selinux-policy-devel-3.13.1-268.el7_9.2> H HtxHF_„ ?*}}udwyUڮTy7Fó*:̮zeb95059b97da6d550a3cdd9b28f627b4421f2db4A<# #va׍F_„ ?*}}_u>e FBoėr:ahs>: ? d * ?pt LRR !8R +R A$R R HRR*RR8P | E (890:.> G RH RI <RX ՐY Ք\ ըR] R^ 4 b 6d 7Je 7Of 7Rl 7Tt 7lRu LRv a w chRx xR Cselinux-policy-devel3.13.1268.el7_9.2SELinux policy develSELinux policy development and man page package_sl7.fnal.govpeScientific LinuxScientific LinuxGPLv2+Scientific LinuxSystem Environment/Basehttp://oss.tresys.com/repos/refpolicy/linuxnoarchselinuxenabled && /usr/bin/sepolgen-ifgen 2>/dev/null exit 0p pR^q'"-%$#5-3z+*I[+b$"""/H(7?#3J2*G"&'KH=()O63>)j&0h&H/0t =/:*8"-%FX n'4$7-#3jMw0>w029!B4%48*K66m3-4('<W -* .&.z.^-2.&3&l!*%Q$$FA":4955K*)-:pP9o/UG6.D)>-(252215<$?R.@C.;E6 7=b,t2615w5O4 ?;5RQ#/@}!;A$q06(4N6j4 "-&h7%=$6zLa,J,g#1/(076E+~47,8JC95F%3 Q%!-S;Q5'-&5%8,+7.agA;HBjHS6,1o"40+./`5Q 9?i6./&95754,!1}'$4.38A-()+CG%0./-74>679,C:p/#0r" J> +w$2; E*yF`*c/0v>7l)4QQ+01 0)-y8.' 0Y8e>g':6(:60+(yBG".')\.k=6@,6_a).I947Gn*I/2'*q!{2 &&.*.LN(C$#-3U)I*A19="69<7 28BF/<260'(#@_-.K:`6&Sn.&,9! &3XP0@z;1E31d$)00313|01(12RV'&6^.'0'22D"2D)f2D)f2!(,-=C74.*h0xI!& .0J.'[EE=?0(-&'W/.U;0AG0J,$/b=8F 2 M)B'(7$6<=677\6S6SS''g37K)&0hN3!Y1I_ /(()4& $p%05BQ58f'$#!r#B--I0}=F0TBM)H#0& $%.:0KJ+6J2r/- 4.2-03-Ah55.1.5-7.]37j$S5i6,549q,,X-J*,+=F0="274:..BCr>*A25G?//-18O%0i'2u(-*(})+!+y() +%$\%B>BW#-'8?9.$:04490#"M.^(FO27'\ NMDYWBbY$5u;d/ \6ja 3] Vi1>q)II!5 S =s + [*U/V("3^w-q67A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤A큤__N_N_N_N__x_x_x_y_y_y_y_y_y_y_y_y_y_z_z_z_z_z_z_z_z_z_z_{_{_{_{_{_{_{_{_{_|_|_|_|_|__|_|_|_|_|_}_}_}_}_}___________________}_}_}_}_}_~_~_~_~_~_~_~_~_~_~__________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________N_N_M_M_M_M_M_M_M_M_M_M_M_M_N_N_M_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_M_M_N_M_N_N_N_N_N_N_N_N_N_N_N_N_N_N_N_M_N_N_N_N_N_N_N_N_N_M_N_N_N__M_M_M_M_M_M_M_M_M_M_M___M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_M_N_N_cd065e896d7eb11e238a05b9102359ea370ec75b27785a81935c985899ed2df6846bbdba1149ef9edd39c6f18d37f29e5ed9cb3670521f142ed6d7d2bf9f2b8342d2c3aa4d008aad3243fd00e4723033e27e253289356cdf2cf9ec46135a8327bceb4f36b0f077b7a232a94e214b3b0a5a85152e4d89c193f92ddaba3ede1ad68e255a899ee23381e7c3f4d64bf4378a8bd1b0e01580a9606fadd0afda909e078a6b2a805722071b0844f50730c72c612395847c31d56b69e3148757183743ea2113f7a59863753e2c2ea8caba2fc7b7416c3b44b64339694de938c0247be369d1902cbd5bcc5be4939841f87e1b2e790724808591e2321f25f929b8edb7018328a2184aced0a776666c6067f4fbfe9be06f1103d7bd05e412ff94abd7c0db097a67acb10ffd79e2ac63e55398cbf727efceb6ea4b03f66c888eff1ecd9a363d72bfb87333d41c93bf6d358b6318a0a92d5241fdc7dd46b6e0b93729ececf8833c07100b58595625378466fea62c105be03309d3acbd717e1e9efed767b9e66d519451a61f2c53ec7eda0185b022430a50f956b0ea20e7c646142c9e434dfa10339d78b27d8b34c093e5529fee9973c840ba7a3b6ba581a97b8d2a17cb344a435eeebcb37e9310308a3cab032e7e6bc4801be10b900111502dda3815db5f6810316e84f898d3b520caf3b7b3591a0efe5bf9cdaf78d106e19277c05a621f05b846f5355bfbcfd3514a21449572f29f9884e5668e4501ba6e024534e5d4dd5e9d411245f5ad4907030597955cdab06ac4ed0a6005006a4371e6fd15265b90f96e6473852ede99392f3a2af18b2789f70aba7145b47c2edc5d93c63c2eaaf954f0364b19f70c907ae0f2dd8ca1478f250c1ad9764cdcb1e3bf5374253852b518076ef225724e7781c3c4d7f672dea103d9d8311d4ec76a462635b452647de6823a4cb85003e44367949dfe3370fef1188884bb08f262ff2dd8b6fb9cfdb5e830a3c87564a93524637c372c9468707e97413130a64e274e173db6dd98e00b800facf26971e85be169324d37087fcd9a8ae4c5243f7d371472f1bd9dc58682ef6ba37277a5e0e681e71b2bceb90dee324f81f9aad26ea8c541fbae82b28f5593bc61d9e32ad160d08d873b663e2f0f1eaa213e683f3cb86925ebe255ad796ed49d69d416350f8d4634d1f6a85cc19ba2b1d6e85f27f9600789fa44ac3d1edf5656f381fb3cc2a725d4b792d69cea533aa4cbadce4f4149d218216e15a8e72156ef95e1d1074b5007c0fd110e0bc1537d1fb66e218749ca62d7e8a4c43fab08267d3d72c0f150cbbcbd54e8e2abd5d75c676a7643d4cf38722674153a5b0a81d2dd413049df7e327ea4adc3fd59a5c8a45d29c5c8ba990ef7e9c25fe533aa61a0ecce1e3957e6506e02d870c58704e368ea33168f25de1ccbdbfe71f512445cbb9034296c73b1041b362dc7aeff1fc80dbb075497a2148feb1a1bd6de4131a10114fb7d2287081cd43ab132705e55a02cd7887885ed3e8ee27e1c29918259aa43c1c030fe3a82913fb6bf909acb6a2bd69f98112a829309f6a8d57e693c20629b6a2cfb5be7fb45c91c98620927822b96e42ad22e3284d62c6273d5787eb8a9fc9df32f9ef5a8fd149beffc14d33c5170c3b2b3acef1501c67c2919149ea7939d19f784580133749158cac4ad7d37150d155289bf95b4b4a08643efb9fbe0bbde65b1559339d0439c90cbe5d7a1e9cd2285af15ab62bf5fb359812b4025d17f26e40729548d5360fb9ae84e7e0dcec8af014660114c1dd97fb4d731438fabe424272bd8ceb05209bf56ab0e5b64c6c3029ad543bd12a211c38bdcc77713cea656250401845829a788794bf30e31590f78f1b59db597bcee048c04a8cb3ac6aa126d7a85cfa173a8a62a72848473ef6c91491110ea6741acb697148227b55f284b2865c4dab1895eb29a5062f20cc4dc0b1f99a7bdaf71e9eade5da7234da32084aa7258e77b29488b1f330e8768cff80a2a30a1dab0dcc6386327c45539c7cd8b3caabb787954f184e9a406ae926eff030558302fd8cbe5698da22404d1acef9d6215cc63d7217b7813ca122f3cf293b48cbf8d7273413be2ef41d085172eda2f31210ddd2ff308204f27d3760fddff4424346b1ba58d94657d35e3bb6dcc8730d2c7d538e74be75c063859f348f97ccace7b01412c17055195b2cfb4d2d511d320f1deb5ee2ea1f3f5696a50555e8e48b68098f8eb887e296e21f5b4e131f282137b24199bd8d49b88895cf9d5061bfbec47e7ae16b74c7edeb10b93a36fcbefee44e0949f21ddb2e32281bbb969ea6b80580a5043d6d82daa2a4227ce6e35960c10ce4c9ce59070d75d5b21e082fc46b6fcbea94f0eeb4c04af79bb76df10801a21db9a92f5143ac6484c870066ca77a713257a5b6dc667d8ee96af91e3284ceffab1631cbe988eef7f09123e4e30ab40fbc6507c7c29496cb513b3883063bfac47f046c1b4792cc628986bfab32726f4d98063d9305172978fde420b6fb31e07bf1651dca0a8d9286915b7d2acdc91486d29c1314bb3f14955a34c5579a76e7ff074b633a919455da1dcd15a3434813879c148109004f83a5cec99e66d506700fcf776d95c7abfcc186e1ba75d01b0924df37607a97bd8aef06d4a8d3f2397d526b9b5c89684d6aedbede36898cdaa3b5e2b203cf71ff7922846d4eb72d40089d588f3735c9ab38e7b319cdc7077e0aa40117b779be03c5e58305bc1c3d968663cd0febcf5713dd16a30857b9d917a98935c1acfc1977f7b181004824dad83175d87ae8117cafcdb9b87f63c2f25f506b10dc174ba8cef36bbeab1bf2d92c83e0a981d066ffcab834665cfd095a788f636c3a6f475834343e8fab7a3294cd60cb38061ff300514eaf94867e92a1494431ee21aad81ca8c4e6a27f4e21b5acbaf37eccf0bf470bb2927ecfc5969fe512398e933c3305bdef520a02def1cf93269fd77a71897ffe2b25dfd0a8e0799aa6be2b26e3df4e089cd998f430cc16652f9b688f34442e017b1a8d84a952f8bd8bb3a263403d0cdc704abd4f17a2ebe32f025e2cf279e86eb56d629eec856772c7e7e56c768dfcff3a8086ce27c17c249291fb448a954b66295e5e277de6139f237e61d4a53105e29d79b21fbb9c5624fc0a6d5183d1292843ed28dfe5d963d1615ec1ed786561da376ee73b2974d4f18f9bac2a5763877626bcd2b5ba06fea298265ef843acf4e79d38b6064914d46092d7c47db7a3e504ccfe71a5505a6f5bd763fd0a73c52012096b26438739bbf33cf92132944df3f7f4023e7176fa7fab7244c5b46d232d099003aa117516e9f474ead63c22c21a0f9566e302bf157b7e8074c1721788770aa842c8b331fad5af5d5194d62e91d1ecb9ffa7722d5936e303c3c055731b2b1c861b8f82eea2ec4f9cdc46922c8f526aef82ce0eaae8a009f704c1b3c44223632328701cfad9dbec6d2813742003ef5204cdd7c89c72c1403a4803c6c4ca846eb576a84f2f8cc15b6ed5fd1f4a502216974b64d9925116d9e31c7399f167eefd34511c5a3b139ee874b46a806e0ad9cee0d8c7f1d8ff3c00101da73641fb738001fa2c6c56d1c7bd0bbd4fa21de6dea94c261656f30fbf4071dbac73ef178347c0f83344a1aeb2265611b9dc25397937b6ad544d6c8226a79f51ef8521bcc354182d28abc55f36d69674218b41fcddbd2bd347a06ee8ae72b7634895b493dfeb70c144ae1524cf7e2ac3bb7a71de35d5cd30cb76c5127c459711b3dcff7aaaf26ecb17b5f77b94d67ebb658f1c9c20543cf4f580e998555ed667bfe9843fea524d8a5b8d4cf986eb27b5657731c4badf1914fba32b15544eedc2dbed07c94fc6acf86632263f970a70fd85d1cb7d48a9c26879a1f99a2edeb927399bbe7d3a1f54fa29b74ef5fdc56fa2dd8e0cec02b34a8938c83228e5eeda2ee7673937d3c0ada21e07ac18404ae7692f55f396120286075ed31e309a9ef4923373343e711f7ccfb2efccb6b957abc883c62dc24c0c3004aa5df14f7f148ca4bef48e6682aedd77b4bbb40fd6dfdefc1a15a43d924d0506ba10af47254c64ca92c533c4affb005ad896d28ec37c0454d26bd450107231fcdb968b4f1e75cc964542c8cf461a1a70d8dc9544547bf54ffc692910bf813cb61688a1f2d2bffff770b47da5840108bac5165feb0bebc914320ec068cd276bcb30f557924c643cf85f18b058e5dcf0fdd299df36626f4e9b2316c75a119f913cc689973db297ee98444ca597fd4b77bdbae4274f2d819c32791d4d8ea1471d4222d80935ad44090a1d7ce4c318003e047621c463fb60540f706b051cbf76a948b948b1cb27203226ef420cf1c105aa62e7bf2a870188e052debbd1d13a60b5c9fb47296db7b6070ed890c6cd11a7f544c895a7f3b55d821df18526964b7e823638e50908860734ce4e64d08ca9af4d17a44cc19ba0e17c5b02e3957e7abc598094800f8b01891c86a40086dd90cc8743175f5a864a63ad4bf8f7a273c5133d0fc9837faddaff05be59196aab33ddf38d49e7dc6603b3c79356765a68f8b70204c78b8cd00c0f3209954efc13041379caae05ddfc9c79fea8471af56d7f062268911f7aecf732df29c1c4800a5df432aaffd87af587968d5ec0826023dbe5e50e75e5df18f587a9eac36dab8c862a72e2642bc7c4ab2499ba850d804f4635079789b95249689bc1e9b4e828bd38a6bbf07349eee67cecf8663216190e06054cbffe1e0b3926ecc6a33251cfb33830e12e69cce3cd084749cb6f41d7f16f5838a57839b9aa37951e75b8512cebc8e0d0b458c9c8dbd3e4071714ce63082753734fc674db00a6ae4a6f18dd6c75805c86ed6496dbeaf1e2be7cc3505067892d10e2ebbda7b6a3065db9fccbb6d0ce40e89d6092d98e7df7c07c42dc620b8404d4ff92ead7ebcd81d0d0f8d8fb2aad5bd4708d5b15388ffb8e68022d47445e80004fccf7a6e3816e6d6eb15424c0f300b3ba002fd97c791dd94a6d0e19710d0e6b2c5cb46bebca225c1de97bcd4da08ed6cce02b37a8834e22342f37c822e3a37176eefea2e034302ce80762e04f6536e5aac6cd31b14dea1431ce76c85224d90b3faf1dae5c79ef62cb453d1c7350ebfcdd94e20278ac979c8651a95dcf7ee2788f68f7a87b746e61879dd2b7cdcb35a31b5398028019630b8153c28d08beb342dfbd59babb56162b329eabdec800a827a898fc8db4545a3d536d0f1dfe5a6a8f02f2fe1715bd7bb475bb73ee1e0a9b42b3332f25911d5eaa39779f75ba65be71a09b05b1a2198019ab7df87b486594fe6536ad115ee9021d0b151f32ee4431101a9efd257f59f7cdb75570b50706aeebf21f5edd6a47d0399254487828415e6ce8544ed22a7c0b1a0cbc4cfdd73b961af1069fbde645ccd758ff5aa65d3b26b463fc57002d109d14a1427d737dbdeadb913778d454852d35a8daa8e7fd18d5f513ee8bbc7617928ff1085b6c6f5799281ef2018285387d4dab27116d83868a26666f9c3f6bcd0240da1b3d22b39edbda276357ec2f7e0fc29d3f7b95637f25019d6e13aa147fff89990dc503158bbb8cbd05eaad84b72e0930d10baeb9a08c48327ec9140e197aa9863e5c14f7b2fcd7762d94930f3fea452cdd8d3c35a90eba0b430a0afdbe104e3cbafba265289f57a6c7fd32220a9fe29a0764b5329f836fc225f9e284078576a11b5f7eb0530031593254007886240f80d6ae3f39ea577dba8b00070f4074d1d4c7a6f61ff1519ad8c583a5c1624be10f1ffb3fa3e716a9ff420e73dac9c831ea7fbacc3b3e222adcda69a5de8831ea85c06b2a5e26d4ee87a67aa50087a58775ca56cfeeeccada968b6c9fc1b8d906f45be71fc9bccf0087342852be15007dcd928ca0bf719e4de7d22dc9bbd7b8aa225c1bd9a8f8dfbeaa03e9e9622825a0af16e741d2f2f1ad9d51d3e7ee6cce1fbdde99ff95bae0e24b4389941c3c9a9cc1a2b30e01d69218e5ea7093825aece4afe9b82bab1c621e1d85b3e7931d2a71b787b3e76a6b47a6fccdf84a3669c697ee0a0c4e791a3e669bb2a394acf68de16f8cb7df8e1aff2b64572b673506f6ac8e61e8ce889f050c43e9e41e3add195858ab76b5acf37feb52f4ed37663b5c264d31d2a9636c7a2e712f2729ef10a5ba08c0a72268714335b5d9811ddeeafe99fc58f224fc586cba75e6384e442a070f662b1adf903df89919f8530a77590c15295e0c086d05bf42b308f0a9aa1e17e00e0e05ef2498c5f4c0215075e1dc6b9893f2c2a2df2995976bbd9afa1e755ac0879eb801308bc9141c59f38f140abe63be54d9330a43aa33b110d4b3913ad934ea6a5b69046d6bbd93ec6f984772838ebe99a7105f3c34c420c359a45a68725c7bf38c14e9c368e0f0b90de79ce97e778e42c655e6b33e24fdcb9dd6cc4d8d812e1b00c2edbd4300fc1c544e52aae6d5c2d29fa9d782773f1fbf7c205a11b147d6d8dc9c8107c20a30fd20dff2016b7c381b607eab4b7196a8738953ae07f75449babd49eba7163f7b574d0ca4e0da78b5b070d19579324d12427d869eeb09b225d0fe548b810ba91808aba45dc955277c945ec035f0ee9cdb82306d4c149dfa4d4ebc649776b9ec9b542f264351113f7638814841a3a04067e65d4b4a53adee2907d317942258876a0c71be5ef16d9d67d7b40fcc9da27aab7d0baa114a1c255642813862155810641b7f0f096cd0368f577ac3c4385fb1870c918429ccb1ccdc3bafde5d8002576f7995aa437683042d944a8ff94441c7a70c05f2cc6eb6bb0ac03eb93f565b9610ca4e86db8860b653854563dd4dbf955409c16a7d6c6584444449c90891090f3a7da148008e43bc5b73d468a8aabc0991a65d03724e128f6e25a6ba4f584c5d8a0d8d194d2dbaf4010bb9e8e8910db3293718c0c85d6fd776e8fdffd16631b371aa5490aaaa4167a7f32eec915713f87e8305ba728db39e7ea1d6465a95ef110781f955b49db43c85342508b262c4efc5142a639817824958660101d25e127fea092dfcab0ed2ce1a3e476b79a10ea6e64d10a41aef0baad3b4c54d341dec19d3783fbf0adea2ceb5aa0044f86d27d31ea0bda4456832481ccedff607e8ddea2869e43f85093b97a44e3f7edcae31a021406bc5f3f1f013eeb7259229031cd6e016f91492a809b06ff7f61e3b7dadbc3c8cf72ffca6e7e119fb488ae841fbd08dad72904a28ea1e87ede92e79509c07b445a758fc9bcf2b4b4dc5835f4e081fac31973dab4776fce5ddcd11b9d1f57a9ba2d15ade85c44efe6ad2a25fdd9bdb257b960c7c5774331459d7b7e2f713d0f6ec927803eeb0d51ecb6ecef51ffeee8cff44f705408f98a24f92b24d44e25e0be79bbc7e16b6a470934ab67bdff2314e75de086abeefbba69edf5c3c23ce945b37f70624bc0f57792b09a089371db04a9d96d42fcd0f11b2e2202fff1f2c14a7b014907fcdf10d38bafbd3067bf02d5cea383d87a1c836b43eaa73ebbcace44b3afb1ed7fbe9ba239a279391a969c0033bc3d6ba075f935c124b76982fea89f385b00e8062d9581b831449203022f5c438277b5c3475c8ce0d60f03c57f2792c4b0e8840c0cf0c78dcf706cddd083144b3481dd1b5e600a5d5da961df502d7d67ec0c54d27d86bdf893a53321261bd341970085a5f00606a04458bce7b251e064ac3c317e61d0e923840dd893b99a6090a4b3aaf2aca4c2fa6dd7e30c4c8c805c8ba27f20cbf026edc189431aa31461a0739c538e3bdda9b4071f2338983a7efb7fe9dbecc21fd3331d2527648519f8d13b2453d219953bc463d5a0a8771fb6bc257391ab0ccc3b84e83752deea407f18ad46bc486f74e22cf5702ce02915ad914edc9f1ecdb7d00a393248be23828b6e3ba2c76e5800a98a82c71e2fc582b19c45c865be66c9ac515a9098e656d1e9e98055d23809183ab632f5d225122068330dd74610985badf664b7606a1b06335aa8a67cd47d00b5d133ef5fe100362a25f26bfb50dbb3fbf503624a88a5c3c394cae1069470cc236534c41e9edff108f7a4b4970287857903bc3a1b27605e3cb6b16f4cbecbb5d6c24e1e564da94e273f5ff9ae232f5d7b16ff4effbfafe7ab23486638c3ff0511d0333b91e63b30d8d939f4a17ff7fd15095952ea8bf0dd86c8837c5dcd434766219d69acfeba6d53b016ea7418350bd1a41bf4a71164496504b98c790878b01519fd32a21f7a1fa052c0276addb9ab62ba2dc834157199868325907ed3a578df60be7c390ef61d13062b3a338f67167b2c4bcb01f894053325b6e800675eec25db876b269ea746974b98879be1b6906166466b3a12592b278c45b12d12e94bd07a28da43d08d19d31297018ff8bf0fd997253ce053cac6d38b7312083b50b36358ae502911d64466819fb666b012890d3a55c729af30e7e0fb73bbcc16951645163f1ea7a66b7c8b15a8bdfd0442d21c485ba3aac5b0281db578b7d440975800b9c07ac819c4732586f677bc36b2efe4dcc984d56c6a63aab6f8f647f79aeeb090219c15d15313123b458c15f0a154cba36fb74509bea741fa8b7822c49c24675e09aac2176065ce6699484f1d78bf16d087b113b99c297c48bdb7b653dbca6c2d81270c4b3ee6c602ede492ed6220f31bfe88c15b9777bc873d635d315cfd58e33bb29ea74584cd9c643da6145ce57011db01ea50d6fbf2ad22ea470838060fdabfc44cabb66d291a39d2422c42309972f4441a5695370d9f687ba7c5efa50a80781e569c8ded5af5254124a3ea5c1fef84221ea39a89b4ba0c75593985a8f3b6fb6a86b97af48428d0edda956b9dffbe3ba5bb31078d6496f537e711af8fe17b6dba760fa09856337653e6259b317d7cea4adc61eff4802ada503c3e8f1f6ca5230a29b5a8fa95e0e8488b1cde01abb4464613d7430cb7c07eafc5b0390ddf01e4ada6e3d9cbba1b3fcb8693331c22ee45ba733ec873529bbb5b024fdcbac9e303bcfb51aa2e1ee7d6cae4f22e3ea1944d8d512d09ec6ded71dc4b6d0da5e4a3b03a6d7f4640407fad50c939eba220bf634f8c50ca1dbc7147326bc1a1a54b51ff18e16ce7088beb9174f4276c01e07aa422b618265ab5678aa0c781e9822b5acd3ef058c227ca64f7274736d566d4c9ce10308b860a0ca8003539b71aeae333b666bd8bbea28660c5bebf2238d8c8303d6deb5f3c0de156e33600e43f03bb72869ecc90e146b4b5af8eef52e09d66243cf9d605ff51413d76069abb4ff1fe490da394c584e995ea1095e590fdaab743d558949e65043a34807b12a5595534ed9b518141fa8724f491e837b114404946cf6bf43b4af5770c9dd471465fcf3ad7875c4da15702cf21042c7581371b419c556ce3103b39716986f7051318c914e14b52435daeb9651b88da9b03887036fe1e0308b5789714e87831765754c6bae96126b38888cd18d30a7e9d18727282ef698aaac1f61eecbe9dc1d403c34795eecab35bd2e648bb45959fef653b98431bab550ebda5289cd879d610727f4a52def49c9c47d0b6f27189a4a450a466776c9ae8baf3f76fb4560d9a7a4cf5dfe62358c5806a5de0c24771023490656d12e8f848c3d8de113f8c0b384deec31e02fedd28f28f66dec6e8c30aa3b827f7578adad8877c30cbfec6abb45290e0da810902b27075b7b5f3c32fd69f85178857646d21023fed290434ecc89366ab497eba861162c585d221617f55fb73dbf572129e2f57118b08904a54ed9c6c0214bea1ac1bfe345ff5c13b043714fda1373496df730b9a5c0d466f4a74a31e0f8b4a8eaaafd171c8887e45b88104f948bd9e81d116650b36a3c9b0e8d06dc22122db4533d9d6e62048dcd308a08f2d9a9c2e961322051d4bd6de2688a4616210736036ad642f5e5a6398bed815a953c8941e2a24f0fcf1e9f3396b51ae1368a2a1ebedaf0df4a022cef096ee015b0441fff33d2d6b548c37a7bb921f6b0d5431cc3fa142296097c7f264bc977eb11f39ba4d230deabad4dbef49a52b1fe7b25bf941e942e6b951a6fe6947987bdc6609c546711f6848dc735637552e1dde16f66819b75c36cadfc20bcd3c44e42f88a6e04d218a0267ddbaf60e0a2b5391c3e193a986c206804fa3177ed0af1c7d9684eea7709209a659e2a1916fab405c5862b5c0cd6d6f15b9f121df7fdc744f16efc4a71ef84defb56b1f9fe0cf154a45d4e947bc6a763caea9d98dff9fb77475ca27bb5ac2b1a4d58cbe460caad32683c9c8c6fe0d770b3e7a7971bcd791f60ddeb303b3886044ef062583fc86d119f91da8189edae7ae139f9bf13b217f05dbacf0f5aca9e13bd7d97bedeb41c5a04192f80404025517bebeed54804125bc1398d5fc3cf068ca41aaa52a955ff654200943b3f52e132e6885d6b3598ab03302791f2728b784dcbd6170ef60549c9012ab87666b90e5fd4ed2aa215a8fd59ee718bb57c3db3d5d2b8b903eacac8a18d945d8fd11a23542780eaa9ef13834c1e935e0ff3fd8129adfb0fc6abd196549215e92274c5ec527915c817c4f4e8b46d8b16a97ea615b84e1d4918cc48e53acf007af2268c72a4638afcf87997e5233d9d9781b069e2f402de8f4c4db6cf997e7bdf70589641fb737d4a33d3a65e9c783721d691c1adcb4329cac49d16d5828b882285463082dca6350ebbe2e769ac8dec45c285a732188dcec5f4efae6a46bc43f449af8412790311d5933b783891c5052e334a8226cf7cdee9366c4ae18f6b743deca9d3b14d46abdee01856fc8a59b6214ddf9b57d65e252854bd4bf28080b206844dbb99994604f40042b0697e82b561e70e5f5c9412ed71fb1541d91d3a2e6a1454adbb1d58f2a4f17fda4a0fedbd791fbfe9035958fdc8047bd43dac558caa3c42af9f94012c58a95d94a99a3a993eab597fde3194b371544ed10894729151f284b9ad9d8a7d7e8b3a6e8884622be8af7a5b843c85ebed8ac7c4141b641dcec33a5276df0d7fdeb3d1640df0ef978d83fe09d22eef274f4399f6a68357e2d6526317517d9a392677098ade733ee6ed21429a3f248d7dd4a14845d63120712108196673c3ad6f73b451c3ffcf886f7f837957a3059c9c63f1e2d691992ff3944ed924c3f3e16aa6d50f00c40a1d9d4f9ff1cfcfdfbfa017cdbc9c1cfd56efc0099d6b3b244932236d30f7e8c42304a73ab5bfe6ca16f67a4b49f686f9b08881f32829d213efc2b930aba6cbff7dcb287732e5ffead5f57ebd6625ed3fbcec47ad4a8e24db81dfe4d2002ab1edeee6e0120acca9c5203987ba639ddbb2c8ec8f3efa30f5c571bb60f7b7fd1815da9233d25b250e26bc14be1b47e3551766526d3eabcf0f4c41e5dda541fe13fc156a5d330db944c0603ff7003f2c191d98bf2d5c1a6a5d11c98f72258638aacf5621b73986e2297e53b3c4d792800b253bf8d200aedbc5beb29a3579300f402ef724d0bbd7385dc25a9cd1c65961088ac82d29df26acdd60f00d7824b8de46f9fb344d7fad005e2b6a9d95abb4dc11d7681cb503550966f02329339e8ba08282808c24820db77b985552fd09b747af9c7d389855da903d4adf53e0657476ab9a171b930d0514e0e289df2cfdb7d4af26262956ae07273db2faf37848d232c9f04265ffdfa898c46922ecd16f6b0bbb6bc61fed475b1dee48c02041577bf38554a780ba90128f416945d8e29f542c414cedfa9d876597e901d883326559c94660d683bb505d996914b8426ce680650de5269dbb1b20ae7310b09968a5716969d49af5a0c53f961f5b135c1ea459395f339a79ca8716772d6ce6e04dea42c53e7d52806e642a7b0367a6b1b80ded5945da7781811a90ad504029cde4e656ce69625a17f5331318723a2cc310b61fae3ad10dfe9567482af4f20866a0ffec8ad8e5991e8bea60ea88ed6b90a518f27b7d7320b70ebb272ac9a8e9fa2aabcb3a1bcec65a004875c16717ce9a865b26c85a839f30165cc5af14aebbe7dbd24ca35dcb026e017f946e3338d8bb295440eac398c9fa8a7638a11398ee7f3e91fceffd128d1741ca34e1f8ec6cb98c1515065c0b5f013c3ac0d036ddab5889dd9e049af8ebdf8c480a07e5413bcfdade193ff65dddab7989aa5635909cbe84e8231fda58bed4a0cbc3ab6e128d0571ffecda1ac189019f449e831f0bbd6b7ef543e97657b5691abd1df49308581601d8c311b7a6b302641631a5f3c05edfd69026c90eb92db4eb1d9087de328fcd973219bf7eb5dc6c7954695d343eaf68cd614ea3b444eb3a4719c0818b258a01e8060d06c9525d5c8d5395ee8c9531c74f826aa1c21c1b7a1a7abb9462abb60276c0637dfac244dcea4d423935e1e0df05087f2a8ea47e235a648a488a8959f6fbcdfaab245771874ed34d6733665ecf311fa984f00dc99816966bdda5b4f2827d0b54ed1db056bbd78aaa44c671c3feb08333d86a6f5cac4e8ebfb796178b3ba8cf61dfda104dc5955134ce2f01f5c58c8285912ff9c4508c9333a85fa5547d2c0e63867eda1cf48f9025cddfd4ee422436b99704bd5add77cae33f7ee28ab0e8e38be6a6fcf16e6d1da01e1a2a845e9f5cab878b7f13407a15c059dc2ae330634aa172f67c06d8e083ce7bc5c577c1a3eeb4f4814089f15520d83e5676c1a848621f0d5aff7441414ffe9bc3f487ff925957cf08fa7b0d8398d19dab7e7f76d09f88b424279d209bb6ec34890887ce7fccaa93827f1ceca06551b56ec56e12adaae367b245dbac403389d62db28233887d229d3e1f084e2dc0345cc0bf82ebe8f1f62447755206ea5f261177ed57ee58bf1a999a3c0487cb5bb373f980ec4492f030bd786b4714499d2e844931e73e28fa174141ef1cf3769e22795efe91792c8d3c513a48c0b1b919e3afb8c81422e76e2ef7aee7ee709d0bb823df9df3f8f4ff779231baf11d29f119cd14977df26cbd313ee6c5be73af9c156c0a2f992bab0ee4c9c544470a5922ea84ffccf5aa2ca80bc91d5f92d6959704ce3a52fee0063e400b5096d988db1a970c3f9bf110177ac1bf44c38aa358e360f1aed45b5d3ba0d19f034657fe528d2faaa5e824d6ca1de675abe2fbce3b69e1e491468ac724650e7b2e35e65f7cf380232b3e4a87f476e3c5ec2b36813c48525b8f50ed83a0411329b1414660944011c59b23e903b161c0c5be4fc8bda5530efec717e23db3c4d9b0f3f6557c8b082f9eef3685eda428098bd03e68699228b6fee0d1ef2b10167f97be0c41f34eacdfdcb7b30163516fb5a72629d7b4526b0b17e909461f7e3fd896b02ba6265debff201208f79a7a2fd551cf9c65eae835946a65cc96b3e4907aae68e93ceb13360bc42935184cc74d17fd97cd2d7e6185e6f7869a2b1a582ad0ad1f98563e91ba4c9fe1ac446ab9aa37c426c4c36b4a5031a2cddf874543c19a710f16e30f023a9cbed6fd855d114e77fb72f12870f07cbd2643d88f0f4674d63c0453bfbdb606bd1f659810887b652836c8df1e28a21379c6d1ad480a0cbc8e86c4b33000a43395c67f60106220873630dfcf7927ca2f0fc7070f41b2d5ff6b6e3593e8208b57c974f25db2fb6c85f99abea521b6d28965b95aa599042ab9accdaf6bb4789fc2b0c02d20f3baf65c676d41b68febc69a94e02d0bbe538d15eb7de37ea8a7d7d6bd1f6ecf260d39ce38d4d4b8287df5710d5854ee4da13225b30bf655180a853baad4eef86e9a47445b48cd266ff436e23f230673fc4e7716faf6a3302d7bb7e1461a14223fdbbf7ac6e68fff64c9c8f808fe401cb8cf166d178d2fed4dee24287374cfef7c4e6ee3fcceb642a7945c93ec2f57ebd08f3472938efbf7be88de580cd27eac02099acd30ae5d1686b2b2a513e8a50e91db5bf068adfbe49779571c50b3a36a0caea57c4cc040a33ec30b05cc9c86e53cabd2a27e05b0263abde43b7458fbf975f28bb093420805811bb0af01a461b156c47e2532bc41f13b6a3934bf4cfa9548dfcde296fddf13c57b6243999de0b6f698d2e47b59e6d0b5367b2c4ea380c32c7d7217a69cf3b18e0cedb8ad5dfac9de6b7f256d94bceac4dec28bf32257982109e759ce48155a935cb15ae76868952316ed27b78f742de8365e90366291b0f6e2a55c0578b8233a1368caea8121a141b905e0a65e165a60f643f08af2df719670aecdfa5191b93467c13940306aa076c59e963b67d394cd027362c4587e001d3390981ef05ae5cf28f3a9153e079f3b35daa7d4988c698dd3ac8ec504ffdec6540866c85a53a155251329b018f8ef2520ecb4c1e3895593f4bd7e489bcd9ef63cf1e3f8bb6c9b9b3f8273d56cb2359b0d10e4cdc1680cf1f697e72ff37dc2e24f9a131d0d2f21aa5aa4e0eb4609a6fc12f0a3e4ea5cc6a76f1e035ed64f1ebbf7cc7f3f1b03657f00ed05123fed472d3f2f82d21d5441e77dad0469a1b9695cb68fd27eb1e04a58f290ef61ed51acfc808bc8cf51303dd9c562cf75575af654e4c4edf12e2c860aebc9831db91c438f569c806d0bc20db6b5ffab6d0cdfb3a14d819a9ecba60db9c47175a1f9a88811b208228168674945f8ca3f5cdbe53fd626c4ef3172296da80d6799eaccbad797968bc2cd50f9bbffe9e5cecf7de4e5e0d6cb5d452bcdda040dbea2e37f4e5cf7d0e6da940a215757e21f25c6a141e1988bc421b747a2e6cc5241a92db15fc200e735ddfb80c4226d881378c57fa331d887d13d897aaff9f74c043c766016bf91df033caa30e10bd92e7f07bdf08e779ae25786ce38c20e83d27ee588c3a377f17650f0d99e6f9c6c9fa2d7380eeb17296054e6cb1c39277d2c4650ed27cdc6ccf56616a09edd869c60866ecd7d1a8d45b5d93eecb23e139667869be7e05530ccb2869cb4a5489502bed624f53f22ad523ea347e4130cf973641020a5674983df656b4224dd0e8504536a7e746b72a5ec5ff0af4b839aa5181b22a5967c643c9380d6e3aa9fe4e9cc61928301d438f369e03cb6b04a116bdd21f1b1ab7d6a538c3aa6f9f5cc4e2e95e90089a9c9bfd807b10a2f011dafc099e76d05feb51bf552986935a94c73362952fdb41079ee5ae1361eeaf922a5dae52d99fb90ccf46940e0cec40a0c63bf6097a0dd774d8f84a8451450dbaa6c761f5e1ce7cf9ce67552841292baf86add8b0a2cff2453900395c62f93d55d001944ad5fd9128a36c1de7dd56215f8dbd7338847fc2e54fda99e80ecd86b62a31ec739542b830353be23c019489ab63b36b77fc4f26c5d99cca84fdee94c46b7d79288e2ebdc9a5a79f58ede512344f824078272bbee4ef9f28b6815cd9c2ed71edc327931b4bd7afecaedb2675146d9839d455deb84c302de7eafd424d5f9baf4f571c81b89462ab5429a8e3ca4c3fceaf33fa10368023fe867b61822f3822456fb1b7e1f51b77b7abe89e97a5bdf2343318f4e06179c71e448588f1d8169dfd8ae4bd18dba3230421deba558102387389cfbf30907c87b7fa656689800260b4ad0d318137ad5076a4dac24c2502599740145b4a8e586c7bc2e325412d9a97fe8c7d9c59d90fc3630fcf1c84ae6c10f0e3444651ac2b7d3c6328d2a3a6951ca1ae9162d036df72c4d9ff89f75b91e8a9fcd3df9f3debb2aec21e3e76acaed0d624c89b11aa71553fd47ca5b967dd981d4234dbeb9f67f28d206851ffdd6af9449f37e7a1187cb91af13e3dd1c7c2db09029a2743993b9b2a1d2267ad264dfd73ec732cc81ac0dedae3f4dafa664185df0dbc797e966173bb554790688a709776cb95864ef3a175576cf9adcfef0602f7223be7ef0489d3a559127439e11b37df9c7ffd34002554ca17f4938363f0ba433cfde5df2396fff696adc5ab39e3d39239fdbb70a23e90ae94272adbcd97d13c87faf886e8c7a775226f54b088895c1ac75b364e871b7a2bdf209ed836905cc6a816f68a481d966128409dc23f9b2ef7fe67dcb0cf8c479245269d89f44dcc0a91529081160174dc3f78524e92a738507839792e553098163a10434e62208e2694679f58116098f90073eeeed61e33468b7352fccccb7d6bb6bd56c0dbd5b3ed38471d612db4c304656310ebfe9b4b54ae7dc2a7a8d47515d66965d97b172e1dbcb60221de1801bcd6fe17a03300f520ab0b3d500983173da8697cf38c8d4b9640ba3082f160d2e8e17d1a6aa0a2d49e338c9ef78b6ac2b5ecbc110f4fa355f6f5b350ae09be26b1005d94483c8b13875795b0083a456873574d7e645d466abfa628de60deb47e86c59b9541a4cfa506b9d08c8362ab4b42d1bb85e5c6632010557d0962e89e5ca0eb57bead8cd21e174c8ab271024a47a4a066c7c5fb63d0e75d2315af6c1089be500c90ad156bd0600d8cc0b96aec37186b02f946787eee8a348e23b53c7b6e8583de4596a0dd248cc386c0548257f9855ba5b400a7a61217b052c00e5378300645ca01fc21a52873441f39fc70cf2833fb395e4f856d87bf6f8841fbc2d260f2931ed7c783a87a8766034d4bb99ebeab7edcf4fe1abdd9226e941da02ebaa8c3c397a0a19303790406355b2c800c4f8ba3e79f712cf64e28102d58e80969094aa5779c7567089f4475e3b028b73bb58da68a522fa7250e424222639223bf504c7a1c729fef0b362b616d4088c3ffb1a566a415f30eedf02b92696f8de31e5af01ffd9be62d6f734cbc8d4d45d89f1fb6eb0a4903e560d7387be6f786f92a1e1425b1b6a133185471c88537fc7342e60eeda04eb1112fa4a5a758f4b5d9517d3526882299623ed1e960e3f66c410e257ace41c1f3c3b84a69da238c19d2faf2f2e53c505d86be81707b7d2fefbdb138b42477f38dc3290c990d362b6edb0ceb2d8a2c2ad2810fbbf1da48a0a04da45886f79b939ded76bd8567fade778b333dcbc4477b574cc585585d621f6a95debea068979012d0f8a1fb223f348f15b3ffbac65961782f7a3083c1c38c1edf23f5372c5d3a3e246fe710e51b1228bc827b10b88f2ba4ea8e68f268dbc30d3eac9a85936ce9463448c499c522144f82f229276c76b6725388be1f3ab05088af0a1e4f8af8830df307a2c55d4ddce91ed33b6f2a8b83dd582a21e500cbd6bc2562d41e14d6cff4fb363544bfc81a26d9b4608ccfa1f15be1f6cfffbb62a0cb6dee22c50b36a41a1d1e81c131600594c61e8763974095e5a4066a3c85daca398a39304c6cbfa0622d184e9dde5d362d265a79cf08f5d46ee09081b5f173707519967ef9d00b25f2896adfb8b45ab1408ca4489de921f3ab8b49392b7448604c47842c608cd05c1c0f6e0aa606941322051f0373e439ae57b1d8c15813c02342fefe6a34a58244268a49060d8918265f5bbe012821c873390b934af17d76aab6d0be2559ccca72a518380234a95bb8603aee3639418c12db86e0ca1d91d9c5c06db60eb6043b0e296d6d2565a69b2fa9df930b4b2492ebc071b4931da34f02fb7f76bb96897b3683a840dbb2e8f861854c8a0eb73eacd40a85879f503b46c319f7672dea112c15f16441b83bf1a877101145c5a1cc110fab1ba3c4bc900d27d3882b8ac4040401fa3821bb9311ac255c3f186efb87763e1ced84cf305fb92b5c23ef047ac3fa26bf2846597b6ebc5a47ea0514cfc47d5c3219649920f8161e890ef33de580b794f91cf4bff87ea7596041f0a3186ebd2b5946e7f53a6c76a4a21e524c611abea4c154d32a94c68025e05d47d5fbfc6a9e1b3fc0a4c448fdcfe70d360da232bf19c504deb8f5902848fe72c181a847b6582194fe07220d3b1ed5e30e17bb3d0c7c5c8891451e69f0f14b1719ef63ffa3e0409735d376a4e39e07f8e5cf7362b36d33631f01b8d33b131541c264314ca2bc551f228cde58ad74f9dafb497544eafe6157b496a20d1eb4849af8734dd4de145d903a9f5cf6ae8816b6df849e8323e18c76454f1b0e3a2a26e2c87046d6d715b630954eff5c1d7bbcd191ba1c9a67a91635b83cc5c15f190bff7d549a05615d22e7327f0821b7c812286931ef905e51c0033fa37118c8e0d052652bfb7623c9c9489f4c6afa80877c7f63975d70fbd8345eab1dc8c1a5fa404b4503ee2133d5671697efdda9d21590f17f6f72f8e8bfc5990be6f511ae7f6c18843dfc251d00959d43734b07d4d6c8eec7e1e06c9b7c336b1e3a1327aaffcdcb71314f5ac0602a6ba47d05b891213e5ad56019a347966c6f2986f1b25912e6e408d570dd592a567b709dc7be446272fa9390a08d57cf86ee197c75cf095c2527c7a44873aa568fd3a0d8f1ea7ff6288428e3247d631a39c4813c6d74eeead36db2d449b47f2cdd0c189d4b5696ba94c7338250421763ba4d263e7066309fa7b689dc42bd4773c2ff1cf71671d22aeb7b21b685f907210928453252e9e0f9d1f0386d73dd0fe21b9b699360b60b1b98eaf95a0d97ec9ba3d2ffc6c0e5816d236aa0b98e37afdf374ee40b54dd685032fcf82a7adf76d2e9998b99c3713e57f6bd06ed2cd7f0938a3eee98e251f3ad2e37a388f151ffbdcedfd6a65eaf6b9371fe2eeb72d8b7f85a19e250af5d8868ac245b38d028d155434668ecce79cf2e6e897c0b927c5bc4df8899c036c3f60f6c7af886b529127318ae28f9e679dac4ce25bb0cd0af014dea48933da3eebaea8668ccf588387651499ed536a30ac93a35b9c6fc806a79270eab48e5137f166765f5282bf4ada489b3e90ef8964c3517bc5ad1b935734fc663940670c92fdf4a666d1667c8486cd7ab7fe7371b91f9ddb96b11c540e37f1846d8aac3644f33bf6550170f47dde725437bb2170115d34e3e20f7dd752548a39835bce0eb3ee5c2dd61ba9c893b468fc38b23b76c471b6fc68ef037d5ab5f46fcd4e07f26503cb26c275b43dc2204864384a2bad94f8c10e45b72799368e9386debdf17bc08f024d6553350562a5d2e5d0ecc63b45198d879fa5be9b8334621b84137f3f511705ccbb530b609bcf9d3256ce00147f24ae764d3cd4e3acd0e31f040cbe39bec2bef89e30696abec57cdd2a4227804973f78da269f301ad97fc5e102a9d9aacf982cddcf62e41c6239fae9a593e00affd6eab0940844287381e97ef470d0300140cbf00e7a660e86cf5e365487ca80bc6f2c894d65225df58e26287826ba4faf9a553beeec8ae9b58f089c5eb8050e93b88cb12b128478e11e6b6a6c8239deffd098221058ebcb87c89b333fe3e6de2a94d451b743fa7969f937579085a50e5b78c69434e14f50675f87e22c90a23a0b03e67279a0b128a44e6d28f9d4b9b019db7e8afef3281280efdba7d821d53e88bb3f7f5131f916f2a7e8cd08c7ec26d39c92a1ec397920108f0fa70d92a090ab706d3bb1d80b199c020138219ff5c3444679980afff2b93878bec12df04906f1caee800b3ebebbccbae89ecfcff63a00f2cc11b7e21745ab15986d34b41640b0a7d1a8a7c0349b9212534b72bd9a5917738c1810b29b7e1cc4d6e742249c0fcd71ca170b19cedc0cf623eab6649ce92e476848d792ca33349ef967fc7a693846e5e119063e6e92bfce4c195b2921dc8cfa42de2d531172bfc6a5822bffcf7142308768e1f52015e5e1f961e90da029f660ec0a3388d18cf60d30c3459c992df86637b7751ed8f00090eb8f30febf1d23423d8e7c9075b788dbe596c1cb2bbfc7b9aea071065d31df1cceb7ef8eaa4773d998e54ead5b1407c98921582a538bc611c3a36822fb4eaf4873bd525e6b6f8ed3908451591e39a7bb80ba026c6fd43173be7dd7b680ac79790c81d99ee0ecbeb7b4e888446886b880c896c4556483dd1d31f45f36bedaef5945ababd8894ff48723a106e37620d9436fe3b80b3799c88d62ffbcfe9900befc52fbe2d63026d0b737afc875ccd2b2fa9d661c2691825819edcdb6fd0ff09ee6e240ed718b22e396e60bac49e3a28d60e4234130ba1d9b1f911e3e5aa7cc7e270dec2ab9c82f956a6aae8977c3d23ba5ec5781498699fbbb01de072e7b767250af91bf3009f876241b7d7ff6a55ae804974aa1d80860bbf1a233c83b071af4a5795e686b7cfdf831e7c9343363bf5aa902fcc78cf8e8ef589a9b7a0d3d3cf90bf39be1d062b694257f90d50d687ff622768333cd78eebf9317b15f451f02ea42552586f2c363a2a884b038b0c3e7a2194759fa793eb0fb4947fb7ef0fd9da258f120b7dab0e8a54dc71e042b00540583542da6b4c986c1f8d2b3bc67e1be4b78bb3754c24c6dce5794eca924cd5cfbdb3bc5d44025e3b101a6d1e91fc0051a434a1da48af213cf49fd7ec16994a4f0427375dc5ce40f7552c611db124604cdb42253f15419822577277cff4a31a64edec46fd4e0f3a1a4fb525c9984e3bf7f1391d94ff2c0d9ca1be1f23ddfabdfeda39f7ded33867a77d75080e1eeef08c7fe335ff109437f3e570cf9f5b812079a10789a9706dff34068cbcddd8e5cb301ccb7e00a894f0c3dccfefe8a8e47ae81b5ce13615284210ca28ca27452673765167cf1d625284439c34ad04d0ce03cb5fb7afcd4d73a5840dde5c513a884263aec775e874bcb6fe04b8e86a1e7c1f44331aeed2b6603c4f844b1bec3f2f912e18a1bab330db57f657e3359af9bc1490fcf568c8b070c6e615882e3c96c6625532b584a9cd2d9b624bd2fe9faf262354a9a3ab505dab6fc68a22666580cefa3a45d16f63ffd5e8c3ab5ae74e57abc0e0f2ffaa7a635e762752d38537ebebe8ea1d5e8b83be07ad11895ed45998e252e5b0de231d908b5534ec7c6e8f89fcb9449bc3c74f95ca84a5ff48e08a50551014b95df9031e2f5c7cae534c0c25719fb9f2bf1b6c34216d2ad1ae71c41e3b66692b2c81b095906963c21093d4302f312a8d999805c437d9a43d1d596ad6624ee8494317260724650844ff5c3c340dd0ba2a2081982ae4a51c17c49f2a993418d4f66e5df4e6dcc28fb0b10a5ccb943db307c699661dce52e9c9b3351de4bf5565491a764bd8d495842e1aecaef7719c6d74693d470c7eeea619f8a44f3f3a4821056777bc119f44ae967b633b894a6a1161f6a5e360d2227dcd0a9aeae5a1ea6a05cbeb58914db6b4c1652fcd42401779d84ece90d1e72700d50045a7b18a3ec19e757b72b0fe898a421bdd28ff4468571c2723a7e662119b2142d7af34f2bff9b896161e5eb773c84c09f85562ca5b03b344c362555e882cfcd023801b1380d2a1b93db95a7a3ccb4c1541ad1c8edd0efcba34641d30466904b28516c0c965fd2696d4a9998fac4f02dcfded4b0d5080a8fe80c19010a95628d1f7a4e8215cf20c18df3fbede2d9678744730bd03d519ac914b2af66dc1c11c5f131f1cb55788e3b4d02accf6d6566be9e4edf58746e602412dc8b7aa0ab599184dfecb038f522fc71c1810c11dbf6f7faeffab57c0c530f83a8f09c2ab8c3f17331ca6a5572bf451fe1051e885f48e0fb3fb8970f2070eb28b93a3516442578eab3ec09e9d77d837399a03975e27f456e8ecbbed6ee14ab3ec98e56ebf4fb9e4786b9d1ed6678ef8565390fed03cefefc8155a103b98832f253216e1ef40abee843b12e419156c9d240367d317aa02e99628ad0b9f786f4df246aa54b4931ac655898244326ff5ef3cad3c606eac442b68a58f6cc47da16524a7e1014fd4a688aa5db494a1558c904485e8445972b23786ea9283beb3a9e0f2fb69a67507ec7de587cf0fb8d31218188f77d755852584b7b3f80d5f4b000ad3a9f49959ae835a60725f4ff479ef4cc08f428ba4ea45a2e7f7080ec659286ce0d3a844be1eecf066e1433589ac9d20d737f5183dcf133b58817694866efa8c854b4cbb1bf7e1100f1537ffcf4ca038549c955b918b4fdc6db6de9be08adaed9a989b53fc04487a9718c26112da91612185eaee7d04754792891d190631a17edecc95af981f2e6a9e3e6de2c7693a52f76e69103792e79134f6f2da1cc7ac6ca9326787e95fbb4bd4a42806b27cea926e66fc19f68bb62e98d5301f8a37b7bdf1765654f268491ffecdc1110e0b03a029a8ee4d4a1e2ea1c9039cf58dacff505ce176093dc0ed9eff16c6f7e592163c288443db5ae04da0806066bc42d925fd31ebb7ed17475f862b57459aa8206c0ca64fc02e2006b076fd1ea60c1c3227a84870a79d696920c74d045160bc7f31b2042543c95475775b7937cfa1b1b7e54ee6ac3a12355409415fbaf4f63b477c11bcde9c8af0e1ae6acba1010aa614f9f42c857a2962cf5a0a57e2659a46b446c46df8dc3770a3661ec3fe36eae0c1693321f18ad259a441ed3f8f33ab5172e59f4c358ce8177594a762436b4998093de6a399e79c3e41d8891b61fd20209b5d6e87c0fa87c9caf90d6731456b95037f2f2fe76a365a220327111a3af818ebfba8f224574bc1dc5d5a701ce3042a04c0faf8fc400e4a2e6f0cf34c385738b3342b9485674213359efe9fe62e75691d1d9bb0361a630a55120e42ffc471ac4da9ce95e8b7ffdaf69640c5b5358350ab29f19048cd280728548d641e079681ae2613c28b641ffa8c88e63a71ee3648c9e94f3c538c70b065a2eaf96feb1854d149d32c18beb34bacd53372af1057a72ae9470e0207800610ebeec74db620bff3099525a0918edf5cb3abdafae547b80dceb5f51a42a8301bd388612630a783dc3b6944310cf38dfb79a8a58c362d9757b7a03efe933a2a136a54c720207e4e7215d9441fa9eae744f54485b0edf99ae2e5abd3d748cc41d605074544e13ff4abd711c0b84e04f6a5c9b940c1272daa81509f1ca77c1e6d1dd7df364c95fa8915b287ceca4626da38483133a126ea59e1823c0069eadff1a28de025e9c65f2a8962da41ba414a7c5324caa2c6c874f0063aa6c2d5c281b91ee68c78bdb02b6076c1f927fb5789229c29512e7634d05fce06426c1edba1a0827659eb970498de6ac9dd7d58d8ec9eb4dbde05ec42a2043dd757cb3ee57a5530c136b0f446f061cd74bb454afa2be230577c0a91c401eebf2b9b86a0864be87024dbd59523ec2d4e9046f5b99b3168e19a47ca346f7812be8e9f96bd03a7148e762c1d4eebe5440401df23c9205b8f18f849f6cda5ccf0b334dee9b5a60499569d06e3b839d08490ac5538e37eb224e1e10736865de549df3ec61972fc32e20586bcc31647452013687f14ec30ece9d2332f9264e91e4ca588b3938e0b8cb0ece98f1ec5f3eaaa8fb5327857bd57684638232d661138dcbdc4e1e491e66e6ec2f6891e28a98e08cee67f7bfd3469cd8702478c2d74d5f716138092d0e25b4d0ebd9bea32a699c99f1102f09e11b55263fa53c605da73dfb5c6ee0f148408d79b39ff741bab8cc59fd8646c002a5b47f5943c9287f56ec9edb4db6c404811f844a356fe97199b58d4544e2ddb9dc38585974cb39015889e4e1635629d4b638f6e4809805359b4db3f69b43700bec513d539c8a7a8cf17ccaa98d8cf459319f27b4e4fa4512a2e6dbd7a65d7aa1c4f2c67aa8e544e49f98dd46d94cb03511c1edd109d8187ffcb37b08464fca4563b40ed90aa9b32b728f2f739a03a2a4930e39001c03bdf7201ed2ef675d67b910ea4b80eb97a1391439f66158888e5f9269de9b77d7da2daeee92d6dbc3dce815d08f394df5a2b77d6817edbb1b1146ac04bf8dd6da22d12214584eb7a52e23e262581e66dda05d0b1262049ead7ee22d9fb705835cf6f2fe31e5cd442a55ed783ad4d022b74be2859f7e2866bf74331ef2088a0de2170d6e2195b03c430b5a4c8464c672fe2252a909ead26bf0b19be6aa474a4b3b7b9a1c69ab451ea1c159bc80189109999f7ec42edc3398e8e7d00e408ad4cae1cb7f0a297f536118b6b6a3f935e6546f06bf43c5730a01b925e176291538b1fe647b512a404be85ab02a3c399b7d6ec4544a92f0c6b127e57d1cf4f8ba5537e2b976922418ecdf0954facb7c0cad16a23d8eb83ec1d12563ac4f2881841a0d35be2a1aed07118ab75cf9ef3c63b42067b9c61d0fc211b78dd798e60b40bfe9560449f48688198091d3531331c3f2b8168083dd7ca8adeec9ad99ae6f69d1cb4d24f913e28c43d66f727540abbd75945df36791532ed0c8626bc4ddb2f5ed9007c020f92b7fa08a283726ec580188ae095fb55602435b15bcad2e86672911753c867b0fc11560a7154751a68310c430d85f51304adc6efcd728c14966a3c2b114f9c8ecf790d8fb6bf836dba1b7fadb73915446acd8daa823260a87739fb058a10e5189a0fc05490cf1dbee5ac6d7b072c17780784ed4d5565dcc7cd33eb114a22994c0bcd0e3662506e0af1bb48076083721fa4d5d380875ffe056a800f227751095f2e83c07de8e560a1957f606a38893786e45ad6682999d66f1f8058f2e5a3d7d26ede79b07525b08d26657e37d7b7ced693a5df2a02ca09ce901cfc68c60b9ef63d34096649fcbfa21b20c9675c07b991c199dc60938c9faf075ff45ed4bc45f4dec9018894919e1103c54251bc4588fc4f1b503c66b27d3a0d5cc3083115579e9e57cb952a819bd9a36265ff03f1e84babaeda9938f2f39aff6288a1c5abad5790b4db0ef5d483db3f97167c4d6b54dd84ede0b1db3debdcad910cd455f7bbaa5c803f84e2e0265da78f3436c5e4c3bd69212350c7268bf6e471f933d5b955460b2380e2ab0a43ad538c3c3177a1f1144c87be51ac46243559028b50f1a921d49a2c97d3a56aae3b84f23a04f76d83c3f7d5275d760ef3b30b45d4ac81fa9f93f4efd9ef6925777589ddcfb41c05147e06e8368ba64b3b4c4efdca81c0f62849fddc528a12c8b8a36cbda4312fd70a248b68ee2ac5ec7cbf9d94565434da3ba4dde20902b2190aba43094d0602ad7e09fdfae28058c2b9fce8afdbe9b4efd4d7853fcf90593bc650ce2ac4183cb846ff66f4345ce972dceac9c171565b9df5469a920c421a34ce1f32a5ad71962989b810f2fb0afc1b7e8d9721c85d8a8790aec475f5f413c212960152e6f8bc3991bf56630ffa6f26f91c73c290828c12465810e0e4cd904ee0aae1d206849f01fe1ff075d1232e8869cde42567d98468fa366c1a69f344f54567ded2bd441009f7e4e1be67197fa10d99d6a7ebaa64c0c98e0d4be57055a148ecf864192f5cd93ceaa3fc84f5443d5cedb3cc8c4fddabfd84647ab596f42b997a7e12ee1150e7337b3f21a8e803e2997a6920a498386ecf70c8382af9f5e93d6302c621cd4bc706ffdcad47784f747998c32017e4edbceb4567b2ae0838478d60e5a92d0a73e3adc75f3603c57831410ea8acd79b43d066893afe178e82ce7c87074584627336c177d61e5193fad2e1c7cba943327e928a66ba89a859c802c2a87cfc861fce9d8e6820d501868c874475a81d5ae51afc0d0fb82f4bb078f879de59b6ee7f976333c44c021b3a49eb4a07e94bea1102fb14bfbe0800200e141b0989aabd4944e8ba4e2dc547c682c8e54620fd26c3a2454dd94dc5758b88bf1d2a543a00afa48e4c29971118a8f9a08ead180e35c4d77172b2cac750df08dc1c440d853f7ccc0eeaeafb4fdba86cd93ae34d1991fc435ba892949a0296340a13fd5c6920547993fb4eea1347dd53b6229bd1aa32de50023cd1a605f6d1dedd1a1e97aa76abc179298218f691c266a93f3bb84903c7518f07050f46bc95d7d1fbb9f48ea89de13fcbde1d84ded3801cf6b94df3554195ef8f9867e743e67391e04f38efdbea713ae2c20df294c2e3b31b4b9cf8a8e746994777634e42a6eab58e4d31b0480dbaa99d2fe614cb188129320c016801db6886823740058fbdec107fb5d0748427e03c8da41624cc1501680ab06b39825e61450e9f6764e5fd3d455634c38f749ed352677680d9d511ea197655381c253c2a81a128a0c8aedc2af8914f11cf4827ced9c8f8f8ef9124e57939f4a90f67ecb7843c755d677b0282286614136c196e2fc14f8b44d9c3f63eb44c4befdc05929868cf0a4abb7a8bb4b28480693f496c0868563b1b058e4e57150f244dc62de63991d58570a1ec27077e33afd101a3de74ca8d64b9254dbe6944c977f819db8deff2d71a20f77f14d2d0a9e5e5f2fecca573f7b7db99696b3db0c4062336977cf672ae9728d2acc08b3149f80d0d4fd31af65255a5605cb9c0455f4aca06d7fe160eea53ebd8ca41f0ff8814595a3b483d8f6d3eabc88612d898e8cab1151eb0741f1853a3cdf0db9232d989c1b12c5a379ea52fc8151d08e7bd3fbf9969c2a432a5120117f6862e551bf9c32869f8176e88b4c64f407b7c21214ad0088f528bfa0ce1b7f95d498838aa126371e2f5aadc1b7947d078b93545a2b4825f8ff9b77e3b36b425bc9bb46f625484ef72017458710ee1b2c43c094e7bc3d559dfcf6f8ad22089baf56b3f6ad5868e43fb96bdc91270a4d98af0e8a85ae4d12aa0a4ac41991486f0916c304efa8c0ce976a214f398459fb3886c8ed491bbca9fb643530783f63913cde871cfff5a7169438b7d4d13efc473a3f2b9e125163c5a1674370020cc361a96315e31f3879d931c9edd28a43b8b87f7deae77a6842807ca9402426a9c3a8b024e9580e862529749179c205a6f31019e4d386031f43691b1117dba022c12ee4a495780c50715df341679040b26cab9059a3ac912d5b3c7a2028cc3318f8681abbbcffc2921953a2f155974d84e9504009a201ea7ce3fb2ad35958dd914116d8f34a42d7a3a4642e4c5bf327a697dcbc6df299c6926bbd60c225473a2e4754a4de5c2254329c7676df27548836047b03b762804317a1ba293c6d81b7eb5d4d83fae99a9fbe6a7e295630ac1d38e5aac6b5390561186c4052d6ee0bec1dc096dc75e676f53713cdc40470a7cf522df40d63a07299d734456c4df3c3f43a8b720fa8f6573e2de2dbf13549d79362411727154f6782c2a320cc0e1f21003c5e64a893da423abd9d9ed7d1c36642f1b5cb90082e4e0231455dcfa32bc8ee34b8e4fe4105af66758b97110dd97221f7de2e976a6d6385cd80955027a7cfb878a24c05fca4f5bb62fdad10856f33adb9d1d322eed646f0ce131781144c9e8c637a5965d8d82aba0e0f0dbcc0ad5837f5224a23fa22485847a7b652ed631412ed26f14c5c46f38d57969123370a8bec718e9b7f91e43ea7d70a880c56ae530ec82c2b835fd038395f9b5118e1a36261392b40732c1cadd594238b33bc399218e9ad70c4c1e7ee183967a9cdfc6c25b1761c629222b3973f5ed0166e78f463b36626e05dac58312fd664e8d8aee6ba069ab0bcbc74d537b4d1ac072ff5bb4ddaa7e3ced813f9a6edb86e1d476381193f2148f2cf1c798e55a6f598a2135a4b9363b132ed69876d3aebb61e61d70ddb44bac645dd63a166918fe13d8ef7a6ca4fe14e96d0bea2446f9a475427a4002b71015177f9d9317707e716d0fee50b83f216b67c3835e8d1731f9b7d872cd4847961689c21df9aac55fe157a1a1bf936db10a27205bb16caeef4dd25ad16143d5f57d2ad6666455fe8ea1cc9d305a521e281f680ff885ccde7bf3b76a1c2a3d3db0df951a322233e2089395e50573f64d3387d02d94675a59f55bb5d9d2778a7ec0c9df870171d71ca86a5b3a7d7132a9d0094a38b26986ba25c8051e6097aea67871325a2c1748897efe8a5d386fd9ede154661c4bbba1baffe263f3bd40807c625fcc139059832ea2af71b8d2ab8c15c581482971cce6fe27be9aae7ccee550dbbc4f2ae45ba6e90225ad338a7de982ee43e9fab48bbe8c2dac754e2756e687de4ac73254f6bd4f4460e2a477fe219fc897c3eb8b2eaa53186860f2f52910b4c62008222bfececd0bde71df1c793ac49b5053f93ee5ad7ad1ea616e8abb63fe3d7b3970bb5d1228097fd0836ddbaf1ec08fdb81335091fb49b3341083fa896c54c0d653e0556fc783a334551a99f5f8b69dec31c0fa754e74a0903945edf7707bb9b571328554313ca72261f31491301bd55dbd59645cf1f0302cc07ecde832ef32124642fc099097e82c5983b28a7dfb1bea499f157f10ec612419e6f7008829c007bb9760436208cdce2ac75871a56be6a9d59b02a3d049290a37b832238e954d7392b57ce64df42364db94c419a622f5712dfa4cd7cca7a911d3f6cda7ada6b70857524cfa91e0d51548c006f39ac0e789ddbf121f9405246ca499f77fbc26425938fbbe6779219fb06be251d773578bbd88a7fee115fe9b204f6d211e43aacdeda90960741a10b71fe1d8ca5d6b13a9996183783fabebedbc621b8754c5533fde7aac3150fc7ab74437477d05d154e1adb2e71ccad7ac1996abe1db5efe213a31dee6da483990c50fe404da62af84adf5daf7e9b53849a60e5637a524ae8ccc42ead86795ba61bfa57d67c2b284910b093f41299cba21bf16122b1ad186bd32f737b3c58f4ecf780bdb9106509059dbd799ef250729e729ccd17d3a8996c042fefd2dceeb0481003767c536d8b0177725e4d7176d436e20b13cbaa99237853f5340e8234f85843991c61b50d544beca9d1a00a0b73b57d35eefa9fec8236cc15d20b6b1989dfed0e631ef2fccbc6a0fcc1181a4cafd35d7d2ca6629d22ba8c13df1e7462e4bab4ba98b45b6efb30d8e5218d074b554e89c5376aa10667427efb334881075fb2fffc55c692572aecd5f08ec436cc3676617ae37d5d84daf40544606025df4018ddcbc3ceaf0b8025c060717be865f56a69c86bea599b80444dad1f8507a5fb2a26eec2631858fed0e876b695aa8cbfdd6a9d359591cca084a80eb1dcf88ca17009181a52c40c5ba60bbada9b892827bce141acffbdef8e7ca53e85d01d19f3de2626c362ab28c98cd595ba47b7ac4f57a7a406d1345f56a2215cb1f1d28c48f6c6ebb3ac9469fcebe1c082f23dd8b508dc6916fd4fe967eea583c69959d9a84cb5f243a5c76050de32af073e52eeba83a4aa76e317e757af901c0b7754d55b2570b6f028761df6532da2332f00f7c5e51f97f7a502be159dbd2d3bb7954f67202344fe0dbea3bd05fbd105b811c09f85a2275cc0fdd304ae34a93a713242c523424397ad09eb272863d6b6ff125cbdb03cdab18768b71d7f400cbfe2f2dfa83595ccbc11c13884a913db5a5add85e90efd418da338ee410a876e96edfbfa405abde623731b5dd3d664c25e301edbc03641d2bbff2ea8680c56acdffa3c24868cf2f330a4dd055bf4f9bbf2262718cd5d2a1178ec4bea739cab2f7a2deaf0361c68107d0c0a12c452ce9513ce29f5df6d9585fe3a7f1ea1b611d234a584dc151514def71eb31939c927fe4dd8dcf782472a767f8d3a2f53d63da89e9ee0213803a77b6e9b1ea300c3483d411646a43aed604249ad37ad5e940c2df768ecbc9afaf4ab9faf6c9b58b3e642b4bb78dc146392ae622abfd5484a3b856aed6acbc0c11089baa8b650bd14ae6a7153fd13ed76bdfc2cd0ce82a60f2daa99d268b036f8b0a9217b5215bd35bdc568762ece8572ff53276e7a9996a986294b2737117eb97355035febc3f263be421d10a4bfa1dff911ffd0741e350ee6ce038c7ad47c09a6c39da27eaed385a9df14346f68719cc617c4330a846f287225869c12a16005cad1c68cfeb7698ba8a4febb08fcef67145a7587e19e33a5b7c13fec3c2cc0a6bbaf90469aa5e22b3132446d71ae3066c809f4609627e9110037b4eae1c539e9d7b22721ede781299349fae8cdb67be5f6e7e324a943e43d0f21bed059054accf389a1b6968f1371284e95cb37df40639805db4ffefd579a010d056b5761b8223ee74b051e0dbfb6fe38d92fe8416bd76f3f23a0cb91ca81f687e7c69e582462a0c0af1f0dfb7545e98398a584275f317829ababe5bfa11b1d0ea686837591da262ed8500f6ae34236d04278634ad57e94c98a4db0b6f6eb255d266855aa8fd97da15d001b6e2c1dc20a908e9d92fb91edeeb58704fac05e4f9b1a0e653285b002c586d4b2a0916f6d0b47d38be04f57ac2734f1fcb5a0cc089a915d7d14c471c088755363ad5350ee1dc9b645577dc727ce60a470175841bdbae62fa8606d3a2c445db0d019871cc46a3d88eab420cfac297a55db602f68989ac43123f70cb5311d01aaf750baab01699bebbed20801dfe3eb47ea959247aeea85df4446b2448ba8ba3f7030f956aa3d7c3d226ff6fd5aaa21481158729c166065c148cba42fbb08122f9f2e017929d68d29767c1666d3177b00b353d9211b8538da7f09068334fcbfaab93baadac0ad26497ade8aa117641eb50b243bfa475c046a7a776dc9a55f9411ca5d3ca25c0259cf9eb3c142b9c94b13937866ed497f81274e03d55d9f47bae3c4ee3f5ecd42e2311c5d40163820be6e6603432278477fd4c8063c677fe53f0ed31023a03139da1437ef7c491c2127ea60a5549d622ccddb15bcb22ebf6a896e0dbfd987d17f7039713e48a7440fc87b61a6a77121a62d85e523d667afbb6eda5b9783dfa53228d55b95cfaf2cbcf94c838b6601b6f97b4fe986cbd0d84fc37f3faf6f5cb5c0bd472a37ae239012b9fbe9bb195e1c6d1431c613a9653c6f387aeffe6197518cdd309dda442033dd28b8cde28b7876662dd11dd8aebe840eb7ed1e938342baba1361ee2549217f05616b4db5cb3cee6f869e12d90c95cd87bbbb9ee8a4b11ec15c76f6ae8a8d3252774521438c135294ea17cf1d5ff5a927a0a63ec575b6a8449252621600330776127eefa86e98fbba4f3290d8041b032b8d971a12e35afcef5ec13f03eb04664dddade8b9f1dc3a2241b0f872f64fb6c8e354eb34f4b137ca91f3217ae89d7f53cc94b07997e3c8347d0df5bbfcb40c40f1385162eb68352e3c88c4800eff0e1b8edeac03cae2452f7a1f0cad7378cbefa7282cb4bc0290d2bffa27d59e533742e8bb122e032debbe9530ab961d7f8910953f336429ac58b980f69c6ceeb0faa3ccd5c28494c777842ced609af2346cf96863c50ae49a57f0f9cb7e484446ad328c43ced76782dc9a6924bba4a78123c006679f900e29cf17ead70211ea1ead0a6d2033a12a90923d130261e7277f7cc59af62d0363fc8437b324f28c56eab6ca11e03656c23cfff609e19990bbd070b363d272881a579f0485749f6abf985307b6e42a386dfae0a3997c6a7cdedc03f45d635389ad60a7c3d41025bdb33ae9a3b32fecaee84f4318f9bf3b4e5bb5262dc24b847f1b802cba2635d9f606c4fc844deeef1171d1f076df605e1c789055a37c15dee59bf6e7229716225688a031722a831e6324cba96468774258483d7713e9005660269ed670417a317f3fefd36b6ca5c46475d93a74769c07b023fea37643c3e6bea08f53eb453acc4a5454ad1d67d09629ad9ee23e0687f12ab7e9c393ff5c97db8243a7765252d501a6336aba1fbd95bf5c50d590a49d6601679083042912ca1cdb5374e8614754685a8ad756a69362e17343b0506d11d59adc9e3bbd3c750644e6fa6eaacc029ce31357b914150b293810bf6c127703317fc9c21b5520741d486a1c2070c88e5335bc6a058880713c291a42d1160c6c2f6d1bd986abc3ba89e7e59ba566af266168188d2bcbe1624ce8e105c67d79e18dc0f294fc41d0a0c5b95ecc45e358de7d33cca62175633425052b89be23a60df128199106b1f68f334d485ed034974be4feee59f29ba6a351943be371e0990cf73a343ac0ff4eb1baf4bf697c3284b4c8714f42022918083ee265b773f284e0a64b4761b0ba4c68e0e38702dc7b774396ed8edba4f05441e595834599da0c1222569387691ecf52b92246465bc19e1ec55a9b413199d30c2e901c670111209430d02460790116bcd9e9384e07510b7441a840f2d7cc7acb2eaa3abc6d9a2b6774ec8ab57db407899a3874311b35ca189156219ab2854a6b36edcfdf766089cf4bd8f632947d77c82fdfeb407115359afe9e5d2b72e18b0cdc64b0f9c849dac9b9544b1c6d1ca3d9aae9142887792381f6e5d80411cbbd80867b77274679d332c487b47741cc6206a56b4acf970eff51adfa19fc1a00de39d083f63ac8c2549e44d7a95351231c18aeeba00f650d8c07f634db8e917d1b1c1a62a144e3496310b911e25f0f590ae35c4bcefe4fb1950f5624abf77af7d042d1459ccb3861a2f2489c180fc726aafa39c99fc0ffdb538f71a8d33fd1fd879bf89d581ddc0732dd4d285d026e095d7e5e995cf0146cb9c253e86ca117216b750f6d45b68d1b28453b0d86eddf7f9090c2078ca2b6d92b22c17d8b1f3a864b2b942102e6b009d64a61791a401221e07a0475a30837e9c7515c3b74702392de432d24a84100a4204d4a97b5439b311a57ffeee69685088ea2739bbc73e80861c6ce6d1bdfc355b7e5c94647b32a77cefdd9738504ea204b9fec3e698a434b9972d59c228d855fd83a5c7a4019e1fcfd315352142fe4c82228102bd73065ed6cdfdec3a9ce434b48e43f16783327dc3c3195e6ac05d6a4dfc97aa546caf720d1bd4f7f003d61a019fe5b7f72ce05cfd3e2a60e8bab0834366530e8bb38762cbc0e876a5e68a2b1f7c1557d3f5dbcee79a2fdcc83b6090ed35be91a52a406ebac173f0d19cdac3b46f8484a51b810fe39f440e6f4afe3bcfdd88dad637c2830708b1019402f97546ee58a20ab491c669513fd652184d0498e0ca93253037f1fa92b091e9de52fa8c448561335a716117acc56fa12bec5f38da7164266122d5d8d4d1a2d971d0bf634d6beef38ef9dfe3e59bbfcd21023c6403723f4d08bf7aaf7866140a2b2dab0f534a38e511ef93fe91fa121346afd83b412b11d0ec5051e82eff2c0cec08b881590dca93cd607158386b117b8a1d82e3d6d43de6c4251dbb94d949defa49eb26da22a537c995076c57bc8ee288ea91ba057b578559821f776bacb79ab881e80602d890c64e22159d79fef4de1141a161ee0759512705953916e665e2f7369eb9c27bbde9dab3c6a82998e3ce741f3347b30802278e3e023e04b25e41e1be544de2939cf765cd21749f0e6cf34a90399f8b33db48d10da781f988c7c2ee22296538387d067f33284f31b55beb9d6ac7e333e6c98b6e43631f1f488702789af4bd325b7ff95122e3967395b5e1eebba7e6121aaa3f71ceeb1145509616127b9dac0fd174c17ac34c6ebfa77b5c3cddb32a3ba0274f5b3705041de166d726aba79d012ea48ae4e6cdb8f545fb5de56c12c383735df8811cd55c3c24d6ae0b29f94bebe866b3f68046914f127333152fc298e08df77bd76249518ae0aa2a5055b0aa55d342522b058d86cd00830884893a168d7c6a3049259f7e999d11193d6da9a28283448c12587a2fb0f873dd733a761508dffa6ea72683faec7bf3ac2f01e7cd4976b4218dd1ec738eaacc766eddcbed2b3e487b96b8c95f09ccf56f3fe5c597155db8d36a15515e65d6666d28ea9be4a5a3723ec0a54c4034be527333ac41bb869c7b72eb2515cbeed4b352a9e1daeb6bbbe7b63253af521d86513c48bdd5fb9539276d447757441ac541afa68df3df110f11893f741cf4064a40e386545d3b59dcb7afee462e57644d286ccbb575b81b61aa6a3ea2d2b096a6f784d73333f830aed2e0d32983afb7807aa2a175239cd6691c4a4d4b9deeedc6c58523035ec0bec8b6901fe63049196cfa3b501a85cf34efdedf62c5937e6d1193a6f9e2e7dafe85d25b7b4d7916233f3fee4eef3cc6681d3966ddc7f5a58343752577ad6252c00c27d65aed140e236bcbd9083ce55e33615e3a21c76d4ee2eab5010926db5bb9b97df23527f68eea87e730e7dae87dd631982c45fc053b233c2d2333f76dc0e386a3b41b4ed70645d239e18fc4d4049eaeeb37f6229ff86e25a9a800f1c6e9390367ef85f279932fd5500e7c1d2053b9df7d17a942afafc419b78afa2da47ffc355e5a4a9f4979761fb33e95367cc13c1c78ecdb9ec1b18cf6ef359a937b02f06d58bb7edc42812e23f40fe701c1bc353960235231c1237473d89f6c57b006666993fd8d5ce780b097cb8c805f0247e9418c741582eabd6c1071e1bb2c567c4caf1556e10701359a5fb811bc1ca690165a8e9b5b2d56c9aab2eab7cdfd0c283d665b01f1cc1786e211983553fa101ad51b418a696c27e75057812bd93a21dac4f9a4da5e51f969698b72d2f03fe4ea30f06334e62f5f553bf623bac1d243ffd59c55b12ee0e4f7323c52d552f9cb43b5bfda85147330be020212e245a3b8f616b28edd8c05b47d686f8c9ba0e814e4f01bc8443e5f899796ae6787be772039936f5a13fe08f06f6f242234c6ba565612cb0e554c028e6a2d0f1f22c719ac4288379e0aaca3f2c8b76733027702e78606d624c8dd91bcdf3b1ff718d67cbde4ab4938e42c33c3904fde960b793188c1784b2c3ec14592b8a133561d334711b99d45de88f293af8ca5131283b21b4055caf9ec2dae922ef16733636f96b0ba78f77392a2a78e65d782325eb9114466129a0ef74439e31f571ad87631ad14c6562a0287f7223a76351c0b50b7287cf61bfefcda941e932b7a093b9277e119976455747246264ef799cfcf743ec1a4d2a03726da41a7fb8db33cd1153eb6ec530dc87cf7f33b3a7db98b97abe1930ad22472ff3c69b29012b5b0769dc2bba0e690af902bf06fdcb1df0c43b8477ddc2a20c3116849e4091f7f882aa487b45ec72acacbc89f1e4314b0bcd071802978f45d63daebc6c54c53bc6e9cd0a578ce2c2d1a0969f1a9f9200ab5e687948919adce4df303346724b7f89eeb2c5cc010ab1202b078bad280a198698ca034f4f87f93dcbcc8c6b52093080d116c703544592c91124a7c16e176f84cffae2e493b008f0f1d997854a0c527ec4a3260c0ab5829c5949fbef0965bf0f90a1c1fa01b30d7a65fba1f26d98c6f9700da21adde4decb73a8e3811cd9add0c0e6b283c50512ab3c414ad001f8529846a23c4b6b1c80f20a19660cdf9f31cf6dca580bba9039ad81100957920f4d99d388909a46f5a006d54d01d5964be4b1c8cb84aa429cbc0639a59f3d9e91f169928367e7cfd29a5a400b655767012f93d2732808670ebba7209f3f64bfeff234f355017620b6cc4d0e438f7f768052c008671b2287580096698e4482b281ecd71400c213f6c9174557b81f5e452dc05d80101fe67999a93fda47da50903fb61937c80e8004f913d95c8c949cb5a23ef184b1043b6a8459f608c3880fb39be54e84e1321946f554efbeadfa254282727790980b897c59d806e459acc18f3818b4b0f144c9cea5f1f3a92e82ca3701aa3fadf9d4a88a03941961851a5b32670b1d4feb6188e0e047a93c6458f564b4f04b38c5b11acb95eccfe49a6db624c33ac970388e064fc06f8d5a7a73b73aa4d0b5e3bf415426c08845f1ea5f5c70d3961d07e1d0aa77b69ff92ab05fdcd9d24932653de32d9dfa81bd4b84fd96753648744df13112909d51da90ff0713d319a3ec6547762154f02603a8a7d4980a297be4bf97d07c6ae5da09715ef15297ae571906797e7cfc46cf81280f14210ed15481cc44c33edcf815f773f99cb57d69e11dc111d1de02074673a00e8a2cdad60088fe0053ff911623e68c29fd0c9769d5c6b3b1e4faa8a346d9766c63fdf569a6337f2fce218c05f1dc87cae284621a34c97e2b51e1f587e8756029ad99d56f114f9c703780378fd6362709b79b3daa00cc76d38ba8360344aa21b7b8acfab59d7b525b8eafef1fcdc4588e6fa755e348c8e6191f632680f2f7c08695baa9e545335fedc3fb158ff03d1a1795c1a91c0822a19b023e19926d2e5a9b4c9822932ea23d54b78bbe906f4b682d783bf26d9e95a97684ab8e10280d5f5e95c4122700e9dc326616d4e948f51c7d289add476ab9f32ad2091cebfb8e39f95827d988151af3282da7e435ba451671058bdbfa5637b5f893d297b8b40c9c668924ddddac1c31fed6e66ac02fa43553c2995ac5fe2fc266251b6369c32e9cfe6b66e50c0aa6dd5cc9ff1fbf426fb718143a57a35f18064181d04c068867003917dc63347866ddf2cb7e54c5a56668ed35a94f7f26bac29383b1ec92ea70d5e32ecc9b839d4ffe34739eb637f002b2219b66064580c87540595b56795340f92d547b177361a82b26119d31f3e9609223cff0b61397e4a43915328769643f01cf8d95312b3053704bffb4162cf48a5a4c4bb6756b323fb5af7140eac6a59b75f80675414b22a89c80394378eb17816e2c056f17dc59a7a7c9c8755d41244a97101363887939cdf1198acefd5c5684a316b01e88b1314fee980b24a28d411230ab5337c57ee56f406c9e94d9f17bab6f93471026536084eb20140b7f262c860bd88207791454c8ce37d8d392da5f4003b5785ae65d1a29bdd418fd23ac24dadc075e2c6c662e60939c7c38c1e8fb159890df477d5995b95e078ed6adb6a5851be204764c959db4e36be70a5b84798082fff250cdb3dfdda4e3ae35c18ba05e87750cdf8895b6ded59fa414d6e1645d47dba5f718b94c448b56ab27556b84b4a201269551001460bcc2bdeadb61f21156e3585884add8e74f26283094a0861c359a61da583c336d57748bbdc275dec647ec64cc65358e6c9d60e5e9b7a321aaa3dc28e82bfaec6a1ff056f6193c0496b8b0f3aee62af61c86be733e4a8fede307a7296f4607e6168656ea5e0f0233c1fb8fc170ee3ebd13e7b7f4f024cdd089e7e784d7fed1271b3ea7fcc6097564071b90b5de7858359ce2280e762d470f08ec793073aa6eaaeb56ca882efb57348fa6ee7e50273bb71822b9f971725e66699b0b23d46da0cf15d582b7d3b25a362e62b8588c69c6f26a8a1f144deb7d5fd1b877cb58582e9ff3a9550b1103ed916ca164dc2d5bf333f9825a9596b673ee7c1a4c7c16e56ac8a3b27518f1b83b871b5bd51d57cf39e20fdef6ae459a66808b61d11a4b7d14a5bf95dcea23dc7a842bc83982f2823eed3d2c4f01be2d94bb5e2b760d2d4728b22eb468c15a4b4b34cf80689bc72273a6c701e2bc7ae62ba938a5d75aa607842ef628d1df329ac9d7d1b7e6348b2d6bf1c37068ba8f20ef93e42af392ad47d564e92416c75f73ada136912c8ad81790fb099fa8ece60e954660b5ee36fc9a96cad8d6e1ba46a8357a2e5d93f97000a3cfe65b44086ed4b2367c21293516242761e286ddf8587419aa6b340529050dec0b7fad5daefd116c83cadf1b6b4bd1d2d47c11942ad743c4f9e22484827d8a50030fa6ff9608de54ba08ecf0adf16e5bbdde5fa4f3f76247d860f9c17900a61390e2f94891ce9e0bcfacc08f6995df46c384a686cc52c1dcdbf03f5c70eff5a69f3ef5c173c749f502e29a863228a03ad49afa84a7bad6b818d740f2160be5bb8f59230216358d5d515be2f80baa9c19846a359cf14aa65c5d326ada9d114df5adbd67a24bd25d42ddb8e6b21c820786b6a3e836c8e11880096c88a76e6b3465b2d61fb111456da58dcbccf7b19b300c88db34699a9ca265599305c22a780e0e1bed18fec6aa777cbd0e9969533401615f79cacfe402f11629b8122175a8367c1d105de7f6a1cb88225f778cb322e41f990c6409fe24b6ef4b37780c99d8068089bb3a4b778ec63c80f6f8d03343ef3770f288c724cbb375f126c932c4d58bee0dd606045c9a5b27ff0d5597b25f5ec5c232a6a3d697601ce0e6d49be3af9d557b0be1597fcb7a681dd73bafa132de4a34ca6486127234bd0ab6c050df98cf6b0f111f7500652ca14cab4a41fa2d18f1c664626ba70f874a8365ea64d1e1e8a257a1d313a6b652cf6db617dcd22d74378159ef1ce25258c76e1e676aad0722a01e30db706e67788d558e44bd0fb600b177d88096f96dacfd78b58a1537209074a42c22425e297d11704380c9d18a3bd86ce35504f5127815feabcdef91c7a5b0091ee7c195e0268af5ef300a5c9fe1406579ecdcb0915397d14f82ed2bc55f8de4e5abcecdfbc41f9e80a83a072d01418a2a544f718ec3d4f6332d1bb2aebb00c6ca66b9999e6bd2bc490523859f0db1dea63779b9f1f84d52cbf3e7dcede8214080c6b54916f512426bc9447266897ad4078118867e0d6746cd99378ff539066b246ecd123bcb3597c4acc172ea13c1e260468fe12b1696ba737e1984e9b593f774c3db1696be6964319b9f9388707bae3ee0858528e3658741dc271e80974045f3ccdcf5c271fa4458e81023f42761c5eb37375dea4e4d4d8b1de0b4724631cb35b0043e7ac67c4edf767115670eaf50370af4cd2637de6c760e5750b8bda3c5351c16a9a5ebc02e2ea24cd10e9fe31deaf0e250d869f933642bcb9da2dd7ae6d92e3c3242c2ca4908bb60f19d68897616973b67dd1f1b037c460f7181782191858f2003a4146daa41901058972d7baf5088dd5f89f294ddf5d0b6af191f36df14250213469c2735942e825ae6d36406817d2ec872e739cc1cb9f0bee817e95e37bb38c24b9bab958654afa1a38dc4c3155c37d1310f014a5860de0637d0a48d23331bf8afc9f5cef164c130ca4a472b360b92d4552f083d6ffc381f8b033bcc0550c42ea706ca15026f0d4171c06e6e3ed636e2d7cfa92856ef967342076d612e419457b0667c8087f01ebfea10184cb54e7c6df803d8878fc04ec7e45e1705072d1a554a5ead50980fc7dc0443a2f51f64bb73fa10f183be1e8c4368441ddb9cc5c47845c02ab67194a7f27a109036ef7c44c33ea236f799350705cf63fa5a8ed6d8075b8d483c41a589c4ef7efb716cf495f839a1f22ae433f35d4c5abbe7bbcec3a78ad021babf3e0b9ff84130557125622e93b0795670617a426fa536430d1dc22c79ef99b0474f5fc4a7812efe5c9e2e9f1a23edfed2340ce460b118525836600127c410d977d7f2e9a89a6b571289479ee50ec969a026d8054077f783ac7038fc45f1d7972c01d4ff6811fb44dbad8a5de90b39b8a8c055e25ba81b4839725ae5f33875d468fa381a5866ebfa41f21cf2bcd32c0a3e171ca4cd5ee36fda6a7de9f0c630430e796fcae444eddb481d8c61f7c1c1a6b6b6df269eb1c69ddb5d6e2c4bde345e22546ca393c69f48b4d52019f1cd025393fb97d193b53654aa6bf784c660040145a5d5da90092751a9294b526d087323a04313b76cbe6447ab73707f48abe7628a2d8e2b0a5de8dc8e7d4baf10cf6fb714170a8d0e808f9b00d1e3796967ea69bbf899bb84605751b423872250ad5e61d0162613a0876f1c0aa27c7c9dc629bc9ef8fdbcd6abcd26fcdf55e0bb080028cb3de1e3785a3320ee1652bc1a553fde8f73da96ace4c55e5d140bc4211918ed8694dcc5d974ff47276c8c157260e9099cb8042fc9f9a258a6a107023ad1f91a1cef61a74521564bee71c2c055606b183fb3e5f02c21d21f45d8c3dceb63edb8779d4e54668ea48b3d283b141db2e76e2cd4f4f609d47125519bb969771a27a129d82b326cce960126a21be34bcc01bbbda81dbdfc70e2cf40f79d3c7da6f29603a5e52e7f968c8bfc4709adfad10b5d2901740c54625168f306997e9ff6a4dd6b642635308a33e7fa964a666fbf436c2dacc0444c8256f8ddc5cb975510e16e093089030fea08c28cf13a58a35e43883a9feaa5b6552041142f20a916a2b4bb0c0892a4ccf1a8707b3bd537b359cd86f831c655102f69601746ba8a29cd9a089cc3796df03360f77c6727dfe70cf7bd1ee97bd070a1b8ff7798ba8dc2e1ca6f09c1ac987da350d1929136cd346b5347b4aa00aa08b1707ffd7ed550b167233ae883db4791025d4d3f0893cae53d0ee29569290f29b0f73b691f05895c9a2c40357ea89b2fdebe78c41e14f014919d17cbe67b0fe6fa854d65c7a2fa0804dd88d8638caa595e49d2bcb1eb6bb45aa447c4f6ff29d308b7785fa01213a796bf7f61237c38b7d6fa76cb760315659cb37e2c88a9cfa7d48353a5e160709aa599f17ab5076cf9010a1aff139e7d908e73c96c1eeda61568730981f77f749455f6d4efa787d9fd40630cae5ce4d302f7cb502afb8a092b1a0447db8c42d95be45ad25ca5db36cd0f24768173e21b968e7f38503c70bfe56101b8152b3e1a32d922a58fe48f8fa01802d578ffce70178b29fcd877d58d2062a166933fc33d52c611c44d98beefc7a2ddfab7b17a455cabf8acab61554a4c1e649c4d228fea931d30314849cb63eea6684d5410dc66d24fa96739949aa615777b13a0849df0f9b95023bfb065c29379f515d4eb24965f0da79ebfa7af2b3852ee22611953769bc08b0df17def102abf69d9e9d2ab0854760e6ee324c6d35d804f0069d65636227f3004c20e2b74a1666b877e0701f933590c14a0693251fb7588d16d011de7e13d98b07a9935ef81774938d1f8dfb137ef0804e32d54efb3566ef86664a6b8d78d19ff938ca4e067e6c9bd56a635ba2884c97a074fd7e5d32a98c6ac2563323e1d7b40da5cc1f7a66385ef4badc4fb28ea729d6a406b13db81f59251659084f059081828fbc0a287f21a7481d8dbacdb4cd8714741779ce7f0b10d23bffed168fe6f15298797240be1ab25efd139f8f6663e275121659798aa25963f01fb9366b0eea86b68b02f48c74ddfd8f7d326a5bcdd419a78d76dc27507ab0aa42971abb2fb8f1b624d62e13980139cfdec46acd5a48fcfc5b86a5e940a9849b14c16368fbd87c5fb40b8f410d515fd63ddfc55c529e5871a4988f6b1478222f54769ccbe8ee2f3b735fa774ab209ee535a968e7f5c73ae0b5de7c384522f475b368931a1de116ed780a373343da60ddf436d33d075b54dc44383d1b526a931061cebb55f946b2bcde161065cb864915963c35219870dc42e260ab6bb141437565ef9fc46b8e662228db93f8063dea3693be95fa1569f3b3c91b8b67f0b77d4a7523cf67d842d97ff491ac1842f40f10eacde168aec22d2d14732daa332ab4a4c30248538e83dd7afd1ee5d712876feaf7825829e2e7eedfa51679ab1d7c340f9d40420378b49fc3fc42f72a9a0ef50bf647469bdcf7149a89c14818c0ea9b5fee05682c065ca8a9032bb556e10a0a2e7d508f1d60276b6a8186759960374cfed62f261cbbe8b3e77cb01b01c412d961c16cbbff5ec6c655a18f3d99b0b8ba2b4aa9480d626d4534cf488116b5b194add0074a593366f9f4c8ab554393017f7dbcff227adc4f71578342e2d84814a1c949f6d51703ab19ba4460a1548b29a5b52b5214a1bed29e9cc43e8b0590aa3070424a755fbeff2c6ce21c722042d196d7192681845c6f898923b56e5f3a7370eaa6dde6d978e89f788d512a80fc498c33ff338ec7f0c3c600de2bb10c1afe00f096a9ae8df2b5e49cab7828c8b23e925e8b46f8ae63e024d51c5cce6b972e070373aad3419669fce258a3be7b3bbeee648a0c7caae41e311bdc63f25a49691a192ed222014d0071e3d7c64e3592feb0806efb75f5e4af2e6fed4d7d0bd43c4a7c60c815cd80ea50fcf42c7e4f1db51cf0abc3e13f4bf91a41a4fc3dc846fd52471628de83030a44e40e76462c6e3bc2cc3561cfc80134e7d03d955e9d64080cb8010b54d350db79d3f32b95068a570ea03232c72c60631d150f317724b11b487dc910d98e2cb9460ddd235a8dc716278e888689c0d5f78ab3b58c904794b17c4bb64d3d6f28dac34b8a9ee8a1dc6f6bfd1c2e413e4b24ccd3543f6eb8e1b962cf0657bead354f86f08fb83acf0f2d15cdb76cebfbe9efddee249045cc81f0360110d2c9c77265cacf1808e1c01c426620d8e9353ff01078bb31d4e49983b38764b57ede033442be57fe2e7eddbafccba9c67435feef3aa6476bb9f59c22a7186659791f24ea5aa27ff0350e301a756fec499d85eb9faf9d230b40f3982dce8192896f6fae40e80b9e7ea12c5f4d0a31070bfca4ab36898d33f2d5f351ce8cf7e17db47b09b29b6646db4334883c7dead3bc7d0ee01dcae538c3d49b1714f3c113d06102aef49d645173306c4f207ec6eac2475bc8fa26926eaab8daa466e6c34ab10668fa741b86b382e92b2214397f748cd625ba2b58e697d0180c69fda71d034cc0670d4abb988426bd872fd41b642ecbfb6be68dfa4f340707a6b6409871faa6e3067219f101d3cb77ddfff917e482730104661cceb733c1c8990e16b5508a890bb1f9e8d2487295eee1701bcac5abc493de597d5d9cba5cd5af580949919869f4f652c32fabbfa516fd7e11158d2757bcdf0f755df173d3f8a550f91664ee1fbfd1fe2e59ae2715ff9aeea4f6e5041aa73aea79be007519d9e80f3fc68f329869d7f478fe0119f2111f54df2cf7b560fb1b47165ffc114f5cbe2c2859c07c3564d638cf9c85c5b84afdc9e5adc2978b62752b13878a63ee99c68d6b79db08bcbe71bd7d43beac5e3096a2c6a472c0df4bce2087fe04ae6fc39eff4ea505292100fa2e449a20358a447dac2e932e04d7d18ffdbd3f64116e120f3aae0392e635702f6ab8282c7bedeee6904bc2880bd57531f848c8fa136e125585af4a7a7f206ae99a126a67330b01e99d67b16e0f0f06f556418d3eaebac9ecaf854ac4e450620e22a388b25ae4efdcae411eda11fb962a74e49e12de23e88b8e6e8c72121502ca28ab80ec0a5022692b0cc5062a8d2bf2cfc2be101cb922d31a3bb9f5171d85a0a03cc4c51d0a2ce10fea4c1355bb710ada6ec0f11b69a74187f2b1c63f9ba776ee670eedb92f052f1e90992332cd3d3da29b248ecc997d73887e3ff12e12feb5b1939f61c73c0709582ba97883728722837edd1db6f102788d29df604047d15a1852a5dd7fc7c74f30d392c0a8534255713cca7653257ce25fdeced943975bb6ba8593235be0f4f199d174f7843c720ccc6baf0215e17be990c8d2c9236224392020c2760c7d5610f539f02f2d083e892d69f78c18e755a0f356d6c90a8306674d83c32907c66a654183ed03d261ae20ddc26354f38aa3bdf0760380fc09bd7f12b225901dcc213c71318e05bbebd80f524cf5061ec623cf5bc895b4a6077976a7ddfb9c0cd3fa783259354b6a2d9f284552ed221b78d0b55e8eae65c02003e58fb60c50bff4d44d5bbf786a3f5cbd49c3cc914fc3c602d082d7557c3f7ab7ace38536e001bcf52eb0ef80154322b310e2ea795fe7333d0ba333dc1a7a853d0b9825e34ff5cc055917311b257cf36bf141a2decab2f2adcb50466bd0432e09ff47d854ff60e1443cc6d6dacc027bc112c705ab3b6d6c3de3ef5ce27d4d129fdb066237160be102dc61a8690c459a52b319c974404180caf42f8620ff20f9681d46a8953f4291f3de9ff279d00cb82789f9f3390a83d0f9d38050aec674c5c92bff62cf37d43b50905fbfac7db15ec9b8771850627e1f9e770c312d2138fe017e607b8c1642c6193e31f193b69ffac55c595da60862d4d14c2cfe9a6558b3398ed59bc10b4a1822dd6fb02884f6d44ccefd2acae2137921c5c0e61af9b6845095b45d27820b326e1306ee3ae43d05624e3e2bb39362187700f383b59c51594cb7ae9af7a6e004d2ae29e9ed089968a55efcaa2f352623448f5c54666a6b57111956291dcd7f5a4d181bca27e3145020dc777335c523570d541bc674e94c4934374829c23a70308b1932cfc1e5aacd9156d5f73da866de9ec2d3451247e2f3f3002408fb776a822a58c313e8616d49869e70d2e7926ab78c4f2c95e286db19b74770a15064005f43ccac5d10198033f1a16ef1b73e2fd166acebec28a489847a9ec8537747b5c83997872a38527282e648560e37180d3acab42a72ecac8dc39a281f1c19b64c8c71eb8535c29c8f8b60a4aaad677de1e20a0f21a524e0bb3e1e91926c4021f3070eb5de9d98a8df57c41452f66e5ce73d7900307c01ee5e45201abbbf8f49bfeafe78720bb61856e7752389ff5d32b760488343be6f700a1c9e55fd535ec4584387630c08a2a48f89f1e7efab7c9de516fa1771def7e4dbac84f8db1de0015aafbd1f2d74e64e65fe58fc43a36150672689ebdef7b06b565ce79bc4ec2335c89b84780985086a74e81da4c032429d717e5c979d276fea444f6ba91edc42f5caa9dcef02bbd32e44565a745ecc2d53207621ce08ee5421e74da75fed5eb0c36720ac7bf257418746f2b2c0c9be338ceca525bd2d9df8086e4dd1b39c9ca6771ae45bc522b980eff22650f48f22a5c66df99a70d00195f6aa67023b00fa611d4d09cabe9af0010edd6aab27dc4e4815cdd63292e5edb1a572dbf1c307cc0127d6ae1a2edfd548dfbcf3360079f6cb5de7778ead94d8ea779f40a51468df59c9f68f9b642929d27db1b62b28faa2f28889ef015c1b547c2a7fa8b98ceff4c4e721b8d7caac45aec0866c1e62eda03a822517e99d42a6a679d36aea470b4ae2a2f97fef10c28943ea9861b09ba728bb660b6bbe5b2f052c88b744bf24caaae05561feb1a5735f213b9bd71892f0188050dd475e72c9740ae547d17dba345b4fafa7aa952bd9e0639a2d3566ee4e9ad19515d523d2e4f36d26ff1e7ef1b609eb3b126823314ba667be6d09e7c435b4d6e68e5a8f1345e55f2a71d50b8b8b105b87c9be2458431d77b36ccd6f89235c8512dbb2d57f8c59f560879332543b473d0d19165422d731c2350156be4658e3d17ab99a5e2816e0bfeb8868a7cb38627522e5d2d86b7307a41f3ad81341c03ca0d7e571b4dbebf47d47a90638207314b6b00686d4427b56330750f0121d400e9d590df382d206d0d812187260693fd726374ab708767b3ff731a9774e56647d00e850b4e31e47f422588d47691d26fae2c91a9cec647376c3061b1a41f12ad3ea960b18424e474d5462a6b43b3b083d7b8eb3cd3e3fb8ad176138ee32c53af44e90cf24ac6d1b3f3a0fc446c2b2d7211c2136b646c59ef7a8ac5a4faf92f201651879cab5905e6c5ad9b39ee8b357259ac5051ca342f48cb3b5f641e6cd4b740095645d8343e36752b1b57a0f6e303a6a7cf32fc24a3870bc0e3897e96712d82a1225701f8be67aac7299b091e2048947f23a93c985b761fb16454f89dd5cc893f1fa3aa7bd95015c9da68d57bcc35ea31bf25d69551683c6931093b2aadd0f37ed9acf6a408ed91f11101f562a2e2c5f16fdecc66dda489676775b1a2d62b09fe66ff297ccccf99f5aaf8488601f66f11b9cfdd0d91241fed97d3c0088963cfbe070f039e5fcac771780e6b2b245be54f17cfe37e425c0de47acc34e25519300a8afff1f835d63680fd56064190b99b6b0c723e7411d0b183ec38d0aae036bab9785586d3d50a0d062a3038681769da5820da23528c36df7f3c9a828fb0adb085adbe1892570135b9fcb61d795502f612507a641afe9b2b2b93310408eab6a1a581f107de5cf9998413d3c68d6243afa58f2dff4bbb6a97c5c6cfb5f9dc23aa7393ff18ceadaf4bbc3deb8791ab6744ce12d16f90fff60c7d88ad8a30b82042edb1fb6c6411d873e295d3e86ff5ccb94ca3ae8bd5f6b6f6baef56ff9d9f00356a9eaabc41f2f05d94fb7ec0f69329e3ec74e0900a2d326d76e99ea7707e1ce2b7c9e6a3f47ee0d8ab2d7f8cc651eb5cbaa2c6b617062a51b3ac075fadbea8b53d0b781e9091901c608a42fa6a2fb46fa13663a7273defe1808c6027a20202a7fecf228e09b6dc2cc97221bfd0ac131d90c33861c5b993c7248555c7a15c9d90fe9a8c34923b3dedac4a88f8eb0b71d778f94b607d1ec95217f8bd5b03214536d4f7c402c079cf7f67027fa945b4782c2a06ec557cc466964d2bf2cf0ec14ebdfe615cfb1133491ccc415e202f1ab98e3c738ea119238f3ccc569ff46181e0b82c4db4e1d997566979b1005abebc940acb548ae12b96ad19af931e1cad7869c80dd8228e000126b3b93d629afb1aa9f487a25701d6ee99e4cf2f5b9f207f73e11763352830ec4e195996180fc56c5d84d0615352894cf5b67f2b1e91974da5e501a8b09f090edde5e77c5366c947b3a2746ce229b5754f6427e403fcb271e487fccf3d74e0fe67009ce4d32c4fc1808882f1d4b65436887c30ac2a06f8c8c8f48d1dc75e1446f6e02f13305f0ac1c859912dab3370f14e7959902351550bd14b3d5b1b012eaac45fb19825896a5adaac9d3374ff6a40290f56314ae3967fe76610cb84eacd3998c630db20e49958f0d8366044fc900284d5e8db58504fbd6975535a2ee1ead79b6cc88bc6831f661b1fee9d97dcd7f598338c12befa546a75c7bc86c784b367da4df13f70a59c5bf9933e95654b7701b41963d33993a9e0f46e7281411e4e7a3b97906fca7bb82652c94025930124c911c6dd1333e8f7340448aa6fbaa75ba9380a049b41bb86262d4921453133dcce9bd98da9878ff74c6a6ae2b40dd06c1d8a963ad52aef1b26f73e9c57fd52286f2bc6ce8df8781d3c4c68912a05deaf4ef510089374b5a3ea63672190ae97c9a0c79dbd339b36ca5abfece9fbcffc1a6564735f8e5b7ea9ee50b7aa3feee252816e206a7ce1ba545a90f74a20711c831a4554a7c53288733fecbbbf9f48d272d6b65926e6491c7204b34f76048735d6256dc1a9ed16a62193ef707a785456133801b11691fdd576103235c6ba2978ab05ae19878ccadc36f9574c97ce3a5bc3aab4ed3070dbb7ebfae002d7ea4c48794deab0502b6dbe03c1a49ee52728fd3ec92389993e7464e8d8040e60b211d75bcec5adb4a19ca20af1f2232c652fc25159e12e858f3d07f08910093953401a8f70c11236df7992bc2e113e51b20b22a2296639fa6133b6015f802d66852bb2b4b698f1e8a81a76e67687d0b8508a371a3cfb18254265d57413dd9aaae3742eaa265f3456bf9dbdfb08fdf6b477a6a10fdad90e7a3355697aec35bf22a8f84b655ed7fb307d0489142c045faaa914e81c608e59c6f88b82749d9567c46aca74b4e1978b741a44795d277cf7243127e1597f2e5a3ae676b42c162909e2acf12f010fb756d886355f41a24888a64d5dd10af3515f3001e6911908bc84e293c988afbdabb7d440a2ec3de96ec06b56b4b9701e95e5ca10b6589c2733c81269da2cfc17b3d47fa89dd30503200099ee675147c9e6f97da5e3a7856a4decc4b8c165c4ef804f41c533835ac27e46741496675a2431086b71971f0d40370dbbb119242adaf4e729ddf8d1e04b69a669486aff6a0ee039a66c9961c66e0d6d5f78f3a1fff5432c41265936aea1995776862f892861c937f5904d376a339dbf99a02cc9cff84c27f206c5afe488c953a574c797e99f22b5c917e5fd1a90f3c17a4868d0688696a13dc911ff02f1ad4b6203e9d92f77bbe78470dca7c72009d61b3df1e7871b60921a0d54a6ebcaa148260672a3aedff2f9764f8197d9a0b6c934cceb6820a41476eb1b6a9110af53bb182dbf95046145f6bdf102b1cfa86a5afa8b08e603fc927f0460fa9563545c88d7ca5916dfdb5c9b6c767d520679e66bf673ec64502185615b13d9a131fa4651e5c8b40eaa278c771c4fef3acc35ef76d167f79eb68279911984ac9da9e54eb431dd2340ca6c72e04c2da65412db02aaa3246250c507eb8ff42c1d25b629f9340317ce8b71eee0aa0c015b2b905cfa739bcb9db63c6779cbf2a576a132b4028bf070686f89adfaa5ca91fade9b6f6b4df65a63848c502d2d24b94201e4713ecd2aafce1b7eb28ae4f96ab46476eefc5392d6ba2fe7220eb3458363b121c138d122a188c3dc60454f7ef6fbe7479cf56d1a20347d7960a7330ee392fbb02e0d5b59f7881035d8439568b8f438c0d91f38b1467eb4194f28f7a1558882f831aa7bf0679b0059c10180c66abaff9d238887a05ff23493cb18235efb163adc0a06a2c8099bbda391161ad30f52ab2c7627ab44e1ec88fcbfa08277e4418a7a2286601e56877d6269595c4885c64ea809e9c121caa5532d4aaeadb9e9e6651be49f25470bb0dee83448cd59ad75f4cdcdf2d6c3346d6065ca27b286622eb28fee3ce4399894dfbd1846725fad67fa2b818870e0aad72f9499e1fc776431e6fa6a6858f5c6f1f0b56126e8f912a126053d445f27429a596842da82b1c3b8308ffab9ca5d5c88a2d39b0f44968b0ab67222c6b93f8cafda69183c62918e96bd5d949173c140d1f7d0d256ab50c9fcdc61c725a4a1e1f4639c8363ea53abc87a8b8696a1b8dfd51814f19a6bbc18f5c567ee8d89e0a85879c50fc1ac149cba1e9453d5d262d272c3a76a0e254872e1f54e8fa6da6c8d2220605305dc398214609f1e31edd55c8185c46fc00880f28beba2b50b042b26b20d8fd7f26fd662142b0440addcbd3a64e6ee99bb583676f96927d779481a0647ae6a8cc059d35daea794868326bdb485de1940b2a0c5b90489666a5ad85e2a4c336c730d0cc6280111fd237f90c67e4f6815889ffd803bd9cce441ac59e2aadd6e546f9ac17507798d056b2a421d381866b954c30d33a932a629b67e2745913efa188f9bbce163bb69ed44d12c9167c406883793d6e073e31f74637aa4a17c5c1e67bc663294b8f573ebade9b593b1f720c74cc001f07f29d1168caf61ed84f913f70cfa5c6ebbade99e2d4a5a9b2a872a1b1fc75c65337ddb01ea09c027bb0ab8c5bb00cfe363edbbcaaccd3b997cf926dd2ccdc64d98cdaa4389d8e3c46a789810929302c1e8d10c233932e1144928018bde47eaef06a82746533c7a4b9f1b8253c9bdc89e63f7feb3bc7ccc9aee795df2fafc139fc21ea9013ba3a3c248747fa68bb7210b8557073f3fd7cfbcb3a57eab551aead27af9f716c1d528efcf4723c5755ddd767ba5543f9a7b1c112d10174ee53670c3efa51b94b73a0922dd298c2ae4bc7585bafc8404413f0042165cdf82fc68e9466646ef85d2a9b52bf523fe8094b7dd275c84288aa10f6fe14c5dd5f3e8b2e30e2f182083b5a1f4b0072bb58e0004fb9868578a1e1fcb8be370bfec6c5b2d0318eef1e9bb50ab89fd834ab0e625af5527a5e6f82f8a3a405eff949692ed2338cb902ca715293b77dadec10b53bf024f432daa9e080dd7f2810c25b850e8c2e0b405d1375275fa5e832390fdc7373e6977f682b358897fdf88ccd4f323356b80cc556eba9346d54c0472b377c06d453348058467141f388a523f6ee723496005e37bbb98d321df49a1884bc3561c19198cc35f2ff429ea6efe3161f569f92e1da035ff641f28c04a0a8052136df82f8b0447529ae3e27f8a58912e545514146409666760f5425a3225a4c26c143794808a9cba3f10821c3a9a6a419e06c57f5a6dff47370620808ab3cfdb8f2aeaa4c2eeb90405d1ac832bcc1a55bbffa814c3471d27765a5ed6edb3566edd96e20e6f108402df41b49faf48b75484ce9d37936b2f26672e80731901740049f18de88bd5eb2f58dc4afdd7a8f9198992edbed64c2602373c57e2c06bfddc03177ac292e562cbab5e054acd21318a4a10a4805330476c9099e3d7660d79a3b2b8be3c14d05fe246eb1c9964761289d097f71472a6beaa0127023697956632f8ba77250559a15ce9e7f270e6eb1edb62586cfc31cd4fcbed345891201cb9f2834761f84bd88f6ab147e6b3f1ff90139f9c6c4fcca9dca67f6f4474b102eb1d4765f13ddda3746d54e44bdd32806a9a8a179baf0f8d75593777e79ad9eb9a370db4ce21cf5fc496d6e521ddd7f2e86d2fce6bcd92f1dd8028592154f1a8734fedac7795d4c039d5ebd66d4ac8475a137ed935f20c7fad6ec11db1f86058949a36165489f84d9cda1b1bc1d4e247187d32e953e61716bb585c1d0454f7b965292fae8b22536dd70cab60356d1dbd744f7011c840ea57f5b80a17340138bbef39b38a34631fcb4ae8d262656ab1557b3d74e09da980adc68b54c5eb56ba9716374b1522367425691f578ca5d4cfdf22220b7694610d9eff4fad493158fdef22d1c936252b49153004e8c5ae8b53fc55dfc7aee6769d559dc6d0a439d4d709b116e3abb4ead94bc8cda7b0bd12c0a96a151ff242377453f06983beb82d144028101cfc7cb7b12abe9a1ce9de7f714f1c7c24357c98d11145b5a768f01b6e6f2bfa3da6a825728ec4d1186fb56378be287c83bb728ac1f2e844241a0d5cc98b9aab6996b7ecc14b7b499624b294b767111b76681e3bd0002113c7e3206caed1bbaadf9f536c32c97ba20607bd2711ce7fad2a83149529b060620ac3c8be317fcc60c721d23665f16c9e7eb87b8e591da318ca5d60a8cd6c7acc1d3c2d7a06e4483f0186f62e2ba305649189c5e53605892ca44ea79e249bc821f3e82e1c1583e7aadb19f0c574c2e138adaa6efbd425980613fbab36ff49733b6179e15246bc89971830913c0c225e6fd33bab45f351768e60d9016b5dbe6c9f4cce77d160878dc2a27e19edca99840bc821a66df08234e37b482e1cae6644af512098d2495c11ecb228a57c43ec86768f732eaa843d810a0faa286e1fbe63bdc46bf9e852e349d15c0a170c8fffabd3dc7839f6a8190b7184ec66bf453b4eb894885d61e9e21438073e1729f784790935607c7cfded186c2a6b134916d591421f72aef18288cd68f97f0998c659a81d73526766309ac0300415da7b642dfe8ba7e3c9c37af67b4893f119f69985e1e16f4bfc24a1dbb04462575658584d7a752252839e0787f818f41901f5080e1d52f35e165003d5c0f8281cca9a45dc44769f5665d33df75ff7ed753aecec1308e456ddfee4dfb559bb6fb36cfa647b5777228cee24821962f8350ed090a538f12a50724188e273c645315f4da6267f040104edf9029bbb4da1884407f8437f5d1665d870885f1bfcc6b28d3f367465ef32dae8fdb43ffbdeaee77e4193482563fcd3d841e2003850e5a4adfab4a1dab93d42a9d707cc91f5b78382bd068555baee3664a461831989b94c420c1bfc0b53e8e4a1b26a67764ff9d721bd676265bfd2d76548d3ee2aff5fa8c6f28673111195dd8108568c5baeb5928123cc3c1b07c07cfdfb5d1b71a90bc96b083b75ada40678238949c508ba6ce3af28e601b3ff5c087f63876b575fd2eb7323053775f5487a6dabf336946eda37230d3afe6a75e16af37a9193bf5ed51d5efbe577c4527d4cf0d0b8fa8a5f15c3a0c86b2984c2fa556522afdc5cf3989be38b3f1489a775cc80126f4d1a8441834285954db30d2035e886940aa2254c6a7fa3587c874574b47e8979ae0986eb3088e01a1a670b2d7b5f7f042960fea80d5a4b7db00cdcb715765d11897aac6584687657e883a35e36f6bb2e461ef2ffbb4694e11a41c08e8059b623f10c48f63c62fb5a371680dbcbaefc2f43d32e52de3db301729a1b604cf905eaf28e369efd2b04c8a6bb11d60be37de8897e2fd350db4d073e1e0ecdc8d430eadbcce1c2f9483546647d3dbd75abeb905506182853505c63ed3e3fc8bb6c544a55ec2358f987e91434db7b3b17e514d2f48f7319c7ef30eff72cab9a0852645eadbe45f34bd141f5de7b6dd367854ba7fd6658e0ab2ee66dd20f2bbf921f3cc5a0563ec062df41b6c9a4aadd81c262a9683ed1f5beed2cb04acb8ed18581103daeee290630e04d67226f6ac86d5c680cd7cf4c79256d383aad62adb72a01eec6d9f098d5ce17185b645b64c52293358623fcb8c77479dceacd1f35821b2e43b825223eadade6c6fb97aa9226edb450e9c188133f2b5ab21b3600f488f34a18db510c4fb0c894345fc280833c53bb2bcc559bc70effc2b5eca18b6d2a609fba4f8f44f77c93b8ef7d642011a633d790ec454d67642a944ad1d2aa5e96bc51819452dbfd7177f3dd9e1579be6ac226caa88435614d0c29b519def4c5f36f85425bdaf8dbf6e858cd02aca16c6c9d82a0f18c5090080164047f2e975e9ffeac708d3a2b8be97695b2736897676ed49b9dfda9c890da00b0cb6da8a832264cdb48d8779e719246a6a830fd4033094135fd6b9e636240a4e0349526f4536b5bd4b736cdfcd46a88de2344fa8db7a39fceb5b724a9376f7e51aa417f1a10baf63cf530a4e759c4be80b251ee82cb392bbd7183039d952a0d4d1ed64f506d9efe23b37f970187481518b39553343e89b89c2f6dcce66804b8d45e1d55ec1dc36cc679e462ef0170344a83a53bc23044a873d608da8320ac65e235db368ec238efc73a0203508252577fec225b42f66ed7935d065051184cc0371494b774893d57f30bcfbd03c7ab000091123fb60fa23dc7977917000d8e9ddab549cbf957485e17c342807ad67edd3919d1d5c4c847c8eb7c6fb1b6b756bbcaac63bd1cdc9f8d96cc9f91fdca6af5f66e6ddb2355d6387d4229529bedffda6fe0a77c0907cdfcf445c8c720eff421ee021081d34d0b73b54b3d84781a1ada9dc628a4b59f6253f1a3cff7e82c31014abdfb9015711302df5363c688e3232679cfe23c0b273f68c0e161f6548b405e8177ccef5ee92b215d98cc128ec7997bc8f7197c143accb3c720c1f4ed2e331130e4a70df1d89d4ac6bfc50c642cc8cc1b05040cae31594015470b104163e85a9f519ec28427b47a3a8a0b92dac1276436acbb54bac573e9b83af6955baa5e254871e2e681ac5f42219834da9a5411d59f497c6df3a89b46399e8060121f44b73ac189060dcfdc7e66f426462aeb94eb0d7a16135d140ece4e04fab9f317cd83c2da92777bb26d75957c8d170caff2d1572dee417551be25c2b0446cb6bbccead36a25e3a2f523bc9b6fe3537b3fe0aa0918ff2e90d41ab5d8203c9701bc04cc8b426fbb2b25601df442b472e6b5d3c2dde368e1329c36b3915b82af2137dbe48a5ab8cf13af4b255dbd31ea11473575a63c08ff3d36ed69a0982b7e2faf71b27cc091d7944b25c30144c6f1e98e0ff646ca67f3c1eab89ff4d3cfbdcf15e475bdc50b64f802fd83ffc56f99177e399c256d93b6fe616073e922ccea2b52b84eb6e9ed064f7acaa2bf7fec7dd2bee3d796bc0744082041a06cf8f1e45dd44b8bfc02b1a584fd52817f2c16f6d26828f8fe32f5863cd938c5d2c7cab425f6cf1bff7e5c4035ee8bf6cdd48374f49db86ef77444d0b73acabbbe06d193f015aad4dabb76072ce6ae8beaf03e48c627465dda54afd436d47f007c5b1c7b52cf55830d6a3dbcd561bac52be9e131182f46854ba40f55c86c7935413f3c9ebaed553f9b9fafb964f0c5a03ee454b8a21bcef78881b1dcd9e4f0944f5e0dee6770f7d32e058739d6a63eb6e264ada03dc9a30d0b1db52bb8d96dc1f7c6265fd93ec0da79c5898fbf9ebb3dc1bb2ffe8ad5eb8ab90e70f448d5fe3fad48c56d1bfcd93dd5b11f413eaeb15c0056ce58e6652cffa6da783774a82e27db165d9d8363082158db4c2fca14bce0b913326338a952f0c298c13f4e34914b7a30dee0b507de40fa8ad3c2f8f52d1728c2fcf55f6d1ebbd74086b553b14dd513b6350e3a768b8678ca52b18189a5b85564134db150477a016b7824e73e59449451b33fddc3fca5183dc7d9a198d69544c402d09a96e837c02247e4a6130d6eed2a9f2b30c3f738c35d70c85248c3b057359ed5ea1cd52b3d75eb9d54174e6a28ee2c6111a86baa9775f96a245abd0122b84590b748d11e36778668804478853cc95a6b177be3e89ad0d4dd55cf07353cb8977d3bd98060e117840d167f0db84d406970401cb2938b18074c16b36f9fd560d2658a28f3aee83ffb01f39fd96972dbcddd32018d34891143f8288664e979993eba480034fdab02115f30ad476c5814c52236c0351dce3f0dadbe16ad102d558e58e46f4de316d601f1eb8559fd6e7fa0da2edaa56f5a01fe1666e4700cbc5dc1ef9f7674f1fa53a82de533f9084a762ef55562b17634c10f12f1430c0c7be8aa9798546cd20c5eff8408a3cb350afaddd7ee636cd8ec151e393db773f5bbd9e176a34373d86ef942dd0d79b9e271371ed04fc6bee281bbcbc2cb0964bfde1e396a4c18625e8e24c29951cbdc14718e6d5109b0c08565d7735b9bca70a223539dda13c5e09eedc6ac0cfbf99a4807070785cf8dcebbab95d7a05ef72583571f7cf3444111c2d7cf6631862d9975944aad75d7121705fae35559fcc29c10be0ef7945100115b9f3c54195f6ba9878e79c64132a7fe77767413faf8cbbecf2ff69e85ec340b5692343cbd35c12b18aabc308b5d49214f95c8abe9237658b6f43919438f0789c7154d639c21103181eb034aea16574d9b6b961ebaa798d75ac2904f37e5a683dbb687f10e0818620bbadd332c64b26e0a1f4c6f64cfe00b35e9c5c8265032b1bb6ba5b13d924d0d200a10249cf5b69919d56f2f8ee7d0400c4ebf7153181646511f2519b3bca740aec21d724ced7aa4b820ab901cdfea9c89112d9e50021c63c6707ad027f5ca0be19cb4de574ebbafd938b3e9570d8be400d97da0ee86ba610153c7075ffa8b175ef3946454d98d904b82ce7ca96ff4cbac78721ac8c31f05fbb8e42c55b32556888450385e3540e73d58af2f6078582f2e941d213a237de856139ef5954f8af94fa85a9ece6f4b649d63fb0284a9c4fd576ad72a86371c8e8b2f43c27ce93027d0c7593926a6d69e87ea5795b61888c1aa80f605d1ba68fb1af27697f8a409f800b9405fc44a2b70c283d640d237b73b444da8326e7171c2f699e87c63a02d79cc10e62da48ed2f97597ab3c57c2944b11186e1df36974cc03a7c87606755b499406d36a35de4966e5a983e8cf04168af815d21fe1af84864fdbc6fc0b1a881b7f266d8cf96c7b67bd124bb3c785236d119466f2ff51edef931037f4fda1951cc8518579c4fd97d9e6e43c8848d5ec133e47a9aa5bc6f49295e63884fcb22e77fc54e4941241b888a31aa59e107b714f37d474deb8b9a62bd3a6e3867e6b8a972ffcbdd03d0c4880060a0297d9841d384b36f1682bc92768a1aea387214791408a323d534f9a3a362de6cad7bb3b395799a1c98d7ab4b909d19699256f2e028fa054ce49aa8645a150c2dcf0ebbabd87f87c14285b7475ea9fb1a2b772092d94e4a2332122b14c958c48dc2d147d4f797e5cbb1ade04c953f37555803900b7091ad9c274db66dba1ad056534beb09ff8030ec81d88848d7089d787aaaf897a74f9f91692557e5b306cbc359b986356bdfe5682a624c554dc42f3e521c76711beaa01733ba252670a55910720d4e62e0d294f49c7a5be941ab31619b07f28784a8196105c38585c29fbdfdf32b29c9dff18edb10cd5d176199bbec3d9c4b2eb6a5ee2867b255ad92ba3774d2356ce55e4ffee3c5cf8fceed59dda03fa9cda4bd1fc8f7005e2d9b67b2b729af552856a2d69a43380d8e3582bf5a0844ad15b75115a79b3c343c898164ca54480b7c4111b33949585bd30e2e660344012ad27a9e85fdf6ce509e07ea1ad1d81816db8e485d029101155c57641e2839a65c77e5eb43ccd16f81f626bd74c084bacde9e7716266b39a463ab4a1f2055fbdc00c20ea10db76139a5b90e106bfa4a51f41d475c303d094b6aa0303775b834388fee4d6677e18deecb5eaf8c3d591d3cb4c956ae34c7c60fe071f5d3f19cab9a59dd9423c6e88af1fa1223501da07cc214b18724ec1c587951ba0b1dc970bda7dc0ef804fdefebadee0965e023312ab274d01ff551753dc0b7afc85e10b68a9f56428cc2267fab541213b3ce4ce53b48aec637c8ea474774f6bdaa573f4eed9fd4998559a0670d82f622dc57e6e475c63c832aa4b17c31f83ba5d7ca5db9fdc57d4dbc9e8affaad3b65d1b3c4bf0b75df9f602ac32d1ea696219afb6952a294f4b540cce84a33242e065c609afa4e97d83aed8fbc70e410bb4ac1e64656c713f72378bfbae088c13d3e8e1fadbd2f5cfa1718d26c9376cb66449aecd642d476cdd411ab79511ea6608cfc1686b83d4ea4a0f8f197a759b62753860ab0c47b8caa719338d29ee89c6953ed4beebf5685b8b2ba9eb59fcefa66329670c5fe2ca4435c41b5ec4bddd9a69aa5727f8c7026cc337e7f5ea2b85d3e6eadf65d1da59921e9601684cbd6db98176793a8a778e4f97171b0a271463c772de46a0436964b32a57a00ff7e9b78ca13c743767b460bedf3a1d701196e2a87424a7fcdfaf115afcf9476b7992addc11bf5dd4485153818ddfe711c3fc14fb30aa9336100044e5a37d30d6d246459a6c6c38a28b0ee36c5f4ded811a115f23d4853e71cfbc48617fc8d469baeafc65234b2284f93d2a41953de6549f9c41b571867bbb6ff418332d3cbcc109f85d59203bc4d222a70ef70373f65e9cf0780289af7a3d8d168265f3864c5d2e933bacfa2424be11948b89596109584ca6e8ee0144c3d99a82cfab8846844f118601ab906b0b44730d79c9169db3822060b3fe635b51c060ba336c774dd1a5612319c004cd5a626743a468607a7cce9fd29ece8b85e868444b17ce733e80d2eae2e43585ed707a50ce1b2a2173dceff5f35b4dfeb79a69e18ae83d3f8445f0dd7f896096bd7e10383a59f95db4cd85ed6e54ca1cf899e13cd8fcf8d894fdde52f8598fb1581db8f2da9bd57d644127db11aec8803135259c6cad21a3a8cb51b86f5832f74d2d7da4c00ad6e04975e7986d4d7f5182ad6ac51225ea5bf595012f4da7a714ff27a654cbc5614843c848aaa8d1e71be240742e0225408d964430303d332924cf588f4c0bfb75f32c2907095476f00465ce5377a0864ea08f2916a2194b915e61d9829ba0af574d7d8d4fc61be6557c49d9b1893796a674dcd4a2d0ab1540da21721f9ba2889d40d11d15a03f47fb9b4758fb5d396fc3ef09dd2eb17340651bbd4d4d302171b64a5d134a14c2f5761d69baf6e087645f1569ae3c9430bd62569a771c3c9d386357852630d14d59bccaae73e88e79fd335da885dbc26e317a560e886b46237a9bf974c90f17e8d1a3193eb8f6a8a4085fe6afcfc6625155f230cf95e28b02b2aa25a07dd2b9402a7e11a026050b95f200b7f559706d39de6ea5c6a3290939e06c2dca3293634d1380cbea8776653dcd705517ec2d729f81f6402d576f5dabf30f4a8cdc49be08c481f63d7595360804f33291665408c80c03c205b4f72361e2950d32c7279a81d3d6a36479bb03f1ac6bfca0e129b096f3fc11b1a31322a3603bdbcf5f25ef6983aabfde61dbbfb31aebf6a6438c0de64b0fb58146993c8339ed1575816a6db7850ad758ee3d1b493442e12deb80ae936380c081a69dfbe7b86cbb28d5c225733e9c7e7674418cc7696f6bc482688210a51cea3c76ba11c21c21d75191c1f92f2834c1a9f9c6d1be9ad98508e7b4876621c126d0a3b9432e15f6aef3241bebfc3cb8f2dab4b96f97a61ee2e7312845d3614d817793f6c40190d7b17ef2b7bfc8ce665fc927dfd178722fa98d37e58d5c3ea763893f1f46390b9e412bb7b986e6f26e6b4998a7b7252bee2a919d92a4f63bcbccf52f7a4236cac4964dce74ba8572e8481de412bb53a0ec1667d3f64526bce5b1d39b5a49449f20a6d274d55e60b0c722a8c3606a1aed9a73738d634bd51a4b4be81283351fabfe38d8bc07b96495b56be9c69adf49958224936770455c97be2e895476df55af2d69e308a5b1f898d2d60896055b8f95f99cda6c961be77245025b3aae7411644fea5d5ed7c0f9fb6a9d48af4287b4be060236cee349ec67d4e94f6da473e30d4d406d95c62c1e7814aafe12b62e4ebfa9b4421b156a67e6743bb98d4bd17da6eec1e5a6591e5b6215675d6704257ca0cd1f71717e12fb61f365c8309df3e3e7646cf2ca5bf8fbb0e602e769c5510b11bbf114744ee38b80e0200a059a64daa7b699ea04851f976a7ac131cc0e2da1375524def3476375b4c4fc0e8e9e114f8873394b2ae418d4bff3bb202b523d2b7c897bbbac4f2af74dd5887ca6f5bfdc6a379332dd8f0a6a3b5792c1f1921642c1498dc23802f39f4e43e8f51f3415daa93f1985ad00c9e8768cad571d2016f57b05337882a38ad9f4470d205b1eb895de995fe90369bf0b6c0d73c5923465938cf6750d0a46ef63875d8eb0958c48459bae7ed3d0e6f1a4ff0c876e86f23f199e98d6fc6810cc76de5161e8c5d2e502ef34cdae2115a05ce7760248fbf9d29f89d80de97a7c4ce37d6999ed4c65057c55aa5b6295e0897474a4abd86b58a630b5519e24a96a9c36481adf71efddc96315cba56b0e648dbf25530ee8f03c8433265c28cd29475daaa79058194de73ea9f6beecbfbdac88cac419f91c685e36f599e7419d1b68ee540daf765f227cd6e91a6f1a83ac16f7619fa2c96da41337d7228a77a8bbf1659a978bc7c23e5cae67323f20d9d69bf343769ee98114b192c2d8567db0a2347fd93cff02620a59c45887ca6a95b586a04bae80994c31d39264e90306f73714ccddc98ab09f33d46be27789f44508d7a4e0294ddb7a972022adef1feb4bbf80b6acb41388b29fdb5eadb1741d38ae895ec6f034d72efe08fe09efc1063a32664526e718f90d541642e7a88852594ab25eb9eab2c473f4e86ce95f9ebb533d1a8d8a592931632928a08d8377a606e099c8ad9f42dcac63554b356a129a9e9573fcfb207b27baa436c6d4ddb4f8580d914a1263461e304db5e0815f7dd9b755db529032597b77050aa6c653afe3f7d7eac9e3df2d52b926639aa3f51d8cd5471da36ecf408bd859ce900e439901bd20c3c1bf000f6e62cd234e5fa295118a5b5f55100702fdafd43a7398894f4a3dd4f74889d27294143d5f3609d97ac3323c6f3d6ecbe990dcb5d975358f54153f286e78c8cfbc76cf3e2540614252d267ac9327d13fde8abc4b282014be61a11450aa26626c478ccab01c380f39cea9dc5d67501ab68b06bdcdd25871b7f3edfdff804e86957530235d7ea279358e444c2dba830c6fd5daadf7ff821eda6d9c8f6eb4ebad0d80fc45576ab4426f0b390ce9fb42312c23430d040d85efa8cde8e1a3c47a082d33cbea897edf90b00820032156816c8cc1218b9cbc41108f910a9a072afb6d94c20b5daa083a8c6f1e49570a82b779b06e91e01eeec67ad5fcc586401c91030a8300014a92973e2b4653816cfd1866ebe6a07b7b9050176f3f0fd7deb7094b96dca67a7fab85f80275b5616414ba3d11bed295420cb62860d5a01fe557eba85cab0dfbdd4ed1d7f30cdc0540690d7bfc99ff1e594e0dd369785079e2cc436db5a506ed65677921744aab605757d8f99d80cd79397578fa17671b4b70ebdf40a36ec697ece2a6d2b170bd083c0efd515b81acdf56c750064571d635ad50165f1e98519b12655820ef9393b33d71e037d8ae46f6e9ac84b732b21008111b16796ea62181f264aaa19c362b426516c97bbdbbf0b0da0e47f805847067261b62d7d699124645c6a6a983565815e6de4fbc31263380b6dc811fa9d4c1ed15690b2dc7c1afa5a4a810ee69bb8759c898287630273ba24e0a58de5608a0b0f5b0273c930fbc6aeb8b2ec767e4b8cf94740f93edbb0277d158d33a13e5d998b5cec54b5968271a32ce79f80118678f2978011bbaa86de2c5579e966ae17c6dd435279303fcb2d1cfdffafded27c921d1feea042f83e96f01bff7fc98215044eff87f28e65559c9b030a0676eac25552b5961084f162e8bb638d52c81b091ddbdaaf684c6f1cce30ff4c8c60f55148aed8bc5894c22114a2f37c483bd9d9eb809a483f918cd901f9c48251f8dcb19f35d61bf1105ec96e66f22601575a5abeedfd08dc5ec6669790c3b47e557d391adfb259ee0c86566ea1c4a93ad18003cb35a752e91df73a688cd65b92b754071ce3f6328f76c6d6f455eae1c4cd80e2b05cc183e1dadcd83deab48dcf62d191e0f69e1ea30f050b80640b70c4fd455fbd6649d36f54adb32a85ed69d81552ddf2e2878f85120b57279c645236986f1affba9e034017145436f7519e5681fa5b9940890979fb54be43bbf4d721c959e5e34fbb412f7df3a1cfd4c2b7e1bb2f6c462624f3aedffae879bc34d721c959e5e34fbb412f7df3a1cfd4c2b7e1bb2f6c462624f3aedffae879bc33edab1ff7eb6bf33f108e9ac1a08eb16c954b88a844e3119adf5950b44014eb63c8d900fcc619be33d08fd58502389ad641764bcccc2649d0c88659fc24b6d7be234489f88176e66bd858291d9de7054c6bdcedbb9f19ebedfab02d238b3dad79ac6a853e324ff7c5e92f5e9bbbfcda63466ec3e8a17fd9b3247f183465e93ca372fd5afc77f0d7f38658bb86153e8c7472376a5d735412237aea47881eb714ad1ffba188101427d74509d8786310f1e0793a251f31819283664626cbb6286bcdd109bc3de5bef59a8492c6f849e7cf1c2a665d6b5844e749d36a714fc4eb8f652fe79b889ef808d2d515a143bd50327674d18780056158238e627e37eaf784b4505976a7c3561f4c11d3d6507b4c18b802110be70e1266ecd65aa25fca95101a77e1f35756774bd632f5c4eb2c37314911471375f8123b8c3fc9ea3a5c0cc6d9b188fe909be6889a961ab6d53b11520bc8ef965b7387b554bd7c482b02b0f4f80d00110a008aff7aed1c6d66dfb2edfa2605d155c2d97a1c2877fd1bf4d770e6708988dc83ba66d6a40a20293dfee564ed40c41d5e541c2997e512019841b0b19fb878199014dea84874d11e319609135d4251944a93718a1549871f86355fe28ef6282e43d78006dfed31b909d581b41acb46b9a049d7babd678a808a8b42ef723c6b3654d1ff2ac20fe4e91db0ffb8387d06864cabae9e45d13b197ef3dcc5d88c0c453131707868135f170cd3c9683f02d06d3501e764593754b5f089bd7dd2b11d8da24b078973a81d23f56a3cd370391c47ad7ea923f5233254b2c62a41ea39a3c45f364074338dbc792fc2c11e46cd8506f84eec2d00b8b7cd076d84a54a4e74dfb2af63dad0b61ff21f4f95994201c284fe8f586948c544ff57e966e81d01c4e3d56cb060111b09771b67ad0ce7c76f75907623f84b05a05d45611f5bc55eab02c151e601843afc2885ab9824b294c7d32e6352066793e8ccf6663071d70e16fed8696139a12f8dc737261cc47235f1f6043d92c85ee5f87b03e8429862ec396b133cb906d4fc51662f88cdb3cd527f0c6b7012ed9be804ded9422125eb5dc9143c8d61b9b80d5cf522b829938f539a301cd22e79e52f6213df15534953e17076aff00521a5402e73915fd843905ff5a92e6db5564e3ddd38febf2dc5d98f8fed85c6075f8b02b13976a0930190debfc8b9465651dd71ce4610e5dd7b70c4fd455fbd6649d36f54adb32a85ed69d81552ddf2e2878f85120b57279c6f0f73a33836688f5f01e1ec80ba5725affffe64d3ca9d151d5ffbaf1d6317b22@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootselinux-policy-3.13.1-268.el7_9.2.src.rpmselinux-policy-devel       /bin/sh/usr/bin/makecheckpolicym4policycoreutils-develrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PartialHardlinkSets)rpmlib(PayloadFilesHavePrefix)selinux-policyrpmlib(PayloadIsXz)2.5-82.5-243.0.4-14.6.0-14.0.4-14.0-13.13.1-268.el7_9.25.2-14.11.3__V ^^x]µ]]{@]{@]]c@]n]V]V]S]R@]Ik]:@]5@]%@]\F@\\9\@\ޢ@\\@\@\7\@\\~d\y\s\k\V\R@\R@\@n@\;(@\2[v[[;@[;@[[R@[t[#@[@[@[[h@[[[9@[@[}P@[{[{[z@[m~@[i[i[i[dC[`O@[]@[Y[6@[3|@[2*["X[d@[[ [ L@[[[@[ZmZȲZZH@Z@ZZz@Zz@ZyZ_:ZWQZV@Z.s@Z)-@Z%8ZZ @ZZNZNYYA@YYW@YW@YYY@Y@Ycl@YP@YJ_YI@YBvY9<@Y6@Y5GY1S@Y0Y.@Y-^Y, @Y, @Y%uYYY@Y@Y@Y.YXQ@XXX@X@X@XXX@XۡXP@XXg@Xg@X~@X@XƉXCXCXX @XXXBXXXs{@XY@XWXRXRXOXJXAb@X@X)@X#X!@XWWSW_@W_@Wv@W;W@WίWW:WQW@WW@W@WW~W@WW~D@W{@Ws@WrfWj}WbW^@WYZ@WYZ@WUeWM|WBW9@W9@W1@W(W V@V@V@V޾V2V@V_VVCV@VZV @VqV }@V }@VBUUU@U@UpUUUUoUoU5@UUȒ@UĝUUWUU@UUK@UUU'Ua@U~@UzUv@UT@U@Tr@T@T@T7TTTC@T@TTT}Tto@TsTk4T`T[bTWn@T?@T>aT6xT6xT@S@SSDSg}@SB@S>S;S:@S9XS5d@S4S2@S0@S,)S*@S)S)S&S&S"@S!S L@SSS@SSc@SSnS @S SK@RRR@RRJ@Ra@RRR&R&RRR=RʚRR@R@R@Rv@Rv@R@RR@R R@R@R|@Rz/@Rz/@RsRpRnQRi RfhR_@R_@R[R[RSRNRNRL RIgRB@RB@R:@R1R-@R-@R(r@R' R%@R7RRNRR@Q@QQdQQ@QQޞ@Q@QکQکQ@QzQQ4Q@@Q@QKQQ@Q@Q@Q@QQ@QQQQ@Q@QQQ@Qzl@Qw@QvwQo@Qo@QnQm=@QkQfQb@Q`@Q^QZ@QQQIQGQ@j@Q9Q8@Q4Q0@Q-@Q& @Q$QQ@QQ@Q @Qh@QsPP@P@PP@P[PP!@P8@PO@P @Pf@PPqP @PP7@P@PPPYP@P@PPPM@PPd@P@PoP{@P{@P@PP5@P@P~P}L@Px@PvPvPuc@Puc@Pr@Pmz@Pmz@Pmz@Pj@Pd?Pd?Pb@PaPaP[@PXb@PWPS@PQPO'PM@PIP@@P>@P8@P7lP2&P2&P,P,P*=P(@P#@P#@P!@P!@P@PkPw@Pw@PP

