selinux-policy-doc-3.12.1-153.el7_0.10> H HtxHFS ?*}}O &hlZ!3\0  kSQTЩ7fa2e1744de08a39a391874ee1f4325a30630887 -4v^ BZFS ?*}}<.`Rx6p}{Anb9-r4urԜ>8S?Sd ) Flp    x ,  |P(89:GGHIPX@YD\X] ^2b3Vd3e3f3l3t4u;vCxwDxKSCselinux-policy-doc3.12.1153.el7_0.10SELinux policy documentationSELinux policy documentation packageSswsvmsrv03.fnal.govScientific LinuxScientific LinuxGPLv2+Scientific LinuxSystem Environment/Basehttp://oss.tresys.com/repos/refpolicy/linuxnoarch ` i 0'iv./VQx~*GK:= N6="3 -(?$TK|rGtFx3zjD*!y@ %KE "  EIKv/s ?(@(9#mO+7TN)22L0A +W`jbD#/6o ;IT TYA?Ii;^'D6QF-Nc5 yKjuFDs&MDY 5<j"#_tHa 0vTm(4s$ 535pV=JlF4"6!X:Sf `9>#Gxhg )4z ~dM[FF6BZqU\koOh_  !M1 i=S٢+; J#(@H!(f82 xIo7%e>A큤A큤SkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkSkf90d6642396bd107eb2bead87e1f4abd10f50053d71665ab6c4dc0292976a653846bbdba1149ef9edd39c6f18d37f29e5ed9cb3670521f142ed6d7d2bf9f2b8342d2c3aa4d008aad3243fd00e4723033e27e253289356cdf2cf9ec46135a8327bceb4f36b0f077b7a232a94e214b3b0a5a85152e4d89c193f92ddaba3ede1ad636143f526a3916c0b576bec80ebd5850108fb1be802edda44686f6083bad5ab1fa37bac62fa2652703459d0d28d5461fbd5c707f006adf0742f6b71d25ab332f52eec103da47bbe49e1225281c6ea7853187ba5bb452ee3ea79285dadf158405fb2603c814cd87371165468cac4e9e9183a45427140b1f1a0ce9edae8c0701fbba9630e097150a635a4888bd1b63ba32fe267a22ee2d65a91ed300365e43f54cd362a73b335564b783065ad39f15331cf4b3391343bc5e6777ad955c8c616dd95b0459fe89dfe352bb7d730c0104ab29fe7e5984256aef06e42ea576d50532373deac70a29319d87ea13558da54203bbcd74e7c69c76ec7738b4f4eb2e1f8b9f341fe9ac06ff0c79d1fc1724838e7c55e2994028735d2cf53e639af4859034f000398cc42ed0a362d005087a637a60c455ee42017e470591fdec6c8e6139d0b7fa2f3970d3ade4ebcfd7a0340108c26acb9be43bf9af722488c010cf66686af0255f3a612ec0cd69c85fa054c870f3e3396ac38d2ddde45b6db5d8983d2e88cd431c9df5c11356faae0b2a36c8b4b5aa8b303d14b2f3962c86bce7f3ed0c129f9bdecd99b568e3c5c6ce8708f981b1a88bf88302dcf2ea834ac15fc53960b01496b1542030f6295cf4bff39a18e41da4914b1fbc4cebdbdcd7bbe8ae9cca9017de989ddb6272ad3d282ee9392c356022bdac2308dce47f3c1b14e8026ad4bf9b1d10e878863eeecb5f4ac9496e6907179a1af9b29590007e3307552dcf93c7e2fed3af5009c896434e58cad7480946e9777855d43f7a66320aba2802459fc0d85fad40c9df330845dbf8012931e66975e8f33c6b6cc36bd383b0e52259e67e32631ac8c5d1d1d705a61335645fcb829d1b7766ff1c4dd9d49d387bc8a2c0ecbfb2876b4dc4a4155e6064e31f6437724a574138106f41405eb40205778f8ac542a9fc6119317c73374414bdbe02a871cccfff31518fbb7ee3b3ff97a1131675dfdad3961ebf3b1bd6d0ab7293b0435979f19280f400a25506450390dffddbbfec110bf9c76e9f9ec378cbcc18a3fab2dbc09bab835f4366699a08cc0014b25214c8fec52dc3192d64a161d03abf39c68f8d79f46c7eb232d93c1f7df7c08d3f40b5c5dc394f8ea2f73a11a2183e90742ceb2ca0a956f307b271c74626ffdb49e17626e0a3c493726b61ac978146b5c1d0ce767f7179458befe7d2f99e8be3d80fd862b356dbdb283175f971a29f53b35272eb045557a6d18d3e9cfcca266cef6a4530c7251c1e514b6b589ed95311e16f12325af91f2749956cbe88d06808b42381f0b2e634aa903f6f9973b37d766b1ab0e310ab4eeefcf4f29d92d9ce069ae2e27aede5756fecde40c5829d8ba92b53e8671d3c96560115df05682e887c7ed71cad026118b9218b0e98f973bc6aeb64e9fecc238a95bbb6fb4c5fe6da3407ad0e78327143615f019f80967ca9226e2f3a9232446f4bf5a1005c0d433e18e5deab48a56b6993d4d80ad1f82d3f96214335fabcc7fe84381901b22a0783b0f4c2f5429906fa0e4704d7152fe56ced00747494174b81395e29b43ed611dddc62de59df460aebf25165e1a275d27819f4d19e87c32f7505385d46b7adfea5c0565058bb5405336cc7d3ae52aeb74843c6ef7e9d38e5aed91aaebc05c9e10c574d7a8d51a2e05c52e57bb76db04a60b3b76a291f5d81b0774e01e9c2b7a553d3c454f9442616b3d56b6754465e3c33e893d12c3c28bab9c099d1a3283a914ec9a44d26c20a74769c70a25edbadbe7a246e25bd6e6be1e3811d9fbf4f22dabeb6e2f71747aecdbd9c8735b3e7024181fbe89c05b9bcb6390ea12fa232c1e6689076eb57199270f9bfd0cfcef38242fce8490019e4d4e12de79883358e5155ade1c008025b2470167dba08f66f8ebfb5849e06aa90096080183050563ddf69678477d320d68376e39b6ec8de0ef4dad38a65864be31adc8d64a5832a62b865076d01c660809228bf79db5c7dff6705bd119773bf5984f3910fa69130b69570b85385b5f375b3afd012738ad4fb63bca0368b8b5c03c4deb6d49dc4aa10ebc72913233be15518e32ae265587cbe1ab35f6163bd6d8bedfa1f169fd7d8aa5cfca913bfb7a27143521539befcf57b69f0feb0f26f4edd22243dca426c39d4d3d56c581aaaf3559303767e05dcf682d6962b0ff8bd09d6e0e2c9ec129164b36e13c91d049359aa1db1b1327452e63c219c6aa5632e9bdbf806c2ea21cdc72e60580f1fcfece365aa0fde7003fd562cbac4a81bf2022017d7e313f9e28a417b777c4f1fc487ce554cd341762932caf62d73497d3c1c1250b9de3c536269fd0b484277a570bb7ce11bed069e531ac5ca99937092fd99a7544b74c3f19a68af62718e48abfbd225a38b1f5e003339776b53e76ebf7da927980da6d06df2587a7a329c6a85e630b751d2f2b2137064594293b6aa2fa77e0c0224d3b822f5edf0c6b06796ea80f789e7165752b1c7bd4f496924076d495b6ce72a51c972cd30477fb22bee42f97324d584ea27a47e6ea189ec713137cce819a38a2cff97aa1b6758ce4d0da42e87437c877e393aa690e7185eb18a019261aea72ecb15bdbbce0f66b3bb538574bec72cba78ebbcb6159b718a7b2b29561efc9125636311853c3b7bc6415fb62a74ff2478a3c965ef6b0efd8ddcc64cbaeb50df99dc802a96c55ef6122525e1859d19cc6fc6b5293b07e2e0d7d584d258507dffa4100490136e441099127ea9fc919644960eaa42b3e5a90f2f56297ac9d2ebc08a4ea473308597520623602b7157f61cb960f6799265e717a3db2fc92a5a280aee36ae0a2ac0e4a817be45e4a8ffe26ff9edf072649740a14d05dc4f457b4e7a21bca7084ce1f562a3e166924c144aef5aa9de02abcb44c57972a554ee8571a071d8d7270d7a77d54c75369e82301662fb987b06f6ed91822d0ee92b37ef471458900e53fdcabe27297e292d380b65b67644652aa2e8f7fbffffb9c0f45370417f29304673fe73f21539a50056c1c0b5ccee18ab36ae48e4d83edd1d33898e2841f74e2b05bbdea1c10ffb63b43fe37ecd89924b3e28caa76be3de11a67bbedb1e9d565f0aaecea7040b5222018b9fdac1a8401a18f10c0aa44ccd2c61f07df9fb1695d415e3802bdfb06af679ee49017923c14d554f1def8494d9ab39e0a2591b588a8f8024fedf079ef5e98873851f02428aef78c7b41cc718446201d0f464bd0b278573de7856c7db0adf70de80a63434e958b8732578bf985e965fba2ac2f7d21e1d492ddffa9f613a0819e38f512432bb3743cabf55d8e8f41d15e0250124fd056dda99e477e01a9e12a0993385c828c7274ecfafaa329eba09c46886f00ce60ccb12e990bfe87ba8240a6ae3020d43590085302934fcc419f4748eff08f6adb8ca208d25139631c3dc41b9aeabb0e7beb3935a6f1557cd7d0c668ebd2033249fcbe32e8b3a8b45617e0452382dcc78a7a72f7665a63f8af33b60bb38f1eeec88e8ab1dd796553b4db2e63a0ed5fbfd8fca5a1e91d8cc3c7b1f8f43c4ca1b6a1d43c2e2cc8ff7678d0d3eb6bfe593a78aef3f40a063ec4e3928b3202db9cc41a66d552d0883bfaf67f23a0fdd5accbd99858badc7df8d3542d7ec4534ec5c2fa4ec22c9d9cd3e8c6b98c1922e009b0bb573adca239db68b03bb4739d7ffbc5d78d0bcd03593122595a4aa77e6a152ab86aeb2f44b4241e4875fa9baacbf60bb3eef0c8badfba7bf7eb72c9d64fdc0070058d60944c3206a9d3eb04fe940713d4cc1c1eab7249798218f9b92c58ed8e7fd50413fba2b53ad04fe1d4d9a81c21fbc955d444df4b714ce61d2bfeafce4567ba820fa02c3b372416397c1cf0d67d209e8845c1054a558cde1955afe6b17475983d75cb75f789923074a665f22fbd1a224f473dad332d0309394f3d44b96606828cc64cb8adfbf59fa5a2baaef4b22520a3b97f65ea765c4a4e68a10826bd8e58f594f86e41ae264f88e669eef249f67f5240aabaadf48eb36377f7b79e6ae7a78a6a246f9819edf913a0fad879d95f54fa80c501e73da43a98774dc72e70ab66ef03b85c772fbaa9daaa3cd8813c9318a9a423a7f23213f036550932c404cf4f137dc08b5bb6432668658d13bdb0d94afff017f24e76b3cf23ced3a1a9ab128fa43617548ec58490de97413523fdafa1225cd29bf28119b03ab9b1d4aa15b0d5ada320c0e6269e30ba0a86c22e7a55acae9ada3f8c99e28caed70e7d945957eb4518971cc82c1015c4a17abffc021c95d1ce708dac995fb8cbb629c5df466ab4c2118a74f6ca9d369db9f9e199b0f89e736ca0c006bb9843aeb403aae3937947fd3c73c6c5177ce9451ae9798f703ee4a572f097b3250c356d0c0a5f854b8082b9e0f7b9a641dc1688229fdbfcab6a169a3a9b6947283f8148349073aefda533fe853adca621de432595c7622bf6dd79922d1cf2ae0205d28ac4c83b2058e152be982f1d876ec5e36d7e4d3b7b85221532291ebffe06708d82a097907aacefa3b532746ab7599e11a3249ec50b1974d8c99bcd2705dc175ad07466ddafe64c1be775c3259d22780c932faad72c528bcde0fbd67a32f116f3a55d00cf6fdb43ff2d8ffaca9042e2304b7e158f9e076ce90c543f784c31a3f699c86b4ba1288919e2dc6693d9fa095048cb1d296262941f0dc45bdf6791e7a6b8c1214189a14fbfb9ddb484f7ef0e3c3432ea3aede3dc80bb8e7cd5658c7905d67c309f0c75534a211b8d624b9af228a94101c0498a731434f294b97f4ab88cff2b0b12c32879b1306989461053b84a2527c2c74ab06d4c31fc1dc9bf872c1857a8866f48e29ef8896d981ecbe3d7dd2567e75c327d7e056b8ae7539f00f042298ee26d216bc7666d73203dba5c04b6795491e36b31cf15e543aa6c3d0d4d11476e0f60345a67d0f5a6967bb4a1db2648e351707ff194a8bcdf3ae2890006f196a0b517aa8da7f200746aa10b0a602c157e5840c2386efa8aa24c44869be4a4742e9045c9ed9ac744dfe657712a60177c5083d71c3918ca5e9612e72b1afe88b4e2dc098fb85e7b42fd729955f8498b6483fc800256297396e62818d4ba14afc4f119f7023dcacc99ab266d02b52c79619b8dfdfa3621c97f3186afc0a12dfc76bc540d2e6ebeb1c85f2d01ebce3be93482c4ae3471ee7081122a94ab16ab1c014bb2cf4f5649da23eb0075213e072c79eab6a5525407292ccb70cc5a394e766cdfe64fa45288cdfef499d8cf5d089ecfdde4b8e928087839c47717124be597b24913494bc22a2c64e4cd5c6b98745e206afba8242dcb145a35c4e8a10f310f20cfbea1e6038b7f0ef83c21575d39d945ad71bd95b0ae47317b7f54416af16796862868f8db6f1fa78c545ebe2ebfe40e96dd74c829c3fc2b753d39a9927b9f9990afe75ee5f9dd237e825e5476cb4e5c327af97c079cf12242cafd8a4bf9af3c6f0725377b8da49c49e2d1655dbae427bbea01936c0dcedf7a1f7fa49204bda0a69eab7685e916bde196c889e64a9cbc39b020b39e91bac70ad846153c2b1c9dfc7696fd97d2acb69e35d74155d2f917cef6fd0b675acd4694c2c5e482a23b7d1fde39e8990a6d6179c6e1ea648d9fc667f7a74e93b332cf0fc5541975b9436f5f07715c8dad8d7aa6cd25fb46f4323b4feb62a368d6ee8df039650a148f0ff21a1137f666dad53ea4e34c5e011e4882933a815d3c57e8e4ddf6b229a9c78528b73c0a64588fa4aee0a2fde322a1dabacce53474ac8ee3d3fd9c795933c93b875589ee4eb256f990208cffbe4d52f36d4bd3