y찺U|ɏi3tMrN%;.Z w?iX7ѹ:_o:!m[wDobdޫ\ݫ}HU)B$q*|JVZe,R^^35P 0_Y"\y  QTW@g48>"} }*d y a!$LTtl`bpc1K7Naj} 'z@x/WgRQ,[W'ږEBF8Q$1YKL@kѹaW+VU`S/9]!Ƽ[?GR Yt/}TwAƇˌnن,lr)A?ˮ%1Kܓ7mU| <=\,-+f]UO1LV6#B##"z4Yy;ync鉆+!Z/UAq &#ddB1p /ⳳc\ N]z}*^Ǡ0A lk8Arv=_Ib <ຂu9"};'챗ΡCFaMV "Q77O%'-<({kY6˥2ĚeJe&Q<_uodrC&W5;ӄ 1oJ/_`@Z]`+ `#x9tA.Ml=dF^E{ˡt7 3=E?pu} [v}JYuF;v1\LCwᡎRS a[ްjΤkXz|K`}QjF9)?p 'R;`i4'a1m=qohopڴk޵Od?S`hJ}&qϞm?$-qfui~KR+ԗv>6ɍR*Gkk V~]PJp+6y<oBMV8.s)375C:`ߒM i<6H/$ks53 l*QA6S%km$G66,p"?d'mB?op~aldvnDX;_8/#;&ii`7/hC'4g 0wJi^z&9\DA3^n(lbޑ`Ez8kR*scҜj` X <L,{u2\XqjfpS?7AL;۴PeT,,!( ]zE2NQƚ#_Y#9˸}㞨Tcf?lCuzM؝yNUזħ J2appz<}CdQ]7:?aCHyj0Ձ"B&v- [I7L $huQ(uʙd<O+pef.?c%v&c)"{5>]69N$MdR2]INJȄk,C@]N';t3/}Hƒu'SBH2.I,Bs?M6h؊DuU%pzD +/&V6#z%8- 4B8{A<2OqhGϏu2U HVsT) K˭:fƩ+łGXx&灡4_L~U u_I[h% rTG2\ݳf_C-v y vjp]X9]/v"E@$!ޖH90[}|b>S@P[7U-D܏m^5 CF֪}Y3'*Z{G0]," ̳1Ʃ:P!'+ЌKjjN=~MIȦch$gco*8DZ|tO?:dk[hFa *2 7\>ӹ^37jw?(!zMP3wwzp)B RUD`%҄4o\GkZ%۬8XL.K1{Bsc'/zUu8W(mzLs7vSf)hue>Ue MsR;DGiW F8,[|D&lMHjf&\uks6኎"BJ^U;!zySu_jJ|S< X5[ڲ'J]ƷPuJ$]=p_53Z~"GHίF(r(q@RL7,,M -mn_즖 8͸L"M|.eAZG ; 7<(Y^$RWb^bl#(&p'qaB*>ʄNwoLMw/ C[ȕ׀-|v5Crvr |,1"HO1*?^r_ԫ$Jn$.FI$CײB [^0 0$n?ib.ڻVn*;زzi9(~͓ ,.+xhZC=fٺL6M}r|"Zh)л/zHBIUS1D.%^ b b%̰N'g-Yg#H7TGnTiqF;?|MRnmJLTBjFV&'AmLMr渚< q_J.*7-ƌ2۫8 (m\Xґ L7f̴bTygCv@)~Zkܔ)DY3l#9 y2hRhNE(ѪƗ{ T+.3*7&4M O1oWq%](2(B~'(o rln#( Ǯzfv&0 5uݪr-j 2hٌ}SKǙL lT/¥/)2-m2W P ]Q>v76w.'b)o1VS/"=l҉I{>>J6B:*dgz ov'7-eآrb3du$<;Q2cQ?O@8q:TG{Sg"l"\= V8?V(Fgbce=1nޱ;K!Er"O&2/ Ϙ 7<# %϶e1Sy=vuk6v7eNMwS33 Kٕ˫HD啄`3{(5@\59Emn뀐]k^AOBfUzPozZV@vpWX*Y&rZ1#L5~Ե tMxӼHtj͂a1lC:M:#eL>pF÷| 2K9qY{nڛl,?cUI hz)|8+*1Գ?{slB!VYw>5T|{:q*WJ]?E[#|ŞD C8x_{eOtP|-cpXL[졑W5kx ) BS4eFd~܊L{CFAQWN2Ay6?'!_^ T29A'7tKQsj=!Igo֏r߲M?,E(I8![]yrJ#םǕOg;_d)r<>HLDTo731ɨ} zzp͉/Fa_kD;h rg&Sɽ7w*C›Ɋfk](O>7yU*VٰTL_t tiB7G\Z{,A IdА2LNzA6bVs-d\ÿn;̙xLay6*` M+Ce)(.5$v3L=?ιwWOH}oT\'XvpO߿DV G`$y 71O>F!ʁe-.]1Db 7rHoB58JСIM֓Y09rˉЛ{F;U)CvGRQ{b]rHNK0獈jKY֓^,PNHJ Ez}g&s2f9fNz 0*B=G-B:JPg|$ f4I1rfAsӉ%I.Qrh,  szSH y 8G08К!N~iA=OPk`E9+r-x~8+)eC3%XM]鮧=Ot;eudsjEj#fbO՗y8TI0oeqxĸ6EZpjM gkyI A+UUI .|%GG8ܼ}o[U(ǣo?-LdLz->B*P[]οQn_Kv\&,u3Oyr+I3L,~"41:7H{D&9~μ7슮 eQn22ʣrALqer*? 'NMdIJ#^ cU+aWUO"ڮm^VK mݜ^YCH*(q 0 ȋ\Hfi+hDt|h]CFWR9QNTxs"h4ez2/34`B3_XqFpVT+"t9f[s_JuςSN'3L4FCH3;XN.p.yCg%+KܟoW39A~럔ZS;8% x}ҭ͏bŪEtq2Bf2qy+^}FЖ&KF1Ni'ZcTX|gY0>>Ss s9x-N1ݢ]*ie{gfKFEk7i+x*"M+ʚs7,iT Bm s+)klM V娉o{ql*im5OQmR+ ezְbTiik6NmؘF%2ge#J&"ѿш-=0Wv~"zιr.M]]٧܈ cU9 cbd%գ,DcG#i_b2e#mԍ'"?t KY>gYì[Q@˄M  E @Z`iT!6/Il#B]) UWs8EW2jT>%{C{@/}ݯ g$ h\AmzT?,: )(eUT6m-Տԏzv  {a <"=@2DE-~3L`}&8Wp\)22#$*wlq `DkW2#Bl/?ݟWf7! yU]ݫLp7uK19ShGrglŖ7ZGW#ɯL ԖN["EeڰNwW$lЦ>5y>A[=Ko TayOle< *)U8lr?EzȈJv)l MtJTr*$t6l4uWi4LxIJ\!XVOTa@Čs؃A"&zؚX/s|[>f'LMQScd%ĩWXz&՛AȲuz3RqȨ |ꉱY >H}P: No%|Lw#1ޚqJ0kHk%F]X4 V:%saUB?+P<э-%{.y5+lUC)P0m.:teT8J,8*3e"E G>jfXJiҘ1 /O#x ŧ 9OCsBǀiwJ= jP"0D&d^\Gm(伎J)w؟\aKF44'OKgǥf F 'Bl@tbؽ 4M QZW)ԀTC`-ߛT6ag 0t20*2}@!3bJa89<+ݡٟmyQ|•LJV̕uٌh-n̡=pCגfbeDwE?'EerGOD^$9+Zc/ЪUbB:46fo~yK.C QFKuxӴ> HWqKUY AaVofK| l |nbUݱ5&zITu"^ex8^i"/iSIGJթtNi.J)qo3a=^_dƉFpؠwyIHv,҉yW:P~_i}6.1cm%P/DDr`\n&O= 5F"S1se!|a~71'2 mRvo7~H6OULoQh'p0ଡ଼퍐A`KG,^Ff 䍇?LiFvCȝ&lVȝ&c\[j[x {oֽ|>gt5#UeëÓOw%fvM3!]*vv[RDmLпIc@R#v?+Y(}pW ?t~fڃ e,Էwn4l40̭#^v;'IT{OvC5sWU2ϫ/)TMԠL%+R> Df~g9FGjJ^e Oքڞ RFQ\t;3^`؁Sq?Jio.Ȝ=N);2$k>_ 0fԓB(*wn%Zzɭd_׈?,05yF ~5*LVQk-r,˄u9&*oJͣ7(x鲺T.f7Bχ Ln%oMu]^H*(%w&YN&T/D ILTSֲ'dN0I瀶;a~mx ]<?ϭa' s!lq~DV]R!I[[Y="b^;!'iе6Y/;=Mfd}BNub5ʱ5~<`"^¨c>Zv^0`hJsd:JvVrT?k#rK[v31f"7> L*({'^'. <=.2PV.\Uw_r# W3)4k:H\>x.5Bq*MA)MTO,B*FFӘ M ڝj|s \7QKDT=2":S\jr Gg9x`gaiZVP͎j6c[9ǰÉ_TZNN#[x+&i2ČI2M'g뀑ߴq 9t}H|ՖCnE HD]Z7Q,mP0W_q`5,GMY bOalr{'gsEd. J'?n86(rBj+^Ni3]a1%jRd"MxReMG3(&TĨ ϣ< <Ұ\1W :%ޠ+HҰ1prkl d9VFTǰj4*x)BęJ(;Zz Du,"R$ Ų7 zETRughrB*~ry {"kRI/>~jXЛ/EWVΦa?^3$9ҋ0afd??, sa?H̏g ?vGrQXH˧;=s4[翊W3)3>ˏFݏ\=eb[O׾UuUÞDps:⦑EBjkƟ B OX{#,Gwz 9Trv۾ xu}|J3pZ"ianrhq  r7,6%Ȭ~k5imN*b Jo4bHO'I \Nn)4y"{/:]?(i٨k5@Y|) vT10v o6F_fMЗk?^­ȕ}e8D9Aa@Ċc8r;1H7 mkLjK[ߒ*%"ԄDrLcՍ\Sy"g!<^`u{VO$Y"/>&x!^<xԍO<(D% @єYwﳁ̤WNeSی@$XQ~,h';?fLxeI([q"~j=_o9oʟWݎ>'F#UlY/ N{/s @`Jib3( oγӉ.4-ƚ |{jc̋aUtya߿1r W?l0ߎ4}VR?A#YW\XrSܫ|pZ׫VXx'QmiX RH'Mr)ƮMiG%+EגU\i G3m,9URa{r|2qz~|Wik¹s|*.>`=ph!%Νcj$o˄嵅Vclԩ-1t؇d7X9(rEOii&fڜt^!D5"Lnԥ*r Q\JЍ}tMLO8-R MA8,$(2bWa:yyilᳲO CICC5 SXDS ȍ[ ]8ic5,myypEinL[z%]#$*F-]@ۂoZ%U2d pL 26"~5:Ы[e["8^#"0^S!oG!?%rZoW{]c4RE%R>W81V#sp҄M= M*w"}{@Bv[j8AKF]_Rd%gA9`ChS[ a9-OTE|P*z6-c꤅9LٵxB0gc21U ,EP:CqzarΨV ,~)rjafy]5ˀC]9P >O|N/ry+9C n#FNk_%k:EҵjQrV;3^.1N}xl (ҧ/'ݺV0a 5\eϔf.S!P% Zwأ7[ 7 _snusW @_Ei.1߻_ڠg;lSݒ9}$+Γ$Z]93Cfw}_$^?