@NNU@NNl@N@N@NåN@NNNN@NNN@N@NGNGNGN@N@NNS@NS@N^N^N @N @NNj@Nj@NN$@NN@N/N@N@NFNFN@NNN@N@N@N]Ni@Ni@Ni@N|tNyNx@Ns:@NoENoENiNf @N^"@N\N[@NTNS@NS@NC@NBrN:N98@N7N6@N2N.@N*N)f@N(N%qN$ @N@N7@N e@NpNpM@M@Md@Md@MM{@M@M۝M@M@M‘@M@M@M@My@My@M3@M@M@MMM@MMMMTMx@Mx@Mv@MlMbSM[@MRMQ0@MQ0@MJMGMGMA^@M>@M9u@M6@M5M4/@M4/@M0:M,F@M$]@M@M9MMMMM\@M M M@L!L!L@LL@L@L@LOLOL[@L@L@Lr@L L,@L,@Lډ@L7LLLNL@LΫLeL|L@LB@LB@LB@L@LMLL@LdLL{L*@L@L5LLA@LLLL@LcL@L@L@LzL)@L|L|L|L{@LvW@LvW@Ls@Ls@LrbLrbLmLk@LjyLe3Lc@La?@LZLYV@LXLN@LN@LMxLMxLI@LH2LF@LEL=L=L=L;L7@L LT@L@LL@L@L0LLGL@K^K^KKKj@K$@KKK@K@KK@K]K޺K@KtK#@KKՀ@K:@KK͗@KŮ@K\K\K @KKKKK9@KK@KK@K@KKKKrKK~@K,K,K,K@KK8@KKK@KK@KqKqK}+K{@K{@KuBKs@KqN@KjKie@Kf@Ka|@K`*K]KXAKTM@KPXKEKEKEKD{@KC)KA@K;@K2@K0K/c@K+nK*@K(K"4@KK>K>K>JJęJH@JH@JJJ_@J@JjJjJ@Jv@Jv@Jv@Jv@J$J@JJ0@J@J@JG@JG@J@JJ@J@J@JJJ#J@JJJ@J:J@JJQJ@J J J|@JzJyt@Jyt@Jx"JrJrJq@Jn@Jn@JmJhPJeJ\s@JW-@JT@JS8JKOJI@JCfJCfJB@J@J@J?r@J<@J;}J:,@J7@J67J2C@J0J/@J,@J%@JJB@JJMJ J dJ@J@JJ@J*@J*@II@IIA@IIII@I@IIIX@IX@IX@II@I@IcIIo@Io@IzI)@I@IܑI@@II@I@I@IԨIд@I̿In@I3I3I@II@I@IV@IIaIIm@I@I'@II2III@IIIIIIII@III@I1I@III~@I}Iy@Ix_Iw@IuItk@Itk@Io%@Ik0IeIcGIa@I`IVIO@IJ;@IHIAI>]I= @I7@I6tI3I-I@III9@I9@II IP@I@IIg@Ig@HHH@HrH~@H,H@HCHHH @H @Hf@Hf@H@H+H@H׈H׈H7@HBH@HǶH@HH|@HHH@H{@H)HHL@H@H@H@HnH}H|@Ht@HsVHr@Hl@HkmHgy@HcH`H_@H^>HRa@HQHQHO@HFHFH$@DX@DU@DN@DN@DLDH@DGwDGwDDD@@D?D?D;@D;@D:HD:HD2_D1@D1@D-D+@D+@D'D!<@D!<@D!<@DDD@D@D@DDDDDD@D@D@D@D uD $@D D @D @DDDFC@C@C@C@CCCCCR@CCCCC@Ci@CC@C@CtC@C@CC:@CECCC @C @CعCعCعCعCC@C-C-C-C@C@CCǖ@C@CáCáCP@CP@C[C @C @CCg@Cg@CCC!@C~@C,C@CCCCC@CC@C@C@CZCZC @C @CCCf@Cf@Cf@CC@CqCqC @C @C @CCC}@C7@C7@C7@CBCBCYC@C@CC}@CqCqZdenek Pytela - 3.13.1-268.2Zdenek Pytela - 3.13.1-268.1Zdenek Pytela - 3.13.1-268Zdenek Pytela - 3.13.1-267Lukas Vrabec - 3.13.1-266Lukas Vrabec - 3.13.1-265Lukas Vrabec - 3.13.1-264Lukas Vrabec - 3.13.1-263Lukas Vrabec - 3.13.1-262Lukas Vrabec - 3.13.1-261Lukas Vrabec - 3.13.1-260Lukas Vrabec - 3.13.1-259Lukas Vrabec - 3.13.1-258Lukas Vrabec - 3.13.1-257Lukas Vrabec - 3.13.1-256Lukas Vrabec - 3.13.1-255Lukas Vrabec - 3.13.1-254Lukas Vrabec - 3.13.1-253Lukas Vrabec - 3.13.1-252.1Lukas Vrabec - 3.13.1-252Lukas Vrabec - 3.13.1-251Lukas Vrabec - 3.13.1-250Lukas Vrabec - 3.13.1-249Lukas Vrabec - 3.13.1-248Lukas Vrabec - 3.13.1-247Lukas Vrabec - 3.13.1-246Lukas Vrabec - 3.13.1-245Lukas Vrabec - 3.13.1-244Lukas Vrabec - 3.13.1-243Lukas Vrabec - 3.13.1-242Lukas Vrabec - 3.13.1-241Lukas Vrabec - 3.13.1-240Lukas Vrabec - 3.13.1-239Lukas Vrabec - 3.13.1-238Lukas Vrabec - 3.13.1-237Lukas Vrabec - 3.13.1-236Lukas Vrabec - 3.13.1-235Lukas Vrabec - 3.13.1-234Lukas Vrabec - 3.13.1-233Lukas Vrabec - 3.13.1-232Lukas Vrabec - 3.13.1-231Lukas Vrabec - 3.13.1-230Lukas Vrabec - 3.13.1-229.5Lukas Vrabec - 3.13.1-229.4Lukas Vrabec - 3.13.1-229.3Lukas Vrabec - 3.13.1-229.2Lukas Vrabec - 3.13.1-229.1Lukas Vrabec - 3.13.1-229Lukas Vrabec - 3.13.1-228Lukas Vrabec - 3.13.1-227Lukas Vrabec - 3.13.1-226Lukas Vrabec - 3.13.1-225Lukas Vrabec - 3.13.1-224Lukas Vrabec - 3.13.1-223Lukas Vrabec - 3.13.1-222Lukas Vrabec - 3.13.1-221Lukas Vrabec - 3.13.1-220Lukas Vrabec - 3.13.1-219Lukas Vrabec - 3.13.1-218Lukas Vrabec - 3.13.1-217Lukas Vrabec - 3.13.1-216Lukas Vrabec - 3.13.1-215Lukas Vrabec - 3.13.1-214Lukas Vrabec - 3.13.1-213Lukas Vrabec - 3.13.1-212Lukas Vrabec - 3.13.1-211Lukas Vrabec - 3.13.1-210Lukas Vrabec - 3.13.1-209Lukas Vrabec - 3.13.1-208Lukas Vrabec - 3.13.1-207Lukas Vrabec - 3.13.1-206Lukas Vrabec - 3.13.1-205Lukas Vrabec - 3.13.1-204Lukas Vrabec - 3.13.1-203Lukas Vrabec - 3.13.1-202Lukas Vrabec - 3.13.1-201Lukas Vrabec - 3.13.1-200Lukas Vrabec - 3.13.1-199Lukas Vrabec - 3.13.1-198Lukas Vrabec - 3.13.1-197Lukas Vrabec - 3.13.1-196Lukas Vrabec - 3.13.1-195Lukas Vrabec - 3.13.1-194Lukas Vrabec - 3.13.1-193Lukas Vrabec - 3.13.1-192Lukas Vrabec - 3.13.1-191Lukas Vrabec - 3.13.1-190Lukas Vrabec - 3.13.1-189Lukas Vrabec - 3.13.1-188Lukas Vrabec - 3.13.1-187Lukas Vrabec - 3.13.1-186Lukas Vrabec - 3.13.1-185Lukas Vrabec - 3.13.1-184Lukas Vrabec - 3.13.1-183Lukas Vrabec - 3.13.1-182Lukas Vrabec - 3.13.1-181Lukas Vrabec - 3.13.1-180Lukas Vrabec - 3.13.1-179Lukas Vrabec - 3.13.1-178Lukas Vrabec - 3.13.1-177Lukas Vrabec - 3.13.1-176Lukas Vrabec - 3.13.1-175Lukas Vrabec - 3.13.1-174Lukas Vrabec - 3.13.1-173Lukas Vrabec - 3.13.1-172Lukas Vrabec - 3.13.1-171Lukas Vrabec - 3.13.1-170Lukas Vrabec - 3.13.1-169Lukas Vrabec - 3.13.1-168Lukas Vrabec - 3.13.1-167Lukas Vrabec - 3.13.1-166Lukas Vrabec - 3.13.1-165Lukas Vrabec - 3.13.1-164Lukas Vrabec - 3.13.1-163Lukas Vrabec - 3.13.1-162Lukas Vrabec - 3.13.1-161Lukas Vrabec - 3.13.1-160Lukas Vrabec - 3.13.1-159Lukas Vrabec - 3.13.1-158Lukas Vrabec - 3.13.1-157Lukas Vrabec - 3.13.1-156Lukas Vrabec - 3.13.1-155Lukas Vrabec - 3.13.1-154Lukas Vrabec - 3.13.1-153Lukas Vrabec - 3.13.1-152Lukas Vrabec - 3.13.1-151Lukas Vrabec - 3.13.1-150Lukas Vrabec - 3.13.1-149Lukas Vrabec - 3.13.1-148Lukas Vrabec - 3.13.1-147Lukas Vrabec - 3.13.1-146Lukas Vrabec - 3.13.1-145Lukas Vrabec - 3.13.1-144Lukas Vrabec - 3.13.1-143Lukas Vrabec - 3.13.1-142Lukas Vrabec - 3.13.1-141Lukas Vrabec - 3.13.1-140Lukas Vrabec - 3.13.1-139Lukas Vrabec - 3.13.1-138Lukas Vrabec - 3.13.1-137Lukas Vrabec - 3.13.1-136Lukas Vrabec - 3.13.1-135Lukas Vrabec - 3.13.1-134Lukas Vrabec - 3.13.1-133Lukas Vrabec - 3.13.1-132Lukas Vrabec - 3.13.1-131Lukas Vrabec - 3.13.1-130Lukas Vrabec - 3.13.1-129Lukas Vrabec - 3.13.1-128Lukas Vrabec - 3.13.1-127Lukas Vrabec - 3.13.1-126Lukas Vrabec - 3.13.1-125Lukas Vrabec - 3.13.1-124Lukas Vrabec - 3.13.1-123Lukas Vrabec - 3.13.1-122Lukas Vrabec - 3.13.1-120Lukas Vrabec - 3.13.1-119Lukas Vrabec - 3.13.1-118Lukas Vrabec - 3.13.1-117Lukas Vrabec - 3.13.1-116Lukas Vrabec - 3.13.1-115Lukas Vrabec - 3.13.1-114Lukas Vrabec - 3.13.1-113Lukas Vrabec - 3.13.1-112Lukas Vrabec - 3.13.1-111Lukas Vrabec - 3.13.1-110Lukas Vrabec - 3.13.1-109Lukas Vrabec - 3.13.1-108Lukas Vrabec - 3.13.1-107Lukas Vrabec - 3.13.1-106Miroslav Grepl - 3.13.1-105Lukas Vrabec - 3.13.1-104Lukas Vrabec - 3.13.1-103Dan Walsh - 3.13.1-102Lukas Vrabec - 3.13.1-101Lukas Vrabec - 3.13.1-100Lukas Vrabec - 3.13.1-99Lukas Vrabec - 3.13.1-98Lukas Vrabec - 3.13.1-97Lukas Vrabec - 3.13.1-96Lukas Vrabec - 3.13.1-95Lukas Vrabec - 3.13.1-94Lukas Vrabec - 3.13.1-93Lukas Vrabec - 3.13.1-92Lukas Vrabec - 3.13.1-91Lukas Vrabec - 3.13.1-90Lukas Vrabec - 3.13.1-89Lukas Vrabec - 3.13.1-88Lukas Vrabec - 3.13.1-87Lukas Vrabec - 3.13.1-86Lukas Vrabec - 3.13.1-85Lukas Vrabec - 3.13.1-84Lukas Vrabec - 3.13.1-83Lukas Vrabec - 3.13.1-82Lukas Vrabec - 3.13.1-81Lukas Vrabec - 3.13.1-80Petr Lautrbach - 3.13.1-79Lukas Vrabec - 3.13.1-78Lukas Vrabec - 3.13.1-77Lukas Vrabec - 3.13.1-76Lukas Vrabec - 3.13.1-75Lukas Vrabec - 3.13.1-74Lukas Vrabec - 3.13.1-73Lukas Vrabec - 3.13.1-72Lukas Vrabec - 3.13.1-71Lukas Vrabec - 3.13.1-70Lukas Vrabec - 3.13.1-69Lukas Vrabec - 3.13.1-68Lukas Vrabec - 3.13.1-67Petr Lautrbach - 3.13.1-66Lukas Vrabec 3.13.1-65Lukas Vrabec 3.13.1-64Lukas Vrabec 3.13.1-63Lukas Vrabec 3.13.1-62Lukas Vrabec 3.13.1-61Miroslav Grepl 3.13.1-60Miroslav Grepl 3.13.1-59Lukas Vrabec 3.13.1-58Lukas Vrabec 3.13.1-57Miroslav Grepl 3.13.1-56Lukas Vrabec 3.13.1-55Lukas Vrabec 3.13.1-54Lukas Vrabec 3.13.1-53Lukas Vrabec 3.13.1-52Miroslav Grepl 3.13.1-51Lukas Vrabec 3.13.1-50Lukas Vrabec 3.13.1-49Lukas Vrabec 3.13.1-48Lukas Vrabec 3.13.1-47Lukas Vrabec 3.13.1-46Lukas Vrabec 3.13.1-45Lukas Vrabec 3.13.1-44Lukas Vrabec 3.13.1-43Lukas Vrabec 3.13.1-42Lukas Vrabec 3.13.1-41Lukas Vrabec 3.13.1-40Miroslav Grepl 3.13.1-39Lukas Vrabec 3.13.1-38Lukas Vrabec 3.13.1-37Lukas Vrabec 3.13.1-36Lukas Vrabec 3.13.1-35Lukas Vrabec 3.13.1-34Lukas Vrabec 3.13.1-33Lukas Vrabec 3.13.1-32Miroslav Grepl 3.13.1-31Miroslav Grepl 3.13.1-30Miroslav Grepl 3.13.1-29Miroslav Grepl 3.13.1-28Miroslav Grepl 3.13.1-27Miroslav Grepl 3.13.1-26Miroslav Grepl 3.13.1-25Miroslav Grepl 3.13.1-24Miroslav Grepl 3.13.1-23Miroslav Grepl 3.13.1-22Miroslav Grepl 3.13.1-21Miroslav Grepl 3.13.1-20Miroslav Grepl 3.13.1-19Miroslav Grepl 3.13.1-18Miroslav Grepl 3.13.1-17Miroslav Grepl 3.13.1-16Miroslav Grepl 3.13.1-15Miroslav Grepl 3.13.1-14Miroslav Grepl 3.13.1-13Miroslav Grepl 3.13.1-12Miroslav Grepl 3.13.1-11Miroslav Grepl 3.13.1-10Miroslav Grepl 3.13.1-9Miroslav Grepl 3.13.1-8Miroslav Grepl 3.13.1-7Miroslav Grepl 3.13.1-6Miroslav Grepl 3.13.1-5Miroslav Grepl 3.13.1-4Miroslav Grepl 3.13.1-3Miroslav Grepl 3.13.1-2Miroslav Grepl 3.13.1-1Miroslav Grepl 3.12.1-156Miroslav Grepl 3.12.1-155Miroslav Grepl 3.12.1-154Miroslav Grepl 3.12.1-153Miroslav Grepl 3.12.1-152Miroslav Grepl 3.12.1-151Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-148Miroslav Grepl 3.12.1-147Miroslav Grepl 3.12.1-146Miroslav Grepl 3.12.1-145Miroslav Grepl 3.12.1-144Lukas Vrabec 3.12.1-143Miroslav Grepl 3.12.1-142Miroslav Grepl 3.12.1-141Miroslav Grepl 3.12.1-140Miroslav Grepl 3.12.1-139Lukas Vrabec 3.12.1-138Miroslav Grepl 3.12.1-137Miroslav Grepl 3.12.1-136Miroslav Grepl 3.12.1-135Miroslav Grepl 3.12.1-134Miroslav Grepl 3.12.1-133Miroslav Grepl 3.12.1-132Miroslav Grepl 3.12.1-131Miroslav Grepl 3.12.1-130Miroslav Grepl 3.12.1-129Miroslav Grepl 3.12.1-128Miroslav Grepl 3.12.1-127Miroslav Grepl 3.12.1-126Miroslav Grepl 3.12.1-125Miroslav Grepl 3.12.1-124Miroslav Grepl 3.12.1-123Miroslav Grepl 3.12.1-122Miroslav Grepl 3.12.1-121Miroslav Grepl 3.12.1-120Miroslav Grepl 3.12.1-119Miroslav Grepl 3.12.1-118Miroslav Grepl 3.12.1-117Miroslav Grepl 3.12.1-116Miroslav Grepl 3.12.1-115Miroslav Grepl 3.12.1-114Miroslav Grepl 3.12.1-113Miroslav Grepl 3.12.1-112Miroslav Grepl 3.12.1-111Miroslav Grepl 3.12.1-110Miroslav Grepl 3.12.1-109Miroslav Grepl 3.12.1-108Miroslav Grepl 3.12.1-107Dan Walsh 3.12.1-106Miroslav Grepl 3.12.1-105Miroslav Grepl 3.12.1-104Miroslav Grepl 3.12.1-103Miroslav Grepl 3.12.1-102Miroslav Grepl 3.12.1-101Miroslav Grepl 3.12.1-100Miroslav Grepl 3.12.1-99Miroslav Grepl 3.12.1-98Miroslav Grepl 3.12.1-97Miroslav Grepl 3.12.1-96Miroslav Grepl 3.12.1-95Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-93Miroslav Grepl 3.12.1-92Miroslav Grepl 3.12.1-91Miroslav Grepl 3.12.1-90Miroslav Grepl 3.12.1-89Miroslav Grepl 3.12.1-88Miroslav Grepl 3.12.1-87Miroslav Grepl 3.12.1-86Miroslav Grepl 3.12.1-85Miroslav Grepl 3.12.1-84Miroslav Grepl 3.12.1-83Miroslav Grepl 3.12.1-82Miroslav Grepl 3.12.1-81Miroslav Grepl 3.12.1-80Miroslav Grepl 3.12.1-79Miroslav Grepl 3.12.1-78Miroslav Grepl 3.12.1-77Miroslav Grepl 3.12.1-76Miroslav Grepl 3.12.1-75Miroslav Grepl 3.12.1-74Miroslav Grepl 3.12.1-73Miroslav Grepl 3.12.1-72Miroslav Grepl 3.12.1-71Miroslav Grepl 3.12.1-70Miroslav Grepl 3.12.1-69Miroslav Grepl 3.12.1-68Miroslav Grepl 3.12.1-67Miroslav Grepl 3.12.1-66Miroslav Grepl 3.12.1-65Miroslav Grepl 3.12.1-64Miroslav Grepl 3.12.1-63Miroslav Grepl 3.12.1-62Miroslav Grepl 3.12.1-61Miroslav Grepl 3.12.1-60Miroslav Grepl 3.12.1-59Miroslav Grepl 3.12.1-58Miroslav Grepl 3.12.1-57Miroslav Grepl 3.12.1-56Miroslav Grepl 3.12.1-55Miroslav Grepl 3.12.1-54Miroslav Grepl 3.12.1-53Miroslav Grepl 3.12.1-52Miroslav Grepl 3.12.1-51Miroslav Grepl 3.12.1-50Miroslav Grepl 3.12.1-49Miroslav Grepl 3.12.1-48Miroslav Grepl 3.12.1-47Miroslav Grepl 3.12.1-46Miroslav Grepl 3.12.1-45Miroslav Grepl 3.12.1-44Miroslav Grepl 3.12.1-43Miroslav Grepl 3.12.1-42Miroslav Grepl 3.12.1-41Miroslav Grepl 3.12.1-40Miroslav Grepl 3.12.1-39Miroslav Grepl 3.12.1-38Miroslav Grepl 3.12.1-37Miroslav Grepl 3.12.1-36Miroslav Grepl 3.12.1-35Miroslav Grepl 3.12.1-34Miroslav Grepl 3.12.1-33Miroslav Grepl 3.12.1-32Miroslav Grepl 3.12.1-31Miroslav Grepl 3.12.1-30Miroslav Grepl 3.12.1-29Dan Walsh 3.12.1-28Dan Walsh 3.12.1-27Miroslav Grepl 3.12.1-26Miroslav Grepl 3.12.1-25Miroslav Grepl 3.12.1-24Miroslav Grepl 3.12.1-23Miroslav Grepl 3.12.1-22Miroslav Grepl 3.12.1-21Miroslav Grepl 3.12.1-20Miroslav Grepl 3.12.1-19Miroslav Grepl 3.12.1-18Miroslav Grepl 3.12.1-17Miroslav Grepl 3.12.1-16Miroslav Grepl 3.12.1-15Miroslav Grepl 3.12.1-14Miroslav Grepl 3.12.1-13Miroslav Grepl 3.12.1-12Miroslav Grepl 3.12.1-11Miroslav Grepl 3.12.1-10Miroslav Grepl 3.12.1-9Miroslav Grepl 3.12.1-8Miroslav Grepl 3.12.1-7Miroslav Grepl 3.12.1-6Miroslav Grepl 3.12.1-5Miroslav Grepl 3.12.1-4Miroslav Grepl 3.12.1-3Miroslav Grepl 3.12.1-2Miroslav Grepl 3.12.1-1Dan Walsh 3.11.1-69.1Miroslav Grepl 3.11.1-69Miroslav Grepl 3.11.1-68Miroslav Grepl 3.11.1-67Miroslav Grepl 3.11.1-66Miroslav Grepl 3.11.1-65Miroslav Grepl 3.11.1-64Miroslav Grepl 3.11.1-63Miroslav Grepl 3.11.1-62Miroslav Grepl 3.11.1-61Miroslav Grepl 3.11.1-60Miroslav Grepl 3.11.1-59Miroslav Grepl 3.11.1-58Miroslav Grepl 3.11.1-57Miroslav Grepl 3.11.1-56Miroslav Grepl 3.11.1-55Miroslav Grepl 3.11.1-54Miroslav Grepl 3.11.1-53Miroslav Grepl 3.11.1-52Miroslav Grepl 3.11.1-51Miroslav Grepl 3.11.1-50Miroslav Grepl 3.11.1-49Miroslav Grepl 3.11.1-48Miroslav Grepl 3.11.1-47Miroslav Grepl 3.11.1-46Miroslav Grepl 3.11.1-45Miroslav Grepl 3.11.1-44Miroslav Grepl 3.11.1-43Miroslav Grepl 3.11.1-42Miroslav Grepl 3.11.1-41Miroslav Grepl 3.11.1-40Miroslav Grepl 3.11.1-39Miroslav Grepl 3.11.1-38Miroslav Grepl 3.11.1-37Miroslav Grepl 3.11.1-36Miroslav Grepl 3.11.1-35Miroslav Grepl 3.11.1-34Miroslav Grepl 3.11.1-33Miroslav Grepl 3.11.1-32Miroslav Grepl 3.11.1-31Miroslav Grepl 3.11.1-30Miroslav Grepl 3.11.1-29Miroslav Grepl 3.11.1-28Miroslav Grepl 3.11.1-27Miroslav Grepl 3.11.1-26Miroslav Grepl 3.11.1-25Miroslav Grepl 3.11.1-24Miroslav Grepl 3.11.1-23Miroslav Grepl 3.11.1-22Miroslav Grepl 3.11.1-21Miroslav Grepl 3.11.1-20Miroslav Grepl 3.11.1-19Miroslav Grepl 3.11.1-18Miroslav Grepl 3.11.1-17Miroslav Grepl 3.11.1-16Dan Walsh 3.11.1-15Miroslav Grepl 3.11.1-14Dan Walsh 3.11.1-13Miroslav Grepl 3.11.1-12Miroslav Grepl 3.11.1-11Miroslav Grepl 3.11.1-10Dan Walsh 3.11.1-9Dan Walsh 3.11.1-8Dan Walsh 3.11.1-7Dan Walsh 3.11.1-6Miroslav Grepl 3.11.1-5Miroslav Grepl 3.11.1-4Miroslav Grepl 3.11.1-3Miroslav Grepl 3.11.1-2Miroslav Grepl 3.11.1-1Miroslav Grepl 3.11.1-0Miroslav Grepl 3.11.0-15Miroslav Grepl 3.11.0-14Miroslav Grepl 3.11.0-13Miroslav Grepl 3.11.0-12Fedora Release Engineering - 3.11.0-11Miroslav Grepl 3.11.0-10Miroslav Grepl 3.11.0-9Miroslav Grepl 3.11.0-8Miroslav Grepl 3.11.0-7Miroslav Grepl 3.11.0-6Miroslav Grepl 3.11.0-5Miroslav Grepl 3.11.0-4Miroslav Grepl 3.11.0-3Miroslav Grepl 3.11.0-2Miroslav Grepl 3.11.0-1Miroslav Grepl 3.10.0-128Miroslav Grepl 3.10.0-127Miroslav Grepl 3.10.0-126Miroslav Grepl 3.10.0-125Miroslav Grepl 3.10.0-124Miroslav Grepl 3.10.0-123Miroslav Grepl 3.10.0-122Miroslav Grepl 3.10.0-121Miroslav Grepl 3.10.0-120Miroslav Grepl 3.10.0-119Miroslav Grepl 3.10.0-118Miroslav Grepl 3.10.0-117Miroslav Grepl 3.10.0-116Miroslav Grepl 3.10.0-115Miroslav Grepl 3.10.0-114Miroslav Grepl 3.10.0-113Miroslav Grepl 3.10.0-112Miroslav Grepl 3.10.0-111Miroslav Grepl 3.10.0-110Miroslav Grepl 3.10.0-109Miroslav Grepl 3.10.0-108Miroslav Grepl 3.10.0-107Miroslav Grepl 3.10.0-106Miroslav Grepl 3.10.0-105Miroslav Grepl 3.10.0-104Miroslav Grepl 3.10.0-103Miroslav Grepl 3.10.0-102Miroslav Grepl 3.10.0-101Miroslav Grepl 3.10.0-100Miroslav Grepl 3.10.0-99Miroslav Grepl 3.10.0-98Miroslav Grepl 3.10.0-97Miroslav Grepl 3.10.0-96Miroslav Grepl 3.10.0-95Miroslav Grepl 3.10.0-94Miroslav Grepl 3.10.0-93Miroslav Grepl 3.10.0-92Miroslav Grepl 3.10.0-91Miroslav Grepl 3.10.0-90Miroslav Grepl 3.10.0-89Miroslav Grepl 3.10.0-88Miroslav Grepl 3.10.0-87Miroslav Grepl 3.10.0-86Miroslav Grepl 3.10.0-85Miroslav Grepl 3.10.0-84Miroslav Grepl 3.10.0-83Miroslav Grepl 3.10.0-82Dan Walsh 3.10.0-81.2Miroslav Grepl 3.10.0-81Miroslav Grepl 3.10.0-80Miroslav Grepl 3.10.0-79Miroslav Grepl 3.10.0-78Miroslav Grepl 3.10.0-77Miroslav Grepl 3.10.0-76Miroslav Grepl 3.10.0-75Dan Walsh 3.10.0-74.2Miroslav Grepl 3.10.0-74Miroslav Grepl 3.10.0-73Miroslav Grepl 3.10.0-72Miroslav Grepl 3.10.0-71Miroslav Grepl 3.10.0-70Miroslav Grepl 3.10.0-69Miroslav Grepl 3.10.0-68Miroslav Grepl 3.10.0-67Miroslav Grepl 3.10.0-66Miroslav Grepl 3.10.0-65Miroslav Grepl 3.10.0-64Miroslav Grepl 3.10.0-63Miroslav Grepl 3.10.0-59Miroslav Grepl 3.10.0-58Dan Walsh 3.10.0-57Dan Walsh 3.10.0-56Dan Walsh 3.10.0-55.2Dan Walsh 3.10.0-55.1Miroslav Grepl 3.10.0-55Dan Walsh 3.10.0-54.1Miroslav Grepl 3.10.0-54Dan Walsh 3.10.0-53.1Miroslav Grepl 3.10.0-53Miroslav Grepl 3.10.0-52Miroslav Grepl 3.10.0-51Dan Walsh 3.10.0-50.2Dan Walsh 3.10.0-50.1Miroslav Grepl 3.10.0-50Miroslav Grepl 3.10.0-49Miroslav Grepl 3.10.0-48Miroslav Grepl 3.10.0-47Dan Walsh 3.10.0-46.1Miroslav Grepl 3.10.0-46Dan Walsh 3.10.0-45.1Miroslav Grepl 3.10.0-45Miroslav Grepl 3.10.0-43Miroslav Grepl 3.10.0-42Miroslav Grepl 3.10.0-41Dan Walsh 3.10.0-40.2Miroslav Grepl 3.10.0-40Dan Walsh 3.10.0-39.3Dan Walsh 3.10.0-39.2Dan Walsh 3.10.0-39.1Miroslav Grepl 3.10.0-39Dan Walsh 3.10.0-38.1Miroslav Grepl 3.10.0-38Miroslav Grepl 3.10.0-37Dan Walsh 3.10.0-36.1Miroslav Grepl 3.10.0-36Dan Walsh 3.10.0-35Dan Walsh 3.10.0-34.7Dan Walsh 3.10.0-34.6Dan Walsh 3.10.0-34.4Miroslav Grepl 3.10.0-34.3Dan Walsh 3.10.0-34.2Dan Walsh 3.10.0-34.1Miroslav Grepl 3.10.0-34Miroslav Grepl 3.10.0-33Dan Walsh 3.10.0-31.1Miroslav Grepl 3.10.0-31Miroslav Grepl 3.10.0-29Miroslav Grepl 3.10.0-28Miroslav Grepl 3.10.0-27Miroslav Grepl 3.10.0-26Miroslav Grepl 3.10.0-25Miroslav Grepl 3.10.0-24Miroslav Grepl 3.10.0-23Miroslav Grepl 3.10.0-22Miroslav Grepl 3.10.0-21Dan Walsh 3.10.0-20Miroslav Grepl 3.10.0-19Miroslav Grepl 3.10.0-18Miroslav Grepl 3.10.0-17Miroslav Grepl 3.10.0-16Miroslav Grepl 3.10.0-14Miroslav Grepl 3.10.0-13Miroslav Grepl 3.10.0-12Miroslav Grepl 3.10.0-11Miroslav Grepl 3.10.0-10Miroslav Grepl 3.10.0-9Miroslav Grepl 3.10.0-8Miroslav Grepl 3.10.0-7Miroslav Grepl 3.10.0-6Miroslav Grepl 3.10.0-5Miroslav Grepl 3.10.0-4Miroslav Grepl 3.10.0-3Miroslav Grepl 3.10.0-2Miroslav Grepl 3.10.0-1Miroslav Grepl 3.9.16-30Dan Walsh 3.9.16-29.1Miroslav Grepl 3.9.16-29Dan Walsh 3.9.16-28.1Miroslav Grepl 3.9.16-27Miroslav Grepl 3.9.16-26Miroslav Grepl 3.9.16-25Miroslav Grepl 3.9.16-24Miroslav Grepl 3.9.16-23Miroslav Grepl 3.9.16-22Miroslav Grepl 3.9.16-21Miroslav Grepl 3.9.16-20Miroslav Grepl 3.9.16-19Miroslav Grepl 3.9.16-18Miroslav Grepl 3.9.16-17Dan Walsh 3.9.16-16.1Miroslav Grepl 3.9.16-16Miroslav Grepl 3.9.16-15Miroslav Grepl 3.9.16-14Miroslav Grepl 3.9.16-13Miroslav Grepl 3.9.16-12Miroslav Grepl 3.9.16-11Miroslav Grepl 3.9.16-10Miroslav Grepl 3.9.16-7Miroslav Grepl 3.9.16-6Miroslav Grepl 3.9.16-5Miroslav Grepl 3.9.16-4Miroslav Grepl 3.9.16-3Miroslav Grepl 3.9.16-2Miroslav Grepl 3.9.16-1Miroslav Grepl 3.9.15-5Miroslav Grepl 3.9.15-2Miroslav Grepl 3.9.15-1Fedora Release Engineering - 3.9.14-2Dan Walsh 3.9.14-1Miroslav Grepl 3.9.13-10Miroslav Grepl 3.9.13-9Dan Walsh 3.9.13-8Miroslav Grepl 3.9.13-7Miroslav Grepl 3.9.13-6Miroslav Grepl 3.9.13-5Miroslav Grepl 3.9.13-4Miroslav Grepl 3.9.13-3Miroslav Grepl 3.9.13-2Miroslav Grepl 3.9.13-1Miroslav Grepl 3.9.12-8Miroslav Grepl 3.9.12-7Miroslav Grepl 3.9.12-6Miroslav Grepl 3.9.12-5Dan Walsh 3.9.12-4Dan Walsh 3.9.12-3Dan Walsh 3.9.12-2Miroslav Grepl 3.9.12-1Dan Walsh 3.9.11-2Miroslav Grepl 3.9.11-1Miroslav Grepl 3.9.10-13Dan Walsh 3.9.10-12Miroslav Grepl 3.9.10-11Miroslav Grepl 3.9.10-10Miroslav Grepl 3.9.10-9Miroslav Grepl 3.9.10-8Miroslav Grepl 3.9.10-7Miroslav Grepl 3.9.10-6Miroslav Grepl 3.9.10-5Dan Walsh 3.9.10-4Miroslav Grepl 3.9.10-3Miroslav Grepl 3.9.10-2Miroslav Grepl 3.9.10-1Miroslav Grepl 3.9.9-4Dan Walsh 3.9.9-3Miroslav Grepl 3.9.9-2Miroslav Grepl 3.9.9-1Miroslav Grepl 3.9.8-7Dan Walsh 3.9.8-6Miroslav Grepl 3.9.8-5Miroslav Grepl 3.9.8-4Dan Walsh 3.9.8-3Dan Walsh 3.9.8-2Dan Walsh 3.9.8-1Dan Walsh 3.9.7-10Dan Walsh 3.9.7-9Dan Walsh 3.9.7-8Dan Walsh 3.9.7-7Dan Walsh 3.9.7-6Dan Walsh 3.9.7-5Dan Walsh 3.9.7-4Dan Walsh 3.9.7-3Dan Walsh 3.9.7-2Dan Walsh 3.9.7-1Dan Walsh 3.9.6-3Dan Walsh 3.9.6-2Dan Walsh 3.9.6-1Dan Walsh 3.9.5-11Dan Walsh 3.9.5-10Dan Walsh 3.9.5-9Dan Walsh 3.9.5-8Dan Walsh 3.9.5-7Dan Walsh 3.9.5-6Dan Walsh 3.9.5-5Dan Walsh 3.9.5-4Dan Walsh 3.9.5-3Dan Walsh 3.9.5-2Dan Walsh 3.9.5-1Dan Walsh 3.9.4-3Dan Walsh 3.9.4-2Dan Walsh 3.9.4-1Dan Walsh 3.9.3-4Dan Walsh 3.9.3-3Dan Walsh 3.9.3-2Dan Walsh 3.9.3-1Dan Walsh 3.9.2-1Dan Walsh 3.9.1-3Dan Walsh 3.9.1-2Dan Walsh 3.9.1-1Dan Walsh 3.9.0-2Dan Walsh 3.9.0-1Dan Walsh 3.8.8-21Dan Walsh 3.8.8-20Dan Walsh 3.8.8-19Dan Walsh 3.8.8-18Dan Walsh 3.8.8-17Dan Walsh 3.8.8-16Dan Walsh 3.8.8-15Dan Walsh 3.8.8-14Dan Walsh 3.8.8-13Dan Walsh 3.8.8-12Dan Walsh 3.8.8-11Dan Walsh 3.8.8-10Dan Walsh 3.8.8-9Dan Walsh 3.8.8-8Dan Walsh 3.8.8-7Dan Walsh 3.8.8-6Dan Walsh 3.8.8-5Dan Walsh 3.8.8-4Dan Walsh 3.8.8-3Dan Walsh 3.8.8-2Dan Walsh 3.8.8-1Dan Walsh 3.8.7-3Dan Walsh 3.8.7-2Dan Walsh 3.8.7-1Dan Walsh 3.8.6-3Miroslav Grepl 3.8.6-2Dan Walsh 3.8.6-1Dan Walsh 3.8.5-1Dan Walsh 3.8.4-1Dan Walsh 3.8.3-4Dan Walsh 3.8.3-3Dan Walsh 3.8.3-2Dan Walsh 3.8.3-1Dan Walsh 3.8.2-1Dan Walsh 3.8.1-5Dan Walsh 3.8.1-4Dan Walsh 3.8.1-3Dan Walsh 3.8.1-2Dan Walsh 3.8.1-1Dan Walsh 3.7.19-22Dan Walsh 3.7.19-21Dan Walsh 3.7.19-20Dan Walsh 3.7.19-19Dan Walsh 3.7.19-17Dan Walsh 3.7.19-16Dan Walsh 3.7.19-15Dan Walsh 3.7.19-14Dan Walsh 3.7.19-13Dan Walsh 3.7.19-12Dan Walsh 3.7.19-11Dan Walsh 3.7.19-10Dan Walsh 3.7.19-9Dan Walsh 3.7.19-8Dan Walsh 3.7.19-7Dan Walsh 3.7.19-6Dan Walsh 3.7.19-5Dan Walsh 3.7.19-4Dan Walsh 3.7.19-3Dan Walsh 3.7.19-2Dan Walsh 3.7.19-1Dan Walsh 3.7.18-3Dan Walsh 3.7.18-2Dan Walsh 3.7.18-1Dan Walsh 3.7.17-6Dan Walsh 3.7.17-5Dan Walsh 3.7.17-4Dan Walsh 3.7.17-3Dan Walsh 3.7.17-2Dan Walsh 3.7.17-1Dan Walsh 3.7.16-2Dan Walsh 3.7.16-1Dan Walsh 3.7.15-4Dan Walsh 3.7.15-3Dan Walsh 3.7.15-2Dan Walsh 3.7.15-1Dan Walsh 3.7.14-5Dan Walsh 3.7.14-4Dan Walsh 3.7.14-3Dan Walsh 3.7.14-2Dan Walsh 3.7.14-1Dan Walsh 3.7.13-4Dan Walsh 3.7.13-3Dan Walsh 3.7.13-2Dan Walsh 3.7.13-1Dan Walsh 3.7.12-1Dan Walsh 3.7.11-1Dan Walsh 3.7.10-5Dan Walsh 3.7.10-4Dan Walsh 3.7.10-3Dan Walsh 3.7.10-2Dan Walsh 3.7.10-1Dan Walsh 3.7.9-4Dan Walsh 3.7.9-3Dan Walsh 3.7.9-2Dan Walsh 3.7.9-1Dan Walsh 3.7.8-11Dan Walsh 3.7.8-9Dan Walsh 3.7.8-8Dan Walsh 3.7.8-7Dan Walsh 3.7.8-6Dan Walsh 3.7.8-5Dan Walsh 3.7.8-4Dan Walsh 3.7.8-3Dan Walsh 3.7.8-2Dan Walsh 3.7.8-1Dan Walsh 3.7.7-3Dan Walsh 3.7.7-2Dan Walsh 3.7.7-1Dan Walsh 3.7.6-1Dan Walsh 3.7.5-8Dan Walsh 3.7.5-7Dan Walsh 3.7.5-6Dan Walsh 3.7.5-5Dan Walsh 3.7.5-4Dan Walsh 3.7.5-3Dan Walsh 3.7.5-2Dan Walsh 3.7.5-1Dan Walsh 3.7.4-4Dan Walsh 3.7.4-3Dan Walsh 3.7.4-2Dan Walsh 3.7.4-1Dan Walsh 3.7.3-1Dan Walsh 3.7.1-1Dan Walsh 3.6.33-2Dan Walsh 3.6.33-1Dan Walsh 3.6.32-17Dan Walsh 3.6.32-16Dan Walsh 3.6.32-15Dan Walsh 3.6.32-13Dan Walsh 3.6.32-12Dan Walsh 3.6.32-11Dan Walsh 3.6.32-10Dan Walsh 3.6.32-9Dan Walsh 3.6.32-8Dan Walsh 3.6.32-7Dan Walsh 3.6.32-6Dan Walsh 3.6.32-5Dan Walsh 3.6.32-4Dan Walsh 3.6.32-3Dan Walsh 3.6.32-2Dan Walsh 3.6.32-1Dan Walsh 3.6.31-5Dan Walsh 3.6.31-4Dan Walsh 3.6.31-3Dan Walsh 3.6.31-2Dan Walsh 3.6.30-6Dan Walsh 3.6.30-5Dan Walsh 3.6.30-4Dan Walsh 3.6.30-3Dan Walsh 3.6.30-2Dan Walsh 3.6.30-1Dan Walsh 3.6.29-2Dan Walsh 3.6.29-1Dan Walsh 3.6.28-9Dan Walsh 3.6.28-8Dan Walsh 3.6.28-7Dan Walsh 3.6.28-6Dan Walsh 3.6.28-5Dan Walsh 3.6.28-4Dan Walsh 3.6.28-3Dan Walsh 3.6.28-2Dan Walsh 3.6.28-1Dan Walsh 3.6.27-1Dan Walsh 3.6.26-11Dan Walsh 3.6.26-10Dan Walsh 3.6.26-9Bill Nottingham 3.6.26-8Dan Walsh 3.6.26-7Dan Walsh 3.6.26-6Dan Walsh 3.6.26-5Dan Walsh 3.6.26-4Dan Walsh 3.6.26-3Dan Walsh 3.6.26-2Dan Walsh 3.6.26-1Dan Walsh 3.6.25-1Dan Walsh 3.6.24-1Dan Walsh 3.6.23-2Dan Walsh 3.6.23-1Dan Walsh 3.6.22-3Dan Walsh 3.6.22-1Dan Walsh 3.6.21-4Dan Walsh 3.6.21-3Tom "spot" Callaway 3.6.21-2Dan Walsh 3.6.21-1Dan Walsh 3.6.20-2Dan Walsh 3.6.20-1Dan Walsh 3.6.19-5Dan Walsh 3.6.19-4Dan Walsh 3.6.19-3Dan Walsh 3.6.19-2Dan Walsh 3.6.19-1Dan Walsh 3.6.18-1Dan Walsh 3.6.17-1Dan Walsh 3.6.16-4Dan Walsh 3.6.16-3Dan Walsh 3.6.16-2Dan Walsh 3.6.16-1Dan Walsh 3.6.14-3Dan Walsh 3.6.14-2Dan Walsh 3.6.14-1Dan Walsh 3.6.13-3Dan Walsh 3.6.13-2Dan Walsh 3.6.13-1Dan Walsh 3.6.12-39Dan Walsh 3.6.12-38Dan Walsh 3.6.12-37Dan Walsh 3.6.12-36Dan Walsh 3.6.12-35Dan Walsh 3.6.12-34Dan Walsh 3.6.12-33Dan Walsh 3.6.12-31Dan Walsh 3.6.12-30Dan Walsh 3.6.12-29Dan Walsh 3.6.12-28Dan Walsh 3.6.12-27Dan Walsh 3.6.12-26Dan Walsh 3.6.12-25Dan Walsh 3.6.12-24Dan Walsh 3.6.12-23Dan Walsh 3.6.12-22Dan Walsh 3.6.12-21Dan Walsh 3.6.12-20Dan Walsh 3.6.12-19Dan Walsh 3.6.12-16Dan Walsh 3.6.12-15Dan Walsh 3.6.12-14Dan Walsh 3.6.12-13Dan Walsh 3.6.12-12Dan Walsh 3.6.12-11Dan Walsh 3.6.12-10Dan Walsh 3.6.12-9Dan Walsh 3.6.12-8Dan Walsh 3.6.12-7Dan Walsh 3.6.12-6Dan Walsh 3.6.12-5Dan Walsh 3.6.12-4Dan Walsh 3.6.12-3Dan Walsh 3.6.12-2Dan Walsh 3.6.12-1Dan Walsh 3.6.11-1Dan Walsh 3.6.10-9Dan Walsh 3.6.10-8Dan Walsh 3.6.10-7Dan Walsh 3.6.10-6Dan Walsh 3.6.10-5Dan Walsh 3.6.10-4Dan Walsh 3.6.10-3Dan Walsh 3.6.10-2Dan Walsh 3.6.10-1Dan Walsh 3.6.9-4Dan Walsh 3.6.9-3Dan Walsh 3.6.9-2Dan Walsh 3.6.9-1Dan Walsh 3.6.8-4Dan Walsh 3.6.8-3Dan Walsh 3.6.8-2Dan Walsh 3.6.8-1Dan Walsh 3.6.7-2Dan Walsh 3.6.7-1Dan Walsh 3.6.6-9Dan Walsh 3.6.6-8Fedora Release Engineering - 3.6.6-7Dan Walsh 3.6.6-6Dan Walsh 3.6.6-5Dan Walsh 3.6.6-4Dan Walsh 3.6.6-3Dan Walsh 3.6.6-2Dan Walsh 3.6.6-1Dan Walsh 3.6.5-3Dan Walsh 3.6.5-1Dan Walsh 3.6.4-6Dan Walsh 3.6.4-5Dan Walsh 3.6.4-4Dan Walsh 3.6.4-3Dan Walsh 3.6.4-2Dan Walsh 3.6.4-1Dan Walsh 3.6.3-13Dan Walsh 3.6.3-12Dan Walsh 3.6.3-11Dan Walsh 3.6.3-10Dan Walsh 3.6.3-9Dan Walsh 3.6.3-8Dan Walsh 3.6.3-7Dan Walsh 3.6.3-6Dan Walsh 3.6.3-3Dan Walsh 3.6.3-2Dan Walsh 3.6.3-1Dan Walsh 3.6.2-5Dan Walsh 3.6.2-4Dan Walsh 3.6.2-3Dan Walsh 3.6.2-2Dan Walsh 3.6.2-1Dan Walsh 3.6.1-15Dan Walsh 3.6.1-14Dan Walsh 3.6.1-13Dan Walsh 3.6.1-12Dan Walsh 3.6.1-11Dan Walsh 3.6.1-10Dan Walsh 3.6.1-9Dan Walsh 3.6.1-8Dan Walsh 3.6.1-7Dan Walsh 3.6.1-4Ignacio Vazquez-Abrams - 3.6.1-2Dan Walsh 3.5.13-19Dan Walsh 3.5.13-18Dan Walsh 3.5.13-17Dan Walsh 3.5.13-16Dan Walsh 3.5.13-15Dan Walsh 3.5.13-14Dan Walsh 3.5.13-13Dan Walsh 3.5.13-12Dan Walsh 3.5.13-11Dan Walsh 3.5.13-9Dan Walsh 3.5.13-8Dan Walsh 3.5.13-7Dan Walsh 3.5.13-6Dan Walsh 3.5.13-5Dan Walsh 3.5.13-4Dan Walsh 3.5.13-3Dan Walsh 3.5.13-2Dan Walsh 3.5.13-1Dan Walsh 3.5.12-3Dan Walsh 3.5.12-2Dan Walsh 3.5.12-1Dan Walsh 3.5.11-1Dan Walsh 3.5.10-3Dan Walsh 3.5.10-2Dan Walsh 3.5.10-1Dan Walsh 3.5.9-4Dan Walsh 3.5.9-3Dan Walsh 3.5.9-2Dan Walsh 3.5.9-1Dan Walsh 3.5.8-7Dan Walsh 3.5.8-6Dan Walsh 3.5.8-5Dan Walsh 3.5.8-4Dan Walsh 3.5.8-3Dan Walsh 3.5.8-1Dan Walsh 3.5.7-2Dan Walsh 3.5.7-1Dan Walsh 3.5.6-2Dan Walsh 3.5.6-1Dan Walsh 3.5.5-4Dan Walsh 3.5.5-3Dan Walsh 3.5.5-2Dan Walsh 3.5.4-2Dan Walsh 3.5.4-1Dan Walsh 3.5.3-1Dan Walsh 3.5.2-2Dan Walsh 3.5.1-5Dan Walsh 3.5.1-4Dan Walsh 3.5.1-3Dan Walsh 3.5.1-2Dan Walsh 3.5.1-1Dan Walsh 3.5.0-1Dan Walsh 3.4.2-14Dan Walsh 3.4.2-13Dan Walsh 3.4.2-12Dan Walsh 3.4.2-11Dan Walsh 3.4.2-10Dan Walsh 3.4.2-9Dan Walsh 3.4.2-8Dan Walsh 3.4.2-7Dan Walsh 3.4.2-6Dan Walsh 3.4.2-5Dan Walsh 3.4.2-4Dan Walsh 3.4.2-3Dan Walsh 3.4.2-2Dan Walsh 3.4.2-1Dan Walsh 3.4.1-5Dan Walsh 3.4.1-3Dan Walsh 3.4.1-2Dan Walsh 3.4.1-1Dan Walsh 3.3.1-48Dan Walsh 3.3.1-47Dan Walsh 3.3.1-46Dan Walsh 3.3.1-45Dan Walsh 3.3.1-44Dan Walsh 3.3.1-43Dan Walsh 3.3.1-42Dan Walsh 3.3.1-41Dan Walsh 3.3.1-39Dan Walsh 3.3.1-37Dan Walsh 3.3.1-36Dan Walsh 3.3.1-33Dan Walsh 3.3.1-32Dan Walsh 3.3.1-31Dan Walsh 3.3.1-30Dan Walsh 3.3.1-29Dan Walsh 3.3.1-28Dan Walsh 3.3.1-27Dan Walsh 3.3.1-26Dan Walsh 3.3.1-25Dan Walsh 3.3.1-24Dan Walsh 3.3.1-23Dan Walsh 3.3.1-22Dan Walsh 3.3.1-21Dan Walsh 3.3.1-20Dan Walsh 3.3.1-19Dan Walsh 3.3.1-18Dan Walsh 3.3.1-17Dan Walsh 3.3.1-16Dan Walsh 3.3.1-15Bill Nottingham 3.3.1-14Dan Walsh 3.3.1-13Dan Walsh 3.3.1-12Dan Walsh 3.3.1-11Dan Walsh 3.3.1-10Dan Walsh 3.3.1-9Dan Walsh 3.3.1-8Dan Walsh 3.3.1-6Dan Walsh 3.3.1-5Dan Walsh 3.3.1-4Dan Walsh 3.3.1-2Dan Walsh 3.3.1-1Dan Walsh 3.3.0-2Dan Walsh 3.3.0-1Dan Walsh 3.2.9-2Dan Walsh 3.2.9-1Dan Walsh 3.2.8-2Dan Walsh 3.2.8-1Dan Walsh 3.2.7-6Dan Walsh 3.2.7-5Dan Walsh 3.2.7-3Dan Walsh 3.2.7-2Dan Walsh 3.2.7-1Dan Walsh 3.2.6-7Dan Walsh 3.2.6-6Dan Walsh 3.2.6-5Dan Walsh 3.2.6-4Dan Walsh 3.2.6-3Dan Walsh 3.2.6-2Dan Walsh 3.2.6-1Dan Walsh 3.2.5-25Dan Walsh 3.2.5-24Dan Walsh 3.2.5-22Dan Walsh 3.2.5-21Dan Walsh 3.2.5-20Dan Walsh 3.2.5-19Dan Walsh 3.2.5-18Dan Walsh 3.2.5-17Dan Walsh 3.2.5-16Dan Walsh 3.2.5-15Dan Walsh 3.2.5-14Dan Walsh 3.2.5-13Dan Walsh 3.2.5-12Dan Walsh 3.2.5-11Dan Walsh 3.2.5-10Dan Walsh 3.2.5-9Dan Walsh 3.2.5-8Dan Walsh 3.2.5-7Dan Walsh 3.2.5-6Dan Walsh 3.2.5-5Dan Walsh 3.2.5-4Dan Walsh 3.2.5-3Dan Walsh 3.2.5-2Dan Walsh 3.2.5-1Dan Walsh 3.2.4-5Dan Walsh 3.2.4-4Dan Walsh 3.2.4-3Dan Walsh 3.2.4-1Dan Walsh 3.2.4-1Dan Walsh 3.2.3-2Dan Walsh 3.2.3-1Dan Walsh 3.2.2-1Dan Walsh 3.2.1-3Dan Walsh 3.2.1-1Dan Walsh 3.1.2-2Dan Walsh 3.1.2-1Dan Walsh 3.1.1-1Dan Walsh 3.1.0-1Dan Walsh 3.0.8-30Dan Walsh 3.0.8-28Dan Walsh 3.0.8-27Dan Walsh 3.0.8-26Dan Walsh 3.0.8-25Dan Walsh 3.0.8-24Dan Walsh 3.0.8-23Dan Walsh 3.0.8-22Dan Walsh 3.0.8-21Dan Walsh 3.0.8-20Dan Walsh 3.0.8-19Dan Walsh 3.0.8-18Dan Walsh 3.0.8-17Dan Walsh 3.0.8-16Dan Walsh 3.0.8-15Dan Walsh 3.0.8-14Dan Walsh 3.0.8-13Dan Walsh 3.0.8-12Dan Walsh 3.0.8-11Dan Walsh 3.0.8-10Dan Walsh 3.0.8-9Dan Walsh 3.0.8-8Dan Walsh 3.0.8-7Dan Walsh 3.0.8-5Dan Walsh 3.0.8-4Dan Walsh 3.0.8-3Dan Walsh 3.0.8-2Dan Walsh 3.0.8-1Dan Walsh 3.0.7-10Dan Walsh 3.0.7-9Dan Walsh 3.0.7-8Dan Walsh 3.0.7-7Dan Walsh 3.0.7-6Dan Walsh 3.0.7-5Dan Walsh 3.0.7-4Dan Walsh 3.0.7-3Dan Walsh 3.0.7-2Dan Walsh 3.0.7-1Dan Walsh 3.0.6-3Dan Walsh 3.0.6-2Dan Walsh 3.0.6-1Dan Walsh 3.0.5-11Dan Walsh 3.0.5-10Dan Walsh 3.0.5-9Dan Walsh 3.0.5-8Dan Walsh 3.0.5-7Dan Walsh 3.0.5-6Dan Walsh 3.0.5-5Dan Walsh 3.0.5-4Dan Walsh 3.0.5-3Dan Walsh 3.0.5-2Dan Walsh 3.0.5-1Dan Walsh 3.0.4-6Dan Walsh 3.0.4-5Dan Walsh 3.0.4-4Dan Walsh 3.0.4-3Dan Walsh 3.0.4-2Dan Walsh 3.0.4-1Dan Walsh 3.0.3-6Dan Walsh 3.0.3-5Dan Walsh 3.0.3-4Dan Walsh 3.0.3-3Dan Walsh 3.0.3-2Dan Walsh 3.0.3-1Dan Walsh 3.0.2-9Dan Walsh 3.0.2-8Dan Walsh 3.0.2-7Dan Walsh 3.0.2-5Dan Walsh 3.0.2-4Dan Walsh 3.0.2-3Dan Walsh 3.0.2-2Dan Walsh 3.0.1-5Dan Walsh 3.0.1-4Dan Walsh 3.0.1-3Dan Walsh 3.0.1-2Dan Walsh 3.0.1-1Dan Walsh 2.6.5-3Dan Walsh 2.6.5-2Dan Walsh 2.6.4-7Dan Walsh 2.6.4-6Dan Walsh 2.6.4-5Dan Walsh 2.6.4-2Dan Walsh 2.6.4-1Dan Walsh 2.6.3-1Dan Walsh 2.6.2-1Dan Walsh 2.6.1-4Dan Walsh 2.6.1-2Dan Walsh 2.6.1-1Dan Walsh 2.5.12-12Dan Walsh 2.5.12-11Dan Walsh 2.5.12-10Dan Walsh 2.5.12-8Dan Walsh 2.5.12-5Dan Walsh 2.5.12-4Dan Walsh 2.5.12-3Dan Walsh 2.5.12-2Dan Walsh 2.5.12-1Dan Walsh 2.5.11-8Dan Walsh 2.5.11-7Dan Walsh 2.5.11-6Dan Walsh 2.5.11-5Dan Walsh 2.5.11-4Dan Walsh 2.5.11-3Dan Walsh 2.5.11-2Dan Walsh 2.5.11-1Dan Walsh 2.5.10-2Dan Walsh 2.5.10-1Dan Walsh 2.5.9-6Dan Walsh 2.5.9-5Dan Walsh 2.5.9-4Dan Walsh 2.5.9-3Dan Walsh 2.5.9-2Dan Walsh 2.5.8-8Dan Walsh 2.5.8-7Dan Walsh 2.5.8-6Dan Walsh 2.5.8-5Dan Walsh 2.5.8-4Dan Walsh 2.5.8-3Dan Walsh 2.5.8-2Dan Walsh 2.5.8-1Dan Walsh 2.5.7-1Dan Walsh 2.5.6-1Dan Walsh 2.5.5-2Dan Walsh 2.5.5-1Dan Walsh 2.5.4-2Dan Walsh 2.5.4-1Dan Walsh 2.5.3-3Dan Walsh 2.5.3-2Dan Walsh 2.5.3-1Dan Walsh 2.5.2-6Dan Walsh 2.5.2-5Dan Walsh 2.5.2-4Dan Walsh 2.5.2-3Dan Walsh 2.5.2-2Dan Walsh 2.5.2-1Dan Walsh 2.5.1-5Dan Walsh 2.5.1-4Dan Walsh 2.5.1-2Dan Walsh 2.5.1-1Dan Walsh 2.4.6-20Dan Walsh 2.4.6-19Dan Walsh 2.4.6-18Dan Walsh 2.4.6-17Dan Walsh 2.4.6-16Dan Walsh 2.4.6-15Dan Walsh 2.4.6-14Dan Walsh 2.4.6-13Dan Walsh 2.4.6-12Dan Walsh 2.4.6-11Dan Walsh 2.4.6-10Dan Walsh 2.4.6-9Dan Walsh 2.4.6-8Dan Walsh 2.4.6-7Dan Walsh 2.4.6-6Dan Walsh 2.4.6-5Dan Walsh 2.4.6-4Dan Walsh 2.4.6-3Dan Walsh 2.4.6-1Dan Walsh 2.4.5-4Dan Walsh 2.4.5-3Dan Walsh 2.4.5-2Dan Walsh 2.4.5-1Dan Walsh 2.4.4-2Dan Walsh 2.4.4-2Dan Walsh 2.4.4-1Dan Walsh 2.4.3-13Dan Walsh 2.4.3-12Dan Walsh 2.4.3-11Dan Walsh 2.4.3-10Dan Walsh 2.4.3-9Dan Walsh 2.4.3-8Dan Walsh 2.4.3-7Dan Walsh 2.4.3-6Dan Walsh 2.4.3-5Dan Walsh 2.4.3-4Dan Walsh 2.4.3-3Dan Walsh 2.4.3-2Dan Walsh 2.4.3-1Dan Walsh 2.4.2-8Dan Walsh 2.4.2-7James Antill 2.4.2-6Dan Walsh 2.4.2-5Dan Walsh 2.4.2-4Dan Walsh 2.4.2-3Dan Walsh 2.4.2-2Dan Walsh 2.4.2-1Dan Walsh 2.4.1-5Dan Walsh 2.4.1-4Dan Walsh 2.4.1-3Dan Walsh 2.4.1-2Dan Walsh 2.4-4Dan Walsh 2.4-3Dan Walsh 2.4-2Dan Walsh 2.4-1Dan Walsh 2.3.19-4Dan Walsh 2.3.19-3Dan Walsh 2.3.19-2Dan Walsh 2.3.19-1James Antill 2.3.18-10James Antill 2.3.18-9Dan Walsh 2.3.18-8Dan Walsh 2.3.18-7Dan Walsh 2.3.18-6Dan Walsh 2.3.18-5Dan Walsh 2.3.18-4Dan Walsh 2.3.18-3Dan Walsh 2.3.18-2Dan Walsh 2.3.18-1Dan Walsh 2.3.17-2Dan Walsh 2.3.17-1Dan Walsh 2.3.16-9Dan Walsh 2.3.16-8Dan Walsh 2.3.16-7Dan Walsh 2.3.16-6Dan Walsh 2.3.16-5Dan Walsh 2.3.16-4Dan Walsh 2.3.16-2Dan Walsh 2.3.16-1Dan Walsh 2.3.15-2Dan Walsh 2.3.15-1Dan Walsh 2.3.14-8Dan Walsh 2.3.14-7Dan Walsh 2.3.14-6Dan Walsh 2.3.14-4Dan Walsh 2.3.14-3Dan Walsh 2.3.14-2Dan Walsh 2.3.14-1Dan Walsh 2.3.13-6Dan Walsh 2.3.13-5Dan Walsh 2.3.13-4Dan Walsh 2.3.13-3Dan Walsh 2.3.13-2Dan Walsh 2.3.13-1Dan Walsh 2.3.12-2Dan Walsh 2.3.12-1Dan Walsh 2.3.11-1Dan Walsh 2.3.10-7Dan Walsh 2.3.10-6Dan Walsh 2.3.10-3Dan Walsh 2.3.10-1Dan Walsh 2.3.9-6Dan Walsh 2.3.9-5Dan Walsh 2.3.9-4Dan Walsh 2.3.9-3Dan Walsh 2.3.9-2Dan Walsh 2.3.9-1Dan Walsh 2.3.8-2Dan Walsh 2.3.7-1Dan Walsh 2.3.6-4Dan Walsh 2.3.6-3Dan Walsh 2.3.6-2Dan Walsh 2.3.6-1Dan Walsh 2.3.5-1Dan Walsh 2.3.4-1Dan Walsh 2.3.3-20Dan Walsh 2.3.3-19Dan Walsh 2.3.3-18Dan Walsh 2.3.3-17Dan Walsh 2.3.3-16Dan Walsh 2.3.3-15Dan Walsh 2.3.3-14Dan Walsh 2.3.3-13Dan Walsh 2.3.3-12Dan Walsh 2.3.3-11Dan Walsh 2.3.3-10Dan Walsh 2.3.3-9Dan Walsh 2.3.3-8Dan Walsh 2.3.3-7Dan Walsh 2.3.3-6Dan Walsh 2.3.3-5Dan Walsh 2.3.3-4Dan Walsh 2.3.3-3Dan Walsh 2.3.3-2Dan Walsh 2.3.3-1Dan Walsh 2.3.2-4Dan Walsh 2.3.2-3Dan Walsh 2.3.2-2Dan Walsh 2.3.2-1Dan Walsh 2.3.1-1Dan Walsh 2.2.49-1Dan Walsh 2.2.48-1Dan Walsh 2.2.47-5Dan Walsh 2.2.47-4Dan Walsh 2.2.47-3Dan Walsh 2.2.47-1Dan Walsh 2.2.46-2Dan Walsh 2.2.46-1Dan Walsh 2.2.45-3Dan Walsh 2.2.45-2Dan Walsh 2.2.45-1Dan Walsh 2.2.44-1Dan Walsh 2.2.43-4Dan Walsh 2.2.43-3Dan Walsh 2.2.43-2Dan Walsh 2.2.43-1Dan Walsh 2.2.42-4Dan Walsh 2.2.42-3Dan Walsh 2.2.42-2Dan Walsh 2.2.42-1Dan Walsh 2.2.41-1Dan Walsh 2.2.40-2Dan Walsh 2.2.40-1Dan Walsh 2.2.39-2Dan Walsh 2.2.39-1Dan Walsh 2.2.38-6Dan Walsh 2.2.38-5Dan Walsh 2.2.38-4Dan Walsh 2.2.38-3Dan Walsh 2.2.38-2Dan Walsh 2.2.38-1Dan Walsh 2.2.37-1Dan Walsh 2.2.36-2Dan Walsh 2.2.36-1James Antill 2.2.35-2Dan Walsh 2.2.35-1Dan Walsh 2.2.34-3Dan Walsh 2.2.34-2Dan Walsh 2.2.34-1Dan Walsh 2.2.33-1Dan Walsh 2.2.32-2Dan Walsh 2.2.32-1Dan Walsh 2.2.31-1Dan Walsh 2.2.30-2Dan Walsh 2.2.30-1Dan Walsh 2.2.29-6Russell Coker 2.2.29-5Dan Walsh 2.2.29-4Dan Walsh 2.2.29-3Dan Walsh 2.2.29-2Dan Walsh 2.2.29-1Dan Walsh 2.2.28-3Dan Walsh 2.2.28-2Dan Walsh 2.2.28-1Dan Walsh 2.2.27-1Dan Walsh 2.2.25-3Dan Walsh 2.2.25-2Dan Walsh 2.2.24-1Dan Walsh 2.2.23-19Dan Walsh 2.2.23-18Dan Walsh 2.2.23-17Karsten Hopp 2.2.23-16Dan Walsh 2.2.23-15Dan Walsh 2.2.23-14Dan Walsh 2.2.23-13Dan Walsh 2.2.23-12Jeremy Katz - 2.2.23-11Jeremy Katz - 2.2.23-10Dan Walsh 2.2.23-9Dan Walsh 2.2.23-8Dan Walsh 2.2.23-7Dan Walsh 2.2.23-5Dan Walsh 2.2.23-4Dan Walsh 2.2.23-3Dan Walsh 2.2.23-2Dan Walsh 2.2.23-1Dan Walsh 2.2.22-2Dan Walsh 2.2.22-1Dan Walsh 2.2.21-9Dan Walsh 2.2.21-8Dan Walsh 2.2.21-7Dan Walsh 2.2.21-6Dan Walsh 2.2.21-5Dan Walsh 2.2.21-4Dan Walsh 2.2.21-3Dan Walsh 2.2.21-2Dan Walsh 2.2.21-1Dan Walsh 2.2.20-1Dan Walsh 2.2.19-2Dan Walsh 2.2.19-1Dan Walsh 2.2.18-2Dan Walsh 2.2.18-1Dan Walsh 2.2.17-2Dan Walsh 2.2.16-1Dan Walsh 2.2.15-4Dan Walsh 2.2.15-3Dan Walsh 2.2.15-1Dan Walsh 2.2.14-2Dan Walsh 2.2.14-1Dan Walsh 2.2.13-1Dan Walsh 2.2.12-1Dan Walsh 2.2.11-2Dan Walsh 2.2.11-1Dan Walsh 2.2.10-1Dan Walsh 2.2.9-2Dan Walsh 2.2.9-1Dan Walsh 2.2.8-2Dan Walsh 2.2.7-1Dan Walsh 2.2.6-3Dan Walsh 2.2.6-2Dan Walsh 2.2.6-1Dan Walsh 2.2.5-1Dan Walsh 2.2.4-1Dan Walsh 2.2.3-1Dan Walsh 2.2.2-1Dan Walsh 2.2.1-1Dan Walsh 2.1.13-1Dan Walsh 2.1.12-3Dan Walsh 2.1.11-1Dan Walsh 2.1.10-1Jeremy Katz - 2.1.9-2Dan Walsh 2.1.9-1Dan Walsh 2.1.8-3Dan Walsh 2.1.8-2Dan Walsh 2.1.8-1Dan Walsh 2.1.7-4Dan Walsh 2.1.7-3Dan Walsh 2.1.7-2Dan Walsh 2.1.7-1Dan Walsh 2.1.6-24Dan Walsh 2.1.6-23Dan Walsh 2.1.6-22Dan Walsh 2.1.6-21Dan Walsh 2.1.6-20Dan Walsh 2.1.6-18Dan Walsh 2.1.6-17Dan Walsh 2.1.6-16Dan Walsh 2.1.6-15Dan Walsh 2.1.6-14Dan Walsh 2.1.6-13Dan Walsh 2.1.6-11Dan Walsh 2.1.6-10Dan Walsh 2.1.6-9Dan Walsh 2.1.6-8Dan Walsh 2.1.6-5Dan Walsh 2.1.6-4Dan Walsh 2.1.6-3Dan Walsh 2.1.6-2Dan Walsh 2.1.6-1Dan Walsh 2.1.4-2Dan Walsh 2.1.4-1Dan Walsh 2.1.3-1Jeremy Katz - 2.1.2-3Dan Walsh 2.1.2-2Dan Walsh 2.1.2-1Dan Walsh 2.1.1-3Dan Walsh 2.1.1-2Dan Walsh 2.1.1-1Dan Walsh 2.1.0-3Dan Walsh 2.1.0-2.Dan Walsh 2.1.0-1.Dan Walsh 2.0.11-2.Dan Walsh 2.0.11-1.Dan Walsh 2.0.9-1.Dan Walsh 2.0.8-1.Dan Walsh 2.0.7-3Dan Walsh 2.0.7-2Dan Walsh 2.0.6-2Dan Walsh 2.0.5-4Dan Walsh 2.0.5-1Dan Walsh 2.0.4-1Dan Walsh 2.0.2-2Dan Walsh 2.0.2-1Dan Walsh 2.0.1-2Dan Walsh 2.0.1-1- Allow certmonger add new entries in a generic certificates directory Resolves: rhbz#1879496 - Allow slapd add new entries in ldap certificates directory Resolves: rhbz#1879496 - Add miscfiles_add_entry_generic_cert_dirs() interface Resolves: rhbz#1879496- Allow ssh-keygen create file in /var/lib/glusterd Resolves: rhbz#1867995- Allow rhsmd read process state of all domains and kernel threads Resolves: rhbz#1837461 - Allow ipa-adtrust-install restart sssd and dirsrv services Resolves: rhbz#1820298 - Allow nagios_plugin_domain execute programs in bin directories Resolves: rhbz#1824625 - selinux policy: add the right context for org.freeipa.server.trust-enable-agent Related: rhbz#1820298- Allow chronyd_t domain to exec shell Resolves: rhbz#1775573 - Allow pmie daemon to send signal pcmd daemon Resolves: rhbz#1770123 - Allow auditd poweroff or switch to single mode Resolves: rhbz#1780332- Dontaudit tmpreaper_t getting attributes from sysctl_type files Resolves: rhbz#1765063- Allow tmpreaper_t domain to getattr files labeled as mtrr_device_t Resolves: rhbz#1765063- Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command Resolves: rhbz#1765063- Update tmpreaper_t policy due to fuser command Resolves: rhbz#1765063- Allow tmpreaper_t domain to read all domains state Resolves: rhbz#1765063- Update sudo_role_template() to allow caller domain to read syslog pid files Resolves: rhbz#1651253- Allow sbd_t domain to check presence of processes labeled as cluster_t Resolves: rhbz#1753623- Allow ganesha_t domain to read system network state and connect to cyphesis_port_t Resolves: rhbz#1653857 - Label /var/log/collectd.log as collectd_log_t - Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessions Resolves: rhbz#1688729 - Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t label Resolves: rhbz#1658319 - Update sbd policy to allow manage cgroups Resolves: rhbz#1715136 - Allow sudo userdomain to run rpm related commands - Update rpm_run() interface to avoid duplicate role transition in sudo_role_template Resolves: rhbz#1651253- Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessions Resolves: rhbz#1688729 - Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t label Resolves: rhbz#1658319- Update sbd policy to allow manage cgroups Resolves: rhbz#1715136- Allow cupsd_t domain to manage cupsd_tmp_t temp link files Resolves: rhbz#1719754 - Allow svnserve_t domain to read /dev/random Resolves: rhbz#1727458 - Update sudodomains to make working confined users run sudo/su Resolves: rhbz#1699391- Allow virtlockd process read virtlockd.conf file Resolves: rhbz#1714896- Rebuild selinux-policy build because of broken RHEL-7.8 buildrood during build of selinux-policy-3.13.1-253 Resolves: rhbz#1727341- Label user cron spool file with user_cron_spool_t Resolves: rhbz#1727341 - Allow svnserve_t domain to read system state Resolves: rhbz#1727458 - Update svnserve_t policy to make working svnserve hooks Resolves: rhbz#1727458 - Update gnome_role_template() template to allow sysadm_t confined user to login to xsession Resolves: rhbz#1727379 - Update gnome_role_template() to allow _gkeyringd_t domains to chat with systemd_logind over dbus Resolves: rhbz#1727379 - Allow userdomain gkeyringd domain to create stream socket with userdomain Resolves: rhbz#1727379 - Allow cupsd_t to create lnk_files in /tmp. BZ(1401634) Resolves: rhbz#1719754 - Allow mysqld_t domain to manage cluster pid files Resolves: rhbz#1715805 - Relabel /usr/sbin/virtlockd from virt_exec_t to virtlogd_exec_t. Resolves: rhbz#1714896 - Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domain Resolves: rhbz#1705599 - Allow rhsmcertd_t domain to send signull to all domains Resolves: rhbz#1701338 - Allow cloud_init_t domain to ccreate iptables files with correct SELinux label Resolves: rhbz#1699249 - Allow dnsmasq_t domain to manage NetworkManager_var_lib_t files - Allow certmonger to geattr of filesystems BZ(1578755) - Update tomcat_can_network_connect_db boolean to allow tomcat domains also connect to redis ports Resolves: rhbz#1687497 - Allow lograte_t domain to manage collect_rw_content files and dirs Resolves: rhbz#1658319 - Add interface collectd_manage_rw_content() - Allow glusterd_t domain to setpgid Resolves: rhbz#1653857 - Allow sysadm_sudo_t to use SELinux tooling. Resolves: rhbz#1727341 - Allow sysadm_t domain to create netlink selinux sockets Resolves: rhbz#1727379 - Allow systemd_resolved_t to dbusd chat with NetworkManager_t Resolves: rhbz#1723877 - Allow crack_t domain read /et/passwd files Resolves: rhbz#1721093 - Allow sysadm_t domain to dbus chat with rtkit daemon Resolves: rhbz#1720546 - Allow x_userdomains to nnp domain transition to thumb_t domain Resolves: rhbz#1712603 - Dontaudit writing to user home dirs by gnome-keyring-daemon Resolves: rhbz#1703959 - Update logging_send_audit_msgs(sudodomain() to control TTY auditing for netlink socket for audit service Resolves: rhbz#1699391 - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files Resolves: rhbz#1699063 - Add interface kernel_relabelfrom_usermodehelper()- Allow sbd_t domain to use nsswitch Resolves: rhbz#1728593- Allow ganesha_t domain to connect to tcp portmap_port_t Resolves: rhbz#1715088- Allow redis to creating tmp files with own label Resolves: rhbz#1646765- Allow ctdb_t domain to manage samba_var_t files/links/sockets and dirs Resolves: rhbz#1716400- Allow nrpe_t domain to read process state of systemd_logind_t - Add interface systemd_logind_read_state() Resolves: rhbz#1653309- Label /etc/rhsm as rhsmcertd_config_t Resolves: rhbz#1703573- Fix typo in gpg SELinux module - Update gpg policy to make ti working with confined users Resolves: rhbz#1535109 - Alow nrpe_t to send signull to sssd domain when nagios_run_sudo boolean is turned on Resolves: rhbz#1653309 - Allow nrpe_t domain to be dbus cliennt Resolves: rhbz#1653309 - Add interface sssd_signull() Resolves: rhbz#1653309 - Update userdomains to allow confined users to create gpg keys Resolves: rhbz#1535109- Allow ngaios to use chown capability Resolves: rhbz#1653309 - Dontaudit gpg_domain to create netlink_audit sockets Resolves: rhbz#1535109 - Update fs_rw_cephfs_files() interface to allow also caller domain to read/write cephpfs_t lnk files Resolves: rhbz#1558836 - Update domain_can_mmap_files() boolean to allow also mmap lnk files- Allow rhsmcertd_t domain to read yum.log file labeled as rpm_log_t Resolves: rhbz#1695342- Update Nagios policy when sudo is used Resolves: rhbz#1653309- Allow modemmanager_t domain to write to raw_ip file labeled as sysfs_t Resolves: rhbz#1676810- Make shell_exec_t type as entrypoint for vmtools_unconfined_t. Resolves: rhbz#1656814- Update vmtools policy Resolves: rhbz#1656814 Allow domain transition from vmtools_t to vmtools_unconfined_t when shell_exec_t is entrypoint. - Allow virt_qemu_ga_t domain to read udev_var_run_t files Resolves: rhbz#1663092 - Update nagios_run_sudo boolean with few allow rules related to accessing sssd Resolves: rhbz#1653309 - Allow nfsd_t to read nvme block devices BZ(1562554) Resolves: rhbz#1655493 - Allow tangd_t domain to bind on tcp ports labeled as tangd_port_t Resolves: rhbz#1650909 - Allow all domains to send dbus msgs to vmtools_unconfined_t processes Resolves: rhbz#1656814 - Label /dev/pkey as crypt_device_t Resolves: rhbz#1623068 - Allow sudodomains to write to systemd_logind_sessions_t pipes. Resolves: rhbz#1687452 - Allow all user domains to read realmd_var_lib_t files and dirs to check if IPA is configured on the system Resolves: rhbz#1667962 - Fixes: xenconsole does not start Resolves: rhbz#1601525 - Label /usr/lib64/libcuda.so.XX.XX library as textrel_shlib_t. Resolves: rhbz#1636197 - Create tangd_port_t with default label tcp/7406 Resolves: rhbz#1650909- named wants to access /proc/sys/net/ipv4/ip_local_port_range to get ehphemeral range. Resolves: rhbz#1683754 - Allow sbd_t domain to bypass permission checks for sending signals Resolves: rhbz#1671132 - Allow sbd_t domain read/write all sysctls Resolves: rhbz#1671132 - Allow kpatch_t domain to communicate with policykit_t domsin over dbus Resolves: rhbz#1602435 - Allow boltd_t to stream connect to sytem dbus Resolves: rhbz#1589086 - Update userdom_admin_user_template() and init_prog_run_bpf() interfaces to make working bpftool for confined admin Resolves: rhbz#1626115 - Update unconfined_dbus_send() interface to allow both direction communication over dbus with unconfined process. Resolves: rhbz#1589086- Allow sbd_t domain read/write all sysctls Resolves: rhbz#1671132 - Allow kpatch_t domain to communicate with policykit_t domsin over dbus Resolves: rhbz#1602435 - Allow boltd_t to stream connect to sytem dbus Resolves: rhbz#1589086 - Update unconfined_dbus_send() interface to allow both direction communication over dbus with unconfined process. Resolves: rhbz#1589086- Update redis_enable_notify() boolean to fix sending e-mail by redis when this boolean is turned on Resolves: rhbz#1646765- Allow virtd_lxc_t domains use BPF Resolves: rhbz#1626115 - F29 NetworkManager implements a new code for IPv4 address conflict detection (RFC 5227) based on n-acd [1], which uses eBPF to process ARP packets from the network. Resolves: rhbz#1626115 - Allow unconfined user all perms under bpf class BZ(1565738 Resolves: rhbz#1626115 - Allow unconfined and sysadm users to use bpftool BZ(1591440) Resolves: rhbz#1626115 - Allow systemd to manage bpf dirs/files Resolves: rhbz#1626115 - Create new type bpf_t and label /sys/fs/bpf with this type Resolves:rhbz#1626115 - Add new interface init_prog_run_bpf() Resolves:rhbz#1626115 - add definition of bpf class and systemd perms Resolves: rhbz#1626115- Update policy with multiple allow rules to make working installing VM in MLS policy Resolves: rhbz#1558121 - Allow virt domain to use interited virtlogd domains fifo_file Resolves: rhbz#1558121 - Allow chonyc_t domain to rw userdomain pipes Resolves: rhbz#1618757 - Add file contexts in ganesha.fc file to label logging ganesha files properly. Resolves: rhbz#1628247- Allow sandbox_xserver_t domain write to user_tmp_t files Resolves: rhbz#1646521 - Allow virt_qemu_ga_t domain to read network state Resolves: rhbz#1630347 - Bolt added d-bus API for force-powering the thunderbolt controller, so system-dbusd needs acces to boltd pipes Resolves: rhbz#1589086 - Add boltd policy Resolves: rhbz#1589086 - Allow virt domains to read/write cephfs filesystems Resolves: rhbz#1558836 - Allow gpg_t to create own tmpfs dirs and sockets Resolves: rhbz#1535109 - Allow gpg_agent_t to send msgs to syslog/journal Resolves: rhbz#1535109 - Allow virtual machine to write to fixed_disk_device_t Resolves: rhbz#1499208 - Update kdump_manage_crash() interface to allow also manage dirs by caller domain Resolves: rhbz#1491585 - Add kpatch policy Resolves: rhbz#1602435 - Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_t Resolves: rhbz#1623942 - Allow svnserve_t domain to create in /tmp svn_0 file labeled as krb5_host_rcache_t Resolves: rhbz#1475271 - Allow systemd to mount boltd_var_run_t dirs Resolves: rhbz#1589086 - Allow systemd to mounont boltd lib dirs Resolves: rhbz#1589086 - Allow sysadm_t,staff_t and unconfined_t domain to execute kpatch as kpatch_t domain Resolves: rhbz#1602435 - Allow passwd_t domain chroot - Add miscfiles_filetrans_named_content_letsencrypt() to optional_block - Allow unconfined domains to create letsencrypt directory in /var/lib labeled as cert_t Resolves: rhbz#1447278 - Allow staff_t user to systemctl iptables units. Resolves: rhbz#1360470- Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_t Resolves: rhbz#1623942 - Allow svnserve_t domain to create in /tmp svn_0 file labeled as krb5_host_rcache_t Resolves: rhbz#1475271 - Allow passwd_t domain chroot - Add miscfiles_filetrans_named_content_letsencrypt() to optional_block - Allow unconfined domains to create letsencrypt directory in /var/lib labeled as cert_t Resolves: rhbz#1447278 - Allow staff_t user to systemctl iptables units. Resolves: rhbz#1360470- Allow gssd_t domain to manage kernel keyrings of every domain. Resolves: rhbz#1487350 - Add new interface domain_manage_all_domains_keyrings() Resolves: rhbz#1487350- Allow gssd_t domain to read/write kernel keyrings of every domain. Resolves: rhbz#1487350 - Add interface domain_rw_all_domains_keyrings() Resolves: rhbz#1487350- Update snapperd policy to allow snapperd manage all non security dirs. Resolves: rhbz#1619306-Allow nova_t domain to use pam Resolves: rhbz:#1640528 - sysstat: grant sysstat_t the search_dir_perms set Resolves: rhbz#1637416 - Allow cinder_volume_t domain to dbus chat with systemd_logind_t domain Resolves: rhbz#1630318 - Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging' Resolves: rhbz#1564470 - Make ganesha policy active again Resolves: rhbz#1511489- Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module Resolves: rhbz#1638257- Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging' Resolves: rhbz#1638427- Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t Resolves: rhbz#1638257- Fix missing patch in spec file Resolves: rhbz#1635704- Allow cinder_volume_t domain to dbus chat with systemd_logind_t domain Resolves: rhbz#1635704- Allow neutron domain to read/write /var/run/utmp Resolves: rhbz#1630318- Allow tomcat_domain to read /dev/random Resolves: rhbz#1631666 - Allow neutron_t domain to use pam Resolves: rhbz#1630318- Add interface apache_read_tmp_dirs() - Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs Resolves: rhbz#1622602- Allow tomcat servers to manage usr_t files Resolves: rhbz#1625678 - Dontaudit tomcat serves to append to /dev/random device Resolves: rhbz#1625678 - Allow sys_nice capability to mysqld_t domain - Allow dirsrvadmin_script_t domain to read httpd tmp files Resolves: rhbz#1622602 - Allow syslogd_t domain to manage cert_t files Resolves: rhbz#1615995- Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs Resolves: rhbz#1627114 - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t Resolves: rhbz#1567753- Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs. Resolves: rhbz#1625678 - Allow chronyd_t domain to read virt_var_lib_t files - Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333) Resolves: rhbz#1625613 - Allow tomcat services create link file in /tmp Resolves: rhbz#1624289 - Add boolean: domain_can_mmap_files. Resolves: rhbz#1460322- Make working SELinux sandbox with Wayland. Resolves: rhbz#1624308 - Allow svirt_t domain to mmap svirt_image_t block files Resolves: rhbz#1624224 - Add caps dac_read_search and dav_override to pesign_t domain - Allow iscsid_t domain to mmap userio chr files Resolves: rhbz#1623589 - Add boolean: domain_can_mmap_files. Resolves: rhbz#1460322 - Add execute_no_trans permission to mmap_exec_file_perms pattern - Allow sudodomain to search caller domain proc info - Allow xdm_t domain to mmap and read cert_t files - Replace optional policy blocks to make dbus interfaces effective Resolves: rhbz#1624414 - Add interface dev_map_userio_dev()- Allow readhead_t domain to mmap own pid files Resolves: rhbz#1614169- Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket - Allow httpd_t domain to mmap tmp files Resolves: rhbz#1608355 - Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files - Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks - Label /dev/tpmrm[0-9]* as tpm_device_t - Allow semanage_t domain mmap usr_t files Resolves: rhbz#1622607 - Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t- Allow nagios_script_t domain to mmap nagios_log_t files Resolves: rhbz#1620013 - Allow nagios_script_t domain to mmap nagios_spool_t files Resolves: rhbz#1620013 - Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctl Resolves: rhbz#1622197 - Update selinux_validate_context() interface to allow caller domain to mmap security_t files Resolves: rhbz#1622061- Allow virtd_t domain to create netlink_socket - Allow rpm_t domain to write to audit - Allow rpm domain to mmap rpm_var_lib_t files Resolves: rhbz#1619785 - Allow nagios_script_t domain to mmap nagios_etc_t files Resolves: rhbz#1620013 - Update nscd_socket_use() to allow caller domain to stream connect to nscd_t Resolves: rhbz#1460715 - Allow secadm_t domain to mmap audit config and log files - Allow insmod_t domain to read iptables pid files - Allow systemd to mounton /etc Resolves: rhbz#1619785- Allow kdumpctl_t domain to getattr fixed disk device in mls Resolves: rhbz#1615342 - Allow initrc_domain to mmap all binaries labeled as systemprocess_entry Resolves: rhbz#1615342- Allow virtlogd to execute itself Resolves: rhbz#1598392- Allow kdumpctl_t domain to manage kdumpctl_tmp_t fifo files Resolves: rhbz#1615342 - Allow kdumpctl to write to files on all levels Resolves: rhbz#1615342 - Fix typo in radius policy Resolves: rhbz#1619197 - Allow httpd_t domain to mmap httpd_config_t files Resolves: rhbz#1615894 - Add interface dbus_acquire_svc_system_dbusd() - Allow sanlock_t domain to connectto to unix_stream_socket Resolves: rhbz#1614965 - Update nfsd_t policy because of ganesha features Resolves: rhbz#1511489 - Allow conman to getattr devpts_t Resolves: rhbz#1377915 - Allow tomcat_domain to connect to smtp ports Resolves: rhbz#1253502 - Allow tomcat_t domain to mmap tomcat_var_lib_t files Resolves: rhbz#1618519 - Allow slapd_t domain to mmap slapd_var_run_t files Resolves: rhbz#1615319 - Allow nagios_t domain to mmap nagios_log_t files Resolves: rhbz#1618675 - Allow nagios to exec itself and mmap nagios spool files BZ(1559683) - Allow nagios to mmap nagios config files BZ(1559683) - Allow kpropd_t domain to mmap krb5kdc_principal_t files Resolves: rhbz#1619252 - Update syslogd policy to make working elasticsearch - Label tcp and udp ports 9200 as wap_wsp_port - Allow few domains to rw inherited kdumpctl tmp pipes Resolves: rhbz#1615342- Allow systemd_dbusd_t domain read/write to nvme devices Resolves: rhbz#1614236 - Allow mysqld_safe_t do execute itself - Allow smbd_t domain to chat via dbus with avahi daemon Resolves: rhbz#1600157 - cupsd_t domain will create /etc/cupsd/ppd as cupsd_etc_rw_t Resolves: rhbz#1452595 - Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645) Resolves: rhbz#1452444 - Update screen_role_template to allow caller domain to have screen_exec_t as entrypoint do new domain Resolves: rhbz#1384769 - Add alias httpd__script_t to _script_t to make sepolicy generate working Resolves: rhbz#1271324 - Allow kprop_t domain to read network state Resolves: rhbz#1600705 - Allow sysadm_t domain to accept socket Resolves: rhbz#1557299 - Allow sshd_t domain to mmap user_tmp_t files Resolves: rhbz#1613437- Allow sshd_t domain to mmap user_tmp_t files Resolves: rhbz#1613437- Allow kprop_t domain to read network state Resolves: rhbz#1600705- Allow kpropd domain to exec itself Resolves: rhbz#1600705 - Allow ipmievd_t to mmap kernel modules BZ(1552535) - Allow hsqldb_t domain to mmap own temp files Resolves: rhbz#1612143 - Allow hsqldb_t domain to read cgroup files Resolves: rhbz#1612143 - Allow rngd_t domain to read generic certs Resolves: rhbz#1612456 - Allow innd_t domain to mmap own var_lib_t files Resolves: rhbz#1600591 - Update screen_role_temaplate interface Resolves: rhbz#1384769 - Allow cupsd_t to create cupsd_etc_t dirs Resolves: rhbz#1452595 - Allow chronyd_t domain to mmap own tmpfs files Resolves: rhbz#1596563 - Allow cyrus domain to mmap own var_lib_t and var_run files Resolves: rhbz#1610374 - Allow sysadm_t domain to create rawip sockets Resolves: rhbz#1571591 - Allow sysadm_t domain to listen on socket Resolves: rhbz#1557299 - Update sudo_role_template() to allow caller domain also setattr generic ptys Resolves: rhbz#1564470 - Allow netutils_t domain to create bluetooth sockets Resolves: rhbz#1600586- Allow innd_t domain to mmap own var_lib_t files Resolves: rhbz#1600591 - Update screen_role_temaplate interface Resolves: rhbz#1384769 - Allow cupsd_t to create cupsd_etc_t dirs Resolves: rhbz#1452595 - Allow chronyd_t domain to mmap own tmpfs files Resolves: rhbz#1596563 - Allow cyrus domain to mmap own var_lib_t and var_run files Resolves: rhbz#1610374 - Allow sysadm_t domain to create rawip sockets Resolves: rhbz#1571591 - Allow sysadm_t domain to listen on socket Resolves: rhbz#1557299 - Update sudo_role_template() to allow caller domain also setattr generic ptys Resolves: rhbz#1564470 - Allow netutils_t domain to create bluetooth sockets Resolves: rhbz#1600586- Allow virtlogd_t domain to chat via dbus with systemd_logind Resolves: rhbz#1593740- Allow sblim_sfcbd_t domain to mmap own tmpfs files Resolves: rhbz#1609384 - Update logging_manage_all_logs() interface to allow caller domain map all logfiles Resolves: rhbz#1592028- Dontaudit oracleasm_t domain to request sys_admin capability - Allow iscsid_t domain to load kernel module Resolves: rhbz#1589295 - Update rhcs contexts to reflects the latest fenced changes - Allow httpd_t domain to rw user_tmp_t files Resolves: rhbz#1608355 - /usr/libexec/udisks2/udisksd should be labeled as devicekit_disk_exec_t Resolves: rhbz#1521063 - Allow tangd_t dac_read_search Resolves: rhbz#1607810 - Allow glusterd_t domain to mmap user_tmp_t files - Allow mongodb_t domain to mmap own var_lib_t files Resolves: rhbz#1607729 - Allow iscsid_t domain to mmap sysfs_t files Resolves: rhbz#1602508 - Allow tomcat_domain to search cgroup dirs Resolves: rhbz#1600188 - Allow httpd_t domain to mmap own cache files Resolves: rhbz#1603505 - Allow cupsd_t domain to mmap cupsd_etc_t files Resolves: rhbz#1599694 - Allow kadmind_t domain to mmap krb5kdc_principal_t Resolves: rhbz#1601004 - Allow virtlogd_t domain to read virt_etc_t link files Resolves: rhbz#1598593 - Allow dirsrv_t domain to read crack db Resolves: rhbz#1599726 - Dontaudit pegasus_t to require sys_admin capability Resolves: rhbz#1374570 - Allow mysqld_t domain to exec mysqld_exec_t binary files - Allow abrt_t odmain to read rhsmcertd lib files Resolves: rhbz#1601389 - Allow winbind_t domain to request kernel module loads Resolves: rhbz#1599236 - Allow gpsd_t domain to getsession and mmap own tmpfs files Resolves: rhbz#1598388 - Allow smbd_t send to nmbd_t via dgram sockets BZ(1563791) Resolves: rhbz#1600157 - Allow tomcat_domain to read cgroup_t files Resolves: rhbz#1601151 - Allow varnishlog_t domain to mmap varnishd_var_lib_t files Resolves: rhbz#1600704 - Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415) Resolves: rhbz#1600692 - Fix ntp SELinux module - Allow innd_t domain to mmap news_spool_t files Resolves: rhbz#1600591 - Allow haproxy daemon to reexec itself. BZ(1447800) Resolves: rhbz#1600578 - Label HOME_DIR/mozilla.pdf file as mozilla_home_t instead of user_home_t Resolves: rhbz#1559859 - Allow pkcs_slotd_t domain to mmap own tmpfs files Resolves: rhbz#1600434 - Allow fenced_t domain to reboot Resolves: rhbz#1293384 - Allow bluetooth_t domain listen on bluetooth sockets BZ(1549247) Resolves: rhbz#1557299 - Allow lircd to use nsswitch. BZ(1401375) - Allow targetd_t domain mmap lvm config files Resolves: rhbz#1546671 - Allow amanda_t domain to read network system state Resolves: rhbz#1452444 - Allow abrt_t domain to read rhsmcertd logs Resolves: rhbz#1492059 - Allow application_domain_type also mmap inherited user temp files BZ(1552765) Resolves: rhbz#1608421 - Allow ipsec_t domain to read l2tpd pid files Resolves: rhbz#1607994 - Allow systemd_tmpfiles_t do mmap system db files - Improve domain_transition_pattern to allow mmap entrypoint bin file. Resolves: rhbz#1460322 - Allow nsswitch_domain to mmap passwd_file_t files BZ(1518655) Resolves: rhbz#1600528 - Dontaudit syslogd to watching top llevel dirs when imfile module is enabled Resolves: rhbz#1601928 - Allow ipsec_t can exec ipsec_exec_t Resolves: rhbz#1600684 - Allow netutils_t domain to mmap usmmon device Resolves: rhbz#1600586 - Allow netlabel_mgmt_t domain to read sssd public files, stream connect to sssd_t BZ(1483655) - Allow userdomain sudo domains to use generic ptys Resolves: rhbz#1564470 - Allow traceroute to create icmp packets Resolves: rhbz#1548350 - Allow systemd domain to mmap lvm config files BZ(1594584) - Add new interface lvm_map_config - refpolicy: Update for kernel sctp support Resolves: rhbz#1597111 Add additional entries to support the kernel SCTP implementation introduced in kernel 4.16- Update oddjob_domtrans_mkhomedir() interface to allow caller domain also mmap oddjob_mkhomedir_exec_t files Resolves: rhbz#1596306 - Update rhcs_rw_cluster_tmpfs() interface to allow caller domain to mmap cluster_tmpfs_t files Resolves: rhbz#1589257 - Allow radiusd_t domain to read network sysctls Resolves: rhbz#1516233 - Allow chronyc_t domain to use nscd shm Resolves: rhbz#1596563 - Label /var/lib/tomcats dir as tomcat_var_lib_t Resolves: rhbz#1596367 - Allow lsmd_t domain to mmap lsmd_plugin_exec_t files Resolves: rhbz#bea0c8174 - Label /usr/sbin/rhn_check-[0-9]+.[0-9]+ as rpm_exec_t Resolves: rhbz#1596509 - Update seutil_exec_loadpolicy() interface to allow caller domain to mmap load_policy_exec_t files Resolves: rhbz#1596072 - Allow xdm_t to read systemd hwdb Resolves: rhbz#1596720 - Allow dhcpc_t domain to mmap files labeled as ping_exec_t Resolves: rhbz#1596065- Allow tangd_t domain to create tcp sockets Resolves: rhbz#1595775 - Update postfix policy to allow postfix_master_t domain to mmap all postfix* binaries Resolves: rhbz#1595328 - Allow amanda_t domain to have setgid capability Resolves: rhbz#1452444 - Update usermanage_domtrans_useradd() to allow caller domain to mmap useradd_exec_t files Resolves: rhbz#1595667- Allow abrt_watch_log_t domain to mmap binaries with label abrt_dump_oops_exec_t Resolves: rhbz#1591191 - Update cups_filetrans_named_content() to allow caller domain create ppd directory with cupsd_etc_rw_t label Resolves: rhbz#1452595 - Allow abrt_t domain to write to rhsmcertd pid files Resolves: rhbz#1492059 - Allow pegasus_t domain to eexec lvm binaries and allow read/write access to lvm control Resolves: rhbz#1463470 - Add vhostmd_t domain to read/write to svirt images Resolves: rhbz#1465276 - Dontaudit action when abrt-hook-ccpp is writing to nscd sockets Resolves: rhbz#1460715 - Update openvswitch policy Resolves: rhbz#1594729 - Update kdump_manage_kdumpctl_tmp_files() interface to allow caller domain also mmap kdumpctl_tmp_t files Resolves: rhbz#1583084 - Allow sssd_t and slpad_t domains to mmap generic certs Resolves: rhbz#1592016 Resolves: rhbz#1592019 - Allow oddjob_t domain to mmap binary files as oddjob_mkhomedir_exec_t files Resolves: rhbz#1592022 - Update dbus_system_domain() interface to allow system_dbusd_t domain to mmap binary file from second parameter Resolves: rhbz#1583080 - Allow chronyc_t domain use inherited user ttys Resolves: rhbz#1593267 - Allow stapserver_t domain to mmap own tmp files Resolves: rhbz#1593122 - Allow sssd_t domain to mmap files labeled as sssd_selinux_manager_exec_t Resolves: rhbz#1592026 - Update policy for ypserv_t domain Resolves: rhbz#1592032 - Allow abrt_dump_oops_t domain to mmap all non security files Resolves: rhbz#1593728 - Allow svirt_t domain mmap svirt_image_t files Resolves: rhbz#1592688 - Allow virtlogd_t domain to write inhibit systemd pipes. Resolves: rhbz#1593740 - Allow sysadm_t and staff_t domains to use sudo io logging Resolves: rhbz#1564470 - Allow sysadm_t domain create sctp sockets Resolves: rhbz#1571591 - Update mount_domtrans() interface to allow caller domain mmap mount_exec_t Resolves: rhbz#1592025 - Allow dhcpc_t to mmap all binaries with label hostname_exec_t, ifconfig_exec_t and netutils_exec_t Resolves: rhbz#1594661- Fix typo in logwatch interface file - Allow spamd_t to manage logwatch_cache_t files/dirs - Allow dnsmasw_t domain to create own tmp files and manage mnt files - Allow fail2ban_client_t to inherit rlimit information from parent process Resolves: rhbz#1513100 - Allow nscd_t to read kernel sysctls Resolves: rhbz#1512852 - Label /var/log/conman.d as conman_log_t Resolves: rhbz#1538363 - Add dac_override capability to tor_t domain Resolves: rhbz#1540711 - Allow certmonger_t to readwrite to user_tmp_t dirs Resolves: rhbz#1543382 - Allow abrt_upload_watch_t domain to read general certs Resolves: rhbz#1545098 - Update postfix_domtrans_master() interface to allow caller domain also mmap postfix_master_exec_t binary Resolves: rhbz#1583087 - Allow postfix_domain to mmap postfix_qmgr_exec_t binaries Resolves: rhbz#1583088 - Allow postfix_domain to mmap postfix_pickup_exec_t binaries Resolves: rhbz#1583091 - Allow chornyd_t read phc2sys_t shared memory Resolves: rhbz#1578883 - Allow virt_qemu_ga_t read utmp Resolves: rhbz#1571202 - Add several allow rules for pesign policy: Resolves: rhbz#1468744 - Allow pesign domain to read /dev/random - Allow pesign domain to create netlink_kobject_uevent_t sockets - Allow pesign domain create own tmp files - Add setgid and setuid capabilities to mysqlfd_safe_t domain Resolves: rhbz#1474440 - Add tomcat_can_network_connect_db boolean Resolves: rhbz#1477948 - Update virt_use_sanlock() boolean to read sanlock state Resolves: rhbz#1448799 - Add sanlock_read_state() interface - Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026) Resolves: rhbz#1563423 - Update abrt_domtrans and abrt_exec() interfaces to allow caller domain to mmap binary file Resolves:rhbz#1583080 - Update nscd_domtrans and nscd_exec interfaces to allow caller domain also mmap nscd binaries Resolves: rhbz#1583086 - Update snapperd_domtrans() interface to allow caller domain to mmap snapperd_exec_t file Resolves: rhbz#1583802 - Allow zoneminder_t to getattr of fs_t Resolves: rhbz#1585328 - Fix denials during ipa-server-install process on F27+ Resolves: rhbz#1586029 - Allow ipa_dnskey_t to exec ipa_dnskey_exec_t files Resolves: rhbz#1586033 - Allow rhsmcertd_t domain to send signull to postgresql_t domain Resolves: rhbz#1588119 - Allow policykit_t domain to dbus chat with dhcpc_t Resolves: rhbz#1364513 - Adding new boolean keepalived_connect_any() Resolves: rhbz#1443473 - Allow amanda to create own amanda_tmpfs_t files Resolves: rhbz#1452444 - Add amanda_tmpfs_t label. BZ(1243752) - Allow gdomap_t domain to connect to qdomap_port_t Resolves: rhbz#1551944 - Fix typos in sge - Fix typo in openvswitch policy - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type - Allow sshd_keygen_t to execute plymouthd Resolves: rhbz#1583531 - Update seutil_domtrans_setfiles() interface to allow caller domain to do mmap on setfiles_exec_t binary Resolves: rhbz#1583090 - Allow systemd_networkd_t create and relabel tun sockets Resolves: rhbz#1583830 - Allow map audisp_exec_t files fordomains executing this binary Resolves: rhbz#1586042 - Add new interface postgresql_signull() - Add fs_read_xenfs_files() interface.- /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type - Allow dac override capability to mandb_t domain BZ(1529399) Resolves: rhbz#1423361 - Allow inetd_child process to chat via dbus with abrt Resolves: rhbz#1428805 - Allow zabbix_agent_t domain to connect to redis_port_t Resolves: rhbz#1418860 - Allow rhsmcertd_t domain to read xenfs_t files Resolves: rhbz#1405870 - Allow zabbix_agent_t to run zabbix scripts Resolves: rhbz#1380697 - Allow rabbitmq_t domain to create own tmp files/dirs Resolves: rhbz#1546897 - Allow policykit_t mmap policykit_auth_exec_t files Resolves: rhbz#1583082 - Allow ipmievd_t domain to read general certs Resolves: rhbz#1514591 - Add sys_ptrace capability to pcp_pmie_t domain - Allow squid domain to exec ldconfig Resolves: rhbz#1532017 - Make working gpg agent in gpg_agent_t domain Resolves: rhbz#1535109 - Update gpg SELinux policy module - Allow kexec to read kernel module files in /usr/lib/modules. Resolves: rhbz#1536690 - Allow mailman_domain to read system network state Resolves: rhbz#1413510 - Allow mailman_mail_t domain to search for apache configs Resolves: rhbz#1413510 - Allow openvswitch_t domain to read neutron state and read/write fixed disk devices Resolves: rhbz#1499208 - Allow antivirus_domain to read all domain system state Resolves: rhbz#1560986 - Allow targetd_t domain to red gconf_home_t files/dirs Resolves: rhbz#1546671 - Allow freeipmi domain to map sysfs_t files Resolves: rhbz#1575918 - Label /usr/libexec/bluetooth/obexd as obexd_exec_t Resolves: rhbz#1351750 - Update rhcs SELinux module Resolves: rhbz#1589257 - Allow iscsid_t domain mmap kernel modules Resolves: rhbz#1589295 - Allow iscsid_t domain mmap own tmp files Resolves: rhbz#1589295 - Update iscsid_domtrans() interface to allow mmap iscsid_exec_t binary Resolves: rhbz#1589295 - Update nscd_socket_use interface to allow caller domain also mmap nscd_var_run_t files. Resolves: rhbz#1589271 - Allow nscd_t domain to mmap system_db_t files Resolves: rhbz#1589271 - Add interface nagios_unconfined_signull() - Allow lircd_t domain read sssd public files Add setgid capability to lircd_t domain Resolves: rhbz#1550700 - Add missing requires - Allow tomcat domain sends email Resolves: rhbz#1585184 - Allow memcached_t domain nnp_transition becuase of systemd security features BZ(1514867) Resolves: rhbz#1585714 - Allow kdump_t domain to map /boot files Resolves: rhbz#1588884 - Fix typo in netutils policy - Allow confined users get AFS tokens Resolves: rhbz#1417671 - Allow sysadm_t domain to chat via dbus Resolves: rhbz#1582146 - Associate sysctl_kernel_t type with filesystem attribute - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets Resolves: rhbz#1557299 - Allow user_t and staff_t domains create netlink tcpdiag sockets Resolves: rhbz#1557281 - Add interface dev_map_sysfs - Allow xdm_t domain to execute xdm_var_lib_t files Resolves: rhbz#1589139 - Allow syslogd_t domain to send signull to nagios_unconfined_plugin_t Resolves: rhbz#1569344 - Label /dev/vhost-vsock char device as vhost_device_t - Add files_map_boot_files() interface Resolves: rhbz#1588884 - Update traceroute_t domain to allow create dccp sockets Resolves: rhbz#1548350- Update ctdb domain to support gNFS setup Resolves: rhbz#1576818 - Allow authconfig_t dbus chat with policykit Resolves: rhbz#1551241 - Allow lircd_t domain to read passwd_file_t Resolves: rhbz:#1550700 - Allow lircd_t domain to read system state Resolves: rhbz#1550700 - Allow smbcontrol_t to mmap samba_var_t files and allow winbind create sockets BZ(1559795) Resolves: rhbz#1574521 - Allow tangd_t domain read certs Resolves: rhbz#1509055 - Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db is turned on Resolves: rhbz:#1579219 - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp Resolves: rhbz#1574418 - Allow ctdb_t domain modify ctdb_exec_t files Resolves: rhbz#1572584 - Allow chrome_sandbox_t to mmap tmp files Resolves: rhbz#1574392 - Allow ulogd_t to create netlink_netfilter sockets. Resolves: rhbz#1575924 - Update ulogd SELinux security policy - Allow rhsmcertd_t domain send signull to apache processes Resolves: rhbz#1576555 - Allow freeipmi domain to read sysfs_t files Resolves: rhbz#1575918 - Allow smbcontrol_t to create dirs with samba_var_t label Resolves: rhbz#1574521 - Allow swnserve_t domain to stream connect to sasl domain Resolves: rhbz#1574537 - Allow SELinux users (except guest and xguest) to using bluetooth sockets Resolves: rhbz#1557299 - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets Resolves: rhbz#1557299 - Fix broken sysadm SELinux module Resolves: rhbz#1557311 - Allow user_t and staff_t domains create netlink tcpdiag sockets Resolves: rhbz#1557281 - Update ssh_domtrans_keygen interface to allow mmap ssh_keygen_exec_t binary file Resolves: rhbz#1583089 - Allow systemd_networkd_t to read/write tun tap devices Resolves: rhbz#1583830 - Add bridge_socket, dccp_socket, ib_socket and mpls_socket to socket_class_set Resolves: rhbz#1583771 - Allow audisp_t domain to mmap audisp_exec_t binary Resolves: rhbz#1583551 - Fix duplicates in sysadm.te file Resolves: rhbz#1307183 - Allow sysadm_u use xdm Resolves: rhbz#1307183 - Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Fix duplicates in sysadm.te file Resolves: rhbz#1307183- Allow sysadm_u use xdm Resolves: rhbz#1307183- Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db is turned on Resolves: rhbz:#1579219 - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp Resolves: rhbz#1574418 - Allow chrome_sandbox_t to mmap tmp files Resolves: rhbz#1574392 - Allow ulogd_t to create netlink_netfilter sockets. Resolves: rhbz#1575924 - Update ulogd SELinux security policy - Allow rhsmcertd_t domain send signull to apache processes Resolves: rhbz#1576555 - Allow freeipmi domain to read sysfs_t files Resolves: rhbz#1575918 - Allow smbcontrol_t to create dirs with samba_var_t label Resolves: rhbz#1574521 - Allow swnserve_t domain to stream connect to sasl domain Resolves: rhbz#1574537 - Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Fix typo in sysnetwork.if file Resolves: rhbz#1581551- Improve procmail_domtrans() to allow mmaping procmail_exec_t - Allow hypervvssd_t domain to read fixed disk devices Resolves: rhbz#1581225 - Improve modutils_domtrans_insmod() interface to mmap insmod_exec_t binaries Resolves: rhbz#1581551 - Improve iptables_domtrans() interface to allow mmaping iptables_exec_t binary Resolves: rhbz#1581551 - Improve auth_domtrans_login_programinterface to allow also mmap login_exec_t binaries Resolves: rhbz#1581551 - Improve auth_domtrans_chk_passwd() interface to allow also mmaping chkpwd_exec_t binaries. Resolves: rhbz#1581551 - Allow mmap dhcpc_exec_t binaries in sysnet_domtrans_dhcpc interface- Add dbus_stream_connect_system_dbusd() interface. - Allow pegasus_t domain to mount tracefs_t filesystem Resolves:rhbz#1374570 - Allow psad_t domain to read all domains state Resolves: rhbz#1558439 - Add net_raw capability to named_t domain BZ(1545586) - Allow tomcat_t domain to connect to mongod_t tcp port Resolves:rhbz#1539748 - Allow dovecot and postfix to connect to systemd stream sockets Resolves: rhbz#1368642 - Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t Resolves:rhbz#1351750 - Rename tang policy to tangd - Add interface systemd_rfkill_domtrans() - Allow users staff and sysadm to run wireshark on own domain Resolves:rhbz#1546362 - Allow systemd-bootchart to create own tmpfs files Resolves:rhbz#1510412- Rename tang policy to tangd - Allow virtd_t domain to relabel virt_var_lib_t files Resolves: rhbz#1558121 - Allow logrotate_t domain to stop services via systemd Resolves: rhbz#1527522 - Add tang policy Resolves: rhbz#1509055 - Allow mozilla_plugin_t to create mozilla.pdf file in user homedir with label mozilla_home_t Resolves: rhbz#1559859 - Improve snapperd SELinux policy Resolves: rhbz#1365555 - Allow snapperd_t daemon to create unlabeled dirs. Resolves: rhbz#1365555 - We have inconsistency in cgi templates with upstream, we use _content_t, but refpolicy use httpd__content_t. Created aliasses to make it consistence Resolves: rhbz#1271324 - Allow Openvswitch adding netdev bridge ovs 2.7.2.10 FDP Resolves: rhbz#1503835 - Add new Boolean tomcat_use_execmem Resolves: rhbz#1565226 - Allow domain transition from logrotate_t to chronyc_t Resolves: rhbz#1568281 - Allow nfsd_t domain to read/write sysctl fs files Resolves: rhbz#1516593 - Allow conman to read system state Resolves: rhbz#1377915 - Allow lircd_t to exec shell and add capabilities dac_read_search and dac_override Resolves: rhbz#1550700 - Allow usbmuxd to access /run/udev/data/+usb:*. Resolves: rhbz#1521054 - Allow abrt_t domain to manage kdump crash files Resolves: rhbz#1491585 - Allow systemd to use virtio console Resolves: rhbz#1558121 - Allow transition from sysadm role into mdadm_t domain. Resolves: rhbz#1551568 - Label /dev/op_panel and /dev/opal-prd as opal_device_t Resolves: rhbz#1537618 - Label /run/ebtables.lock as iptables_var_run_t Resolves: rhbz#1511437 - Allow udev_t domain to manage udev_rules_t char files. Resolves: rhbz#1545094 - Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin. Resolves: rhbz#1567753 - Fix filesystem inteface file, we don't have nsfs_fs_t type, just nsfs_t Resolves: rhbz#1547700 - Allow iptables_t domain to create dirs in etc_t with system_conf_t labels- Add new boolean redis_enable_notify() Resolves: rhbz#1421326 - Label /var/log/shibboleth-www(/.*) as httpd_sys_rw_content_t Resolves: rhbz#1549514 - Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/ Resolves: rbhz#1463593 - Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_t Resolves: rbhz#1463593- Backport several changes for snapperdfrom Fedora Rawhide Resolves: rhbz#1556798 - Allow snapperd_t to set priority for kernel processes Resolves: rhbz#1556798 - Make ganesha nfs server. Resolves: rhbz#1511489 - Allow vxfs filesystem to use SELinux labels Resolves: rhbz#1482880 - Add map permission to selinux-policy Resolves: rhbz#1460322- Label /usr/libexec/dbus-1/dbus-daemon-launch-helper as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled. Resolves: rhbz#1546721- Allow openvswitch_t stream connect svirt_t Resolves: rhbz#1540702- Allow openvswitch domain to manage svirt_tmp_t sock files Resolves: rhbz#1540702 - Fix broken systemd_tmpfiles_run() interface- Allow dirsrv_t domain to create tmp link files Resolves: rhbz#1536011 - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t Resolves: rhbz#1428568 - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries - Allow ipsec_mgmt_t nnp domain transition to ifconfig_t Resolves: rhbz#1539416- Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t Resolves: rhbz#1540702 - Allow keepalived_t domain getattr proc filesystem Resolves: rhbz#1477542 - Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t Resolves: rhbz#1538544 - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t Resolves: rhbz:#1539416 - Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t Resolves: rhbz#1479350- Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets Resolves: rhbz#1535196 - Add new interface ppp_filetrans_named_content() Resolves: rhbz#1530601 - Allow keepalived_t read sysctl_net_t files Resolves: rhbz#1477542 - Allow puppetmaster_t domtran to puppetagent_t Resolves: rhbz#1376893 - Allow kdump_t domain to read kernel ring buffer Resolves: rhbz#1540004 - Allow ipsec_t domain to exec ifconfig_exec_t binaries. Resolves: rhbz#1539416 - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock Resolves: rhbz#1530601 - Allow updpwd_t domain to create files in /etc with shadow_t label Resolves: rhbz#1412838 - Allow iptables sysctl load list support with SELinux enforced Resolves: rhbz#1535572- Allow virt_domains to acces infiniband pkeys. Resolves: rhbz#1533183 - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t Resolves: rhbz#1535133 - Allow audisp_remote_t domain write to files on all levels Resolves: rhbz#1534924- Allow vmtools_t domain creating vmware_log_t files Resolves: rhbz#1507048 - Allow openvswitch_t domain to acces infiniband devices Resolves: rhbz#1532705- Allow chronyc_t domain to manage chronyd_keys_t files. Resolves: rhbz#1530525 - Make virtlog_t domain system dbus client Resolves: rhbz#1481109 - Update openvswitch SELinux module Resolves: rhbz#1482682 - Allow virtd_t to create also sock_files with label virt_var_run_t Resolves: rhbz#1484075- Allow domains that manage logfiles to man logdirs Resolves: rhbz#1523811- Label /dev/drm_dp_aux* as xserver_misc_device_t Resolves: rhbz#1520897 - Allow sysadm_t to run puppet_exec_t binaries as puppet_t Resolves: rhbz#1255745- Allow tomcat_t to manage pki_tomcat pid files Resolves: rhbz#1478371 - networkmanager: allow talking to openvswitch Resolves: rhbz#1517247 - Allow networkmanager_t and opensm_t to manage subned endports for IPoIB VLANs Resolves: rhbz#1517895 - Allow domains networkmanager_t and opensm_t to control IPoIB VLANs Resolves: rhbz#1517744 - Fix typo in guest interface file Resolves: rhbz#1468254 - Allow isnsd_t domain to accept tcp connections. Resolves: rhbz#1390208- Allow getty to use usbttys Resolves: rhbz#1514235- Allow ldap_t domain to manage also slapd_tmp_t lnk files Resolves: rhbz#1510883 - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t Resolves: rhbz:#1508360 - Add dac_read_search and dac_override capabilities to ganesha Resolves: rhbz#1483451- Add dependency for policycoreutils-2.5.18 becuase of new cgroup_seclabel policy capability Resolves: rhbz#1510145- Allow jabber domains to connect to postgresql ports Resolves: rhbz#1438489 - Dontaudit accountsd domain creating dirs in /root Resolves: rhbz#1456760 - Dontaudit slapd_t to block suspend system Resolves: rhbz: #1479759 - Allow spamc_t to stream connect to cyrus. Resolves: rhbz#1382955 - allow imapd to read /proc/net/unix file Resolves: rhbz#1393030 - Allow passenger to connect to mysqld_port_t Resolves: rhbz#1433464- Allow chronyc_t domain to use user_ptys Resolves: rhbz#1470150 - allow ptp4l to read /proc/net/unix file - Allow conmand to use usb ttys. Resolves: rhbz#1505121 - Label all files /var/log/opensm.* as opensm_log_t because opensm creating new log files with name opensm-subnet.lst Resolves: rhbz#1505845 - Allow chronyd daemon to execute chronyc. Resolves: rhbz#1508486 - Allow firewalld exec ldconfig. Resolves: rhbz#1375576 - Allow mozilla_plugin_t domain to dbus chat with devicekit Resolves: rhbz#1460477 - Dontaudit leaked logwatch pipes Resolves: rhbz#1450119 - Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon. Resolves: rhbz#1507048 - Allow httpd_t domain to execute hugetlbfs_t files Resolves: rhbz#1507682 - Allow nfsd_t domain to read configfs_t files/dirs Resolves: rhbz#1439442 - Hide all allow rules with ptrace inside deny_ptrace boolean Resolves: rhbz#1421075 - Allow tgtd_t domain to read generic certs Resolves: rhbz#1438532 - Allow ptp4l to send msgs via dgram socket to unprivileged user domains Resolves: rhbz#1429853 - Allow dirsrv_snmp_t to use inherited user ptys and read system state Resolves: rhbz#1428568 - Allow glusterd_t domain to create own tmpfs dirs/files Resolves: rhbz#1411310 - Allow keepalived stream connect to snmp Resolves: rhbz#1401556 - After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy Resolves: rhbz#1507089- Allow pegasus_openlmi_services_t to read generic certs Resolves: rhbz#1462292 - Allow ganesha_t domain to read random device Resolves: rhbz#1494382 - Allow zabbix_t domain to change its resource limits Resolves: rhbz:#1504074 - Add new boolean nagios_use_nfs Resolves: rhbz#1504826 - Allow system_mail_t to search network sysctls Resolves: rhbz#1505779 - Add samba_manage_var_dirs() interface - Fix typo bug in virt filecontext file - Allow nagios_script_t to read nagios_spool_t files Resolves: rhbz#1426824 - Allow samba to manage var dirs/files Resolves: rhbz#1415088 - Allow sbd_t to create own sbd_tmpfs_t dirs/files Resolves: rhbz#1380795 - Allow firewalld and networkmanager to chat with hypervkvp via dbus Resolves: rhbz#1377276 - Allow dmidecode to read rhsmcert_log_t files Resolves: rhbz#1300799 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow pegasus_openlmi_services_t to read generic certs Resolves: rhbz#1462292 - Allow ganesha_t domain to read random device Resolves: rhbz#1494382 - Allow zabbix_t domain to change its resource limits Resolves: rhbz:#1504074 - Add new boolean nagios_use_nfs Resolves: rhbz#1504826 - Allow system_mail_t to search network sysctls Resolves: rhbz#1505779 - Add samba_manage_var_dirs() interface - Fix typo bug in virt filecontext file - Allow nagios_script_t to read nagios_spool_t files Resolves: rhbz#1426824 - Allow samba to manage var dirs/files Resolves: rhbz#1415088 - Allow sbd_t to create own sbd_tmpfs_t dirs/files Resolves: rhbz#1380795 - Allow firewalld and networkmanager to chat with hypervkvp via dbus Resolves: rhbz#1377276 - Allow dmidecode to read rhsmcert_log_t files Resolves: rhbz#1300799 - Allow mail system to connect mariadb sockets. Resolves: rhbz#1368642 - Allow logrotate_t to change passwd and reloead services Resolves: rhbz#1450789 - Allow chronyd_t do request kernel module and block_suspend capability Resolves: rhbz#1350765 - Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label Resolves: rhbz#1447278 - Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables Resolves: rhbz#1491994 - Allow svnserve to use kerberos Resolves: rhbz#1475271 - Allow conman to use ptmx. Add conman_use_nfs boolean Resolves: rhbz#1377915 - Add nnp transition for services using: NoNewPrivileges systemd security feature Resolves: rhbz#1311430 - Add SELinux support for chronyc Resolves: rhbz#1470150 - Add dac_read_search capability to openvswitch_t domain Resolves: rhbz#1501336 - Allow svnserve to manage own svnserve_log_t files/dirs Resolves: rhbz#1480741 - Allow keepalived_t to search network sysctls Resolves: rhbz#1477542 - Allow puppetagent_t domain dbus chat with rhsmcertd_t domain Resolves: rhbz#1446777 - Add dccp_socket into socker_class_set subset Resolves: rhbz#1459941 - Allow iptables_t to run setfiles to restore context on system Resolves: rhbz#1489118 - Label 20514 tcp/udp ports as syslogd_port_t Label 10514 tcp/udp portas as syslog_tls_port_t Resolves: rhbz:#1411400 - Make nnp transition Active Resolves: rhbz#1480518 - Label tcp 51954 as isns_port_t Resolves: rhbz#1390208 - Add dac_read_search capability chkpwd_t Resolves: rhbz#1376991 - Add support for running certbot(letsencrypt) in crontab Resolves: rhbz#1447278 - Add init_nnp_daemon_domain interface - Allow xdm_t to gettattr /dev/loop-control device Resolves: rhbz#1462925 - Allow nnp trasintion for unconfined_service_t Resolves: rhbz#1311430 - Allow unpriv user domains and unconfined_service_t to use chronyc Resolves: rhbz#1470150 - Allow iptables to exec plymouth. Resolves: rhbz#1480374 - Fix typo in fs_unmount_tracefs interface. Resolves: rhbz#1371057 - Label postgresql-check-db-dir as postgresql_exec_t Resolves: rhbz#1490956- We should not ship selinux-policy with permissivedomains enabled. Resolves: rhbz#1494172 - Fix order of installing selinux-policy-sandbox, because of depedencied in sandbox module, selinux-policy-targeted needs to be installed before selinux-policy-sandbox Resolves: rhbz#1492606- Allow tomcat to setsched Resolves: rhbz#1492730 - Fix rules blocking ipa-server upgrade process Resolves: rhbz#1478371 - Add new boolean tomcat_read_rpm_db() Resolves: rhbz#1477887 - Allow tomcat to connect on mysqld tcp ports - Add ctdbd_t domain sys_source capability and allow setrlimit Resolves: rhbz#1491235 - Fix keepalived SELinux module - Allow automount domain to manage mount pid files Resolves: rhbz#1482381 - Allow stunnel_t domain setsched Resolves: rhbz#1479383 - Add keepalived domain setpgid capability Resolves: rhbz#1486638 - Allow tomcat domain to connect to mssql port Resolves: rhbz#1484572 - Remove snapperd_t from unconfined domaines Resolves: rhbz#1365555 - Fix typo bug in apache module Resolves: rhbz#1397311 - Dontaudit that system_mail_t is trying to read /root/ files Resolves: rhbz#1147945 - Make working webadm_t userdomain Resolves: rhbz#1323792 - Allow redis domain to execute shell scripts. Resolves: rhbz#1421326 - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t Resolves: rhbz#1473303 - Add couple capabilities to keepalived domain and allow get attributes of all domains Resolves: rhbz#1429327 - Allow dmidecode read rhsmcertd lock files Resolves: rhbz#1300799 - Add new interface rhsmcertd_rw_lock_files() Resolves: rhbz#1300799 - Label all plymouthd archives as plymouthd_var_log_t Resolves: rhbz#1478323 - Allow cloud_init_t to dbus chat with systemd_timedated_t Resolves: rhbz#1440730 - Allow logrotate_t to write to kmsg Resolves: rhbz#1397744 - Add capability kill to rhsmcertd_t Resolves: rhbz#1398338 - Disable mysqld_safe_t secure mode environment cleansing. Resolves: rhbz#1464063 - Allow winbind to manage smbd_tmp_t files Resolves: rhbz#1475566 - Dontaudit that system_mail_t is trying to read /root/ files Resolves: rhbz#1147945 - Make working webadm_t userdomain Resolves: rhbz#1323792 - Allow redis domain to execute shell scripts. Resolves: rhbz#1421326 - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t Resolves: rhbz#1473303 - Add couple capabilities to keepalived domain and allow get attributes of all domains Resolves: rhbz#1429327 - Allow dmidecode read rhsmcertd lock files Resolves: rhbz#1300799 - Add new interface rhsmcertd_rw_lock_files() Resolves: rhbz#1300799 - Label all plymouthd archives as plymouthd_var_log_t Resolves: rhbz#1478323 - Allow cloud_init_t to dbus chat with systemd_timedated_t Resolves: rhbz#1440730 - Allow logrotate_t to write to kmsg Resolves: rhbz#1397744 - Add capability kill to rhsmcertd_t Resolves: rhbz#1398338 - Disable mysqld_safe_t secure mode environment cleansing. Resolves: rhbz#1464063 - Allow winbind to manage smbd_tmp_t files Resolves: rhbz#1475566 - Add interface systemd_tmpfiles_run - End of file cannot be in comment - Allow systemd-logind to use ypbind Resolves: rhbz#1479350 - Add creating opasswd file with shadow_t SELinux label in auth_manage_shadow() interface Resolves: rhbz#1412838 - Allow sysctl_irq_t assciate with proc_t Resolves: rhbz#1485909 - Enable cgourp sec labeling Resolves: rhbz#1485947 - Add cgroup_seclabel policycap. Resolves: rhbz#1485947 - Allow sshd_t domain to send signull to xdm_t processes Resolves: rhbz#1448959 - Allow updpwd_t domain auth file name trans Resolves: rhbz#1412838 - Allow sysadm user to run systemd-tmpfiles Resolves: rbhz#1325364 - Add support labeling for vmci and vsock device Resolves: rhbz#1451358 - Add userdom_dontaudit_manage_admin_files() interface Resolves: rhbz#1323792 - Allow iptables_t domain to read files with modules_conf_t label Resolves: rhbz#1373220 - init: Add NoNewPerms support for systemd. Resolves: rhbz#1480518 - Add nnp_nosuid_transition policycap and related class/perm definitions. Resolves: rhbz#1480518 - refpolicy: Infiniband pkeys and endports Resolves: rhbz#1464484- Allow certmonger using systemctl on pki_tomcat unit files Resolves: rhbz#1481388- Allow targetd_t to create own tmp files. - Dontaudit targetd_t to exec rpm binary file. Resolves: rhbz#1373860 Resolves: rhbz#1424621- Add few rules to make working targetd daemon with SELinux Resolves: rhbz#1373860 - Allow ipmievd_t domain to load kernel modules Resolves: rhbz#1441081 - Allow logrotate to reload transient systemd unit Resolves: rhbz#1440515 - Add certwatch_t domain dac_override and dac_read_search capabilities Resolves: rhbz#1422000 - Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain Resolves: rhbz#1412072 - Allow nscd_t domain to search network sysctls Resolves: rhbz#1432361 - Allow iscsid_t domain to read mount pid files Resolves: rhbz#1482097 - Allow ksmtuned_t domain manage sysfs_t files/dirs Resolves: rhbz#1413865 - Allow keepalived_t domain domtrans into iptables_t Resolves: rhbz#1477719 - Allow rshd_t domain reads net sysctls Resolves: rhbz#1477908 - Add interface seutil_dontaudit_read_module_store() - Update interface lvm_rw_pipes() by adding also open permission - Label /dev/clp device as vfio_device_t Resolves: rhbz#1477624 - Allow ifconfig_t domain unmount fs_t Resolves: rhbz#1477445 - Label /dev/gpiochip* devices as gpio_device_t Resolves: rhbz#1477618 - Add interface dev_manage_sysfs() Resolves: rhbz#1474989- Label /usr/libexec/sudo/sesh as shell_exec_t Resolves: rhbz#1480791- Allow tomcat_t domain couple capabilities to make working tomcat-jsvc Resolves: rhbz#1470735- Allow llpdad send dgram to libvirt Resolves: rhbz#1472722- Add new boolean gluster_use_execmem Resolves: rhbz#1469027 - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service Resolves: rhbz#1468581- Dontaudit staff_t user read admin_home_t files. Resolves: rhbz#1290633- Allow couple rules needed to start targetd daemon with SELinux in enforcing mode Resolves: rhbz#1424621 - Add interface lvm_manage_metadata Resolves: rhbz#1424621- Allow sssd_t to read realmd lib files. Resolves: rhbz#1436689 - Add permission open to files_read_inherited_tmp_files() interface Resolves: rhbz#1290633 Resolves: rhbz#1457106- Allow unconfined_t user all user namespace capabilties. Resolves: rhbz#1461488- Allow httpd_t to read realmd_var_lib_t files Resolves: rhbz#1436689- Allow named_t to bind on udp 4321 port Resolves: rhbz#1312972 - Allow systemd-sysctl cap. sys_ptrace Resolves: rhbz#1458999- Allow pki_tomcat_t execute ldconfig. Resolves: rhbz#1436689- Allow iscsi domain load kernel module. Resolves: rhbz#1457874 - Allow keepalived domain connect to squid tcp port Resolves: rhbz#1457455 - Allow krb5kdc_t domain read realmd lib files. Resolves: rhbz#1436689 - xdm_t should view kernel keys Resolves: rhbz#1432645- Allow tomcat to connect on all unreserved ports - Allow ganesha to connect to all rpc ports Resolves: rhbz#1448090 - Update ganesha with another fixes. Resolves: rhbz#1448090 - Update rpc_read_nfs_state_data() interface to allow read also lnk_files. Resolves: rhbz#1448090 - virt_use_glusterd boolean should be in optional block Update ganesha module to allow create tmp files Resolves: rhbz#1448090 - Hide broken symptoms when machine is configured with network bounding.- Add new boolean virt_use_glusterd Resolves: rhbz#1455994 - Add capability sys_boot for sbd_t domain - Allow sbd_t domain to create rpc sysctls. Resolves: rhbz#1455631 - Allow ganesha_t domain to manage glusterd_var_run_t pid files. Resolves: rhbz#1448090- Create new interface: glusterd_read_lib_files() - Allow ganesha read glusterd lib files. - Allow ganesha read network sysctls Resolves: rhbz#1448090- Add few allow rules to ganesha module Resolves: rhbz#1448090 - Allow condor_master_t to read sysctls. Resolves: rhbz#1277506 - Add dac_override cap to ctdbd_t domain Resolves: rhbz#1435708 - Label 8750 tcp/udp port as dey_keyneg_port_t Resolves: rhbz#1448090- Add ganesha_use_fusefs boolean. Resolves: rhbz#1448090- Allow httpd_t reading kerberos kdc config files Resolves: rhbz#1452215 - Allow tomcat_t domain connect to ibm_dt_2 tcp port. Resolves: rhbz#1447436 - Allow stream connect to initrc_t domains Resolves: rhbz#1447436 - Allow dnsmasq_t domain to read systemd-resolved pid files. Resolves: rhbz#1453114 - Allow tomcat domain name_bind on tcp bctp_port_t Resolves: rhbz#1451757 - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process. Resolves: rhbz#1447669 - Allow condor_master_t write to sysctl_net_t Resolves: rhbz#1277506 - Allow nagios check disk plugin read /sys/kernel/config/ Resolves: rhbz#1277718 - Allow pcp_pmie_t domain execute systemctl binary Resolves: rhbz#1271998 - Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl Resolves: rhbz#1247635 - Label tcp/udp port 1792 as ibm_dt_2_port_t Resolves: rhbz#1447436 - Add interface fs_read_configfs_dirs() - Add interface fs_read_configfs_files() - Fix systemd_resolved_read_pid interface - Add interface systemd_resolved_read_pid() Resolves: rhbz#1453114 - Allow sshd_net_t domain read/write into crypto devices Resolves: rhbz#1452759 - Label 8999 tcp/udp as bctp_port_t Resolves: rhbz#1451757- nmbd_t needs net_admin capability like smbd Resolves: rhbz#1431859 - Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t Resolves: rhbz#1431859 - Allow rngd domain read sysfs_t Resolves: rhbz#1451735 - Add interface pki_manage_common_files() Resolves: rhbz#1447436 - Allow tomcat_t domain to manage pki_common_t files and dirs Resolves: rhbz#1447436 - Use stricter fc rules for sssd sockets in /var/run Resolves: rhbz#1448060 - Allow certmonger reads httpd_config_t files Resolves: rhbz#1436689 - Allow keepalived_t domain creating netlink_netfilter_socket. Resolves: rhbz#1451684 - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files. Resolves: rhbz#1451318 - Make able deply overcloud via neutron_t to label nsfs as fs_t Resolves: rhbz#1373321- Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files. Resolves: rhbz#1451318 - Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/ Resolves: rhbz#1448056 Resolves: rhbz#1448060 - Allow tomcat_domain connect to * postgresql_port_t * amqp_port_t Allow tomcat_domain read network sysctls Resolves: rhbz#1450819 - Make able deply overcloud via neutron_t to label nsfs as fs_t Resolves: rhbz#1373321 - Allow netutils setpcap capability Resolves:1444438- Update targetd policy to accommodate changes in the service Resolves: rhbz#1424621 - Allow tomcat_domain connect to * postgresql_port_t * amqp_port_t Allow tomcat_domain read network sysctls Resolves: rhbz#1450819 - Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options. Resolves: rhbz#1415841 - Allow radius domain stream connec to postgresql Resolves: rhbz#1446145 - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit Resolves: rhbz#1449977 - Allow glusterd_t domain start ganesha service Resolves: rhbz#1448090 - Made few cosmetic changes in sssd SELinux module Resolves: rhbz#1448060 - sssd-kcm should not run as unconfined_service_t BZ(1447411) Resolves: rhbz#1448060 - Add sssd_secrets labeling Also add named_filetrans interface to make sure all labels are correct Resolves: rhbz#1448056 - Allow keepalived_t domain read usermodehelper_t Resolves: rhbz#1449769 - Allow tomcat_t domain read pki_common_t files Resolves: rhbz#1447436 - Add interface pki_read_common_files() Resolves: rhbz#1447436- Allow hypervkvp_t domain execute hostname Resolves: rhbz#1449064 - Dontaudit sssd_selinux_manager_t use of net_admin capability Resolves: rhbz#1444955 - Allow tomcat_t stream connect to pki_common_t Resolves: rhbz#1447436 - Dontaudit xguest_t's attempts to listen to its tcp_socket - Allow sssd_selinux_manager_t to ioctl init_t sockets Resolves: rhbz#1436689 - Allow _su_t to create netlink_selinux_socket Resolves rhbz#1146987 - Allow unconfined_t to module_load any file Resolves rhbz#1442994- Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type. Resolves: rhbz#1436689- Allow pki_tomcat_t domain read /etc/passwd. Resolves: rhbz#1436689 - Allow tomcat_t domain read ipa_tmp_t files Resolves: rhbz#1436689 - Label new path for ipa-otpd Resolves: rhbz#1446353 - Allow radiusd_t domain stream connect to postgresql_t Resolves: rhbz#1446145 - Allow rhsmcertd_t to execute hostname_exec_t binaries. Resolves: rhbz#1445494 - Allow virtlogd to append nfs_t files when virt_use_nfs=1 Resolves: rhbz#1402561- Update tomcat policy to adjust for removing unconfined_domain attr. Resolves: rhbz#1432083 - Allow httpd_t domain read also httpd_user_content_type lnk_files. Resolves: rhbz#1383621 - Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t Resolves: rhbz#1436689 - Dontaudit _gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t Resolves: rhbz#1425530 - Add interface ipa_filetrans_named_content() Resolves: rhbz#1432115 - Allow tomcat use nsswitch Resolves: rhbz#1436689 - Allow certmonger_t start/status generic services Resolves: rhbz#1436689 - Allow dirsrv read cgroup files. Resolves: rhbz#1436689 - Allow ganesha_t domain read/write infiniband devices. Resolves: rhbz#1383784 - Allow sendmail_t domain sysctl_net_t files Resolves: rhbz#1369376 - Allow targetd_t domain read network state and getattr on loop_control_device_t Resolves: rhbz#1373860 - Allow condor_schedd_t domain send mails. Resolves: rhbz#1277506 - Alow certmonger to create own systemd unit files. Resolves: rhbz#1436689 - Allow staff to systemctl virt server when staff_use_svirt=1 Resolves: rhbz#1415841 - Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context Resolves: rhbz#1432115 - Label /sysroot/ostree/deploy/rhel-atomic-host/* as root_t Resolves: rhbz#1428112- Alow certmonger to create own systemd unit files. Resolves: rhbz#1436689- Hide broken symptoms when using kernel 3.10.0-514+ with network bonding. Postfix_picup_t domain requires NET_ADMIN capability which is not really needed. Resolves: rhbz#1431859 - Fix policy to reflect all changes in new IPA release Resolves: rhbz#1432115 Resolves: rhbz#1436689- Allow sbd_t to read/write fixed disk devices Resolves: rhbz#1440165 - Add sys_ptrace capability to radiusd_t domain Resolves: rhbz#1426641 - Allow cockpit_session_t domain connects to ssh tcp ports. Resolves: rhbz#1413509- Update tomcat policy to make working ipa install process Resolves: rhbz#1436689- Allow pcp_pmcd_t net_admin capability. - Allow pcp_pmcd_t read net sysctls - Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t Resolves: rhbz#1336211- Fix all AVC denials during pkispawn of CA Resolves: rhbz#1436383 - Update pki interfaces and tomcat module Resolves: rhbz#1436689- Update pki interfaces and tomcat module Resolves: rhbz#1436689- Dontaudit firewalld wants write to /root Resolves: rhbz#1438708 - Dontaudit firewalld to create dirs in /root/ Resolves: rhbz#1438708 - Allow sendmail to search network sysctls Resolves: rhbz#1369376 - Add interface gssd_noatsecure() Resolves: rhbz#1438036 - Add interface gssproxy_noatsecure() Resolves: rhbz#1438036 - Dontaudit pcp_pmlogger_t search for xserver logs. Allow pcp_pmlogger_t to send signals to unconfined doamins Allow pcp_pmlogger_t to send logs to journals Resolves: rhbz#1379371 - Allow chronyd_t net_admin capability to allow support HW timestamping. Resolves: rhbz#1416015 - Update tomcat policy Resolves: rhbz#1436689 Resolves: rhbz#1436383 - Allow certmonger to start haproxy service Resolves: rhbz#1349394 - Allow init noatsecure for gssd and gssproxy Resolves: rhbz#1438036- geoclue wants to dbus chat with avahi Resolves: rhbz#1434286 - Allow iptables get list of kernel modules Resolves: rhbz#1367520 - Allow unconfined_domain_type to enable/disable transient unit Resolves: rhbz#1337041 - Add interfaces init_enable_transient_unit() and init_disable_transient_unit - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd" Resolves: rhbz#1435264 - Label sysroot dir under ostree as root_t Resolves: rhbz#1428112- Remove ganesha_t domain from permissive domains. Resolves: rhbz#1436988- Allow named_t domain bind on several udp ports Resolves: rhbz#1312972 - Update nscd_use() interface Resolves: rhbz#1281716 - Allow radius_t domain ptrace Resolves: rhbz#1426641 - Update nagios to allos exec systemctl Resolves: rhbz#1247635 - Update pcp SELinux module to reflect all pcp changes Resolves: rhbz#1271998 - Label /var/lib/ssl_db as squid_cache_t Label /etc/squid/ssl_db as squid_cache_t Resolves: rhbz#1325527 - Allow pcp_pmcd_t domain search for network sysctl Allow pcp_pmcd_t domain sys_ptrace capability Resolves: rhbz#1336211- Allow drbd load modules Resolves: rhbz#1134883 - Revert "Add sys_module capability for drbd Resolves: rhbz#1134883" - Allow stapserver list kernel modules Resolves: rhbz#1325976 - Update targetd policy Resolves: rhbz#1373860 - Add sys_admin capability to amanda Resolves: rhbz#1371561 - Allow hypervvssd_t to read all dirs. Resolves: rhbz#1331309 - Label /run/haproxy.sock socket as haproxy_var_run_t Resolves: rhbz#1386233 - Allow oddjob_mkhomedir_t to mamange autofs_t dirs. Resolves: rhbz#1408819 - Allow tomcat to connect on http_cache_port_t Resolves: rhbz#1432083 - Allow geoclue to send msgs to syslog. Resolves: rhbz#1434286 - Allow condor_master_t domain capability chown. Resolves: rhbz#1277506 - Update mta_filetrans_named_content() interface to allow calling domain create files labeled as etc_aliases_t in dir labeled as etc_mail_t. Resolves: rhbz#1167468 - Allow nova domain search for httpd configuration. Resolves: rhbz#1190761 - Add sys_module capability for drbd Resolves: rhbz#1134883 - Allow user_u users stream connect to dirsrv, Allow sysadm_u and staff_u users to manage dirsrv files Resolves: rhbz#1286474 - Allow systemd_networkd_t communicate with systemd_networkd_t via dbus Resolves: rhbz#1278010- Add haproxy_t domain fowner capability Resolves: rhbz#1386233 - Allow domain transition from ntpd_t to hwclock_t domains Resolves: rhbz#1375624 - Allow cockpit_session_t setrlimit and sys_resource Resolves: rhbz#1402316 - Dontaudit svirt_t read state of libvirtd domain Resolves: rhbz#1426106 - Update httpd and gssproxy modules to reflects latest changes in freeipa Resolves: rhbz#1432115 - Allow iptables read modules_conf_t Resolves: rhbz#1367520- Remove tomcat_t domain from unconfined domains Resolves: rhbz#1432083 - Create new boolean: sanlock_enable_home_dirs() Resolves: rhbz#1432783 - Allow mdadm_t domain to read/write nvme_device_t Resolves: rhbz#1431617 - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content Resolves: rhbz#1383621 - Dontaudit domain to create any file in /proc. This is kernel bug. Resolves: rhbz#1412679 - Add interface dev_rw_nvme Resolves: rhbz#1431617- Allow gssproxy to get attributes on all filesystem object types. Resolves: rhbz#1430295 - Allow ganesha to chat with unconfined domains via dbus Resolves: rhbz#1426554 - add the policy required for nextcloud Resolves: rhbz#1425530 - Add nmbd_t capability2 block_suspend Resolves: rhbz#1425357 - Label /var/run/chrony as chronyd_var_run_t Resolves: rhbz#1416015 - Add domain transition from sosreport_t to iptables_t Resolves: rhbz#1359789 - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd Resolves: rhbz:#1332803- Update rpm macros Resolves: rhbz#1380854- Add handling booleans via selinux-policy macros in custom policy spec files. Resolves: rhbz#1380854- Allow openvswitch to load kernel modules Resolves: rhbz#1405479- Allow openvswitch read script state. Resolves: rhbz#1405479- Update ganesha policy Resolves: rhbz#1426554 Resolves: rhbz#1383784 - Allow chronyd to read adjtime Resolves: rhbz#1416015 - Fixes for chrony version 2.2 Resolves: rhbz#1416015 - Add interface virt_rw_stream_sockets_svirt() Resolves: rhbz#1415841 - Label /dev/ss0 as gpfs_device_t Resolves: rhbz#1383784 - Allow staff to rw svirt unix stream sockets. Resolves: rhbz#1415841 - Label /rhev/data-center/mnt as mnt_t Resolves: rhbz#1408275 - Associate sysctl_rpc_t with proc filesystems Resolves: rhbz#1350927 - Add new boolean: domain_can_write_kmsg Resolves: rhbz#1415715- Allow rhsmcertd_t dbus chat with system_cronjob_t Resolves: rhbz#1405341 - Allow openvswitch exec hostname and readinitrc_t files Resolves: rhbz#1405479 - Improve SELinux context for mysql_db_t objects. Resolves: rhbz#1391521 - Allow postfix_postdrop to communicate with postfix_master via pipe. Resolves: rhbz#1379736 - Add radius_use_jit boolean Resolves: rhbz#1426205 - Label /var/lock/subsys/iptables as iptables_lock_t Resolves: rhbz#1405441 - Label /usr/lib64/erlang/erts-5.10.4/bin/epmd as lib_t Resolves: rhbz#1332803 - Allow can_load_kernmodule to load kernel modules. Resolves: rhbz#1423427 Resolves: rhbz#1424621- Allow nfsd_t domain to create sysctls_rpc_t files Resolves: rhbz#1405304 - Allow openvswitch to create netlink generic sockets. Resolves: rhbz#1397974 - Create kernel_create_rpc_sysctls() interface Resolves: rhbz#1405304- Allow nfsd_t domain rw sysctl_rpc_t dirs Resolves: rhbz#1405304 - Allow cgdcbxd_t to manage cgroup files. Resolves: rhbz#1358493 - Allow cmirrord_t domain to create netlink_connector sockets Resolves: rhbz#1412670 - Allow fcoemon to create netlink scsitransport sockets Resolves: rhbz#1362496 - Allow quota_nld_t create netlink_generic sockets Resolves: rhbz#1358679 - Allow cgred_t create netlink_connector sockets Resolves: rhbz#1376357 - Add dhcpd_t domain fowner capability Resolves: rhbz#1358485 - Allow acpid to attempt to connect to the Linux kernel via generic netlink socket. Resolves: rhbz#1358478 - Rename docker module to container module Resolves: rhbz#1386916 - Allow setflies to mount tracefs Resolves: rhbz#1376357 - Allow iptables to read nsfs files. Resolves: rhbz#1411316 - Allow systemd_bootchart_t domain create dgram sockets. Resolves: rhbz#1365953 - Rename docker interfaces to container Resolves: rhbz#1386916- Allow initrc_t domain to run rhel-autorelabel script properly during boot process Resolves: rhbz#1379722 - Allow systemd_initctl_t to create and connect unix_dgram sockets Resolves: rhbz#1365947 - Allow ifconfig_t to mount/unmount nsfs_t filesystem Resolves: rhbz#1349814 - Add interfaces allowing mount/unmount nsfs_t filesystem Resolves: rhbz#1349814- Add interface init_stream_connectto() Resolves:rhbz#1365947 - Allow rhsmcertd domain signull kernel. Resolves: rhbz#1379781 - Allow kdumpgui domain to read nvme device - Allow insmod_t to load kernel modules Resolves: rhbz#1421598 - Add interface files_load_kernel_modules() Resolves: rhbz#1421598 - Add SELinux support for systemd-initctl daemon Resolves:rhbz#1365947 - Add SELinux support for systemd-bootchart Resolves: rhbz#1365953- Allow firewalld to getattr open search read modules_object_t:dir Resolves: rhbz#1418391 - Fix label for nagios plugins in nagios file conxtext file Resolves: rhbz#1277718 - Add sys_ptrace capability to pegasus domain Resolves: rhbz#1381238 - Allow sssd_t domain setpgid Resolves:rhbz#1416780 - After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk. Resolves: rhbz#1350927 - Allow kdumpgui domain to read nvme device Resolves: rhbz#1415084 - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization. Resolves: rhbz#1146987 - Add user namespace capability object classes. Resolves: rhbz#1368057 - Add module_load permission to class system Resolves:rhbz#1368057 - Add the validate_trans access vector to the security class Resolves: rhbz#1368057 - Add "binder" security class and access vectors Resolves: rhbz#1368057 - Allow ifconfig_t domain read nsfs_t Resolves: rhbz#1349814 - Allow ping_t domain to load kernel modules. Resolves: rhbz#1388363- Allow systemd container to read/write usermodehelperstate Resolves: rhbz#1403254 - Label udp ports in range 24007-24027 as gluster_port_t Resolves: rhbz#1404152- Allow glusterd_t to bind on glusterd_port_t udp ports. Resolves: rhbz#1404152 - Revert: Allow glusterd_t to bind on med_tlp port.