fa4e1275a138373fe137f26fb15f26afc76803b732065d91874fdde7a811ccd74eaa0f0fa2d7e67e7f882beff4027dfa6bd84de3f9fb49cf944b4b2a1869aa36494dd5713aa1da389957be6842c68442c31fee08be960c3882bd15705f65d3e06378cfb1b0232e3d67bb89aae19884c0f20e84895c07e803f3f694d94f17e306b06336e86ad4f5e1cc1fff766f5292e9f4cd15fd1cd08e92c0e1013bdbd8e26baf0fe635c1cfbadc404731229bce876d017ce95280cf46bdbf4ed952f554092396e49386defe67816bbca30a612b8844bfb52d4848fe7a7ad507907c446c4b7a4819eda5b789c3ade8bb9d6238de5153f24ad7d7814945dff697374dc35851b73718d04d06b5d1b0299cdf269c0d14c9eb20bd8cf52b0df3d0d4989d2c1e10c1fa7fc91835250fc4c4a4bc5f2ab0197c33900f1d38971c569de4621657be1084c81ec065bb28816cd9267a047973127c48635f0b5db465a3558e06c25dbcb6da6f37da610711e1ee7b263743eff5de5a2f1910bc5073333be05bea4176b572c2c8a66df58e1560005374d4af677cf0c546afc022bff119064b2463f48ae5a16d675c1e3378c12c1bcbab265c80e6a1e2a2cea0f907e86a0e8cb0761a2fe408ee648df18b0344568d08f420519e3aa9d2894b4f090e4e2723c170b34de4bf8470fa3654caab3a98f2908c17d5aa9f1164efe33365767056900760d295632ca18dce13c3a3b3a2d4eb1c8ff7902d3a2794ec98b24000ddd3915f3f4fce18cf1b4a51b3fc370775187e2af15999c23537b434505909b6f5474e0d9b6c80d3b9c638f0edfe33cfbaf86d39daf465b36949476419a08de306b004bf46e73dcd84100d6593259d5f9ebf219a689ce9316ddc6aec13fc470ffd25948368ff012f5c37c26afcbeb5fc2f51fc8b951746f42ba38f007f098df7238653c517a4ece25fd30e5032c6a936eacc47e9fef11ce966c480c02d2ce18154c38f20447dbb0da2c168ebdae506fb5e6da81bc547b46a77226206da14d0c044ec91f8b3354a0320da04bec5891a2d90155307d9e232511304cede544c806d97ff8b6603fceebae70b3d77e319a4fdcffa94e509d5cfc5ae43662161f645655e99927f2e8462ceed8f8630f25def88f938526a180186ce70a439b0fb30a07cbdce083c858c108ef2eb0433dfaf680bb6c1f98e12cd5c9a9b9ff8e84ba89582827e440a962c3ae4dbb3db68dc19ecfb5f69a6ad9f41c40141105df1537903feebc3848143323ae08c5c7337d97e1fad40b563e6f05f5c31f6e5777f3102899edb82d658e479bfee4b3b67b5150c9652a2ee4761b3c6977ba0cdcac02650b6d0d24dd6b6ab6f7bb98435b88df8a79259c55de4c4703938ba7806801c4272a8db2851be04cabe670e77613b9ede36481ade14f9174941b0665e4d15b3ad92fff4d845274ef0c68ac81e320bbbb6e32f37899bf6c4936eeb0deae64d13ab3d9b645e0740f634c4f2129ecea8975c7f514c52d582011d9f1bffe995251b4c7627e1d4a81f1cceccc5c3c4c11732709f79b983d2e58bd32498849d46dad535dfb7f5ce4a21f21a8d506e4970b3b407ae0f3b91180ddf726fd4c2a8fcdc2fbbd557d192bf54e96d1bc21ec0331b45ac6280217c93884e4874e1ca143c7884a718d2616d4694a5b131ed35d847b3f5ccefd64f123981c43396c5c851b81cf072a1fb98a417697957b161c16056972f74221c52bb1c13e92c3b84a83b068df1b35fe81cc7a0edb64f5cf039f7dd2fead9dd99e44ab16b4baef27fdff1a0365fd3c68eb3c7d1591f6f5dbf1ff01dae227a4e283a5ac59eeb0316593baf2ea3bc288557458d447136cd0bea2f375777a554f88b3f3732b26064965fada3718f78de3b36a4152cd7cce62586c1b2604d30e70a8dba8d10f7e08572bf00c8eb3401b2497f04c91bbba903f6b7cc0e617646e09fa7e23a5566b749d4ff8b81dcb129270fc65bb62919270d6063445697238d7a01dbaf52baa6cb350dbcd41b2f1b3dc55668a3fd15f1c84e9fb75c77baaea658cfbe1c2533955cb346630b444c019eb50c675448145a1f9a7b8ac0c7daa3829a272f6806db078ee6f504d6868192224718aed7efb2794f756635a50f54faa2cf8cc05af680ae26fc38791b6c254d85c83f2cc7d4297186baf1671b91c734c98d7d3ee1543eccf5ac59c65d05da8a71b8df202a99b0897df8cd0a3f337c91eecc3946c6d725a278fe5bc75c1eef77967d69d1d80b24add4244e3f04229303af50045ee33168ff2e7f1ce6fb836550f6a4626c7347c3463de2578127c64b1841bbf3a01f67acf6c7a66fa8a3dddade17c7528860fde7071569601fcecc52d877b526f40071ae2dad7f4ecb1c031dfd3ffe851228035b4a41822bb74627236ce7eea0a1dce826c1a1fbe2b5d774db383108d94392c5228416088cdd75a8b4ded9aabfb7443d0b341a3c681cbc9036e95f9066f4f3a857a746bf6b3f8d15590954d79bfec69cf221f67367e52e889c6f6575f122aec9fd24add2901474a4935670d8899fcdd21368b38fa42b5b6e5230e653f9ba2999bb402212a5c59c69dcc7ba92ab9e85eb32180c174beb4f406897ea4aacd27a62146ba48ddbe7ff2951e61756de46db8dae194a771c3b08e33d48fa6746bdbad563f7ccdf78c6c03daf1bafb94b10b6c148787269c927bc9c008e6902d96b72936b63e51161594733671de3c97e49ddfc5a1858a6767efb84d69bd2f090986dabf2d38eb6b5cf5467996384fb39fbcd0b86a059fbbbbd32ed4e8f44355dc5a86189cfc012660681214254cf5cb4c841632f436c1dc8e368d8188e1494f61e2528c25c97bb40514da83d9cf51de8557d80fbcc3a5a1c0aecdd371d6ff8170cb1ce8ae24a6f06f6d6281ade625babc372ec7e98ba71beb4e43c313874c087ca88d080bb889cff1ef95ace2e41be3640870efa59854717e05b0a7518bc303ab02b76c2d4002e38b57bea3191202f6f4d3fe00452c42337d7f7176397a970b3575646c279dc6b2e497576bd18f099ff5a66328e17463f0606c9cf2b5bcd9021f620aedb026b870d263a948e76dc403480229100c9fbd8300d17ee326ea9fa06186ffb5ea3704b98e0ab05b4159f2ccd91591b660ccb63146b4d2b8f3f30dd5ebcc64390954986fd0243e9ada47fdc50c5097097c108b3bc131949864568e1885254808fcd2bf2cd6a440a6007a44361bf861322f7dfadee4081610490be55ff9934e44d54e108c24f8b387805c326a9209fe64e2c0d560da6eb2eb0a772c7d3878ce29ea094e71f4a19efe6f46832e34cfe4e030aafa787f219b3fd0c0227c42189d766d2e38541d89a25c6b155c67599924a0078523dcf5852be6bbc90188bf4b4dce36cefd55f63903b3a0e97aad22bd661cade9d9e6eff4da681164e2a8b95fd91694e3cd74eccc1e7a643e66cf8b2abeb0c0d7b2741086e84d82e33711e6bb3427d4abec24dc7adbb58fe01fe689fd4673608a4a69e4004f89735717703e1e52c85bbe9d7fe5c9cfbe6be758ecf3fb7c6661d8def127e3979eca374e7bd46d7b7320bbced1a96cdb4d42d4c03ef0ae90ffc5ced57212da9b2cea0d6b2ae236643f338c5c599d7206e757093cd80e54b7eba41e8c3053baee62af50724197917f6d4a246c2c969d0796fa0a1ccb3f29683b96561bdfa1afe8d3b0c3114b44a97b5f66d9ea6e6c4fcf3c84f039010cf281b5520d54427b4c631b755f949eef93bdad12634e356c1e00dc0dce4b14e42bee72eccc4ec1d4027ff83e05494ea5da13732ea657e72a7186402b9824aa3c307baa5cac44acfc051dca2a77c8474a79fc9d10b005f0b128f44eb4c7569a32c96d191b9a50a1f9a7ca8d33113ad62a0d54a9f6cdcd64608fadb5d8653a582489a28663ecac19041db7778ceed81e3bdeb223629836f0441380a26c5b80a9f45f594eb2968f07ab72ad4223388363209421e17012b7b932f06791fb4364c117aea4a0cf8828c21108de4f3ec4446f6f90c78a803260803dec7788c1d81a3db309caa2363f0eb789ec5521784dc0521acc5f6f42d6650378eceead32beeeb0310b53aba103acffe869418febd7a35b4f3b6f6fa652af48bcd13207e841ab3f42dcd6836c550906a98c8f31079f9b6531bbd0caedb3dc257061220a3e6494601ab7d7a609a5f43bc97571e8502af1008e18dd65353bc1e1dc8828c74748432109175e849c845a1609a59919b966174fd06c46c4cc5ebaab675f6d055416dc258119bc8b0e083728764ceb934d4acc5817bd6f76929774f5e93181468ccc0becef7040be37cc129d9aca7c739f68efc4caaf40a60342508851528c4bfb06b685b425338fb436beb4e743535915a8c7e2c6d7e69eac2a697f713d3592ed3f3c98c797fa8edb8ef474cc727915cc1a44bc694e80a20bbffc88af484c196d56c52dd0fbda265af34ec347a80b12113e286314bf13e856f48840d7cc91d3cb4e79cb2c9453a5da620c186a4838fe1aefd5cf2ae285603f5a934fc2829bafbcdfb8e4966c3e54389910996bfd8888c7760427cdc23d9483c26ebb30c9533fb324387081a3a27efe4ab1651d4ddb4fdce744a3592bc47d4461ed10f86925fa903e11e45c7752c90f21f1618efaa4e9bfb713bf44442620f54abe9476e043c9e61911555ab48c456a2df0b7967154c2589bb13cb26bc8521efaaba2cb6857057fc57163bf3619be108d993fb7ef2ced3b2133dd8bce83640770030cb79a758a79fd6eb740a112d73190aaed96b017e3bfc6c6953488c7d42a43e5985f8acfb49b53dd41ba50debb9b1fc6d74338a307a5717a045f5465b85d4e9487f97149eaaae978cca0fd26eb97137c307032ae7289413a3d0a73ba870e6d241a78d6d4073295267801fffb674cfe2d6758191647dcf281aac9f4d0e313dd33cc78739f1780f35cd5203ff7e795d32eaa55006ce5238df3f904e635a7d83fa651a97478e3921a3fea7a838494a12a3618049a4e0d7a127166d44e1f21ab84a54e47422b0863181463ad1097347effff51fa9c0501c6bbb164b075983bf5bbd022d8070224f51a0dcec627377824800531b566a1e0f8447212ebd43dd3693f3f27618e7f7ea904adda28386ef825bb87101196a28ecea53815f08e37993781acf6f23e7903e3dfa8ed3ea9c3df1999789f745f1d1b95961ce00af6ff5370c3be92b04c06e27cb277e2cb44938afb8a646bf79ebfcb855c1c9b283d40b2ee18214ab53dd8e47c90cd72cb80f92fc1930562659b2ebe41476142b2d746ae11e173cd444406ee6c4d2b69080b2f7632dff6a7204f9f00289200df66153acabbe78a4ec99db2a46feb7279121f20ee321358ef58252d4d731d2951cad013a5d90f91c8d8e7cc4d19bf1b8ef0223a1ab3594db35cfe48e3ee1958d7dde623178acceb2022b32ef6c70d2450060be11d98a4b6f7641b61644a8736861419e08a04e059fdca61ee70b9700da11a7ceab3a67817be8a31887c92918338ee7c5fb8403bf3be077ea7ea58c8328a3249f682f97cbb0b12d64a3fee4458f2661b5d91a90d7d026b84f7e328c4f2978662cb9f16d958951df0e9373679976ed5b17d8c4940f95a14f710f68e49b99a8e642eee9c935ba55c2f13bcf2e5973a4d924d889608371ede2af01a387bc88a296500b5c220414c1ac531ee2cd32e35b4b3f5975a67cc5fd4a832c58a27e3d59f0beea3a8cf08f01c4bb1f092fe3f4236e442767a6307928778398570125d1fb81f800e1de67a181ac70da00db4ede97a59b696e72b11b395b2f83093e3846630e0c14a30c98af7ebbf673fc70cd793a345fc3ae39bf53e7cfa10a3e2b08a2de16bf8f0e3c00dac20b77e76f21afc8ecd0f9badd997802ef8da4a9e0c7d82c0e619b5329597a8e55e516a386b914712c0c2a2f1298997597f0bdd5e27e09f61dfc8a9ebfa919eb477a12d3b6ef8d420858e7e01fb1fc86e82053baff42bf800cb9edb5662810becffa147c0b1ec9869922de1e48086135ed9b2a470c83465465b8252a356584a4e29a3be4ce54dabb51c958d3a8c0f889bf2d2a7629682d05a491abf8d1566c3e3ae50faf1b71938cd26605539acd2ec42687bdb74fce94369c020842724e44ab6f6a107b6d4c7358e9c3029c6dd5023fb5c927683c9c36f18db0eff1bcb2d76d3aeb8de084fafab73bb9e0319dc99d5bcfe8902618a89e0317816d640f8166e153536b06e917e7673bcc6c9035f5429dce211a38bdbc292739eb578d35b6b3a9c81c7e93dfc01ea5671df041a01249758ef1562b767680f6fe2a1ad206e3b8e878e2953effacc725b643c7773c250b7abacba5028a541d49c5296c46b38494c6073b8cef99c75d990421db9ab84a9c27133e89c5a5413adb084d19d68de1fe0476ce75023563d0b7fc06bf72afb234f68a4d5d2847bcabab622d6051c38579829de812de23c0b4fa29d15f4de827db608c926ed4fef05ed4b624d4bd158136166da8711d7cd77d2e0d9735c3d8c453cb27680b5ce98d5132fe4decc218532bcb6ccc7aea02708b2bed0c41e822cbc77c909e01613c7ec632a3d4bf8b00213c36ca6abd04e3ac5d39a453d79a7696123996a5772de9870cde6982923c1fe5be880bb7dc386f620badf5ece208e673ef3d3d66a39fd07614566cae40b84e700e7dbca452327e1082582de133a7d4ab9e74dcfb8a1bac573a67d68cefd973e65a008748c2473dfad54ed88850808ee0f21b9daceb1e26e5d738bc2714d0bdb4bc2648e19a99a99157ddf84fa84c007401d704d9525a801106baa18d1333e111f0c578adb0871671719cdfd1c2469c7a34ed0ff589b4f8212a8718bfa918d2466b173f9ddfddd30e495dbe6f5cd75691532d0876627da7078a12f4781be8abe2353a3528f85d1dd633df96f578aab04a8934125d9cc04494a71e866d73932249fc256a6bb16676839a0ad68466768a0a01450307fa0f95a338da5226d8afaf4e19c62142ae8b2913c3ffcd1af1ff57798f44de918846a7d4b7cc76d43e26e3b944bce4be9c4c923da41e06fe18662e280a252a9afb3d61cf6e50d69a101ce4e50977ce72cf1ecfaed757f09d6b660628a44ec983057f6cbe79bfadcc3d45ca07bd1db9ad74492b53099996418c1a26ec535069cb2994523a4ab7177e1f87b78ff3c78ecb0c23f7c86cbd4e0f17effdce22753c06ded4db4732e972ba1cd1156f5e791ecaaaaa30dcff86af679b0a4a992bbc41dc5f716f000f74ef78d45b2ef45031f14e5c27d3c214a9eff398172f1cdea289132fe264fb42284d3bb93f19591d59b1e92466fd378dff851fc43520163cd4f99fd1925e15ca8abad1e4a60ebd77295bbc35a212257c2e87afc7406fde6be64a435f54251c88e6bbed913a7e64f91842e58cfcd8b4c0d04bddae2dad4d18140c3def4d183c9b57a1a7b7bcc9b8bb9bef0a7299a2d2f0a55e3f773a8cd4a1cb91cec49aef94980f96c2c1b97dacb6be79eef062f31d8b6e026750838f9ef9f74ad26d1456b139f32e6e4198d7e82e5595bf8ffef333070deba1af1a85f85e78c4a7274a7665cb42f02a2c5caa64938164d2e00651032f9a061355e78c15b103b25fe7d6c6b05385396484d4ba1d14f17d5669d092c6d5dd26761acdce161cffe7bd4f34c1eec5017d131c2a1cf53c3656c024ba9cb30cd2a96900f383ff22ecc3532af1d416ef238fedd9793ed464fdc1e7558d2bb4765593adce723d712ae437ef3146eed2e18082c8a48b03ea2675ab4291ac38044c0c71801e233aae9556317d499a5efb18e041b185b3de78ed2ea58f4613a148e53bcada4519deb8e071b59821daca50834477c7a299c6a71bfc9cf77548c9127ec861e3754cb38a047e0a80138cd8449f889c548d3813d591ecfd209d08d40a635b71dabc9d561a443dcb7c2cb1a416781b2f86174064b8dadca3d12ce54fc6a681f1372255c4cee5b2828cdf2ee99363dced07778dade04be1ea8a92eb1dea73f1ecd0b94be8575310a3adc2a15fdba53042365b7be45973ec4fc3cdbb78d402670a659785c8ac213bbd9f2f4c019d3c07ee1970f7403158ab02a03661745d0548ec09e89dbfdeb62cc64e1fb31f34394f86a51c8a5238131b713100525dfa3c08e617420fec41c3dac656923763097a15764e83458889f54875c72178f3712ee017e2c94d192b0e19e68efb6b02eb73189e210e214499042d494e7f2faeeb1572a6504929ae128129acfb9e3a26851dda9a54dc53a8a88b234bc60c45f4608f0e0a54b08e1a2cbf339ffe36a0c6e900d86531dfece5d282cfea3ad265ec86a5177de244d1fbc8fa849da4d4647db5c374d24d178443d3ec902b0965ff8f8fa0a2fadfb7ddba43699db3ebb13a9af6f83d508209d2e91d6df8892c9876b8771bc452c72cd39bd0978227ab279892bc9efb48d6ef7135562245a4caa78f16c7e538f51b49fcc9d8ff642bf2fe05950fd7855025892171b2f784894a6fa2b05101e7dee9be262b1e1917d5cf99e3d690e613e23242aa7146039e48bf51bc7459ac82f63d517a96134be97f236a34217633186ce6913a325bd1c30b05ce3f7a82a9a22ca23a8e98fd52e365f3574ac8f26d6aa33454085d7142042d262b022751abb4dd274954f381495c5acd1ec182c8a231f612475ef129101a2bbe6f5bc30aba0950d7e9a439ea0578571d89d38afaa49db4dd36987b4e44546b88fbe086627a39036adedd367ccd79b5b498e1405cc07b6654ce42bc7a5ed5c7af54555ff43e32ced0d249cd530564dcf8cf4ec2574dee39d5d874a21ff87ebd184984b612faece8915a7156294c5fc48af009549621190330fe41ec98f837697499a029b2ab75a2cba286dcb4fefa436ffb8e32eeb56ebc4180a75ca2d5a8f047baa3392e033a74d14e60a89f1f5cbe7f15ea6d80f8ac4556882fb9e6e2c599b4e296855a4e9e344345f11fba8c52326b8c0351923b70cfdb0241315e43627cd577295195b935d43cb37f65b499c83db6ceabf32adfe0c23ae7e3a15888657423456150e77fd10e502126e180bdb8e97b2ca6b476339f7a89ebb3c22f2d1eba256bbc9864daa1b38b181a93eaedb8371c981ddfcf0afbc7d0bee0f8b5a1df6516609207b537cdfd688042221e6e282c76ab5443719af678ac3059ca6efeac18771a41a60e11dbc7e60ebc72bedc874a22f95a497deeee1a0b7f72d0a445baf10b7e82adc145eea275c02850b65d2ec5f5c1bda738706987fd008f07dd1f35e2b5f85320c64f9cf3bac081b78a3564876a78a6295434b748fd7abf794013d397d1af869cd8a9f0f782d465ca214429c7546655b3b382f1de9fe07ce2802d97327c08923f1b24e5c34b05db7d2001921d3494cafb183f2b18045aa4e3da5f2635a75c94c8d03e8caf5b5bcba28157ab802fee813b6ad0497cf4c0bfe9851a031bda14175d8d008df86029fb3962bd60d20de1fd8f93e93605f49d4fce1db6e8d81b39e2c037318f0f26869c8ff50e348f1da32ba3ac17a6bb1b8c029573714c61dc10c54dd1a4e9c4cd20333c3b675370575bade21b82e448664ddb18db7b5ed4f4ef48bded89b28bd2db08a4e3145afade0ab82c820d945303b1f436f9eda6b47ed5166aa753f8fbe58081355d9cb172f403a35c9236332b9329c28e56e0a045d59997230a4894f24a8a23073af9b1c2793ea249eff0015de4f896bba22f0e5d6a91f45cc4ec613cf2fe33fb5b792125a7b34046b98050137b4dc74f3ab06c36921b8a9889677ab7a960e45a7e16d7651c46504205a04e3d034a16a64ccf710cf6ac03924be57fd9cf5029d30e5097610a0ec9f72c2a2e29046e783b36b662d3f4fc60f2689053e031aebdd277babfb5e065bde98b6236dfb9c7b1d55bc2decf80de9e03373a50cbf7e93461a0d4e37ff0fdbe9f8b04f9e912b97a25f5d1546236935362989225a11290edc5a62cc2bcf3e1acc41367cc1cb8f6d3d8fca4dbdfeafd265ef49e9af4bf0abab48c232017a6423c300197c812353cc4edd3660685fc363f2f47b3ff3417a802e102e0052e02d050d9d2048d38f24e3a017444a1c4ce68c6c40efef9fd2b40b5b0e1bc7188903ea4eb2644a25e7a8af603f3d5cbd6d5ab4d1ed35aaafa414bd4968e8b3dbd83329a418b8894124aab858392b55f3c54af79833881979efba18215ff5e5403445991014f393710487b0a4df2acadc5fbe9143ecae61261306874a02bea19594cce9d482b93353f9889d35f7735530aef810da2075ac9ef25ee68d89cb63b55c53f3f73dbb40b995eba5e1ee4a3dac3d80d4bfcfd36b4c43fd6e700c8d479e613426934d0216e574894ff4ae60a1cddab83a18be1c6d7df764ed074f02b34f91d6025052d555509ae2c3574b3ee5c7f6ad4147e0fd2a7c01559b99938fa31cfa753c52b61a3718033a25726e4dcd958b65ac791b200621923582dde54648d2af4d4b73b6523b1e8076173ed3d787e5f1bfdaa93dc7380baebf54431e30f1a95ec994819b2d39b1b6c0e218dff577e3f56edc3ba9f43f4ed5c45691f48a29300922f20e4fef241146dcaffa2bc13083c8bca788fecb7e93831e4ec9a411dcf9ce76c704744fb3bd18e080383f19589e6daeb63a6e29ff34e956eb36dec050587a44b386091e4caf05fddcb36ef13d38c0c2807e23bf0fe5e130866b28456d4b1c0b168d28425c05ee3d13ef99b4ef86fe47af49faee0e3209d5eabd959087d993799f98dab944a806f234f3ff3c8fb5a7b303c5025d517b28782bbe814a5a50f29139696788699a80710cee1d8a099b0299ef28e8505f9e5f20ef8f7c38cb1f53189c77bc2520ea1c455902d7035222f8f0ee14fd1d275e04b26a7163085f03e70d5f04c0351903f86b029f56f533e4eeb441e97bb791b9856accab15cbc9c1517f3400584b077bffeebd7cebdbeedb6b46fa78d3f786f1c062fc5eb807a0de2c9e73e87646f417450743729a6cfcb4a5555a5ff88f853b750d5c2c04fbc3c8e36f043aa345712266a91b554a6f5dd97b102d2726d339659cc43ba2995a557c13cbafe9dd1fd9a7fa20a6b933244f9c7d9fb55d7f7490e835521541517239ba0fbe84ae98b6cb1e4e7bfac75ba9fe1bd680767bcb58d0a3298b5934fab877c71c10acb29a8567457adcad870018d437acc96121b11ed8576cb2b740ec0cd939fe8d16de62301629922fc9d6e5312af4f4e22cef2d305733c11c1a56c7341c5d68330b21aa8bf95791eced526e3b0fb2c8d571c1c2ad83307785f490095fe2b3f5f6ae9671073aa3a4929e4b0adda5201aa4595dd5ce8336679d870b6e445897b991f036a005c3bc157da3fb1c414e7889843d2e57d0038d9ccdde518a8ccaaed2ed4597a9966432f60c654795999d91bcce52b16f04ceee4b643aeb188aab31eab77be86cc1018c0d3d5d352b2c7b83ac7e00e57e3bc77d84a47e58b4cca3c48224ee2c057a8b1501005ad35ce4ec813b7a7ca88fac3d836110bfa8142fb6e62daa3ff0d371f00996e354eea8f61ce5c4178b5a33b6cd326470b743f459eb5dc159795fad8f7f35771084cf5d6150ca365621bcb9a8cd5f70adb408c29fd55685562dd3ac5f6299aff99bcc3303a92d67a0a0d3bb0d97a897cb04c949642edec0cc77562b0c8b88885869cc2205107c7460733b26eeaef6eb6842af974bf2d2968c8876fc9ac8ba6945f87ade2d04f41999c503ff51c91656451595e3985da20eee317de3ed14fc619690a37737ded32ccc5203649cfe687bab02b48175a081c986364c49c750893ddff94a9e036e11e76520d67360a2f67c323ee70a060595137dcd14c66678f9282ecc57df76b97932e4cb4ffca1ac653f94be4c61d83043959bfeca05203e48af89131e8351668e1c14174e171275f0547082797e1f09a9c1ad58fdbc80d804ae61b175b9b4805d71bad1b8086ff13b0cb8b46024a9d396636de131f7595cec2fe9b62d5256566b0b6bba44caebb6d7a6601ed7b491271e6e449ff01695681639a58940b1b44f68f3e1026fb22489c2f5246077ff2d8587fb788da7ab321cd37178a6a1a453b5d9427ca8a8180dc1757c043daa52f910ee7b275a2b6f2917a07571fc097c7de9b2032eed1ee4fa315e9a381d12584942cd25969316b886c86dc73ef5882b450d860f4843c7847d3dc5e5fb2d2711595a96cf0d01fa11290552fafa58b0afca65e9de20f2249658295a51a54d3656e3ae2959ede86796d5a3ba4995b8bdf79a51558e94d5af39d5b14dd60c92d098354382243a947941793983c76dc6daa54abb4ce3377475a6b4275771c931a522a7f7972f9cd8ee0b2e1ee6bfa6a943a5fde0f3f5ebcdeb5631c4412bd3bb4102827916428fa59cd8b00dc648a5c31dc379e3962fb0edeb30ae1f6cf8645dd5520a6a650fa90e3a54c0e939fecb9de573854aa98b67800492e711a831bbbe37fa25f8a56adbcfc20e329c0748f01f2020b430ac3edb7d2280857b545f3b0aa0edca3e5bc8c8b7316b8f804f9f11744dcfa6b10221012289fa8fe976861ab65bdd4d595df11fe54465373d095929c885520223138a374167f75ab8e81a734e26dad28d171627da7bddb76c747150c1108bd37d35d8dfb109559521781c35a1eb372ae4455be21b0aac95dc0374abb8e9403e9f54426345ca16795d71f1727e1a9bfce99cfb11e14a487beae7503101e611b29e6ea158a818af1c966719eef089d2ccf2ef394c3eb22eacdd6e9ce1495de5df76d3f8e67e4aa7196ef92952042544a08bd66f6c2a8e162328c6a6c0a8d2056d6fac70fce3ad2b6c73b6627257eb71b5001ee86f2512495c2927b75cfd139b9728e2c98b612c85d9fa2c378f5f70d72ebe5a117be4ca05060a07791caa27dcd4fb6ef38b204e8802bccef95b691557adc78208b1e906059b423b9ac18ac68ce9a35f872ee0fc019f963e2ee8dceffff9a39ab0692910441fce15539300fad700f935d8bf0de8d6a17c6370637f38c19cb05bcb02dcebb14cf5d1ac50bac908ed9e18ad90df795a4949ef2612eded2aa9e4619ede8bf68f56fe41620b356cc20