([I}OF_E.]8ϗBѽY>oaFm*FWџ_Q9W7}&aƌZ\;{ wNͿ!f":z׉?x 7TG|吋TL==~FZ y 5gō`ifTM'_]E-2h ؃vlbe7@q5:H jfop ijd nSUeWʭW!|B&6bfMfPAav`nOyOi.11͊W91d Pu*ы / V੬RGbƸĤRӤ [#/jjLLIE573$u2 {idފٲtq1B%_-Jơegm+$! iZ!6{l|hfkӲVg_KA&.+O^0pDM "X-yV\iRwǢ{ɜLZce*˄xΰ{=H @-cl)(Wȫ4z((#)K8 xbΧHOu9U'׎A% ;jjuG&!ͮ{ 0ϼvkm:ȇ [(od(-c ˜iޠUUh-k}\cJZ#bvd~7s7aoIk{g;.S3$0$?A#ÉBxx;1y?~,KaiSP(Qk(br6R CyjČ4VuYy[đaܢ]Ɗ$ZL>_@zfJN~+L0_pFKO^qS  pLg BaN`dQ|/%iħb~ sssׂ7uvHƙL <pKUqw+! ḏ#M{LF7j}48\v#4skŏW~v" "Ϳ뾁2 "y}CI{&j/nohmp($HZYPE:Q)=>@vVDP i,jx$<$"H-iOu0.))Bbi8 gw!e8Dz0]l o"ihgu mƀb{oA u=?LgFKh!aLv1kݬ0ySO 读k" `U,rt5([[&7x sǯ ?ǣL1SiA֏ ɼ:%]CPKƭ 4kvas~ke_t:k1(}pp;-vEIΐFV/C5͎^T$0lcV"NeE%8ve4p[>\<`⿂پS-7&t5з\c`;@7.&4)O2gWkwe Ӹ%C)R&l1~󜓳Vv(+aeݛ܁ C%'Gě|iR7Pl afd-g[M % E|2EAϻyS*n I_R4 ZDA1Jh$),\ rjߤna'_nZD0Qq&4 зG.O$TE9pJe8i<^kT߃vyO6LR$ǒɵ"CVmnb5_Yxi cƷL N&=[98aP?_IT< .G[ytTBKoLLޥV(2'){ g ?&Zr*).mY{!)-r_f;-Ƃ2A-!QQ/υS\7ޠ/][ϵпYgrB5y Idu[/X^+|̊M_X^i aNnc+8LN{;U$6Qrg7?>J\Vb@^""ǭ*_Cٶ0w"T ^G6IcrAhwִ ?l-3ګ͐n܆\y8Ih-m7틽-rfS&\)9!y jsiQ+Ap KBd{L(6A2R(g2RNCrRB캯"0QCW ˰Qʒ맔q$0JǡqNTZnDLzJT};}z(X.{w#i L #) V+}#T90˨(GY|ҥHJYPf:F ),!.O0 Jݥɷteyt Z쒣N|냒%`ᗍ! q.?ӾnPlc;nhnP]c4@O81HHHrc!o "C56щQ4:^#ho9 N#Gn0ӽ~TEPǣG-'!ES:Q3DB߀]5/r|xxNl (1X &֧&g s̃lL4Vn|pD~lba3V}܄@cA JE5.݉r3` bJfKG1LOtMۍv.:7s|܂LAѺΛm~ևA>Wɩzn$wPSp(FX:~+pTH46(>0R#ޫ ϒk`m9Hh+,h6+Ib%d]MBO)~^1O*)e[PwLYcYOs"!Y3`Ћ!hvݩ36Άg"Hs1{ʨo5+es!o:DAaExNԁ6` Q/!pND~]/J0.wjfnaӣj,Gi_R1`f6h9b.ky*:Z*dߺUw.?_{Ci4sop;;Kx[9*iV<Z@i߼O+C;911 2OY.`qt6yoib"g4;Qm77>'o#;4w#F`}i9zGL vMwgMao# 8t,sMby)|YUuEa9(|ߦ~e}o_,]iZ-ps}qw<Kytk_Pa!k~SfD#VĪ}|7†GWYyVS&ElEb0"WUlr4ʙ:dFd0z8^)L $@JT+cW\dX%7$*~qaXj˫)dz/Å=(glXB4b&#k&;VÎl@|nbmIE;@0 ^QנVyu=r}Nvs= o&Ev$_DA:Ȏ ,j6bn@q ;n*lQbaZk@<MĆ`K\SwPw^C1R8Ԭ,o[6+ƒKW~ ':lS(0NVwf~tA;(JW6'}8=MpdYDŽ1?, nus'ʗ. &Cv7>%VXlK!,5RCp~m_ e}0&j*Ŋ5mD4G`ZRw{K ͫqDɨ|3⎪_:a`\Ѩ_f1&Y("u`x}ϳmJX*E Z `%>^=gUT( uz'ȇ'h%"X/r5V/_~݆/"98߀)ߋ2Q{kt\Oc!]Hq={.@ֺDD$f&j\(; 9yY|.?D+Kk ?2m4/3J'F.~yU"y "R2BǑ3a:@b&`Z%G3K9t oɶD}lOrz 8+_Hr870iՖnvWPq. ێ3\tм  _Ew%Y.6H2-@'fE,| '8,ALwp(ufeBF;+&4T_14V&#.ӴIZQM[`drk@DhNΎZ;@f=%rnHI HXZCtuNC]=HۏST5 y5>f&j6] >vUD/@T CENaou~9վ1{bUXcזD$dngm*9=𼷫fwGoP!ރR 浓:fa3XK ˤbh},E^[I~R?BDG7sI;"ޱx!:[}Z{vG2j@EtW9N1qe?W~̧s(W -;y@bB=].ih34_ xA@F:Ho~ӽ<{:ݥ;Lmn{mL'F-Lb&4PrZ@x%,|l0%b c&R29Mח=:t%74&OPI֣ Hp@JSd ?d8J082RG';t%BT')sMԷX;ӳ#ʊKX.3h浊 ȶ3g vXjBy{Z)@::J Zڧvp]וwHt3j5uԆDT~n Y!TevECN`K<8΂zu?eڎ'oy rE]'5o;"߼ ~tDlBLMY{׌N} #H S0Pߤ=(qQքB@$w k;N?P`R A4zga*J =2BØ3k+|- 輕-o-$;@}ρlHgQSqyV+ vl)(agR+}xZD 6ps^nsbFNO ixw{NWBϯ'D;$C&١xΒ8xY,nqC;dHi1Pj!cFVX*hB rL{3Qha.xJcVPw P}{B-^M y?f`+!c3`O XkNhd|Z!hᕶ+%b|U  GI#ye,nt!hVoBSb$[?ŅNb pݎ7oKUEBivk)H2ZY6B>pӋPrEt!._@ zFSG[Mpp%.:#阋UCO 䟿c;eQrUwևBlY݈rtxϋu8zA HYD]=m %̋mi9>-'5h탐R9èswA'Eٌ:Pc̑_'TnCViQ=ph6GɊ r3 #. V 5m\i훯sr倨%t!f"\UUUneV\fqH<9*_bTɖjx ׈b Rf3 sQsL|x`Zj QN;Ey+\4{hm ${rnjɭaXxR @k,A9c6*y3"$_b d^-M, Nl1JN4Nm V_n[| mH(q7E[{4 JG$yNUbNiqO~#M_]]+P=g&+>lPb14 $)IޠP&m jĮkwL+4n@;=mlѨjb`9`ifKwM5XgJUrդf }=||+n\-v(LP$oX@o~8gF[He&վK{bNC3kZ(xk %P}DLyAг3ZMw4 sˤiU?CR2\ަË:5CĿ/KXѦ2o@ss<i$İBu7Pv(Aapۂ %VxIL>j 6g޻n{aY`7 y=k1վR#+s#Lr3QC ,hIu؏miA֮1QHd~A 5OH{`tfm%0TМK;?V%06,ER3פK-D#í_g+T7/;1)i兿fkj*?όvU,F5K8m Y+\9}nU|a Dd^6( C{#| aWVr=NmB։,6L hǤAI ! *4_BYkbAOIyPvDş7 ^1w>ʨǶ> tJ9Vy?*16U?}dl n`ZjSSS˄@wocTҤ,fÊ~ˡT_I 'gJFSJ#:y$TBq'l9KٴLz(!OU4Upq˅ $op]OX(3 #~#ꄊ_ ݩ0 P" &TEr2y VtBMdQ g:&@2 OK݁.8ꏱ8Q6I-=gTy>pa׼L/)p9nv#;X,D!)=ߺU߭3٧NXSW@fkcN̈́Íi~1/R~J@P亣q5jⶩYPS&Gkm p9ui8PڦצsKWR0.$4=SNÀͳFTy~ M(~:A0B+b3!XIڸ#j"rsy =>0M.!^*Nmlj\ݨfW.Dߡ4Z3i?N\͸$]rx}cz=lѧ5j Nm9hD޽U+F5Hdm3 KK쏠7вU>NkquVYaVK)ާZ$[;(Y2Ɯ xDLEMį{{p< u(-2a%$T@ **Ma)˜oG`M8E3u+WO\\*JA4)7#h纗1Ty0P\ꐰY$.G:$ݵ('PX&n&G{:NշG*!j*z'#%+r3JdqS#_$.jM8{;")-α3;g\Ushf^=NG|ːn<1Kꇃ=_-y~i_fef!iKX/yUP!S?R?gkuoʐ<*4+5Ρ#mL>P=݊dC9ϒ9 (X뱚E ir* yDga7 5NyXC_y]|PE,a dz1s|b( w$Lv|SRmz`\ іxU<8 C4pvk5f{=9*43lzXPȎtt 77Ij*TX JW]&x!JvɠLԹ$8hO\4o[‹eΦ pWkzCȃTlQԁjk +7}sg>'Ιõcs},GpD0E%&ɹq_<`;5M=XAANqd4<ВfL Ui))jq ^Xl=m2V)J[> ̃B=k yܽ~[ns42Ǡ++ z'`r~`MT3q|,yx&<2JG}Kq ͣ|.O2=c 4_Ktqt"ysOŲh:9Tet1K;J5[:;wⴉIB]h-Q-k@:\G]E'1-18TJ%po2!E<|TI(O3?J`Vy|cj? m)Aw&Gx^0m:2`ED@勅8*$鄽̷tltclMhOҨ:4ϏW\֗y7nmEp/k6,,iڅ!#5idkn Қ򄝠`QU{»B͉>rkOW(׵^]tmbpyp Y=oHB@ o{d֎:U7!{)`ɿw"{T<}pZPTrRx2gFDc[a!\:ꈎڈXso L/wQ8h4l.䮏=hPZEesgӀ@)x{hۘ(yO@Ѷ0VuԆA@AQ_#,6m1 P7>e6*L7hoZ/)N!Ǝ[눀9뱢բ[y+h&Ox8~==JEAT nh$:{kJL@ӣ"Zt T1 rJ,\M 14>ǀ(xm1hL: i:Y]NWylO s0 EJU__WwʖE&`GVP"eJ%- gXX_Hgy`S@\8W}N߹ MרWA I(lwW8HA0q4d`3)sbylA]|OAEy2DMpy;],"peP=8hF.vlCe3-AܘI' xk0 c=',2O NZP$AWɕVq6ei'.KENQ$>qô T*iQiX9r@?rcU3@Um P\/t7dR},4U ʾ\rM_VC:ri: ~ pӓηn*;wz#6ri~w\O-}|74aq{9^Ё\n#"ExR /}"qiîPʅBiY.2>p WTY^І>5uޫQQ\Iצ ]֋DUIɐ-N`-0ڄffKTukAeJ۶mZxVs ()lW"ȂA //mJW`)OXQ:LPp:Lw ِ*4.OMMJnMV=d~Zݚ;Ђ/^<Ey1F"U-sLM/3}eaq3½…CFw"--HkBL/cU ΄Xv$.T>hX)Ko8# /8?I XgEUqp}~l Y="KJYY^:o3KN>6]t"Sq*kgYS YH.