- Allow glusterd_t to bind on med_tlp port. Resolves: rhbz#1404152 - Update ctdbd_t policy to reflect all changes. Resolves: rhbz#1402451 - Label tcp port 24009 as med_tlp_port_t Resolves: rhbz#1404152 - Issue appears during update directly from RHEL-7.0 to RHEL-7.3 or above. Modules pkcsslotd and vbetools missing in selinux-policy package for RHEL-7.3 which causing warnings during SELinux policy store migration process. Following patch fixes issue by skipping pkcsslotd and vbetools modules migration.- Allow ctdbd_t domain transition to rpcd_t Resolves:rhbz#1402451- Fixes for containers Allow containers to attempt to write to unix_sysctls. Allow cotainers to use the FD's leaked to them from parent processes. Resolves: rhbz#1403254- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t Resolves: rhbz#1404152 - Allow systemd to stop glusterd_t domains. Resolves: rhbz#1400493- Make working CTDB:NFS: CTDB failover from selinux-policy POV Resolves: rhbz#1402451- Add kdump_t domain sys_admin capability Resolves: rhbz#1375963- Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access. Resolves: rhbz#1399250- Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning "Access Denied" errors to DBus clients Resolves: rhbz#1393505- Allow cluster_t communicate to fprintd_t via dbus Resolves: rhbz#1349798- Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package Resolves: rhbz#1392010- Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device. Resolves: rhbz#1384488 - Allow glusterd to get attributes on /sys/kernel/config directory. Resolves: rhbz#1384483- Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros - Add selinux-policy-migrate-local-changes service Resolves: rhbz#1381588- Allow sssd_selinux_manager_t to manage also dir class. Resolves: rhbz#1368097 - Add interface seutil_manage_default_contexts_dirs() Resolves: rhbz#1368097- Add virt_sandbox_use_nfs -> virt_use_nfs boolean substitution. Resolves: rhbz#1355783- Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t Resolves: rhbz#1309883- Allow ftp daemon to manage apache_user_content Resolves: rhbz#1097775 - Label /etc/sysconfig/oracleasm as oracleasm_conf_t Resolves: rhbz#1331383 - Allow oracleasm to rw inherited fixed disk device Resolves: rhbz#1331383 - Allow collectd to connect on unix_stream_socket Resolves: rhbz#1377259- Allow iscsid create netlink iscsid sockets. Resolves: rhbz#1358266 - Improve regexp for power_unit_file_t files. To catch just systemd power unit files. Resolves: rhbz#1375462- Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain. Resolves: rhbz#1331383 - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service Resolves: rhbz#1206525- Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm Resolves: rhbz#1331383 - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t Resolves: rhbz#1206525 - Allow mdadm_t to getattr all device nodes Resolves: rhbz#1365171 - Add interface dbus_dontaudit_stream_connect_system_dbusd() Resolves:rhbz#1052880 - Add virt_stub_* interfaces for docker policy which is no longer a part of our base policy. Resolves: rhbz#1372705 - Allow guest-set-user-passwd to set users password. Resolves: rhbz#1369693 - Allow samdbox domains to use msg class Resolves: rhbz#1372677 - Allow domains using kerberos to read also kerberos config dirs Resolves: rhbz#1368492 - Allow svirt_sandbox_domains to r/w onload sockets Resolves: rhbz#1342930 - Add interface fs_manage_oracleasm() Resolves: rhbz#1331383 - Label /dev/kfd as hsa_device_t Resolves: rhbz#1373488 - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs Resolves: rhbz#1368097 - Add interface to write to nsfs inodes Resolves: rhbz#1372705 - Allow systemd services to use PrivateNetwork feature Resolves: rhbz#1372705 - Add a type and genfscon for nsfs. Resolves: rhbz#1372705 - Allow run sulogin_t in range mls_systemlow-mls_systemhigh. Resolves: rhbz#1290400- Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261 - Fix file context for /etc/pki/pki-tomcat/ca/ - new interface oddjob_mkhomedir_entrypoint() - Move label for /var/lib/docker/vfs/ to proper SELinux module - Allow mdadm to get attributes from all devices. - Label /etc/puppetlabs as puppet_etc_t. - Allow systemd-machined to communicate to lxc container using dbus - Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579 - Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579 - Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579 - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t - Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383- Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t Resolves:rhbz#1366915 - Allow certmonger to manage all systemd unit files Resolves:rhbz#1366915 - Grant certmonger "chown" capability Resolves:rhbz#1366915 - Allow ipa_helper_t stream connect to dirsrv_t domain Resolves: rhbz#1368418 - Update oracleasm SELinux module Resolves: rhbz#1331383 - label /var/lib/kubelet as svirt_sandbox_file_t Resolves: rhbz#1369159 - Add few interfaces to cloudform.if file Resolves: rhbz#1367834 - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module Resolves: rhbz#1347514 - Allow krb5kdc_t to read krb4kdc_conf_t dirs. Resolves: rhbz#1368492 - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run. Resolves: rhbz#1365653 - Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together. Resolves: rhbz#1365653 - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type Resolves: rhbz#1331383 - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init. Resolves: rhbz#1367834 - Allow iptables to creating netlink generic sockets. Resolves: rhbz#1364359- Allow ipmievd domain to create lock files in /var/lock/subsys/ Resolves:rhbz#1349058 - Update policy for ipmievd daemon. Resolves:rhbz#1349058 - Dontaudit hyperkvp to getattr on non security files. Resolves: rhbz#1349356 - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t Resolves: rhbz#1347514 - Fixed lsm SELinux module - Add sys_admin capability to sbd domain Resolves: rhbz#1322725 - Allow vdagent to comunnicate with systemd-logind via dbus Resolves: rhbz#1366731 - Allow lsmd_plugin_t domain to create fixed_disk device. Resolves: rhbz#1238066 - Allow opendnssec domain to create and manage own tmp dirs/files Resolves: rhbz#1366649 - Allow opendnssec domain to read system state Resolves: rhbz#1366649 - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs Resolves: rhbz#1366649 - Allow rasdaemon to mount/unmount tracefs filesystem. Resolves: rhbz#1364380 - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/ Resolves: rhbz#1367520 - Modify interface den_read_nvme() to allow also read nvme_device_t block files. Resolves: rhbz#1362564 - Label /var/run/storaged as lvm_var_run_t. Resolves: rhbz#1264390 - Allow unconfineduser to run ipa_helper_t. Resolves: rhbz#1361636- Dontaudit mock to write to generic certs. Resolves: rhbz#1271209 - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t Resolves: rhbz#1347514 - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain" - Allow modemmanager to write to systemd inhibit pipes Resolves: rhbz#1365214 - Label corosync-qnetd and corosync-qdevice as corosync_t domain Resolves: rhbz#1347514 - Allow ipa_helper to read network state Resolves: rhbz#1361636 - Label oddjob_reqiest as oddjob_exec_t Resolves: rhbz#1361636 - Add interface oddjob_run() Resolves: rhbz#1361636 - Allow modemmanager chat with systemd_logind via dbus Resolves: rhbz#1362273 - Allow NetworkManager chat with puppetagent via dbus Resolves: rhbz#1363989 - Allow NetworkManager chat with kdumpctl via dbus Resolves: rhbz#1363977 - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls. Resolves: rhbz#1322725 - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t Resolves: rhbz#1349058 - Allow rasdaemon to use tracefs filesystem. Resolves: rhbz#1364380 - Fix typo bug in dirsrv policy - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd. Resolves: rhbz#1283134 - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t Resolves: rhbz#1362688 - Allow dirsrv to read dirsrv_share_t content Resolves: rhbz#1363662 - Allow virtlogd_t to append svirt_image_t files. Resolves: rhbz#1358140 - Allow hypervkvp domain to read hugetlbfs dir/files. Resolves: rhbz#1349356 - Allow mdadm daemon to read nvme_device_t blk files Resolves: rhbz#1362564 - Allow selinuxusers and unconfineduser to run oddjob_request Resolves: rhbz#1361636 - Allow sshd server to acces to Crypto Express 4 (CEX4) devices. Resolves: rhbz#1362539 - Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-* changed to /usr/lib/systemd/rhel-*. Resolves: rhbz#1363769 - Fix typo in device interfaces Resolves: rhbz#1349058 - Add interfaces for managing ipmi devices Resolves: rhbz#1349058 - Add interfaces to allow mounting/umounting tracefs filesystem Resolves: rhbz#1364380 - Add interfaces to allow rw tracefs filesystem Resolves: rhbz#1364380 - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices. Resolves: rhbz#1362564 - Label /sys/kernel/debug/tracing filesystem Resolves: rhbz#1364380 - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1357857- Dontaudit mock_build_t can list all ptys. Resolves: rhbz#1271209 - Allow ftpd_t to mamange userhome data without any boolean. Resolves: rhbz#1097775 - Add logrotate permissions for creating netlink selinux sockets. Resolves: rhbz#1283134 - Allow lsmd_plugin_t to exec ldconfig. Resolves: rhbz#1238066 - Allow vnstatd domain to read /sys/class/net/ files Resolves: rhbz#1358243 - Remove duplicate allow rules in spamassassin SELinux module Resolves:rhbz#1358175 - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs Resolves:rhbz#1358175 - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1357857 - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data. Resolves: rhbz#1330464 - Allow gnome-keyring also manage user_tmp_t sockets. Resolves: rhbz#1257057 - corecmd: Remove fcontext for /etc/sysconfig/libvirtd Resolves:rhbz#1351382- Allow ipa_dnskey domain to search cache dirs Resolves: rhbz#1350957- Allow ipa-dnskey read system state. Reasolves: rhbz#1350957 - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file Resolves: rhbz#1350957- Allow firewalld to manage net_conf_t files. Resolves:rhbz#1304723 - Allow logrotate read logs inside containers. Resolves: rhbz#1303514 - Allow sssd to getattr on fs_t Resolves: rhbz#1356082 - Allow opendnssec domain to manage bind chace files Resolves: rhbz#1350957 - Fix typo in rhsmcertd policy module Resolves: rhbz#1329475 - Allow systemd to get status of systemd-logind daemon Resolves: rhbz#1356141 - Label more ndctl devices not just ndctl0 Resolves: rhbz#1355809- Allow rhsmcertd to copy certs into /etc/docker/cert.d - Add interface docker_rw_config() Resolves: rhbz#1344500 - Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t Resolves: rhbz#1355632 - Allow rhsmcertd to read network sysctls Resolves: rhbz#1329475 - Label /var/log/graphite-web dir as httpd_log_t Resolves: rhbz#1310898 - Allow mock to use generic ptys Resolves: rhbz#1271209 - Allow adcli running as sssd_t to write krb5.keytab file. Resolves: rhbz#1356082 - Allow openvswitch connect to openvswitch_port_t type. Resolves: rhbz#1335024 - Add SELinux policy for opendnssec service. Resolves: rhbz#1350957 - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd Resolves: rhbz#1350957 - label /dev/ndctl0 device as nvram_device_t Resolves: rhbz#1355809- Allow lttng tools to block suspending Resolves: rhbz#1256374 - Allow creation of vpnaas in openstack Resolves: rhbz#1352710 - virt: add strict policy for virtlogd daemon Resolves:rhbz#1311606 - Update makefile to support snapperd_contexts file Resolves: rhbz#1352681- Allow udev to manage systemd-hwdb files - Add interface systemd_hwdb_manage_config() Resolves: rhbz#1350756 - Fix paths to infiniband devices. This allows use more then two infiniband interfaces. Resolves: rhbz#1210263- Allow virtual machines to rw infiniband devices. Resolves: rhbz#1210263 - Allow opensm daemon to rw infiniband_mgmt_device_t Resolves: rhbz#1210263 - Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file. Resolves: rhbz#1350756 - Make label for new infiniband_mgmt deivices Resolves: rhbz#1210263- Fix typo in brltty SELinux module - Add new SELinux module sbd Resolves: rhbz#1322725 - Allow pcp dmcache metrics collection Resolves: rhbz#1309883 - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t Resolves: rhbz#1350782 - Allow openvpn to create sock files labeled as openvpn_var_run_t Resolves: rhbz#1328246 - Allow hypervkvp daemon to getattr on all filesystem types. Resolves: rhbz#1349356 - Allow firewalld to create net_conf_t files Resolves: rhbz#1304723 - Allow mock to use lvm Resolves: rhbz#1271209 - Allow keepalived to create netlink generic sockets. Resolves: rhbz#1349809 - Allow mirromanager creating log files in /tmp Resolves:rhbz#1328818 - Rename few modules to make it consistent with source files Resolves: rhbz#1351445 - Allow vmtools_t to transition to rpm_script domain Resolves: rhbz#1342119 - Allow nsd daemon to manage nsd_conf_t dirs and files Resolves: rhbz#1349791 - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t Resolves: rhbz#1346900 - Allow sssd read also sssd_conf_t dirs Resolves: rhbz#1350535 - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl Resolves: rhbz#1086240 - Add interface lvm_getattr_exec_files() Resolves: rhbz#1271209 - Fix typo Compliling vs. Compiling Resolves: rhbz#1351445- Allow krb5kdc_t to communicate with sssd Resolves: rhbz#1319933 - Allow prosody to bind on prosody ports Resolves: rhbz#1304664 - Add dac_override caps for fail2ban-client Resolves: rhbz#1316678 - dontaudit read access for svirt_t on the file /var/db/nscd/group Resolves: rhbz#1301637 - Allow inetd child process to communicate via dbus with systemd-logind Resolves: rhbz#1333726 - Add label for brltty log file Resolves: rhbz#1328818 - Allow dspam to read the passwd file Resolves: rhbz#1286020 - Allow snort_t to communicate with sssd Resolves: rhbz#1284908 - svirt_sandbox_domains need to be able to execmod for badly built libraries. Resolves: rhbz#1206339 - Add policy for lttng-tools package. Resolves: rhbz#1256374 - Make mirrormanager as application domain. Resolves: rhbz#1328234 - Add support for the default lttng-sessiond port - tcp/5345. This port is used by LTTng 2.x central tracing registry session daemon. - Add prosody ports Resolves: rhbz#1304664 - Allow sssd read also sssd_conf_t dirs Resolves: rhbz#1350535- Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs. Resolves:rhbz#1331315 - Label named-pkcs11 binary as named_exec_t. Resolves: rhbz#1331315 - Allow glusterd daemon to get systemd status Resolves: rhbz#1321785 - Allow logrotate dbus-chat with system_logind daemon Resolves: rhbz#1283134 - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files Resolves: rhbz#1336211 - Add interface cron_read_pid_files() Resolves: rhbz#1336211 - Allow pcp_pmlogger to create unix dgram sockets Resolves: rhbz#1336211 - Add hwloc-dump-hwdata SELinux policy Resolves: rhbz#1344054 - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t. Resolves: rhbz#1121171 - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd() Resolves: rhbz#1259764 - Create label for openhpid log files. esolves: rhbz#1259764 - Label /var/lib/ganglia as httpd_var_lib_t Resolves: rhbz#1260536 - Allow firewalld_t to create entries in net_conf_t dirs. Resolves: rhbz#1304723 - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals Resolves: rhbz#1288255 - Include patch from distgit repo: policy-RHEL-7.1-flask.patch. Resolves: rhbz#1329560 - Update refpolicy to handle hwloc Resolves: rhbz#1344054 - Label /etc/dhcp/scripts dir as bin_t - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals. Resolves: rhbz#1288255- Allow firewalld_t to create entries in net_conf_t dirs. Resolves: rhbz#1304723 - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals Resolves: rhbz#1288255 - Allow mongod log to syslog. Resolves: rhbz#1306995 - Allow rhsmcertd connect to port tcp 9090 Resolves: rhbz#1337319 - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove. Resolves: rhbz#1262483 Resolves: rhbz#1277506 - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t. Resolves: rhbz#1301516 - Add new boolean spamd_update_can_network. Resolves: rhbz#1305469 - Allow rhsmcertd connect to tcp netport_port_t Resolves: rhbz#1329475 - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t. Resolves: rhbz#1328234 - Allow prosody to bind to fac_restore tcp port. Resolves: rhbz#1321787 - Allow ninfod to read raw packets Resolves: rhbz#1317964 - Allow pegasus get attributes from qemu binary files. Resolves: rhbz#1260835 - Allow pegasus get attributes from qemu binary files. Resolves: rhbz#1271159 - Allow tuned to use policykit. This change is required by cockpit. Resolves: rhbz#1346464 - Allow conman_t to read dir with conman_unconfined_script_t binary files. Resolves: rhbz#1297323 - Allow pegasus to read /proc/sysinfo. Resolves: rhbz#1265883 - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals. Resolves: rhbz#1288255 - Label tcp ports:16379, 26379 as redis_port_t Resolves: rhbz#1348471 - Allow systemd to relabel /var and /var/lib directories during boot. - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces. - Add files_relabelto_var_lib_dirs() interface. - Label tcp port 2004 as mailbox_port_t. Resolves: rhbz#1332843 - Label tcp and udp port 5582 as fac_restore_port_t Resolves: rhbz#1321787 - Allow sysadm_t user to run postgresql-setup. Resolves: rhbz#1282543 - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script. Resolves: rhbz#1297480 - Update netlink socket classes.- Allow conman to kill conman_unconfined_script. Resolves: rhbz#1297323 - Make conman_unconfined_script_t as init_system_domain. Resolves:rhbz#1297323 - Allow init dbus chat with apmd. Resolves:rhbz#995898 - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t. Resolves: rhbz#1233252 - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Add mediawiki rules to proper scope Resolves: rhbz#1301186 - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t Resolves: rhbz#1052880 - Allow mysqld_safe to inherit rlimit information from mysqld Resolves: rhbz#1323673 - Allow collectd_t to stream connect to postgresql. Resolves: rhbz#1344056 - Allow mediawiki-script to read /etc/passwd file. Resolves: rhbz#1301186 - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc. Resolves: rhbz#1344505 - Add labels for mediawiki123 Resolves: rhbz#1293872 - Fix label for all fence_scsi_check scripts - Allow ip netns to mounton root fs and unmount proc_t fs. Resolves: rhbz#1343776 Resolves: rhbz#1286851 - Allow sysadm_t to run newaliases command. Resolves: rhbz#1344828 - Add interface sysnet_filetrans_named_net_conf() Resolves: rhbz#1344505- Fix several issues related to the SELinux Userspace changes- Allow glusterd domain read krb5_keytab_t files. Resolves: rhbz#1343929 - Fix typo in files_setattr_non_security_dirs. Resolves: rhbz#1115987- Allow tmpreaper_t to read/setattr all non_security_file_type dirs Resolves: rhbz#1115987 - Allow firewalld to create firewalld_var_run_t directory. Resolves: rhbz#1304723 - Add interface firewalld_read_pid_files() Resolves: rhbz#1304723 - Label /usr/libexec/rpm-ostreed as rpm_exec_t. Resolves: rhbz#1340542 - Allow sanlock service to read/write cephfs_t files. Resolves: rhbz#1315332 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added missing docker interfaces: - docker_typebounds - docker_entrypoint Resolves: rhbz#1236580 - Add interface files_setattr_non_security_dirs() Resolves: rhbz#1115987 - Add support for onloadfs - Allow iptables to read firewalld pid files. Resolves: rhbz#1304723 - Add SELinux support for ceph filesystem. Resolves: rhbz#1315332 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) Resolves: rhbz#1236580- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added missing docker interfaces: - docker_typebounds - docker_entrypoint Resolves: rhbz#1236580 - New interfaces needed for systemd-machinectl Resolves: rhbz#1236580 - New interfaces needed by systemd-machine Resolves: rhbz#1236580 - Add interface allowing sending and receiving messages from virt over dbus. Resolves: rhbz#1236580 - Backport docker policy from Fedora. Related: #1303123 Resolves: #1341257 - Allow NetworkManager_t and policykit_t read access to systemd-machined pid files. Resolves: rhbz#1236580 - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS) - Added interfaces needed by new docker policy. Related: rhbz#1303123 - Add support for systemd-machined daemon Resolves: rhbz#1236580 - Allow rpm-ostree domain transition to install_t domain from init_t. Resolves: rhbz#1340542- dnsmasq: allow NetworkManager to control dnsmasq via D-Bus Resolves: rhbz#1336722 - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te Resolves: rhbz#1333198 - sftpd_* booleans are functionless these days. Resolves: rhbz#1335656 - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t. Resolves: rhbz#1335828 - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus. Resolves: rhbz#1336760 - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t. Resolves: rhbz#1336737 - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain. Resolves: rhbz#1264390 - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t. Resolves: rhbz#1337061 - Revert "Allow all domains some process flags." Resolves: rhbz#1303644 - Revert "Remove setrlimit to all domains." Resolves: rhbz#1303644 - Label /usr/sbin/xrdp* files as bin_t Resolves: rhbz#1276777 - Add mls support for some db classes Resolves: rhbz#1303651 - Allow systemd_resolved_t to check if ipv6 is disabled. Resolves: rhbz#1236579 - Allow systemd_resolved to read systemd_networkd run files. Resolves: rhbz#1236579- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus. Resolves: rhbz#1336760 - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t. Resolves: rhbz#1336737- Allow logwatch to domtrans to postqueue Resolves: rhbz#1331542 - Label /var/log/ganesha.log as gluster_log_t - Allow glusterd_t domain to create glusterd_log_t files. - Label /var/run/ganesha.pid as gluster_var_run_t. Resolves: rhbz#1335828 - Allow zabbix to connect to postgresql port Resolves: rhbz#1330479 - Add userdom_destroy_unpriv_user_shared_mem() interface. Related: rhbz#1306403 - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments. Resolves: rhbz#1306403- We need to restore contexts on /etc/passwd*,/etc/group*,/etc/*shadow* during install phase to get proper labeling for these files until selinux-policy pkgs are installed. Resolves: rhbz#1333952- Add interface glusterd_dontaudit_read_lib_dirs() Resolves: rhbz#1295680 - Dontaudit Occasionally observing AVC's while running geo-rep automation Resolves: rhbz#1295680 - Allow glusterd to manage socket files labeled as glusterd_brick_t. Resolves: rhbz#1331561 - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content Resolves: rhbz#1246522 - Allow stunnel create log files. Resolves: rhbz#1296851 - Label tcp port 8181 as intermapper_port_t. Resolves: rhbz#1334783 - Label tcp/udp port 2024 as xinuexpansion4_port_t Resolves: rhbz#1334783 - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t Resolves: rhbz#1334783 - Dontaudit ldconfig read gluster lib files. Resolves: rhbz#1295680 - Add interface auth_use_nsswitch() to systemd_domain_template. Resolves: rhbz#1236579- Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs. Resolves: rhbz#1312809 Resolves: rhbz#1323947 - Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144 - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t. Resolves: rhbz#1324144 - Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports. Resolves: rhbz#1324144 - Allow prosody to listen on port 5000 for mod_proxy65. Resolves: rhbz#1316918 - Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled. Resolves: rhbz#1309454- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs. Resolves: rhbz#1319442 - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap. Resolves: rhbz#1296640 - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits. Resolves: rhbz#1097775 - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution. If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t. Resolves: rhbz#1262483 - Allow nsd daemon to create log file in /var/log as nsd_log_t Resolves: rhbz#1293140 - Sanlock policy update. - New sub-domain for sanlk-reset daemon Resolves: rhbz#1212324 - Label all run tgtd files, not just socket files Resolves: rhbz#1280280 - Label all run tgtd files, not just socket files. Resolves: rhbz#1280280 - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody. Resolves: rhbz#1321049 - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets. Resolves: rhbz#1318224 - Allow prosody to listen on port 5000 for mod_proxy65. Resolves: rhbz#1316918 - Allow targetd to read/write to /dev/mapper/control device. Resolves: rhbz#1063714 - Allow KDM to get status about power services. This change allow kdm to be able do shutdown. Resolves: rhbz#1316724 - Allow systemd-resolved daemon creating netlink_route sockets. Resolves:rhbz#1236579 - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used Resolves: rhbz#1065362 - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t Resolves: rhbz#1321943 - Label all nvidia binaries as xserver_exec_t Resolves: rhbz#1322283- Create new permissivedomains CIL module and make it active. Resolves: rhbz#1320451 - Add support for new mock location - /usr/libexec/mock/mock. Resolves: rhbz#1271209 - Allow bitlee to create bitlee_var_t dirs. Resolves: rhbz#1268651 - Allow CIM provider to read sssd public files. Resolves: rhbz#1263339 - Fix some broken interfaces in distro policy. Resolves: rhbz#1121171 - Allow power button to shutdown the laptop. Resolves: rhbz#995898 - Allow lsm plugins to create named fixed disks. Resolves: rhbz#1238066 - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777 - Allow hyperv domains to rw hyperv devices. Resolves: rhbz#1309361 - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780 - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/ Resolves: rhbz#1297323 - Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib. - Add support for /dev/mptctl device used to check RAID status. Resolves: rhbz#1258029 - Create hyperv* devices and create rw interfaces for this devices. Resolves: rhbz#1309361 - Add fixes for selinux userspace moving the policy store to /var/lib/selinux. - Remove optional else block for dhcp ping- Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks. Resolves: rhbz#1263770 - Fix context of "/usr/share/nginx/html". Resolves: rhbz#1261857 - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics Resolves: rhbz#1270344 - Allow pmlogger to create pmlogger.primary.socket link file. Resolves: rhbz#1270344 - Label nagios scripts as httpd_sys_script_exec_t. Resolves: rhbz#1260306 - Add dontaudit interface for kdumpctl_tmp_t Resolves: rhbz#1156442 - Allow mdadm read files in EFI partition. Resolves: rhbz#1291801 - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid. Resolves: rhbz#1293140 - Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs Resolves: rhbz#1293140 - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface. Resolves: rhbz#1265102 - Add missing labeling for /usr/libexec/abrt-hook-ccpp. Resolves: rhbz#1213409 - Allow pcp_pmie and pcp_pmlogger to read all domains state. Resolves: rhbz#1206525 - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port. Resolves: rhbz#1275246 - cockpit has grown content in /var/run directory Resolves: rhbz#1279429 - Allow collectd setgid capability Resolves:#1310898 - Remove declaration of empty booleans in virt policy. Resolves: rhbz#1103153 - Fix typo in drbd policy - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp. Resolves: rhbz#1134883 - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files. Resolves: rhbz#1293788 - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern. Resolves: rhbz#1254188 - Allow abrt_t to read sysctl_net_t files. Resolves: rhbz#1254188 - The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system. - Allow abrt-hook-ccpp to getattr on all executables. - Allow setuid/setgid capabilities for abrt-hook-ccpp. Resolves: rhbz#1254188 - abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling. Resolves: rhbz#1254188 - Allow abrt-hook-ccpp to change SELinux user identity for created objects. Resolves: rhbz#1254188 - Dontaudit write access to inherited kdumpctl tmp files. Resolves: rbhz#1156442 - Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables) Resolves: rhbz#1291801 - Label 8952 tcp port as nsd_control. Resolves: rhbz#1293140 - Allow ipsec to use pam. Resolves: rhbz#1315700 - Allow to log out to gdm after screen was resized in session via vdagent. Resolves: rhbz#1249020 - Allow setrans daemon to read /proc/meminfo. Resolves: rhbz#1316804 - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg Resolves: rhbz#1298151 - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution Resolves: rhbz#1236579 - Add new selinux policy for systemd-resolved dawmon. Resolves: rhbz#1236579 - Add interface ssh_getattr_server_keys() interface. Resolves: rhbz#1306197 - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106 Resolves: rhbz#1306197 - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used. Resolves: rhbz#1309417 - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t. Resolves: rhbz#1293788- Prepare selinux-policy package for userspace release 2016-02-23. Resolves: rhbz#1305982- Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902 - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols. Resolves: rhbz#1242506 - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba. Resolves: rhbz#1284972 - Add support for systemd-hwdb daemon. Resolves: rhbz#1257940 - Add interface fs_setattr_cifs_dirs(). Resolves: rhbz#1284972- Add new SELinux policy fo targetd daemon. Resolves: rhbz#1063714 - Add new SELinux policy fo ipmievd daemon. Resolves: rhbz#1083031 - Add new SELinux policy fo hsqldb daemon. Resolves: rhbz#1083171 - Add new SELinux policy for blkmapd daemon. Resolves: rhbz#1072997 - Allow p11-child to connect to apache ports. - Label /usr/sbin/lvmlockd binary file as lvm_exec_t. Resolves: rhbz#1278028 - Add interface "lvm_manage_lock" to lvm policy. Resolves: rhbz#1063714- Allow openvswitch domain capability sys_rawio. Resolves: rhbz#1278495- Allow openvswitch to manage hugetlfs files and dirs. Resolves: rhbz#1278495 - Add fs_manage_hugetlbfs_files() interface. Resolves: rhbz#1278495- Allow smbcontrol domain to send sigchld to ctdbd domain. Resolves: #1293784 - Allow openvswitch read/write hugetlb filesystem. Resolves: #1278495Allow hypervvssd to list all mountpoints to have VSS live backup working correctly. Resolves:#1247880- Revert Add missing labeling for /usr/libexec/abrt-hook-ccpp patch Resolves: #1254188- Allow search dirs in sysfs types in kernel_read_security_state. Resolves: #1254188 - Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs. Resolves: #1254188- Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs Resolves: #1254188 - We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes. Resolves:#1261938- Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t. - Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions. Resolves:#1266928- We need to require sandbox_web_type attribute in sandbox_x_domain_template(). Resolves: #1261938 - ipsec: The NM helper needs to read the SAs Resolves: #1259786 - ipsec: Allow ipsec management to create ptys Resolves: #1259786- Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type. Resolves:#1261938 - Allow abrt_t domain to write to kernel msg device. Resolves: #1257828 - Allow rpcbind_t domain to change file owner and group Resolves: #1265266- Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. Resolves: #1256459- Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it. Resolves: #1230300 - Allow qpid daemon to connect on amqp tcp port. Resolves: #1261805- Label /etc/ipa/nssdb dir as cert_t Resolves:#1262718 - Do not provide docker policy files which is shipped by docker-selinux.rpm Resolves:#1262812- Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager Resolves: #1192338 - Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem. Resolves: #1238079 - Allow rhsmcertd_t send signull to unconfined_service_t domains. Resolves: #1176078 - Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t. - Allow openhpid_t daemon to manage snmp files and dirs. Resolves: #1243902 - Allow mdadm_t domain read/write to general ptys and unallocated ttys. Resolves: #1073314 - Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t Resolves: #1176078- Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. Resolves:#1250456- Fix labeling for fence_scsi_check script Resolves: #1255020 - Allow openhpid to read system state Allow openhpid to connect to tcp http port. Resolves: #1244248 - Allow openhpid to read snmp var lib files. Resolves: #1243902 - Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe - Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t Resolves: #1243403 - Remove bin_t label for /usr/share/cluster/fence_scsi_check\.pl Resolves: #1255020- Fix regexp in chronyd.fc file Resolves: #1243764 - Allow passenger to getattr filesystem xattr Resolves: #1196555 - Label mdadm.conf.anackbak as mdadm_conf_t file. Resolves: #1088904 - Revert "Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc." - Allow watchdog execute fenced python script. Resolves: #1255020 - Added inferface watchdog_unconfined_exec_read_lnk_files() - Remove labeling for /var/db/.*\.db as etc_t to label db files as system_db_t. Resolves: #1230877- Allow watchdog execute fenced python script. Resolves: #1255020 - Added inferface watchdog_unconfined_exec_read_lnk_files() - Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764 - Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764- Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file. Resolves: #1252442- Allow exec pidof under hypervkvp domain. Resolves: #1254870 - Allow hypervkvp daemon create connection to the system DBUS Resolves: #1254870- Allow openhpid_t to read system state. Resolves: #1244248 - Added labels for files provided by rh-nginx18 collection Resolves: #1249945 - Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db. Resolves: #1252968 - Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution. Resolves: #1243431 - Allow abrt_dump_oops_t to read proc_security_t files. - Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains - Add interface abrt_dump_oops_domtrans() - Add mountpoint dontaudit access check in rhsmcertd policy. Resolves: #1243431 - Allow samba_net_t to manage samba_var_t sock files. Resolves: #1252937 - Allow chrome setcap to itself. Resolves: #1251996 - Allow httpd daemon to manage httpd_var_lib_t lnk_files. Resolves: #1253706 - Allow chronyd exec systemctl Resolves: #1243764 - Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t. Resolves: #1243764 - Added interface fs_dontaudit_write_configfs_dirs - Add label for kernel module dep files in /usr/lib/modules Resolves:#916635 - Allow kernel_t domtrans to abrt_dump_oops_t - Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override. - Allow systemd-networkd to send logs to systemd-journald. Resolves: #1236616- Fix label on /var/tmp/kiprop_0 Resolves:#1220763 - Allow lldpad_t to getattr tmpfs_t. Resolves: #1246220 - Label /dev/shm/lldpad.* as lldapd_tmpfs_t Resolves: #1246220 - Allow audisp client to read system state.- Allow pcp_domain to manage pcp_var_lib_t lnk_files. Resolves: #1252341 - Label /var/run/xtables.* as iptables_var_run_t Resolves: #1243403- Add interface to read/write watchdog device - Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde Resolves:#1210237 - Allow apcupsd_t to read /sys/devices Resolves:#1189185 - Allow logrotate to reload services. Resolves: #1242453 - Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device) Resolves: #1244260 - Allow openhpid liboa_soap plugin to read generic certs. Resolves: #1244248 - Allow openhpid liboa_soap plugin to read resolv.conf file. Resolves: #1244248 - Label /usr/libexec/chrony-helper as chronyd_exec_t - Allow chronyd_t to read dhcpc state. - Allow chronyd to execute mkdir command.- Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t. Resolves:#1073314 - Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if 'dracut -fv' is executed in MLS. - Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if 'dracut -vf' is executed. We allow it for other SELinux users. - Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode. - Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling. Resolves:#1183503 - Add support for /etc/sanlock which is writable by sanlock daemon. Resolves:#1231377 - Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet. Resolves:#1243775 - Allow snapperd to pass data (one way only) via pipe negotiated over dbus Resolves:#1250550 - Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.- Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files). Resolves: #1243902 - Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device Resolves: #1238079 - Allow lsm_plugin_t to rw raw_fixed_disk. Resolves:#1238079 - Allow rhsmcertd to send signull to unconfined_service.- Allow httpd_suexec_t to read and write Apache stream sockets Resolves: #1243569 - Allow qpid to create lnk_files in qpid_var_lib_t Resolves: #1247279- Allow drbd to get attributes from filesystems. - Allow redis to read kernel parameters. Resolves: #1209518 - Allow virt_qemu_ga_t domtrans to passwd_t - Allow audisp_remote_t to start power unit files domain to allow halt system. Resolves: #1186780 - Allow audisp_remote_t to read/write user domain pty. Resolves: #1186780 - Label /usr/sbin/chpasswd as passwd_exec_t. - Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds). Resolves:#1221121- gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te - Allow pcp_pmcd daemon to read postfix config files. - Allow pcp_pmcd daemon to search postfix spool dirs. Resolves: #1213740 - Added Booleans: pcp_read_generic_logs. Resolves: #1213740 - Allow drbd to read configuration options used when loading modules. Resolves: #1134883 - Allow glusterd to manage nfsd and rpcd services. - Allow glusterd to communicate with cluster domains over stream socket. - glusterd call pcs utility which calls find for cib.* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.- Allow glusterd to manage nfsd and rpcd services. - Allow networkmanager to communicate via dbus with systemd_hostanmed. Resolves: #1234954 - Allow stream connect logrotate to prosody. - Add prosody_stream_connect() interface. - httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t. - Allow prosody to create own tmp files/dirs. Resolves:#1212498- Allow networkmanager read rfcomm port. Resolves:#1212498 - Remove non exists label. - Fix *_admin intefaces where body is not consistent with header. - Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config - Remove non exits nfsd_ro_t label. - Make all interfaces related to openshift_cache_t as deprecated. - Add rpm_var_run_t label to rpm_admin header - Add jabberd_lock_t label to jabberd_admin header. - Add samba_unconfined_script_exec_t to samba_admin header. - inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t - Fix ctdb policy - Add samba_signull_winbind() - Add samba_signull_unconfined_net() - Allow ctdbd_t send signull to samba_unconfined_net_t. - Allow openshift_initrc_t to communicate with firewalld over dbus Resolves:#1221326- Allow gluster to connect to all ports. It is required by random services executed by gluster. - Add interfaces winbind_signull(), samba_unconfined_net_signull(). - Dontaudit smbd_t block_suspend capability. This is kernel bug. - Allow ctdbd sending signull to process winbind, samba_unconfined_net, to checking if processes exists. - Add tmpreaper booleans to use nfs_t and samba_share_t. - Fix path from /usr/sbin/redis-server to /usr/bin/redis-server - Allow connect ypserv to portmap_port_t - Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files - Add support for openstack-nova-* packages - Allow NetworkManager_t send signull to dnssec_trigger_t. - Allow glusterd to execute showmount in the showmount domain. - Label swift-container-reconciler binary as swift_t. - Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files. - Add cobbler_var_lib_t to "/var/lib/tftpboot/boot(/.*)?" Resolves:#1213540 - Merge all nova_* labels under one nova_t.- Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins Resolves:#1233550 - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/ - Add support for oddjob based helper in FreeIPA. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add nagios_domtrans_unconfined_plugins() interface. - Update mta_filetrans_named_content() interface to cover more db files. Resolves:#1167468 - Add back ftpd_use_passive_mode boolean with fixed description. - Allow pmcd daemon stream connect to mysqld. - Allow pcp domains to connect to own process using unix_stream_socket. Resolves:#1213709 - Allow abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add support for oddjob based helper in FreeIPA. - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/- Allow iptables to read ctdbd lib files. Resolves:#1224879 - Add systemd_networkd_t to nsswitch domains. - Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization. Resolves:#1130675 - Allow NetworkManager write to sysfs. - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission. - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types. - Allow NetworkManager write to sysfs. - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. - Dontaudit apache to manage snmpd_var_lib_t files/dirs. - Add interface snmp_dontaudit_manage_snmp_var_lib_files(). - Dontaudit mozilla_plugin_t cap. sys_ptrace. - Rename xodbc-connect port to xodbc_connect - Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports. - Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot. - Dontaudit chrome to read passwd file. - nrpe needs kill capability to make gluster moniterd nodes working. Resolves:#1235587- We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem. - Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so. - Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password. - Label gluster python hooks also as bin_t. - Allow glusterd to interact with gluster tools running in a user domain - Add glusterd_manage_lib_files() interface. - ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid. - Allow samba_t net_admin capability to make CIFS mount working. - S30samba-start gluster hooks wants to search audit logs. Dontaudit it. Resolves:#1224879- Allow glusterd to send generic signals to systemd_passwd_agent processes. - Allow glusterd to access init scripts/units without defined policy - Allow glusterd to run init scripts. - Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain. Resolves:#1224879- Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block. - Allow samba-net to access /var/lib/ctdbd dirs/files. - Allow glusterd to send a signal to smbd. - Make ctdbd as home manager to access also FUSE. - Allow glusterd to use geo-replication gluster tool. - Allow glusterd to execute ssh-keygen. - Allow glusterd to interact with cluster services. - Allow glusterd to connect to the system DBUS for service (acquire_svc). - Label /dev/log correctly. Resolves:#1230932- Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs - Add cgdcbxd policy Resolves:#1072493 - Fix ftp_homedir boolean Resolve:#1097775 - Dontaudit ifconfig writing inhertited /var/log/pluto.log. - Allow cluster domain to dbus chat with systemd-logind. Resolves:#1145215 - Dontaudit write access to inherited kdumpctl tmp files Resolves:#1156442 - Allow isnsd_t to communicate with sssd Resolves:#1167702 - Allow rwho_t to communicate with sssd Resolves:#1167718 - Allow sblim_gatherd_t to communicate with sssd Resolves:#1167732 - Allow pkcs_slotd_t to communicate with sssd Resolves:#1167737 - Allow openvswitch_t to communicate with sssd Resolves:#1167816 - Allow mysqld_safe_t to communicate with sssd Resolves:#1167832 - Allow sshd_keygen_t to communicate with sssd Resolves:#1167840 - Add support for iprdbg logging files in /var/log. Resolves:#1174363 - Allow tmpreaper_t to manage ntp log content Resolves:#1176965 - Allow gssd_t to manage ssh keyring Resolves:#1184791 - Allow httpd_sys_script_t to send system log messages Resolves:#1185231 - Allow apcupsd_t to read /sys/devices Resolves:#1189185 - Allow dovecot_t sys_resource capability Resolves:#1191143 - Add support for mongod/mongos systemd unit files. Resolves:#1197038 - Add bacula fixes - Added label mysqld_etc_t for /etc/my.cnf.d/ dir. Resolves:#1203991- Label /usr/libexec/postgresql-ctl as postgresql_exec_t. - Add more restriction on entrypoint for unconfined domains. - Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface - Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default. - Update policy/mls for sockets related to access perm. Rules were contradictory. - Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow r un sudo from NRPE utils scripts and allow run nagios in conjunction w ith PNP4Nagios. Resolves:#1201054 - Don't use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead. - Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type - Label /var/lib/tftpboot/aarch64(/.*)? and /var/lib/tftpboot/images2(/.*)? - Add support for iprdbg logging files in /var/log. - Add fixes to rhsmcertd_t - Allow puppetagent_t to transfer firewalld messages over dbus - Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script. - Added label mysqld_etc_t for /etc/my.cnf.d/ dir. - Add support for mongod/mongos systemd unit files. - cloudinit and rhsmcertd need to communicate with dbus - Allow dovecot_t sys_resource capability- ALlow mongod execmem by default. - Update policy/mls for sockets. Rules were contradictory. Resolves:#1207133 - Allow a user to login with different security level via ssh.- Update seutil_manage_config() interface. Resolves:#1185962 - Allow pki-tomcat relabel pki_tomcat_etc_rw_t. - Turn on docker_transition_unconfined by default- Allow virtd to list all mountpoints. Resolves:#1180713- pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t. - Allow fowner capability for sssd because of selinux_child handling. - ALlow bind to read/write inherited ipsec pipes - Allow hypervkvp to read /dev/urandom and read addition states/config files. - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd. - Add glusterd_filetrans_named_pid() interface - Allow radiusd to connect to radsec ports. - Allow setuid/setgid for selinux_child - Allow lsmd plugin to connect to tcp/5988 by default. - Allow lsmd plugin to connect to tcp/5989 by default. - Update ipsec_manage_pid() interface. Resolves:#1184978- Update ipsec_manage_pid() interface. Resolves:#1184978- Allow ntlm_auth running in winbind_helper_t to access /dev/urandom.- Add auditing support for ipsec. Resolves:#1182524 - Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t - Allow netutils chown capability to make tcpdump working with -w- Allow ipsec to execute _updown.netkey script to run unbound-control. - Allow neutron to read rpm DB. - Add additional fixes for hyperkvp * creates new ifcfg-{name} file * Runs hv_set_ifconfig.sh, which does the following * Copies ifcfg-{name} to /etc/sysconfig/network-scripts - Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t - Add labeling for pacemaker.log. - Allow radius to connect/bind radsec ports. - Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log - Allow virt_qemu_ga to dbus chat with rpm. - Update virt_read_content() interface to allow read also char devices. - Allow glance-registry to connect to keystone port. Resolves:#1181818- Allow sssd to send dbus all user domains. Resolves:#1172291 - Allow lsm plugin to read certificates. - Fix labeling for keystone CGI scripts. - Make snapperd back as unconfined domain.- Fix bugs in interfaces discovered by sepolicy. - Allow slapd to read /usr/share/cracklib/pw_dict.hwm. - Allow lsm plugins to connect to tcp/18700 by default. - Allow brltty mknod capability to allow create /var/run/brltty/vcsa. - Fix pcp_domain_template() interface. - Fix conman.te. - Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc - Allow glance-scrubber to connect tcp/9191. - Add missing setuid capability for sblim-sfcbd. - Allow pegasus ioctl() on providers. - Add conman_can_network. - Allow chronyd to read chrony conf files located in /run/timemaster/. - Allow radius to bind on tcp/1813 port. - dontaudit block suspend access for openvpn_t - Allow conman to create files/dirs in /tmp. - Update xserver_rw_xdm_keys() interface to have 'setattr'. Resolves:#1172291 - Allow sulogin to read /dev/urandom and /dev/random. - Update radius port definition to have also tcp/18121 - Label prandom as random_device_t. - Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.- Allow virt_qemu_ga_t to execute kmod. - Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean. - Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs. Resolves:#1113725 - Enable OpenStack cinder policy - Add support for /usr/share/vdsm/daemonAdapter - Add support for /var/run/gluster- Remove old pkcsslotd.pp from minimum package - Allow rlogind to use also rlogin ports. - Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t. - Allow bacula to connect also to postgresql. - Label /usr/libexec/tomcat/server as tomcat_exec_t - Add support for /usr/sbin/ctdbd_wrapper - Add support for /usr/libexec/ppc64-diag/rtas_errd - Allow rpm_script_roles to access system_mail_t - Allow brltty to create /var/run/brltty - Allow lsmd plugin to access netlink_route_socket - Allow smbcontrol to read passwd - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it Resolves:#1140106 - Allow osad to execute rhn_check - Allow load_policy to rw inherited sssd pipes because of selinux_child - Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS - Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly - Add additional booleans substitions- Add seutil_dontaudit_access_check_semanage_module_store() interface Resolves:#1140106 - Update to have all _systemctl() interface also init_reload_services(). - Dontaudit access check on SELinux module store for sssd. - Add labeling for /sbin/iw. - Allow named_filetrans_domain to create ibus directory with correct labeling.- Allow radius to bind tcp/1812 radius port. - Dontaudit list user_tmp files for system_mail_t. - Label virt-who as virtd_exec_t. - Allow rhsmcertd to send a null signal to virt-who running as virtd_t. - Add missing alias for _content_rw_t. Resolves:#1089177 - Allow spamd to access razor-agent.log. - Add fixes for sfcb from libvirt-cim TestOnly bug. - Allow NetworkManager stream connect on openvpn. - Make /usr/bin/vncserver running as unconfined_service_t. - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain. - Label /etc/docker/certs.d as cert_t.- Label /etc/strongimcv as ipsec_conf_file_t. - Add support for /usr/bin/start-puppet-ca helper script Resolves:#1160727 - Allow rpm scripts to enable/disable transient systemd units. Resolves:#1154613 - Make kpropdas nsswitch domain Resolves:#1153561 - Make all glance domain as nsswitch domains Resolves:#1113281 - Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active - Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t Resolves:#1140106- Dontaudit access check on setfiles/load_policy for sssd_t. Resolves:#1140106 - Add kdump_rw_inherited_kdumpctl_tmp_pipes() Resolves:#1156442 - Make linuxptp services as unconfined. - Added new policy linuxptp. Resolves:#1149693 - Label keystone cgi files as keystone_cgi_script_exec_t. Resolves:#1138424 - Make tuned as unconfined domain- Allow guest to connect to libvirt using unix_stream_socket. - Allow all bus client domains to dbus chat with unconfined_service_t. - Allow inetd service without own policy to run in inetd_child_t which is unconfined domain. - Make opensm as nsswitch domain to make it working with sssd. - Allow brctl to read meminfo. - Allow winbind-helper to execute ntlm_auth in the caller domain. Resolves:#1160339 - Make plymouthd as nsswitch domain to make it working with sssd. Resolves:#1160196 - Make drbd as nsswitch domain to make it working with sssd. - Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working. - Add support for /var/lib/sntp directory. - Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc - Allow winbind to read usermodehelper - Allow telepathy domains to execute shells and bin_t - Allow gpgdomains to create netlink_kobject_uevent_sockets - Allow mongodb to bind to the mongo port and mongos to run as mongod_t - Allow abrt to read software raid state. - Allow nslcd to execute netstat. - Allow dovecot to create user's home directory when they log into IMAP. - Allow login domains to create kernel keyring with different level.- Allow modemmanger to connectto itself Resolves:#1120152 - Allow pki_tomcat to create link files in /var/lib/pki-ca. Resolves:#1121744 - varnishd needs to have fsetid capability Resolves:#1125165 - Allow snapperd to dbus chat with system cron jobs. Resolves:#1152447 - Allow dovecot to create user's home directory when they log into IMAP Resolves:#1152773 - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t. - ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. - Allow nslcd to execute netstat. - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability. - Allow nslcd to read /dev/urandom.- Add back kill permisiion for system class Resolves:#1150011- Add back kill permisiion for service class Resolves:#1150011 - Make rhsmcertd_t also as dbus domain. - Allow named to create DNS_25 with correct labeling. - Add cloudform_dontaudit_write_cloud_log() - Call auth_use_nsswitch to apache to read/write cloud-init keys. - Allow cloud-init to dbus chat with certmonger. - Fix path to mon_statd_initrc_t script. - Allow all RHCS services to read system state. - Allow dnssec_trigger_t to execute unbound-control in own domain. - kernel_read_system_state needs to be called with type. Moved it to antivirus.if. - Added policy for mon_statd and mon_procd services. BZ (1077821) - Allow opensm_t to read/write /dev/infiniband/umad1. - Allow mongodb to manage own log files. - Allow neutron connections to system dbus. - Add support for /var/lib/swiftdirectory. - Allow nova-scheduler to read certs. - Allow openvpn to access /sys/fs/cgroup dir. - Allow openvpn to execute systemd-passwd-agent in systemd_passwd_agent_t to make openvpn working with systemd. - Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files. - Add auth_use_nsswitch for portreserve to make it working with sssd. - automount policy is non-base module so it needs to be called in optional block. - ALlow sensord to getattr on sysfs. - Label /usr/share/corosync/corosync as cluster_exec_t. - Allow lmsd_plugin to read passwd file. BZ(1093733) - Allow read antivirus domain all kernel sysctls. - Allow mandb to getattr on file systems - Allow nova-console to connect to mem_cache port. - Make sosreport as unconfined domain. - Allow mondogdb to 'accept' accesses on the tcp_socket port. - ALlow sanlock to send a signal to virtd_t.- Build also MLS policy Resolves:#1138424- Add back kill permisiion for system class - Allow iptables read fail2ban logs. - Fix radius labeled ports - Add userdom_manage_user_tmpfs_files interface - Allow libreswan to connect to VPN via NM-libreswan. - Label 4101 tcp port as brlp port - fix dev_getattr_generic_usb_dev interface - Allow all domains to read fonts - Make sure /run/systemd/generator and system is labeled correctly on creation. - Dontaudit aicuu to search home config dir. - Make keystone_cgi_script_t domain. Resolves:#1138424 - Fix bug in drbd policy, - Added support for cpuplug. - ALlow sanlock_t to read sysfs_t. - Added sendmail_domtrans_unconfined interface - Fix broken interfaces - radiusd wants to write own log files. - Label /usr/libexec/rhsmd as rhsmcertd_exec_t - Allow rhsmcertd send signull to setroubleshoot. - Allow rhsmcertd manage rpm db. - Added policy for blrtty. - Fix keepalived policy - Allow rhev-agentd dbus chat with systemd-logind. - Allow keepalived manage snmp var lib sock files. - Add support for /var/lib/graphite-web - Allow NetworkManager to create Bluetooth SDP sockets - It's going to do the the discovery for DUN service for modems with Bluez 5. - Allow swift to connect to all ephemeral ports by default. - Allow sssd to read selinux config to add SELinux user mapping. - Allow lsmd to search own plguins. - Allow abrt to read /dev/memto generate an unique machine_id and uses sosuploader's algorithm based off dmidecode[1] fields. - ALlow zebra for user/group look-ups. - Allow nova domains to getattr on all filesystems. - Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes. - Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket. - Allow rhnsd_t to manage also rhnsd config symlinks. - ALlow user mail domains to create dead.letter. - Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. - Allow pki-tomcat to change SELinux object identity. - Allow radious to connect to apache ports to do OCSP check - Allow git cgi scripts to create content in /tmp - Allow cockpit-session to do GSSAPI logins. - Allow sensord read in /proc - Additional access required by usbmuxd- Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems - Label /usr/lib/erlang/erts.*/bin files as bin_t - Add files_dontaudit_access_check_home_dir() inteface. - Allow udev_t mounton udev_var_run_t dirs #(1128618) - Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it. - Add init_dontaudit_read_state() interface. - Add label for ~/.local/share/fonts - Allow unconfined_r to access unconfined_service_t. - Allow init to read all config files - Add new interface to allow creation of file with lib_t type - Assign rabbitmq port. - Allow unconfined_service_t to dbus chat with all dbus domains - Add new interfaces to access users keys. - Allow domains to are allowed to mounton proc to mount on files as well as dirs - Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories. - Add a port definition for shellinaboxd - Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t - Allow userdomains to stream connect to pcscd for smart cards - Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix) - Update to rawhide-contrib changes Resolves:#1123844- Rebase to 3.13.1 which we have in Fedora21 Resolves:#1128284- Back port fixes from Fedora. Mainly OpenStack and Docker fixes- Add policy-rhel-7.1-{base,contrib} patches- Add support for us_cli ports - Fix labeling for /var/run/user//gvfs - add support for tcp/9697 - Additional rules required by openstack, needs backport to F20 and RHEL7 - Additional access required by docker - ALlow motion to use tcp/8082 port - Allow init_t to setattr/relabelfrom dhcp state files - Dontaudit antivirus domains read access on all security files by default - Add missing alias for old amavis_etc_t type - Allow block_suspend cap for haproxy - Additional fixes for instack overcloud - Allow OpenStack to read mysqld_db links and connect to MySQL - Remove dup filename rules in gnome.te - Allow sys_chroot cap for httpd_t and setattr on httpd_log_t - Allow iscsid to handle own unit files - Add iscsi_systemctl() - Allow mongod to create also sock_files in /run with correct labeling - Allow httpd to send signull to apache script domains and don't audit leaks - Allow rabbitmq_beam to connect to httpd port - Allow aiccu stream connect to pcscd - Allow dmesg to read hwdata and memory dev - Allow all freeipmi domains to read/write ipmi devices - Allow sblim_sfcbd to use also pegasus-https port - Allow rabbitmq_epmd to manage rabbit_var_log_t files - Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input - Allow docker to status any unit file and allow it to start generic unit files- Change hsperfdata_root to have as user_tmp_t Resolves:#1076523- Fix Multiple same specifications for /var/named/chroot/dev/zero - Add labels for /var/named/chroot_sdb/dev devices - Add support for strongimcv - Use kerberos_keytab_domains in auth_use_nsswitch - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to - Allow net_raw cap for neutron_t and send sigkill to dnsmasq - Fix ntp_filetrans_named_content for sntp-kod file - Add httpd_dbus_sssd boolean - Dontaudit exec insmod in boinc policy - Rename kerberos_keytab_domain to kerberos_keytab_domains - Add kerberos_keytab_domain() - Fix kerberos_keytab_template() - Make all domains which use kerberos as kerberos_keytab_domain Resolves:#1083670 - Allow kill capability to winbind_t- varnishd wants chown capability - update ntp_filetrans_named_content() interface - Add additional fixes for neutron_t. #1083335 - Dontaudit getattr on proc_kcore_t - Allow pki_tomcat_t to read ipa lib files - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign - Allow init_t run /sbin/augenrules - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces - Allow unpriv SELinux user to use sandbox - Add default label for /tmp/hsperfdata_root- Add file subs also for /var/home- Allow xauth_t to read user_home_dir_t lnk_file - Add labeling for lightdm-data - Allow certmonger to manage ipa lib files - Add support for /var/lib/ipa - Allow pegasus to getattr virt_content - Added some new rules to pcp policy - Allow chrome_sandbox to execute config_home_t - Add support for ABRT FAF- Allow kdm to send signull to remote_login_t process - Add gear policy - Turn on gear_port_t - Allow cgit to read gitosis lib files by default - Allow vdagent to read xdm state - Allow NM and fcoeadm to talk together over unix_dgram_socket- Back port fixes for pegasus_openlmi_admin_t from rawhide Resolves:#1080973 - Add labels for ostree - Add SELinux awareness for NM - Label /usr/sbin/pwhistory_helper as updpwd_exec_t- add gnome_append_home_config() - Allow thumb to append GNOME config home files - Allow rasdaemon to rw /dev/cpu//msr - fix /var/log/pki file spec - make bacula_t as auth_nsswitch domain - Identify pki_tomcat_cert_t as a cert_type - Define speech-dispater_exec_t as an application executable - Add a new file context for /var/named/chroot/run directory - update storage_filetrans_all_named_dev for sg* devices - Allow auditctl_t to getattr on all removeable devices - Allow nsswitch_domains to stream connect to nmbd - Allow unprivusers to connect to memcached - label /var/lib/dirsrv/scripts-INSTANCE as bin_t- Allow also unpriv user to run vmtools - Allow secadm to read /dev/urandom and meminfo Resolves:#1079250 - Add booleans to allow docker processes to use nfs and samba - Add mdadm_tmpfs support - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t - Allow vmware-user-sui to use user ttys - Allow talk 2 users logged via console too - Allow ftp services to manage xferlog_t - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies - allow anaconda to dbus chat with systemd-localed- allow anaconda to dbus chat with systemd-localed - Add fixes for haproxy based on bperkins@redhat.com - Allow cmirrord to make dmsetup working - Allow NM to execute arping - Allow users to send messages through talk - Add userdom_tmp_role for secadm_t- Add additional fixes for rtas_errd - Fix transitions for tmp/tmpfs in rtas.te - Allow rtas_errd to readl all sysctls- Add support for /var/spool/rhsm/debug - Make virt_sandbox_use_audit as True by default - Allow svirt_sandbox_domains to ptrace themselves- Allow docker containers to manage /var/lib/docker content- Allow docker to read tmpfs_t symlinks - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets- Allow collectd to talk to libvirt - Allow chrome_sandbox to use leaked unix_stream_sockets - Dontaudit leaks of sockets into chrome_sandbox_t - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t - Run vmtools as unconfined domains - Allow snort to manage its log files - Allow systemd_cronjob_t to be entered via bin_t - Allow procman to list doveconf_etc_t - allow keyring daemon to create content in tmpfs directories - Add proper labelling for icedtea-web - vpnc is creating content in networkmanager var run directory - Label sddm as xdm_exec_t to make KDE working again - Allow postgresql to read network state - Allow java running as pki_tomcat to read network sysctls - Fix cgroup.te to allow cgred to read cgconfig_etc_t - Allow beam.smp to use ephemeral ports - Allow winbind to use the nis to authenticate passwords- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least. - Allow net_admin cap for fence_virtd running as fenced_t - Make abrt-java-connector working - Make cimtest script 03_defineVS.py of ComputerSystem group working - Fix git_system_enable_homedirs boolean - Allow munin mail plugins to read network systcl- Allow vmtools_helper_t to execute bin_t - Add support for /usr/share/joomla - /var/lib/containers should be labeled as openshift content for now - Allow docker domains to talk to the login programs, to allow a process to login into the container - Allow install_t do dbus chat with NM - Fix interface names in anaconda.if - Add install_t for anaconda. A new type is a part of anaconda policy - sshd to read network sysctls- Allow zabbix to send system log msgs - Allow init_t to stream connect to ipsec Resolves:#1060775- Add docker_connect_any boolean- Allow unpriv SELinux users to dbus chat with firewalld - Add lvm_write_metadata() - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type - Allow pegasus_openlmi_storage_t to write lvm metadata - Add hide_broken_symptoms for kdumpgui because of systemd bug - Make kdumpgui_t as unconfined domain Resolves:#1044299 - Allow docker to connect to tcp/5000- Allow numad to write scan_sleep_millisecs - Turn on entropyd_use_audio boolean by default - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf. - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo - Fix label on irclogs in the homedir - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix - Allow postgresql to use ldap - Add missing syslog-conn port - Add support for /dev/vmcp and /dev/sclp Resolves:#1069310- Modify xdm_write_home to allow create files/links in /root with xdm_home_ - Allow virt domains to read network state Resolves:#1072019- Added pcp rules - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6 - clean up ctdb.te - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow certmonger to list home dirs- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask - Add sysnet_filetrans_named_content_ifconfig() interface - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow kerberos keytab domains to manage sssd/userdomain keys" - Allow to run ip cmd in neutron_t domain- Allow block_suspend cap2 for systemd-logind and rw dri device - Add labeling for /usr/libexec/nm-libreswan-service - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working - Add xserver_rw_xdm_keys() - Allow rpm_script_t to dbus chat also with systemd-located - Fix ipa_stream_connect_otpd() - update lpd_manage_spool() interface - Allow krb5kdc to stream connect to ipa-otpd - Add ipa_stream_connect_otpd() interface - Allow vpnc to unlink NM pids - Add networkmanager_delete_pid_files() - Allow munin plugins to access unconfined plugins - update abrt_filetrans_named_content to cover /var/spool/debug - Label /var/spool/debug as abrt_var_cache_t - Allow rhsmcertd to connect to squid port - Make docker_transition_unconfined as optional boolean - Allow certmonger to list home dirs- Make snapperd as unconfined domain and add additional fixes for it - Remove nsplugin.pp module on upgrade- Add snapperd_home_t for HOME_DIR/.snapshots directory - Make sosreport as unconfined domain - Allow sosreport to execute grub2-probe - Allow NM to manage hostname config file - Allow systemd_timedated_t to dbus chat with rpm_script_t - Allow lsmd plugins to connect to http/ssh/http_cache ports by default - Add lsmd_plugin_connect_any boolean - Allow mozilla_plugin to attempt to set capabilities - Allow lsdm_plugins to use tcp_socket - Dontaudit mozilla plugin from getattr on /proc or /sys - Dontaudit use of the keyring by the services in a sandbox - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t - Allow rabbitmq_beam to connect to jabber_interserver_port - Allow logwatch_mail_t to transition to qmail_inject and queueu - Added new rules to pcp policy - Allow vmtools_helper_t to change role to system_r - Allow NM to dbus chat with vmtools - Fix couchdb_manage_files() to allow manage couchdb conf files - Add support for /var/run/redis.sock - dontaudit gpg trying to use audit - Allow consolekit to create log directories and files - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow pkcsslotd to read users state - Add ioctl to init_dontaudit_rw_stream_socket - Add systemd_hostnamed_manage_config() interface - Remove transition for temp dirs created by init_t - gdm-simple-slave uses use setsockopt - sddm-greater is a xdm type program- Add lvm_read_metadata() - Allow auditadm to search /var/log/audit dir - Add lvm_read_metadata() interface - Allow confined users to run vmtools helpers - Fix userdom_common_user_template() - Generic systemd unit scripts do write check on / - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files - Add additional fixes needed for init_t and setup script running in generic unit files - Allow general users to create packet_sockets - added connlcli port - Add init_manage_transient_unit() interface - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t - Fix userdomain.te to require passwd class - devicekit_power sends out a signal to all processes on the message bus when power is going down - Dontaudit rendom domains listing /proc and hittping system_map_t - Dontauit leaks of var_t into ifconfig_t - Allow domains that transition to ssh_t to manipulate its keyring - Define oracleasm_t as a device node - Change to handle /root as a symbolic link for os-tree - Allow sysadm_t to create packet_socket, also move some rules to attributes - Add label for openvswitch port - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label. - Allow postfix_local to read .forward in pcp lib files - Allow pegasus_openlmi_storage_t to read lvm metadata - Add additional fixes for pegasus_openlmi_storage_t - Allow bumblebee to manage debugfs - Make bumblebee as unconfined domain - Allow snmp to read etc_aliases_t - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem - Allow pegasus_openlmi_storage_t to read /proc/1/environ - Dontaudit read gconf files for cupsd_config_t - make vmtools as unconfined domain - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig. - Allow collectd_t to use a mysql database - Allow ipa-otpd to perform DNS name resolution - Added new policy for keepalived - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd - Add additional fixes new pscs-lite+polkit support - Add labeling for /run/krb5kdc - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20 - Allow pcscd to read users proc info - Dontaudit smbd_t sending out random signuls - Add boolean to allow openshift domains to use nfs - Allow w3c_validator to create content in /tmp - zabbix_agent uses nsswitch - Allow procmail and dovecot to work together to deliver mail - Allow spamd to execute files in homedir if boolean turned on - Allow openvswitch to listen on port 6634 - Add net_admin capability in collectd policy - Fixed snapperd policy - Fixed bugsfor pcp policy - Allow dbus_system_domains to be started by init - Fixed some interfaces - Add kerberos_keytab_domain attribute - Fix snapperd_conf_t def- Addopt corenet rules for unbound-anchor to rpm_script_t - Allow runuser to send send audit messages. - Allow postfix-local to search .forward in munin lib dirs - Allow udisks to connect to D-Bus - Allow spamd to connect to spamd port - Fix syntax error in snapper.te - Dontaudit osad to search gconf home files - Allow rhsmcertd to manage /etc/sysconf/rhn director - Fix pcp labeling to accept /usr/bin for all daemon binaries - Fix mcelog_read_log() interface - Allow iscsid to manage iscsi lib files - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it. - Make tuned_t as unconfined domain for RHEL7.0 - Allow ABRT to read puppet certs - Add sys_time capability for virt-ga - Allow gemu-ga to domtrans to hwclock_t - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages - Fix some AVCs in pcp policy - Add to bacula capability setgid and setuid and allow to bind to bacula ports - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t - Add access rhnsd and osad to /etc/sysconfig/rhn - drbdadm executes drbdmeta - Fixes needed for docker - Allow epmd to manage /var/log/rabbitmq/startup_err file - Allow beam.smp connect to amqp port - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t - Allow systemd_tmpfiles_t to manage all non security files on the system - Added labels for bacula ports - Fix label on /dev/vfio/vfio - Add kernel_mounton_messages() interface - init wants to manage lock files for iscsi- Added osad policy - Allow postfix to deliver to procmail - Allow bumblebee to seng kill signal to xserver - Allow vmtools to execute /usr/bin/lsb_release - Allow docker to write system net ctrls - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix pcp.te - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl- Turn on bacula, rhnsd policy - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl - Fixes for *_admin interfaces - Add pegasus_openlmi_storage_var_run_t type def - Add support for /var/run/openlmi-storage - Allow tuned to create syslog.conf with correct labeling - Add httpd_dontaudit_search_dirs boolean - Add support for winbind.service - ALlow also fail2ban-client to read apache logs - Allow vmtools to getattr on all fs - Add support for dey_sapi port - Add logging_filetrans_named_conf() - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring- Update snapper policy - Allow domains to append rkhunter lib files - Allow snapperd to getattr on all fs - Allow xdm to create /var/gdm with correct labeling - Add label for snapper.log - Allow fail2ban-client to read apache log files - Allow thumb_t to execute dbus-daemon in thumb_t- Allow gdm to create /var/gdm with correct labeling - Allow domains to append rkhunterl lib files. #1057982 - Allow systemd_tmpfiles_t net_admin to communicate with journald - Add interface to getattr on an isid_type for any type of file - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory - Allow initrc_t domtrans to authconfig if unconfined is enabled - Allow docker and mount on devpts chr_file - Allow docker to transition to unconfined_t if boolean set - init calling needs to be optional in domain.te - Allow uncofined domain types to handle transient unit files - Fix labeling for vfio devices - Allow net_admin capability and send system log msgs - Allow lldpad send dgram to NM - Add networkmanager_dgram_send() - rkhunter_var_lib_t is correct type - Back port pcp policy from rawhide - Allow openlmi-storage to read removable devices - Allow system cron jobs to manage rkhunter lib files - Add rkhunter_manage_lib_files() - Fix ftpd_use_fusefs boolean to allow manage also symlinks - Allow smbcontrob block_suspend cap2 - Allow slpd to read network and system state info - Allow NM domtrans to iscsid_t if iscsiadm is executed - Allow slapd to send a signal itself - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA. - Fix plymouthd_create_log() interface - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container - Allow postfix and cyrus-imapd to work out of box - Allow fcoemon to talk with unpriv user domain using unix_stream_socket - Dontaudit domains that are calling into journald to net_admin - Add rules to allow vmtools to do what it does - snapperd is D-Bus service - Allow OpenLMI PowerManagement to call 'systemctl --force reboot' - Add haproxy_connect_any boolean - Allow haproxy also to use http cache port by default Resolves:#1058248- Allow apache to write to the owncloud data directory in /var/www/html... - Allow consolekit to create log dir - Add support for icinga CGI scripts - Add support for icinga - Allow kdumpctl_t to create kdump lock file Resolves:#1055634 - Allow kdump to create lnk lock file - Allow nscd_t block_suspen capability - Allow unconfined domain types to manage own transient unit file - Allow systemd domains to handle transient init unit files - Add interfaces to handle transient- Add cron unconfined role support for uncofined SELinux user - Call corenet_udp_bind_all_ports() in milter.te - Allow fence_virtd to connect to zented port - Fix header for mirrormanager_admin() - Allow dkim-milter to bind udp ports - Allow milter domains to send signull itself - Allow block_suspend for yum running as mock_t - Allow beam.smp to manage couchdb files - Add couchdb_manage_files() - Add labeling for /var/log/php_errors.log - Allow bumblebee to stream connect to xserver - Allow bumblebee to send a signal to xserver - gnome-thumbnail to stream connect to bumblebee - Allow xkbcomp running as bumblebee_t to execute bin_t - Allow logrotate to read squid.conf - Additional rules to get docker and lxc to play well with SELinux - Allow bumbleed to connect to xserver port - Allow pegasus_openlmi_storage_t to read hwdata- Allow init_t to work on transitient and snapshot unit files - Add logging_manage_syslog_config() - Update sysnet_dns_name_resolve() to allow connect to dnssec por - Allow pegasus_openlmi_storage_t to read hwdata Resolves:#1031721 - Fix rhcs_rw_cluster_tmpfs() - Allow fenced_t to bind on zented udp port - Added policy for vmtools - Fix mirrormanager_read_lib_files() - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files - Allow ctdb to create sock files in /var/run/ctdb - Add sblim_filetrans_named_content() interface - Allow rpm scritplets to create /run/gather with correct labeling - Allow gnome keyring domains to create gnome config dirs - Dontaudit read/write to init stream socket for lsmd_plugin_t - Allow automount to read nfs link files - Allow lsm plugins to read/write lsmd stream socket - Allow certmonger to connect ldap port to make IPA CA certificate renewal working. - Add also labeling for /var/run/ctdb - Add missing labeling for /var/lib/ctdb - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446 - Dontaudit hypervkvp to search homedirs - Dontaudit hypervkvp to search admin homedirs - Allow hypervkvp to execute bin_t and ifconfig in the caller domain - Dontaudit xguest_t to read ABRT conf files - Add abrt_dontaudit_read_config() - Allow namespace-init to getattr on fs - Add thumb_role() also for xguest - Add filename transitions to create .spamassassin with correct labeling - Allow apache domain to read mirrormanager pid files - Allow domains to read/write shm and sem owned by mozilla_plugin_t - Allow alsactl to send a generic signal to kernel_t- Add back rpm_run() for unconfined user- Add missing files_create_var_lib_dirs() - Fix typo in ipsec.te - Allow passwd to create directory in /var/lib - Add filename trans also for event21 - Allow iptables command to read /dev/rand - Add sigkill capabilityfor ipsec_t - Add filename transitions for bcache devices - Add additional rules to create /var/log/cron by syslogd_t with correct labeling - Add give everyone full access to all key rings - Add default lvm_var_run_t label for /var/run/multipathd - Fix log labeling to have correct default label for them after logrotate - Labeled ~/.nv/GLCache as being gstreamer output - Allow nagios_system_plugin to read mrtg lib files - Add mrtg_read_lib_files() - Call rhcs_rw_cluster_tmpfs for dlm_controld - Make authconfing as named_filetrans domain - Allow virsh to connect to user process using stream socket - Allow rtas_errd to read rand/urand devices and add chown capability - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp Resolves:#1051497 - Add also chown cap for abrt_upload_watch_t. It already has dac_override - Allow sosreport to manage rhsmcertd pid files - Add rhsmcertd_manage_pid_files() - Allow also setgid cap for rpc.gssd - Dontaudit access check for abrt on cert_t - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind- Fix semanage import handling in spec file- Add default lvm_var_run_t label for /var/run/multipathd Resolves:#1051430 - Fix log labeling to have correct default label for them after logrotate - Add files_write_root_dirs - Add new openflow port label for 6653/tcp and 6633/tcp - Add xserver_manage_xkb_libs() - Label tcp/8891 as milter por - Allow gnome_manage_generic_cache_files also create cache_home_t files - Fix aide.log labeling - Fix log labeling to have correct default label for them after logrotate - Allow mysqld-safe write access on /root to make mysqld working - Allow sosreport domtrans to prelikn - Allow OpenvSwitch to connec to openflow ports - Allow NM send dgram to lldpad - Allow hyperv domains to execute shell - Allow lsmd plugins stream connect to lsmd/init - Allow sblim domains to create /run/gather with correct labeling - Allow httpd to read ldap certs - Allow cupsd to send dbus msgs to process with different MLS level - Allow bumblebee to stream connect to apmd - Allow bumblebee to run xkbcomp - Additional allow rules to get libvirt-lxc containers working with docker - Additional allow rules to get libvirt-lxc containers working with docker - Allow docker to getattr on itself - Additional rules needed for sandbox apps - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled - httpd should be able to send signal/signull to httpd_suexec_t - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.- Add neutron fixes- Allow sshd to write to all process levels in order to change passwd when running at a level - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range - Allow apcuspd_t to status and start the power unit file - Allow udev to manage kdump unit file - Added new interface modutils_dontaudit_exec_insmod - Allow cobbler to search dhcp_etc_t directory - systemd_systemctl needs sys_admin capability - Allow sytemd_tmpfiles_t to delete all directories - passwd to create gnome-keyring passwd socket - Add missing zabbix_var_lib_t type - Fix filename trans for zabbixsrv in zabbix.te - Allow fprintd_t to send syslog messages - Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port - Allow mozilla plugin to chat with policykit, needed for spice - Allow gssprozy to change user and gid, as well as read user keyrings - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly - Allow polipo to connect to http_cache_ports - Allow cron jobs to manage apache var lib content - Allow yppassword to manage the passwd_file_t - Allow showall_t to send itself signals - Allow cobbler to restart dhcpc, dnsmasq and bind services - Allow certmonger to manage home cert files - Add userdom filename trans for user mail domains - Allow apcuspd_t to status and start the power unit file - Allow cgroupdrulesengd to create content in cgoups directories - Allow smbd_t to signull cluster - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t - Add label for /var/spool/cron.aquota.user - Allow sandbox_x domains to use work with the mozilla plugin semaphore - Added new policy for speech-dispatcher - Added dontaudit rule for insmod_exec_t in rasdaemon policy - Updated rasdaemon policy - Allow system_mail_t to transition to postfix_postdrop_t - Clean up mirrormanager policy - Allow virt_domains to read cert files, needs backport to RHEL7 - Allow sssd to read systemd_login_var_run_t - Allow irc_t to execute shell and bin-t files: - Add new access for mythtv - Allow rsync_t to manage all non auth files - allow modemmanger to read /dev/urand - Allow sandbox apps to attempt to set and get capabilties- Add labeling for /var/lib/servicelog/servicelog.db-journal - Add support for freeipmi port - Add sysadm_u_default_contexts - Make new type to texlive files in homedir - Allow subscription-manager running as sosreport_t to manage rhsmcertd - Additional fixes for docker.te - Remove ability to do mount/sys_admin by default in virt_sandbox domains - New rules required to run docker images within libivrt - Add label for ~/.cvsignore - Change mirrormanager to be run by cron - Add mirrormanager policy - Fixed bumblebee_admin() and mip6d_admin() - Add log support for sensord - Fix typo in docker.te - Allow amanda to do backups over UDP - Allow bumblebee to read /etc/group and clean up bumblebee.te - type transitions with a filename not allowed inside conditionals - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7 - Make new type to texlive files in homedir- Allow freeipmi_ipmidetectd_t to use freeipmi port - Update freeipmi_domain_template() - Allow journalctl running as ABRT to read /run/log/journal - Allow NM to read dispatcher.d directory - Update freeipmi policy - Type transitions with a filename not allowed inside conditionals - Allow tor to bind to hplip port - Make new type to texlive files in homedir - Allow zabbix_agent to transition to dmidecode - Add rules for docker - Allow sosreport to send signull to unconfined_t - Add virt_noatsecure and virt_rlimitinh interfaces - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port - Add sysadm_u_default_contexts - Add logging_read_syslog_pid() - Fix userdom_manage_home_texlive() interface - Make new type to texlive files in homedir - Add filename transitions for /run and /lock links - Allow virtd to inherit rlimit information Resolves:#975358- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t Resolves:#1039879 - Add labeling for /usr/lib/systemd/system/mariadb.service - Allow hyperv_domain to read sysfs - Fix ldap_read_certs() interface to allow acess also link files - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt - Allow tuned to run modprobe - Allow portreserve to search /var/lib/sss dir - Add SELinux support for the teamd package contains team network device control daemon. - Dontaudit access check on /proc for bumblebee - Bumblebee wants to load nvidia modules - Fix rpm_named_filetrans_log_files and wine.te - Add conman policy for rawhide - DRM master and input event devices are used by the TakeDevice API - Clean up bumblebee policy - Update pegasus_openlmi_storage_t policy - Add freeipmi_stream_connect() interface - Allow logwatch read madm.conf to support RAID setup - Add raid_read_conf_files() interface - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling - add rpm_named_filetrans_log_files() interface - Allow dkim-milter to create files/dirs in /tmp - update freeipmi policy - Add policy for freeipmi services - Added rdisc_admin and rdisc_systemctl interfaces - opensm policy clean up - openwsman policy clean up - ninfod policy clean up - Added new policy for ninfod - Added new policy for openwsman - Added rdisc_admin and rdisc_systemctl interfaces - Fix kernel_dontaudit_access_check_proc() - Add support for /dev/uhid - Allow sulogin to get the attributes of initctl and sys_admin cap - Add kernel_dontaudit_access_check_proc() - Fix dev_rw_ipmi_dev() - Fix new interface in devices.if - DRM master and input event devices are used by the TakeDevice API - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev() - Added support for default conman port - Add interfaces for ipmi devices- Allow sosreport to send a signal to ABRT - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t - Label /usr/sbin/htcacheclean as httpd_exec_t Resolves:#1037529 - Added support for rdisc unit file - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs - Allow runuser running as logrotate connections to system DBUS - Label bcache devices as fixed_disk_device_t - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t- Add back setpgid/setsched for sosreport_t- Added fix for clout_init to transition to rpm_script_t (dwalsh@redhat.com)- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel. - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on - Add lsmd_plugin_t for lsm plugins - Allow dovecot-deliver to search mountpoints - Add labeling for /etc/mdadm.conf - Allow opelmi admin providers to dbus chat with init_t - Allow sblim domain to read /dev/urandom and /dev/random - Allow apmd to request the kernel load modules - Add glusterd_brick_t type - label mate-keyring-daemon with gkeyringd_exec_t - Add plymouthd_create_log() - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6 - Allow sssd to request the kernel loads modules - Allow gpg_agent to use ssh-add - Allow gpg_agent to use ssh-add - Dontaudit access check on /root for myslqd_safe_t - Allow ctdb to getattr on al filesystems - Allow abrt to stream connect to syslog - Allow dnsmasq to list dnsmasq.d directory - Watchdog opens the raw socket - Allow watchdog to read network state info - Dontaudit access check on lvm lock dir - Allow sosreport to send signull to setroubleshootd - Add setroubleshoot_signull() interface - Fix ldap_read_certs() interface - Allow sosreport all signal perms - Allow sosreport to run systemctl - Allow sosreport to dbus chat with rpm - Add glusterd_brick_t files type - Allow zabbix_agentd to read all domain state - Clean up rtas.if - Allow smoltclient to execute ldconfig - Allow sosreport to request the kernel to load a module - Fix userdom_confined_admin_template() - Add back exec_content boolean for secadm, logadm, auditadm - Fix files_filetrans_system_db_named_files() interface - Allow sulogin to getattr on /proc/kcore - Add filename transition also for servicelog.db-journal - Add files_dontaudit_access_check_root() - Add lvm_dontaudit_access_check_lock() interface- Allow watchdog to read /etc/passwd - Allow browser plugins to connect to bumblebee - New policy for bumblebee and freqset - Add new policy for mip6d daemon - Add new policy for opensm daemon - Allow condor domains to read/write condor_master udp_socket - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift - Add back file_pid_filetrans for /var/run/dlm_controld - Allow smbd_t to use inherited tmpfs content - Allow mcelog to use the /dev/cpu device - sosreport runs rpcinfo - sosreport runs subscription-manager - Allow staff_t to run frequency command - Allow systemd_tmpfiles to relabel log directories - Allow staff_t to read xserver_log file - Label hsperfdata_root as tmp_t- More sosreport fixes to make ABRT working- Fix files_dontaudit_unmount_all_mountpoints() - Add support for 2608-2609 tcp/udp ports - Should allow domains to lock the terminal device - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - We need to require passwd rootok - Fix zebra.fc - Fix dnsmasq_filetrans_named_content() interface - Allow all sandbox domains create content in svirt_home_t - Allow zebra domains also create zebra_tmp_t files in /tmp - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services. - Fix labeling on neutron and remove transition to iconfig_t - abrt needs to read mcelog log file - Fix labeling on dnsmasq content - Fix labeling on /etc/dnsmasq.d - Allow glusterd to relabel own lib files - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd - Allow ipc_lock for abrt to run journalctl- Fix config.tgz- Fix passenger_stream_connect interface - setroubleshoot_fixit wants to read network state - Allow procmail_t to connect to dovecot stream sockets - Allow cimprovagt service providers to read network states - Add labeling for /var/run/mariadb - pwauth uses lastlog() to update system's lastlog - Allow account provider to read login records - Add support for texlive2013 - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - Allow passwd_t to connect to gnome keyring to change password - Update mls config files to have cronjobs in the user domains - Remove access checks that systemd does not actually do- Add support for yubikey in homedir - Add support for upd/3052 port - Allow apcupsd to use PowerChute Network Shutdown - Allow lsmd to execute various lsmplugins - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too - Update gluster_export_all_rw boolean to allow relabel all base file types - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling- Add files_relabel_base_file_types() interface - Allow netlabel-config to read passwd - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr() - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling - Allow pegasus to domtrans to mount_t - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts - Add support for unconfined watchdog scripts - Allow watchdog to manage own log files- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory. - Label /etc/yum.repos.d as system_conf_t - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t - Allow dac_override for sysadm_screen_t - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file. - Allow netlabel-config to read meminfo - Add interface to allow docker to mounton file_t - Add new interface to exec unlabeled files - Allow lvm to use docker semaphores - Setup transitons for .xsessions-errors.old - Change labels of files in /var/lib/*/.ssh to transition properly - Allow staff_t and user_t to look at logs using journalctl - pluto wants to manage own log file - Allow pluto running as ipsec_t to create pluto.log - Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files. - Additional access for docker - Added more rules to sblim policy - Fix kdumpgui_run_bootloader boolean - Allow dspam to connect to lmtp port - Included sfcbd service into sblim policy - rhsmcertd wants to manaage /etc/pki/consumer dir - Add kdumpgui_run_bootloader boolean - Add support for /var/cache/watchdog - Remove virt_domain attribute for virt_qemu_ga_unconfined_t - Fixes for handling libvirt containes - Dontaudit attempts by mysql_safe to write content into / - Dontaudit attempts by system_mail to modify network config - Allow dspam to bind to lmtp ports - Add new policy to allow staff_t and user_t to look at logs using journalctl - Allow apache cgi scripts to list sysfs - Dontaudit attempts to write/delete user_tmp_t files - Allow all antivirus domains to manage also own log dirs - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Add missing permission checks for nscd- Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Add file transition rules for content created by f5link - Rename quantum_port information to neutron - Allow all antivirus domains to manage also own log dirs - Rename quantum_port information to neutron - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Allow sysadm_t to read login information - Allow systemd_tmpfiles to setattr on var_log_t directories - Udpdate Makefile to include systemd_contexts - Add systemd_contexts - Add fs_exec_hugetlbfs_files() interface - Add daemons_enable_cluster_mode boolean - Fix rsync_filetrans_named_content() - Add rhcs_read_cluster_pid_files() interface - Update rhcs.if with additional interfaces from RHEL6 - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t - Allow glusterd_t to mounton glusterd_tmp_t - Allow glusterd to unmout al filesystems - Allow xenstored to read virt config - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label - Allow mozilla_plugin_t to mmap hugepages as an executable- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp- Allow sshd_t to read openshift content, needs backport to RHEL6.5 - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t - Make sur kdump lock is created with correct label if kdumpctl is executed - gnome interface calls should always be made within an optional_block - Allow syslogd_t to connect to the syslog_tls port - Add labeling for /var/run/charon.ctl socket - Add kdump_filetrans_named_content() - Allo setpgid for fenced_t - Allow setpgid and r/w cluster tmpfs for fenced_t - gnome calls should always be within optional blocks - wicd.pid should be labeled as networkmanager_var_run_t - Allow sys_resource for lldpad- Add rtas policy- Allow mailserver_domains to manage and transition to mailman data - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands - Allow mailserver_domains to manage and transition to mailman data - Allow svirt_domains to read sysctl_net_t - Allow thumb_t to use tmpfs inherited from the user - Allow mozilla_plugin to bind to the vnc port if running with spice - Add new attribute to discover confined_admins and assign confined admin to it - Fix zabbix to handle attributes in interfaces - Fix zabbix to read system states for all zabbix domains - Fix piranha_domain_template() - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files. - Allow lldpad sys_rouserce cap due to #986870 - Allow dovecot-auth to read nologin - Allow openlmi-networking to read /proc/net/dev - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t - Add zabbix_domain attribute for zabbix domains to treat them together - Add labels for zabbix-poxy-* (#1018221) - Update openlmi-storage policy to reflect #1015067 - Back port piranha tmpfs fixes from RHEL6 - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop - Add postfix_rw_spool_maildrop_files interface - Call new userdom_admin_user_templat() also for sysadm_secadm.pp - Fix typo in userdom_admin_user_template() - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey - Add new attribute to discover confined_admins - Fix labeling for /etc/strongswan/ipsec.d - systemd_logind seems to pass fd to anyone who dbus communicates with it - Dontaudit leaked write descriptor to dmesg- Activate motion policy- Fix gnome_read_generic_data_home_files() - allow openshift_cgroup_t to read/write inherited openshift file types - Remove httpd_cobbler_content * from cobbler_admin interface - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container - Allow httpd_t to read also git sys content symlinks - Allow init_t to read gnome home data - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it. - Allow virsh to execute systemctl - Fix for nagios_services plugins - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - Fix hypervkvp.te - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Fix logging policy - Allow syslog to bind to tls ports - Update labeling for /dev/cdc-wdm - Allow to su_domain to read init states - Allow init_t to read gnome home data - Make sure if systemd_logind creates nologin file with the correct label - Clean up ipsec.te- Add auth_exec_chkpwd interface - Fix port definition for ctdb ports - Allow systemd domains to read /dev/urand - Dontaudit attempts for mozilla_plugin to append to /dev/random - Add label for /var/run/charon.* - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service - Fix for nagios_services plugins - Fix some bugs in zoneminder policy - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - glusterd binds to random unreserved ports - Additional allow rules found by testing glusterfs - apcupsd needs to send a message to all users on the system so needs to look them up - Fix the label on ~/.juniper_networks - Dontaudit attempts for mozilla_plugin to append to /dev/random - Allow polipo_daemon to connect to flash ports - Allow gssproxy_t to create replay caches - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type- init reload from systemd_localed_t - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd - Allow systemd_localed_t to ask systemd to reload the locale. - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory - Allow readahead to read /dev/urand - Fix lots of avcs about tuned - Any file names xenstored in /var/log should be treated as xenstored_var_log_t - Allow tuned to inderact with hugepages - Allow condor domains to list etc rw dirs- Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Add additional fixes forpegasus_openlmi_account_t - Allow mdadm to read /dev/urand - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it - Add label/rules for /etc/mdadm.conf - Allow pegasus_openlmi_storage_t to transition to fsadm_t - Fixes for interface definition problems - Dontaudit dovecot-deliver to gettatr on all fs dirs - Allow domains to search data_home_t directories - Allow cobblerd to connect to mysql - Allow mdadm to r/w kdump lock files - Add support for kdump lock files - Label zarafa-search as zarafa-indexer - Openshift cgroup wants to read /etc/passwd - Add new sandbox domains for kvm - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on - Fix labeling for /usr/lib/systemd/system/lvm2.* - Add labeling for /usr/lib/systemd/system/lvm2.* - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules - Add sshd_keygen_t policy for sshd-keygen - Fix alsa_home_filetrans interface name and definition - Allow chown for ssh_keygen_t - Add fs_dontaudit_getattr_all_dirs() - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys - Fix up patch to allow systemd to manage home content - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled - Allow getty to exec hostname to get info - Add systemd_home_t for ~/.local/share/systemd directory- Fix lxc labels in config.tgz- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper - Allow tuned to search all file system directories - Allow alsa_t to sys_nice, to get top performance for sound management - Add support for MySQL/PostgreSQL for amavis - Allow openvpn_t to manage openvpn_var_log_t files. - Allow dirsrv_t to create tmpfs_t directories - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label - Dontaudit leaked unix_stream_sockets into gnome keyring - Allow telepathy domains to inhibit pipes on telepathy domains - Allow cloud-init to domtrans to rpm - Allow abrt daemon to manage abrt-watch tmp files - Allow abrt-upload-watcher to search /var/spool directory - Allow nsswitch domains to manage own process key - Fix labeling for mgetty.* logs - Allow systemd to dbus chat with upower - Allow ipsec to send signull to itself - Allow setgid cap for ipsec_t - Match upstream labeling- Do not build sanbox pkg on MLS- wine_tmp is no longer needed - Allow setroubleshoot to look at /proc - Allow telepathy domains to dbus with systemd logind - Fix handling of fifo files of rpm - Allow mozilla_plugin to transition to itself - Allow certwatch to write to cert_t directories - New abrt application - Allow NetworkManager to set the kernel scheduler - Make wine_domain shared by all wine domains - Allow mdadm_t to read images labeled svirt_image_t - Allow amanda to read /dev/urand - ALlow my_print_default to read /dev/urand - Allow mdadm to write to kdumpctl fifo files - Allow nslcd to send signull to itself - Allow yppasswd to read /dev/urandom - Fix zarafa_setrlimit - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add additional alias for user_tmp_t because wine_tmp_t is no longer used - More handling of ther kernel keyring required by kerberos - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed- Dontaudit attempts by sosreport to read shadow_t - Allow browser sandbox plugins to connect to cups to print - Add new label mpd_home_t - Label /srv/www/logs as httpd_log_t - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add labels for apache logs under miq package - Allow irc_t to use tcp sockets - fix labels in puppet.if - Allow tcsd to read utmp file - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys - Define svirt_socket_t as a domain_type - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t - Fix label on pam_krb5 helper apps- Allow ldconfig to write to kdumpctl fifo files - allow neutron to connect to amqp ports - Allow kdump_manage_crash to list the kdump_crash_t directory - Allow glance-api to connect to amqp port - Allow virt_qemu_ga_t to read meminfo - Add antivirus_home_t type for antivirus date in HOMEDIRS - Allow mpd setcap which is needed by pulseaudio - Allow smbcontrol to create content in /var/lib/samba - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts - amanda_exec_t needs to be executable file - Allow block_suspend cap for samba-net - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t - Allow init_t to run crash utility - Treat usr_t just like bin_t for transitions and executions - Add port definition of pka_ca to port 829 for openshift - Allow selinux_store to use symlinks- Allow block_suspend cap for samba-net - Allow t-mission-control to manage gabble cache files - Allow nslcd to read /sys/devices/system/cpu - Allow selinux_store to use symlinks- Allow xdm_t to transition to itself - Call neutron interfaces instead of quantum - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t - Make sure directories in /run get created with the correct label - Make sure /root/.pki gets created with the right label - try to remove labeling for motion from zoneminder_exec_t to bin_t - Allow inetd_t to execute shell scripts - Allow cloud-init to read all domainstate - Fix to use quantum port - Add interface netowrkmanager_initrc_domtrans - Fix boinc_execmem - Allow t-mission-control to read gabble cache home - Add labeling for ~/.cache/telepathy/avatars/gabble - Allow memcache to read sysfs data - Cleanup antivirus policy and add additional fixes - Add boolean boinc_enable_execstack - Add support for couchdb in rabbitmq policy - Add interface couchdb_search_pid_dirs - Allow firewalld to read NM state - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files()- Split out rlogin ports from inetd - Treat files labeld as usr_t like bin_t when it comes to transitions - Allow staff_t to read login config - Allow ipsec_t to read .google authenticator data - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files() - Call the correct interface - corenet_udp_bind_ktalkd_port() - Allow all domains that can read gnome_config to read kde config - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work - Allow mdadm to getattr any file system - Allow a confined domain to executes mozilla_exec_t via dbus - Allow cupsd_lpd_t to bind to the printer port - Dontaudit attempts to bind to ports < 1024 when nis is turned on - Allow apache domain to connect to gssproxy socket - Allow rlogind to bind to the rlogin_port - Allow telnetd to bind to the telnetd_port - Allow ktalkd to bind to the ktalkd_port - Allow cvs to bind to the cvs_port- Cleanup related to init_domain()+inetd_domain fixes - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain - svirt domains neeed to create kobject_uevint_sockets - Lots of new access required for sosreport - Allow tgtd_t to connect to isns ports - Allow init_t to transition to all inetd domains: - openct needs to be able to create netlink_object_uevent_sockets - Dontaudit leaks into ldconfig_t - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls - Move kernel_stream_connect into all Xwindow using users - Dontaudit inherited lock files in ifconfig o dhcpc_t- Also sock_file trans rule is needed in lsm - Fix labeling for fetchmail pid files/dirs - Add additional fixes for abrt-upload-watch - Fix polipo.te - Fix transition rules in asterisk policy - Add fowner capability to networkmanager policy - Allow polipo to connect to tor ports - Cleanup lsmd.if - Cleanup openhpid policy - Fix kdump_read_crash() interface - Make more domains as init domain - Fix cupsd.te - Fix requires in rpm_rw_script_inherited_pipes - Fix interfaces in lsm.if - Allow munin service plugins to manage own tmpfs files/dirs - Allow virtd_t also relabel unix stream sockets for virt_image_type - Make ktalk as init domain - Fix to define ktalkd_unit_file_t correctly - Fix ktalk.fc - Add systemd support for talk-server - Allow glusterd to create sock_file in /run - Allow xdm_t to delete gkeyringd_tmp_t files on logout - Add fixes for hypervkvp policy - Add logwatch_can_sendmail boolean - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb - Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add selinux-policy-sandbox pkg0 - Allow rhsmcertd to read init state - Allow fsetid for pkcsslotd - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service - Allow fetchmail to create own pid with correct labeling - Fix rhcs_domain_template() - Allow roles which can run mock to read mock lib files to view results - Allow rpcbind to use nsswitch - Fix lsm.if summary - Fix collectd_t can read /etc/passwd file - Label systemd unit files under dracut correctly - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh - Add support for .Xauthority-n - Label umount.crypt as lvm_exec_t - Allow syslogd to search psad lib files - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files- Add policy for lsmd - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory - Update condor_master rules to allow read system state info and allow logging - Add labeling for /etc/condor and allow condor domain to write it (bug) - Allow condor domains to manage own logs - Allow glusterd to read domains state - Fix initial hypervkvp policy - Add policy for hypervkvpd - Fix redis.if summary- Allow boinc to connect to @/tmp/.X11-unix/X0 - Allow beam.smp to connect to tcp/5984 - Allow named to manage own log files - Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t - Add virt_transition_userdomain boolean decl - Allow httpd_t to sendto unix_dgram sockets on its children - Allow nova domains to execute ifconfig - bluetooth wants to create fifo_files in /tmp - exim needs to be able to manage mailman data - Allow sysstat to getattr on all file systems - Looks like bluetoothd has moved - Allow collectd to send ping packets - Allow svirt_lxc domains to getpgid - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff - Allow frpintd_t to read /dev/urandom - Allow asterisk_t to create sock_file in /var/run - Allow usbmuxd to use netlink_kobject - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket - More cleanup of svirt_lxc policy - virtd_lxc_t now talks to dbus - Dontaudit leaked ptmx_t - Allow processes to use inherited fifo files - Allow openvpn_t to connect to squid ports - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert() - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files - Allow user roles to connect to the journal socket- selinux_set_enforce_mode needs to be used with type - Add append to the dontaudit for unix_stream_socket of xdm_t leak - Allow xdm_t to create symlinks in log direcotries - Allow login programs to read afs config - Label 10933 as a pop port, for dovecot - New policy to allow selinux_server.py to run as semanage_t as a dbus service - Add fixes to make netlabelctl working on MLS - AVCs required for running sepolicy gui as staff_t - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC - New dbus server to be used with new gui - After modifying some files in /etc/mail, I saw this needed on the next boot - Loading a vm from /usr/tmp with virt-manager - Clean up oracleasm policy for Fedora - Add oracleasm policy written by rlopez@redhat.com - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache - Add label for /var/crash - Allow fenced to domtrans to sanclok_t - Allow nagios to manage nagios spool files - Make tfptd as home_manager - Allow kdump to read kcore on MLS system - Allow mysqld-safe sys_nice/sys_resource caps - Allow apache to search automount tmp dirs if http_use_nfs is enabled - Allow crond to transition to named_t, for use with unbound - Allow crond to look at named_conf_t, for unbound - Allow mozilla_plugin_t to transition its home content - Allow dovecot_domain to read all system and network state - Allow httpd_user_script_t to call getpw - Allow semanage to read pid files - Dontaudit leaked file descriptors from user domain into thumb - Make PAM authentication working if it is enabled in ejabberd - Add fixes for rabbit to fix ##992920,#992931 - Allow glusterd to mount filesystems - Loading a vm from /usr/tmp with virt-manager - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device - Add fix for pand service - shorewall touches own log - Allow nrpe to list /var - Mozilla_plugin_roles can not be passed into lpd_run_lpr - Allow afs domains to read afs_config files - Allow login programs to read afs config - Allow virt_domain to read virt_var_run_t symlinks - Allow smokeping to send its process signals - Allow fetchmail to setuid - Add kdump_manage_crash() interface - Allow abrt domain to write abrt.socket- Add more aliases in pegasus.te - Add more fixes for *_admin interfaces - Add interface fixes - Allow nscd to stream connect to nmbd - Allow gnupg apps to write to pcscd socket - Add more fixes for openlmi provides. Fix naming and support for additionals - Allow fetchmail to resolve host names - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te - Fix corecmd_exec_chroot() - Fix logging_relabel_syslog_pid_socket interface - Fix typo in unconfineduser.te - Allow system_r to access unconfined_dbusd_t to run hp_chec- Allow xdm_t to act as a dbus client to itsel - Allow fetchmail to resolve host names - Allow gnupg apps to write to pcscd socket - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te -httpd_t does access_check on certs- Add support for cmpiLMI_Service-cimprovagt - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t - Add support for pycmpiLMI_Storage-cimprovagt - Add support for cmpiLMI_Networking-cimprovagt - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working - Allow virtual machines and containers to run as user doains, needed for virt-sandbox - Allow buglist.cgi to read cpu info- Allow systemd-tmpfile to handle tmp content in print spool dir - Allow systemd-sysctl to send system log messages - Add support for RTP media ports and fmpro-internal - Make auditd working if audit is configured to perform SINGLE action on disk error - Add interfaces to handle systemd units - Make systemd-notify working if pcsd is used - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t - Instead of having all unconfined domains get all of the named transition rules, - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default. - Add definition for the salt ports - Allow xdm_t to create link files in xdm_var_run_t - Dontaudit reads of blk files or chr files leaked into ldconfig_t - Allow sys_chroot for useradd_t - Allow net_raw cap for ipsec_t - Allow sysadm_t to reload services - Add additional fixes to make strongswan working with a simple conf - Allow sysadm_t to enable/disable init_t services - Add additional glusterd perms - Allow apache to read lnk files in the /mnt directory - Allow glusterd to ask the kernel to load a module - Fix description of ftpd_use_fusefs boolean - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t - Allow glusterds to request load a kernel module - Allow boinc to stream connect to xserver_t - Allow sblim domains to read /etc/passwd - Allow mdadm to read usb devices - Allow collectd to use ping plugin - Make foghorn working with SNMP - Allow sssd to read ldap certs - Allow haproxy to connect to RTP media ports - Add additional trans rules for aide_db - Add labeling for /usr/lib/pcsd/pcsd - Add labeling for /var/log/pcsd - Add support for pcs which is a corosync and pacemaker configuration tool- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1 - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown - consolekit needs to be able to shut down system - Move around interfaces - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints - Allow gconf-defaults-m to read /etc/passwd - Fix pki_rw_tomcat_cert() interface to support lnk_files- Add support for gluster ports - Make sure that all keys located in /etc/ssh/ are labeled correctly - Make sure apcuspd lock files get created with the correct label - Use getcap in gluster.te - Fix gluster policy - add additional fixes to allow beam.smp to interact with couchdb files - Additional fix for #974149 - Allow gluster to user gluster ports - Allow glusterd to transition to rpcd_t and add additional fixes for #980683 - Allow tgtd working when accessing to the passthrough device - Fix labeling for mdadm unit files- Add mdadm fixes- Fix definition of sandbox.disabled to sandbox.pp.disabled- Allow mdamd to execute systemctl - Allow mdadm to read /dev/kvm - Allow ipsec_mgmt_t to read l2tpd pid content- Allow nsd_t to read /dev/urand - Allow mdadm_t to read framebuffer - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t - Allow mozilla_plugin_config_t to create tmp files - Cleanup openvswitch policy - Allow mozilla plugin to getattr on all executables - Allow l2tpd_t to create fifo_files in /var/run - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory - Allow mdadm to connecto its own unix_stream_socket - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now. - Allow apache to access smokeping pid files - Allow rabbitmq_beam_t to getattr on all filesystems - Add systemd support for iodined - Allow nup_upsdrvctl_t to execute its entrypoint - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch - add labeling for ~/.cache/libvirt-sandbox - Add interface to allow domains transitioned to by confined users to send sigchld to screen program - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs. - Allow staff to getsched all domains, required to run htop - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Add prosody policy written by Michael Scherer - Allow nagios plugins to read /sys info - ntpd needs to manage own log files - Add support for HOME_DIR/.IBMERS - Allow iptables commands to read firewalld config - Allow consolekit_t to read utmp - Fix filename transitions on .razor directory - Add additional fixes to make DSPAM with LDA working - Allow snort to read /etc/passwd - Allow fail2ban to communicate with firewalld over dbus - Dontaudit openshift_cgreoup_file_t read/write leaked dev - Allow nfsd to use mountd port - Call th proper interface - Allow openvswitch to read sys and execute plymouth - Allow tmpwatch to read /var/spool/cups/tmp - Add support for /usr/libexec/telepathy-rakia - Add systemd support for zoneminder - Allow mysql to create files/directories under /var/log/mysql - Allow zoneminder apache scripts to rw zoneminder tmpfs - Allow httpd to manage zoneminder lib files - Add zoneminder_run_sudo boolean to allow to start zoneminder - Allow zoneminder to send mails - gssproxy_t sock_file can be under /var/lib - Allow web domains to connect to whois port. - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t. - We really need to add an interface to corenet to define what a web_client_domain is and - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain. - Add labeling for cmpiLMI_LogicalFile-cimprovagt - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules - Update policy rules for pegasus_openlmi_logicalfile_t - Add initial types for logicalfile/unconfined OpenLMI providers - mailmanctl needs to read own log - Allow logwatch manage own lock files - Allow nrpe to read meminfo - Allow httpd to read certs located in pki-ca - Add pki_read_tomcat_cert() interface - Add support for nagios openshift plugins - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab- Make DSPAM to act as a LDA working - Allow ntop to create netlink socket - Allow policykit to send a signal to policykit-auth - Allow stapserver to dbus chat with avahi/systemd-logind - Fix labeling on haproxy unit file - Clean up haproxy policy - A new policy for haproxy and placed it to rhcs.te - Add support for ldirectord and treat it with cluster_t - Make sure anaconda log dir is created with var_log_t- Allow lvm_t to create default targets for filesystem handling - Fix labeling for razor-lightdm binaries - Allow insmod_t to read any file labeled var_lib_t - Add policy for pesign - Activate policy for cmpiLMI_Account-cimprovagt - Allow isnsd syscall=listen - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler - Allow ctdbd to use udp/4379 - gatherd wants sys_nice and setsched - Add support for texlive2012 - Allow NM to read file_t (usb stick with no labels used to transfer keys for example) - Allow cobbler to execute apache with domain transition- condor_collector uses tcp/9000 - Label /usr/sbin/virtlockd as virtd_exec_t for now - Allow cobbler to execute ldconfig - Allow NM to execute ssh - Allow mdadm to read /dev/crash - Allow antivirus domains to connect to snmp port - Make amavisd-snmp working correctly - Allow nfsd_t to mounton nfsd_fs_t - Add initial snapper policy - We still need to have consolekit policy - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow dirsrv to read network state - Fix pki_read_tomcat_lib_files - Add labeling for /usr/libexec/nm-ssh-service - Add label cert_t for /var/lib/ipa/pki-ca/publish - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant - Allow nfsd_t to mounton nfsd_fs_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow passwd_t to change role to system_r from unconfined_r- Don't audit access checks by sandbox xserver on xdb var_lib - Allow ntop to read usbmon devices - Add labeling for new polcykit authorizor - Dontaudit access checks from fail2ban_client - Don't audit access checks by sandbox xserver on xdb var_lib - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream - Fix labeling for all /usr/bim/razor-lightdm-* binaries - Add filename trans for /dev/md126p1- Make vdagent able to request loading kernel module - Add support for cloud-init make it as unconfined domain - Allow snmpd to run smartctl in fsadm_t domain - remove duplicate openshift_search_lib() interface - Allow mysqld to search openshift lib files - Allow openshift cgroup to interact with passedin file descriptors - Allow colord to list directories inthe users homedir - aide executes prelink to check files - Make sure cupsd_t creates content in /etc/cups with the correct label - Lest dontaudit apache read all domains, so passenger will not cause this avc - Allow gssd to connect to gssproxy - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS - Allow systemd-tmpfiles to relabel also lock files - Allow useradd to add homdir in /var/lib/openshift - Allow setfiles and semanage to write output to /run/files- Add labeling for /dev/tgt - Dontaudit leak fd from firewalld for modprobe - Allow runuser running as rpm_script_t to create netlink_audit socket - Allow mdadm to read BIOS non-volatile RAM- accountservice watches when accounts come and go in wtmp - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket - Add httpd_use_sasl boolean - Allow net_admin for tuned_t - iscsid needs sys_module to auto-load kernel modules - Allow blueman to read bluetooth conf - Add nova_manage_lib_files() interface - Fix mplayer_filetrans_home_content() - Add mplayer_filetrans_home_content() - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t - Revert "Allow thumb_t to append inherited xdm stream socket" - Add iscsi_filetrans_named_content() interface - Allow to create .mplayer with the correct labeling for unconfined - Allow iscsiadmin to create lock file with the correct labeling- Allow wine to manage wine home content - Make amanda working with socket actiovation - Add labeling for /usr/sbin/iscsiadm - Add support for /var/run/gssproxy.sock - dnsmasq_t needs to read sysctl_net_t- Fix courier_domain_template() interface - Allow blueman to write ip_forward - Allow mongodb to connect to mongodb port - Allow mongodb to connect to mongodb port - Allow java to bind jobss_debug port - Fixes for *_admin interfaces - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality - Need to assign attribute for courier_domain to all courier_domains - Fail2ban reads /etc/passwd - postfix_virtual will create new files in postfix_spool_t - abrt triggers sys_ptrace by running pidof - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it - Add passenger fixes needed by foreman - Remove dup interfaces - Add additional interfaces for quantum - Add new interfaces for dnsmasq - Allow passenger to read localization and send signull to itself - Allow dnsmasq to stream connect to quantum - Add quantum_stream_connect() - Make sure that mcollective starts the service with the correct labeling - Add labels for ~/.manpath - Dontaudit attempts by svirt_t to getpw* calls - sandbox domains are trying to look at parent process data - Allow courior auth to create its pid file in /var/spool/courier subdir - Add fixes for beam to have it working with couchdb - Add labeling for /run/nm-xl2tpd.con - Allow apache to stream connect to thin - Add systemd support for amand - Make public types usable for fs mount points - Call correct mandb interface in domain.te - Allow iptables to r/w quantum inherited pipes and send sigchld - Allow ifconfig domtrans to iptables and execute ldconfig - Add labels for ~/.manpath - Allow systemd to read iscsi lib files - seunshare is trying to look at parent process data- Fix openshift_search_lib - Add support for abrt-uefioops-oops - Allow colord to getattr any file system - Allow chrome processes to look at each other - Allow sys_ptrace for abrt_t - Add new policy for gssproxy - Dontaudit leaked file descriptor writes from firewalld - openshift_net_type is interface not template - Dontaudit pppd to search gnome config - Update openshift_search_lib() interface - Add fs_list_pstorefs() - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18 - Better labels for raspberry pi devices - Allow init to create devpts_t directory - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18 - Allow sysadm_t to build kernels - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18 - Allow userdomains to stream connect to gssproxy - Dontaudit leaked file descriptor writes from firewalld - Allow xserver to read /dev/urandom - Add additional fixes for ipsec-mgmt - Make SSHing into an Openshift Enterprise Node working- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime - with the proper label. - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files - Allow systemd-timedated to create adjtime - Add clock_create_adjtime() - Additional fix ifconfing for #966106 - Allow kernel_t to create boot.log with correct labeling - Remove unconfined_mplayer for which we don't have rules - Rename interfaces - Add userdom_manage_user_home_files/dirs interfaces - Fix files_dontaudit_read_all_non_security_files - Fix ipsec_manage_key_file() - Fix ipsec_filetrans_key_file() - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t - Fix labeling for ipse.secrets - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid - Add files_dontaudit_read_all_non_security_files() interface - /var/log/syslog-ng should be labeled var_log_t - Make ifconfig_var_run_t a mountpoint - Add transition from ifconfig to dnsmasq - Allow ifconfig to execute bin_t/shell_exec_t - We want to have hwdb.bin labeled as etc_t - update logging_filetrans_named_content() interface - Allow systemd_timedate_t to manage /etc/adjtime - Allow NM to send signals to l2tpd - Update antivirus_can_scan_system boolean - Allow devicekit_disk_t to sys_config_tty - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories - Make printing from vmware working - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes - Add virt_qemu_ga_data_t for qemu-ga - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both - Fix typo in virt.te - Add virt_qemu_ga_unconfined_t for hook scripts - Make sure NetworkManager files get created with the correct label - Add mozilla_plugin_use_gps boolean - Fix cyrus to have support for net-snmp - Additional fixes for dnsmasq and quantum for #966106 - Add plymouthd_create_log() - remove httpd_use_oddjob for which we don't have rules - Add missing rules for httpd_can_network_connect_cobbler - Add missing cluster_use_execmem boolean - Call userdom_manage_all_user_home_type_files/dirs - Additional fix for ftp_home_dir - Fix ftp_home_dir boolean - Allow squit to recv/send client squid packet - Fix nut.te to have nut_domain attribute - Add support for ejabberd; TODO: revisit jabberd and rabbit policy - Fix amanda policy - Add more fixes for domains which use libusb - Make domains which use libusb working correctly - Allow l2tpd to create ipsec key files with correct labeling and manage them - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files - Allow rabbitmq-beam to bind generic node - Allow l2tpd to read ipse-mgmt pid files - more fixes for l2tpd, NM and pppd from #967072- Dontaudit to getattr on dirs for dovecot-deliver - Allow raiudusd server connect to postgresql socket - Add kerberos support for radiusd - Allow saslauthd to connect to ldap port - Allow postfix to manage postfix_private_t files - Add chronyd support for #965457 - Fix labeling for HOME_DIR/\.icedtea - CHange squid and snmpd to be allowed also write own logs - Fix labeling for /usr/libexec/qemu-ga - Allow virtd_t to use virt_lock_t - Allow also sealert to read the policy from the kernel - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content - Dontaudit listing of users homedir by sendmail Seems like a leak - Allow passenger to transition to puppet master - Allow apache to connect to mythtv - Add definition for mythtv ports- Add additional fixes for #948073 bug - Allow sge_execd_t to also connect to sge ports - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files - Add networkmanager_stream_connect() - Make gnome-abrt wokring with staff_t - Fix openshift_manage_lib_files() interface - mdadm runs ps command which seems to getattr on random log files - Allow mozilla_plugin_t to create pulseaudit_home_t directories - Allow qemu-ga to shutdown virtual hosts - Add labelling for cupsd-browsed - Add web browser plugins to connect to aol ports - Allow nm-dhcp-helper to stream connect to NM - Add port definition for sge ports- Make sure users and unconfined domains create .hushlogin with the correct label - Allow pegaus to chat with realmd over DBus - Allow cobblerd to read network state - Allow boicn-client to stat on /dev/input/mice - Allow certwatch to read net_config_t when it executes apache - Allow readahead to create /run/systemd and then create its own directory with the correct label- Transition directories and files when in a user_tmp_t directory - Change certwatch to domtrans to apache instead of just execute - Allow virsh_t to read xen lib files - update policy rules for pegasus_openlmi_account_t - Add support for svnserve_tmp_t - Activate account openlmi policy - pegasus_openlmi_domain_template needs also require pegasus_t - One more fix for policykit.te - Call fs_list_cgroups_dirs() in policykit.te - Allow nagios service plugin to read mysql config files - Add labeling for /var/svn - Fix chrome.te - Fix pegasus_openlmi_domain_template() interfaces - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks - Fix location of google-chrome data - Add support for chome_sandbox to store content in the homedir - Allow policykit to watch for changes in cgroups file system - Add boolean to allow mozilla_plugin_t to use spice - Allow collectd to bind to udp port - Allow collected_t to read all of /proc - Should use netlink socket_perms - Should use netlink socket_perms - Allow glance domains to connect to apache ports - Allow apcupsd_t to manage its log files - Allow chrome objects to rw_inherited unix_stream_socket from callers - Allow staff_t to execute virtd_exec_t for running vms - nfsd_t needs to bind mountd port to make nfs-mountd.service working - Allow unbound net_admin capability because of setsockopt syscall - Fix fs_list_cgroup_dirs() - Label /usr/lib/nagios/plugins/utils.pm as bin_t - Remove uplicate definition of fs_read_cgroup_files() - Remove duplicate definition of fs_read_cgroup_files() - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd - Additional interfaces needed to list and read cgroups config - Add port definition for collectd port - Add labels for /dev/ptp* - Allow staff_t to execute virtd_exec_t for running vms- Allow samba-net to also read realmd tmp files - Allow NUT to use serial ports - realmd can be started by systemctl now- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid - Allow virsh to read xen lock file - Allow qemu-ga to create files in /run with proper labeling - Allow glusterd to connect to own socket in /tmp - Allow glance-api to connect to http port to make glance image-create working - Allow keystonte_t to execute rpm- Fix realmd cache interfaces- Allow tcpd to execute leafnode - Allow samba-net to read realmd cache files - Dontaudit sys_tty_config for alsactl - Fix allow rules for postfix_var_run - Allow cobblerd to read /etc/passwd - Allow pegasus to read exports - Allow systemd-timedate to read xdm state - Allow mout to stream connect to rpcbind - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki- Allow thumbnails to share memory with apps which run thumbnails - Allow postfix-postqueue block_suspend - Add lib interfaces for smsd - Add support for nginx - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t - Allow pki apache domain to create own tmp files and execute httpd_suexec - Allow procmail to manger user tmp files/dirs/lnk_files - Add virt_stream_connect_svirt() interface - Allow dovecot-auth to execute bin_t - Allow iscsid to request that kernel load a kernel module - Add labeling support for /var/lib/mod_security - Allow iw running as tuned_t to create netlink socket - Dontaudit sys_tty_config for thumb_t - Add labeling for nm-l2tp-service - Allow httpd running as certwatch_t to open tcp socket - Allow useradd to manager smsd lib files - Allow useradd_t to add homedirs in /var/lib - Fix typo in userdomain.te - Cleanup userdom_read_home_certs - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t - Allow staff to stream connect to svirt_t to make gnome-boxes working- Allow lvm to create its own unit files - Label /var/lib/sepolgen as selinux_config_t - Add filetrans rules for tw devices - Add transition from cupsd_config_t to cupsd_t- Add filetrans rules for tw devices - Cleanup bad transition lines- Fix lockdev_manage_files() - Allow setroubleshootd to read var_lib_t to make email_alert working - Add lockdev_manage_files() - Call proper interface in virt.te - Allow gkeyring_domain to create /var/run/UID/config/dbus file - system dbus seems to be blocking suspend - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need - When you enter a container from root, you generate avcs with a leaked file descriptor - Allow mpd getattr on file system directories - Make sure realmd creates content with the correct label - Allow systemd-tty-ask to write kmsg - Allow mgetty to use lockdev library for device locking - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music - When you enter a container from root, you generate avcs with a leaked file descriptor - Make sure init.fc files are labeled correctly at creation - File name trans vconsole.conf - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow certmonger to dbus communicate with realmd - Make realmd working- Fix mozilla specification of homedir content - Allow certmonger to read network state - Allow tmpwatch to read tmp in /var/spool/{cups,lpd} - Label all nagios plugin as unconfined by default - Add httpd_serve_cobbler_files() - Allow mdadm to read /dev/sr0 and create tmp files - Allow certwatch to send mails - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow realmd to run ipa, really needs to be an unconfined_domain - Allow sandbox domains to use inherted terminals - Allow pscd to use devices labeled svirt_image_t in order to use cat cards. - Add label for new alsa pid - Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition - Add support for sshd_unit_file_t - Add oracleasmfs_t - Allow unlabeled_t files to be stored on unlabeled_t filesystems- Fix description of deny_ptrace boolean - Remove allow for execmod lib_t for now - Allow quantum to connect to keystone port - Allow nova-console to talk with mysql over unix stream socket - Allow dirsrv to stream connect to uuidd - thumb_t needs to be able to create ~/.cache if it does not exist - virtd needs to be able to sys_ptrace when starting and stoping containers- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms... - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets - Fix deny_ptrace boolean, certain ptrace leaked into the system - Allow winbind to manage kerberos_rcache_host - Allow spamd to create spamd_var_lib_t directories - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs - Fix vmware_role() interface - Fix cobbler_manage_lib_files() interface - Allow nagios check disk plugins to execute bin_t - Allow quantum to transition to openvswitch_t - Allow postdrop to stream connect to postfix-master - Allow quantum to stream connect to openvswitch - Add xserver_dontaudit_xdm_rw_stream_sockets() interface - Allow daemon to send dgrams to initrc_t - Allow kdm to start the power service to initiate a reboot or poweroff- Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Don't audit attempts to write to stream socket of nscld by thumbnailers - Allow git_system_t to read network state - Allow pegasas to execute mount command - Fix desc for drdb_admin - Fix condor_amin() - Interface fixes for uptime, vdagent, vnstatd - Fix labeling for moodle in /var/www/moodle/data - Add interface fixes - Allow bugzilla to read certs - /var/www/moodle needs to be writable by apache - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Fix sys_nice for cups_domain - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Kernel_t needs mac_admin in order to support labeled NFS - Fix systemd_dontaudit_dbus_chat() interface - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Allow consolehelper domain to write Xauth files in /root - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Allow consolehelper more access discovered by Tom London - Allow fsdaemon to send signull to all domain - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Fix file_contexts.subs to label /run/lock correctly- Try to label on controlC devices up to 30 correctly - Add mount_rw_pid_files() interface - Add additional mount/umount interfaces needed by mock - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk - Fix tabs - Allow initrc_domain to search rgmanager lib files - Add more fixes which make mock working together with confined users * Allow mock_t to manage rpm files * Allow mock_t to read rpm log files * Allow mock to setattr on tmpfs, devpts * Allow mount/umount filesystems - Add rpm_read_log() interface - yum-cron runs rpm from within it. - Allow tuned to transition to dmidecode - Allow firewalld to do net_admin - Allow mock to unmont tmpfs_t - Fix virt_sigkill() interface - Add additional fixes for mock. Mainly caused by mount running in mock_t - Allow mock to write sysfs_t and mount pid files - Add mailman_domain to mailman_template() - Allow openvswitch to execute shell - Allow qpidd to use kerberos - Allow mailman to use fusefs, needs back port to RHEL6 - Allow apache and its scripts to use anon_inodefs - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7 - Realmd needs to connect to samba ports, needs back port to F18 also - Allow colord to read /run/initial-setup- - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock - Add virt_kill() interface - Add rgmanager_search_lib() interface - Allow wdmd to getattr on all filesystems. Back ported from RHEL6- Allow realmd to create tmp files - FIx ircssi_home_t type to irssi_home_t - Allow adcli running as realmd_t to connect to ldap port - Allow NetworkManager to transition to ipsec_t, for running strongswan - Make openshift_initrc_t an lxc_domain - Allow gssd to manage user_tmp_t files - Fix handling of irclogs in users homedir - Fix labeling for drupal an wp-content in subdirs of /var/www/html - Allow abrt to read utmp_t file - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6 - fix labeling for (oo|rhc)-restorer-wrapper.sh - firewalld needs to be able to write to network sysctls - Fix mozilla_plugin_dontaudit_rw_sem() interface - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains - Add mozilla_plugin_dontaudit_rw_sem() interface - Allow svirt_lxc_t to transition to openshift domains - Allow condor domains block_suspend and dac_override caps - Allow condor_master to read passd - Allow condor_master to read system state - Allow NetworkManager to transition to ipsec_t, for running strongswan - Lots of access required by lvm_t to created encrypted usb device - Allow xdm_t to dbus communicate with systemd_localed_t - Label strongswan content as ipsec_exec_mgmt_t for now - Allow users to dbus chat with systemd_localed - Fix handling of .xsession-errors in xserver.if, so kde will work - Might be a bug but we are seeing avc's about people status on init_t:service - Make sure we label content under /var/run/lock as <> - Allow daemon and systemprocesses to search init_var_run_t directory - Add boolean to allow xdm to write xauth data to the home directory - Allow mount to write keys for the unconfined domain - Add unconfined_write_keys() interface- Add labeling for /usr/share/pki - Allow programs that read var_run_t symlinks also read var_t symlinks - Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports - Fix labeling for /etc/dhcp directory - add missing systemd_stub_unit_file() interface - Add files_stub_var() interface - Add lables for cert_t directories - Make localectl set-x11-keymap working at all - Allow abrt to manage mock build environments to catch build problems. - Allow virt_domains to setsched for running gdb on itself - Allow thumb_t to execute user home content - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000 - Allow certwatch to execut /usr/bin/httpd - Allow cgred to send signal perms to itself, needs back port to RHEL6 - Allow openshift_cron_t to look at quota - Allow cups_t to read inhered tmpfs_t from the kernel - Allow yppasswdd to use NIS - Tuned wants sys_rawio capability - Add ftpd_use_fusefs boolean - Allow dirsrvadmin_t to signal itself- Allow localectl to read /etc/X11/xorg.conf.d directory - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors"" - Allow mount to transition to systemd_passwd_agent - Make sure abrt directories are labeled correctly - Allow commands that are going to read mount pid files to search mount_var_run_t - label /usr/bin/repoquery as rpm_exec_t - Allow automount to block suspend - Add abrt_filetrans_named_content so that abrt directories get labeled correctly - Allow virt domains to setrlimit and read file_context- Allow nagios to manage nagios spool files - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6 - Add swift_alias.* policy files which contain typealiases for swift types - Add support for /run/lock/opencryptoki - Allow pkcsslotd chown capability - Allow pkcsslotd to read passwd - Add rsync_stub() interface - Allow systemd_timedate also manage gnome config homedirs - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t - Fix filetrans rules for kdm creates .xsession-errors - Allow sytemd_tmpfiles to create wtmp file - Really should not label content under /var/lock, since it could have labels on it different from var_lock_t - Allow systemd to list all file system directories - Add some basic stub interfaces which will be used in PRODUCT policies- Fix log transition rule for cluster domains - Start to group all cluster log together - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update - cups uses usbtty_device_t devices - These fixes were all required to build a MLS virtual Machine with single level desktops - Allow domains to transiton using httpd_exec_t - Allow svirt domains to manage kernel key rings - Allow setroubleshoot to execute ldconfig - Allow firewalld to read generate gnome data - Allow bluetooth to read machine-info - Allow boinc domain to send signal to itself - Fix gnome_filetrans_home_content() interface - Allow mozilla_plugins to list apache modules, for use with gxine - Fix labels for POkemon in the users homedir - Allow xguest to read mdstat - Dontaudit virt_domains getattr on /dev/* - These fixes were all required to build a MLS virtual Machine with single level desktops - Need to back port this to RHEL6 for openshift - Add tcp/8891 as milter port - Allow nsswitch domains to read sssd_var_lib_t files - Allow ping to read network state. - Fix typo - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them- Adopt swift changes from lhh@redhat.com - Add rhcs_manage_cluster_pid_files() interface - Allow screen domains to configure tty and setup sock_file in ~/.screen directory - ALlow setroubleshoot to read default_context_t, needed to backport to F18 - Label /etc/owncloud as being an apache writable directory - Allow sshd to stream connect to an lxc domain- Allow postgresql to manage rgmanager pid files - Allow postgresql to read ccs data - Allow systemd_domain to send dbus messages to policykit - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them - All systemd domains that create content are reading the file_context file and setfscreate - Systemd domains need to search through init_var_run_t - Allow sshd to communicate with libvirt to set containers labels - Add interface to manage pid files - Allow NetworkManger_t to read /etc/hostname - Dontaudit leaked locked files into openshift_domains - Add fixes for oo-cgroup-read - it nows creates tmp files - Allow gluster to manage all directories as well as files - Dontaudit chrome_sandbox_nacl_t using user terminals - Allow sysstat to manage its own log files - Allow virtual machines to setrlimit and send itself signals. - Add labeling for /var/run/hplip- Fix POSTIN scriptlet- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp- Fix authconfig.py labeling - Make any domains that write homedir content do it correctly - Allow glusterd to read/write anyhwere on the file system by default - Be a little more liberal with the rsync log files - Fix iscsi_admin interface - Allow iscsid_t to read /dev/urand - Fix up iscsi domain for use with unit files - Add filename transition support for spamassassin policy - Allow web plugins to use badly formated libraries - Allow nmbd_t to create samba_var_t directories - Add filename transition support for spamassassin policy - Add filename transition support for tvtime - Fix alsa_home_filetrans_alsa_home() interface - Move all userdom_filetrans_home_content() calling out of booleans - Allow logrotote to getattr on all file sytems - Remove duplicate userdom_filetrans_home_content() calling - Allow kadmind to read /etc/passwd - Dontaudit append .xsession-errors file on ecryptfs for policykit-auth - Allow antivirus domain to manage antivirus db links - Allow logrotate to read /sys - Allow mandb to setattr on man dirs - Remove mozilla_plugin_enable_homedirs boolean - Fix ftp_home_dir boolean - homedir mozilla filetrans has been moved to userdom_home_manager - homedir telepathy filetrans has been moved to userdom_home_manager - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd() - Might want to eventually write a daemon on fusefsd. - Add policy fixes for sshd [net] child from plautrba@redhat.com - Tor uses a new port - Remove bin_t for authconfig.py - Fix so only one call to userdom_home_file_trans - Allow home_manager_types to create content with the correctl label - Fix all domains that write data into the homedir to do it with the correct label - Change the postgresql to use proper boolean names, which is causing httpd_t to - not get access to postgresql_var_run_t - Hostname needs to send syslog messages - Localectl needs to be able to send dbus signals to users - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default - Allow user_home_manger domains to create spam* homedir content with correct labeling - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working - Declare userdom_filetrans_type attribute - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute - fusefsd is mounding a fuse file system on /run/user/UID/gvfs- Man pages are now generated in the build process - Allow cgred to list inotifyfs filesystem- Allow gluster to get attrs on all fs - New access required for virt-sandbox - Allow dnsmasq to execute bin_t - Allow dnsmasq to create content in /var/run/NetworkManager - Fix openshift_initrc_signal() interface - Dontaudit openshift domains doing getattr on other domains - Allow consolehelper domain to communicate with session bus - Mock should not be transitioning to any other domains, we should keep mock_t as mock_t - Update virt_qemu_ga_t policy - Allow authconfig running from realmd to restart oddjob service - Add systemd support for oddjob - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd - Add labeling for gnashpluginrc - Allow chrome_nacl to execute /dev/zero - Allow condor domains to read /proc - mozilla_plugin_t will getattr on /core if firefox crashes - Allow condor domains to read /etc/passwd - Allow dnsmasq to execute shell scripts, openstack requires this access - Fix glusterd labeling - Allow virtd_t to interact with the socket type - Allow nmbd_t to override dac if you turned on sharing all files - Allow tuned to created kobject_uevent socket - Allow guest user to run fusermount - Allow openshift to read /proc and locale - Allow realmd to dbus chat with rpm - Add new interface for virt - Remove depracated interfaces - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t - Remove some more unconfined_t process transitions, that I don't believe are necessary - Stop transitioning uncofnined_t to checkpc - dmraid creates /var/lock/dmraid - Allow systemd_localed to creatre unix_dgram_sockets - Allow systemd_localed to write kernel messages. - Also cleanup systemd definition a little. - Fix userdom_restricted_xwindows_user_template() interface - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t - User accounts need to dbus chat with accountsd daemon - Gnome requires all users to be able to read /proc/1/- virsh now does a setexeccon call - Additional rules required by openshift domains - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work - Allow spamd_update_t to search spamc_home_t - Avcs discovered by mounting an isci device under /mnt - Allow lspci running as logrotate to read pci.ids - Additional fix for networkmanager_read_pid_files() - Fix networkmanager_read_pid_files() interface - Allow all svirt domains to connect to svirt_socket_t - Allow virsh to set SELinux context for a process. - Allow tuned to create netlink_kobject_uevent_socket - Allow systemd-timestamp to set SELinux context - Add support for /var/lib/systemd/linger - Fix ssh_sysadm_login to be working on MLS as expected- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file - Add missing files_rw_inherited_tmp_files interface - Add additional interface for ecryptfs - ALlow nova-cert to connect to postgresql - Allow keystone to connect to postgresql - Allow all cups domains to getattr on filesystems - Allow pppd to send signull - Allow tuned to execute ldconfig - Allow gpg to read fips_enabled - Add additional fixes for ecryptfs - Allow httpd to work with posgresql - Allow keystone getsched and setsched- Allow gpg to read fips_enabled - Add support for /var/cache/realmd - Add support for /usr/sbin/blazer_usb and systemd support for nut - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t - bitlbee wants to read own log file - Allow glance domain to send a signal itself - Allow xend_t to request that the kernel load a kernel module - Allow pacemaker to execute heartbeat lib files - cleanup new swift policy- Fix smartmontools - Fix userdom_restricted_xwindows_user_template() interface - Add xserver_xdm_ioctl_log() interface - Allow Xusers to ioctl lxdm.log to make lxdm working - Add MLS fixes to make MLS boot/log-in working - Add mls_socket_write_all_levels() also for syslogd - fsck.xfs needs to read passwd - Fix ntp_filetrans_named_content calling in init.te - Allow postgresql to create pg_log dir - Allow sshd to read rsync_data_t to make rsync working - Change ntp.conf to be labeled net_conf_t - Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it - Allow xdm_t to execute gstreamer home content - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp - New policy for openstack swift domains - More access required for openshift_cron_t - Use cupsd_log_t instead of cupsd_var_log_t - rpm_script_roles should be used in rpm_run - Fix rpm_run() interface - Fix openshift_initrc_run() - Fix sssd_dontaudit_stream_connect() interface - Fix sssd_dontaudit_stream_connect() interface - Allow LDA's job to deliver mail to the mailbox - dontaudit block_suspend for mozilla_plugin_t - Allow l2tpd_t to all signal perms - Allow uuidgen to read /dev/random - Allow mozilla-plugin-config to read power_supply info - Implement cups_domain attribute for cups domains - We now need access to user terminals since we start by executing a command outside the tty - We now need access to user terminals since we start by executing a command outside the tty - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen - Add containment of openshift cron jobs - Allow system cron jobs to create tmp directories - Make userhelp_conf_t a config file - Change rpm to use rpm_script_roles - More fixes for rsync to make rsync wokring - Allow logwatch to domtrans to mdadm - Allow pacemaker to domtrans to ifconfig - Allow pacemaker to setattr on corosync.log - Add pacemaker_use_execmem for memcheck-amd64 command - Allow block_suspend capability - Allow create fifo_file in /tmp with pacemaker_tmp_t - Allow systat to getattr on fixed disk - Relabel /etc/ntp.conf to be net_conf_t - ntp_admin should create files in /etc with the correct label - Add interface to create ntp_conf_t files in /etc - Add additional labeling for quantum - Allow quantum to execute dnsmasq with transition- boinc_cliean wants also execmem as boinc projecs have - Allow sa-update to search admin home for /root/.spamassassin - Allow sa-update to search admin home for /root/.spamassassin - Allow antivirus domain to read net sysctl - Dontaudit attempts from thumb_t to connect to ssd - Dontaudit attempts by readahead to read sock_files - Dontaudit attempts by readahead to read sock_files - Create tmpfs file while running as wine as user_tmpfs_t - Dontaudit attempts by readahead to read sock_files - libmpg ships badly created librarie- Change ssh_use_pts to use macro and only inherited sshd_devpts_t - Allow confined users to read systemd_logind seat information - libmpg ships badly created libraries - Add support for strongswan.service - Add labeling for strongswan - Allow l2tpd_t to read network manager content in /run directory - Allow rsync to getattr any file in rsync_data_t - Add labeling and filename transition for .grl-podcasts- mount.glusterfs executes glusterfsd binary - Allow systemd_hostnamed_t to stream connect to systemd - Dontaudit any user doing a access check - Allow obex-data-server to request the kernel to load a module - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info) - Allow gpg-agent to read /proc/sys/crypto/fips_enabled - Add new types for antivirus.pp policy module - Allow gnomesystemmm_t caps because of ioprio_set - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t - Allow gnomesystemmm_t caps because of ioprio_set - Allow NM rawip socket - files_relabel_non_security_files can not be used with boolean - Add interface to thumb_t dbus_chat to allow it to read remote process state - ALlow logrotate to domtrans to mdadm_t - kde gnomeclock wants to write content to /tmp- kde gnomeclock wants to write content to /tmp - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde - Allow blueman_t to rwx zero_device_t, for some kind of jre - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre - Ftp full access should be allowed to create directories as well as files - Add boolean to allow rsync_full_acces, so that an rsync server can write all - over the local machine - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6 - Add missing vpnc_roles type line - Allow stapserver to write content in /tmp - Allow gnome keyring to create keyrings dir in ~/.local/share - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Add interface to colord_t dbus_chat to allow it to read remote process state - Allow colord_t to read cupsd_t state - Add mate-thumbnail-font as thumnailer - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data. - Allow qpidd to list /tmp. Needed by ssl - Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18 - - Added systemd support for ksmtuned - Added booleans ksmtuned_use_nfs ksmtuned_use_cifs - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow - Looks like qpidd_t needs to read /dev/random - Lots of probing avc's caused by execugting gpg from staff_t - Dontaudit senmail triggering a net_admin avc - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port - Logwatch does access check on mdadm binary - Add raid_access_check_mdadm() iterface- Fix systemd_manage_unit_symlinks() interface - Call systemd_manage_unit_symlinks(() which is correct interface - Add filename transition for opasswd - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow sytstemd-timedated to get status of init_t - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow gpg_t to manage all gnome files - Stop using pcscd_read_pub_files - New rules for xguest, dontaudit attempts to dbus chat - Allow firewalld to create its mmap files in tmpfs and tmp directories - Allow firewalld to create its mmap files in tmpfs and tmp directories - run unbound-chkconf as named_t, so it can read dnssec - Colord is reading xdm process state, probably reads state of any apps that sends dbus message - Allow mdadm_t to change the kernel scheduler - mythtv policy - Update mandb_admin() interface - Allow dsspam to listen on own tpc_socket - seutil_filetrans_named_content needs to be optional - Allow sysadm_t to execute content in his homedir - Add attach_queue to tun_socket, new patch from Paul Moore - Change most of selinux configuration types to security_file_type. - Add filename transition rules for selinux configuration - ssh into a box with -X -Y requires ssh_use_ptys - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated - New allow rules found by Tom London for systemd_hostnamed- Allow systemd-tmpfiles to relabel lpd spool files - Ad labeling for texlive bash scripts - Add xserver_filetrans_fonts_cache_home_content() interface - Remove duplicate rules from *.te - Add support for /var/lock/man-db.lock - Add support for /var/tmp/abrt(/.*)? - Add additional labeling for munin cgi scripts - Allow httpd_t to read munin conf files - Allow certwatch to read meminfo - Fix nscd_dontaudit_write_sock_file() interfac - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling- Allow gnomeclock to talk to puppet over dbus - Allow numad access discovered by Dominic - Add support for HOME_DIR/.maildir - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain - Allow udev to relabel udev_var_run_t lnk_files - New bin_t file in mcelog- Remove all mcs overrides and replace with t1 != mcs_constrained_types - Add attribute_role for iptables - mcs_process_set_categories needs to be called for type - Implement additional role_attribute statements - Sodo domain is attempting to get the additributes of proc_kcore_t - Unbound uses port 8953 - Allow svirt_t images to compromise_kernel when using pci-passthrough - Add label for dns lib files - Bluetooth aquires a dbus name - Remove redundant files_read_usr_file calling - Remove redundant files_read_etc_file calling - Fix mozilla_run_plugin() - Add role_attribute support for more domains- Mass merge with upstream- Bump the policy version to 28 to match selinux userspace - Rebuild versus latest libsepol- Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Add labeling for /var/named/chroot/etc/localtim- Allow setroubleshoot_fixit to execute rpm - zoneminder needs to connect to httpd ports where remote cameras are listening - Allow firewalld to execute content created in /run directory - Allow svirt_t to read generic certs - Dontaudit leaked ps content to mozilla plugin - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - init scripts are creating systemd_unit_file_t directories- systemd_logind_t is looking at all files under /run/user/apache - Allow systemd to manage all user tmp files - Add labeling for /var/named/chroot/etc/localtime - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6 - Keystone is now using a differnt port - Allow xdm_t to use usbmuxd daemon to control sound - Allow passwd daemon to execute gnome_exec_keyringd - Fix chrome_sandbox policy - Add labeling for /var/run/checkquorum-timer - More fixes for the dspam domain, needs back port to RHEL6 - More fixes for the dspam domain, needs back port to RHEL6 - sssd needs to connect to kerberos password port if a user changes his password - Lots of fixes from RHEL testing of dspam web - Allow chrome and mozilla_plugin to create msgq and semaphores - Fixes for dspam cgi scripts - Fixes for dspam cgi scripts - Allow confine users to ptrace screen - Backport virt_qemu_ga_t changes from RHEL - Fix labeling for dspam.cgi needed for RHEL6 - We need to back port this policy to RHEL6, for lxc domains - Dontaudit attempts to set sys_resource of logrotate - Allow corosync to read/write wdmd's tmpfs files - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set - Allow cron jobs to read bind config for unbound - libvirt needs to inhibit systemd - kdumpctl needs to delete boot_t files - Fix duplicate gnome_config_filetrans - virtd_lxc_t is using /dev/fuse - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift - apcupsd can be setup to listen to snmp trafic - Allow transition from kdumpgui to kdumpctl - Add fixes for munin CGI scripts - Allow deltacloud to connect to openstack at the keystone port - Allow domains that transition to svirt domains to be able to signal them - Fix file context of gstreamer in .cache directory - libvirt is communicating with logind - NetworkManager writes to the systemd inhibit pipe- Allow munin disk plugins to get attributes of all directories - Allow munin disk plugins to get attributes of all directorie - Allow logwatch to get attributes of all directories - Fix networkmanager_manage_lib() interface - Fix gnome_manage_config() to allow to manage sock_file - Fix virtual_domain_context - Add support for dynamic DNS for DHCPv6- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch - Add additional labeling for /var/www/openshift/broker - Fix rhev policy - Allow openshift_initrc domain to dbus chat with systemd_logind - Allow httpd to getattr passenger log file if run_stickshift - Allow consolehelper-gtk to connect to xserver - Add labeling for the tmp-inst directory defined in pam_namespace.conf - Add lvm_metadata_t labeling for /etc/multipath- consoletype is no longer used- Add label for efivarfs - Allow certmonger to send signal to itself - Allow plugin-config to read own process status - Add more fixes for pacemaker - apache/drupal can run clamscan on uploaded content - Allow chrome_sandbox_nacl_t to read pid 1 content- Fix MCS Constraints to control ingres and egres controls on the network. - Change name of svirt_nokvm_t to svirt_tcg_t - Allow tuned to request the kernel to load kernel modules- Label /var/lib/pgsql/.ssh as ssh_home_t - Add labeling for /usr/bin/pg_ctl - Allow systemd-logind to manage keyring user tmp dirs - Add support for 7389/tcp port - gems seems to be placed in lots of places - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus - Add back tcp/8123 port as http_cache port - Add ovirt-guest-agent\.pid labeling - Allow xend to run scsi_id - Allow rhsmcertd-worker to read "physical_package_id" - Allow pki_tomcat to connect to ldap port - Allow lpr to read /usr/share/fonts - Allow open file from CD/DVD drive on domU - Allow munin services plugins to talk to SSSD - Allow all samba domains to create samba directory in var_t directories - Take away svirt_t ability to use nsswitch - Dontaudit attempts by openshift to read apache logs - Allow apache to create as well as append _ra_content_t - Dontaudit sendmail_t reading a leaked file descriptor - Add interface to have admin transition /etc/prelink.cache to the proper label - Add sntp support to ntp policy - Allow firewalld to dbus chat with devicekit_power - Allow tuned to call lsblk - Allow tor to read /proc/sys/kernel/random/uuid - Add tor_can_network_relay boolean- Add openshift_initrc_signal() interface - Fix typos - dspam port is treat as spamd_port_t - Allow setroubleshoot to getattr on all executables - Allow tuned to execute profiles scripts in /etc/tuned - Allow apache to create directories to store its log files - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6 - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM - Add filename transition for /etc/tuned/active_profile - Allow condor_master to send mails - Allow condor_master to read submit.cf - Allow condor_master to create /tmp files/dirs - Allow condor_mater to send sigkill to other condor domains - Allow condor_procd sigkill capability - tuned-adm wants to talk with tuned daemon - Allow kadmind and krb5kdc to also list sssd_public_t - Allow accountsd to dbus chat with init - Fix git_read_generic_system_content_files() interface - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler" - Fix mozilla_plugin_can_network_connect to allow to connect to all ports - Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t - dspam wants to search /var/spool for opendkim data - Revert "Add support for tcp/10026 port as dspam_port_t" - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6 - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain - Allow systemd_tmpfiles_t to setattr on mandb_cache_t- consolekit.pp was not removed from the postinstall script- Add back consolekit policy - Silence bootloader trying to use inherited tty - Silence xdm_dbusd_t trying to execute telepathy apps - Fix shutdown avcs when machine has unconfined.pp disabled - The host and a virtual machine can share the same printer on a usb device - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob - Allow abrt_watch_log_t to execute bin_t - Allow chrome sandbox to write content in ~/.config/chromium - Dontaudit setattr on fontconfig dir for thumb_t - Allow lircd to request the kernel to load module - Make rsync as userdom_home_manager - Allow rsync to search automount filesystem - Add fixes for pacemaker- Add support for 4567/tcp port - Random fixes from Tuomo Soini - xdm wants to get init status - Allow programs to run in fips_mode - Add interface to allow the reading of all blk device nodes - Allow init to relabel rpcbind sock_file - Fix labeling for lastlog and faillog related to logrotate - ALlow aeolus_configserver to use TRAM port - Add fixes for aeolus_configserver - Allow snmpd to connect to snmp port - Allow spamd_update to create spamd_var_lib_t directories - Allow domains that can read sssd_public_t files to also list the directory - Remove miscfiles_read_localization, this is defined for all domains- Allow syslogd to request the kernel to load a module - Allow syslogd_t to read the network state information - Allow xdm_dbusd_t connect to the system DBUS - Add support for 7389/tcp port - Allow domains to read/write all inherited sockets - Allow staff_t to read kmsg - Add awstats_purge_apache_log boolean - Allow ksysguardproces to read /.config/Trolltech.conf - Allow passenger to create and append puppet log files - Add puppet_append_log and puppet_create_log interfaces - Add puppet_manage_log() interface - Allow tomcat domain to search tomcat_var_lib_t - Allow pki_tomcat_t to connect to pki_ca ports - Allow pegasus_t to have net_admin capability - Allow pegasus_t to write /sys/class/net//flags - Allow mailserver_delivery to manage mail_home_rw_t lnk_files - Allow fetchmail to create log files - Allow gnomeclock to manage home config in .kde - Allow bittlebee to read kernel sysctls - Allow logrotate to list /root- Fix userhelper_console_role_template() - Allow enabling Network Access Point service using blueman - Make vmware_host_t as unconfined domain - Allow authenticate users in webaccess via squid, using mysql as backend - Allow gathers to get various metrics on mounted file systems - Allow firewalld to read /etc/hosts - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t - Allow kdumpgui to read/write to zipl.conf - Commands needed to get mock to build from staff_t in enforcing mode - Allow mdadm_t to manage cgroup files - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files - dontaudit ifconfig_t looking at fifo_files that are leaked to it - Add lableing for Quest Authentication System- Fix filetrans interface definitions - Dontaudit xdm_t to getattr on BOINC lib files - Add systemd_reload_all_services() interface - Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files - Allow accountsd to dbus chat with gdm - Allow realmd to getattr on all fs - Allow logrotate to reload all services - Add systemd unit file for radiusd - Allow winbind to create samba pid dir - Add labeling for /var/nmbd/unexpected - Allow chrome and mozilla plugin to connect to msnp ports- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file - Dontaudit setfiles reading /dev/random - On initial boot gnomeclock is going to need to be set buy gdm - Fix tftp_read_content() interface - Random apps looking at kernel file systems - Testing virt with lxc requiers additional access for virsh_t - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container - Allow MPD to read /dev/radnom - Allow sandbox_web_type to read logind files which needs to read pulseaudio - Allow mozilla plugins to read /dev/hpet - Add labeling for /var/lib/zarafa-webap - Allow BOINC client to use an HTTP proxy for all connections - Allow rhsmertd to domain transition to dmidecod - Allow setroubleshootd to send D-Bus msg to ABRT- Define usbtty_device_t as a term_tty - Allow svnserve to accept a connection - Allow xend manage default virt_image_t type - Allow prelink_cron_system_t to overide user componant when executing cp - Add labeling for z-push - Gnomeclock sets the realtime clock - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd - Allow lxc domains to use /dev/random and /dev/urandom- Add port defintion for tcp/9000 - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API - Allow shorewall_t to create netlink_socket - Allow krb5admind to block suspend - Fix labels on /var/run/dlm_controld /var/log/dlm_controld - Allow krb5kdc to block suspend - gnomessytemmm_t needs to read /etc/passwd - Allow cgred to read all sysctls- Allow all domains to read /proc/sys/vm/overcommit_memory - Make proc_numa_t an MLS Trusted Object - Add /proc/numactl support for confined users - Allow ssh_t to connect to any port > 1023 - Add openvswitch domain - Pulseaudio tries to create directories in gnome_home_t directories - New ypbind pkg wants to search /var/run which is caused by sd_notify - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans - Allow sanlock to read /dev/random - Treat php-fpm with httpd_t - Allow domains that can read named_conf_t to be able to list the directories - Allow winbind to create sock files in /var/run/samba- Add smsd policy - Add support for OpenShift sbin labelin - Add boolean to allow virt to use rawip - Allow mozilla_plugin to read all file systems with noxattrs support - Allow kerberos to write on anon_inodefs fs - Additional access required by fenced - Add filename transitions for passwd.lock/group.lock - UPdate man pages - Create coolkey directory in /var/cache with the correct label- Fix label on /etc/group.lock - Allow gnomeclock to create lnk_file in /etc - label /root/.pki as a home_cert_t - Add interface to make sure rpcbind.sock is created with the correct label - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules - opendkim should be a part of milter - Allow libvirt to set the kernel sched algorythm - Allow mongod to read sysfs_t - Add authconfig policy - Remove calls to miscfiles_read_localization all domains get this - Allow virsh_t to read /root/.pki/ content - Add label for log directory under /var/www/stickshift- Allow getty to setattr on usb ttys - Allow sshd to search all directories for sshd_home_t content - Allow staff domains to send dbus messages to kdumpgui - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t - Dontaudit setfiles reading urand - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir - Allow systemd-timedated to read /dev/urandom - Allow entropyd_t to read proc_t (meminfo) - Add unconfined munin plugin - Fix networkmanager_read_conf() interface - Allow blueman to list /tmp which is needed by sys_nic/setsched - Fix label of /etc/mail/aliasesdb-stamp - numad is searching cgroups - realmd is communicating with networkmanager using dbus - Lots of fixes to try to get kdump to work- Allow loging programs to dbus chat with realmd - Make apache_content_template calling as optional - realmd is using policy kit- Add new selinuxuser_use_ssh_chroot boolean - dbus needs to be able to read/write inherited fixed disk device_t passed through it - Cleanup netutils process allow rule - Dontaudit leaked fifo files from openshift to ping - sanlock needs to read mnt_t lnk files - Fail2ban needs to setsched and sys_nice- Change default label of all files in /var/run/rpcbind - Allow sandbox domains (java) to read hugetlbfs_t - Allow awstats cgi content to create tmp files and read apache log files - Allow setuid/setgid for cupsd-config - Allow setsched/sys_nice pro cupsd-config - Fix /etc/localtime sym link to be labeled locale_t - Allow sshd to search postgresql db t since this is a homedir - Allow xwindows users to chat with realmd - Allow unconfined domains to configure all files and null_device_t service- Adopt pki-selinux policy- pki is leaking which we dontaudit until a pki code fix - Allow setcap for arping - Update man pages - Add labeling for /usr/sbin/mcollectived - pki fixes - Allow smokeping to execute fping in the netutils_t domain- Allow mount to relabelfrom unlabeled file systems - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working - Add label to get bin files under libreoffice labeled correctly - Fix interface to allow executing of base_ro_file_type - Add fixes for realmd - Update pki policy - Add tftp_homedir boolean - Allow blueman sched_setscheduler - openshift user domains wants to r/w ssh tcp sockets- Additional requirements for disable unconfined module when booting - Fix label of systemd script files - semanage can use -F /dev/stdin to get input - syslog now uses kerberos keytabs - Allow xserver to compromise_kernel access - Allow nfsd to write to mount_var_run_t when running the mount command - Add filename transition rule for bin_t directories - Allow files to read usr_t lnk_files - dhcpc wants chown - Add support for new openshift labeling - Clean up for tunable+optional statements - Add labeling for /usr/sbin/mkhomedir_helper - Allow antivirus domain to managa amavis spool files - Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool- Add interfaces to read kernel_t proc info - Missed this version of exec_all - Allow anyone who can load a kernel module to compromise kernel - Add oddjob_dbus_chat to openshift apache policy - Allow chrome_sandbox_nacl_t to send signals to itself - Add unit file support to usbmuxd_t - Allow all openshift domains to read sysfs info - Allow openshift domains to getattr on all domains- MLS fixes from Dan - Fix name of capability2 secure_firmware->compromise_kerne- Allow xdm to search all file systems - Add interface to allow the config of all files - Add rngd policy - Remove kgpg as a gpg_exec_t type - Allow plymouthd to block suspend - Allow systemd_dbus to config any file - Allow system_dbus_t to configure all services - Allow freshclam_t to read usr_files - varnishd requires execmem to load modules- Allow semanage to verify types - Allow sudo domain to execute user home files - Allow session_bus_type to transition to user_tmpfs_t - Add dontaudit caused by yum updates - Implement pki policy but not activated- tuned wants to getattr on all filesystems - tuned needs also setsched. The build is needed for test day- Add policy for qemu-qa - Allow razor to write own config files - Add an initial antivirus policy to collect all antivirus program - Allow qdisk to read usr_t - Add additional caps for vmware_host - Allow tmpfiles_t to setattr on mandb_cache_t - Dontaudit leaked files into mozilla_plugin_config_t - Allow wdmd to getattr on tmpfs - Allow realmd to use /dev/random - allow containers to send audit messages - Allow root mount any file via loop device with enforcing mls policy - Allow tmpfiles_t to setattr on mandb_cache_t - Allow tmpfiles_t to setattr on mandb_cache_t - Make userdom_dontaudit_write_all_ not allow open - Allow init scripts to read all unit files - Add support for saphostctrl ports- Add kernel_read_system_state to sandbox_client_t - Add some of the missing access to kdumpgui - Allow systemd_dbusd_t to status the init system - Allow vmnet-natd to request the kernel to load a module - Allow gsf-office-thum to append .cache/gdm/session.log - realmd wants to read .config/dconf/user - Firewalld wants sys_nice/setsched - Allow tmpreaper to delete mandb cache files - Firewalld wants sys_nice/setsched - Allow firewalld to perform a DNS name resolution - Allown winbind to read /usr/share/samba/codepages/lowcase.dat - Add support for HTTPProxy* in /etc/freshclam.conf - Fix authlogin_yubike boolean - Extend smbd_selinux man page to include samba booleans - Allow dhcpc to execute consoletype - Allow ping to use inherited tmp files created in init scripts - On full relabel with unconfined domain disabled, initrc was running some chcon's - Allow people who delete man pages to delete mandb cache files- Add missing permissive domains- Add new mandb policy - ALlow systemd-tmpfiles_t to relabel mandb_cache_t - Allow logrotate to start all unit files- Add fixes for ctbd - Allow nmbd to stream connect to ctbd - Make cglear_t as nsswitch_domain - Fix bogus in interfaces - Allow openshift to read/write postfix public pipe - Add postfix_manage_spool_maildrop_files() interface - stickshift paths have been renamed to openshift - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes - Update man pages, adding ENTRYPOINTS- Add mei_device_t - Make sure gpg content in homedir created with correct label - Allow dmesg to write to abrt cache files - automount wants to search virtual memory sysctls - Add support for hplip logs stored in /var/log/hp/tmp - Add labeling for /etc/owncloud/config.php - Allow setroubleshoot to send analysys to syslogd-journal - Allow virsh_t to interact with new fenced daemon - Allow gpg to write to /etc/mail/spamassassiin directories - Make dovecot_deliver_t a mail server delivery type - Add label for /var/tmp/DNS25- Fixes for tomcat_domain template interface- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes - Add attribute to all base os types. Allow all domains to read all ro base OS types- Additional unit files to be defined as power unit files - Fix more boolean names- Fix boolean name so subs will continue to work- dbus needs to start getty unit files - Add interface to allow system_dbusd_t to start the poweroff service - xdm wants to exec telepathy apps - Allow users to send messages to systemdlogind - Additional rules needed for systemd and other boot apps - systemd wants to list /home and /boot - Allow gkeyringd to write dbus/conf file - realmd needs to read /dev/urand - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded- Fixes to safe more rules - Re-write tomcat_domain_template() - Fix passenger labeling - Allow all domains to read man pages - Add ephemeral_port_t to the 'generic' port interfaces - Fix the names of postgresql booleans- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer - Move netlable_peer check out of booleans - Remove call to recvfrom_netlabel for kerberos call - Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules - Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface - Allow rndc to block suspend - tuned needs to modify the schedule of the kernel - Allow svirt_t domains to read alsa configuration files - ighten security on irc domains and make sure they label content in homedir correctly - Add filetrans_home_content for irc files - Dontaudit all getattr access for devices and filesystems for sandbox domains - Allow stapserver to search cgroups directories - Allow all postfix domains to talk to spamd- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check - Change pam_t to pam_timestamp_t - Add dovecot_domain attribute and allow this attribute block_suspend capability2 - Add sanlock_use_fusefs boolean - numad wants send/recieve msg - Allow rhnsd to send syslog msgs - Make piranha-pulse as initrc domain - Update openshift instances to dontaudit setattr until the kernel is fixed.- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd - Remove pam_selinux.8 which conflicts with man page owned by the pam package - Allow glance-api to talk to mysql - ABRT wants to read Xorg.0.log if if it detects problem with Xorg - Fix gstreamer filename trans. interface- Man page fixes by Dan Walsh- Allow postalias to read postfix config files - Allow man2html to read man pages - Allow rhev-agentd to search all mountpoints - Allow rhsmcertd to read /dev/random - Add tgtd_stream_connect() interface - Add cyrus_write_data() interface - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t - Add port definition for tcp/81 as http_port_t - Fix /dev/twa labeling - Allow systemd to read modules config- Merge openshift policy - Allow xauth to read /dev/urandom - systemd needs to relabel content in /run/systemd directories - Files unconfined should be able to perform all services on all files - Puppet tmp file can be leaked to all domains - Dontaudit rhsmcertd-worker to search /root/.local - Allow chown capability for zarafa domains - Allow system cronjobs to runcon into openshift domains - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories- nmbd wants to create /var/nmbd - Stop transitioning out of anaconda and firstboot, just causes AVC messages - Allow clamscan to read /etc files - Allow bcfg2 to bind cyphesis port - heartbeat should be run as rgmanager_t instead of corosync_t - Add labeling for /etc/openldap/certs - Add labeling for /opt/sartest directory - Make crontab_t as userdom home reader - Allow tmpreaper to list admin_home dir - Add defition for imap_0 replay cache file - Add support for gitolite3 - Allow virsh_t to send syslog messages - allow domains that can read samba content to be able to list the directories also - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd - Separate out sandbox from sandboxX policy so we can disable it by default - Run dmeventd as lvm_t - Mounting on any directory requires setattr and write permissions - Fix use_nfs_home_dirs() boolean - New labels for pam_krb5 - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0 - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs - Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles- Allow realmd to read resolv.conf - Add pegasus_cache_t type - Label /usr/sbin/fence_virtd as virsh_exec_t - Add policy for pkcsslotd - Add support for cpglockd - Allow polkit-agent-helper to read system-auth-ac - telepathy-idle wants to read gschemas.compiled - Allow plymouthd to getattr on fs_t - Add slpd policy - Allow ksysguardproces to read/write config_usr_t- Fix labeling substitution so rpm will label /lib/systemd content correctly- Add file name transitions for ttyACM0 - spice-vdagent(d)'s are going to log over to syslog - Add sensord policy - Add more fixes for passenger policy related to puppet - Allow wdmd to create wdmd_tmpfs_t - Fix labeling for /var/run/cachefilesd\.pid - Add thumb_tmpfs_t files type- Allow svirt domains to manage the network since this is containerized - Allow svirt_lxc_net_t to send audit messages- Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working - Allow dlm_controld to execute dlm_stonith labeled as bin_t - Allow GFS2 working on F17 - Abrt needs to execute dmesg - Allow jockey to list the contents of modeprobe.d - Add policy for lightsquid as squid_cron_t - Mailscanner is creating files and directories in /tmp - dmesg is now reading /dev/kmsg - Allow xserver to communicate with secure_firmware - Allow fsadm tools (fsck) to read /run/mount contnet - Allow sysadm types to read /dev/kmsg -- Allow postfix, sssd, rpcd to block_suspend - udev seems to need secure_firmware capability - Allow virtd to send dbus messages to firewalld so it can configure the firewall- Fix labeling of content in /run created by virsh_t - Allow condor domains to read kernel sysctls - Allow condor_master to connect to amqp - Allow thumb drives to create shared memory and semaphores - Allow abrt to read mozilla_plugin config files - Add labels for lightsquid - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow - dovecot_auth_t uses ldap for user auth - Allow domains that can read dhcp_etc_t to read lnk_files - Add more then one watchdog device - Allow useradd_t to manage etc_t files so it can rename it and edit them - Fix invalid class dir should be fifo_file - Move /run/blkid to fsadm and make sure labeling is correct- Fix bogus regex found by eparis - Fix manage run interface since lvm needs more access - syslogd is searching cgroups directory - Fixes to allow virt-sandbox-service to manage lxc var run content- Fix Boolean settings - Add new libjavascriptcoregtk as textrel_shlib_t - Allow xdm_t to create xdm_home_t directories - Additional access required for systemd - Dontaudit mozilla_plugin attempts to ipc_lock - Allow tmpreaper to delete unlabeled files - Eliminate screen_tmp_t and allow it to manage user_tmp_t - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors - Allow web plugins to connect to the asterisk ports - Condor will recreate the lock directory if it does not exist - Oddjob mkhomedir needs to connectto user processes - Make oddjob_mkhomedir_t a userdom home manager- Put placeholder back in place for proper numbering of capabilities - Systemd also configures init scripts- Fix ecryptfs interfaces - Bootloader seems to be trolling around /dev/shm and /dev - init wants to create /etc/systemd/system-update.target.wants - Fix systemd_filetrans call to move it out of tunable - Fix up policy to work with systemd userspace manager - Add secure_firmware capability and remove bogus epolwakeup - Call seutil_*_login_config interfaces where should be needed - Allow rhsmcertd to send signal to itself - Allow thin domains to send signal to itself - Allow Chrome_ChildIO to read dosfs_t- Add role rules for realmd, sambagui- Add new type selinux_login_config_t for /etc/selinux//logins/ - Additional fixes for seutil_manage_module_store() - dbus_system_domain() should be used with optional_policy - Fix svirt to be allowed to use fusefs file system - Allow login programs to read /run/ data created by systemd_login - sssd wants to write /etc/selinux//logins/ for SELinux PAM module - Fix svirt to be allowed to use fusefs file system - Allow piranha domain to use nsswitch - Sanlock needs to send Kill Signals to non root processes - Pulseaudio wants to execute /run/user/PID/.orc- Fix saslauthd when it tries to read /etc/shadow - Label gnome-boxes as a virt homedir - Need to allow svirt_t ability to getattr on nfs_t file systems - Update sanlock policy to solve all AVC's - Change confined users can optionally manage virt content - Handle new directories under ~/.cache - Add block suspend to appropriate domains - More rules required for containers - Allow login programs to read /run/ data created by systemd_logind - Allow staff users to run svirt_t processes- Update to upstream- More fixes for systemd to make rawhide booting from Dan Walsh- Add systemd fixes to make rawhide booting- Add systemd_logind_inhibit_var_run_t attribute - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type - Add interface for mysqld to dontaudit signull to all processes - Label new /var/run/journal directory correctly - Allow users to inhibit suspend via systemd - Add new type for the /var/run/inhibit directory - Add interface to send signull to systemd_login so avahi can send them - Allow systemd_passwd to send syslog messages - Remove corenet_all_recvfrom_unlabeled() calling fro policy files - Allow editparams.cgi running as httpd_bugzilla_script_t to read /etc/group - Allow smbd to read cluster config - Add additional labeling for passenger - Allow dbus to inhibit suspend via systemd - Allow avahi to send signull to systemd_login- Add interface to dontaudit getattr access on sysctls - Allow sshd to execute /bin/login - Looks like xdm is recreating the xdm directory in ~/.cache/ on login - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald - Fix semanage to work with unconfined domain disabled on F18 - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls - Virt seems to be using lock files - Dovecot seems to be searching directories of every mountpoint - Allow jockey to read random/urandom, execute shell and install third-party drivers - Add aditional params to allow cachedfiles to manage its content - gpg agent needs to read /dev/random - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write - Add a bunch of dontaudit rules to quiet svirt_lxc domains - Additional perms needed to run svirt_lxc domains - Allow cgclear to read cgconfig - Allow sys_ptrace capability for snmp - Allow freshclam to read /proc - Allow procmail to manage /home/user/Maildir content - Allow NM to execute wpa_cli - Allow amavis to read clamd system state - Regenerate man pages- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild- Add realmd and stapserver policies - Allow useradd to manage stap-server lib files - Tighten up capabilities for confined users - Label /etc/security/opasswd as shadow_t - Add label for /dev/ecryptfs - Allow condor_startd_t to start sshd with the ranged - Allow lpstat.cups to read fips_enabled file - Allow pyzor running as spamc_t to create /root/.pyzor directory - Add labelinf for amavisd-snmp init script - Add support for amavisd-snmp - Allow fprintd sigkill self - Allow xend (w/o libvirt) to start virtual machines - Allow aiccu to read /etc/passwd - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes - Add condor_startd_ranged_domtrans_to() interface - Add ssd_conf_t for /etc/sssd - accountsd needs to fchown some files/directories - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit - Allow xend_t to read the /etc/passwd file- Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t - Add init_access_check() interface - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t - Allow tcpdump to create a netlink_socket - Label newusers like useradd - Change xdm log files to be labeled xdm_log_t - Allow sshd_t with privsep to work in MLS - Allow freshclam to update databases thru HTTP proxy - Allow s-m-config to access check on systemd - Allow abrt to read public files by default - Fix amavis_create_pid_files() interface - Add labeling and filename transition for dbomatic.log - Allow system_dbusd_t to stream connect to bluetooth, and use its socket - Allow amavisd to execute fsav - Allow tuned to use sys_admin and sys_nice capabilities - Add php-fpm policy from Bryan - Add labeling for aeolus-configserver-thinwrapper - Allow thin domains to execute shell - Fix gnome_role_gkeyringd() interface description - Lot of interface fixes - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files - Allow OpenMPI job to use kerberos - Make deltacloudd_t as nsswitch_domain - Allow xend_t to run lsscsi - Allow qemu-dm running as xend_t to create tun_socket - Add labeling for /opt/brother/Printers(.