468e8cf6fd8c5618a0a74bc8763abd70e3d51d305762a5fe15f4a893b83150a66009d53e3a09068d232c2d9d8523ed1b3daaa0e1599b71d92a9bd365954e3fbe1887e6b81f7d5b97edd64babe00aae5df6a9d478dcfbac75271c20c27adf87f23ef79900b57e1be4510bd60f2a36693ae82fa2e39cbcd2b0055fc6a797ae6b4ac4015d4cc016ea3350ce3eaaca595473525e082203024922c353af8cecd1656502a5271f4f446ff05b46325cda409c64bae94961a3060d8003104b838fe030cd204aaa455f5eb24ae8cf80486fc616798a9579a9292005b24ba3d6a48098bcc388fbdd7b309310e35ff555b62f7aa726756da038ceaeea3994a0c015040f804673fe0a23eff9cc112509db062ea529b631da6870646dc6e3a47011841d3080c8de1d81362787c836f66249b8e39979f2a64df60a63b448e90cce7a2725590d19c44a992c4df517e113580fe943852942dd333f0ec9964900bf5a1dcb1554cecdd53cb935c50a711a7716152f27d9d16d0e934a0661d0a30b546f7cff3017e76af889a38f5e9a63b3a3a375e52bcff1b32a2216d8bf09ded1a5c8ffcd0c0513bb729f4b6c1756bb5939b8c87303fa68ba9b8a7034dc6c9470b916052fc7efe7c7848cf913844b39d319835f21a5978f66fcdc466b9e36b55fa1a2e8db39dd2dbfa334192dee6121bd680d7876c54be57bb13fd459220f374f346fa4af38dc4981d793c12dbe3488e579383f20857c8f5d7e4f590d7199861eacd6ecd4c19906874dfe90b68e55d708022d31902034a19ae8add324950dbdd7d334e47675c7e761a0f8878274528d9d1ec19ebc6839a65f73b8a3ea2694854426b31cfa2c1df6a884effc4ab08065bb3270c267387d90fa33007305cca002b1eb8ca9f5db0f8860cc1d5a4e3d5d668f76f7762f3d3416d37592cbb8761066fcfa2ebf172aa8c913ab89cc045acf274bbf8d6973500e39f1352bcdbd045586608920a4b0f945d085e7e5b868154dff118b09e18ba77bc212185226d3d09ad14a3cfe7b8f0374a2695c0b9e8ee5d3d5be38925fdeac4cadef8034fe55e34a68a9c550f52256ede1e2cbd0dec7df45dc2f735b427fe476136aff47feb7369e115c4ff48785b82bb11e206730c6cfe88f8b6f1d59b87bf399ae393bd21b4dc5ecd4eb791dec80a087c89428f760f9ef09f774ba21638f333b0912232f3e5c09bd6a109787e5319a9185393e251e16b28edf9c4153e87863919d065c042520c95d325ba47e67f5bb333ec2eeaa5e4f5d070791aafc976674c4faa6932fdc478925168f5b9d5d28365dfa8d05bc8ba60c4d78dfe4f3496eaec7da85c9ad71fccee16c5886ea5b4254956af8d9d2e114e7c378d7fb4cd7c684aef905a04ea5ce0cb4e861c9bacd2a78de931cbca54d9285bad681ac10b7be0a59784f18dcbb49b30b6daeae34a7aa1345400f65dbe176319f26619c9a3ed3276434e60674e3ed7f5127654429a3bcd211e2de9dd0e5065de14e1b01e781d93212d922e57c0fd708d2fe6a7ab8b8ea7a71bec0de42076f7245d4c4484eddeae161c671b7645d3ce85c13d0d49e7891041e7ac5c067bb3a3c50d73e409b3b70d77bfab21605ccd83dc549c4ca6b38d12a55d554ebe8e5fdfa9282ec50d90a6c9c279333b500d31ad7033e81347d7e462532bb04b6877bc71ee320254f0338ff44f2aca315804ddc224b85f79bfef4dbeea624244d5422713ff34f5935a7da29732b5de52def73bdb9cd21ebe0176981b9966a72a2c4b2f0125767e901756d026cbb4662df67b662158d01ca7c1983b830b4ece5cbbabe9eb8b42ea1103f6b75896035fc6148ec5c61f664b315954d108934424463f30d86bac7a55ee6df50ef35974e697549c7fca7d5b0833dc49217639455c8071e6017f17d1156711ab1a474d2270a7a26229d63de10d86980a0f4f4fa8560ba3ebe8d1e894a60d0a0d0b83097d6b351bdabb1a773cd22c86f0584b27a3a9f28e6874b5b1094b41566f1c5dff89797edbe40ccfb5d74ebc0cac2de26b1a5803c4ba76d2e5f07d51330af91adf9ea6c0d1d572255e6a59be77d6e6e21c6cc6921f4dbd29c2ffeba523178f8da8e0584f20ba60fc5cd90118b9b43afb2f84fef5947e93f3a80f948e276892a0fd0b155b4453c0856c5b7316faae1c05b0c78c6a9dc5b63dacf6d1686da486a11d55779ce5e95b181f2b180862ada8c6346af1481c057882a6690355ce2a805ac4a5ea847b57d2a1c26a16a09a4a6b7769412afb0ff55fedfee349824f26f321cdb380d2ec29de46f569f4de0cbb538cff229048e100fd8f1e804021746b298c528256ca4a3bb756b877cfe635473bf67b1f8876dda54d7bac332a6eb9f9b1eac1e2226ed4df310eac2f5cd3dcdf58f5b5c923c475d6650c7c67964ab04ceba8992a0f0a9e0053cc6b3281a7643c3c73252beeac02dc9c3bbf021c85e62aba4050263773a0efcbafff88014b86ed6305cb9ab687e43fc20c257868abf580f8dafa60862bc8d677c9863084c84ecc8b563ecc5e831c0fd455bf1eba477d439b3fa65ace06a7a30b6cd1b38c7082b813df9d964d83e391828efea38c9cf541ecf4bd950599f8027496ea48998fe4ebcf4503e027c46a25fee8439ef81958ed92b98a8f302ce06e8c97dc690fadec47d717c5ff0d374a9f11009d4f29a0f7ef5566b0ff2aa648370b7dd9492795049a2a1c7272e6e78ecff687b675f79b06910a7ef08133ba45b58671270999eab919e5d4ca24abce90b5c1da2380b48a752fd7db8935bf4211b14ece33fd9ef14938397a091b956efefd26296a6267c6b630f2d86f47936be0981e03163c0de467035e6339e10c83d6eb72bdc7a458ce98b9523f33ec76437e3ec6cfc82dc8c58fd3f8df8b0297c36d421693a05f737b48c04db656774c5552238a949c9f4f461a9f58d79e4e20fc18326a5eb73276b53a99af58fffb66ec94e3ac35995e25c068d41277d20c808dfd89a7f744995851675a04e3f7751467f1d83fd98b45d2910d4920120fee50d2fbc193ec2db0e5d7331704a9463d6c26746284e8439647eacb65101fde10fe06ae272357216c953a3af5c7fa358e0bb1dd7e0c41620d3b4d3887b6e964697681054882d4fad04bacddeea48623c20e44c30360b9c535cc638eff2b53bdc9c6eb6eb504e5deb4rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootselinux-policy-3.12.1-153.el7_0.10.src.rpmselinux-policy-doc    /usr/bin/xdg-openrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)selinux-policyrpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-13.12.1-153.el7_0.105.2-14.11.1SSS|@Sy@SpSj @Sj @Sj @Sg}@Sg}@SB@S>S;S:@S9XS5d@S4S2@S0@S,)S*@S)S)S&S&S"@S!S L@SSS@SSc@SSnS @S SK@RRR@RRJ@Ra@RRR&R&RRR=RʚRR@R@R@Rv@Rv@R@RR@R R@R@R|@Rz/@Rz/@RsRpRnQRi RfhR_@R_@R[R[RSRNRNRL RIgRB@RB@R:@R1R-@R-@R(r@R' R%@R7RRNRR@Q@QQdQQ@QQޞ@Q@QکQکQ@QzQQ4Q@@Q@QKQQ@Q@Q@Q@QQ@QQQQ@Q@QQQ@Qzl@Qw@QvwQo@Qo@QnQm=@QkQfQb@Q`@Q^QZ@QQQIQGQ@j@Q9Q8@Q4Q0@Q-@Q& @Q$QQ@QQ@Q @Qh@QsPP@P@PP@P[PP!@P8@PO@P @Pf@PPqP @PP7@P@PPPYP@P@PPPM@PPd@P@PoP{@P{@P@PP5@P@P~P}L@Px@PvPvPuc@Puc@Pr@Pmz@Pmz@Pmz@Pj@Pd?Pd?Pb@PaPaP[@PXb@PWPS@PQPO'PM@PIP@@P>@P8@P7lP2&P2&P,P,P*=P(@P#@P#@P!@P!@P@PkPw@Pw@PP

@NNU@NNl@N@N@NåN@NNNN@NNN@N@NGNGNGN@N@NNS@NS@N^N^N @N @NNj@Nj@NN$@NN@N/N@N@NFNFN@NNN@N@N@N]Ni@Ni@Ni@N|tNyNx@Ns:@NoENoENiNf @N^"@N\N[@NTNS@NS@NC@NBrN:N98@N7N6@N2N.@N*N)f@N(N%qN$ @N@N7@N e@NpNpM@M@Md@Md@MM{@M@M۝M@M@M‘@M@M@M@My@My@M3@M@M@MMM@MMMMTMx@Mx@Mv@MlMbSM[@MRMQ0@MQ0@MJMGMGMA^@M>@M9u@M6@M5M4/@M4/@M0:M,F@M$]@M@M9MMMMM\@M M M@L!L!L@LL@L@L@LOLOL[@L@L@Lr@L L,@L,@Lډ@L7LLLNL@LΫLeL|L@LB@LB@LB@L@LMLL@LdLL{L*@L@L5LLA@LLLL@LcL@L@L@LzL)@L|L|L|L{@LvW@LvW@Ls@Ls@LrbLrbLmLk@LjyLe3Lc@La?@LZLYV@LXLN@LN@LMxLMxLI@LH2LF@LEL=L=L=L;L7@L LT@L@LL@L@L0LLGL@K^K^KKKj@K$@KKK@K@KK@K]K޺K@KtK#@KKՀ@K:@KK͗@KŮ@K\K\K @KKKKK9@KK@KK@K@KKKKrKK~@K,K,K,K@KK8@KKK@KK@KqKqK}+K{@K{@KuBKs@KqN@KjKie@Kf@Ka|@K`*K]KXAKTM@KPXKEKEKEKD{@KC)KA@K;@K2@K0K/c@K+nK*@K(K"4@KK>K>K>JJęJH@JH@JJJ_@J@JjJjJ@Jv@Jv@Jv@Jv@J$J@JJ0@J@J@JG@JG@J@JJ@J@J@JJJ#J@JJJ@J:J@JJQJ@J J J|@JzJyt@Jyt@Jx"JrJrJq@Jn@Jn@JmJhPJeJ\s@JW-@JT@JS8JKOJI@JCfJCfJB@J@J@J?r@J<@J;}J:,@J7@J67J2C@J0J/@J,@J%@JJB@JJMJ J dJ@J@JJ@J*@J*@II@IIA@IIII@I@IIIX@IX@IX@II@I@IcIIo@Io@IzI)@I@IܑI@@II@I@I@IԨIд@I̿In@I3I3I@II@I@IV@IIaIIm@I@I'@II2III@IIIIIIII@III@I1I@III~@I}Iy@Ix_Iw@IuItk@Itk@Io%@Ik0IeIcGIa@I`IVIO@IJ;@IHIAI>]I= @I7@I6tI3I-I@III9@I9@II IP@I@IIg@Ig@HHH@HrH~@H,H@HCHHH @H @Hf@Hf@H@H+H@H׈H׈H7@HBH@HǶH@HH|@HHH@H{@H)HHL@H@H@H@HnH}H|@Ht@HsVHr@Hl@HkmHgy@HcH`H_@H^>HRa@HQHQHO@HFHFH$@DX@DU@DN@DN@DLDH@DGwDGwDDD@@D?D?D;@D;@D:HD:HD2_D1@D1@D-D+@D+@D'D!<@D!<@D!<@DDD@D@D@DDDDDD@D@D@D@D uD $@D D @D @DDDFC@C@C@C@CCCCCR@CCCCC@Ci@CC@C@CtC@C@CC:@CECCC @C @CعCعCعCعCC@C-C-C-C@C@CCǖ@C@CáCáCP@CP@C[C @C @CCg@Cg@CCC!@C~@C,C@CCCCC@CC@C@C@CZCZC @C @CCCf@Cf@Cf@CC@CqCqC @C @C @CCC}@C7@C7@C7@CBCBCYC@C@CC}@CqCqMiroslav Grepl 3.12.1-153.el7_0.10Miroslav Grepl 3.12.1-153.el7_0.9Miroslav Grepl 3.12.1-153.el7_0.8Miroslav Grepl 3.12.1-153.el7_0.7Miroslav Grepl 3.12.1-153.el7_0.6Miroslav Grepl 3.12.1-153.el7_0.5Miroslav Grepl 3.12.1-153.el7_0.4Miroslav Grepl 3.12.1-153.el7_0.3Miroslav Grepl 3.12.1-153.el7_0.2Miroslav Grepl 3.12.1-153.el7_0.1Miroslav Grepl 3.12.1-153Miroslav Grepl 3.12.1-152Miroslav Grepl 3.12.1-151Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-148Miroslav Grepl 3.12.1-147Miroslav Grepl 3.12.1-146Miroslav Grepl 3.12.1-145Miroslav Grepl 3.12.1-144Lukas Vrabec 3.12.1-143Miroslav Grepl 3.12.1-142Miroslav Grepl 3.12.1-141Miroslav Grepl 3.12.1-140Miroslav Grepl 3.12.1-139Lukas Vrabec 3.12.1-138Miroslav Grepl 3.12.1-137Miroslav Grepl 3.12.1-136Miroslav Grepl 3.12.1-135Miroslav Grepl 3.12.1-134Miroslav Grepl 3.12.1-133Miroslav Grepl 3.12.1-132Miroslav Grepl 3.12.1-131Miroslav Grepl 3.12.1-130Miroslav Grepl 3.12.1-129Miroslav Grepl 3.12.1-128Miroslav Grepl 3.12.1-127Miroslav Grepl 3.12.1-126Miroslav Grepl 3.12.1-125Miroslav Grepl 3.12.1-124Miroslav Grepl 3.12.1-123Miroslav Grepl 3.12.1-122Miroslav Grepl 3.12.1-121Miroslav Grepl 3.12.1-120Miroslav Grepl 3.12.1-119Miroslav Grepl 3.12.1-118Miroslav Grepl 3.12.1-117Miroslav Grepl 3.12.1-116Miroslav Grepl 3.12.1-115Miroslav Grepl 3.12.1-114Miroslav Grepl 3.12.1-113Miroslav Grepl 3.12.1-112Miroslav Grepl 3.12.1-111Miroslav Grepl 3.12.1-110Miroslav Grepl 3.12.1-109Miroslav Grepl 3.12.1-108Miroslav Grepl 3.12.1-107Dan Walsh 3.12.1-106Miroslav Grepl 3.12.1-105Miroslav Grepl 3.12.1-104Miroslav Grepl 3.12.1-103Miroslav Grepl 3.12.1-102Miroslav Grepl 3.12.1-101Miroslav Grepl 3.12.1-100Miroslav Grepl 3.12.1-99Miroslav Grepl 3.12.1-98Miroslav Grepl 3.12.1-97Miroslav Grepl 3.12.1-96Miroslav Grepl 3.12.1-95Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-93Miroslav Grepl 3.12.1-92Miroslav Grepl 3.12.1-91Miroslav Grepl 3.12.1-90Miroslav Grepl 3.12.1-89Miroslav Grepl 3.12.1-88Miroslav Grepl 3.12.1-87Miroslav Grepl 3.12.1-86Miroslav Grepl 3.12.1-85Miroslav Grepl 3.12.1-84Miroslav Grepl 3.12.1-83Miroslav Grepl 3.12.1-82Miroslav Grepl 3.12.1-81Miroslav Grepl 3.12.1-80Miroslav Grepl 3.12.1-79Miroslav Grepl 3.12.1-78Miroslav Grepl 3.12.1-77Miroslav Grepl 3.12.1-76Miroslav Grepl 3.12.1-75Miroslav