$bTFa9VGTN<ٓt[٬9ýqMIN?|7rMQ"|:<Ǖ3(Bc`D0` s7HX\rH#Bbrt/2s5U@A4[!wRw~o80߬>A w @̎w^)ԧ7Nl@`Vv6-;ӽ^w(dbY]kO ϲaR$d]Ge5\e#vt($y{Ỉgo#s]߆~{DY8Uϸ{!80[T,RRY9 k˻kX؃w3~gˋ@q3!trNmO%&ʯS3v&!"!ua"}y|s!w Q?dGtt" S:ZLlg:ӛ+9# X62#oUPbӅ$%vUא|RD OPs;k ވ3 Aq[&نJ@˞oo]Da3,\rTHZ@ˆɞҒ ]"ρKO4U^۾/kX5ՔF8IU_Xp''xS Vo{՘gd̎%4- 7$@Mc2A|(|~xEϽ׻6sڱ$7:JfߑM+xS|F45J鱼2|6K~-G`j%㚊{9 &\PI$\:݁pm;޶*aMeг'<Yl}_[**D`_S忼`'&M N i5cqFRjjtQ+|oɏ$K}r#y5٘C:ۥȄ~u.;-ޑ074y 1&u^\siq^ r;TrCq7"NMk0N p)wQʣ(?frVt-f EJByRs!h?jƷgmv"d!艣`a~27&'h5JdYSX$8"1,o떳 0Ac7RF!h/hN}yogףN?OC3yˀlMuѯ`3-;!Yor`fsV=A. !y۱PGeKrPe墁ɨl^^X՞\h64 ͜WZ[oى#v鑃u|rLUKk;x'wXSw߷sQ2膵ϵd,i֐7rVtp|u LPȶ ٝ,l'̾$}"t?XSVHz #*O`~/mo$]6UBz$Ļ0zpGNUa:m~ʜװN #;0~<|HM$7m@Oua<+5N DQV=$Ua옺yPhq5%ӿ[RڥZhx,dم:5I rbZhN!N7p2YmU;5dRt\`JQgD# s @J =:Ubf|'n;_Oݶ+}!6yq?tJ.b=ߕI2MH;].8Lu&t6=޵`/ ǚ0e.Is-ܔժkuHk K?條F~EOކsc*c%;^j\ݤZ3#Hol>Wū ] иU !=]ឱÐckCϧ6M3HG0rTdۼ3dAgSJ0$T_GXw2^G 4fcPFrt*$3 ;vz!R-`w˼f`U0$TVJȿ" uj-Q؛(͗s5rqP%8UB\wj^Xu>Hϒ,)5gq&?~g d0qqǜّIV> 44&Mor7ojoi@Hm>S[we"tqZg~t˂>R:/.mҳRr5RO^s, jxTb x@x%I*3^(K8B`#͉H iATE=h(C2[AMMF?LPIBG?u`El: , 44MLV@Q?Ao|.JV>u)lfuӲiH[02>?BKh&j\a5Mͧ8_ZZ#ތ[H(3r=F@:0ٙ\g9럄tFq5򎠃z}Z+Bx9DN$-,VPҞm.0_!Po)fd (p ҆-4j;4g r|%Z g>*}q/:\uV\QِoX->ևW]3k5/U_rA }ilT. K7xloD 3;A-'(Xq=j yq*> 4vX8`oU4b9 HVƶ:&EP,V91f_Ӱ0ma-V1L۪eTR"0Q<昖} UtƏD~9Yt)=k58y~6T=X0BQiB}b=nܯnnĴ>\O>ÔVƨQ2-& {}:[i|=C?^!)KPuewMʜP0?ܤ0ڹugp`f^@ZUNr"η5K厜0ڞɻBV;Nn!W9灼Ϫ@O hEC$J90瀴rY8]zhWU:&Ѷw:Bփo };)μ1+q͉qUos WH|HE#o['778!>6bL.=޶r &Mi N?8E>cKga F@ww8= r`—C>]MrMZH?J-5ǹP]+#yëfާ(:+'ɗ('&.bS={w|="٧ضڻD#dϨKwI};n{7?aZ6LpW6Y|"l^GWFbUgGKضOG3Ebrg@03E1o!xr= c_I$$kx;0Ҳqݹ,>b`tI~P'-!zC6?ݩt <\ %d|wČM6 Hͬ5顆VD7 F?F0yRM; epT=Uی.br?-ACAP"l9-\;|Gڐ؊l峒;#Cm{qOc:c-XbΪ;B- reu>L>E}>d$ %$bZt\,5.uM1V.)>ʉےsL%407 +ѝ)]M#U6 ŒZEь{;r|} B+;$VXuqY9ް6>Uh@fa j3 +@ ڞ e80;s> wK c'-kE7# B8/W9 K ҈YLp<1TńqmgqeR8ftWXa:KfO.g~T#Q=bž׀!x.[ '3sfӷK}Z6!lXL`9>W aQF^*uj\aS^&E-Py^t6R[.DhFAg$` D&2 hnNEM_]E-A'Bx!MCNr%Y" J/{%$ #âc$?.Y]kҸ(0 eҶ6H_c%LpU.1W \ :7Sq0l7f6g`{t"QZCǎ%AXhz[?E92N~QDҸ`ӔcCZ-C]Кr]\nF#V{m&  [I4  &X6 ǝLK8 t}`CIztc nG($$ynY.l&KHM>Ji`ג&nr&EbM—0^NkՇ-M".;3P\eQ{.D+pDWi&8pnI/ő'/M|*0iL~C[U!-!4#!S6P8)-iMF6v\J @ q%xݏ [drIC׼ne]DYtWh_3zˑ:wwi9qh}>C\kJ6즩ԞQ9n_a#s䱔F`)y#s!u: C*w:>@ 9(8nEb&I7:ϊ_!L>  "3?+L\TrPۊP v",|G$,|jL&!F/̓=>I[75YkEC;7N '7C\^`w3rC`12LI\ݤ`-559 ۫CxQ^U!V ٚqy mQ;_G,BA+TPSřyuұ՘IlKuެă#|!/yٛ2q j٪¨:O93%`Bqo\G$@ y+XrHk}FM[\xf\`{{c;&vZܡ0!Q#{9 K8 miRW47*r`Pr613z@cfP1^t;0qwU~۱c1ëj90B{ mB c$c=*Z(gؘ噹1%#͔ kT=O~=_fnC8Cf |TAɪO3^IJM"Ͳ[!9tyKּ4.`M\ ܹlK][Ӊ^C诙I²Fy,xjTfq! 3G%L޻ ˑ7H<})y=u$ď@9E;srQE?k7>|$)j.AbAѐ jq_ŊW+G ΀ۄe,cE?aK.&[$|9&ab!)FGU- Ѿ D=X sM^&?u|. b2/Lthd{iuҵУW}gE I*t >3icZ e ~9"J, Flc-ch#QX4z`Dm 9Ʌ1*\@\XП:h\&pDi13_'|rCЖbL{ pE43572 BWO!L`-/nu9|TjRrPW,n"~L]A(y_i ~G^j²?c-dt1XEqVaQ"#PbhV.j}D9=8buD\￵u0ܿ&帰T2&/A3[ݎ‌-k4 (% )mFf1 +L@,ZМZQ %)n!"jE:tR?8wޜCѩ:GoCp_&$>&5ALaǶ Ÿ p| HyU!Y ukZ!"fF ig=PHө tU VlEq_mt6d7޴/,(X\5 1Nvinq =ګ1H؄lC)nMϋpKFzrĴQy8͉9 CP4={f@z'/0O *Q/9aP&l ?PJpG~'xȰ;xtKʓxaDIwvhZcgע:csxTkILPI]-C/~;^4}v'H5A*/ء /v/d!6Or]zG|i'M(ҡ(Tr-(RF9` Pf_q=mBh hA<),pKyw0Mg:oKs? AH-\D(( 5:-oȸ5ΨLj(, 8 $:Q71JukN6xNg+@(D{j ؙGP %vb*QNJڔ~F;u'Oy*8ʨ'0jҨ /N[ؙoqR"'gHx?H*cp$&JG:3๴=fEըjRR] B=4JlhDý“oA9pAN01T#6%QO) j0D@(!4 m{k82DKg𺋢F%=DWT.Z) atQ%ztY){E 1s㊀PMpf8^4VkAqu ]}i!DOwIǷ;]%5P|;*7.^kt B5,iZ (a~ר Ť{'_^ȘKmo&`NkHr䝑mah !||HQ1 Bhwݡh*Swi/K"[3[ɖo Ix%ߔoI{xa-vx sZ9}55wp1hqHeH/ )[}!4Y'?{tOi& \NMJj:7GGt3Ra ^?h%m ׺碃;SYv:fc۹+#S^Wʭs`4 ' J|;ZSy]T4-X:rރ.ygrUk,?9%ْ)0W/悕޶S[meBh.8OLl R92z}q8hִI~|5IL2iQ7}QŒvky5 RZNHE"]oF}!hQ~O\-,r`>s6v?D!Tn>US[>u t]Q&P@y8ų&}=л.v>lb^wNK\.FSnB7iX$ cEY|} KEW{QZ7}U5^\ DŽZ0/rju_&o) /)2 5やjkV[ǣ%]|,iV2wxF_8`L2n <#_i Geg.ch.Ҩ*Ht%דuy= Ӷ;E םG S:[ ?{1(u7%? *;ݬJ'q(1* ivfE1+s ͑\_]D,_DÈΦqHNEj gݢ(ڄA mz5hlwR\vU89l iBqֳҴq3oY޿cz?Fr]HJֿ+=#JU o'-AhֽDuH@Sc3dȟE1BJʙeƌEqu=E(Ӷ vHs /YR E=k_;CdqK> [صp\PRPy|f2,qnޯ!< rf(yɆ~KbMu++}\z~\U\p!^xPYܿva(p8Bp~L7.(k*m}OM,txG'EGfS],1O _s(gL%&lt˫Պ_Dݥ UF Gό~+uoEnЧH? uQO ?)ѝnau3jc&dYj!DRnCI*>"G#І [njաlQje`a-j5>)زi9%YP/wNH=(p7%1o:`Ԫa|3й@Dega+6ambP1 I#"^@g!^3}MovzZojKyK)ỳՊ gܪܑzIJ.(^UR9ـ>/QUop7mm!Wzmt`jw#66Ea<]T 9vE%3~~g32Yz^)â)0;v҂uв*&0شR!Y_7hvRov%͍vnj- _,^&[ic?bLCbKǦ,SeOXΒ[+mٯLzī/onF+xڜ̲T[XoW5kb?o^Ugpw7J}Ljg鮜GP%DX/g5Ă]1$_ ney5T|d2賂zuVD5FQ@E2nRȦHPq :s.BܯY/$@1W;;$ T優}y+'\~ZàV,Lr:_҄z/%>.ӟͪk)}$-=Ha 18/>3Y=2ϝx ]ߞuT BOQ5^{C'j^