*/)?inf - Allow jockey-backend to read pyconfig-64.h labeled as usr_t - Fix clamscan_can_scan_system boolean - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11- initrc is calling exportfs which is not confined so it attempts to read nfsd_files - Fixes for passenger running within openshift. - Add labeling for all tomcat6 dirs - Add support for tomcat6 - Allow cobblerd to read /etc/passwd - Allow jockey to read sysfs and and execute binaries with bin_t - Allow thum to use user terminals - Allow cgclear to read cgconfig config files - Fix bcf2g.fc - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains - Allow dbomatic to execute ruby - abrt_watch_log should be abrt_domain - Allow mozilla_plugin to connect to gatekeeper port- add ptrace_child access to process - remove files_read_etc_files() calling from all policies which have auth_use_nsswith() - Allow boinc domains to manage boinc_lib_t lnk_files - Add support for boinc-client.service unit file - Add support for boinc.log - Allow mozilla_plugin execmod on mozilla home files if allow_ex - Allow dovecot_deliver_t to read dovecot_var_run_t - Allow ldconfig and insmod to manage kdumpctl tmp files - Move thin policy out from cloudform.pp and add a new thin poli - pacemaker needs to communicate with corosync streams - abrt is now started on demand by dbus - Allow certmonger to talk directly to Dogtag servers - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c - Allow mozila_plugin to execute gstreamer home files - Allow useradd to delete all file types stored in the users hom - rhsmcertd reads the rpm database - Add support for lightdm- Add tomcat policy - Remove pyzor/razor policy - rhsmcertd reads the rpm database - Dontaudit thumb to setattr on xdm_tmp dir - Allow wicd to execute ldconfig in the networkmanager_t domain - Add /var/run/cherokee\.pid labeling - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too - Allow postfix-master to r/w pipes other postfix domains - Allow snort to create netlink_socket - Add kdumpctl policy - Allow firstboot to create tmp_t files/directories - /usr/bin/paster should not be labeled as piranha_exec_t - remove initrc_domain from tomcat - Allow ddclient to read /etc/passwd - Allow useradd to delete all file types stored in the users homedir - Allow ldconfig and insmod to manage kdumpctl tmp files - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those - Transition xauth files within firstboot_tmp_t - Fix labeling of /run/media to match /media - Label all lxdm.log as xserver_log_t - Add port definition for mxi port - Allow local_login_t to execute tmux- apcupsd needs to read /etc/passwd - Sanlock allso sends sigkill - Allow glance_registry to connect to the mysqld port - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl - Allow firefox plugins/flash to connect to port 1234 - Allow mozilla plugins to delete user_tmp_t files - Add transition name rule for printers.conf.O - Allow virt_lxc_t to read urand - Allow systemd_loigind to list gstreamer_home_dirs - Fix labeling for /usr/bin - Fixes for cloudform services * support FIPS - Allow polipo to work as web caching - Allow chfn to execute tmux- Add support for ecryptfs * ecryptfs does not support xattr * we need labeling for HOMEDIR - Add policy for (u)mount.ecryptfs* - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache - Allow dovecot to manage Maildir content, fix transitions to Maildir - Allow postfix_local to transition to dovecot_deliver - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code - Cleanup interface definitions - Allow apmd to change with the logind daemon - Changes required for sanlock in rhel6 - Label /run/user/apache as httpd_tmp_t - Allow thumb to use lib_t as execmod if boolean turned on - Allow squid to create the squid directory in /var with the correct labe - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com) - Allow virtd to exec xend_exec_t without transition - Allow virtd_lxc_t to unmount all file systems- PolicyKit path has changed - Allow httpd connect to dirsrv socket - Allow tuned to write generic kernel sysctls - Dontaudit logwatch to gettr on /dev/dm-2 - Allow policykit-auth to manage kerberos files - Make condor_startd and rgmanager as initrc domain - Allow virsh to read /etc/passwd - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs - xdm now needs to execute xsession_exec_t - Need labels for /var/lib/gdm - Fix files_filetrans_named_content() interface - Add new attribute - initrc_domain - Allow systemd_logind_t to signal, signull, sigkill all processes - Add filetrans rules for etc_runtime files- Rename boolean names to remove allow_- Mass merge with upstream * new policy topology to include contrib policy modules * we have now two base policy patches- Fix description of authlogin_nsswitch_use_ldap - Fix transition rule for rhsmcertd_t needed for RHEL7 - Allow useradd to list nfs state data - Allow openvpn to manage its log file and directory - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly - Allow thumb to use nvidia devices - Allow local_login to create user_tmp_t files for kerberos - Pulseaudio needs to read systemd_login /var/run content - virt should only transition named system_conf_t config files - Allow munin to execute its plugins - Allow nagios system plugin to read /etc/passwd - Allow plugin to connect to soundd port - Fix httpd_passwd to be able to ask passwords - Radius servers can use ldap for backing store - Seems to need to mount on /var/lib for xguest polyinstatiation to work. - Allow systemd_logind to list the contents of gnome keyring - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL - Add policy for isns-utils- Add policy for subversion daemon - Allow boinc to read passwd - Allow pads to read kernel network state - Fix man2html interface for sepolgen-ifgen - Remove extra /usr/lib/systemd/system/smb - Remove all /lib/systemd and replace with /usr/lib/systemd - Add policy for man2html - Fix the label of kerberos_home_t to krb5_home_t - Allow mozilla plugins to use Citrix - Allow tuned to read /proc/sys/kernel/nmi_watchdog - Allow tune /sys options via systemd's tmpfiles.d "w" type- Dontaudit lpr_t to read/write leaked mozilla tmp files - Add file name transition for .grl-podcasts directory - Allow corosync to read user tmp files - Allow fenced to create snmp lib dirs/files - More fixes for sge policy - Allow mozilla_plugin_t to execute any application - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain - Allow mongod to read system state information - Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t - Allow polipo to manage polipo_cache dirs - Add jabbar_client port to mozilla_plugin_t - Cleanup procmail policy - system bus will pass around open file descriptors on files that do not have labels on them - Allow l2tpd_t to read system state - Allow tuned to run ls /dev - Allow sudo domains to read usr_t files - Add label to machine-id - Fix corecmd_read_bin_symlinks cut and paste error- Fix pulseaudio port definition - Add labeling for condor_starter - Allow chfn_t to creat user_tmp_files - Allow chfn_t to execute bin_t - Allow prelink_cron_system_t to getpw calls - Allow sudo domains to manage kerberos rcache files - Allow user_mail_domains to work with courie - Port definitions necessary for running jboss apps within openshift - Add support for openstack-nova-metadata-api - Add support for nova-console* - Add support for openstack-nova-xvpvncproxy - Fixes to make privsep+SELinux working if we try to use chage to change passwd - Fix auth_role() interface - Allow numad to read sysfs - Allow matahari-rpcd to execute shell - Add label for ~/.spicec - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it - Devicekit_disk wants to read the logind sessions file when writing a cd - Add fixes for condor to make condor jobs working correctly - Change label of /var/log/rpmpkgs to cron_log_t - Access requires to allow systemd-tmpfiles --create to work. - Fix obex to be a user application started by the session bus. - Add additional filename trans rules for kerberos - Fix /var/run/heartbeat labeling - Allow apps that are managing rcache to file trans correctly - Allow openvpn to authenticate against ldap server - Containers need to listen to network starting and stopping events- Make systemd unit files less specific- Fix zarafa labeling - Allow guest_t to fix labeling - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean - add lxc_contexts - Allow accountsd to read /proc - Allow restorecond to getattr on all file sytems - tmpwatch now calls getpw - Allow apache daemon to transition to pwauth domain - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t - The obex socket seems to be a stream socket - dd label for /var/run/nologin- Allow jetty running as httpd_t to read hugetlbfs files - Allow sys_nice and setsched for rhsmcertd - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports - Allow setfiles to append to xdm_tmp_t - Add labeling for /export as a usr_t directory - Add labels for .grl files created by gstreamer- Add labeling for /usr/share/jetty/bin/jetty.sh - Add jetty policy which contains file type definitios - Allow jockey to use its own fifo_file and make this the default for all domains - Allow mozilla_plugins to use spice (vnc_port/couchdb) - asterisk wants to read the network state - Blueman now uses /var/lib/blueman- Add label for nodejs_debug - Allow mozilla_plugin_t to create ~/.pki directory and content- Add clamscan_can_scan_system boolean - Allow mysqld to read kernel network state - Allow sshd to read/write condor lib files - Allow sshd to read/write condor-startd tcp socket - Fix description on httpd_graceful_shutdown - Allow glance_registry to communicate with mysql - dbus_system_domain is using systemd to lauch applications - add interfaces to allow domains to send kill signals to user mail agents - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t - Lots of new access required for secure containers - Corosync needs sys_admin capability - ALlow colord to create shm - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific - Add boolean to control whether or not mozilla plugins can create random content in the users homedir - Add new interface to allow domains to list msyql_db directories, needed for libra - shutdown has to be allowed to delete etc_runtime_t - Fail2ban needs to read /etc/passwd - Allow ldconfig to create /var/cache/ldconfig - Allow tgtd to read hardware state information - Allow collectd to create packet socket - Allow chronyd to send signal to itself - Allow collectd to read /dev/random - Allow collectd to send signal to itself - firewalld needs to execute restorecon - Allow restorecon and other login domains to execute restorecon- Allow logrotate to getattr on systemd unit files - Add support for tor systemd unit file - Allow apmd to create /var/run/pm-utils with the correct label - Allow l2tpd to send sigkill to pppd - Allow pppd to stream connect to l2tpd - Add label for scripts in /etc/gdm/ - Allow systemd_logind_t to ignore mcs constraints on sigkill - Fix files_filetrans_system_conf_named_files() interface - Add labels for /usr/share/wordpress/wp-includes/*.php - Allow cobbler to get SELinux mode and booleans- Add unconfined_execmem_exec_t as an alias to bin_t - Allow fenced to read snmp var lib files, also allow it to read usr_t - ontaudit access checks on all executables from mozilla_plugin - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode - Allow systemd_tmpfiles_t to getattr all pipes and sockets - Allow glance-registry to send system log messages - semanage needs to manage mock lib files/dirs- Add policy for abrt-watch-log - Add definitions for jboss_messaging ports - Allow systemd_tmpfiles to manage printer devices - Allow oddjob to use nsswitch - Fix labeling of log files for postgresql - Allow mozilla_plugin_t to execmem and execstack by default - Allow firewalld to execute shell - Fix /etc/wicd content files to get created with the correct label - Allow mcelog to exec shell - Add ~/.orc as a gstreamer_home_t - /var/spool/postfix/lib64 should be labeled lib_t - mpreaper should be able to list all file system labeled directories - Add support for apache to use openstack - Add labeling for /etc/zipl.conf and zipl binary - Turn on allow_execstack and turn off telepathy transition for final release- More access required for virt_qmf_t - Additional assess required for systemd-logind to support multi-seat - Allow mozilla_plugin to setrlimit - Revert changes to fuse file system to stop deadlock- Allow condor domains to connect to ephemeral ports - More fixes for condor policy - Allow keystone to stream connect to mysqld - Allow mozilla_plugin_t to read generic USB device to support GPS devices - Allow thum to file name transition gstreamer home content - Allow thum to read all non security files - Allow glance_api_t to connect to ephemeral ports - Allow nagios plugins to read /dev/urandom - Allow syslogd to search postfix spool to support postfix chroot env - Fix labeling for /var/spool/postfix/dev - Allow wdmd chown - Label .esd_auth as pulseaudio_home_t - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now- Add support for clamd+systemd - Allow fresclam to execute systemctl to handle clamd - Change labeling for /usr/sbin/rpc.ypasswd.env - Allow yppaswd_t to execute yppaswd_exec_t - Allow yppaswd_t to read /etc/passwd - Gnomekeyring socket has been moved to /run/user/USER/ - Allow samba-net to connect to ldap port - Allow signal for vhostmd - allow mozilla_plugin_t to read user_home_t socket - New access required for secure Linux Containers - zfs now supports xattrs - Allow quantum to execute sudo and list sysfs - Allow init to dbus chat with the firewalld - Allow zebra to read /etc/passwd- Allow svirt_t to create content in the users homedir under ~/.libvirt - Fix label on /var/lib/heartbeat - Allow systemd_logind_t to send kill signals to all processes started by a user - Fuse now supports Xattr Support- upowered needs to setsched on the kernel - Allow mpd_t to manage log files - Allow xdm_t to create /var/run/systemd/multi-session-x - Add rules for missedfont.log to be used by thumb.fc - Additional access required for virt_qmf_t - Allow dhclient to dbus chat with the firewalld - Add label for lvmetad - Allow systemd_logind_t to remove userdomain sock_files - Allow cups to execute usr_t files - Fix labeling on nvidia shared libraries - wdmd_t needs access to sssd and /etc/passwd - Add boolean to allow ftp servers to run in passive mode - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with - Fix using httpd_use_fusefs - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox- Rename rdate port to time port, and allow gnomeclock to connect to it - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda - /etc/auto.* should be labeled bin_t - Add httpd_use_fusefs boolean - Add fixes for heartbeat - Allow sshd_t to signal processes that it transitions to - Add condor policy - Allow svirt to create monitors in ~/.libvirt - Allow dovecot to domtrans sendmail to handle sieve scripts - Lot of fixes for cfengine- /var/run/postmaster.* labeling is no longer needed - Alllow drbdadmin to read /dev/urandom - l2tpd_t seems to use ptmx - group+ and passwd+ should be labeled as /etc/passwd - Zarafa-indexer is a socket- Ensure lastlog is labeled correctly - Allow accountsd to read /proc data about gdm - Add fixes for tuned - Add bcfg2 fixes which were discovered during RHEL6 testing - More fixes for gnome-keyring socket being moved - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown - Fix description for files_dontaudit_read_security_files() interface- Add new policy and man page for bcfg2 - cgconfig needs to use getpw calls - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt - gnome-keyring wants to create a directory in cache_home_t - sanlock calls getpw- Add numad policy and numad man page - Add fixes for interface bugs discovered by SEWatch - Add /tmp support for squid - Add fix for #799102 * change default labeling for /var/run/slapd.* sockets - Make thumb_t as userdom_home_reader - label /var/lib/sss/mc same as pubconf, so getpw domains can read it - Allow smbspool running as cups_t to stream connect to nmbd - accounts needs to be able to execute passwd on behalf of users - Allow systemd_tmpfiles_t to delete boot flags - Allow dnssec_trigger to connect to apache ports - Allow gnome keyring to create sock_files in ~/.cache - google_authenticator is using .google_authenticator - sandbox running from within firefox is exposing more leaks - Dontaudit thumb to read/write /dev/card0 - Dontaudit getattr on init_exec_t for gnomeclock_t - Allow certmonger to do a transition to certmonger_unconfined_t - Allow dhcpc setsched which is caused by nmcli - Add rpm_exec_t for /usr/sbin/bcfg2 - system cronjobs are sending dbus messages to systemd_logind - Thumnailers read /dev/urand- Allow auditctl getcap - Allow vdagent to use libsystemd-login - Allow abrt-dump-oops to search /etc/abrt - Got these avc's while trying to print a boarding pass from firefox - Devicekit is now putting the media directory under /run/media - Allow thumbnailers to create content in ~/.thumbails directory - Add support for proL2TPd by Dominick Grift - Allow all domains to call getcap - wdmd seems to get a random chown capability check that it does not need - Allow vhostmd to read kernel sysctls- Allow chronyd to read unix - Allow hpfax to read /etc/passwd - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them - Allow rpcd to read quota_db_t - Update to man pages to match latest policy - Fix bug in jockey interface for sepolgen-ifgen - Add initial svirt_prot_exec_t policy- More fixes for systemd from Dan Walsh- Add a new type for /etc/firewalld and allow firewalld to write to this directory - Add definition for ~/Maildir, and allow mail deliver domains to write there - Allow polipo to run from a cron job - Allow rtkit to schedule wine processes - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label - Allow users domains to send signals to consolehelper domains- More fixes for boinc policy - Allow polipo domain to create its own cache dir and pid file - Add systemctl support to httpd domain - Add systemctl support to polipo, allow NetworkManager to manage the service - Add policy for jockey-backend - Add support for motion daemon which is now covered by zoneminder policy - Allow colord to read/write motion tmpfs - Allow vnstat to search through var_lib_t directories - Stop transitioning to quota_t, from init an sysadm_t- Add svirt_lxc_file_t as a customizable type- Add additional fixes for icmp nagios plugin - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin - Add certmonger_unconfined_exec_t - Make sure tap22 device is created with the correct label - Allow staff users to read systemd unit files - Merge in previously built policy - Arpwatch needs to be able to start netlink sockets in order to start - Allow cgred_t to sys_ptrace to look at other DAC Processes- Back port some of the access that was allowed in nsplugin_t - Add definitiona for couchdb ports - Allow nagios to use inherited users ttys - Add git support for mock - Allow inetd to use rdate port - Add own type for rdate port - Allow samba to act as a portmapper - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev - New fixes needed for samba4 - Allow apps that use lib_t to read lib_t symlinks- Add policy for nove-cert - Add labeling for nova-openstack systemd unit files - Add policy for keystoke- Fix man pages fro domains - Add man pages for SELinux users and roles - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon - Add policy for matahari-rpcd - nfsd executes mount command on restart - Matahari domains execute renice and setsched - Dontaudit leaked tty in mozilla_plugin_config - mailman is changing to a per instance naming - Add 7600 and 4447 as jboss_management ports - Add fixes for nagios event handlers - Label httpd.event as httpd_exec_t, it is an apache daemon- Add labeling for /var/spool/postfix/dev/log - NM reads sysctl.conf - Iscsi log file context specification fix - Allow mozilla plugins to send dbus messages to user domains that transition to it - Allow mysql to read the passwd file - Allow mozilla_plugin_t to create mozilla home dirs in user homedir - Allow deltacloud to read kernel sysctl - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself - Allow postgresql_t to connectto itself - Add login_userdomain attribute for users which can log in using terminal- Allow sysadm_u to reach system_r by default #784011 - Allow nagios plugins to use inherited user terminals - Razor labeling is not used no longer - Add systemd support for matahari - Add port_types to man page, move booleans to the top, fix some english - Add support for matahari-sysconfig-console - Clean up matahari.fc - Fix matahari_admin() interfac - Add labels for/etc/ssh/ssh_host_*.pub keys- Allow ksysguardproces to send system log msgs - Allow boinc setpgid and signull - Allow xdm_t to sys_ptrace to run pidof command - Allow smtpd_t to manage spool files/directories and symbolic links - Add labeling for jetty - Needed changes to get unbound/dnssec to work with openswan- Add user_fonts_t alias xfs_tmp_t - Since depmod now runs as insmod_t we need to write to kernel_object_t - Allow firewalld to dbus chat with networkmanager - Allow qpidd to connect to matahari ports - policykit needs to read /proc for uses not owned by it - Allow systemctl apps to connecto the init stream- Turn on deny_ptrace boolean- Remove pam_selinux.8 man page. There was a conflict.- Add proxy class and read access for gssd_proxy - Separate out the sharing public content booleans - Allow certmonger to execute a script and send signals to apache and dirsrv to reload the certificate - Add label transition for gstream-0.10 and 12 - Add booleans to allow rsync to share nfs and cifs file sytems - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it - Fix filename transitions for cups files - Allow denyhosts to read "unix" - Add file name transition for locale.conf.new - Allow boinc projects to gconf config files - sssd needs to be able to increase the socket limit under certain loads - sge_execd needs to read /etc/passwd - Allow denyhost to check network state - NetworkManager needs to read sessions data - Allow denyhost to check network state - Allow xen to search virt images directories - Add label for /dev/megaraid_sas_ioctl_node - Add autogenerated man pages- Allow boinc project to getattr on fs - Allow init to execute initrc_state_t - rhev-agent package was rename to ovirt-guest-agent - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly - sytemd writes content to /run/initramfs and executes it on shutdown - kdump_t needs to read /etc/mtab, should be back ported to F16 - udev needs to load kernel modules in early system boot- Need to add sys_ptrace back in since reading any content in /proc can cause these accesses - Add additional systemd interfaces which are needed fro *_admin interfaces - Fix bind_admin() interface- Allow firewalld to read urand - Alias java, execmem_mono to bin_t to allow third parties - Add label for kmod - /etc/redhat-lsb contains binaries - Add boolean to allow gitosis to send mail - Add filename transition also for "event20" - Allow systemd_tmpfiles_t to delete all file types - Allow collectd to ipc_lock- make consoletype_exec optional, so we can remove consoletype policy - remove unconfined_permisive.patch - Allow openvpn_t to inherit user home content and tmp content - Fix dnssec-trigger labeling - Turn on obex policy for staff_t - Pem files should not be secret - Add lots of rules to fix AVC's when playing with containers - Fix policy for dnssec - Label ask-passwd directories correctly for systemd- sshd fixes seem to be causing unconfined domains to dyntrans to themselves - fuse file system is now being mounted in /run/user - systemd_logind is sending signals to processes that are dbus messaging with it - Add support for winshadow port and allow iscsid to connect to this port - httpd should be allowed to bind to the http_port_t udp socket - zarafa_var_lib_t can be a lnk_file - A couple of new .xsession-errors files - Seems like user space and login programs need to read logind_sessions_files - Devicekit disk seems to be being launched by systemd - Cleanup handling of setfiles so most of rules in te file - Correct port number for dnssec - logcheck has the home dir set to its cache- Add policy for grindengine MPI jobs- Add new sysadm_secadm.pp module * contains secadm definition for sysadm_t - Move user_mail_domain access out of the interface into the te file - Allow httpd_t to create httpd_var_lib_t directories as well as files - Allow snmpd to connect to the ricci_modcluster stream - Allow firewalld to read /etc/passwd - Add auth_use_nsswitch for colord - Allow smartd to read network state - smartdnotify needs to read /etc/group- Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory - lxdm startup scripts should be labeled bin_t, so confined users will work - mcstransd now creates a pid, needs back port to F16 - qpidd should be allowed to connect to the amqp port - Label devices 010-029 as usb devices - ypserv packager says ypserv does not use tmp_t so removing selinux policy types - Remove all ptrace commands that I believe are caused by the kernel/ps avcs - Add initial Obex policy - Add logging_syslogd_use_tty boolean - Add polipo_connect_all_unreserved bolean - Allow zabbix to connect to ftp port - Allow systemd-logind to be able to switch VTs - Allow apache to communicate with memcached through a sock_file- Fix file_context.subs_dist for now to work with pre usrmove- More /usr move fixes- Add zabbix_can_network boolean - Add httpd_can_connect_zabbix boolean - Prepare file context labeling for usrmove functions - Allow system cronjobs to read kernel network state - Add support for selinux_avcstat munin plugin - Treat hearbeat with corosync policy - Allow corosync to read and write to qpidd shared mem - mozilla_plugin is trying to run pulseaudio - Fixes for new sshd patch for running priv sep domains as the users context - Turn off dontaudit rules when turning on allow_ypbind - udev now reads /etc/modules.d directory- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out - Cups exchanges dbus messages with init - udisk2 needs to send syslog messages - certwatch needs to read /etc/passwd- Add labeling for udisks2 - Allow fsadmin to communicate with the systemd process- Treat Bip with bitlbee policy * Bip is an IRC proxy - Add port definition for interwise port - Add support for ipa_memcached socket - systemd_jounald needs to getattr on all processes - mdadmin fixes * uses getpw - amavisd calls getpwnam() - denyhosts calls getpwall()- Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there - bluetooth says they do not use /tmp and want to remove the type - Allow init to transition to colord - Mongod needs to read /proc/sys/vm/zone_reclaim_mode - Allow postfix_smtpd_t to connect to spamd - Add boolean to allow ftp to connect to all ports > 1023 - Allow sendmain to write to inherited dovecot tmp files - setroubleshoot needs to be able to execute rpm to see what version of packages- Merge systemd patch - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online - Allow deltacloudd dac_override, setuid, setgid caps - Allow aisexec to execute shell - Add use_nfs_home_dirs boolean for ssh-keygen- Fixes to make rawhide boot in enforcing mode with latest systemd changes- Add labeling for /var/run/systemd/journal/syslog - libvirt sends signals to ifconfig - Allow domains that read logind session files to list them- Fixed destined form libvirt-sandbox - Allow apps that list sysfs to also read sympolicy links in this filesystem - Add ubac_constrained rules for chrome_sandbox - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra - Allow postgresql to be executed by the caller - Standardize interfaces of daemons - Add new labeling for mm-handler - Allow all matahari domains to read network state and etc_runtime_t files- New fix for seunshare, requires seunshare_domains to be able to mounton / - Allow systemctl running as logrotate_t to connect to private systemd socket - Allow tmpwatch to read meminfo - Allow rpc.svcgssd to read supported_krb5_enctype - Allow zarafa domains to read /dev/random and /dev/urandom - Allow snmpd to read dev_snmp6 - Allow procmail to talk with cyrus - Add fixes for check_disk and check_nagios plugins- default trans rules for Rawhide policy - Make sure sound_devices controlC* are labeled correctly on creation - sssd now needs sys_admin - Allow snmp to read all proc_type - Allow to setup users homedir with quota.group- Add httpd_can_connect_ldap() interface - apcupsd_t needs to use seriel ports connected to usb devices - Kde puts procmail mail directory under ~/.local/share - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now - Add labeling for /sbin/iscsiuio- Add label for /var/lib/iscan/interpreter - Dont audit writes to leaked file descriptors or redirected output for nacl - NetworkManager needs to write to /sys/class/net/ib*/mode- Allow abrt to request the kernel to load a module - Make sure mozilla content is labeled correctly - Allow tgtd to read system state - More fixes for boinc * allow to resolve dns name * re-write boinc policy to use boinc_domain attribute - Allow munin services plugins to use NSCD services- Allow mozilla_plugin_t to manage mozilla_home_t - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain - Add label for tumblerd- Fixes for xguest package- Fixes related to /bin, /sbin - Allow abrt to getattr on blk files - Add type for rhev-agent log file - Fix labeling for /dev/dmfm - Dontaudit wicd leaking - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it - Label /etc/locale.conf correctly - Allow user_mail_t to read /dev/random - Allow postfix-smtpd to read MIMEDefang - Add label for /var/log/suphp.log - Allow swat_t to connect and read/write nmbd_t sock_file - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf - Allow systemd-tmpfiles to change user identity in object contexts - More fixes for rhev_agentd_t consolehelper policy- Use fs_use_xattr for squashf - Fix procs_type interface - Dovecot has a new fifo_file /var/run/dovecot/stats-mail - Dovecot has a new fifo_file /var/run/stats-mail - Colord does not need to connect to network - Allow system_cronjob to dbus chat with NetworkManager - Puppet manages content, want to make sure it labels everything correctly- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it - Allow all postfix domains to use the fifo_file - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t - Allow apmd_t to read grub.cfg - Let firewallgui read the selinux config - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp - Fix devicekit_manage_pid_files() interface - Allow squid to check the network state - Dontaudit colord getattr on file systems - Allow ping domains to read zabbix_tmp_t files- Allow mcelog_t to create dir and file in /var/run and label it correctly - Allow dbus to manage fusefs - Mount needs to read process state when mounting gluster file systems - Allow collectd-web to read collectd lib files - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr - Allow colord to get the attributes of tmpfs filesystem - Add sanlock_use_nfs and sanlock_use_samba booleans - Add bin_t label for /usr/lib/virtualbox/VBoxManage- Add ssh_dontaudit_search_home_dir - Changes to allow namespace_init_t to work - Add interface to allow exec of mongod, add port definition for mongod port, 27017 - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t - Allow spamd and clamd to steam connect to each other - Add policy label for passwd.OLD - More fixes for postfix and postfix maildro - Add ftp support for mozilla plugins - Useradd now needs to manage policy since it calls libsemanage - Fix devicekit_manage_log_files() interface - Allow colord to execute ifconfig - Allow accountsd to read /sys - Allow mysqld-safe to execute shell - Allow openct to stream connect to pcscd - Add label for /var/run/nm-dns-dnsmasq\.conf - Allow networkmanager to chat with virtd_t- Pulseaudio changes - Merge patches- Merge patches back into git repository.- Remove allow_execmem boolean and replace with deny_execmem boolean- Turn back on allow_execmem boolean- Add more MCS fixes to make sandbox working - Make faillog MLS trusted to make sudo_$1_t working - Allow sandbox_web_client_t to read passwd_file_t - Add .mailrc file context - Remove execheap from openoffice domain - Allow chrome_sandbox_nacl_t to read cpu_info - Allow virtd to relabel generic usb which is need if USB device - Fixes for virt.if interfaces to consider chr_file as image file type- Remove Open Office policy - Remove execmem policy- MCS fixes - quota fixes- Remove transitions to consoletype- Make nvidia* to be labeled correctly - Fix abrt_manage_cache() interface - Make filetrans rules optional so base policy will build - Dontaudit chkpwd_t access to inherited TTYS - Make sure postfix content gets created with the correct label - Allow gnomeclock to read cgroup - Fixes for cloudform policy- Check in fixed for Chrome nacl support- Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_overide to communicate with users TTY's - Allow svirt_lxc domains to send kill signals within their container- Remove qemu.pp again without causing a crash- Remove qemu.pp, everything should use svirt_t or stay in its current domain- Allow policykit to talk to the systemd via dbus - Move chrome_sandbox_nacl_t to permissive domains - Additional rules for chrome_sandbox_nacl- Change bootstrap name to nacl - Chrome still needs execmem - Missing role for chrome_sandbox_bootstrap - Add boolean to remove execmem and execstack from virtual machines - Dontaudit xdm_t doing an access_check on etc_t directories- Allow named to connect to dirsrv by default - add ldapmap1_0 as a krb5_host_rcache_t file - Google chrome developers asked me to add bootstrap policy for nacl stuff - Allow rhev_agentd_t to getattr on mountpoints - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets- Fixes for cloudform policies which need to connect to random ports - Make sure if an admin creates modules content it creates them with the correct label - Add port 8953 as a dns port used by unbound - Fix file name transition for alsa and confined users- Turn on mock_t and thumb_t for unconfined domains- Policy update should not modify local contexts- Remove ada policy- Remove tzdata policy - Add labeling for udev - Add cloudform policy - Fixes for bootloader policy- Add policies for nova openstack- Add fixes for nova-stack policy- Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain - Allow init process to setrlimit on itself - Take away transition rules for users executing ssh-keygen - Allow setroubleshoot_fixit_t to read /dev/urand - Allow sshd to relbale tunnel sockets - Allow fail2ban domtrans to shorewall in the same way as with iptables - Add support for lnk files in the /var/lib/sssd directory - Allow system mail to connect to courier-authdaemon over an unix stream socket- Add passwd_file_t for /etc/ptmptmp- Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK) - Make corosync to be able to relabelto cluster lib fies - Allow samba domains to search /var/run/nmbd - Allow dirsrv to use pam - Allow thumb to call getuid - chrome less likely to get mmap_zero bug so removing dontaudit - gimp help-browser has built in javascript - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t - Re-write glance policy- Move dontaudit sys_ptrace line from permissive.te to domain.te - Remove policy for hal, it no longer exists- Don't check md5 size or mtime on certain config files- Remove allow_ptrace and replace it with deny_ptrace, which will remove all ptrace from the system - Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;- Fixes for bootloader policy - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore - Allow nsplugin to read /usr/share/config - Allow sa-update to update rules - Add use_fusefs_home_dirs for chroot ssh option - Fixes for grub2 - Update systemd_exec_systemctl() interface - Allow gpg to read the mail spool - More fixes for sa-update running out of cron job - Allow ipsec_mgmt_t to read hardware state information - Allow pptp_t to connect to unreserved_port_t - Dontaudit getattr on initctl in /dev from chfn - Dontaudit getattr on kernel_core from chfn - Add systemd_list_unit_dirs to systemd_exec_systemctl call - Fixes for collectd policy - CHange sysadm_t to create content as user_tmp_t under /tmp- Shrink size of policy through use of attributes for userdomain and apache- Allow virsh to read xenstored pid file - Backport corenetwork fixes from upstream - Do not audit attempts by thumb to search config_home_t dirs (~/.config) - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t - allow thumb to read generic data home files (mime.type)- Allow nmbd to manage sock file in /var/run/nmbd - ricci_modservice send syslog msgs - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly - Allow systemd_logind_t to manage /run/USER/dconf/user- Fix missing patch from F16- Allow logrotate setuid and setgid since logrotate is supposed to do it - Fixes for thumb policy by grift - Add new nfsd ports - Added fix to allow confined apps to execmod on chrome - Add labeling for additional vdsm directories - Allow Exim and Dovecot SASL - Add label for /var/run/nmbd - Add fixes to make virsh and xen working together - Colord executes ls - /var/spool/cron is now labeled as user_cron_spool_t- Stop complaining about leaked file descriptors during install- Remove java and mono module and merge into execmem- Fixes for thumb policy and passwd_file_t- Fixes caused by the labeling of /etc/passwd - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide- Add support for Clustered Samba commands - Allow ricci_modrpm_t to send log msgs - move permissive virt_qmf_t from virt.te to permissivedomains.te - Allow ssh_t to use kernel keyrings - Add policy for libvirt-qmf and more fixes for linux containers - Initial Polipo - Sanlock needs to run ranged in order to kill svirt processes - Allow smbcontrol to stream connect to ctdbd- Add label for /etc/passwd- Change unconfined_domains to permissive for Rawhide - Add definition for the ephemeral_ports- Make mta_role() active - Allow asterisk to connect to jabber client port - Allow procmail to read utmp - Add NIS support for systemd_logind_t - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t - Fix systemd_manage_unit_dirs() interface - Allow ssh_t to manage directories passed into it - init needs to be able to create and delete unit file directories - Fix typo in apache_exec_sys_script - Add ability for logrotate to transition to awstat domain- Change screen to use screen_domain attribute and allow screen_domains to read all process domain state - Add SELinux support for ssh pre-auth net process in F17 - Add logging_syslogd_can_sendmail boolean- Add definition for ephemeral ports - Define user_tty_device_t as a customizable_type- Needs to require a new version of checkpolicy - Interface fixes- Allow sanlock to manage virt lib files - Add virt_use_sanlock booelan - ksmtuned is trying to resolve uids - Make sure .gvfs is labeled user_home_t in the users home directory - Sanlock sends kill signals and needs the kill capability - Allow mockbuild to work on nfs homedirs - Fix kerberos_manage_host_rcache() interface - Allow exim to read system state- Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t- Allow collectd to read hardware state information - Add loop_control_device_t - Allow mdadm to request kernel to load module - Allow domains that start other domains via systemctl to search unit dir - systemd_tmpfilses, needs to list any file systems mounted on /tmp - No one can explain why radius is listing the contents of /tmp, so we will dontaudit - If I can manage etc_runtime files, I should be able to read the links - Dontaudit hostname writing to mock library chr_files - Have gdm_t setup labeling correctly in users home dir - Label content unde /var/run/user/NAME/dconf as config_home_t - Allow sa-update to execute shell - Make ssh-keygen working with fips_enabled - Make mock work for staff_t user - Tighten security on mock_t- removing unconfined_notrans_t no longer necessary - Clean up handling of secure_mode_insmod and secure_mode_policyload - Remove unconfined_mount_t- Add exim_exec_t label for /usr/sbin/exim_tidydb - Call init_dontaudit_rw_stream_socket() interface in mta policy - sssd need to search /var/cache/krb5rcache directory - Allow corosync to relabel own tmp files - Allow zarafa domains to send system log messages - Allow ssh to do tunneling - Allow initrc scripts to sendto init_t unix_stream_socket - Changes to make sure dmsmasq and virt directories are labeled correctly - Changes needed to allow sysadm_t to manage systemd unit files - init is passing file descriptors to dbus and on to system daemons - Allow sulogin additional access Reported by dgrift and Jeremy Miller - Steve Grubb believes that wireshark does not need this access - Fix /var/run/initramfs to stop restorecon from looking at - pki needs another port - Add more labels for cluster scripts - Allow apps that manage cgroup_files to manage cgroup link files - Fix label on nfs-utils scripts directories - Allow gatherd to read /dev/rand and /dev/urand- pki needs another port - Add more labels for cluster scripts - Fix label on nfs-utils scripts directories - Fixes for cluster - Allow gatherd to read /dev/rand and /dev/urand - abrt leaks fifo files- Add glance policy - Allow mdadm setsched - /var/run/initramfs should not be relabeled with a restorecon run - memcache can be setup to override sys_resource - Allow httpd_t to read tetex data - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.- Allow Postfix to deliver to Dovecot LMTP socket - Ignore bogus sys_module for lldpad - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock - systemd_logind_t sets the attributes on usb devices - Allow hddtemp_t to read etc_t files - Add permissivedomains module - Move all permissive domains calls to permissivedomain.te - Allow pegasis to send kill signals to other UIDs- Allow insmod_t to use fds leaked from devicekit - dontaudit getattr between insmod_t and init_t unix_stream_sockets - Change sysctl unit file interfaces to use systemctl - Add support for chronyd unit file - Allow mozilla_plugin to read gnome_usr_config - Add policy for new gpsd - Allow cups to create kerberos rhost cache files - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly- Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten- Add policy for sa-update being run out of cron jobs - Add create perms to postgresql_manage_db - ntpd using a gps has to be able to read/write generic tty_device_t - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev - fix spec file - Remove qemu_domtrans_unconfined() interface - Make passenger working together with puppet - Add init_dontaudit_rw_stream_socket interface - Fixes for wordpress- Turn on allow_domain_fd_use boolean on F16 - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Add abrt_handle_event_t domain for ABRT event scripts - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change - Allow httpd_git_script_t to read passwd data - Allow openvpn to set its process priority when the nice parameter is used- livecd fixes - spec file fixes- fetchmail can use kerberos - ksmtuned reads in shell programs - gnome_systemctl_t reads the process state of ntp - dnsmasq_t asks the kernel to load multiple kernel modules - Add rules for domains executing systemctl - Bogus text within fc file- Add cfengine policy- Add abrt_domain attribute - Allow corosync to manage cluster lib files - Allow corosync to connect to the system DBUS- Add sblim, uuidd policies - Allow kernel_t dyntrasition to init_t- init_t need setexec - More fixes of rules which cause an explosion in rules by Dan Walsh- Allow rcsmcertd to perform DNS name resolution - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts - Allow tmux to run as screen - New policy for collectd - Allow gkeyring_t to interact with all user apps - Add rules to allow firstboot to run on machines with the unconfined.pp module removed- Allow systemd_logind to send dbus messages with users - allow accountsd to read wtmp file - Allow dhcpd to get and set capabilities- Fix oracledb_port definition - Allow mount to mounton the selinux file system - Allow users to list /var directories- systemd fixes- Add initial policy for abrt_dump_oops_t - xtables-multi wants to getattr of the proc fs - Smoltclient is connecting to abrt - Dontaudit leaked file descriptors to postdrop - Allow abrt_dump_oops to look at kernel sysctls - Abrt_dump_oops_t reads kernel ring buffer - Allow mysqld to request the kernel to load modules - systemd-login needs fowner - Allow postfix_cleanup_t to searh maildrop- Initial systemd_logind policy - Add policy for systemd_logger and additional proivs for systemd_logind - More fixes for systemd policies- Allow setsched for virsh - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories - iptables: the various /sbin/ip6?tables.* are now symlinks for /sbin/xtables-multi- A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit - Allow colord to interact with the users through the tmpfs file system - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files - Add label for /var/log/mcelog - Allow asterisk to read /dev/random if it uses TLS - Allow colord to read ini files which are labeled as bin_t - Allow dirsrvadmin sys_resource and setrlimit to use ulimit - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first. - Also lists /var and /var/spool directories - Add openl2tpd to l2tpd policy - qpidd is reading the sysfs file- Change usbmuxd_t to dontaudit attempts to read chr_file - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains - Allow pppd to search /var/lock dir - Add rhsmcertd policy- Update to upstream- More fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git- Fix spec file to not report Verify errors- Add dspam policy - Add lldpad policy - dovecot auth wants to search statfs #713555 - Allow systemd passwd apps to read init fifo_file - Allow prelink to use inherited terminals - Run cherokee in the httpd_t domain - Allow mcs constraints on node connections - Implement pyicqt policy - Fixes for zarafa policy - Allow cobblerd to send syslog messages- Add policy.26 to the payload - Remove olpc stuff - Remove policygentool- Fixes for zabbix - init script needs to be able to manage sanlock_var_run_... - Allow sandlock and wdmd to create /var/run directories... - mixclip.so has been compiled correctly - Fix passenger policy module name- Add mailscanner policy from dgrift - Allow chrome to optionally be transitioned to - Zabbix needs these rules when starting the zabbix_server_mysql - Implement a type for freedesktop openicc standard (~/.local/share/icc) - Allow system_dbusd_t to read inherited icc_data_home_t files. - Allow colord_t to read icc_data_home_t content. #706975 - Label stuff under /usr/lib/debug as if it was labeled under /- Fixes for sanlock policy - Fixes for colord policy - Other fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Add rhev policy module to modules-targeted.conf- Lot of fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Allow logrotate to execute systemctl - Allow nsplugin_t to getattr on gpmctl - Fix dev_getattr_all_chr_files() interface - Allow shorewall to use inherited terms - Allow userhelper to getattr all chr_file devices - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t - Fix labeling for ABRT Retrace Server- Dontaudit sys_module for ifconfig - Make telepathy and gkeyringd daemon working with confined users - colord wants to read files in users homedir - Remote login should be creating user_tmp_t not its own tmp files- Fix label for /usr/share/munin/plugins/munin_* plugins - Add support for zarafa-indexer - Fix boolean description - Allow colord to getattr on /proc/scsi/scsi - Add label for /lib/upstart/init - Colord needs to list /mnt- Forard port changes from F15 for telepathy - NetworkManager should be allowed to use /dev/rfkill - Fix dontaudit messages to say Domain to not audit - Allow telepathy domains to read/write gnome_cache files - Allow telepathy domains to call getpw - Fixes for colord and vnstatd policy- Allow init_t getcap and setcap - Allow namespace_init_t to use nsswitch - aisexec will execute corosync - colord tries to read files off noxattr file systems - Allow init_t getcap and setcap- Add support for ABRT retrace server - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners - Allow telepath_msn_t to read /proc/PARENT/cmdline - ftpd needs kill capability - Allow telepath_msn_t to connect to sip port - keyring daemon does not work on nfs homedirs - Allow $1_sudo_t to read default SELinux context - Add label for tgtd sock file in /var/run/ - Add apache_exec_rotatelogs interface - allow all zaraha domains to signal themselves, server writes to /tmp - Allow syslog to read the process state - Add label for /usr/lib/chromium-browser/chrome - Remove the telepathy transition from unconfined_t - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts - Allow initrc_t domain to manage abrt pid files - Add support for AEOLUS project - Virt_admin should be allowed to manage images and processes - Allow plymountd to send signals to init - Change labeling of fping6- Add filename transitions- Fixes for zarafa policy - Add support for AEOLUS project - Change labeling of fping6 - Allow plymountd to send signals to init - Allow initrc_t domain to manage abrt pid files - Virt_admin should be allowed to manage images and processes- xdm_t needs getsession for switch user - Every app that used to exec init is now execing systemdctl - Allow squid to manage krb5_host_rcache_t files - Allow foghorn to connect to agentx port - Fixes for colord policy- Add Dan's patch to remove 64 bit variants - Allow colord to use unix_dgram_socket - Allow apps that search pids to read /var/run if it is a lnk_file - iscsid_t creates its own directory - Allow init to list var_lock_t dir - apm needs to verify user accounts auth_use_nsswitch - Add labeling for systemd unit files - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added - Add label for matahari-broker.pid file - We want to remove untrustedmcsprocess from ability to read /proc/pid - Fixes for matahari policy - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on- Fix typo- Add /var/run/lock /var/lock definition to file_contexts.subs - nslcd_t is looking for kerberos cc files - SSH_USE_STRONG_RNG is 1 which requires /dev/random - Fix auth_rw_faillog definition - Allow sysadm_t to set attributes on fixed disks - allow user domains to execute lsof and look at application sockets - prelink_cron job calls telinit -u if init is rewritten - Fixes to run qemu_t from staff_t- Fix label for /var/run/udev to udev_var_run_t - Mock needs to be able to read network state- Add file_contexts.subs to handle /run and /run/lock - Add other fixes relating to /run changes from F15 policy- Allow $1_sudo_t and $1_su_t open access to user terminals - Allow initrc_t to use generic terminals - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs -systemd is going to be useing /run and /run/lock for early bootup files. - Fix some comments in rlogin.if - Add policy for KDE backlighthelper - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems - sssd wants to read .k5login file in users homedir - setroubleshoot reads executables to see if they have TEXTREL - Add /var/spool/audit support for new version of audit - Remove kerberos_connect_524() interface calling - Combine kerberos_master_port_t and kerberos_port_t - systemd has setup /dev/kmsg as stderr for apps it executes - Need these access so that init can impersonate sockets on unix_dgram_socket- Remove some unconfined domains - Remove permissive domains - Add policy-term.patch from Dan- Fix multiple specification for boot.log - devicekit leaks file descriptors to setfiles_t - Change all all_nodes to generic_node and all_if to generic_if - Should not use deprecated interface - Switch from using all_nodes to generic_node and from all_if to generic_if - Add support for xfce4-notifyd - Fix file context to show several labels as SystemHigh - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs - Add etc_runtime_t label for /etc/securetty - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly - login.krb needs to be able to write user_tmp_t - dirsrv needs to bind to port 7390 for dogtag - Fix a bug in gpg policy - gpg sends audit messages - Allow qpid to manage matahari files- Initial policy for matahari - Add dev_read_watchdog - Allow clamd to connect clamd port - Add support for kcmdatetimehelper - Allow shutdown to setrlimit and sys_nice - Allow systemd_passwd to talk to /dev/log before udev or syslog is running - Purge chr_file and blk files on /tmp - Fixes for pads - Fixes for piranha-pulse - gpg_t needs to be able to encyprt anything owned by the user- mozilla_plugin_tmp_t needs to be treated as user tmp files - More dontaudits of writes from readahead - Dontaudit readahead_t file_type:dir write, to cover up kernel bug - systemd_tmpfiles needs to relabel faillog directory as well as the file - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost- Add policykit fixes from Tim Waugh - dontaudit sandbox domains sandbox_file_t:dir mounton - Add new dontaudit rules for sysadm_dbusd_t - Change label for /var/run/faillock * other fixes which relate with this change- Update to upstream - Fixes for telepathy - Add port defition for ssdp port - add policy for /bin/systemd-notify from Dan - Mount command requires users read mount_var_run_t - colord needs to read konject_uevent_socket - User domains connect to the gkeyring socket - Add colord policy and allow user_t and staff_t to dbus chat with it - Add lvm_exec_t label for kpartx - Dontaudit reading the mail_spool_t link from sandbox -X - systemd is creating sockets in avahi_var_run and system_dbusd_var_run- gpg_t needs to talk to gnome-keyring - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd - enforce MCS labeling on nodes - Allow arpwatch to read meminfo - Allow gnomeclock to send itself signals - init relabels /dev/.udev files on boot - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t - dnsmasq can run as a dbus service, needs acquire service - mysql_admin should be allowed to connect to mysql service - virt creates monitor sockets in the users home dir- Allow usbhid-ups to read hardware state information - systemd-tmpfiles has moved - Allo cgroup to sys_tty_config - For some reason prelink is attempting to read gconf settings - Add allow_daemons_use_tcp_wrapper boolean - Add label for ~/.cache/wocky to make telepathy work in enforcing mode - Add label for char devices /dev/dasd* - Fix for apache_role - Allow amavis to talk to nslcd - allow all sandbox to read selinux poilcy config files - Allow cluster domains to use the system bus and send each other dbus messages- Update to upstream- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild- Update to ref policy - cgred needs chown capability - Add /dev/crash crash_dev_t - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability- New labeling for postfmulti #675654 - dontaudit xdm_t listing noxattr file systems - dovecot-auth needs to be able to connect to mysqld via the network as well as locally - shutdown is passed stdout to a xdm_log_t file - smartd creates a fixed disk device - dovecot_etc_t contains a lnk_file that domains need to read - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot- syslog_t needs syslog capability - dirsrv needs to be able to create /var/lib/snmp - Fix labeling for dirsrv - Fix for dirsrv policy missing manage_dirs_pattern - corosync needs to delete clvm_tmpfs_t files - qdiskd needs to list hugetlbfs - Move setsched to sandbox_x_domain, so firefox can run without network access - Allow hddtemp to read removable devices - Adding syslog and read_policy permissions to policy * syslog Allow unconfined, sysadm_t, secadm_t, logadm_t * read_policy allow unconfined, sysadm_t, secadm_t, staff_t on Targeted allow sysadm_t (optionally), secadm_t on MLS - mdadm application will write into /sys/.../uevent whenever arrays are assembled or disassembled.- Add tcsd policy- ricci_modclusterd_t needs to bind to rpc ports 500-1023 - Allow dbus to use setrlimit to increase resoueces - Mozilla_plugin is leaking to sandbox - Allow confined users to connect to lircd over unix domain stream socket which allow to use remote control - Allow awstats to read squid logs - seunshare needs to manage tmp_t - apcupsd cgi scripts have a new directory- Fix xserver_dontaudit_read_xdm_pid - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. * These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t - Allow readahead to manage readahead pid dirs - Allow readahead to read all mcs levels - Allow mozilla_plugin_t to use nfs or samba homedirs- Allow nagios plugin to read /proc/meminfo - Fix for mozilla_plugin - Allow samba_net_t to create /etc/keytab - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t - nslcd can read user credentials - Allow nsplugin to delete mozilla_plugin_tmpfs_t - abrt tries to create dir in rpm_var_lib_t - virt relabels fifo_files - sshd needs to manage content in fusefs homedir - mock manages link files in cache dir- nslcd needs setsched and to read /usr/tmp - Invalid call in likewise policy ends up creating a bogus role - Cannon puts content into /var/lib/bjlib that cups needs to be able to write - Allow screen to create screen_home_t in /root - dirsrv sends syslog messages - pinentry reads stuff in .kde directory - Add labels for .kde directory in homedir - Treat irpinit, iprupdate, iprdump services with raid policy- NetworkManager wants to read consolekit_var_run_t - Allow readahead to create /dev/.systemd/readahead - Remove permissive domains - Allow newrole to run namespace_init- Add sepgsql_contexts file- Update to upstream- Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on - Add puppetmaster_use_db boolean - Fixes for zarafa policy - Fixes for gnomeclock poliy - Fix systemd-tmpfiles to use auth_use_nsswitch- gnomeclock executes a shell - Update for screen policy to handle pipe in homedir - Fixes for polyinstatiated homedir - Fixes for namespace policy and other fixes related to polyinstantiation - Add namespace policy - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts - Fixes for init, psad policy which relate with confined users - Do not audit bootloader attempts to read devicekit pid files - Allow nagios service plugins to read /proc- Add firewalld policy - Allow vmware_host to read samba config - Kernel wants to read /proc Fix duplicate grub def in cobbler - Chrony sends mail, executes shell, uses fifo_file and reads /proc - devicekitdisk getattr all file systems - sambd daemon writes wtmp file - libvirt transitions to dmidecode- Add initial policy for system-setup-keyboard which is now daemon - Label /var/lock/subsys/shorewall as shorewall_lock_t - Allow users to communicate with the gpg_agent_t - Dontaudit mozilla_plugin_t using the inherited terminal - Allow sambagui to read files in /usr - webalizer manages squid log files - Allow unconfined domains to bind ports to raw_ip_sockets - Allow abrt to manage rpm logs when running yum - Need labels for /var/run/bittlebee - Label .ssh under amanda - Remove unused genrequires for virt_domain_template - Allow virt_domain to use fd inherited from virtd_t - Allow iptables to read shorewall config- Gnome apps list config_home_t - mpd creates lnk files in homedir - apache leaks write to mail apps on tmp files - /var/stockmaniac/templates_cache contains log files - Abrt list the connects of mount_tmp_t dirs - passwd agent reads files under /dev and reads utmp file - squid apache script connects to the squid port - fix name of plymouth log file - teamviewer is a wine app - allow dmesg to read system state - Stop labeling files under /var/lib/mock so restorecon will not go into this - nsplugin needs to read network state for google talk- Allow xdm and syslog to use /var/log/boot.log - Allow users to communicate with mozilla_plugin and kill it - Add labeling for ipv6 and dhcp- New labels for ghc http content - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy- Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot- Update selinux policy to handle new /usr/share/sandbox/start script- Update to upstream - Fix version of policy in spec file- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs - remove per sandbox domains devpts types - Allow dkim-milter sending signal to itself- Allow domains that transition to ping or traceroute, kill them - Allow user_t to conditionally transition to ping_t and traceroute_t - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup- Turn on systemd policy - mozilla_plugin needs to read certs in the homedir. - Dontaudit leaked file descriptors from devicekit - Fix ircssi to use auth_use_nsswitch - Change to use interface without param in corenet to disable unlabelednet packets - Allow init to relabel sockets and fifo files in /dev - certmonger needs dac* capabilities to manage cert files not owned by root - dovecot needs fsetid to change group membership on mail - plymouthd removes /var/log/boot.log - systemd is creating symlinks in /dev - Change label on /etc/httpd/alias to be all cert_t- Fixes for clamscan and boinc policy - Add boinc_project_t setpgid - Allow alsa to create tmp files in /tmp- Push fixes to allow disabling of unlabeled_t packet access - Enable unlabelednet policy- Fixes for lvm to work with systemd- Fix the label for wicd log - plymouthd creates force-display-on-active-vt file - Allow avahi to request the kernel to load a module - Dontaudit hal leaks - Fix gnome_manage_data interface - Add new interface corenet_packet to define a type as being an packet_type. - Removed general access to packet_type from icecast and squid. - Allow mpd to read alsa config - Fix the label for wicd log - Add systemd policy- Fix gnome_manage_data interface - Dontaudit sys_ptrace capability for iscsid - Fixes for nagios plugin policy- Fix cron to run ranged when started by init - Fix devicekit to use log files - Dontaudit use of devicekit_var_run_t for fstools - Allow init to setattr on logfile directories - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t- Fix up handling of dnsmasq_t creating /var/run/libvirt/network - Turn on sshd_forward_ports boolean by default - Allow sysadmin to dbus chat with rpm - Add interface for rw_tpm_dev - Allow cron to execute bin - fsadm needs to write sysfs - Dontaudit consoletype reading /var/run/pm-utils - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin - certmonger needs to manage dirsrv data - /var/run/pm-utils should be labeled as devicekit_var_run_t- fixes to allow /var/run and /var/lock as tmpfs - Allow chrome sandbox to connect to web ports - Allow dovecot to listem on lmtp and sieve ports - Allov ddclient to search sysctl_net_t - Transition back to original domain if you execute the shell- Remove duplicate declaration- Update to upstream - Cleanup for sandbox - Add attribute to be able to select sandbox types- Allow ddclient to fix file mode bits of ddclient conf file - init leaks file descriptors to daemons - Add labels for /etc/lirc/ and - Allow amavis_t to exec shell - Add label for gssd_tmp_t for /var/tmp/nfs_0- Put back in lircd_etc_t so policy will install- Turn on allow_postfix_local_write_mail_spool - Allow initrc_t to transition to shutdown_t - Allow logwatch and cron to mls_read_to_clearance for MLS boxes - Allow wm to send signull to all applications and receive them from users - lircd patch from field - Login programs have to read /etc/samba - New programs under /lib/systemd - Abrt needs to read config files- Update to upstream - Dontaudit leaked sockets from userdomains to user domains - Fixes for mcelog to handle scripts - Apply patch from Ruben Kerkhof - Allow syslog to search spool dirs- Allow nagios plugins to read usr files - Allow mysqld-safe to send system log messages - Fixes fpr ddclient policy - Fix sasl_admin interface - Allow apache to search zarafa config - Allow munin plugins to search /var/lib directory - Allow gpsd to read sysfs_t - Fix labels on /etc/mcelog/triggers to bin_t- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp - Fix xserver interface - Fix definition of /var/run/lxdm- Turn on mediawiki policy - kdump leaks kdump_etc_t to ifconfig, add dontaudit - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap- Allow groupd transition to fenced domain when executes fence_node - Fixes for rchs policy - Allow mpd to be able to read samba/nfs files- Fix up corecommands.fc to match upstream - Make sure /lib/systemd/* is labeled init_exec_t - mount wants to setattr on all mountpoints - dovecot auth wants to read dovecot etc files - nscd daemon looks at the exe file of the comunicating daemon - openvpn wants to read utmp file - postfix apps now set sys_nice and lower limits - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly - Also resolves nsswitch - Fix labels on /etc/hosts.* - Cleanup to make upsteam patch work - allow abrt to read etc_runtime_t- Add conflicts for dirsrv package- Update to upstream - Add vlock policy- Fix sandbox to work on nfs homedirs - Allow cdrecord to setrlimit - Allow mozilla_plugin to read xauth - Change label on systemd-logger to syslogd_exec_t - Install dirsrv policy from dirsrv package- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it - Udev needs to stream connect to init and kernel - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory- Allow NetworkManager to read openvpn_etc_t - Dontaudit hplip to write of /usr dirs - Allow system_mail_t to create /root/dead.letter as mail_home_t - Add vdagent policy for spice agent daemon- Dontaudit sandbox sending sigkill to all user domains - Add policy for rssh_chroot_helper - Add missing flask definitions - Allow udev to relabelto removable_t - Fix label on /var/log/wicd.log - Transition to initrc_t from init when executing bin_t - Add audit_access permissions to file - Make removable_t a device_node - Fix label on /lib/systemd/*- Fixes for systemd to manage /var/run - Dontaudit leaks by firstboot- Allow chome to create netlink_route_socket - Add additional MATHLAB file context - Define nsplugin as an application_domain - Dontaudit sending signals from sandboxed domains to other domains - systemd requires init to build /tmp /var/auth and /var/lock dirs - mount wants to read devicekit_power /proc/ entries - mpd wants to connect to soundd port - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit - Treat lib_t and textrel_shlib_t directories the same - Allow mount read access on virtual images- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs. - Allow devicekit_power to domtrans to mount - Allow dhcp to bind to udp ports > 1024 to do named stuff - Allow ssh_t to exec ssh_exec_t - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used - Fix clamav_append_log() intefaces - Fix 'psad_rw_fifo_file' interface- Allow cobblerd to list cobler appache content- Fixup for the latest version of upowed - Dontaudit sandbox sending SIGNULL to desktop apps- Update to upstream-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access - dovecot-auth_t needs ipc_lock - gpm needs to use the user terminal - Allow system_mail_t to append ~/dead.letter - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf - Add pid file to vnstatd - Allow mount to communicate with gfs_controld - Dontaudit hal leaks in setfiles- Lots of fixes for systemd - systemd now executes readahead and tmpwatch type scripts - Needs to manage random seed- Allow smbd to use sys_admin - Remove duplicate file context for tcfmgr - Update to upstream- Fix fusefs handling - Do not allow sandbox to manage nsplugin_rw_t - Allow mozilla_plugin_t to connecto its parent - Allow init_t to connect to plymouthd running as kernel_t - Add mediawiki policy - dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. - Disable transition from dbus_session_domain to telepathy for F14 - Allow boinc_project to use shm - Allow certmonger to search through directories that contain certs - Allow fail2ban the DAC Override so it can read log files owned by non root users- Start adding support for use_fusefs_home_dirs - Add /var/lib/syslog directory file context - Add /etc/localtime as locale file context- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user - Turn off iptables from unconfined user - Allow sudo to send signals to any domains the user could have transitioned to. - Passwd in single user mode needs to talk to console_device_t - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio - locate tried to read a symbolic link, will dontaudit - New labels for telepathy-sunshine content in homedir - Google is storing other binaries under /opt/google/talkplugin - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15 - modemmanger and bluetooth send dbus messages to devicekit_power - Samba needs to getquota on filesystems labeld samba_share_t- Dontaudit attempts by xdm_t to write to bin_t for kdm - Allow initrc_t to manage system_conf_t- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets - Allow confined users to read xdm_etc_t files - Allow xdm_t to transition to xauth_t for lxdm program- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home - Allow clamd to send signals to itself - Allow mozilla_plugin_t to read user home content. And unlink pulseaudio shm. - Allow haze to connect to yahoo chat and messenger port tcp:5050. Bz #637339 - Allow guest to run ps command on its processes by allowing it to read /proc - Allow firewallgui to sys_rawio which seems to be required to setup masqerading - Allow all domains to search through default_t directories, in order to find differnet labels. For example people serring up /foo/bar to be share via samba. - Add label for /var/log/slim.log- Pull in cleanups from dgrift - Allow mozilla_plugin_t to execute mozilla_home_t - Allow rpc.quota to do quotamod- Cleanup policy via dgrift - Allow dovecot_deliver to append to inherited log files - Lots of fixes for consolehelper- Fix up Xguest policy- Add vnstat policy - allow libvirt to send audit messages - Allow chrome-sandbox to search nfs_t- Update to upstream- Add the ability to send audit messages to confined admin policies - Remove permissive domain from cmirrord and dontaudit sys_tty_config - Split out unconfined_domain() calls from other unconfined_ calls so we can d - virt needs to be able to read processes to clearance for MLS- Allow all domains that can use cgroups to search tmpfs_t directory - Allow init to send audit messages- Update to upstream- Allow mdadm_t to create files and sock files in /dev/md/- Add policy for ajaxterm- Handle /var/db/sudo - Allow pulseaudio to read alsa config - Allow init to send initrc_t dbus messagesAllow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr intd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port- Merge upstream fix of mmap_zero - Allow mount to write files in debugfs_t - Allow corosync to communicate with clvmd via tmpfs - Allow certmaster to read usr_t files - Allow dbus system services to search cgroup_t - Define rlogind_t as a login pgm- Allow mdadm_t to read/write hugetlbfs- Dominic Grift Cleanup - Miroslav Grepl policy for jabberd - Various fixes for mount/livecd and prelink- Merge with upstream- More access needed for devicekit - Add dbadm policy- Merge with upstream- Allow seunshare to fowner- Allow cron to look at user_cron_spool links - Lots of fixes for mozilla_plugin_t - Add sysv file system - Turn unconfined domains to permissive to find additional avcs- Update policy for mozilla_plugin_t- Allow clamscan to read proc_t - Allow mount_t to write to debufs_t dir - Dontaudit mount_t trying to write to security_t dir- Allow clamscan_t execmem if clamd_use_jit set - Add policy for firefox plugin-container- Fix /root/.forward definition- label dead.letter as mail_home_t- Allow login programs to search /cgroups- Fix cert handling- Fix devicekit_power bug - Allow policykit_auth_t more access.- Fix nis calls to allow bind to ports 512-1024 - Fix smartmon- Allow pcscd to read sysfs - systemd fixes - Fix wine_mmap_zero_ignore boolean- Apply Miroslav munin patch - Turn back on allow_execmem and allow_execmod booleans- Merge in fixes from dgrift repository- Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0- New paths for upstart- New permissions for syslog - New labels for /lib/upstart- Add mojomojo policy- Allow systemd to setsockcon on sockets to immitate other services- Remove debugfs label- Update to latest policy- Fix eclipse labeling from IBMSupportAssasstant packageing- Make boot with systemd in enforcing mode- Update to upstream- Add boolean to turn off port forwarding in sshd.- Add support for ebtables - Fixes for rhcs and corosync policy-Update to upstream-Update to upstream-Update to upstream- Add Zarafa policy- Cleanup of aiccu policy - initial mock policy- Lots of random fixes- Update to upstream- Update to upstream - Allow prelink script to signal itself - Cobbler fixes- Add xdm_var_run_t to xserver_stream_connect_xdm - Add cmorrord and mpd policy from Miroslav Grepl- Fix sshd creation of krb cc files for users to be user_tmp_t- Fixes for accountsdialog - Fixes for boinc- Fix label on /var/lib/dokwiki - Change permissive domains to enforcing - Fix libvirt policy to allow it to run on mls- Update to upstream- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t - Fix /var/run/abrtd.lock label- Allow login programs to read krb5_home_t Resolves: 594833 - Add obsoletes for cachefilesfd-selinux package Resolves: #575084- Allow mount to r/w abrt fifo file - Allow svirt_t to getattr on hugetlbfs - Allow abrt to create a directory under /var/spool- Add labels for /sys - Allow sshd to getattr on shutdown - Fixes for munin - Allow sssd to use the kernel key ring - Allow tor to send syslog messages - Allow iptabels to read usr files - allow policykit to read all domains state- Fix path for /var/spool/abrt - Allow nfs_t as an entrypoint for http_sys_script_t - Add policy for piranha - Lots of fixes for sosreport- Allow xm_t to read network state and get and set capabilities - Allow policykit to getattr all processes - Allow denyhosts to connect to tcp port 9911 - Allow pyranha to use raw ip sockets and ptrace itself - Allow unconfined_execmem_t and gconfsd mechanism to dbus - Allow staff to kill ping process - Add additional MLS rules- Allow gdm to edit ~/.gconf dir Resolves: #590677 - Allow dovecot to create directories in /var/lib/dovecot Partially resolves 590224 - Allow avahi to dbus chat with NetworkManager - Fix cobbler labels - Dontaudit iceauth_t leaks - fix /var/lib/lxdm file context - Allow aiccu to use tun tap devices - Dontaudit shutdown using xserver.log- Fixes for sandbox_x_net_t to match access for sandbox_web_t ++ - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory - Add dontaudit interface for bluetooth dbus - Add chronyd_read_keys, append_keys for initrc_t - Add log support for ksmtuned Resolves: #586663- Allow boinc to send mail- Allow initrc_t to remove dhcpc_state_t - Fix label on sa-update.cron - Allow dhcpc to restart chrony initrc - Don't allow sandbox to send signals to its parent processes - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t Resolves: #589136- Fix location of oddjob_mkhomedir Resolves: #587385 - fix labeling on /root/.shosts and ~/.shosts - Allow ipsec_mgmt_t to manage net_conf_t Resolves: #586760- Dontaudit sandbox trying to connect to netlink sockets Resolves: #587609 - Add policy for piranha- Fixups for xguest policy - Fixes for running sandbox firefox- Allow ksmtuned to use terminals Resolves: #586663 - Allow lircd to write to generic usb devices- Allow sandbox_xserver to connectto unconfined stream Resolves: #585171- Allow initrc_t to read slapd_db_t Resolves: #585476 - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf Resolves: #585963- Allow rlogind_t to search /root for .rhosts Resolves: #582760 - Fix path for cached_var_t - Fix prelink paths /var/lib/prelink - Allow confined users to direct_dri - Allow mls lvm/cryptosetup to work- Allow virtd_t to manage firewall/iptables config Resolves: #573585- Fix label on /root/.rhosts Resolves: #582760 - Add labels for Picasa - Allow openvpn to read home certs - Allow plymouthd_t to use tty_device_t - Run ncftool as iptables_t - Allow mount to unmount unlabeled_t - Dontaudit hal leaks- Allow livecd to transition to mount- Update to upstream - Allow abrt to delete sosreport Resolves: #579998 - Allow snmp to setuid and gid Resolves: #582155 - Allow smartd to use generic scsi devices Resolves: #582145- Allow ipsec_t to create /etc/resolv.conf with the correct label - Fix reserved port destination - Allow autofs to transition to showmount - Stop crashing tuned- Add telepathysofiasip policy- Update to upstream - Fix label for /opt/google/chrome/chrome-sandbox - Allow modemmanager to dbus with policykit- Fix allow_httpd_mod_auth_pam to use auth_use_pam(httpd_t) - Allow accountsd to read shadow file - Allow apache to send audit messages when using pam - Allow asterisk to bind and connect to sip tcp ports - Fixes for dovecot 2.0 - Allow initrc_t to setattr on milter directories - Add procmail_home_t for .procmailrc file- Fixes for labels during install from livecd- Fix /cgroup file context - Fix broken afs use of unlabled_t - Allow getty to use the console for s390- Fix cgroup handling adding policy for /cgroup - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set- Merge patches from dgrift- Update upstream - Allow abrt to write to the /proc under any process- Fix ~/.fontconfig label - Add /root/.cert label - Allow reading of the fixed_file_disk_t:lnk_file if you can read file - Allow qemu_exec_t as an entrypoint to svirt_t- Update to upstream - Allow tmpreaper to delete sandbox sock files - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems - Fixes for gitosis - No transition on livecd to passwd or chfn - Fixes for denyhosts- Add label for /var/lib/upower - Allow logrotate to run sssd - dontaudit readahead on tmpfs blk files - Allow tmpreaper to setattr on sandbox files - Allow confined users to execute dos files - Allow sysadm_t to kill processes running within its clearance - Add accountsd policy - Fixes for corosync policy - Fixes from crontab policy - Allow svirt to manage svirt_image_t chr files - Fixes for qdisk policy - Fixes for sssd policy - Fixes for newrole policy- make libvirt work on an MLS platform- Add qpidd policy- Update to upstream- Allow boinc to read kernel sysctl - Fix snmp port definitions - Allow apache to read anon_inodefs- Allow shutdown dac_override- Add device_t as a file system - Fix sysfs association- Dontaudit ipsec_mgmt sys_ptrace - Allow at to mail its spool files - Allow nsplugin to search in .pulse directory- Update to upstream- Allow users to dbus chat with xdm - Allow users to r/w wireless_device_t - Dontaudit reading of process states by ipsec_mgmt- Fix openoffice from unconfined_t- Add shutdown policy so consolekit can shutdown system- Update to upstream- Update to upstream- Update to upstream - These are merges of my patches - Remove 389 labeling conflicts - Add MLS fixes found in RHEL6 testing - Allow pulseaudio to run as a service - Add label for mssql and allow apache to connect to this database port if boolean set - Dontaudit searches of debugfs mount point - Allow policykit_auth to send signals to itself - Allow modcluster to call getpwnam - Allow swat to signal winbind - Allow usbmux to run as a system role - Allow svirt to create and use devpts- Add MLS fixes found in RHEL6 testing - Allow domains to append to rpm_tmp_t - Add cachefilesfd policy - Dontaudit leaks when transitioning- Change allow_execstack and allow_execmem booleans to on - dontaudit acct using console - Add label for fping - Allow tmpreaper to delete sandbox_file_t - Fix wine dontaudit mmap_zero - Allow abrt to read var_t symlinks- Additional policy for rgmanager- Allow sshd to setattr on pseudo terms- Update to upstream- Allow policykit to send itself signals- Fix duplicate cobbler definition- Fix file context of /var/lib/avahi-autoipd- Merge with upstream- Allow sandbox to work with MLS- Make Chrome work with staff user- Add icecast policy - Cleanup spec file- Add mcelog policy- Lots of fixes found in F12- Fix rpm_dontaudit_leaks- Add getsched to hald_t - Add file context for Fedora/Redhat Directory Server- Allow abrt_helper to getattr on all filesystems - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so- Add gstreamer_home_t for ~/.gstreamer- Update to upstream- Fix git- Turn on puppet policy - Update to dgrift git policy- Move users file to selection by spec file. - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t- Update to upstream- Remove most of the permissive domains from F12.- Add cobbler policy from dgrift- add usbmon device - Add allow rulse for devicekit_disk- Lots of fixes found in F12, fixes from Tom London- Cleanups from dgrift- Add back xserver_manage_home_fonts- Dontaudit sandbox trying to read nscd and sssd- Update to upstream- Rename udisks-daemon back to devicekit_disk_t policy- Fixes for abrt calls- Add tgtd policy- Update to upstream release- Add asterisk policy back in - Update to upstream release 2.20091117- Update to upstream release 2.20091117- Fixup nut policy- Update to upstream- Allow vpnc request the kernel to load modules- Fix minimum policy installs - Allow udev and rpcbind to request the kernel to load modules- Add plymouth policy - Allow local_login to sys_admin- Allow cupsd_config to read user tmp - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t- Update rhcs policy- Allow users to exec restorecond- Allow sendmail to request kernel modules load- Fix all kernel_request_load_module domains- Fix all kernel_request_load_module domains- Remove allow_exec* booleans for confined users. Only available for unconfined_t- More fixes for sandbox_web_t- Allow sshd to create .ssh directory and content- Fix request_module line to module_request- Fix sandbox policy to allow it to run under firefox. - Dont audit leaks.- Fixes for sandbox- Update to upstream - Dontaudit nsplugin search /root - Dontaudit nsplugin sys_nice- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service - Remove policycoreutils-python requirement except for minimum- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)- Add wordpress/wp-content/uploads label - Fixes for sandbox when run from staff_t- Update to upstream - Fixes for devicekit_disk- More fixes- Lots of fixes for initrc and other unconfined domains- Allow xserver to use netlink_kobject_uevent_socket- Fixes for sandbox- Dontaudit setroubleshootfix looking at /root directory- Update to upsteam- Allow gssd to send signals to users - Fix duplicate label for apache content- Update to upstream- Remove polkit_auth on upgrades- Add back in unconfined.pp and unconfineduser.pp - Add Sandbox unshare- Fixes for cdrecord, mdadm, and others- Add capability setting to dhcpc and gpm- Allow cronjobs to read exim_spool_t- Add ABRT policy- Fix system-config-services policy- Allow libvirt to change user componant of virt_domain- Allow cupsd_config_t to be started by dbus - Add smoltclient policy- Add policycoreutils-python to pre install- Make all unconfined_domains permissive so we can see what AVC's happen- Add pt_chown policy- Add kdump policy for Miroslav Grepl - Turn off execstack boolean- Turn on execstack on a temporary basis (#512845)- Allow nsplugin to connecto the session bus - Allow samba_net to write to coolkey data- Allow devicekit_disk to list inotify- Allow svirt images to create sock_file in svirt_var_run_t- Allow exim to getattr on mountpoints - Fixes for pulseaudio- Allow svirt_t to stream_connect to virtd_t- Allod hald_dccm_t to create sock_files in /tmp- More fixes from upstream- Fix polkit label - Remove hidebrokensymptoms for nss_ldap fix - Add modemmanager policy - Lots of merges from upstream - Begin removing textrel_shlib_t labels, from fixed libraries- Update to upstream- Allow certmaster to override dac permissions- Update to upstream- Fix context for VirtualBox- Update to upstream- Allow clamscan read amavis spool files- Fixes for xguest- fix multiple directory ownership of mandirs- Update to upstream- Add rules for rtkit-daemon- Update to upstream - Fix nlscd_stream_connect- Add rtkit policy- Allow rpcd_t to stream connect to rpcbind- Allow kpropd to create tmp files- Fix last duplicate /var/log/rpmpkgs- Update to upstream * add sssd- Update to upstream * cleanup- Update to upstream - Additional mail ports - Add virt_use_usb boolean for svirt- Fix mcs rules to include chr_file and blk_file- Add label for udev-acl- Additional rules for consolekit/udev, privoxy and various other fixes- New version for upstream- Allow NetworkManager to read inotifyfs- Allow setroubleshoot to run mlocate- Update to upstream- Add fish as a shell - Allow fprintd to list usbfs_t - Allow consolekit to search mountpoints - Add proper labeling for shorewall- New log file for vmware - Allow xdm to setattr on user_tmp_t- Upgrade to upstream- Allow fprintd to access sys_ptrace - Add sandbox policy- Add varnishd policy- Fixes for kpropd- Allow brctl to r/w tun_tap_device_t- Add /usr/share/selinux/packages- Allow rpcd_t to send signals to kernel threads- Fix upgrade for F10 to F11- Add policy for /var/lib/fprint-Remove duplicate line- Allow svirt to manage pci and other sysfs device data- Fix package selection handling- Fix /sbin/ip6tables-save context - Allod udev to transition to mount - Fix loading of mls policy file- Add shorewall policy- Additional rules for fprintd and sssd- Allow nsplugin to unix_read unix_write sem for unconfined_java- Fix uml files to be owned by users- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less- Allow confined users to manage virt_content_t, since this is home dir content - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection- Fix labeling on /var/lib/misc/prelink* - Allow xserver to rw_shm_perms with all x_clients - Allow prelink to execute files in the users home directory- Allow initrc_t to delete dev_null - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead- Update to latest milter code from Paul Howarth- Additional perms for readahead- Allow pulseaudio to acquire_svc on session bus - Fix readahead labeling- Allow sysadm_t to run rpm directly - libvirt needs fowner- Allow sshd to read var_lib symlinks for freenx- Allow nsplugin unix_read and write on users shm and sem - Allow sysadm_t to execute su- Dontaudit attempts to getattr user_tmpfs_t by lvm - Allow nfs to share removable media- Add ability to run postdrop from confined users- Fixes for podsleuth- Turn off nsplugin transition - Remove Konsole leaked file descriptors for release- Allow cupsd_t to create link files in print_spool_t - Fix iscsi_stream_connect typo - Fix labeling on /etc/acpi/actions - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed- Allow audioentroy to read etc files- Add fail2ban_var_lib_t - Fixes for devicekit_power_t- Separate out the ucnonfined user from the unconfined.pp package- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.- Upgrade to latest upstream - Allow devicekit_disk sys_rawio- Dontaudit binds to ports < 1024 for named - Upgrade to latest upstream- Allow podsleuth to use tmpfs files- Add customizable_types for svirt- Allow setroubelshoot exec* privs to prevent crash from bad libraries - add cpufreqselector- Dontaudit listing of /root directory for cron system jobs- Fix missing ld.so.cache label- Add label for ~/.forward and /root/.forward- Fixes for svirt- Fixes to allow svirt read iso files in homedir- Add xenner and wine fixes from mgrepl- Allow mdadm to read/write mls override- Change to svirt to only access svirt_image_t- Fix libvirt policy- Upgrade to latest upstream- Fixes for iscsid and sssd - More cleanups for upgrade from F10 to Rawhide.- Add pulseaudio, sssd policy - Allow networkmanager to exec udevadm- Add pulseaudio context- Upgrade to latest patches- Fixes for libvirt- Update to Latest upstream- Fix setrans.conf to show SystemLow for s0- Further confinement of qemu images via svirt- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild- Allow NetworkManager to manage /etc/NetworkManager/system-connections- add virtual_image_context and virtual_domain_context files- Allow rpcd_t to send signal to mount_t - Allow libvirtd to run ranged- Fix sysnet/net_conf_t- Fix squidGuard labeling- Re-add corenet_in_generic_if(unlabeled_t)* Tue Feb 10 2009 Dan Walsh 3.6.5-2 - Add git web policy- Add setrans contains from upstream- Do transitions outside of the booleans- Allow xdm to create user_tmp_t sockets for switch user to work- Fix staff_t domain- Grab remainder of network_peer_controls patch- More fixes for devicekit- Upgrade to latest upstream- Add boolean to disallow unconfined_t login- Add back transition from xguest to mozilla- Add virt_content_ro_t and labeling for isos directory- Fixes for wicd daemon- More mls/rpm fixes- Add policy to make dbus/nm-applet work- Remove polgen-ifgen from post and add trigger to policycoreutils-python- Add wm policy - Make mls work in graphics mode- Fixed for DeviceKit- Add devicekit policy- Update to upstream- Define openoffice as an x_domain- Fixes for reading xserver_tmp_t- Allow cups_pdf_t write to nfs_t- Remove audio_entropy policy- Update to upstream- Allow hal_acl_t to getattr/setattr fixed_disk- Change userdom_read_all_users_state to include reading symbolic links in /proc- Fix dbus reading /proc information- Add missing alias for home directory content- Fixes for IBM java location- Allow unconfined_r unconfined_java_t- Add cron_role back to user domains- Fix sudo setting of user keys- Allow iptables to talk to terminals - Fixes for policy kit - lots of fixes for booting.- Cleanup policy- Rebuild for Python 2.6- Fix labeling on /var/spool/rsyslog- Allow postgresl to bind to udp nodes- Allow lvm to dbus chat with hal - Allow rlogind to read nfs_t- Fix cyphesis file context- Allow hal/pm-utils to look at /var/run/video.rom - Add ulogd policy- Additional fixes for cyphesis - Fix certmaster file context - Add policy for system-config-samba - Allow hal to read /var/run/video.rom- Allow dhcpc to restart ypbind - Fixup labeling in /var/run- Add certmaster policy- Fix confined users - Allow xguest to read/write xguest_dbusd_t- Allow openoffice execstack/execmem privs- Allow mozilla to run with unconfined_execmem_t- Dontaudit domains trying to write to .xsession-errors- Allow nsplugin to look at autofs_t directory- Allow kerneloops to create tmp files- More alias for fastcgi- Remove mod_fcgid-selinux package- Fix dovecot access- Policy cleanup- Remove Multiple spec - Add include - Fix makefile to not call per_role_expansion- Fix labeling of libGL- Update to upstream- Update to upstream policy- Fixes for confined xwindows and xdm_t- Allow confined users and xdm to exec wm - Allow nsplugin to talk to fifo files on nfs- Allow NetworkManager to transition to avahi and iptables - Allow domains to search other domains keys, coverup kernel bug- Fix labeling for oracle- Allow nsplugin to comminicate with xdm_tmp_t sock_file- Change all user tmpfs_t files to be labeled user_tmpfs_t - Allow radiusd to create sock_files- Upgrade to upstream- Allow confined users to login with dbus- Fix transition to nsplugin- Add file context for /dev/mspblk.*- Fix transition to nsplugin '- Fix labeling on new pm*log - Allow ssh to bind to all nodes- Merge upstream changes - Add Xavier Toth patches- Add qemu_cache_t for /var/cache/libvirt- Remove gamin policy- Add tinyxs-max file system support- Update to upstream - New handling of init scripts- Allow pcsd to dbus - Add memcache policy- Allow audit dispatcher to kill his children- Update to upstream - Fix crontab use by unconfined user- Allow ifconfig_t to read dhcpc_state_t- Update to upstream- Update to upstream- Allow system-config-selinux to work with policykit- Fix novel labeling- Consolodate pyzor,spamassassin, razor into one security domain - Fix xdm requiring additional perms.- Fixes for logrotate, alsa- Eliminate vbetool duplicate entry- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t - Change dhclient to be able to red networkmanager_var_run- Update to latest refpolicy - Fix libsemanage initial install bug- Add inotify support to nscd- Allow unconfined_t to setfcap- Allow amanda to read tape - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi - Add support for netware file systems- Allow ypbind apps to net_bind_service- Allow all system domains and application domains to append to any log file- Allow gdm to read rpm database - Allow nsplugin to read mplayer config files- Allow vpnc to run ifconfig- Allow confined users to use postgres - Allow system_mail_t to exec other mail clients - Label mogrel_rails as an apache server- Apply unconfined_execmem_exec_t to haskell programs- Fix prelude file context- allow hplip to talk dbus - Fix context on ~/.local dir- Prevent applications from reading x_device- Add /var/lib/selinux context- Update to upstream- Add livecd policy- Dontaudit search of admin_home for init_system_domain - Rewrite of xace interfaces - Lots of new fs_list_inotify - Allow livecd to transition to setfiles_mac- Begin XAce integration- Merge Upstream- Allow amanada to create data files- Fix initial install, semanage setup- Allow system_r for httpd_unconfined_script_t- Remove dmesg boolean - Allow user domains to read/write game data- Change unconfined_t to transition to unconfined_mono_t when running mono - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work- Remove old booleans from targeted-booleans.conf file- Add boolean to mmap_zero - allow tor setgid - Allow gnomeclock to set clock- Don't run crontab from unconfined_t- Change etc files to config files to allow users to read them- Lots of fixes for confined domains on NFS_t homedir- dontaudit mrtg reading /proc - Allow iscsi to signal itself - Allow gnomeclock sys_ptrace- Allow dhcpd to read kernel network state- Label /var/run/gdm correctly - Fix unconfined_u user creation- Allow transition from initrc_t to getty_t- Allow passwd to communicate with user sockets to change gnome-keyring- Fix initial install- Allow radvd to use fifo_file - dontaudit setfiles reading links - allow semanage sys_resource - add allow_httpd_mod_auth_ntlm_winbind boolean - Allow privhome apps including dovecot read on nfs and cifs home dirs if the boolean is set- Allow nsplugin to read /etc/mozpluggerrc, user_fonts - Allow syslog to manage innd logs. - Allow procmail to ioctl spamd_exec_t- Allow initrc_t to dbus chat with consolekit.