Grepl 3.12.1-74Miroslav Grepl 3.12.1-73Miroslav Grepl 3.12.1-72Miroslav Grepl 3.12.1-71Miroslav Grepl 3.12.1-70Miroslav Grepl 3.12.1-69Miroslav Grepl 3.12.1-68Miroslav Grepl 3.12.1-67Miroslav Grepl 3.12.1-66Miroslav Grepl 3.12.1-65Miroslav Grepl 3.12.1-64Miroslav Grepl 3.12.1-63Miroslav Grepl 3.12.1-62Miroslav Grepl 3.12.1-61Miroslav Grepl 3.12.1-60Miroslav Grepl 3.12.1-59Miroslav Grepl 3.12.1-58Miroslav Grepl 3.12.1-57Miroslav Grepl 3.12.1-56Miroslav Grepl 3.12.1-55Miroslav Grepl 3.12.1-54Miroslav Grepl 3.12.1-53Miroslav Grepl 3.12.1-52Miroslav Grepl 3.12.1-51Miroslav Grepl 3.12.1-50Miroslav Grepl 3.12.1-49Miroslav Grepl 3.12.1-48Miroslav Grepl 3.12.1-47Miroslav Grepl 3.12.1-46Miroslav Grepl 3.12.1-45Miroslav Grepl 3.12.1-44Miroslav Grepl 3.12.1-43Miroslav Grepl 3.12.1-42Miroslav Grepl 3.12.1-41Miroslav Grepl 3.12.1-40Miroslav Grepl 3.12.1-39Miroslav Grepl 3.12.1-38Miroslav Grepl 3.12.1-37Miroslav Grepl 3.12.1-36Miroslav Grepl 3.12.1-35Miroslav Grepl 3.12.1-34Miroslav Grepl 3.12.1-33Miroslav Grepl 3.12.1-32Miroslav Grepl 3.12.1-31Miroslav Grepl 3.12.1-30Miroslav Grepl 3.12.1-29Dan Walsh 3.12.1-28Dan Walsh 3.12.1-27Miroslav Grepl 3.12.1-26Miroslav Grepl 3.12.1-25Miroslav Grepl 3.12.1-24Miroslav Grepl 3.12.1-23Miroslav Grepl 3.12.1-22Miroslav Grepl 3.12.1-21Miroslav Grepl 3.12.1-20Miroslav Grepl 3.12.1-19Miroslav Grepl 3.12.1-18Miroslav Grepl 3.12.1-17Miroslav Grepl 3.12.1-16Miroslav Grepl 3.12.1-15Miroslav Grepl 3.12.1-14Miroslav Grepl 3.12.1-13Miroslav Grepl 3.12.1-12Miroslav Grepl 3.12.1-11Miroslav Grepl 3.12.1-10Miroslav Grepl 3.12.1-9Miroslav Grepl 3.12.1-8Miroslav Grepl 3.12.1-7Miroslav Grepl 3.12.1-6Miroslav Grepl 3.12.1-5Miroslav Grepl 3.12.1-4Miroslav Grepl 3.12.1-3Miroslav Grepl 3.12.1-2Miroslav Grepl 3.12.1-1Dan Walsh 3.11.1-69.1Miroslav Grepl 3.11.1-69Miroslav Grepl 3.11.1-68Miroslav Grepl 3.11.1-67Miroslav Grepl 3.11.1-66Miroslav Grepl 3.11.1-65Miroslav Grepl 3.11.1-64Miroslav Grepl 3.11.1-63Miroslav Grepl 3.11.1-62Miroslav Grepl 3.11.1-61Miroslav Grepl 3.11.1-60Miroslav Grepl 3.11.1-59Miroslav Grepl 3.11.1-58Miroslav Grepl 3.11.1-57Miroslav Grepl 3.11.1-56Miroslav Grepl 3.11.1-55Miroslav Grepl 3.11.1-54Miroslav Grepl 3.11.1-53Miroslav Grepl 3.11.1-52Miroslav Grepl 3.11.1-51Miroslav Grepl 3.11.1-50Miroslav Grepl 3.11.1-49Miroslav Grepl 3.11.1-48Miroslav Grepl 3.11.1-47Miroslav Grepl 3.11.1-46Miroslav Grepl 3.11.1-45Miroslav Grepl 3.11.1-44Miroslav Grepl 3.11.1-43Miroslav Grepl 3.11.1-42Miroslav Grepl 3.11.1-41Miroslav Grepl 3.11.1-40Miroslav Grepl 3.11.1-39Miroslav Grepl 3.11.1-38Miroslav Grepl 3.11.1-37Miroslav Grepl 3.11.1-36Miroslav Grepl 3.11.1-35Miroslav Grepl 3.11.1-34Miroslav Grepl 3.11.1-33Miroslav Grepl 3.11.1-32Miroslav Grepl 3.11.1-31Miroslav Grepl 3.11.1-30Miroslav Grepl 3.11.1-29Miroslav Grepl 3.11.1-28Miroslav Grepl 3.11.1-27Miroslav Grepl 3.11.1-26Miroslav Grepl 3.11.1-25Miroslav Grepl 3.11.1-24Miroslav Grepl 3.11.1-23Miroslav Grepl 3.11.1-22Miroslav Grepl 3.11.1-21Miroslav Grepl 3.11.1-20Miroslav Grepl 3.11.1-19Miroslav Grepl 3.11.1-18Miroslav Grepl 3.11.1-17Miroslav Grepl 3.11.1-16Dan Walsh 3.11.1-15Miroslav Grepl 3.11.1-14Dan Walsh 3.11.1-13Miroslav Grepl 3.11.1-12Miroslav Grepl 3.11.1-11Miroslav Grepl 3.11.1-10Dan Walsh 3.11.1-9Dan Walsh 3.11.1-8Dan Walsh 3.11.1-7Dan Walsh 3.11.1-6Miroslav Grepl 3.11.1-5Miroslav Grepl 3.11.1-4Miroslav Grepl 3.11.1-3Miroslav Grepl 3.11.1-2Miroslav Grepl 3.11.1-1Miroslav Grepl 3.11.1-0Miroslav Grepl 3.11.0-15Miroslav Grepl 3.11.0-14Miroslav Grepl 3.11.0-13Miroslav Grepl 3.11.0-12Fedora Release Engineering - 3.11.0-11Miroslav Grepl 3.11.0-10Miroslav Grepl 3.11.0-9Miroslav Grepl 3.11.0-8Miroslav Grepl 3.11.0-7Miroslav Grepl 3.11.0-6Miroslav Grepl 3.11.0-5Miroslav Grepl 3.11.0-4Miroslav Grepl 3.11.0-3Miroslav Grepl 3.11.0-2Miroslav Grepl 3.11.0-1Miroslav Grepl 3.10.0-128Miroslav Grepl 3.10.0-127Miroslav Grepl 3.10.0-126Miroslav Grepl 3.10.0-125Miroslav Grepl 3.10.0-124Miroslav Grepl 3.10.0-123Miroslav Grepl 3.10.0-122Miroslav Grepl 3.10.0-121Miroslav Grepl 3.10.0-120Miroslav Grepl 3.10.0-119Miroslav Grepl 3.10.0-118Miroslav Grepl 3.10.0-117Miroslav Grepl 3.10.0-116Miroslav Grepl 3.10.0-115Miroslav Grepl 3.10.0-114Miroslav Grepl 3.10.0-113Miroslav Grepl 3.10.0-112Miroslav Grepl 3.10.0-111Miroslav Grepl 3.10.0-110Miroslav Grepl 3.10.0-109Miroslav Grepl 3.10.0-108Miroslav Grepl 3.10.0-107Miroslav Grepl 3.10.0-106Miroslav Grepl 3.10.0-105Miroslav Grepl 3.10.0-104Miroslav Grepl 3.10.0-103Miroslav Grepl 3.10.0-102Miroslav Grepl 3.10.0-101Miroslav Grepl 3.10.0-100Miroslav Grepl 3.10.0-99Miroslav Grepl 3.10.0-98Miroslav Grepl 3.10.0-97Miroslav Grepl 3.10.0-96Miroslav Grepl 3.10.0-95Miroslav Grepl 3.10.0-94Miroslav Grepl 3.10.0-93Miroslav Grepl 3.10.0-92Miroslav Grepl 3.10.0-91Miroslav Grepl 3.10.0-90Miroslav Grepl 3.10.0-89Miroslav Grepl 3.10.0-88Miroslav Grepl 3.10.0-87Miroslav Grepl 3.10.0-86Miroslav Grepl 3.10.0-85Miroslav Grepl 3.10.0-84Miroslav Grepl 3.10.0-83Miroslav Grepl 3.10.0-82Dan Walsh 3.10.0-81.2Miroslav Grepl 3.10.0-81Miroslav Grepl 3.10.0-80Miroslav Grepl 3.10.0-79Miroslav Grepl 3.10.0-78Miroslav Grepl 3.10.0-77Miroslav Grepl 3.10.0-76Miroslav Grepl 3.10.0-75Dan Walsh 3.10.0-74.2Miroslav Grepl 3.10.0-74Miroslav Grepl 3.10.0-73Miroslav Grepl 3.10.0-72Miroslav Grepl 3.10.0-71Miroslav Grepl 3.10.0-70Miroslav Grepl 3.10.0-69Miroslav Grepl 3.10.0-68Miroslav Grepl 3.10.0-67Miroslav Grepl 3.10.0-66Miroslav Grepl 3.10.0-65Miroslav Grepl 3.10.0-64Miroslav Grepl 3.10.0-63Miroslav Grepl 3.10.0-59Miroslav Grepl 3.10.0-58Dan Walsh 3.10.0-57Dan Walsh 3.10.0-56Dan Walsh 3.10.0-55.2Dan Walsh 3.10.0-55.1Miroslav Grepl 3.10.0-55Dan Walsh 3.10.0-54.1Miroslav Grepl 3.10.0-54Dan Walsh 3.10.0-53.1Miroslav Grepl 3.10.0-53Miroslav Grepl 3.10.0-52Miroslav Grepl 3.10.0-51Dan Walsh 3.10.0-50.2Dan Walsh 3.10.0-50.1Miroslav Grepl 3.10.0-50Miroslav Grepl 3.10.0-49Miroslav Grepl 3.10.0-48Miroslav Grepl 3.10.0-47Dan Walsh 3.10.0-46.1Miroslav Grepl 3.10.0-46Dan Walsh 3.10.0-45.1Miroslav Grepl 3.10.0-45Miroslav Grepl 3.10.0-43Miroslav Grepl 3.10.0-42Miroslav Grepl 3.10.0-41Dan Walsh 3.10.0-40.2Miroslav Grepl 3.10.0-40Dan Walsh 3.10.0-39.3Dan Walsh 3.10.0-39.2Dan Walsh 3.10.0-39.1Miroslav Grepl 3.10.0-39Dan Walsh 3.10.0-38.1Miroslav Grepl 3.10.0-38Miroslav Grepl 3.10.0-37Dan Walsh 3.10.0-36.1Miroslav Grepl 3.10.0-36Dan Walsh 3.10.0-35Dan Walsh 3.10.0-34.7Dan Walsh 3.10.0-34.6Dan Walsh 3.10.0-34.4Miroslav Grepl 3.10.0-34.3Dan Walsh 3.10.0-34.2Dan Walsh 3.10.0-34.1Miroslav Grepl 3.10.0-34Miroslav Grepl 3.10.0-33Dan Walsh 3.10.0-31.1Miroslav Grepl 3.10.0-31Miroslav Grepl 3.10.0-29Miroslav Grepl 3.10.0-28Miroslav Grepl 3.10.0-27Miroslav Grepl 3.10.0-26Miroslav Grepl 3.10.0-25Miroslav Grepl 3.10.0-24Miroslav Grepl 3.10.0-23Miroslav Grepl 3.10.0-22Miroslav Grepl 3.10.0-21Dan Walsh 3.10.0-20Miroslav Grepl 3.10.0-19Miroslav Grepl 3.10.0-18Miroslav Grepl 3.10.0-17Miroslav Grepl 3.10.0-16Miroslav Grepl 3.10.0-14Miroslav Grepl 3.10.0-13Miroslav Grepl 3.10.0-12Miroslav Grepl 3.10.0-11Miroslav Grepl 3.10.0-10Miroslav Grepl 3.10.0-9Miroslav Grepl 3.10.0-8Miroslav Grepl 3.10.0-7Miroslav Grepl 3.10.0-6Miroslav Grepl 3.10.0-5Miroslav Grepl 3.10.0-4Miroslav Grepl 3.10.0-3Miroslav Grepl 3.10.0-2Miroslav Grepl 3.10.0-1Miroslav Grepl 3.9.16-30Dan Walsh 3.9.16-29.1Miroslav Grepl 3.9.16-29Dan Walsh 3.9.16-28.1Miroslav Grepl 3.9.16-27Miroslav Grepl 3.9.16-26Miroslav Grepl 3.9.16-25Miroslav Grepl 3.9.16-24Miroslav Grepl 3.9.16-23Miroslav Grepl 3.9.16-22Miroslav Grepl 3.9.16-21Miroslav Grepl 3.9.16-20Miroslav Grepl 3.9.16-19Miroslav Grepl 3.9.16-18Miroslav Grepl 3.9.16-17Dan Walsh 3.9.16-16.1Miroslav Grepl 3.9.16-16Miroslav Grepl 3.9.16-15Miroslav Grepl 3.9.16-14Miroslav Grepl 3.9.16-13Miroslav Grepl 3.9.16-12Miroslav Grepl 3.9.16-11Miroslav Grepl 3.9.16-10Miroslav Grepl 3.9.16-7Miroslav Grepl 3.9.16-6Miroslav Grepl 3.9.16-5Miroslav Grepl 3.9.16-4Miroslav Grepl 3.9.16-3Miroslav Grepl 3.9.16-2Miroslav Grepl 3.9.16-1Miroslav Grepl 3.9.15-5Miroslav Grepl 3.9.15-2Miroslav Grepl 3.9.15-1Fedora Release Engineering - 3.9.14-2Dan Walsh 3.9.14-1Miroslav Grepl 3.9.13-10Miroslav Grepl 3.9.13-9Dan Walsh 3.9.13-8Miroslav Grepl 3.9.13-7Miroslav Grepl 3.9.13-6Miroslav Grepl 3.9.13-5Miroslav Grepl 3.9.13-4Miroslav Grepl 3.9.13-3Miroslav Grepl 3.9.13-2Miroslav Grepl 3.9.13-1Miroslav Grepl 3.9.12-8Miroslav Grepl 3.9.12-7Miroslav Grepl 3.9.12-6Miroslav Grepl 3.9.12-5Dan Walsh 3.9.12-4Dan Walsh 3.9.12-3Dan Walsh 3.9.12-2Miroslav Grepl 3.9.12-1Dan Walsh 3.9.11-2Miroslav Grepl 3.9.11-1Miroslav Grepl 3.9.10-13Dan Walsh 3.9.10-12Miroslav Grepl 3.9.10-11Miroslav Grepl 3.9.10-10Miroslav Grepl 3.9.10-9Miroslav Grepl 3.9.10-8Miroslav Grepl 3.9.10-7Miroslav Grepl 3.9.10-6Miroslav Grepl 3.9.10-5Dan Walsh 3.9.10-4Miroslav Grepl 3.9.10-3Miroslav Grepl 3.9.10-2Miroslav Grepl 3.9.10-1Miroslav Grepl 3.9.9-4Dan Walsh 3.9.9-3Miroslav Grepl 3.9.9-2Miroslav Grepl 3.9.9-1Miroslav Grepl 3.9.8-7Dan Walsh 3.9.8-6Miroslav Grepl 3.9.8-5Miroslav Grepl 3.9.8-4Dan Walsh 3.9.8-3Dan Walsh 3.9.8-2Dan Walsh 3.9.8-1Dan Walsh 3.9.7-10Dan Walsh 3.9.7-9Dan Walsh 3.9.7-8Dan Walsh 3.9.7-7Dan Walsh 3.9.7-6Dan Walsh 3.9.7-5Dan Walsh 3.9.7-4Dan Walsh 3.9.7-3Dan Walsh 3.9.7-2Dan Walsh 3.9.7-1Dan Walsh 3.9.6-3Dan Walsh 3.9.6-2Dan Walsh 3.9.6-1Dan Walsh 3.9.5-11Dan Walsh 3.9.5-10Dan Walsh 3.9.5-9Dan Walsh 