wc͓Z'^\E^ e}^ۧY>+k!=HA"@0H@Y:SpVaf>@ 39@yf6 S͂ vBʘ9g4 X3֔Ť,\^7rnop kG -(9.dz~fOh^fq`7;!fa/ͥi SIhxs 1KZm^f;EB=9RD2¥ˌ%+nKH^%C()fdsYGjp|o嗾g"Ddáղ shVp/>/Kڅj\쿯?ۂa/D^U'JyrZo.S|la6fT@" XTOW|+4%uV8/7I;&dRW=g7},h= äx)]njw,ڟfH@ǜ+ۀQ'={Mc`I9GXwt˥^H [Ծoqf("N+ e0""?*I6Qx L8F(M<3AyJ*_f_-*{wDuO egK|tMJ02A~P(3NbìsYo"KܸU K(JDm(9t-էR|A&93gw>KGZ\ OvYVL`s٫䪓6Ű- †a3ah`NmT`Ļ~߳ZA2d֋xR))4!j00J׮dq .6;ߦ"HXRNzm#`ݧ@N0fcnd̦`Xx2|W$g@97-hAi{rzu^bƃYR5A^0JIXȬ\ |wpx Z=[?Eڎ'罼=G:A8KS >ވ$ޢoc!C鈞N/ӝw,qajjXѦu8;H(ZL-~L+r`|Tb5EYިKx;]El{aI;p/Y7-W{ՍA3II @8$T҅.d%KeKT ׵YR;@$) zD2ffoUnGYe=Rq/X c ~z,E^n6TB˞qn]}ҵh7}D@R/js!f`vu͵(+/{-5WHS+(e"PݫqAe ;:Aܦ91!ln0yp|+c?S3m ZDmU*ߌt@ZUT'pbe~lBfvU%dh  wwٱ| T,x7S"&wi}ώ52l]Bm$-#NڱGD|ǠL Rƽ,mDQ2 XTwHBθsNt]Ŭ@d 2eQR\Dr4"p™zFޢutR-(6;!ﻢ;D^OIFw6E:gҀQKo23YAx VU  | _ Ion7(ET4ud@%MUz: Z7Z?3^ 7 y+0GS/R!8N۶#GvkJV۵WTPʐBq_^ ͕cgSYO1Y<>:_?NGb])q\=@) @}n—cKRMtys=h\WLnJy.)G&LUSk D꾭 (5oXhk5H߉JՑ'A{U.En;&ySιiDy)!s´Ȕ(zb ,Do۔c YTvë,v`e9ݑkΘ\ǘ}г0L'z rl&;zFR*Ӥ ܤtv P_-Ǵ-Qq>Ww1.ܿrC;;}sbbJ`}jSyt߄]>-bk?UΕ(^RkQMs·hiM‡u %)s>*ޡF,AdLv-'GOy˹h_?_ߟsBL!Ґyli69% Gk)xNV͟3VY3⨠15T0o5>GEV!;dUW[Ү3#Ъ} XCDvu%W%M䇛îm(D[E^B#ڷIQ[EONU\Y!f'q;UptNWĄł(dGq :b,@aO)y"C)s ɖZ|d?%4h̩%}Su$L@[= a(mf($a4T^=Y*R4*&$0u*[=3^OEg}kJ:|V厄 \{*]˭<X @z?ZÔJr)vᡋ!>:m^ՌՋS*0UvhYc`[ _T@uZTQM//d`|2<^J(,(a Ow)e$Rbgo?yʓK1lQR#!.VvZɹ?J`NvSC}%S)r*L|؏˩=p[姺ġ¶C Gi`%ncg0d0T/xr[AoZP0@7cL^`H(ve݅jg8vIN]1GBߋwPR :CsS.5pM"v9c--}M>lMwœF~EGL-?r:.Ͳ{,S\E8 VqL0)D#>dhGvܴfg7V/ġSbEJLAyi*#$' l.D)NJR^Z;Ox}ܬaBW x |ov(`ɆUq?p,u7UԦt8!q6I0[f -=$̸KVk&lޓ? vͳ 3AgaS|۫ yQDzGJ:'H z: E[t-o|buήP `@ǎ1ίQK}G{Hk1o}N8ɡUjEk7ʴi?Y]D %ˁx%g=(`h{ j,\bEp"7*C͞`3spv r-g6Qʲ:~ZIXjђOWh9j$\Wys(1ݝ?m{nQBU=! l4H´N5'ۘ0B~yk9CA"Z}H0.y$|zq|XZZWs+lcԈlުtEM@%w~dr0v*{h&mr4BϕECr.ʥS^mT^눺jTB ɓ/ߴvȗIG!(_Șsnv/qHJ4|sɍXpnuj9bDԮ$w]k5ސN`L $T܎qkx!;ª +e2{[^Ģމ=nÁHh®"H k|t@n);Qkʹ-:ԴS`m`f@3K)@čHW6 Z!}B*5[җL&#qADFqKqiMtPsEjgA&UD+ı ^Ŋ8Z׮S2JBnwy*6'kxŋg"MTaz k L0'(7.c.e|>NmT'0j ?>gvO¥4﹑_B,7x /̫֛&}q?܈RB6<*v [^/]t+?9m6B&Qx) draswVPс|v3f=ܰ플z ]Fwff_66砳 z.mj'( Y4GY?6M-Ft $o}2DApo9wOzC R+FApUŘ\4 -A6̋Dѭ,Oڙ"cr Fm_^`]%ٝoTZԖF*z `Zqhفв>^yv ޜ@<"םV&P b@ $F"񶨈*-4iLK3.=&9.Υ8k| hf!ܴ}YG,epzXRm+aO啀׶rH#!}4z'sX 96V3u=C>'p ѣO*|F  >QPV ؁`6ViЙˏO*XELڨmI8ʹzzvz_, 4B |c3jTMΘmu}!Kx׏-uI?a]`r>]i.PxN&S䎋tvQN1sn]/ϺTo @pc:1?=ɡlBEDq v؜s!X >Pקl-L/t85+սk|MƇ4NH+<+yo^; uIHlL&zrp@H& QpHNr]'-t5yWD+T@32Ԇju tRp2N;.̄h/a-? "6+fﵻ3ENpR9Qvݰr!2Ch ^ZeXw*2fPsj]>/f7ødQv{)ൌ22sl;xM H$-7yM|v2] ";RS }w6!J*&DAސxKa6pee >->+cax 9C卒wݶq ~>pJ)"@.b1R#׏_'vZI?G@B$1)P '>=BrᚄEA."'hwqA,uF%Jh~IvgX-3K#_옕B#hpY5eT3)=bMPqdG2hGr93([/?MqI_m$. R;MZi) %wFgtq|qAt4O#{YqҬ[xIf]!a&i[6}?;j#N=^_ |,$c,|ξP \eiT60xrr 7њ6z TCfv ˾{쨸j{^A:0꣰1#zz"66B1xy1f<o};4K(i1 UI"q3(9cr^#x^Eв%$2o7pO+;6[b^cl%3jQ2α_]XۓOC-YFvGx?+dwv ;3h86@R_BP K/k-$VVHpLd,-e"S#&dhEMR "M9Hu |FbGA7W^"kў:3ѮnY |`v)@i9ct&"{IP|(lG2a:{R؂X'`=Џ\ G""|祜hZ_rCjWσ1X Y3'V-2\lg-}l)v1K*1vX\^!}]^ۙU:V(aD%ri'ynoI) FdU}\6Is!WBT_Bωoϣ۹>A1+DQNL?~>%3XC.Pl4Gzh>fT=GƖ0 zky\M^aE*ǽGge/ZFs }ohkm-Mבc|pγ&r'TVUm2%Ϯ9d+|2#35O8hN1-!.v[Ax:[d?>?с@.Y@ H'h&Ku[eU葉e_ i&E`q{|E,4=$tjt[IûzڡՏƏGJ^67<8l TwuxWD84H\g*.Y|g*uEnZΧ%iyPU]@O_gow%#vBy5(.Rѻݤ#6RKÈAPBh,݇ۑKV.V|%ⶑStlA"[;r6㞗xzE9𘫶MKD_n-U.Là QׁTHv}GyILFd_1˸jLK:)fDK&buic-Cր ]Bך|NĂl۫Xi[`#`8g"5Oë5X=$3=ƋQf5:H0Dۉc1M+)ݯny6g3~UWhsu6gY4OSZer9͓N'_WނjRۂ) ]^Ĺo:X|l,A &fVĕ#9|zb~'oWPۤ]>uEf$`wcX.,j~*HD7aפqTwPo loFYsԑ|E;R逢9/v(٩ܔ|"q8 MmM'Îg]z`w)A*j.]nX7"ҍSPn*dOXE 5HW^Բ Nh)p61-۽9JiuW-q!Ġ9s4c7*HOhD2fZڶiDBǎh^`P@߃i&HGqS}M[;(r+!.7( 氍qu2KĖ^V~3ć:?&Zi[fh<-0"yפ$PL)x &Iq?kyC<7H%$}F7^c4|(Gb=O|tEd2A2UXFo#.7r*]qi^]yjQʥ/c ӀZgcNbd 8݉A+6rwvړ qn2bgn8]p!_TDr!"dy/wԾ7YIb SXRF2hpxCkI|Ip7&N6NP]Mwx0T怛Y Q.Aj!؉^L]$NyT4H5fgE G-vsu`w8Vӵd3ya\&4sDaZr3sw/qc%l.g- Ī=j kc(o(kjQv`eFIB[JC|I^~5{@3ep#8B"QA#pK"mͷ|@ oH%z‰q|%%xE?$vAy)+P\$h±ZS]cb1|b~ўk۽нpȌBnp͐Tp$*؂lZ!2sHHXm_=¤e(} }O!CCSm~¸-B=Hym* Id'9=6 R;Z֦ȹq:)h 2v.D^ Ex}Hj|'k֓| KY5|u]U"X<_ 3 ʶYS6`ߦ}dݙ~M?q= J%-iZgk c6m90}kua@O/Q>WxmI|:=Qp^5|?|>U(@$ YOjFٹp=0)dnS'>ɔ6y.(PzHPo٢ݵyFyv=8ֹEIHHHQytr8r\9Jf:VZi588]]^ >z;z;|Aiڦ/v"7萉m4 tBX`q$vi`A[LNo dIphީuD*q˖9*߫s\t*'wJ4>L zZ o=kkliUPXT-iԏ{6e*_sZ!7Md ڕcod4B.eӸOl!ʏi 5k}")#Oz~)XDP:Su:V};xr~k6N<K;~Si$/ND@5:3hs-\ԋ]^•alN1 :"hW}=MJ u8cKwaоک| @dCFVF5{p۲@4( iLzy!ci{һvHUҦS6EÁ=*DLEz|dFޖG=_2|\{ jL&zo;2[`2Y\^)써 sZ/ 3HaFMAI+B 5 /kq>[9mm?$;p lf6xQXV=KI:Pشb Dl ! Ehٵ;TS~ T1}FSxL ͠+E,5u*ߙG-:?3R"N@N`'|Y[ ---3CzZHJ D.YHt0bobնQ+$տJx5sgrډ'qvt9 *+c?c:XykRB1۠-)I[]zNJϻBL~0!c{V [\x~3m}܍? 1ZxO c6w *~۰J]'#N/^!}"ely3::y@c#*}g< &x\dblDsn%p*;(-O,/SB@j|?|Sп<׏uO* VjW:kY]r؜ß!퇝kD:d,!83V6/ep==ZFa ^=zN]8^&wYY1P0Og-,yMK`ɚ kӉ+0ulpo>xLONd+ "{[6PDU$b}) DYW+8#pF+h9zka>Yo(-?i% Z)J *?