- Additional access for nsplugin - Allow xdm setcap/getcap until pulseaudio is fixed- Allow mount to mkdir on tmpfs - Allow ifconfig to search debugfs- Fix file context for MATLAB - Fixes for xace- Allow stunnel to transition to inetd children domains - Make unconfined_dbusd_t an unconfined domain- Fixes for qemu/virtd- Fix bug in mozilla policy to allow xguest transition - This will fix the libsemanage.dbase_llist_query: could not find record value libsemanage.dbase_llist_query: could not query record value (No such file or directory) bug in xguest- Allow nsplugin to run acroread- Add cups_pdf policy - Add openoffice policy to run in xguest- prewika needs to contact mysql - Allow syslog to read system_map files- Change init_t to an unconfined_domain- Allow init to transition to initrc_t on shell exec. - Fix init to be able to sendto init_t. - Allow syslog to connect to mysql - Allow lvm to manage its own fifo_files - Allow bugzilla to use ldap - More mls fixes- fixes for init policy (#436988) - fix build- Additional changes for MLS policy- Fix initrc_context generation for MLS- Fixes for libvirt- Allow bitlebee to read locale_t- More xselinux rules- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t- Prepare policy for beta release - Change some of the system domains back to unconfined - Turn on some of the booleans- Allow nsplugin_config execstack/execmem - Allow nsplugin_t to read alsa config - Change apache to use user content- Add cyphesis policy- Fix Makefile.devel to build mls modules - Fix qemu to be more specific on labeling- Update to upstream fixes- Allow staff to mounton user_home_t- Add xace support- Add fusectl file system- Fixes from yum-cron - Update to latest upstream- Fix userdom_list_user_files- Merge with upstream- Allow udev to send audit messages- Add additional login users interfaces - userdom_admin_login_user_template(staff)- More fixes for polkit- Eliminate transition from unconfined_t to qemu by default - Fixes for gpg- Update to upstream- Fixes for staff_t- Add policy for kerneloops - Add policy for gnomeclock- Fixes for libvirt- Fixes for nsplugin- More fixes for qemu- Additional ports for vnc and allow qemu and libvirt to search all directories- Update to upstream - Add libvirt policy - add qemu policy- Allow fail2ban to create a socket in /var/run- Allow allow_httpd_mod_auth_pam to work- Add audisp policy and prelude- Allow all user roles to executae samba net command- Allow usertypes to read/write noxattr file systems- Fix nsplugin to allow flashplugin to work in enforcing mode- Allow pam_selinux_permit to kill all processes- Allow ptrace or user processes by users of same type - Add boolean for transition to nsplugin- Allow nsplugin sys_nice, getsched, setsched- Allow login programs to talk dbus to oddjob- Add procmail_log support - Lots of fixes for munin- Allow setroubleshoot to read policy config and send audit messages- Allow users to execute all files in homedir, if boolean set - Allow mount to read samba config- Fixes for xguest to run java plugin- dontaudit pam_t and dbusd writing to user_home_t- Update gpg to allow reading of inotify- Change user and staff roles to work correctly with varied perms- Fix munin log, - Eliminate duplicate mozilla file context - fix wpa_supplicant spec- Fix role transition from unconfined_r to system_r when running rpm - Allow unconfined_domains to communicate with user dbus instances- Fixes for xguest- Let all uncofined domains communicate with dbus unconfined- Run rpm in system_r- Zero out customizable types- Fix definiton of admin_home_t- Fix munin file context- Allow cron to run unconfined apps- Modify default login to unconfined_u- Dontaudit dbus user client search of /root- Update to upstream- Fixes for polkit - Allow xserver to ptrace- Add polkit policy - Symplify userdom context, remove automatic per_role changes- Update to upstream - Allow httpd_sys_script_t to search users homedirs- Allow rpm_script to transition to unconfined_execmem_t- Remove user based home directory separation- Remove user specific crond_t- Merge with upstream - Allow xsever to read hwdata_t - Allow login programs to setkeycreate- Update to upstream- Update to upstream- Allow XServer to read /proc/self/cmdline - Fix unconfined cron jobs - Allow fetchmail to transition to procmail - Fixes for hald_mac - Allow system_mail to transition to exim - Allow tftpd to upload files - Allow xdm to manage unconfined_tmp - Allow udef to read alsa config - Fix xguest to be able to connect to sound port- Fixes for hald_mac - Treat unconfined_home_dir_t as a home dir - dontaudit rhgb writes to fonts and root- Fix dnsmasq - Allow rshd full login privs- Allow rshd to connect to ports > 1023- Fix vpn to bind to port 4500 - Allow ssh to create shm - Add Kismet policy- Allow rpm to chat with networkmanager- Fixes for ipsec and exim mail - Change default to unconfined user- Pass the UNK_PERMS param to makefile - Fix gdm location- Make alsa work- Fixes for consolekit and startx sessions- Dontaudit consoletype talking to unconfined_t- Remove homedir_template- Check asound.state- Fix exim policy- Allow tmpreadper to read man_t - Allow racoon to bind to all nodes - Fixes for finger print reader- Allow xdm to talk to input device (fingerprint reader) - Allow octave to run as java- Allow login programs to set ioctl on /proc- Allow nsswitch apps to read samba_var_t- Fix maxima- Eliminate rpm_t:fifo_file avcs - Fix dbus path for helper app- Fix service start stop terminal avc's- Allow also to search var_lib - New context for dbus launcher- Allow cupsd_config_t to read/write usb_device_t - Support for finger print reader, - Many fixes for clvmd - dbus starting networkmanager- Fix java and mono to run in xguest account- Fix to add xguest account when inititial install - Allow mono, java, wine to run in userdomains- Allow xserver to search devpts_t - Dontaudit ldconfig output to homedir- Remove hplip_etc_t change back to etc_t.- Allow cron to search nfs and samba homedirs- Allow NetworkManager to dbus chat with yum-updated- Allow xfs to bind to port 7100- Allow newalias/sendmail dac_override - Allow bind to bind to all udp ports- Turn off direct transition- Allow wine to run in system role- Fix java labeling- Define user_home_type as home_type- Allow sendmail to create etc_aliases_t- Allow login programs to read symlinks on homedirs- Update an readd modules- Cleanup spec file- Allow xserver to be started by unconfined process and talk to tty- Upgrade to upstream to grab postgressql changes- Add setransd for mls policy- Add ldconfig_cache_t- Allow sshd to write to proc_t for afs login- Allow xserver access to urand- allow dovecot to search mountpoints- Fix Makefile for building policy modules- Fix dhcpc startup of service- Fix dbus chat to not happen for xguest and guest users- Fix nagios cgi - allow squid to communicate with winbind- Fixes for ldconfig- Update from upstream- Add nasd support- Fix new usb devices and dmfm- Eliminate mount_ntfs_t policy, merge into mount_t- Allow xserver to write to ramfs mounted by rhgb- Add context for dbus machine id- Update with latest changes from upstream- Fix prelink to handle execmod- Add ntpd_key_t to handle secret data- Add anon_inodefs - Allow unpriv user exec pam_exec_t - Fix trigger- Allow cups to use generic usb - fix inetd to be able to run random apps (git)- Add proper contexts for rsyslogd- Fixes for xguest policy- Allow execution of gconf- Fix moilscanner update problem- Begin adding policy to separate setsebool from semanage - Fix xserver.if definition to not break sepolgen.if- Add new devices- Add brctl policy- Fix root login to include system_r- Allow prelink to read kernel sysctls- Default to user_u:system_r:unconfined_t- fix squid - Fix rpm running as uid- Fix syslog declaration- Allow avahi to access inotify - Remove a lot of bogus security_t:filesystem avcs- Remove ifdef strict policy from upstream- Remove ifdef strict to allow user_u to login- Fix for amands - Allow semanage to read pp files - Allow rhgb to read xdm_xserver_tmp- Allow kerberos servers to use ldap for backing store- allow alsactl to read kernel state- More fixes for alsactl - Transition from hal and modutils - Fixes for suspend resume. - insmod domtrans to alsactl - insmod writes to hal log- Allow unconfined_t to transition to NetworkManager_t - Fix netlabel policy- Update to latest from upstream- Update to latest from upstream- Update to latest from upstream- Allow pcscd_t to send itself signals- Fixes for unix_update - Fix logwatch to be able to search all dirs- Upstream bumped the version- Allow consolekit to syslog - Allow ntfs to work with hal- Allow iptables to read etc_runtime_t- MLS Fixes- Fix path of /etc/lvm/cache directory - Fixes for alsactl and pppd_t - Fixes for consolekit- Allow insmod_t to mount kvmfs_t filesystems- Rwho policy - Fixes for consolekit- fixes for fusefs- Fix samba_net to allow it to view samba_var_t- Update to upstream- Fix Sonypic backlight - Allow snmp to look at squid_conf_t- Fixes for pyzor, cyrus, consoletype on everything installs- Fix hald_acl_t to be able to getattr/setattr on usb devices - Dontaudit write to unconfined_pipes for load_policy- Allow bluetooth to read inotifyfs- Fixes for samba domain controller. - Allow ConsoleKit to look at ttys- Fix interface call- Allow syslog-ng to read /var - Allow locate to getattr on all filesystems - nscd needs setcap- Update to upstream- Allow samba to run groupadd- Update to upstream- Allow mdadm to access generic scsi devices- Fix labeling on udev.tbl dirs- Fixes for logwatch- Add fusermount and mount_ntfs policy- Update to upstream - Allow saslauthd to use kerberos keytabs- Fixes for samba_var_t- Allow networkmanager to setpgid - Fixes for hal_acl_t- Remove disable_trans booleans - hald_acl_t needs to talk to nscd- Fix prelink to be able to manage usr dirs.- Allow insmod to launch init scripts- Remove setsebool policy- Fix handling of unlabled_t packets- More of my patches from upstream- Update to latest from upstream - Add fail2ban policy- Update to remove security_t:filesystem getattr problems- Policy for consolekit- Update to latest from upstream- Revert Nemiver change - Set sudo as a corecmd so prelink will work, remove sudoedit mapping, since this will not work, it does not transition. - Allow samba to execute useradd- Upgrade to the latest from upstream- Add sepolgen support - Add bugzilla policy- Fix file context for nemiver- Remove include sym link- Allow mozilla, evolution and thunderbird to read dev_random. Resolves: #227002 - Allow spamd to connect to smtp port Resolves: #227184 - Fixes to make ypxfr work Resolves: #227237- Fix ssh_agent to be marked as an executable - Allow Hal to rw sound device- Fix spamassisin so crond can update spam files - Fixes to allow kpasswd to work - Fixes for bluetooth- Remove some targeted diffs in file context file- Fix squid cachemgr labeling- Add ability to generate webadm_t policy - Lots of new interfaces for httpd - Allow sshd to login as unconfined_t- Continue fixing, additional user domains- Begin adding user confinement to targeted policy- Fixes for prelink, ktalkd, netlabel- Allow prelink when run from rpm to create tmp files Resolves: #221865 - Remove file_context for exportfs Resolves: #221181 - Allow spamassassin to create ~/.spamassissin Resolves: #203290 - Allow ssh access to the krb tickets - Allow sshd to change passwd - Stop newrole -l from working on non securetty Resolves: #200110 - Fixes to run prelink in MLS machine Resolves: #221233 - Allow spamassassin to read var_lib_t dir Resolves: #219234- fix mplayer to work under strict policy - Allow iptables to use nscd Resolves: #220794- Add gconf policy and make it work with strict- Many fixes for strict policy and by extension mls.- Fix to allow ftp to bind to ports > 1024 Resolves: #219349- Allow semanage to exec it self. Label genhomedircon as semanage_exec_t Resolves: #219421 - Allow sysadm_lpr_t to manage other print spool jobs Resolves: #220080- allow automount to setgid Resolves: #219999- Allow cron to polyinstatiate - Fix creation of boot flags Resolves: #207433- Fixes for irqbalance Resolves: #219606- Fix vixie-cron to work on mls Resolves: #207433Resolves: #218978- Allow initrc to create files in /var directories Resolves: #219227- More fixes for MLS Resolves: #181566- More Fixes polyinstatiation Resolves: #216184- More Fixes polyinstatiation - Fix handling of keyrings Resolves: #216184- Fix polyinstatiation - Fix pcscd handling of terminal Resolves: #218149 Resolves: #218350- More fixes for quota Resolves: #212957- ncsd needs to use avahi sockets Resolves: #217640 Resolves: #218014- Allow login programs to polyinstatiate homedirs Resolves: #216184 - Allow quotacheck to create database files Resolves: #212957- Dontaudit appending hal_var_lib files Resolves: #217452 Resolves: #217571 Resolves: #217611 Resolves: #217640 Resolves: #217725- Fix context for helix players file_context #216942- Fix load_policy to be able to mls_write_down so it can talk to the terminal- Fixes for hwclock, clamav, ftp- Move to upstream version which accepted my patches- Fixes for nvidia driver- Allow semanage to signal mcstrans- Update to upstream- Allow modstorage to edit /etc/fstab file- Fix for qemu, /dev/- Fix path to realplayer.bin- Allow xen to connect to xen port- Allow cups to search samba_etc_t directory - Allow xend_t to list auto_mountpoints- Allow xen to search automount- Fix spec of jre files- Fix unconfined access to shadow file- Allow xend to create files in xen_image_t directories- Fixes for /var/lib/hal- Remove ability for sysadm_t to look at audit.log- Fix rpc_port_types - Add aide policy for mls- Merge with upstream- Lots of fixes for ricci- Allow xen to read/write fixed devices with a boolean - Allow apache to search /var/log- Fix policygentool specfile problem. - Allow apache to send signals to it's logging helpers. - Resolves: rhbz#212731- Add perms for swat- Add perms for swat- Allow daemons to dump core files to /- Fixes for ricci- Allow mount.nfs to work- Allow ricci-modstorage to look at lvm_etc_t- Fixes for ricci using saslauthd- Allow mountpoint on home_dir_t and home_t- Update xen to read nfs files- Allow noxattrfs to associate with other noxattrfs- Allow hal to use power_device_t- Allow procemail to look at autofs_t - Allow xen_image_t to work as a fixed device- Refupdate from upstream- Add lots of fixes for mls cups- Lots of fixes for ricci- Fix number of cats- Update to upstream- More iSCSI changes for #209854- Test ISCSI fixes for #209854- allow semodule to rmdir selinux_config_t dir- Fix boot_runtime_t problem on ppc. Should not be creating these files.- Fix context mounts on reboot - Fix ccs creation of directory in /var/log- Update for tallylog- Allow xend to rewrite dhcp conf files - Allow mgetty sys_admin capability- Make xentapctrl work- Don't transition unconfined_t to bootloader_t - Fix label in /dev/xen/blktap- Patch for labeled networking- Fix crond handling for mls- Update to upstream- Remove bluetooth-helper transition - Add selinux_validate for semanage - Require new version of libsemanage- Fix prelink- Fix rhgb- Fix setrans handling on MLS and useradd- Support for fuse - fix vigr- Fix dovecot, amanda - Fix mls- Allow java execheap for itanium- Update with upstream- mls fixes- Update from upstream- More fixes for mls - Revert change on automount transition to mount- Fix cron jobs to run under the correct context- Fixes to make pppd work- Multiple policy fixes - Change max categories to 1023- Fix transition on mcstransd- Add /dev/em8300 defs- Upgrade to upstream- Fix ppp connections from network manager- Add tty access to all domains boolean - Fix gnome-pty-helper context for ia64- Fixed typealias of firstboot_rw_t- Fix location of xel log files - Fix handling of sysadm_r -> rpm_exec_t- Fixes for autofs, lp- Update from upstream- Fixup for test6- Update to upstream- Update to upstream- Fix suspend to disk problems- Lots of fixes for restarting daemons at the console.- Fix audit line - Fix requires line- Upgrade to upstream- Fix install problems- Allow setroubleshoot to getattr on all dirs to gather RPM data- Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform - Fix spec for /dev/adsp- Fix xen tty devices- Fixes for setroubleshoot- Update to upstream- Fixes for stunnel and postgresql - Update from upstream- Update from upstream - More java fixes- Change allow_execstack to default to on, for RHEL5 Beta. This is required because of a Java compiler problem. Hope to turn off for next beta- Misc fixes- More fixes for strict policy- Quiet down anaconda audit messages- Fix setroubleshootd- Update to the latest from upstream- More fixes for xen- Fix anaconda transitions- yet more xen rules- more xen rules- Fixes for Samba- Fixes for xen- Allow setroubleshootd to send mail- Add nagios policy- fixes for setroubleshoot- Added Paul Howarth patch to only load policy packages shipped with this package - Allow pidof from initrc to ptrace higher level domains - Allow firstboot to communicate with hal via dbus- Add policy for /var/run/ldapi- Fix setroubleshoot policy- Fixes for mls use of ssh - named has a new conf file- Fixes to make setroubleshoot work- Cups needs to be able to read domain state off of printer client- add boolean to allow zebra to write config files- setroubleshootd fixes- Allow prelink to read bin_t symlink - allow xfs to read random devices - Change gfs to support xattr- Remove spamassassin_can_network boolean- Update to upstream - Fix lpr domain for mls- Add setroubleshoot policy- Turn off auditallow on setting booleans- Multiple fixes- Update to upstream- Update to upstream - Add new class for kernel key ring- Update to upstream- Update to upstream- Break out selinux-devel package- Add ibmasmfs- Fix policygentool gen_requires- Update from Upstream- Fix spec of realplay- Update to upstream- Fix semanage- Allow useradd to create_home_dir in MLS environment- Update from upstream- Update from upstream- Add oprofilefs- Fix for hplip and Picasus- Update to upstream- Update to upstream- fixes for spamd- fixes for java, openldap and webalizer- Xen fixes- Upgrade to upstream- allow hal to read boot_t files - Upgrade to upstream- allow hal to read boot_t files- Update from upstream- Fixes for amavis- Update from upstream- Allow auditctl to search all directories- Add acquire service for mono.- Turn off allow_execmem boolean - Allow ftp dac_override when allowed to access users homedirs- Clean up spec file - Transition from unconfined_t to prelink_t- Allow execution of cvs command- Update to upstream- Update to upstream- Fix libjvm spec- Update to upstream- Add xm policy - Fix policygentool- Update to upstream - Fix postun to only disable selinux on full removal of the packages- Allow mono to chat with unconfined- Allow procmail to sendmail - Allow nfs to share dosfs- Update to latest from upstream - Allow selinux-policy to be removed and kernel not to crash- Update to latest from upstream - Add James Antill patch for xen - Many fixes for pegasus- Add unconfined_mount_t - Allow privoxy to connect to httpd_cache - fix cups labeleing on /var/cache/cups- Update to latest from upstream- Update to latest from upstream - Allow mono and unconfined to talk to initrc_t dbus objects- Change libraries.fc to stop shlib_t form overriding texrel_shlib_t- Fix samba creating dirs in homedir - Fix NFS so its booleans would work- Allow secadm_t ability to relabel all files - Allow ftp to search xferlog_t directories - Allow mysql to communicate with ldap - Allow rsync to bind to rsync_port_t- Fixed mailman with Postfix #183928 - Allowed semanage to create file_context files. - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t to bind to reserved ports. #149030 - Don't allow devpts_t to be associated with tmp_t. - Allow hald_t to stat all mountpoints. - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts. - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of /etc/mtab. - Changed the file_contexts to not have a regex before the first ^/[a-z]/ whenever possible, makes restorecon slightly faster. - Correct the label of /etc/named.caching-nameserver.conf - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src hit by this. - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed xenstored_t rw access to the xen device node.- More textrel_shlib_t file path fixes - Add ada support- Get auditctl working in MLS policy- Add mono dbus support - Lots of file_context fixes for textrel_shlib_t in FC5 - Turn off execmem auditallow since they are filling log files- Update to upstream- Allow automount and dbus to read cert files- Fix ftp policy - Fix secadm running of auditctl- Update to upstream- Update to upstream- Fix policyhelp- Fix pam_console handling of usb_device - dontaudit logwatch reading /mnt dir- Update to upstream- Get transition rules to create policy.20 at SystemHigh- Allow secadmin to shutdown system - Allow sendmail to exec newalias- MLS Fixes dmidecode needs mls_file_read_up - add ypxfr_t - run init needs access to nscd - udev needs setuid - another xen log file - Dontaudit mount getattr proc_kcore_t- fix buildroot usage (#185391)- Get rid of mount/fsdisk scan of /dev messages - Additional fixes for suspend/resume- Fake make to rebuild enableaudit.pp- Get xen networking running.- Fixes for Xen - enableaudit should not be the same as base.pp - Allow ps to work for all process- more xen policy fixups- more xen fixage (#184393)- Fix blkid specification - Allow postfix to execute mailman_que- Blkid changes - Allow udev access to usb_device_t - Fix post script to create targeted policy config file- Allow lvm tools to create drevice dir- Add Xen support- Fixes for cups - Make cryptosetup work with hal- Load Policy needs translock- Fix cups html interface- Add hal changes suggested by Jeremy - add policyhelp to point at policy html pages- Additional fixes for nvidia and cups- Update to upstream - Merged my latest fixes - Fix cups policy to handle unix domain sockets- NSCD socket is in nscd_var_run_t needs to be able to search dir- Fixes Apache interface file- Fixes for new version of cups- Turn off polyinstatiate util after FC5- Fix problem with privoxy talking to Tor- Turn on polyinstatiation- Don't transition from unconfined_t to fsadm_t- Fix policy update model.- Update to upstream- Fix load_policy to work on MLS - Fix cron_rw_system_pipes for postfix_postdrop_t - Allow audotmount to run showmount- Fix swapon - allow httpd_sys_script_t to be entered via a shell - Allow httpd_sys_script_t to read eventpolfs- Update from upstream- allow cron to read apache files- Fix vpnc policy to work from NetworkManager- Update to upstream - Fix semoudle polcy- Update to upstream - fix sysconfig/selinux link- Add router port for zebra - Add imaze port for spamd - Fixes for amanda and java- Fix bluetooth handling of usb devices - Fix spamd reading of ~/ - fix nvidia spec- Update to upsteam- Add users_extra files- Update to upstream- Add semodule policy- Update from upstream- Fix for spamd to use razor port- Fixes for mcs - Turn on mount and fsadm for unconfined_t- Fixes for the -devel package- Fix for spamd to use ldap- Update to upstream- Update to upstream - Fix rhgb, and other Xorg startups- Update to upstream- Separate out role of secadm for mls- Add inotifyfs handling- Update to upstream - Put back in changes for pup/zen- Many changes for MLS - Turn on strict policy- Update to upstream- Update to upstream - Fixes for booting and logging in on MLS machine- Update to upstream - Turn off execheap execstack for unconfined users - Add mono/wine policy to allow execheap and execstack for them - Add execheap for Xdm policy- Update to upstream - Fixes to fetchmail,- Update to upstream- Fix for procmail/spamassasin - Update to upstream - Add rules to allow rpcd to work with unlabeled_networks.- Update to upstream - Fix ftp Man page- Update to upstream- fix pup transitions (#177262) - fix xen disks (#177599)- Update to upstream- More Fixes for hal and readahead- Fixes for hal and readahead- Update to upstream - Apply- Add wine and fix hal problems- Handle new location of hal scripts- Allow su to read /etc/mtab- Update to upstream- Fix "libsemanage.parse_module_headers: Data did not represent a module." problem- Allow load_policy to read /etc/mtab- Fix dovecot to allow dovecot_auth to look at /tmp- Allow restorecon to read unlabeled_t directories in order to fix labeling.- Add Logwatch policy- Fix /dev/ub[a-z] file context- Fix library specification - Give kudzu execmem privs- Fix hostname in targeted policy- Fix passwd command on mls- Lots of fixes to make mls policy work- Add dri libs to textrel_shlib_t - Add system_r role for java - Add unconfined_exec_t for vncserver - Allow slapd to use kerberos- Add man pages- Add enableaudit.pp- Fix mls policy- Update mls file from old version- Add sids back in - Rebuild with update checkpolicy- Fixes to allow automount to use portmap - Fixes to start kernel in s0-s15:c0.c255- Add java unconfined/execmem policy- Add file context for /var/cvs - Dontaudit webalizer search of homedir- Update from upstream- Clean up spec - range_transition crond to SystemHigh- Fixes for hal - Update to upstream- Turn back on execmem since we need it for java, firefox, ooffice - Allow gpm to stream socket to itself- fix requirements to be on the actual packages so that policy can get created properly at install time- Allow unconfined_t to execmod texrel_shlib_t- Update to upstream - Turn off allow_execmem and allow_execmod booleans - Add tcpd and automount policies- Add two new httpd booleans, turned off by default * httpd_can_network_relay * httpd_can_network_connect_db- Add ghost for policy.20- Update to upstream - Turn off boolean allow_execstack- Change setrans-mls to use new libsetrans - Add default_context rule for xdm- Change Requires to PreReg for requiring of policycoreutils on install- New upstream releaseAdd xdm policyUpdate from upstreamUpdate from upstreamUpdate from upstream- Also trigger to rebuild policy for versions up to 2.0.7.- No longer installing policy.20 file, anaconda handles the building of the app.- Fixes for dovecot and saslauthd- Cleanup pegasus and named - Fix spec file - Fix up passwd changing applications-Update to latest from upstream- Add rules for pegasus and avahi- Start building MLS Policy- Update to upstream- Turn on bash- Initial version/bin/sh  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0122456789:;<=>?@ABCDEFGHIJKLMNOPQR3.13.1-268.el7_9.2    develMakefileexample.fcexample.ifexample.tehtmlNetworkManager.htmlabrt.htmlabrt_dump_oops.htmlabrt_handle_event.htmlabrt_helper.htmlabrt_retrace_coredump.htmlabrt_retrace_worker.htmlabrt_upload_watch.htmlabrt_watch_log.htmlaccountsd.htmlacct.htmladmin_crontab.htmlafs.htmlafs_bosserver.htmlafs_fsserver.htmlafs_kaserver.htmlafs_ptserver.htmlafs_vlserver.htmlaiccu.htmlaide.htmlajaxterm.htmlajaxterm_ssh.htmlalsa.htmlamanda.htmlamanda_recover.htmlamtu.htmlanaconda.htmlanon_sftpd.htmlantivirus.htmlapcupsd.htmlapcupsd_cgi_script.htmlapm.htmlapmd.htmlarpwatch.htmlasterisk.htmlaudisp.htmlaudisp_remote.htmlauditadm.htmlauditadm_screen.htmlauditadm_su.htmlauditadm_sudo.htmlauditctl.htmlauditd.htmlauthconfig.htmlautomount.htmlavahi.htmlawstats.htmlawstats_script.htmlbacula.htmlbacula_admin.htmlbacula_unconfined_script.htmlbcfg2.htmlbitlbee.htmlblkmapd.htmlblktap.htmlblueman.htmlbluetooth.htmlbluetooth_helper.htmlboinc.htmlboinc_project.htmlboltd.htmlbootloader.htmlbrctl.htmlbrltty.htmlbugzilla_script.htmlbumblebee.htmlcachefiles_kernel.htmlcachefilesd.htmlcalamaris.htmlcallweaver.htmlcanna.htmlcardmgr.htmlccs.htmlcdcc.htmlcdrecord.htmlcertmaster.htmlcertmonger.htmlcertmonger_unconfined.htmlcertwatch.htmlcfengine_execd.htmlcfengine_monitord.htmlcfengine_serverd.htmlcgclear.htmlcgconfig.htmlcgdcbxd.htmlcgred.htmlcheckpc.htmlcheckpolicy.htmlchfn.htmlchkpwd.htmlchrome_sandbox.htmlchrome_sandbox_nacl.htmlchronyc.htmlchronyd.htmlchroot_user.htmlcinder_api.htmlcinder_backup.htmlcinder_scheduler.htmlcinder_volume.htmlciped.htmlclogd.htmlcloud_init.htmlcluster.htmlclvmd.htmlcmirrord.htmlcobblerd.htmlcockpit_session.htmlcockpit_ws.htmlcollectd.htmlcollectd_script.htmlcolord.htmlcomsat.htmlcondor_collector.htmlcondor_master.htmlcondor_negotiator.htmlcondor_procd.htmlcondor_schedd.htmlcondor_startd.htmlcondor_startd_ssh.htmlconman.htmlconman_unconfined_script.htmlconsolekit.htmlcontainer.htmlcontainer_auth.htmlcontainer_runtime.htmlcouchdb.htmlcourier_authdaemon.htmlcourier_pcp.htmlcourier_pop.htmlcourier_sqwebmail.htmlcourier_tcpd.htmlcpucontrol.htmlcpufreqselector.htmlcpuplug.htmlcpuspeed.htmlcrack.htmlcrond.htmlcronjob.htmlcrontab.htmlctdbd.htmlcups_pdf.htmlcupsd.htmlcupsd_config.htmlcupsd_lpd.htmlcvs.htmlcvs_script.htmlcyphesis.htmlcyrus.htmldbadm.htmldbadm_sudo.htmldbskkd.htmldcc_client.htmldcc_dbclean.htmldccd.htmldccifd.htmldccm.htmldcerpcd.htmlddclient.htmldeltacloudd.htmldenyhosts.htmldepmod.htmldevicekit.htmldevicekit_disk.htmldevicekit_power.htmldhcpc.htmldhcpd.htmldictd.htmldirsrv.htmldirsrv_snmp.htmldirsrvadmin.htmldirsrvadmin_script.htmldirsrvadmin_unconfined_script.htmldisk_munin_plugin.htmldkim_milter.htmldlm_controld.htmldmesg.htmldmidecode.htmldnsmasq.htmldnssec_trigger.htmldovecot.htmldovecot_auth.htmldovecot_deliver.htmldrbd.htmldspam.htmldspam_script.htmlentropyd.htmleventlogd.htmlevtchnd.htmlexim.htmlfail2ban.htmlfail2ban_client.htmlfcoemon.htmlfenced.htmlfetchmail.htmlfingerd.htmlfirewalld.htmlfirewallgui.htmlfirstboot.htmlfoghorn.htmlfprintd.htmlfreeipmi_bmc_watchdog.htmlfreeipmi_ipmidetectd.htmlfreeipmi_ipmiseld.htmlfreqset.htmlfsadm.htmlfsdaemon.htmlftpd.htmlftpdctl.htmlgames.htmlgames_srv.htmlganesha.htmlgconfd.htmlgconfdefaultsm.htmlgdomap.htmlgeoclue.htmlgetty.htmlgfs_controld.htmlgit_script.htmlgit_session.htmlgit_system.htmlgitosis.htmlglance_api.htmlglance_registry.htmlglance_scrubber.htmlglusterd.htmlgnomesystemmm.htmlgpg.htmlgpg_agent.htmlgpg_helper.htmlgpg_pinentry.htmlgpg_web.htmlgpm.htmlgpsd.htmlgreylist_milter.htmlgroupadd.htmlgroupd.htmlgssd.htmlgssproxy.htmlguest.htmlhaproxy.htmlhddtemp.htmlhostname.htmlhsqldb.htmlhttpd.htmlhttpd_helper.htmlhttpd_passwd.htmlhttpd_php.htmlhttpd_rotatelogs.htmlhttpd_suexec.htmlhttpd_sys_script.htmlhttpd_unconfined_script.htmlhttpd_user_script.htmlhwclock.htmlhwloc_dhwd.htmlhypervkvp.htmlhypervvssd.htmliceauth.htmlicecast.htmlifconfig.htmlindex.htmlinetd.htmlinetd_child.htmlinit.htmlinitrc.htmlinnd.htmlinsmod.htmlinstall.htmliodined.htmliotop.htmlipa_dnskey.htmlipa_helper.htmlipa_otpd.htmlipmievd.htmlipsec.htmlipsec_mgmt.htmliptables.htmlirc.htmlirqbalance.htmlirssi.htmliscsid.htmlisnsd.htmliwhd.htmljabberd.htmljabberd_router.htmljockey.htmljournalctl.htmlkadmind.htmlkdump.htmlkdumpctl.htmlkdumpgui.htmlkeepalived.htmlkeepalived_unconfined_script.htmlkernel.htmlkeyboardd.htmlkeystone.htmlkeystone_cgi_script.htmlkismet.htmlklogd.htmlkmscon.htmlkpatch.htmlkpropd.htmlkrb5kdc.htmlksmtuned.htmlktalkd.htmll2tpd.htmlldconfig.htmllircd.htmllivecd.htmllldpad.htmlload_policy.htmlloadkeys.htmllocal_login.htmllocate.htmllockdev.htmllogadm.htmllogrotate.htmllogrotate_mail.htmllogwatch.htmllogwatch_mail.htmllpd.htmllpr.htmllsassd.htmllsmd.htmllsmd_plugin.htmllttng_sessiond.htmllvm.htmllwiod.htmllwregd.htmllwsmd.htmlmail_munin_plugin.htmlmailman_cgi.htmlmailman_mail.htmlmailman_queue.htmlman2html_script.htmlmandb.htmlmcelog.htmlmdadm.htmlmediawiki_script.htmlmemcached.htmlmencoder.htmlminidlna.htmlminissdpd.htmlmip6d.htmlmirrormanager.htmlmock.htmlmock_build.htmlmodemmanager.htmlmojomojo_script.htmlmon_procd.htmlmon_statd.htmlmongod.htmlmotion.htmlmount.htmlmount_ecryptfs.htmlmozilla.htmlmozilla_plugin.htmlmozilla_plugin_config.htmlmpd.htmlmplayer.htmlmrtg.htmlmscan.htmlmunin.htmlmunin_script.htmlmysqld.htmlmysqld_safe.htmlmysqlmanagerd.htmlmythtv_script.htmlnagios.htmlnagios_admin_plugin.htmlnagios_checkdisk_plugin.htmlnagios_eventhandler_plugin.htmlnagios_mail_plugin.htmlnagios_openshift_plugin.htmlnagios_script.htmlnagios_services_plugin.htmlnagios_system_plugin.htmlnagios_unconfined_plugin.htmlnamed.htmlnamespace_init.htmlncftool.htmlndc.htmlnetlabel_mgmt.htmlnetlogond.htmlnetutils.htmlneutron.htmlnewrole.htmlnfsd.htmlninfod.htmlnmbd.htmlnova.htmlnrpe.htmlnscd.htmlnsd.htmlnsd_crond.htmlnslcd.htmlntop.htmlntpd.htmlnumad.htmlnut_upsd.htmlnut_upsdrvctl.htmlnut_upsmon.htmlnutups_cgi_script.htmlnx_server.htmlnx_server_ssh.htmlobex.htmloddjob.htmloddjob_mkhomedir.htmlopenct.htmlopendnssec.htmlopenhpid.htmlopenshift.htmlopenshift_app.htmlopenshift_cgroup_read.htmlopenshift_cron.htmlopenshift_initrc.htmlopenshift_net_read.htmlopenshift_script.htmlopensm.htmlopenvpn.htmlopenvpn_unconfined_script.htmlopenvswitch.htmlopenwsman.htmloracleasm.htmlosad.htmlpads.htmlpam_console.htmlpam_timestamp.htmlpassenger.htmlpasswd.htmlpcp_pmcd.htmlpcp_pmie.htmlpcp_pmlogger.htmlpcp_pmmgr.htmlpcp_pmproxy.htmlpcp_pmwebd.htmlpcscd.htmlpegasus.htmlpegasus_openlmi_account.htmlpegasus_openlmi_admin.htmlpegasus_openlmi_logicalfile.htmlpegasus_openlmi_services.htmlpegasus_openlmi_storage.htmlpegasus_openlmi_system.htmlpegasus_openlmi_unconfined.htmlpesign.htmlphc2sys.htmlping.htmlpingd.htmlpiranha_fos.htmlpiranha_lvs.htmlpiranha_pulse.htmlpiranha_web.htmlpkcs_slotd.htmlpki_ra.htmlpki_tomcat.htmlpki_tomcat_script.htmlpki_tps.htmlplymouth.htmlplymouthd.htmlpodsleuth.htmlpolicykit.htmlpolicykit_auth.htmlpolicykit_grant.htmlpolicykit_resolve.htmlpolipo.htmlpolipo_session.htmlportmap.htmlportmap_helper.htmlportreserve.htmlpostfix_bounce.htmlpostfix_cleanup.htmlpostfix_local.htmlpostfix_map.htmlpostfix_master.htmlpostfix_pickup.htmlpostfix_pipe.htmlpostfix_postdrop.htmlpostfix_postqueue.htmlpostfix_qmgr.htmlpostfix_showq.htmlpostfix_smtp.htmlpostfix_smtpd.htmlpostfix_virtual.htmlpostgresql.htmlpostgrey.htmlpppd.htmlpptp.htmlprelink.htmlprelink_cron_system.htmlprelude.htmlprelude_audisp.htmlprelude_correlator.htmlprelude_lml.htmlpreupgrade.htmlprewikka_script.htmlprivoxy.htmlprocmail.htmlprosody.htmlpsad.htmlptal.htmlptchown.htmlptp4l.htmlpublicfile.htmlpulseaudio.htmlpuppetagent.htmlpuppetca.htmlpuppetmaster.htmlpwauth.htmlpyicqt.htmlqdiskd.htmlqemu_dm.htmlqmail_clean.htmlqmail_inject.htmlqmail_local.htmlqmail_lspawn.htmlqmail_queue.htmlqmail_remote.htmlqmail_rspawn.htmlqmail_send.htmlqmail_smtpd.htmlqmail_splogger.htmlqmail_start.htmlqmail_tcp_env.htmlqpidd.htmlquota.htmlquota_nld.htmlrabbitmq.htmlracoon.htmlradiusd.htmlradvd.htmlrasdaemon.htmlrdisc.htmlreadahead.htmlrealmd.htmlrealmd_consolehelper.htmlredis.htmlregex_milter.htmlremote_login.htmlrestorecond.htmlrhev_agentd.htmlrhev_agentd_consolehelper.htmlrhgb.htmlrhnsd.htmlrhsmcertd.htmlricci.htmlricci_modcluster.htmlricci_modclusterd.htmlricci_modlog.htmlricci_modrpm.htmlricci_modservice.htmlricci_modstorage.htmlrlogind.htmlrngd.htmlroundup.htmlrpcbind.htmlrpcd.htmlrpm.htmlrpm_script.htmlrshd.htmlrssh.htmlrssh_chroot_helper.htmlrsync.htmlrtas_errd.htmlrtkit_daemon.htmlrun_init.htmlrwho.htmlsamba_net.htmlsamba_unconfined_net.htmlsamba_unconfined_script.htmlsambagui.htmlsandbox.htmlsandbox_min.htmlsandbox_min_client.htmlsandbox_net.htmlsandbox_net_client.htmlsandbox_web.htmlsandbox_web_client.htmlsandbox_x.htmlsandbox_x_client.htmlsandbox_xserver.htmlsanlk_resetd.htmlsanlock.htmlsaslauthd.htmlsbd.htmlsblim_gatherd.htmlsblim_reposd.htmlsblim_sfcbd.htmlsecadm.htmlsecadm_screen.htmlsecadm_su.htmlsecadm_sudo.htmlsectoolm.htmlselinux_munin_plugin.htmlsemanage.htmlsendmail.htmlsensord.htmlsepgsql_ranged_proc.htmlsepgsql_trusted_proc.htmlservices_munin_plugin.htmlsetfiles.htmlsetfiles_mac.htmlsetkey.htmlsetrans.htmlsetroubleshoot_fixit.htmlsetroubleshootd.htmlsetsebool.htmlsftpd.htmlsge_execd.htmlsge_job.htmlsge_job_ssh.htmlsge_shepherd.htmlshorewall.htmlshowmount.htmlslapd.htmlslpd.htmlsmbcontrol.htmlsmbd.htmlsmbmount.htmlsmokeping.htmlsmokeping_cgi_script.htmlsmoltclient.htmlsmsd.htmlsnapperd.htmlsnmpd.htmlsnort.htmlsosreport.htmlsoundd.htmlspamass_milter.htmlspamc.htmlspamd.htmlspamd_update.htmlspc.htmlspeech-dispatcher.htmlsquid.htmlsquid_cron.htmlsquid_script.htmlsrvsvcd.htmlssh.htmlssh_keygen.htmlssh_keysign.htmlsshd.htmlsshd_keygen.htmlsshd_net.htmlsshd_sandbox.htmlsssd.htmlsssd_selinux_manager.htmlstaff.htmlstaff_consolehelper.htmlstaff_dbusd.htmlstaff_gkeyringd.htmlstaff_screen.htmlstaff_seunshare.htmlstaff_ssh_agent.htmlstaff_sudo.htmlstaff_wine.htmlstapserver.htmlstunnel.htmlstyle.csssulogin.htmlsvc_multilog.htmlsvc_run.htmlsvc_start.htmlsvirt.htmlsvirt_kvm_net.htmlsvirt_qemu_net.htmlsvirt_socket.htmlsvirt_tcg.htmlsvnserve.htmlswat.htmlswift.htmlsysadm.htmlsysadm_gkeyringd.htmlsysadm_passwd.htmlsysadm_screen.htmlsysadm_seunshare.htmlsysadm_ssh_agent.htmlsysadm_su.htmlsysadm_sudo.htmlsyslogd.htmlsysstat.htmlsystem_cronjob.htmlsystem_dbusd.htmlsystem_mail.htmlsystem_munin_plugin.htmlsystemd_bootchart.htmlsystemd_hostnamed.htmlsystemd_hwdb.htmlsystemd_initctl.htmlsystemd_localed.htmlsystemd_logger.htmlsystemd_logind.htmlsystemd_machined.htmlsystemd_networkd.htmlsystemd_notify.htmlsystemd_passwd_agent.htmlsystemd_resolved.htmlsystemd_sysctl.htmlsystemd_timedated.htmlsystemd_tmpfiles.htmltangd.htmltargetd.htmltcpd.htmltcsd.htmltelepathy_gabble.htmltelepathy_idle.htmltelepathy_logger.htmltelepathy_mission_control.htmltelepathy_msn.htmltelepathy_salut.htmltelepathy_sofiasip.htmltelepathy_stream_engine.htmltelepathy_sunshine.htmltelnetd.htmltftpd.htmltgtd.htmlthin.htmlthin_aeolus_configserver.htmlthumb.htmltimemaster.htmltlp.htmltmpreaper.htmltomcat.htmltor.htmltraceroute.htmltuned.htmltvtime.htmludev.htmlulogd.htmluml.htmluml_switch.htmlunconfined.htmlunconfined_cronjob.htmlunconfined_dbusd.htmlunconfined_mount.htmlunconfined_munin_plugin.htmlunconfined_sendmail.htmlunconfined_service.htmlupdate_modules.htmlupdfstab.htmlupdpwd.htmlusbmodules.htmlusbmuxd.htmluser.htmluser_dbusd.htmluser_gkeyringd.htmluser_mail.htmluser_screen.htmluser_seunshare.htmluser_ssh_agent.htmluser_wine.htmluseradd.htmlusernetctl.htmlutempter.htmluucpd.htmluuidd.htmluux.htmlvarnishd.htmlvarnishlog.htmlvdagent.htmlvhostmd.htmlvirsh.htmlvirsh_ssh.htmlvirt_bridgehelper.htmlvirt_qemu_ga.htmlvirt_qemu_ga_unconfined.htmlvirt_qmf.htmlvirtd.htmlvirtd_lxc.htmlvirtlogd.htmlvlock.htmlvmtools.htmlvmtools_helper.htmlvmtools_unconfined.htmlvmware.htmlvmware_host.htmlvnstat.htmlvnstatd.htmlvpnc.htmlw3c_validator_script.htmlwatchdog.htmlwatchdog_unconfined.htmlwdmd.htmlwebadm.htmlwebalizer.htmlwebalizer_script.htmlwinbind.htmlwinbind_helper.htmlwine.htmlwireshark.htmlwpa_cli.htmlxauth.htmlxdm.htmlxdm_unconfined.htmlxenconsoled.htmlxend.htmlxenstored.htmlxguest.htmlxguest_dbusd.htmlxguest_gkeyringd.htmlxserver.htmlypbind.htmlyppasswdd.htmlypserv.htmlypxfr.htmlzabbix.htmlzabbix_agent.htmlzabbix_script.htmlzarafa_deliver.htmlzarafa_gateway.htmlzarafa_ical.htmlzarafa_indexer.htmlzarafa_monitor.htmlzarafa_server.htmlzarafa_spooler.htmlzebra.htmlzoneminder.htmlzoneminder_script.htmlzos_remote.htmlincludeMakefileadminadmin.xmlbootloader.ifconsoletype.ifdmesg.ifnetutils.ifsu.ifsudo.ifusermanage.ifappsapps.xmlseunshare.ifbuild.confcontribcontrib.xmlabrt.ifaccountsd.ifacct.ifada.ifafs.ifaiccu.ifaide.ifaisexec.ifajaxterm.ifalsa.ifamanda.ifamavis.ifamtu.ifanaconda.ifantivirus.ifapache.ifapcupsd.ifapm.ifapt.ifarpwatch.ifasterisk.ifauthbind.ifauthconfig.ifautomount.ifavahi.ifawstats.ifbackup.ifbacula.ifbcfg2.ifbind.ifbird.ifbitlbee.ifblkmapd.ifblueman.ifbluetooth.ifboinc.ifboltd.ifbrctl.ifbrltty.ifbugzilla.ifbumblebee.ifcachefilesd.ifcalamaris.ifcallweaver.ifcanna.ifccs.ifcdrecord.ifcertmaster.ifcertmonger.ifcertwatch.ifcfengine.ifcgdcbxd.ifcgroup.ifchrome.ifchronyd.ifcinder.ifcipe.ifclamav.ifclockspeed.ifclogd.ifcloudform.ifcmirrord.ifcobbler.ifcockpit.ifcollectd.ifcolord.ifcomsat.ifcondor.ifconman.ifconsolekit.ifcontainer.ifcorosync.ifcouchdb.ifcourier.ifcpucontrol.ifcpufreqselector.ifcpuplug.ifcron.ifctdb.ifcups.ifcvs.ifcyphesis.ifcyrus.ifdaemontools.ifdante.ifdbadm.ifdbskk.ifdbus.ifdcc.ifddclient.ifddcprobe.ifdenyhosts.ifdevicekit.ifdhcp.ifdictd.ifdirmngr.ifdirsrv-admin.ifdirsrv.ifdistcc.ifdjbdns.ifdkim.ifdmidecode.ifdnsmasq.ifdnssec.ifdnssectrigger.ifdovecot.ifdpkg.ifdrbd.ifdspam.ifentropyd.ifetcd.ifevolution.ifexim.iffail2ban.iffcoe.iffetchmail.iffinger.iffirewalld.iffirewallgui.iffirstboot.iffprintd.iffreeipmi.iffreqset.ifftp.ifgames.ifganesha.ifgatekeeper.ifgdomap.ifgear.ifgeoclue.ifgift.ifgit.ifgitosis.ifglance.ifglusterd.ifgnome.ifgnomeclock.ifgpg.ifgpm.ifgpsd.ifgssproxy.ifguest.ifhadoop.ifhal.ifhddtemp.ifhostapd.ifhowl.ifhsqldb.ifhwloc.ifhypervkvp.ifi18n_input.ificecast.ififplugd.ifimaze.ifinetd.ifinn.ifiodine.ifiotop.ifipa.ifipmievd.ifirc.ifircd.ifirqbalance.ifiscsi.ifisns.ifjabber.ifjava.ifjetty.ifjockey.ifjournalctl.ifkde.ifkdump.ifkdumpgui.ifkeepalived.ifkerberos.ifkerneloops.ifkeyboardd.ifkeystone.ifkismet.ifkmscon.ifkpatch.ifksmtuned.ifktalk.ifkudzu.ifl2tp.ifldap.iflightsquid.iflikewise.iflinuxptp.iflircd.iflivecd.iflldpad.ifloadkeys.iflockdev.iflogrotate.iflogwatch.iflpd.iflsm.iflttng-tools.ifmailman.ifmailscanner.ifman2html.ifmandb.ifmcelog.ifmcollective.ifmediawiki.ifmemcached.ifmilter.ifminidlna.ifminissdpd.ifmip6d.ifmirrormanager.ifmock.ifmodemmanager.ifmojomojo.ifmon_statd.ifmongodb.ifmono.ifmonop.ifmotion.ifmozilla.ifmpd.ifmplayer.ifmrtg.ifmta.ifmunin.ifmysql.ifmythtv.ifnaemon.ifnagios.ifnamespace.ifncftool.ifnessus.ifnetworkmanager.ifninfod.ifnis.ifnova.ifnscd.ifnsd.ifnslcd.ifnsplugin.ifntop.ifntp.ifnumad.ifnut.ifnx.ifoav.ifobex.ifoddjob.ifoident.ifopenca.ifopenct.ifopendnssec.ifopenhpi.ifopenhpid.ifopenshift-origin.ifopenshift.ifopensm.ifopenvpn.ifopenvswitch.ifopenwsman.iforacleasm.ifosad.ifpacemaker.ifpads.ifpassenger.ifpcmcia.ifpcp.ifpcscd.ifpegasus.ifperdition.ifpesign.ifpingd.ifpiranha.ifpkcs.ifpki.ifplymouthd.ifpodsleuth.ifpolicykit.ifpolipo.ifportage.ifportmap.ifportreserve.ifportslave.ifpostfix.ifpostfixpolicyd.ifpostgrey.ifppp.ifprelink.ifprelude.ifprivoxy.ifprocmail.ifprosody.ifpsad.ifptchown.ifpublicfile.ifpulseaudio.ifpuppet.ifpwauth.ifpxe.ifpyzor.ifqemu.ifqmail.ifqpid.ifquantum.ifquota.ifrabbitmq.ifradius.ifradvd.ifraid.ifrasdaemon.ifrazor.ifrdisc.ifreadahead.ifrealmd.ifredis.ifremotelogin.ifresmgr.ifrgmanager.ifrhcs.ifrhev.ifrhgb.ifrhnsd.ifrhsmcertd.ifricci.ifrkhunter.ifrlogin.ifrngd.ifrolekit.ifroundup.ifrpc.ifrpcbind.ifrpm.ifrshd.ifrssh.ifrsync.ifrtas.ifrtkit.ifrwho.ifsamba.ifsambagui.ifsamhain.ifsandbox.ifsandboxX.ifsanlock.ifsasl.ifsbd.ifsblim.ifscreen.ifsectoolm.ifsendmail.ifsensord.ifsetroubleshoot.ifsge.ifshorewall.ifshutdown.ifslocate.ifslpd.ifslrnpull.ifsmartmon.ifsmokeping.ifsmoltclient.ifsmsd.ifsmstools.ifsnapper.ifsnmp.ifsnort.ifsosreport.ifsoundserver.ifspamassassin.ifspeech-dispatcher.ifspeedtouch.ifsquid.ifsssd.ifstapserver.ifstunnel.ifsvnserve.ifswift.ifswift_alias.ifsxid.ifsysstat.iftangd.iftargetd.iftcpd.iftcsd.iftelepathy.iftelnet.iftftp.iftgtd.ifthin.ifthumb.ifthunderbird.iftimidity.iftlp.iftmpreaper.iftomcat.iftor.iftransproxy.iftripwire.iftuned.iftvtime.iftzdata.ifucspitcp.ifulogd.ifuml.ifupdfstab.ifuptime.ifusbmodules.ifusbmuxd.ifuserhelper.ifusernetctl.ifuucp.ifuuidd.ifuwimap.ifvarnishd.ifvbetool.ifvdagent.ifvhostmd.ifvirt.ifvlock.ifvmtools.ifvmware.ifvnstatd.ifvpn.ifw3c.ifwatchdog.ifwdmd.ifwebadm.ifwebalizer.ifwine.ifwireshark.ifwm.ifxen.ifxfs.ifxguest.ifxprint.ifxscreensaver.ifyam.ifzabbix.ifzarafa.ifzebra.ifzoneminder.ifzosremote.ifglobal_booleans.xmlglobal_tunables.xmlkernelkernel.xmlcorecommands.ifcorenetwork.ifdevices.ifdomain.iffiles.iffilesystem.ifkernel.ifmcs.ifmls.ifselinux.ifstorage.ifterminal.ifubac.ifunlabelednet.ifrolesroles.xmlauditadm.iflogadm.ifsecadm.ifstaff.ifsysadm.ifsysadm_secadm.ifunconfineduser.ifunprivuser.ifservicesservices.xmlpostgresql.ifssh.ifxserver.ifsupportall_perms.sptdivert.m4file_patterns.sptipc_patterns.sptloadable_module.sptmisc_macros.sptmisc_patterns.sptmls_mcs_macros.sptobj_perm_sets.sptpolicy.dtdsegenxml.pysegenxml.pycsegenxml.pyoundivert.m4systemsystem.xmlapplication.ifauthlogin.ifclock.iffstools.ifgetty.ifhostname.ifhotplug.ifinit.ifipsec.ifiptables.iflibraries.iflocallogin.iflogging.iflvm.ifmiscfiles.ifmodutils.ifmount.ifnetlabel.ifselinuxutil.ifsetrans.ifsysnetwork.ifsystemd.ifudev.ifunconfined.ifuserdomain.ifpolicy.dtdpolicy.xmlinterface_info/usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/html//usr/share/selinux/devel/include//usr/share/selinux/devel/include/admin//usr/share/selinux/devel/include/apps//usr/share/selinux/devel/include/contrib//usr/share/selinux/devel/include/kernel//usr/share/selinux/devel/include/roles//usr/share/selinux/devel/include/services//usr/share/selinux/devel/include/support//usr/share/selinux/devel/include/system//var/lib/sepolgen/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz9noarch-redhat-linux-gnu  directoryASCII textSE Linux policy interface sourceSE Linux policy module sourceHTML document, ASCII textmakefile script, ASCII textC++ source, ASCII textASCII text, with very long linesASCII text, with no line terminatorsPython script, ASCII text executablepython 2.7 byte-compiledXML 1.0 document, ASCII textcannot open (No such file or directory)?`7zXZ !X ] crt:bLLlo(X8#3r]tMaO>'+'SK@Ot)5$ڝ$F0T~7p@;x$Cxt4`dIeLuD;2zKoQxv]y/z U zD=3~7&5MZ)AW@|(Gg4OΥ?ERڣnun{5ӞxLU1p 15bv]&}keУTݕ eQy+8')mNV6$"V=]Ǚz_Vݳ!3^tE<'}/-9(PPbCtDJ7 RٯEZPL(}j[fANsѓ q|h >|8~?xD;n<؉m)&i'V&9܅P]ӷHyC]BQl`ǃ&ݐ/E:ut0 ,72ݡgCT!+ݳnzWFHt[0lTÒmD9d}{gP32_X';˖(gª7.9BX؆pwGsB<:tMZf9c.c7E 9(-=c%eEpv>}D @܎נ8kV͈uOwZ<ɷxq,i'wskmjwɍƽ{}dƹ[u f&Ypxsr9E5/(*q*-a43kZY-^2cP/Q{RW# U|r1 җ@o@[m=d~QЁ!P'dD\- o@1PAB6BTT[%DרNMt\u\iy Ҳ\}F1ߡ9> 8֠"pi6V W+wEn1)d;Čba`uT+~SS=` !_[Uxdh&AӨA3!vHsG:*`F. ?xWa\=W-ePл$#A,'Fi`aNG0,0&gH8/̄ԺpT (Y'rȡ}I%ChqI4X`2šD7'\ǫc.Cn\ XO$~0(ť>bN:0IDRt J@̶֩MJtғaÊĤYI&lW76d <2[1~t<nHn Iw5UqI# `N+viRmg4:ߺ+#$k ۧ %dJHM6''?,}q)o÷m]spQ(ccmGNh)쬼څvDoBZy$"sHρP:B/)NKm'>Kw0:uR} &Z8rIKgt* R#\َ5#:aSd܇KSE p"ߋ']p=obӖ`)~J\4;gv$S{M]5W=ѲwlXب6Y.w Kz8E-V*YJUMNJuq+ftxXm&hf*:d3j|i6JE^z/bA'׌LҲ;>17SbL- }rqq>>2+v@g&Eu`"ee+i~刳a}-&XvjlMX|vGW!8ɦ= ^sAiW\a&qZi+{5(eDd. iUK,Xʀ}Ç}D%:E C_;X"}t(/rR96=-WtzGj/Rd)n ThZB9k-$.KeEO'rﺝiPA2OHBW6F\p7lpP40ly`$Ҟ o JC4ddEg ~j% >z;W^^t"ڄU2R J~~:S'&XEsk] bɊ?X$jQ 4>d:t Iߺ=C#v=VU*]};#{I+2 PrmZ۵ꇃ@&b(rGrK_0Z Kqntw΄B6Eï{;lSRqIm($i<sl:QߗRN]$C9H|j "QBFuL9EaWyVN|R_'Eρ] v )XdH@mמ<8{HajI_ 4Im!C4.eA9.r}g1^B1( M;.zɇ6DUBHk %1~[HS4 af8 wz k>g<8T3|0Ɇ)o8KHGhHO$2P&FE( >e{`&'@$R[Iŋ|sUO72.O~qo)DN{I05:xqF{:<НJL'a`a@cȃ3^Ԭ ,@Jܷ4>EAH Far^0Eu #3x9Og&v*[;a5ANW,_ ξfB]n:'B1V%FJA֌=I_|Ikw᷒4袚mMc)r8ZV88y5aGCN } PtX*2'ʞQfg]O.'[zA >^06ic]y,2Pb@XN~#Q{ M]W6K/*2Ӗ&Lw\ `]A.sEgy]/*}PKb/+7 m?`}ZFnHaX?Iߎ\{aV܉ -#|q6-]zBo@(W27ih_NH͗]y Υc#M,՜<ᒗbh&71u#_č,[mS1!!|06-nS"j;AY_2iQP,WJbD NZe[YC{iR6x+DZپMBJo{8JCwW.6V5>͕y#v ;PDVya{:h`; e67c zY2(VZ|EtLhryZfz5+}XwSiV[% PXt\z5Td}kLobP޹R#n~VS5v3I6?~H~$ cp67é}=h:%tOB) ͋QZ=aDʍes igt,9StO SRqesvbCB7zD.ҧ:>=&r f꒮,֝g@60`_|-g⛨ٛh٫C+2:Cd5EzR$ڻOMvb?Yh!5F݃JvEw0l&rfϰC*~$y/(@|̎kk5M7%|c @ 6{S`硟%rW7SriC971HŊ6 iM "d >=Boc|ujb QXe~I^7^̮4 ث6UJH ;JYC9ٲN:|DJuGuJt#nW ~1QjK۰5~*mq T$.kX!+ik#Z,XQl7>V#`%r@ͫwh cBjA38ĶD3s>u~yV`K5i+6^X%u3 NM~#ftƥ\<[0. "'*Y"z ok RTScT"a_iv vlOp)*0T0Tӈ⿻OF]˭k%Ik5T rs;N:`ւ̉\zIB:R{|.<6nloy Ez~3De %? ´ iW30ue18VBq]]In$6 GIBA/ʑb`^ɀ m(c'oU˗C6[zQA6"^Kڦ5J}ŒG:Z.);ό p)^d,ZWK[+PїGOJp'g P|V R"X %fN[i÷lHƒu%P+U2M!R~!^N7e?wP؆vn*tݳ@JG%(+ BѓdB@EjfJXo/=_cȨ^_a d7pcWYryl1A`i9zeFm QY׮v!ӒqbNC H'_REJW9/#tѾ$~;V>23 nGM̹C {f' ߉fCg)gL2j+kV|$FxH#HXA;m,tjX8+HjML{fs+2b u~<4z;wOr7h]fq۹џ'5UI&S 6A(QT- )B1܃F"[hގ*Y7@r}\780ۆYO.E1t$j)ߺEWwEьxI[]>6-wF&bQiFUDIԐ2+ѐIIX=#FzP[xK~lPI3=5b恁v\/ϽRR6uv{ ě'NB;lv8@_NO_̄dX6DX~~{o AZXWiB~M>|FA-!g2O5i~G^)o\b\<2pݨU\=? I= :_&sk]zp~& f=MūxQ48oOϯu.We%ѷf;5i٧Q1Rat:"6 (y۬#[M[+pff*/(Qhǔ$p!bgnT֕ߪ25V%MukHu!_өclMax&9 9;كC'1}o c4sSZ l.Ì'1'QDk%x6݉8wX=*g-Z/R$40ͣy]r ]"G~s 7_5]ja ]6.{\f y5eYc/v%/)gJ6{%js[DZEQD e[I~ Qy s8 9aW'/A!΋sq+LuWF/m 8GP56Tt!>09A2FN Wv,bIQj9\rHRי䛜Uˏ {Qb%Rz[x8:m#5dk ,ם -aՁ7怟w:Ojޝ#ΥIKam9^F Ӷ7.7%n죈>@ryf,qǑ vP؊34mXj_A$D6a-6y6/%쭲(!Uo1 o.v+Q]'.mП+G &P)lq9b"O7,lު;䨁GNX Vg $ /F'/,m{\DY7/pU4OR<KaK"J~V޴ۧvMg;?_f׷Ђj34{tg-W@f[ٷ#-E9 +ܣEncs|#'ڲ9UnzԳX)`v?BVa =w"8[h S+FkP,a~smm̃J}ݤ ham|eQ٦\%TCND=ܬ+o}@y$[,HIw77uo<HCDZQ73U\͉9BlDF"D䘧[YYS7ES-H&f޴ tjίf`(=NCa[?(d2;nL~͚ W qWd[&%洎yimu/vj.{/ BR#G;k49JQ5,Yajm p84]ּAkOA\iY9PBY(sr9!*[~Lځ +79A<{bMb1(]nouǣz&.wգU`1͹^dě pn奀[;874yCTdwÝV 7j )a)'&cDpZ65=CTԇ`AUS۟T KOzL0nHk?|[;d A2kD{[Aa9ѝ΄ʱQjhwsYA)g K%me*#-}kP4BdFCJtީ@Y2'¥8GRGetd|0p[/qSz[O_b6ERhT a$V?=ZLp2ݣ@H>C ~ヨO/%۹-rf?`꒎I<gmLc+Z!X0ɥ{7hf_l,yJBU2"{j־Rp9փz08 %f#dP6E# ARd{+?BWOh !ab@Ef%tLm1f0g WN8~? 7G(}[:j>DCt0Eo2'C5Pt%p:c'=-$o,SᩄR+-U)fbZrnFi]9hJ3}9AiOwܱ :ZwE^^lW`nt p86ULZ"XW{򏺑QhE-a=㏏8g?"ɣ@n+mr=l2w"}褠ـ]ηHKUfVrSvDh1-gHh% %ǽ&2BaHc3k (ȿݓ 0 `^~c}@O>bdWg ?ٟs+ D6t6MoD"NDjt5!LO`D6QB|`Oa5AgYp.//JUwRǜR>{w_H89& wPXJ8Ggn ucF{oJzRuMj_DtZ9؃SUeܥbW낷[/KBv)F;spgމ R_פ :;PHH{αb*m)29I3ٗMJZG`A6p+Fm~,[!>^ pAնc%o]Zc `ͩlBKN^\|yjrFsfKړ3~eSnQJ5@r;WϘEzWly5`"m}-d+#\U){2W {B̞ſJ]$Hk뿻73psW02[ќaԼG{pwz%Le 8, ,~tWkj[cqGp,Bs}fZV#*x VߧNac>ɾjvYp/EWϿCRtQ f7ϗKp=2QNP *ukt ?oԲcM;.Q_EXҊhiY W;nǯl&Β!w_rMMivl pdvM`^ZL~) ~b"xrgMlQ!|z>t1d54'z2EYZ3 TR#?(£MeSOԣb z? My'w hPAa|E]VѠwLl @D%fفJ voj| %^0L?~PiBN)akv-r IF=6E ~Wg|\ 5 x1VDo$n-ቝKTj{G5(MdCQCpK[R>=3͓>E'G'Te,X| GFM`ˈ9 ]z`fZIXЄMLCeRK%h93*"(kwWҡGފߒAQȐDW/N5IRQ黙4vߙVwz[0:tͻd_q>;ۊ@"Jx Wg@QF4Tѽ$K2wpLR.'OS^/8pa:O~fg-ISCq8ScSt$dbͣE,n|@h3ri_ wLʑ yxgcc) rǕ< jˆǼHGm:f\d*/0C( 6HwpuMbG?j.ϲp7h f*0>P}w75 G *S&H"T"p;lsnI+UΊy Iؾ\r} !hF#B仍wmӄ0V 3xzmc3j.MY3g6Vh@pyaAD(aσ;BK64 ΄yt #/kc'-AaS#9rb7q2e_B `~1e(FΦLߧ޾{XxIE9zhv'ί 'cM#9,Q2n9ʣ(w2fUIQ.sZq["~w[Mn2Au9 BբgeV% IJ*HK ־Osժ[=ܯkP,(VIQ6T"u /IH%pאPbnFTF~Tך6Wg=u#k}ƮvTo؅Ê8 bn~Qʭp *VCF@R6p ^K~H IRnBf!H $/ũ^:&![:崆}pY N-F~)p)07P Dbۻ;i֤IYKՁTX,jQ 3/ax:Mh)/6ڋ'6I%A7T1 E/4Fi15 LK%ƜѼ-aye'Qx3E`!64\ڟ׋ws~[lq#> u-jb C ?f 3 ɐu ?[[ovPXU O8v[?c^ 69M=߶gk vzu5U+$_NfE2ϚFFޛ_8!Z4Q!ye14|,ߒ-Ms_oܣݻ}SY Ra5ȋ| y8E]. ."[[%##ze:M|*eczzoξi撤iuK={I: ϊ_={ n9p髿8ȥOHq $Xp QVOదouŸun˻u5{ Ẍ'xyn5-ᚌK..8۔:P0ʢ܉BX7ӯS`\0S,Ԍ*-NjN ;7H5d^V\SN/iHK|%A``d.ٜI7Cݳ[^^c/o%0!}ޖB^=eb6 X8oJdEÓCCSTJޛ]oo yw>BsGʦF APw &̻⁹*Jh«#GBs8.lݽ] "NE@#;: yɸ̘h' \e? Wbs/vCu!<Y#]Ve6jw\cz?D"O[U Ɗ kP-x-6$Pg Ѵl-7UshA? +GQqTY;o~B(+Om!xOS/,\{)8k7̖..U@" \n;4¸kRxy?!=ysc"q[[Z0˸ozɛͼS$$i)[+_\bolfxÉ!H%7OuJ_y7ox3!?[P7cQ$oe{!81&߰db M) 1j.ލ&3wO*/S v!bbnA]38K%K眹#{1G8@T[+( G4ȲS{ї1 hj)Ny"#kQ/ԕ'M+ql{ I{HqyA uId;4n#UQ|dHYD@zO0ީCUT*QԻ g0e (q (XvStd&36)(:s9PNHX@}I/xXoa1@r%/~S ekbO̹( ,=g݇.\S HLzz "O-h|@\&̵.Dɹl4nU8q;Yja-aC pEG9ra ;N(͇k$w4F7"IZ+9O(`Ev㉁3#Gn4K`I1zbE4 /b_ÀB0,D -MDBP@:%hʾgEGts>ai8# c>B Պ*+{\T$y:韔DO5fY8#D{iQ&!AZ)F,Hch*/GmM>+Wpw 6}EV턕jGz]Sw@IԹuiGx{hK2V9C؉#gVs.;7n\bi^@NoPp4R\?fCۜRMwدyVOL{H I#P<:zpdاx #'ff[ÿB59:PW׽ٲlvXl< `:L,D<ۍ=Pp3~҅߂49 Vʩ l 0lgښ罐|s9wxP{ғX_D@ϯܽV1)<ľg,g$ccJu[QsԢqřOVʟɯ펌7&˩}_ŧ T'ٌꆎ5a!D.Qs%%7yd >ތx@Ѭ$.[2N~ή7nUCy)Fy lt'+cp#>JXr`cd足bJGK;d4uaeG_-U{d@L V#D[b]U8M聶oRgc*Jڙ#KAmk~^`l+L ,rdQ l}!B|> fMPi09Ӳ<օJTc;׼~F^,/OrwBBk>Qͳx]쟐pmk[zYnP+cu# 3~~əqme_P])vJJpi_>T:{NLJ1Z5Pǡ6؝LAeIMаKh-GgŖy}Άw8^R'>%צ1?QRIHJ,My7bT^fz .XC0w%PM3llM#( ©.P} 3ꗊ: }sl:S|bE5N-V1R>0^@X5Dt@ _U;MuS'v.F[9͐2ON6q,MIF;s\ ch/ID7OѸb^ׯه;܆+D8k!O B%{ѻw@{,uAVȹ,.A6JZ/li~:J;ՙnQ}u*aB rjK4(Hn=OqMdtG Av7{Pm¾WeT % 6$E{JrYd&Jp1p N w)0{τ99ۓs kFR `Q6vV5X7+d*Љ) b0Yg=qɄc S~e|k!_k7ژ&e"81#a xW%cIO?Z\wGޯ*kzq Ao|wK]v;d>aG4lDfrK4oȻTȜ5tQlj﭂Iek cICiyM=ny.˙xVZqo %/@=/. P(`9|$L?8,Vq  4%h$??4mCQz>qY ?o:<9#^587G4{/i}mnAƴ0> X{ov׫.@Hw2ᖨ\Ѵo zGz&O6f݊m}"6 Wc֕֜Mʕ<6~#/,Sa?.(  #X:!^` ۉ 7c bx}fapiU2 J d"+4,,WǮ1Z2c$ogf+lHՠ=m/Q]pI՘ӆ7< j)*79be+}$\Ou˻7wd*1P]*c} a:y Lf./gl\{ 43@\i"mj RQ5z1ʷwKS^STуRM-yNt!Hu(͊1~1ܞH(h[򻢾PV_ސFI]+-5~b|[dTp*fmv-(3o_NAܖ[Zzx,d4oG8Hf(FtE!8H,U!U,BBE!&:(w P$Xҍw' `zb{҂p?raQ-J4o0]x@N7A2Ua!r$<MDHA|^æ t#m 񷠀j~avG]QSĊQCkW}j^{ctoHk殾/ۜ5&wH ;F@0>j^19}aщ")mR .UEaYA,m>GzCJ)1{Z竸֯Ű: aP8쓇WOvYM ^P 73KjSl5QjӺU jrAk~hB|=|i GpZ̷OgH MY7G~wZP=)S*Hx+a.5 TAzPp_K[b-Σ6 0tA)317i Í PJ}tJ^{^^>jqaT+,%Z=E.ULl[V;Rz~uE({Wfޜ:1N\\v6WDyC W|gkSb=Bؔ()jVx/@D:ڠ.7Dr&p)&2 T$-hG}d4|MOf)gjMUI&|+6RV *YZ*S<Qf*f_BBL�E!qbblKH:RA^` oxo/DM|NYút%YTE.Qw)?Wk9x!='h ̶L^9(켩O5::ʺ02N_ʤ]-/HauO Asuc6q ޏ%-jByD z擥J=.m01+ycgs 0!*AXJ[Y?/gI OwMsZ2}[Mlej = - -X Vo2@]Fh%ǣQ8qxoSmDziYq rI!DȦP q{+0K5+9X/dA a$tO6P_lc~39 K ,ڧ20MxIl)4aC`bȽ±51c7 G6[ -c°S/zEc2 2{D`%q+@z :\L䐀1amP эC%1ǔ]j"yELfXӤGz-3]a#ZQ Q^iqav# uI+-nl|֭L6`BiuE&rmEKExAQҖ5F\|H 9@TB22%p&G&U7R*z]ٶ:g=D|d,ٱ킸~(vVx}RT[ 2 ,.ТEezSo~;q+9c 4Ȍ]g<86$=>]ggӇ{f죯Ɛ8#k;Җ=@Ck:r{=+*AcUU0[T|y<(Cmo3vEf.P@/z˅ rtH<;'T6QWHU9 7soС¦P9.$ a' ˏk yr?_Ewd*Q7I`(+Xf @am:fZ ~0Ql~ө.2^ i|"^Xw -Yn'nT$uY\ 퓀g7BO!]5EF4b&&)3W**JH:o*1)-Qsc9/rYkrz鳂v1%4.(}IBizø[7By25= W= _kkQ!Mu q"HDbUR&jBŽD®)'CUiXkq> "`l} Sx-ֵуI'}4'ߦwUcvszGT:T/pAh;U˲ ͗@`Ls­f*۽*u+˃(!X$pI?ƥK^6=AN]r UdqPElynF'NzVC<4D,=OzjG\&e;ޭ( @WX9a5?{8O+rv?Y%I.&N kV)G~+k*-7 <,}Eqiu#Ob"ybP>L:ie1b7rhhd%Ƿ U:^xKoW9ͼlfz |U`2Bq<8jݬ\e]KoWۀ2+{FoO)F[0ʄޛn'gosTJs߱&ԐH˳YZ BQ-bP'wON'C1/Ok Yu4ݭ\ ^%lo'9 ¬,C Ċ{Jbq^G1:/ Ȟ~l@n+㸃Ogk}!+ܲ4D'f Zo޼52婨ry>OVY[xZ5P/Ka ZB, k:rK{%eTdݢŽr$~4pGl7Yc8S"67_jތuI <#!HR3%nI#xv  (52_d gGgqSL(zv얒@m|Kn~#Qens6>t XX;*yG65*zБ̵+ΘRҵg˺sفfݨMO*hƥư.xo+]ݡ!:0h|Zo5 GN|ۏ;o|[Y#C'|wMX͙=P&jb'uゥ5zp }92C8f $+n#)\r?43H gt#owjJ9]QBɢNcJ@y A_Qhc@p3>{)/o۱(}]dWsz44G}]qh!gǖ!cD׆;\ɜ.jֱ qggC ^ +ǞǤqAOiD*l]xMy1Bˍ̺׎3`]xA&s@)Vu'\+7f%1i6MӬ4)-*`Wt2 F)f=%|ӯ^|UQ+kFp~-Hh k8 E@t"b]0{(ܩv.u/U [Q +R06\se >֞~hGN X:PB7k>bxczj4-P ,&>oӰutk'X[/q3ުTe_)kMMz ֩2;,TNOOq)Ʃr^_=%Yxluy꬜#r@A̴;ZX'XO9D6{ @/&ץ2g9\ODT?džUYer* ^ah _ܔ|_mAb8FLFtp1mӮ| p󙬐z\|Fܖ1푓+:¾ZM^Rm_?ˬ£*T"l%"-1g^@ +މBkWsBJn+9Ps0)9{|f\n{<5 n%S1-{^RO9wNمpb2?(ۛ?_FvVJ@=5 9D='doQ7htNۂV&E ܾ TV՟:rL1a͡sp{EJi)n'ͫ)T@Byj uݫq2ekuAVʧ̊کjy[G] yK5?2D#x#sZW^8dm=ծlN~l ׈[>=S잍L^jD8i{&5ХwcFv|r$QxSŭIKb|K0+x}B71]40k1 oC$!-g0ډ$/^/'E2#-Ss vidiW4q軤":۪ן>PK5=.:?H%g^QI蠭,N}Xߓ]F;yZ"n\8:4Z%3.M7ljh@x&ӂ|?G'.!d˝GN9k+9/_dJ֚RhI::ǮL䋪8`BVtt <^~`l/Nuں>[C Qb̐Q m&I`g$67g8̮{hݻ:[F!Ǻ=o-SaNDJ;Y&hfQPLhloF$wVۚ տn 8swqm`3^|wXCf.:\kUS6? 3n1DGahQ؋|-H2$Fd#/&I4 dBبv& ٫t:F+F̉wG?zrK:c[XZjZ^kP5a.Sn:5"GbOקyKiR %ReL{2f-LSZ,QڇtwQίAm7Qp, M0󉥳iu"Q3W 3]mgFZƏ'n+ ,-+Trv1Pyݞ\;vf*%bezU6d 84 ;aQ0)MJxꚭ$-ӤGjfn;i[+?}f %0 EXPF>-Yez!D5p5έrKTX04ySG !ڋ8ƿO E 9Ui͓ja3QкXI5jz7۳Cx3^F $"emY0V/-"tVj; ]/ K(JV=IM]>|:wbw'oH)6bye "Zrm:'~< NY8Ի9pu>B(#ֽ<1o´;NaB.F>ޅ+=d~ΘHdFC͓}>eYTɝ?ýzwSV o A}tP< IiSM7|V'HXI'd/b;c>2+)HUXjݶ3;Ag,ױ1\BeEaROU2bANžC6ZW]H8)~j zߜ2)M52ZS{5UtA{}7AZrB5r祧d^ !S6!CόB̾}X XDkQ~b22$'!' eC/Ce㪎P>.|@eX%1l=eɟ33txE w@ΟĤ(^ raߒa94wB52[ y{f'lT$$ YS%kuT 8>M"dNQlzibNzv^F@8cଆњ ͚z'IA'2&z80Wr唪X,K;-lzfح٣! T;J(8*r<˄wtWHz#5DghěJ1uHK1rS +IP1ė(1Id{MFsC \o,beJ0SqE]d7i~'pHۖj!O?:X1(ZG_&s,%@ v mKVK;&9 `^,SҨ_N2i=;4 {ݩ5-h٧#ZP,.i})V^AFbqPMLpxKD6O{j&TQ(CZ77Vƍ_lӝe223Bg܊ʞ'Wzқ;ZUTG ngǽ&`ם"ts%gav_4 έ]0=běcJKy93CJVHoyZ(µ9Ӑ8nz6"sM9ʯd0[@W_\O'MCb[ %)H"l2ov_G)kh7G.Yhc%!6^wØF&3tB֤D5C04.>Bˤ]L U-c.*N K9RcP`H3AHBQݙU WPE-u3q?JOfTWmIÉOz[XWŸZK"RKƭDF-0za 2 Z§OWVOGav<|[d뢓3cJbݞh@׍3FtϥO[H2]R+ɥճ>h'z!7Qq0ws!`b| lY(*=ޱZu}`Y'SS+̧)̣I.uL?x& ňai :hEq&d])#[]g#hmLohTe / Yk;=}[Hǜ\*Uǥ! L})E86߻a /BYtSAbzHtbp;$'ȾH* _k6k! 0f<}% mw.BʢV~aUAm5xbx#1:V';bp;ݝ#~~LXDYİif&+8Vd]x^T0 w'qmM{z#ry-ōHӺ, O8bə)o>'hŀ +0:ߞ5W _3BdU1{ɛ݌i3R%QښS{c^܅j8K~Ah<+|H@PZfՅPà k3FVԨYCkȜ f?N`PEe⠇ %}M#ef-fb`ߚ$jW(Zp#}_Xu@Ϲ^\&,8.׎(~q jl6>t08PG]=khhP5cءqf<'q0- \e'wK[ ;yoj=NҼ6qlvq$GKI%sziomɿ˾( Jvd[Y}:[HLYYsRPu,JXQ?Eڗy4K3" nt6y픱q S~ Ds-83\eQ0E% çW`Py1 ;!+(GJ^IgO~cy[APT1kd|aojX&87 4!Y 87a̗۷[!} 9U]YJZhzCSC0K|TO[B .ƫW^DEJ.(Ш-p/V l͑N.6p7jhLx$ts*ԤMtg:=GIc=hH> r_IF# (< ,!c\,Kzu,^ NJo0 :~E'kO6E 4@rIƾnD$R2VQCDg+H%4Ȩk Q0BN>--nXf: C΀正764:h2ǩ+c^&v= }v^v^6eMƧ 2,lQ{"GôHJ U˝fAcې&YYEbDndxCFI|TW7(*-'<?)4A N>_$C_M>Fcz{ @gvsnZ^>d&9-Y20 7U;tw1EϜUAaЌ }P'lO} 訲85/Uf&w~Tf=" 4 u>UǢxH|#?:|2PA.#'%oG0@A?"#( 9 <Т"ΑC|N+{RZWz d3`՛~_KTYnh4zaDc`_'%eeP P8Dbs Cr_sxz3苓Cwznpag#"EǍ#TL'PvgkD#قQp G.N2~XIEGx3sZT-ލR@&ν*ꜪmE +ǪTXS;8%fXYvjIM̮"2!C|P?3si,SEb䥤2Rs E{ loQLGͅDڛOK: M4;6Vat>6oVduc"R'yA"҇r Q9qXI}`3y/w"W6}u}aQ6/7'roT-gTK@& ``WVkujAZEe0nna=)[v2 o2֏dAa^I~jC-jTTc]kٚ qEu =_.)L,A*5f]epV04 \ɪ)D'踩?ݛJp=mܟJ@3tv ^_͒*Ip1Z+P#xHǢV[VLb-Plߋ8IH.JMWzVE)> KvtDM{ ǣry)֥y^t*CV?i n¦* 0 NDUg &>28C_@ 5NmW_nMM ^.[q89L1%L U3" Ϡ a 4;6E%O5A ԭ^y}Tm*$ vqH͋_gQ`ͪO $9镋&\=28P/*FC]}?5b{P`I`]KV j9 w+]Gd|&.<txl"~2(F5!M^`^_ٿ߸+4$A %y;qN3oρce}*׬]GՕk{! O@so#bc\R!|b7UyU'lo,80lP U:r:yI/M5)s@$\6֔Sc71+(9CmOR8U~kXz|^Z@T: `rrY4Tͭ%vF>D͸ULW."E.sA!*s؃_Foj4b!8WRn-,†DOd8? `'֚IZlZb?5 fv@c3S4<ܼo9PLn΅E+e@+p>" `b䂸Gl`C GjM@|juc8BrPY}^©継j.vG/?`\k?*w+|7݊WK.j=4]cxf |aZ֒a*NmlW:ƁXmW}.ae>«H%HG|o,57$VˏMRvSwRPkFN]ƗĮm0%Q)]w6Cë, 02pl$VΡ0cG%%Lm)FF8,_H MI9J1Kl \aHnʯ(pWA<fy^JKpT3p0 pn`1}߲BIka tH'_X$WQj<5lbHF6GK."wu-D`ܥ gSjjN4vgln3h̭R-ɑW)8E&H $N&Hſn0X^ n)Sܐii'%@܉@H5~$iW8HV!Z <[J 48JMLJ7[C#Fk 3x5+f r-J"3H;b~>ot6`e&רǜjo{N{K-ffcT['YPx6u+IVLc}L t}MCp1G`}%}vqxh$zA'giJng(F>t0 H3 Jum(& Lt /ND4O?SFV_K +© 夀㶺7Ƿ+ؙXĖ㊘rme 1?. +lA|U5@UUMxAz{%9Đ p<0 bh)CVIj>c.OZL;]t&6m mXJ-o>?mQנA>ld2QPmq9Nqe )=E/l($t-UԿ? FmCӀe2Ah3'aq 3) _rmg[ӊks!<:qbq?B#?YBpȾ8`ǿ/Zc%}U`17`?ɿZgԡOǸhoR#!. _1>`-ZrҟDNDF?qSI mF>0,&]5 wWԿXw0#߽[rS׸o5Fڿj h'eG YQMnk[OQ%؋f$kDO\B>7E'g'""D? .XkOֶ"4>tJ-"A} rNhX)@T [P݀bx9l;d6qA{3LV4Z~8:Y88dǁ&g6٦j0qWujT\oXiG].$Wd#9.Q'*5+RK {I"(k<+TrqVr:R`zNx<1 Ϯt,r"Ian0>\.O~"Mo:O$׊,iN^cźU92$@bL.h`2åشԉZdzgb7л[&Λے=# |PA&gbApQ*NK"lU?K<X#)lg_P:C5CyNkГEE4|g&D= s~FKH@AnWcJ SOyj3WY8R."Cl.H#U7d*GN"0}gU*ٓLZp:18 ,b=(ԈpN2wwCI eJ nnUֳ=5IW&DiXWK7~}2'J-~Po:{LYuhS$ #)SfDq+&= Ogs̶%Ї|֞԰#׫ZT'D<́nѵ=Dtmp/d2!Y |h(E[RW97{n/Iѡ)O͛!!d 3i8@^ȅ J)W{ty@?<Â*W!fG(YOޥ#D^:7;[VgcX2/7z%9_!Û xVƠVs*4uvХ\JZQU8\WͲAk4X ƪ٧|15yR03 ;yJH~+Wo0{¸,.uoݑ9k 񝵻pI7F7Ɩ 5||`0Aw=J b3ݣ793 @d )jʯe]e"L*'C3:7R:QhuchS1/R 9=2)"/9 NPERDOkf=H9=ijqHUkx)i1#h\r`t³* EA2>riG\\# jM(aa; ^(t$SzGD͍t?e{۷Ͷ뫒Cu&u;I= o}E-0+p釉l WB' :7vI = cTbJ(hJÂ>8*1[[ݜq~m v|=E ZZ[kf NZE1J; TgWu}:^|3<6. ]ΖI1eUFb1^Jk'cHLFgTNt FzdW r\m ʂ>8q?? PΊ~Ckࠨ-1X0ubs3?#$f GI mEemXGߜ[{{*lQ1vԢәP!.o-M,݈:l} 黆W^t} P 2=zgpX'=7pbk2ezsTMmRf42k#XB3TQdGe`#*fXWH2-(Aϭ idb3QcS04^Ku^Oc~/YZ3!_#js9yT(&\}j2=5XO ^G*;%PI1^y_zacYȔIܼv/[+R[{k=9- Afq#7j?oR+sj'`@S|7@h"tb8 Cڶ} g1/{` Xm+É4co|E4?q[2T" 5>z͘tx98 ALF! >ab@[{6矖tN]L週t` #pafF0M#=Rh*3SݥЉ!˿ikIB;:>} h^Sh=&"KW$ێA֏ij= Q-u05 +S>$mK`ޘH 4X_WhշطJYw&΍<*&1a5;fy糤!Avѫ \jeUG[ǂUz&(ESN51 ?jՄ,ĺ4D/lZWƁ}.%PVSذ+>6#&wrM\j?kL}3H`̣^Z~'W}bhJ#:l,/B&q~ߐ$Z&0?c=;2l+:^*p&_`vV ͏#eoIՕ5{|0'/m-_:AUALp)w9'K#MɊkg92\C?GULi=1Iv8VyAJ,TځW% p4-voq_=lI!6m'|Y]{g'PYxUm?BФK-! ͓00\3齶+`zķ|d̶(9cB~INCy7̸ >W0sѣV|X):f4>߬[)WE/ šy~D(9[@xubS;KR\ӸXU;[Av3:bz2x|\=[COUQzoնXh>P׶^`?m^߶ 4U,Uc*ڋA㡧L gpjDTdYT+*6yk8.4h0@x5aAd#l4ނZO=e珏 6b.Kl}Rdm!O|Ch}nejXǚrÁBkvx5 A3Ӝ苧WvS=].qdebg pd>ӓ'[~.!oP"Q~ K.Aڣ$]m/뾤ݍ >dsb t!xKj񥔔^&Jsep/FwdrO"Ҙ_;!a&ƭppG3W7óijS3OBDG@w0"PW⵭Kۣ@DhA[\ey85%1?7xRj~lN'PPԤކR"ۓ]`V2r$axUVFYUb2]xG+xjߟ,F_"^tp(PyY(x5Ityp%t'Ywl1,VS,mvkt=5==@{ !! :ˮ-\71 "&=>/t)>c N봪͢ssMCċn2+VwGҞF&30EU]F -Pp`}>)o9wbdFjl}ܥ 7*Kqt 8)gX]nJ2<:8P  q+섮-(4AH`jL%n{\VJDݫ^AJm:s?NqKY(԰GUuuҺԢt yt/KR-pSfȭ0mT2g%" |{Ubl=싌8.ώiy7!63g9/XkS>.DCO/ydᜨӋP;'}*sz/_F('u]{r) l|ֆlbL$ypsDS |8o=%(/@IdcU7S]Ԑ ޔeߩ"KhQgB׃uii[ AZ*\UN9U2oh&~c2>ɢDE 4]Nj7BB`j4ZVn/ǝ_uT\/kGh_3+1-#\-ehB*Aupe5DHub;7_[૦yyp{?y;8 v#-f*sx)Я7+(7]ݾ Q Kݷ24?ga8޷Qk^ SQ\0^VI<}ʡf㯍'̘rqRX, HCwt|+'KqxiPPmF [Cg`f7/I$1,fSMDdV-`UP&$ޙȬ|J6u9ϱ/vMn|[Z$΍tO,g9ȯ-\ W)g QHN%9g(&uE sj3n8yQ֝v.T${ǡ57'F9‘6< ;TFkϾ>Ҟ'w#~I[Z ,`Nq4>r1Zy_o5lL*EgO2mCI""95{l/VS2Tt$TD_X۸'j:i?Vh'#k:a g6.M`Ƹꓘ!`G`Nwao-=&x r &aj%p1Πuߐ~''/gsKt)(G2Dw5 KW$&l'._c{;(c@V0q!\cyVGm1~^PDn4aA~EiXX={i^p#.Ѳ;#SmKAgY~CYi|jXӃmɞ?lrY/W X!5_@9fo㗌%#F @;M2?KVAGĀCQ;f hԡ^&LSܢѓ2 D\d|L`{Iuqd(rgoǒl'45ej7󐇦)_v(yWQOOr2B\9]v7WA. *xB@bRסz׫z}L[hx)R6yo 2IRBch$T ЭCi{ OҐl֛>~)MZgPjFp=D"A):&y=Y;AVRt+CY@QF]:e%TW<\_SD, t<ۻ1lLV^,:۰oGf9hq P8+z0?_&đcЗ 0v@ cή Tthg/Y h-k!2ɲd 9Z@iDBh^NlZ2^ T8Ow$ ݯ W'^e[H0z?"ĸ#@Ǝ*1`]6m+6"w>CB xiA^@˧6Ngp#e䇉θ)mĔ}\ ʷTw4e_]qu^`xN@1]k&pH{Dʹy 0Lc&N6` `7ݬ6""E9Tތgx4Uj{iyØȞ-zzN_R]jL ..Eq݇ro?#(![I8>RJ&?0::Y*aL*`'Eb]L9"M)pAqde"CA`Yf3=DtxUZ$[٥\z` [Cs_?BDik:) ] M="Y P\Py~r-~`7\@%õAYT1hfdcԃɱ8u*Т O pbyG`?G|h JC.~o(X;˿Vݮ:.|Y; ƙD8- Ow]j}%_ WxY)fyJ[ǩQv0˔1^ ^ԢUz8V^]HHy ?.MF Jmʩ's9#<3G'}o%\kyjC5݃bxt)GnL9`/` Zh&[V)f6IPW*H+  lxsKKb|ǂz_EqKP &+Lj[jvJaxVKO;E>ҙZK,{F ziңd@ŹW'jԜ#$搶QT,[)f@WuX "\p'8 ͐]\/;Yx@| :†<Q$nWY8gȀ*(d8iI⭤LW[bƂu;lJ[)LjyF OE#\%eMKt N])gPw5:|=!ORc[?LUE1_X=kK9d`23Og'(署4\NcX!paU_WAd$VBS\Ff#B|Vܶ9Wxs^렓 vޛsEEnDȟ* fG1V 塥W*hGaG!\i/ f ]s4ZtA{ \ 9huR%[LRFطk쪻dԘqzwdݼQ(*p0`:Z2WFYSPJ`ndEk )DÞݼd/DEHW(M^c/$cB8f&J9ge s_%+k EzIo[r)Cy;xS:XN9љVu1FbKy&?uBkor6t{.nJ[ݢ$;|ʧ L-b/!>mQ{9|f #(ӌ I[*S% ,a*%L&702 #TEX_J\5*7/`ㆃ50&@dtz#6owT&̓Cn#AMx0nnO#$3DR7]o'u!wߢRbx[}xY`<:, !#9޵D>5g%]^{F#)r=3oFujKH4~[|G3f@3 >ČɪhjOC';4tHu?uzޥ^[FԒ8ŗII~yY{vdd\G&E,=Ȁņ;8eĵȼg oӑ'R##Q›`oŴDdMK_pשg}n側j/zjdž;gϫ-Lr 5|^6я )8SWXz=k ϔ{O8ܻpH[M*CUS  _KvfB.Vү-HR‘ߺAK - 9ҾHlL'_9jo/⿭*&<E2sBC1Ԟs:w>;y,Z)|8/}`Oc!-M:;lmݽd0/Ud4 Jﴰ*yfVoB7;p.V0e$8 [4-^}-y?ojE=dBqOy@w ϬUFg?v(Zw\_G`#15  &b\ i#_|x| S'PDr&^Aƚzg/ *>!KTԐٛz U0WQpqaJ2 u7ݵ{Uf/E5K,aKy,]Fa{!:i够r+2>6z*x JεKGhi<42 eIx*A>d@ȃ8#Ψ(DwxB¶A|)8/'R r F$Spexsm M{.nn=m&Nc61PG mNT+%EShGQuߠG}0,/4 ?{V]%|Kjj]IX = rW/"<]<1& 8VrCiL֩xo(Yu^lO>ga&})E}Ȅpm"{[}~@ 2{'1}mw5?N8։D9'엠HDquPd~njӪ?B|̮ryA5 ͳUv+(3< ;w0J{_GC>_Í^U:㇞icYUܣ~, ZO/Edи|\$Ga#}l,nx R߳ PIEVtK7` #6y76A ӏn!H7Ed&s/Q)џZ\9n5| =֌{r` D9f_iPfS8EIcR-{:K<> 6-\]źd9! ϖ΋7 gu#|r=a-c_rdAKDEvwj0TUBN/@Z&Z-Cu*3mH*yBL{H z]n.pk(6Z>Upl&8}c+!yf/ c@`a+w=啴;-K+7ղ`Ηsƿ|b1nPZ4श]HJٍ314~6ES"j]?]&ŧmKn@ѣE#r  wJז^iG+y9#+Y6g`4f]nQyKBY2x쉬qDKw\x3v3k|y G ԐhYPF@J3a'3dʾF@*W}mG}q!&wX /珰bnB0O)*zX,8o$z,qgbFH-8[,s9Lu%ZQ6vyK%f*b+s<0B\ rG8O3v  ;`(mPyKYӾ$<~=1%N-\Ϧ܉w Gw 5"՛IZnc3}_ʂ}WLyJE_XF+;ٳ8m?w> U'O|Y9P,;5Fڧ\SlDTͩ;3(/Z D?*H,埊t 0{ėKRxz%YnB;/:i<ݾ˜N(}p˅'oDzpGϓM.G-绌Us&82Ukr(呈XDp+=և\! U e,%qQy-,;\HTJ^:g,mb u99#6-Wy`{E%߾E0h}NNu@S,E[LE`'D^Y+px$r CbSu+qOas+XnEO1CԦF$:PYL8cN^P>S ;_&zIMU`:sN3B,U,WĴ!sl^9Z+z~Dk315_gR&9oJ8#mhmܴc'WPץ_E5Pr&Dv0_|a~vKx*^x@s>b[`1Cx=tÑ© ܾ& oZ~|(BwG|˘8k EyӸ|Lϳrp9?"gm[ձC |ӝ`vR6|t,z֓6!(V#39Ph{.4REokN- .˙@VXxIS|y;<"m_<F;@; 7y K jqZkiAbP* q0$Fgy=)$:SŘШy`Y1Y*NS>t+ykxM:Lq[,({BsZLE< "FGQׁ+$||oEXPlsL Q-8Qc,omռ~QB V>B]}2e<@zm Ssl0&lG󎷝6 RwKWfx7|Ž"޴yEvۛVxWCg s*nPysn;ElO_gȶ֯s Ĝu7 헎W;$<Sy//fZ5Ȓ_WBpnĤq1LǴ|#y7&ZLFnMx/C_MT{/NP;2˒ޞ?Jc;o;i(zƦZwY2(jQN W(\ƺKx&Z(sR8U^@nY ء9 #ʽEaJ 84κtՄ-}iZRP[|p;ȓ!|ҁ8Kd@ڼN.b?)kw7{4$qJCJҢ]d(.I٫<؈;㛪W|@%bN2O Α< ɓ) >zIfFkZ+,b>rUԑ *ipLF ᯞ<.je[9Vܲ4W(wz9s|ukpJ\y aۿ |m5_HW/ '\n䘄Au*L},4BSJ1 q^4e-X#?t$Z+AR7u;)(:~j'6jRi9o{/} hs)$k{RiMh,7?[٥k8|A4fHX 1TQH`;v\ G` Q5 nCpKӤ. OSb48Aj1䋷3rx"ٳ֤xyb h2# v!\WdzE0zWiZZW<ӯJnH/%&T^hSMTtԍxh[$E rp,M_dh ؐ=w"^^\M ( mgt3[vx5d0Ie@23^Tf|[efz4TC\O`e(.3`I}ƒE^$nt˩=kB+o_!#r/\kGVw(/ ~x\[{H1xSc4'挾%No-tؾ) "{d`6.Jl+z0v֬SU,~xv d~nxS[ RkEsYABvJm]=_7o{g(=B1e,<$˂ DOeHeԪɢR\G-=tP=szn@|pbc'o7A]_9pA'J]5tB9s\z$8ϫC /mȸ6;Y?[)WF5guةO(6`ZN9aTf<,-"]ʝ]1uo:\#W>[H_{#V%!H)|Sc3GWSnǓ1Ղ#y=[S~A ͹Fp5oD| |s+\wXB7JV)}>5&@͎@-0Q!wB%)҃3YL f!>aB5V;-TO@]n 4"סgZ&Q~>WpCwM^kB_,KyU5'><]?mj4@#Q7l"G4Ԃ/|վOhƜ{1Cmܿ49ʸ er^om2_38 n𳷣0؍p4֭`5g'=SaN#%+-~Q-A_.B(Dϑۃ9c5+]hC-T9b )}O+NBF/EA`Ka2=ʄëV5ӷET ?T6s^&E4;k2+4$x!܄bڶ9~8@*4t=*Ktʅ;WW܅t2n[ (wI-݁D5OyHbq=$/VC?!Ji< aV#nՙUyZ8 ~+EL.z.nj<6ƺz#bsoۣCpYRͼP@T(MvRi*Θ. tCn<]ɉTyeg#|&r F w +D]Cw#-}a(QoK$\þ&"zO;eZWG$ўPf[YXp9k |O̬[wɱQg`;$eC6~jpzAkerJ87H.:r: \ Jjܢ-œ(E\4%O[g%Kf'[A;9pR\&P{x$}0]B򟂋)>џBFk8VJyL|U^+y [_ؾSjrg0rZyf/<;T}AI=cTD;eyn43.Pz6Ec)XzwWK-ge/*^ Xm0$egLI ^2s dʱEn!@ &ջ0}CTOoCXkl; =*!:1::xTM3WYݗ&;bJm{S)7:XJjxkW+ԬtJێA_ѼD=-{~2Zw![wBj݉kQ>u{ ̀&fQI6mS7t }BȳEE$W,%Ԑ^6A e`4fN s{0Mn׉KnrBk@5>Y0JKE$xbISuJfF ߽~#fcZk9mFq#p!/ ;"J>^BKF,ίNg~C(Asv=C:&+dh<żKs#̛!h5Lv6p9yo1NAX~4χ .72n<*ѕF/gMO1{@/wms-Ndxgճ͓bp#mX u 1]m_؋❳T- ^`~XFXIM-xY?g=~%#4ܫl^=aU-YAE$m?K y@j2 `;sVה&`tyВJSI,*9Τ ݹɰHf(5W'Eo0|[]I~E8vˆF~8#/EE8S0 +퓹SU& F5 "OMGH›?cDƅv{q٥n ŊBBU7ɑ#9swc0._r~G[ :h(GMX 4_~ $\OquzsT(ZIlEDYˆ^X󩗶2O_hzt)x+ä&r—r zȗ1P/y!>L# 0f:&z8F#AMSY'e<]\spl)ťA@"c,4AM&K~Jۛzֱ ^y5?I{eCn܊b^8s*/:5KVGPY\*(Mb^~/:b6d** s<!胏y1 Zވ%A$OUo'K;lG!YQ#htȽ57)Eƿfv͒ƿ0"y܀ŋp}^]TDD+BE </e`<y} 6q˗;B%`>xp=lGQ_JSЋ3N:Q$1\;o?OtAt3".J,չ/~7`1*N|OMP%q6N!%+.V+ƒ%]zhBb_;tAkr?DsC=V  I#[xw? Zq̈́:sHQՄWC + K?B,=;.xLk$oD *Zm!4XG[D1&MS\&ICˮ8IQu'}=D(5nn{8+n;~ t&F\D]視&Iy%~o/Q*5VU} % y -\T=l}`I6:Ϛ]T7|ȣɎ;xa pth/i06Ĩ[&b5'ϵ綡:xd?lz=j1ˀ^D oeBƠ>D`.(& hH{2Nb|!0X8^X.5̙?SBΑXXrJ![R@6rcXfZS+̀q}ຼO*影2X> '?/$?^:$n|;< 6@0&0Zj"'0e!Wdm7# au^Q p7:x 8:Z?& mo#{k.Ziba:/zPvZj09iOo3Ek[>O7gjɼKCafV} `wȠr%Nj~淥Eu(VO1GC8ԫEH;e9s ܢM)dKTZUҝq̩;B^6ϒ#nN/8$|\ Z8F[&qs2V}?&Xү lb졄Sa #vx+ uiذT*I4pG{oݜ{}2paP\@u˃BY,czһ6!^ܻ s|lř t2qɉEp(eы1 \)jWvyῐKkeos$Ӎ,pmMtHF_gKb^zƹ :e8w}ȏ"7̟o=uznZL.. Q˜}ys/ U*+".*ew1R9j~J^x|PS^鰃Pŵ|\`5ye4s+~4 Yv߃#ɘ?ʸ,-؃cߛ7.N7j~Ǚ8\P~d[iʝZ5hq<#Te`@ij*,\2d 312_S \Uy:CB#eY1i̙ VӣTkJWxZ^HngՊ$f /~ERI@A]+/w- 1[NK^'kgr [;YxL-=wJ-(WZhqn\9KHs_ &=qJe=S1w ciG%'iʋ6C|vj [Q~趪bQR)(BUaȭC PP#7:mKpK;4Ksg˟9YRTi:U@^524SFv)0WP# dI0uK.t6!,UD_{O1qdLm-h}RH%ϻ&JH4`}0>j#h^*cb掽l!sxvȪ%D!OyD uo} y[\}S2~=lEu-類\_^4LUwl]3讜AV`y/균A?q:y^sh~g;\ 4VhUҰw{O,""K0z+Tx՗m}_)NWCX{)gY> ag֠ yA#6*-5?;cǼx2V}&nDm.VMJLtMd q2z/ U&@}y +WH졅;`'lJaU8& ][? w, xm;"䞈_"@i 8R^D(Z4r"ѕO^ACРRLCs>az=ht]ݎ ʤȝy/lz_~ԗ`rqzH0hO8@~%II?\h-u/buZ^ e\aK-eEut]Zuu06wX#׆-5,>݄>j%&quD8%HQ&EݐȝpC{R@r35^oLТ p-FC6BPz!F]y-6·(7s~r0V.<^AS4׀,"W,~wd,m8%HC3n:ϓ\GүywlkOzp鿏b4$COZ:Q[^Mnx&w.ԜXFF6gy~1Oz[u[oD9$#;.C*Zd&ߤ!A}5HYw21y-[.nU|C.4=nqBuKa RaWIi0@l竡Y l bGE$|B]}4])G*7%5; Bk+NAnC8"3Hjn"{xґ\lé3PqAi]N\EkZwLӮ}0$ˌ5|3BQ~o5#]."li EG}9QCef(!L tƤ*|"Vt*/Qk v>fiɽHi_z-|r|n\7t&? x3u|<857 :=bM^A#3B TpyR.ԧm|t"&QsWJi Aņ@6]QЍߐc]EZ蓛 WTNhTᡅ w]y[MBTN7=C (4~Ӷmb&b@_}.b 8|h{Ѩl9aG踞`"H?%˞j2hԹ+y>n~@u[籸pvf>DsiO0 hX R9we b y<+Vn1Ѱs SEHFg8Is;/֞W} d5us/i6 Jnk?m;_r{(s̐B&vLC*4M6]5Ʀ?:&RWQB姉{]B)#ny$wsߨy(cbaZ&qT<%/ >qsHc-SBعħяf.3U۶Aȗ71̇Dϗ+7e[ ![EF;/x5V!W}|R[Ξp( x:G`g0QSѺEŚc=bC`wZ^j1Dƺhˑ&$<m kԠ2en.0z&$]ʠQkW YJ x)OrJitLȂz[ Id2w ¸X>w>T_!"x5_ ܯ-(b=9_Q8Y-91:eqIv4/SN ]H睽No,l%z(OWzl1}g'k{İ^*8 .w ==7DfNKQ#WhĪ!^߃{1-#jD8Ǔ&4|rqoIfmJ).8O~k:K`VW\1!9[/j0 x#A JM8s.q]eٿV);1SDzePR8ZYQksIo_Y%ƭ Di*4 2{ D¼Uo7C}ᴤ ìZ[<ⶍrJ\dWXfpTU2LEО=fv.Hfưj8y])@;!#W]Ao7_^ˁܦwN,J-vH<}hkB, +c?=?M;lZ9ܸw#k2՚G>;j4=;R7=0J*.輅J&}@f)<KfS{vR{L.\Hv#A4qGۀ?Ak/1t3LM$.RI)lED咑riyWA&*4UetP,ma{@  Třcr^c0W {УX6`piAA>vpZց%SB]0AQTVŜhx~"sRZAV 3+;^ Y~Db6]RIUw'X CHF3]m"'bIjXcmSEJnRn#/4ܳ*lLxOUEd$KE@ѩHLwPE484ll`l3b:ͺ&`:sn,θiui#T %eY)+ "Ț3-|݂f5/{Rq64[LC}\X|=Q6'ӻܧp,kx]:S<5}}Ĭ$ȭGs'R? Ïmf#NT]% }H 6]-@?>0L"yp3ul݌'?&꿶<`=P^7leDE>A|vTx$HsIO=TDsṞl1+ג/@o$v/tl ߴz`aMhnxWtjn3-jDhXJ"W&0oK=_\ŌL6&":/AopHԑ1h}bii CP kV&ٳAXH~{,yѩ/M1kf#M0R#8:XdSF:H؈x&Uq̏,ӽ("t^!Ǔrɭm>N'B񐙼S' d}j}P|89;,I__> ^l7qk2|CV[VS+w9߳`:scDc2_%X^XoȤ97:?OLbԏFf%CTӏ'Pf1Ɍw~_Tb!QsXpK#txu ( Pt4*@<-׍LpN錚{[oHƞJNKܩ Ҧ)5>'MR<5 89mv+vʼnf i)v<r+jR᨝V; }v!a'I=a0<nV.с@̐_ bz#R.Wr>2+v SA$rcܸmӎzBl /ƶ!>Q>I0FVz;Go yBb\&H\㪓jJAJKAǫYUsk`_67{.R+!iu2LZ,{ ~1'/uQT}ҽKӊda=R%Qm֡}`< .ڧ>U i}mⰝW*١=H0`ShqWN$ X/Y3IS}>[SCIWw[yZ[rT.b%"nLqﶙ]n&"J%,b..:=Ț% ,IJ"i;xmQjF]]@)^i=D'xe̟?R"\F)߼<^bhdRs+s,p6FAkbm}viۊ{ 4 5t V*{' f*GQ0XY9Lz=KihMHڵܖYMaiGm~=Ŋx}Հ,K|1@0a/)٭}mgdC8>C싸\V,Ito&*Qё)~ [ 9O -#7 "؞>U:)O:ý˘yN (L]+$~aU*\4c\rn-*P?\jNXMWW9u+~'>%Ռ_lJsEjAxf++2j4{{֥lp [:rNK"d TZs&p58Iv&sVTo*8ǁ7lHG߾%/o'i2z̍Ӳg{)OQgjx %ksR֪ڛ=") p(֤<6=Rt ZX]bZ?@HR}&BC3غ7#}I]Y85 $s [[VV~;stzuis^Lg.B֘NçJQ;|l+,g]&x R}j:5]>]pt ,⒜qw !U(I3CexR8l{f3tlg)ԏh*q m~OBw?,tkvWjsrHޕ` ჟ>=6xCKg.a`.cbKyJ/D?6j8⋼ ;c&dW!#ހ}DMhV4āNdc$ ʮxv xhc_esop}N}LjPt$]kظ)BOn~MUТgEfafxx;bu![nXFr@8oimlRFz|Qi'4q ƎCp''7T  "n5(1}Cˌ"9:;5( BsD[F)>^~vo%,~]aO R8LD{":')If㝱Fxxq|}_ei/TJ8 4@ܹPnL]k_ %fd?C|k ) ,PʭڣP OpRTl#Mi)D+,L $md8T_o>VhjEb{= Gҥ .V{mص؁7o@re]q(|ͱ!.!z^铫4UQ6#[˹?%P Na{| Ys\"0;{]3ozm4bd{^ky?g(S;,O~z`e<C=  VB摔gwbvUVS&P&IltV&Y./x(V!an N)te*{6-*H͔K܅NƘ% 7T[g+7F4Y `3P]&pRQ3@>Qԩ Re68TQN ֌^7ٟ.7ȗww$e1peX`Ӫg*@8\qۢΟ0lgT!` !cHuSw_C<^,b[kѮ m &F`䷈7?Y]UޮZn\Q^x].32Nq Pzz"Q;4X_4ѳz(j%uYBSX (+ژ?KS>S,'\$@1zMP0Zh# s`LZ'- UX{ ͆NYCv8?$)HR6yAV 2hcفMm_=,EBO$a[FtB(&}c֧m&h2nwZi^%1|Wu!S|C [XeZ&ρ\B|b=2ƚ2Z„eVg13u,CHTQn_d.pW޻ۀiV^"!x'8[wdmiTǵ'ޣCT>A(6X;|qPl:wOY@X 2`.XuVK`.?3f^eT@G5@CqpKn\VViDgd n몳 :_4SEbSղ~ >eJ*y{7r-J:j1!CX ] !^Ė !C M;c^4tUFZJ #pq#RjW䀹{EJ=2Gt!<+6R@cB15%?A> !ovV%SaQuKI.mNV p!6܌9%&EQ@J?Cu\-˳~+dW䍵 J[8ꋱ+PK%5Kep18VOF&^m7^2MLg|Lp%gg,]*Wj~}ғm8-nRowL9]Mj14}-WWam5f~~g-qߟ-ݣ;2qf&y#ns &!LgOMj~bLjDo#Wm`z*0+9ZZKjT V%XΈGNFQ`yD a'U2~O*!QKqbשoo9e0'acbrQiaMGAaIJ*Z"MwY7) ?0PoP(XsZʮrʀ]f¹Y'ؑ+c0ͅpg#e]tg;乒7 =)8Yf3`-h @ȗ 5nK4%^e_pmaN8*#>X/]&o_

CԥV= 1[T^h_v6ό(:H_8L/ͶfP wEcq- %)./(v?W0W1_=_OF]nf!mds][N(%LqIq)BRXAXNPzs%5̈́Pϼ> 4rA1<&p|r+BRi%sFl{Je&qy˚8KLIԾv6藸ʫhS𡻗FT勦8H[|N%_NmlE{de$Uq* l27S GejftYuG0s$M)gT }K^Oi\*F8 ['Dk^Sl>f Nܼ?31Mlϓ.#@*cHߎ{vIh1ZժYlD5ms;$@T [m.oX!lX2Q:޵u9ml0: (Q+5pAsؼW=#W UP5k[nku*wlVhs|7YHȀ) 9ԖBauԣ۔2)f8$@+|RNBP&(=lٹ9X&Ojln_0+ L.cV!fѩAi3~ Ur`D`rU6Y,v?D{($.=OQkeK |  ,e1P[T __\u KNvĒ탖25Z Mc F4<<<fNSH*SHSj@Au^Z4<5Y戈5%W¸9h_ze3eZ029;slH>21Y8DLhyb.֣ tY.A&=ecm-%jsFg,Ow\4##D-?dU'3WDZ*Rxj2h6#TKK=%5N\%NbgB9:CE gv挘}");.#ČQ p;!S'fkW1R%KbHk:G`w'4( TP#m>f ;t P[SAA.ӾJl༑?כJ O˘ϱfx}ۣu(x]/>;AU@]铽2i9v];p ÌEFubf<iWΉ؅h2}Sm4{GrϮn򍂃p-2 Gx ~I ߑ*8 zKYY3Ͷހ- Lje8F~z̀a @Mnz/N[ HȗMY%Y$CԾdU\"Ϥz4C j-Kz y=6M9i fzVdßPDMgNl5C6&:**elt0ܷ=2dӠv Zh;|V&cEMdϽ]0Kg: nQA]gGwt^T?tf6?g>+kX["4&',鳽+(j`^O%cia~UU`mcpg{^GN~pbd$SG2q܈\:*~\sۖدE'bHSQzJ}P1U]AhӸp^34즀2Z$VͶp4@&d>w(:Az P)֢a[ >U>e ? ,OB0_¶6B3 Xrr[zkN(*f43KÐ D';lu Jσ} FTTѣDpR^yDK&o^|L RˑuVؠ#ONFM@J[:r+^#n3ԛvW=72|EpҶbKFwʾ ς  qѦre ͞ "2_YJ p@-;~˂ e)O-rӓِ]  eAmFRy3+Xn0F>qLTq}XyIA{ aTk?o:R 5;^ U%Row ;SD- )SC.E\֫GLb6 CP :d82r+ሰK+ۤha! #Y,G ۲FqUǬ)0) &(7XB3[7F4J ,2`Lno9Uv/:Znb+W9*oil_$].o7dPWN2Qv/kNuOjrmoiynmLןL_w\aK(\kEMYZ@谥vrS'i2-/.v0>;,PD(y?4*gV=е!b'/}zCXvEhv\[F$l ,eN-?ǰ`iR R%VGp9պ:5>qZ:2%Pȣ+my_C$v4)wbL2xd V`iPң 4uug:GMi(|*pHYz/H 3<]߷v{&7CtS/pe8h', sWZbjp8]bs!xy9|3jۧzА?馑bxm9/7<#Lj!WٞWmn9BUdž_wFv:<@}f'5maW4[JKR*f o-C[5$+gdtJt.{{‹wf5(޷k-M3T̀6;_E!Xg;lwWp?JEϼxe>0;(eGlV-7k!{ANNu.m,K.MFށ-35LDVԊ;^dFM mn0+޺GGs ú$Vlslu.WcMLOo${zZ4=7DL8ܟGWft 1IæDU폳χþs[+!ضz_ɿCoXSvoEu q'EV{yy[pMcPBk(/{oB3})?jZul9I %&W.'Rl=З?|fȩ@N$[Яs.!c)L9,V Eg~\v^A|t5JRs2k?o!{>1A'D*VebSѧM=;ݴnh;Ô6;Qw;K!DTdVXCVH%*Pc !I] jϽNwfcg<{g-NP@s] PEa@l vɧ`rWD(}I.:>L$pKiaA=oQ抦h/ `wnՆ#Є0T64*iaC u#,}֛ŃK p!Σwr;ìb Y9|(Z;G{G8}o٫1n6_zLʀC$hp*mh4nr7uUMR3w4Pm,rFi2C7.)*+b&jBX݃)!lY:!;RQLbRC x xkP?EŪ,v`zG1KEK ʲCnp|=3+`Ox;dtCE}Q;HjR0UjOsoRF zJq%fòg?5VpsoUTбN]9Fqo`y VݍgWk:Ať;WP #2b+{?v6Zʖ>3P7|T[O-FI 0Nn(4VjEek/V}a'Qi&wEPn JUL&9(;RѐjwAi#[Cn&uUx|c8CVITҁ {ߘ?_ ^Ă^tQ;rUhh @ $t#~t.:jěuGWrO4aALS|+_Nhd{t҂:#l.\$eҦj*l_[OrXL>l.JA$gR)zb=CpXslr\+sl$csKEń宍R~c~Ǧ㚦T$PZ 5wU>`kd NJ10H2\[^ Sڊ+{H6Ql`M7^33 *WQ6WU}Ks]4')sP>n`K~S'gN/Txp\[T>5z%58q-wPbld[ ]jzLZ648|˻qP-5A%ho X>2^ g~ǐ+/Γo0eD_h*bX}OBFmgfq'ڋѸQg J$nZ `7FctwL:od-s~jWT2.G6ABGdz;j ,zOWcCMҥZ(&:*Wp%Ef&LA Q{_*>KfZO-GEjzvo.M}Gj8 5Kw;p{0'&8)fqぞՍCItC7%ZyotNFB]pցa`~Zǯ$|s_R[e)ә*_Ax ~X'&lqQoxdQjbD~v'qmV%`8XOl{X5wlWn΂v4<8]y _tf7x'YݰHUm{Sw:NW:ѷqe^7G iސwJ{E~FO^ ceY+]wDh6ab;ƖjN4NS} 1s 89 7uWz2gU::IT?SC Yv[/5 HA!yi} J)j(h&4wu>dVyd BP~=rw%BK"=h՛:a]nj:tٍ__3Ho9#WHJ_B%wbzf޹+^@Cv sZ/N G4xHt+^rY_殫p('LJ4@I+S6fn@5.r:͂꼧R5c@4ᯯ;y:?@^@xY=M@v5؆s*w6*eFl!嘎eW$P |;t}:U)}y1Ͼ̈ě3Il6ncҭK {!'%ԵG֘#0#ˈsfd$6=&ZwL50pE2x%c3Ё(r^ES~yZ d #BZ5BudYc!j"]UdkĚBՈ*a>&ŵ!VTLaK-u]q=ĶGdz Zp=nՓʴD?=ϭ.WS <^wU72 /8w`k9'ϓ}JǖɴaĢrY\ )7rP61< 4 JHGw2͖ r5gļKkqKL}Vz+q'_螁؞mǥh8XܑO TrהE[æcm|I˷Ҥ9wxFڴZ31 ˔QZvuVJ8bݗ]"۫3FCwe:!AY)p2}%fPW>~w n8<e7 Kjj=b=:-Y* T{2|iLC/B~SFSմS0-L;B)_^<ȦU\~ƻv,}<~DybRsgfnAŴt+Ww`ᜀB6ԛ8Ɍ27*9!1Kcrrå6<3 ,+S؃LL|ݱS+#x8]Y] Q.hF 闻P`:nZal]U3(Nj!ڇƖcb~Urơ)ޯ2?ǸE(gJ̗~-53TM89rϩ8ʢ w"irW$Qza8nK7P?IKH'cVMbsb"׻30ʋ3>F!9.kCg3'v-eZs4R &O(C0d,BƲH4nKv!,b_oQ^ܥԦd#,܀V`gjMkE]q_/}פ.**YILo[vkC@W52Lz@L7>_M\GScB(\Ssm)$d+1`49m:xQ0)iI7Xm?4=48\@fN% GJziCWJ""r39v/@r_ƬP<%2COSSK4#3,g^ڶ$X7@%G}Rm=NO}'l?S\3DգI>_ؑ]ip\I.Q#h}61Fo,{LC&!āVzJ -*cZ ).rV 蘅Ȫ=Y%+Lhм'r.,aB`@P1D6  WD3OTBqȉ0y$osP`UAUuK#ݸ2{$1!K%Fd,&:8EDwO۫0}<%dՉik2_$Vz=.W4uTK]暪l9\fv*-摤lEk9 AܙAa`+Sm!QPEEمeF%cȶ2R~FN(PTp1Y%c`Uƴ05yPj6.?F5u.KkW8xJNϹANHGL)?xj 6?݂qf^5?W(ZahY;``K~EUனl0jmj oS!j pu|kmo/#3f3\+U､Hֵ[򴥄T}271TtWG8fRN&5]d \Ӟ{ [0~p,L QZky)fuP!%܅4*"DTUˆpFg895uJL2Bs_cˆ!X:]]UYAuCjAR9,;_T$3)|GҾK5[O+xP@"p,ta姷-)v_x+nvmn LQSپQw΢/˱q8)PPM .0Nтu5Gu;%[4 H]jjn&p Gsx>20U\nѳ'?&Acn__)<<BVcD1M8kHTMѹv}ǙVfD1ͬ+!Nxp) ϼ1/CkT,o!Vٙ{ kCFgQ(zB.VLd[LGY>)-5̟wjxN shU).Ud\L^! I@3w3ۥ?K_oGV͇VCfu$` 7Ѡֿ7ʰ2wlf|a޻+N42N %7ҥ)1L@8GoR%J~+b҆'j^X1p(2`ct{I={l .aA&VxJ#<+PRl_QQ 롳r^j8|܂A_ENzq5 Q^ݬ@m E=v* ZH ̾"߯i5!eF9Oҹꘫ3M28PHaVHc־T`V\VwJہvelB !eɱ,܇8\:G ʎlq\]oKj;A6wSxV!1tپ S-T7H= ?gG]y5>@ 4esOÊ1U5!' [J! zPvg`3$]@>*Tay^_#/WzN;?Qtq_]0sKʻi*[,@a-/_iuNGlYJe"F 0maZ!B0 .͠;߳-eV)nd$Qmn2I.TAD"={aS4qݓOn]ZC3O#8H~ſnM lQgQ`9ꁊFu֔}w\$E&˷BN#>吵xm(Zɣ..nFEt 5W2;0Tty]Lݼš/w2N` mc>@ڢ>elqy@1Z6Q7-:Vomٮ_ׄX:~nP a(DAboT;4gpM) 9/Mz#`#2R1F+!d8D̥_v7WZ%z'UH<>GsaR -~BD13SE rx#7߯Fkf gDM\`$"<ϝ sʟwX˦>ϩ'yA71;BtX7Qlp BNqj E$chU-J%^coO5Co0^)ݢv7wdN_c,Z`ack<!jy^*ۈ⷏ ؛d𮘉HDj6k"w͹B/oTRBW Gca+TKݽiL3 ZiZ4,>6.7j9/I'iQoC+Ny۱s uiKM!m1gT㱿Bm3Ǽ"CI%P`H2-JmLGG:8'f&7[9!H]SztQ2Lr/ < uFfSxcN| qJ̦ݽ@5:fGkFEU6ݣO8U5kr9Qըb'RZʼn|FGkۤ8)CZilzwϦPIӠ$Glhѳ?r 58mqmR ^SC޷qw͜"K_!baJG(rgycWr&{Kx76D"~_aP{B]Hr+cl[R{; {0ʃKȦ8"hp{ dn>G0.%%s& V<5Lhlg+B FX;5ׯ t7 <zᵧhz.2Su# CD[Xl}K& !ǐC;:Te"oC;u^:uv/Ǘuji&aͻHJϴ>zx`~`hm':p2 v_KmZ_8Wyhf&a|)q;g+-'l7&{ODOU/ꛠoN좥L LQu=#+埾9ƩJhs/AW gֲz1qMwYY .cxͅ<Ο$*DV>0ɴY)߿=-m(V"#tACvs  os1u&SN(vT16x^FaԚƑWA}FO.H< "U;+^ PZv,W2 ߯BsTfUB5\YaV%関kbuRj BoM/`GjV4GsͅX YvHTܰ1Vt:?9]ܘ椱>3 A,CLa-x̸? *u2li<4`Hvv⒝FlB b 1W4uAmӄ>Е\#FY(nxq,O?g"3UI7W~>F~F Z"µ4ßz[LPk\}lqi.[=;xXz߄`#wVV|B׻~j/0%tl7w/l8 X mZtэ2'Nl B Y#\) ;TDR)x{VIroX֡0; *3|itX24glF8uRQie)=<3A'{_ML!([fZlȠS գ08jM–$fh ߧaW :o \VcN)zZvM[PsΧȕ|I+5H.xvaROuEc@lBqPa$&Ͼ]rv@Oˢ ]-F< ;:.WXg$/7UxN@"bToHR ə]rּ".O*PEcGw^R k叏-Lx4gٓ@Jy1ߌOy>ee$4zM8T6@r"ͥt¡I{fH<6`C[ULNm;*GMhs+rI0{{&m=ثK=<%аK_)c^iЩmkþu/5u|P>,~̓-$Pgt~ IQ6: # 5x8"Ҹ ]2ՁB7|! 9`eKB L8DxcZxcw"Xn>CJh(Wy3=uYrD¦Ν%Gdn x]P㺊H!,F x% 'ےYӭS@ׯd-j6_V__1O"X8ckT r=6B*ʊ-Kcs?&2Z{C~f*'*—!|$~:rZXSu[g;WnpY!a51s:L/|9L!!bДiM?FS~-:v6wU疰n4\s|rMÿm):9r:Q(Eaz3'K~H<^?NH^!{&OzڰA b})JlXAyX^]Qatxl`Oyىvb|{hyܕ$׉?]܈+>u#W'`XnxPKߕ^y+&DKT[cn$>x<+;ժ&,DpyEL%tG˔E>ņO d<$X\VB7&"?}n\uE_|ȼp1Gq1` JSfp t՘zr..g.D[ֱُ7#ʅPoAePޤQnz"PAlUuvCݣՎ?# !W ; 59sNl7vڱ!d'`&uN[ͼHzV Fgc'_ `wxHwrL:SsPB͋9{=sAs¤)Di"|lːڶ[M?A4c=cXVj{`+} ˃'*"Ou߅DpeXA`qjϹ D~0=H|GWК[<_`$6w" 5+9L,:24rYgCoPiѣn9sdޓG> {ӥ$ 7xyDZO'T~ݲ )xխuqM]cǔx-g|HdnNśȄ?dq=[ߦ/z(IW g^x+Z=LvZp\SM-fR"G^9]ɾzZo:lpݦuك@/hԟ0ڧNb$Y(xbjM+^}8/ s]:5d LNsX UpIj 0|yk<6,E+/w&_i2fg3}:XI툎Br׋XL4[[ZfoPns*m}ܛn2ł88ݖ Rwan~S;@ (<%Ǯa7pritH#}0 ej)倒&3i:C1OFɰs *_en3b6 ;1trG8S_|s3mH5]ҿc]>iحRM{0lAEc0~8x=4GN /_`+;Ǟ8Ԓ8aHU`'0=%)-[WR̕V{o`~=lfNoL刾|رSM7Vy-n7%~m'42,Jn ɏtUKs,{ǥx "5\AX/QaS_[G%^pHtW.K$5w!Z4vq;LkafDzҢc|^9̉֓epаo*H$.z9&W\{Q*21s9ͮY qU{EtP$JFKAɚ-A:oɄBC%qQQik YmYgʓ%4|1 j ƈJͧx.k-M-FG4Ӡ=>95-8<_m17dL+,cIb="ؿg 榣5[O+V{}#_+gGw ʾR4*=K_.5N9LǹDE]IןWdf3(Ní%3-1pd$. W쪘/Arڧ\ku #hf;89{*)QPJkuW}Ʋ~  ߒyB4^'|9}l6!}pzp5S^#6ޙVI&/1+6ptgm;&JdRXaH|<@ yگˍ&.}NX—% BpnCf&T3qEȼxgb\`1qᑫU`63cT6YgXmd]i$v(Fȗ/ wP(7'Kaɥ>8"/Ʌ3¡:{T&ࡤ]WJ,:wAD%L'M=@H&xq2NU-g`C2k%Z ،~I9]b \V_ LF%GR^E0ֺfNsL WFxCkG[vQMs^ᖿAnDin&'=wjKp4[x&gaB~$& q<'"JzRBBrLjycBŘ+Da:;g =uQN=rh_׉hS@?gؕtؑfャg(-1tDGx *6h(6{VGa4$.v026"Vʒ\+{ _> J\%t5LQZ)+~W1[0](\#=gDH8@uOMbc*׾ex5|":*|24PJ:Mpx]r@rk0/*6 ր@:i=.G9},sv!)@t7CfPvx)^=v|9mq'-bK*>aֹs\o*%aӪ͑'E݋ʗM;҆|oiCu\,&/ WV[-=3߲:?}幺oXĔD}BIM ./ÕH@ߝV&Q9v|22ZRhW8fRGɛ٩RjYDaO%),u?IF)y#- Qna1XcjgE6b8f7f;=%(2>l$rЭAT[>[) 'C3yj X“P(b}%\ a\6A?^љRVK £T*ov<ɐ5V&A ϖ4k :xRs"-Uxy8V c'w;MOiwwޕ7:Fj Sl~bqzY]CsV{AFBvpduιɯkQp<ѰC -)8E^F*w'AUR6zٔ'ud/4+A2`87}py>M'l7\}TgTZw_d)$ΥB밷; *Z:SsٶICq2>0-I:4Xds1\MUR^#3$3{z_Ēu+41b cP,'Ϝ+Vef9 AuQ.ێ@fFnt 'FiV4afpr EH(0J.aʽKa/A -:&#N7eϥ|;sP>;k5O`$m,e^j{ rV@'l(.V}jB y=RM *K,[G i>B~Wq_:)BByEr/]S)QeڀZySff$HDlצ44D{gwC>w;W#o)UHV#_;ךF51(aEq,|tݛ&!.%[k.Ym{|ѣ|.}߶)-XЕ/fBQ]/X.gNDt?eَZyDeCد5еk̋Ea&IV݇l-e}ӏ+:kNI蝕dPpS^vB\diܻ'*&[&-:8Gɫp~ 2=n5S8;@G+U$C`RC^$\iʺ?.)l<|L00(5仏̯.‚~2Ա>W`1U6(E*~t@덶}OWu$ap[γyq&vѥ6'N*|۰%X'1y RUkP[]@{ML俉"SFkt@G*&̈br4W4D#b U'I$jWC55Z͢ jFa%Npܚ}8ĆUW jttDׄ'6Ӗ.0Qdf~||ZjlRR$L/{Ҕ^4P֍bj|A&L1 (`/dWN #oy h|$z@{9qĘ}f:_Tw9ACv<ְ{V@ KƖPq(8ք^TXX vbvemyJѼ)ߦqB'\ڍ|دdt +ڶsUᶉ\m?+f-+w R4P~ul:nΦ$vErDl/2˨6IT)܉@RUϴkrm4 ۼTb#Ә;Ö˹}3=O5\py/zu-Z.!?G}c'9.YFɪ߻E>^o-s0*y{0+IwX&ZOт!}}U@M^'zL O6f\󴗧2$Eվ~OId -:L_iF=ͤ,&ɖ3VM<x@H{6"YVXj_cI^{*o/Yh*6~(䎝2/:)vTu'IP iȽceվ94]PtHُWD) kY*>3K&<ȧBpO_RyM(,Q={~ZVE-YIOcuNK^U(A8(@2Oyj}m}q0K-*PR{$Nn02Rqm%":F]@"lvRD*Iy^+EƱ~:e9C )Z'9}|^ǵ# +Ocf%Am gh~rntym𞽣gA'j %Yj(* %ﷵh2ɺs4|WJ:`ZDeRZι\гP47t ] (r84w : $4E1en;/ .(Ao/V-JWl2{*. /0yΡ(ޡ2*ZZJG_)?oSjIb2YHcWXI)VVi vZ띄m,TzA0pB, YeB|r$*rlUK'\졲ތ4STԨy;!w ]+Q<`%xDQjCC6MZ؄R\ci(m|DCk1[mWJ*atQaPNGʖv7oYڷntLNRӸp ^k s AwT} 'i& 9UoHw_em׾ӵ~A iD_>"ߊvv.:s$/'|jTېN^?GN6Ry}N Uتr{J'V|CIE bܢn^j6/ٱ;i}]qrLh$ŗ `!Lx$!kG13=k9O;[B*D<A8YP\?hRqr"&/%ր,FsA۩WE;m RFZȭeto."Tu \Q&eyob+~7 U } W߿$ġgٱ 8}y6lpUE1&G gymZCCqI?|Q礩|(s9S5xq}(PAХJޝU~Ub;R['CW/RGD., b@hY$e6f.G` ͘"$@U. Qs0㟼:W@ 5(Aj;d.doK- w|iIЉsbT'riΞ \3A^C1L4 Q vi Iɠs+\6 A} x#_1ݏ~gyA5q 0θC?>{$" x9pf$Z?ę69Hj3h}n\iTTt9~gGkCh}4q<%&(,"(X~ 3pVKڶfä_d7xhhUoCMF|ib&s:cDpU5W! -{nMTNlŽBLs`N`0mq%mOy9 Nb-0d2tHT݈ 4~XVzyڄN ZS(7ċee,:H"+iP[2VyjV!) +uQL2{MAw{<ͼqи>vpA=x>eqBt qxH@ b87͌~]1 |bh!"oG.A~`MOVjATd>KWEZky7\RA"2ΝKk)dw jk1>yk dY* O05Jd{(3k'aj{@{ރwjyLZδ7U%gxKJݝ|kUqĚ !%D3aI*ugra=OJmaa7g;R"ed]^ܼχy Q}O*T+1\X~|_Pp`}T@&OdC@գi X#Zzԅ{n?'FC:I6rH[ڏu;&W(zvQ !Yy"YMW \/`6F=PYT &Aڒ)qԁ z}*e4f/ltoZEUй+ ~NAl}@yvsHsVÆf’w\F[N>яY/I>XȔYBgP}K|%gm:4tkL;vOz 3` |5UϫWF |xsIo z޾SH%sCfAl&i'/ >\94W M9MQ} Y[ - Law+<O&.T'J pw% V霞;W!#" k%:gBy=өx_t^d/KM>GfZtU~SF]Q MxUiVoaV/9EЪs`VVFA]9<%=h(e}DZO;2+ǎZ.Z:68ɍBcbXm 9JԖg^ג0?A)Gk!戭kg بd&{V-vDHflx`{X^U;9"lkqysTdz {;fzZ?O!d30t"xqܕ4Ѱ&wN>rpHwrw}d,Xch;;]@'&/+zp|^[σqBRdEYL~9uoicH%VWCЧzU'eϰg*x*I0̗Mq~+A>^=D^W@ 4)MO.0?b--3zy.͛9EAOaZcb\I$JĭO y Ѭ\%m4<#1\;Ad!Qd_% x '[jTQ!lx0~ go~x:[Mo`@w5 'uy&di&|8˝dAZ`U3q!Ȣ`lF0HuD(v iYrn+J+EN6꿾r+#rٌv"dB"0l\ П0Mj 4[38-'iW.70ݻ,e}za`Ь#s\.C#>>>.jc҆\Md0iSUܗ[! D f OϢ4t^zNtQ6l|PT˺úb ~wfSF C䠻JW !ECK qn0zė1Uo3> ?,D$H'8Zu Tk!$nuyjӕHE+Df󷬂j|aY7H iJɉIEwqaa)ҶSɓZ򶫛n6\R' LB8G2 sV2w ww>|[phJΜ+):iǸ8y.62禌Ԅs_u=VJ tpht')0e ?5}ۭDD@L CҠQJ؃+'jzYGs8D"6-+VR+m}B2 d,|I칔yUMT ߙ5POo4P*;oMnk#Y/a\u< nh[aQge8b׊|%/F:, FfV{z>[9+% J⓿¯L DBɭ[c^|w7Aʰ {lOiO_]~댽wO]: FK;: |rī"2ܢ6]J@Y9;ahIƁCZ^Լ.uۼoGkJoe|o;.SwJ.Ǒ||/^ӽV1tp_87{FԝvN`<Dr k0`=>ڕl|r +RUpVjJ}zm;s&Y0]:expG%zčo\ʼ8osKK(d=<O"?|(;'֞0TPQ{ds6 cϦ5bq&UXj.Y0+vxVF&mO0zGi7#.zA" CLƝ9N ۠Av2IhDwY'9{.jH=bDy^躓+sGnE>T*ȩpJ8Cz80d@)B%º$=.nsѶf JժPFL9]SƁs&l;a5X%R"䙃_iY2=䲦K8OT@`}Aڢ4%ҕrl69DK۝haJ(=&m&O G5>U M0(x0 b0fY(,oW&Ea¤5#dg~.:Mgx+ \HD`!"/zl۽q(7%.؛& qwy-񨕇SI4{%G' X2{ݡק6Mr*FyN-H1]>1Hs{av̧xs jZnU 1LϧI]ar_CeGfgFŃ y#&?,OCwcNl/  xlb%=*U@bfSCh8CmTM#v_356~&8-fh=Ǝ58'{'k lQZzY0\eCҨ 3hܤ4y&prЈ3QLxGȓ䠀M*Įjr]H.ƣBK>rc)ynJ' 2# 69 efH?th8H )Ysi£MR!P+@t: ^Vh:ҫ1EN\1JHZkpaoژ:*5"1@ 7rDC(1mhOCWaҫ'm^ˋ]iB׻݆rdJ'^eႉ\/{{gS~3*/0W_sqc0ɞi]n'Bf tkc ,%"pV2ڏb7rjܳlش=SMA9SA+Zr!Qwj|MyKjcJO!@+M+'Ƥ8a_ \+ DMߩIM0$O_Bc|fdžR>Ir\wL Wco9g=* ;?+/7?1XH1ػW1#/"]m;p"w_ Ҏ#GDư (f~ q7uG Ok{}OQ*(/j`yocqGxp2J9/CԝGUJ9FD1Fo64dZ'lA R9D!}J r#>~{IxCMP]"\b*;7ѿ?y{!^mk|S14ohg]8fS$ Y+{AMf+ S#Z9>e ȹrRֵȔ2QSNaJrNqVQu^DM[ZZD*X2|*I&D-|}33 ۨ;4xDd*-_1>:jDŽ|+?}Ave-$1[|P\H-1Ej|b/Ţ'W ق 5҅.gU䧊ZtYӾ6Rdr^om`i!ZrLT~UT{Lb5}QſB9~Y5f5YBccR %=54ͅty S+pwMKW\'KXpQ6Z#Bf֝V?~A]'UF_oȹj`tioz0&օ]RQNL8VϞz8#DAN .k;\I"`ޅl)#~e N?ϽaQn@Z$_ ZgZ4^DtOư 5ZOׯl ’竡Cj9A#H?Rl ([L~.se޸!Poi9L{eY6q{J^MGxRGnM'Rݕmp}Җ9gE`\$'|ЗVLc.4~Hy%S>SV 7LkҍԎOҴFL>ĪbT;_GOOR~{~_Ί0⤭)B اUAk@vз;Ε_Ysƙ-@‘ZsJMf^}d%: pݩ3Y9p);laV^[;kyV?{Eۊz] 2bZ0:!騎ߛHwIk )OGE^x|@x7]4=/S $R~JE%&YkCKfLlyzP/twU{Å7l@۾l旺i:12 .ab(qsΣ6u.h;Z[?Ҍ ;{K"!|D%`K)# *4c+yIYFB(sA-tXʄ=z8!-y5*Ys54:eŦ/Ag [=dIzrc̸_A cCI(=} rno@! 'N?=kdBdyPUjtr. X蔥=$ ޽Tj;UQ&xUX{<8HX`k^C>@}2H2,!A ؍,Ig̰RgHM0eFZ< =8n_ E~;a:;y%6v[:r8 &ËXף7ْA,ɛ{Т6M& Zֱ8J9]M ,Z i$;X.?c H f%)@}!`P4"BݑMDyZd}ÑV?TU"*oG|)2Ntq\轅FvO:`5ZȖebdzN_$) WwM uO㺿"JQpo%tzhHiEkaaU"A+D:Qk욤]6)fWDfwzxy1SDc(AYV;u%*ۘr_MvM%4|$+7uNq*j 6~u;g\-)!^.P| dcEok# jy16d }n=Ryeo7=Oq#i4 -EB(t4ƅuA~2 ЈQ;I*?lF;xEq3hnhsZċԊZCSMKb@/Wa($9 M[S3e0c-OɒM}`>F \A0FFvh*;s?cB"7>3Jqz|y,cЫQU o],({*S^D!UbD0k/Hqr>wC K]hkP&F0&ށ-{R:Fw&/^D !RS8eaH=x\0Ԝ߂A|lKSd>1(wԕkinH}:v3p7cٶo7R283׭~Ӓ$}]y'9q(l>bxlhܒYX/_8' 2"\+lFjKՒakG ݡ@7W/yاL X›cET@=Zc͹8@[_,."g9w lBՖ!D=PlKGt8Kܚ&:{O MWi(q).g(զuԗ~48zC!)%nIl*|"~'tF*;Xbd$繘QLO^KE=-[ >>+X*6(cHQr|lrw7l0)@*svI(bDF$?DU|[gnRʡ!blsTqq ^ђSd)`uVkpVBI块Wu Ȑd-f''9;N %|6&"砋&N_ib8^}7hUZR{ȵ\WGxXExzOʂF90j" KzC{X rtX.Vupt%Ϣ.m7;5_agNCޝ[X}jr'&ˍ\:ߜ^in]|7;vd^~|c9SJqq4s!Y n.p{vХ_k8]usjרo±Ptf]ϓCL#QA)ƈ T;vz$j]pLY[k4e$yhmczz[ihB>-0OL;_P3M 7ƵMõZRR圎`/f''H}mG>bOPd XPFnu-a]t+L"O2CMe4VdtQ/#>Ǯ "K~0z08Fj!Ն4_wEIc~/sYJWm,yA5)־ ½ӒuʧKETo[P3N%CBirxiݯR5ag7 #uB\qbѰVBUUN~ Vנ"AGXz+~r@H:CaaB@t2\SOJ"W 4ղ tD{W@4-9V;FSvTY?#3 YⰀcMwA& ͠BH œӘB}ǃQ>|KLq]=Dkl"]oCճ娊+GlH`l=1@I%`]ІW+CcOBNqA[*!-Y\F~sY֖r Ϻ-4:CyԳ_ž(~ ceʖPfUպ^[*E+ ʎ6(8'CWwPv=Tc5 {d8IgʀAטP0fUMvj2#bBTMs=$ daD {Mf,č gT%r\cAFk1{V g< i4ד!! GVz$FR<;OS62MD#Qpܔ>kS|ag8]: A7PCNNu1 ?! ]|W{`xS-5xϘ t $rV peLgmH-ZKS!э=Xh EA|1&kWa7 15" MfҠ"xACJNLps(C8ڹ*V)&3IGMK`zr@ Kl/3*]&T\#0JVL|e@ܕ<\U_甓U[ N5N²q4u2TR& !u cukak΄ >F;3k,<`;wq@dzwpqx'q OmK#= D*/;fL`&7Up`{zܻM0T?4ⶎ ʵx<,DqP )4We7Y'u86x\4g)m̌?7B]~yx& ,w/,٠ޭ/HG!7um|AHשņ}San%)?>;͑ٛS%}ļCJKIs=޹ļ**9vuOXY\R\&!(x jA[DBE5CD(yKIJQ[QP&ؼ"07*iA~?iiRO=}Ж 㿒nD:xQ Upr fjz.'zu]#~L!->2axuz'}&aTSBiHC Q=u/d.-+x "nz *]껰SbӀ?M5%ySbL1kBA_hX_,*X.MbHᄪ\z edGR z¦FA:Ke͋ ]Wx2;qB}aQ%S4Q <#TB4O4N=!mQs,"آD_7 7zܻ\*ͪX`%B~d?U,i [_;6Cp5bT0-а;mcNDe 끭j)  W("ݗ4\N%aE. Je~vXIޫx:U52-e%*yv}xvQzf0arXV,cxu$YMk ==$ yE J#zLe8V [%(+}@gܬ?I׷ߢĨiZnJi8H]ym̪>w:6ol"+?,d]_#X&t(JoZu$wXwE޺x<XNmmԛ%Y\eaȯi_9 PZ##x :iت*PtuCofTfef.e ;HҚ-naԬXR**{GV^A63u/{C"nX#: s%￝;*B[!:BIYt؃Yt(Q] y-Շ-v_86>s9*O Le 5Yp;OY誹CrNƍ)f!ś\y[$CyU "-`N < xKp؏ 1$8D@cߌkMd_Tg@X9z{7gk3}U1Ǯ,Hˉ 6DO ' /)јZ.$Ķ%f= C booO̶┳:Ο #~Y: nhs?T xl϶,~&|D aI+#<y WqZ:u%mg^S\H'T7?ԜO|eߜ @bFXR6_?,DuZ s B'W>5;¼oT1ƍMѠlNKk ~rN 3QRz Q nv^ZYTEJIZS즒t甚R] |.\JI } |8& W'ɉ Ye2;|(/]~BA#E;V!دv"%)8-i\ gڞ˴2 YÙb 梨Fkǐ7I)`0p`kBy)&E5 w q&θ[-Ĺa)t&AonVT/΄vJp0ȱ=J"$\rA_N`w[P3e`)D `l`Rn$֣88"*Vy$ä#GJ%Xu:m8^Yo]Qt|$ttpӨX9X-O6N0gGՂܠ{R=O0m1ՂA=2`ew 0*ctD EdO$7\Pv5 zW-IFD#W2+嫾)5\IO5wy?KrJlNy_q(tӄ8nD@Dw5!b`x/Pﴘ_s0ѐ>;Q4w:=DQ'm[T00WJ {٬CՀds/j$m5mES eaU?joTRE Ǟ{Ҭ]}aI -y0M4e*-qlk8x)lSl=Ѡii23'TM.k >pVRlBBoHSm.N]0 .}"neԮh8hly$C\\@|l_+$W #Xr#xC*e^6>sR4qX(\q$ ܃۬T7}aӁoWBB(Mg/ZeV.3wf*1%+BXv)sn;5Ce6^ i#Q?6F[J} y^ O!,+A=9Mk_&W "*$^v)jua[8TG.IfrMQN{K>8& NErhtVw~Mb<0D!K;aF t\h?1rsۇ+lBxxg&ε >tJY\]S. ?1Ȉjp ĉ,#nh-_۠񚛱Rڿ?'}-r{TɁU8fH>l%aD[ ?c[n|xԨQ3GԨFchmgdh QH΍ xv "BYGh1+/w]ia nYeE])^HJL9ᵟ6=44Rj6T'mf3Ê_% LJfZu?'2 n\%BҳEjsyN2}CISQ5* ) 1Z,iв 4萃AvJ&ܙe$.I M^cjF8z;9ʓ-7tЉkir-R% 4L+klPWg'3wLo120~G\b;1.CXP,-E1ej'q'ƛXȻ݈!FN7^K77Po-A@O H~.(11(jXc %lWK8YWg<lyct-CYiysJVB 6)kCϸ`G㭮u:FE+# c8 kYBV v1^R5`|{ʂ컙X9uYj6z+":_KS^’M!@-/[v_+E_ nYvL jrUͦ#{R[$vvz8cU(Cפ%;nIJjI!oArdOQRNmz,UqN͘2ZV񿈘 #uQG5wnmekt~tb\TPf"\(Kyw~ VB%Mkpf5ONxx皒j,MJ95jOxtShGj 3{s0 ;5(jU-$Wz#r>vv؛4ԭ(c Y|حj78G xT$I4d!>oߵߢw!5\NCdu#b4qibɨ~![SqڪuCw+'޷i|w\7ɛ *>ѥHu:6YX9tfg,: c5Àn.~(2Dk-.;suˋ\P끗8]|F] Kk\ϯQ:{ˍ.݄(?7N}bJҼN.҉q )OZUBkH@*=ˬ)M`=Y3_b~>ߥ% ڳ]9?]BMڢȽّ|Irj~A@Zⶱ6'_a] ˃=xW<p'1\6\Mim8:Luv VB(߃N]F( ?+ ~7l4qI8BQp2e/q9-p9=C>&8~iFŹs2xuoȟ|Xа D>Yy1D~U :ĵf,6H:1Cp;]' SБ^Z~E3N{KD3`]QT/ (?'i\^[[Jv!&Hn &I y/& @s0\"(i׾ߛ,N;]=sc0$GZ ϲgpܽP^FxpoW!8{`'2ZrUj}-z}+Z4,r  <)+i\z@v.a^=P@[Z u oL3'>΃ժQŊp/ItnW5Yq j1yK OeFh9 ,8Hj&BAg~r$?ۢ4e먊z̚LNq*6?ـٌi1þQJbݴ*4GŸed]GOfOHڂuw!MU;x5;U#a-x'@@8Q{PzEٹV\K"f鶧t``BbGLvXEɺ! 5He X|3fX30\T|RδoA9w')F9-yRKAhoVT`7OW*KOl/kaADoFYg1syuiu7@ ?8Vϲ*5(m_M蹶n暽rУ%gwuB3!d/ *"1Gʢ]vlT?> -9 '$s'!u195T#p]ko3c`[]ED%{g@v;QTx1`,O-W2oI}T*fQ8ŞQtƙ0rwbDD:r | l%O$fљ춑noll`u4Ԑ3). |;鎽7A׷4.xINO9b҉wV܉=\4i_7x㟈K\7~F]p] y7e97yCSjj< [lv86P!QN# &6ZĤ#f4A"PV,nښc͐Fĵڑ)X!G8PG5DoZ62'I?N)C?Wv)Wco1;ݚnfi , KC24W5&LGxVya&1ٟ^8<ن|[NG;ڀCNe >!m5hZo ",_'Bh8;lqo<(;9n]Z} ùu"(Sf-JMJ=_7T^F" bqO:b>H}>^NvH)}I.AުsgU'&*iQ|5,tߤkt6vH =eo&4la[ʧ"}vs$K=CQ8g#*Bhhݓ9ی 5UŒ-%n?#)wjRǨDR7$\c5L:!3d!웿3H[TF ܙj'do_wJc X6n?_U_fR/ұ+cܺOL*(Rۮr PxViSޔV~u!vGZXlH9Zh?e|=M}%VgQ65-nؽ1l .hTE]#RaRcb$կ+>ǡMeŅJ 5ϱ=?5AC\3Pcܥ&/˰bfyD^5S $E #L xДV+T7[|Aܜ8Wf@{AJ”zRRci jYYI٘!4xEd -iQVXR\)+LDpܪRYS6~rnYܿP鍉ZK$xC}_j]Y! |W?𡮐8M^{1@.qh;!ZvK- $2#P*`i̼^JCG]|HïD;MX_5Ŋ O=y~s`לjgTE|X#xgB'YXwv9g[RHr*k9A0YSz'ldYzeB\`=l Râ1slMMurlxl1A3dWNn,\]iԑ6d%lXƊ,C<@+7 '5_ZקhP23kM&AeJnN%&TC|KIew0"g}!Vu 5l)D27ӻ G/H)mL#b6ࡪf?f͈:('"R"Kp Œ @hɘr /L/2ȾT|wMDͼ(9I.r{ 9k # zeB-[O]Յ\1^Gܓ&.txV_c]"yG("sjZ&ʕ[!F"h7/]\1dN(nI#H*4DPOϰ/&묊y~2*P8@Bd%snV*C^uCrjP=!:T39GJyPp5dH65+:#{AK.DE{9~[c| tdYT,GMJpsBa/0ݟ-Ѧ18wJm R]#!rٔ{/}^Ҍ^tZ0'7oǴFxٮU*k|}|%`*UM4ѐ*#Fw9/$W~A6~[F]0Ƌ[mz!RĄ!M.ʈ z0D]3_ֵi!GXNvR%\PARv,UPȁ_[gᙩGzZ(9M7lo#4ڰžVWMrlq 7ن9˧ *yjD1 Hz 'tuˉyHgݣd_=ȚFh29L=:P]CqPRM(ȥ:p9&-mrǫ"#^Vk1>S+-2iMÁ<ejL`J0`ro&yƯRQ(D3VtW;9$W_- y0UF]xJ8eI<`wk}8V>:[ ~RшN>~I(5* (7O%=x; jV΀S>Z *.tۃ`*Kݶ\ek }}N+i^wjH}L#ڈIlbzŵFًe .F" *Nraݤz5ӳ 9qe%%^)CiiRSC%Sw n 8\"I7 paw݁ ~_hW8Fq HOrKg׃Uڄ  ua)~kvy8!L4 ؐrjipHhe贰o،:=.+7PkpH>vӣu)N߰$&bA-U +H*9ֱh\,$r8ESiX9NbxNeĆ7X %_]ý# Wv-O.Ye?B@ݍ1EQ:*]<=>cJ{#ñ\zo܆hܕ OAʕ3Al̍ҍh0gw*nk/ҺM OIGV -(@IΆTssD i@r8~gJ\Vz@-8[X:y)A_7}UJm}i_"+VLQ\(Ưt9kvW}ES pܑpe&8lC6F;9L D~ktSXw-gU/CCj-3mW ?D?&sfh#~ [x''زZT4:&.4zkm"qe5MGi.+\tB9/mjڜbkWin4Vơ8,G,]L slSG*Dʲϩ)Ynj -8{$]Hr p Ļ;4)t7F|N/Dlnۂ?jToD!=&f TZ˩ZfIIFSh/ɢ^})Of5![|&By7I$nS= !P=y^R>.=/B4|E 87a.@L L+XݍE@;Q֯~<|IBHJo-9$7/ɡȇF ]:jM9d^ǫh>q;~ůM4čwg Z| Q23}|;Q/>ۯB3bLܧ-ɳצr뜺| n< d*IRߛ?l,  4m8z&.UPŽȧ Y %05lm%u UYdM[ .{*7'*h(l U5kL',{*tA0akASN[C,9Ō 38ۏҼ~ t,ݳ*Ϡ!ebW s,ك嗘oϗ2AG}og;>hJ:1H%o,j~yvr_KcOdڌӸB*'ĞDA{h_кߡV&?P]&zM=ؼy2xP7tGR墧/qRS֔6{Ä6G%-bcUR?4r? sZف ֨1! @Me:j$&GH=M>}x԰MWs! Mk;8H˚a-M5kLE2 [%S`CV6I M"5GŦ"`_esHS!upTo!n_V 3;?OkKiz_r`ҳ"UJ*,DKA*QcqB@ N7D\6dPSj.Tc /|y¤bpcͦsW9PT5EUz//"n>“ٕ6(.}  sljZfm8u0܎-oͬB9ثi*^&&vPؘcƢ&}NOc%l˶#Yq@/=";5\$(QgB{QZ3 \،72׬?[5 JK/Cʷ=t\WL9M/5oyHۃOIMX >h8 w(7d}a~a@3J⦜eu~*Z "#}Y=xZedwvl7]_ N-rߝVNax Eq})Gfnwc-5/L Nۏ[G~WMzE >=f"g(Rho"mM}B>y0+cŏ_Z%P73VN}SM `S %U8DyP('lY'оOkճG8͏8zljAͫEi=uևScեqH;g&آqe1gg!pP"w :^e0ѽ*JaL}gҹ3-v0&gMYPv_$AեvwObQ1B|'%5O9_5Q09WOps%Ok[p|]Ly]ZQH*]d`u)P?sܹ;F7/*à:$fK%m ȵ>;`?y)3S'ԛNMgʉ ])Z1MФg8ѰGJP]Ӻ4N=>YkOtc\$Tf\*.C:MPYRfxTrzzyX513o(dg ̨Lt^6$ |8(T%PY](0ݧJEA.Эۻ1lUpGq +)}/f}~.ȇ8$n;ɔc]Vp;@7MP !t{s#rGv:(<6 :wo_zY)Ӳy°B砕&-mjBQ3p!-c,{DUO 3逶NQ0J+!@h 7Z=nØ!Є|&%GlĞMj"V>[A׷|yx KRf>Lh'7kZ7,ܟO~Lnr]@?yAp*22Wvp5=_L̰&VZMe{{B. W0Ybkҁ<#ѡK5w7򱋵w H<cH Yt vfQ;Hxz ؿD',Ypxi;w=jL~,>M'd}N31ϳ{J#*4bٲm_3H!^&s #5&AE_sQ! ۜ!0:c+hgAW}G ydgeSr\ jFa>^e~.-fS"q1?0- S9&3j$f6hm1Zs.>Fj62Id? =Liit' $`Kڮf9.c!].yh ,nKԩm/g⸉JSL*,W5RQ-hC0;Bf-n9e~2)2J5lMh i">9qV&} ƕ`GF@QEj5" [~Q̲ôoB{H1%Eo15㖡*'*aRg,v[hne'FwPɗ?]rj9Lf)">@q _!҂oZ,[bqd'k&f |^6%{ R6vBb:~=MhrA<1 g}Wbfd$0l1fyة ΐ0f[1hLlr-gStYQU{B]1,#FK1 /iYъދ'ﴮ7vRWrK?'?Poa ÓҒ‚Zi϶L0uUl)~?bU, dؐplL!) 5heI PsAO/eV ,[( dnY.m1영nJWoE)McV 6>e( M+@-SWɍkacgݓ^o볚 "3a\YAhc [_lݠkz$E#\TɊ;'`N sD`QA_/P@adǞ"3cbur* l Y@ϗ(ʋr4kQgsݭ0x.<߯=GcX+Pz,Q7:LpࢡR(Ȯc`dr`p ycy7lw$yB2;rLM)Q֪Rl )@[ib)Okn؏kbq}e{aKBǔb[_* W6 A+1lv?C v[Mm+<eY) 7-?H\XiѴšk % F׳ /[=pHt?_3s*YPY H?+7+h.7}$%Aܢ3S#g 5[/hhodCV7VO/RXⱢH_*{ahB"~Ax\s_5ݽhڄBBn~ѽlyE Hwi2 1Zf 큷 qhO: >W* 5h` Sb r^.Ȟƈv٪?5X>)RpCl USE&eS罎ޟmͿ3ap 7a+J3;E^5O]{ ֘j4~rfyj4r):s vġ["I 1 ZJ6VE(]] 4`[ꧣchwU,)\[ p4MJx`z-H T?]˶Ya8/ԩAG=#=®~lCNזL K3]Œ0=UoiFo rh! uxN&i>pL6jb}1L؝G,6jǨK۔-NxCv&zi@2|Ml5(\cre  ,-cU$eZ`j, ,_jr\feyVw(w8QuyqVI/~PQϦԽuem(Jn_| k=!7E2}09% m9U^$7-г^tv|/䞭B<7sܑOf{APM}|q5qxqejߍ,tȧTKR5}_P  ċa&uyEJoP Cxs!Ѳ4HK[iJ7FP.UmK\y4Zix>A"gL!N<ͥ?I_ET|z LT)B.{!\X` @ iyK%艉PL(ȸ 7JSIybh!cS$2:sE Xš zSgJg1F 7 Ri6;OZ@łrRQñNX'b#!V.%[ ^O88~RN\wRMt"f.ٜVd۸F`(u7P $\o_V- x6zÈG IHy @e` [wҘ߿ș;:+ѡ*9+¸<{X!^qR4 cƷ\~L#JnGLjgu?1ràZ;I0:IG5l},4㒗9RRb-t Q׎eBpp{h{L@ JNtIQ$[Q&\ӎQI(SbR.{T -J8̉a W5uAyϙVtPv5rY/}vr}{c ȗu6tnN~jmKpGkO y Em%)[pe2̮} }[ƪHgpDjn7/7lJ~?Ugڪ#ֺGsdn *k 5Y}D)J+ڿL9Prb)azg.Zc {Z`}!BݒD+Y7?d0& scw1{J.c_] UR}r9OeDgv,Yi aC]Yy@kGX3GŚCeAW:;jB&Nލ셦[@5J\O8o:`(;w Sڼsr<ުnYv4B$:[f{Y?~T c%ˑ^ϚWGIѢmM/X'f͗^LY Pv0D1@2ǐ]ȟ#$`:bn};5m"TIo͔u Y\@\r}7UoX)SQc1Ñ^8<|1Uy_D.#x$hgd5Ul ,I]ˮ(ҲEl4<YE5"} VSm4yUex )?-(ûéXJY4QNO?.ELSl3Gd c[yȱU)]3I6`$aƒфY͑1A,Ҽ[oHN%ޮY,$Ti-A|-0KroGmp~ B{EвߒܨF_"hjJY~kұ^qԘS5RJN7_ 4P6>c%GDoOՍ1sÔy'ؘBW;, |T`nzt3%Gy ˿ 2W`PQs:bX1!=c-9lJs韭yKG+Jd3qyH(.ۍbzjgpkqExAQΨ=l;e7P?>6|W& GvT"R&@Ƹӛ2'^ãD蚩vJ WD5QrzMckPlʽPp/]2 !Vwvoy_S,i4̊3[vpQ2k.:ҁrKχxlj(v&mIGBȔ:%HF]u$;&|bYyJhs(?8@r ֊/De*KfI Ls+-ӳN ^ϫʨ8BvnG<04t']9d9.iK.cPYva/z5VM]/$LGMPs`B'؈X Rv2X0`p{ _39N)qk=r&=n:kYG2 J;\zQSߒ2.~7%"w9l&jg>^ZzD_UB788!2SBݶm"$&şAsH%2+N~ \{'B=nbbH+E@GV1;B> Z=OO:70x?^0-ozRkN:-su ٞP; ]H0l/hm m_jUNX?Q5nϟEG+ %_f7 x$kvAT4gsvd&p!w٪" sbPFt>gy&NIńNƐQ_ 3+ 8^k~~_T9-a˭E ܲ%K&g WH,cCzsm-;4s[DgHӍ ""C 4s'{3\f5eW_R;h}*!Ų#@ʑwAK޳̿ny2. $n+0XϾl^\|ki~ѯ\;L!Tq(^lyr 16Tl0Ĝt!@)(ߐ0'5G̴"[%|1MںjicH)|mw+Z7 +5[ ^_GS*`*K_zPlht}ݝ^-(lt: "j^s )?ڰ#s:݈ f}gxCY5C#5Xjf~\:X6P !!G6kaQ 2]WJ} Zq2D:M@Ew1IbSr6\t(a)(1M3tS2̺ܮWړe6A}Y >Vߖ4Xk=8"dRhDq\J GOTOwHpײvCfX}Ŵ3w55d ,=%opӀNե)l.ey&Gg(A>ViK,eFJNCv&2+TF-h+Pn jbmq,W~1W BB]UifZl 11P;vu"H06Fr;/k  Jjkt;>~} 1-`[W[EV@7Opޕ} 3 ?LG}q:pj(sP =I%[`L<t%lz+`2.BaoʚFMuW%=haH|mmƥ]s(Һ]m>*gY({y+Z,?Q OZAANfD: b5L%E!i} zxKX4 A:)Hh~gkO3pY3ym,9M'`ux۳Gvah\lZj9qYѐ0f)AX$[v/3l_Aaɷ|}P~Oݘ Y/=nNK߳|1/:ߢ tF~vA"iFl,䫊^ި2AEi۶:WAð]"5O 0u7w|Gb `cq%YxB*ׄ i}| 9d~i]QF˜["Ha`Epln5KC 5 U|[O\o Qc^ < u3%oqYOLM+~z{,P6 [yMΎv'ÅΉ'\I&e'k8,gd6wZ8cJdc=AATw!yqzYB{_t謓´(@=tsxlHjun)ȽOe;aЮiv"`;ReIN@bA0:E+liR&r AVhɵʣXtiU`#*@Av$DA`b_qmY95dS31OVSHE GA"|;yU/̤tF)axY(ZCn($;X;YW1.l>#^B j5LgX#5Bi]^=W:7W D֮>XAmxgab(fִ/Cڈ'TB'%4F7}U؀ί!own7[hk/(y0y>8#x֞;o S_ qOҷՍm)¾f`cŜEF@xU/]~ 46ip'.2H#.BːB4'$+2)W#pkb]/V$8P54Lk$u_y6h p7FTv! nR9h,%6lOe3$=MJ/MUg%-&{]~1d,B<J5SZ9Lv j 'w'=G:o7|z}'>,A֕/DL@/?uqIsMmF_aXGe e fFLtĴގU}EА[h/̜ -1VɩHJ!/;ѵDbހn;[f]3[qXb=E($owϽ"n3ּAw WkPSF6ӯr%2pkiHB m drθe2CՈ^<AO**5!b[[ G)Q^x78eTHEú\ h{\:MRST8hsF|O.^ @17<+W ?_}Fɭ(\'$e<dJRV@o~7+ka19A~ mig TAtmE~ 7Xv6^i :Jg \QOZh<]>RXRH!97PI=;?8{_@,(aR1W9.LV#Q(>!qLV_Wx'-Q/Y;g|O=Xthp$6"V U EF7Ja9AőP\geijJ"2YMkF3ҕjBk|3bx^oR-r&- e L~S$kޫ3e덀eUGRnJ-z뼦@S0dJ dz)Cs%*VN.@K\.^suNzDN׋:sP^{oY%_]/Z;2y'j2@$<ͭZfo6I> (dX.|XmA, AMx6כq*EL89 k8d*CB 1+i1plyr2ף3MA|ɜй=#\ ʘ'mRFa, Xq՗R\!eYrZ  ' Oܧ7,3r?;by0u>,xX ?\+2`V%GHpe{r-&ȡk&6H@ʐ92ӼD";66CSw;=S]^ I>UG-e +QO\NԾBClR 3܋a!gNDR 6(x?a=`T$NAufȝL-Y qiU˶&њѓ. _`uAiE*PCSG No26gݿC1R6>%~5?ߊFJFTk6sHq擮͵/najgۼ!Ac1saxWӏr0?Cg+3XڃyItA6)2,5iv\VibC DΟJ{f80cKLׅUr}bQl> ~|o*ZI uopSYl(Μ)a7> )St̵Um/bRq0ְ+a9mGQr騌ZEJ@n _Fn.ۄ1hys ]âuБ\tMJݥthkg^.L>@AzFPWC֬b茜Se기BTfa HWꎙ=_]&JFg8(r @w4lIO"o,~XVg6N#5"6; vjph%&H:e*&az"6bn(1&SNNyc^[n-7@GsFdQ*_.a5h蝝-@WE sV 3W1CU;r-L> ˔uDkjWlfOa>zTs|5u删y5j¢tCW[G99+o%w?\ei_p~. OU+ 0HT7O1}e. +o3|bIWUDT^OLB}"'t<,OXYCf?Q\G/06^Vsja|I;6nI$h! 1'k3J5lbGy&oVN]LcmPXP_rw(v͎.~a+|ŊʚkbU}wP84<^dqԤ1 f|Hjus^fs_9%3Ć hߤv}@(1޿` Ahv:UмBVO]bYZNa|M6Ǘn^2z6]ᧁ=lU{ AoHo8 cw-&-N˸ Y[OA+yPr`ɴI"QfsE#OH٢Smߍ,uUe"0߆Z0 @ @kk&+hM -\Q@zJwY p#w ɰeW=hylN͢ȭ[-CVI緯5_3wI(#<GP U@^8#=P7kD u:<ЗJ.Xr5ְih~&)8ǚj˝dbh鹅RT82;p7 SW6)!iTrMĥz>va܅-*V o?ۊ |T]C!pc`$RqԾ>VR@&XmCCϣ5(4#Ͽ,!81Ă${ Of ҋ> v(c?F"ttX(-JHgCC*P6"\_WhHA(N,e פ'Ѯ|XhZѱ,6;NX(|Nihh-CL~ՏvnRtbqnkm4 `PCh`1>qZ%,ZٜSQ=<(J*wt5^A30 YiA~u|8ٽi")`Б:NCbK+=X$Bҧ7`@2'clM^ծ%(}Pq bpI1|Mk=vSm43_E{6BBj a@(M&(٧0 <Σ tnF篎|o)|Z{fO/Šk08k9-4UvKAbD[Yy7 :u) \E뵩ox;뽎Ob &cĻDmÑ+sl*۷p$SPV*7GSYnCYl1RRߟYږBmG(/Ie~sF8x-⹡C>ÞZ{T{k[gXp!&o X1k&1k$Rq` Ka(.XERj,PXwSLKɲPY;dQ.=W%HiUDrfsj?l`;- Q` Q];Zp'pi꣇cbw?]H56(Hښ,f'<5(S}@8C0 rʖ`4%㏞W"TejK͙itH::[wvX~9&)6YĮkr57Jz]0ˋp1.~MPCskHX4ɄHYYy,* $4I u9~ƀ7aJͼ}— s IYƉ Wj.7^e>iq#"}CvoVqx՛o,0+ $b^k@r@5I7GԙwtwP7/y9p[aB~3iê7`R>2l$)"ȕh#l#jgߎ8Y 5Vc#q|>0m4' בpv!HP5;sHk&?<OJm%zǖ18/5፽;7ӊxyûeY|FjsvRl]N xEYN=sͯ|'nqX0b~ ks'S;u咪}fc_EtbħH:v51=rM9d@uM_=L~\T9 O5tke'$@{ pW,7C A:рmfru؇HMmї_!twqJzaMK80a 8ue.:ߪ~Q }oiA2]ّiM`Zܻ15;͏P4l/9q6\s0P,,oNˮSr|H1wR^R9nɨLvrkJK Z=md5#~`s"IBΔ- Z%hxYn)np{ZT txu&B|63nTnt_RX1)PW]^UǿE y2:f+z !li!j(u4GryLb`T Y˂SHۗ޸Q)z%z(CN 1^K. :XOzhԭ/ ӝ0*خ 5/񖄈bfZQλ9{=b5e-k͛0kw[@VBS=ge(-S_VD5dAW5dA<:&.@r I>QUzm%JFp/{w+Μ^ePRMcA㧈pC3X.x\5*hm=Hwy-|+"U@ZjʺJLD`0.=S" 9mb>:ఎpZ S?aD^@-*쯄47ULdeY-zw@j ~2N!kO]\OY}>7ě<``4BIf>YgKS[dPGԌ.bc̃jG8QNZ0ii) b&a ȭvE6C(>=[(DWE-RW6yRA%k|j\ cҫP;i-~Ge 'Lv8:f ^ȓ~뫟,3g xT"&Zk1Bē2{Qp1.N_sEG+MQ7XVv^g V{pAҷXH㐍]\fX])f/k=*<2&/0!騠a1Ihn~Oo0"_pA[]G*pb)P(d\7mi$;/6Ʋ[M\風ೃ^V,ᤥdj,%_ xUOi2A5.nwnB#]]}nr@G_-ʪ?+{ru 6n,SCD"sL=6`<;i<"mS,Icō`7>cLV׀.WXt&9L"Z@C 7HT \zqJšjsI]hЂ=1weon+QhxN; .>9H+qǷ`1Xd2JӲrQάOr@fGRylmŁNBG>JE0S`JVLp3%z_>@~4'.Z1p'j6zr0֯ &bDc|aZ i/Ή0E/`]SNVez&kRfi!ATf!M?;EdZCA#xFA+PhWwDj3- ⎧lSpP*j%"s~lԾ9E8*%u5n 3C[&,.z20ZW7+]Hh:%1NmB$j2P@1NNIZ""^$k K^lks8) VPnq5%4Y?\]G:Uш@i G:AIfs̑? e`kU[rbFƣo6G~>r4Jn[/ ?c @^oHYWgv/&\S5̯=-{ȌH-ttIa4s=5A窤  m5eR3}r=:DVB`\y%ٜ? Cᰟ@wιiƨ84s'da"hr_ësF hӾ ,c6r3#<@p#VJݲZnW8[ 0d;πlӾ9#[Sk̷N >G.HX;(Z#ӵK#o֪]b*Y^둒yJ#BQ6;zg`;:]ي\eePf@Ξ4k R^Z,66Nl`"9,>T %ʇ_8-e{$9R}v?&F8COѯ 2MS8聾[,_o_wS cFƍb)wi}' / %6nI9b2g" %h)u0,H $ni)":+ 8#xud7u}>BUjwQq$-V;~`txQ][Q&!!mvVa:*ОP.4iꑔ:toaYcx֨i x@s8m"PtedpJ}{^nQCVŦ tY%ww[ނh> ǹ Î# 3 ie9jڬ>{Ji.%% -}2R+b'.\&U\Iu {H ~/ Љ {.%+s]he>vhsK#YRO|0m/?r%&ݫ=ڀ;fbk)X%lY)NTjۊ vON;Mqv R<"UF)xL5՞sR`X5U\=Xe߆;Ð!5׫ܪ 'ֳĜc8V8𒿆3տ"fPWEŖXmF DlGO!6 xIcof(&7e?iL^Ϝ䖎VPPP^]P4A)o]lNTM L bk}Md^nĸ +Qyn"@lE7K8 lY8$(Haih mгV=Bl{T\r"\{תo=ɚ:d- cm:-\ &rL{J&+P3 ӃeҪ&!N/|yaGC) !F#|P 9N "^39ڿxz 'ҵKrG8otntM&&3O3')ZCRVl] cG@Ć܀6SAh /nG83u.7!i`>Ujd)\3+*CL s&C/j@?۫>9?e'!w{"pJ`}Q)<%vNJҨ+@b9PCW/QH:~\]?KE](D8-sʒu{얯Y뉣Bl҈JPq#EL! m%s*J9Q3ASCEU*zzxྜ/x(klJĸKL>2ؓR&Q1I/3ڐz6G!Z֘ 0+~$m~>Bb|1Y7,{|6Q CGN[=:6ɺvvBHkPe g*8eD门#,X*i&hB:{"d(ͥL㞝ƶ(892T&v2x9 mB8"\>T3xiD  ƿN8bھɥ3?I^h;'$|N9 Z%L,Ӣ3\Gu8J+Z:X/UJ_5zO_jnO@XSN#I8Ya)t8&Q悱O}"$fyDJH~z7՗/ucoaeK$';4D­y((wWX ~F[IK@9gdFu% &kP@Ơ39[2ޒ7~e>.Cx ^#&8k07K8m xts=J/G> (}N:p&spY}YWx|m )5q2jYuDFjE@e\?B@nUShƔ$;S!gGH+t*լи0lKa;Z c[wkVعEGCxv b`o,.0u ϱSD܄vf: D mb:s1Q l׮pxh"L/C8h zy)u5 u歾nn6D^vZ,R2\V2rEрNֹ9rU";{ $ʋ֔@Q'n3{&a$`i q@Pni_/&zۣ(%m={/uvޱZq8&igr-%t߮"Zh!nK>QYKO=x AE;М)y&nӶr䆞f.Gd`D *" '<.~qC40Ouf S@?q&!5# 0Xѩb ZBLi e`s(E8*3/eFhaCy+g?*?r-:ChI& N|P̗ ;E -3gzm)»Cdٷ'žm)mb2) ְS|jw}o)[yTd]"y~fGcY3*{ϝ{jџcJFS!igKGK5a5wIAXy|A{* aym} E甈%J(Ɍkpw|YypΒ@\i44H3u?):5<'̲VDzn*9clf_z MΕ}˲-L矃WK?_ԐE ^!u;c]_)y J&щ_Gօ'M8e+B@61P,T'>jR0Ը=tGU׬SITUt@_Թ*?ZK.vi3%f#Fbao_Z6%НEM[ҰFJ˸oǣqZ}(O =2NlZ1. MEBsXri^);$2~ [QeΒmird[k7DXՐxGڱm>gEkF5-[l"N۞!Qyp̊ٷu{9bYmGhۯ6ޘԄupF87V݆㜊r@By򲥈h ׳xsH"$-S>NuQZ a9Ncʧ[>`'DžXA';;pJ_ Nr[x:0bSYw[BĿ \)젨urPgFZw*7}_p '0xо hg. ^⭷ Ǵ1'Mst{¦yRv'(V'zJ5enr`%~h*aK3pз*j,c$TސK]A/1"l F).&+^E bB`BRV.EgWJJqWټwft4eE)56BMSt RI뽅(hq_d9OxY`M?TR;49˙IHybZj\F`l\/2 ?;11BdazԣpPP3i4p$jKRi73zJ\NL{`brnJ(44UD=ZO׮tc;l+Οdzl4u=st2^ ϺV[9*FӇ0b1n=pHC 'aal.M Gh.ZsZ(xUj`vz=^ZTRȑM> &#s $RS6_3^o}]wx"5pTqW$ ʟ6䝚-P1؛؛?(rl;enyES{8r<)6 %(=/8kn( )!¯kgI8z9`RHSH 7V]߇A[Nѥ5/[@)ۼ;7=LaAB 'g؟OCpu}iNa3µ: Zh4D9]֟]5"vd}Lܰ4pξE.pC-v۾3l46YI|17{_sCgO&5NugLubUG}_OAI-RJ'+P\UZBo#_ ( wg=4A(:VayiǧaMRw8UN_WR>H *B6͑F{D'?F2Ysv) L{nKMGQ# :SOq\ 5Px_(@\KKxGhx=2,|oOܑ 9\VLhw&N2L_Q!%93ý&l$`*3]S+/brMX1`[=_4 oF?^D9p"IwO4Ryq3BNV0@(}>*c D#"H7c(b5ӻ(ȷE "w9q`ۇ ;}۫㜞}ɘbp$9y6c.=̓~p5 }O14=;S/{uEaCstee>hD|p"fKd9I^`sKe[Jtr}/4yr]w&{S ]3x\סk;L*b$FLZSkŭ`do>Ls|wR0V(8o-c.hE&mդ *R3IvH#w45p"ᰭPcz+r@!ϛ͕#!۠'5 jEOv3h> :F;NclWlGt eidmj4O(;w2ǂIxUb }J/@Zu'ix 5hǞ0NCN ji|GR]h&X d]>FewqJ(uͤMj_}=DŽm`bCQïaG(V0/H%ټIGS% ŔFZvӝ#Z8d8nGA:5&*Hl1~OByǽrs a7 R-C~FX%X JSŽjϗb(<|~ XPVYW۟vVPMgs7g"#HbpWØ^1x we^,??7v~d*7Np?j*G-K8i_ɌtRFl1}p2lIx$\/YIjgSyMWNˈ]aUrqҀ:`Am(TuYv8Eb[ᒇ$$-{nes5b4VsQ7 |\](qn4R 1A6Y.w(kO<[T W5DBQZhgXp"]Sle`ʃOa`i9fEf`|AKZ7l鋉 *Q۵! 8]s^vKhhYLzE#ԟ6+rۥMrk4]_\nSlEs컍ĉ/,<ŕr\ΐ: d_xʒt OFmE.ib-rxH)<~ ۑD ߚ|OX)n,tyΧq0gtĕkw~ ^?SNmgۡ5r[bY8 L!X9Z|f ´{Hzg#E'fBRL=\v Ve"wq×osoVBe=I kY=^#.'_0KɦBF5%fy.6whgP:>uaxB! 1{ /7mwmNMQrQD#(>0.N[XmBW.x@4q.3Z(UWMLwl3"oVe*;lYb^*ٷj́O^]1aɴRN7E,|5d$4?aMPVhi;S\?o=o yH^*y ]Ɇ2zy_k_+P/uDKbkf6  _4/[*l# :evNI39y RR}%8)ŧ<: B7&+=Ndj̲{]t 2.!as<oFi(A#U>3=;V !>YNqq x\ED@H="۞o! =qŽSGO4yoSSv>g.KKaPt9*x-…OT`luW :[t wwSMY?v{-kƺ}X8א`婂e(l[ G?'yɴ͹i,8MD'lW"hú),l~ YvNP"d{F[d&cƩڃ" r xl5ݯ =4"4H2̭[07Osz{ktįCnjC$[I(SLg\|CY$Sn@F߽AM"dl8Pmnܠ9Yp /6'qِ,e[$7f&(aZ u_~9ڄ54LM;^95mjwK8A[wN`1Wv9l0gMO wR =O87 |Dr{5c; ε!^GS\8f@A@ -'_ nKƾr_B=R5?Km- aIٞL y smz >?c`FOc>Iz`pA/kmȴa"c݈-n\KՍ# Q_&鹍ҋBk;m.U믐vD6aXBǼ5nguI(|at';PWsr9AkaD-"0*<X$?XVJk"νdgW(a '֙LQQvu\H XeNX#[YQ5G@ ۱U>嗖j]Q}l堃5É"P:+]jU+ƒgE6w(IݪX h?A$'$8s aNU/51°9S<gT2%0-uoA~"z8$4ǔXI SQYFWD;BhX9+8O'vv,UN-E:jBgZٌ N7DY.kB`nrcq$rڛoZ?W9vJ/p#IL7uiyorWq0W;,/j]H@ѯƷLK]EKwQ#lR V(>G=g6 h.eq]!KoۙZi|sEDotL .J&pޑYM e X1=|1~R4Z4z$UТ̟bE5G$PG5#\G*1$qGMm͊29as᪠dZC+$4 FU hTHNw"l3Nh!%Қ  q.QJ,ۄ43ڑ*?h/Veɴ%œ[1bJO1jK `6jRfoXmksNw ݥQdxav{T&5~,t\`eV1 YL87?5 (Tه Kz C8AkN7!Lu(욥"Ĝ6 N8e pM3F>z>]h|is]-)GAP[$˶'\.Y<yZ8`|k.\TJk\na,EI {_2Ņ1p@]XskߡutwARP k‰AŁ)Khߴ.֌3"d! #OGvaDٝZ 5-9T(.5 QdAcׂY tCi5䨡) 1 aU'},T5>KF97 RLv-J5pk߁)DZzFe GeeG~-j!J *F6W85J@r\qZOڀ|*JS>ys&X4/F*ָMWGe'B3hQTx4zVω My&4"?CIiWK C3 B6PghצH V 7 }_3(烫4c%&|.D' q)|>oI1ŋ< $KMp=sAZQ6UU&iuHN{@ y%$ҿHR}vj:P$== q׏L<"*fMN"1FmH)]Et*=I S"!tt)5i y4-_~vVqZxQ׿= $6 ,9I jB梑¢yh"I I"BO]jߵh#ֵM'R "j'CEfݿVVEߛB^9=aVC 7[Nk"+^(؝.Ȳ: $G,5OqY?e JtΔǭH&b2Ͳq[=ާ W0%]KHǃ9$P/gKyvVRqrXre&6Wp{]@Sxk;|T` 8ImF 'LBl.iuJg3ZV|^|N7҃,w3TA-{A1hu|M 4_߳]<;0q.d@wFlnwEa;N]?jZ@rпq+}]:o}l܀죑 _GC6RkpQV^\ޔh$F{T3fϥޤG$lM!.MIK6? -҃BKy Z$(OL8t99IH8'KWhJVgV;E3թw^ty2@ 0j/k4TOЉu4PdbrR_P[ ' ]rDiglJ_jS>^ W&'e`Ӌ^cl(֎2bLŀU{f[FO.|VnT ݫqӳAt%F#ѥ*9S"oMY YIbC)RF{GZ[!d4Ru`Xb,0ªrI;AB& #dQ*%鬄^׉ A|ՙri0{j0d}A&ڿD{q0K¯4T@O~!ki,/1$ͤLtb=,ŬRZ%,6͔clۚyz bSq5P2m`/QL&c%KK1 {z9V\SJ 6 B~=Gl@2^bd>nYKrf.B#;2,rUjC9C.oGZ}u{Em%M 1PG [ᕦazb 1~ꑍ70_Q"ͧCJt٣b4|6BzB՛Cfv/Ì5skJ[%U;sϻa*%N9Mw:tvS [2'NR#۲\3S!$HcO鈅Z:jf&w1Q`MK;eSp;F߫:|4m3Z,/cLKu)M)c<_DĤ>Ve -5gwMYc?gk"-5; 9bSa~\rBM*S!oѿ^;$kST$q%4jw  C/7SU`UO, q9o^aa (HIl7b|"ogĎ8ٻ٬K/ =6 XqmCXQ.?FQ91pO uGG=?=vrso66f:`941uYl] MpХhGn(wzM)b=͕qi13cD{(P (D(Q^. N3I.b\]:SEѻj Ƌt OsFf|oq'[狛q _0!78b@ +l)XG늼.2s}"c"qO "hĥVU %C<gVVk*VA Vqw }{ɜ Dm>eEt5[!"%΅ߗ*WMY{!?{͒tdh%*?)N)7m RJ~))ZQ%u!B ˩2%C&j֥ˋvg% UnF%>q,)3be>jlէL: {Kf0CZ݂eY0Hm64۬9zM9#f]s*CM=`lzOKײFσc6{gm &ID0|]:|Q!en0 +R[y֣seweJ+QZZOR'pM=D>AT ;N`v<"I1o 2/tTt sWҖU}*|{:[D꾎[t8Jv"~eC C},M'DC;'E+թuT(%Y1PxXCHpp/X=,:4!J PasX2JnPWȾƾrR=k]$ESi2&GO"nq'.8՟qyDtn+@[,N\,.A5nl?дLիϴ(AxcYLc]76#)׋TM#}E w=cSZO]NT 4'!7C9@rC2JR_0їrVMnT;/s"%{n1L,*nHYA̚|XMy| D~(zח)KZl^ 4X揌Ư )_y>Ey#ٹ^+~*1 1#8=bsf`|"f"?׎fcωQzgp^݄۷jt *WB<3A2_)Pz2Cd5e5D5!B\\!$*ʲh)t-&kJ R ǶZ78V-ˊ {oQb1c(:H aEynrMF\}Fe?__P5Fe8k+(*]GcUѰel>܌|:-ԧ^ZtMj=L?_K91B o q%o TtWC *1TLQ^ ;RJU6[qPqUNj|nZ3!F$e1l7ɃFj}`z* lQKc%.JBUU]Q..5h7$)[JP;E~ˎ'=%+G̢LwSB 燱O$ӌ̢!j߼>c=g!$yCZmS{X~\ulvĖڅPZD#/bJ#+yxD!v8Q\Kt,_b<|x@+2>RQ9ܝb \j,[$x<؂Y3i~0>Wl! ti)n1\jt Ɩ'̫E],dm/n1XFLj{cwf齺\c@ur*8j{WLj~spO, Ŭbe2u'SuYsE zpzkxInc$7Q1dKa*Oϕ7ݴ{:taʹ'hB3_] /U C@/OS{$tEϣؤB1҄ٹk¶#@fXl;f 7i&Dy7JoDxO6%"9M ,B"GFӓ{:;E$!gQ1wa0]^ [ 냞Q[2?H x2gۗtr0u HJ'kI9GtBW wH$j<j+@!iW @P\ LяO_3"ˑeXn(zdb b^4zC=d-E# #O>JOqN+]Q V~Xq(9:Э,Z+B=ݍ25'EL;ot-+zHQ{xlN"ӓ'N3nj'!ZGmnUڽ{t\Lj !Yt'2C X-8$NQe|ƶPׂN$~5ӂ>tG3/p9 tָz,&0 /Ei/D3uﴹGB;ή{k?hu2aؕsucZO7bRcI`XC8ucJ5;+EWvjRtʼ`jMv\ڵֽ j&GQ5ꍿȵ]S !B%dDs0)@pWк|nUeau`wepoO;% )rGn, d4/$^ s(C1tb#Mo2)0A  N1Oq)*?UTk먑Qt'~uHAZWa_sFhuvSTH{מӢ};H sh`L !: n(]È@M3}x*/ FnC2E^OGv'TL s3bHq<3r C95 *~-ՙ%5ZA87sfQ7l(BX|Щe9cOw+Ȗ+>Q\o^Zvgx([9*iÊ\Ys!RJ;3 |krj((UU8\,\*$3oouX)S쾰c][r BڝmLɖs[t0Wڛv9ֆ2IPOcF \Kmܝ%lmA(6.s<[B])ܹ&)ݣn?KIY~+. )=Km#F^h5 9rA 8>2L=I;JA] KCkQ16.ˢY11ʲ׭M.oQ.B_xy_a8g13$xꍥKT )LlT][UlTډ^&L&\<zG)b)&sU|XU viWl&zn!´tA>|1|K:GQ:7T @|BgX#>}aKn(-uK8 '}ξ?U<وk=iJc{lioD%4/" ̈́#0foC~ST?dc2;(EhG/>ww:]ݍ̞ql|HajRo;)ؼs*d x(`fchE8QdUPՂٍi1UXO9H$6^q)LEo@רzsOػ82郩d@ӒX93~OR袗V [)ҿąݦp+d3Q-,>ԝڝ_3:^.E4u tYbNV1s;ϵw;/XΣ巘n..:!5^0*vo0 V-DTA-xR/#+|֒B~g{<b'yx, w(̸CQ%*_GŹJ!#ڪa*4Xx)cL(,ie{\<%U n]^!qSP& |%+h/v H(^5b$`\* *+fY}6&eH ,k>>աT*W3Ib}L\Ώb2_~Xіm,$y%[qEXHUkZ{ҒX8l<4Pގ 0BuY=(SWx Q_ӟ`HKرG˴wwI_4F?r 6.'܆^v͉@*H'{k}Z牁Na-n^iqb l;5C1 2)՝a߀;ʚQB_.]T7tr%1G| ནhXa4kQ3緩z$!!qߨiWhP!N3ѹw fmӑ0&\ˆ,E@C+b3{XFJd{cb5D霪nfHU_4=!HzFK8” } ±QbK}~Ox+\Lۊķշ;F4$Yz-;g)ĝ5UhcIҔV yr|VT+gRkħ/E|*jr6)s : f м=5{{tHQH@W6|_Q/ dT\gZ<yN5t(dxuYPrR^Y6C-[m"P@%,S3O"xzys6Σ B#Ck,LRaA4(m;X_{fIv\/Br q>,p72qTJ#|*Uq&p@? wӜnWf`엺 6 1Flv꧐ۺ ]Mc2CUBq@a@i ̀bHSU^[殂 з}&iJ?G rmkO_P"K f9^7+#@}rTquɼʤNrdͪ2sؼ*:?}-2Rì(L6hʡi1机6"@6+՜)ł.~zNCp9O!2; c>Z BZ?Ց=LN{f6Ng*m?A,BGk9oJx C/4g.(`@wI ZViҪ,Γf3B'{zVqw\ax @_l_=Ky&8qNL3G*VU$P-&Oʷ'Ma-ͲC`9!ǟ=X0yȾ]iΝ-EN}:\ 6|pL(LSSwQ}F+`x! 4K~p)-#T[)()\~1y40kO.QؒgF߆ n_ G-Do3?Jw<{ǼE2^ S-bg=sӇP7^T L)]jxti7䠇S<("'` &6/x%zB7Rjx`]8Ԍ\aguD }Yuv8`CQu.GNd *\!^DZY) $@  T55|oGMKa̽g?ᤅb9p.a:jʢA?|]h<{ZOvVi#0A!8#~lHJo:h~IbXTArA3f%6DD-t-7i4`cO7I5Ih}cA&ɬ$ԔY #`Hg=.4LP^J5H6'l~ g!-y0cъ,is3&Y/"hƮEt:D$ e̱Em EL.1K}p ۠j4vVQš;cg#}ElyJ,[5[/&]w @р`K6%WG[2_[p6h/(0=)g0 dޭjA_>-&NsGA /+`·5N[ۿoϔAy=RX!:.KtGTnM9@ݜ֡MR;>GomxT2GNlU-y]/aL c` [U acO%w'*V̓ rۚ"I֡H?VYEd)VV-1Hvʭ|syBZms7NqPq]!P6J~ <ӫiit5v'~jHD m ڈbSM2wkXjQId [ER6a'37ᵫ/,—qmj QYD:kjߤ*jP"hŴ5ѴSyG\IbkCS$Ъw9KAHL2]ὗY'}"WN!ETPJH }=N:{u1t-Ph,+B,n[!}wҵI9.%"4aIe Mq_2@yN qOoǰ;ycC`D<Cn4]Cqs2c #}~дCxyXv,mR[!WNX:1zGWYx\TNg[_~w JIqǼQ䴯3ĥVeBs0܁;KHK 6|JZu  m[U_3-ҝo(92ˇ_o`QvЉW(ZMܨya/j*5dArSDNuZT?漐{V;_g\Ϭ'^᳤KU춅[+I]U1lR畹sIh?ެA[!!8p'yՐajAWn('vLî$].Է4˩m{:z d )~4D|ٸaLROa~h`LF^Q?F?$Ӌ_$(פWT*=Zi9 =(Tk쫊PWyxTHV[~xqUлܖ ʋZT=5 8t9\3#*vA/7K=ׂVh,߳\ @KȞ)dFRX/ʵyJ?Qj^Y{5.KcU\mF*D#.8ys(Y0.;UTQWvl B`@<ߌTuHx [5QmA~A{fL ͭxIK4 7]Xwzvf۞%ōꘃḇh\NwJ&Ҧj?H/!Xj "ұ_a0".L۶}nKD\JhQu@e_XvUBW=%  =5cZP )U`%ʍx넅p( j)ŚrshR={{d 0WU2~yw!P. rn y "= n.3~C$.T\(StvKp7z-}hnA+ $z4ҙ7IrO({;]Y^\?ŁphT이Zuбm{mtP_{D{\>y-a7H0"~]}$ޟ,FJ™Z9nPY<#>\ĺ"վpc6Skh&V8@Qh֓tL]U9:Xh ثtgHcJJtRg0xDu2N{vXlֲL 3ƞ9\sb G2u~_.Қ Ry} \`5FGJ0Q!VXu[ʴ(=J>^N{>gjytD+/GOQs_E'Wogg#5,0O?񉆖Y%Ĥ/w901,O@>㓩9ޠFE+jugE/Q7,Ql9:WʜH )'(5 }nv[.d){#Y:ځwrUF2 )T cT EN7>zQ S ZF҉$\]:֍ vQKͪK 06UW.~ y䦥~r(.`eO vȻ$g4 I 5ϛ;Z!nl1MN5r^E:C+^768:sqyw^1hr;瓺鸞s)੻N\uɏ+Ճصyt!|Tpc532|XJxBW4&cNݒa 3COrDwGe4M;RTɔ0XM\P|ݩh  @5~0В%@STK] 0ΧK*-ȥ])IQWo?z_q~:!JuY'N#m ]I O_IQR_.ۄcA嘀eXw?r`=6|VGbXoZ/sh/r\lD Ӣu[Js/F>L_n}i )|/7M^Y+cQ n#`ba'r::I1]2#lj?F'qJNmÞt퐯oM]\_mBҼԃCBᐝ|CÞ06U,>`uA~Gmt1*+#w] C2)εSfPpMO ԽMnA4o%⺌s.A~XOaA\[J`@,%I›KmCo45#&0J;c|MMwoI VzIk-RNӣEq|qrUaT%mZI:s~1D=wox1<ͣD{!{L~>^c?b,x:ß<DlnjgaW9+/-(_j٥B] g&b OS#{w0CoCge%89 RvbM< N?J}) p[aN/bH GfXsf 9$Oƍ&n eq#e rqlYU9IP֫5PcA:MKu->̑ST~qZ)ZW~"O3xi \{B4=tqa}ޘ=yYӺ 5iT>)[< w< +iDu̕$ at4b®{Έ埠z)>q쯧xe`ΜWt 3VPn4 Rx-/PIm 7ȘC(@b,aP1 KЦq ,|͙]{FɐIhST€B8&߈׉cާ t{Dc 0'z[8fe}9rM\W_.o0k9T޺<:tYqrƇ̴Hmw dA3DIY݅s6VI`u3{xW4]_,W5 ЈU(&;)LAѱy53~ \!̝orJ%گ2 /Z`g37'vmQX.~KlB\PlSPse>r[>r˧ѶuPfHP!!3U`|ЖI#AC56 cOcnX1qC܎,-0}á4^+{Xx8՘}Y<%{: ^Oj9 dg;t*J'ױO>Mn;j[256ߍvOm(Y $amd-'LI~]+irn3ȈH8?uq";x^*9Fl¼zV-{LO.JfՃCw>;8+<ʭj;%bD?TҨg:M}sy)%Z*=ف^e&Ԥ BI#n+/eędN zc2 ~'8J$y#gT㐝 :W Dx&_Nr;){2>I_^RUm7$C{ǑkȰLi0w6mnlC8NQNP)k+v:WU&[#o2(Su)7p hszLu?Tl= Amp9·E i7&#V!s:,hZ-r[ጮ N pI 6ԥ` :Kڥ:2k;4*j% R \13"}'՚MgeplKjD]Y]&TCXTHpeU6E4B.|} |g PyZ\uˇ2Tݿ}(f1+[ʧ3F'ySK5,'ډ|ȤĮZ mǷ[N]lODĚe ppB*RH<]4qКj ݦs,xlG6EcEG.n$C0&^=)5 w:`ܚdvvFJ8uVՇx&(ճ.Zưx0űq/Oe[>P/bNdp Eߙ KE6}31[wmϺɺ褗\1$PQib顬E˩{B3XF8&^,7j?WtT?MJ88HsgGPxnD r>PH属|oKj]! ~5 1 ;UOe4t佾yTً1ĖE9C n:s,.~}{MXMw$k[73s: ʪB{PQ5T]7|Z!sXԘQ;D_rH W#+|0yĥX's8ФL@ t}ve& V*F0588"Nd]gn?$"]mt@8YBsKׄ Q'ʆcJ KվOG+jO (W[f*<x6h3Z nٲ`S6o#= ZB} #2EhR>k0:x_uCSOV%,ª', Xz4}&٦]IQGT Dr_J7Xp+L󞨺)%(wFx,hǩ 5@i e3{k=x!\\ĝ)eImgLaaq۾p( \(n /< 7 YƂڎD*|FU󃻘1N[;\IVCNa VrdeV?(b)jR:z3v f$VJÍ[鱸ea*X,ol+RYdReKih.H1Jtwu5Ս!FBӭxT!G}`68Z`[%jbhWC&[̩ xP΍Elfi>wNIΪXƃ1{SJq+OƗb֣\!RmL{>XљX(}Mf#sitw%S^eI7h$- : ]0N1KeGQFpvUѹU@`xAz#v'`y>j7@I4 AeO.7O8& 8yj=mQԧKG&P|\QP1m~0$[#'C >~M~ˆ}?˿n\wqL?D T++#+~cBǥ %rAxtwz d T:\wU#,àlav_o\$Tս.ojbDux\XJD*n) st-rpЁ?g[^sC$!Ck٫╬c!V5$"1W+*IOs"?_{+bKhy"C}Cuh"&Ü| +#'lIMɿf'2CxO܋d^C!)b쒩 !О[nQDr# 1xb-<:n{g!]ya},^%:C[ H^|O c:~Sa]zvj.rTEQ,KxdBEƲhdJ@gT;dps$-4@>x ç zT&=pq@ƤXnh3Spa€`h()śM`QD {(ڢLMݍ om=qñ_Lc9?jiNSNU:⟸g"9x# Vn3>SU7ANv%}l5nG֔φ%l'(kER N|M|4Z,:ʂV޳>Iya|$_;FHd[$;g9[q3_͈0bfkǕ6(m&o%L{xG}Ba3YDִѣE3@[D5wO^Zuk+kvUbJzJQdci`z5F!-*^`12 }k$YFyZ_] pX1G79dxXK͐S@mH6`ѩDFLA5>)a`O򹞻K}!`:v/7ƶ T2jP3fj4g :!cP߈=[ ˊ:гi01#X;ᛯOo}Z%vSX lϜJq1*ӈw5kV4%y?9pȋ%X؝?-b,7 WxrDyXdn}J3Vw~KŔ_z#P +pZ! rv}l[.6mXPo+#DD+MDW䱫YT 4dE_xq+(k$@`{&z#yv9A<*);[3gj)mє$\A^^İB |`bxo} \uWco`wض<,C<@IX/GϿ?S%f6p-lgsvu-.9V=at'zR[V۵7r]|PZ&KP4)S&yzuVC$KmGfWre?$ B)^gnl;Y7j5 |aa3o_}NajSkl$97rϣ?' K_`늧%QG`ra3gʺаG3|om,ײET6 BKK{dr顸LQ3A! ů';DZ+!(3YjUtY%{3c~s68su|9SQ$I}n_¦bw8qK<7J `I2iԈy=yu\;m޻_dmA WvssKj/(&vBtbLԄ;"U 7 w9Ag,!]^IIOtPugṱ9P 1\&0B5cUiuT!*U5DKh[myxjJ *pE7eK @ h1PTF#Mxp7}î ԡflȠ2 d*\]yU10:;+/|!qG6\F.&ްn'ec[_qO_,P_ WVM$ ; D]O߬ԗGK En{&~9GȤ*ʕҫyl!7 nb=D I4#jq 3 LgB<}ԲD{PB+~8h[[ _U'Gyr2V5p[gp wfG2?>-d3UOdMc^zWR<}*.f\b<Wkje^LpԒ 7E8H-D$T BvET:o7%E}Ŧ`"^Ө(db>Z5+G}.JyjNjtuNp)Bjn<2Ή ]\xc: ee{^ӊӡK@WGh剌do1lmtzڑꈉ? ז[, |]TaA"߼$'5I_%ebKKh$#|")>rS:[v\n$('\jtzubYyXemxB  *.Æ?~,BW,NKa֥$\O &++1 z" ӍkGxXHZDEI wNJKXeqb0j`dH88ёÆ_VJ2-x3RŹ~#?rwï(3(lTwEΨOhU4T/ @0n;W(l^.6lZs0^)Fn;v$r/ Y(#mM]/*(OHϓ~VŦ Z4h/g=hm.[wv@Eoe7Zȩ[ nuPbd-7:AZlʂ`5czDJ Ń)GLtpx خGsuLE)B1Ч"db\) )4`pG︓xC;c:ƾ V?̨^K둿dfl>`F`}(r"ļCJC> Ú2IPl!9$-ѳըP9>5*x/uz:e*KsFɞRuzOrPf/gL̊Jg7.`$YLkΐ>^% *2i oF̿9Zآq3i ݩ٬%T)ڲ6vp4K9YkrB_aVF$Bbtdq:SYMWxS h6bhD-׵e_hveJZ}Uji#Qt+}9'P(΀ ( V˿4 ox 5DhHdȕ!HzD:.$m]>d7;ߟ|:>rxa0}H+֌ |Eɉ{n3OH.,(} H#ֱVӉ[v cEn`#)qo*ʽd:Ћ*F֌Y"=M7N nB ȣOl3V(1:guG^Kz=H!5I>G:N V$gD>FuWf3o5M RhmMy_E_sB}Yz-,8뿕1dTC,/A~Y,r ]n=X_ $IUgZ/Oە3ײzGVE 3w=()0K.FW[]P&[t ϳd,)& ({t8Lso:Ce77:0ֹyזDsk} ־3B8'H<%#,^ 0eYcLCkF DU{gdp6"aa:Z,|1Hn64M E^{+\ǡ q߯ϱ t8}Ý wy!у1 Ĺ&nB-S4¿Wa}$Ey N3_R()fgHX#KS"aL8qpEǸT>jȧꍧ,d;uaH+oDM&KγUEdkZg?,Pd71>-c+Ȋ.XCŷKC1['7%R&۬6 C\MNrQ^)>05 A)ͬ8ȱ]\;Wq{( {S"mH7st:bkvُ6~5 f)fjn]iOB])Ҕ &ry/A̋~O S*q3_[5 p}J<Ev;| /G:`*ets^|"0#ZjE㋽jn>Q9vq$|@+d=dB{/Iynسw-&/4~ɜ[Uh~3$zҹ}h/*4q[j1oXv^s$Gao8zH^KE? }vsԬO0WP\qp z5M&$X}Z{Qc˦Bx˓o!nh\=a`\XyFN/љ[ɔrGc<4\"sH);iӱѲkd5? "E^LW%EByrI(4ix3 (Q1Huˡ,iey)'^O*rk \- #dJG } h [W#^F3xzj)3돿LIK8F{Wp,Tw0w>5|>gUs1WO]y1XgWQ/LjlbN`SלtP542%.%{[L<@vE&gzW/'OQAZ222UxV tS^_8vEߍ*2ߧyd>x  w43` ͝y*q]?3e[/%X!$BB#"y}Hak*,򲍂R%ESrM1ޚ禑v'FdψU!-S >|ZF1+vNmzi9~ b')&7wPЄ~몜hoda"ԙDYHqlڌZڪm9G<%joDJYO2fsqc4<(AkA(2UۢV!f 8+ᄠjx[oy%<"G!-},<ckp//K#Huf_Bu eӥ1nܹf^HIYuUo_MBZ9+xgW-jo5M`:IZ=RP1,HaS'V;Ғ|R"x-44gB@\0gUs#3ɏ~[0׊sYBpR)K)fu*gr;XM $ 7 :+kn)u&loiQ U5?Ϋ˭ؠ4Y\ի2X_ax{Q6n)1l-#Do!EK tſx&T$O>EyGNKh]2u+!/8 r)uVBǏ5ju!_|v΢D, Esulj!]|gtǀ{z;zЌtkݦMÙ)ٶg:}ѿӰS(SXIٱѿ+]k:^AJ-#^nf96ZjOW\h~)&@fo#k<5%.(ad/PXX.. M wqߩg3Zx8LG~QM) ܈\V ;{RҹTCiѿCF HWpQP -AY1BïM$*Z\ dE@xzeeBI.^]}a׹GGEfڟ%-ct'zO@cz{͞gd]e錑 q-Bw O'JdZ6á?%*锆ٙ+?K[ʹNY79qw&bDy$;inG*?Α٫-]T,jٝq IDQ:wIPeEdWff\m`6VjWofOvDH:LZ󺯢Jb5WLiae;'c'E!r~5 tn.[:QU ]HJHZZ_2#vr2C6kDdî2ʟWyF>陽 ;ߜ&Ye':lm 4A茕 QQSq/R+&ZT +O˞i^~VhLN¹ aψCiӢUfZ*I;)f13"_-ed[/TMb0%rbVZш%֯*t;R}abHӐFr>(?jL/ ݌#$z y ;22™e%Ae6wͪMAg'+*nBE al2 va- ԵGwP RLgݠ6ȆtJ%ߕWL'f,ЄFɛE{XoֻVDS-')f>2i=[z)ĩw""7wnx"yFXN@F?#~(:+g)TUPaID[vl+؉B(Vj餰)]=y}o BLNK}ѓ ‘DEs"]zz쑷JSeԴA0r`VW?mt=oPxr-."oT|2j\8TH6/`{YSƓ"UH5xSU7/D~ڵZk%vb2ӿiEMju"Q.c\$v5'Sw[[^2 ?BY$-5 k3IV*g :NL0W?S?[LGmth~e8 c}h$287B޺P&XS[ǧuW)qvUcYQ&\ՀP)Qq?׈ xgd~y'$7"?ٻ֠*q7} AN?yv:sw[O^]Yr`{a/sYtr ]i5bkl7ϬIEk qmmeci#jD:,(wTl ZCJ€ijܾ_+vvZ-?}-Cvm/!ݟ>Y, -wܛ$GD~أChATz:nMf]iGr#v-^47GD<}<(R<wJAܐ~*\tifȅ<=|d^:"ǴT-u2b c'b&zZ k)@d7ۜWKr>v\YVe>\;)?UZNNL6b)]*J~-ۉf22Sfw #:ruAlj=18f&zeCX/*ΌL7S8\e% N3JbXۙiCtEwЯ[6i 8aaDUʰɵ+ā$!|=~lӐ'ʘ6u\5s)Hd`I#7+HRF:%/9Bʟ͙}DD >tm0-_9{3>HokYu*< Ҁ4xM;TaQ9!yĸ\p䣕؈M0ꀏXJ?R"LzjD"GGkɐ5OFͺ# W!cfZ|)f];TEI@%nOx*}ojec= ?_\hp3zo衺"a+<VL,U/|599%c駺7__\,z*t_'^5; [y{޿ TFoݩ l(BM̛\6ܥ#.PMڣآQQ_1;yJGA L}l]*'OuXT aJ`%j&5L~$Oװ7 }ZգGwAj{8QiȆwcb3DXu(.ICbڼ8Ω]#uSGCְ]G[4gD0棲f^=PnL4̋<& i5컬b+~|00e*$vu{#2•B aaC9 >h\-Z}-cW *qos 6|[ k [K?o]@E/1c6hqi[jJ*mQ2 7р 9gTUpkSyݧO=(RxF!۹UAL Wzɽ+>~2DsA{OtC$T}0R9.ڮ 01DH\^=g`mVU#y[錅*B&BWwBن89w6Yۆ"7ů8f}="i&/yYڊ!%JAxM392=}gԪ6쨶$85{U~xOR?]-PBo.W u ,_ /IX]/mӮr8;!iBCKeh+D;vyqn싊29<.k8!ګnjHLGiՇۙR鮹yJ'kd5ՈNSq8Y7ߥ!X5-dY+R2vCjgWZ#='M]^.MU,hzl}J5P4a_ N }LIc$-*Ea\ Qjfylp~3wH5!m4/+j<ƻWzMLCGg&8ޓZz:1˥8`b+QJ3*(ck7u'fOtDmxmRLSHVz/L܈<3ye/mTH uլF668| j*`0C&KF_-T|6ԤkA3xI/I4z[#_ò_w6P ?\]'̣U#F|()mP/`S`z—4}ՒMƙi޹قk5AOf~ցN*8hLNx?R|0/ *L-|t BBM,B*_>]׊NYRvj6V5:-  [xA*[,B.niSڤ|IYY~U` \nWdENwBĠ5_/;r/bűV7Ƃ rH6$+*YdN0gM1 îgIJi gEN1|6mvSaxCG]ɔ2fnr;mo&bk5['0e\C'UFbaqV ),BZQ }P|Q_ѰӊhZ, ~|s!BtA҆+O7r hJQ4KKUd!Pj0#{TAJlIBG&2j{5ÑB3CUi2CN 2ɿ?+T0q>9F2xŚ|+C&-GY;X.1p${FGۮ];,5]A:d $^É{F߷p.ˤͳ$Ǫ]C؜<%#.bXMH(iD^&>b1t)c[站Ag*]I1&PHY Ldd M$:¸,w0~l'&0&/-eĪA2b=!g`Qͷ6i(QK᠟Zo"}k^Dxy]և{Mkxj6B-)j3.A4HB\|Q:jT%1B/P<" BV9fNiP w-T8v8(R6s$UhZxHl{{v;``ˮN\ Dh:xR6so!111AiRCƃJ0 \GV4G/Z}z-޺75͋$bM[I:Kc>esQ-coɔlR~߻BHƀx$#3NJi^dň^NvKV"tMюA:TqrvM*午Zo{}r5)Ex1ZW>}dwOhcz^\ 6o7.;jm ^g3QgCuKBs.X /-Ol@g_S]n] aΤ4BMdضp=7},LY؄l,"XkPن~-MGLV bX';]  +*q*jhԇovHۗ&kSl0;%pӺ3.e,k;)Ok! z獯4`_.뒦عŝjםnX(>zMw8OJ'?pMAy cOi̊]~5lle%]EnĒZ^j9o?_)] E(Kh'mv\]~GXVl >AJdY_R>ձnZHnHE2F $@%ڸq‚c:o>7r6%A>s#o+fUD#ub8jGp\ue⢌8x U7WNn>;{W QDs)lՉi4% xg÷+NS@bYTzw 4cgJ/9ۅp,YZyĥ.cJov!Ply*V{5`U9bu~ }0D>b&Ho82ʿU":\MKtlNȒʧ2CRW" >Ϩ8 dZH 85,ςθpnY"~a4m_Fm"g3Ųʪc)]鯲K,8^S[j*8F@Z6H4M/I &m7L[ǵ!p6QVB=]l*F?Z0>Eن2%J| ǥ_ܢS,#0၌^2p-:WaJ/$zLη:1F+6)֧\C#bu,lKjWtQL r/|q ޶ NiKu׏HLĺ2՜r=paQ!bRd9{+JJ:O)QuMDUCS#@oՒ'dLICLSysn0/so8f[WsnKQƑ;"wBO6tV~I*(!ַGZ[?d0WL{8scBgv!>4;ZI4]gd‘t{jM5}N. J]M"c:.V"r~ !شΠvlnD %t>?V>T8ٶX 8W篭Q 3ē,?W_DBϝv*i ꄈhwΝOhgWWd NES1/<)D*_ Y?ºZJw#+)j9~€xt0)xN⚞iXн=^sjM0P`R&9vC