3.9.5-8Dan Walsh 3.9.5-7Dan Walsh 3.9.5-6Dan Walsh 3.9.5-5Dan Walsh 3.9.5-4Dan Walsh 3.9.5-3Dan Walsh 3.9.5-2Dan Walsh 3.9.5-1Dan Walsh 3.9.4-3Dan Walsh 3.9.4-2Dan Walsh 3.9.4-1Dan Walsh 3.9.3-4Dan Walsh 3.9.3-3Dan Walsh 3.9.3-2Dan Walsh 3.9.3-1Dan Walsh 3.9.2-1Dan Walsh 3.9.1-3Dan Walsh 3.9.1-2Dan Walsh 3.9.1-1Dan Walsh 3.9.0-2Dan Walsh 3.9.0-1Dan Walsh 3.8.8-21Dan Walsh 3.8.8-20Dan Walsh 3.8.8-19Dan Walsh 3.8.8-18Dan Walsh 3.8.8-17Dan Walsh 3.8.8-16Dan Walsh 3.8.8-15Dan Walsh 3.8.8-14Dan Walsh 3.8.8-13Dan Walsh 3.8.8-12Dan Walsh 3.8.8-11Dan Walsh 3.8.8-10Dan Walsh 3.8.8-9Dan Walsh 3.8.8-8Dan Walsh 3.8.8-7Dan Walsh 3.8.8-6Dan Walsh 3.8.8-5Dan Walsh 3.8.8-4Dan Walsh 3.8.8-3Dan Walsh 3.8.8-2Dan Walsh 3.8.8-1Dan Walsh 3.8.7-3Dan Walsh 3.8.7-2Dan Walsh 3.8.7-1Dan Walsh 3.8.6-3Miroslav Grepl 3.8.6-2Dan Walsh 3.8.6-1Dan Walsh 3.8.5-1Dan Walsh 3.8.4-1Dan Walsh 3.8.3-4Dan Walsh 3.8.3-3Dan Walsh 3.8.3-2Dan Walsh 3.8.3-1Dan Walsh 3.8.2-1Dan Walsh 3.8.1-5Dan Walsh 3.8.1-4Dan Walsh 3.8.1-3Dan Walsh 3.8.1-2Dan Walsh 3.8.1-1Dan Walsh 3.7.19-22Dan Walsh 3.7.19-21Dan Walsh 3.7.19-20Dan Walsh 3.7.19-19Dan Walsh 3.7.19-17Dan Walsh 3.7.19-16Dan Walsh 3.7.19-15Dan Walsh 3.7.19-14Dan Walsh 3.7.19-13Dan Walsh 3.7.19-12Dan Walsh 3.7.19-11Dan Walsh 3.7.19-10Dan Walsh 3.7.19-9Dan Walsh 3.7.19-8Dan Walsh 3.7.19-7Dan Walsh 3.7.19-6Dan Walsh 3.7.19-5Dan Walsh 3.7.19-4Dan Walsh 3.7.19-3Dan Walsh 3.7.19-2Dan Walsh 3.7.19-1Dan Walsh 3.7.18-3Dan Walsh 3.7.18-2Dan Walsh 3.7.18-1Dan Walsh 3.7.17-6Dan Walsh 3.7.17-5Dan Walsh 3.7.17-4Dan Walsh 3.7.17-3Dan Walsh 3.7.17-2Dan Walsh 3.7.17-1Dan Walsh 3.7.16-2Dan Walsh 3.7.16-1Dan Walsh 3.7.15-4Dan Walsh 3.7.15-3Dan Walsh 3.7.15-2Dan Walsh 3.7.15-1Dan Walsh 3.7.14-5Dan Walsh 3.7.14-4Dan Walsh 3.7.14-3Dan Walsh 3.7.14-2Dan Walsh 3.7.14-1Dan Walsh 3.7.13-4Dan Walsh 3.7.13-3Dan Walsh 3.7.13-2Dan Walsh 3.7.13-1Dan Walsh 3.7.12-1Dan Walsh 3.7.11-1Dan Walsh 3.7.10-5Dan Walsh 3.7.10-4Dan Walsh 3.7.10-3Dan Walsh 3.7.10-2Dan Walsh 3.7.10-1Dan Walsh 3.7.9-4Dan Walsh 3.7.9-3Dan Walsh 3.7.9-2Dan Walsh 3.7.9-1Dan Walsh 3.7.8-11Dan Walsh 3.7.8-9Dan Walsh 3.7.8-8Dan Walsh 3.7.8-7Dan Walsh 3.7.8-6Dan Walsh 3.7.8-5Dan Walsh 3.7.8-4Dan Walsh 3.7.8-3Dan Walsh 3.7.8-2Dan Walsh 3.7.8-1Dan Walsh 3.7.7-3Dan Walsh 3.7.7-2Dan Walsh 3.7.7-1Dan Walsh 3.7.6-1Dan Walsh 3.7.5-8Dan Walsh 3.7.5-7Dan Walsh 3.7.5-6Dan Walsh 3.7.5-5Dan Walsh 3.7.5-4Dan Walsh 3.7.5-3Dan Walsh 3.7.5-2Dan Walsh 3.7.5-1Dan Walsh 3.7.4-4Dan Walsh 3.7.4-3Dan Walsh 3.7.4-2Dan Walsh 3.7.4-1Dan Walsh 3.7.3-1Dan Walsh 3.7.1-1Dan Walsh 3.6.33-2Dan Walsh 3.6.33-1Dan Walsh 3.6.32-17Dan Walsh 3.6.32-16Dan Walsh 3.6.32-15Dan Walsh 3.6.32-13Dan Walsh 3.6.32-12Dan Walsh 3.6.32-11Dan Walsh 3.6.32-10Dan Walsh 3.6.32-9Dan Walsh 3.6.32-8Dan Walsh 3.6.32-7Dan Walsh 3.6.32-6Dan Walsh 3.6.32-5Dan Walsh 3.6.32-4Dan Walsh 3.6.32-3Dan Walsh 3.6.32-2Dan Walsh 3.6.32-1Dan Walsh 3.6.31-5Dan Walsh 3.6.31-4Dan Walsh 3.6.31-3Dan Walsh 3.6.31-2Dan Walsh 3.6.30-6Dan Walsh 3.6.30-5Dan Walsh 3.6.30-4Dan Walsh 3.6.30-3Dan Walsh 3.6.30-2Dan Walsh 3.6.30-1Dan Walsh 3.6.29-2Dan Walsh 3.6.29-1Dan Walsh 3.6.28-9Dan Walsh 3.6.28-8Dan Walsh 3.6.28-7Dan Walsh 3.6.28-6Dan Walsh 3.6.28-5Dan Walsh 3.6.28-4Dan Walsh 3.6.28-3Dan Walsh 3.6.28-2Dan Walsh 3.6.28-1Dan Walsh 3.6.27-1Dan Walsh 3.6.26-11Dan Walsh 3.6.26-10Dan Walsh 3.6.26-9Bill Nottingham 3.6.26-8Dan Walsh 3.6.26-7Dan Walsh 3.6.26-6Dan Walsh 3.6.26-5Dan Walsh 3.6.26-4Dan Walsh 3.6.26-3Dan Walsh 3.6.26-2Dan Walsh 3.6.26-1Dan Walsh 3.6.25-1Dan Walsh 3.6.24-1Dan Walsh 3.6.23-2Dan Walsh 3.6.23-1Dan Walsh 3.6.22-3Dan Walsh 3.6.22-1Dan Walsh 3.6.21-4Dan Walsh 3.6.21-3Tom "spot" Callaway 3.6.21-2Dan Walsh 3.6.21-1Dan Walsh 3.6.20-2Dan Walsh 3.6.20-1Dan Walsh 3.6.19-5Dan Walsh 3.6.19-4Dan Walsh 3.6.19-3Dan Walsh 3.6.19-2Dan Walsh 3.6.19-1Dan Walsh 3.6.18-1Dan Walsh 3.6.17-1Dan Walsh 3.6.16-4Dan Walsh 3.6.16-3Dan Walsh 3.6.16-2Dan Walsh 3.6.16-1Dan Walsh 3.6.14-3Dan Walsh 3.6.14-2Dan Walsh 3.6.14-1Dan Walsh 3.6.13-3Dan Walsh 3.6.13-2Dan Walsh 3.6.13-1Dan Walsh 3.6.12-39Dan Walsh 3.6.12-38Dan Walsh 3.6.12-37Dan Walsh 3.6.12-36Dan Walsh 3.6.12-35Dan Walsh 3.6.12-34Dan Walsh 3.6.12-33Dan Walsh 3.6.12-31Dan Walsh 3.6.12-30Dan Walsh 3.6.12-29Dan Walsh 3.6.12-28Dan Walsh 3.6.12-27Dan Walsh 3.6.12-26Dan Walsh 3.6.12-25Dan Walsh 3.6.12-24Dan Walsh 3.6.12-23Dan Walsh 3.6.12-22Dan Walsh 3.6.12-21Dan Walsh 3.6.12-20Dan Walsh 3.6.12-19Dan Walsh 3.6.12-16Dan Walsh 3.6.12-15Dan Walsh 3.6.12-14Dan Walsh 3.6.12-13Dan Walsh 3.6.12-12Dan Walsh 3.6.12-11Dan Walsh 3.6.12-10Dan Walsh 3.6.12-9Dan Walsh 3.6.12-8Dan Walsh 3.6.12-7Dan Walsh 3.6.12-6Dan Walsh 3.6.12-5Dan Walsh 3.6.12-4Dan Walsh 3.6.12-3Dan Walsh 3.6.12-2Dan Walsh 3.6.12-1Dan Walsh 3.6.11-1Dan Walsh 3.6.10-9Dan Walsh 3.6.10-8Dan Walsh 3.6.10-7Dan Walsh 3.6.10-6Dan Walsh 3.6.10-5Dan Walsh 3.6.10-4Dan Walsh 3.6.10-3Dan Walsh 3.6.10-2Dan Walsh 3.6.10-1Dan Walsh 3.6.9-4Dan Walsh 3.6.9-3Dan Walsh 3.6.9-2Dan Walsh 3.6.9-1Dan Walsh 3.6.8-4Dan Walsh 3.6.8-3Dan Walsh 3.6.8-2Dan Walsh 3.6.8-1Dan Walsh 3.6.7-2Dan Walsh 3.6.7-1Dan Walsh 3.6.6-9Dan Walsh 3.6.6-8Fedora Release Engineering - 3.6.6-7Dan Walsh 3.6.6-6Dan Walsh 3.6.6-5Dan Walsh 3.6.6-4Dan Walsh 3.6.6-3Dan Walsh 3.6.6-2Dan Walsh 3.6.6-1Dan Walsh 3.6.5-3Dan Walsh 3.6.5-1Dan Walsh 3.6.4-6Dan Walsh 3.6.4-5Dan Walsh 3.6.4-4Dan Walsh 3.6.4-3Dan Walsh 3.6.4-2Dan Walsh 3.6.4-1Dan Walsh 3.6.3-13Dan Walsh 3.6.3-12Dan Walsh 3.6.3-11Dan Walsh 3.6.3-10Dan Walsh 3.6.3-9Dan Walsh 3.6.3-8Dan Walsh 3.6.3-7Dan Walsh 3.6.3-6Dan Walsh 3.6.3-3Dan Walsh 3.6.3-2Dan Walsh 3.6.3-1Dan Walsh 3.6.2-5Dan Walsh 3.6.2-4Dan Walsh 3.6.2-3Dan Walsh 3.6.2-2Dan Walsh 3.6.2-1Dan Walsh 3.6.1-15Dan Walsh 3.6.1-14Dan Walsh 3.6.1-13Dan Walsh 3.6.1-12Dan Walsh 3.6.1-11Dan Walsh 3.6.1-10Dan Walsh 3.6.1-9Dan Walsh 3.6.1-8Dan Walsh 3.6.1-7Dan Walsh 3.6.1-4Ignacio Vazquez-Abrams - 3.6.1-2Dan Walsh 3.5.13-19Dan Walsh 3.5.13-18Dan Walsh 3.5.13-17Dan Walsh 3.5.13-16Dan Walsh 3.5.13-15Dan Walsh 3.5.13-14Dan Walsh 3.5.13-13Dan Walsh 3.5.13-12Dan Walsh 3.5.13-11Dan Walsh 3.5.13-9Dan Walsh 3.5.13-8Dan Walsh 3.5.13-7Dan Walsh 3.5.13-6Dan Walsh 3.5.13-5Dan Walsh 3.5.13-4Dan Walsh 3.5.13-3Dan Walsh 3.5.13-2Dan Walsh 3.5.13-1Dan Walsh 3.5.12-3Dan Walsh 3.5.12-2Dan Walsh 3.5.12-1Dan Walsh 3.5.11-1Dan Walsh 3.5.10-3Dan Walsh 3.5.10-2Dan Walsh 3.5.10-1Dan Walsh 3.5.9-4Dan Walsh 3.5.9-3Dan Walsh 3.5.9-2Dan Walsh 3.5.9-1Dan Walsh 3.5.8-7Dan Walsh 3.5.8-6Dan Walsh 3.5.8-5Dan Walsh 3.5.8-4Dan Walsh 3.5.8-3Dan Walsh 3.5.8-1Dan Walsh 3.5.7-2Dan Walsh 3.5.7-1Dan Walsh 3.5.6-2Dan Walsh 3.5.6-1Dan Walsh 3.5.5-4Dan Walsh 3.5.5-3Dan Walsh 3.5.5-2Dan Walsh 3.5.4-2Dan Walsh 3.5.4-1Dan Walsh 3.5.3-1Dan Walsh 3.5.2-2Dan Walsh 3.5.1-5Dan Walsh 3.5.1-4Dan Walsh 3.5.1-3Dan Walsh 3.5.1-2Dan Walsh 3.5.1-1Dan Walsh 3.5.0-1Dan Walsh 3.4.2-14Dan Walsh 3.4.2-13Dan Walsh 3.4.2-12Dan Walsh 3.4.2-11Dan Walsh 3.4.2-10Dan Walsh 3.4.2-9Dan Walsh 3.4.2-8Dan Walsh 3.4.2-7Dan Walsh 3.4.2-6Dan Walsh 3.4.2-5Dan Walsh 3.4.2-4Dan Walsh 3.4.2-3Dan Walsh 3.4.2-2Dan Walsh 3.4.2-1Dan Walsh 3.4.1-5Dan Walsh 3.4.1-3Dan Walsh 3.4.1-2Dan Walsh 3.4.1-1Dan Walsh 3.3.1-48Dan Walsh 3.3.1-47Dan Walsh 3.3.1-46Dan Walsh 3.3.1-45Dan Walsh 3.3.1-44Dan Walsh 3.3.1-43Dan Walsh 3.3.1-42Dan Walsh 3.3.1-41Dan Walsh 3.3.1-39Dan Walsh 3.3.1-37Dan Walsh 3.3.1-36Dan Walsh 3.3.1-33Dan Walsh 3.3.1-32Dan Walsh 3.3.1-31Dan Walsh 3.3.1-30Dan Walsh 3.3.1-29Dan Walsh 3.3.1-28Dan Walsh 3.3.1-27Dan Walsh 3.3.1-26Dan Walsh 3.3.1-25Dan Walsh 3.3.1-24Dan Walsh 3.3.1-23Dan Walsh 3.3.1-22Dan Walsh 3.3.1-21Dan Walsh 3.3.1-20Dan Walsh 3.3.1-19Dan Walsh 3.3.1-18Dan Walsh 3.3.1-17Dan Walsh 3.3.1-16Dan Walsh 3.3.1-15Bill Nottingham 3.3.1-14Dan Walsh 3.3.1-13Dan Walsh 3.3.1-12Dan Walsh 3.3.1-11Dan Walsh 3.3.1-10Dan Walsh 3.3.1-9Dan Walsh 3.3.1-8Dan Walsh 3.3.1-6Dan Walsh 3.3.1-5Dan Walsh 3.3.1-4Dan Walsh 3.3.1-2Dan Walsh 3.3.1-1Dan Walsh 3.3.0-2Dan Walsh 3.3.0-1Dan Walsh 3.2.9-2Dan Walsh 3.2.9-1Dan Walsh 3.2.8-2Dan Walsh 3.2.8-1Dan Walsh 3.2.7-6Dan Walsh 3.2.7-5Dan Walsh 3.2.7-3Dan Walsh 3.2.7-2Dan Walsh 3.2.7-1Dan Walsh 3.2.6-7Dan Walsh 3.2.6-6Dan Walsh 3.2.6-5Dan Walsh 3.2.6-4Dan Walsh 3.2.6-3Dan Walsh 3.2.6-2Dan Walsh 3.2.6-1Dan Walsh 3.2.5-25Dan Walsh 3.2.5-24Dan Walsh 3.2.5-22Dan Walsh 3.2.5-21Dan Walsh 3.2.5-20Dan Walsh 3.2.5-19Dan Walsh 3.2.5-18Dan Walsh 3.2.5-17Dan Walsh 3.2.5-16Dan Walsh 3.2.5-15Dan Walsh 3.2.5-14Dan Walsh 3.2.5-13Dan Walsh 3.2.5-12Dan Walsh 3.2.5-11Dan Walsh 3.2.5-10Dan Walsh 3.2.5-9Dan Walsh 3.2.5-8Dan Walsh 3.2.5-7Dan Walsh 3.2.5-6Dan Walsh 3.2.5-5Dan Walsh 3.2.5-4Dan Walsh 3.2.5-3Dan Walsh 3.2.5-2Dan Walsh 3.2.5-1Dan Walsh 3.2.4-5Dan Walsh 3.2.4-4Dan Walsh 3.2.4-3Dan Walsh 3.2.4-1Dan Walsh 3.2.4-1Dan Walsh 3.2.3-2Dan Walsh 3.2.3-1Dan Walsh 3.2.2-1Dan Walsh 3.2.1-3Dan Walsh 3.2.1-1Dan Walsh 3.1.2-2Dan Walsh 3.1.2-1Dan Walsh 3.1.1-1Dan Walsh 3.1.0-1Dan Walsh 3.0.8-30Dan Walsh 3.0.8-28Dan Walsh 3.0.8-27Dan Walsh 3.0.8-26Dan Walsh 3.0.8-25Dan Walsh 3.0.8-24Dan Walsh 3.0.8-23Dan Walsh 3.0.8-22Dan Walsh 3.0.8-21Dan Walsh 3.0.8-20Dan Walsh 3.0.8-19Dan Walsh 3.0.8-18Dan Walsh 3.0.8-17Dan Walsh 3.0.8-16Dan Walsh 3.0.8-15Dan Walsh 3.0.8-14Dan Walsh 3.0.8-13Dan Walsh 3.0.8-12Dan Walsh 3.0.8-11Dan Walsh 3.0.8-10Dan Walsh 3.0.8-9Dan Walsh 3.0.8-8Dan Walsh 3.0.8-7Dan Walsh 3.0.8-5Dan Walsh 3.0.8-4Dan Walsh 3.0.8-3Dan Walsh 