}UT c*T˟ͭBJڰ+÷5zZX6Yb.$*" iRhLLn>ZD 2[5aHe(_4g/nI΄6F59|}x=8! 3oaaβID{TT }͓ "Fz޽2T_w0&w,laC u~>5T ). OH~M_dGZs%R M^,Bqm` ؽ1`M^)@m&6JوQx )qaQ[ICj6yRc6g #*% !l s:F: :G0,!kSh'qhw{.eoO9 ̎/CdGY~8V37[Sy"@d>ߋ mj-l4jEqWG +Q[A ʖQ |8m'4a0_9f#^%$(T'?xU֚)`yuIAPAIy[{VW:թSL4nSAW4k]c+q[K\{Bu\YNy]<ބW=Xp4)@ѣce'F~x"m'뉙T]7LbtB/D3p!(W mrUy0  gO΂5Tb$g,'_ޣn ͫ2Iq?ɏk'i@C׋S XKxԝ_ߥ_{WY i_T!j:]1`sB`}0MW  g >Ebʓ`%/Xb&|gfIIad· KgR4͹9)R TͳFƩe1s6݃lSЛT)o̬Pq5A'={c`j^A}ztz *?׏B} \U9bWfǭ3Ƚ.\(0gԿ_ekiW./Mt| k墊 Sc\e=vY Ef<< E%7X͕vv8TvzPjW\!PSFQF٤j,}/1!{cQji0>b Y`i5B K2){RN A̘BM8 I5v&n0k0)HB`]YKU"Rl=)x2ú3mJPܵ{-#F^ ~noE,^ V̀fN!m%uw[1-yD[;M !gFn>2͟ $rq x d!L'ޥs,ٰvlT &K}PvcpπH,Zg1!yu՟zdacRX\$gӔv2N%BHi!P^6y4USdw\s:%RJ#L|%@sJ:` `-$trK n*t6Wf$" H/KR߱Ѹ 8Y9h ~ R iNN{z4KO  ٢c7Vne]ǿʻua)YR\@/ڐhNat#6.d"zHj#LJKJF gx[_ԙLċӲ8$ >dwe?%/B=WqD 0OoqYl>~5"ܳZPoŌR®3wT;@ =NÂskO&nmhU:es:O;HK,C)q>#r/9cR~4'|솂:..?鏚gYaӖaH0} ӞNz/Oׇw@10? H5D N'@}>ԗ2LKcʙX= %ӤZ!R@Do1DWJ)?>:$e_"uECljad`_o]_LMp|2@ݗUsj]f}>gx p=J଱ ν6brϏ?N7 Ao˴„9T̳JuH5H4z[l :ٗ_z-"w?#r,,/M2041TlD'~EW~]am5]Xжq%2K8$ Ԥ`mP&Ӱz єec ve뻋X)Olf>h~ NҚg UY$y{HBnQ6-ci߈%w7 Jag6of3uBX#_ $Xȶ]$GcK=ڧ{[h[B 7*"U]PxϵK[@:j/_nR;=JzBPbs|8k^!Ґ\ľ+l9x(Ae=<1sl%Pੲڼ ܵ,BX Hfr0x,=tن{NClzi+ioxpI<`5$3.TǸWV u#&@(m9v9G$,5ޥ䮃AVjpQt_J><\,xFaz3?gBOׄ"O=%N5I*õ,TTQ(wKU:{i@u1B;l*α@DTڪ&|׍Fc7!ɌUb2<}|֫Kd2*CC uh'gcD|bսc̱Wv5&ӎ-]y3F3~oy !DOeWYpזcԺ?ڳdܼ#rT) emśMw4]QB~FG| c;tڶיۿ m1JfB䕬OM/;ʗN!&y"+mOWԶfd `}eef+ͣ"عX4}:lTK,hejq"~@ZwRM}#;?t~Z4/6Js F蘿}ri$OcBdmu6[-$Ɠ*=sE׉̰5+T">1L s+ Md7 )*%e2j̠UR SY_,?ÇT5tbEtj;(6]K&bP}>\Qq٩~G8 yU4t#ǭxę"v6Y*qI^\ ADVw%tuqU-`Úc5QsCJ撫jG' 2ӰcNQRXE7E칶ILNtru10]-m#- G2p]v8\Yy2a?%Vv@VG4ڜUpna$]U:_m {gDӰ[ :$؊8[$ZPz™ a:h>]Ą sOi5^g,a;jzyx~S Kgxuem p5)le_aԲJ& SdPUc',L%{B sy@CÐu2X- *dYIZ? 6q_# ~ B(~ GI$Qs%ވRMC {ꍚPL1#6-t6 :fQUxWa)0+ tuyzƟWCVWskw%e!$BYXn͖5=CaWޗɃNp]LKۋAڃ.kOL I8~O <'XQ6W &ARaI w諤嬬QvkhoYUn/Mu.6iLXnCQ/Hep#Jڨ8}mp0zx>;{b(ڤ^&)ܽ MmQ3g&e$床z qUh.s\vq [F]aXA԰]~ueB%] q}ao&ii[ |rː܆Z5, b4ς-k`{1޸:_cӜOtU̫yʨu-,MDt20+@1A>"vYA5a:SEvo˝ C-*#¡li`g\w-q?QMjB@ė8U7X5"٣Ze"ES1@G0Vϟ-/N*H?|.?ԣ˄MGCٝ\uj >Mo`8'>~츗aTFM]$5~R6r0 z@eCP )89=06)3{EÞ}SUCcknHzUɌZZ+W}oθ(_xo@w4ޝbbb%#&tnӀӫ&{P=aV )I}jDg"]EYL" $v~Kb`fΫ-9ɪAI& =fo˙  fb6϶<ב7UdGJ26Z D5籠a< 8mF ə_]@ܔcCsXP\5u@'h Lb"?odDKc*[u5mVG&RKg P~ydɓ2Nh3_SņT/"[m-$°)گ(UmQW} \Djd&pk?V PG;.~.b `UrzWm02IdT\|N0-?@[&7tlEU̬t>({=7"ҧH@DxxZ/ , *<>.+-{CgI80ZgqNjɛzds*iߕudPϚSO5R(F6}"U+jFcM'7eQik4w-D;6h >܊:Jqx =%|́PXb> %*8O~qL;8mҦ#~سi$ی*4I `syAR\G> k22dw02} gu_kLz!RnBg$e Snc{BwWL̰X 8{Q0,I6C /8#oLF#lFZ|ʫ~kOzu!wXc&z%/L>rzb/kHtQ;J/RtȪٹ;p`\Ѽs6g(s 7}ݞKPo)Ge G:CL孍戴ٕZ/lĀ^L-yI^Q4A]tT`5\I;r+lU+tu L6ul44^ݓ|ƒosI'J" س56\v_kaS䔏-B02nba k?wUZ]=4)< $9No|j`CQ MԘUtȥ=׎TLV|ĦT]iO:-w5\6ʻ K*"7|4įq@qM8"7lX%\dqXa e-pa@nqD'9%m*F ncԱ! n?GeB5 tϑPyy5 7/<9m#OCpwiR[7Qne>⣓F; S &^syPf'e9ZnGPs;EM[AeF2"@jCf$ʗ;&Mv- _؉^5,J/ŹdBZn'LA;MvHQ Bc[Ivy,GZa2`4eZU1j[$\cQ`\S`]86zܩ_Ѹ0X\8D3>j׋ƔdV%ys{2u֔@Ӎ;rnm/³Ek;|_mEMo;덢l"NcE.WqK%^jj. w7NiN@`(BI.{'t]pg!$>:%'k$"QU1S`kos?Q'Ȱj+"DZq}!Sb]@ECMOPR m #\⁗&syX/~N&鹀U{%"Q$/Ħaϋts.Irm_])e+aDsT6~/G활_cRO>T&M}ʾ!NNl dιeS8c{4ӻz^PCOe%T[q֕$\%[^d+i>%X_5amM8a;2H;9r)_egiL=_pvs0L$[&)Bc^_ X#^g2^Y #]ɋ.tax o2jsÖ Rk}4?Y^yb.jr۽ksIaal^KGﶿl cu~MMMRidRKB]n^A渵zJ4避ōĪ+-:vDGI3)$W98yx1kοTpo/4l I 5!#Y"q)'gYAwX$,1e9$GD/l&DvD0;B7ل63ď6d{*.S$۸^Qq*85}祟MePCE:{vXD'2:=oUz5Y$2pE5CU{r$P?Ӆ"ZL.jo|Ik㰑ժXAc桁^ Jn|O\A0)s{!]`藔/YӭMtIL쭷18LYGp"ܹ.nuP藧&S>KsoȖߺe vx}z_p(k _.!p3ւ֞dRRI?f}Q2EGT5wЛL͡MS%9Jm_w9e ^p:͕v%1aCꝰ*|PxZf@N/𶻎'u AC!U8e xITVU_؆mv pېx9E( !+~Xrb98|:i(¢G ݗd%Lk(P _qqi}?EwAq7K箄4F]Do/BŖVN"JRz:$'eJOF|҈KXkz?ƂH#ܴҫ}03<<0#U"Էe~9!:diN̶ @ :[gKUqvyS[;,ENL~1`;{;=µuK:dVX3 BֽegWγ3׈[T E&.;x^Uo12̰ud>kպ0h4!4t~{ZӛŜ01>g"^Dۇpp:6jՋCF\ T{PԒoJɉ)9DiH:xZa?Ae`2khֽuy1^D(M#(6Mu `O_$-R6P sت2F <>BUYw)@\d>O=O<"`j,A RKS  #[%w)W`#2v.㓃na8DmiIFjV8D*ed?%T-~d6Hi@7cܪ[)H%Q`jN^ӄw*Q: eC EFEN J7])'nnڞ{4}_Qu޸pW 11"YE[ʱe-t3r'uH0HZQ BH;HV |'ARqA/h){d |c Nԑ,cG :+f]kUL|8م:8K9 [lS<>QX03>r)֭ ^g#lgR9YoO- S^LvR$ 9`#şpM#8Yp~":VVp>Bj!߉/RJRdŠX,g4XѣH e澨sejƎȝb|'/P>./J&#LD~֗؁I겮8ÐU$O;-^#pfȷP2&E ~þ$D1n}I9+}:\t|A*.DXp@H"Culv!UϠ!GWm>?׽КRZ5I2D_By:[k㻙V=#R%S]%[‡uD]f>sZmٟյV? 'FyHx7Na g<;>1eFXEO+!AYڱUz/gݙ8}3}_] 08!  ÷Y3t9q$z/zv o]={#f7kEMWR':xM=8mV[Fy4o`~yD6bW?C{)a!^{i|u)R<j8Jc=FA068qء0+e;BcQLAxo|mp.x# IrmB[vD4i5ѐ?@[ُ,v3^63p$j"}QSe I_DZ>S1N f!!iy|W|v9>=')M1͢JbNHDC4pU"H#l{%Qψ@hja5p\z'D\,F(r%IV U33w,W͸b~[IJV7Dž=&1Y{߾ <)u,)<$wڦ,3%Kl$7Ag$pjxKθ%/2jNߐӄ"#2 Õ^G 0No`'xYG?;v\fsAG](,|ۡgxMTi9mc ?^m |$"TűI;g8TVHC59Tit`Gz*o-"a]xlnz}0 l\XqI6@FODoԽ2hwJY TfA/QYۨ<prSՎi/vsI{pB4"a\3oVz`b|5uYHIL@]B%?G\B/yv̆ [-&Dt{fC2x) cvk/if![4 AHEOJ̊jA:^2l!QCtKK񤒈J㩌dMk^D 4Jٞ#|Յ`aWǣ RE'p+ũW3.