&J")<ۥ1U'׍UDzuoMv|ʵpFd?%n8#>%Rvu*_eΝ5&аuOKeLCmed _difFIM]VtG$߲}\^Exm(8^.w ,OKFB sv0AHM-vdTA{5SNqxb+sm ϩGEX1$nU#L9`#/|t9,>+]5^m?2l``mWܬTj?1|f|Q+'HlƷ)z|2i[Ɛt2g{P{*큎f4jͻ v3 :V ><а*$~; n`ԪhAU׋!\gtxwК3DЫovτ纯uBHğuk; 5[g bj&as,Jh2 ; u cd5/ BNd0_hCoS|MŅRm]-24UWr%pg,k2~Ѧ*ި ^FWZUl]:j z~8NJU=ê9vC7|8Dv<Y)䍔b=Rlx +R+z \n~%SPHj+L%}d@\?mupzV ƅ*jI zOkZ[ X><>Đ:{w4r| el3gbT;(mg|X i1w6C2[V#c/r{>z>L]8”{M{ 1U Oٽn^\KWlSbXYGk,O{ FLiaZzѸ?MjIx~w*4#_B%s=%?Э.!2"D|Gh( m@eVx XV)pV! 7d#LR4^ME"9דq̺B:#fD߲\<"e 0 i<*j8]4mMR$[l/׬(̈KN%+xA<2PؗɂU IQ +o[A-}q_pN(}Q:W~>pCk惄s@N +i8nTa{*?v0q   Cɵ 6ImшOyQȇ.pk~f{R~gPK\AʼnMo&뎙Z :fEV rxRk)6!25G}{VZ!B?n>(SWIJCiEr "3EԚfI!q-+ UEJS_Szlǀ`U!* =ڳ݈?Ov PXM~}WӪ:|EsMFCӁVKlq k<{:Nty7`[-a ޙC^pnR UPz"RÉFn|eb+ܠX81J,u?#NN@H 4ѭ7xC"15=.Y46UW7 \-R-%/ܥNg7;S T$Zb'Z{?\J?&jQ2z= bڦې7'di,`+4?PK{h>i'J+,Ҟ̡!6H eIrJH4,V (u 3GilM$ Jo5x sߨ-]^@g?a4Mmc3Dt"_z+c3Y:\^X][SaR*Ͱ$:WŧgוՑd*֥aGJ펄͝nLq@w)qtЕD:Ka򑅐!lJ (k쨂<o x<5/Ğ(R AV09k|d︈/n8tIW{[!)WVMC".?vX%A 5-ErvK莻8ԍoB\(,g*1Mڋ8J o֜K٭͎ f{ita 7/%U8R{ˆ#0fOXJ b*d%߳uQ'RU_wTqe.e:)bk=y@@xN>?FXpVKIBiK2w+[i%zũf]CJv*>B=4[rZ%Ú.Ό-!=?zAjӟ7$J 9S!H:y~" wZ* m#5k׹ehi8D4ad(TT"Ov`r)k)(Kpw0 6OzDbez$d.ν)PM:zv0@XtHg3jT&*rk@~O)t*&{^GhDe`щH6㪒|Gh@P7Z ?@Tu2"t(^Ϊ?&8D lrzŠ(͆%Au.}lU`I֘ȂC)J83r݊ɠK>wYDEGwZج$AQ!{* X>0"EV*L{:ʍG%'=BQ9 ܼGM7j93B\:4&@zZ ֻBrg Q?r}&#׻[p&:j&;UZC_5޴@(JĚO>/izs 1FS:GY>>zMDΨgB2KN8PtZ'=?b4r l3*♕j*e ȞEh[~a7ά2tD˶.A ]8ꡄO\{+`46ׯGZ*LV4)cb1$t1W)zSlVp%|4t +3ڥd[w{:g3ۤ+g0z;&1}l"kֻµm"vu*vxZm[>H$J=ԕ&ܚ=9(dU$]gƊeH%.A |6ڠMe۰@UjDMtA8U{*p !,ӧV9B#@?D$ܛMpbIJvHs>N`n3*p46CiU*u6MO28$㜟ѓj3RҾ4QI{vVduf\'¥L/E\T2:ݪ<C|f~t^9bZInnIK.51@sI2p W+.Œ(ҶNhTLtLn!포h'gԄCFtY@8BQU$mK~߃yRk#Sǽv4G1tՕjpG3aǻZ24RBd;DpWVLc\5pxjR5uȖ4TzgV@+1z3M I {y.&mdžTt# CXL#% xE}ND? ב6;5)Iѱιs"՗EC".<I^ݔbU<|AWt;3(8U ,^s2Ŭ'Z 蕻q7{0-k<#i"oY+0F|UΆPb4ffj.$;4};FJ}!k븹EnxrTBro3X,+Or7+>-ZbxӍ:9s|{i!{h%'CCOJΐ#y-ΓhNwdhDUŀW Y)U7IsxNr\OHތQP"Na liM` ͻ|A*@Nj?./ NjImf6qFV1.$s OS|FrSyt{Zf"$RO%dӞxʯOT:x͵ ptVz`'TÅq$4iyШ +zq%ƻϮ;ˤ+ˌ=܆&>3ḩI\6&JgyT#3yorm0iAprr-٪# Z}gy\+X\:}//4*2W=̟f!%.=?~Ucd9Fv\E `*2>=6Ɖiy0sj {4L'ӫoѯ݋}B}O43#3<Rg)̍k&mܰH$nvDB^ڭW,k| evC]GXɻ<% g F^wS!|Q}_ f'9kFQ8Er.5u>`>(7cX[c:qGm?Y}ˌ:KLly~Tc7@W: 6:MTx8dSuDYwgumJ]!Ê2=a15v.ZE06$N1گn"(ŗpikPt`ouZVDUvl;<KaȐ6oGZB?!s:*ƵJl 7B,}B' ugVGɀ&n5DWYΗUmv~8 gx9b+]Q=KGZxBMe F.=(lY8W4{D:&=~}99M \.T tһ8Ed?:}:Bk"-Y|4.H_&; \e%˰'E<&Nk 6HM*Hڣ)UWB3p-'sJe/5lz}c"PCt@q*kGZY_1j}{WOSqQ_v,BtE*I;3j6_ة48waG 8_x zE܄.H2m+zp05\$6d!KI{ŁEp}+v6ee_I<s rÐBdZ:G-@=ࠢjUO06גM!}3YG.ïpT=slgF(TQt-k?U"cRnqBlWs 0-xl[Y~B2G\u?ËsԌKMNggֲW]/Xc޾jNL2F·c/Jsi6X5aV.uw s条t0PCPM'T<`V$`QDr̖!O]rͯz%< 5X?0m!wWfp\45Y;D,J^G*s)V%fmu#@b;Ͼw?8sC|U Cд'U!1UIfCsDjh(@UѷJlϱKSw~vhcSv6ӆ7~JLτImT6aBOP4(,=\3 )-%f3@L [h\R LXvYK EQirѐEXQ qHg?ur=@ser/*.:A,&EHdH(xUSkc >l.8[R9=n]EVQS"F!IgDQW8K])h-q73M"(8jn$Ѕki8{6A]UдBx3gH,xg$IӪѯFc8,fH8A12h@rǏ6 ~ǫ?M jɤ/E1K K٠'3҅;i <3 *0 D1fiP OzwGrO^2$0:uA`]yI:bEQt%$W !d>ϥ /c^G^I'5O>`eHے--&Vg`g px^pX83)oi Nc8 y6VV5)95F9v7ەpQPv;eetRԉ@VB{FF ĝVĹ&CT !AhֆrH 3IĄ0E/ha\8]b.E#M![xts=U^p]s6Ƣ- Kn O*I5yXWB&BH>XxQg[˾6@v?BpcdLz,k6Jb,.ߗ>s=$s$49OYyR_NAyhY%1qgCvAA|S-òtgW>sw wفb3JyT]ۭŢ#. ǹܣrɞ,r FhefX)oɷ+HRB5TgkT5o26L ӻsΤyr:/bΓ^wDL^2/ewI7 T|tIdޠ[qW/7IP-uҖ odM 2̟q>6-2'k꫖k}T4~s Y(cjt( 0QmގؗQΤQo2^Ԁgi:s[G@Ofg,-+Uo6jg;wdI&Btc0-f¿ͱm#wr"b`ʄL`H*nFTOqgC5?U cKzR&HWTvd0Ǖ%e=UɲZh|2$) Ƌ*ڧJ\gk[N.ɁRب`S&3ΈrQ2;0G1_ύhAS4{#1 SB*D;jy2E뒠xD(h w cnaDs7gsIٚ϶IC$^L5d*gp@O N䓻9\wa"G65vĪ=KM -)qRpQ#"Ɔ?$~L#ۅncgyMJH^^&f"L7?t{67Rߡ\6<LrhFC+}d#!F+RbJ>DhIaYu.];XׇS52wJmiؔ+_p^\G?Ti !8[ = "x&46,(NJ7QC"E٭$BV' e 0嗶> |"QML3qaWr,؎GY7F8(5-utdq y 齃'o73 ( Epz]IC9bXa+?ǃwr ^1Dpe0iS6cBgf ;o{%ss ޕ_Qf׳!Q֯*~"&?wMR4ЊDl*-Ag  n gtF¨-ߩ*R[zjsWxU)U^E*V/JeLg]4 Gu~Bdy#fWԸk@d;-)Ϣ) ?s?]غf) Дx';cTЉ/, r ҸŧֳP/9^r@dGb&S;fZi.XZ 8mS%p@qt{>Uu1[*̗g\+r+_N;= Ԉ#M'{JlTJ0MC"axPw2=ш1bw U ɢaOUzqM\D@+YӺr`J6g@eBPBO ^AhgD,3.ow۞Ctg:d%/Fmilß!F4=y_hg-Φ/#!O*/N̦ %TT@t=输y{m ΃~N=*S"FmA5PQ$&j `p-) xcio)Ʃ6^ŀ&zdhUFg[l˘iOU_y 3v%oАuuɿde822pgmH!'҄b5X C017@w˵9@0F@mXܭʂN!:;K;b#(GND'Ѱ|1> N3{[OKH;\ul>3Q‡kE"d]bJ`?ojF΢0sVRE f\ % `௔8Uy ^$1TMRGw#_Rd$|r>? M}=LS>_9RtZhBWBN49xD(E \ORZRxc>:#kzJ<؜"=?+od{KX} Z`8SA3z9֦ j<{n!⩺]bnb l@::CT 0P9$|n4eYSK=L Lj4:^j2Gu_ODf)P~R$?G1"oKiUXte/ ܹ < Q>/=[E~_D3\tY(wkd$AQ֌D՝Pn{J$َ'B(4;LD"x/^ v&^o^1TZ/nL5)3r=@'rKx[6BWaB@M:97.b\{?ss>c‰Rk^ dDV3$uo"(<,;?'sYd?3=hMF/h'cltvFwüPr;SBItr,FOȣ7Eg0%vfZ0³3 _B2JABGm$)<۫Q&uhcJ{ \q3l4cuuĉ~GY@C,FI@*[[N`mpHf&JZ,.^5+.̼#0:1Y1cgWR{Z{V=MnLx$ZTHXsx|bfQ:[6ګe؍YE)H]ףQܓ P2B`n8j#eUү*? <RCL >FW]Bz~O^&)El#w C*==y>wQ %d Р :?[g'◱Qqr2hŁiJ0Eh@uf%dXmMc+͗ZK-JKqcNK+׏~fvʣlm=z)TTt۽k2HP'͛.x|+P=ے ~uD~R;paq .=K895,Et5 y(0S5W9 qf:MmN\|aa> p_񧢧HHOc2.o!G<P@CFux> cKme[i\Wxk _e0U0P1B B\٩ @aph[P6U1ZUX 6a`./oiӕmBR!ҹZ{Q0Ƿb ۤ ]궁9Wi]kO#r.8~x:8X+oˈ˥+qYiq#Q}"z Vb2N niஅwPW>~^'YԟXjIuMV.+bwA1Uck)tΧ_1wǷ^46WKQEdg[S퉓}M5WJ"[1AnJx8j \4gLUPvЇ3a2u#<jY)->nv06 t6 Ee}LdIwȨ:\ )f+Ca9+e.nX8/%þ_ 6E%]aWkC+ eTsQSB CQ@,ԑGK^!S+0F.$x(CuJKJ+^ec}"V}Bkh\椹ڳ\]x--ʢ0=sCaf:RrF%m5a %&<2eL @S1DW1[v 7^8Fv'N媫F(+瘆NcPAe6'@&טhiU:Ovp({6rn:~NJ^WJEWQdopڹt*$5Y^:X(tG)mf4Iv d 9@<{#r0qȺ \2%'K,VVA%{#Zg[ ͖FxCe(3DWjcn[)CƸ׿ȏbĵC/RS&縃E!orvxZy <몯|=rʷYVo P#4}C#M޻זsLaCK YFPMȒ8o93`n\֐%m2)$Q˓i)"/Zگ{ns9y]Xa3/M׌t|<z5,n>}vëQ*&ņYEYG:ԻMԴpqh]x;2%C\@YջxQ7 Hɏe ڿ%'Hi5݄L?ڢ8B|e} bái ^r L'w㇘Y^o8d}4xd#i\cqGLzV<8y.xo5 5o[%&Ep60AQO [3a?sB΂YGL8Yt} ͊ a Ư@l(~g<u0Ncb$0.('AcSKwbK6U+eD֔q&^4=!a0 L# &%k6֦PB^dKxQ ?D_ c gukd mA…Cj;qr&Vу+I~, kZ&ֽ]2W†g\Q t8Ķ=5V-Me:uj4W&{ {3f@ey.TzQL.N*L!wL'1y}x(b"(l $iBxz@"k@a!MY!!H/sT+f zoB~W9{ 1>i9OPG/yk Fik~4y U4d[7&gv8*̒%Ӏ4-J_; "ܷUJiLLí;NxIJz* wY/Ӿt]wR&,XtB A^u\! |rA`S+b酛VgrYq(>(!0p> P5ߚteKjiZ5]$X,VWB"7?^̐˳wde=Qp) dN_5f?TLH @UYދ|Apg{*X(xCtļR::'C x^+з5ۼ$EaVL}"d*Q|A6rԴ2bռ4՜ˢ+ ЄP<#;-BN"k:QJV'L4c)zsgջjp:it, -Iө \t?aoD:"OCM哜~, ^%Tw5(_Bykק;=l3I٘cR ,%\1BaZ&o,OJ%p„BLQ-_6IN!DX풞Vэ!,{θrX_Y{}?.%}u: fJoȻYh-;$cf?˝e<R0d%N9EGzKx+YZ*FBS03\34Tk]I.7 eny#W#>v"AyBo@6 H} ĭ.ЛBw^3M P^@@9rO+d3v!_垊:%GUTd~:y<ԭ$$æjLH, 07.n* He+BB3u2m8Ej&Y6n˨ Ȳ$|ʘ΁J솲\4wtDr5!e֟yjky'oQTĄ9 ƈ:/gnJ~ ,$}PϬכ8G͖#a-BͰQ 2·:IyWgz%/2&&0QqBm3{ ?>ҩw20.ͪsʛNIfVxm1r>Q;չwvl)]!O4E'~z8]L㑤-'̈́a`+P9hF(BC6v;EW) {wΞUʢ;OᴋXɉA<7KJ&O2}2aG% \xVJp8 t&+fmKkGqxsxOx.WV-&{FH^iK nTDCgӆy,{ )[{&+PGLT%]!^,:r{!6~>n3&yd+Nj@@oCShQnpZ:~ ZĐ#h n(2Hj~?0'9@n>@Sntt+[ߌSKۦ1V8Cϧ|xA:w*"Ep$/bdcwDϚwE#&@D!z~n:sB2\TZ5~ a l $Bt~E6T:N.l!ö5]wԡ{ϲ vPw#LTŖI|~5Еc`T]7 bqYbb!4ILVE*[ dA БDXWo|%ekʼnumçp:_ک 0R{x4]q_@(/cő5Yr hF &"biٔx6ja2; Rm@.Yx$VA]gC.-SPiQ^OaOȦ :ҿ= 8s)Ug*!X: 7n恨kK*q_#1G=7぀ ml&G)zcS~ص9zFâ1VݬQݳZsT)1S2TU+}! :a jڨaY:g4C ҀGcBKU;.]8V c{6%P6d%>+Q{QȋLCD DQt'km=dEoy6ԺKȩPE%B ʭ]lu<`>w eIo tj80o"/-+gRDnrE³>'b @L֫ Ńg?zt7"/<:φGcO󛇮Gr\`Ү|(8ӊ&pѭ/A1f `,]N~[5+Kw-l3THf; E4MSGu+v!A`Y/,[e)Yފ޷$ۓ&Nl&V8ʭW`nj0J.NI)4-̩nmj]@i2/m\ }θN=2n&q bُv3o[rspK{--kOh}!Ì}wW(F1W/t'䮇xطhܟEUԽX0*dO/JJ'z_9 y/<*}bPr~`$E%I %Ld>G,p pNkqZYbH{mT:o gb)Rcd?L{I+-#vȯ!Hg5\w6+7^磻krgDP} PEs Hu)s(נX򱮛&'UkQv}vZTe) J~jGBԏuh%5U'Jw֯º^ 4*]z8LQzpJd`%w.I.^L.O+ov2qK>RW\1jXϏדȮ=l["R-= V!QP ,hksS)"Ɠ_h'i2'ֿW : n[z dRsWhK^ PXÝ qm XhN# lu!g3C&{Ov lPܚ%(y _R-g1#/p\[@h<Q3_)"imlNW2ǦV*ffG$!FHe| I{ژ~^] tyaViaQMJ-jq3>kuT}י6A@FK1޳@ 8 k*,|7uxPZ6`gLA{(`f$ľ_i(:ٲo?X'E. Y]9NT$v` QX۱_3@T=FOD;1SH%A۹Km QRrX 1i3mCoK r9lhwɋsxWXfؾp޻Â5(]tۊJ-4&Q0#D@[?TԋUQ+i=N5EUAW|1`C#.nv5]:2om:24,#"6/rfJ}? T6gqBSyrs v|pti^? 's۶ʡP&FlSf/ 7ZEdm@\uO͇Y6 f0i}˭bUl5ۭ68tW1ywClSq=t's۾9jTRH\w,eޟAoPTvAe<jdAzqt\Oag:K=ve{tg sdA ftɊf1CGJYw[xs)3Up-` kLN(#x?3Z>q24B0<^[־sq2!Vbo 3}8e\C&[tvI RsܟSd T7y]R'j/b#.䰨 X7"ah‚^;/W!.B9k'Rs 7[isDUDO`tNM0SecPt0"6iܻōu}okޅ"Zu*:( >:2"?< zm!x/iZTJo28Wy֫YHg)c®mф39~hONi]6s R Q (J=A)Uk Gegmn+ݫLO3O $6[NޝU"JT@J/ F-Cͭۆ2ˆH?.v\-c:b0u*.~B(L#A-X_1՜5_TUfrC@d|&zY1>y%8^8WyNI ^u:vR8Ǔ" PQl=P߽olyiRxkI%!eoq>\nom5 Wz$ Ϟ@G*8EȗL W'7uעt:bׇCRkؼA|" FE|5ZʔoIػ*Bĩ9,"hkE@;eAb_"d[[2e"Ub ~umnnOQDùR =1!]昩{y=O/4ڎ›R[RژDU>Y/qo/19LEXy}H5k~,/; ų؞K(hzݳbA8fmlȅq nܯx3a)oBT[RD g蒁ڨxє" Eweɩܲfx?BB.ͱ'PZJCeL1'1ER`S[r)J}І8=W* St?*JHQ-fz|X)y沌NfhJgf us zpV7HT5w+|#W(Rh~/GaxTЊ>ibXf_ʧ^b nJΒS+'ahkfXes)_[kpwmQגRDskwő+d6y+B#VXqFփ &[@UvSdZ'3NWnٻxcXЃhĽ܀+:`oh 9]q 9ɖ c]m7 ղ罉w+,Qu<-ߟזf-de4R*T ]͆ZF1AOD9[cЂ SF lG@)ܚ4>d],N.h-P ߐauKTʻ-@ qǾB 1k.J}kX|:'V@Nˮ-QP=5k 69"lXp֕Xt3m--^daAXMtT"fcZqN v>Enh'CЃfb Gȧ_n/}-Rv O~wZ]YjWZ} jʒa4o0-:4 ^R?;]ubeP@\VÁJπ3>w"Rq {H>3f##ܒжsOk-C IXl+lZ ;4chGwp qэTx x_ZP`I3ܪJ'8W(N*no@e'{!kc b^]+РK抏i7><7!yr{*IPq,^PRYJYF$S\!3kpr{}I4;d8f`GexǬ%js"y0qmZgY&X.6ǚTCA E_.]D?PMMx«r C q3O{9@!x| |=l5طCTO[HBo=7e)}Ud,fݹt8-!A U{CC'TµxTb7sl|y45b*Bc~ѧԉOkİWh@UJq2+ǔq:~x ]L'JXB?Ď䮯?,PnGw)hƒE6q9"SvF3'vbjM2&7 U˵_Y*m&w*6|"]. 5QÒ;Gyf}7;j`.̹EOЪ2g^:^ۅ9beM)VS@L? Nʥ,_ tkAYKSaC "UA>xnסqS ;ULz :+LO7zNɒ"y_Kkd ˯8Pk2uH$Ld^Z[N&}SF2"D塴Gl(:gĦʋXu^qa/+.b 8}^TE tn 5xr0V$2R@Q\O (#ϡk%,;AII+7iԠ}QP w`1YE3i >O2#,o#*~\څj]NJ!m ֠|TO{U$S]K%mLDcS:N'2Ul-E#?+4O<@1;n6H3e-p{҂585gk|_S%Inϟӂ r5 a4ܺ]-lKYsOL/x:(Rt7\c=gsJC_ tWqCSwU5" `RdkYguȩm_ozJf_nyxT9HPι$my5g^|zN]?QշBtQR\:p-("{v9g IP*4'tax\HK9.rb{o(yIhu)NXraΰ:p~ƛS ;hC3ti"𵒈 ! ɾpė-pS9l׽an*M]0_q_ؕ+PA'+o{h*s~ !̇ƴ&/F!΁'GJXǿ,6JrWϻ6'_S7) vٷ?4跖v3s Yz6i f XI݇=Z#<̭>.V,\zrDKF;]|MEN 34埥 6e@3@ccQ' $c4^9i1}8ih?dtu2B@ƄGC,P}7&UZ3/csFg|U!hy׹?5MOl|"$d#2~ƸZ?PS7v1 ̯ܶFY7 >)}X7rO}w03rPDAr=R֌Ҟ9G4U4VUti6R 3Ld(t/bb,A*~ZQ{9!XU)6VZvm$Fr$?Fnfyԕ;ͳ\!m[vE0\kcD2.ZŸf$dR(M! W&<%U.җϪ\*:̄#$9+BKunu]li-LjI ֝m(X40{&k"ؒ0ZUq}\N҉B>B;c^ \tYe#KwKLpЙٲb{eurF'l-Ql!K(ʹ'KP=k7~~ r2 JPLAۆl# OK؋`5O;sΤ_ЋRd] !nЏ,F,iÆv@bX6Nw1s4K>/Dk{Id@_[G.V ʉ< {n8\A^2'E.|>ÛGqC]5 x.!O T-Ng3DZYVyosQ FǟQlA-3d 4IOB:81w}%}V.!nkClc{ʈm3 #Ħ+d2!f)r[\W f@h_JC`ޣWd{u(utJ"PbS7 s(eLW4'ɴ]i F,6MKl:>'L8 2pR{sej\o n&sR"`ZƳ2|SCne9 uM 8gglSJ#!jNS2_ʴf,;ۖ/[-=dj|O{uۯ'}𤵘Ax&܏5ydnpC!^=i|#Yx n;HU`i,i}(-[::fr Klӓ*$6^z|E؈{g%0Ǟ\g<`8c M=4g1N^.k< F}&_('z12u/Z%Vg|! I]XL20C'aՏ[HpJDa-7bm͹S*ќ-,E7-T)gJm$2d5hCsv^̝^TAzgLv7 U}VB<ȐY g:` K_"f zߪ J&nBC9 e,azs*M\F†r{R.sdx;1WfλugN`"\*ʹnDs,~U6*6>"-Ta"],LHe -(kfiC阈&TDl5\^UB7b'p8OB'ؾmY8/I nPnIbq|wިMK7"=-< C5Y*5.D{<ceR3#[IS+k2F{\-:^zGc&~~WIf ׵6@>Tvg@eh11w2ޏ D^UA`Gd_iiRjx>u3.YTm&| Z1L9'ٖ68ΩٽbP*/:*Pg(BM i"c2!WSc٤VE "UW&In{);6pq MCzFSeQuݭ7͜j~=]7Js֔KWݏu_-5r5SQ=rV{݊Z_{?PR/~/d 7d]P,0F!Qk,NȈvefB[7/U\R?;, I|^g7\/QX=vtԃӜ]uki;o/ YdXql7'h QO\{Ҭ0S;AhDw@p=!ޫ7/6&rg gdVewQr̯غ̴(%LrJ $FgY8Ξ\n7+_f|f'ȅ\_j_'!.x~L[,x4ptT>i~q-x:01ӍХPZ4[qA}| =sBb4kqM3wI>BC΂ 1Ш'Ri>֥*iCg+v͞3{T-y6}s(5(q\yup݋I?}'I & RGK?(1JuQ%$t%K|e ؚOBghxFn#¶9(qS#}n˰gqSl[ ;0mwihj{#xsil'K)W<7-}?r!SBp'jav*;hz~TLjY?>/08(]m}Ťs ay@iIVbx [E{əy](5bnpv3TUoeڼ_k~H "~rMꑆȒ􎣕"DXJ*1 ŎB˦%zYtv3g~q]JH_tDgFMh)$neHkA5ǝ)D[- E[7]%{+[Q3Px.gCS=;++榯n8S)GTV;TI3G%jVer}[q):UA}LCppA{^함⍞PͩQN&_^!x7J8ZC5ȑ'INbR[yr/t •)-\sRִE4ljPI@Ҕ7@X-=- pGtI&;HJiktA[oj "!%dxcWD-8a-j byt#. פv:؞{3sK߇,!UR\^@&'-y k!/tFi~JT}r!Y.;7={mQ> PvP8$s+X[G%8$*2Ը.bKsF$:Y"I.lh@?'dGi"2lHraT۠(iE݇#(biYQ-FKjhp۪@\.jvG"|.?S. _`m;G>R6LI2껇]]k77NvP Lvfw!ý 7'#Ὲe$ж41_Xpp=|3[׭./ixhx.eOnoe1i/㈍»wL d R$bP gop/=bGqt=ܟ}ga>7H #Z~kq&BJ]pGI8&C:X=xnrDVOSAv馧T{j&]pHb6 ZCayG:3]pEJUP8` F`{ `wWi8{mʑ12=7C32uc;O5=e0?ȓ+PwEy3{ <(̬X]{ Ci;b3D>F:Ep5)ҜཎU-@Cu\aqS3kPEƥZmGĈpE`ewz\R?*cx EbgQDz79(GfAWj)^~ðlL.PAS/wS=((m[/@NXy_:آ]5ۈ="(A, sXr;!"d2 o:)J-J#u& Aץo`E*(oP1<>25ëɶ\KYRRmIio.:W#;]gV뿢C^'QyR:u$fEG4`Y-_s{^&w2 X1ev%Hm[9L1=;_x3nݱ/89bkk7JQK?kKI;ί g>Y@<]ons&XxSňz&a(%{G2s(q;?;G&jC wHzp&P, QCg$zs#1 "'d5;-ti ]4JG`erǤ)al:fO4>P+%o;oI#ь@E//ƲqZ 1%rIxHEc9\5Xk;M>w+‹Qy.ѹrfi+[#r(SOWx!hFF0+'f!~ʞ" /p+@1  %5]W&CzY!8ZuU*͔ν5o=v [ t{5cE\HA K\6p^I"#b!]ۦhTYt@q@F\TbkJδڑR<}O5 BIAS!EvFnyhC¾z[JcDhBgiFˊeOFBlrZ?nY2+~&7v.4yKuSDnL/4#"[ 3f٩%Hc. *!tBYQylAwʯI/<״x$`9g-3xUey2T( k 83'~^`}[P?uX?lo>Icv;mUKV(S G@_=)CG$qNɃ(R!'s.(jաo:A hS;xDMJMf\$hu5[_I*>P^} PmJF+r*:.ByP9_͸rBo;E$N R^R\1Ӡ٧Rɝ:> Lq H$B DTQ+Sod%\ Khd/ؙ]aOxmӣwKc\qi?im&ВZO 23SvBFS$vQ  Q=k,#VB rxyjK~tJp{m2?@4#}^,tX㝛,,GcAwه?c~iS=i)h1;KC+뜜|(+t5[65{Ctہ_|oKzrIҊ=|pÞf:#\z?@Rby+Y3r*s;h)->6Z}6.HqFXn𨶕qDZ_Fmғ?cz>h+v w&s«hG濡*gC mg$ݔx=r " w#>tbx o5/Ģ[#{0k! QENxNת:6i4outoāot/=3CJ#V'p& .⃟S:/B͜1I2ov5{ڝ.SڋvMz*S.l?%t*5Mh%>f6JU"׎P C!Ggll'us`M Ԁ'_+i!F?ʇӍL7'+#rĈ%?Hn~758.bo-E I6[k!62d4>y4R4[䚾KQ }}8+9,ÕJ 1[]>})[ԬRX3wictjOwSQ<Hc]MC8in.c&lL't%X+?uyՁΞx'ȫrcZ!sB[Ua 7')f-I\ɱ4O[d: *fKa܃ym.x!N=`nG+:xFX51jy^4p: "Ҕ;yva 0 3 cmDuQǶ@&a pLóEԡ(QxoeJE`h>9V D3]i#X-oԝz\CW|YUrorNbֵ9_9B٘'߼v|x1Pg^eI VvIKQ±BIBy|4yQ1 'F/AR DJ #cPn?2;P5XB:5Bm& w$FQEmױ[ } '0]\R=J`eNGf{hacwMH;L4V Ҕ]6aUfF|sFᖊ~-Qb"nq/A/b!z 5@] cj `m^Cq;eo八xHaOaToIOR7yf_[ *4Ew_<]y)"*d L}(ņM|*+D"UsuP3xEE0ے&ŸB^hCNpFScPL*3By9W,FNa(*IQԴdYsǍZgSGdlv0DV-5|j7؃ɖx@NiJc>DLЦӼd <ݦy*~C?20)9'@ UCM.T 4c=#W%-He(ZF+!|5,uJv_ Qj6Uo`]lDWqc~sPiSϵ)C:9}C1鄶ŰVؐ8 /K374i?"W25~}Tn%1*xi܃RZ4vS-ӂC`0_ 1}O>\w)H>&"(!AHڦs6SfRZ !굲,3aH]G}~@5$t;|OJ#K6i$]GWljfe'Z$@i|>q"Y<<2I .cv&^QTo־YW촒B!-YXQ0UCb6dՓSkf0ueMmm}̿ލȚcUPˀk]Lx)+;b1|Zs+Eg5цzPiʡI;UY!efN$trLBtlht=%-~ 4W+x,)Y5@gLߧH֎=P*ޓF%F 1j? hy۲4Ns%|7g޵wRV1ДgTuv㥥N&1(& >fvhK7N58g81_;eTg'lptpU}.WxWEO %2[P<cy&BtY=T6I y"n_\h m#7@Pd08zsgCFLD^%+ :/αt{uR=-(]}+g/ #Ya r[VB iNnD a[V^B+kw]{Γy辽h{ӣlmI'>tvJ@<0#l5/d-}.֧+$^&dxW/BL6”-Pbևλ#:_(Wgʩr Q1`*>|K~Ye' Lf<Yj'RJ-V˔g;/ ||2]5Eڤ09k0_2o CB)fT&{4¥#yu[4 UE/ϐ84@ F"Y y`vLKKNil`@_@?IzG:k"-Ő$j";@).*ыb&dŷ(X+6:KI[ %-1d |jR5;OVRdߚ ڧt@ t. SihGk 5+՘ zpE sGvn v: lNR'!E.Nmw#0V{lu~!ijᵸ9X˳WKBHb5wx"LVȝ(AB#e 9EB(]H~ ӚsP}bLY2}זH0~õhآE泆$Gk bj&ް$=/fJF#EoHGjeΠp0CGV03x mv3yŞ |ޙ[BZ t܀Tr%i͍¯{ a"ކ@ '/ktnQ'oH:JZp+8/N"ݳqj$amsw)=VJ @8V#i`5}(2fJJ{.DH]ߗY+Tw9vu~x]68ʎH9 3{=}9 S=mQγlgI%7uÙDžyY_&p}LH_1_SqCI\l ~5dm)J$E`IcV91HTEƹѾ[;񫂈2Lgi8X (c^0ڭ|l4JEȺsJBTO a`^25VЭu`?!><=!E[JtڈpǼmnTjdt@]5+|C%:tA/C6Z8z3-؄ўryQPO_H"i~aڳo![AJ6tyZN:2;ΐoC.Lڿ6V,?ZKOº _#v~¨l8u=Ҟk:5 Pxu^J-f=:f@VL%v )D, +z!hЙTtby$ֶ3QP UDž; $'e*zH bgO^aA1)t5}+/ޙ(#dSr8 &R^rq1WVEZȞM]*όO@;cP]-=qXZprNJy\V,q;o*#گQ "s^w1lo+},v0{eASU'vN0J|7 ;i 0`hAG*puWp4O=>9Ri!qk"]ۙ-\/8|9a(.+1'AGz<ghm/ĝbw{bg+(^> }tXqo``͢sG0RBRU7d7)!ոBq˦k ~OH|Q\n &mrojb[zYE3 }dNxUz (\tSMBeI_nՑڷzauMώgiQd^+]N0s&jt5QT~8HdkP煙Tr-%:7Т;- ';b~C<T@zA.PY×@z|B-+n&:$D%%u&4a OtG uedRމ]{`#sF1헺X$:$yu㗚(p̣>Ʋ{?9"-L>l\b#ƱLW3?gSDGLp ŪY3;J $r:\+)3r'i,r ? _z۽L/xX 1ܰtZ`E{>^u.0'B Xj]S@"/ԉqc."uM?b\W{/"_Xjh8fA`^W2Uo0-}h#9R΍ђST"< 0txz-~)ɝuu+M2}e s^ ZPt#Y܇Ϯ)uC}+f^#Hٰ,Ak A3bNF>ӭWn:>X<  fq"{,%7yFNeɡĽաmȟrMө^IJO0ͤj!&>v7^H;;i5*_\j6'TZ| 1y^3ѵM?[ePi.MR.EWNEKطL7}U_W?6qkP(`JE\Q/-T,[KYL{Z/RY$9ot'('Ϋ{9KZq7X'_(p] _\YUe?1Q, e>+ >pnRUmI=A[Z<8iL9/ ֺǸ蠿Ao|0|_VA{"O\Оim]MӢT> 6h%(XFäHt T 1ɏF\@+?Gyn 쇕굁,JI$'o"=GG} Iz6QbQN*lWBIt,LYv:wBMꍸ'LZ"f5r"'.dM]jZ V&0ٷ<-hUB |pkc$/zY^s<`*Ɏ? ]ZIZJ*|^2nw~̳t*IHB@?$fW*k,sbg ^mGlâC$)VV/ !wnPR 0ȬS1*P3t2v}[ՏOɉH_SJɘ؋I!:W26 4̶Q? FK@Ls2Iy5'j m1.?sfք+^I0}L< 1=mM i6دRL,QZ!cȢc -?:/ۓ#،=Wvq4FԾ oyi ŋSel!!FХǤx5Y69 KXſ|nJZp9vev7|̘D¢9]b?}unMO|/JhZ zen fq9j5DJ F2y,&aj~lTKLbcln*G ޓ+"} <gHř Y؞D6e̼)rPdxP/Ř #L[Ie\X}"N[.4%H$7RHrHB.S2b%36wGs;S8s#qVwj4ԇ~i1W^5_6"v>$Pg]ج,{6 ?')Ar. ZbXBjN"y'\/,iF(w˜c_-U`d͐VmP{WKkoa2;>|<Z6̵Ғ|gu[g '36\T~- ||,rxUӑ % X? 7W.^^l=o9:=(Sfj?&RiLw,]7wӡ_U)v:j?W:*9班= m`n RhDU;*#H0=ujsC iE-.jadqK."%+P.~*V*-pc}J|ܐNngl?zȟ^-^;h_=0'}tUT P!oM~G s^CBkOЂO+j OLWkNF?yn H7icMׁRNz.r?m3<'A;]H3ӨXEgjM+a &9=o7Ѡf,A&5-nEF^VY\D'%.S L̊qL?y7^b,(6I~KlB\~10v={E-^P#|!ઝc^u)=ڄ q=2/|e\ԃŞO:6$UKYLd(7Oq1d.I')@c}ߏDh S*vt+jFz-ߛȌHo\.1S'~Ѝũ۝7Z5zepI(:(#`&=:$)Y-Ü>EnVS\3 S4/&)hd6RiIY=;&-@[`9^_LE;?1]x9a(-4hU= CN?T#Bվ:<Ƭ=;q!"o5LOU7xL+?[pqÛ&5Fx!vyor9 WcP"r夏jQU@9 q9At4)>X'HvO&`1u?rp ])[fs[ӄnҼY0v;[ s犭=C/)ij }J wZ׵-{9`cт>g~/&) kU>~yLhAQC^HK@]Sߨ@tq֏v5Ke&oI@ j`cm Y%ZdH{S wD񡕟y;J]0sI{9 cS2c9u~w}ROHQpf-{E"^i2Ci d+\_D uubo+dRXկyRd$-h,2W)3ؐ~q۩:]"ij*NX@9=;A%AmYay8ظDžU,xfk,UPA +_k~,CJZS{SF n/1 G[ t"–xy4i"mN'1/bL0P/lj _^Ғn#iFw~5} (1-\vdI0$ 8?qUe_ӛYL˸8(j(_9NcNH\>Tw&dBO:sT̀;&Wj8"d{oji͹J zΜMimS5-^i+\4WͻNVAdXxs6wA@d1?Pi " ziu8 | QHsaZ>5y ѷ- GH|S2edL 3!jvȉ)DUўfwX%w\vgyñnqtc];> i%-TWq\0RH-JyV답 Oei3c {Qv&`5MjtHޟ=9 ) eT:έYi"i>a; SAv*ykZ'=A?tiGu%ۦ Rυr@N}1G"U0ivmT5jBM_lx7Ȧ foᚉw:|.ZB!=X҄1!r1Bu֩9S+(.w'(Q7hcY.'txz-?(g\]y2eN} 61 Ӕv.AR Y^^k,Ml'm|Tn( _ɝ xEl% N*,C:!Na }$]:(g[]jb<&ѭU^^qmܲAi&BT9av ,hGеix9;Q1–}Ye$h_q ~8(u*.kGub t3ZTdz=AQDE'݋1]Ӣ`Fg%\ՕSB1,|AqP~A+U?I[v2QDS)5$;xزA;{Bi9-JohcKz#o͆Rk1`Ms+i$r mmvყHYb&)tP['PO0mn]=n>mW\H?T9?%BF;ɉ=)`<.o\Dtرd$ʊSm3xcxE\|ˇqLc5= ތ]ncK%hz@[$Q= ÖA nWƞ$1=.f?oO.R_/QadxLArӢXt=WDjՠu gfOCQe/V (7߾yo[Piw\ї°zpAک%aWߎJ|nI?pR, jN=ʶ]n6֯ѝ[~V;;r*Lh]cDI6DpiCP3N@k=P=,c`֘8\dw!֠j<p@BHάS0NWPbHC?Р.*í о#Aʬ?n{p(/t0s)m[ RYg™Zŭ/S58g7{auO4 eTwvWd3+{o=1 dJuf?1* QDxxLZ&nY.CD[EМ](pq1c:%ݰs7DRWdDǶGb Ϲ^ [GN&FAv}hkKj!ÙipјhB/j7"=?ȺsbTؗf`oWT f+TMCpF`24ykʐOBm@\UZiUl/5o??uwg6f)joG*!\ .ٍOZHQ:^ưLE&_3zn_[ d{Vg:.$6,Fd7&*Bxct݂C}CNJp5*![x |M#G] /eļq]);7j/sLc(ECc9gC Hzo1e@[Iu&Ƀd95|8 lt&yOƮp~`h\I7٦mBȡ 6W(DUN} sUTGRj0)&gyN4ݕ\wqGaO ӈ91`"*$b~ء' ׁ(*=!Ϫ$ CsDR#P׿l-0eGh~lե ).yq7ZzrLDu t)ra}{6iϽ v$.O}8JTS RY%œ>QHFA F<{|'?@ƃ1ALadSWf?wpZh>+!<3H8# ,KyNȰκnwFty~iʅsE~qQ46.݋KY7誖At]i<j3SnhM8-ҞiYq"xFи46MdjSa Q`7c-6R˵S{VzBQBǔS6s'O­ רԵn۽PaP3LĚSD4^D#j2ugCJڨh}rLKzw`6nW8SGS|'F jCnϿpl#!b ~ DGcΊLۯZg4U|xoݲ'[O括` \d6 .T:3 5աh AKT֍{y7c_0uȕ; ܉'ݪ(B)?8g06E#e;;nS Eq/GH $]\f on:wc`,(o>C>XgqiMiQpV omX$s މA|4XK7]0HQEW54?D:G2VUL!cig} ?~ka~ ~ܼ|+{`e0݉^6xHGd]f)+OIqoPXjr54GYBg/9}:(Ύ# xa-Io'; \|lSGŭDy;_c .3?edQ0Ww=Q&ql)Pzir7,^t !Z?e+I,m1Aoߡ]]WbiȐ[+7oek C@; ,H\6Qx'XСZпbP FL\UE8Ej&B>)K$ʾB('p&M:qPW\JyoO|wEE6'Z8Zl 7ʴ( dZݾѬ~I)0X^*hoWYq!{*"DI%eB}zhoxO×mu~(H*0j%U=Qúrz:Œڰ0F7SNWsyتLmo( *,p_X?f.؆n3߅[]X dTds˓X뷯_+\Jdg8(tX*KhTGo|tbJHMr-8 y8%De$ ='8Ě~2V_e͌9" UTe9*Y&+DF; t3QNlVud^V'(+'R+r&Qg<-@8,17Yԧ: @wq5ŭ8و(e(o^+ʐ+N;C1Gdff;?O'VXw9{A|CQc|>/z7sEDToᚍ_OH9Jg+ hQX6 jUZFu7/A,3wdZL OA!)Tn -" WrW@Mc]e\vDaJd&b)JZBhF(=񔽖׵Tv>Ksk}0<TΊu./[V~x;[of !tTmVk땆1(xܻU]f[UFE|^4#8P$ WV'9Ȋ&Bj]=nJD jun^p❻LU'(pƠ.Is_jiEHk PiOcxːDΧpL;0x}2ցs&xz8Y28ah`mE:I֮>vmu8<˭R`GV b0T^ {rAniJyѡ·B؍-JKlk,ՠm`/O~N[r=:qw\'DT xӷK @$ q, :Z .s ߍBsHS& .it#ABd BV;P`;ftUX"~f{9rQ}kBuC?2qAիBfa8Tɲ]p+( To^(b%Kj|[X!kjj3fGPo'!Yk݊ :yR5#<ȏz">b'j43cOeb6ؾ+~6ޒ!G_7b+ _X[s^Gw iƒyxj\~=Kso+Ap7'F~o!}m(]9ls- +"מ[Jg +qLQNEq5KtCQ9{Cӗx<=+ xCl#1pI}oL1=D6Z$'&ܷ'z`A=5:Lz#} Э5m*Q~5ɲ&+ɒ-޼Į z&UnJa $H֗A>9ZgBei/zCGIgXo3+zRÝow3 h @*q?ra[aiĬODž5 N'%TEo:L ]/*dD>##]+,ɮ)y_]xTAF_FaOdsvp,O \iU(>'e @ acf/%7;0<ҋU:gZx^8͞i.Rjn]" $gbHdp3^RbڷDﶴ`hYg˴MF+y?UzW nG徴Rc(dbqcib~궺h)`IU43{Z(^r彏i bAa,-j003#HRҌg/yf*4G4fQȌy[C'˞Q.׸vӽc.99  6<ݤKAK_d6f%_[mz͖ cH$HNɝcWZR9;aՎBz6& 'AQq4wgN|`KeQʖyv+ ]rQċGe8iR ^ *k.<^ ~-^OdR*yR=Eo;: v;BSE\Y(Yd m 7 Bl1ctE˚JdA\jarMSɉy*] g>@XՑ O~]^?ݡdS7b;W%rIJL$SnJan4Ž K߳Ul@yI|)0xWle)_hy[*vn4wh6gSYo.ǩođn/^U۰dRAmn9<Xe`Nߏsw@h=[jCD'Uo$3{QP@|d%-ϥ%AMmWZB<袠 ~Lj#hA]ΕESAΓlHXK#m̈⨂"K6Lb{Aj1Pm;߱ͩJ4/{5SckO>{ F_H<>+s7 !xڐލ}aPLzރOe3=Fp"LJQ$.R@$#\sݛ=\Wr|F&zΚDF!i=}\Ȍٯ4CPlHpgO+ME{v$ƾ}hd=+%r[Q@$21y뉱;>L0B,ί1q\&mw`(bƯɟ~N-nh^U ereYN5;/mjl*`tϹkзe)|S^TlnȻarmޝZ{O'h(WtDG}AvvOG;!J>)`o'  IC/ױvy8WT%װK :ֆ\j!36DCJj؂~ S)ɫշZ) pG#!(ъf+I}" }1{.;4ږ}ǠYn7[˺(S[b-Q~=2c#2H$_k(,g &"5T^9>2*hprJɼT7il& эv`g  XR;~]Rd&wzjRl Ge?X{wwv d *k+'.LS7ߋ/<$tjtE)s0쪚{]'uskcrҠPB@a쳸,o굚@Tcnj}ߥ䉏Cq^bUӯȁД気 ǘ8GrVxN1{JBBsYHBwU2 exT=03DiuSWfJ!g/!֬+-XG1lA'o90|Y0GWY8tc֑o&kcBF~apVr 6%e-۾^XYτD0$I@fSY`@n± =0iO.p'X7$5.ȻJ\c4# L:!),m1tuho;\4\8&5lU8WV`_ [A "ycRNº*1>JQZI dlȞc{ C-IT6eO&Έ $a}Gğ:O-u?.>D2$UuH?߬jm)B/TpR|`mJFy8͚ R> Ot/ ͧrEں,OTW8p`[1V7vn2qs)S/h/p2Ll`'|'j>Iff*9z5=׻GcWcTREܔ5ߤIdN!UyD]X+9~%(F_n:9w9;8_e+#)n(xmV*~K_xTތgi:Z.TQ͜:gֳADB8)A/9 Dɇu:R9{8kpnىI?dlu>=xk}u(^*"}nc޶j7(mWvOhq fK:lX<7Y5"j0$uWJ5X霕^-q8Ω첒<[i#V>7^u]irn8wxij%pE f^ L]{nOzBbzL m$-4y}%aT#Ϩqчo"qLJYZT[-rET2aurk> xd OL+PChP +5H9T}ɀOC2R &!czrz((z'xE$lo[] =Yq/3G#5z0R.e( "8DabGGcs# ? rƼpU+׻E,όPHf~nhZ),B4#bYo ,ynm_-jQ^)w^S`Z[^ݼTȭ:#3gCa إڣ ӡ,AFr7zQPeZGэ=p(MKޫAvo'at(@OdMPj%n6y-Q=)O[Cv)`_un WeTo5ϖyght`_Zi[8_Oi501IL\`ٔjtHm /|Pxr A\Ѝ%SQJ"lq{a1܂aj4⭒;B+ [i8+AEVBiա?26|N:pGP1wm(z!H%;2+ejHe x c*-:1SLM5#! Ab5m{SLCswlEɸJٓuYQzE(Ÿ蔮&/Yw&Mr̕YEl,r(U8&Vbonsݻ7 K,0g3#D#g(pNF#.'QP;C8l~m7d ;4Q7ry"߆ϗUw.ǐO@f&ejr2DxF@6֢jڊEҞ`2,E3Vs˨ 2~O(>I6#+:KkhPhy{6ﴧ '; Y_"BT~Q(Z`Ʀ])2}!`Z8IM25 Yxd +k^}'bz33)%gqV:!P)n.~<Ԫ$/*yl]v:2gּ|.+"h!0OJ\eǰhZ "MN^䏂-a`E"'R褧`] 5?M;#0\)b0Taaq~a R۠''EY(,1%ʢ-Zu-fF7 [HWJku!ԱjFiyöq<>N0™GUSɻ<}6hMu$JR~Bg.G sPq=3^]ӄےC}rxuUjvdNnǗo$SY62!C3 5l!XI@binNMG.N% \%)ɞ-)="'h6v>3jmxm_zVixqΥn ,' 0 .- P5i6׼!9DeFRiNd|]7kZ~[ՃM|j\8Kmi0F?QeUIׅrn2s6ɷ?}9cGyiZT`P ~]nj[d11c'S"x4EQREqC(NʹƋ?K$ؙ\iV^``Kd!9Z%m|%)IN,L&9eG;F3M |C*'^HDEn y&H' tb)o^8,Xby棅]P!'~\<)h8@e4<)**>0)yn.Rs<ќ{("GjANwh;wr!7HE0/EdMfLJ,*_j+.\V Nʾ?u[CDY;m2ek \#̐e1|k%"*lxhjF@I 5>|srKP f -fٔCHx-櫅`ma;1P3Z=aE g^X!"m_U^oM~EiEKT]e J 7eOV,##5)c܅'ua$Xx.ƼׁgYNbh n2ϓBf Op)T[R|S4H&é\2<3* EYԄȩ)DzN j@xU@U \?U`5 j­<\$?Pל6ncytZZZ)>H0qdP'aCtM 9l0wSˡ}5Icv I=k_t]THnlO q~?'})#y´G!|J5QcL— .p"goBuMT;k,R9UYEeɎ8u5낹@4cN3Xdo͗ ێA}DɠSz&7=K:}*1o6UC30m*!N fw^a5` C 健C F, pxVE,l(e*U%?NrQA *,Ŝ|'<Ӡc iJ'ߴnȖG0+D/>߉bqt=ʘO"Y%$gU.pMlvd^Zql w{WȠ}VTi[W3Q ٹ\9-.d>Qr9z: Xkg5bTe];ߥv*)3߄ޕF^_p\ xt?fWqp/äEwd#%cD0@?ÞRx4u#Ӊb郕6, -߇Bm}.3@dK=uXNPHTG!k71_L֗ Bf2 7tXZp,}{v>ZD@]f6!:yho}C KSX4f7#t+T'ӊ3|[#E`M})Q=T!6_TOt/t,wɒn-rۯrz~b,CGځhz'!0_G,IC݆-ks[(Zi4LLn"OM$ʻ NbOQ+,T;`C>b*FԭhO ugfK'pI_a\iGňȓ{0_U:r4M=x2HoӚK6wGsxl^^c[W(ZW!U7Pr`6jis-cdP2 ( a-qb1ή4 ۨ ` ssdMrzQh$.Z0vo0{q5'㎺<5j_G+3B5rƧK=T@*2H4̓Y^g PJ\- !hGIN_d2T-(Zm]4H" H"l+M1,D]\4DPޖӪ Jb# 2,\|imrۃ`r?\d%ɀq} ϣ&e fkxIi$!'E.l K*_B6a1_Vyά':3hk7YYL HxRlc9I`+m+Awsq^ )(R}t_vt"7Uv͙q\l"XZo"@(̧wR[>BFB`mj=Uרޘ7:les%P͝pՐn{&yRaC` +?>#RF& ~U>e|Ш|r9@$ޒڲQ^,G TD斪%}gӎK#5 TSQ6W"l/Opl-UY٪C!<$5v.7{&HWMa3%!!ك "wX9rgWu6|B;rGbZQlIG2{% 2u8+Cz@ HfvVО݋B5I,sqJF:vd;~ֿrUǞC+הog Rg%o[eox|UL䟢E\cѾQȄG*db7#R)e/y:z͗KrzE} M"9/dȒp aGUX}s5˥gK/%ĕ!>d>4:fZ[N+K#DȋbCo2Vbx7zrQ6BMiEt[ fη$CLB'VHN^<#H j.j6*Ʌq$,F(tY*ul"/,b*drg rY.;M7 n[4mboFj-:YR:yK"W WjtL eZ. pfCp1ri2C8$C% 8*#Dcdbo-6(U 5Z\m;A8|+ xԺ %9oB׽nMI i4; uvH= DnxZv~FA!(>D0%|<2Օtc:zu(Jt]'Br6i|?C2o\v:Ŷ>C5{x5̙;~~gң@b%Z#I]A1ڌ71s-Ee'Lrn!Jy$ѮMKw^O3ƓO^Elmp?#pT J#uڲ~_4Tjꗸ7-{ 8W_DF|Ei[l7\W:)MޝXЅ;/(_Hkk@Rv9Rwy0rE$1:^X4ۧey\cyN)sc5kTVD=y$>߷'}mH=n?j У1NY )Fpc45lڇ:*yk%-w, =28h*_~\y@^Y OZ㻋T{ xBaV`XK,$@/B(fNm}ݾl,k=ijh ltQ`}.*ZfQL0k xf&vU$tm.pO $]!VʤaNJXSa@m6fB AS`~ lM,NQ5 gKs,F[68f{BԐ#\d&M&4͂qЫ6!ǀ6w}8ÊJ1~Q5c6Jw-gi\V j2)mDwLB2ž]r%9sbDMp cw5=ß*7H*!B{lzC?_ <bcE=Q*ؚs"tɎ'_11DR" dJ7?U ;d["+' /Ia YytdI*%eYp3 f &9c d8잌@'RFG|_x~E2]gTfH ƩgV`4 $xI#"A'ߺxLS(k=A,ƯmdbyB7׈JQ?||qcE pl *}/zf-A<=}MS/fm@~ /aLdǾ_d  e6LqfkV 3ZVfW[7p=M^:8bo*hy;E"D8=Vy;{>n  JWx hr,gaF#҈֋cR;zeL@ o2a$l<-wЄ5j8_qzFّkǪ(pړ?5c6}FÃ:4>'qӒ]f} AV|3*#qn->t7ط/k\s~RUR6,a c+Ȇ 9f !f:=쟆Pa-=*Ef^a9@mVfˇ^@ɒ'b~"Ʈ~ hY6a^n>0iʟ#P797NzaQ`_r$F^!BY>.<?s5as<:"016y5 dWH P.$,I\|fXQI;KL9V%} Yd`)V"+,/sIx+oL.MWoK Wp3#!-XR:Hf|a8 ;8NYAs, DžO1ACi{[u!$<< >"{AMOa\&V*{;qm`. cdŹTUD{)Τ> &4AXO_v)\O3\Xn$ݍk{oǥӼ*Y{1?$K|eviZ1֎"lxJ4Gv9S܏zz} pxM#Ͷn}_20 YuErB_nlSFOeڇl:E)Uޣr9zم}ӓ.oM}#`k|ᒞV6ٰiMiPWrҩ -.: 8cz@>Y@LXį+ZV-dy?qk0Dvl?8 s5(;ߴOQ0ߝ(a`YQNl/TA1[ ?:@r$?D?;6SF͵ztgr-u֮_M$zJҽπkVG*~4-rN ɶN]@lrOw>&BwA )qaȓ|ڕūVz.a_ Z~Z76UQZ5u4[珄^d&T(Չ&ZaX7SL=r`w,OX(th.z?AYn2e[\Nm%}d#]oZ"f[c]zC-3+P8!Sc!M@Sk1W/g?I(`>Gbʯ0T.| 7+ JP ~M/pʁr6_uOpoc; @wų}Wx%0&Q.oğx'7k3˙9 y {T* w'iKajb͠ВUrߥ Z" բ=IF(nj66N&}w;@/KkۛT[!źAѱzL=/ K^ Vpv)pw( `'ԩ9ڏ.kW@{F^ƞ2\+^TI{wSL(;`pJ4~@3&(.Ansgxt/Wx!TEyZڑbX 53*,1$ *xt9bsFNjymWc].cj }b%u]vJw3ւJl]Q0IRaf4̠Q d=?>{S7s@3?QI2!ډ7*m*n-/|@9v_TV{+n"Jߦk)]NY@1eXC\x$oz0%[Gd?S#0R)D~et=VC{Z$egw鏢,tuʞi\@HzmSF@tsPmUJ 2> fiuIN/e`ߴ3Lr2=pxp+B{zH=/qĴvP[58F>]:J{050۔7y|LyI@<'vcpWa@jW"]4QJI˕؃t `y ,l'~n ԌJa^Z4 Yi$vAOr NY[S|S#Vdؘɍk;75+#4O q\XF>ZIJq\ Z {f&IڝRvP~̒j:YuGaw |p BfP׀;Mx*BHmcb(L_C*?CM./eabZ֔*XE-Q돐X«[L GDyЅ'Iwyy3 .GHV/_#2MھAӎ?D\&H %0mW\e9k$ix\}fGaeg-u{ҿyvcD6TU~U ǔ|U؄m7ni*kXWte_kFLr,0J7߿_=5 ]FBh^5lJMȚ!OAOb/7af4K32m[dԒHf]O q~_aHNK[pɿ-)U4gĝSeʞT\n(*&Ź/V2X3]RNQ.,.*{Ft+?Ư4P/؏`ɸċWzsP f A*5_!QV)83C9N P* Zڠ IXXeK\ݢX68R 5|ix (ܢMD{uS ' ˾WJǥ*KT9xpXgf3ݱH~Wbejkca'L7nߕjG-̆WGSŬ lС́PS?J+shYȠLˉm?|<):aʃ|NOW0p+Km!o 7IH3%C##|CXKxo͠6E ->&7ZF dy=#R!GM̏z2nNofc@}ZX ܶ 2؞tL$8/*'(\,J[0Aeb⎅$T'NEXw+>,.bWW`=C7Z![Hk6z{G6 x#rKs =Jd@z#?3ֵ9lzҖĠ4*v5`_.nd7ZamCL+iZav /kQ:VMK4 F'gϩ6rPu30Ww6]vk-#'d[s\иڢ%\aDt(O /8mcu_I!XfSstbD6ʑe\ 5حIYOuNƈПwkABaD,v7\ AaRtz5'ֳ?#eğmzi&ʫsXu,W\ ;9g=7jef惎4&L;(3Ƽg$^ͬ}FkBcPZ̕EK^HJL͸;PcDߨ'[ʆ)",RF8A+&u %ywU^qBDN'W@j7胏ј#: $3p"V?n?UMcl@x0)wh\5a 'cfm &@n)(ɫ,~rܴV7oF&cƄN]i'*9?|̥7>УlzhsW;$]'bHTeP e vs$]|\/u6,7VD'dRKqv(TSiVhP춥ikH*vS kr /XÓv -{RaEG& gW/;:6K +ː=5f@}uIPpK7"m N!sŽf=Heȥ8K cܶgyW^#q4jNzS lQ1eѕg:9UdT%žxwz#%%u(f Eӈ/25&Ф'>x@iikf{ȗgtრ֬ -G%5k V<ija!LG-!/.3QP5!_<܌iEW lTB;=y\CaWX~G w#j4ʞ~g߇X#D3~"K.#:v ~55}9}s*wb[Y+u@;*A G15Xun~]N?<%X ->87nxnňJ3KlBkf3)B>Co/4j(l~-xj C 7^qHi/Џ%%Vd_& OXuq&7ݮSr2iM=c&$XX۾EbY qZxBZfg.(O>=G=+؝cH>LxU~BGH_% Ve/a"⎈N!*<>6_uKPp7@ y-bz.F̕E=ԓY۵֍ě?T,dJm S".]_nY@!2V>mIk V-hC@QBmT7>>lV,59X@ 7l @{Dw歵ӭ*Wy Ŵ[D~)Nf߀Bag)>Ka'"A1|<9^^B<:FaHw .jړ!? y!aW7yc2g9eM*NZGm=.]M %YЗ|;aZ[v.T?Y;8=*i/e uO'V0:^@;͈Uvq1AfT d\Q+.qZWOP 7l(/k{4Mt~}od/+UCmuv!HFѽd!d6ZPV s*+Jr-iK@5:+Nŀ(BNZo,LￔnCRUd|W6HR4ͮ_{&uUa` @2"E:oxk**JT5b T|33B j6Yo6M7f;Kw& znJcd&*z2]]LcٸgپwЍr^ԁ9d< &HM]l͞?V*$\BbnB&L *P 5֌Ѕk.-ekMͮ#RXyt4xp ~<4zW,M$)q=i |G!Q`8=3޻> 49e9 Az~~%B[;4zMө-jcl5RBTLȖ\]:$!5xdYdnFeBx6- WIu3:ݰx˒O^B͛a Ø$s _Մ]iWfKC8HJQy+v" U]b`'r% B"=GU9q,K&ď#BSm%?m18z<)꙾2j:LmrzowW#Ϳ]GDgn 3zH²? '}>!-bga;8oIOW skЁ^ ߐDc&ń~\nlʆVbg.A/4L |l\e`O&S8s]5rH{JGG‹FӓN S-cEsp] lomjճ#tm?kVc0.rJ +g>vrw`zVԦhG^gcyRrF=ty3 Uk"pmП '?88V0;ċY"E,])e|bwJ:r=¼uJgL[@XCM2kҟFYCV?ʱ Ճb*ܺ<+cLZWUp ƎW_3yf`,(L}K&>ZZQP񸵬_kq}%ՠҎg{UJYo Ͱ$X רKD U a/ 23Ul:Y{;„ͽL-К\~eWtRއqr%91G `f]6򋉡z˻F_ʏfn~!t禈PB%\q@SSpV ^h1D.ҪmJ0d@@-;GϧD[qf< `5:mkLǦjI|rୖBo@Gfu0[ 𪌜Rc!cTh -7 >*,RDS|I0,RdpI휭 x<^֨HZĹ0oҦ<~ž Q6$Tۭ~zVm6`p*| J76 5AP(ϮO1"P4X_U׃g rC-eD%K 1?ne`8z aL/Riq^.vZl rZ,R|8*Y5(U,$J4\;s+o"ӻ!'NEZ͘m}<,n/,O(̊k[~3$_8=7:\vJF%g號J&Xp+dr sѢoOSgfKZ]G+”|W:ܷJ7M/:d/&bרO͉U#¨r}s 6efh3"]yjfFxD^ 17#1"uٱRxWJ܀򯱳 0mlpL=wb_b!w!1Y#MV$`S]'aC@\ ;`"Gh00Aז 'K7xf^ sRŜ<>y.IjBV.QIyGuX􆩋b>;X+g6]F(6BQ<u$HL!  _YUv-T c`hI+8{rQRS _ fM ma3Nmi=7V] GA\(\3+e\ o,H a :wg7~.n/l.WxE(>(zΕr'*s}HWNA "6&N} IeֳͿ 쫧[Q3(j}VA[Ry(% r0xW칓;2DK4ǟae|b÷~RWy(^gv_,~hWm48hj`3`#6Ј\*@c rԐ>o\f9Lc) V:xMsV#xySw,1JFqDM^ľNKHOG} ZO/nMC/6ݨyH)?;T)I@P*| ~ OA_tد {mɸ 'I3) B-N[Upus6lҲD(8FTx"pO!,#u6fvx /U ,-P1 7-Fee%*mƙW~/*;Z1RSn#%]_&`tټs67!쯯cK޾APR{IGZ(ݗ(ޫAJ~)!U5C~h2zO(ZUW1ķgi&92@l,>vXފKId8/+]zOoE͒ɺ/9$Կ%縏0.S8 yelVYdWۑ/!o&2\WM~&1(­%"cD?N')嶻9DO0U:z2f`I#7n>(w)փnuqVNWLn&AM4mo?c i)H_mˤy8fؠuÒg6'7bh{[oپV-w "E:rK)9n/s=bHg(]jgFœpSS#BW^0nه$vz8LGض;;ŸA-)ypeX0Hpza ArҤ \fDzI'2EkT%FSdRפ# FS-X%@–J<+Yy=ҥf$I:+sD@j%n1XY,<'V\EgCn/ʤUףl))-f`4\{&IodmN T1~kn_Ǟf/|@l9>}3ve3 Hяαǻ!\UsC P^TL3j;YvTᐈ͌# 5a\jgqs7,dbme09:~sLȕc=.|3A^ٸ&zsX{V32>,*ŒB>3B)Noche.Hh^"Z/JAr]~mͬ"gf!vU{r, rc @= cD{t8TTr ^ClBN͓EfnFv>C *~t3\-Puy5g~CHB[s<W5csxC J|ō7WD(X?ҨV.ayx:M ݑ rq$\9Z:iSJ3Km:8f7QN&H"H|(0% 8$LX:Pj|GQ.Oxq;;ߎ%ɰKLUdkF]6ّ6Շd #Kہ?~oQ$u#L3b@CB/kQTql!TJ3fwlL m:&O`|kW4}̔n^M!)'&& i Н/]cxI_#[PZ/4wf;| }N:փ\))=UCVإğˬvJDYc쳮[bQ Ѵ>$IJ¾eQ0Gu0!@Th 2@\C=Fȣ (CF9]FB H@$h0:HD[X⡎XOYz/;B~5:6M5 @}~xZ=+d`w+)=@,z/]. ,7_`7 `w4o_nE0lP ;EDeFz>m~Y\>58|Wb-X⊍}av;Okb3*\,+Cx2[5|cH2e 2B p; 94DLCD}ʁ_u.-`<' %G+w9CNiQ튖>Iiѕ)}d95) ,eؠ9 ovky;Ll9 WPD{dis͇5F!lB͗Q| *?ۓ"JۓO 8 U#j^R⳹m?(t)Q%ǺPٟOc&=۔- /C]1zi)ƬNtI8_陎ax7kaixkK52{nʹ.ܸ*7ZG] 7 _rVĄ&P нaM3 KB&baի_#Z_eKkmTF3?+6sj#i"$mQ露tȨ儨?:f&?tK0+;e![j6MBW)/-?O5vO[J';ꢠY!,[feA<[ Z{_/yҬ; :l8`m%eIkf>g@lȁBw艪.:2^ E,]7E8Mrj[TU!i+T^f$Ajmq Riٗ:<$F6[*,5v$U>jL1fD7} 1GJ9YAn[Lvq<7&\gP&Th ؉)$_ h$e%+^eh#V5A\v?i; @ˇ} dJ8Nhx%8 5ǙͥYC5 e.QLӹq [{n8EBxۡp.`Vtd)C $69iu7[F_HݯtM7Qcw^3ا+z޾c0DT? &uJ#ߊi;6 wX(@ K9 zYmaِU3}-],I[?K& nQd(ȟX^.b(bS\n͡FvQDG?DSc%m*xfBpxgjiQh_/|ŒtՕzJ,"/"xp ej̽g[A3I572g~>öဵD. 'L8ܵ0q[)B a;cfPo5͆D:1yWׅeI.T,"6wJHqQ5k=8֝u}3aP1v`Q$6h h,R.(f:?,&0;Y}0J mi3ZsQg7E,$`Wna,%?Cib@qHl j=86~gKáEQHKth\ReSq~5>Ie3i )`<k8Y5Ll߭YbҀ k \6!F,c./C`Vi?߃KυX|4Q9+/xHɲۺ/;QW^[ޒru#j;%g i!m%1BBE`C脵YɘtL |RhR1A࿀RsC({'tiiʌ1e#']>9o!JGb(zzUgp-o뻏Gxˠ|=hke2|bȤ% ߄s:!]NJ#2ޘBXߔM2_ji&pw]-@Oce?&/RL]Aפ ! vaJhCquh?bY Eut\>>AYRqU`ͮrZlJ3@49ut\u|6,+#%:(e dq#vAG|ܪnaMe:͗;QQ&HWM3'o2E:x1{YKwmݳdK=WhH4$_W+(,|,T{>"{/5vf"d tٖx$̱Jwu@^tcR*q W1)Iͱ8wpp?vs~V<ȣ~L(!$J ,o,ޠGҊ2 gw| [+QRu!Ia\rxyq.$Hھae{6aae\z7pXM$OU[(нiU@Rw~jVǧsݒNb*FnDA`B #mܫOxcs3hb)"-9TL5Zm`+47l4eu"`/pb1f+85>r.K07˛DumbOFEcLyuXܤo@U0G ^q) r,9!)9+DCF. ?X7E9(tڗp+ߙ%vr}I:v @r `46¦o}4Bܐob>ہəL阛ن;s锗4-K? |^Zs+$Y\!X/br0|'Ngc?RuWW?ແ$FHCI:ti@7a"9ijlE{^4Pj&ZwDX K\d2j qo&0" bLTq1s DBNkB- ɑUoq8HcE;Hv.yǣN;x7D6Gk^uW]:C;UۛurBGIwWJO}g`,=C<;sT^GK{ (ˍkM-N:xsF6y*`GFt|_]6]蠷\- O: `z+psr`)nqY(Wiq6'ю yB3(] BgsDYIH;}T%%:[²0? Pq/ҕNcHG\e< ;?;0ڕ@ы%uYS~L؍~ٰ'(ql+[П@  luk%^'˲ɧj/Vޣ cHbY VQ YewMJD՘_O W_8zO*8Lg4"d+&6z\]mþoG뼽I=MkHZyFtd&={"Ite/֒G;G s>t>SFeG٭ 1AQ@ 1+bJJ`o~˥쑯xz]'?V7-DFij3w2ګ a_zيTywa:);.nBm~%0 vo*u;Ц]ZX(u7G(Tk:Rf[(]ʷ%Cbĺ9M&i"KG_Ulh0e&KFTw#I֑GKAmR{{PpKZ2QbpG(~(ᑮ7EBG J-yk7 zb.¨݈i^E%CX@ftïV*N@|:RTDɉWR[܋_X$)P$0֑!j9 q)YӁ)MՔYedPsoZ"3c^9Qn.sdB<%WcP6ak\xok0^'NkM(s`ILw(_G;Ѝcq;c*4E*M_ S@(KӇ%YQNj:q'63j_hS6ee4NX+ٝp%:9&ÒAhldϗ.S"w=ˑ/S7Q=ԝ~ 6 ccKATg偽%Jd-6wS0IR}۟_d&\iMx1AFI\ZHH~jJRM:@SK3C;v4խ/ek׍t34?} Ǚ;:k>Sp^XM9bc 4kF<2qX^BǞ ώV5hM[rISXa_Jv ;r9xm۸[ۛD65^Psۗњ~ٮD`!]S0YzNU;\O'Gw{fD}i8 i Բ&co2|!~@ޝe1<zZMQG&_M#/P )8#69NP"Q64tFr&!2ғ "8O]!! l*@{zL}Z顖Vm:{eS'ʳô v`24Lr?aw2TNЪ|r^⃋Km>۾n;SX$p_SY|!#?tpx;3y qԎSսQSA$̻H(.fk`+1C*%;F-yܷAt@:#`U%u2"m:*ehH U~z$G oy/Ht* TxW;κB+ u1J1cKø6/q-vTNKRr/4̓AP.*-c@WY+XX}>bIbV灇ꖫZ" ΛwaR-@7}bV )Č Jq/=ϽmPFŀhFdL^0 b.J낃Za/":ЌߤpIĈͶUA#6ȻܖS;EΦ`8$dsz MCFS^︲yA:;rbMEഭK#ݣ(Gvh[w,Ns"}-p? q(q]#"8+OYBR7 JRLeGw%~y <1J2Pm|(@\)9]PJa4E\t&t6s[+9GlASůrl qL/'il'n7FyjVDP\h׼wدAڑmJ?xTAgcۊ0FD"vTZJD"M8xJ|LDGޗ~xr^by_!,] NS뷴Sr?Mv&mYfao[M1:7x6TzAclVKFo$G>ىzA= wT,ffB L9XY 2VQDX [w7faԪ.\fQ]o:n$eؑvyp+dFqDy=nj#;S3iڂo#f6%DKtȑ-~;B[־sMV|L`8sYaHаm) 3 5FBk=,{bo3dvgP$dVCh7BrיN j/j1ռ-EtEƗ0)uga(ňՋ89Utp|%`IkCצ8yuȝ\*^fOPy9iDLU_,8$=s*|ƾG0z:\q I/X)ח:g 6u "%o3Uއ Ϊ.:c-?قdnNUKr).7dQ >eJ+{sc7+(3/~pmZ[v'jyVMX\~R} WM91;^ErnJSLiN ݡ57=t< U^pW juk"-qn3>$, ~OޡDmVH-՘uxz ʩzF, J۳W$Svi%$xQ7*d&||ba1ZS]ŬEjɖ+,d3DtaB寘(u`-h<PI}F  Gi/N. GXD^ҏ"ځ߯O 1 چ&_DwVF&oɴkބii䅺݅4 N^;IOpH,fl [Io\CUHrXZTGlL.Kg~6 1d؟}BZ>^@K\=ܲ.W@Y8{#G}n?=Cfjݽ.k{wXӟj~%P^Gv%@BcM[Y-n ߸L%rT托gRFL/Ny̜ἂXʕ1RXJ x 3PL(Bm|@ 7+tq4;fhS#0#:!Bz )X_觵p0`/o;&&*DY~(K: 4"K ȋ3Hf<_-܏ÁcH ]RSs1 pJ_x:oK=l#--|a&΋^jxϐpB5. u0LhU7Kw3]v^8> &UޣrcY}qf% kb8 8 DMN vgQoi$t`._" dAZtNpA-I-5/agf!SCKmFR79xH?4 s5qqJϗ깃3&)nq\z<)i#EPc}[A U2Ex;vmlD!?yLN\|n4"!~⠲OZɂ+0Mzn̮/?NsC=}(yNLԲXg]ٌ0&].47QEEhX҉62+M@IVŨf:zS]:r#뱐SK>07E];Hkfy(SU@=t{Cj ̫!yQ}cjPI+I3%c05K2co[!Bz_}|D]л1< OE;Y˂| ~L` ë>p6lmBJ蠤W !|vdYH$,h+{m:!Ol1O߇" Grnļ#TI`[/?9r虞 l*SY`rN75?TT G,`KeLo=F(j+b.q/{꽮Oϐ#~AYR|ߪ,9>iKäV8- D,o!Kɗ^?Noh5:^mZMhIIM'Q<u:2- _XrF.90Ddܛ;T; c^yƬtq2.WDZN#.30OH6[y! 燖N5=tnN/@$g369q7ܧ).zK. I! <ԥȎp!=ڟhn̕M6xH,vWJFg }3,{[AHBx)*}EDٝd2LF0t}Ls m ᭸l#`-- 1# c0IdW[pyxZ|/Ia yxXUĝjIe0A"u$\*;k>Qtc\֓`НsH8=˷yzu,< LQc%;̗$C'-d^ Al7&{IO@84Foi`ǵFA^!:\vX4FrU=Ò_'K(@ly\)9Mg^}?73sDs;`Ss"f*@EB-HgxL!TgJEǓR '3u_y5^H% "_=[WtgҊ Pc_  $"Pl[ث+ ;1#MŴD` Ogu Q4!60m7w_ߣGF"9orD[q^,pOXIOU}bm[h4 {\CK^l_OU%[@4 'I3NVOұΌB[ PFy_..'(eo5..e;<D9ZT;0<8tݟ~R_2Eb_j:"pWJT L( q+JN)92GwlN}Z4s\Y$o瑠}(n9wh tppPYMbY$bY?d)%SeEєC׉}&ֵƁ ۂ)'[\Br||hϷBg|xiQQ R5A-/#Ԭ!|znjUH;UA&9EoyE؏sZMd=۝{{AkȜ\tIjڱTp1JDLQ9띡>}]%3Fo8,`,T#ͺ52~W*v|toRL<ΉN6~ 5$EjF5`/*DžƖ?|6MCzA!x!/hϫbQ5 q>YϷEB8WTk\J! cCCS|% 9B[HϩwJ48lǏ@BG@RyfVA-3ߴmuѝ\B/:nN8եB4pY `i6>wG@5Z2 ~?3p\#3O BmkYz\e}ԩԫ=VvAKG2m>|bGܩPߪ`)Vf"n_e|q (}EdQ[.9K8Z䛹M}ǜ,Ȟj]mM`6 nSRu\@mXn//fSM\|Ko¸ 6֯~2@; w,U1VNS0T*O]"Ӣffafn)_A4½gy"~@`q}[SR &C"(ځ`ȫkln}QcдW`Z I&n+pluz˵b-([0xL}98+(;h* :h@-t.gSH/u!/G 34*])_Ka$b:  (8iM(<"IO =|'])gYvz4!+{*+d/R=qeiܦuLW?}r L-n0Dfms Nh2Rv34uZK[ JOB+u E:l[{">z?@7%ltvF(@xlN ٹ^]VDrVSO rUx!*ҥ(X@'/QO-k\9AB{FWeH$oҌ%gvzo?6 toYi$')hP›j!zq?t-r v{elȓW.>[Za\=pBOW؄/haAĂ+s#lHlVݠ'}{'6 >5Xk~R1`AB*)3_ ܬlϪ3=K嚘o f<0?[vѫIʻ)[>+%ߜy̕ Øj=De!'/Ծ De$PZ%HX'/a 6{[„SO dR@TtDϕkvڛ}#h3-R xB _ "^F)ʦ?%`6@pEРu6iwyUfSqK2 ^qwWo +d[,aۼp,M,xRALs\IYnwK%D"6H=1𭓡ox3XR@JcMBI*kB6 ujPΧT14jSjhO׍¡(1 wҴ%$M'7HWq}M"KO3 4`Dddi7'皤HOLӿNT~\fw\P ꅻ8E^(R@a#E>A7c/(m<̨a7jҧ@o2]ơE4VLKyVő 5N%t Ӱ8xܷ*V0!CVA(Sdʍ[S*RKSx:F IUl7H$e/ubGل! 4~B5qf_(RnTPT8jX="o^zj0[B0Q:IZݳjL>g[val |!*2vroZ]R`>iUV/LiXfYԑxl /^GTLұL}hl߹QysZv2H  O|S *C+\ 5$%Uzdl9J5 +pYQBPS G'K’m뜷-ܔ:+N| Gױ2Xd GhV`--Ϩ@/sL-;3bW.Ų$S r8'Own~l we #+03TsN\&C/> erʁJ/%#β@qgTnv$dre7 F Gz5wWNHb< &5RԪ$jy) :KHOg`5HoKj2ۆSw |# ;31hi>~G%B<ܮ;;}·!.oNSc$UҠNDCO@0!WmA{ɰvW:7qⱮh&*~ܲ2y+Ocێf CVEzaN ޽Ś|61ϨU :OZ_:/MPƭ aLCuηMeWqTrVg zM^ғa Sj+v" v'Swvƒ*eOkwW5 avCO_km'axm)  ~((jzaack %!笾Sx~X,Y)7R*&83|̬:q?tDHS8_nqL̇R;ɈgX14L3 +YCc!F]^4LAGH\޼8%nj S Hj"EKQ y=x~m@~Ȋ~GveEx&f5w}޺IWsUpf.<9& VnT(0\tֽ9%R-s۠Toϼo]iGCt>iFV3@Z)/Gь<)m o pTxYIX9i{_BH~3+%Y&YMݯWWRvѺS*|S (ٛ.fq<O?H{HRy }m)3Kܾ sqZޒ mE|k߉I$qꈜ7x.LJ?.-9>npan>|c` NaGA ]#Fϴ 8yY?T!M~Q O<]e01c*SCP7-I_C+';͖m (XB]Kޣg,-8~chm 2}Vyk6x_lc+jY D:KʑQsE"xKwBsS[SgK}!X:xO>OͿe:oX a G&c:qO>Hm-T&=`e( \wcq_zo܍"^derĤZuSи{A0PZMA1=P+뤲MQ.ɉýcɪ+.+/ԪsI2 kL\yIb^7r2%23(KA}HC/VdڈgD~$.cr\ܓUӐz4rktXALBb5q !kA*_M&|֙0}!\Nt^-i9' v7Mσk6)oUշT|N9NzTޑiꅑ:fwM o|i'eA-eipmC(rkPwN%=çOeˊ tkq+(֨ EaTh5)/Nè JwR5p&F&‹*Dw#S̘v G(8Oۉ=jWda(>NA+WX:)zNN3#64녲G/]pmF{B^H5hs9*]xBsfҠ}#M ^m)epҎ+fÛC/l^g-BV2灤x_A*eh |4^d; ɠmh ){ֿjHN~=iYx?hyk,ȼO`!eS) RE#p jy|僟37Oi%G"{L@ dmIA/U=lL@)'6!5|98;r'ښVP2A3APW:\Iɢ6aQ*44'\ /5]*֪^V>L*S@drvˊk~B߮1`' Cto pK.f`\^Cyl?lX#^Nqldw[@C76k&ȸѻAjE l&[f}%ܡ%EpXPcw.q^+yq6m)T+,#=H+V C|Eq1̳)~ 0P἞b-@zbǜ'%/ S"5#%FWo=UG)ֆXyYݺ3tzsA-zR923TյuZoP s[.A۞.G'-Ȇ >.T&(ssm ^% =0͸jb1"]WZD Y[!N,8OC&^S#2/(, ;"ȲU#V))l\ J៹_hejD&W chɒױL!@͒LibsosÉԗ"H'Z&2W_Ke j27Ob.rۿclřX/4vw ReGdMwñoUϊ:YohҔP!`\Ouދ!bIPz^?n5S Qry&n.k@PN5#"}zp2G0j$L>Ă?xׁ< U\Ĕ12=i1> u.ȄA ,DxF)mӾJ+d:P^@yԐki*s㭰=Ua`` *X7F60OmQT6etB a0d?qV58_BG</x]CjZQ-d٩/Xd7ZHcj  ;.jK;H몔kddA`7 1>w2[,#lݱjSvD}d-v5~Z2&K:f@ l*rd xͣN  $_*1 v(Rz\~H2{씉PKQB3+[$ p/KjJ巺*r6~XqBx;}u8Ϊi 3k}niUWHdm7zmx RfYCOb!7w)V}8M3?/,X8ruTAQ>m )Nق y@GqAvKjJ=$k-~2I⏹Üu'9E,F?_t%G_LRT!E9R(p$&X_-AlvRoxKAQiC\/бydaW4,Y'-oz/Bߝ8G.pXdE+AP$?W 6+f~(+`ijxMMb_\'Tcm'rԓ/*i%!KxB< p@ ˀ_0h }dy|,*k!QY`'#+cÜIT8 ;^pL$\23+waDј$k{|]j8*iߠ>GqLCi sRFhj!BJ>\P DQZPdeD ܸ<#D));q #[ޡ"L,t3$ c^`Z/ݸޝVvg#kHkl⦤3vSUr,BQw1&eB{]aB;QΠ^(/V>bL>758{-NNbzAe6.?yL@=g[bn3<IYNmLpm:^֮(K V y+gBRЀ'NN|=0b-D2M;s"śPőAT!t( lxvl(rm%sJ"m|:S4Ea1>Jyo逞)= NxRX9ME>ϵLfyQ0AQvfב`)&A_Hk{u'-?VA?&zj&YӶ#d<86P2CPl-0k{q&&s4ǚ.{qevd3L(% Yf?X:m,kxTps1!*IqNϦ77)̀=Uc 1AUt%mZ&K{Z|'i`U졧$BlGS.Fi[5w0&+1^j_<.nܩM o_{G#s냒_$&IR4Fby/.?'bia1է]‚O?/눔G@*0][?!t HH iEPjvzeMޥWy)ҒZ07: $/~SRY3g޹Zh;IkeR(هJdƕL]E F\#|k8jbT!Uw31⣭yY`5gmUϟ]lSBӊs)o)!s%C7Ad8<_hb+'lڬES/ĉ-/E}$Mj3ge@uNnHZ)"yXgGt4qyrmY˷*bYy͍;]3xלo<\,dl &TpwYbBo0@zJEomBl fĨ.R]qsυ\a!ɟ&Qt_6V? @L)(g4?*g44c]q=(NX[uXZ?=I20~v[X)ˡzד'VOHW7mOma))6spum{G$ta: Ҍ=6wђ7:b rK Yi jϨ[MC/=$yiy[I,Y-ahE˻#luC!ѰHkĵKvN7>SmmZœ[m1@<])g\D3w/cBjxW>eR.gwLId9dKۮ5(_wq܆k2DreN5)`h#eiHX`_%/L,CBg'[.?9hA%DVZSVdfIU|DgǪ[A#3q5GrҙD̈`caDV# ^=;禚I{!]zXOgo+,HOq˱dK~ ?];[dRDigTM ^ 8LL@ލ:ΥUYMt)!DbCVfyA[0Ss[E%Cx!~\Xv0ºRԃ'ѧ^y#ɦ Aj8OH n&iqYZ;*Eߔ?'> %nI5o Ku3}h- Vۉ4F(n}v -W^NMQTFKMfl؇~h5Tx 'hLԂ/i4o. H?(jM }VLjNؗ񰯹Xê-7%߿̦Xܪ(a*0mu t+aȹݩ ZogK!z J "n1M2 =jhUr3" =@R}f.3!K+uZCe16 f_>p]6J;/X +ϕlC 'ߴ-JP5,6x޷N⮰n'W<'wBaZs֡56[pq?^W /3+*+Z?*/ܓɏxW[m{;VBH/ݝ,Xz/T9ʌь3^ۧg yTZ{qDg~`\=?XCDFvKTJ ӽ?I7z@2@ ]fQ,~ LO _`meH }(uxMߢHOnBE.#sNFY0Opk9R߽YpuIZb$ EBLeXk{m {֏A侹+tA";bM:v-f8D0WvJdSRzX o6bZp.1v?_ "6*d}̙KV :[7n:Nnߏ&u>ҹʪt)H}JfP R!n-AlL'oF{ /&w*6w>ȀϿb/t>}J$[I@E4i÷EL%Ý\>b^ui}_ yQvt~qF(ŧomT3ZIh԰kg֗hOm4$(i!u6\-Փ_fFPht߳Z-[a1kVm']6J)ͯDt_A6^ l|1lB̧幃]rՈX];V$:ƜyzKk\ ty.# #AbIyW3{7 Ua=l'-CEY hh8p\-HUOդH#Ӆlve`DƢRepRK&;-Ec%Ԓ i(b-T[l ‡ s4ְ~D&~ءktvXw]~# 5Rd>wDT4/uf58w@MŠlmI4}O{C!>g6.3$ .,zѡ姵 'An038@v~o/BV@S!=˦5Ks-AyYUx}:iPsUsqHillMxiD!EZa{id|I+vl[tҥ\p>:b3؅aza$ݱ Aayiz*Ims#?73/<"8(¢K'quߛo}3ʮ-rR56ig`N ui7HBkg / +=(Tm{PÑu I  3ǷqC+_τ$F.9;]umؿ}[nYR o!h߁D{Cc-Ge֗ ,gyy?g@GS!F(_">T!u;I5WCla]`-aEbE7 mX2gXfLWO; ~EKSRKmO3'~?RGPm>>wAYjw~?ZIV?øK=x6ԒCL٪HW#'c颫{BW90(ͰC?Cf4?Bit6QW1 *N[ 9&%c{\EFc?"E?ꏡ:DZ}F %DdRVgq6ғ(Uҡw4leʃnA;AIդt /VaW I{׎@Ghա?E^t+Jl9an +tk%WlcDp/ "qZ>>d,7kщæ0dӷꬴ?F7mFCqV9- PH'mC}GnwY^0L^PjOG67aI2Q9wͬvqKr Î! QZE|5dTeaÉUX+W.`UlH. Agԁ'qnFY&)jOкs7I<+,{ST\ƪKsw,X%Ⱥl6~ MbjO(K+Kɐb! 9"?NfEڞ†fnxG<`\Fo ?ʁTrp0~R2IW sd/2!xfPi,/cC4Y(ŵ!ruP]D7dkN&I3t=Ar ьbv .h'8&?Mg:-0XK5 4(_\Aӄ.0Wmz#8zU yy~t؛5( "Pn/с 7\_hiw[F7Xݚrho'F=PEvPĮ V}3L ݱ?8؟+:,h/tpLX[i}aJ/B>|E0b̘vG5糛i$ijwӊՉY/KQa- @}.}hjWXO;.ʪעw2U>tҎR]// g2|&3"n\ 5$L h?Z11p름\+QCWk ,CL}_ni{W <3!+6śI\whߢ5IR"wtEz̫sfUo~7{HŰNL(O#!Dsd8Hnܰ00#GʩW-#1IPSY:pխgzttQtX,p|?jC "8"=GC٪eͷz^G] 4,>ٵ,f pŋC'd34+4aeR}VfAB uЮMF6,, ɋpa:,,(}qU7˶ZU!%:؀NbIX][Um'΍u=+TE"tjB󣝲1{]͸"VS哧xd<FK{a#IapĝBzبO|K)7 E G%5i[ybe -_׌kG>Vf(lr*C ӿ,+2O|o&M3eJqHY+az7) v̨}^˥HMi8i +ؖVբuS409>#]C[r91 w/Y<>6Z1˾ Cʯ7d/DGa"\U?;ǰwCJ;sjS]bGSҾq^MʙY"*G3Y$juöl92ձ T 1uGa=Z4\F`:vH׽DN1=:'r o2VU\6xw,JK6̡f}8mΝw4xvJc?5`1d(iX?hI{W_]@V7u ϨN?sg`Ynm_ "4 'ZMlH!s'Qq;-3+CN]t8mu/T+J{K^LJSO7eln IZ$0ԹIEt#/aĮ3g+/6 oNv "'V ڇ8֠e~[=Q,c5?\f}# gz0%p,FQn,vh8r^ۇT9:Iw\;5(8;RyCMI dqm{;W-F V!M'"t4<: ceZD5:vñ JMǖΞiS!ߤL uU]L=9i˪D`\P*EDN Js><YZn{7":1f1aV,nph2Pa'Ǐ|tJX2+yyGKvpg5x$2N'mE {۸BvC}"|X ֩Mם[mtwJBg7՞|Nء{Һl\렴 L.Q0Ovk"Cnn=JT݀0PuoJ d< 9#_f 3h;]$η'8>~JHGjjv/.\(Bf:\RΔhl&Q[N*HzGlMH51ZW,J x@Zv`wvrg_C?R_l%mDg9uj-HH,0g|,CZ\jyx~i{сyqҷ.[@."Xs†1$eDM* 3;E"Aonu FX0svƼmo3;9=`z@tH@p`ߙ=L'c5=h{Xt(amqW˶G 8#}Fj=6BdiwK`O9F%@yBl>͘SAq W*J1:T&] hYΩ|Xpk`ܱ,7(v+3K8M9!U;ŁQoU8&1N&/ ACdw%,aO' G|a?ٞ h)7UMFej䪱]WU0];GE}?;jl%H"?0¦ yQ5yaJkW5*jFg24^>sMt,ob&(ztMy4`,  `H%ЏfGh!,*d4;S(wRK]!ۻBaʜ7{j8 ;Lu3 C4C s79\@A~4Tlw'ia`iL6ћ%>ݮ"&{DZ^,çwanXݽ:&ԱC23V2`}1Ԇu^2#`iuGx o/k4bXW,i ]؀o_ku`I`,rNU64?=_O=Ȓq AQaItq#>ÓCm%9%a("-& ^WяsD2WhEXU4S,eܠxd|;HU?Ҷ̊*Xe^^mN˅x\3wRB/zܒp'~EVt8n.%Q=Ҿn]ļ/ꌔ8JIZ";/s/ 'yUcx(|) *b@1'7Q%Qy^^S&EvWYFQڣsa,ndͭ9rji iI['Wgu&_3sZMw&`b`/\9 " VQ4SdFxO!w_4"EE<Ǿ;I!&R Z{Ap +I樂NtbE iUthℼU*d}~ә~yوSڵ>Z*9&?~gTKOoJ&P_<ZSOߚ=:%}E6^OTl6Rkڃr9"y@x PU.>{~z:g); v' .1 cyQCꏪê0*?Tc00h uɂ`-㢊Q5d7',IqFIgeN:Ỹ5v5jG+I=@!_rhoېnHJzPEeQvd9 UV %U-:|g6eLq8> W9Dzp6 8q 9c{ ։:;K;qDiJ  Ppz %5\|]I&&y˫ΠIPv~DtMmK8G 3Jd>9ߌNȀ(8CK 0FŰf 8~o#uJ!QKh0< wF"}Rs&qTw[A}jSnc#{ M~KhZ{S*4To0,;v6)8]pPKz,#t1R+GL}nn,|A5~iC e {}uRy +#2QŚc~}yG (əܓ IriM]+}Wu  ekW_;svK37,a(ȷ4bm"͞n<i`9 nQE.ze?r.\3S;u)]-XJ䂍i˜lӟПױ@c.lT#  pNwE*&~@Rw`&@sC[iEc_)HwpƚD`Z8P>4SUwCIqS(<[Qm : 3R߁o > cOX*ek;? +  =?=H|pF/L]{Ɏ2RU)Nz v sruK>p+o) - emWB݁ӄI@nmo՜jy UDm*L& ̕r[Ƨ{%V4*8\UBV>Zp`Dx^Y5Q[${Yؾ!m]zp?_NBCdmilI[brJFu@l܈wY4~iw Fۯ;%wy@h.x sIm|`eLwhjL{TC+ʠ 2l=:%ioWahW;D\6Dm**jlaU#ls~|z~mؒ!~[j>"ɛIQcf+a߾;jѣJ֋-X!v.-<-O{}nY2Ii\Py.d^%l^rcaA]K;G:<ܳ$D0g#Mf;ZΑ D;b~h˜y«Y^}s(aS^eQrR :ȯ-{d /Olŧ$l9 < C]"M6!NrE1>$Mv`0֞d s9x.#M\0}dazxh`vPVm c_PacFul}i&+ف v4V`6s>NOOLSKKqT((>ޅV)͌UYkY+_.e\%VSNW$\!`nE놜)/re[u*!Q҇?Ocx EfŠM.A)J-/^1\.i" sL̶&[ȘBXz:FIP2Gqc̾=,n 5ر#F);N̻a Q;HĩxwIŐ M؋ =vLd1dCh^jQ֚)xze5vz%6rҿkMmr"5dwWn.=ŭg#LSOGdyEKqdFN:{+#H6, 1Gڴ"XVdPLmkI>9"P KZ*Tw."hus6Ɲj7r?$άbyցa"<e$țS(#m"& 0BkCPFzK=}B|[DL?Ba@8jPQ.Dh9ABt<#:_ b<+p 'gU~)q0:߭)Y)u}EO;hNKL":_GدNkjWGʊe[UOWn7{c~3*dl\'gJʘsş(fz + 7 –V뷾kM&Xn!ػrS/@5%'v6y r#x%]l@ a 4ZXW(֭?F^8 v6K]*@lm=,>'zm,m4ac5˪RJ̓3 <q`ܡL{m/Hv_sϡps1m(ު?9DDV=r[u~;/T { "-.TN%+ rD^ɷ١YT WL wVQW%`0E 91VX0+xzV+n\0[~jb^^՜gZ'#IT[[B zQyI|S18=? )1׾Z`X{7V #SsGƘH['vǦk ]ݍFv!yOP;ucXFQ`^:`H>FOJ9az!J~'w)٠L e/1!/b~ UIl PlY.r NJs:9NϑUI 8a=f )b 1cwdgR9Eba<5/& (%lMzej0~E"5I;ԯMm5zshWq.VRz0e&]󳯮#70_sီcZ4ΈT)oYr#0 WFϷUKc5iJxF<H] D L.o;E"/;G~v3DL ²4F^?"˚w ~!W0]!~yYfL[)AYiۭǞX& VJsܛ6yB^PZw/ 5=e"GaKn<̱Zvn"%`):3|*&p3M1CCJ֚:.vIK9iP:;QVΑ%01ETɕy[&ȿ,#iHq:avPA 8 6S-)Ȗ`X?#L Ql%rF*"ӇdLjIA2Ƙp*x߮ *ڊBˠ|́+gk\p|+`vk.y. #yx ؋OAzP3 J[A<[)s&Ⲱ $k؆p j9V wEwR;t>7أU]Qi>ɺj3Dy:7eP]'S^Қr ߻s?lӀLpEǼ.`6eY&D&d*mshj4 Z̯/P ,AۨhdL:  0yh7CD\^OX1֑9_)xMu'$іz˻U"7}x48a"Ydv Dѝ -Cz9Ĉ໎]UV/P1*B"ʦ `.#/jq\$%;Bg~rovpi";p[G@? 'JQqQJoMxk_(7PI+4؝XWݵD|w*aǾqn}?JW nIc+ZKglu3߇b*e|DHIqfI? "B?E%$dbx/Irzh:%<êߟ}R;Dux4LvuQk͗>%|o6y\xxǏś]USl թӪ,4˺e;Fr H'2t&$(>;k!MQ'ج/()-dH6(ЗD5_k/ a""L|3 3j.Y\]ar~wQc"(}U+cʺbC٧Bf@x A{$y#&u;%Osa /Jl!{ClBt^x(|}qB$''\JL`zrʛ2>}F"yD?lF:\!rLya耨ݏ+c` 䔎 Hro|9RÙX+DBJjH'8uDyyeQpӭ̧7#LM!./8JW]~x4CI,YK:s 0BN@t[]E׈d ]SuMv(\ Mצ]v [VzoDλ&}rn9Zh4xr0nhYcbobU#j :쏃PkӉ8MVE_-w8.+EgOپ N%H=[p}s1R8[6F_[ZuXBѢPYSL@񰖂fx%Oٲk&&>'!MdcF t6K<ٛtO^eNxO.s診*9 ~"ֲ,>;qaɣ}|  S Fw P$-r8 "kҌ<`p^W/Z+j BzP7B疟5m%ȩ2A)KH3kg) ub'W)I1qLDEsO#4l#05azl'пYs氧+ >Im܁dS!fQ,?gLgj8X2 yo7Q"N9ԯg̅f("9,^ /Ră ͩ%~¤?w +w٠9MH}MaJtި$,X@d|I;<Ī΀jzlmFn pĵn=j}siVٹ?mcXiC $C|0`q7~(5fbHS@oWL5,JP9^){ &Eu/ y PV>*+eׅPi.zYWlM: 3Ҩ~hyʒ: 4_Xg7.':9\∠4 xU1ܲ!^sWۣh)ئ&f[mEY}d ,,Uk?{>={?5Bj%~UQ:>ĭXeKj0w'ZĝM$nÅ) Oq]eH@DmRщ7=L:<5,s1y<Ws@ d N(ɾo.96Eb5؅&,gوTv\}/GM%uXOrhs HCUMzOMD!Fqs;xtϰewf zFs]PŒ,?X=_ WM"a܉ TʵcU#R@ $yqh0vw%GyYNM*aݷ@3v}pBdb6=a??.=hnuV [@!1* bNDwݚ,¼ /fS+;J ՘aG^U.֌ 6$Zbe?ou!lt h}u0H}YNT 3g :̉L\yH+@S}+tGqS[GDʱdPlܪh87@)N -*`~èIR*m:zvHsd*pdXg𖲬C 0Uoǿ/H^6CwĹלW $a~{σvF ½l$ymAI3Džw˓t7iGuƄ2azb|L%A f4̢ Q/(M9xBakiythE(Jw9bZu&ۢp¸75g3t!t:w\3, *ˆB FT9G|Dp؟h]T5*G*[EHB,ڳJ m #vePXrxU[۝azbۘ&2+3-k뱆3A8=j ץ< GINUpGc%r6C`#K-Nxc`L'Q5B8`zċm]=.;Vj :k z..>ҍcq%iuJ(OM澩;kݽ^rҗ{/qP7K8ߺN"\ 'SF##Q_ I85Pi鐺\N}6 Cyyy"" H(n76ƭ-x)_N2N49]BӞ$ r2/@`~ZGV$_#2CW B۾!'D7ŜWNRD%:m݋c| ODU!jt-K.k-fu8EV˧L=̀Yd ⤒4% u5r4I΅ȚWl"tLܚ ۓxpKϥ|;F%?Vk6[p)=W Y(ۭp2iDp%%?njfF1+-;"Ao_\yg%_REg@vm]$k/3J:yR/hWh_r =C.$ bO%G2\FBMJͯrbfdS/r:dT/UNX<M{"rV@dC@;dVseI?m2ͷ[8_oٴ]DLCAAՉ{xamucN(O$?!E6jgX!n_M%CEiLjF3tU~)@aF 5)³.gF߅ڽ VٌMERƣg}}+ [ze"`f";[v8*@X(4 S1/pTVl;Lu#i%9h$|js\,6udQ.ļ$rZ~<y3/ ]d߀߽kaL2Q02-91Ձ$kyC ]إ` 4B1YM\عjsyr;d|-Σ`TmHә)4@cBj \ǃÄ{X ;?SJoetVȃcWJeʅ m6 P(hۂ;r퉖=[_~W6*NR ?2y\ ql38N\EҶ.Vr#t* 7v^eAIZYfЗLTZÄ>4˝T(b#|+  q-42qލF`\4Ov"%w|ퟖRK2L*NI.)ؤta:mesAj^?Qy!0GH +L|OOP I]H`,qO{Cv>o)`rQ˘)7cKЯL`YYKҥ7ݤps/ujAm@!o9Oyֽ)h%޾_.`uEIY[g@[`]M#~ș}s*cfCV.5p쫼%57:9>b2]VxX(s.\ ):(*Q'B 2*ևgK͜?XVny8nEYA-t{3 *yfKæ)S]o6+zm&o pAVFA3EW?PdjA8V4g'6 V+.ΕJ(1MVZ2~ɟm&5qyU_3yI D*$9̲ȣ_:#Ga2"hQ_R*B"T/NC'@Uu_Jb!>P->NH]\T0>{[KԽDl1U{ ^^'w'*7'Ȼ/A3ݷ/ہS=-jBmڂAmX/6Q)==׀08O8 |Lj g^D5?qq{z\0ʮ<+kX'a}iU{w$l$5l-NT71^qWIӻANN$ϑs,k =z4qᰗ}QFwW݆ Җ=?kkd:`ZT#t"͹Pvy3IVwJF"K?A NeR7}*~-]Gz!<(͂)GPL F,!˾J/5{@Ib8[c5[sRw*=DTM_Vv>P=cS_1&w(䱭 Řl&rpK5R xG,Ͱ<` Y(R8:Jp;P= D"u!zY92oy%Qq0k*M9T23\ Lc 6cDlr&Zc,|H J$}hz2Ep>D!a=6]7"\_lF1kTiuTk4j/Rp{ ;.s،ϫӖ\([Jiz Kǫ%D?hv֌md}m̆+&Q<G(` x֨f|%Ε~ѳn=ꚕ93b>$mqZmи PL `q$B>IjfNK!Ov=9tcM~][-+k u# Շ`% 03jg ?؜7=IR]((4PP%' 4a#r'ܚ Em ֞xySRi#rZMQ)l g㝉p%ZUG|EhkP3YPбƁpF\'m\ .KD{򊩊8ˆ ,\J#..C<2{۞hBU,WvVca2ei:([.M] ,ˋh m!h;Kjs^"`g;5RuL}Rn Vϭ(`q;`X)MܴԢKV7Ӹ%LrIIR جРZLWҀJ)9G)pTȈU P*3#K_OP~( e^o!7B-=lTAhSn h,3 V-BWՃ\1A݁wBS op1]?}eeb0ɦ߽S#ҩ5FnR' U"~L:vڣO+]p:sqwtimW(] BZXT= ۉyyW)>^r_ڇ.pZ轭QЕ*nu2K0K"~(TLC tѸIOq~ Xϝc߾Oǁ߁,>AuuFθdl󮳻\]1C0g3 3ĉ-*H%|H?6IVol]\,߂X6rPqMP4C2g`v\zeyLp+‰:*ch8 ~M8[G2{qa4duk Wʴ.pI-IW@S?yIFJxFē>/~U"لG̹(r+fX8+: 2r=;d !b6Fq$J~^oݘr'O';%st>b ofһף̱(Ft?jmȩ%c,E[  IV0=UcJ[]e6 o7.d%O_z 8PrSRurT wf({lG1ﴄ5ߨZUaڔrW DdsS]MG:08yh[ԵM-uY߉u՗";i(6jC,.F?ف`M@7 9.0M }t/vj9,ma}ۏkN{ns!#Lfa!7ChEh:Lz'.0 뽤7LJA(xO~A-RXSԉZW3ڃ~ Q)?h[n({ 6 t=e^ PT(q 1D/RRWX2,E͏Zn4DPG4Pz`c|Jy4ñ3#ݵ"y1¯5^HY,Z({]ς[5s}$Jb%RѦce>!"E9yh]ŋB`/+82m1dl%''zQ!!Ws>ud(UYeˊaW$S-V ɇbp'bcMEKxɋTWMfd_3qQI'ёƺ`tQ@>BV nmv[n@~Gnxׁ[!F# 1ehGJO;d.WȔnmCR"H@JB0(m;΍˗F4-bh{훑|Um!o~FD;#Ƅ [n#9$UNGUcyXxJ*VڶEfʬeKxcePWs٪wnճ!߀j!DQK í(Krˣ^):E䨷zMt!hq%xWw&svv*!s^Wcrz Ch˩+dxP3)tEf` q7W|yZpvd0Vr 8cR=3NWx08-;ppy|J#%2؅혮 [E$2ÈgdHHkw.D,&3ukۑű0# kc~qcgy)66_D%)V= TK?dz劃[!%];sjfBm?mdPi}sf.\J6?o!tyxEwU 1HvF? iϬZE^Z#$ͬǏ=ՌRo}:o,b%s 7GYwFd iKpٯ=PW(8=!?ѶnVAv6XQqY27t_ 8Hb=t#(sƒwĦ0r y{V:X]b e3@ Q![ܸlt}y;Ƭ^"8 QΜܪwZ5 \P|bcVEIކE"~iQ[AB7խNxT7/g[/Fm y05˓RSgp($!N+nùOF%3Y^ cmqhH{&HɳdV.5" 묤zNtGj.)]~~4sy3bP(շ֧|@+6!Wy#b!A-!'6cz^<.Fʾ@Ig1` Qba~eHEҾn%%dL9!9 %uJV  h7k2C2jX2 w gSzR&Ab@?Ga~d?V,q.C_@Fy4 3K82%­9KP]*i`;-p2CG })SZO&o=? /ɇؠ8=D70b52Ϟ!~#k7}lQaB+`E}[7oݖ\{9}nOl=FV$zXo`j۴mmՌ^/~C$R0_2t֮-EI z_X= j%M-Vo Wrc/o+s֥%#bp|T>KI {"z@g9*bX, ȖnTn`r1[seqm X?o`+;G,8IAD75)ȏ?ȇЧ; \ p |`X %Ģ 50M-އv%W댾ڍ9 )-t7\,]jIb C~'A)T9f+8F鷃v?Qw ̢'zlp6n;^i@ҙFgn"2RD;L$[8p˧dG,kv@wl2:'x=\c- i^XAa3*JI<(6\ 0gpUo[D>v?,ybX\w●l^?( Z~VoAJӔUEm2E(ӫƟQI۴G]'3$ ndN)^Y&CRF>=VYT9%\p )fbW!o%"]dsXQ*gܤ6T I&FURd,~5Ns͌ Hfםq.~ao <2nShfD鰛[FΕr@d%jP)[#|ywEQa4Dc%2%U|n:1Q*pBVi HvucاMH?9V3U7đ@c~28IQHI/'%3) u{mM1a|b0!6\LT$2 EFDV]6g[G#]* _g7 =09\q&YߵMg,SoFX|/2(d#f.lzx;GLaSȌBs6LRb2n&oT9 v4m7e|*7[ZɓHe`赀\ѸȋZh.` 4t2 cn4j,p#Zׄ)6€w&Ie\5K_'Ur R&ix )Utmc!CjN*|BumH _Er- ,.}[&%1}CDh[`f'z22Ψ EyNg`4oeo0ae;R3P݄+;Mr%j]%lZgB+BUsp q%B"A\ݘ̟| Irg1y5@ |@@('لM ٖ<>8fwDUv*eT"=6S.w :5IZ֤`Ydj!;Ōn׽"3 1tG+oœWH01r׊FQaY{z\^9puc[Fqncv"r{1yM96?QصʗK'V#ɉ61 ZG#$ Ve{ݳYd:0yW%ꠖ+B2k\Ä6V;F0 /u˷#|%PaAmR!F?!/= 'F3GTܴͫ<5#bT*eNF^f"6_Q囩]zpתT 4M_Z( Urw#ic:TȁoLyOҗC0H1w聪/޲isTI!@ > g@]8g@iA9*OKKQMۍsz޽ {hQZ2ԭWvDY4gL_1e<ڎ`i2Tn3p~I!+"\F)pI[Z#5'xre. %Ջ+W7l.s \D":V9Mr^A;u+Lİo|SBḻ-ZqW5ReQo;oۮSV(G=wsg`qL} pc6afsL>C1}_ RPK挻s \ fAބ _ӹEU ohRvTq ws%UE݌5sb]c˖o~µ}U;^b' A{-a۟*f.BYp-rOmC<UHȪd%젠6fHdj'Ō$;\fZZs=2vTZwz?g5yWT"X!:tU>j\7BCHGMSQ*Ý $dծ6_zN]/,٢zzsr}0?i$V^Bʹ664P1 7MQǛ+=J|l6/:GU(LE^0ai1!Cs ;͜ Sʭ"k"w+a0Yy V\qZ eH Feoih՟ TT[H@C<0&"~9 6$0X]=?> ⊆bBFr77k3a0Z_؇q_H뉚#ytDhaZaPFZ(EZBчXR%2i@A%sƎz\Wr}[QNgc;~(Q2MH5DPCudc4Yg ~ h%Qh,uJ!pVx%ndk.@1}\!o&qH7/J s1QP(IAtƷh*< s݆V&GtyE"I?5}# Wx ~Ev9EjOxdfר7)ݙAeеY8{NxV7صj&)|^A4B"pA(J60sy#CU]H#(Ss ,FD|dDG#G[I*q A9J 5}!-PM_ _0AV0Ph+m_U봧/P=i394oq.H׶`};$8JMx}rH6Etk')omի'K$ڽxl~,>牜/4o O{cnQ*SLK f`[֦tޥ9Oc1%(̵ ;jZW2O,FUG.|00Qdd(N`ɜ뫅DTxX%uZ 8-Bt|jͺY =ouqD5J%ß婥p SSqo+heb;'_ k|70ni-s%Uo|WvΜV'.cs>T982xhyd=JqvҕԐEu!Ot4[!먑P^Y*kBslTM鐈0 WnVU/|鲜 UBp6E~Cl:_Unu-DV2JAέsⰛ%qnoXٞ&y:GnEW6S.۳(3!gw 峇Xꮟ'0NM;hYHEኺKcZ*r {|ef]A.Q6r? lxlAݼxB<1;غx+)}.>* i3CsW.rkhf QO8ې1t aN T|UX qٹQ bbI8d@5zmäJ+ZX'#{#zNq:Z LP`2(@ &GK p i+쁽WH{+Ԥ5 lj<G)0l|SI JEwbӝQ ]{p-^.\u!kXR_?ڄb5iO$^BOQPoɼ.r6sM1ԓuىqw9K>` ِXP3 “)bC !rRnqmܿe&ǃ0!,!FL5q|/9 h>/q-SEPa ܿ|nVQMzZuHE5;iB2ãWhzmbiEr( Wn3{g):9K{RJ.i} V5rJjYvlq!2.w>Z2RF qaA1ي?NC ߨAVey8ܝ8cX*@=n?<;IH[? ~@z$MVDoF4nK6/m z'2_fG぀cmSxst *LTC s`I ަg2 !:$ ϳ~A`kJ~Q8>fz=*ܦa?_ y,cz'_c:=ZMV}NE#:|<2)TqK oS@A%j}bAcL?3{hL4hYA@#"BfxT֦L}TZЭunf3|^*͘ǒr +ka;7"b| ε7MN58?* "!FdL͕WT?uͧFM>,9Ө~T>ѻo/]02bђRe42Sn[NՏbr8K>uuue,\f"8iR.-44Pjodngeϰ!p) 9UݫJtڅcjBTe;,& b")yqu7S5q%cS[ ( hEؚҰ = [ L//{' kO+M({k~n$8YId^29ZvјTBA+4Kb ɪ޿)\D[zzB_dnnEi{}?6*#nWvAX!cq\SJ6Ѧl*Pb=d%y]Xcė}lj4 V:IӶ{(q(^* *{"h_[یZ\(1X̨ b֮ I<;?pi|A-+~ḅIdiJ c0*51옫 x0gT|~ʪ;?'mٗc@dɖ|? t{'0n# GyΜ٦x2jxVo9Fl]MG_vNZ'蘝ICxWT~6Qr q]>FWSJPCOÞ%Mfr|Ybu C8}6R{U<[ ɞ$1]V~Xk {F'Px`uwA˃dvogj/, >=g6K}Ov }7X%wKH˓JV1sȺ(-П{|2?$iܚdONĠYD} i#\ =)x~mu5,G!: ]\^ +1 qlvKbKgt9]tV `ueI$j$^/jh["F?سR: oQhZ#<;QE<4w (MܸSLͫOq[Ϋ`fK`㺲'a !T]RP곱f<;As.v"H] ):=onuà$ .RaKNuť`M .ҖA9q4teB6X&3I^`I{o}g{uZu2b(0Ez<#ݞ,pO?DCfy&J%7 qJ }ز̞G9}̝)Єi QMMk,>@1@-Ptn{ )eKpIQ<|K "aaOb%U"F^ 9hfx Av0:O!-IRD5U'+ze>Bp'қ2ee0 -B׼#RPa) S*fzKaBx^B$y] ͖-~!ւdI,s2B;cࢿ_Li j;Ukhwڝ ls׋u;|^ƫt`gЖl \w"~qܮEwkDnF&F΍Yff.;?._h$ uN5Y(2k"'f%K}ܕ_1OS{ gˬ1$XY~[L"[Jv.ƀ[>51NQj3Oa;ET.L`x^;1g`֖?)GDg2*[Ft{K=A>]esHַ?T[=iR 8Jxz[EXR@N+sqőBͣ[iH*pYS);v+e~%xVZF2u Rg& ``F-3 !MH80ۭ1ZZ3KWbRhSfLgM ՘ZB偌C3Pn Vk4Y ~cxl0HLU9^TE}/=,.aVӑ(eM^)^{B XVĢ : f^,הaks =SM}JGh>a`Y;ZQVOMM[ nKv,()I).JzK=vgHM +1^}3w_ZB/2U(twJj* 3ȝ *z,pI 齖yZb\[SSo[)C ܦ.u*LQ˕3xmԁPEM@(J PE87)VLIv0;V/W{AsER?aEA&* Z݀SzG ίC7`0خ1f{VCZDL,?aלj_҉ɢ,l# ](,IZ:T͉|)(~-."}Y1l) Š 6#:n@:ojr~fIb^B1HUޅL#5JI W&f yL6 en.Y|"$(sEI\7ĠQXx8Z3:@-TsyB47n3w t⋐j (͓PDFk{"1BCHJj19QjrB95v@U.C;WTTE0DcjSx>&y@~5"tYeO@D+%J8mPaR{}4 UQNUL a$T<@%a?w1nЇaQf{gaPj$lP3_ف 8Z mU;m.S>{/JLrw0҉rjdua W-iVύuI9I0 \Ӻ$#bG*ڻpR36E2"[W$ٳWPĮi(9ɭ@B-Eb _{>.\zK]K۬(cf 2aTuSݹ!vsW4@^crqIGBKo-7 k$F%HsVc"} cZh V[kZZBGjiYmВ}OClC/wxt U,!YKSlH}X4Eb82;gq9 oJU?0+ep^ЫPHHqߓ7˷a hw;S"[v\߃mRuE~MkL틆8BBElk%?y> YÞy#s,cHb:^3NOqZY`_*7%ֺ`qއ41%$,NZ gY@G:%=cD aaNA{ d\/8R*aMRGLr6 qTCPdśƸ| 7%C#K{#Ñ-\qɈb~ʅ,HyjD&FnPr.RLqr=J,Ŵe$%V3Ò<0Fwaxbuin;e0-(Vqjwj pQ[F3$"qcN1oW"`ˇw@3K*"<`^t54zo f9r[FzVƦ$}ț(ʔYϹ?nd&~ 8Oc pp10 OD@Xv,d>B8"7A?D~첕Fx}v>XG9'v㩪 FÈ[AOQSB+a`+"PTsV.L",VMeV z8]j9ݾ-J, 3ym: YaԠF ڒnd(z?^v[SF G?A}a G e_dNXvC|"k'f߰mY)\_IG" '&U4 YV.}`~fd`dW" IL:⯎MM=H0t8,\0l^(wS1dO1quF3lp3܃sVd ,G?' >jwhlKcQc>so .Lsk/ +!"O ƫsiil^*02%̐8r^=NPa#RFKkp=ҟXgZ%,G+I[MP^C{Yt[t' Kh|Lުn'88#.[Ն 7]z]۩grK '#^CNRNCώ9l9SQ4YK9R/AO@Ié[㴸Ly~8+sU C;ZEz}%vY8+憎|u&Dzy*Nӂ4b0}q*-pfboӂh0W=CZX,T$zZj22́=W @>f8q9[䗛/sw oؽ%ƙ)]^UC\P!xۚqQ Pi19fn>I10/HS0EAu?@K[cCF(2r%Os^(0sIbE^5 `iܬ! rI+Ny ,PJZ}L~L<ܚ;F~ZU !'ɺW>EnK@XӚax"c8> = =kO;E\̗ IogշiBN0%!,4@P7;qCھ^+fq++I[D񹜹U(kXhOfg_foߙesi(emufD!zqGfr Vg;c:st3娠! :0uk4ԡ>t7t@l!m_TҜTK !$ vBPtaWM]-@yAT1kؐEIKcG k?n\v}f)tSr|BV 8S| 6$+!r=+<,V1%@*E Anɣl 4A.mbIr[D\TpVXg^V*)#Q_x"pZanjErkWl4IxSbps/ٹs|(1\ ĤFӃnJ8+oեiJplј̈́FAšխϫWF;]٬qk+P}ٓڟx V0xIg|_de<; ̜ } (:v&^})~ ){8IڮG d4 ^L<5`4޷B=[{9a dfp`׸c9_0hQ7G{0/̍$1N7*_aQyU0eD%Vm?[Rk+7I2aH .Y88|_U%E>X|Ha>5:2*)hޙiH3.?["2N/ Ufdވ(rUM~l+١6fE /ҶJ;rGS(~89q[5GLohqP5dĮq<~k!9#+ )(!4H{u-3f/_fp[fܛoIٞVrsu܁UVDӈ,g?EXe R3mjLAFSmȌf@EmY{P U] # ,Z~@LMMF> ?4lQI.ǐ/!8џ LքMeop^JcrvּtOܷwo[NS^I"1` :s;'6;}9p0=yqQ}t[D>hڏzEٿ=t7Q ڏvbc(#/JkEtPY[(+g1CƬ3e5=jƣȅ2PtSr&_2 |q$P% [ts)B_ QfF6>S@=:x?˰<ֆ< Þ^LƶH>m,'AR7xrt9RdQiC:2XRGh~E{MuHfo.p!hi̙q[c'gDaOE؊mOmSg 3œý~;5ReUghݦr 6xw?P<Ҟ'EЗD%gR64F;EĐ"ૃz?dnVRƽq^ RLixS4|X@l^ٓ8Ni}9WqKf5^XPxADo5y^*M/M~aSR5UqC3j|p}Y3h eQU^E:dl!pKIIw0.4cQ'}嵋 00q%%|ƂАvۿ~+MM=)G+~'*̷Uj]e- oS 3JۂGAȪ%o4 FG MwL#çG_(8H+Bp  Y)ߞajL:ys%@ZOyٹ>-$`k' %/#4x×Xԃ[}|FofBU[p NvֳIq2߽tdžY*LlSoRݨzl}*:! &ÍǭU4ASGL\xfcYՈ/zЯ1vD '5b;}sT7(7]%2#d2V>]}MQ] 6) Zh !7ԦmX`/Ɨ[hvnX{#*BDOZ k 2&_֩ZfƮQ65 ²%d5 uZ[&r~ wW,cUzNnJTܝLG Ŵkb`-ry\NPK(\~ED BrnPhs~ ,0g,EF#\|u\Cw`]9jtyY^6{͸9Vz}!iǬm ^?ЇM E{ %UpF9OnddZS>1G))3> _Ӵvɽy.%:a5E˿c}ɣbJ` bp%uf&m*OgS>[ z`U<4YHrQJBE~7ngH*x[y4H?GI_Ӷbòˉo˜Ǟ-W@x#KumӇU NBeDܔ*lӯ'b=Wkeߦhl+n \LhYO@!VN(+IASɩtݛScfKtUutFWqSF)4 }k-4 I+k_Nœj7/eohr5S幙^B6}x,>1 8+1jUZW?~ɈNl7# z+'(X\1]Ed;KǓ1ˀ90Mf-:\T}L05e1T,h[s_^AZK kABp Ǜ֔E8r-X(oPҖ^gkF;_UH6b!Ɉ{1x9¶H6;i!psc*&i5CB8*0ѐ,;N6ς(8@y'y%g QHOn,HmM)=`^RxB5&i{3F7N0oGJ ܌*y#Bi|22*D݅Lvoİ(lFσA7Ro>}Ie|; ] 1Q1""U֠E,]^΍ڌzyt耣>6Lp]*7]ƞ"h;^rj. ? ow}+&x$k8 y??=&.0jcaG}1ˇ`a[ r"KǗh8o@LLZ MՠDNЗ?U9&* l[8):Ի5Hx $i-Y_HҬ307܋XzIb-p`.ف9y#$b`nfb*|%tp;"*;2S+A 6&}wS*, hj2rfV#t,#Hk5w t5犊E-0'RwLym_.!\4Ӈڹ0-b0I%k/T<{%d6J|Aڧy%lvLbt`F8 [GZ\8;x#@r`;4%4ܳ1xz 9c: eΚ1c F99I/@lme9(ފ:3e,>ſ|\TYXy 2 <`e"=]0q-Q[՗G#PBԴVF$nAE1sO[uRn*w7#V)_ Wse{tͱ.qӇ6xŽ=j''JZkPM #uTR/Fu 7zFb\e]XbH]sCmʒ3\}dѳJ*e0ܺl7 !5td|'|=G=Z1o& 7":90%NlԬmu *7trdzkѳUz*^sr٨a[;q'ڟ3E~ͻdVLrP՚Ot> |xqNiݘ}E>30o ϑp$)Ja]xhmfF.v q6 Y5ZN#.LF!l354X{57hU;lp̖`-*XPt돫2R޳QDdۀ?3UDwVۇ H`T hF,\ɫ5rA˼x ʅM$G&h83ҮN%tSgJv|(ՕzK{D46oo&ֶx]4جI{NuJ*vIk>*@ jsهлD(P?L]ے(֗_c; ~a!L/KT2%ww?M/*;mtMzׁ&sk5cБ82=hHzSSdڤh3c(/ #NG. æa L\܆ J%Ŵ1'Gq[^Ae<([+Lh"uv1GHN|j'?L\o:ǿc РC&LrrY ((70pdneրv/s2nn +.44PِB#b}Efp6pa>15j> I'ru盟M_FDm#c!ufX; |*񍯵#jZʢD&,$3Z]@] "IroN&Ri'0P~FyAO yw{Gn9kܧQԻwZE揬}NTfd~`LftdXJ=sb2XЭx2؊6>-bH}\57.ԌDr6U5s[?ջdX,wQ #(xge)o_;MBAS#S#-c&64AߠebF%;دDrc H6><@2֞ب@(אVq-2)m#6}wD%=:f6!)Y"A]zzV0H}7~;&v^0-=S$8k3B{p.''MhLK:_R"h-΁?L q۟4RU+7n"O tAb?E\OD6N;0ݣs8DdMXZfQ{^(ѧ$ݤm/%K_!\|O$<_ǾPf,xFBP˜B}#7!'D5AR*QZt/ 6}}p&B7-& :zTwQ(K]3g\_6Nͭ:N-htM昀|iB0%moAA#kt( K)-Bnu"9\v wVrEɹϷ~~dÿ~S)姾`J!Ĉlia<4gt_^A oPp~b>,á v#gX)zBB5*4 h ߽*w:XT!OD5`E=ԡ0ƪ.6/B-ժgLdzXbDi8ik>)kE4bgKC2.1Zi$h2oU{.pu[J孑v'ok, n uX+>+d40uUfJ t0{E6YUrb^|Sȭ %|i(g>XXNԦ%|_+D ]K?0%D.Ӑ9hZ;eatK0w=4i)n'Bi_@CzLhhs@|Ψ  \bݍmC`F>׸Sڅn=0ǯvp`(̓| D_sNNlk&7Nw:V؇F/ڂ}pWefeNlj%e: w6ydnC0e9og*'y'?g?)qYvbJp 5* O ף}jh+}AXkkV]-5nudU=qR*9rq=!=K-I,?UFokګh*ǒ WnF鎢6M&i* "m%6!{M\ڃ!?y%OӮxYdɮI2J`?՚獵^|Ej*!TLl N+uG.N=Zԡ=aw&ΜTO!쿉w t͍Et ΥԔ" rekj/꡺k\ʇg&B| -Q8NnftJ>VU5ȋbBPT2H}̖d]f҉ʷm_ia0\=, ه/l]sߎ"ҝ2uL .S'CHvl C N4^[=Ee XERy|Oku);O8ٰi) M}}Zf x$5})b"7)DvsMV NUx* PBE`j$7'ϖ-|yNM[,w mD;O)k6DqZE [S:[s5*&g!03x8TB%q+MGj reE hӈF|vzM]GѴ Xf}BNݳ~RZXqeO$\k:h|zr騋g=iMHz6wwPFqe? ڐ'%7FF*pxy[YvJ3vLgmz)f` IZW_i@ }f=Lt_R5YPG>+u3wJ|R! 6zGn9_lpP--68hڣ$]d;6,, &C4A6`FoOZ7c@}1C`HC_e9ݗ $Iz+Ri-8:/|,ZjmlM4zr&s2sdn@۩#KS+cBH.6-G:!LM$a%R7XVY˴ZӎOX9 ;z44B>\uz_O)]eouW%?G_C(=_|5G<% lI%fDQN3>kuQ w؈\^gď 2B{9-J}ňy]X&o&{ ц&M=[RrY9vgk(`R&~M1ۏg/FCy:.Yw -ĥr b_ڎ%8?GSp@;_.M̟g=Y̮ʿ,# X b/fa+j+L ul}et~;*I%Vm2L V! /3Tl$>8^@6c0N\6,kfI]mMhjyb@\y`^pa#lr_e/2rմ1r *sc o+{C;XaϮ e(fAϟ&RգT'%,X. ^^Z KJ' )_X.:Gh*NW qv;i7\Ih8 믌էey_@ 3Uw=^q0=N#wl>G\&;|g 38r|P"T&P+&vl[ُp'&pZT8XYX{ȥJ't e{Y #>7QOC7.5{ucLM4j8ɫN˵I܆޴KVyb(5+Nd?ir(رxӢk>yFM["3&<֭uAiJ6UO#!P^pBJZ+uv&"P!N {{-`V٘rqvh^&lMf kw93)UOGٳ-6RM% mdX80Q]AX.GY9xv3AhV*pլr3& j\`Qjb [Az=QYwc"m\lKfT3M11դx㤁Z4lC*4vk6XM?/ޭ.G.3F":+nÙπР°Vn?AwYPNJ.GkB#\&coJ2ٴl?SvW:A٫ڽh©8)N 5=硢^g2$-Hd4U!u;y?lvM Z+cr[?&[UvU`V+ CIj̆S㣴x3lXLKIF2 *!)aO[f~7 5e遼V\+,p _QdѝYoP>fpcЌtIPL6pK2kot %{*ԩ*8M\>0贈սEL3:x3P7ɼ)/#.Qη$0J$I0xw|x.ձ?6䜷o Èvnֆ-݁ʨZkɕp_n,8LPd0#@gGiqe)?p6j-T&SI>b[@O: ̹M+vnI'"xD+v:mG|UqyeN3`ޟ3jь=/*UZqhhBיO&5Dub ڱvDܪA;[߼})@L-…$\eH?op{$r}֘3*J{'`A}߳S]2[z5+tBS^RZDIZ' RV`;)Ly:A\uO-pl5xУg^ ,E3HOהxtf_ȠZѳmzd/CS_k0T=hޜzuxMO8^/ք&$ |U;, _20U.뎼'm"lgFW]:%ΌEɅVE̒]IAtVBǔhbA s)7J\M? B?J Ç)9"Xwxe -QXL!]н whM}Dzܽ;vEQ`G8q.+窡Ձ( UAu`WJ#ƥ >WQjV7OZlckƲ~B$D3[PXBOFto-v* k[Aia_o:'F(AU^`:L2=:-@6twg ib$nӶat9\ Wt'O/On{j6xg}2q:#yJC;q=dY\jǠZ ̌%iQ!EP%9< )ԣkAi/ucdɕ}{§~w C:;[̏1g^@Y@H"G?^[W N;SO,[oWxmNJF}f‚к"nHՆڮBG}t=q* +qeÇiƆ/Z I"*-OyX)FzVbؔ'ڃ5V>Wyvɞ}f.tZcHg8^~0},h]"*pjJĝ0嘊&vyEeL3(g)),e"jVp<)ι3M[)Jq ]I :Ix 6a|K?f_As8GXXҮyu_nƞṾՠF^̠ԙ fl1cBRA Ϥ9&v"^HVu0(jᯂ_lë+wO^SP] W/{. ?1vl IAMܛWNMuj#4s\E~J)V_S7m( 0 T!␩:/'Ƿf2[%^9ލ ]o7mwR̡A);_>oph|pR3ԏ.AQ|OAcf)%56bLۼ`ajb|*xfgV01 ORf#ǿ֛}2V݀V' 67=LpjsM*IM)6&F,]xZgLFBnQӖ#ì/#M4PΖD0;pŮRRb:`J4ѵH#02yz $44@<ML fl[T02 UNI`JR-R fK|wddB`'i)%G z\G8wBtlقcGoqO2+iJH ۦ: j;>,9*9\܈=#\?n%sxϕ^У+߫s*`ZgRݦpa}o\azS/1@hO톚!z P>}.uQ4rYy& j\9sCkՔ!g%}iK5! `/U@_\Ʃ6[_!&3@rtEfX$5}II\ B56/g[.'7V zF)+i4#|Jv1"!AؔjYz1*q(.$Wu u)hgy ssOfdG 0y<&}kѵQX<2c_녪Ҩ깿⒎ ?0Pi3+7rwoo,&!_q k%Q#fLA%xG|ICyxlYΪ<(ރSѿ2D6n_ؠJ㦉xo,vYPPʣh5٢pim߲ʤM Ķ&=,G}= C3Z|z~ss8+iM0gc)r?+  >xkQqcߍML96FZ+Hmkr"Dw4ɧQx9?:cۍ  ߊ9C"ȧmj[d23N* ŠfYms?aCe#4_[c7нThY:xUmrʅ";DvzŹtH7Ul62x4/WѤE |l[m`b9YSKGVAEtC9=(BROuvl>SJq VHFiF,5#6N]v 7a_vĬNUI I'7CE;|! ]`hOCh&}n1p#;$8]Ⱦ cpr}*w˭lHҬ _ orʯLWZnBt65ǐz 8ܯ(St2b8z`+b,%"ɏ%/NZΗȘ_񳈄m`+h!7f{}&=HQd<  {RiG ߋ^#|۵)-rlSn$+`?c4M`3}垴͇irr*0Uݕ"z7łmMy][jmу-e:B׶( c 9Y˫.2: _>SE KP\.I;ݥ']$qS6 u$Cj#SF;;AZMadr?/0fa^- K iX ~>) |2 BCŏ1O*PkxN:rh"&Sj`eԃocU$l~}$zB>+|P$x4t3)[x8rQCcZ6tH́UN޶>]#=L~.`皟sw49h9]kʒtZ&$UrfN"5bitU( ) ZL*Ń"yp' Kڎ&r.I`2C %SJ`E8lthO%{FbPR=p\ipb&Res3e&e/nmHあ60VVld$~-2WxҼد/> &V1' (>hE#8 q>߽$KyDO b+e^EL8ɿc"*]b/]IB-fj̽:9A<}jbZ$񦄀Dp@#?rZ_r .ԦD@2Wygn{> 2]u O'.|F|#*A#it,z@1yO⯾Ye ,Lvzۍ?N!U,dAv1ϊ?"P1hDz(⛓S&FbH+ o-9e"LS5t{rÌGJu8v,UJgD՗~;;@ ~,Z`>L( uݑO~޵/%?G՛Kg HBa x2\Ws dNej3Zd-BAn/;QQr1JSgЊ(C/c$G7iOxX,|rsMHωsQllF-Wx$vwZ״ EejZ 3zZa1'[iҪ@B5a3Vs!SudDVOD.oٴ*aYxwa(k#< &.ݻ(v@{Gm=Wrv8yOKK*/ \;a<ykF{j= gv•cڭ-w=hF%ykK;𷚨y 9d]N9;CZy/.9N\CCְ3bc1؟uʿ}-H?S_:5/uT</ME\r2x@&}9b}a\T.~gȃuPTwM}F 1i s?.o.ԧ$RT i_ZKB x<qÒMO!A@>1:ꔌ՛0ctb٫ -w;:\jGV+m4)E29wP'^Gfa#0F>Pc#$03x \ N4: S̟ `P惃Z4ְ7UƁ9)wԔ'n`kUM>Xe-Nʭwdyqm8|KgDp!PDYMOXvqq:D>ң ;$BxO]1̀{W}8FV{PXsު(%׻'lOЗC6V^ȩLYh60h_BwP5k0x^Cb$x9#èZ-# 3CRyZ?A z} (ZY0'g[^ ~9y ݑA5spa?,($Olצ:緧Ϣ5 R(/FRLx48I*$e-vbg mQ-(4M#\,4κ)~EXzTH㋠ݰJ9"sD11=b ۦ[UAPd>F80%` nb1r EErtaK/#8p -uVqfBQtyy,t[~LIJih~\&9<4tXו8= ic}Ҵڎ__1zi7hi61V}sı$B)(J =Yb e- jڛ׳5ݔ  '!⢽\XC?^nBMVV 3 t[x}ukPZA8R' xD!B7Y20eR7ş¿s#ӅU=7"C%[h/j8͠YM$w .ks̑RKJ`I rQS\9#j=8Z}qh 9a%dלu_Ϳ\ nlY g˳&tƍ]qTIVNV.Z8vĬڄ2 `;ڱ> %ާ<5𭳝s8;pߑnԀ-v@!+d ݼO)1V~yݖ+LoH׎ :s Hz14hbP5ZryaW_ EaTejyE 4╂SxV,CM2} o. mzG5~|&^X2smճ 5#ЗPSa jr=HOto7Pca+R;~zAVSoi) ?|?"|yFBv; 51p _]DYr QM.Ы(5h*dnɦ&%qqWە{ck}/4p1C cLiDx$o Gqjʝ*ృz=wlZkIM׆"aDJn̍TH1ȴPywhȖפ|Z S h珧UwEj0+}0aC7+Dl'lB>!?73" ) FCJ'rQ*[$pɝ-2u1JߣmݞonȬ2iKǔJ)PLsUZ z)oؚ?>!X"FHrs~"O-ƳLjBdfǍ2Х`G/ڄɾ䔇+pl{R0K]0ᨶkl^v:L9瞺v4oeroI=.H&GYLH~K;"!;z ȓ3\..>0& YTX>Djx1~a#A*ԇI5%Wߩvx5CZ}~/PDN]c >jg>"-z95t ?"Hf3zPi&6d=p]8]z?* %&WE:*nUMm7<眐qCF0{J`Lv:6Vq((^[quh SxvB7a$$i)Ȉ" ɹrJꮖ ? F!Y~ỷ=ap*rlhAFk2.s#&r=My|WB{}53y@uHFw0R6}?Tұju%Y#zT7( # JBV)P5CcR*9in%߹+rڊ36;+]Ig6LB(C n [4C Ng19fG,+w_N-Pz^4ԐWs)h1\N(^_ &}t'e+QQFy׃i_4$}hό=MNTac֞i4ѳLć GA9"29o:fZi|kf&>rK,]x}d`IFGhDZ9Nb&pN[*k(N.`=o3MVl*#{?ꁼ3DN U_7@]ZX6)Ӎw_Po#_@AຈH٥ L4HRE_1?ĮU,bNqt5)6wZ<FOXb:=3PC}k} WHe7 &}I&6gg!!C0$|b!K@l|bL^cRRccrࡏC 4o٦C}Aj,\|Z%2{BJ >0~g+_޳UU-Os^& oΣ7ACj E.ŮVTyCOʍ}mm_G maN2#)M#-`,!!&Z݈]ͣ>'V%EG ")9@R$ Խidw3 bC1)>hzWnp>N Wzg'P 8xFo ~_-@8fA ׊F484Pa['ITCdߦq5dTe&2٢Q7睒-ݾ[#B 1^T w)"QTL_a/%Ļ_a̒8E`n7(U1D6fJ(VkT(]kVǩ@#ꞷxgtU(Qd:z &aq@Vc^2G@ZMpj/*5 t0[T^9A0?UWi)Ŕ! 6A^yT ^ect3M=QTH1Ŭ]"h f/Jw9pdth!Eгj(gpqe!KQlLzjN 3ҵ;FG lG;矒5[-WHLt2(# s,Ҽ2vH"A0:W&Ɠ# OJN(t؆BaD4@dMP3+Gn\20r9 qn8'80󄡆2y;jbd V<(;6xNu?Pq.pfȅef6}D&Vxȩ^DAU :(;b]!.T)k޸knɹQzWev)#g.^HqsF9300CW*.MzAHж \鷌;Ô Km"ae]ϒly'Y^|);~,!13/A05m9aĨYߌ%0T  [4UZg/1^-S9Jt'%t1" ]n V@O UK[Cwhï Gp>⭚?ܬ[)|h |Ĉvj CKAبһ&SM|/OOȠZx憻`ἕ;殿"G96L*վ?2C"A| " 5_iNú+{Uy-waU5ł)%^ f\csYArXŠ&BTJH~9K4>*f=vA0f&ZxKc)--Z;X/ͺXN(ļ",T~%N,['WPaZP#dӼ[A Ws*EQkЧZ鎏tk}᰾ ]LϓXn 7ľX'ס2pKهs/PGn 05X'ђ^~r& ;~a5rq v)--cG*JP|F( ̇#չXml(>f wv<,r_m%Be 5w2~abK8lYa qc\88rgClɚM<-: +H sL`E4LأIrnv ްܟm|o O5Mcx7AȑnPvʣ{NNJ0L@ M;EjrV{x)+h4%}NEBccDgvN3u@|I}Ԡs|<' IPЅ}DN^ց^p6$ ?3A=tsx7ȟBИb(S%J]ܬX{V榲u9@p3\.n6TZV*d^U0(Hz7C~BW:̗vJ.6qv?%e<(J~\Ѧ cHed̿_@KuAu.8 9;Fl~ijϩ!&s&nXa& -sޯm8]|IKt.Ne,4Eѡ > %It6QIZOD0 sٶ::“R7XW'H12 tOό&KZh+F\V3W`'^[Hw3H _Ҟ! éo9Y ~T&#I^"qޭF70RJˊ9BXΥ-绰a :`ZP,Ge,\F>b޼?`dEsy;مB~_ 9z|4N$u2)G!jh|:]z3(q>|tԽZZFgI}urxqqX&pǯڍ/Hɳɯ[˹@<E$'6`jLx3m6^80齵dF!ySj هמ=`bƐuk *>SO䫫 8 s(9`7`/,P"ce21^Ss#=HجA6 XCS͸_b B fm71M)n,^} RTPrrxђ!ɠTIjp;X_q?Y) v)]M.<(,ײ雧JT T0ii t/BkZԻޟvr2]ơetSfpotHKs-vR#,*^~Alno^L'X>D3;ihWn2xޙ㑢y]:.y'KnGJGeÉMgVQ@?ݲ- eӖ,&PT:26O|"H?D[݊1jWq 8ha6¥w[,'2.`|Q[JMFR>dES<ԱDZa4Iaۊ(\F[;[d %FBFK}kGaDa8[x= ;eRi"x]byugx0~ W_UC)3]1SCwA=m068]jj&l)mҸ5zn|%fת2?s~}x-"$4Ow~Cf }m>-Z˜UAϦ.wNnb Wp+*ttWsxrPC#/I2I>T2(b+NLGUEitlQ{i''u;ct 賳I",R<DzD>ܵd|xg;XCKѣ&!K3&Z{F%wGsy֤:P97Mha@~Uy^%56'7nY;M).tHȱ-1bq|ݒx͢V7lw\K~#RI)\T6v&=L:Ah'CUy3{D9¡>VٛJIHh崌ֿ)֧^}qڇRzʅ}w fctu*6Y9\cjt^mXP/GUg#yJw*9[yyTۂE.fwjXAƴ.Jv/ N,Kjh$bR= s@ [lu@CNdiO}6Ѵ)7%@6<5}D^&"ogwK! Gމ*49_L`H3Nc)U> DQ_y"Lj2pS, ".@Y mk{A{*5dc”ݠ"pطo;Io~K/@K?Bl`ŖQ0] o9ٰ|Mwi2̖v!5|?nS+& VvDܭ9h+QQ.ת1D}I:5:lV22n4y7DVUDiܙQ2!e%52OB*Y t7^0"ɒ (C+aXx)Krl<46uW0}hU"Iи}◵ŝWq#zuYLS%<-bP<3 ǜ`h:_ qṟX<')wQA%^rmrXX1Y/BN𜙍4~kz]֏Vx+tPJUa`ѡ^B>DɣpCGN߁^apQysi2v~ oP<5]*ԚAD,\ {&z~0Amv_+$rEO"]vf0*'(% ,^{;+d=9WMʿֳ.SE՟kL9e#gRP6ی2Sr{\; v$c\W[ӛUmYԋѤ_yM{FomQ&AlRS4LJp~7l`$t *B؎2=Z9oa"N+F$J5)>w5r/,C& owqnbW^vpA(3|'*gV,D޵M,1#1Gmv8 "!Sڡ5 NkOWvwq)@q9(皊O:7qlYɄR !оt2?8*ss=U01q;m;gtNG5([H ƀ;c[8+!lW1!N@*uN3h|>RX!ڃ8՟ci!G!aБHOV+wy&#uY3@?,v9ɿΆlM&ٺme<եQ |d#u>IҫٛfhC_jXlknSO֧Boo/)1D뗃&a'1@'3_ܾO Y9S7?xRWnf-Gh>PK0d o7=E'f]!S5 [Gr?6LEEցD#]µˬ ~ ԞyJk/QY9;@MZc0Bd :CW⤞Ѣ:t3LmoѸ:Ӻ'~ԋ{q;\?ВvO[OTvܾ8uiH#ɓllu>|VS: sp", ᷮpMs ,I7޹9a2h@]GesUZPe6LGo-5yoz溡 qc\!w=5+RIPĒ[AcjYU;&c^9|LA;: [eթ |lE{ul> $Ia%{KVE h툸Ǫ0]k)׮''1 c 32޳ALɤ򬚾zgtq?jC*vrWk24ݖ[eK0E t9/kHz* X "F Z,Rkv+ƈb5Ael (EJ`%4ꣾr+7Sk0GWG؎bU`S^Rm=g ` 24%ׅ~ԮCiT'UmN^R1b\x!?(c+g %= dy3*= Š_zO$6DlSZwLR&kHoViNCqQv ahNѧ gTjpyadvaa˘Z6+% MxY=}!!6ޭ̸ ڵ+إu<Xs7{9.)k`mpk%[!-J8y[)؉NпS 3[B]/ң6lb/UDةf~{USQBG]-`܉C&LjeRk/2]NW͋+}.Y[bqB2h_7M Tc1mi9ӷ>!𙬛EQ~7 7<>Pe,۫UFV+$*־_ ؈Wƴ[*ayky\ݩ~8ܵZ,1 S7lu1H |qMUa4R/MV{ :.Pu^I C^ZdTbM8Z f m+{)k֔G}cDjv\`nbTfR eWg:~Nj0͞-]!X"'I%غ˦ Z3 Cj?_iOJhp޴M:o5"qOF۠At\ }#S3'%9k@\rHs:֍W:$ihu7NW_"tL]]dŢB # {O5$_# OsI1rQTV[K@* %o7L_w;6w>E %'}ņ{vw M77JDcli 8J`oMqRNZZTE1QdylnLsO-RV+!ߵ:w:k[Z[̒_3~9b4#Npx+4{")uvuڥY>%K\|{QQB^H0Mr˛dA9IBQȻ竅-֏uvq>MUPRM\pcL{]}cg,()roO 7Ni`@߇(_<|# v(+H72&8ZkPFʋ릅!W!)L;I;YDE$;ko3~U^!@vzy$銸oSzt )GzFԃ n,RvzCBAa}_Y [% ׺*\*H>4ܝڲ|:;:%Gs;U g/ל(HdOW3d,JJ+g)pf^2MF4sjE&Hb;=jȽ̛աG;` 6 Dɚ^JIџ6#aܴ! MH91jHTԎaKQ'Ra|@ sŗPbP4or^;tv,%N$h`$~8;/:Li-茁i$b3#sM 5~ B~VC 9L>W}p@;v<9IXvT +Ā/dku} xfb1cA+O.RoSS(mG0_eG Ht/RoЬgmF%6.) . 62ثjx1uo?iba%"5"6.̐b,tƨvRrkŠ8vwriw71Wi"t{hMzZq@0~Go}I?8dd"7G!P3 Xя߸~)2iA.Kadz !'tHh*xUAiu}|fЬրç[xwFcmq9^$ptKcQ⼄;Dk!@ M+_iW;ltGvF$Q.t^;tWī 9(oޛMƆ_8jv;oUix+(@A^"Xnr|^1r26CS2b9ʒucDUwڅ9c7d~Z'$TFڱJC{Z"c4͢oOwKWwyV$@8E =)$VMRǞ0CQhI 9bh80s0s7n18vh/_t/@tF0pُ.z=D-E8p"~pZ[}2 `y{[U׫,#ϫT [L+|<[?yiJ)ķii^6ep?mC_^@e2_8N& 0.JTY(CTEm#xRx.<d_s^)%b9%+yLfKTYa|:ZCQ-=.̯ yr44&qԵW-wh(0AKV݈y_:z46?~/N ^ d7S<ݥD8s1fO$Awٓn6(E Xd*6Ұ#3"n7(wQ@?`aQV5dUTZ1@T6`'O+7K?TUaR9 /oiqϾuvaZ-EG.-J.Iv oen|ư6^j9glaI3;f{L J #gycb$Y&s`:C` 6D#([mNDYGyTȪJ^*!F &+_W"a,L{y' 9 ۳ ^*}rphJ$@ukYά͸-Lw# C}w?XÖa_~\'B+@ VBxs9LJUya.VlpF2[tM_A?EAVd<ūaNuZfeZ#N ĉ6 $VHh;8"D,,il:ׂy\;D5=:+RݛR17n ,~7pX IK/ t]XY˓ sJXi#~{Y"~rJ햴?y_sdG ʕwc7? kY֮;@p)`nv`.mR0/bƷ?_`#kyPV->;wcI5@@~v2DDt@&+[Q<pYViZ PG܋B9FL."gp}n(=Xh<5Vͨu^I5-8pÀͷ?ڷ($#ZgTi2Bu^&7 )'~d} ]^#IJҥ}i}}p@!ߜiZs߿;$﷔2WP\է!Qި/X@sC>0˷?pڝٟݽ[ ; :\Ғ-6II0V5dHpbS#7ht8P]1NP[ XB \\ ET#sXa}_f>[ *e_*^SpH)WȻEP'2N9rk.o&.MħQV.b P>OC/-8loZ=y?ߙQQ}mȀ&щ?ٌǎQ`NOS>"=XSRibkhp<9;'zګXhѥuk]a`@/,O)X)7~I5e|r.(3'5Fkmߧ^wG'h+ X[a ׂ58} Q ji466Rx o/`%soj0{Z Ep- kЛƮ*/j͹oHjz{5%!*;fU䇈Zp' ԙ6Ssy6:9v.{=nO+;n% ]Ja^ϭ=q5; C^9A 魚e=a$eLEf|%y<):"%qR hvK(ݖzEbh#E 6Ba ;C'o+sŴ 2=_9C)Ul0sӶvvϴmt\lKc*s;q ex 0K~wRul&A#dv7YkG$mbfdž>mC *=DSĸV/) :u mJRt++H,='dg/ak,) 퉰ߟ>> lܱAG#DO0A rkD}IpXСKa9qȉe?z̭emq hO#~3:EFEuBrq1+!% 1ʣ7zj6GV4V^l6;/])DA8nCë2[xAKj>q5Z4HӇ뀎`S{sXxOtFaT7F"hH+ųֵ蠈^ІOAc z_;+0}~1"%H"6-GkT48PΝ_+y4d,w8CHCʩHxvkvҪp]d[z)ۋΖpD(3q r,?i2+/ )_pnyNΣɇ%P 3T7wQ\m &0O`_]n.w=CΪíC@>UI^8T.fޮ7, LFˆ&W+x Tu>TڄyMJ ]Gňؿ@v 1PordzLcfFMD0M? ( @F rȳ>/Y & ۻVO"VN?;e,qwBlҚ{s=? aI [b\~ܟ;(OHVG$a_^1/,?ss94cΊ/n^5t ǐ1ݓ,kSZci6}JIRyWXKi Y@%!ch [)8 y(ٙ2MKYװTH eP K+' =p3'!ձ[f-Uj\V)Y /׹Y 78}ҥIYࢭz G?.O;R<4y{qa ޣOFFv:'SR{ge6Xxr1|.H0~ougA{F4y{*Ilw2X/o]AK "ᢱ* !՚TY/,Jԉ75]*&ʼnuGz͔t(Y2MK |["QDuHmտ p3e{-mq[k8eN{/bPb{̊Dݭ{ӨF`rqF!A{yІAJm.' S!%IGC5<΃^5 J}SZư_H eCZBd#`93ݨ dwAwWy1 LY<eno4y1$`e"V`4}7#,( "*+UUHv:;^"8^kki k+L!>G! N$#ywѮfQF4> &Y#75UnYJNwݸ8[Ix_;9yX=h/SVdـ3<؞D.SG4ڜj SZQ7ݔ]hMJi%1EM6]o˖,0Vvlj|pF W|x]t^ݕŪA{?9V*`*5 Lj:P㈑L kF$7OXߣpYƉ/B)7^>:mw Ā:2A&45v t^쾢ԩ̻.^=^8O;9~e1WJi3Y˿P_ !kc]' 0pMDtUHX7deУ@?-ih\t+LIj!K:o˄4hW ;۸a$gqGՓ;LZF"h} h*f9v&(|$Q:AQu٢dž,ε4F7ءڨj\:A[Y<%t/j<?Pp4ЬR~bفdT*pj  .cK%Gl&Xeb;&к&bFVO@MZ3C&Tm;2%OF*DYp8O +*|5 C3XF='{X }D߱>Sk/$?)pj9vuR~5xjJ-W!g&+)A0Vٌ;0R\hDج4w?_E.+}CIp /d 3I }+E7oI`L7dwn#U CUR^2Idz#'+$.WXt vNh"UYbWg Z'}#L??\ɹO`'Ԉlt7d_α j6t;sF:B_ ;?/1˔8ZXWxtU͵[,xuͺ[Qib|iKy!(Tw BGKI?}u_GY0zBwn:" : KZyc|Em[*c|ȶ9т75%r?xQ\=ɃR C3l@DT)Fu\SkyȲc3V8mH.y61'g%:*^՝;$Jmn3iT-o¶T)Zś-Z)-?},沆63>][C([XO_ \_$#t~[` )FbѿZۤ1;Ьe,,,Zл!NO}<,9wE7ڈ߮]j/Hi0~Uo ﮉ:vᔱ6j6dtB[İ:,ˆ.dm a85Q)HT|tN<_ͅqD]'8ס숉M\!iS7Ңdm\"bN ߲Try[ڠS(v_U!mV3vGnxI /rz}~N%Tu]HZ/[]$Or# h_Xwm{. e2W_K)> K2=]Ò8︉nUD"jDD(ΰtr7t xZy.IxOmlv7N!* 5*^O@dTOdn⢴8_dOeRO:˩dgGYPe%<-xmG7Es.I_/пf++#5{MSЧ0? oXUV0Ày)l)Lĥu-qŲ`zd?6&#H3#%U"o^yޢ$hX8љ1a'nGJ ^| ^5扴!Ř`Ul{q 0!Jf{ Is7֟- &y 'dVE) g=O[XOx?PCIIHi?!t,]v $Ծ3lH]S`ʳMB4eEdgJu75d@:7zpv~lR>$JҁVG<О3iD#--~9IdXhWx eI@eI W*}.!hW=> ' 3dJ>7OE_1 vC?h;]G躁hHSL`R('+, @169-i @{n!%~qӉDv^od@3Y ~k0:kŮu}X&{8xX6b4-ZFO Z(i d v_sd-J-AVbG2 mi'F7h,}J{;FژdP١3o͇ܦEvVPsHRv ;EV' ig:hízkj2R2ˉ4qsmYa%kuOxݦ@t163lkuB0e"$g yӟ ݀5+0tbR?(VV "}//5J쳾^CjlPGN;|,5$ τ+/s@s7_|5BoB;@<2R!=2-SK9 a6nwVQoLnW*j<5P+,^Z.nT*ZQg/\;l3Xeg4VN]l0ap)Ъd ~+ N%^94L.hM{V .eBm@c u)T~r K_8Gѳij, ;T{r+D]s<Ŝqas^&96U 4F:twnxB4l>MQkyj;T~9y@Qr"R~{k(g2OJxI0q!d=Yx/8_MGfV& bS_йQV= Cd;]AG-ŪsJv#_"erNS"? l 9k=>C# ʷ66ab;ް*M9] Xω>Vr?ɛb] 0w8h;V.āQh$cX2'JG#)ʦ*:G O:ӠuP/-ݙ|Ia_o3@* k*7ߪ{JL/_ɿP-wM0~u+$*=BEO𤈥W_<[SFiQ"Wf׍VU΃"mӱy13|3rW;*ocTێs?0^FoۍR?4&UxG,):ڝ5.˳/k!r8JQuEG,aiMWUG2UW}ÑA։|éo <}sX).4P.rD#. BzCPjps,c+54aRA1WԬW eצ)$Zsibsv6&X̬ed8`ԝ=5\Rr_Fg, m0<J_.X6I1e,80 DB7|T]/%ϥ p&BJÚJ0/W3> מz"QoˋƑYO]0?e_gG ehyiL}GqH{Hg'ǰ  6,]myWf߇,xcց: b@,-ryhZC:M)N%3}}'”/Z>hʘzr6lpGQZc*VN]Aⅶ;2M}jWX2ϸ۞NP"AlsZ. }UFL^+lsp1E/@~J,j>Ӿ_{&X3Ox^YS҆|况3MtyvIo\ ݶCDp\<*X2g3-U2l 1euÊ? چȞX΢NcNyo_@|:xL 2=o\ص 7`]u^`l6W2Z /AE\Y\(N2dH4FI/rpv`Y kO4 9iY'iVj)LxAC&y=Oy!< tAUnI#*? _!p]4v{4,C0"XP})HrP|d=7{@B-X]Wj5cv|V 2[+B^?ZWD3t6WPĕkY:xx5/8lџi0f>*Ek&xa-4ߣ_:a8\{iEINh c־x bݎV(#ݔXҙ:nG_B.?c]Xqm֕ ?iO͔q#7NS|H>?}3PO;j'̡M8!)P:&H0 NbY.tcu ͱݰJ ip/H68,Rs\55AhI_D: )f/ie& k 꾲8ʥE;oHzY{j裓+C9xSv}^1 k"xjX9+b/VAf7 }IG% )_ϬF޿{- ~i=C6`|%0i"Hj.ݹ7(JW.B++ y" ()0z~&[&]c!zf=ƈ|զVhu筬WJ(gͶ; _I*qrSMe>l0i[ќ͓)`Q1w'ܪKGQ^%9| ğ~0ɹ *9S g(vzK}(&4#'3t9 _qs[D2H!`8طvlW!Î"ˊ-WGfmTTs"SyIC2A,嶩-7⥅usg33ȴP~~)p-UݮPbP1mIbA.HU_1{ ck:q%9%ۋ{Pk],ooKj t:D$ Pa.xA)tkQuOEb ٍ?49PZXrGfҖ5cCa^(-7\ < >+/UK<εiLy yTؕjGandUuN 0ܢ%%` {:Bp7. dϙlf˙AUkVrHZ}ާ=&_!ba+6H;V aT9^ ?;DG5y+R v7&r &Ps~F:\:JxZ&6Td g;{#xq5jQm> 1̒! rT4?%ΠsqlH_M@lؚ r=-~=#4Neڒ&둆O4s1 @5֯UR,Qh=EeL"v~vfM}[H LElv>=h(|f%; /ἠ!guW} _,%\*0c;ׯIIt|Ss:FHOLEUf2x|Ek~NXQvM50$B ycMqhJ~R85jIx)6\K|5伧/yXxkoz =YKq߿ ! ;5B]C.PGˋWVA겤;^: ]bLp9rJ1lQ:>Ffn<=KC{B*SC}c_ P@u oX¹9Rр D\^c3E$hmgNbhC= '?=vM\8=qaj<րcU|:Z=~Zk% _ [Df /b/yR{6vz?}}a`R{䏃8Q5 5ݍ8(8a)r9 Ԕ3" 0(; q"$-wZbfbr J_O Lq!Sx`82H$d&"= /InNxQW?[vtc? quevYr"tΚYe{'ڒ&>~Cԗ5K`xDe5!~|\פwI_;>: ; 1Dɏ{_ ez{^t#|QtʙO0Y=e.)eQذ <.yJE< K14/n L!#kr<>"8!SI?F[~Ll zuBGQԱtc[/tjrqNm ȝ} V:Gm@"(mҗ!@N?G_SR5Zx %/0A/fY,vĒzj+<Ġ;yZw-NFJ]; a{i< )%W v[ˉ~D,u<3\ȧKcޭध$y-ʢLٔ` ťp*A!̽%7cӴZ۲T[ArכKE9> ﱚ |ĴȄ##/tJE`e,61BR+ҹR̨+1LwjAmQo@'Zd|@dU.{ExM݇Xp飕 7DRGcZ!r)V<@[2^ CS^Y6i疟Ь?Di.һ5#}eԕg1fJp F(swF&YF6aBT[W%ʈhZpPoQ  K|~춎+2yR7H{=Nf¢:V. >R}g&AF?іك:P)O4<||Nēsא |7mMDJɨ aO =;1L,JrށHB^lH'VA>(r`]Vg&$ȢfBKvi]kEjn]]%nxH!a:~=''m`/[?+YKҷ%12/tpH#j MR?#Sӵa&Q r79B% DEk? GjJ%#6"=0Q P;@N{wݜ쓧.+S*·Z4ygr潵DҜyٿjqozE8ƈ*hW a< & WEqjbl?@:F0JDϺH%\3-U26, ZmLhzM{k( n/w"uZ#H()=nXå4B tlRTvhґ~TˤIQTaa窠eRCBEx;;LGe9{ NX6CZ(] ,KHK EHrCI\AA*KgFtfGoLT'm= A2;[h1+!iӺ89B3\ KUj *,NEtUuʠH&:J1i>OEjm&r, x>+  ONPqjk٢& [6]՞,y*啒C?m| x~M4 ]&#>϶dDm?B Y]B,ŢoM聯hui|֠52i KaTɺmp~1[ⳁDiycQwUuH᱄+u%>f'k BA«ҴgR6tܘTycOGyufUӯ5/ Lnx$ǰo| X\/\O2e0 ;),q (h%c3 f@zcOloIuD5T0dya5<y j̓-~{(ے:=qc,!P][|Q p\f~e.Rens>AbCEnl +F m~- IExL3d"䦭GŷCV^=b-M'Tמ#kkC& 'PQf`g 4U~XY:xF n] w!]/?/:S`#Smz$H6wvl+c69MKk5T' B$_3n1Ad^* ?#B.dl=5Y:>w0V@L4~Μ TVҮsïr.QϢm6,"*l:5 s" +)X'ݴB"(;Iͥ#"i05ʟGc;ظ9؄Q4WrHܘ?6O":E`cTCjL%H+6vW斗"w.Vo6OTwVw?T!S7n*;3?$m%eU d>4se@4OwDt< bTQuY*MyD>x`G➨,&:,uIh!9OORR LE\WP h!dM jlQK߉ͭxYN:pRCp& B4q/HE{ra(!0OɖeدW)Du+ڗK;ڃ߭ޣ)c߀[`ZXKsCӉꭐSI8*Cv9'` C˪f}gb_ݠC $*pK-3^|U }e_c}۹`u TiSt Tz&5. ҵ,$-{Aҟ|7K`#Qo6*N hO"~'_LMW쿆c彄'FN+o)^@D02'XMދ79=D$+lu+߹Unk[לkF'e[b=(31SLJ9)uGX5 ŁJ1"'Zf2U|V`8a$wԷf-%h(P|b¾AV~|fEn9h_dy^.eg|ޣ"eq5xx/S}9c^ѕ^69З6l#˓NECXw.8՜Μ,B 2~&6aw]r .PgM&s3:'P<m[pIE/w:oU=aB&q,|߱U 8!zvξ\ -.6wq49)]-8-ܔT{sEcA*I*{˿Ѕ.`_OftM7=(O)~)`xFdx_Xl0sRl*SYBFt[hC_R^qO 9țR-U kZBB.\z@ޙu XWILe~M)npmUP߀Bsjgqο.vf;:j??c)(%gjZ [[2 %Evʶu-J7 =೪k4!lRXoE|7"P1]W[#Yee"kЁL G9 n?h^F`sK^͋V>z RM_o$334t3 ";-\ )ahvCL.cގS}|d8T& O"OD4؉Ή"YiO3 Mv VUd"\֛X1FS+v;vvzofjgD͑4.>wC{@AtT ɑ:˗v ~ib=hR} њ@Fٻ}~c[ ۠SWd'6"WHY 0^ ӊ6C#ZD5Qs'<[>DGiseeqGW o`7ERϷK-+-%NfÃðU6cՂoK(S;|Fl< K.n6[HH*rڏue"/cy ,@\78nPts_ͭW"ԨaD׋ t9fDyUe'af&Ess/ȩ& ` RfgtYE]|Yd-?eǛ.gq 擔 6pv!,Xs7"3t5cP?Ka8K?f&QZotl ^ۥMxa&_s37s EW-Ys#V8" Aht4 {u7p ?Q*=tȽ <`]S{|ZuƓW5dބ,7æS_Wdڪ9y^|9(xS 2F4?U*q=[O:U~d Y*^`dFc^֕ӡc$?_ـ*ا_X?c2P5;bard /DoH(93be90D%+Dձoī9w 0}]9l]7PFr:B ^/69)@)0kReq8O`n HRzTK"=}|㤐  ,ME%YC&gAFܤn,ni$DP,ϓ=Ѿ yQBA$ߧ:v3Ʈ\/MXf-6!RC_1Q` ?A _rVN?uU%M|3u[,Qk p&Jsbɣ4t~{Ch|\}X`5H[Wyi1Ā v横u/;d2Fkk ~ZɪzQ-ƱJ8'MW mIsZ 1P |1XY w9h`kD76zپ͏] wDk`b]СD K奦@g_wǁ餤UЬsPw$V-$A["##ubJc5079㊡RwrY#HB7Pdi }_4_6Wxv;zWfGSIJ'FyM iT]A>MGDy$qvkt/tV sKL/, ZGR5e 9>z xwvTs]QorVJyLbb7!!x:hK9CJԡx%u =(q%F5Η%-d%/}APKovҨ<Ϳ:K]ᐢY=䌇摣7`vor0P@3˘6fX!\H|@݃i"/-Wd9DcI9z ?.sSqN;Ha х}Q{q7&cQ7Cq#2SKBBW&vήMwc^|lX2X(Nvtt+ I҅R';20Zw~-u(2N&!ׅuja`LE#Lƌ1o:+CmFJ1Nq222Zvjkm.{_4c?^_4A54gk^6houRb,l*babkcc 4l'\攄g0V_4! YjOܫ!xps*10܋z Khfj]+H +.alCmv=%yu@Fe!A]M:)%wƌDy6o_uB#î½c4_nQ,(ᔄV`yLAG! o2ߞ2Ec{FnЖ,w o o8.q^ҡHd O8rd"UdD^Z6]9ioʡS?ftpmc_xa;dlTBy\@E wtI5RضVhʼn]([Zkj aFxLzHe@ p jU$`1ImuM+2\gU, 4b`TZ"uⶱFA.-\ӐZU* w{p6aVgsmpy7 {pN#D|fmQ٣cC_:qFX+h k,X ϚԎp+x`]<y&jŞs}|9lPN'beǴ e0mk<ێ-s7Wfc]\)[I/{s`flE4Q^U=YAfI"/iA)ЕWzwг Hsȑඳ(_> y,cb4ͥj 9qָC?Zٖc\(9q`PZ\wfᄅgL8Lulj#yheXJ<;+0. GNאfT7tk˝ƠjYS B<Fu-ÆzeNO63F+ Uu̧:c=7HNք)h%vGˬ'[Ư , E1qE[0Gg& ~[uLc{mwH+ ѼV@5nM{ROr|a ne}7ۘw=cB׌?đ[k3ͫ<@Ӣ6 Cw?oqa߶uhݿ2g2S1g1nWL+ DW-^g>L$&]GK ̖ 4ٽ;|Io)sfMFZe qa-00ON ng  /qTe)_?lpݜ]>ݥT}cl|~+5c/mTGQۮ%KU/ԢNF~t(:0"ρLO1s[Damp:A9,8Uh-Kq&{*KFNc2"c_13FYQd\bA(Q ca}px_8gfP=gDJ=B-܍Qxb]joD<@=RNqe4Jo w= L?M&.-ITY>j -II2{9|zYA <5)B>Ja6c=+"b#LE 8rtC(NIF#-H]MnJ^馬JG'xeetfR|%a]pYd@F4YC˹0Lnb ,̿vjeSt^yP]@߈e19d*&YBjf$q/z8٠+Gg;XDAuyZm7:I ƺlc/#M,u'Fvs8SYߤ;d5̘5L Z Q30|7d= 䰫l82gU*0 2p|r @ź  #8miQv1paS5NL§dh&Q ` >{Zk&+Xowb'Z̿(@C+IVt"~)樂-W%4g6JA/\dQtWi1+c26^-I`?}ʰX"zyY-v#yhqaR5S5ǥ)e"#HIB˾h};3dpoQe$A3/S*5h eRr]wU̾Z(&dnj>3gB^ɜZ-=>u%@K]!UڟGuTT/.l݅drLj?))fÚ;ΝP R[ܶZX{*b "6zQMQ7"o6];?4Mnw|ܢIΘl97Hu3yqԓ5s%7d vKHLqFJYFU` kZT&}-27p޶ĸoQ.]ueح=r7#1jLJZa3A3]E Ve*yo } ͠᱕)ت˴k|)5D#BˇQ_·E;:c ,ᲅ89 ɣɲDq@u"_ ]}: R`|G/;*^;zwMVgH[?d(VS,sr-Fxrڋ̩ TQxS&kf>~nfeXUwBP ]Ɵ !|(?ɅDL4(@H]$aY /v.srQy 7IM- J*I K+RpX{D;U:فΣUSqgN$Usc<;|R|֠2dlaC T3M`05(w@~`x:G~:t+{/y } [wt%:+GDu)aFa7g1.F܂]tMJ5O)&)3:^xNlz<:dh95&ξY$S$>}ąm 쑊N<77,㱓8=`Wt\yEbK/xTr8D;x"j}^9qDfJX''B+dWΝTS9ʲ`rrAÏKk&)R_˻E}/!4fAKܫ*."ڬ5TOݳn4vtUG6- #y4ji.Zk:-fBTn;Dq UqQWSakZ\1S<&Po 㠯oW5ZےW*Jː)9EiApJ7G]G*,06U˔oUg\kdABFrXS6`Oݶ(yS5%cw)Fn#;^șl"oUh ~` l,l{F|?ז+b>dT=S%X=??aw?NgM:to;m̩C8WDߥ^? p C_0./6Ѕ ʍL81&ޱ6t)hg?ϛ:% Ru`VȰdy((98 lJgv94ZliT]GSGۼٺh Q.bS]0ൡPzo8hmHn^6F2D{?ozd>PeN~Ddb'hOmCdWݰZgLo' &O'/~ 22!UE`L]0)#+T8 [+'|33Ac:&} oU%|wNFx:BdأRY#4PGi3ZŗeRd`0M3'sϑaդG6ne%Zf so$]i[ ~j+(mvLUEZR:$E͹B?f-ʀSXd~2Sw4ѪAbMmء;"=2a1]owX$c4&|+zh($QU F;/ XT~f߇ܔ“򴉷Gֹ=`ٮiTmCm0'u"}cqmq6gB#0>vV- wG̳"qwbj=\G"YfEeӓX~ !$HDKWŭܬ6r!t<*DwߛIZ tA. Ԋ &Jw%ZmRDJ&j dAc{m/5;0ݧWʑZx86jlDKy4q0++}.!S\Ɓ\ Y!z`]3Qjc2w)bYy@⌣}G& yE,iN]\5x`slS\HGJI"Hk[1SՇ g+"?mう~ ۀSM~kuJo:+ICmE=5ja.=ULhG׾Ü/h~_>n%0' G?:TZ7Pދ@LLMg;'Τo Ou'0~z[x;§ loFIK L3z4w1?Ot_+5Y{C'WfGT '^'&2U32}nv򢬔YLL ,1/ +kPuX lo"-Ɓъx*+ihڈV>HtLcR@K;^`lW!uMWREMy%h!-NU@츠@VG6{=R-dlj'+ْS=|l 2I~ϵК\k8h]nb+{D bbOa_`H\.|K7NLh6԰H:$w/{Fp'; -4+P)Pz - IG~~޿,w!keߌjm&@%"@u_c6P>>,v;+ R7trJ%ľxi(H/I%^{&5lpN LЬXvvKe9q;xBY#^|ca[s\=V|l۪@1{Mo^;)go>zįp'LBܒ؇v4ba,I\^utl:̂H3C܂/i0pBn(t.WM\_`{Ac-ZU)0xZD=1ly?3 XuȩXDJDLTO3JSKj {1<1Esݙ[&p&d\Zm<3ì/o}+5<__?$ч`c>d \lprḿq'H. 92h'&:ylի: "Lt ʊ(I 07Ex,CJN _'WO  ??˿ PllK!X>1pb78V?{}M%z iDŽo9MK$Khodtc,_ҏLfC5h Sq r&0Ew~qz: Ɔ @G`OA-k/k%'h|.wO:L6`Rgq {ѕE J2s{$[ngO0[8HIruN n7S3Ȱ@ C`j_nX؂N6R ."y]aOq0n䝁ᬉ6PQz*$ pr")*s7k圉= cp_I:3?tIOeL:~d.;\u[(F=ʤ .eҶ C^g)$Zw,q!r6M@bJ\(qZLRxi*x$KcJ\6rp%pr2@U$\DA Kǡ" nhxVZbe'Ic[y℅=-!4ܥFJUvLhؽXl5>w3p@ɆpKInT#׾2ܽ/u(n|sLLƎF*/1 -#+)( 5ෟoZl?!GC's:#|aw:':+{d\LzzN-yNs/k6"2b4ɿN#?8 bqk|Y1Ch ^ɓV;oW"'[|W]2Pf3f|IQ[O)h0`0 }. 0Şߋ2l[pohQQa چ{ " GepJ- KWbr RU4*='/Jrz ')$ 5^$nAq2,=sPݽLćȇ\T XGkQ 0g@># PaנC҂h<UXACFZ6βgr) qPVn6ZY껯倠gVJѼ):2o:l)¦$$C?;o2^ry+U;.|TL<0KpSnW_c* "I17vz3yKDX p?q Itom|gzlg  yhꝅLƐhdfC(J$|!7>pMB(glY6'A[ng([mZj hML`lS2xN<Vy&4?bPU7@Mwn|9)w?HM%ss,™+ eMْsl=+Ac2s!#5/(rb?/ QCk 7:do:7u7WٲP2R-6 QZVX-kl…S{ cMVNrWоQ4q`i4W#| Ě-{ %%y0PCTQMg/RZ9|ת}i\}ڄ1rOE`DĂ Bê1NawRug+@TlO?ӑ#&r!@"tftITG87˭]9+zg4`{sۓn%Ku|grI_>z[C'\"5SNI3F XZRtPPw?4b\DP/Pr1 (zg~%wc`u IKƚHt:dD;4i#k ?)U' $HlP~*R*ov"M*+i3x˜GӨܹ:Lyw69\* Jc|+QL6thV/T'E<+s2Ws`Vp>%6Y3)tOccTej.} [O/w('yQ\L ly{`!#V%1}M:>%veo{lzaŦ󌬰רUkL⍂\~jyH()>:̯BI@sȻ^V컆;gӭҺ 2c.[υs5ۖ6ou%̩2gX):ܘ[Dmo^wQD vUۙ" TDR/F9l!59:ATaھK.~_#t!|X^b6ޝ. Pz0#b10811OLӶ( f\0=σԽгa,f̏pwDh}e¸r35u JNT㧞4#=Z&Nk@\hTi1NqR٢ R`/:0ZsT2A J,{\έ1ϋK =W7Ǻ((UےWY_j*oL\|:i@MvR1E܄QK:(2k0a_*oFsPvQ s`i'AV1eowx2~qջes˳KN> + YQcʢ`aE֙zx]n`0uҞaP+>um𫅨o4'~a[&JC%jJϳq'dle՘N;@~5;r>c< |?0S{PlmM?Urbŕ `~Z% /R mSqN|"4|2vԔ0YЇw*@\ iT>ǟb| zC,YAc=l!BİYO9}U4*@D 6YD [w}Zm*QRfrkc]8<.U|pj)eFeWf}\̎E 'n:>{ns¦dɪbi+CT1&RO  '#MtX=Ң֩z)@f-d23rمj9sê 8 Dr|P.+Z0,,ʯuU}*=[䒹El}g/WOdLR9t]r3@pxpqꑱ=!N} ,!up|0k}-< փAiֳ+e[NM3z 6__ ULe/!m  }ƷɏyTN2 액YTE+Rՙ&ta0}Sbp9{.xNu)HR:PU,h[G-%衺Ak6AǁShk<# kYO\]|X~5H}kJ-@ҳq)Ge%)=S3u+ګa~Cqvd`0tiI4t3CMFE"H،ƱDI(]PKEJk626{p%\v@PݱO8Y)B0șg).Q2b}jhUs5b2 ; HF>,ޡeDEP9,KiäӘ%#rxM@Bu}M_T3.$Pw#S[@:)F-,Qzb* m)ٴJ<=Hr T;yDoB-\6ohK$7,B{$UTh>M-;"hx]%LKc] ?3؁ :igJSʁo05w M3HP:3ك8q7SQ˖q|6h qTAF*zb oD07~"{ Rq ~GӉ޻R7nx5pʃm,V ^+t]+'{PeByP0u СoQ#|-Skg{nm,2<@'y)]f?f * ɧ!a†Cr5|WtMR{X_A jPY4̷'&Зr`R. DodR]ޓ)r;Ly| *4VXx tJ)$%̽ %9Ji7~-*rq& ]0U?3/gRF~6g 0Jz'}hN2K93C6<~čSg0K br)ǐkXk7sO̣,5Ӧ[-Bns<+l'cgbR4ǐ&EZQyL:e>3~XîLR/Ey`a~~s%:Z)vA[EVh=xy,Tdt9Kk5O^LF̧BSBX(U2[?LG -TXrٔȕ0F(M2[~ݥ2ܐ R!vĠ+:R`N͛(^p_ a .Sq˧e/;-u7(g bqPOSdHj&pjł K-4S%SVd!ʛnp^ >hGF5Y-;y{dhDze8+^W\~ q<'ąw%elkZ:D=UEUC@f{|,vƒXqGQ9R<-0ڲ!3BjrB@CVqX䀹dcui9Y"MQYE"L}][5W@L|ذha;EMAK؛[V􆙏CJ8DZ6$ݝ4a-(ťhԱnq(rrfUq+=JF-\gVKC0Aq]g7ڮDŶ/v=~ַQ0z,d$7(îyFÀƆ%-yΔݨTT} J%x {Z4pjs+ƹ)35nnC쓘萈< 3$-V G;clvcTd!UqN,C"QQ!ߚ=Ҵ3%'?oڡ:v% ]fͮgT*DF4q%c<;Z{ƾޜ4oO"<B)#DD[&:}ے ~']R*I-ŶxR\|`Һ[/P)PjK>46yuaySw#][~&S.Ph:y:Eq'AXINEEXyE0]L"9i4bs{/Hu)FVY*wQ!ɵ>4nX?W ۷xeVyj7qZ& #PN179q=`d>QR p&ܙC(ȁ"֞m;BM( ʧz2ibxJ w.4W=z1*CS!WXI \v<zƵL6|, /cI;Zi <012k>ab27g-%Tv3;c}@ Ni_;K-U 聁j۶P͟ܦ0g~cCX" [,ysG4xE\/,?Mt 9i/wxp壄W A"yPcm~)w+A&,\ Qɍ Ԟ7VJ;j #uAIrB]iB!灎;yW£ER8FM ҧvѳ(0WVkJ3 ):I cZ.j>L-D3P؊d]]xޔ(-# Ӄ<׼{JVzƜ;9z7L%!H̶({ֹ^- x r24?%%:M8⫝*R#XoY ls (6;Hkb+^s@&evzi |ꂷ:H8Qy #ΐ7jr# T L5w4/L{vhJ)1蕌 %z ,gDz]j,eced7\|ϾnADcے=qv@[ 0YVz[a(1n7WCC6T!Յ de?jη}%η|CpkAehIK"ĦFɤ,2 f|ш܈VCށU[gإYi>[Ƥ&$E5/O*Lf-Dpwˊ4s* b YPczʮDuoN .GsOeLh3垈8Q%M1)ϽH|!Zu%ZІ Tcn##:_2#ұ>ÑɇqKzqMVa$ bː}GG)Y(Wښ)!7eY5 5CT-rbwKA<($bLK(AWcYٍ @u1i@ɩ2 "o@}6DT5$=:=PJXb)x-{p5Mv7c:B"z4 kMvH@ ZG#XۍI)k'ATnRxd7 *"9BET݇gѓ3|IdYQasR2 \F3%QƜTYUHf렢#O.Vh4xKz\f!dR~bhT緯*w# +Moe\ l{yJ5Yң9vl' Im 2:FujUXU>*!ZR~NI IAȚ*y~&7HaD@pA Zd*1pCYkH#[xYVr؃_QVG b4,R1YXmh8k K6iiaMkh\YNvJZuCLɇKDO)з! bzaʽ.}Ψy3?0T\J6 ܍B9\-ě0/n3,)PfX' Sŵ=)t@­uoZ$>*M&˰vs|kqCRYkYx?ۓ$VqY1}mQlZ:F֘ay ?) &OBcToO[F?BB-wp" 4a@3bۺ9n[z_]&]<ŴR+<f!QծNkH'?F#~_%P_)4^@=Ll[@3m\;t>7 bh@mLf\szV,#bW|[iM?*[ `Oʗ*1q%{K "aŘ튆eO3aj zڍ|G~pC֕Z_Bp},ҞKsoaL+LШv4za)tAe(p45%'!;+᭓S&,D4't|>- ~@BܢV:L[V]|(hE-=,-mЩ.=. XHnǂH+=3? . HvKvS:0pBJrd'5+8H^r`Z1#㜲.֟b gboI:v} ǥd 0g>$ W/o@߀)-lƚ?Yx'#>ᦟ$Wݱ:j%D, F ]lY 3V E\ۏ~K9y[ԋ;(lkCBj$)\7Tω{"(yVvF3YnT+?Q47#?zNVrݕaM w7v= -iY+q?^*ȏvѶ:CYj~WftHEmH T̛AKo; /?/~뉞Wj+!UXGCx؛dgcK5KD5йv#6c-l8*Y2i=PF[3K\̫ V-TR[^EM=Q7"َ+ch%)3z WU8 9ź=$|b1M_~*뵘# g:BYzl/@$8>BB`4ѨIq@V:Bvr}l\G#KFL,:S65ӋKAߤ KɛU29I+:2#xҴcK2Fԑ(8@׬q o &Jip\WܰQ aUMn|EP A 3%(scz;>e#*"@Y:lr1k!F| + #At7+c匱Rhܽx|YY"}PW&wD&sVKQC4G |Db ܍Rf²Iyh>Ȋ%#O1QiR'(sVCF#Ye裬Klj[O qƫ1|l~btGޖz-鉺i'⮟'Y9 °;x ujg^~^J%.v'>*eVڬd e 4sl`h~^ 6cfjPFqg{i@7i/Uh9^3&w{⤘L"q +&6p4#9>ن0PQڤ˦A jdɁDSNx>mu%2JȪ>f~[d#E(ć6 qQ?X2i〉# Vtf,9 g=,.$2dmx*ar68ɠEfGhD9 ,jE/@'y-Z8IlQ"4XxAe26*[Ce%M5Ɉ5V[5ԌQI\ԫ C,WIi ?O9j-c& У;s;tlM4k_μ1sZeviY P0H\8 &ڥF:«J*Șb۰!|.m ڂ&]GCAIQ(`a_Zͩ af_hgkj.Sx9(N)ו!k6?!}U{c߻}j4Ƿ_ˎ>c 7kߋKuw\Cޔr ĬwfVښAK *gѕNc'Īrdb7l$l KCt؂{@}=,%HPY.͓sI%J:~2ɳWl10OF0u*\"̀Z]?u- : &b x }BDx uS PBB-!+b'#wT9 2r'u3\_"z"<] udu#gxnٺd4,>h [U{;̨ {1d^K³+# 쓓>.z߫q]^x"4r0 ` h{k㇭^tC(io2O'k͆/Z E Vaj Tv14Ga܌Y-rKbe$*ރ]IS@UP;$PƼmVO?x=h;[-1j[XIsb )_׷IE*_N K!!-56=> qޟ6k~ߴH*A'Ƭ {ɪe}$8?{6Ҫѕx7_5[~/iF׸< [h#m+OFK$ /<{=bjy]a":%81] 1jPT-2 vwSh}4MMaҿ\5 L (î e~MiGh@'by,?X"]5 CL0 *оY#4?տȄR+}FPkCjK:}dtI,Ҳ f*ecG]Ymz~؍cDŽAUߩ O3y^:+#r}1uO>< LUw"^ƾp*M5f|"!LAg tOx!OUB !4 -^!Lc@1k_Vs:)74ci- u I-K5 ]E X3Z 5zAé{$fL|bOW\YF & `t{5Uy /\̘Ŧ}p0v vh۷b)U'e%&Raa&{"a3f4ube5 fA#baM1V]TՄW?8Xb!#'9:kI\X۟SV %)\!ЦH4G{|/Y_y|b9Ї0n=O?ÑiIK_e:O˜|+V "tѢB".Y6+3rkAc텃:a(J 5HSuԥ JE2 3,ԏ q>:OjjR8mlYźa(/jƛܰcKˊ|@3w8%G=bV\'RFa˼AVb'Ą0ShI@LXe4!n?ǟ*2Om$Pcl"s5'qkQRH,'n;cMB>M[U*.gWw!GSlIfD&[s9X5$>7{AZIʹ0<ѵ {R(U<[s):x/'Q}4 &^ ޜɼV=U Z?rFm G|bK4ĥeHX"iƶ"LBFևBONs^goN# 1j_6d@3WZFnT9ZK_(a .<ËҮǠ}Ċ ~ܵ$w3JG374‹v.N[vB80.{KLi=TYG.֟lTJpM?+>Yf"#tK5_f3fʣag y4HC 5WʨE}5TFM\C*p$M|uDxs Z@EDSsA-My>oiE{\sh¦:9xݦ*=)K⸳j[-eoκS˻1&vm!tq2p}f ME_fƪa}jVEG(t{JhIiQi!em8 LѭO[2ŖI%K[̊|5d)RI-2<>D}k էr^bd'M- _>Ct>[CdVtvj]/6XD_\qz]ɖrΏfIq磄8Fs–{Bm`H7-P!gVSٺP贇`3{XWuZ(IT7ksWJfKpFjr!ewʔ)l@gOPr'ΊJΓfPUXjWLI'X RNP%+uIT\xPJC㒂bY*\{XAx]hW,?gVFl5 =X}mŘvض{$i 2O" ĨwF:OsvMHC E3YZZžIR[*r %Q4`5:lBGNPs>=3@ʃ<NxU@{dN9Kw᥯mG^9.78ƕ6$mǚ/9+ qRp|:VـOp{П[p,hT]&ǜ9r{3*1Z/9aYEUkM̀t?3,$8/ ?iV\qxѠB\b^7 qMˀq$-voßip8:۫oƖw2: Ʉ6'#Բ BY*/])ŐY6f0`HTH܇].IVs"ȘU5G.ZINz` $ RX$|z!v)e+b] qZ`"k1wgW0[J']±6 Fp}sbj)om<^~$BU~Xt'A?+>_QH&[ˀ Yl)t:ZU(LbvʊO\Ga(Јsj_6򂬴"3eҌ92ILl6R#A@@0u;b΍`ɠC sySBVDye3ףG1r  k.4m%Նo$_&a۱?yPH$ j9wWh͍~."=$oL.v~-lF+ -N̻# C }ˋdb79v\6-_2k*@Ѧad7KN6%V&?pI9wyL@;O/0u[׆9*X^H*Extanr~[yn^ z,v;ޤZ+k{{j hCBo:Whb\Ju38~5}bab~Ρ4`_ݶ'Ȉfk\,b[eZ/{J+I84ɋf Oj#b肖=7šl?D)?Ae.ߩ7H_j0ۀޤh[& #ru~$91Y_S7.+Jq;sWyYP3l*I/NF ko&Z=&F7wK5 Нxc`5w?&z-1wC|'|M+ÛA7PMxqCip4/jXAVL:P,h5]fy5R[GHv^ʼnxIQ|^J@3S}fN\$ao@q.(H'M3yxg>TEˀo=suƢ"БuNqDƟJ2^.NqmVD lt Hv6E5ą;=!/4M9>W2\`y^5N1I[fӍ\J+J,&°tK DBrVfEsS@$Fk[j|<!8\^\r_]gf*KY୮DIy~Ѱ[\W )bN %0.Nje\CS[f#$}ڭzQYuilE{:Iρ3dd#^J16zv?BT0R=3} T.D%[ Jhm"`g=ws9'yJ=Z ZFJ n_:5E,PGaev~ Iw(N]3'byY@ cF!@X(pNcz0&o+=a 1$KYo<~Aְ{ۿmڅ;&4q,WAE"{N翴[\ĵ.[@E,c- #p6Mj^n)j]KYUR^byWPW?WƢЄq4G <;V4>JOU9z)Ws7Cȳ,70L*ʂ=Z4#e3lKUu}R )eH DƟ@vs>t.>|Egz@ wٷ;zKy> dl0ŭ>ŭ`wM( R`Ix0Ub \^%X`}xlLxH>"i^}/NUNM{JHK$KZzSɣܳl}5۪G~^U\P4gUsC*og歙lo9Juoz茋]kUZ{veRAkiWRF?̕-pᏋդf9:¸|nn1?q p3om'Q-m~t*~b[ ;zp(հ9CziX&{˪jEZᕒ:TS/nS}>97a)*er&v߶K$z *$@{SloؙHZ)}/mf|k@k' M2z!~wChU0/K8qrpWfN 59 :,X (vJ`Q2Yx^70V*RU'k?+lض%/"NDpuM&lt3ifs$`} dw7n>QYCa`{mLJ8[9w@ozIߞ8` 2r܂6Y`3n)5 ƨ`XUx;֡SAN9)<-G"V*㶩Ƀ[fzD_:ahI4Hc݂0>8KӑA\DX-`+ y "'wŞb9\KsEH@5dMsQBFfl<[ӛa}le{M2O f~Ii䉚QV_ @TA8m"Ю cCNY|GHK2D3e4ƅR ~^H|Rݎ&KZ+n<1~jT,įb^@h}_в/2;3{/+V+B7ciH 6/ʲ< T+&<MZW^ NAS]e tdY͛\A g#I2%A3Rԣ PzH6~?M' ~pi RSt2!#].N5eyas%r-Zo~H+~i0l"F;(qͤ YxR!J|KAhu uQ|&:2SBqY oѺ㋨؄e/25IkJQhFG a("PEPT.ۍlUU76 ٗsYg8TcW?'si]% m5'8MaCF!gڞ 2 x2UE8e("r-8d!\ނv>!y|KMݡڻͳV&fBCW] ]aNh`Ψ91/#w[EF&Q#ٙG~vL{ȝMI%*F}5!%EPВg\ykzq /tL` /օxj+:U_Odʞit)LZ;V'~,Ύ)H35F=c] USV[TNm]jZڕp<:(Tw\2+8\U) LT1!,:ddW3C*҆L?i4yPM/0.~o1]yit^Ԋrt lfPP ouVu-NJ(M̫GqTDžEv ^KLDEy[USTuC-C-?VJE9(C1"E[{^C'4ZE5DՄXDj Rڼ# }4'XK# 9S8)}Dp7^qY̞63։V/_dQ*Tߧ6pAhO 4v.?4 8h*mk2b%R!BX\[s6_scf@a>1KjEuZg k?Rmf:)@hM7t6!r ?A\{j^˂M< j#~97<^y͓W Y=" B{ x8,?QG@3'\4^N0'urAf96e%n2İ3ABrǭ>dQGa|#Mۍm3M0w[ bX?'[e lD(fcZ\k`{IIHb; cB(FqdF- ZJJt;7@Aҝ\'q#9nX"7|gy_2:{/9Ŋa> ꇉ螪"<8rw8t` U"n+kֲ8,e>6n l-Z} ĉS 2ɟ_E}ϟ{5Zu?0Z͝῕#RT u D¸hMqqJdrVQOxdns-y";nӴͽ[q3㸏OAX` oS8MT&^ǓvL2Qgh rg.gڣXb1 I?gȼ,цOɫ^ ωu)Wb ts$w?ߊbjVMZxk`ŨWk0א :W7WAKҙmda0y]zRZo?#Tw>LUb Gnr~F,?>o,kv6㣤a @f2>j:|&flF+E-yV4'~r,^2!+BJ9Kj7jhS̒қ5iX9t|V5mvV4X]mƞc iMq vB!A:3rԝ\i(Mm*1+¬zr8% 6*_eY+g}+L_K%'|KJ$!Ll/lP[cSPƊk}߬E2}THY7Zɱ*&IQ7S[s$$J$%(bCJ*z#I@4 ~詵'E|Wߐ-{drm~9\> <򰻆qQJ%M^ɹK2K&cn.f4p.WRdqVUtEe=.tSr80ټM| ,xOG87Gķl n 16XQQ|5r:]2U˥ڌ:/  95&փmJ$$B.T+M؂NʈC?OHi)N^~YU=t~W""zB3"T∨dN^*sH51!č`zg58R#?dȏ^۾h#bkjφcmނ%(x }xo R&nJb,JSOw_'%TT*1LT1hdsKGV{\ZmS|˦/j=;b{㉝/U: wj9uLٸtlW\.E[_ȑT{rSM¸RN0Ϩr?<`ws*/Q'g>>89JeReY{Mĝ5#01Vf4XɇqiDE%C.==l3m#2P%jҞ)9˕~  {؋!aZՅD fsx4B.{ =u |qD!#%qSmV7N/hhU\AFP;̍/[29Qxs/%|B:Ieqˌ˦UBҋ*dtgzێ6M0OFYFqSNmC$hDNLx,l Rce:N N|BLg*J!|09cH<]1*uS$)5$#Ղo<: VlO$3vYMÅoam io5`.REYӣ<ߣN tg+hbk>ʛj'd|AxWZb+#I ݵ1řW_nJCeՙ^_/7"ܼVI!EpNVyDJΛ//bT~co &LIEVrLy̋OHu+t̖ x1Uq ;GK>q)B\qH"=3.eH͐ݛ$`}ؙ^|HLĨ*\ ;[u8JI6HW\ 9ra&B.l2 q|.11!StaLGwSpjZءPf/Am5Ʃ3Yꊦ RuurJDUգ~~AK#[@&U6f"-w /*8k%ɍkO<{Vk)?J43 ǻ}T儜c\k欩1]$M2B&XH2$Ķ/Qʦ"`3lHٌ3=ǚlV>jYW+/T؜$@INIt n|vSr 3 `'"%vX rֺ*-$^GM)m wy'lnIVl&-Xlҏ "%>ZZ]|xo/Frߑc%9$'ΖZbՌeA٬85I {%GU3de{)i _^op5|NĆK8('Af},id&*0GXdS\(hf CN =>5ūwj%0 |֟hZ{Crh5!HԂڋ0:2nr%E7~Sy)gς8z:3en&T(x8GvՎ G@.34ӦImp:g1WO5* #ywO Be|ā庲N_D9`]RlK>o3+uzS1>QV"z+qt$1\)qhm\ !"8.D~?I+ ߂ub,^=V~˅'+x:#_ZA#+ 5.rbbT2V [4fe2Pfq:Fj >5l%K ^Gtw ~9JbS&2` [Vԩ|x9u;>(KpD>>Tc!YaXjx2#߷X LW҅) pzBsa9cPVcsEߦ.H]g}TO|jmHV33-B#s Ԑa2I([(8lgcUUZ2缇M[[9dK8׷ wjξAڬ^4|cq=[nl6iK XM%{]H+a|^TC܍W@Qך6ljY46l==g˂_ :ڿkSIy9ay9ZcT#cv"jv "kֿz|v(} ]C'$}^quƽ*ܰ 0^Sϝbn%Xӱ?ƶV_.2P9"ǿA;^^ўR^jɓ-Q+D>e=B9zx /,ue4{Wm0>7nR,'P6%.6pvytGhOH|yiw2.)OHP^r|3`M]z`O<׈DpN7UC3+@LUFB=j7_W;̄e`2bo5R740&u:Ud}+^O|B(S<=;&,r {6GMiFѕ`o^uО{قԈZ?BY@d"@j e.P%cjF^ޯD7(dtf,9+l6E7,4 ه@I8]ۅo_X/EUs!?SOm=YLM'Pƈ%oIuۓ0.NHUb^ {帰 e,y`zhDO|-0~ƽy/W@|,NJKZnlwsfb^'ڷlǥS8^w9/_V., @k^wGthOcZ=ۮvҨ~ilV1߅`*Ox1v|`1_ ND Qd]2;첤skk EtqϬP~F֨D &śn S ͫ0;VѦLr˄ozͮ!탑fR|U@6cGv)Xz#i2FJc;(~e1TQ .94#ALQ&;?gĴƦ_Zſ#^Uotuo疇~/TswᬥECt<nPO]5̞櫚)*׎I^nl/zksDs|3c t0w# C @7R co" ;F{ Z?6dH0(Z z1R㱞wCx eiHH_c/"w2UYYV's`= Sj*yܸ_ e/ FK/Zn,_YYq9N$=Xhn*}⩑g mch{Dx`m<̊I萏Ov 1@KFYm4bM#NĺZT甍ڈą^)4R'A=S =O!3 Y2ml֔KBG* QGI={ P2O8s$&ry]otBP|Dmj4lA\h9 bUiٜ}sm *@dYHw@}hTr2!bH.NpOOκ+ȷcj֪xYvEZ,J]Ħͷ;-4YUJkRԭG!e:P/-.K܎38l{6$z%١ޞ&* "!=EүXkvA36uLbrr˕:mRrh K!W;DK=Sa92 _t4ȡvEZTNXŬ Kʚ#԰]bv߻Lat?t TAPE4' nȡ p5 ޕX;1n >,H|!kQMg jm nl-pSo ||l$j!UcTo M'hƀ?hZHC4#isNl_ T5g'hu 9q%JD&Ey(B*V`CzMy9|nuc<) &k8S@ v?$ 55j 8Akl" ".NqҋrvL\\ ?'ɍk)Eb' T2X3"r,-}KqnȧI_UɴS@t͗~Snu`i1v4 !u|IlC+ہ=2GX裑{R(Hkw YF:A7yB(-uh0^ҘH"'Bu˳ z#7>ez8-h"#RIC^t9Q)fbUƒHjΨ u" |VW7Y`dbM:'4Q1-[!f׀?JOG\3{s>Xvekdm:' ʸP25EdC;M$peRysC+yҭY6Ed~ѸΆj8N:`>qz/d?qbCatJXF3cY=ߍ@|1}( ́X!IיP5]ɎN\4?7fefȲ$Ö{pB ) GKcYt%AP&BfБIl.kBr<@Uύx սՐ:qʥ @ }4ܕS}V*O9[HDų-9Jea7RgVtX;[dNkﺫd9S$C%IF9g\@f\;#$IRxD2R3[Q*iMFNV|]׾R4@Tgn< BM}xE;%2Y؉!7sWmQgڻx7q$U览ѳ"G ]k Ӊ7B 8-N#VKb -A*)&؃f܎ ZCg 1`4gF=rr`pNʓ Vb=ʮ׹ɥEgH/\CC*@4fD֗ٮ:J U#vN=e"cr!ONP,eЈJ=87M {4߰Llaɖ ̢q pP5a\b[2N:.'j_d_aɝ>Q~eŷ1,9_J+bz8uRȱڹJ`Q{βXdtnLE_%ք ɮ֢{bBDk>vl@?[5շh,'-”3S56X(ȁ:,!rRנuR*F,T|F3LBQ &zXzKwL$5~Ye+q! ,>+ZKqV="eO=*UC}{~{iW{'#?лnͳuCñ 7lGlϋx8B9% hmf SJ݆@kxSN\jM^VT,埰`lE!Hvs *r2X%jK>ѿT*[awWր ݴL{uw|d$h{3x+7?ࣵuUH1:F*mю X>T#N6xfxL6Pfy9ACv:ԩ9 2]Ŋ7~JTa 0nS}<@@!Cjɢj8;[r,Ջ }I)7Y2z[*vX]}5&cU^05qCnO&;PCۢԇ%D#׈ܴR&֍~Jt4a]{l◜I-+NRX8סbH` jrµ2InZSpVۂ(&fuʵE^aHpӸ]LlG4t<hTyMK(i[ϱ.~:s:|7FiX~4CbK^HtKv#Nhm5k_/֣Ʌ+O I37/a:cwa T9^/VF?[6x.>f. zV}L\( Dџ1 7% ?M@Wl~cm|f?*m-^ J {}KznsY$PaǑES/H$@y$ :]IzQf/DlGl"$&P[|&_5dZ\﫥Yoˋ1#=ݛF`5ǻ@ɐGwKQcΨ&l؈6}M Yq/ ָ >foر!_f]h'VBkXIh)0XJc@x_&Cn_Z?)b%Otv?T Sq2?zd-RPDlYw<&5Y”}}jJNfJGc/m}b+Ibuh+f{5XkV7oְ ;4=Գ{jZ dM}Q o(;ӬڐDZצRQp_UhX|[D_%ٕw|kz\-"_5wgxaVw5`C1=mtRL/9Hp.浲(V,9V\kFFPKƔc|2@J!G ~фγ&H\ݏ)TqJDo:[Fzm-;p1] gOd &)H+Vav)۔>@4JnWhɫ"8 LMY,O_^IXӀ <`8Tf²ZzRۏ52tb4!{g4܊+IF3 zG⹸!~ OsˆrqHƢ_3CB0?a5ZATcl.voԜ#KyEا,ɘm٣e%0;^NMrrk8F_tYjJk~:CWjM?N?Χ HQ\^B_Lfϳ"4]@?*d#JfV_y}b9*ydW֠ CX]@GΪ#z6~eO#1ԥd=;*؉ >%dȎf[A& *}#]cuH\Į-w|Ţ|UT)zyU[TQxxI?/-1H" 6IE SZE R2WmZf,8of<6#τ YiHk J83uҀ,qGTm6se+T_嫝GF;`$6jzzfw 7#yn"޴7aH}ĬS8//Ƀal+8TIDœW5*sfud4px5V+w:*ۿT\{_ v} ~&/]GS N;O-c[l}aJ Dx>fmtf⹘uw\0"D76K$E3}+MBDVۅa4|?q} }LD!Se=Kd-Zƹ ڲKyMr'i1 r-8 jd>fG {/"dyidK` T2Wx|b㋥7=4JG60נ&%YySmo:,[W7_ bdn}17ErJ~4g|Rp'տ&O.険P]f.cvU+GAX?G0vO@1)knG|rp .u8kb%b28f0PƪShW\[3K E ʍ}t:f#aEC)k,JtD+ugr}^H&c$eNeX 9._#+GeIP-C07/3}]応HwU?QR^'X+md&ms#>7O%1dG5eTǦT{cݬlNb!_~aJ>r{vRs+uq.j>׫" w<Z<#Ԗ-sY [o_IiHvԸulbq)[ph_$¾xCuTXK` ǥH'1@GhW(tۍ1d=O@д HRa/]Cszfvu5!2.U:TXcV.H7>%`GeDP1ʛ& )D6q'vrmb| 26J.P jT>XH*Hzz5:Ҫwy= {S/Ӈ0 dbpha29io AwU֛ aᣐ߆f~D}]eG)hIqM8Q7A<}+*f3n~%nBou !Εc#$&tǓ}Փ ֝se^&1a%qmͶQ{}i>*=v8ZF4 )QE2Bhx<"E0(+|=оlY_e8@|҂4G"<smx Wx;r:橐Om~ NFĔ+<~{LEagiE@pz(#b1w#Cv?FQu\9Q?A$ #/%cEXCdVȇQl\I&oî- Jظ6@$/NY/=a#I%j N1smhBKR2HKT4Io۵[$9V6 Կ m(,O^seLpL##AUţg1#zAu rЄ2iW1%^)̀gjKMǺDd'}D\bSgg"ufhn^9C'W<K}/aV]pڣ[y]Ӌ'au|[)V9_ ;m/'38XaM@|\avMSE*cEosĸ\ߗ[(/Ր5'2( D`)ʿMs;A{/8}1*Q)l[X,IX`0mUt'j}I@ #3UDه7DPm^M[èV,叝=&`L[Ljn:>~G''٣o~әZ]ku:CEO(\f4΍OVahW%O"#_w#m|owҮ^p"8Sظ3㏸54EK\sȡx\S9BFPHPʌMT&B`rZ@퍂D+7VNwR\,\qqTŕؖ 2T>w*`@^mǃO嬝w?="wmMQOk\z p$_}VkݵEOtx ,gY  H9ڑRmu3+!a&2V^h^#mPQ1B-uKXmߦ[+nb]ʹH.wnM@yc[W61wߒՂ o3oގ5p*xP8"1Pc1P` jhY9_):B?\@mN܎ϫWv(h#dMx\'fzm  'Ty º>`j*gOz, Ǩ ̌iwq˄@ y K݆/9uoa[Ub-a)sZfj17chGB5 xCS ¿ clVlC/v`XB5&ZFv~ 8VPqQ-TYJfF"BkM*h$@Tk?wFil$ӇLlMZ_{pn7rZMy .%?ӕ p䯓\d-2&g+I`?Qo!qy9`5 i¢PCwS1|9 9 7W5""X#:cV''qgZhLGGɨx0?j46dDv)IE:8d\88Xfgu9~9Ide%K1&Yj9P|, XD(=_[:1sb0rzc[de !h/'g$6CC IFCo1xp ޜZŚ)EGju!O^bHM T: W3mѬ(XPV.Ae@g+·m5Oy5k|6NϭNoX\K07T/Z 1-v&ΤIu](Y~kŭL'̵!9.|{z=1t9x)56ё$ m+[l~К$@@r=_2}ϽQO|j? G9>KX$~$给UFujHO"G2A81fdd F1=G>j f_)qPd1n3C?z?2 ==xkP5 qҩRnճWiꘅѳ۩0&/Z<R-K`.!4HzEOm=Hz; B-;vbMSc(pǽW: (k395^EyΑgD"!σjn'5@Iwvo{ϯATxsH#ͶTs_pn%xz5Gc5ɥ-MRG%Y,髦B5JAX>9q}'$mEm>fwQ`7٥G#N! S$_v1w 2/_"A /I͟IK<  8AO9p!޼@b2̍>֦t GlŚ뙙nX1 yFkqUȧJӮ)=u"K>lAKÕ>Fe!/&YNr5" ؓk:wdegzI7 gC LNgoɺF;v&|hmf+;3D7\>Wı~td,Pj  jk[ ev46gytO"[KJKe”)n|rУC-Vr=[A0hiOo{ʈW]1,XDuhZrs5Lt9 Hj04xS&tw'/G-mTQT >G7xW ן2 u{g3!maY&ʫե'lμMͻv̟po/ `.\eg3$I~]JjYH2I3دlIw{ y%#c9\t!;J[.U &B ˫y{!Lxrr*CLIG`(tR,)_Us@O'exPkOwܔ)qw.V)5=7`yl'"'bkzSŕ&KS062~J_ )K^dz٪BLȎ6-Ȩ%jjeQ+Ӿ]v:eKssuջE`g*u:n.hhD9`#hL/.1;I5-p]ol##ymà TN e]/^;. 1մ <8 d Kff]m/m ) 1И Mo SeSr~ʜ%C Kp+Vz5~+7՝G#.X=);|oI#B/=*TgcF6c%_(L2_W! ~h{WӤЭ#@%oR@ n\˪9Y3n BR0c,:1{Pe*N{d-m$ cB@7:P<\:& 7}#yČ2Wܦ5 -Ҩ>9M:ItL(~)IAyVN$/{N;`ԌyU jFI6D2@( 'gB]x")UP/Q)01^?` s6+~ ĭ. -r_uPaO*-TkזhG\S!":Tx dIq;9qOv=VD%PVHe ą$#Ӗ#|p-5>,qWSq͇u cvE Z"~|i0+t6Kb.{oS4[Gx_2e$L4x&ኧԜF4|n/0;h<Ҭʯt݌!Eif)ClQvWuH>U6a\LZخs}pé-B ]v?%#n Dxb̛\! L%,;7p󘯈Zpјs,Cy,1p=%\Z#jDzʒnVd/mZ}iGkR삤{4yy!9%j$;SՋ#A%Vr(֤$>'?<'. N$bi/2&_HO>=bܲ;,객eBu>45<4S}ULXM^ nJImʩ, ?6Uưn@qK<-,*$95$%-2 5iPn%K1K|!Veqs(Y)XO8VI;R>bTPB]%/vxJ"Q5+M 2ĊD2Cpg@nĸozXWY䒽0! ƐȾ)% ?G6jQYx}] ݚx3m2l 7Y9.{4~۹?%ǖϊôse%GFbR̾*9׈bjU@E%`|cg+!JR7uСUAxI,PvmVZ"u4k2?YNd_ DS'9U3-u樴i/ /1VƝ+v*NG1&{/ewD#H^)?`Qى$p8MPIae;zvB܉ A pCcVxʈ0˜H?J/Ro>;,]\@KO-[ѹx$>z7Vy?N .:(Ȫ?%l2WȠ)hf_Hc;.VDqt[fYu g R+OLLjBsħ0k2}`̲48l,v W`5Ri@p\'h4׺&}0#~05螚7za}gAESчǰLΞu̫.Lo t~/|d&4kdN P-*!AfksV}|; - O"huK8N+?adc`[Pt{c%T?o&M#hgi @b2o;>C-_T7}# vL*7GPKY oQ7N=krʻ;*pJ<)Q$;;_su$҄$z5% Og~h6 G2Kb۸D(2:$0LQ R9!(Kk“"B|)4uj$ă.6& <͏*Ju@˿ws(f; .Gm][0-vAy 7`wy: M\ъMcd=j%Oÿ0Ō ERf;U0vwF7LeC1UB jπSTN-nlA P6bMva /!p|\,0 9 o\˫T/ %U_[Vm{f5/;`d gD?R?O÷ž&}Sy0؎,bԠo:I@s'/]ƺ p4׻Kg#4#`ʔ.(;&WPY&hIlm #p$--죎;:҉D-`dP`dW#31| "%ksA4Z,|~{'jkuZ 7) ;5+zeWW`l9g\]JB!L]]Fm>>lQ'm uM!,R;K'GPݱLp`Zg1Ffv3Zju(VF>]v?BqjZN1|*?A'?a @p0.9YJыx( wř<)s<>Rt^AZd\!dPR .Ր֪!h74$y;+ꛟ}\OۈͿ J>7E4RżjU@;cO5 'ݕ`p55bwP=q5O1VE0b'ۂ4vN}k9!pXd(&Ȥj_/xjmIG] 3i^‘B٦b8*W̢>+h d"V,_9@yrPzpFhkcHU4ަkvp4\/fvcs>14֐^fKŦx2ֺɌJ٫<oO)"/D.]Mz 5ߌ1 b ?Qc=v=&ͤ@Oi[en~kF rǃإ=n€k2ਥV$IOV;SZ!vi4g:H `gJOe>^kGIm>ތO2'%8lԎwg1覡`u|UGY#8 :,bSJ-ͮP#Ndd=>1v/Eb Kcy0nxY?y"^@{AElAsїHU4dBPX˴ɁXM?5U8A ʗH?4؃ ܪsC0&qf/}j׻1_hHQQ#/ po/BwFw!P=7$mXGL/yǔZՠnP!@&:R9йGkHxĖX0 -N5|>X:R1q d1oUڂa alWZ9L]&[*+eO96fdChO|+fs] 턠O:>Zv{5m/xJ' z$)zn h`X~Ibҽkm f2}05gc@ 6<=* ^mJHC㵬*'avRK)U#{;%샷c ?hldaEM $}+#>̄qk{j传.Xfa EXw_nut$ovGn$k`gGi擿ۑ.Xd~>|{FH- :h9^: Myz8\8`=\bW*N VC.RlwFO{9{%S(]tS~RD{i>ex=7Z⦸F!7m!(%NCbD,#,'[<'SʻUOt?v}:YgmN=ʊJml4x(6pLx=3ɂ'>*J _]aTHZa{G~%a,pVlZRlxϧ_b[ /9% X^ʯoe@W ')EX0!ޔ9+MYx}aHc>th%"]c aHH#]?᫲ЬU.${|>aF؆V%d䭷*>)e&mD7d]>=~PZѵ UH@UՊc3^cip/JB2cr RԭS9ܓ*Z ~RIbU&f2[%|)>}❍eVOʓ acWp+L|5pv(raFKӁY SWE|3xH-^.Ƴ||Au8t׵x;x33 ^ZE0@\?- B\O2ukFp"kx< #dc`PѢ^&o˔= qK/5YñƟRo{)F6GD}:+&5ɩ9ox$5:[QϘAO\oc}TrR'ؤ f$զC/$D4vߓOc&zy[V9OB2~.2%:!AĒ ܕ?N q oąlgW#6PS"dz5/Z\"sC Blsf#fw;ыHo9GXlm_ 9=,챗7u-xtT2MXH؋1r]N43V%%~BkT` kMsYgEۍ0% LB3'ۏ!@ӾԦCS2N<`a H6kJ`UiJG}P7[=Ao3}|fe\9b T뫠qZloA zE `qC35s3UY)`Q}[5^ަ(tm#hYJ_MȤZh1%c׃]3C&ۼLn3s߭3܇_;F2ʶd?NHGYgp2 J w<пI= q%v*@#qd!C)^ty~斌>OLf#vI0{S%F,TWޑgI@eXzQ{^qc/{iֿ~p'WTTIoA\݌ΩY9Q߄,(SQ,i7)٬ėy݂383GY%3w{kˮXx-V hebymWJ,8[.)zFAqVvQg?HY 8{8좾=|ܢڒ;uDۛ7aM ct~|58IEbX\X)qt.7YraLi,}[f醾bABָ٧F0R/~ a}ʧu*ے ,7ڟy;#~YBq]2ϵ|szI`K.o@}#:7E0PDHq&ǗKsmɆ?ܣ /%Ȭk :N;r}g1ԴQeTհUKny=Ui*_\WsJGBhWvSb_+tiJET[o8R4hoxyHtf":׳gϭY4)J?]N ]=t9"zx$xfc)s~)󕷖 c$G_et̻IzgqhGvd$( D}U;>:iJyl0z[N43uq䆇rI`dH%8'Qcg|Y8Iy٩Og ]?}"f%wٵ ?sS/,s((iyΝka"f<8\nKm_ tq?Wd'YR؇36 "|^|C+e8~m=bHI_Xl'Kj'`=c~{IO0v4D ۲ eR˧[`hVs|'..j!ԭ'ks[Ns=:>0\ jJB%,xdutFޛ Lk[&?3R: 2>Ww|(H:9HT6fS+!9(QNG"ÎLA7I0hBt[gMwl4A靌s.iA }"'~pvpt< C?k[,19*K9nz3)B_X9Zw_u%Ri̇Y_E#1$i"+d7܇(`y K+%%+> @nxc|!+պTBT9׊N$^EzǤnA!Wϳ Zh蕙WY+$V'ah IW@:,%w:wBymI\VUѯЉrrg[9~wWn5'*n|қiR<ϧѿ{$VqĈ]9AtwHPli1J 41g@$;03bBWPچ>{8u Wח74-SGE=./Z)< =cQZ\&ƹ\ưze KcPsbbnWFHŮl~{ _9]ʼgNB1 Vv*q )Ϗ?m2sȥV]jceR/Whї)Un<*~殥l)^t%j6/mS(`1|[3/,VP gd?;k~9Y}M!$E)P{~ #Foa 7-TMO7pDsEH ;%d#?$Pq :͟=qPVQlbFdGڶy!VKhhVzȪLPY7 F0Eun+HMNR\dpԄ 9.u5䕒 K 26Bԣ71&&aRa̽|&j9 b\+FL5Q5itRYypAMJǬz!Dތo Ю#^noN1Nn܋"髪mBbKhP$9y1T  [Dai^_<)0rhQyD=}N&$C,{Ia_WQ[k= pIM/X i#u^dU( ~܄kʌ~Ts 8xN^_F;tc3 ͻq72!> -9ݠFT),[}!qu5@,ݱ(}XzDWw 𹅡/ Q68~~Iv9U03L/ÞiU_̕*50\7"+=ރөXȇJs1&=/=JjL{)-k[;nDN,L8)I~*d+'+q*l&)pr05L6l;[X 6gbEеǒ2 wu8طPD^۳ Sbl|x5?[Èoe;?r}*6+Z@ I`S(H@aͫRICÓ&+Mjq>5"v?Vnq預 JoD{K؛Zё`LrhA5X=/>+Κ/bCE$۽vxGztT2a !׏2tm b3cr%/aBsˋ7͘L9 ruz#l5T4$,VT"*Ll4Fzf Q(nce"~xUD(VPެ+Uu_lU8zdpZ~{SYOT,濓GnECR{@鄬a r|˼O2DZ.h7DD :(p`ۆ o(tsķ0$P7ibbG`( L4slZxȊA=Wڎb*!LhG*0X5z@Uw} !'7|#*ÔP FyB0z 2>$-u,G?k0#B2q kwG|t,46,cׁF{~_>)nMUTĸڰZ!g#%si+#8|+06 N 3VpQ߫O>b8jK1[{Q> ϧl B47h?8В9v0I~"75Gf7P| 9j0L?(@ۍ;eew^1ugQ@smBZ 7˰C,mHo|ꑱ[ { iv]\2SzY Â+eXeRM".zJTؾ8JsYnS'Z_w69Y0@)y]wP:Gw頉}8RW."o-ff)b!AL:+g` \=aZBB( Љe Ӈ_ʖ~Ebz^PC- Hs(^0=E;B 7cb3v[/ޔq;GEmqգ@'P M-,?c@^X|aҢP;ZQnssE<@2t2ļ"gp@rAea$nb13XIi,uaKL _qy:O1 #9pRRXKxZmKٿu纶{XsP q%23 1;)@0~t) ivJV>MtpiK}8o,a?PFhO%HِP ꒂ~q&/t~E^iSf./Du&5h+pnSNvG$)p@>3]J:~e:|B_CPe<:̩o{$NVKPX#QY F75,*)#6eL= V27i1|x[f h-rMz Zbԝ6yE) ֐s/B ϼnVЇ]jj^ < I pUa`i]5H!.Gc5S˯דT.pXpW9jeZ _^Tl梴e;ԗ$8L4ޟ ? p0Fʞ# m(ǜhiJ}guh`7 )KJ`NFcZ@l#$턗y4a 1>q9v؁Ï_)_(8+[? M=YrX;3@?H9oyK6 H8BH}Mߠ Hagєp\/}$A,y<{}jn1.Z57agLRBq |?*N\Rux O;Jno7P9ȶ?K39crȼGltio)sҦՈZ/t?W>)bŕ,2: p(!|ahVZ%V.BrϾDK.eRp0]3!DGbod-̥I- D}fAϰq$OcPHny3 _b0[5/7LLi!V}95.adINLd3K 𥌌 E]<`ֆ')61oiF< ƺ]mbzA-'=(3r b)*4Y7$c`} =YlrWm3h%9}o)@ߔ9j3VX#qViK3dS9]d΄'EqQ:<|uPp)O:3<nZ; k/(Zc[K LOaLBOSSJ,OP[i??6/]4z'bug7p kϑ Z{|.G[n+ 2Jd.?]fv#/Su?ǁ!{Wym9VJe+LK?QGfOؽOB~et>[PꨟYO6ik4iQРYv5 T(]O)U҅۞( ͹7)g;d,8ԉ"ܯH]P*ࢾfR٬hݒ%q1{d焦FLpr]gbt`)Yw7hTNRFs z-ZdoU}"퇔'8RJ0Z:{Is/<jUwyD>x;aq!{Ty mTO#ڈ+ÆD[! E{Vgp eE *)8ƍw[p12/5֨{Cb9•͂E ̂x e̘{JF2*/VR܃fDZb)9TR XD[!Drd7!FF,ol( &TڄZfZ J>=zݼc@d]{j1TY;W xv/oq̀$}ZܩOEbN\¢tb6dJdVPuл 6ۇY'uf!ӦM7֑o@~*垗ijƟ}DӿqC:Jc@%O\k~hw酬d%j=Cd,QwSMu ̰95]s;-EѣHh xs15} )+CNUi?tOh?Ii'@ܣE o?S2쎗+FŌxjv+y}S'JpTO*kUo\'<2N O:ߵTx=  KkO֓C'U"(= b3AЄ^&wzx]Yb4C^s-xOPHr@>lZ-bHu4{*!>XjmH;<^:tt_'`K^粉6~v}u&+|+09jL(KZ&V-^ dSk[zP̱ۙ,)Y;jܬѮNG䇇$ ur*V%WT%Y}rB3 sX9gcԷ]XQ?I5т* CщZj}sdC"kä!,f(&{oԖ5tWŝa?;8>ȍgKP xRH9M6Ec1D}`pcŧi@q?z7@ܤbTɛ2S^#MbR$Bk+eDs{b'w{qz"OrWB֧l0U)fXܳc&ҤOWw>I٣©JfeG`V+߰9#>՝XlP'iPv;2.%bɅ~ ~ /9 inS)8r+;LCa =)`)!u˞tyEQ YjH[s<}KoߢP#d )hˁYQ5> vĉ$gZˇ|N-ufAz}M8VJq%UZ/NMظt~v N?̍M".H>Wr@.]+m>f.[D4ʻ=ޅ0 ;z4jcT7}OړfUa7HbW)57Vc5ɰQ_@*po/xGNi /*P~Y5԰R^W\Ta>N X SU=O דb+)%+ˤ,( he/5D"2rq >xI 2c;~%Ͽ;4 MjhI;ha.>hX!GI#^z'djMV:P1(zBuiBaUѐ=y҄#oZ0hJWo6u8ɪހPF?P2褮ue'찡MKA:p>-q2ڣ6q)32q"je{@XAߦ_q LDC#esjI9e(O Xa_$'l[#١7o!A3Z%E+3Qj !u8W5$bSǖ%Eq~`}zgs &*<dnFz; jh,ھ= ?$:ɉ9hǽshw?„^E޾ct'S{Pn'~%.7ErWB GcVn:H89۝bhŌ̺/0=RasOx+t@DSaBEqvsI)Av{]iqXW :hcY?x=0~'̠+B-#Cq2kAwpN vͿo,1Sj@dҮٟދ 8qedH-(xZ.&6KCW@3ׅO CFI$n /dΰ3 X.*ȓ;usO,m چS:@א 4v&Ptk;Ŵqò. G)yPwhy5 HK& MI@$.ĤtҲWq-"/s]ix5Tm-ʁP#Fu!AwMDSv O<^`>El؈#Nmn `]Xqo\Y?xWko;>:*R\bT0^M"j|F 0-؞wm,826+P nݬE$Ԋ4N9z4NZ,۹Y7VWKq*:VY6 " ,>R6qSπǤwg-\zیإBҩC(n:4m)Fz790?dJ 1x{X6k%2Zo33N` |hDkBkke<">*%hACa{ h|O,nSC).q<[^\ Ij2g+fS,LH$*P{<_\*N/,% @'Psr(T3!l 얣#j10U2 Rtf7a8==k!SF>eɪi(bbǢTdFY)3J4CO1,/tv95y8BjbW#rfWAE] ,f{${6ŸߺQq hw,O m)ENJi!ŮAls_`+qʡJ>cCBacׂ64x2obu钟6񊲆Ga5 W3coNP ǓEHa(i_;g/ϭ $Ae]Ans#FI{1c1]g aZt6m+^#+>ݼJB.) ToFo2M!}7cR.<~ȧ%@fWPcەQⱃayWg> 8(+U/NRx@03:վ`xًb Ռa-.ƂIg H-Hrrų rJ(-' &y]k-i489:Ī_߸,H&~j5o 6Gr"&xAYEd\%@ do{!WPB1izw5h8d_ٰ+)#L4ۗ8FT iu3]C-T k6P0JK&F]l@~j'm򸈤;Ӕh"m-ߢ͈Y{H!f|ou1[pqpؗe .>{~P 4$O `A 65w!Sز:i59YN슦q+>(sGU<򨌁ѵswQ؞]Y/I :r~|9 M">9wRyRn ^بݐ|wսFF.e($Hb^yt?GE\)3^#s?%Lɮ\cdPzhƦ]pOd4s|P+7^g 8 |U Ue‘GqLӳi T*IT'=o"N dNI.e]a=he1hRoH4tx,߽4M4{0"J}rv>0˄Pm|61f!P>2|nMީZ'OrpJ ݠ`z4km䧞@5^6nf3@,Y(322Gzn>`DgwI2@ꮰG7Jf[%`wVo}`;vsu(|i3A3[!ñVp %v@n{cC`W\@Yddy ?AMul;vKsF^HUQ''d#7S՞*5; ]4#7$A_Wjzj?GŠUBOXJU sީMٺW8hz!QHeD .u0 {6}ReDuŭd__u_a/d\[e}khp~d>m"UZr`Iil}3f*XŬ02)nN^2ku˛6Gd"-qٸDΥYިPL{%-{ޣpʫswTl}Ti3ǭ#K>eM yԏ,YB2oZ+$n$Ѓ* *9&^NY0\~8#"GĪ,sp'"cڧʚ;4q.=mvV#6́S`\v&2YX(/a\5Hޕ$EstIBM4St;~XGV7\C+'Plw}cv/CO^WY2bR'sy$"#ș3J /IRkB5i/#㐒'56ʒ7PN!ɶI򯢲߇3ӤI&@DQFU1 Q/#\>*ކZ+x=B/גTN@rߌ nJj] N͆k@otr+#pJPBYIJ`ʉ}hK'2PLsaFR@:' 3'ngi|=Na؞I$~%#Ʀ~=~>M=| C DZ\qs{FSo@(i=zdPV9ʻ/ Na u]DžĩddOY3`ȭEqǃ}vjʪ`a>/S~e:Xb9m(\̽ yN:̅5kkb DE(EyDe [_Gxϴ錙\z*P>+[퀔d_E2T~5h/^ H?djOUOSzv5= jJ3J.DhCB~kC_ZPqkwy#KnNi?C~;M#X n`p@N s5ʐsT/tP::*7Ԯ?_乳՝*$e@^%tQd@CQ=SPGZ`:!tWﷃņ 5>-ڭvRkK|`RD*5  |\tveI; D"-o0 bE]\;]n Co+v:C! ,O -1ұpCJ' . G 1{ϝ 5+0PrW l g1>" "4IPcx,n"*D~5)&CXv:caEK)?ZwǦʟwھ@U3#PAA #!8nc0P3Ƣe( Brꁏ9QB1hR}#U_}ͷ44_?|{CҺ 7)Xen _H4t]64|kpzw$}6Uh'uW3n~8޹A|gDxP6o!rpz`@XBNgtɼZ ђPMD{$Mz Jp*76iWHz]Jr߳ei[%W6U^Lt^W\c5jv="W!*Kn-b8eov :'d׮խ+MXuCTP)~? A+ b9h]{Z`Imr.K(ҒGP0I7MO2$J (>j qřLm(̾}e|>}1GemuF8H""ʡ6I 'kp *Yœjl G?Xqݍ/t+[C1]}5H4A:k3Ml&py*,t#GT=0>F:IPψ]懸#m-PA訍FW9߬*(4V+OmS lAeFa邉iQ:2- e; 8U]^%=8e( T2j{Yϣ{ɄpA.@c]1QgZ(BGN٥EWژ 0WeK0: nS*VSGPy @aQdg$h<=8*Zs<ϭJKH@q\VFrY^oON].ٳ4C|i_ D[4F¯]tX`Eq|tԧU/RsY@_+*taMYKlHX*"@uCl:<(CЇXU`1}a=I-Lػ`U|E{ {tL+iFSJ+1vWׁg-`)qRlv첅GL}9 T6IbG\C[~sN  J'3XY7ɣ+v8$ъ\$k-;[.W8zfNK*Z25JHeޥmdvA"*7{l-I2*4BB h!@YIsltw%7wh]Y^uS!/wX<wJ;5;%o-Ot;gP [iO|)ʀ>>G*N.9~Gd/>txm!"W"cM'pG >.UJ(uʧ:RxՎg4HLL)BvOy#3RnKSL]/i2߇F ?J 06ꋾ;g_=ck87L\,&nżASӫM\'9aM;ssUW:Vwzz0b9uU f}XrnB=tT19ǘd - YU^=O& wJ[8)^ %TuJ/2 hdלuHӑFfCM K|kO`S4!@h4 BOf+Ũ1#W2ƥ3_<6ٳ7ߏo+_DOZ*ojݘ7|kz('} !+ZD(yo9n!|ky°}9W(T\Scq9`X[yDXE|G>Ղ}iN8TҸ K]) *>ݚ0.5E`E_QIyQHhs ;*!4߽VpQ~l jB;" *>({D_Y7&Oue*`v.g"IcեM:GBrL?(N6b`GּwKok 2lk}tΫ*1n;x0%Vnt5lzcnWd;ʔn1ٜz*?a"iկ`pEPH77(}WuGrwo<;}.Strjyrp$ ʑ&D^btS+t+hr9$m~b&I:2hbf߈e DP:-Yc޶񉣝U+铃55>zP9{p]px#&mDaIbHgl1$%i^? Ǹ4!W{|&A)!<0J?9B  4M3Db'Tg iwrJiR Qzۺe%mwʂ_著֤#UlOf+kYu_-!?7=P'CH0:e6Faؠc<[O_eh9Wz \epBPd[{Nњ`/dvUAT`1'4.CS>Vm(vm5Dh_sKF©`i_bt7ݧ9::Ӈ) =wr5v%ܜ!LBՎ1D4R]O4Htc.}DȔeu,4UZ1J{ s34$zmIXmWקE*W[|YL%qcUCXI-P/vIRFCv, mE$H8ZyeKNEu` _A0'K|FP_PjMCoV%ǧ0ږ`4K>xoV{v_K7o6gKˌqS>#|0i"HqϚ"72:[Z\]C|_#ÅCr d˸= %F-ENp]˗$o(Ε`LNovmM~hS%]恞 7vXAXm } n[a)ɝZTIVgǖwFzc`yb]cGP$ihnK_XIJk?C.OskfB-2*_=  ~=Qڧ5~q.2G0W NOE2^YV#h,fУ//Xhu$vVdPɂꇃ`Wo)fxyb3A9s8џMig*B{a8SeK.rС)K=]#B@A@+YpoumP+FRs)Y&PT_L,*#;v{{x0.@G-N v Y;8r:P5N=₮.԰]^/xӊhʧ7|vM'̚p2{Mjav`}j҃L[MA "UFB+"%"[owrLJ'NJ NQN+=s9A2^<4(U PUt̰>W7zW4:ܸmpA}?Q>Уܯo9{:sYH'  6Y}$A}U"M} ؗ/*1 w ͒7B3YY[wֽ/tfD}UBַ45t%X xǼ+H)?K x"{%j˲К6^dMg$ v"3͵xP ~QUB-UDp3CV[N; VR, a'gd>a𼣹/"7WS5-O5y"j: ~,?$Ӹt !wChCk٢N.TxBT.ai_$}LV"c|Н.W$oX ,bgvg’Ƌ# Qմ WBYsޥYoW:vqgz?;}^Tv -] [L!| /H/KڞdS [?ۦ;|a$CI ŒL~Y̰h'IG* k^i벟#/'iÆ{yҖƪwŀٶ~yvanS1"X1uL1෦G'<v2L]V+n yt3l#I oD|8d@{pBEa媖9g&ש*my r~L mXZbx*=&^H R%dn-L'81FS0vX 5FI_wzhT Ej170}N_%D08Lt Ze2=M'bSE6it3`z9>h~}6 "q|XSC`NscyDXѧƵV YEg#6& Z:eH3;kֲK'A;7#H4OR:1)w ί 0aqvtbόivS^naoy)8݆杪ٌ-b%pWX:5o'!}u[.=Fpl0QZS ˣ|!&k/Jc#Wr^2QJ8~s1@"7~phyB%ͤqh \rAlY$API'C:L2or̫04 oQ-\F"l6e9)(QC_f xAx -7YEJZW+ninndoޥysX`DW;&! n1NÆlWTD]òJ?#2,6f~blotGI.P1}⯯`|7(B]qF3ջh"!XV$E j5qZD,Ǎl9` xޡD&}b@U8"W%IED+ Ɍb{amo{:m 9v{?SrE΅!RE<[YgPlemgn@B~)Xv_% XSHQN'~sAIxDuaw BݓzF'L!ό%l=[DȻ$U`Ike:eQg/Q84wT[Ay _N`ł&"ɩ~Id'^tz@$* d)4[]-Jm| ֚4IYXgA(٧Yy66 ےmL;ղ`uo"2#1-(oHl"7n<%1)ڋ]}NAϴCt|n{#s7x՝ f9r#V*}`Vr&fG1Fn݈hh[0+ጻ6ȸ/XN=g=vxb=*|PKy *';;89=3avĢNgF!LO[&'%+S?ql=n25{T*\ҊuWʟ lOg%&˭ye3f:b""ۂ!ʼZ{]&s ++m\Aon/K'MI'BGI&/\AFZgp:E>ŵ9?YT <0"鸙bvJI-Â+ t3nm"=a}5 j呚uKZEyř׆\yj ;59'~-e-H=5֚) c%ssP!XP(kmEeM&LBrehSmhMUZ%|BR 3$>$^cjp̥IGۖ!;lp"و|s2{ `lF@ s _tDln+wk MV#poX1x 3'0Kc4%UqhAe\[yӿkL2 X9 ^E '=QK0 5&!]@h0GMG+ju17 d0JӘ2R@@U:l}.q)<`zh1=k^ftCA-f\'4ɸ a1"-x0AAV}"|6xJrX#S">TX_ :#Kg"(U>UH7]I 'C@dyO#Hܹ,m!֟J5V߸wnMOv]g.quKZ#$hnޠN vH/Cc<Ck %R.v/=jЙ."qgX`2\`a>++;ea7Qp% CHզ'QP9%Mم~rɶɂI$UK)沍^)*MJ\F*iWz]V`%# @#f8o`6$ Am׷+E 쇣 mqk&k گ?:jc 0+Cwo 5Y$}Z^tU F؛Hllj+lҚYbXd:JȢaqJc0z9{Za.WwCɪZy'nğyb0O okDgpU?`b^&߉ʡ9ZmI?c|F8X%k+JgIȟe\~*,:ojuCh g=dmB5)$,Qް i\MlPT]^Uiϋk .SX;(I/{ N_/d-ڔfz7TVnU1,uo), lD~v5WqC4>,BP?J= <:LūA 4 u)r=tP a"5w}equImV/ߺ?78-OMg My㨮n<ݜZT{.RDfZ~ҹl A0b[:Ų7iDC-`鴪M?ȉ'ffW,b<2Un!NPSVi?nܱKJ{YHCU&߶Pz慢Z\!d(Ȫ/X"b4@4mJI[R(>yV_) 3+n#=7!TJfvmn=0&Id&׫)m!MJ:]sCq'f1{`@kj;vWH5iA; +o1&`VK Zή;EocR7eu2I*7n^ Ң,way !a7Ohywwt҄ k02<IW0"Qt {|V?'.#:S;#1x ])Aq*x2.:g_~)Ɉ҂u+0ֳMB\5WgP8ȹ0g:O25E:Nb!߸.K.RQmA~)VpeKk툉4yi7VNR^ܯ{^t`L:{agz`PՃ Wc Kc\!#Ĩf?!Z[ IhgZ:x$gI1O?Isk5IE$|x&}\c|Y@ݡ:EQ r0D(3jdh2Fe9k@_;7XdF*ՀOQz̐^kĘR{My nhf!ٟJF/gYy:F o .w.ChlN&`n͓gN97aN8fe@ѝ%V\p]y~~})3[Q, &A~VJJ`.)'Z9'y] ^D,Т.>~^{NN%~v]7L0VxY MeY{Rh7 OB -<B:w })tilfG#o^2A3FRѽjAFwzp*)Y١RhNܿbz7¤ ̤/aobxAt}%w^dJ0g*8! ]83vGKc{ *p2 XVxǴ?STu>#ell.r3R?~ee}xO3S5c{L+c䩉o &e5Qڋ%+ q='.=AhwElwc.]bÂV>j7 ICuz "xSO@H*:76ꉂls[0u)OJ&lG3햆sZ֧P:'8)GɄ\|EItWHp i|{$Kי V&aeCC ;Qj6Jw @ӟCu?;؅{߬;WGp eN/ !<3DwL b`^.ujli0CǪl1`D-?m t>.9 Ttr0]«YvtMhA+eM>1o}>8CbM"45DL"P'Wb(uk5r箱Q' TI2 VP9A$jR1 U\'`"V=avMDN^62w@NԄ?#.x:XDeV":j]_褋.]pӽ!N}^FD2:3;lªv%y+ V键9ˆ$"YM騻;nͼRfMN;O?="DW)!SdN=TQ$ECC 67i eqsZoV33ʒA\ [ɓ$fw3_40xx@/P0-qz@Us҂2r G *5 ]ZA[ U \IۣSՈmP*J[,,\( n-\D1qlvIȽJd"}? m~"z!з-Pѓ/tm;&UuYAܗd ݵ!3K?M71UJȹuJ(g6`OmȊc*o?