3.0.8-2Dan Walsh 3.0.8-1Dan Walsh 3.0.7-10Dan Walsh 3.0.7-9Dan Walsh 3.0.7-8Dan Walsh 3.0.7-7Dan Walsh 3.0.7-6Dan Walsh 3.0.7-5Dan Walsh 3.0.7-4Dan Walsh 3.0.7-3Dan Walsh 3.0.7-2Dan Walsh 3.0.7-1Dan Walsh 3.0.6-3Dan Walsh 3.0.6-2Dan Walsh 3.0.6-1Dan Walsh 3.0.5-11Dan Walsh 3.0.5-10Dan Walsh 3.0.5-9Dan Walsh 3.0.5-8Dan Walsh 3.0.5-7Dan Walsh 3.0.5-6Dan Walsh 3.0.5-5Dan Walsh 3.0.5-4Dan Walsh 3.0.5-3Dan Walsh 3.0.5-2Dan Walsh 3.0.5-1Dan Walsh 3.0.4-6Dan Walsh 3.0.4-5Dan Walsh 3.0.4-4Dan Walsh 3.0.4-3Dan Walsh 3.0.4-2Dan Walsh 3.0.4-1Dan Walsh 3.0.3-6Dan Walsh 3.0.3-5Dan Walsh 3.0.3-4Dan Walsh 3.0.3-3Dan Walsh 3.0.3-2Dan Walsh 3.0.3-1Dan Walsh 3.0.2-9Dan Walsh 3.0.2-8Dan Walsh 3.0.2-7Dan Walsh 3.0.2-5Dan Walsh 3.0.2-4Dan Walsh 3.0.2-3Dan Walsh 3.0.2-2Dan Walsh 3.0.1-5Dan Walsh 3.0.1-4Dan Walsh 3.0.1-3Dan Walsh 3.0.1-2Dan Walsh 3.0.1-1Dan Walsh 2.6.5-3Dan Walsh 2.6.5-2Dan Walsh 2.6.4-7Dan Walsh 2.6.4-6Dan Walsh 2.6.4-5Dan Walsh 2.6.4-2Dan Walsh 2.6.4-1Dan Walsh 2.6.3-1Dan Walsh 2.6.2-1Dan Walsh 2.6.1-4Dan Walsh 2.6.1-2Dan Walsh 2.6.1-1Dan Walsh 2.5.12-12Dan Walsh 2.5.12-11Dan Walsh 2.5.12-10Dan Walsh 2.5.12-8Dan Walsh 2.5.12-5Dan Walsh 2.5.12-4Dan Walsh 2.5.12-3Dan Walsh 2.5.12-2Dan Walsh 2.5.12-1Dan Walsh 2.5.11-8Dan Walsh 2.5.11-7Dan Walsh 2.5.11-6Dan Walsh 2.5.11-5Dan Walsh 2.5.11-4Dan Walsh 2.5.11-3Dan Walsh 2.5.11-2Dan Walsh 2.5.11-1Dan Walsh 2.5.10-2Dan Walsh 2.5.10-1Dan Walsh 2.5.9-6Dan Walsh 2.5.9-5Dan Walsh 2.5.9-4Dan Walsh 2.5.9-3Dan Walsh 2.5.9-2Dan Walsh 2.5.8-8Dan Walsh 2.5.8-7Dan Walsh 2.5.8-6Dan Walsh 2.5.8-5Dan Walsh 2.5.8-4Dan Walsh 2.5.8-3Dan Walsh 2.5.8-2Dan Walsh 2.5.8-1Dan Walsh 2.5.7-1Dan Walsh 2.5.6-1Dan Walsh 2.5.5-2Dan Walsh 2.5.5-1Dan Walsh 2.5.4-2Dan Walsh 2.5.4-1Dan Walsh 2.5.3-3Dan Walsh 2.5.3-2Dan Walsh 2.5.3-1Dan Walsh 2.5.2-6Dan Walsh 2.5.2-5Dan Walsh 2.5.2-4Dan Walsh 2.5.2-3Dan Walsh 2.5.2-2Dan Walsh 2.5.2-1Dan Walsh 2.5.1-5Dan Walsh 2.5.1-4Dan Walsh 2.5.1-2Dan Walsh 2.5.1-1Dan Walsh 2.4.6-20Dan Walsh 2.4.6-19Dan Walsh 2.4.6-18Dan Walsh 2.4.6-17Dan Walsh 2.4.6-16Dan Walsh 2.4.6-15Dan Walsh 2.4.6-14Dan Walsh 2.4.6-13Dan Walsh 2.4.6-12Dan Walsh 2.4.6-11Dan Walsh 2.4.6-10Dan Walsh 2.4.6-9Dan Walsh 2.4.6-8Dan Walsh 2.4.6-7Dan Walsh 2.4.6-6Dan Walsh 2.4.6-5Dan Walsh 2.4.6-4Dan Walsh 2.4.6-3Dan Walsh 2.4.6-1Dan Walsh 2.4.5-4Dan Walsh 2.4.5-3Dan Walsh 2.4.5-2Dan Walsh 2.4.5-1Dan Walsh 2.4.4-2Dan Walsh 2.4.4-2Dan Walsh 2.4.4-1Dan Walsh 2.4.3-13Dan Walsh 2.4.3-12Dan Walsh 2.4.3-11Dan Walsh 2.4.3-10Dan Walsh 2.4.3-9Dan Walsh 2.4.3-8Dan Walsh 2.4.3-7Dan Walsh 2.4.3-6Dan Walsh 2.4.3-5Dan Walsh 2.4.3-4Dan Walsh 2.4.3-3Dan Walsh 2.4.3-2Dan Walsh 2.4.3-1Dan Walsh 2.4.2-8Dan Walsh 2.4.2-7James Antill 2.4.2-6Dan Walsh 2.4.2-5Dan Walsh 2.4.2-4Dan Walsh 2.4.2-3Dan Walsh 2.4.2-2Dan Walsh 2.4.2-1Dan Walsh 2.4.1-5Dan Walsh 2.4.1-4Dan Walsh 2.4.1-3Dan Walsh 2.4.1-2Dan Walsh 2.4-4Dan Walsh 2.4-3Dan Walsh 2.4-2Dan Walsh 2.4-1Dan Walsh 2.3.19-4Dan Walsh 2.3.19-3Dan Walsh 2.3.19-2Dan Walsh 2.3.19-1James Antill 2.3.18-10James Antill 2.3.18-9Dan Walsh 2.3.18-8Dan Walsh 2.3.18-7Dan Walsh 2.3.18-6Dan Walsh 2.3.18-5Dan Walsh 2.3.18-4Dan Walsh 2.3.18-3Dan Walsh 2.3.18-2Dan Walsh 2.3.18-1Dan Walsh 2.3.17-2Dan Walsh 2.3.17-1Dan Walsh 2.3.16-9Dan Walsh 2.3.16-8Dan Walsh 2.3.16-7Dan Walsh 2.3.16-6Dan Walsh 2.3.16-5Dan Walsh 2.3.16-4Dan Walsh 2.3.16-2Dan Walsh 2.3.16-1Dan Walsh 2.3.15-2Dan Walsh 2.3.15-1Dan Walsh 2.3.14-8Dan Walsh 2.3.14-7Dan Walsh 2.3.14-6Dan Walsh 2.3.14-4Dan Walsh 2.3.14-3Dan Walsh 2.3.14-2Dan Walsh 2.3.14-1Dan Walsh 2.3.13-6Dan Walsh 2.3.13-5Dan Walsh 2.3.13-4Dan Walsh 2.3.13-3Dan Walsh 2.3.13-2Dan Walsh 2.3.13-1Dan Walsh 2.3.12-2Dan Walsh 2.3.12-1Dan Walsh 2.3.11-1Dan Walsh 2.3.10-7Dan Walsh 2.3.10-6Dan Walsh 2.3.10-3Dan Walsh 2.3.10-1Dan Walsh 2.3.9-6Dan Walsh 2.3.9-5Dan Walsh 2.3.9-4Dan Walsh 2.3.9-3Dan Walsh 2.3.9-2Dan Walsh 2.3.9-1Dan Walsh 2.3.8-2Dan Walsh 2.3.7-1Dan Walsh 2.3.6-4Dan Walsh 2.3.6-3Dan Walsh 2.3.6-2Dan Walsh 2.3.6-1Dan Walsh 2.3.5-1Dan Walsh 2.3.4-1Dan Walsh 2.3.3-20Dan Walsh 2.3.3-19Dan Walsh 2.3.3-18Dan Walsh 2.3.3-17Dan Walsh 2.3.3-16Dan Walsh 2.3.3-15Dan Walsh 2.3.3-14Dan Walsh 2.3.3-13Dan Walsh 2.3.3-12Dan Walsh 2.3.3-11Dan Walsh 2.3.3-10Dan Walsh 2.3.3-9Dan Walsh 2.3.3-8Dan Walsh 2.3.3-7Dan Walsh 2.3.3-6Dan Walsh 2.3.3-5Dan Walsh 2.3.3-4Dan Walsh 2.3.3-3Dan Walsh 2.3.3-2Dan Walsh 2.3.3-1Dan Walsh 2.3.2-4Dan Walsh 2.3.2-3Dan Walsh 2.3.2-2Dan Walsh 2.3.2-1Dan Walsh 2.3.1-1Dan Walsh 2.2.49-1Dan Walsh 2.2.48-1Dan Walsh 2.2.47-5Dan Walsh 2.2.47-4Dan Walsh 2.2.47-3Dan Walsh 2.2.47-1Dan Walsh 2.2.46-2Dan Walsh 2.2.46-1Dan Walsh 2.2.45-3Dan Walsh 2.2.45-2Dan Walsh 2.2.45-1Dan Walsh 2.2.44-1Dan Walsh 2.2.43-4Dan Walsh 2.2.43-3Dan Walsh 2.2.43-2Dan Walsh 2.2.43-1Dan Walsh 2.2.42-4Dan Walsh 2.2.42-3Dan Walsh 2.2.42-2Dan Walsh 2.2.42-1Dan Walsh 2.2.41-1Dan Walsh 2.2.40-2Dan Walsh 2.2.40-1Dan Walsh 2.2.39-2Dan Walsh 2.2.39-1Dan Walsh 2.2.38-6Dan Walsh 2.2.38-5Dan Walsh 2.2.38-4Dan Walsh 2.2.38-3Dan Walsh 2.2.38-2Dan Walsh 2.2.38-1Dan Walsh 2.2.37-1Dan Walsh 2.2.36-2Dan Walsh 2.2.36-1James Antill 2.2.35-2Dan Walsh 2.2.35-1Dan Walsh 2.2.34-3Dan Walsh 2.2.34-2Dan Walsh 2.2.34-1Dan Walsh 2.2.33-1Dan Walsh 2.2.32-2Dan Walsh 2.2.32-1Dan Walsh 2.2.31-1Dan Walsh 2.2.30-2Dan Walsh 2.2.30-1Dan Walsh 2.2.29-6Russell Coker 2.2.29-5Dan Walsh 2.2.29-4Dan Walsh 2.2.29-3Dan Walsh 2.2.29-2Dan Walsh 2.2.29-1Dan Walsh 2.2.28-3Dan Walsh 2.2.28-2Dan Walsh 2.2.28-1Dan Walsh 2.2.27-1Dan Walsh 2.2.25-3Dan Walsh 2.2.25-2Dan Walsh 2.2.24-1Dan Walsh 2.2.23-19Dan Walsh 2.2.23-18Dan Walsh 2.2.23-17Karsten Hopp 2.2.23-16Dan Walsh 2.2.23-15Dan Walsh 2.2.23-14Dan Walsh 2.2.23-13Dan Walsh 2.2.23-12Jeremy Katz - 2.2.23-11Jeremy Katz - 2.2.23-10Dan Walsh 2.2.23-9Dan Walsh 2.2.23-8Dan Walsh 2.2.23-7Dan Walsh 2.2.23-5Dan Walsh 2.2.23-4Dan Walsh 2.2.23-3Dan Walsh 2.2.23-2Dan Walsh 2.2.23-1Dan Walsh 2.2.22-2Dan Walsh 2.2.22-1Dan Walsh 2.2.21-9Dan Walsh 2.2.21-8Dan Walsh 2.2.21-7Dan Walsh 2.2.21-6Dan Walsh 2.2.21-5Dan Walsh 2.2.21-4Dan Walsh 2.2.21-3Dan Walsh 2.2.21-2Dan Walsh 2.2.21-1Dan Walsh 2.2.20-1Dan Walsh 2.2.19-2Dan Walsh 2.2.19-1Dan Walsh 2.2.18-2Dan Walsh 2.2.18-1Dan Walsh 2.2.17-2Dan Walsh 2.2.16-1Dan Walsh 2.2.15-4Dan Walsh 2.2.15-3Dan Walsh 2.2.15-1Dan Walsh 2.2.14-2Dan Walsh 2.2.14-1Dan Walsh 2.2.13-1Dan Walsh 2.2.12-1Dan Walsh 2.2.11-2Dan Walsh 2.2.11-1Dan Walsh 2.2.10-1Dan Walsh 2.2.9-2Dan Walsh 2.2.9-1Dan Walsh 2.2.8-2Dan Walsh 2.2.7-1Dan Walsh 2.2.6-3Dan Walsh 2.2.6-2Dan Walsh 2.2.6-1Dan Walsh 2.2.5-1Dan Walsh 2.2.4-1Dan Walsh 2.2.3-1Dan Walsh 2.2.2-1Dan Walsh 2.2.1-1Dan Walsh 2.1.13-1Dan Walsh 2.1.12-3Dan Walsh 2.1.11-1Dan Walsh 2.1.10-1Jeremy Katz - 2.1.9-2Dan Walsh 2.1.9-1Dan Walsh 2.1.8-3Dan Walsh 2.1.8-2Dan Walsh 2.1.8-1Dan Walsh 2.1.7-4Dan Walsh 2.1.7-3Dan Walsh 2.1.7-2Dan Walsh 2.1.7-1Dan Walsh 2.1.6-24Dan Walsh 2.1.6-23Dan Walsh 2.1.6-22Dan Walsh 2.1.6-21Dan Walsh 2.1.6-20Dan Walsh 2.1.6-18Dan Walsh 2.1.6-17Dan Walsh 2.1.6-16Dan Walsh 2.1.6-15Dan Walsh 2.1.6-14Dan Walsh 2.1.6-13Dan Walsh 2.1.6-11Dan Walsh 2.1.6-10Dan Walsh 2.1.6-9Dan Walsh 2.1.6-8Dan Walsh 2.1.6-5Dan Walsh 2.1.6-4Dan Walsh 2.1.6-3Dan Walsh 2.1.6-2Dan Walsh 2.1.6-1Dan Walsh 2.1.4-2Dan Walsh 2.1.4-1Dan Walsh 2.1.3-1Jeremy Katz - 2.1.2-3Dan Walsh 2.1.2-2Dan Walsh 2.1.2-1Dan Walsh 2.1.1-3Dan Walsh 2.1.1-2Dan Walsh 2.1.1-1Dan Walsh 2.1.0-3Dan Walsh 2.1.0-2.Dan Walsh 2.1.0-1.Dan Walsh 2.0.11-2.Dan Walsh 2.0.11-1.Dan Walsh 2.0.9-1.Dan Walsh 2.0.8-1.Dan Walsh 2.0.7-3Dan Walsh 2.0.7-2Dan Walsh 2.0.6-2Dan Walsh 2.0.5-4Dan Walsh 2.0.5-1Dan Walsh 2.0.4-1Dan Walsh 2.0.2-2Dan Walsh 2.0.2-1Dan Walsh 2.0.1-2Dan Walsh 2.0.1-1- Allow swift to execute bin_t - Allow swift to bind http_cache - Label /var/log/horizon as an apache log- Allow neutron to bind xserver port - Allow neutron to execute kmod in insmod_t - Allow neutron to execute udevadm in udev_t - Allow keepalived to execute bin_t/shell_exec_t - Allow neutron to create sock files - Label swift-proxy-server as swift_exec_t- Allow rsync to create swift_server.lock with swift.log labeling - Add labeling for swift lock files - Make neutron_t as unconfined domain- Add more fixes for OpenStack - Add fixes for geard - Make openwsman as unconfined_domain in RHEL7.0- Back port openstack fixes - svirt sandbox domains to read gear content in /run - Allow gear_t to manage openshift files- More rules for gears and openshift Resolves:#1092405- Bump release to rebuild as z-stream Resolves:#1092405- Add fixes for gear to just execute ifconfig - More fixes for mongod_t Resolves:#1092405- Bump release Resolves:#1092405- Allow mongod to create sock files Resolves:#1092405 - Add additional fixes related to docker and upgrade issues- Change hsperfdata_root to have as user_tmp_t Resolves:#1076523- Fix Multiple same specifications for /var/named/chroot/dev/zero - Add labels for /var/named/chroot_sdb/dev devices - Add support for strongimcv - Use kerberos_keytab_domains in auth_use_nsswitch - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to - Allow net_raw cap for neutron_t and send sigkill to dnsmasq - Fix ntp_filetrans_named_content for sntp-kod file - Add httpd_dbus_sssd boolean - Dontaudit exec insmod in boinc policy - Rename kerberos_keytab_domain to kerberos_keytab_domains - Add kerberos_keytab_domain() - Fix kerberos_keytab_template() - Make