۸Ӏj` gCV4<_=)'NX˻1R Dž=Űcb8Ah@2A|yVWS/ɐZҞI ,Nq'9ukT^r0Iٿ_nM(bA*+t8S&ḑK'"X@ѿ-S PZjHCPv؀G[u 9cF9b^hĤ X^c5;O(t~x~h\4{&s/"MRߓg-9/x~D2INic8y[u;&\jl$ᣛ56ՠV" ^83:c/;Pu]׻5).N6m+uݮX_#Wݿ%7FԐjKpQл Q[ Ob^~$ ,=kl28 5Zs|77@ٷD-(̗Jk"ۓTT'4,J{ 6C*'XӢ3H60ao t4dkM`LOhE\ўUtI%E̎J@x;,[Af) (GKVt&T2fM~rl7q 44$4,J^ ا` Tv8,JK"IE#jrH]<^)\O>WFOH MUEۻlmSrO|+y#(ZrPM2}'AM/H[D4YNa1gp?Ȱ9NմAhJg}zaCW7.l荕6adRn%!aco><"b[ Ie4F/e d!C .3cv> @ {Y""SsM>g GZӈN:|M3q uNJEZ/QL@$Ͳc.C ☬Rc2Qa[T*LR1d9,29CO'i %Fۑ(q:t≲'wzxq◫ė$~4&}ie-=ogQO&PηCA1i1lǬOI욟&\rnE-eȤUJG?I,dQY)n̢RAѥ긹 bFo̺Uǹ%ea*h;WqjhŮGŽ~E8BN7H5.5Wu @$\_ UpQ"^].>hDPGH5ij$+h\qZ}ZmRy0ޏTL=v-x9r%g/G2w:?npΧ vxE/M̥|xL _>+"j"n|H1yϫix̎iX1v8&8J]{CE_WH{cad$+j4E:-y>׮W+]3pÿ<:N[v3jI/)D~HYʶ^ ·̓@k"ysecH딩B_|$-A[ĂjIPj}a TOl: ٩ߜdUXh8ĵzktX#c,@󫶼JAu !etSHWx2㌒R.N?|6؀1-D&cnڂj` Vg^,,9[%UB@f؄\H=j-wtïu;YE;;P;c6iX8"$_KX<a_j>lӮxL0 xg (-y7T[ y(a&aiK~b-6lgۃqd>h-rZlHۚUT]U=''$5z+N&6u> {P{ҢeǗ&`IA@}p ff3ߜ炷ҵөa ҨJk"UNJ4q~qPKuRW43!jK0Q_۫{c\&t:CFFQԋVP,HTZ4x+ <4 UjkC.Vf?\m qp LcsTW.B6Ɍ6z+1 T'l!?V|k2"}$줾>ᓮ kUYLJ9e,bp ;z/\L[bd-^P(?)b?ئp@ʐu>q)hץ; hw25n֙͐.%7 6'i^;Ӂ ]8<ׅE:|}4x-0XA)*#9myk+}Bٹ?ݮB@P!?C;, g 3(" Co]0lBǾ߉T >es脏)P=.kda'[JymJ' 4oj|"ޕXZr|̴. AhRkŠ@GCq{[E=O/Uq{sX#zg[`l(􉶺̟x<6 ?{"r8+[npo~모m"hHtkL0ׇEw(c}%ik0{84;;ڠ&C,.4RGQx  _qw //AUΞTl[AoD *MXͲқ{zWv{4PO KX[j \]N'anEEC eI^>PjpDvԿʤ v[DX-YA|9RdhwdȺйKoqX0ͯVv&49MЫ}t.H+s)uż#+er-.vÒ٤ĸ{)QEP%^YO4`JvBP T=4xY |X=pDKZd xܯa*<~-WDv67`>I)/ %V G}p )a4l @yLw,P4TFkx3Lݾ񾼴K s"Z9,Yƍ7F'z02YaLp'vPl܃ļ HӮvDMNy{;4> N9'`Ս}= m4!Ԧp1]2uF;yp%a./TSt/vt}\|^tzpنWrJ(#ZU;FWFp&^gDo̚>bY*]. ᖗi1Ai4!G b X/ȼjDESe|ltҙKYMd[VK{NK̕ yeY?)P0vx:):uT*P&6>YyH%~ZA7(z^2l2:]> .gbڽ[ A3}A>5"ׂ fEqXz A79fÇT^Wl7Yχž3CҐ0[F9ġ1.×Q)ݱǧm1b?5Krs4eEG i0CևRVy@6єsya"Iw9"d,48<t ZD/쵿G32J+O'ZްF0~U!2,*a*,6w }hԯ; j֦:ZvԵ+$8I 5[_l~ A5v0ʎ<$tɁ IrF |+%9-Gu9t)ROXc! vӡfmB_ {!׷BO"˷]`CaiR\]~; @4/q,V esTk8kJ 5Y̑9ir`Kd#ՍA}|5VvJ̪PTEFgBV>zѰs04nL逄63 3Vp[.͛vc&ޤ7YGU Q CKu;rd]|RT#t)]8vN3`<ah/0`KAu.-. ljҮ  Aq"  fcC@-7,͋ge5b83־M6TutB]HsrxNUI9܋ArVwӊw0exRZchOSNS nٛQGs 5Pe0I ּk15K^~:͜lI!׹r!HKa? OoSmBFb,ZޯR#uy~%Y\e§pj,qG5#u)[P=gLxwu[~QlU 7-['oK@ MNZjS{E,*1yaց@~hݞ46[GETDRCNvEwLSsK\d]Rx$Z$ґ5+ yKbkm8P_%~5PrBBFևH[#d)5C"n/Jqptn}QsJZK@BMUQ521v''c " E̪uPr_IW!;JJ'_yLݲI?U_w;1bZ*}A16+8B̮{&Zb"vH7*fc~|#} eA5{4 vh)pעٛ;^v5Ѽ 8!@$uV+AP my&aW75db[5<WU?S"Q~lP7+.[UV{%uVv~ƩJ6 f-枈/w(jjB _{BQrnW3X/`XڒP@th5~[Rv,l++WbWG` _ bu0SF-/5RQi}~8+2sG{Ot#oZc^*9:]w7T$frUQ7ÀiwzJ]7/O_09Rg`c$W6EWMl_E-tyep&Q =`{Og،dYW+޽%#F43ݶ3ܝ4oWEiC/1aIޒ,Da EsH,{hXe?|OEQLF霝,6cZUڰz?V4MI:rc $4zSlAR{*Gc̕p De3dUd"Azݱ{9l48Va㺞0jU)+558qfR_I}T/q }*G;Zȵ!cepqNlVy" ɐ~պډvh qbΛ`+@IP M;," 0 m͌u(,c:sstTNcLawuӞh%u#%)DC}s9k;A{xf@0ӍAxĩCMêufF̤fet_>2zᤓæ}SP8mT1)X`P'تRe#. k>hIȧ+@SY(^^qu}%=|) h ^M~XL=<ш!FD>y1D;&3Ɵrs_ @̔^\z^mqvb);!]I-=JX8>p/I)̂kT<%eɘݶ 2n'H_8YC{K8q2o6@`ݫ}w|VO c` S^hPMՋ7zQDĐ+k{ 2v;+cl'b꨹#3r$6ZᱤKɱ,X>Pqչ(;yD$DD&H nEe =Ar?]y='\dq; uNEN&Dq]Rjb{ I;Bl\N#) KPY___brIKF_Wg)Ʌ SG^!m&s c4߯ϖ6Lgl%: Ϊ YU[: ՟B|/wö/GU'+>Fq5 LBiJmhv 2D'wUBiAÉ"a^{yu<6+HiZ/sޥX!`ΛrBdN(99Bq zF$:71TsS"(ۥ8nji].\&.Ps>RjC/?TZ}v`:Ÿ]$F}lv;wfxC w!;(l^VZ@i3 2ڰ7~24Ч?\o$i*H.!(H"nHYA|*C:V]FWPxܲhB6knOK{MQGW Oʸm奈 ͅ%E`rϒH1H`n+/ABoz:6HT}_Pc\@YQ= f)j KsGTfCQHPUL[iwq}ߔJ^'~}5$ȃ.}¹u5=;`T@30Weq<'XOAxm ݜӧE z!GMЙl]qT}e\Fo XƼ&YTђ]5λF?;!6s[:=?gi[r+3yz, \ʞABxJE:34 %P}C[[=UFZ6즡ρD|ulY죭w3Z )Qxm-07Cu;y%r{Ai"2BHr%zn( {" Ir\X];+)A\ %i!_&9j>(i:08˓|[ŢٲGÕ0; BU[8jK~zjkB0P_ -H8} G[趷q1ܧfSD7pW1zRp;'BU6Ԝt$=R9$MZMleh/>IUZ+i<=Եr0 C|ȣ9`o1Sg:-׸_0RBɒ %U"4eO: o[p ҶؠG9``t:F;7c|wn^sTaA Bκ'~j3T?gM 0Q Q9ŅxAԬ-ҳCմ"v@8"9PnHFbftz5I\bM|zn0 pTwY⴮N?]]ށ|ʸe=S>t2fmZPSU2ꨟ\/k'Ks)Axï۞|J.GUJ%kA&@"m=mSlolFj~Иa/,(|TõުW1r2DuӍpog͸mj= mPGҲ]/F5c-']@4絛sNH)5n;la+i/DuWffyr2~zuogB]eE]w°1nC4<׻<`Du9\|~uЕCqxB$L)N::"X0/^tc徊Ի*Q)7r;&Lwld~ =O J(8^.K¤E'Nuu= c8ࡱLzK9}1ޔ,LCJ>[ۤ"xEL1禀%$ hB^Q%}L4٥%\DuR~wz_V1^Aqī [p!1yzK8ypfHQ6;r\^Fݩltoo( -~[iUyMz(K_:#Z`ƽN[p^6I9_35[\U%oM2Xp^ B1g=0]Q9yQx1(@&IM0JtK푳ǚ&򷢕bފ2GzGO%MټxxEXjHH2GG$B4Ϳ;t5@> [uD@wgZgNΛ u߽ccBCנuȕiӥyz#H v[w2*D fq۾PݴM}<|)ThMޞ D,w7%@c ;g2k[#@ƦEZ8 F>dй#|8l#V'}n'ӴG {z,*4n瓻J!5T/4.0o5ai.L5S"O~_M7Ȯت(P {'7PWdljVE(3m0H XЩCWZ5M[X_ 8BID՞z4IՈvќIlcbhUC^då]I )(,U9R4$atUY /90$rebDyXhh<A'BSv>aU\w†ֻ F￲ ^4UWS뚒t.>z@ n!E|&wW Jq{)7!Rd3XOC~ܴ̝Mҗ_֩$d& ;'w.<5seR9.;ӆ9lW֔ s0?,.(:V=%GNi::TE@V Sr-oCNk(h5}o0kTFBch.P}Lڱf>t7ЭP$]2KqrqE]"UEpը=L'ce Ru^b|MTjv`37Pzgjh"VQo _ZN _#O@ n^13nR4݄X% 9! ݥaVnPÃ)7>msD{ 38h6{²%t槦~ {LXRg U,-tOʅԡ1Wf=)װn6Qξ8"YG]d,GĤyEWB@@=JiIon|LERQ(0& z.!Ve/&C ybNd+;.G0ٔ`?;0 A'yRK˥MLj{l%>:zfVZx_&h+{77(gKJh/lס4E! &RΘɌt`L$P9Kީ ~ weW:ZD喝ofKW}OqE"4&&(sNtgGz1Fptc$֠jm{ 5`E-[xM4!