[a@<&OF*;V<ƷgV'9;;w\ĥ޶c ~{MIBg9p:XÛ[Sh֞dkϬiK;e`4\;0&W-u F] SAJf`d:SUON[s=dNrx`٤zc%[D=X}7%Abteoϝ"ϴ-$[vƀf}oz~B v&kkD?@( (>(%F5!jK{sU-q/8,T`}˦{t&ԤnSz,6KTFmV4qW@K9p5 }?`X/ ߡmVP?[Sq x&cdc'uV,kkXB3r_@65uد rGە9>BɺKCO(7y k mcQZw" oIO@b׼,tmp.7y-˂%q oj[ಗbae^?PSq|ױ0KM Vo[hCRѴ, u\Yg0JvEL6Yp͟U~s Or)mק}8.ϒt{ƛshTVrȒ!y,ǀWcV omL(gK627KS"w~6 gA*3]ljO-5"9&bd72Kj)ڒzH-&E20:?\gC4r0{(XkĝuOO %5`d=X& %Wd`".mc W 6J:l1: Kp BcKU:S Y- כuO^O|Ys,U7alqj$JQ5U|=^X{@E'WM{D3\Nn#2$f=+SDNU'\" R4f}GZaХ~t62P[85nȓJ'Rfq".abeNK}\yUMJu|mߤO^}QWD'IhsG~z!XG<.Fd3QxmtJv6+~.-ʗQf{V@#9 fA _b#Ӽ:7)UD K<rgC@8$ET U.uT_Cd \W&UrS\M/:dқ>+MQY.(diKNزrrB =ơBQ-9ckZC9iFyZ\JmW_YW%Dl;`6K0]"XEJt)E)PgÅC/2e\y j<&z-{iCXv 6C@my\voY QV J~/3zb1JYRJ(jّuuR[ ?z'#y U;oiT2v/ǨB05Đ&l{ aڢAYJ({QAT?xEk7;ƫ=inxYǥ`MfnZ.Kyr7ŗܾwB%)$tMe)^i{rP%;0&p>|r{oQ" O[i-%Udd4=LFݼ??X9AAZumb~K2TuRPxr<f1֤YnhLXYQ* Ao~p[оz wqk7WgG쑛 ~4 GQvS.$}?WŕZvo1fE#!tuf^"aU{ҙלXZ-[im'Wy2'ҰՔHn{iBMF~;)͆[0q{cȲthմAH7왆|Ƀ<ݍIW<̅ա.t\~oy.?x;./*߉6 UV 4!u7o%|\\{\f 2^Dz: B|9_y#~InxtXDyr V b7+HwS-y'vnFm1s:Q5|m8k$Sbt 4NӺb Fx=@O'S̢ (3Z9k/}.nH?Jm5L fbȖ$;qCl"cDD s鲝9ſ{sG}ߩ:, LiQ')*/C4sNOuť~q;{Vԫm*bKPY}\9îcmKH~[^Ay,8)/ $;H҂?M;6_7zPnB[=;BpW+[7{z49z߬ ^EkG `ugg4L:!y#A˭bjVOBWWGe'q~t3ً\IFo RXPFFR\RVJF*ٍ-u C?jr:GϥrGz)I 욍F22NVfg'nF2h \Mn٩΃P#VWg{(2 " }jQ)!C8:tXx]8\F4Q]׼@+6L7pQt@SVR6'AOA ~k1uN^2h,8-"[9R6y zˤAL*NMӉ$ͭ),@j \i.c31O@\g`zQ<$d6}I.W/H#_J+լܰNEt-Z/ۧ7otfmUn&Av#Wf|trD[j#3VJ;(TZiI~6+<+ tKaK8ni<L 23peu:;B>|f#쏐]m "J{E|+c ߯^JĬ5TAp {nw_`UX>T6E9S-L[v f cdEز/d vX'-0G$ݱZ&8;+vq>2ŏ++ɿTS ƪ n<)MT}LQkTPOIA,#( .}xtd8 `$ͨgi?)SNR[?\۪|:0[~`^c׆<_pף]I-[@/qIuɕD_]ـZdm.eI'D V;Q$&Gcb1I>lBѕ%D98mC,͞H5I1TL<jrSqZǓ`/l i؄?>S:*@L樋J{DY ARx_5 FJ.v i #m0[ðR}0Ɠ8Y}2yIT#M2Fn31&i]+q!lk30 -l+Oo/YOڣYtϋ:vApC"7 SIoHDsn_9 2UBye_4[?ܩ.y#CP} G-ݺ41=!:YN14M7p X5fVΌ̻zH_6v:ϪT\3݌i!O%?p"M=[A:"#ґ%OX i\AApST{0,<^kR'z o *Y5xp C')p!FS1ղsRYb"^ߌd[u'rL+a-'İ ; DrO52Nhق}`^+>,lf 7I&74 p > dpQOJUSyrTQ'>i|DFI VMx*!:"WZ3G IYrβH 46ȇ) Rs!ז-9|NEd6%/rQ# D'ٙޕY@gq=Jqc wL.yC5u#114CBWRl;/@0ey\t9*]J.)$#/wڐ.q[fv 9(=ڈjRHzF)0Ha}RQfu &YOfD :^86֧pniѠew(K._@7;s[\\ ^ >~۲NVR-4(Hkh'h.*uZ&sn\`I&Pz晦,1f0IߤiM 7ZqЄ6o4lr ZE/1&(Ew K_cwG7dZxin-6mz  9t(,.E D}r 6]ED((rKKrM^Oi]G촗d8Q <)HS3Tj jk_E҇}I-ʂ=,dAdb! 'B+!J{iu7x  WWpoVq/ԈMKXM\^tTx,,ψ|j⎌AphL^ 6p+KUEmL>8ygS-E-f(vɿ+Wz2|<Y)L /8ys)4ʗz#U!s BbAx 05^My0;Oe+oPUrD:)XXy)a LqiS,HKTb=J`>mo%_Rò-=C \G)pzVi }++Ozv+‚#Ѧ~S(9I ئDu0<ᴟ1OEhrO̴>w6-Ah,?xK֍&dygkZ|C뱊=6.5ɀIo#>$@}T5ɱ; s9;f{Hi"RU %H+my&Bgg<ޘQDd#|d%VV?'{((R?jPV9b !~rz.69?8H{LfJԹ)ϲF[@>9l *PV@M a*/t' vGmE.]jħ$XLC3D~97Ia+gg2w ]\@ЀilB2d'7FKJPSt,lΘuւCad3ky84YdO7EwC/KqahNK nas,"ēgKU=?4\M7:>kO/nWe%5g2MdꓣЌ)gㆁ:ܸ/ n|a2+>_0&#Fn#jщ]nvt)2q˜ [n_z+*m^R ei6&Gp6(U:Q6̨\l"o;K!\ rn =Cb?YZ#E(ᑐ841A} ϵGvE8Qys$z' ּ %AYh"[?|tQɖ}e:Rxep44=^ŒT'f>W~-)RK;.l7MDuFj4VHcI|;]M p~' 2*tuLCCA{] wwfQS'dԤ稨@Xde|Ej_p%Y L,{4 5 ѶR tye[};ʨ=7gd{H7;)Z4:%$ijB旐rK.ty[DϘ+pzW 3|{I] %icöΒ#3.k.g #2BKEr&.٨c|E:j?u+ [y8~=g;|bϡ U.ŘbEzTRH?POoF_@ ӑ>C_=(;]mx&>?Px@©#%*-lP~d 7(U^;/ތz󾫧ϛ0!LDK;jjgoHe W9#Z"-%FK w  _^$e;OZDtgmD/3c/8}D(V.Rɐ/gΐcS &U%._>o9 g:7^mKjm&='Ulˤn;[p&lƲy{Ku g_U`t)Z./<ѪS>?Y XyG`)w #u(5q(.!wu\Rv;ti0t}O:5j_sQS tU27"Y-N4W3'[5݀WyJ0%՜;D ;>i*EMd4&kRWT3Fddi1UheXO" wܚQ߷>S\PPDn.UxVpi{C낼VJf ~I+nпs49'b:l1j^f(,5Fk-Z9  y5ԴeԹk*bag]yy =;닇6<*n@Pke3Q󜑸=6pIg 0aooBӫd"3{4{6L7Swr9_L)s6r_]6;HC l4ͮtس>q t&XI\`U$i/m(6D'sPꀡ?(` ,fLjOoo+Hue]s*pNA2&6Sbxw`Ά4\Htl1yuϹv ;Yv,3≩HPMHĕO<`'TQ^m}ղ&M rfGVs< Z]RQV|k.WJn߭EKP.;Y8fj2Fw8z6 5Hϱ5X_f]O`Zf䣁ʓb;=ŧެiL({$/b&K)\ߘq-g st?[,P$7oQ77{D i',M*suq+Έ+i#^H罣e}LLf&3JVIoî<̓ y1-N6@ξzx ?&'*0YCFy!$+5:[Lou7<C6_9n |n7Gdhh#ꒆ|7-^<η"hz S~EfWiSCfԠmHC7kic2k9pTֶ6a8# +73[ݗj2:!p 8>1ϿCB/9Hbxc_r*CmwR[KA-1.?ESxH8F$gNZC DO9h oPQP/q2]3_]]GH|vl^$79.,uƲ}™nWwfUh'x&KG'r ;Zz&GkqV|F8/+PX*;Ϭ!`Ѽ]VNVp/I~QP(]K;f3O-cF\])|Oׁ ]&šw %C؇Ll,c@M7OV{~Xӂq=I_z.IXh`UVT^#|ҟ®eaְ< KEos`$cpgrFAQF)$n{L~v.GwMqxl;jU  SgD6IP[@@SZDO:1<)>O`[MbtM+hwWrλBE-2遏3íVS^%NUv.@+eؠ+m?YNIMGi-m7n('\8 pg 0+F_ >A#yM0VmѸ΋ѣ՜x )=&e\lAP$e~j_MBX2ا SfBnHM;/gL\]/oq"OQ|߱L/Zy/ls}W[$fɴRK!ǦD?آEJw^6/,~DYf9Tַvk5_rTPkSZtª9sJC3*>!veSV> HP)Ad4=@-j`jZ Z9C8>m#v2_AX"-gLpl_?T™|%] |6`Zl@x|vΧy$OE *ųgpTz0+ 5XĄ5wn`(1iK2)5ֳ u( ]M}E75aGǣYm<*r-ߜĻ4k|dS c2̃)+waQMֈ(bTH!Ť:^W_^#WΩD!qV0yy n<~Ykl3e9+ԉHh_P{,M ԰%ɻ7O=i{$@gT0x+Mk=H'/vo^^?VUMɋ=LmIL o\' USZ{=5߿.6*O\E1-≶ubm6 YNu݄چ'tQxL?ތR.~R@D#`%*̓K*Uw B3<`ӊerr,$ro{j}Puj8#CrsWz0޵ʩx@WՁS+Dưѵí *]7]bik}13=/koYH~ iK\TIe>1Rd6VYφt2#J=]8qGkWJJ^6Z8ro=KV 4NBBlcgGϷ5¢kݮWi5F%(-Vn 1xzuܳ{iJf\]ծCacKu >߰uv79TF'\lߏ9~M/:tJS q"T*U^H gٕ֒fC6-yW;FçRU$@ >aYa 8:D1WGalZσX#"o6їU]%y@LwĘ̳n ӍC9>9.ꇜ5_#hIg{EɊ3'NIvE֕ՔEyj;f1**ኛHOcg;Ϗ~TZ&3Qv\?q#w7 o$貨AUsjnsJҩž,[9=lӒU&3H2ƇF?N5q2g78SȮ,2QA~Z,$룢q-ƚ[O ,u#^N/Ww?G)1Do^Ԋ6'6[n0AMF {߁/9tFO:+;'0(S~2A|=6⻋%s)C[˺ǪAn޹+v>"V T8oz|2<1윱7#oKR!Py)TǔIXO\Y{'ռ4n!usN n/;S:>>)7-k~a o=EIW- Xˁ!0dqxw2_彲pa}y@"f=VgHfmxg!F.3hWb;ÂWA-Cr/2_5붔e"hmJ?e(u}SRMq:RetT  "uv-Rg_b6^5.W~97jFCJi|rxo$2KۅuјpW[BH >GPYrtjXq0Mx̮k=>Y SUنƙ> ݽ&sھ憩\}Zに>~)EtDUd*+~@xal3; g s \7I}߮;qgz:?O@DrtzcϏ%^IE#@8l1&6oVڒ ~]2ZEh.oӕWx.* !)YPn7W1wi}#ܐg_ɞ݆᠚/1GC7g@>Vb*_E5 o[ne|cq Gލ܎2I9(CIx[f,(%-VZ0CeGϝB^Y5FOif;fJ;(pڡv?}A@ 7Cz6cc\&~ 7tS"CTOeRDyI85¨G?,Ebso݆<򾔻 Xۃ п3fx4%{=RXG8|i/ kJ%4oM>$.f|c')j%5ƙ6h }m3CFyjK}W|OqM +Jl($ +fMSR1QEӕ3[+f6hv0EQ*e-F0Nd] ,hDodX0c kSŮ2Y켍<4{(r<%`1PB.K&?`՘d,mU6Ԕ`"ljZBJG8Ёӄ][(P.B'mzO]\b BoVE`} eDā8C،#G TкWAb.aŽՠ}9w$C- @0\ wc؜Xȳ/fy臃$b* -)9ԑj"S@{ҍnJ5xUTj@bZCP{Ј$Ar"-nʼ@p};u6஠D)`O*mNެ_crUQ_Db""qfjRtfe_q:2K6T1X͔U_h!E)B^tvТ߭ل`Vlr}#G&iaU.5>dFa+}$b(xK]YL0|_{]̂ j`ET-+ wuVAxN 5!kƦ-8, [4'W#Z"d<`c˚}CmqP$ pp̄A dz__ { ( Jœ:\b#mgwb%PPӊrH9cpTŇE=9FT/" 3f E 6>V(+}c樷LadgNY#R =1Wq $JۤmVY2gIS7 C:_rl598Q@e'2#Q u0;E_hJ8)i ԗϨdٝ.ۅ٥ mf PqkpU4ь6xDf%)A'~ZvQր2/Yx$r C{ bEMY,}^ECa k/xhwΥꬖt4ڭE$ L+ځ&H';bG dEqc<}޾BJtI͘!_nCaNj7CJ'wXxiaH=3:G๻$ ~Yyn sg4ldG`7h4,j oqɐDm(Ƕ+P%R tñHڷc&$J׷ 3xSJ xl)VG@):ZQѡ( Yҷ)p~=CPNQRKsClLz<6!I_Q+eSVPGo1Cdž@n!" 0*3C7ySASXHҊ+5pia1#3/2Pt%jU/Aj~W[sf%/0Ѽy=lضӞ}5-"U<? -GA~oƇtV- 0;xoۑτ~Kg,1IfH3;7jsrvA{m1Pwdag[}'$gpA$sZr)"W . zu&Rj~荺۲*Ҟz+6aUEE&F!u6U'os<>_ avF;sk))VYM̷ֶğsx]4cADbS̋F z`P-Uϋg'֎Lp. Z&ޒBɍ3ϖZ9_'7}sP 1!7MxvYBZǦ¿ t@7fF6_pCemtq~<@,>MNad S]ϒ1́kXJ64B9rcaܭ _=9A4G$ׄJhs_! Xeyn=@ktD:-%ab\к%=!`жVda I37 {h] E"Vmf!hA+b# ԒSqbܓ48߬`حfK}QV<+@05œ}~ ^d|dV_*A' =#%M³4+@:ngla X5]>OHX~|aFJ92i\d.뺘l.a g=Uw+Mݐ+v$4/m-bRW-#~2tϓꮫvYp3wwQg.ƨE(C4 `muOXT|W$JžUl3y`u`w7F%|aQ,KN ?a%!=NN0řng lwYeXkYoo'{~ 4H ֹG#[qWFt>KJ"Q?&Qa;^GPH "Wc!>5 ,s\NÖt-!>Zĥ~ʂ#zrw[ p Q~lS*iKwW>om?d\: * rG" kK7[Сo i67Ά<ٿ"AD .5;cH+p>/-&c[kMvS2nӮUjhLsI씞Ud]!@p{Yl+/koWʁ5[$j ̢}H6UQbpou[S+%̊w9,y}h cW-S܇ {E~f~Kz~GbPޑŲK9@IxM**Bcٱn5qSDL,Ai&B<-ـX'~T}#FԹhؤ#}f1>}PKp|L#eT^N0F je & P miG۟0By٘2э^{wq-JQ7+kAWbk2-[A KSJ+ljJd,^ќDQVd} ;:C w X)%\5<8l#ߋ6]v`6m!_p-tKb٨DJWFjZ^= jDI]|U@TЧ H݅CdZsC?犐hVm>Z]M9Ų֏ܛzA$?I'9&$zA1|= #<$ʻw9k|na}Q*l|8ͼ+ A=cXT9{s[{+DwpeOWh&ӷve(2O\h63j(Q,:j5wy|ygƶiit-Lcb(g+U[XOhgb,ZJ2BQ12SZGymfp@C } |yk+/Rꐇoe`]UbbU1]2(?ȔHsN^DTglEl+7 4L&*L!0ldg8BGjuA8_7Ld'90-Li1i d=Bd !ڵSWW d&W?y:~{,on0GGR`jeLsYH-#{db$ivq*ShՉ{ٱz&5nuyI>؎G-0.Flmsa(!)Ix (AOF3j_BFPw E4^;J IelB.U,n)e7x]ڈ^Yi4:3:» ? =|u^š%!ę!gM3ݸ-PE0.h;ULX QpnRW Z dM,ڃ[G#/:e}DfyUm3ܒУGq3g}A1WKsge pQ8)h2߫Xq58_2 ʏ{9w'&hZNrY::93԰W)Hf*1$U*JEF.4g ^(,&\??`@DsVX<3}q"WϵWej㗇hy#d^碥ۘ[@0mpKTQ (X +[i;?٥||AB?1KuOt$0Lc53m!8Ijyov"N-(t@u[2 TeR+X;yͼ#j.ޙc8!#LvxC䗢*SB#0?RYi0 wжmT*ѻ[+R.=-yrdN8vF`8S|8Agq8ԏ{eR <ޣ^ͫk@^M%GP۪ Rc J'0h`dOE!2%qpʮ\W+iv"̠D+)LՈ܆ɤ+^KQ²n@J\V sDg47҉ڪbuB6v}]Eb^tʂWfҏ]^@Wq#"] 셕bqJO$>/2-xnqE]sxߥ< q)wsviL)׏ V1yArwט4qbF@;02c<363 9bi&%+(*g8C_r TVI'`VǏ{ȩjO3 Uޑ>m-L Ϸq}C"T/}1TłmHي20X([Do/#͚bDG9BQvM :aoQlX:їc0K7BzzbZX8)NqAS-Lv^@i-n*jf! ^}{u7"%y 9QJa*'1ex4"YE79赥Qt{j&[B?Eda^y ^xYNJD¼njDJXkݵrZ!@;Y` vw"Yiؐ&WeVq^#3w۵KbHP48F&)c1?7P&M8Ԟ!h.VՎ"AYN{,!d V}WK)rA$Ya "GtT!Tf9CM!zv u:gR=*ISįL]2RQni?>j^}=ԗ洗;.?e'|?wSDF4E~`-MW$an1cPZq 8tj/!3hň'XKuH\7 a9ȳ׼Ʃ- IE9퍿8h}=Í<+622h"eSGzS<@߼iCG/}bQP,7C_(P|z#!>GENof)8>{ֆ\+J-@иn% ;!#^>n 9whǧ0)4SWԶL&@',z3p~ ot pCk~5v#Y0zwY'?WR<$O!eH1׍_ |Kߚ`_RP+]&JPW)!QoTW/E- nA 6KfG&2A?A lvIxO=\yi֕g@Y;lPS(r5 |Nds) -o$u@^+lcgSr\./4^M0ZT4%| J<[=?WtD()M|v)Q4`GMZFE -K残} IF`g[Ae~ +)w2$Aq땼%@>PpvH5ҭKO8OA5PQwɸgή6w? B9^ToBxE7U@SvoK`Ηrȕ3hS0|@db Ks/gi?H9>% *y'25PrKdň(~^H-|@2pO; zuzZ,F&9}sn5&45M_G,XQ>Þ p "#֒-2!n?)7'l1ə jnheщ5~[A9t%U/Wľ5,d*'F@]ZלcDuE ),Qʢ[دdn"kbb`xwqj` N"F Q6֠e;ǝA#`,ʫ}vʪfm#B?&}/xHo*L#H?CȃHb~֐"$om~sjlI8x"LY9'IO^Ԅ#}'ʁm/挵,N; o߰-uDx:aOFtcfM9oo);)m(_\_VZNLm)ZY`%zDxx%}U“5)p)&g7 5 JWҪQa>mT\\:&KVqRaItwQ PAh醯@ct0G Jkh#s6y`J75i=2[b0Ab)1LN춣 \HhW+ڌ~Mz1qކ*Sab E8|%&݋W @,d_P?t+9k&AOgUǀl&+Cb{WA֟mC BT3Y;kl#,1uJLnLs'eXgb2Jqbs@j JT$ˬl MhOy9j8;\돗MԊ=pva`"k ;q;l݆Up)-NP Q j]C*p_=ZpHI%elCM5Bswsɣn5d{^OhxF`9Y.Pw?ނ=3^O-0ytR |۴tpUZA5 `fg~SC***4Ê=@;'_;yS la6խ|JkQ$">dP64 9;|Rp +U쑉F^E}\M= ~U1D3t)T&N8Rhl[\~4dBY Vdugݠz]aFGPY؝v7?y*A#i~M'/N '!>+M Oil)8Muv=8%;}.؞]8ca5+Śn@7Aq1PQzqg`6s )vzI)cndh#TyI0(F~lmB^Nj9ǁ4y FB &gH; H2O=ُ69\zPE|B0 *Ztg~Az] Oq.&-s{Y(CO8H+Q b.E0̇53ƪzrCzU +0@l  nk ?6MhՋ.^~B7,ǹ(?XiM8^tjS"$  R)e =c70Y=eA:M  C7@uL_ :!%*Os޺*M۽($C5 \&:(*KBi~+*ڤ5@nΆR|o:U()8mmK=ύE=ӀEy5ƌ+x\&7IqYU :Aʪd ./" o5שΣkR>D&'/8  ,~i( gN4bytTui*ogZsbFYl@T Iî·vzQLcgD,XWQ?f2BEZ"/w),s2ngT$?k9Gl^EGw[{I2x:FE %W(Rd}73/*ϼ |>b|7Dz`XS`y FOf ryyemXmY$Z ;Ō[I6R[WA8uuxY }Wط|FR3裏} č30s ӉK9@r4B ABWUzf0]Bqm!P¾caCw>)lne)amռJi6&祃 Asw nW ]z)'%^Y9fV(ח(qfIj:+ vn35lЎVL +WGeVvh93Y62G[00}3)\W 7G-+|EKd; F9I4"h+b85>j1IV+#R z2Vےނvu08sAU2,;\ طenHXpҜhoxZqZ65GՃԏaE۵^̪DVi$l\L "~s)k (8@/䐦h?Zj hEpf Z͕?npbLI6 qrA )m ` --*o60fV+_0f=0B6qNq3"8M vZ ♘bNQR_=YFIoB](~Ôkعohױ=HRI׃A88"x .\׸|<R+/V a<ְ2># ^x8x\{(c(4!k37;+ j&'4`@} M[ŽTb8/W҆34;>Ny̩ 0&=xP9)ayܠkc&"]YY]E&,EFRp&V8OX%zvnմU>R}LGF"bf0Vt$MmB\ef.257aD⌠fp!NqA[9qxv|Pqc(X }|vFd*2R[uJQ[t-,o8TUy@ȽrQKj79a~h(-{iUUɬռ [I= IK t\-pJׁ2/"MIB ^57q}?[؁^FzY|c7 e*$7( |yƭEُ '1A({sPK(FKE7ODrܙstg2'bR KT@Ŭ'3xuUO+/S8Yo 5_֦O.W&&諍@VGBQ&B cB#.a@fA(ZړU>n bȮb6a'7EkFS+m&>7G [Cvqa0;|4IXy=V.lu ~{\mBN2= rt#ܫ84Qˆl~Ezr Z LJYlI<0ݔ,+l7Vz2ݙKki=WuWߦDg!}bxOZ\u[˱9E]T-,SnTBTxA]Sc۪~܋9ONb!_ZVOCn _$v9F֭Z<qc_fճTB"v:s/`/a+&OGlie~AcG5c@;M!+=Tnב|" S-Ko/hA}-0JC*{>&3/L Bnsڕc?:I9U+3&+zx(S)7ix%mUE:bCn]BH^FjW4f}D`EG=Xa*Y *-n`8ΣZy)B &N:"Lݼ-(q=UqHZ[d~j@R3xԱh[h2>䭀xv>SFOX'Aüʾ`=?ZwiӬ h(ծstx[ӔgF%dfX䝸HdNFCl`^gƋ sYOGųO t"Zt 3A)!AT?-a7{߉m8QzhycݶwlDz4?v܆GTԁGbKdՠ:l?Aa$VInOCK\©qFuBU`|B.t@N;3yIR,CNb/ퟺķ[ˊu7Uo똄 /8X[y^(q|؎OO{?27Dm )԰oh762nfе7E לMCQJ8CZ9qSd2p*8*&zDf5E@? J_%'ϐb0pXz"i -`Blkc0lNmcUt,31jVOeG^3]OhDUj7SB6 6# n'7,K*>2%0{d-٘/Ҷ~Ҧg&"kDc2'.DM e}!{n@VڂnlT@b[H[ @gE=6J_bĀ kM "4)/K?Se23P^^ n|b\ EbEKF %#\*F,cdyD{%g;)l ]]&JL1,F8ݹBxk!x|h[l`Vhz=_j!Թ7XZ >pL {;*Eclʍ7O>te`=`wW+&&XQj1kځԫ镮+NI5[<'S`nQu"5"`{ ~)FS*b]~ Y]$^|nSWLuWڠfw>BL@Ec4TB*7 0n꼹BbS?Uk"RwA  ,o3k6.yL4X#bN*"@K0BV`, êk"P`]ӻkNxEUalܐs݀׉y[Ev# ƘbṾʏ/%t ً%ۅ|=)Sŏ*a=lr'=h ONLFHnAKk.p (t1+PO͵Dl/ռiR !??F{S35^ϼp'gGOxG_47I .>B;1ϒ. ZeiII"lA7&Pa¶Kpou Q3l eSt'ee;!dNCyM]h_HW 1a3S4\erU6?l WЗnm]B'Ivo|IQۈ)åR\!scXڞ=$~+T ʈs8KfBt7Gz:@#:z ȴxјʝ"۸;AfXy=Ja+غ +[m$p *> Ɛ^ѱ|mSfC Aar0c^ h 1]a^D5 +%f "N)`Np]~2tV(z9*UlNF@̩ {㳇+K)Gb_x^&v-;|VSjiA"KB#MS,Aә&5r=wf: mDMg持[6?#7k 閷6b%yCOkPhN5W[ƾkl\ݩ{k<پp ݔ7ah(\=9=2K b\r5Pņ:/ieb_b` 5 S{22BxNLrwH%%U:Z $RrjÅ{<)}G̯_:CzM贠csd+3RP;n.Jd7\\!PPi۞ SՕЏ bO+Vؔȋfe(}7]%ΰ}.![; q]k:u_rxl'P= 2-Q+V)z,7Z1M81~3:j-N_HLk]V^1dOYmU)eqh(YyBqNrLJWŧ=++z/)_SF򑿒|[o1ijH 4Sq2k[n0I4s]yz-y+D?~C+փx%@OgM9yXXsZ:DĐY8hx:@  sg-tٮה: .Qoj?"88Mq>ѳ&kh=d&M-' -;GA*9Ε6ͤȊ:{T?3CSXPlYRm]ZUfBnjAɩ y >rhKZQ][/q(CN$<#|^slHbR(}x!2{Xgx)\Q/+ e(VZPz!>7.. NRJlnTAZ𡉭{ܳyjQRnrVlpIdT Ê$2Gtp^m!}q#̗}f-X8?޲'g=й%P=uhZ  4ĬEcSJ*pZH21PuBB^AI3P BJВ8rfs"ĺ+!4ˤ\;0C//4?. nպ'&RrjMH]먡/03T؈gR@q [O@x-8 )!C}&g>vo YPihԛRQiC^7. */ ڸ2x靼!ֱ_~)zc} wՄB /a|!nNC8ZV8w:C&|&*GfBa &  .[@}1_G͝!kdGeq2!_& e1d.ĵRYSZ}w+T.Cu޻Տ'<$%X(1NwI_Khh)m H˷/}*Kl7ScE>ӞڟO7r6hs,P/svՌE2rEvFї~¥bĢMiͿQx%3'ڻQD;>QWzg6e/KDv?%G7;~M> al$0S͹ph{#3h4z:|ˇGI8O",cEYX6k A;͐ݍFByT$?s;h$P2ALt82C$65ᒍy_n26\7޹#nS4^=b.k@U3%[5UBS7[("JLSOq `hui|+IPS"t~ ZЃ]!.2d_s)YjiEAnBU+YpQ_fL.|-\h -`,u/)05 Hܠ _yGf^xnYP~7qs))::}N]jBU^C}~WM7Z@V#uc.5YJK(ԭqs(n#tʯ7B>El"aP{}EEH&4oJ6"X;ro HN +4?wbUhy7Z5q [b՛F@R;=+uy5Gqd8`F QԵ~s@*=s;*yԹes ^%] z3JT;u12G *[o@{#X|_Ե7J3<`߉V)j^K#d!{}eCMQeV%KDPQ/:Kcc& +NYWY;>@QrJϑ;N4 6㑨tܗwA1Fvk)3W P@ R]UOGr 8Jtr~ MA iaJᵳ)CKcA/H[{A sI{|*'쐶{)K3ke?E2Dks3ךkᒡ-!:jc-9qH x܇G-2}E^!0-P%;y9bKT)-[ ei&Yt{3戮X^ϒ 6߇I7N94LOqU}P2¨4a9О0TR2ENQ`kt)fu[cn&1*8waw6k˿7Ȭ/4)'ĺgy4ŕ۝F(?8="Ʉ fJ487 (1z̬Jin$oOwP.`] ZI,̾ [/m#i u٢*x߯Je+>[s'hX|J19aKڞ,8GU<U z;:AJ:x#*{0&F&-ZFNP#pw `rb5!v{zVhi4E(&kmOq5f+ Emwɣ;t3%5ޤj@8φx;b^ꏈ.T5Yޘt['UU"?bk- : reLw.ÖeRxL2.Ī61Sx>4V G\ȅ_RGX( Eѧ&gmKU}LЁW@eF=9݂1tz)rIRTQb;͓xzp !܏ɝ8 Z3hB"MU 62?K{X ;:mC1bG4 82{o:#/kW{uiG9;X\GrgQֆ3^OG҅abB}B`A{,i2V"}.OYضrf[J\H6Qj4X#PL >.7y A%ZiJhxE`04y&sXL@]xYk͑V.7X։ qOK05b$b\^}x^Ź;;G@I5;d@=r=aJ]Tr]>YS)Uz'x&q;4ʼn%2wI\ >Ճ4?h N?^9u,hlH HVCv`!+~PvÔy'!jr0Zl& 7 `4qF=0S]t;Z TgfKֱk`Emw1H콩LnݕtG*xL hFYwv*K#{gynTpR.^Guyg< J&jĚP\m[7$BEz&h0۔6ȠՇ]eF>@mTYlI(2w|q)MQz(WaO`DWтõªk(j#13V]Tz\. M萀jN:ܖdN( n͉^xSVȕs͝ȣjF)@0 'K"pZԅ\Ǭ `./Q`)P88壆dZd]o XVέHX@$(4`lqOj'ߠ]#D' Ęxfx9E|!ԐۓHH^4:s9&3QJ6~kƁ@DVũzv+_ hؖ P_/_ cx/,edQ6ϵ4% CԱ s~# ad%=P ^,aR=C uVZኞQ6Rgn}h" / Muǀ^5Jѵ ڠ+5p29mV~nM`l;噫=|9Y\n,yS/w_jMZpmP?Um™r^:~mh1ckZ5 ֘rBKg/cE߰K=Ek1`}p5 S,|w &ld0s3մ eunG Doڬ/=O|7Xؑ(.:!f .̰9⎭:m=RG\?ޠT6<͌,, :*UBmvqVD g5KwW/u?tͰl.%KX0EG"o ӠSq&6oD2YxF;pvD N4cR]DuSU ,тt4.vw+YZQO%}#  -dNYn]HבCb7|MD16Kə(!2B@,\#~L19{XAD1 ;zup&YpƹNP]#µP}ߐc&cQKB[UJiJ)}aez{ XGC]zpbįu:}1[fe268y e*jMAy $ G e R*Znqh+2G˼m=!xOv UMh[V/a!|7*In~7?b[ a9oMU4I2sJ z}BDKõLD ?|ɾ;쓬 af3N?ߞ0Zp $\vuJ1'cS!_@&?9ȸ7 BaL~hG%qF)}\ԇhXKd`KiS_8B4{efį2L=hE}pՎvE۠E bPw<y* ,6I;f 3%{^ (e(mlR>?vzLJ+T| n -J2>V?'M@DE/ RGԳ/vSGL;3Pl,a CYXpTEy귭"3nd9\R6Uz-:D3P|,_p/ ^n =P]+^E NG#tu5hpL\?0N'72w5p}z?·u > SR/Gji8ÁPASdKUl: DQd*gF;q?Ո@a,_ې9KLE.\/w2h{]D {-%fgvب=CdXB5fy p}\˂%h`lm{U_3Ϙ6A.5sN54Tb I1W% mp]ͯ2UCACi RbIZU<R [HBV?Ss}u$q]FIEX; Ѳv̷21X; |y^Vrj!1bV$`ᶰrٽl ;%L M% ew(b!b: q; `f\juZ;˗^w;hg/o( }QjBkCvpBCPK2t>El-q$Ϻa|X;M&ʦ hz ǵ8Εǫ#SʪccX;_Vт 'Xh2_:98&K _Ìxw^RN.^Вc 4'w`{ s0坫{HU K÷.RߘR%0T)BсJRfĚ x#T 9>qsz3o$?nj{C\^^x'\Α:mIMeD%Xy G3 e@/RF0! WʹټO0Ϯ}2ߚOHcj}-_ae*0)6"`~( V۰|~M>X/[P&rr5EL T 9&TsXZ{uO5XpSg$}y7oxRs9bj{"W<|D$ሦzdqtbvqǐo]^bːOf!ƇU*-upxLy .d[ ͔3ظc$<^zy` u5r\lZF |PR=!/IķbQU"`J%; %F\3k¢#m Y 2 ;,}Ts|$vzlOi[[N3Zx^',ҭutKpF G6-?d_UK--f"ܹw Pɒ=nRՠB=>C'>b y\qG*4Mu"?%Z7`LmbSɭ&==~U|oNg5\rj%?1A=!w] iQ{sr/ n1-p:XS .ˋ7/tWxZ  ?K#).凉bVK>ѡYRaؓ8i)GU$'2h#y)u>,[CDbnç4ToŪW۟ZI}6EQ~] @50tݞeZWWKULa[mn Z-tqRm_<1SaJW8r>gKd<EϥhrJ{nH Y4e]GYQ'C9h<\ $W5[Qx`ěqxJ~2YbӑčF@(߁%p[9YN*Er>zpc+WWG'w#UBR$ =b/>u{Ԡ??s^ 2[GZ jӈodwjI''VK-Lt9e? :C/\bH]ʘZ&Zb$(K K4WSnQ5ѱW-Rblּ/kLNk ~.ŜPwKlBjNi4|F_Y!KVcpV-SOR*_ by wrw谽D4Hy˄I.ߝW"AqRLM;dn5O Kf$ .gդl^{IV*A7YY挗wY[4߶ v\R8sgTFjNY^Jךul@=t'zL:$s J<hEb;`6ܑ&;[?3>XwMhC:e`mz1(e02Cخ[Z) T\1cA'o`p$o 0{Na*SȬ?U/?":~5$e$ֈm<~iqk>} ˧MGC`aM&I%xlI┶Ĕ9pDERr9d%#wI|U͹{^1Tmu8>5^1UGq`@/Ih<Џc n hU{Ȯ= Mrli $"OBd:j B"J^ۮh9r xnq A\={)pxkt#D|ZdWcH $b) t㓇Rr3)W-opAJoDlMkt;neЅ(ˋ(oQ G]|@$ZZAS `shPy𭔈Awc.QRNx%\:d4=qat蹭LzG‰u%Ž0>4.Jb>i|kvyڿ]=bjt n,IqonʤVj%5M3ZR4Xw,X[XTV|噌xDA* ѭY"nȒm IZڐ6qJa5fLw ׯ5h׵8yOV^kfsS4T_Ċ0d߆]Ns  %&5(%>Ty'̓zc wZ?c 0`6ǽ׋!vCbek60!_TFd?vJ)KCm)8v=4jJwD;P(*Vx 6Ce?r77P+)0Yu XȘN-a?H|wc1_◆6./q7\zG/(ݺ3;-t)y''χ,K /O?JMdxW/2>> Eit7w~)5c^V5IB?SmRν0iJ,P2L9}gjdxu6?psgs_vQS8O˞ezDXo~0m}KDC w@ I#@zEбiXpiejCVPZ^\{MPSOObtA۳L<O_ψp &rwG`DoJ*+^,`"M=0(od)Mp,TIΥB~2?LYjE#+;\=|NSqط"Mv1[|`ߦ;;4{)+CS֏ X[ݧmdrʢLUj4Rd"1GbS_ O#{~[ [qr%Rx(DlQ辝 EO6:L(P nRRXn̻0}62_x0{ ~ t6tlFzz6Jϓ/_H񯳏]o#/v!Ůn_BH 6pwjvn%\ː]{VAfv^G?TY?v+Ь&#&hEQZE=\n}S% ;7R^.F(5+훩J_@v(}DrO.KMb7 fW!$jU1D4A=nme{ʵ :e=6ҟDXBFox˦k$[]gA5lmgh/\ڬxM4f  tr|}MSPv~E1uvoXHN//ϒ!89 izDLZӈ'/B ϻF\]`rJm!-hÀ8Jxd@|?CKn$\\_`)'GmuCcU RM2MK5x߁7 ٲG1qlF{LaЪFOY6p2Ǟڊꊺﳲ :Fo$r'hK رK/*'v?a[jUQց+!ɍ|3O@Є[ZÌṈ1_Ig72)s,:ȓwyy[YR;1>̕χA[߈GW/l1^0BTi7E<DV7JWĩĞ (<վ U|ei|y= {}ܞ.P=fbPƁӅC_KٶuTX~| ^v #{k?3!zB/`KA"Q}R\#ϮhT{17|R2? f).Έ,lAF?4;%w/-}Iu"{ {3q CN:&`ce0/9~(a& ^M1ec7)ib- 7^T=4wR!1pL^{\{^a0H}ψ搗$Y@G3, G/P-`?Ω-6 {Z>D l ַH[S}Ѫ^ةS_m[W->:@2_9C{ZVn1]ܸJk\ "i{pL--! zkBr#-Mwp:ghˢ}j' x% |^Q{̋7P"{$ Pblhl6 _WXhZfA bfªÅOÑ{C#X""u#:m@Zjec(RWϡ־Cxs#ܑGLaLï[3{~fnYAJ \$Аvb܇C:5-QpbդK0'6VټUMo?PZ,瘃мPE_yB(GK俗$ L.dMØ`yN:+خ ŖL0,H]=~]qZEpU]?DXfoF%#izCpYX8{-H!Y~zݓa8'}%RҦjWUe1+AVZ7[”+D09|dy1']/`aP#ACmGćiҁ桤 !s*@As7bPƣ G&d r >8+,ש!`?¹#r2̄.rHR43VTJIel4i-.zCZHhPjn^W8m(ݣj[W Ar,lxuW-/Y!:]ϋUQ*U6ʭo[tω៻]QdFN^ou]WM|5)1;si7&:Rd"*/?)uΌcunKJ4i_,{W.'[?ӄJma'j6XSk鋟I'Tƽޯ6 j'w^>!&Ce'a! 'fYp'nϏ{e2 r+Ci@r*םN? ~!BpeMZÀ r샏Ә <'*ҽhyj_QGtlW`qov鋆`^ϘaՈ 00(2x?ÁH2|,5b BЕ=A2؝F(OJ'ZUt|70z/\*Avag,M)RC(%n S,%EhCS7TAB6ϳ#9x& eI.02Z֑JQhxTj@VFI Ó\-:-kչFfف%{y*$5 s's X&Ck' 3-ۢӖO#GkW/Ž0sIJ'rVV/1XUtpZU5џ4}^wl'=ܨA}j76_qBlzU$qm  +yxԛ-B8NuwJ հ,Oo Nij^KsDƼWc'@pd]Zhh~3 @W*8` [eB8&W%B]&+):Nƽ06%7HEbεOF[/WX_Np[@Qtxz#uhj>Së+႞#6nߞuàn`/ք1Q6$ 88nfrC=Ɯ KA+"EpUXZ5UXlب~QpwhVЏmNh7F[3{>Ṓ T|פnLă!Yh\tq3N.׀1sُbu\CЛh5?TT.WR9m`+= ]Cp;D_œrWqsQgs~ov(Sxmmr߉T 4H 1/>t\mijAҴWehB%4~?)ΖxVyG^@?G a|#t>iv[#h:~)/xGlqQ} xdMאc!0*)ؾA׋ۈ`d@r;l*ӎ C%_@4 w$c`lu.%^ӂd};ny.46ػdn"fN?tVoH*O%k&qZn4(.Py rw*5͑G"sZ.lw~7ig_=։f)&uofȣw4#GjN YSmZjPH+dJStM!{$ K_!5 F:Y۝"H^9u)YQף82P0:(Td E Ã8YYgHBz`AP{].9:p<0I社m1MM18{Mdb_< 뛬ug,\2>g's&\zX@'do#BVlbvO+Sp@g J,Y/OOtK- 0)mhbt7k(u*`l`ZK,3B(pPLCu3"z,<)t%50>+˳G ="'2hL7G(E8JЪ50Zc[M$J }ϐCy> 53~ /ck֊T\f0\߻d dT)KHalFT벓2A4Y%p(]盈`Ka^gn&O ( %E dn un_Ųٚ'E&Ow?Ŕǂ=Dunt.í|gT[&Q6Q#xӁ&@z:U+T,v;[xib_);ת${c^@}] e;NJ鿤P )DV摭Q? F0$4*H;^YjLV ot!bN*?"u)'.v&*=ocr: IŹo IbTƘZ?-ZΥiD UTJ8MCM[L2Ek`Ae{Lu9+ukNZl-sRNLw8QCa0 |cͻ!Iy'x^XX<$LWcjBԁdlрx4blywFm>͇rp+ ܲuQ}vT@!-Ý&l ͂.++Y1h)!( ;ϗ+36˖6P̚RHᘩR ScK ?רIGZh `أN37ŊPN*[OAp"kOV^+x9w2L֠fƑ͕ LqnpqrMK&0oʼf{S%޿R4GoM~6:mx ]䶻[jFp [4s |hQUPO@&;тz_%pv.4𱫱Pe^#PnbaquI&3,sg𦓣hr+%$ U*ǧ? OU{uhV;B$#%R='!ĨZJE7ŔicJq[xE~WΗR3z Yʦ{ vwŪ.:{ p(h}9WMt\$h7^l^yalMB{{EP*Ÿ):F Bf{-B)`ۨ~YДd0dwv`}&$%ԓeRR)xťxn'G}v|#΃!)9hmh$ _ՍiQ`FHۋ'4g񉠒f(M}0$qUKbhbb$͒>1[D23ZQZ<+W~NƼe7UUyAvn 69e`y |> vj4C/,#y]JY27`fddžhp3.pg*ٽؑ/!~oKR C9BȟKqDlTTҭ[1lrfpHL@y$}Ap:W8a|;j@cedE{ւBn- ~n`:|c\޼*vrMx\_u7N\}<? u06)a9;uF2q'tJiqc[Bޙ7&ZyŪ)[2̿VPE{` *JAoMt<4s/Y|ӟőTT?fpA᱄sT>yJ,c_Tzok^ J`l@z˕x_&Pu}&&9$7-q!r~PLhYTtbPCN7=˼v_FA uw @a*(rW>Uw /w;Qa/ ~*̀ ˏ'7dCs&1 yO|91)Mn8׿7gcF9X3Fanv>N|nsQ9`b#|z fGuA1 ,d~<^.6xc8寐Ү{ղ-һcUGpGHzA\^9aU{9MMBqjt:QT\t,cb5\|28.aI 4hFX 8eu;.cjͭ[B[rѐ(\TԅuZc|;Wvj ׯG+:*7Vn 6MeH\k,;\2~P%Ě "aǠgvG:F˸z[L|2_Ʊڸ@ه0ie(,~h>Mþ܂c >:B]W?Z M)s+gC&[Q"NńWrX_7:-@RͬF3[y%Y2ՒMH =hAOo{ʺAzJrm_ϙCQ$eM#jfM$zNA+@bU?D8 AYn}iٖF=UUA:ԽZA4 ʼnj+`p;'*EK`S($[ŸSEw|Յ cp# ҆Em`N;y.bDM r{26m޺ITKtՒ.9ef#Dz4stdzpJq!!)8`~ qhcŜD.Fj2Dosk96塮YVi+3?*wzK4i4ڜ3ڗbG`㿱30|xﶾ YC:J778y>ML堤0y5}8N. -_A#ϣ+)Bcf19SDC]GWY2lJ sĶ/lMSH<+ B#h{գEMepwW띔[k򸥷YzS'/hD.8"r߹~o8[b;aL$YʒICu ß_ 23lޅUu,9K$}!i&f)'\-taʕ3t-Kqu By6 C9[̨Ffmc '*Qr: ЏVK\TLX.oyE(xV YHkA*{vq#flw4Uޞsèa6<~t_OJpICBf9mVwm\~c vVR%`$sh`/{F;z`I'SK+@~"703W郗pfl=#a5tS2R^L|TD|ٓ #l3FZ^-{B%2~x={S2Ztk;r OcRrn/VI6B~* Ã9ov;sKϚȊIw_;oKq&u@ud nH!Koҿh*K2Td..*vEuD{3H~r៲I6tK;l {a lq= Kf퀞 ] Kn%zm2H"F(0l]'̖)'Eb;*6j$d_?>ߐk(K}~S#%G 3_*a5͍L24*b2$+za 3hB_=%n/n͉u٩eVêQ܌ M:(d ˏ[%$Yݎ[9ڮ\*eR JYjuӬsy>t11wP \,X@*wl؞#AZ>>``mElWN^`}VB 20[G8;h"9o8/)(=yi|P'Kiٸ85D;u)+KujkeT)=ֻ-Y!Vaoҥy`05'4.2)Qe':i?GQg|떅jH?!r]}p[v(GJ;AvͶ./$ vuUW]zλRqX@i_.N 64 }? X3(^z2H}!Uaz2 9MOGl&F__iv>Ua!%>:ۏUs@&Y] Sݺ=IMbtE2t7b?vaE`KR.2P&5W{q"=ooٵG“U\jw--GNm6 5z@G :%Q]<}bsr2RS"oxq;Id$țtT rxQ@&Nؕ㦋PXCE) ,Y4Hsƴ!`裲ږT>@h/3e5^4ְ!+D0&ߞu{ZM.*'p MUuZ҈wIw'qnCE>L}'f jD4J,|B@`i v0G3M|yՆ^_EL"ZN\ QD[=wE<gqQpi kJW>?NzLeZ kF+*; >jna9Im>Je=Y]p`$-"a=K*N‘Lnr4BmyPݑ.K=1H8S9OIֿԳx}@UE6SvNGIǤ3]ٴt™ .n@@ÂeyAb [d|QR^?q-hvБjl itICVw\Eye5 Cv<07ӽ5^곹9.1 BT~>FSTZ Rۭ]/*N;uc8_E\X:.02듛j(UQ6K|#l&1Vj+%|}2mJY\ۼ`{pnk+ |JJ)7U& CV6u'T Xz*{!'RZ8, qC0cX>k[^x$C9!R~5^[@:Ϗm_6{2n_߁+j 7~Mq=reza<ޚ^ǚ+x_[˓q˻؛o|seW|X7+/S tu' {9Sz Zu.5(e1Iɇ6MFǥ<wI7y{QIMNl  "25Z/8/O͢LJP BX<ڋaFR1WT*bx7i;]jUKJ^@t1!FikU,%yへ ܐw( BicQt+ZȮf`/9g0c'+lE5IJjo8CCp" Qy6*2n~E^Aq"RM) ȅfN2ɵz &+X&[DrހeCߋhq;e7"nNsn-S~աz׷#0@k3ueUс]nH޹y3Aq`'i W߳ (p4n::D^v5i+k}Z],Y9Fɻ ] 1sZtT1dB6 /PsR.$ Rcb0L( F KV)MSespi i.>Y Q~;J M4N~"4?ؽLs9NByH dIpG9Q!dah^-"SC0W\;dvPն 3nZI87Lc ߳mi5|>'gR<$H4_y+Y(W&MKl!|K/Fa %g&dbMQQ{%iPs9KPB/O] BA:H]t^˹]ױN(;,9ޱ_/\_7@;nr$]d)5pq6xWֲ=n8e8*3)0mS^7t>qwHIH:ݧ|HWKNWL|ѐԘsʝĬoԗr_nkL !BzD`ۙY)Q~hcHX,QVp1Ivn-ۋʹ(V씔4lF4>U)疣w3VGO[3R}+u Pv:!'UUVNQ'S|d֫ey<3}n#G31PV  isi#&1>ehߝ'~X\ώ9r2HM/9ɑ@s"cq0C}LsTˣ0*40._ztnM['cר <6C:a]g7dvVut!^ /%+Er73fxkyG;<I!s:ؕ' J6,\#hBpz}CkO^tI] ʹ=! 6žzu]'fKmO}bJ)ʶWc:<%%H %`YAnM%)U72 x5wi#uUu›D@H]g h8x60=#`W"T]gWwtC EO C*<6$J,$C:h'T 'ʨqk%Mp.{fLOZ3\LzP?"Z UOO!sڒFu[l(09;qj *$dV>^m3QdoI\}ϓdO F.2!5"̴P&S#eY>u8wj|gngc%B=p@K;S˨Q{<Ⱝ}lĎpM={q[Ѡw; 8C42c-C+bA.hm *,U.dܕjI_OCqb6'~ fB?&1v]]{,SY E@%$o6-.?:eLVa{G .nfD|ӹK`O} !!lȧT0S@G1O2x OEk[RĒfj"C1f 8bun$')U7TVPQheϺ:pQPSx;4P9-E7Y7Z4E!p͉뉣. k$psfS$ ⳝw) n pkLJb+ghv"z=1z$FZvl̪C _Ú)o¤T1zB-tO$ ]8rbp'DK߾34gn58Zce }\G?~i\ׇ G?^l -oc@xsfX-Pfy\<FtL闬6_IaP+nw"wŨ-jiC_.֦*;8q-pO'“cٟ5{h{G)$Ka>=H S #zx .XM_l[)Y-|ҫT֗^ [7TKr}R͖$l"Wc"Y;iߪ[?Id*vΞ~L ?YwsAء^| IMĴP] wULۈIvMOb(PC.J̀AӨ&!n֎#&덑n}teW fU , tW `bӸLAY@)D7\6Kv+dSnT` xf0@һn Lة+b}qW̢; rkuυwuLZ[QEmpTG.@3s #QW$! ̌B;+|KLF8 v}#{^'ڏb ^hx7>ٌңnJ1~!rU=U/a= hqט%|H6 Q[BߏL u1%e#lۢ#aRqgA]|@訣v#>iy+; {h{nf#{vPK0Y^Ez%*/qѹHKLs#A3Il198ђf"_'5?]}ʰ'uɯR+q鼘Z|̢(\q:y^ExRNא2Yt|:0 vGݝܜ m6jA.N{>g -IfґH *Ư SSG#07bRͽu7W4ݔ4 !+qͬoa5LȫL`b:+Yv*hW֭=:[l3O40Rnq=}3-ft:U0d!8Am15>g]IO:7=a %-]Jg \L ȏz_.d`,ݭXB)$M]+}Iȏ޼٥|(h#Jv-BgmꊈbgynLݷ_Iz -7&-VRn'QYv=_z}Xܷ>u}Eo,ʩt+^, M44C3{:]h# 7P-?-*<.%(n>07T>S9㩤EZ81 ߬kӸc"d f|_rUHp;V\ o Xqs/3fzOGw݂lgC|<2Q'63 k[ فq|>)Hsw(ّjQ$$F"Yz[\?i"yMu@ *(CtUBAЯ(ZvsO9B e8Mi*:eF#bsGp;͟=1 Lޠmcе5* ޏY7nc+"'ni/w"JwO&Wy^ x4cfwշ2 Q0]ANBGfM[Uu9O\.5MꋒN3v<ِZa&X44@>n倬7V<:)S.hmD;xclMRGm6;Nu%.᳴sjozH}.o](~DSIċ5C H|./q%4oٳ"/P*~N4%2׈P{n Iz\vFU>0XFH[8xkB_Ot$5lpGj݉| Ye ³)d"]nz]vXKFw;Ĥ3l-޷ʨn<FS{QIp23}7pv* gsʭla_?~1GХ Q}㊲5+jY,`Uud_e#U :G]et?)իb9?oIʌ7G)?WQ3UN$9fmo^X)Yhԅ%L+3b64QvLG2/|)?Fj_CjQժl2iMy!k+~'|P2O?*'{j)RDF/ͱ1kaQ%dh3&Lε` 2#Dl>3~=νd׻.2ǹtkNm¢9/ZF`5zR C&)#v.b}3gFu>^?b1kSUq+fwɂ7olU#Őa2Y*<7Kaeԡq Uc:X=5ۀIkXju"; =7`ֿAcw pk*o:1l1MY.%kmEh`b"dtՠ#;(G#,I1#W7|!(-#DK_і(Q y7dzYf7*HNn'C.~\ p$ŀ%Tr3nN2Zlɸ1ՋuϷW7 vҙELi_VUJN:4 ;nm1>=s-Ŧ*bm(༷wDO'k,>OgrJmvfn]@$m+:G–o‘FE{O(dս]zMxK;_HmSt;Amv 5TٓGOO7AP` E׽Fax(oZrk {&fW r&hb.SRNzHڼV~x,QAIWZ'.˪qCle φ# 2İhЅXL/mju᧱HɌ=|W@HLE4rCnE$5ULP2EתwO"dkRbd9P_v5J(vTFd 4P{2o9u+877\Ci1ꡍ}cJԫd9r[yM&(9øİc356snnddF{C 5#dg X!(si'1_(nH8eSZ؉)> r4XfU&]y֏VazW"IOsqϡ, :פgT5 (.''!9:g:([t/JՑ~BjF?z IR+AF=Уj݀3P/yDw;X4](wm3zw^Z4O=gnхY_Q 5ÛJl}'x%J ZXm>5FU}HZzPp XB{sm&u:ԩX@"A뇩?S/ewۗo?83[HhvDQKND I(s{Vse\tStR 1>㥎ܞ3yriɵ:)fi=A|bu, (D# 3j50M%;>Joc\|1Xv׃sZD* j:ߡtdҦ!i")'rC' \IcLOj0x4w8a7&8v~$U޸om]d$R_`012UtMSE14#F ר"|G  yŌ|E*GՁ3ꇴ)˥~f8Uu~SOL&0]څ 7S}†3fАT3zN#;LG'e"1{hbew'14*ůۏ ܿ6 >?@ed#Y.Z(QC/~/l{@dFGTYbWq>7nh>eݒE&Fs%"I:74afOg Z\EOqa@Sg ۭESp1l:qFLRgM:ъl>1p'C\"8#_.#>ߔO7{E^gz%n iLNB!@j>j? I ~#-c@rAɓO&VS;\^#K?W\1֯h6mŠ1EAGYt@~p%klr47wF ,\ȕ*M(hXspW57σniVȂ&w l‚0%ITqcƱe3uG"32R;0FDuB BEyc $(u\ۈK@jC?XwB-\8!&&T'ƨo ]CƩZ-ZYSM?;lH>m#>.b{=Hՠk 4$#ёSnP-aV.OmrR̞0liN 8E{H$SyV#͕ (UWYR-yD_QoA$T~#ch߆rѦ߸)0pk܎ML*\8th9Q#$V$jNlj>z81=l-Y7d[>`kz(;,}|>yrŶDyƏ%B2ERZȠV)v^Pך CGZgQ pBhU'̭- X0h( `C^<:3sBd,עt3c+PkMRmiMqlR%KZ'%*ƙu7+3\BO?R_mR83+%#4"!pךW^$RjDJL SW(~ EQ3o:{A[A_K`ϺpOuV=^^q *~a15liH1'1rvό~RUC4вuKsSMҵZԔ}x#qxJ7͟JW mv{݅گJQQ_0U<.ykH\ 1V?y}n{z?B;%;8}Z]6U+l&y1)LFM[~\A!ЎA{M>5/?Qdst;hWH(ZKKP^GHze Dِ}lI͐g~"^{P3Q*×P"Pa智:EpouUODZϤQm -#?R/>?F*p9%?TI& ;_%1 |h@V"S]u.>3M"$7N(z>=BfYOZT`f*vV< Cfa'. qB*FnLUrqQzUhBTn|G}yߐLsRI٤ Z/{6/ P%9M;N- sVDb=Le d@{/ԑUsjJ՗Hl-{q^ׅb}iv3s\`,?fFDC&4x*AROVcEUX mFDbgwL dy}h ҢaifU;ey:FTt4֡e- Ov_p;bb-4\UV ()8+W]ρԲKP FćKEEl/[ ?\kcf*`(= RyYxa[Ŋ & 8v(r;U8ZxC>7VʝlcbVrSeMi\-ϰ| qXK.qoV7Ǩg"yͫv;w8r'si%ܨ#EgBBU&TU}w1Ck"bN92/Y2% g,ZoMs]*u3vH㋘cŹ!!rםs>A7ܾZis+jKjزU& Mȕ3?5ۍ)ijSC5M#Bɪ:*DgX)pwArs]a@u@OYy"&6ق T&,@3:0 [|Q1Z( QeD5uFP2 2uDּM|صguxH~&$b!8\5y,ӈ`  ;dTE׌&50n:׺D^n0p퓛{?#S>aI ZZ=yJ|d!L>kA&k`|دX!W"3 rGaW;l %BoSn*oR_ `p䵧XD ^eo/ ~]s&KU?]U-68YV`SCn5 1lyd̕|>?Q ^@OU56"S.opq$cq_/>R Y]ɴQbR2{f(1k̨pdT|٬=Mxj({fkj{C49E Z9ḐAP\M i[rBfUID4iՆ_H/e64b FrĴ.*/x.AԎTJ]qPdY!to%]rBd*ma 6=H'AstF2E 5Ai& Z ћ;KؚFAKvÚ:[yX`(ŭ[w,_~;C8RG֟DPj ڋoTq+.D(ZAk7su_ eͧ34!p:)O]MON4E1#OlIrU8O?p }@1:rU@Å |"E*f݉tT<{y%.FxfkΚYPɳ2.q}Bв"IK0eM} \dBEtZh~᪫> `^hֱ ''=5{@FYXA A`h K%se7^i$0bY DxSkqhNu*IT|*%Dr4v2yٕ:lw ~s;KwM ݬtY9\1tu6SI7o6ov] uS^m0-rOѠ`m Sؐ0yTT\XF0@E.b( fnNaڷ3:>"i 2sb a+QQ 7LI<*l+Ϸ.aaEu6K> MqQ'8%hc^<#TiL7w@ 0Oߎӵ,b2-t@H pm;S ."+?6w}f RNn}ԬA[t~$O;嘱ƙ [ :QDHeJ\'+3mQT258:H[@*7UZsCrHR *yUֺ/6(=%vD]`)gO=^6+zg)p4>F+`,xgǣ}!٥)ƣM$:f_J[H=.@c6FpކAvEXNjDAςT9Tqz&vPSB_w1Tî?,\C(5yPlGM['8~.qdv! Q k48, ~ƮPst@J;{@c)NuS *N;"VufwoI~pNVӏ; (SMЏ냂K)Qx6d$_>f+Q[7,Po!Z!*eUC?I.!oŌFRfFu)*w J(5@筲(ce4S{/ WA 貮1evDU27lv ,w(}z_,\z j9=| )YpU;n3Z$ODdRV١ucZq|X^\kgsM X%yh6+a7KEKؾ;-#6-zXn$,%CFlTAZZ1Fe!d g _'طdؽ˩Cy#ha@ńD;Nᦴ0Dj#;y2+OXK_W#ˢ1Zo0 ڹ_~~`Kd6+Y38ON$[Ґ%CbI ?Ǩ 41u(/2Ey@1BeF}|o?/0)dw /P:@ pe@*ho"c$aoؽ=NbFSl'0EWOD[/eY'(d9y ;;U\R0`h7%%Jµ  +"KfQD&@'v7,*j fģ;X1u\/%Np]_FOWp(L"Kţ6bIyMEk 966G'tjn 90!}̗'EqP<€Sza\81(2[l)]Ih…(ùq,21@xgl(JYq RK(?٘~l)}qva~Q^oE%tfЯ*R/'1eOfWO&.dqezV)k9w7JVaEDq˫NN;e-ƭѫq{k=otRHb>nn\T>F/) 1V)$$,CCzaCJs2q|Aeh&^ܶS J\nM^0% !}fd] @ ub\V>mCF;71pjfX.\rlEgl!a&kMR{dMvw5 i:T6L|?*壍ȅ_pG*DVΑ06]3 (|R֣ޙu+aZF[@+k}KM@N¨bY \3lRwy:u1:&,3>Tх4r L%,f>P-?1@W >]6?˙^ӸqTIB#YDztjF2E#.d,[իyXauca5 N{X O ვmWYW98SX#e{| Yelc<}Q hpcRxM-k5T2Thh3ds/Nuz"u9<*۹7 V3YsU_"E1aѸKpqpVAXQ-O*HJeT '@BfqJ9loKa.edqt~r:}p}3 җT[OCxK4TʉHqI- 8AŶm)d6#)q QWt.$>kB1MvkJZi{X3)D"Д"Vck9|5y[`c5ݾ5B;re2 e7kiRlܔ23w< qS`zy<6XQy>V±*k<BC3KO{sn($Fƌ,X zζc ^ -$b w{{!"$GU^űa20KՠWmO#oArV`].xdC ZVmVbb:%-̓}Uؤ|Ђm\)=@lpp+ 0 a.g/âI?"2~{,=i01y2BDt4S\Zrz}ʍ-8=|;5my-mNIq+nD,Je#ٺ^O[{DANYdAOqT+((]~&k}IJjSa4TҔmOꛋmXˌƒ[;._z! W8kEH ^! ha.,'` *Fĝdi$kfxr@$f\@ARj՛RLXqcPhFwNAQM1ĚHq|28S>c%\HLc97oV-"MKu]fHj5ۧlG|0 r$P-Ȃ鮨AB1̶3L)CɄ,ec}_EgZOd)AlZֆbvUs`UB\u]N(&@U`߰#:2SѽOe/2|+HVJ =^)kw€ 2k)9&yDM{vUM"͠t5\fS#&S,d mFI[4J4[K^7 5oiPDwĚE,ԗ7_YKyU[V7cT+(dy0;^01B Z 䄒a(H4($'g.BjF )G%l&o]6f˅vt~l0N^n5]Un`五Pheᨾx>E;$K\)6>  kJotҝV#,}<am [CgGz{=NZW^ظ[6ƪ^YZ A1D$( NfWsfcڌێc97o`Eڵ]tYȱ ˡ]/6GU㐜hDaWpro72 1 ꨣ͓DUTKeJ_|um2Z_3e?w$+%l 4sF:AO*\O.Yb\=7FWI`-BJjE!s.xT3bLstT,T9lH@ om/ LVN=#'PPWd/ x0wk9k M A˒=~ąP/EY H/kNZ!Z~P(;+ /ǝV,L &g<4ۺG{Z$C3򢃥1Zr@r{0q=Ar$dz=uY};ޕj(LDM݋.qJĆc^̯i9Oߖ/BPCoFܼnBmJup2yLQ]o1-b/{pM5 ~=>t=ůb;¾ rA(9(x$Z&I>jKU$IؖI}~>AM0@p.cM8~ߢӞv8d)8 "ݎ>8cjd|[{$5 `<^B!zaռKa+0$dﰔB?}mA9tL8i xhYi*#Ն1)6Eh--vF*^T}bi&ccLI=bb*1]Swc ;J昗upT!)NM[,盛aT-e;ǻ7 S~5VZ˷; 434g^^7}qu%6Ќ™ ;/8`jCE޵npRnHX۾Zm 9مa`jΤÔ*Þ&UXc RWs@ *" =]s}yz^~gQ8ŷ7o0Rؓϩ,\:.ăo'AV\ RqĠ0sz\^zsGzbs |@!@oq^g34TvR B0dÿ2o[-fqnbՙ3X T)W/XO+6Qķr6]YWdUrT'*_^ h0tT9Dg eDdŸlFxwDL2QeUaɑ~ ´GZȅ(=[BEp>wR{,X\r /LJ>6^ 2n:~߆H$ Q)zD嗏@N2q%7fA}ߕ- $+pXY*{ ],T]+(}N@3_vd[0u;=Kna5F4 V"Y CP]R"N(ۥs-*)D')K5LjCQgdڊF|m8Q,\0ai`mj@Iᙚ4:|2hQ#d%9;.3ZZꆏw!6o^mp j%/s3AR6kx%9!B,>~4"Tj+:<9eFӾW pU'r&i|ʃОOtZȰ 8ˡV骼m1 P>!*sS(1ҏ݋`+½IjLJP(_$ c F[{WON'ƚބ5trH],Ic_W(2=IKύYJ7tk-s?ػp UmlIr0>U=T7"sj CzuUО<+2+Ԓp2hWnoȴi܋̴w +ͺһ.gx=mzCchQN$ɒn \@7<5mE\7$к&)=Y M*6,&M%( gʤ8{A)%hLz̀g6gp|גֺ,_')'f,{yU!DSެ&ĜnWӠ6IE(RC oM7 N`nʿuqkt߅/d <*ٟ$C͏5fhڀ-f3{w4r-:QHi#6BEОJ<-Th"lWD|c-;RB 8uYfbD꼔oߔt}jL(X[SrYXB7<꺃6}>**3uH6AƊHNv  <8Ǧ)]m𑔮;\kH19)nPԩ#idE%mC͐[md!^r/ ;#GW1Y I@8Qoa%,4yLCs$N.iy`#T^b))Nj qߦ6ϴTl|Jح5tڵ^ZOY_נꭡo%X%x QHcXơ < 6)Doo`lxFexvZ ݝeIjh$KׄQ ",! d"{|pR;a*C}[X1Kǻ0s>hO^l+W:5_2U#iMhD,sDޝ%:^EkٽE;$Z|ͩsG6[ڳw6 z`}/25γO3,);Nʙɋ<b:3__#SwҩЮ51zu8Bs=_FTȉe̢q.#C2lмi\׻Bfkvy Z$h$ᵡW~LBB-c`yhXο`3@wJ> PvL[&`f d ij>R㣹SpeKc7w3L8X^lt֖?} Q[%EZM3Zk6V ;bxsIL,^Q!8D-rdDѯ)xNRRP_A#qԱul SmO=iɋI31@%w庒b0ogtݞ$二=KR}<}r4Q~9»!}䔣{LF[haWJiFhi"[NG#1-|9In\QOb3\ٚ71%XZrps$^'=U" R]jd#Sd(1cR O.YNUշSmXy"v̌6B`waIf0=Cw3<ƅOAZ^$N`WBM[i3f\ ӁZB!}0+qoqJSL_I !ny/\B q >Ә`~fơ=7~t6K XQzB|VJE6BF+!B/oE^m܌8NT=7ٵu[b*ZFz.eujJ)So"~%. Y 9`;!BRWU"R% *W_ <(JOyY8^&\8+-Ri`_ Ż {\d|ܾdT>t\ZÊ}ۜQ@'W:`-*zUZƢz6 6QGLbl(R[m4?݂rGXȯVy5$df AؽK8F@jE#ҒcZgʕƹϟ3 R;GC_Ո,`%wMfl0 ?w~e@DK#"v/=#{C=,(2mv/F[oZ#yPX.Ws@`Nu_s;'iqo:qO˒ P2ŸP nj`ɉfߊtKY.JeI0 #]85?NZ~N6-A3J?xK9`8TWJ%F+eD3Ҕz(A!#{"c6.K_\͞j=irjME7izPaE  gTނgI~o]G,+2;%WGq%T%?1gȢHb`YeOn"zv-,@8xTe;hNĠ2Ⱦè/[顓/qZv> 7 -=VVȞ] WzbE;?o6M_^}H. s \hQN{I.7Mc`Q<|z7#4N!ɴB&VfS+& ;ܿd1lx5Y(4+wmEP9Zibؘju8d7Or6^oon畎̴^=ZL0w+Ҽ%_Ir3<3/M#ffk֔{0Xm}M7j'3;+y8~7Po#}ʞ-ގ[^ d?u6Q\gY| F("tc;kG1#kl͵fKp`ALc0_LZ0͌ <K;fΑ3zĤ2/x?4  I1'!{Ү.7_f/cBnASW7 ] &v|35]Bqĝ<8dw["ǮQu ~3E~PG Y2d筳^6B `Iy½( KPEv*/T`͑U!)T_$r,ש.Ov'/ɛszMRfiZ5'w{(IDrQA0 Y<6yC/'-"JcIpq,.|pF{+j9m G'slYLo2[]tGek ??Kά׎-@]Ƙw]Oѷ:9a}?XJM\]q8rc}AFƅc{8`'M^bqb}G*-BGM yJGl[Cfe<)+ucZ'cFԆkw"-yPV럢)X"xӚM+*1[l@Y k`'A7>)s~L56!GO.S㱗4xO8㖈gQ+S,g?mjd!$ٽF|}Oϛ}-1)F0o8U(/5ѧ@ qTPLV|>-)vZ'8[CuNRƑ0''/Bzg$PW??o +G(!pDE e`qC6V `KYS:'䡭29H?(AVF ]`O]j=.]O59,3aqIaZ XQрw01]Ok45\-f.yxZt:XrDC]K&M㧀:=Qa ڭe#˲sy7uG1ۀ^I j}ANJV^7l0TDW g ϩ@ q6;&6X EcQ{fhsݬ`0FD%-',ߡ#S_؎];7M{k!8iBN <]hU;S$3RoG= qi/%չYN7n~ WI0i?NV>둪E#6$ 8rP둢B>9SJwS %-L<lᝢ7lk q-3vl+|j h}czZuRΤJ=K|Q@F %\n ſf{ b^b8#{nfЊRIӋk⦿nf5|z'6xj2262-X) r@M`n|cW;}XPmj$ 86Ymaglbhn!_Fh8aBF#g𽱼OFG<1v{p|°+U8>аe!0j"gQ >5cVIoH0'UI\yPtk#v]W 9Dw7(hf ')l+FM\*L.hbHg]Qug[wt sa5F>8"/dJ{dUH+\%Cř!dlMYN?0նcrJWbUJH!yYik|Ve8r(mPn״-[O )W1S;w\J!7?t>ᓽs=qҢ^YH[CRftߌVw4UB;'~-b ~lkVe,9{XA1a @ب~fD횬h GXBsV T{yܺ; mU?)> -m!Ho1$Ed`*Y6@8 E?'AH3`ҷ; QNR[C~wVk’> #ǕRݠ&^z,ِ&!9xEW8N!t2ъ1މ{S!~'*ӯ'ڀ̱H!6m$7;e&\azܐf@{WQ6^Y NɆ.tiLjYo_Ĵ{>ղ_} >ken_wxA=⬖4!]P7?dV_|ԟ"F`̙t9'uf휮KldZ#XIwPHOZ%|ގo4G^f+epȌi[>ނHR:뾘WAf-xМs11OFE!,BHQ0`Q 6B˗ofzSʒ<rKLǔn8Fa mÇ0Z<RJR^)+կl]l{/m1fwbk-BjD$§]6dFޤ} [<mtX)yXd Җ[Mz_B#_Gߐ1N˞x Xqd Sߑvqlbod !E-:u8DܥV}Yx_$V%t*X 약U-3b ^Gɧ=8f L4 oiϸ#m ?1LҊZ]/FYn&P>r҂En@R|A_ lvox7AJzU s}vE3awzhv&f$Q:E9sL{#?a-GG? y[[{-|Ĕ0(ą-py>ıA'^PEPz"2~RػKF+S \quq#G |zyBwuSfA;ALu??eDVG74a0ݡaR[PqI,HRF5} .d|37N}x+-jS?W ؄w6FŁ&-폠@$!c] ݏ?)! GX- Z]Wem 0q. ;Z9BXGۋ=<9L)DgӳYxZ:kxlYL$M(= v&yw#Z>J;g|1mmI?Fj%6JX7|;یZHil@[TZ ,=_'X|[yj?NPl4E h; SV+ ܮ1es9'†tXzmë;[,/ >I?^aRiN{(Z2Z`_;3bxKo wwzao&Qg{zj",n_((7" Ը:T D&y~Ѡ@//ݟ}OtL\~"72zǣ>VU+᪉vlSal͜KXЬL*/Qx٥3A߻#Sv"R!kyF{3׷LHY 1 B]l%?XoO2:3D^LtDxyK6Tn;hAUojZg{,\ɼ_5fRNYĬ -s`vFk1R?0u6 r-IyuiɌ7!b˹fz"PTv5[>gœW~;1zڳ-R="ڨkƽsɸأU2us_1F|!{'XNY₭2Ò2njɩ  Efi]9{0Z>c3%lUԆN{fQQ%Yrp1"zT %Rz_cd GfoR#$[+XT  =6I#/ݪEu#^lVOIȓ[qhj8LGQ)؎.wB@0T*'Β !\w٦I_2RBO:eSU:bx$4 H(N  ,Nf׎4va* 'Xc]?ݦ:&Jkk0m Gߴ{A*)+yZ^jwtTUDA=zK!0[&F "͈?1O;ށL%IU!0̚t湕dIRݒch܂fV.-3eS0Q"ó+Y+2H?4"w&f}* ~\ PX=óo͛p=c8!{`a Env@_?nHP{aG0)"N[&GV.zu.ohhJR]=U'8}֯ם ueiU`1'C؁d$7h 2~#9_a|:D<dSrǴ~MO~E40E̷e #k x&n5KcTbqTֻ2 jm(R4g lB8jirӞH\|! Yw‧.6a%j*ؽzRDzd9i+4 ayxXalAɥ ңE?\-yU; b[%3ETNxC̗ZeSdK:9D koe{`3l҈1Xχx,ѐ'RZp;D}yO|9XD/OS*k(٢ZxC*]u^#Zm|txe/ qd~}$5C" :Ese"z]t.,B@[%q5Wa@R [*6;߱jѥ1)R ibXnwJE-"rId#%e ]` 4&]VTV0o|q| }kh;lU%Pޭm9૟"\ ` LLxOOMi-@GUD8]rδ'KP卸K+K/֦ f ’rV}GwJėy_#QUson0zzjDY™2 (u0*ד+ẂlX+*_Prt={<¬ ƢѼIzZ_i\2{%,u91f> 34‚q/GL>9AS7߮V 鰬9rHަ!Ñ'g]!"?l+燦[Stx]`{f7W ySNI|Tㄩ8r~Ot]*4z~HynZ$ѹ\8jfS&$  !\%$J9R$+#@ȸ6_&T:O]F:Z8=tb F )elAFl.`c+˺ 3Y.;ZC!wgÁR^p54ܓGݟ9svf F4[N!cWU|FƭZQP_[ h|#i`ޱ RO5.?'>]Lk[a%=6qk'ǠN':S_ZVؔر-B ?k?wyfgI ѝdU4: Og;/G&Ět2(<#+TsڙaQQX:zZ~3#ژY8cخ{F==4㎟ȓQb5mLeZr=h쎠QHzuý|*"Y5}~%5w^845KZ%sU*lj ͺ5\w6†h?0U5Uʬ ~ɞ~wE0iR .G0+Jfzp.[* |1W<bUOO6TuXN}#6ϓo% "ľ\@"{T^'"6oVm.@NW:D́Ʒ5]g]mMŇS\QEU&d t | 1jyHS:~!Ro䷈.]#/ۤfWiEh_~-x&j<29"ֶWJq0KѿgCI0%7R4f3^RgB2d8 N^/Uț2>ad68V! $=m>k>8\)9,62qYl; /9sªJ-{܌ G+#кKgۥR GX1&i'`jɺpܢ! m鶑]L:a+i%Ec5|j+lЯKZ ]|, ;.e!T6H֋fbМZvW1y\mA"G{A~3.¥6Nk1(㿃_r,@L=xL9Nmѩ' ذS0qpe~9d ,f@)y7)Prp(LiyNnG93vwɝF1KH(^EHd?"bR#׽_1V2ۨ~<|Rl@֢xPa{y|\gօ$2winDMoaGBV)ᾔ]@b/O<QI [MHB,Æ ԳwP(&.-Fn0͍4RM)T??Z>.*rkC67f>ie-]mH |^Y騜';y`Ҹ`a3lXoXV"K"d mց>2IY-fZPyPdʇڬ>@ms>O`J~UhW'O5x1!GLCԦ8G ZpTa`Mʔc : _ޤy9@mUGyW$B%b%Rۗ_wה1fYwR9Զ3a]+ .}ou4f UJ}'~Bsk DPdĮ^#F\*G"W ֻasfYlCR4It(Y]15W0/.P{!7t1JoH6Q AK´H/sv ,(aQn;y~˸oWJ̀4!Lj~<-s #]-bqdʰ O*ahJ|* wie\"FR36dE}l(lә a7&is nɜ\i•w'9/ض /4x=uj1 ihXʁr$VtPlHtqO/?S`bڷz)׬l[yXui#9.Ө+ 8,d5ԗ 2ra>.}{*Lr hQKq&@tp!dn踎^Dj!2{L?45AZ ׶?l{9CكQٗ޷;q-#׆lˉba Փ%v"2{&v";{N%AR"Cs8 OI.uy֡ʽ%]IOs勚Df8e&H#hI+9oVޥm:(q R8q+O'VKZ =%6oy3(ozw=כ''ZG3}'/ f!_Ξan i <~UFȩ!@3\qHkF+-\.0s$w+K(1ˉ1PiWbtJZָI̊mdEyPc޴%4"wyb}*~aP+wt.ï*eH(DF5h ſ`CU qsA۱D @-K}Ua-;N?9: s2sԈ3ju tP]Etb5Y*$1]B/)vOW3N nG (L/h^"ؙpC@lQG'3o>؞e#䢊9r* >`tB+y)dZ'H! S-|OBD;>Ƭ7.bG$С$H%L TtvUE SԥͽOSϊ<.~@b#Y:Tvl = \?ͅO8^6S_&YҟM? '9:-K+>\Y& )A>|%]bP.bRIfNtLtA>> B \ES/Vܸl/nvr+oĝISHb8:ij,=! \y1f#ԗ|XE Ʋ.8m9 ӶFE͋Ի5aq@XtobVV'YT1JZvSˀOPFq9Z| 4Ҫ| Es(~#sFP\eg}wZhZ?{Hưv 2uQ{ t5yVk.戕qz?@57V]fWew``E_(Qo #S q!n*r"B{@6Dž2X+NNItUҷ#H=qDb^TఇDP<=?/ 怀{4W?ux12%?Ϝ'MHi(w\aiSם%QifpNj5e TӐ`aAon^Ԯv4֧3b4^ttPz@Q3ʇ)wvRTvψC\. yL_PyuqV*ݣ—ZD& ܮ^|JBaD s+gq/TbfˤJ\_ɚ[,9;R4ͤN% FknvౘR{(C"2fʈ;b=ZaVӽX pH㺢9,зmLρ)dJudxt,vSi;} `5} ;}%rJ]5Z;5L.}jGiK/s!Q}c I:?]}*z-TKJHC+f\6I4U#1샤l;/V~L a@A_<<]ʻ8H`7^FVg.*x'Bt Rc jI`1 F!P+QBM'x.iP[@;O,o7xgDQ>Ik4FmZY>vnL!2[UA#`-]hATXMS@;&~+nh &ϫxl+tOjDɽ'EقߢUoSC8)**,PC7|?J)U0 .[E;_hZ2n Ōg7Ư]{T,{)8Pd;AwYIwQ?z2Ol_MutaНKykeMJ_%uPdy -;cps1dr-IT$[ x`~xd5XTIw̉SuEOJ## y>XK^3[ u|f~攦 {G2Fރ=(q_WqykʺzQS)\)Y vRuq;~hh3TG%MqU%٩< ϞrW^u# >0KF Hi/tⱟ$$N`Z7 rz:+bY!׳ݓ?1k$pX(mM!ﾶm3<w.Z arך9wnxQë5 rgY '35.օD a9w{w*\ŏЍ1'AϠ@E#XTڏr#T^ΑV͙*7~"bIRa/ME`?bҲĩzd7c5Cjx14;FL_ Fc. ڸqh1TIޖ9D`a),{~n_ƿ6$æs-I.Gl+u϶d&ݟ^g<)/|\U D'#2ͽ\Sģ\dLob[ٟ%ֻ+C0'LATsqCG鴹7+yfYQ|&$:vUIDo( _=g8ddL8~:RJcvIƐ򳐈Nj¥1E{$24,r ;R$@Iz{XWkzbЁлڟiyQebď_~{sH]@͞7d]8$*oJ{ӳJ?{|e;.ù!ԙ6`51hx2$*H`yQVAe mI͛*ƎɺBG_ϊclY؁ SZHa49wA6J@v4HInǘbz(N Jxs:Iw!՛dKOsbRZ~iTJГD7'SwpױB7 ځ#,.$Gb̎]xpJJ5}0w>n1MK/޿ZM#\?2ܕhIluc.[h82i䯕Ώhpx(aJzvr pTFs-=j*$TVjt&6y X 5X'!I,0݌nj>}wY.#Zlym$֐3MaȀ{Ɣ>n7|&?V`0/0 Njt:l>*py ;'\?%㮤vXj$Xqݴ2roe M,߻n8KW5,'&°rQRão15 ^ _~Ew`Xs2lÐNkHqn݌E_K 8QkWscxg8Dhd8DtB43F QdLkȾt%k-3X />ZwR/8ErCJ2vq -)۞>6 -nm 5E݅T&2m=ဉJyMyS=:~vRm[CbXjģy=L&jS4b3_h4Т=P*F/')b}:XcIKydx)+ RZ9b 4d.KWrQ9 oXqoq+Y[W3Ad|;$읠xwRQ(٧+JJYsyT,U := X+27U"B+CkzA߬-u,xK}z&T4tNJld`㵚˱m wڈ[J MN,_[]3lzk:- པYV=q%a( ^ӥ%#e3Q`$7L1Bz& :H0لn68sgүOUls)۝IHD?vZB d*A~bTbSǞڍt@{.W2 fI( 9Tn`Y&W l-bl#X0jpӑ.@-7/P2Ҋ꼋A{Td/Ոծ-j'#"FmI23)\yFL3W9d6Sd2l8@4F~lQLXx!BݱL3ը* ;nɈnd/ވ҅KMz\Zն|W^%cI~Ϝ"<zdy Ip`;LkLUQظUXPći{enI\(r&` +II,6KH?-O s V:aĂa7fC>Oݽm$D*;4겲@J/.hږ^$'ym<~6@?PHZlS-G*=! T!`jfO̡)>w4Tn8~cb!IĕG\рO8 cE!T\~^Т`!< *jжݏʞEjZP-cp?>[.)NDVP >/7nv/ uΤsht2GB>PԷ{P LOp/> jUo¾]r@8xJ;x35T$Lo{^G"rgq*gFHO! S7!{VnmTÉ)\^? 2P |i`. iva܀d=5z{V-}aD׮*YjBA)! w"a Sb75_LG}?a33 dc顚"f`6>.#UJU.`LƗb'G =/.")iYzl"/ޏ\RT̯O5yj2XR g#L kXJt(Gp»$Ā#9KFv1RY|`*H RɤAJ h*V97קwc*F)STJ"oNH\+I]Ӑ"uB׎ 3 m/mR?A;ˇ#4|QjQcE<@ W,|/s>rTmazcOMyp1W{tŇ#)׺&+sC(5"cK?WOk KyԒ9d3b pբT/DoK b 4{.b8 9@(lsRNNZ84I7'5(^`CٹIđB̒t {3k\Nm ,U݌:GB\}6f*)G>q ofd40s?ɣ)sԳ/n?t}ɌPѼ㪶F [լD#L:[m_ ( )TK@}ecNŤkmv2֧S pAf,û C\K%&|} E3) vyXpMQ߶1vl#DtgKIA'>*dD@"cQ3ISR+a~,H-=Vޢ}0Z{Uk ŕT2B" M3$ @A0{_M . p?uWZb0E6Mo[B#'>bsܷqHMIY٬aj7*|$lH:^BoAD`9rR OEu <\a]~>2 -AiYd3ۥk}⏮Cm9~dȒQ}rp]BJ~sm$%Y=m4;w9պI(\Lި+0qSKTܴH3}#;V"@-6拦x+&Ł9B׋^h6/EH"H<FL-^n RݯJ䙲ڎG&WfskXӴyO[ \ht;Tf!!6W*\uo!;8Û|*@fv@{>x('rҁ,!#^\\teanB\A <_\l0$.P\Hw{ᇥBbP#Ԯ۠s?U#Ib;:g ^ *&^$wuqq$r/NG|1:ci8dHɬDٻ7Ty!2FoPYBD=o3WQJ ;6.}Y< vjc#n57Pa";l\!{ʵ7>7G<;<*xS/ngS7' r &U'a5)SIcmvX)Sl//1õ*529aN8%ۜKa NΤ8v->` n|6גZ/ 5dBF:RJыvp'ItV%rpSLG4]fo!Y<+'VۡQvdE,AEvs2FTm:SH YZYv}f'& T06v4 -F䞼4kced;"bT0%QRjLlC]R4B9yP47愄9m dIu'a qq~=FQw K]1p; i.w󏚀!;/r!0?q**VQ`9ⲍm#\MXOq a'â-I- jx)3#,Le\HY&8)vw@ 1L\՞G,5x)x1nVYLOTKM+<99&6)Ji-j/À6E,7E)__ 9Sy.b U ӄCJ 9|ggPFYv7\ L֍ƀT{,C&Ҧe=2^EKkMnM3֞mTr|j ./]w 8"fwٛ*lyq$ï `~޿[WRi-![ieYCm(<0ʄ'Ѱ#3J_+V27 G4•t{V>OgWjIWyf9~,2$Inugs53kA0@ZMcBx ¥̥a- C 1[H-7!m"UMޖ~)$ttH;ٓAܒBjd*lyoԪШ-a;|lpX(NoF<('ʼҼF=KͅXYp)%t6]𤚪c;~ݖz"I I %ꌛD)TuZ_І\Q^7輗LHށl;4+´TX,wu6$ٴY0א;:cXbIq.cOh na.uT;Eg3ۘ?D5^5 iѸH3| ոls kt%W).\T Ў|:)u.΢;_ykOY G49뎝lS܂G[zt ֡|n}8HJu5z0gdU_Um$ כRy|z9r&0˜3fSBE.~a(en#OJ޻fŦ*;k)Ȳڈ PMPD`Alj8X%y9laf=Ǎ)GemIL_B56)MJ;VJZhnTGAq S86i⃸ee \.&@Y.EkI}^g`uu' :bnx 7* r&iJ8!tuo#qr'=g@B[oӎRЬx[rHi+ U{F697st=p!6b22BJ'* Z &*ËHX8$%bIBGE~SJ.Ŏ 7Ifi hawLz$H)IcY 4y^d:PճxCvZ~$://cv-w~H>D_fTMdoDHBx]DaRME²}>y dh3'y !4cE};|Ƞ6f?X)  8VkN\dgiGetmB&&kݼJ1Զ⮜$[ݑ|6EE/  )0g"c*z}e Lpol#R2ƍxU$%.b(s5UykN,)ܹڤd("kSI"KNIً#vmhWYf(T$ e`)ehFmF=эZ$5љU Ʃ~ r|j$iHV0[S#|S5{1jGy#ʑ[Q'tZ-] RY&O)3Jҡ ߨ?ѓk yo2&cPA%)0YBfb<.ϦI掟{2VZ$q> *8s睆n `rΎ.npGVf,R@.E$7k{f"@us$.+G) g$IHl?2KtG' |h>-"#C/ KѹæfE+MX~FiDLxږ:STd͹w9zYTтu .e>XpV׬_L*FF`or !(^FT95e ΆklBN7'g< !أt&G׍+R;.x$IS<NCg[Gw*(D/3v[<{].J#83MZFTl4QYI4/I7Txgreyƃ%^'oN"ZY$wlrjzr~Smsg3pM`ͅv!ϴJYsj4*,ۀtr {N"H>ak!N?TQ1աՊ9 z{^ʛ%._JT@3W* "tpPXf=רcQIّGNSÌC5orJ8ʄdEէJ'Cq/8AwHx+ihgm#Ŵkȹ+TEѱtW Sw5/v4陝=VjAT<@8i\xח`G{>e?Ԛc~!~B٫K>%L8iTˆx.)33}TNC@{z^ibŤϾ]U YpB["GUi"f(F^3&ȖÍIRڹO! @:^Хω|^ a9ތ/Su;1t\#ߣ)}[)7t] {@%y+ݑ7k)^]aX\υ5)okfQUpt#T xg"|Ǹ8Ŧ_e*.<|3wW)A)i'qUܝrqݿ4$WC޿1 DLZe;_7TS:BrhfiDD R+߆'g/Oz*,#@:F<=MB@>#dPDŽum[g1 > (;Fv)@ҝ$BZ8ү+DJ[X 3^tx ^^7}='o:vB 6M670"01LZjf9p@StEtH>c\n/qװ;VW 1\Qܤj&"Yp+̔NAdvkTm aNs'9_I}"}N,YOA_MqߣͦBHYvSɓ"*5T Jo [(BB=4{I/Hkxe_~ϛF,,ט@D`^H#+\{dޕn}smJN΁-6@glCɇ M|t"wsD&NF+!ɑW!75h~K/X&⇻{0Q9R}rNZ(A2\j1oUn+%,IyVm|:EnT ƢӧLJ_d<і$B!s Aӊ{P#W6E8yJUv\e@T^E3rh*+ =g)4ۺ̙Մ#xbT+Y<ƛ&;kD7̃[3P Cc^HR{*TaDȊAj4 ~ͱۣ= B m J#]n<=۶ b2%Vw%=Ɍm:ۃE nK;gNՊ eN6%Pb~3L;/*eUhd ,HDZ,׋`'ǧqQޖ ܩudMX91a ,wW8?t6M^ĩ\.y1O,usm +wzK _(dϊ$ >)h=&m@834 7R *37\O8 hl%Sl$Sup! V=bZ{=Fu^'1oabФ{oFXBw XҼ'9ʩwmJ 3[im X e&B6؛ls6g̡j#'L7ܺ3zum烥+mԐeN[jҡ6}&3Vbezxw1 :)u%_ #coML+ |O4Nu5'967TKIH 㠘3!1`k0{~nkԖ\.kG-3Kd"%ek֠݇+EGjNU+5^5zAm(sUxlFV:WZp?k?28Hh Uc$03 lũ:SZ&<XoᷯyPPi.{/Zlij6OfQ9P-#$m;7z>Ez1ݨJ+ۯ8)@Nx˦#;¯'G6W3=(:)B(4y_(/(x{prcrN0}{&߅Wnoj#JvǢqgε~$>gj,HJ F2 IL͙-+dNP]+/Cޓ !vXOҳ[Rx~%e3s8 *ٶGDdWB"wIA"n]Xl\Ζ4vm~yH\$v^@špH|+LMܥ^OՏ\ȰY7Iv 2T%M;a1%VgloF>{gcMC,U<ܛٹ{gjtuiwQY{rYvU|>ҽ)uz?(+.[' h N[Gi[LM]߰KMQB R7Q5.#GN&IƱ@ĭ6 X0;u:(UFG{ILM_o@=<<2)lxN9"&%XB8ճM$% 7 ZRM^+qwzxБN(vz="*^s_oN6UgE)CqZ{gs1ҥħ"ПY%^sH3ؿDwz@a`c)ěM2},?Cx,m'& _BAE?v,6Td HKM ;C fObJɁX- W@@FSx2dJ6Rg`3}azwt{o`{K]YR)*B=M %k$8/}ФRLw<'&= uҕZ&gt:uŸq9*_o̶&GăW"!֯QJ5 (s\>zqzGP# #עN g\)f胺TShj|rȨ].^aȹȍGp4 F7.g.(*- K9Su2 ڡj<k?+H;5`]*;` V^{3+cG H;Myma22N ôp$^$\kcwVvt~dH6_TrllPpe2ܖҡ pXuXzx" l͏Eˊ=@FZ&t*!Y/2mRv0ߑl)S _avJ)l3o; /uJqgRΖrWu\;_\.vaw4K? "ȱSջx }>A0 8fffܮ7%=!xfgŸڶ Of -GY^$j}w} 0V9Ci `k3(„\E%djx"1O`xWPo cD"c kU'>SN@݋Hiݭu-[ۀtES F>FyW-@|K8rw^$=(Q.d@cTX֣Feנd#-NEk8,]G#t_CќU=q}`+1ʹqlo g?@g?9҇sXgG5+7Cb߯C .eP?s͞&B]:~-l¹}ˤSUE3βo7% b@%H>~u<2#,>%7Gym) kߕ`rEߙy`ላu9Mس7o2=ڷL8:xB 4 l ?4PPf狟0OkjU_@?MCfub'SeL?fȣ +L0\^0ىt=1,;+3bɾhE -{#TK^:&4POz@A^B:R,<)NWC+xD+~$+c=HD&$dT'rS#hiwq!$͎C!AI5`] lYW^:06R]5D#$ F#ԃ?cJcW_(sA?ax8ztq'GKLZ34۠ZuJIbB:9\v*i1v|F [?>0} ̥7xϱ;B>oէ wYS烄-=#t l1֒Pu2U %o8v$Ot(7U;mg03Dm`BP_=j2T>!M@1Ena@)+4G#ߣ؋ζexTTmg$k~t2nRAV0nY#Z֔dY*ߥf9V.D FFV6* »C]{ˊ7lY;@iObYeo(ŏUXkPdxQB᎗־- <&_[i.`˄ϯD᩻6dKIjC.oԷҋ$.OfE}. |_6 "8B&uS[PPKX8[Fd;ϡݪ],~ 9؃}{DC}+0V}!IFMv%INAX3q/ӬG_=K c,2{-8ҲxPVרjN310UG;uۯf/41S33u A~JXm{rMcu"l*8(V½ab6fVZP#: Ysc(\LϊitLX ٸTeciJC^ҫD g,TGutpʞIbPaִ?b6ؕ{B`3)ؒ4Z G%܆=Z uAI<蛏_:B2Ю\Ɋ"ۭpúPޛ@쩾:`xGZTU ]LXMlvG(AoT1 w)FNut-|b& }GGqsnS?"(En#={s*FEd3x7<+M{Ջ?n /?rX$y}7&u? 4TtbFhYYI긘w9 lt6aU<1h_ $f`q,z6b!ơ)kh*Np`ْYdc=S܃3ΚuG% 1a E΢XQlRAT/}ӟ)=>` l*|mQ^a[Ãn\=>!>R ['_vM ɯ`FvC7Q mۇz4ՏQ9L5 }=YG-B{ lP[g8 TЃeTLQzxjׄ9jj'1WltOqߋUf\SA]lV3i`R]C ɤvv㗫3?w`チ+ F®\ԝ{5*? uduNEgn:\WoωC.8}j6n{YͲaZ*W 怊m?kVWbZ>B]*j}?Ƅzt9Z<%їIva6/~-LvjޗR@sY(qhO EW!9_fªny(hA'ܐc c]4zO-Sso8l4_XrϚSWo!q ,y4emeTc ǘ.LaAFC.6 ~2ra\rM&|[`|I?M_M}'w˸L>\`{qYGH1yq©Z@_( L٪7/K vofC=n!TGUF v(H'_jV9m7L#^@ !i.%24H?d\ .$]0Xku‚"Dʴڒ@RRCq{PxaEG!EqC4-LA8D6oF} ±*ӞQö} DʽǸ=nً^i_vX0ZXt9ř |Bdq'W5^㵇F 2?b4s,xoTkv3>I jgkP Efc)2A,JC[$IaU p=-(1_%w +i4BDǛ?a)L 0 ZHĜm8ɩ2~^${6bWXPC#m@ݦnC[AXCQo|}9Iǧ[ޞ:kꨃLHx$2ǿi1q߬-{R|[ՎP[T9c>cZ^}fQ"082hP @#\ry~fF;U6i61@?ưkXP/ g3Vߩ!@+_s+B`[j٧469%\>&Qs@U< O* z=YE0Ky+2an46c@0α~A%K⊒uwlJLE_iFLrA^^]5% iV3w*5Y|M#*ٝۜFxC:F3u2'! ~SH\4aЀ2B܌w|-h >\G!v䛂dT G >ڃ"`}76%P K a8$\ 1yeB꬝`xPՙQgΰdz3Ԧ7?跀f.E:wpf_f:Ե ۻlSW|O{\Qtᨛpd篩ɵ:uɳ})ԶDzg)\bϓZ|;Ȱ(]ދCgS\Ny[]7,aUz"JO8{LfnKHlQ:[70wG>y`(m"t`<0/hMGIp<%3 \+jg./TTwXK&YY&3B:([ =7,oceiW,zf󣁓.k_S׌ppſ*X1,wdlT>(6Eb_VE9:26kBV8-݆~WFaM*/Uf{= wSa[uy8$УHEabkron{_*5:G8OnNC6uSY \` Է8!ZܱU?]_P-D{(.cY'ƙʧ6koEuEh!qX}!_%;Lxjvה6+hKʜ@j%ki=*+G'Q|ҳ&WM)Yh(Ƚƍ)ox#Dk[3D;9õkG,/e9Æ)![(!y&8'͸ן6AXp}9Wcق)D}tMkyr-` ?N 2Ow< EssԳj1ruuu&(e %;֭:LD\ب\r)CG0C4zUEzUYMzB'y#޸Wq^4=M/lQn^5jO`RbLƣ+ ]8R(,Rj- ,Vh w"}eml3\AǦc:qJch䊳[WcbͿ0<4[ Â%qox).3+6VEX3# Hrd|6!@mZjw s<0 ˳T K |IIesA/IL3\ b9a.$"_?҃3M؉]T UN=0oQ@Ml:"nFwGR|D1:5bt91&1>6^K@wh](@CpTkcC 'fk{YCHUۙ&>ٲ[lspPلC69g L]֠^ή^?.͠CQN>%3'?HXjoz܍]kCX~0 'uϭE∎|npQ.\Å_T?¥9j{SnrΖ#E Y \ 2gv=:f^oxM;VS̄jOtlS&Ca9-q'tn0RA;,.fHa5`Jo}Cy *wh2!59D,nQAbcufBqh+ksJ:8hWY⟪.ꩴQ@~p.P~"T"P1I%ƎS7HT<7F P)J:fN!96Rlg㘢`iB<Yٖ-a hFO9Lbm+(W&u7kWi }E+e `ܩ)Ŝ+앦>*9쾎q=tܬ>VACdq~`&aplglC!^enZT6y]ɧqB7<3K#wqyyu KTCLN"|*_ݸh`'̆&]wiB}#oՙcC;Mʟ(w98Y>DDx;tJ+F& GQŲ:Id@J!xt3=6= [W$(ؓ&7"ˍeʊd2?Kkҡ_F&d[ʱ;r\C ?AR?HfVy>|`~>-[|pXܯߙR;}׏sZr&RWK7NSl}SD\.Q %s̫mZCXc PM?:}"8)V:^Pp K&+D[i>߲a߭G!*yc,?"L`Pv9ELzH۹yK`0/**djh+e]jwa,fR`#ڮUHqffT>` J@`{U@Վ,9uD-*%C3P[9_6zp).&hrZ0^v ͕p^jwBxq nn[ s5^EoC/#'6NyMN>'ޔ!Ĭ_@@.DAnِar=ڧn?m a$di3Fw%K " 9t?6dJ؊Ԉ OQEnn ݱ醜I!nxJJ$BC_&P7QhL莖֤QԶ{G$a!Qvd(:.)6?>:8Du䖳AUӧVB`j7Ȓ?`@u|_]9\Fb.ѷ{$)oY;UЬ>#qS2tͯB爜hz H_M!bӂ#oblO4qlM/4DomE~4o c {呿V)pm|ISE<|J/iޅ3s|9@yV'Y2rǴ)H~jp;X#YK-BsqI˵Ώ|3]V]P'+"0iւE= W<R\i=rNz+ō2RT Bz:(Cx0 z?/7do >؏# 6jjz0Eyv|v0qOؙ͓ y_wi#!Q״f57J7_eM u=ګ{i &@$e[Iځk'7NVK{Ib~V j7y{%3S k ܄cqѯ3lNvu~Ipa{am(_CHOaD kr"rώ7ܑ@!}uO /8y7G MfWv;DMy]8ɺG7.DOlzy5Xj2Lr_|~SHo{$]5tsH!Ozf0h}ɮ$AYd9Tv.F5O>NسBl~9HIa 獑lb5uLn ^wU`;3'R[0+'RYH12ry r^2zt]"C[i\ ڬ( k*3oJGsEW#fhJ=h?֧a5Lm,T2-0bR(MȯPw^P釯<#lbZfRdUeIKmKF O~he ڛ ƈq[WC\i/I" 7^WGpXV$Yo̐ %J(G.L/1U!NEFQ B7L*@N4EUɄ]a DZ_:ާBI[$YU[:`^,@kl9NfXZ ȭ"1Ȩ8Cc"1_^+JՀܭ }b͉Hy344 K@[TN؇ڔ*uyCdrX|mshC5#-5 ;27bҪm+DUn̶(>WȪ XB.;68 Jks L `w3+=cn6-RrMa|#z{ɩOC@*[Lp |E{=S\~5fCpg)Ee }95 "csVśZ9jf%ۂH$Gh+Ҵfd;:7KK<vE;r5*K= kk$:p5L~ kHWMCJM54쀦3&>۴m8]ErC$woT#Hגju2a5l_ҞA&$=>gv\,\Qv$BPy tj}xD!ȨX6 Nkb\42n@>#1=O;nW>?APAlI@zrVCŌ:ʇ%nY'~nL'ryG6ckU,Ajl}86_a[RƿXeM9Vf#5v.:anRk&8 e: IAHS崫0bׂg HlpyjT5*:Ͼ>҈Y:b]?XƄDCźmLi zBU >:;tO./ +yDMtF(|b!=xyS4o”$h -sΜ]A2+@F..k׳qZqK{ ɓԶgt?+sS4; 4S9NqO ^`͑ɦC#&.2mv|:lGQAɥ0%%9t:4!J)'g߻é;W5@H/>_׫Z%5@0yaɵn_j0J23Xa/(ٺE[co6?-kǦ+6\Fa%w K`D "8#Y%5={tP*M|>HV)+BxrA,߶1لA`êD +z?jS#_u>oVOGb/҆ at8(e_ӝbNM×HS,Sl''[XЭmQF7&œBfad^]BΔbiG%#׭1#31-[<Nݭ{=F9@@^1N++8$KSIX@xO̥˕:}MNF rj0.Ϝ:nV;*gK͕lEea=QV>9ml)dJjb4@k̂/C/aoWo7LC}tƣQ 7]Q1b~ ңL4 `E'ԁ晃 @JH -r=~@[=Xs_w"e {y/)M+ ۷lGm_ IQu- .١2S@,#F% U|%m@6Z9t.z2ƥv^߅ )x,"/4qaL,4gf' voYo FEd'\!=_T䠔jJr/:P@D-t3fk #ת/h;LS. պoi*䛷%v{2S,fDyfyk)H^ޘN&yvjo#,BRRܒ2-K껬nRt$(1oS.E8gd [e;L)=@nhv9kkw[0@ ׅۤN=4|;p*CxB+JamT*@jAs^k&a5!'!FgE~r7 J=Y\yBeP~b ;,-VT L`;& rpīW)ЌcX=LRF}FV#=#ڞO$kWr3P<-5@mnW’'_,as}.pb( ,W&TVW;+ԑ묵8 cdV1va"|?[]62D03nOZ!<`bٵ-Εb3zE Է(e`9ym\g$alëvQ&c0/TgtOKaF36[Lqڴ8-i  !杮_AU,C0'ұUS/Max2[HzmxYOIVqPi.fW.zS\̯GXkIlBUhsKbܱua⟞g(m5򍈆{5?;EN 3?w0j`.l}4#T$JY{%N{ns1WRB iEq$g"l;73&J2vg5 n*5ԮX,E:B)4H+數2_˿^cVFzٹ1 JnS7TK01yOARHb S;zmH-&9r;jcwU /g:Ypj[INLe:Q٬)+m}Mj X(`2'Id=1 ! :H>/w1f|*5RvMi^NW{~/{۠B1W*Av2\pA:BU xlY:u{ڸ- i9t:n1&,tW-YB _RW c&NIG{X}$B6vRDKe!A@のU&;Ί0t!*YVYV!A5Xi3G& &7{ Kʪ(j{%Ư%-9f3hԺ -)(}n׍U:j/cuzh[h"7 '!joDy3&ˤ4]2b>NJW{Miכe<shՂ^uw{w f@*,tI-=*V@vr+COl SZQ;WRʢ{Q~96CmWů%ATXP&m0$,K%-pÙxB;|a.P~+p&;O;'K{s!Ni*I܉#YDscQvE9 <4mWM[ \1 -uI7x͐Prj;@ ,/MNS!ˑ> cgƿ%瑪wVc+vKT m_ѷ $OhNk bI8?`hAP9y 4$&I  ItZǶoONTڗM5!IGwZz. KU1T?MHx@BNY2PzL\'؎F, VM-X+#Om|28EP IjIWrv&Tg6|=zu>92X<ԓyUpc؊@!4[ R"yL?%M-Fj9^ 9XH LV@.0ktr3?m u"lК f"7aTt5Bn8A)5Viϕ24Q۲+t#t鑱QXR7+>klZpbjTieQCKDZ#*M !v+Vo|@1H1ta mm e–%'/b!x" 7#ܺ +M=˭$+;aھȑč|Ks)c)֢/C j(=!0̿-vߒal-,)snM dV,7*sfPʌw$}&\"BBDPC%;)|pJ,л h/999\P1nI ZxXl ݗ &N\54*dg2`3ɼƞچW/}w)PI3I0жI6& `hš鯴8]}߄!j)t58f!9I HCT0,V|E~|\겆Wvԃ ^*dKF61 <7j*o՞(Òc '#"dUUhfgA)eQ}Ut8'5io [ e852\rE^[|* RY6(mҥ]`0~LjEI1[_WE+X򅃊ܚlgg8k̒\dKG9K^U-+k ZOn#87MG+X aDϡdoY."-;;"?[i:735/QM4pP_UZ影,i#> Ud)VHc9CR`J 5M0M*A./ AqJߘy~.]2;Н\y 1Gmj`U2$h~F."Ŀ9ׂvu?ޥe`;Vg$rg=c5`˧KZ*b"?I yy&_z[+h[ |WNl`3TK2n'Ú:W1iQjnp$xW^MSiUel垳`f R^gX<֣ A0};K麮mU*93 lW86z&`sY7gߧ0$@j>O1WzN:O4ŋn䵓$:)i*t$ڮš+!dAXar4kmi kofab)ej\t؀ʈH(<¿92QA=u `B ;~г)G:73esUmJ/®{$t4 dܪtäl7JilKf1Bx,,Ca9a!oDFU!0BV-03=Dc!&[11 A5!ŇimK(啇lG0Q*jqqkWesLShYq#dI66S|[MZ\MLLײ u\`Y"7.T ~/ ݠ#j<:k/31qvj^d_Y!f$8wYDWmϹC`,RK՞B H⧟a;K_~ nd, :N4|p>|Yi)c03=P*~GCr.M+mw C2HMeɽVQ6jK`8al"N~LXg!E\/ fJdrgF#E`v2,Y1f#^ Dm;ckUH5덎u)֏hΊoڽM59_腚F+ipv !7ATP?؀;,㻩=]rr*dml0*}uzRbX|Fߓ/C>KV괝C.}ʃgִ Is/a)o={T!\*xGG( ,  N>~p#wΑ~#%V!a;v+vyYL`0{Di{:Ԋ  f=k JWi, N-f naH /Zr Q ?e7Ƚ+&Ν*)o"fGǮe=yg@bfx$h+YdXt2Aq6#qPqdQ7%9:ԁZFR0L'zsd) HgyJn=h&aS޶;7fUR GWioX_>I@66/x!ִ c4uWFW/7߶R``B wMϧyN{ ϹO gqĮϫ8-gEt`' :\?u_B*$h0[ܟzHӈ"9Ӂf@1=-'5O* -Sκ/,-Et4 c+{LCT4epϰ GuYW}pw֘%`w*7{'X YxO rH$oGX?گ3K׍}M/FYZC)brpBdFu4 pxU?}=Pb$B*sS>yPv_c>2*{V,\% Jޖ|0* fUh9 3T&)f uC>~ㆼߋ`HǵU݇En 0e0VPM2W;2^VA`Xƒv'sQ2K #ځq&ة Ɨ_x}qNz)6&3x( ?ۇt7OU/(.g% ׉Q_{OASӷkIբ$aU3 bsx|dVlDl0{x.NӏQj:.+DΤBmT;@1rxh_@`TkB$LŚSȿV&ܡWpz=ebLW^LAI/Ϊ~by7>vX-mvzgC_> EV30NrHtF7*ǷRf>$U/I-K!1 rSdV]%}"҄弖:?L :s({׊>OOJ>S1(\|eKMna|^#(l0a|bWmXl"R·Gu(0TySgӡ0 &+$Q*l9%:+8pxHnk=2~Ry } #46?$x'ϪW*&o'NS4f`ĖJ1n9=޶c3(>nF[oYa&p nki;4˯%bd%>wjFh 5ܺAZ^QthjpO80dCs%ZPei|kݧqX.D~5-% 4% eH[W^RҞe;ul9#W-ӝ[Z [)i$n*KpxĐ9wZ,W4X'μ4'LK|gћX)"z>NdV OŶ(y4"J"vG:ޗ:% -UeŀSp?(;pc_P4fkJLې"<ݯ(O$%HQ>cn;14:CK=4~l1^&6yY[FYwMh. A TQ~Òc8gLݜJ1oͳC_xvɸs (B٥t+/qkY1 W`.гM_.ngE 3bN۰:fU.S)مAIsoQC2:s [w}֐Y,]9 q ܬ-",hl4L9A }Ys3DiGD\iE\ӡeost6;6ͩ]u=+)4ULċAE:-c7$M,qezx%Ɂc2J*,uu[:-3Vc>4p[:"}tktb% .)r.7!+Q ;:dz)k<~VM;oaz:=C`GZ~TmF6b@ No?Y>PH~2 :}3P++aO`\۲@$Dũ ?34' LWSXAa[]9bDB$:$rc5kϹM^~fNf4َX46S6=/|Q{랞,\ 9W-up <؁"Ј;\WBgi\(sɡzd֨4\A|Kg_[fy5d.Q]n8AA03 O; *>>`em0Te!*:62|,A#{ǩ#/oU'{W~Dq_ KǍh4.ӈgD:u I-D$뚉\YN\ٍ 9_%t %- t?~WEٝT[,*v :4[O e'm: 2bg_b੦@訬Ke&2F Z 9swXLG*)+tB"uHWy K'|r~j*9VLӍZϳVceR `ɦ:c ofWIZCn5<Q'&*G+'Jjj i._͇ hҘ6Zqb-l]2&JjTҘkA+93D~tD4w,1зAҍW9lr/ý`8@ܩx(;bzt?o]`cK~SLK$3n^묚NOl!?S=J4[mͮ\?R>PH6yl]ɹ0S>ehyᠭ>wvIzBrɥag ʝtP~#96M_OHǑ4!M{"& ?65p00d6``U?n+EJ&-1v:aB؍DCpf3EݛEAYi2j!,+9k>c<ݺo)$ڂ1uI1"3>?oq$ 2Djjq',6gI_l_:^+\f] 9hoXpZN,MY[hf8 m"UK ŵ4SBFu=$!fhlPêT aHK}V^ol)1p1װ,O=XgqA J &,A쵐UVn( ~قT*K NsHS&S+b([xpt-XX0%]hp{vlZS#8 בCbN͔ZIDlQu֒([GB7>!^2>V$,iߪ~;gs:b`B7O3҂8՟o,wg 7Yu[j$ (Ǚ"m6է.?%{V1M Pc㵵|>N<]JLkᠬ ݭDk2pcZ̥9F)/Ҭ1 [UK5I^&BȜۏPQ"#uvu8ÜOGd8_\:K1R~3(7ta5*FCr噺Teb38 R\)34dxݝ]-"_&ּp AB8>>+Ѐs{&iRJřY(rz2T|8$5D[l ؐUd8ӿ +(ϔu璌F.Sjr0Li[s w#Wvo ѕNg` npdQFQ  ϨgagvO98n!,?5"~޿\`C-%^I]O}q:q8?sBWD)q$3%6u|F&Y`S[y  %ZD7֬3]@ڒBs9?9C?!HVS;]lȹV~ AM ;/dnLVը. %CWf슚Dh cJQU#UZӯJ<}(P 毿FS3ZZTIl p_c8C ~DCr1.MR#knTDDuch8n=_>~G1wCi:]xhBE!`wcȖks܅?#y8nKN-0n!@&H+, >d!i\/RRٲߴ+ R?zf?OlmU|I'.V?U: ?l%$th Q$Xp<=TXGmkr)fyI؂>}0R Rg\9 /lԊUdV%GY󷏢,Sh4(/y |ȔB:j",vRQ[,ҔDqkkl14:hy^JJ0Y*7 NԍE-2@N KD6Wwz*b;+#iNCLIYɛ'Âp5X x0u d;a{C24IN=Ո珵( ?-X7u™3V|]Ky @-‘?Jv⾂;~90HmO7 Vf>?$=p,8 Pb:Ӛ=x̳Զ`Zy!Y$7gە/*EfR so'B=HLɮ}JΖW;QE(T{_2C6r??@m_+n`3i }lњÛQ&Q"bV}KW~סfD\n c5q8:!oK.T<.Jr#R>Fa6NXJUMV:#C] zWng?E,jYgz&F%^>'!L ˤ!Y4)ixkcu89t NǀWs@-O@v̄wexi]DS]{Q{ͩO I̟$9I,aiQGKҼ=jC̘Xoa^"ߖTmDT}uj5yQ a&Y~ @#$%H# ~{ȇ&Urlhb!N1|1}\RnCN- 0֔"f^IVf[UY{7UOY$?] +.L4۴Fa@(i>;_b/<Il fY #B T|b3rYKrAk_#w |[̓Iw\TY:e3ӿ |RJg'iNagR -ݽ37jmo?٣8MezxdϜ;#FDg+9Z I`&l(M dmrNS'r9}Huh.l06)Sq|Wa6fjaƬws;J)t Py&?Fsuk`8:R9=}N4 HSF񁿰=;sa 9S;S+Ě :wHNiGF$T'H4H1:ڽ J%ZnMN#ORrbu}W'*I71wNG]xv+~ ѠeiiVey88wj#? a`ALO9ݛ"h"˾U}a ]VѰoN:5f@v>A'>}aϭc6;}n$xe*Ld 8&x 1d(iVg6$"h#fw+99FC S FsR= Ry~ޯhZHZikI5'SLB7\;[ioUi2)/! Ėv3-Ѯa7ZXO 4TQjRRct, #IQwp^xog&*eq1'8gax hczEŻR3 Zw492fUoZ&O_%+Vbg-!HD4}g얺?b15UV#nQf 5K^ϩNn֚XJ:e(f\GY9fWv;aݬEo'0x)^9e@x!)ȓkAy1 {VϞ=N͑Av4L*mA=q;L^}ْrilMw$! [+˂+?Kuf9xY&tRrVz Ob(){R.pVA&{q )rb/! ?E7$h,+"ڹOP XEzG2'fLE[)"/mfsq[f>NN%яroE1Ep-.,?^L ֺGj \SA&B rg7,&v:MhƤRfM&*AQTaRE zF kae$'Р9^hڦwL' zx?\+D.KU-K4mYܣ'\ZfVɶdD5% &onymcS:BOXFH27go m%tX^*ΐfCB Su ˅N|_Le1k8g!޻upܹ|5!9?1CM_w9VumrWc wŞժ^B4{PijHi :H5֟;#~`A|=E[sI5W;s\H4FCd7HvA=Mliޘh3@zϱTFfa\vݍm̰VmOQcf.aItqs!k %n6>+wyŚ7x#*DL)&Zu;l5qٗ^q-M&ˑ2N%P9^Pם/!Tt +9(3#q' .Ŷ_i"-zeGc7dR%|&Ȋ4AW-O!,Qy h+es >K!_V `m T5^S0fJ4b:$wjL/2b- \!˾MU4\]lϢS2<s,u`/ ]vkYdub(us(382,Br?u8B0m'Ǖ$o! tG]~ ],s!=F)z7)-5O8b6 :#[,ťHw|%X[y zaT\}v6Sgh3o?Z[0HʑӺru]T,q1Pp]ǢKYq}Iu!v;loa't?sy Hn pDK ,P!p[wq G\Fz+U)@6̗m nW6(7ϐV-g5)aWfM_ _뾨ٝ[ Ɩ)LPˆÅ|.@gQ9R! n{(9ar)>ϊ7&o C3|Y007G&ЃMlHg9f@.* x@gOTCj<=E},W|i*x<K(Uu_WG1#,`F!r= xY8ؙ&Kp)++8=u8|YA `5+Qiu } S3m(\ ).ۭt?1"ɀӼdR4/6*rmQO{Xl7=MpNԑ-..B!.hMk$D~l%2i9<51FoscY6? (FYp! dF"_i%nēi]bqT&Qpii不;/@&/F`40? J ScG:kp Y$K "N^jRs_+άMxs7b}*i%)}z^[$S(7CWSt|5MoS-&ޥP$FfSHR*1E<W<>V(PxS#_ɀ#P=} 2S u$|-.,1ps~w~Qy"7m/6d/ž-"g 3N! i nU~.- ғ^ Roc⨘ڗ'JΉl{oP'p3E+OU%BvY_3 >|´tO\-m!dR]*,h - fP)j≾$8܉:U_GTb^sܴT:+s`h6Ip K43шY1z{ g|\ƁlvE G8S \m$T" hk_r0BiRFkUɓDP%:2)TwKQ]a^"٘)%J2fUz21J3#bK=?O9E uSƯIڋvxhѵo4r!CdcwqWBpwa#^snwJV9%nBhWjNhϿb7^ʣMd`e uewC'}l^o^FkX!=jSAaO"c%i&k?_j>i+`## R ^b`#0أw:xЂ̜JM>N&Qt3rlx7~㯅ҍxŒ7*SkV_-oi\QZ07jΖ+"S$Vv~=,*MYs߰ .{ <'\E>?}mU3`wo6vu1Yd  f SQ+GwJm#GXܯbOn4f ai;j\ӿ?Z AD(KZ'5-.j]Phf`-ඥu~IpFbؐ9"wBDO1pl[C)aˤ`;6bPh.)n+ƵHTaGn3 )+p#3Ay0e/ӧ-YvH3Pʤΰ(Ote/B;a' +7E2J%EȈ-lNU#ׂ`g8%8MK@/ Sv*QGOOgݛrݲ9<{Ί)z(>yU Ax*k+3Zj.=?mAAdrQ%ss=R-í%bg]ATפ_{.4L9f$d[S#o%2GLBRpn쳚vhB_"TOWAMgם:mI*`v(KE u :G$Sq/@ܼ9DWfFj ΃֏5QeR4Cn{RUl3i솕J]qEw*pCsB|rL(yٸY?2"IPeɉ >s0{ƎXuNMcJ]ҷpH$ZCZljÿ SŢڛa-#FҠFj8zI +UK>YRGÒRr݂tq\IOܥ@'[#o7fo^&[jd€i >uu_Ti([. *˻tkG̦fFyX?Pӄ|<.:4%y|FF'nUZ׏v \up}kp(-$'(nSq; m]0.1=s?ɯ,1W_+ko޻M,]aFQAX6,C-rDwpc7>U o?+;0Y^ia'NsD8 + 4[ ?Ni莤lOT6/#0bevY7?%&T5#F 6'8s ;7U=zd0c@BB0$amY+ETSb E‰w"ߩb"ͫA7n߆=X` D؟$9U*9iVZP木CTtdY֋m u %.mvI]VΡZQ@#'Ɓ| +UĄ7V(Qw/l7rnV>TgjlD| F`Taюu\_%y1r+ G\i jH"lI Ǯ- 럯UD }X\mr F,7 =~UKOO:E{LSu) 0ϨKx8`qe3R=0[H.wBablxdPaH ݎ?"5/;$bM. eD(qWαǺYm;jj1dT}mä_,GB3s3^NlS-#(RԤwwЎ֤P2b:|QGZw 9牂ϴے UϢ f\ p܀.;Φ _a XM O5uDq|J/X<de Kas' N#! '&P\PIbEI}n)>'soK_>D&d$vl Pq[rE#Dp޷N[bb櫧y5gÇg9؛;Jh:2$TNj"[E˭/Q2!Lh\?D\_M&h-&vy¯s`ηA],?XH~%ؠ [MWqP&>kwv4gGdpTk`(;M-=)kx>Ry7d'6s$g%!*XsVc Zl&(3M:UK"1-V)z(z`O t*e) J) ,q{j}/ȗ JeIVgC>z~,R l=z%Ŀs68Rdt<3̛`nӋL-˓[v0A4#}+,aWJ&M rn`(]uq⑐RXB qz`ߘ}F?S(a:JiPˋ0ˣsg?O[Ѩ9>\=ZZ/s m.֣FR<\f]a*|2KaDF1hװBmָƵ_sL`{@Rh3xZi3ke>29PCHaWfU9uh٠ga'k!ΕINRyyGO"5ڈ%BD xGe5(Z49v@2Tb#v /DW7L&4i!!鰴e<@ːPkU9 'oໍR 4:itA1Qýbze9`dI dE qV8|CqRYQ|f]O-Dp W AH6G|=%bt^ɱ0 {4&lS{w7x8*bt UGKycCM0)8k^+aX,4^{}~5,r2bc Y!mj |5"6ܞGE' #B9!~xkyӻBK.e4VԒ`O*jxIh *MFsiE`;CW,hGy,_W)Hx;7$K#-yFY,pA Mu;QߢQYb}3DClQ]=Cfu zOb?Yţ!@Mgz}P*2AXO {sUpLZPbCQ1s-.(eOcn̨g|h*0u,N6ٻX(; U[K`/ t}k0cnUvIͶI7[1u,u:La3]6Sb˂|Em{7si?jl+}'rKGTsa:/Av ONz)%B]_D6<Ϲ<$۠zL9 r<_+,N 'I?(H)02^R5y0CGOI>0LbQ y~Z&p Z?8Ⱦ˙ Ԍ-P&u۾-E(iP> At{eo=luGO }wMJ~!>ݝu Յ]`Xf[ǒɔI;!1Is{!i^}n7;_8g~uRP6eq=~Ǒ+dۼE3ɂ2!>27"C¿= = @ Ȱ<ʝfC%[DBj(bqɡ$Иf69UN6~/%4paliY&n^3mpFR,5cPJ"w IF0-'DKNp͡v'-.I W)1Rie\I|tLIT@؆7x+2Ȣ+}UK R Be$}cV,485nR*+'\{oHI00.%N⽨GZcЍģïDضyS_Pwvߤ@ C4Y>TDZyH7eFwL{SY]@iu =QtI#Q EmN4#;RQ/s| 3U'‹(!`w b)j&TBJ 2ڗ.{PB0ڂpI>9đs0en#YpU6!.uF%W](_Y~&6S_x!YΊaHTYgJnl,&X#Ll t!pbWBq䭒Q>{ҭBE!9{mKȞ-1 dPqt\Q󺙷T^HO4KgKٮ.ݝ p( Qbmg[|09>&tfgqޏ|S?Zl92OL7mun$nq4Ȇf4atVX6& ߯`sZ0ИJUk( <Ů*/ [!ȿm0sIa^q>Gm&B2x&'n kAd Mk͡APmqeh P @:8v{u9;~@W(xz ٽ=w3 `{5ZVD*_Bg3nKZ.ឮe&SC,H3= ?2D:D ٠dLxh°}'&5്94@jk;UVT ځ2F-S=X͸Е_^Ε}B㹯r6wN!d-FqceRZBBz |ȃ )8̵٨pIÆ yjiJ)=:(0ݵaf-M,vB`qY^}b$<;2sMu e[)^VúeI"{ V@ft[g eu/+q-Sٶ39PsL 7)$edH%s5t F Rwᑁ`i~[ ؒ<$8|*k@I,W g0 Tfdb̽-nCI[blf \>8ڹ^wWX؃1:e7dcZ;lȹm[j -YW`xUIO`s=_ó8<@GPTucXbJoe@dDp?RP4rA`f/|k#nV- l`JaC?wJ?7u.>AYS8($auIT'Dŷ9ҍٍ^d]-~lv1{O'/}K0=^aǀUBDfݲ`DBVS{7QLcED !lXP}ᲭEnR08 } ZnM#RTKjgނ܉mBk%9;fͮ Ѻ |5jˇ7]R$⻒\Vgf sTiH CVs"nT3oQ[8O5gz\H~xG8ٜKXrXEaxdtZ1\jwuy6eD!(}X 4k@KsQJl Lj؆hjJ[h,Gbrӕ+psg,S5HbEtkDjp'ŊEVzG9SCV͸I/79 Zgl;* v<\I4f=A$L`kϒ]6Y RT66?ID4|AtỸsdE yiӳK n-'zNB POMg$ K£8s~ =4J ;sp ?_=s|. __Q^VvmNNk#aL_Ӷ?r_Q>l>)%_b=Xo) υx061n>yVЩVӒ]8HWO?~\Ru?ZChBkc 1w0'ZQ 8*ٙ Ak8Hs|xwÜ֝1#y:@,.>Ȫ;X.ywWm|u}6~NGZџ{qMmKL7kGku;Z i-V˶j=<ڃ,f`8?"{AA!p j[| uy.bټ4띍~?1%O¶d<%}Y|xe /B ikG3H( Ŷz/Z\PeӻPuhJY$τ .Y?Xn_ĤdP|ib|ޗAW,Uo|| 2D*$|2]T1)$5`ol7h4,vXKTiۅ|awZ74FF T/blGB4R4E}e5щԓcj4T}x𝓸WSo[l>-y}*KCCE]4K|w=zAha/AJ@ zh{9b)DSwhݱG7K,Mf& WgARxYqN7SAt zxW&CF́gϯvp7 w wL Tpx?t^Wv+EniVg$Kj, s+ð$# }Uf:̄,'&6]s{l$<؆Z~ q{EIRB?1OjHY.[9L<e 14 XYu2CJqsQ^vi1>R*lmQ9[7)+D|L4[jso0|W+DywO~SmG\kNr<\0z}Đ4W5#WWD= aХW=8+Qf"ApV-hː )-`F^z)q\^b. .wU t0QZTW`u=eMqj zۯdHprc2x^oP;8?`U8f"|JrܽMW^*WS9_]’wfր|_ɠB"mu3I vn]NI(fSY_ɾKT+[Pu0- f\qP"Ɔg+]~m) DvZNCt/h2,`ZO+G;]44GdͳEa@O8<ʂ% v%o&"jZ1ykЬT2U4n\jpMerǴQ}(Ib``;KZOy__@ *ͥ`>^ڷP9zo)G  ѡ=c j%7fT?hAtp1`U*co`G_QrNյ?]`޲IISqn@Iʲ싈Nqًn{5\ }6Pt[xi趝8Lk^ZZ/oCDl[=V3ؤdb✼d]Ox+Ȱ'==:a΢;C *rim:"{,}#AN}7Ls4*aJ/AɌynz[Ї,kekdG%eR=@V@s1A4]r(CR]//nwvz֭:8az_K3c&jT}:aT*7]G@:-sk]kf6 V]ZAbbIGaC}bxs~j+;mV^0~Cb*zHJ03=W"ތf&ȃݒfjD{(poE{*~=װ^GvA;{.=Ўz+LL/S7B478(d>i%X}Ƒ݂׋F!5s1Fjv%Р@YDfLk2 1& Ri=[ߪ_1$z%R\~HpdH4#IGB'ev X_ @qI0JAHg:B&3\,F ?k)DL-GY;Z7@EcW^>^25O,9{HkMdKo\uuouft꙲&p [{z(w ThꀶѯtH$*Oe|zZX3):#\}"IC6ByDE0MP\\QQu0XKvuSCD\̬wRHK*O7>,LX,Nf/y{J~P: q.hɐ)/BqBZl ,b|փTiyuJf#O[NM-^WXgPɵf3லҁ9: 5m@{я犅u`(2k? z ݐ /2F%{*p޶i C\\>p[wޛe cQD^p溟mU]Cp/A<$?9qq1Hnwz7@n?@ZrL^  LYIĞt#) ]*O 9*1|c}P|V+{^'1TW o-~؞l)^rYeꝘ79>o@55AS(R!{kZ5^L9@_qEMAP*UZ?/ DuvKgi}*;U]TyJסLR$[Q .O+[ݵCX_j.50B]< |S'ַ.ZljD~чh:3qeaj [9oXCc/ .ҡ>6}Bn ;-;9GBt^5yĘX8JQIoSD1 .Y?WI#]A:\!λa|89 ܓvU͛o1_CT>\[9+pUh -;sJˡa iG⯸7$TFP!ۅr .R^v蔤3+pT|p7Vhj~h;OGxltS5D6Eh`ٚ#Sq O&*IkKMou\IAr=jZApFIHY}ai`4_y/;H 35/)cl>H2OW,DV;|uhb3K?E/(QiiK- h_qp|z׼ qĒKkN;!FR4A (*,s8kKqNU@i;|n*J~q¬"Zӊ[J.c=}@ )j+ksfEu yv8xAP{{3 $Qc3}$ @mJn"ɓțv?itKNľn#[AVXꌭmέm1C)x'5b_V<τDt@Y W"7+Yږl|KJ >q~l;~z[;].-ubf4꽕: l֭!Zhi6S \·QS-PrƊ2G:Y6kTף]SޗƞG&[R+ǾAz2s7֢+ nUBto!vT9ʧ6Ba,e![3t:a;al?i`p0'u%eMjJDm˚Hi_`4bbJ eG Ykks2r`'F@9"?D/s~bS+k [FfyitlCiXo#-R3!t3/q*-߃ˏcEr:OC).%#Z‡H/_L~ma[eDʟbN|% _wmKQ?z}L1W!d܋ !md:Tl]f0ޖH4#?f(t2AxHWj+MYzLD?EAMR %gwxP9!5X%xYj| ï5jl)OXt|%Wg{ԊI&^GР|41dw)'><;K.h%u@'MՓ\_z4oEؘ ;_ c CTcVhTAND}=NĄ(<%rPɞ %9v?eX$A {2V/ FN-6ӊEMva "Rv>RHdXڔL]~10gJd[ ?o,8SC| !9#vtk'/v_(B@S:9 O׭ZLvdHPQ Q@j.ʄ04>"Tsb .ԇ.wEQ];#eٕ.UI;cؤ-V_+ 7 7hx6040|¤-?Wv}L{)=urT)PX1DHfkUi8P+q eTʓa]k#r I]\\ dH/v7ZZOxy. 䞾LNϼ3YٔM/w W-!jd@ !ѥW+Ё1xPaEXbݼJn=eDo*TUW_)2 ctVv =J( %pnk4#+/J) Jý@4Rgxt^X?p￠ipZxKuCeԅ>v2D(XRmE-?J(xğm?8+ ʦ6fC㋚C w_`g+MEBpMsn\  [~!曱߅1,t痱dc\E &2f%Aތ@_:![u'ſ<)**isw*`iMBȂ{f3:N29wpAᶵnjL~ r3W;LTBaf, lf?Q4d.=9~ *hpKεᅮ1/%5F c;ÉubҋoM.sWջiؒX.}{z[@5; "Τ@~ދgfX=L#D"b[UtBBvaQ̺E` @  ;Q6\H=JC9ٵll(vG>Қn(0BD <ɑq1IKGh-<:ǁJH?%u|@jV9=(ؙh q2DE\߀>|:706J&:}ʈ*'ٞlfP}>E/ 0k Bg0d^fjc / jlwUÔ L󮙹W9q\;K4OZ51{}#iv+%s.(5G2'%ɉ9F43@X U0_mSd'?}ظX]͍ۅ̓$SsA%)j2KL|_P?|Ԕtk0ZnF M{17p',-?ڣ082ܡ8dcQV飬C]&f q{o":lVp%>.Tnεȑ dܪSo(jt{E@  RCy;^|=VO( B3!j#^:l@b%O>$-7t#<3f+y0@vqKx䗡!4R{Z/7Haolei퇴լ1P`䘛#T:Zo񝈕z>.YpmPfDY<͋f$\z?Ω7ٞ@"l@Lx@[^ŅPhx7v%AN=FZi4+X{[dڬ("l~YkH,gˢT,:3Yɉ'0Uy֩0$Q4XS$'li(Qn [n6ip ɥ1ƒd1ތ/] <4tYC}@?w㍴O,oeŪЖ+1찌Ys_rZtL03cQ9I8[fu"`IOMW;G-log;RzT inkoՎ;F2m9L\$TMԏQXiX5 x |[i`=x6']!$QݏĐնV I@r$Y)Dg0 +?S NP- )vl6رG$Xz{K,=T> 888P(Fŕb&sy`| h/.7,|)Pp:b[394kM5 hBXIQ7~PI4^N̆?WRڽ)L7!&XoVφһR/QSHQY8 h6[,wTdF hOȶM%;itfҥ2]5_"EsǜBb&N9d6yZ,#=PQ O xMYiocg (PrN:?D48O3rfEdeb7^5͈詢vQPj56'P@!njh9XXk8v ]k{A*LQ@;|Rw žM/D>(C u"k91mys X:WW5 `:C䧼H a3ZGҖE8P8K}uv&0H6Ͼ EcFus7XͿ60 H|5323F-ˇ9e:/)F ,!,% ^7t5`y.y33zW]o=NyCz{QcĪ2+l4N'rz~9[nͭxBb9J7K $0eY,uEy0>莞u+TLkq >U0Ԙe &31LD !w[T~\50A9:܏߇sq廞Nu?Uhw?͆,V4yFr}y<_t&'Ӄ} `I읐"DOw0YiʘyG5iqt$y%G>/K=BфD<ץ0?@078Hi>9 eߦ ?C M$iC Hh \jwlz,Qd)Ǿi+|r+ ye0:C6%N>;C Ei'U7Q[&XR;&zg!STȜ #b,Ћ&6zпڪ\w%M&'>?ttBTiByo =1Zmw%]̌#(pTX Ɣ kiY@ӱTS\b~o܌k |I7H'`+),F9810Aq+oȞ`H0Cyg@6M+»iKD 3b &ð Yً ~kT{}R>9W&thhQs_6[xHz4|t6-d4&n|z`YQZϠ91, I}b5Tםsz %"O)2j=[C~gS2!j; z ޛFl\[@m h՟&Oo3 (V,^ Ut/:N _FY fҳˬ4Ts](Ԋ>J0|m8\Wzi(.]K'2cPa,Ή菜چ%S ~*'ݞL&, N?!7v4Q(Դ%\`W[ߞTa-2& Yp<|Z:"az˿yݯ lC f@^?s#J/P1Mr8M~9- T 3ib|QHpƻ|3<=Iً8#ֵU(E/3L be.`݋tHo&X3L~*p+;ZP|cb'q&;9Ssf61f)^z5譵Z5NFW;-?8*ydN4JoK楯QџyʡVrgaZ;7)#C *%>:zO7n@G²PϘ:UY,PP!u8EVܷ#8p!oK&TCy^kν| -+1{A7V$a3Wב8_ Rmx\`*4=NlpU)޸G0%ΗL@AgR[)}iF̄2N6& 2ɾb:e;Tۄϛ*,;XlEwE>_X:Q}QCIQ]N{ 0mzXqLiV,NPj~BooU,%c) /AY^d hkCtV eY2MDŽX "]Xt? wOd^JvXJGu(!\ku__+8TPϓ2b@n[;U7g%Yv%!0mFKgYgl #Ȗ0,ÊQV -3xaGLfR`Y6zj|d<> k4z#\u0y~?*֥~:v1V`@& FT:]k4Jp5z-ߑwpDQA;APf@_kyԺHpWNhVg4ex_)H5C>Ty톀G  $ӎH;|Tu$w ,cjB, O-5\/kj3HXTPŔ੎BU~^ʥ %l-ڤA:~o T]ƒ8 .PN"+#?_*S1 !?J2©9Z"y^OzD'cB'τlkd̯FqurxeupXқ,~Lk~ʶ.*Km:5g;DFz&fPx"EΩ@D月nV[DMkٯ:$,q}6gˡs=twW8yPp'MUβ|{(3R_UCv.nJ[՜?v5ƻ2@ `.%k.5F hK%BޕaTI[Ē`^N 0e a-d$14%ogV;;%Ȉ3ǀEL1#< 46=u_+j]/{mRY( ^=Ι#lTڠV-~ '4tەlG )hoq{Y?co ~2\h^f0vgʉ@<\fZn҇8jk)6w|$a!ORC͏0"Ql !DK~"Y ^B錈HK$=$L'eĚ%HA E}?ջ&ͬ|MҰS2(أĴph 9=sb9,/ [EF[f)\8$3|׳[ =Z,#4WX[ AQ@dUTbwɓEwO<:  Ekx1]vl[U"g SG]O&giVyؾx2a,Xv'KVãd. p,c`4US׮Ox!j_Vl ncB 3VOPĘ9қ쫒dn%T?ZgDG P]%qfԉ:G~/ LbN"x-@RbVs;C4W+W(T]Kblpmx^r&Q.kVYߦ"$2]"9i*㶭HcTN[Nr4] *ċB5V>WfעD<}n$W;HLj^qNBhԣSņ}dW\ )VV?g[Q{c1G26*FtR V"&QR: Lu0Z5{D^.Asgɂr{L|Hd\Ka2;vZrdjTzdzE]U!DA{Lbaumiҍt!!-6d8L++v$yePL֥|/R)HSϛ 2mMPcva $#I ygw:n2kIߴ]n]|s*w\oNLO&T| iUJØ ?v9 V{1.mC. ^5_76VO 2PE\Ɛ2U$|]T(_96m-}R9gCg74/%>HeR]JK {;jVlydU-1jʩ-1e:z\hE*5rKG<Ľ+`L~PCuW75VǮeR%4j-Dä!Has^HWYt2+Yعa D`\W"E3WzM,(c1jK<˫g /`VƮzdOͿTJ0;Cd Tq8՞d'Dj $J {MalICxIEf5nĊj:}>Zs)-V(qzw[ 5̊V }Lm3|uˮ\Xۭ~&67,|/r. g.fbķkf:Oֈ̘Ԋ \' nHG Dy/;0k11tSީ~Klchɻ}Ŋǹn;8bEtwqIMP*9bF;Z}1Ub/fJ* <30L7~̄g6{:Ǒ/N33'}\ Z21k{'͖FC_(.5Q ~hgO×yڊC2CiJ,>'lj{fҁd>%iG陲fbSjҚF%?maL5 y4oME Ũ. J"N,5T hP8LvJ_Cq({5(p`߭ {&]#,*%MP ;։vl5d?u0|a fߤLc)fivݞM^J P F.bG72&DJAGڦrQ}vv 'pPt*؊mTguU%`F.vs,J^"k]I -Elm)yoۭwR/iw'F6}Ogb70qՔ5O$JU6S˻߰eܴeȿ|s ydFJjx4oe}n@}]qr5 x Nv!Əc3}[O%98&<6:$kgGpp߿?kJa(ftdv`Yu/y;dB(5)wqdQZ)ҵ\Wjު1>6qІKJG1F_5<A"Ċj#&&_0 ~buSֽ;[RZXB j a/-нVIg;j@ڃܒ WǺ85}VdXnO[8>k-+p)/zR!_MFWIp*]ESz6! W 6[qwJ֬I;ET|dd9(5&DB:< <r5l*\.ŬwС Y/}@*J]J?IpsrxT.ٔ"ХUZ~`/n{u9"@#tT읞{Eldz$h^iHh+y \6(շ/3$Dx0))TŦqcqeZ`/$mW&-fHܧz0KuBi)82%Yk[\>])J^-߂{ ~\|APJ;" ]d j5xiHm[Wuqc2E?;7_ >/$=8jΣKR.}"C-f1O5sD;A~_ۻn+ ;Xv HM(`5drg:Pz@ؐ3ؓ*S̓nrzd Yl,]Ɏ6+d}Rq9|^eAC$ŐBd%u˘Kֿx p^HMAw"[KMު=XlL~_Rv&ќT9UB[ȇ|NEzmaiyI` #rOP{l\+'6 }$Aç]QYzvԸѓ];T5@}?QOMͣ[2 'ND5ړRU=| pIK에sʆe˛'9 t@ۨ./("L0Zj$=hҷc}v0.DxPh5pI:P1ۊ b E̚`>=_T ş H䉞wHm 8 #-OYܓsqOmw [+[?g##B_կ U N`I5$x;1Ԯ.l9y en+;Ky\B@Mb N%6a;]8vwѢGb\a*Ni\ SxYB [QkҔ\8aʣU04 "Z&5^:\dv []jwyϩn' nJnWUA' X24 F2ȱ`O`%F_WRԹKh}oj7bR(GdKD,[;Ԍ#kl yS{@}n_j0cT׹JN|;um m,`1+@y~+Bi^+^TM;c4"ׅEeȚɷKt{=Qs"Z:SLL@ R F.5C./L& cBC1}ޫ,Iftӎc< Rt cۘ|q.w*zw P;ÜqHm-ucpBv$7+>كIe2/)D? 1!WfŢpT2PPBD_́b4Kn#Bul 8b8aghSS{*kd晵B46xW1@걍?WN;H+Wj>@,WX\SWM0 '\G,K S9M/t/w9gyu#dI3AeiESb4"Suaus+L2 *N'%_W[+bVG E iAv9 6Oxbj M-ݍZgS gͯ,\Hw1nzP0e;dۧ\lgh$JBK;4f6yx*i#ww?@Zf?o9mжTjm}1I֩}6PPxFft-q=#y@vV0h¬F(&TyQND X;BԮ"4S@3}t_2fcXʑɛ:9ԎQϒ1>K *l@T}Bg5/G`ѠnO'׆.a޹`9(p _K 2 t9}3c)} wrP<,5G*(wai^F\G{Sd;/.CUzxE{'Ѩ03WB^+>xբ 9, pJ5I 9f4{߷ݏ ,? #}k6(QUVk1~pzA ~b),QA '!" !CW4ƶr&씆f5v*'4vN|kW `Kso=؍xZEyNU{%kP@i?Me9Rf.gV5^[[\_+UF޲_|&.pYK X*q tz Q$ZA9 ӖciCF_xVO,{5illM 2nc[ !j$fX1sXq@%*Y^q(tԹ:&:GX}@nd}pzU<!CTwVRP_xͯ/H~dnV}~ HȘs"ʞƾC`u]_` 2<ڃ2kptK?H$?fglٛa2T~EA&G4)p4UUu/K}YxGťlڻNdIh g;C)du% Ó'P3={tܮYxi"Nhn Jwg7vF}z袹>t܅l"}Wv.wFJ~Z0H52a`f#A¹[!,F$ x'X/L#e 0   7k+̩Fǎ*YEͱ42肦_{^}ϳ`}?DұX<.Gc~xïyI"r#+)AH &{QJ߬yA˳aN>z9.+/È5;dXDz\$WEvYfZxOQ.WtD~*FԩX֓ 2k7u;A`'E6f"lkKMb_?N1HBpnoJw,fdbYUz5)5C>CPAA'sGb opL{0cPZHE.ErK_xFSZnM@!rܔnLW5ＥEy[WVBgWKdZ^&Df #_Id{fuydԳ76cmYf @I7L/֙0~1 +>vc6 ]Xw^Yc}]|<%! ~,qLjYg[IC*['%=%3œDN2Y8naDH2Mw$X![-͙̳JMv#`%<=#۽L3x)ljFS-ND5|BBxE#msE]x{db܆3&LWyJ.Jpz~'{ytj)l5f;7#HxV5$pӶCr7},!Pw^͕4{";%Z g}_ɟ", g; uUg.`6Y9?%+`4pR<|HkcC[0B|= I>wg F׍6>.;Rr*%|xBM=:}J([@VR-Dzu.Iȇ6IN>Ra+uCU0:i@jsNDgB%@p,'lpEXAT=8X&5xh.\3G1 )!CH-L#bSۈl6ExW>MC Wh' /ƞͅj?pw>xWLWq)voor=r7 4 ߩBE'{ S mI<#I/7ok8q* yeZίD~k^v#TGzh}jL1-eRK V\RBm; jiSU:,@)$Mcf:3՟a=TdYQL:9o=i ^D¼Bk Z; ؠBAdIzo53􅱷*{!kdcMi JtP?oSm" ;o)(oZy(H|iHzvvp:}:0|'gamsjIցV: ED?Y+.1^囶Zp5A,C@Qxb=(,lPep%PHrW.o?[U#?30*14L6р$%XC|Km e8"Ql 3l*9̽$+LfUĿb$_ 5[Hb2IъލDUjaA6C!f"s߽EM%3udp+!tz,)k4K4RVq t6 5B)sBr)f-!R ?պC5&#ON@^"-.K{wjϞ-g w5]u޽2YW.%6:"tv~M}E({3R6 .P٩sO7䒹~Bm? Xy"I}Rg?q8Xs\gϩuvDwx0oc|Ucy.:?8f~m9FP///P{NkJyx($Qwuv;֯b`zckQ·!c0heοyUB]6"3ԜQ ^_^9Pֶ=ySf(O ] I?{;!ZcFIH &d{U;5bpO| ,f/Gg$aP4\JJ$VA0WŖY/7rO ;_׹7* I?_oNxL/G%fU^m,I[+W N~3EzDN6 hϘ/+Mxg^9`ѵmI7[|PگP%섮[~(&ʽVڷͻm!W`v.+@@Xf+#k5gC@7jL1mUfl=.D^ ߒٯf?mG2Z8S]:I+&iOw.1hX|;[9;ȕjhk-"CZӇ7K9at;='(=B?_MYPL^lc3z8eKq#IW+9sr'9BJyf|O5iyýTsƨ &벺G 70>[#z(+z˖zIWH$,/jf.^qonŝ<#2C!3Af&Ϸp`gف|>O#sJե`Vc.z:4@QLvrOXd)>ݗV Ez8zpO݀}ZEOpʼncmS~*wN~*by Vڧu%4w#DMh cM lelǼJmK嬾08s/Y?cPl^oF3 nĥ*s^Ez1@UQ_~bz]v[Qnr-uCBs !c*/+d~JQoJ߉io:syt*z NhEe!4 ljy"Źx ߌ4wIN1TV/EFڊӈ8*6v͒e,uY|ljY="SG:̜r<1066J\(#t+"߮e~ҵ澼$7Eb[&^g;M25]dgYBX=._o#8) ~Q(tF#K6Ca25}-Ircڊζb{<|l:K=|:l+:5;oVvr%Wg.+N b d׃d"j%]tqZ&RxuOl(28Kf*K*B.x`DVːА2K%-큐'ӵh /*^LYF"=Am,a]τ=? ?ҪpT씴C`Dv7݂B^Mc2u?̌"cEcLR7hJSejnN頻f30k=Th~ @ b~'F| xvCb1G(8rTAִ~6, o?.ZEMjV2RP{.ۺ7^np6~'n8&D'+Qٰ-Z= 4Yi!Qsyen )N8o EE֘Hc"*t'JX2}l^{l#E+2ojp=I2 _S1MiRf[۾\Jtl~)1V]Q}!mQ)#wP+$ʖx98Gg V:뀳fVNgCP/Fgi8޹+Jn4l~_r0ps+vX*r *,AF!KV]PsWbI!Ɛ(^<ī# "à %|[X7&DV#lY8gL %/E){SzGKX1VH0R\D`>>6>l0u\LFS *9nJ(EByHIYCd[lJP/DL8m(`u,BAmٙ]CuH#AldJ{ } ڧ]*FO(׃~0=Osނ0%DZ1g W589i)z-żk$kݎ!]-!8f <Q>3^9X-=W砰.n"ͤǖo2N!>ԙݖ|QU+H[3&z/Y(R)'H07d22W"xohqOe6,9x`(@>9>dF18;'[U k`sa]W3GNa#ҊDf1s1n;Ӥ|e;<ɴp9=u+"HIہ+| @Ƌ8u3QB^ھX]zsCn2uZ^|pdFO7?L'F^ja}+}F&a#tQc$}DY=F2N( m{bSf "ũ{Pqf?QX+r[? qj6s+LĽUⱹ&֙Ix *S>1hV FиikBbN!ʱQgUE8fv:z[*YW%eڜlbA} T.3=B[myNd5} s^ us:{3Fx=V 5^65p nx,3#T8r.2c㎃c\k]|SMm 7S&sS-6ឃ{u Z$Rb-"Rvr<-[ioN$nj59`vsn [o YopDX/E,{/3EAK+&đE/80vwk<ݭm_K D8AwJw,;f4GwqVG%5bܝZ 70Vς2AF=%d LbK"2gy]I)-zt'${ NRENld=7s0\c?n~?vw izȷ˺&k{2Hx~D#$=m2#&>}pث8r_Av (}ꨴrJ29 !Xw>tKkX5Q+O^RZ)Z87/ k:Vzn_~U r\^#L< FEÅJHݖAzxgHhnU%Lxѵ0ng Bj5~ eAm: ڡ4u@!cl}肪ETv,mI[fiRgC59 Tɂy0t)m"H+mw3&H7mD9ɹX<SVn ÉṄZE+7^ژO ru@c  e-8*:r1giN^~ςϩ(A4OW(BσY}jH**7HYwIg &Gy \k^(LbeٳsX>(*%܀BZa[T@a F%}*턠}=Fr_&^ 0&#E IRB1Pm𲙃Z ;]9jPu3$~_+oc[g%PPve5[ǹ:cYؘ3S "@:Ѹ 3l/f vH~e7fH>ԕ=-~|hi:-(B^5|@ ō;DUr7wʚƊE^ ̥N^5FlAjQǛ4;z= $>͐zr y=]dE[)Ii OOdI6Zo]Rz?{<.~%@iJM`j|*Dͳ=EAiOLz|>8 ,fzЄNEH=oc lS~1b32w _ ,S`BJu[.TjJjsU1ZHkqa;D6a1|pI֤ePgzِ#tzB(wBufKyzb3\.j[0Y*C{nz*\zi#_+/( "0As=@a `v *yE$tc\nү|O 5԰ӁqBܘQ=?e@좫"aA.Y1Θk qȶ\mTtAb)f xA8`]nO51"pw"|1?/7z%:K׿j. \x ]ԏUYLxo&dk징͟s"kqt|Z ~&^9+.[꺺40:b%щN~'99?:tR'4f5дV_V[Wah;j/lLrQi4OHu [AάV/ A,Ed5fDicP˛^QqD+Kob~߇+F eڿ:iHKٹYZ> m[W\N< Oڏ!]T "R־aJ2Z7n^6$-{1X`vc6h`߻ nN,ZHE:*A$B|*ڣ_itYs7b`FXÏeby/H Z(#>W璽2.B1Ћ#>@υeXR|ӨY/L=uZI)Nfty(rqݗFK.L~5H).}U),{ >IzaCSt`ed~=uɍ`?HNPYx >SP/erb3,f)\ h ~H|_Ț/t;bM};"7 SIT#̀An!0'5jx),\!_0f!1  ilrByΐ*ZDEّlnv/\p{x9wn_}ᓼ^p(}l,r PFu*K1vy>"/7gºT;[2 %t&$uG1@(:24HWfbpW[mI3}됯&qoVRzeۊwfʟ]X.;1ܰ=)k‡.C~w^G&TT:c̆7Du6$;t6pFWH[Z 44Zmrt73WImWD2rrb Zٶ b_l!7 =GǖZLX*>c=|]ChbMzMe3ʨKm3@^Mj4,q*ovBʧQ w X+?9P~T;KR {soBi,%X={)9z¤f+k30 Z<]^9ȶ|Q-&<+P{%iL/lV^yQ,/s4Nezϳ8JX]ӂm8N⬸P[:X\t1#3fPHBBfۍ!6O2<% 0ݑaW=eImeƢض>?_"wLa0!@ |W`$<0]h,S1Ä4|~kC?8 8t{ qN/}I~ *5j2/a2|R ч)'<.׻236uɿn_1|`tϗ.WU>J)^k- z& t`żp.ƿ.h:ׁUlƟ4^8-m< ˾H@M%ƳDxҒ_3wwS D1 #%p܁^ asc.|o/rD gk]ȘCW`2 bxԫ;*k|`hLiY$L (~!O'KG)y>`¤hON6;锯z~h3T',ABh8.k.[g.6f0h<w:v#0P?SzˉK2854YɄ' Cr}X/ I*RT%#ꧻS>.|6}CPe}TuO,Iq%bR=Uw`<踪cz J>ս",u+u؞!ͼEE]mZ I9ٟCnoBSe-babgX0<¶$#P:kjT.O'DKb"0L)z(-@z[\+8:Z+`=- ّIN!,L'N8c ؟gyvo\Lqy oi~@mڃ@y~RxD֙L~f ,fsZO ۤ봉|GaS)K,˭ |UC6p;9 QF.*e[1vF.NC+Dx5@twKu2}ߤbgᙽMqq^[a}/Ĝn?/2׏ɜ5\~_OS:Z8@I&m =~)zNelcQ-yZ]nYPO0+B`_ 7b%-1]i/K`^,[q`8JGb#9 lߑ'a敥w1IoL?Pw l3h#Z\dI_ Xڼ *#>kyy (չU=enI >}wtqlϣeQ(%h/͉>9]͈]: Ud'p'u?-Ot<INa 7䮝_]J@߱HӇnR:1{r|.BSnЮzTMGySN!ktsS[ry'>wndH9㹛7ܻaf޹}N:Ovh m⮷#f@yƘs"Lx?Uޣ}ߧI&nq:&n@ f,ᗣ_-:[2Y|+tFǢ YX+l0 maweiUpĪrw24ebR mhho+m`Q=/C/ur Jx,I-LJau قYxImDf:6vEsQMPʯv}'X7胫%Ez6Tk$Br?}03@yG&;Hjl)uwm (nC QB0+.N e(9 r= Q8h.騋,q\8t_HZGKAGcv⿿]ϯ*DL4WAG5W:9K%3?jA?Qt1Iנ=8OUBxKM-߱S8qjn}m֪ ︉8+?3 0$* ,]ѶkƁ~Oa }@.w V> &l 7)pCc'~(IjBџVR5?i%]W;/ahg| __+={{=D2M)jpwcY/AuT`z#F0v׬B D,0IhwwX+:$S|)bz##\r;ڇl~dA%p*v5m#3K.σ_]tCBtFeBmGMsRYC(LK\tGR/HEXl_@oXGK cE7 IOҔEsK8"SV3֨nG|ۊj/q#XGR n6 UoAE\XLRK6mn8{VKw"8/8:LةG;lu$6X3졊ԡ'z^ wBsT}&A2|+;m]rITa-`buMWU(Y1k=\n4&\"]ɷC.c}fL`"jӳ " i]b- Tbr!M)=vf ʔTʯl8n]z>xVۏL `oGbjr.p74M?3lb0CFwnD't(NmE*|%caN@>2wxE)1T]s"0a%a#ش81 AMJ^OMW/V;T(,BCl:l'tu;Ht#|ȑ=q rR%̥K{$ I.Np9}v'3wiik%+L2R-:-3~$JNIV:S@݄bv0': 6gSB2³uSm/98ϩ\O:V (a?}D<GK/b@̦lA\iWw088RSu:BPK1~}=$Evrnv klE KARg`Aw%;3?ʨ ú$[. f 3^|k5]F,lI0] ˰׌H Kv .@@ƝƳ*̮z`Y)faptG:m[U%bʈ80^YJȀS+u ֢'o+?~* #0L.7nXR)W(Ǣu?$Pa,k惝!8y.\(; fڶ*P,F9mNOi /8'9{cN8x;o>u.N#.O6cPX+ʬ. a6h$TpBf֌D* A@6T,1sV&I !g@ga6h7K&6~emA? 9dqũ o"Zډ (ƫbo$ nE/>vW%?xHF N#/s;<; ˰ ()cOƪc2h'MBu׽xc69nj 5-{OY7|K! 1A<"(g2F {~+Swߑk3?cyAo] Zn\( *ܾ,uL{h8PL$< {>;W[@.2+x{I+tl[?:8(39t%3H|٬L0 U^02r˴.6F\zy>U@J]SBK_M+0R\^U[rWHSz]f2.y{H/^8VS[vCCo;a)iyͿ kwy@GCLN{WoU)1ǽ Sw%6}AFZVg9jo\f|nUަl&RBTlW*R8VHC8z:#s:fHUM7#DJ +A-kse:<=C90v8ʿZwN.z>=%)=ϯ4>72gYgnC>EdGC/0I :U,nnVMhGiÜͶ0kwvkV1Ri F g_.mМBf97 "sSghOQ$^w6_H'@Uy8軀F@ҘͿ4Y@t!\+>o]Dh*'j* b}]s‡ Lw 1y}i^#ھ *A0 eoi E7g:a9N/,HK?HX "`t*fs"y{ |z9{D>w8OT /ua򵤓p4Ы_[Z( ?CoRT[^F_)1@5cbQh,0'M-iu_ވ ߘH=)=ݥ*mta͜/ G9\UxLABNDDN_'҅>MnIV@ѹdhG[r̗9aJHY*7*iKά9 Oi2~H~QZɹPED4A .[̉QJ ӂ ?wavh3R}a{HeC/U81OP ̱2΃;نEbLveQ\jV쌱y.rV\8q}u=u+5N. -_yO weG0/ ZA/g͛ Hh@gxKy-,HO%9o@znX}R:ZX)R%i3}Ξ^Ca0oTlm*%1'⏌ihy)'SPYsP~Y\DU^J[uz%r)_NDXThwt2 L*JF}"'h&- [T~Q;qFs1G0Zf{l@y(+>:JPI,ÉF؏|qbdjKQ!ʻ.R&NaDCy'z#V{gR5v/'3Lcvz35ihtE[gN!8Ps]"}>j])]Z gIT0æ5k1ytΙvZ&,]^)Mt6{N܅ <}47^,%TD6g zT|o#9K|7{Bou]KO@_;86k`W#T6ք $0AoƈuzǕ ZM:֋fmYJsPzVw)!"B 5Gt";Z`/̬bIix}ՠ*W`#C3d]Yْ6uCMVJ}]y%D _$ő%wʶ`ib?=yO2&>,8E+vd _x& Qj%[⥗h4/OZlu0GId:uWV&F}OЕRRI$I8& 4]cbS+>>1ʯς=3552>u4gS:UNv&o:u@Q$[Z8v^=9dhnw Tǵ v"HZ78 a HK$a4IThG䣛\xB%UVxc(%z4YHyN u];H|5?%%dU0*GNCbi4諆o.r.8$$Hc 4rPIl 8HH!RS=|![ ,30~E_=VJSC{ W`4d '?M패crW8O4:.UzTPrnvq왭_ǩZ݄iEfYu2VKpMqEyseXΊH=zNPX/@|U]u)W:$@T~0:PK=t~="MaKhا8mH >ʦr>M\[g/;`~Ȭr$bz\B0xԬѧSvĕp_"''X擘,2Ywl%l2 l2n"Ū/O\ kmyqXP`&Ph@17!ڌqn"<p6V xEg,._O1EB#eǬSn"cPMIp\b{K'WeAڽב~#AT8X..}V1MAJ˕ZdW8hJBF,8#*|=?WV5T" \hj^]@#[LM C ~zq̃U MՌ,8 eSC{0!rĹ:a [ZЍ-׊7a9H2fK'a (*20J]ueSV ֢thPOjc֡R>O E\r329&orΔBA.7I(,gVoˏQG=tSi% Bi~fmoSJ$mQuU/?#nء^, 'Zwqw{gڂI Z.9&jZ8L< JIPze #j6uk< l,NYTMc+r-ExB)-Htdz]nJt VTšXe7ԯWZ+#*!$w}1` m0mˡˁ zT6:B){q0 ^.1qO>so"R^{g cWp?ze:>gDhŜL>V '2q,TЁ}UY/D  K P #=h:zrrx7u0N7 cAu<}_k{2Ylޛb/F*rѼ(8`R:b-뼥٥!''aPD<)W5b8N?hBʕo8xsw\4ܼZ0; 2S$Y"4YG=TKkZvLi p/ۦ Ub|ީH wDOShry6tW9<p%>Lw:חD] fwbQ?&XuΰY}Bsvz) Cj3˯G2ًTO:Ņ&ٟ>u:m'/d sh QBøj;X"F:9} mR ~f4%3R}T}($}̂( OV--v/"V3f)CJG`vN6Yq1f,$mf(U>#3Evl3e bIyN*npRf]fM. q9e6pWȋ~^V)N5L>k~fl߯>Y"?;5= fPMu;WVNƴCIV(xp2iLuS2u2;о~љ^X Ati'G߹EEnZtf]xb7%NJmnu3'QLp"S.8R$Ċ7j $b0hl`H=播qW~3coR-#ƪ-O HSS Hs/DǂSywAT*̡$'q~=$"Dه9oz=.wxR \%X'bzBg cQ[Vs a ݬ:kAo |=\!X[٦DWyAspiKF@W6/U!UL3:gRr([_MQT8ktٔ :(_\M )^8MC ~نZ{lvJ_㴲tT%dm~pS˱kJ\^A+H B@Ǿ 'i|ԏ^*! k~ bV2٢'ML ܯֿɀiN 1{.ϊz^z/ߕqY}Nij*fX)OFZ3P)ȱRu}}saRfiяo7J>erVxA> 5s{0d{s)T c! /-[# 'eo2v4 hIme;83 KՋ^+o(onnB0NwWChIo Z$ 1#9lGE(~;F8:MxqlP\^<̕4>FGJ2Qt Y+f#g_LZ|/U-ԾP(q|@I>PpV`"\~99O(%[L'E՝|DxblT ߽]Aj›+8ĕ mAdhrywy bQAA̾%dX,c˷9hBFM8ەg>Z9V7+ >nS2(YT)UgULbud?jS;^B@ 5!c6=RO3O,&ĭ|_?g˭4t&qbW~XZ M0<=ߧebJB.m֋RbDfqTYI桿8a*]+{I "֖l/T:g]y3 &_Hu!ǔ.1i bdOGC-=v0}VMbrWRlzo`?rebM _L`pcW uP~FlC{P[ A:0_ ԲB 87m|_J1ZGb~|iɃ;"Bd%2{\D*2\ʆ "ᢄ/Pp AtJ6;1޻S MM!XNH.8H։E;^MGVFşHt[ٶ#h,r$Q!b6҂㳊9 r{0J.ʆIJnYc ((g!f_ҒYL@Gyjh% @ 2ll|4d+uuNЎB!v8R`m`Y@툑? #i!ф4P$w=I1N4?VU,\:-T\JWidRq]"X&,[~>mSo\f0YyBCr%G婈btzODG`vyF#N!)OWk#@֭(Sa#{1em#+= %?aBO?!8PQZl\ -y4]<],Ե(+ |4vPOB# vB}r!S:pBG!r lt^^Eݓ1r}5P:&jĮO9I~P,l&7vXYej3マIW,;}qoړ)G?o@wO8"%ߝ*Y-ATu*x LI{A#8(37~ʡ#n +Ҍ{f|X“W`b|!^K6]93ɧUBAL-,woxgB[.R3!RBklU!f?7kC؋36)nwbNRYbQR`&DlC#Ai]X"*)+ό0v/Aw+>xaq̄G; :y*!dIZ~{ȫGi(eG0HSFdzztMfqb >"PG /B&$#0-OO@: a lsލ$>ʣW8)털dk"F {pd 1r<}Eg۫by^Ihd8~jй  $㼳=+@0ltQ!qxD޲{B9 +Osǵkʂ$YNr qjB/2R'sw{y|[]b y#T 0[4"_ wVAv$mt_Yeb%>a^XJ9}@ AuZVc"N3aZMXE"L 8jJXS_m\ SK+Y W pg3'@ŗ[&Ca3ƣkõ#&w# {y !*>p@+ʏ>ʟ9/?'*on\1VT:UbNEGb4 4%gI1纙SGNfV O(R73^c޼dm~*gnXkI)TPEtw~h ?tˮ;ζBNȭ4%AވW WI!rj u9vhHytn Llۊs/nn"7D}?Qo*DrՈt=oҽǟ~͊`R6V߲Sm':TD[VE!;P7PK^'੠.f^l+iyUQCBTʞrXjk֢."Kk4eH,Y̾HUW@R gϪ/HOm@OgHsERfg£ea$8\ѫi12a͗Pe}qfRJ%q{u2W`h>=.*v%(JY-Y\s0>Q:15Ђ(aNHM X(Bn 0K5`|NADAte.gNXUmnz v9/t%?ؤof!{a)r9e`Z5kDCT=>ͬng*-"7\s6+n=a{o-<>OS3; N& irаg"` u9đoijwr3rVnep_OQ]wQzQMG|Lո;pJ9[!EI}*x!Rk;>l|Q`,F՛=9j<.qC '*v x l+N_훼$`"Sã&j &Ⱥ/CU,xΏ,≄-! COHG4tl؇F"OܿTgoT6a[D%Ntd4JiIeԼǴJ|Ưs (m?QeHT^3cx,4&70{ThzWH&/SHqa J?{`@4?JpY\jų6\0u宧L/J =Tp OLu3iθϚ*Dcѽ;.'[ cq&>`i0mZoљA l,fkr#Sw/M)L=f,aǫ>aok|Wd<(y"20fCp.nn;gIО-"} [';5oy=EEcŎl@dj ^Rq?+\rMi'?%g%;k^msr{eݟq8A3ϖ O@@϶ivT6P"4a!GZyDjeb>4u?Wc4E? N'XvL}UwFuvD1_"XsK&KjCs[b_D$y3(7^k-?AsY qYv7KIi)[|p)*aDNQd#2bH-AH:GOCCb{fi$_LPtKIl9{2 t:[]ZlI} ]6髷Vtj ZvSR.SUa2a/ZUrVkPS~KOyeOoOE[.Z Ci\WP!YdqK{Jfu AaA_Nd]tY )(P&"^,ă[eJ{3OI`gL4.'pWԅ%I_>${4bǣ*ϏdCĴHXlDL[2SJstݧx !r݃^8)HK ABbLj*y1(Ik_&|߭gz#ÐmCO@F<1jrh;%|vVYFXufYlͻBrmIBPM1޳<)u/wPa`VKJ,ہg1w•=ng[1 Y\~9D[Е3}UՆ^>",&M⻴,wSC'.7zROLFK[O@ovv=?qKPL!4r*&}L2j=4~ ls6'k0X>m^nFRxÛqҮ+Njd3\+I/4e҇k5Ia:&{8Jj=>zj'gkõzg7';,`,dnU8R!Rz2xvs#7@v?o Iϫ ;G|7Sq7gprh<Mx&r'4ƥm2)i~BȦ)}*J/iXXx!>E4RXiV˺"ϗߚQHv#PL"ԋ3L@U~!ބ4fSb C#tI\[}-.]\V VzeUg%T$NWx{go*fL|LCpGhTG%\BOhzhf?>KKVAW ECaC%cݝt,p&t4l7hoN~PCWl")Ȼ᫷5ϹhD+w\9A ]ON>btD邘ffFV4jf_e*GfUW3zѿzPM.,nr@6="wǛ)X8h]ew-2N%֮K\fE7(Al~otc+l `"a]7bFOPVLxUu5T)Ths]JFfq^Yn3=A!972;ޢUPIhr5M9+M޹$4:Au#:`Zc@j :t ͥjk4O94U^Bpϊ%l>A;-p^:Od3cZywwMa|:A4Pۖnc P` ̏5;n[}׉B|]tPFo҅70k7ɮcR-nR}'s*O_9k?AE!]rv1ozfu9ї/qCBB Fludn`I'e#8t9v'>-'2j &Mc0o!HJ AjZe@Miɠy3vg>,`nPS,yfM},a -£EF/ͼE-w'wwd6Km%Na^idY%}VVMӶٱߚn7{cG~ȲMHphYl1 -pԞ9`-:{ n'Jq0l Nyj% RHn"7[]>Q˘Hg8@})ak"T9𸨠}Hwv ȣFp TVM&y[c8 A,tJu&w#R3R@ScͤaDg:)Myy6 sW)׬F  >uhc.1><:Όw$Dil%N<=q<1ʡO@Wi9E3<sδ!"g pTbunK6o\ϣO=:u 6L>\Pl:'$Ҧ%%}JKr/fȠQ<5/2 td_zj!7 Oe|y0i}SRbaͤs8!F۪ia.C,eMNgzcbLt+!nI{r&=^do{`t+6Kfk2{Vp@B1/&v;nG $/ ub oE`{8k5N|\^GP順t VP\2O[\^ooO2X۟} RɲC{f|DP;*7W:Az0V[a`V*>:]ozH sԓ MCAjhx8&6xߠ\oc5YM͠hL/mmTx4S )BVa;%[.4 =9N1¨N1^]rkˮ@)}h<;a(CC ]Ȧ%_o G\ZL.E ?1w'p) yȳ1i!%6A?!%R7x "ZpšdN= +P mbQljBs^hMgঢ়\%}F 06Wb2)܅Hcsy>65r$xq~Hiog6WDR cLrf3/tE7F#A霚N+J7mv)ce˦}4{j.濝8Ү7+N+axnJL=TDZR/S6fJ|߁&Yc.zd_B]/_9e~ ޴>}vQW=*+3ՇO𣢵0ilޔ8zTUqy[4:*3 S0" O@  g<gGBxD#J`Yʹ\aQm5i $ՄNߴEԝMnVB (bІ`0Fs7 2~8B?Xi̙3qe,V۬ǹPMσ^CO=Q_J@*qe J@ :Bj$ĵDyG:PY(,"kmݖ+n_{w><hoI9ݙWռ'9ikP|!p[J)ʐ8D9%FY2*{%)'"ƻVu8#܂y*n`XbZZm{MuET¾1̆dFKvʽ>qgwo /5MODqQ?Ṷ6:e^x͂܍a# n1rLl'uO ~B>9 qd `~%| g=gfxxyc~Ql[le| [8 ^&]۬j<TgdvX; Q,U Q"fo'VA8bĦo6ApNoF-.R&5~CbPxٝa⾧;{l&{ ]s9 !&Kh׺%cB_ n}e>)dߩ%DxE`G, @ﵩQn8FLߦjIΞǧ!^ 4_?uܓ9:;K d7cpNR>uuu,2%j׾,)1́vB"c|J6 nb QZ](FUtd=VkpyPaeٶ\Z-{ ic%k \Bm heG!.دrG &ZlC|Te[&^T5o+Lc_d}YrG9I`t88oӆjܶsaNj7Mm*+7AFZ#o8 yDRғrH '!23#Tscul.J1蹪'ZjU^b ~ qT賾K"@!E ]_=_ͭAQR* .ƂM`H jγb.?I b U9 7Ocs^|z2kSQ̫]8CVpԵZ< ؙ\OI91@m KuvLhp*39:#FE34uʋ#y'vQvszyS;QWE~>0_ĝ)p7aYFG+IY=!F'fU賂_3>pw+?FO1 =-xEO>5N~$Ypw %t8M}:ldKL4Zħ T|7QVN.؝>z\))=*cҩx1 po_٠fu#ҕ>I|8z96WB7XrXvgWң96cPMjI׫ ]@SF$zWÂ[-[DM) P2E,\:@~IGn 95@& 0zHiSBDw"q%&Bj 9C e$gX&WpWUϨ2^*kΚeh-5&Nv;<`Yyqub<Yfٛ{豂fs@ -fH$1SPeQ08'cBe1-|]&: c h +nZ+ ' icj }Z3Y8 H6ݶm%߼L;(ޟ GȊ[H{j(ptJYJn&S'y1KMǙ:&2W |JpI@% Q-'kp+-Gw|7M<~IP5J<ٶG.jSB5} ;> *%>\k2/\4R!hR80VvD^kݔPCAȣPw:Hl_)J8v-W楬?{;(=co*, CM @6L_BqDpAYL.F}6GY<5rsmb8~Mxjn3=!:84Q ɖo'Am ~)p>]hC_͆N#ok%C,V$XQx*és&tp* Y#oevi вvD4mo3 ԕ2gy2$֖ˮP`ZZ9v+y{yP^YBWn ^_VȼT^x2;w?`EKOUr{[ *C ƝJydƄߏ_/ëΑjVEmi?!޲?9|>豙bOmeQ}&he߻6mY>\b v΁_ ,{E*z!}NYz?COWA gU\o$z1a2Ip@ͳXzZM9r8(7e N{IZZ¤_uNf$6)Q)=?VZiw%S(z%>ݚ@ ^f" v-TmQ}-Wr-^OFtv "u CIl* 7j (-gLnϬ=cOLs`tC*|Nw2ik-R7d]b{Kv T_7(΢]\ܓw$('9==TlkUӳ% bDDMTu bpY]Nm^0= w]~/pʔ{.s͋ӵ k'yȜXI w6sLf}B/5({>]?nLWM[ [흾-ʁhxޮ~2bL~Z7qIr} w:Ml#%g_! j g(h+8-TkSPb,KY({ř +2%24js% 4'|bR\SmBG˟ `Ȭ%N}lYmU[Y3]݉pN3o_aomX6 ELOݹ2Gtxj,;;"c/XXRwfnz(c:. [jA3$ 7}fx,Ek:Qfqe )eM?v,FES / l%'PcMk< ]PYURTa/=k #Os f͋a ]W}zXPoOK%2}[;"Rj!h`YWfN˅D3h)`7tmYz ZRGbɗKh2-L0V^W8{~LɋCbk1Awک<@_܉ފ> XV*t@"?`^w;h:>ml Mg[`0e<ߟ;χ?Gc)]!e M;q( λ/uֆQ:3G, :Y2U8δe]4k'm4:Fn^ ̍/ĖyM@&f4ʙKL:]PZbݠܣߋ)z "}פ:,`G[cL s01qsUu+߂G㹌_Ǎ(.)M\"¢Jkm1\ $t_p+稜,Z|fO.l[o~3Fd.ʔE[^X4/ΟEe{/e8sOI/we\Cu׍ݩIyC)yhkkR9q!Ij( "ƭ<6onrm nc,헓I%{bW9w pv6=H{ң15%CI"zfl06,X.b/#&2r$)~r?x/x@s]γ,H-]t񅯬A$g֭~.>7୮,^股¹_;'\ Ba;tܛv[e.bDW(l0ZCpk '4oVI>gU&j׵K[ƷR('[@^4?٩9OܚgwoC 5nO oT; E2_@r?SS7;>x>~tTڻa7cW"` dq]m{]3t7VzB ו|?[]w;7-SLscYoނEv/[ =.ؕn5+q;L$b[8NW kmGNz.UNFYzTk2&P /ZǖD_#5(z#!?n~H[6U^{NHyoDۊ}o^~3 @\YQav{J EB#D3J#ZcnϬ>Kr-O<#H(I6md_+>yE"#q4rݰd@Ŕ;-лl:5aҮ xEćþ1j9k@&A*_$n|K>˶FEEܡ[2 >,4H)C]Ĩ$.ƺs"U*4 'jUdl㗷F{:U~!f}*k$5#XV|qGm˪/$F^I֏C~i$paGӧQ&5xQĶӠdyUv#'XqfoᗁTf|}A+bÉe uv"e5v mHt =LJ:A]J=ZlѲl2veš? If' Us%DhJ%ge[ }s-w|(4%D<+`Jq݌(0\}$ $DxY͝(\*֝ <&N8$3jpZiBu6H^k_ &_m$x҆칠hAU}Rx]>#"g)n~@!%Cm{gŏUw b|PhI}2RdU\ MHArP .ç?I]WLQtʡBYsÍTZ$si켞EtzW12"dm_#t5 ؟mSJD?mV`c5i){d^RdI{P7VKsmDJF`&+Co(Z2-F7DuIfzwLيˍ~~M i[ĩAe:0#'86\1Wι0CJ PS" C0f$7跬46|c>"əݣ`sdRM⓬5Џvi`< ГЦDk  5fd 5UVeK|I+xaЬ>rx˼/L{ 6Y @8),:b UNh9^>TLޒ ݫpU({8anKRq ѧL|$*xN/9LYuxnE@g䂟l)@Sr )-jvaaX 2~3%uIeߝ]y>k7,@& v u"NF)s:>IA%rKmscuկUg4q [*>&M\:Wvl7ՙg 5⑞_ƖJzuS*#r <~WkZıt+]uy` GtD^Z>,7}Yw9,c&41}N NpלwNN&v tc-䦶qPR!sG~ 2ʗz ΐ&NuY[lV}5 [h P]xL6ݛB8%WD4ePAvî,n7x Pv_y׶ ͟+28rGsO\<"66'Heѝ?8nSnNxU,Vǀ?m#8&dM>>dx*{3~xhpLR߃.IЇGᕿ vu4j'86) =qjm9rW֯&-Y,""fejڮ-4IXNbKyHVCΥ5M<+SL$Bn @`jL="0 6/XW[5'8ڃx9njol-,,)g;R(6,v >.r"\/FC?#C<^-hb+[u* io.ņWf)&bȎip.*fɆ OSdĜZ &l-%8is H-VMF5w=}FC$+5̿˩)!x'"Iu9 NM~` ;tRLS.52Y֙Z+D՟qx)h upBfanp a'6hXيr5-#T@/gF)izHsz=oY ƙGJĞC¦E1F?j:,9B8tPOZ Kc3ㄳ*T $T+_W{zD&:si>"aPm 6}SXZb{M$-wR*_bcpP[^9X6`cަ3fDFܪƟF- &W`z. J}4ѝw^| 1SY+P…[)exje jsB^n>Kl<!*q+ג.(Yb_ kcG{*l uk*~PEuKALw"ų Lp$ҿâu5,Osbd5S'[jY4|K$U|?GHSEF'2~B ?EQ3D{ j#9fs Їv!dߩodU7÷[PylrӃ66aA9k烚YU9-H'GG9tw*YQ 55~5y.ĺy1G IHi3׌|462u0Y0۲JmN\wrwSq+&E#*\,Vja lE0byzՙe/)~Q|[_:Z])LIhhgh ^f. f0͹u_E?<\QX>=ĝSa%9u7 8+VnAo:)/1Uȉ DR˟rEE˧/E^,-$l[Ik6)×_Jogmq:J`i37W2ׂ1vQ5k\>rm<{UÉp{> X5JOq5Ǵi3o߽ޙ!nu R@01‹1|e!MzEr- &8:b$"a!\2Z{݊sGmʢU 嫢HVҏs^}Gf)!EXq=39 }WíG(QuBK@ !=[ >gV/V$O5p*PB;{53f|\Ϸ14s#D[Ҧ`41 9Bߔ/͇M"$|e75|b"eJ7d*Z_.;VH  hh]+tX>8FYAiNdx8ۇAk!Yqf0j' 5Dt Ƿu ,B%z`A\NldCl,g} Káſ Iq $J^7 UsÃpRuVR;4Iz1S7GQWt%xQ!7w0Vϥ=ha֫ 07_OwE|.~tls#\閠Ǘ vq]|"NT&B SR31`7#4mz|)QJ΂4&VyMNnٮk\{^  5,MQ^f c[PB*%E\OLUχl֡T'7 5SYG2, JbcʑiuĘh4;jH8a6(n10 7trFT%+7œĎj& {lH-9f܎ h~@]/L鿋޴ sQo^ ;l-COz<mZjp/Zi'M2INjO#c޽qB-4$#ͅ5mDL6a_QP#r,h>?[nUTKFE9ZW9~w>wT NQ\M# r\ysfBuHqvyyBo{~iV&#׋~TR_xxsdQA ׁ{k'85Hcnu<A!+O4-yPGPa)߃4"dШGCS *HÐ#:GPk ƹ&Uޓ`8( &wխ_ z1k%,ObCċ,r#"vՎe[0A, 2I:&^0fOз\K%n YH&RiG%ySg%7'^.h D>@k ZLd^ v铹ZaGu&^p#gi+}l7=ĔXehX%N ׇr s+Y,rØ(7bx,86p|n,> G,c.@3/>$5n2.~JlR|,_l.}槀!SfX8mg z9?菉E6|s$Nk&Ca% ߮G)65wT|9 _;Baln(]sbzz;O'4I4+\@KqaQÑ)hB" .~.dPjM>k 6ɰȲNI<}FtvɣbY\h5F1\Ʋ1nbE_3?A0qu/&GBTD>UHa6jICp2B6,*pswFuq& >}Iz6˲vꌒN :.O7 TT69]L(T꨿_S d,$qv}?a;0QX۸B@ۇOoXXdY Zc;{ltrO .ȓ$rMJ1s=&fh FBw|r{!"P@W lڑ&p8*Νl:7q$țH>KZh0h֎C@!uԬܼm1&!^+*~Gr -~u/OK%/g tB[pИs^<ݽlS ЯV_`))|R>[ SD*5bu@|:wƼ5}(X23(=DdG To"hR%T[Ǧ]ӻ,.u`J߷Q3ֻ٨Qv]R[T؆@:(-+C99ЄqW7# H.[Aw*ց)Œ[ m:Apo{)œTPE]XPr9D93emQ/ݗ('%MU@԰ Ջ;y!`$(Dj\E=]8iy{ll3X뵁^ _٨9׺w>U~ծjkYKfDk)MMhBn+ٛO#mtm6ub{Ͽf@|U`#`=)+0?΋~*ie7zyI&>n+U}R;ru X",mڻgn>)8p2)R+-42ؐkWN_9&75S=a䀃Ch޵ګg 0}f YڶK˵-oJ4I^r1q0Lg?ϳPWK_x&q㫧mG+`Eg(͐_`~K?Q v?L# &@]‘lczo@RqGW)!D'Qgµ!@CQJ2'L2:' (ֹnlX' _6|DЅNaPG-0'YUCl@?ZJO/rQmэ$SrZɊI;O7l_ e/=Oh$>`5( ⻨L,[b֏pm[UZrQ j>E98Hm4c *"X-0 ?](lM06%P|{!yKm-ү\ GR*E=-%ћ&Kk^5UP^٠4X $)^JfU8U Y B|ުEH+2M>ITVSU"2$]:|nO% y pYibIBaR#5I w@Qņ@JOFl#D!h3,VvD(0*3Θǹ'[*AHm?aIIO}٣&7T8@u1TJO5La,[|]6i;ca*ktO[GeU؛=Ҏ΂I>KT S"7M(.Z%(Vs#I?wRTU0և.̔E@{_&/873_E}qM&g|S(ў|v9y?ɬMds}Cxa MBhP`$ؑx%+mU&:A=A}f;t=gUq`ފ Y*EECiWWQ{/7mr|%G0I~A3R;%TZ'2U],h\IjLHм!tM$4~&t&Gg(G<>N` ),c9U;2 9/cAdZ~p}KQP2bjf E9S2Q5@\-9"%?]1Ha4+XU/f5Qe#[1 cDP@kj%dy-Y{z i"NvVD&dh_ydtj-T|KA7% x6gG7b@ FwU' b<+Hz w㋥}?R[ڰ}a`*^l1K󠶫h  tMzL'~R?CDuBFU@2W3 ajz55HdМYXgUlžY/%? ~<@'h=-6~\g $>QD*]aqL4p^=g(/*s!QNumo*'0K`~_5"](P_Mm 5 rL~GN6 oJ2zQmf.$\m9X6?\jZ^'saK9Z'40۳-'tde.nQܗ|@ K_ںWhpWւ{_mo4%fy }yvj.xRu5s/{%.lpO˾{rYn>6j}m/buS]xdZF `".gKݱNcH$#6 yX 4ˆ8R>m2t%+.͗z6J>/ّl M|A4d5!_"_C[Fs2 w3C1qᙩMqlxgWu"MOaTkI; RN|b\diP(x7#["~zՂ oΑ9Nj(T]!3\8B!1\d%F,>.O0KG՘[@5^ÓB_iޛop(nWʊw{k$7ei8qxfvݭV|eځ`?Y^.4%Xjj5USsר[-K.Y4k 2tې SgTJ}cn4붆+,jcG# n2wjKLxn,/8v^v;}(Se>:BUꛇ);Ax$IA?/b{*pMPz<צƬJ Lj@Q¤l :$'׏ѷ% 1egnmtOљY ?nQN^l*}PE*߄BK9 y 3G_j|U 6=q>֚7$6E6jUY72>h '+" \ \t/:='1-J-ݕ+PgLVՋn91?<ؒ% \mfNkےRw!Oft# p"`41;At^̻59$%I#"c@ѣ@ "0/DdhOHBz &cUu)ș$v/`gc+mł?u5g,#(EbHO1~3@;\'q&yJe+dmC NgU \dEZcKhU9ߖ;e UK-7X#bR 9Ĝ}r2oyC) ]X=P%&B$uu`Ԫv|~ݣܚظ _өm^K9n{x[ǎ#8#4eK;I9=Anӕ?| *HmWe$idRR9 a͏GbXA뙴:&.2 VHRԲ/1ޣYFȝN/8Z$v^?VB_/=?/\S/hԽJr;X6[ԽQ'ݖYo*Aʲ*RՋ[tfn# -CKN`&4l\ձ:^gf?lưʶ)o-!?1+ZWIml“R )o<*k²hAcI]HF=9. .niTklsd{Vm C'zR ߟ@~,\f,[fIuxoSl2ϷGUx%H!,MllsZؓP6v]@h %Zz2a!!ÚbQ.`7oFhplCG-D]*UI(Cz"ɖ Tcc 7T3 #K8)6!>& /amY) muѪEr=TvMۤJϟ _7~&lvsυLWB0Nj0'JȉmeZ 'POne #"g1T2USW6OaS{ɎU{[z&īJcYn"Gˑ^O&~FwmhùHהh& bрfh.Y ĵ|pbuj[ ȡYT@PPv9`һ(^|K(td.#i9R1W H+<>Ցg5$L̈W..byV@9XŃȸY(NyD*V֋İ}5&Y3.P$bN.iԉ2_E^λR7q,dܶ6Cg8 ("))Dom%gGZV0W1"JKw- (kJdEKD(7dn 3%w X@.bг&rmV/흇w"bYdZBttjF<7W6nnuZm]t)3^U d{3m̝\ 1^Fa cHNvPG+3VPOkoY:xz-$lIr Z#,xm=VUs6 -rik%pf[l[*J `E}mʨFA6AI 94XOwdzz'XKĒ Z Zcpx!Z*#G,y5T( RBJfߊA[μUR~P:7fg.,F*Ԏ߀<*Zݞ s.taM,ct1/aBBDOJdusH875Z%pC>js/ZaV3 /2YA>bPU0{.ZMu2Lݔ( (J6hꚃ%g9[]ݺ +h6%m32"U,TȹԌh&p5 #t,74V_;=Y`[gTmLpEoQvCG5LS9^BY&L_vzY{}]2O1Ii#Îa(q t >5Fwv"r!+q|옫+EmyN)0SbYXj?,k^fdQlW_}"7B.()4$ʿnѮxfQҔsCFO&hTVk !0C5;$j4>Xt%^}L"1-U ˭9qa} ??EVnߴ8495 I'X0382ހ$g(FU'odĨðP{;̿fn Lh:ن  ؗ_l4= CoA3 ߵ_D>1b0@PsГI!ǏxE͖kݳi?c<ə,[84HbprOB#d#b9ԡ5dH%SnKp<=vg3t eR,[]5(͉L;]3uz/-hne s/e`'*M T~s7aO.zes4yeC9POX2K6C/PfG eGr l9.jή3]WW9 QRHɂk`:]]VP quxX˫/z?|j6,PHx^Yx8feYdɒ6]/V?]vjEJ6nUO;u+hR[@/45ԫi Q$ ۖ@OPǨ1Kcݏ+5J:gR1g#mQd mv<ޗEv%KR18<݇+`]& |E {QXTiTדZ~uIdS2Ҩ鏗 }}!/!wx2}g7ļcd}PS u In1I:p=p21z /!D對4XĜF#߬VP 'Yq/"ogGQ:L2MYW0߻b\CW9&=BWꅘ#;\'t4#Ã3.X̫x)|#K*\ADL H^2cBjɢQ6E$e^.Viם)B}MV4=kvTJTa/0(VSfKT.ӻۗr;E{ѺJk1^,~Fw4FfRmNI 8jr6ptMthL< gPEdqYWu9em؎2#vAl=oblA?C ]+b@dGEeWDBq0#w-D*6r$G ҳmxd6E u@(YsOϩe(x]c_.hXI6\'UR#x:tRJb4rwvĶ\#q^wpذ+ǎtS/ ‹C” B+>CzdR%C}O1!ۜ|E0c|*,qOH>}_$`@J:k;_eb^t\$'̹-ESIwP N7OV*Vku֪t%'7:'K2 ,B 2ߛE͑͟A(<1O%˖"4baj8&\!bxs3Ϙ$7dw;|) 1!lAn\FhGG7C@nAγs:{6+U<wsx"uAu½Pw,$b\[ $ A&qxW^yw g9"nU7*:[s,&VJ3(a=?1miP1)z- JfK}Fӓs/ŋ_C]ad%PKHE.^sIN5xC:vkFW? =] Ȗ8`7Y㜥%S y:M4h|7w('QGӦΑTDjorAF'ԮE Jun2.=vj_r\|x |^$uLʜIgr/lXu2W C=raNɗǬ612K<~^p8d}t\v(:k vIͅT$fXT*bqMݰB:?pmWae*Li`+Youb߆Rlz΃=GXh6[29i9a 'Vc2@ZA4 {Onc +V(=I!]WT/2P>i`?`;4C"i#XVReR&NyN?R 8hmyy*;G/يCzuz'j̾7I4,&|tw I\6C)SJ3ëX{ \;Kpo,a{C"t߅3@*ٖ:Cg/>}v8^@^3*dF?o>zύF)* ހ\M7SiNf!3[Ֆ鏙])&c9RZ/֋OA@tZ#[6MhCIR_blwImz:@ 9(:E|p=_,zz 9YU{8Jq@I ԸhŷbrZL@xscovtJZi*ƒ"q1+kY^Ƨ^.Y͝GP:3nRȲ:iݯ_s,A&8nr7gyI"~JOD7m6r}|̼AN?zUdD wz+>dU z.|ec~fR!r(ܙӰ(ˍM)S36bxuruP@3ʛ,cFds[Yz3efI~j*I"ԼUmXoezk1 dL0@and&1֗XouFgJVVѴ@014h4]65 @节`D#m@wv?J0*Lz? H{uQ PQR2v<[X|,ca)| YCrfxvooM FpÍmtbta>|T ٴ;GJ2$|p/[ҥB?yqQ:HA_[GoAy.&OUJ1J^>IJCxwjkʋΫX\EŐbbe{K)T`UƯD4 *,*|2@*̪ F! q괞9sh t`Lr / %E_cRQ\b6;Ґk-Dukl49jByLL7K_a\JUVJVt!!2Ce A sN": `6ҿi y4ǔI#&& JCԣZ64eE8]Ed &p|53|;t'RD(YA@z;PeX%=cYݕQՒ]@p ^i%M#q;ϗOjъwS;r b:uЫXn/^I5-F ؇e ОqiYr7ԝtV `ȗk2!`[:)ۉr^Гmr%3¢^Fu}9vt]#&I8>ksCyN knq_=WèfT_r$A3#!ٲҩ;y=\5#UBr ?{IFi|B7NȆ9Y8ż]:#+r i.G6et{$f~|W\AaY`ɟhbJ1*Aq۽FÑ.)"YJ?'6N-&߽*zB29;E=>ɓrK]̗ȏN*|#éSЁƏ#^a!O{u;bNvjJE:N\E@>jr ǑX4c݊`cE&Opg +0(>7wtXwIisSd#Э@ػ~BS^jx9}\xHoԯT:.ը {"yz *Jʄ3@i1d<L^ٞ/}?TiP%"xJb?>jj8QEaK0~4o*^G^2XٷU)o*q\VF?1B fP(U˚zN0 v*RmgoXq@[ҘL5.mql$Մ̅wՙ!.&8SS-olTDXRO"MHSN!޴*[zI3 P$p8_}h&Jvf_<*{Ap #> {VҠSٻliK%닋"_H{1S|tÏ6vqp z%|^#sGqh%?m  x]#syvDi֔e.yB3q%a]*^]$k &YW\ iΐ\ؒNȂsbDT3nfOPGz"l)hV M^8euOpb1(}8b2ʚkP)!y2v? zjp#~ yDenU5WKO xEʈ5#kܜ zP4ZVED VPWNȡ1@j66S |wJ{+r3;%~Qh:M?g3E&gpkk7dD4ukyj-ͰlEΞȮ  %P "Xg6#ྙ's^9^wUX<; "|ex)~ Qf=zUU)>3Bi"Js1g?H0fW,'BT3YR;MhPPxF 6l/KS߾עS 7f{l0AQ;v %Ƿ* {^k 3gz>gwŢ!}ʪ`s3Ȟˎ4UK[ݒaMw0|0]~>e>AW^4ĄqcqR3qX;Ao? <`11Vpl!4#1XQu/)q#yin*L [kd.MU_%{ .x[_3ЍȺ@ Twwm; KEpba>')N` IU3ehy lٰ1kD;nVv.uQu'fԙtCkjexʻK*d/*oO8Nip|[ poT,7*x3F(5\PL`p4\_c=SAT9ts#aF#hAϮ3YJv BeehF1gq e|ڒ=ykAX޻䏍S u:n,[jnMRL$c;e.æ?Jc*8GLFV:ކȑ`,+#ǫ[u6U[]pl#:zMK7LߚHEk!) yX#*jΎ$WzM0uU1zʚ5n} ;) \x ADAR r"'7n5 iDd:~-VQ"f+[X$g.ƯG3 l9Di0̽?F,=T=nH.ý], *?)~Ux *lkKfN(Il~3쾰ahaAgV}ࠃMDի<}cvAU>;Hq?$ZO1F)&[{Z=P ϕ~6%OJcݍy=g_#9hM0=9JHϩW$?;h!j f)B=oj<T.ÿZ'= {uX'9V9Y_>vSa%tPN#zi#x}bRpp$ {Pˍ4V˼2X E:+ˆF:<,g0e=:ӵTKᰓ;vζMi'3܆GGQPϦ\H7rp ,w]xakGl 3'9QLCQK>_Tg3Eˎ5FFXp Uic➗՘e*q:lN0lŧ%'Hѳ~fOI߫fZਐQwqfa=D_+u1};#]N$8]L(kJ-ۨvlFyjKEoT#_?H(?+ه\#G {I|_O>H0g6Uk6xkxk8 9H/d7y_lNSN7xz`m^8(gc!%;f~MG\Ŕ7J:fs(xx6~ouxtnPvuPa]jYn{i2l:v:@ZNk xR8kyaG:=Vjk*N}5(!|{Te|P&1o9Q =Mt %d꠺E=g##Ծwi1w96_rc~(|S>N)H}y\  Ǘh5Oց ,q(T&p#^ SC>x͝Fp|L TҾcA|s=z[GUbSM)$g|sq3F*/{^׬%v a׵sI8̺ޑzp0˳Bė1c1AD3y3ExyLOp* nO]Jq-vRì]cvㆯ3}VnkjP'{{=ŔσTS{:Q7n˻,{^kO^Jl:BYI}2c_c0l1=\K/g(~@ˣdYǂe-Pj. "-#b/24 cP"&pJgyhĺ0fv*s,Fa_><OwR= ={DN7C':ݼV+[S׾ʡ~gŬ2zQWG2f0kPSU]!';gEa!}]%iU0&44~^acp$)+c.D׏ha 4d3^QUhw>w![B,bzFFH_1e/v0q~jKD03Af-{L". 7OO9N= Nz}[,iX%2h;'!nLVnt^3̥%q2ٖx9[j.[`7(ml00ƃf(v"mY>0]0oٻ!yo&)z)-㱓)xgހր'GI5G H) I[v ܏b:׀.RNuo>v5\ #ޱQb ѐuI>?Tʠxʐ` H{rcD~'P#MxtR1X|v|/2ی$8st)ƃ 337d\(J*-^$1e_w%x)þb7}hif"D#L2I_5 jgªrAC4VQI JMnIo <}f@-Utln,2Qb~@5bd؁ČtN{T(}KyrdR鑡R"{Ujn;`3ě̛ $ѽcXn39ʍKΐ w\)2$:y<`߬6nCy`v߻Q1.G;_0'HjC?(2zVHwc NmV{Z0+.UY^aij$ӓxLg: vmʅ^p6bʜVQb_OqŰ"Ȟ_kVs{EŸPFO(k>esա̜7&OrHG_^:Ha^^wW5KqzKhc] 9?V B9;4w?ϲZcS:*6q8x׆bE%U,DE;ZBU\% 1 @PoCUyq6> `@U5;WxZ*΍@JȨ}^yi=bX>a9DFi sWHmBOR>gfDf9ב y0s~=XRQOuu{&S!9n[ǘhlѠdA a`fK \Lrؠ EvM1<ȠZNƷ p%DwّZ6NLHa   b!`N9p]]KK{ϺQjlsE}? @zIВ $;:ZޢZx.jhaxf?}0rؼ?qy:iny;8;HDu\ڸd{0ھK"{KKWy˚Z^{V`=}ZviU7_ ڮ+p`PR? O]X৔w8Tm(jdž>WS:FCj`˂И]儕 .Gɟ*Hu}ǯ֖]>J]ReBP^kR2ʉ6T֧A3simz)-M[6?O}^ֈA c~s[!h`:"/y̫ *.T!FQ61ۛߍԲ/Z dHĖvYճqٕ$}tA0-ׅߪ]:] Bg{ߝ#sg\[&ohgi[ł"?u-~kNS7xC}3xəGfJq}&H2O'Yy}|HZIO+x|L%y5ˮ~:#6hقQ7bK5|-Oeks@ ;g6J vIGD5f+盧QJP/%m!vG&Cb!Z+1jaZG \{3Bϔͧ|àx{GkcHe3Hݢv㉐7Rlg=aq g?_SJaȄFJc$r4]g=G}Xj̗tasLm@,u~jX( ݵE/o̞`tD|zŶ˗U7)Vre}] _2|o @#ftpbP(J!'Vgsi5v |΅262s5j!9%k0qTV&ېV-gb Bd~{>8;p[M}1SnB ҫptSlIf60xU :'i9fnLdk怽%,ΙUcl¤~n>0|r2yW&ޭ=#hiނHݞ]AGlẀFhyaQf(WFf[njnmj]PXcv()#똓y~f+G4 I9CG +z2uspTnzqODgI^=݁c_-7a $<-̟LKb-Z!Ds'@b;f7~H{ΌYg2S 1 Uv{JLRζ(맨l|!%.cS#grV*|=h 3ۀ?V4 >8Zqgm ni)& bjꍞN!𤳂"3tYM@Z(|J]D6Ks]E 1,e^ގ6 N?"S"Lb^ŃWꬋ:;#7a׷1hû>#Dny 'BӼH:)-.O.=06~+OZE/k5O&;e.a.<]XPi`YU͂/vzrFY~e4pIF/1{j#UޥWSz,(.X Fo %x|<1ի#K0? B ŪjtB6= ҆岦/FIC¢/Ľq&ĝN _m!S=fT]Nzm"ql;~P4f"L"t+@P|v 3[&)Bg%7g 3s8'Y1%}XlpwhpTdXqFUd%ĬvL2ӂf!m>x1Ѥ4#I }4Nda2rI&XCZT:XjzxynS̬ ( lM vM3K ҧʳMa;=41`q֐㵥û0.e|+.# W unO4 "䯏+VA{1hPò[9|)IKOo K&L(Gޜ(s?{l+QCh|U!>c3HwTe14kD;\ĺ>銿ro > #4>Xv)B%lv"H~lA +TÈO`SVq(܂K񎓉|Kjw~<ξBQ-k'BXC$bgW<\{tϒ]ȁm;8h CC^jUkm(qSbܾ+aWϹ3 : s@,tKU[Pzp8w#]TZFyM`vQ謹d aE`*m&W5m$>kJbwrk)tx>7'ֳ.'eth7ʧ>ҁ2~{J3\5A\ .>F=||<%din[fP5&{җxi;&6o+G+PLsCuB<2knUÊBKtz}  Lˣ?L} ]-E|>h/;;ߵ:Ȧuh>8!xk*J `=Hs+Ir"9%B&2nG#bjBӦL`I\V.>*lZQ~m>nȴ2kNjrj(؀lCv*CF0`":4̛m UskNBH ,y툴f?e%[,c@+t[6t9?4M8BIfbSWSݕPFcZf+m۱)/#fnlI٣4nP !v02,:q$Yg8GI7@pb(f< |CuEzȅ$QjXWM-w|K0a_* Æ$nP1nhg.IY) 14ըkn UEcO, \USbלV3UX N f|CH3yA%hhkNuz#/ MtR[밍r*=+5(%8;v6W9-w;":yDE/nNvCwP/edI߇@6N f6H#tF L<h0c4eי2.pP!1;`Cp]W(mSer>-4@MZAӌ7teXc" Fٛs+$tfj ۫QS[QTu)o6> Ž]j0qKYN+`Λ7s]v(ÎV6*tya!9S`@!ٞ0g)MtSb~A(XNj+ Z vC 5yc6)% OH Z J*A;{U6UIRqO$6[ WO%dZ}m&0vwYnsilQGyڵV=u(zxOZBge.8PvDJjTUMQIc] 1quȐgDjEݭ;MmE%6LR5[mpw0CP RHr0B&%:X4 i>4&8Ina-*NPK >.y\QE׋ i Wy\ymv{Erq|y+R+UYm5A 39jPiYl^\NJ~b9cvQSQiO!{ (KPaۀRIP"Ч%BVaQ6hG\w?L96U5@AUoVT{TkF' *{|~WRۆ "0HvF9`\AEs_y> iZ {*j÷>=$"wMOJĹ#,X#Y^qJIV'o/ O~hľ !b=$q0ր[u`}kFϦn)l_@o' JS-v )8r4Z4!d0vtɣ[ɾh BsLz4\7H`gF[rb9tskcc.ZG~ xd` sƴg̀|MqcVǤ,06r[X:> {`5SϚ(^sveI;[(sfpiOyh)?SԬzcݣ(O*M(~OB9='WA7Qc@⿊ >sٯڔ=\ˢ(d`l#"yy+4V"F^bv394u?n*-xFH3Tz*<dt ۦ~DU:$S'W Щ8hT7DHa0;kQg7 Uϛ1u4@P43~Ep%τo7=>:S c Ǹ@Z_*YN`87ӫ5 εic K,>]maC( ́(5ZS|{|~$Yuq3IB=|G#+G$aL4\VO'5Mtn:7 Z /(8p8#W7XQ/(MJiBe^f{ ]aXbs]I6ҿb M'h FJ}gҍGt( .W`8IS^rrɐҔMWjUt6XpWPR% ~p)|; 2>CQ1Yb"C6=sKu*~>}z~AE<UuDy?|=Z线zM);3x%_`F\[x`8 XEbX<ٱ?!avX"C(K&&y,%C}QM͹Iz*êLuԻ']^ ~%h=fw&*ubE9ˍnz}L  sB맴qILF?֭)>_TR~?5¾oc'-{lEݹAjiTS ~dE]OϸSN3xo3`xJ,%Uhtxf^z,jjc^ܿ!I=">HppCI ˿*HJotE6[_E?φ\FW&}OKyPVo^Lys B ; siƒ0A^Vاt,O?9dX,E0PB!CS̰{WVD0Ns!m}0}P"Z$+KY{BL3v4aTĵw d4ʄ?0] C-t;p[+3U#_z9u Yh,NZ\ XBo{Lmi30>YDienVIZacG XJN|:|[#Sh{0Cض/\Qf|l2biFV}nMiqbYhC+o$cvYS]H^tO3֔9]1t땻qpɐ'Z>h[kֿ]m">cO^x`+ BOԬgB ܍~,JH 2\q6(mH*5!]7Mnua+LGNWn,!.|80r \ gņž-kBIq;O X4= i58Uq_v?(\ҷD#=?KBCju=__ 1#㶆aZ녴]| g J >ѱ+:Hm ST}_lbЯ{mgG˘eANA fzUqw\MF0ȅ;p^5i9a,o58^ݗ8쓇.l(m%8k`RUcޜPqY{K!WE'Ğ'3]y0gQ ̝U$Lyʬ(A/1wѹdUYZ \8%˩-umE[6QϡroګVF764o F^rk˟sL5%¡żYH?ټ?:Nq$Jsa[,^p;Y:0^YOAӸwQҪU&[6,0F}|쿇r~=JM,GKЏAdi; ?cA*.pۈZbX5HL-oEXIG64@#K9̫񨐋 þt8εuN0~ح: кЭ+3v2Avo,P=hdf}Y=ŹoZs7uf$zĒcGur8j%PֺBI\p>AP"R荞[}:niyN+)e}/. ut+mzoEoui<, {CP$ƉYs$ޡwkaW \+kNFB0/JDī 'ܫʨP(phS3ZXZZ P?uNdUie)1JhOL4'!))kl*wօ<4tڡOXCШi \rVT<6%Z|6@jH֟U0")w#%/6ɽys<{{SDd Y;3 6CR^~EvUSՙ');EiFOR,TV>'k~aB)aZ9iI2̨|78܇E&|e Ptz^H+牬>U#PYXK\KwSZ tCH8" Lq32z@s-ltz+vWX\]$ok߲fB<$"M(Ux!`ܙwZ;~D/-F ѯˍCm yۊ|pm|W:St++Ȅ 1 M4fSP>`Ѭ.H\dU/كPm wv-P*XK#A)ՋEq>",+k>5&;[dφwdA*3R W6|P<:VJtu RS+ sy^tsTl86el?'^{i˔g$5xkPD 0|B-hlH1$OQ xKKQ:ؗPȕdwCAةԵ2#y8rλ<2@Bj#ԊbmaYF4%]g>TFY59Qhi[+ŝ9H:X~[vOn$ ww/4,Xa*дPF)|)ؒyWhbۚ(^xh&Tڙ+L<.blBoc0+;m$?[uƉKN'8XNBHtOIqBg3 b{nYrUy0g`ИcN^ r+k{jt#YiWOY,}%4Amz!vhBtȤAo/lٌryKnt>,f$B|=cSޔ-)oou|z:+EgZ{II"NF呴՘n>H68Oy(LO/Z lUz GUcxjb@vtI$Mbj6[n.8bF"Tm}*#IX *UVy9BKf;tg@9l4a #|",/zpd ߐ\cvú ]?m@ڀѡl_:`B /Bէ1<*N^XTFܜiԒeq4ُ%i=H`" ^8>?w~%5#dTa2]- ]y1C#"!KlGLS(Ag$rIk_3u!1dќD8 b ;##_nTbTI+` . N*zr)Bawgg*.ZWqqq l4z>_umH2MIÕ&TyH~')DG[ާHX|/ٟ<w3ZIZ(ƕ!`! ΪC1 0v`ۣd㱌Ph!G N!xZE#΍̗A  @21yRʗUy;\HءYwE^A_-BVUfC[,e P)sy E?aY&TEzxOeOlrȱi m.P's+Cv`en-/,G̪(\hb{GgGݕs`hŇS15\|!GiQm C&D ZlIߪ"GEƃ;Lӄ(t'drKom~/ ʍfNI4s<1lS}ΧfhhJKL9.2mWKc8yS@g/M `&.2*{|Kd0.h1a:ӮՋuI j# /| P缊YYxhcwUty} ʒ~wQ$4vZ}s"N˔( j٦k['1Qp e;PE8C4h]]$',#{25hb^ ?pk&PMeXޮ'0(f'(fVJl @mid+cdϟ9` n=?M)i!' n\Mh?6"LyR"쩯sQ:o R뜓┹QSv#B`=z,<#8hm4db9+K,5 Wjzhl֠"9 jqn#E j6/ A$U&7rW,VIw#ve7a.%%q^{e"!cCqTa&\ybreϟ57Jr/8q@*49܎%Ϗ260.P?շ6$]Ae`$~$neR-w%'jdQf`zB2UZөUj D^7;Fa -b vMYɣTLt4wk;ʴˎ?H}'ouк&_&e-6a"ߥ'='8ܔc,xȯ!21Aˡ0zIj\z{SHC5-ek0_E4M&w$RXIK=bӰu9˵aW졲Fi]A˱4=%n5[E~Öb{RDDKL3he{QΞa7@"͜1;!Pg>hQ# 0JnMhE׿+u54T;-d\SfԸu{T 15gɢH[ ه|8׌6,'[}7~w?s 3 PS R \EWE8к#Q$| ė’PZj\SD`!iw;wф(*U-?Ĵ=)@&qRxY'#B#07 1{'(ה4k&B,㦸QƜ!N:Tt )"]X,X5U DYM\﷈eϒT&MƚZiqvD7WAk!-yYT"@ : öEݔba\B3Ϯ2z_"#~ {°wy,y}_)8X|V1*x<ۣrK#;éYyG޹{DK8㕰5#NW"-\xUaM,n03[M ؆-ƚYEWaKtչ1yix# FP<:va,ߛ| =X W@xx/C?.f{ɪ$(ET%fs+U@?̥zv+$g ͗yVxTXxpy,5A3tj`FmeEc+ѝ4 ( bk/9ĸwSa#I}Shl&#@%TCD;@gX*L iu93kɯY~ *=۩#~Уff U0&\XXFJt]^/k=!R #޾&}A<|jhv3=xQsD9ʣ`>Ї_ =xۭBM'T(.Gw OrhV:+NJ]~7*8׺~rtVwJKsrAo ArA3b-: hhbd}1t"ݕm KQƤe^s`Հnp;Ȳ?GeVCyڇISmuG p4 |RMƆV8࣫VQFvHI%prɶǻ3Nstp%)uiϙbS$,T pfPA(#Wfim6OtsJ"ҏVFn!([Hh5(G e Mg%%ۥ@UMaW|!۫ F/NBh H٪dA8gޚM{0_k}Ojf$MoQD۪ɓL6 ],7{O+N7۵GQˤT̪e DZmJ}LlȊUǡ[Y(OXbU|E RW5^c7a;C[l:&\c8-UBcHG-bV\ 'RU ]VkOS 4*7AӼÞ ܖa=gcO%6b|d?ُL|B3GQBhB -陠I\ mFLKҁ>i%, );1\QWq@#~E7X@5o%+w-cp Ȫ-=,OA!<իh|t5M LKcS#!NJ sY;=q4ĒA 5YcBΤ58$0ۓ#+@?0Ȃt~7_ h +*f.Un;b.S/8Y^SzY&N!G7TnR*InJ_X.S=^XoBr*r]bciBx' ˜3,_ްR:q\X [ڣG L`46<حsVʈzݔVH4~@!,䄮_KiEԑl6~to-38B?+#4Q<{x1UBPs Y )aסH| :ٛoZDdgngmhE'+uZ=/0l`wu ff5##ddDA\W0?uk9fx:!Ɗ˘ \GjA [ ]*"fLLK};664Ry~o=^5wx _FTvvLmr:\B҉ɞR01̂7d~#_Sf+zko+ ]Qxw~eyprSp@FQN"m\{ H9lQUf>8Op?aUB}_mrwLRVWy,Xg8-RY$4>2~Nj[RRٮHqe;n0d28[ErjK) dW[#L&e?mUWXC2_ gpjeN,ЅDP1.ER:5"Eh:=] %I.hkZ/1OUPpûlʂuIn W9}[Oj;SFYT 7ck-}Rθ Xm3hdU L{-ii9\~@* kJ]i?۫q7M[`i{}GX@w;Fy.u!b9uzg}ٌ+k8v7l&%+kBز,W|b8 d {~r' Rf^uNCU8dqgߘ#i,LGg5S틾Oi<EKbXNE)`<2E^;캄D$/O k=aOqa4rno( ^8yےo)^=2/sМKv&Gө0&S!lKhItB0,̞֓h]zTKR~O%W 3&l1, /.nsa$g6I͂rH. Y0fK#6y?3ZF#QjOr>T'N@fi.:Zsh1mXr)a!|˼{BOPET/ݴ$`z`F-3"azSڶ9^jߔՑ`Z)#NYo)1>%.Z{,ȰsžDC)V_v ˢmz t"^8-Igv `X Ku7g0[jU # ~_P9vu[~PMCćLpL(%1Cޗ(u*MZsW~>>/ƆkØ*?~]>sLžíx˚{rfaS7;ǔ@bo&)65nV}O5瘌XAE|Nǎ qF7D_i3Dm|eđU옛쑫WM8_Kv=V.9bOs0~d'W ш/0@aACI/?\R6g[b w@n[+žQ ~<@6ȩXU64Ǣ:7X4s%;Q3Pߓ[:nhvu *staXoFIrыwt`N߀Ajy3%I 3 e-s͚CW׳)qy3|RaEi_(hՅ!ZFw_J%||Pg9#JQvڛ&ͪr >5n3wJ8uo<0B$P8眵H sA5]ϖhz3& E:{|%]N%ZAy/!c͹}gjJuS֦CT;0va|Fj ?NE{Vhߗre@q#C4f֊ǥ/İBwi52%ȳ^^E }†,z8:T *f<[K"ۭFW,> m3/:g4^aZK tƧ K*NX|`aEH_٤ӷ+K9sYs+t1>9܋ˇF#kWgdn|SP^I.;:8tԈBiDE4TP<_R d4hSDفc7<=G \Y:"!bite7"M7E GXUk-ʆ,MѴإ*qe ;xFM .2(t9KY$QhVh4EѤ<Ϣ<`zyahS*H ,JϊDʆ{Eb@tC}NIb,Ї_|١h0x x+>; <  zt~kkwiϥvAĹ~\`l'3^; 4_2%08^n"+u˶([Q*'mLPt|_tPP[>פ y>Q#8|(w9 [B{ ݆^t| Mgl[:~/5 Ł1^[XEWoS|yq粜ǫ3Ml+W- Sv3hѰyW$ABHq9:XU?t3Göxƚ=K0q p])ՔF9]%w`أ[PBx ay2/{(njJ҆*7QJs+ Z?#Qwn5ER@Oߕ u`$1x9&L Q;g.W[fG2ҁ> 2F /yIJcr8&2%q>GߥI`s*7W$VŜ6}`p`9բ/wZ lYkG\SV+!a$Y(YbOfپh0s[DȜ2Uu5iB>y1[qXmfС~blyAF>YPXE$X_9Yb."tDۈvrz=;2jt0 Jc7[1h|{753%ݹ3g3:t#Sd VBw)B-7͡o:EtVHkZ˗rpC4c epJ"Tj6Yc#ܰ w7Zuɝ5bjR"h o,E Qj)Yz|.2I3]r;bJ=T'EKHx]=L~;ܸ۵\&{P:+^sUJvѫᥕ!U%K:{._X-F$PJx.Ja5!JO" ~]Ok.* *Kjc J޾>^UV 3F~C%[[#&0y ( [;.Bv(yҟ@S+`њ`^ ! O^=='.|lA ,,-48\W G={|(mpy'DAduo&aـVK[b-S ϰй-xf͹T״iJ 7h5q}Ҳu^rw `8%io|+yu|t)nB wQJԹ )D8a7 UK+9b=CkhbY% nǎ/x8^ʳ"" C% q.+4z׭`̒kuŝ׺α7k {xtp'akn9L;?JU{=W… +jr#c ,+ p+#|^x_"]'LR,]ذc[-23R 9] ҇k 4tbbQO°ۼ>hX[9 8mMʑ([Ms3$n9J=, R*efƘ?n:<,ɟǜMA/EB@ϽļCQcȤ+I5)ʯ]s{z$X|ܡڒ#<;=G- ]B+3AXf@q,e܊EisHGyŨtel4GA^Wd o @4aCZ8W?-oT"dE[F;~ qZjD9*3Z'w+ +7΁DzS25fvxt(r%İ[ 1N"aHmm1#pLc ˀ~Ub9AsO`7wEq:]*f H}aT mRiOcn?B,sN"kc4&Urh~rl)#^[|}? B@f!P^<6|RQx 47$ \qt^ͲrcaYSA(sF(ʠKvWgU0j*. 2`^.PBҟ%d5L]vB!a) Y@,Kd%mQ}5(H#yLU65~JʝcMbM9F2bx;̲=p5a1b$}ĭyhljͬrhƮ BJ6iOI&?*%hwwLd*2l[j7Q"`~bj!O2hɏCerǑ3s]\*UOH 7Vu$+LgxdN[kj#6,3/` s+3@':.+c.c~e2V D1dn)r͵-7H1WCLKƯz_~TF j*y1E6RW];@O ¤(`IQi-۸HTfOsPք i6b7 ) ИMJ0JџDCRߵ{@'da$v;kH .:,QdT|:(ʽB! P}/%I ߹1'%MRq` ό@LU՟!9xs7AH5zڀB سoGD/L]' E״\|F2x b0KƳd0o/MÖ?d7/)ΊUqqɼij`s?*;`Y~=0".CBx>#x_gn:h7*$;2/`c?GLgwZGT\*3j4 xԗ$t !-OSn-o0(ŜY;o,~2Ҟ5n-ς 7VsRPCɭ',e.=ΰ5E^%XAЮ/ ۈBd{)/"e+;uNG0o0wV=xַ)]Xz\[jEnJ*^j^ ,?-_؈7psQLz=׊qac[rt {8*+TU xݜ)J<{9\ch!|oЯKzD=zj*Tu?fcdML:vA /ۯ!2iq Gtf˦lKu>ť{x=>^T J::-mO,["D:-0%Uӊ}JeU5òސk vʽlm8yfQֵN'om~zv>E}о+RB{XH3?Ɩ,uUxGA|qd29yUdҐHoê5ܬ-;urUVoms3IDDVae h.fb<~n4g:]s󦬅gՌs,dI ?SJT pkM{IrZ%ʼ/yV!XwZ.paGGgm^Xvx'wv&˔Ip*tȭ0>IX=aNQňV3*GpQ23CO^Qf-Ɵ+3IOΥ=d2%r=4̋n;>+7\BWn GmˣSlKr{FH$ k x1f,] n׻jdH8j{,;-;l M^/҈ϒݒas)5L|L/ˆ=xMd8*hc&xSy^bwY2]A&lNv6($ [ /m|BQud-YL=B*A#-J 4v^j te?Rf/H]΅rdBRGT6.\Qj~2շoa.HH<"B0X3Ws}"wu F VOsOX{94H0rVS$4JdΨ3fم"M(/U q!*2A{|*_"Uav v:jRe42N|~ E4F.,,|YjV6>쮁Dq.I`cAz{L|.>^Ӽ*R%_R(ZYGɦ(O4t⏹dA"qC4s6"JD" vhqp8mwpQIj_-z.=KH;r<;ٻwTַ׿!p2@%4Te T/9ݹdR .Y,kJ\E/**bfRWC^/j: (#5j3OX._@@u/FQoꊋb,];$CԨH݀= ԼJXǢ  aPYQMVkk::74p!€{?m\;^X?$i'jIʭB=Y"ZZ].KA5 V0F(Rqߪ|̟9ODe L64\uLj95~raSi5ms"z;264Z~r>2{&3K1vIxy _3N\_qLi#G:Kfv}߼,i~zK22`ls,mb-_J־?Dek4;[bzTjƪ{FÈ]ټAkX oiM: vg Tˈ}WKqm3>yh8yb^ Is347e; {LiMA:TmZ0 I{t{:v{ϲ5΢s6)UK C1al .DN`5zBeî:_5L:gNP{#j I]BHYS%h3¢7n>es(D!]p4-" EM#}zb*8xXS:eo A= G_UȜr[MU԰/d#5aycATc1 IV+h.V,i4k?`{5Q5&9=94nsBd~VfU{⫥JF*ӂV{.԰-Oj'mi.+ Zi-˪uOOo^OR9/ ?^$2*'Z.]fQXp&C|WA_*/{JfCfe+g]w,xg%"^FHXb۪L# S*>ݯ^+oK@2~"i%ĝdSnQe +<-`%>ތ'OQl!FffF+Tu֢#ĠJ;f:ۦ+j`kh;NI h3+F%(ũ>|U?tA @0b`y 3d_܈pbM$`wW,P]^'3  ґ(?pxY[y5pbсo -ׁ3 "z@ nºW0PA$bIvQ~[3I8/.MXyӸӴE4ņpK@"!XA&e uZ$ޓJeuZB&3sv E|dz˥|c! } ? |<y^S'rdeJ) EHL@VOM^1NP߬& XGDZ}ٿ;u*3͘E"Q-ky4fy~8?EIT+~%fR5 -!T|6t+v5CuԿt0r7saNF9Ku_!L S`Mw^žӷ9;BrJ}6U~.-g(eX۶ )05/Pg%(TNdM`++r bVDi/n"[_.c9^GݷeBdw10E(2LSY EXۢj,'j!tb5oX{ =J1|P Z<ܻ,DgPprrvmYeIBꬌzXpk^ )@k]2Of/f*xLBX֟)_1 Aa "~ /P?.o^uSjcP&j&zXll/fB `V͎*P'1K.y_L{2^j k$}LkO4lm jMCJ!wmhQ'r-3|?8w29JIA!6T. 6^>R/&sBV_scyu*S7a^)LR vފml^b -|ݩ`pk/_(F8q<@h=:I'`ԇSl#QގuI%:悫,` Nwt2DZ^k|IUB&Db=?^& !ǩgo#+Sd|y$~yDX'D@uOڋ6{iF sO? mfJ,'Lk.CRc'˴j`@ q@ [_5Q: JԂ* 29YtkThbvDyާ>EST7|w0(Y>5+p~e1bmk'ۭo(-#B351eqas+`RCO߰:Hy C6)ѡVi^Ji?eCQ=&dN$\s[ ,J>.}ޱ…1?[?2Lpukn~¥kF#Ϗ ұ%O"7duS 'Ϯj[h*M;-{E 5Q6WPPJ{dgx 'ԅJ1a^YwqI8fSr "1۷lpogS(|NUPB@K'Xq]O3>ec&&q)"Ʒ/lHr?8=ȝʤ+!jG((/(ӛ~Sk!h|^Qer^q Ȃ!Ą *N[اf.QiQ ]rD9+svhu(:v0** K@W9] / ^!lc<A oM'R08UI ^93o>5ƂpA̢S\d]14 /)xUIEmvp|־/=%Nm.ub4@[Xi6 _'HÉ%tDzГ>ˢ+ї75F9ꢰi;r՗ ݡ/aJz.T7*"E\r nT$'# kǞFM@q@XDvC61Ȗo* gӔ٫-bxYk0~; .qߗ4U;Y:+B{=xV<>ӓ).-qS& ʟ yC l7~Fz] و52NqNO偤:9h$: .+!5H7_xDf`L:)mv) Jh~=>hqf![*+P%즢hmU[ ZT?o'#%ks~Y4JTF7AT%3#Ax~SWGg/F}~ҙꬿHtlp-gZ`>l,]i^fŰxL--f7G3Ә 7ڑU>d7Ak%T'%}Ff3|c7Dih@XJ_fq^ɗFOEhRh?U Mdsf؜{K.x "0eL7:Vpd>K^kU?5e0ٌVH׼=o[ }JjI2U좎QJM-߬ rㄭ Eo7꒒#wsGhr>@/0'@`ZȰRw )X]sX(I9k|$./!꘯$jӢsdq5=r[|D{@xy(s:TR`Ybʌ=ߨ ?hZ<5zeswd7@=ȯ {#wfɖI^oo]~I!ʷ P7EܷܢйE `lV$o%yXR? prU;WݸY6^z 'W~ޣn=WA>l4fS`6fuB18/˳mDmac לFvؑiQVwTФ +}2+靗3ٝ bRjad Md4ŏثҷXV' v7HS$sl -p;h;jJ ZFƑ~|> 0?||rNekـΖəaP, (qX9!WנM"#|N,Qt=z7l_B< K~gACɉ? ]l7pǐgx*Apa(A" ٭fկUU5E&;G4F@ [P~.2"-ڲ7zT\D3\ď)4zaAFWtL(}eFx%oWFG=aZ 2?=0hBJ-SV2:.ҬٯE4^1%q~pC"p X`mMXj|1Ju"InCc܁*8%g=Gި}p%I|]?4 _3WT,2PV4 eJC $5J W npz^ɸNu0lz6`䴻b =c@PЌբ:JlĺN)Iw Hv S1j(-φ,nRϹJ}/+0$G،jб .N+kD 'o$-zMvYq\@`U6zNiʬm%Cg%x TnCq>|QT_ȶz,-gqR=[0>0OCp4K׶ TT#]-kꁀ2ZFEx{uLJxΉ V)N3T&Mn~`~sCmoU67NlE5"sՄ7!Bz5tx@aiUiZ6N#/ yN]Q,mP=u*a,Pi'srJ}ڌۭ YaxF 1U붠0Zۨ8U]0XD!JCըE){9H7Tp ްlG 0 ,u \==+(Q\)9 T+qrfb)KN]qZ-^x.nT4GyBQ^<0B1GQSU鲮*7ª}Ojhևnj/y#v'',iS}5߭!$3-͞K)_/YL_X-dpZ'I&>h~s"dxf@7WDUx<鰠 B/dZ3=Ә`X])։ҷpY # >@Uhneˌ4hGj'x8Ւn nʥkv~9siVG0 Ayg^"!B;&Oڷׄ3.Ay:(f٘t#Av,kV (Vx ^@.\CiԻ 28kC7! bw9?SEQ>E䓉|iDh{Ei\ sHGb D5@ "9Ń5x +>]ލ+'< r<\"D*P\ ^MudC1s/܃GYϗg?g<.WȽw2*4A=?ڵ8$sG+H;0Ev\$ZP$> 8r*æ03#®x;^-wR;10eQqMP԰R4r"f6>5TeSӜʏ;\ jMTIe^`t;2$RFi6LI^١.Ƅ瑛 >4]}$ۉGi"y7soCaE%P0ja/ # .[yRp^-wzʉS4C=n|8Kw'$[}*Or{&9x c'AQ)hjD/j^ ۲f>1$ #ݫA'U勼hp!F հpu"rdt0o)dMӽP= C3kKn>@zï@aβffGWX7մMC,]e҆HEHӕ_uH8$Zhb) 0yvQl8Ux"$K(%l]j#gUI`">}R.aJʞ ;8fP{"{(#i1>30гZ grXEI珃oobiPڬ[ˣkaU rѹm'>[9jŋH.8\"ה&͖'y`=2/w0ao K&Xg'zGMVql= |/Ҳ X~[G/sgmL  rZ A^]\?ķ}RF~&wD &; F0V= Aoڐ6i4C`Rʨg{ȍCQ)svPAyk69IHqLhQf)FJY޾YGjNk* tX7‘^Uo^"R_kVr)oPj7(z}&i@jA ߊK~&tͼZ!0ܣosdNʗJ[(kVrsztw_ĸS/>ZgDKeyOζ8Bf§T1Z ah{a1Al+ x҇rFf}D (dӫU1Ɛ;N:{wTȢiRV Gx hwGIg xЛ)4\U L`w0ÒT~y^NsDqˁ5uNwҌWtghI=lXc'R(;in >[fE=Fv ۪{Zeb9 ch-]TB8F"7Mq)CGJv"Dy"mx<(JG:,6JXSҒQ̉Lk?s%,?>c"{%T @;aPg) r*Oq,F_wtMsQw\|*:9pNa/^  '┞.6|$M=s)9Q_+>u\/yȫ=T&sjA{ﾠNPeD2QB6ݛ鹔$n`ME [>Aıw^P? і"g"1m8 `f?k堪 Z'׊8#5՜C 9ܰ ƏS&L+l䥂|Wov||/,!t0̂zDC}A]ðwxx YM'o5_[.M%iگAc\yRkA!s万f~  ŘAQ K;A`16IbB©ɿmu6KNQ+hS/>5P3IZ'#<4U*FEmƴ[h0ފKf;dd@{Y6pz LrBvX>u'^0cG 5>7%%.Evy}vs2[@O)OLxt]2@elOQ%`$tD[<e8]C0Ѣjѩe dWGf- J.$ΰ@!ũӇ lo$ACJٱILh gst?do28 6[g{T<Ճ~(ٚل_86$M;\+厂o'>~0 ]쀈`:lsT sLXsGrV>RƯʭ!]S^ŇcR1o1 I]EML.YU4j9nOQsժZn6rRֳ-hKonԎ>" YUM[V4EiFu' By }S\%(N8 ?p)}w Gkxy 9OЧK["֓U4Vj!Q|PFB5tqș d8@G\.ٸcbw3HDݣ)tootD}wU C1D\Jpiu4%kmS:u#gN:p(P$Gx 2Pe`8b킜* 1L'6g3LDBSaHyd$ 2 Xq̎<ۃ[NK>AKeVnpO얻\4(ЉaHtH5|9~K5.dbjZ|f `07!n'iØWY8ߙ(~wb!ynz 0- *Y~Wws:aOa9Vy2c^ΞYxo ^.A_&\Qeo pҦDpMUn-2.z*cY2;$ r^|d:<6t=N&]4Ѷ̷mbKc?ʟH |tTH*zcw诛Hή=XrS7>h]Y}?'`vh-d0C T.P׌EFrOC>qMHkϢ*.:z]7͊ Ƃ(C,T~cEӡH$S!B+3N˒|u:iԫ^["-+gL^GJ/נ)ʧXy6MGIE\LΡ ]+* 7<0I3ɀZ4 ^2eV@l3 lDaJZH#hʽ> &|*}JRF(_Q?ސTuqLtcݣs~Sb r|\׾i㽣?ԈOFȮyU:՜,JZhl`5+)'5`EI-WԹH$nY H*vܽQ* ɪ=3[1*" ՋʂňAԁߡjh'ۤ筭&3~;r։k#* M"<+.h!B <fA񁛽%usefP'rL"g,-:pW0frf` yPs ؘN7WTbtE ̸L!Z";$ vrrѫwtgcs\v K[/Hݸ62v\!MQC i=#GG4\ )G)rsToM^0a 'Ấ(ۋ*bU- oMMUBٺA"mTJ&Pl(Ӈpӭ@;Q w-i"+A޽ 3|ߝ{%`xxl |_ƽ_B,54;pZO S[zY)\ 峝ZhŴ aNGf!'-!;(ar^zQaH!}SHl {}m ۧs9 V/| YM2z uNÝ'j{ M-$ u?f<`%69M3Fn}{U^IŖF}zpuKuQW6t6 ~e(=甓i hm) E_/&dr6óӬœʁazAEED&l$Ur"Ш4ϙzoR&Ui 嶺FCƂ*FXLtLCs3IZJ&`?:iP!СO_*RO]QחkG9*j/w2Spս {Sq|0jXLb8W@v/ pZ΢F\A'5$ZpK葫D]W?y"'M?"*6C,R;Bv\fzu{Y:I~NveP0\+yHZ+3@f]͔j<^$-;֯^3Hge8/`#8# ]ݪNIZ@g㊑XE5qv6THHV[o=%g ^wg43ej,PY/d][ZXYIqS)+rc=5.~d5pEw]ee>ʾ~}a ցA$0չT†ɌGfBHpRZ8G:7a/,)UW!|}E71^ ņHܥdT>]⧅ TOyfHz1hRM]I&DZn4aO6XjgbgvpͫuЯ֦ U1O OOO;K&'8,Y7>)ȏ.B|ӋtoJ(=ڌ],M2D| )cJǝ כ`Lg8ϚAqC㟲#)B?8jva=0 "NM<X7!|4N X<+:{lP_``qH]N4. W;gij{zb\su@gcajЌЕ-%n4?Í7T*}oCǣ]_,8"?Kf!h9 wl8 & ÜF-%4Њ6O_Mg}k5?G'(YN.7w(KՉpƛџb;aP8h\pmW 5pVt}pSw&v# '/KɗacwЎġyQhщ5F/&ZLu[w[d^5IGWEK)=oo\u+΍:PMwhZO2&*VrE sr NW֗ G&)xVm^%u:ዘiv·cdbnFW'CfneVrһCoхxf &\J}ߵ[}@§K7[Ir@H gT.Aٝs41r4:&Fܛ*Kj-A4cm''i BH]EF z{óG Nw(u}o2W]d?ڼr_)]K%648WQۙg,hxD>)l\2E$ص[jErK}zkW[K#$ wL i!=EhJWSKXA9noD1L}1̋D_j A|V[AQjW0^^fU:z%nRwI;>a? ~T)‚5]-5rwG΂{9ccƶj^Ԡ_fgI4C?!V4Ml=T\]F /^.iFy[0 #-^pjf/ŝ&B]$%`u#Jy=vL$H7)]]Ub2]̢<jy|H>vs}Aۄ>ɸX'rٛ^vHm.AVTE{DmS(XMm_v{ fQjWMxD ?=*B:;l^dcJA3da]_Sqa^{qnZDTYEڇ+_4)b^)=Rɚt/>X@\s+YI|"l}]Z ž80cv+`Ox" W1TшN3nIs|^M(L" ۅFNXQۂ TוgV?uC)6&/rxn+k 0%kC٦,N\-ʮyvBXo5 Pq^Bv"]B^c^).bfڷ8#{~ȲjITm{j2ə70{e(B vu-jP/0Z6zʢ9'h?iN/T寑:̚ѩTXn &8G. ύ,Ω6F]iw4_ ] eɈ%Hc ) f١=X@;]a60iz7afY bѠgTm}WLQdCGM܅mz3e:""^ݡBW"kB3;R#}&DCĸ^4/zZ ?Z!}E%DK`D!uJRH'[[1R Wէ.Ȁ:HٛL J{^"5YZ~}TQ j5RƻnBrX7Қ;eg IiEa| d jMsVDD0 HVWGkĀ*I@WPϢ:.ŪZѥ?߉VrҤcX|Yf,QvxƯQ.^&J ʽ].D&$K\8Oq!L]CHd'|sV *m\rfĪp5lp;piHjsqgz~ݕ˽WoDhn_H +zv!gu<[kOgV-z/?kYUamOSv/el? h%{m&2\jX izπ<]J kD)wW׊FtpӔһ\< h4oՁ/&ѧ{'\ sw> Afy)L]U\}>Cuի &šSOHzod#A|$Ỹ(42N헥uMzz:Q^d#[N&c) 7A4l׷b>=J<5.:`N|˟beT]e[M-Do>g- PJc ,v;D٩|LA9{YRE_e\ˌ-|f~:%[Ȱ]+z[Ҿsp3Ap4z*Mk k\UBB֥S GuWk뎵 K|'ݺ>y+C;}9 \*p<y4U%`?=쫜LI{ %ևYX`T1oYdL&qV &S̊ \#I1 (Dz б70)B"UsRͦ |֐Z i|u/2*|ҽcA%HWOGC Ci z;50+}#*WfPǼLotJ`{5U}( j**D$Zy&GLl8翋 ܂o5)~-\,%4Aձoe?tLf^6E1ks˧![j=L6&җɩB&u9/f5$p.1 &"N)|]f:IQje:xgS.:ONB@\Nܢl.sѩqƜ SY3Q՘48ZOqcCtQ=9Y˧,'gUEclUqgv!k|X>YnB##BNwE΢xc #_-|/=179e! z;

~9?27%70%SIpR6gv4F> u1MM}|`Lϭ:烙`4 ת.^wRs"l5xͳn5&6l¤i?%|cEXL=p/@A8K4Yl,|N&>z(k/Lɂ;QlCYUu0LPX7'1OPg%K'\;/z :ZTWYYH-6 ]f:3M{ov!VRAHϳzaW\]+Myxzͥd>a-*IEamhTrS ¶D0|amjodD*'KIF e5W0OHaiG*gSp6).ȯX3Apu᥿Ǽ==2h1TJSE_ts7UV)8w4&qE8lI4O7hXI@vuhyH^ICփ'7d~T\Ț;R 'gq,^iRY..Q+Ezxc^z2>9v(ĵwofbo( Y&V|F 2blkY8K%q,f͛gޮ#Us_?p7 1Tt2;ij +Ã4`QdZ:砃Ƶ#)[Bp J }Kj\,cųzϒ<  ~` H"=ƩpF_g@Ro6Ш~VFIE6ۼ&bgaby$Q\&8ښpR̓@k 9 XJҬ%TAXp1AHH! 1'J|c KJ24x^|.s/-hș E 12i塔 `kJy=!!״><@Y֯:>6C pP{ 80$}~hDJ7Uz2_`lOUp/V%aTn4d =zHDHvMIE5)-G Wy QS^ Y*ywCg,AskP[O ץř(TBw֊Kc?ԜO! &t~Bphw2zt?fȰ5np`1&4PL_dΟI!S/#g}&y_y ,MHg~Ъ; :Fo5W ˫A!"|9Mbf`'&} ̊n[i2 ޟi} Xy6pKTnPWB6%IR%$(ͪWnznN^ږmEO=-o0}n1r G9= LLBߎq9Gxm36й%V{̂Ყ+0_'WiaK[Bu# K [߅z|Cnjo"',0ܯ)]@KRZmO x9rh)N'2t.]d!X[HmMFy)2Ok]Z y_->]]Ds{eqsǤ0-0J,{8@Xy-kwFK1it}KʹZQq2K;ﳑ5Hg&lVTjA=a.D^QRta} vD#̫5݁8"QI>Hؕt$+d4K$dش@VP[sDkoצKhҵXv7`0Fo}ǀЖoVf&5)M UQfe6g{Cهbjh)ik;pH9He .4誚#P?gCKvy 'i'LpQI!1ua§ ׎떝(DŚ$){O:I3- '}q\Z|+Q䲚U,=RkiwN_)~ijMA{PUc{uYQk-^tdoAQG;z|\ݕ]+4M@HYtRl.]4afROKnmg4r ƈ$%]mP%E3~HU 𜋗h'Mڔ{˽1JhL f*U-e^-z+s{>fI[S&>h Xm7(r0K1 ѽOmɔa0Y$+f.Eŷ%!ux);g3~UP&Rn0Rtb& B:&ޒh@6J/9Y5_.M]{t'ջ#% z+`5*_e!s1Ѩ=#ກdx3vDІDe2$\(82SIc'* 2ACd&N)Mehx4f|^"3Jd{&l70Û[_4!a!ϽY`TaY6ͦ*$`E. S:Sy ^9Kt3}_<):?x'ý4tLj2 zUm<7* DGMЇ:H7 ‡ᖪ{q2}͖=@xyDl=쥝.x#5bM:%܎#µ:\z!àOQGV2>E)/ϊ!f̺rddmCTnLIz_M)'l2÷O'==WY/J94+f}ЃFdn U3LO]VGx(^k97gvOQ/r$NrIt6LmaB"b 02E̥i0 ss+^5rzwU?O}:tA"r9LH 毿.|\?&xYjŊ.^w}84;9 r?U75,[Tuw L—j; D{@#!Dz %),\I3\#zTٚ!2Y-W.?~2Genoi8;b2#_Dt#pk93K8Q.\etü7׽Oήs,ܾ8'Ѕs41Ȫn  Yޏ7ƑEG $XT坖F ߧB6L5I09 KE<\t+bAD5p=( ^-a<Δ.Q4e7`Iط. w{t0grhPZ"-wW>GD>Rpq `^t/^|n{#{%9#,,L\\gg [:Ww@o~>,RNo^43&Č4&oH$PA6I M4#]؝#HZ7>Ĩoʏej-;FpQx2<~ }j\ \%^]=~V G;!/Zh /݃C`ڱ*&JP2c1JE*wnXw[L3*1/yYSɭѾugz%EcXHfW)xB6L3sf{! %a5ACaKq"X˅kBp"J!E*?Y=$C@9-?sc^2Z0yP;{ ΍ 89R nU 9nY%D0ؘÑDUNOp_C6>ԏYI^(Fk, hGS΋QV?P-YҡzcL%<ޘi)q6wGdHnJ]2U@fUJSLM哅s "LyG_Gx&aATYk LZNCNYW ɲ(AѯktS=]k^?qQ)cӌuqeg:qZow侵w~|E>rPTwWj-.#p9!hi'7b]o_buD^/= d.,;~ h0KGt+7V^3DcoG}'E?B13 մb`I(\4͹4/f瘦/ 0h\ڨ$Z?aKn,}vqdo,yCF;\]88JpWcggvb9F:lv$k亙oX8ӌ !%=ƑDsSm.ܾx1jΗ@ƩU =-\]:i/[lwW@;V5 Z[|3oMO9_d5?wCGAeM?K<1D6i:d:=_>d]&CJo#yQ!~D-1s"IIVծs*&H/Xo;{GhD$5Non1 4W99eujM,Võ6~l'Oȃpv}aP &xQ@PãDFn2 2;FuԳ:VNw[ɢvgqt U{9 VP~N(1M crYMU~v[AFuH 2s?|9+A>'E`P [Ms#6bF 2*+D"g{xr,q]CD#{Aʌm-p39 >q ex7O={4gIU vJF.F_3.R,T1}vI]?Pi߂b~2𡖒׆Kߖ%dtƧ+U^`~?L&.@qgW8N)e&QIπǨ0[Z %o`ibz FhMoG/ ]H\ٚOda{/b͍O@7\sENW8uaٴRl K 0|sk$ocZOؔ4#z$ݩH4tARz0$Qqi#EQt\0zY4 %CwAָDaBr:IEN~kǏLyn!D>%M   ěFTIsk &CsF|J?!|2Ym}lQײz־6n陊y.x躦Ol'"}LvEfhge?#&V6n[&ݼnćͲD֌2Girs7Z ݖ'VkҺ5øJu2&e%` ӖU2N4Oh&0P>/!٢Zic:H6=p4zvrseI+}t)xSSDC]aR=奊^Xy1RyAJ[ !NIS̄/"E|1)^ij@p^O]p)FQ`M^澉6Ng!UAV$5BAWd\7n eXu樺"G֝#d/"lO jK.^ߧ 6)UKš"Sf ZyP63Uا 6k{]V3QbՈ#SjF[Hm q=`1yf 3ꨡ6VCb/%ZA_kt0s/<|yP@FF 65]yUMQ:ԧ#4/m.Hc^0ɿ':= (xz q CMֹ"'kqQJ%5NC8'l?C09]9` PzyPhD%͙e:6Z>cqB͡bE x`y( ά{OnBeSRHarg"}R%V"(z :Gh&*X8*ʧIٱ>d ze:1B\42~1#Λw/1 H+RLq(:Y<l-HsY/_<L0r0M4;{C(-o>87%%0Og.E X?rRc:' "( NVj4G?V;thFqf$@{ vhhՀj^$q2;޺/]64!AB99FGp^lRRYW-'v|80/~Ъbz.K*9n߽6JG=;Svw?5YKb]y;&a߿8$\䤍\15kG1K@O`Z5/r 3GnoS|ߜ, "]dze 6+Ss拎٥^ܾz*hd}΅=r׬c$J PHsb.oaR܁ LnƏ 5:Rn`T$:.<<\;&266MN֚pD *dbv|.|ؾnիV6SHmY'<Y2D8Ǎk>zU T& w7s?>gĸ'V%{ \aK]j؉B%iѼxYaЬ*TXS'ݡK=2! 9DRBNB/J"S3䲑pL =6zQ`2 )ok?Q:QTf9 c Gzc>TȈRRhY!].#~*C~[N>7\yF]3H =E#;YH(.S֬qj(+)rcmGuS#8F~?miԻ@)d}PCޮ0G@cM6ZxӺ}=2 )7bt>9V>(BMa5=;^1My>ySWu2mI_'Hu\oi;ʛg+yOn_lС cA2Μ&ޡ>&pm=5~`'coR}F}򀅅Vȸ{(6rOi̶t ˲Y΃z{ѦNB"i^0N~0jm)3}}y7,ru)ڀ=fiC.Z |)mYiE/}{r%$D]oظ@$4I# RZu-{׊O-r# S|꯯P|+UQ.]ދyF;)5+?mEg,QmSRK7nb/Dy,1|6UWcrs0;BVlN|Lr=7]@Xeͼf3ށv QghZlo KjP!㓬dfM1P&y&?,y9n"$`˔c\3ʜ7OrýPdgJQH*ZȢFGJG/Ӛ]ą9܁EIYFGuyp|@9\E  n 6B49[6 Ayq[ĮPZ)>Qb]6<{O`Z 3{*DNoSU^opobiZڰ3 U ohwACzw&XM-WHpQ?-ZuX OP3бnPړІ_Gi~JgDƺarʒȣV, `j|(dF *i{:E D"'~ݬza@ :%$v q/JZd-l}FMQt[ә>\@#~ܦo ./#s*,}!}ibucE_tDB4|KA0+ib wrn/SM_"RjR(BLZzDnhy? CgrMA[ cB {<. MZ>07% P1u=!V@ssIviHl+a*_md܍U"dA4pKZdǔ ~i4}2C<\ZKT:#q:@+0]>?!i3Wjc~k;`dy3}ŋ.0!'=pdg%Ӧ`WvG0-qt<>(,"V]a3E73mVq) He !,5:?iM!Oa$ ᩗ?DҜ2Ђk`zmg܍M`i7/X,Z5:2.k}|0=wBq#[:F.,rS/XS7[t |YZ 4QxzmD}!ެI~Zqj(K(0V[*ۢ%vlY@@טDHXwPIס3DVgemCMaEC]h#ٚ;x$!M~h~}DVljxf}55 vo,Հ6Czv6 .IRCl0iR:HogRFU2SibwhQok6e1{2NSR貝~2|@sYDa&Gt %!yԽ9ooS…0{?5< #p;&;zDa:Mo[Q\P:xզ?Ch<0 ġXB 8FU͕?UMj .1d ȃO2[`qX`ʆm4g 쾶G lgyS @~TٞϘkiBQqA(qYa[gm? w&yj?;Fdㅋ-̲$*;4 JsCIrlED*J>(4 0ERa4nXGkTpp".ȇc(df rZ3 XۅPtkQGm&F q30he;Uo uuJX<~jR^M[4!`vtlIt4lCB `68kZֈ;1"z"t dY{K&A.orOvLaK:KW@%N Fy3obp{$oʁI ~/mR*N+88Gr#J`21,jSg5'WH2\X>LchY~f4^xLzo}5UݡԌN*MlN^)*:>9ӅY [cn#383(0;{dWm@\=h<0XsUi=dגS jvKq9/NHxs(i[~EK.3t_ì] %dZADIpuk?7{4&ʄ" m7Z{dSY-|IEx8~d8zRZ6Z6v}6F4]i* :~[-d;\,i 2=S+0GjNje䢱ZBzU9𧗾THVꎵ?Oh' X 0(/OIV68t1-BCћF36|є]DeƕT#L$mwb5h*~yF Ll_/~[1ze6qXE :m[_r 53Mt~ ?:LY~mϽPs´؆_g,+.P;  m^hn֠>dOri@X8U$a+D }zm |LPO/!p"K0'(k(N2dPLp̱h?@NlX\8vJuٮ.Ly|MC.moJM=&A{V&P V9X.Kz7cf3$mʛ?ݵ+[GN/a($Nlr۽OBB&d_Ш}dl饯D.4Ec@(Rģ*+#ߜqΘ+B1~C#kS7SlWg6;毡΄5Z. Ռ-:A<R-bZAK/p߸+:"th S'DPEvS`Zf3xK A{U+GCmu'C-7t+"Oɦ<_?#!֫Eb5p.H賠+3b–0UslrݽRQ#"ۭrо25[Ee%F}zÂ_ֽAx (i n3`us;sFBh#pOx9H2q+"t.|Dp+ek泦~ %( uAe;ͰIψO^ NHU#EQIF%|t{ n ?OVՒ"F%9nx6z/!f}?E0Z%XbY)6)5F֌@mM]p;^mT/s2YVCO ą)´@ c#16F<3"$zDUB?Umyb9,|MCUy2s#MH6Rb1Ѕ=:`*IF%嵉ZM^.݈+c k?*n<褅}l MNtUˊq*n4c} * \*Rv,FK#qADM?$Pgn rXCEC?.J"Q奆\9ՖYτ[sͦ+DYRnJ sVCC% Cn\@QQ)}'Ր )G-@1W8se}g jՄHQУ Рy)%w`] L+0J54j;AX/g{x-Phghr&j pZ+P(k5|$}V voU:/10cUXݯk/+C]= *W4>>5~fHj$@7N»*3HijxU ;%YXDž^V劤"KkO(GeBT>وo.YeyM? U׽P'CVn|)zB}{vV/#(-NywxkUFmdi:;L-s@͗[(pZ,JÄq'OD&ng[:ZLë$, $kz[[۸KjabD k(+]"0Hӿ 4>" a)Un[t-fdYg2bZ6có"챞m:(b<wVlv VwA !Q,lg,]ɖ^ lKw9ҚA)hƓ/\=G0Ku '#fe^)0@ LZAl7S$?wadOj}Q=rLqOky7` #ddx8I}C80 w{b)1\źSH͏3q9!Wj ..{gu \fR& Ҧj͋3:y >4,*9/NR停>0pO'_%(Ƶjeّz;PԘXI)z ݒ?&A\K0D*B|~a yI^׽kA11 5U`ݰIZ~̲dBU¢lZՀu&Rs^X9/f;iԗbjf99$rJ8%r){y#wϥ/WR}8J"dԦDn״;byjYmnOQG&38 +QAO 8T\ƣyysE|LDh/˄Na-=_ >qxY (F|0.Ve%S61opMG ё`α'\YfRXvY[ڭR+t[ BS=wX:.VNu/8f+%xY (F|0.Ve%S61opMG ё`α'^[sS|11np#_(˅ѕ~*'uMدՐ%S61opMG ё`α'\YfRXvY[ڭR+t[ BS=)d ;*lߵ;Ľ._>KfBqxY (F|0.Ve%S61opMG ё`α'\YfRXvY[ڭR+t[ BS=)d ;*lߵ;Ľ._>KfBquU? UBԯ&女ZN )S&OVQesʶps_4+MԸx}ܝMخO sS|11np@~`:Ε;6qًf+%uMFҰh{Ŀ*&LqV. Lf0ueiDFZYGw{ѣbzwXAs"A4nÅ``FJNrhG|;û>1"l$:Hjd`_Cdq _ARbPE ;j]딺[[ٗLrq REj\C3NA{;-.>U2U7rC,1̎/6zzTO}VpG"԰2QzD yORNv>RTcZi)&iمlԤZz|UϜ*! $>I2S:wؔ\x4xy=q.U-sji%;ӜQq{ҽ {sG.(٨50 m/mJ7qO/B:ݗpwϥx28]w[)ϺOc|:S爗""M-w_qOp̖31k.) L+G!ة ;# A7xa!=G䯷>Ay ^oCJA-nOcv$ I`o/B_QdӫrOd|)c~5GޯzؑF믫=#&Iy\:(hXv٫d=IR=@Ft3XqWM=8lb 9|]`џh~3-(_2;o ϟ>d|m9q_R/|S?xRU'^+\ShPABD'j?s7vŞY1Q o8}-!^F:f)MM=β]_=4F3cM%+=d_~cWW Q.nO|NݧIHfw4Ϫ0u7|MDfwURWFtr=N*EB;>:<'6O$:r@>Ab_FeYJDh%w8/ R1Ҝid]3`)ߛiUtUuء7.']&=YcufۘZ}3Lh]VyZERS4]Hɨdb('Rw;L̓* ]`ïDt`LvVMy[mep%V4WyߪK9Oxqc/sf0d)lקoаQt2#n2g6).܇E6LĖb&N}l:G߭ ɇVyXp<>E_Dv]}'ǎRF0 HEpm‹EFMӢ&+. m Q=箨s]R|.|yTIB* fZ;bfك۝yG%Q}"$t KZۚ6p EP8~$Dϯc h-T@>j,\/`幮kKSMѬ-T$̂^IɅ{d3hzawRCl? >\3MUOfֆ6%\n艻#5, ~0L5ЧW]=nj7(`Ve@7Ubznc;瑩;ف e!0` ofc5e!~pIkpōuukG$ K]j ä̸;5X crxa5|VϾ߫Mtc_,;JE q+ey\y/Djnb=*6MlZ}?PubpV݁rsH;s}mmFMrDBWbק`\7@.W)e*67eXw2qR1u OUI)O(qIA<\O#.El&ȐHC@ {M ْK'ɋ"@gEf\ClE(s -NhQD$霓wUr/o}u+SZ\K)0C:+~ni 7Z1J۝RSjkX:b_D㤚 ;k!jX sO>9ą( F!nk+sx,>}lT:v=S{EtZ%hv ΊaT8?^1{N0#!Qϕ'CDVz%(Bq1 ь: YZ