_椅׀Q];fI݊ Uў|H;0+qEf{䍫 ;eǀu;=4,ˀQȬ;_BH%[H'&{QDbݻ/@d#TUaEi&2d:/^)lj m;BXzŜ.uI)ҺiMa3s,iPA6$ejcjǨk AYM1Sρ/BvTD5|h߳X>(-Zqk+$.D|3<*uqbԁH, ruG`LfZ|5D%QR1 tkoW*dަFM˪ Pe΀rz1i7\J}Q[ X-h8uWM vjį䓇Bؼ/Ka4d*. "jsZ~ 6 FLc ܳgE)`Sԓ8&pj6yޡkUYSv]Y;!\q,'_JZ˝*Z8nN62,Tced@"zWWx5x_w?\ǿm$P>tTL[ bqӊ)rt\<,q3!/9a(>& JYBt+I@VC{Bg b z4AIv6Z|Vo#V 3E;FXvw|S,78} rԭ| ,5 Jh_lGl\ۗÏ_#nz7aOuYF09ѴK׹ӌv" _[n=wI4'w'`KRPBx qzx*kv-WG;EUs8$QrE|(:2;/èXBr?:C`TF{/_&aF ʷ f;l;Nm>/I\JhPl_:2`dFuM@_ƂSkn-S* é&ϝ!NGbfQ.mǘIg89ȥZ1yqJ_,7jj0ST+y!Y@/Fn{~4v2ȪȉܗXt!l ?_%[3t(}M>n[*tx';-MvڑPCuaPƒh@GtuK;7k!Ҽ4# θ^PPmmH83J];G9v' X1*f`͈ VNwf6^ !=`D媋'[*b v8 ̒얾%$Q]*t#h^-jJ ʬA'6QWɐi%eJy} FE !#kƫsԏi{9?U3ϳnIyEgXUŃ#\~+p@_vsShӒ?X@Υd4y+fc\Hk}y6@ݱ~h!J3rIq!~b#t´u (Й"du1{*C!3% CHV2P3ujQ]w #\,> ѧxɂ(_fҎ]QIwWnbee@!sE/o0.u·*FsTå0+Y~;e*릃@f.q |HO(:933iXF8B@/sΎ]S-!W[$i+/lu^TC 1Lr5uN2)u\%}#)|aa_V7w*ux=dj#bK˥IQcs:+^;RlGqm>pǀ? /@qgIX5:]S/u()3ׅMg_l]vNYX,^A}ca# E\uD=K<6}ҥ<Rj*c)]Kz:;!m6m*<0eVl8r9PvQV&qA[m!Wbo-I<}ûR+:[b_ L[y{_WŀVxon3W`&Lemf׿ 'aLͫ ASB+?Y}IcVLI>oG Q[+Qt|̽h vߋ`=0@/tެB7k|ܧW\,[-"K|ĥ2xYYJA|4u]oءT9Cmm$$IWQ˜q(dOy2[Irn4J@l*1%*dϱ LrARm2뜨/xP+ylJt#ݰު)8p|W}fn XQ<(G\hi'~i*j h 6pД}8~)r\h4rK0iT')"-[VCNziJuصu;[$եZ?&衝8bdi*jK]5ƼDlvDXq1 w[t`0!4,Qra K-_$6?f PE8 Ѧ)fSrM;^ˇja4wQ}fLh&>Ɣh*>!cR#zʎYǪ}sc8"KoNo-IO`Bd``SpHL#uq yӨAMf.&Ucfi;l)5u2 ΫRP27% 9*,hf:d2‹& .yK78o ֭8 yM_PO6, aC(TMAwDg#| ՕK$&1lU.3[ny\ L fM=LOF5h2_DFDNVD5ˈfw9 ϐo=hճxCH'"6_G-.ek8e7魾kY5ϋF=ې~ʧN;`e̳nĔۣݯMF5m?D [X@tU%[7N6}> #;n.|C.=}-dϮ:f5벅J o8J}{JE}0bbL[1j;ګc3Y"JNތnjR.1ѤꤟU8}4)k1`Nio\uic;˱F?8sCt;įUk.ƲN0}ֶ<ܵȶHR*eʑjiB ZdT4Jr8 uaй.&٧m?]utlGawI~l1q+ *x>ܐ fUFu,^ EL+KڅpӸ:hG%34҇tZQ97NP1FlmQvrvǔ@2e+ ic*>"2 tN2[6:_~H"NİFHth\AAΎv@N{|9 oG mgMp✮d< Y+G"q 6 /@&©:dG3wq^zfԨ03m\/L j>`Ֆ1C6* XeSMBoi+"L:_߇Vmm^ MT ű:;? s .ss4bJ8 4ȅqgMOz>;N& PsCCM:"@ X;,yzRZt;s~Fޝ(ZHRƻW=19Հz΍/ L]nxa "[]ߜ9"h )+w&n?0)w\䗒_+})}v/j 1G"L.: *r53i%ݶS^\Jp^ʸ5Xq'}J,h.ҕZA?0EH{+:MpB1s 6Q,yN_i$aP鏵Dӷc:Qs˃+lyI$y~}8$kT\:Tf}N梮‚߽#YsOls,Ӿ 5@[GBի7cvwFJ&AŁA"G[>&:n5TjVNeJPS@֏q~üDOD !U\ }̓m7H݀& JH'΀E|p!k^FLɩٖiOzb21AeL?kM"ٯˤ4Gk.GuD2d?_PͿ(jR;OaXO=WC': :=~ lmv,`^yiY,,JQ餙}%otOD/U񒈴,Gbg]awd6y*T[4H\h PcẋH$lXjZ@%K;֦Dݧ,2 JubW$(`B6qvG>Av/ 2Հ|&B #ׂi kJ![25!` ',󒹎!ٽ{SGe/CDq ސ0,g?<1#^ ,XTgE\rk [l>4 @<3f?hx0'Lr.S9{9$q  3FiܹBG__TvT/u_?f'ϲR`+*պ d|.rУ{9ѸJ"od͑6dnֶ6nW/63^bd)eֻe4`cQx Iip끆 z Q \ě[)(?b1K`e=#^S8s4s'/di_\=N.PkpG.FNJ:W˟$M*(. (kvN=~>mIbg߼ٍM";_w Lt"|Ovoe0M;l*u|+"_ SY$s+8jGx$231P<@U6M $ Z՗(|0c햠Ls#?|~w+92&hK\EBA#$+&F\Dp)K»n81kmbY^=}{$GG`sM@|G4#jV3q (֬A^+;T_ޅEhI>ͪ٦O r)䅛Mū<އ+v0sIMrLm"3|Eh̋&%R̈(vl68ɾMQ]TLwwN' 8u8tKwҡ}.JŸlvvՠs@G>m9^"!Z֟Tujs|@NaäLTEb(O(=koIEԋ<EǛPԥ.;ެۤAB<~#۷=T4Gwnڠv d'rn} V$xV}#ݎ(W~AN49ڬ~B1y}Cڙ3`)VJ03fE nl Rn03QQ7i^1 2/i(# )ƽQD)@~2!Kh妌G̞( _Nj}ΥeG ;rfRwjk`OSg`2`aBdq,5FpEAޤ f0IblZ bwfNbOR.tZf:f޹#7/TQr{pDJGN4(?%]r I}+:RTKH+7VۤQ!t&5.8"2^{^OJt@/[Q%HUw]+j,9p cןI4$xMc/I(#Vsi_ FY,MEZ!]8)t5U:IWYt ~gGKVZ~Kh{DHK_y?5oL"M彙LD$+{5j7?G.|ȑ)ћ=-J \MBEAֲ'ʻuɓlA +$RzvLM EgA}P2Jea**-s?;49GDg]MX!N]{̻0 }-gR!bf@vSH]xU:-?U2p~fH=%[b?W(8!eOV37QWE,<4~8TR$"8:$s~}LR,OjTВ'8H+]<[CVMD'rN,׫R88VFʨICUg8-l JjbP2*`_h,g6A?4w l 䳊0ѣd$L#fJʶC6Dƻ g5B:뾡M 2H SB-L»}9)>u6ndN)uLwJbMYi(~[ʿ>ڻEypev}kE䝣3Ugȱ MnFbsT OgN m\5:^]Н6M♉RRa8Kz:lmmKQ,Ws%E_cA]T8x- &U:MZ9MɷQh\w-®Md Vj,tc+" "qD9~3v0Еb\=s2&zB5R]( >wL3e+7Xsz ӹ]LEE|;QʢP1G J-'mgZ$sZs@#u,NS 3q|# nɳ . !ɞx0v<L!&+ݱͷ 5P4Q܃,cޱz8TBFX%`&K8g@]WwpI}2_ 03;OicϦ*52 Z 3oe͟`<6@S9?|˲uKDMOV&gmzjY _CuV&L+n҄w~څ6S;XRN{H Izo.[E{^l>|:r<[x٩<|9V$AX\x_$FTA#t#&V ̒[g[mk>%AR6EA~=nr64G[mF( ?>M?x?akΘ/CI0m"AZˆSo@ّw^w%H$L-:ЬKhspReOے;xTB6P(SW|o%k/WX^E^+^?1~D}~rM&ht &qpMy´</|'cz(R".aҲp2v)9rY>^[b䗒%():Xif[iRc/%Bm1tx=w5ђv{*42KGWVo^DUw"B`zW,FwNAm^FlF5+ /-̌<3Zq?1(Lcian;xIKX}2`͟e2lrѩai6*^ly=q W^P=ӳws* W0(Z3INk %z(Mh&>-ٿPqSϲ p0^ &BP X+%28 qCNmz׮8`VFu nFa9wWI \|Mv60RJP007gumtJx-/ʼnrsшc]ۃLI "ͭ^{ d:CQayu%M*! ԃZv{OZ9EAKwW\T9%{>xB[yt۠5} 0ُ>nRIagيÙ~܏k*: ~Yߡ_re;ZE%P1&bKVX2VS4PΤSk;LC ;^PG5 ʹ}@^FS0+2?]A2N%~BH;-lk+K X'݉qh1-EOI԰ !1xdGD<^> +O '. F (`nml #3m>C534q,iO b]]adCq@Rg"ή6$hoeJ{)"Ѕn55$.R9R2*26!f_): YB{XSzwxDj7OO g/$Kj>Y+F}fx9zO5b&\Z^.b^ywυS&pAVt&JtGRbfAxh$hTgܼ$}3u9r ii"܉f9{QqӕmbrLxQƃ aH>#AF8}5N&Cټ/ 8YJ힡zN`I#FhVshuXS qO',g"gvV:MxP$`ܕ"Cq OW9캅 1p:۴Y*j%+#a|4Ej[]\ M] 8 fv!~yQ[ltUwː-C[JI0O<.܅3HeVx4![ :M_L2\J4foJuV D1p &6計qLN}uͽPHhr"XZ*8lʆ59G]aAqчoBw1gqζ%OST hSU?冫FkH)**flpG(Mfj4qpI Ha;- qc}89.'POHg)DJj2%Y m4iR9p#[{{yS$V*f*0`nى'ǾI !YGI+/2i " m Dk` Ĩ!' Oy-V]+ % E`/+93;=HO 3G2Nԉ-D>zb;y z@xZhޑU B |G :QM%K)vDbJw ǷM}Pb^݅jm ITd@,c7b3AĭkG0RK+gFigξ0}$X_`A2H*qʛ]=w2#'nCYN܇"/(*f5QkSqu;hZ #s<]}ʶR(.WQC r­wrUԼa9UW)fF'2M>Q*{ɉr&yuXU{E>~0 ^\ >R|' A_j->]jt.oI~yAsKDE7dWxZ3goN <03M/3N2lfDyw㡖̓- 5M ^Qś xmR`Y~f!hu 3mr; Y~*2sV XnYŤF|+5 6\i~}>K6kGպ4؝W!C(̑Z|3>+2;a7 Qv"DP/e0\"뤔}Y,v=RqsDX15ˀ *M=Ѐ_HE`}mT[?HLQ;]Ѧ'Kp>']9>bXWi@$3 gkj)AFBІ<>?X+򥱂(R%*PxWzHܷΫv;aHh:~*8 12s(gUA:g`@f&]-ƛ1JwqNNiԽ뽿ex`7Ǚha*! kXz* =<5IL:3:z~Mso8R>=JdR obQs])OaUF &/N.%O]C<#xiY3n˥¡w _>'M\ RHkrG? l9/l,=ڹSJ(2 nz XD v@$>Aoh`6Y#'"7G`_L&KI]ҕ6% )]l;Sir+K23U*=tf- \*KTzrj1H/"y3 û_Ԥ!& O5b%|@{ H왩^ bj*K{ؑЅB ޠeܩ͔go?tikO5QWȚ܊FiT\wF-0_mͣ7KZڎChE&ͧ˘\_dmD 2|B4TAHӳ3> )a` R̀!%WDkyS7k`Z>%Wf%z⿗UJ]=m~*a,y~C{!7: V_hJ/EUP,ozd(:xaBeH) `Ka?\1ۛAyEM+~K/w%|duaT5-c򭡐S16y#ldsTX2;W;lTg}2I$L 4CM]3?[ #ץ3U)ߨjntsK1'e ͻs^r0ܞ(,Bc$&FK1`KS~lV[ZT,i^!LZv[H/^N J1Y}y r Sl}N2,;-Ju{Y;sUlyIJa^EEZ͙{uVB+Fk.d+QV)(L /d#*Q.W|{욂/)^CUM5=K _Ō0--قt# ֲvp ъ˃ *(W*ZJX=su/)L`N{QR`:_x-_;ދoq3m`Zc eMKe_ܭ:*'$7AfvUutkym|ҙkԠ%˹%+ˑ>c4=*+~or4_VE2 XZ u~ I;G<\eX2<<#[>2v**F=Ӫ8"ovCAhYv0񥳼 b P3:܏=Qu&vuS@}GT9'u!@b?` 2FCZ~C^-ewV8xFxoG*BԻD˰`,_yC6ar| ᭭fyT$/-gJhsfs)w FD>Ύ!mY|U]]\-rnr,y^5f@սmYِNW k6`^GfV5n \q2'"xf`vzYO ;y#7}$>% Lnں 쟚w" J` mT鼑D0I/ζ{Rzѩ:e oUIl+Rʻw"ubF h9U^7I! ۺwC("۠&}ĢM6I[kPqO +L-5Ekٷ 2ɫp" /K6mtF4v-^S#,72kƒ960GϪ&)9ޙ(J}f2g6H?0V?7'R&+hlՉoyT&ƈ_ds*Y-^m_,'j?MNV's?vJ '/7<6ňq bхW<ɽKMe*.Q3O>F"ѼȔ_z;f}/)OZcOxms:\c&: YN)3.K]|+61rI{cO$z̦x,9a_:GO(Җ4K=Zc:]U˺'>>Do:pAĦEB D / kQ_ei& d?K;. /?lQ(cFmTPw.$=%tƵ/Kܷ 6Ӥϐឮf9)!(=8۾bPVF5jx[Tcc^{VG}tc>$$$#BKӟ_VHƵwΊYJ;hE+20nvu:J9IE~ݤg`St׳:Fch_?h'ZlYfꗋ_yqAZ8dE)u a+iwop6ߠ~x0JsfwRND21Cl{H4R-† b2^#s[ȘB[uVחPO%ĒJ F^$ou,Ӡ9Pt VR8S@Khj8>v΍f6\BAPɋoX_ubWtL> a! vbŵ#v%_ב_U?INunZ 1/*ALlfyQ Z޸)eꏈI0Ɩ'lQ6.9!kchx`iƪyR_}#i-Qji۬ez1-cKDڷOu!w3wwUf @.έ ,dWf1 oFWb5>U(zf23ƀ2И9~xo^5p~ y/ܱ,Jw6UgoD\t‘w !Q>Jk4Q)WYy h KOR3ԛ{{Xc\ޖܠKH8 igWc;Ccz?",7 tB8Z 7Da#XF1`vl>9Qŋ*ҮGAɯqX 99Ak6) ?ьP%WT 0!*-r;؈u}LA::UG)·)he]"fX*hUz$PtM@!}WRŧ-sdT&hfK%vQug!t D T~0!l'HGh*y¢~'=mfDZ+C"L~"xK'-]&ۻ2^ݤQ_6%4!=_vؾJ9*lc}W׽7pʈ6`/ I4tQH7F/5: *ՋKsg(SD(Iԫ^`Lq)Xw2qg: ˆYL]S9B\C14>dHU`3Hu2qF{g9O'^{?LwA4S;]Mƒ* ]\8y&u7W^ Gt9^2@Q1>qWnа$NDA @&iR "r'J}(#Q$W]hpla+D eQ!՝5;QV!o-36r4ާOzZR=?c2U(O5)j0 BѪi ˏ詘r  0G"QH>/\WKԺVBCʧy|?3ڸ4i~FÄ.)&9k~NB'DkUA1l  T>:8J6;+!O :_UG*[]_!+3:raNj32W̤yMEFXG ,uWL_}W:9%AY=C%ZުP Z(kOH:eAx;ɛMۇ/|6^6}9UK-ȠNB i]Zatg=^S ,0#L3BN޿Jt˕\E5\aȮ>)*Z\Ϛ$^u`cɜkjǭ6z ;61;yd]@\ԀZ%zAou Ƈi^>%OPB |̻$ѧZƒoy"gqOT#Bv7qX7m]gib,΃ :(pܞݻIno^vHZi$nݕZOrk4s,ʟ1\%{!N9reť8[ytXԲ'toe)]Ļ墐?ڬ37Ƿ78}X-"'~>.Q?|VA<%"+s{nHn CՐ87<'Qgpra`SG{s|^}"Ѯ$kQkc&RxL}kpAY>(q{|`7D_>NuY؍mP3IhƬRn>1 ` TeOL^vq&QnGpԆVcu~_Q@BmBYq3Ϋ V-Fq43_q[29lPzo jsL)ÃŰH3G7vU0bU?ZErSh7]xϽ6F~Eo_+y$)4ZF6EWb{fE_pϤ@NKJs#ޒB@!g]%bG(l>C#'u%k~Y(pH}d*E 7g>䜢"Rj4/a,VHb7ݨ&C m#ogMjcԭ(u7<=y%k!#n V= rwgtD[`+?!Ex©d- j$&_OR0jj c:@]&6! :*Ova5V\@Hޯ[z"\'< qyHJʜI~۳;`Y}͖Bl+ ZAP{>x=?𝛹srWr\Fwf tEG,{z53fdڜ4É1ĺ4is08׋7AdCCEOjjLrp2 >Uy݈jÈ:2ςo ֚Os݂(bq씞f O!=oҦ[a4(7|a=A՗ ijjq[Õ/[h4?i,=a!fޜ.q㬗Yn7#ͪדوǐ}_Q:VtpńCd?UP3(T#X.W%ꊋ@u!ke{nCYcCs9Ϝkp#'˓X7|ȴڎoRVąVm8?*MQC㱢9OQp zis}-k%c=閟&iIBKZ.?+6U['JUyS$';ۋ?_Xw'IGF)N?[w55|[Xl/MI(0,zo$Ӄ6x_2 Q_xS Qz֫-Aa@`A_qE/9S̓^cvhY; $LH)BH _6wu/1;T'ZѪH&&Θb6m薙l)[wTyYl!.Z29%-3M85C$c}'*b-U|AN<2p`Lscڍ^!j k'ÛT(&%g,m!$o*垒w(5?!G7zΏӎ̡I$OӅoEnj5߆ȰiY4bXs G!B֋'V[6&&f$}ǯ@SD>EΞDzr {|>f++Z ZKfBqxY (F|0.Ve%SGOS׸^嵃Bw8C'fN=I+GNRVDFTu,0PT"_p;27vm[sS|11np#_(˅ѕ~*'uMدՐ%S61opMG ё`α'\YfRXvY[ڭR+t[ BS=)d ;*lߵ;Ľ._>KfBqxY (F|0.Ve%S61opMG ё`α'\YfRXvY[ڭR+t[ BS=)d ;*lߵ;Ľ._>KfB1xB2#_s@:gφX.KegN,}r sS|1+Lbh}oѰ)Uߊ]s8Aݖ2ÐO/P.wzR^_|c(y f]~Xz-{{`䱌3sLF?g*~/{ߣ)2>ъO#hH)/ka,XNSeUSA?h6YgJȀҦ9ʦ<0E:~BaQnt- ENkvyUjshwhͻ"@莓U[@e%k%; +g,uϐ 3:uaI9TQAmO/'h?k" ꤗdyV8ʱzLp 3DD5 ?tlև3/#y__.Sij`Y,i'qw{ * UW1;ڐ Mҁ^y [MeWU6Y4V>NYK,D2}Rijl S3ݼ׎c2Ȼ"ڳEp 2;/fVٟZtVmѯ7 9D|kV8ʔ/ܲ STJ$d"C-InjNϋR:ً\ϧObvC$5Q %C>?Ua $eXe% "rmDcnS /Qڗï+~w'l"b1wb)Jmq->{.#ag7_X)#-DM9 ic#Y=B>Q6kII8Fx@ '7d7J!XS[r~Oұ鰤F>8_˙C{1?53=qn8>/ohl'8 v)Hv kJx38uT~5xTzeBֺPTڤi12 s!5;Cڮ BcbPPŸ!@O٧V{@aU ߖ-hI?cH-̤O~'{oDL*œ9O׺)W ˧+󲀕Ć1 U&YEVK\WG `"r&DgE\#>-a`eJg"s>dါv#[MfE "f{_]Vj\v}U|CV ?25A˲id!ZM[9fbDRmK50@9֊Fdzb2tt-hr)98 ="6ٳ#7yR4uFĞ (aRz}vbNP0h],) I,:&Gg0s&J݉Ate6N_gW9Ԇ2AwhVV;ݶRB-?j/@JnL$ܷHg=ǂE[2R8;⺮13.,iHۡ*DŽ .vNΌsez,7.;%i"m8bvkۓ67hJGNVZnhoGsKU4oV3׉c0&poGM *_`NWe``NUyWϳ0dѫ|g nMbNW W|ctԡxNCI3ԝw?|NM9y6NBh K{ۊnBd4[)vbƌ7gM␰O:ѥt.}Jkn-i76kuG~O#=O?7l0) gdM:f&hœ`v`+y. A)¼zm,ϔ<ǝ~A1={v*-dʄUfm#FAT.i]SlN&iU82?d$`^E,6 BiRoc[%|zh1C媩f7lb?Z6 SMLQ"d6zp yHX-tߣU7gC/ sw2ӟ(gր3Sؙ\^ʃF}%@2#+v "g03Nvr=п!Gڃ?g!0r!BC@.pPȡ㱈Lds*W;˗A݋qZMH-nM:ebc~&CU;O_ElΖRaqC<'SbXF @?~iI~%I$K_0x,af Wh(2PZY{#ݪC=7zD lb; VO=Gq쮸N'skigC԰^o1[>㮏N}H?eŁ# #Yj;PhM1 %?7: YZ