all domains which use kerberos as kerberos_keytab_domain Resolves:#1083670 - Allow kill capability to winbind_t- varnishd wants chown capability - update ntp_filetrans_named_content() interface - Add additional fixes for neutron_t. #1083335 - Dontaudit getattr on proc_kcore_t - Allow pki_tomcat_t to read ipa lib files - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign - Allow init_t run /sbin/augenrules - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces - Allow unpriv SELinux user to use sandbox - Add default label for /tmp/hsperfdata_root- Add file subs also for /var/home- Allow xauth_t to read user_home_dir_t lnk_file - Add labeling for lightdm-data - Allow certmonger to manage ipa lib files - Add support for /var/lib/ipa - Allow pegasus to getattr virt_content - Added some new rules to pcp policy - Allow chrome_sandbox to execute config_home_t - Add support for ABRT FAF- Allow kdm to send signull to remote_login_t process - Add gear policy - Turn on gear_port_t - Allow cgit to read gitosis lib files by default - Allow vdagent to read xdm state - Allow NM and fcoeadm to talk together over unix_dgram_socket- Back port fixes for pegasus_openlmi_admin_t from rawhide Resolves:#1080973 - Add labels for ostree - Add SELinux awareness for NM - Label /usr/sbin/pwhistory_helper as updpwd_exec_t- add gnome_append_home_config() - Allow thumb to append GNOME config home files - Allow rasdaemon to rw /dev/cpu//msr - fix /var/log/pki file spec - make bacula_t as auth_nsswitch domain - Identify pki_tomcat_cert_t as a cert_type - Define speech-dispater_exec_t as an application executable - Add a new file context for /var/named/chroot/run directory - update storage_filetrans_all_named_dev for sg* devices - Allow auditctl_t to getattr on all removeable devices - Allow nsswitch_domains to stream connect to nmbd - Allow unprivusers to connect to memcached - label /var/lib/dirsrv/scripts-INSTANCE as bin_t- Allow also unpriv user to run vmtools - Allow secadm to read /dev/urandom and meminfo Resolves:#1079250 - Add booleans to allow docker processes to use nfs and samba - Add mdadm_tmpfs support - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t - Allow vmware-user-sui to use user ttys - Allow talk 2 users logged via console too - Allow ftp services to manage xferlog_t - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies - allow anaconda to dbus chat with systemd-localed- allow anaconda to dbus chat with systemd-localed - Add fixes for haproxy based on bperkins@redhat.com - Allow cmirrord to make dmsetup working - Allow NM to execute arping - Allow users to send messages through talk - Add userdom_tmp_role for secadm_t- Add additional fixes for rtas_errd - Fix transitions for tmp/tmpfs in rtas.te - Allow rtas_errd to readl all sysctls- Add support for /var/spool/rhsm/debug - Make virt_sandbox_use_audit as True by default - Allow svirt_sandbox_domains to ptrace themselves- Allow docker containers to manage /var/lib/docker content- Allow docker to read tmpfs_t symlinks - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets- Allow collectd to talk to libvirt - Allow chrome_sandbox to use leaked unix_stream_sockets - Dontaudit leaks of sockets into chrome_sandbox_t - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t - Run vmtools as unconfined domains - Allow snort to manage its log files - Allow systemd_cronjob_t to be entered via bin_t - Allow procman to list doveconf_etc_t - allow keyring daemon to create content in tmpfs directories - Add proper labelling for icedtea-web - vpnc is creating content in networkmanager var run directory - Label sddm as xdm_exec_t to make KDE working again - Allow postgresql to read network state - Allow java running as pki_tomcat to read network sysctls - Fix cgroup.te to allow cgred to read cgconfig_etc_t - Allow beam.smp to use ephemeral ports - Allow winbind to use the nis to authenticate passwords- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least. - Allow net_admin cap for fence_virtd running as fenced_t - Make abrt-java-connector working - Make cimtest script 03_defineVS.py of ComputerSystem group working - Fix git_system_enable_homedirs boolean - Allow munin mail plugins to read network systcl- Allow vmtools_helper_t to execute bin_t - Add support for /usr/share/joomla - /var/lib/containers should be labeled as openshift content for now - Allow docker domains to talk to the login programs, to allow a process to login into the container - Allow install_t do dbus chat with NM - Fix interface names in anaconda.if - Add install_t for anaconda. A new type is a part of anaconda policy - sshd to read network sysctls- Allow zabbix to send system log msgs - Allow init_t to stream connect to ipsec Resolves:#1060775- Add docker_connect_any boolean- Allow unpriv SELinux users to dbus chat with firewalld - Add lvm_write_metadata() - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type - Allow pegasus_openlmi_storage_t to write lvm metadata - Add hide_broken_symptoms for kdumpgui because of systemd bug - Make kdumpgui_t as unconfined domain Resolves:#1044299 - Allow docker to connect to tcp/5000- Allow numad to write scan_sleep_millisecs - Turn on entropyd_use_audio boolean by default - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf. - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo - Fix label on irclogs in the homedir - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix - Allow postgresql to use ldap - Add missing syslog-conn port - Add support for /dev/vmcp and /dev/sclp Resolves:#1069310- Modify xdm_write_home to allow create files/links in /root with xdm_home_ - Allow virt domains to read network state Resolves:#1072019- Added pcp rules - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6 - clean up ctdb.te - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow certmonger to list home dirs- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask - Add sysnet_filetrans_named_content_ifconfig() interface - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow kerberos keytab domains to manage sssd/userdomain keys" - Allow to run ip cmd in neutron_t domain- Allow block_suspend cap2 for systemd-logind and rw dri device - Add labeling for /usr/libexec/nm-libreswan-service - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working - Add xserver_rw_xdm_keys() - Allow rpm_script_t to dbus chat also with systemd-located - Fix ipa_stream_connect_otpd() - update lpd_manage_spool() interface - Allow krb5kdc to stream connect to ipa-otpd - Add ipa_stream_connect_otpd() interface - Allow vpnc to unlink NM pids - Add networkmanager_delete_pid_files() - Allow munin plugins to access unconfined plugins - update abrt_filetrans_named_content to cover /var/spool/debug - Label /var/spool/debug as abrt_var_cache_t - Allow rhsmcertd to connect to squid port - Make docker_transition_unconfined as optional boolean - Allow certmonger to list home dirs- Make snapperd as unconfined domain and add additional fixes for it - Remove nsplugin.pp module on upgrade- Add snapperd_home_t for HOME_DIR/.snapshots directory - Make sosreport as unconfined domain - Allow sosreport to execute grub2-probe - Allow NM to manage hostname config file - Allow systemd_timedated_t to dbus chat with rpm_script_t - Allow lsmd plugins to connect to http/ssh/http_cache ports by default - Add lsmd_plugin_connect_any boolean - Allow mozilla_plugin to attempt to set capabilities - Allow lsdm_plugins to use tcp_socket - Dontaudit mozilla plugin from getattr on /proc or /sys - Dontaudit use of the keyring by the services in a sandbox - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t - Allow rabbitmq_beam to connect to jabber_interserver_port - Allow logwatch_mail_t to transition to qmail_inject and queueu - Added new rules to pcp policy - Allow vmtools_helper_t to change role to system_r - Allow NM to dbus chat with vmtools - Fix couchdb_manage_files() to allow manage couchdb conf files - Add support for /var/run/redis.sock - dontaudit gpg trying to use audit - Allow consolekit to create log directories and files - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow pkcsslotd to read users state - Add ioctl to init_dontaudit_rw_stream_socket - Add systemd_hostnamed_manage_config() interface - Remove transition for temp dirs created by init_t - gdm-simple-slave uses use setsockopt - sddm-greater is a xdm type program- Add lvm_read_metadata() - Allow auditadm to search /var/log/audit dir - Add lvm_read_metadata() interface - Allow confined users to run vmtools helpers - Fix userdom_common_user_template() - Generic systemd unit scripts do write check on / - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files - Add additional fixes needed for init_t and setup script running in generic unit files - Allow general users to create packet_sockets - added connlcli port - Add init_manage_transient_unit() interface - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t - Fix userdomain.te to require passwd class - devicekit_power sends out a signal to all processes on the message bus when power is going down - Dontaudit rendom domains listing /proc and hittping system_map_t - Dontauit leaks of var_t into ifconfig_t - Allow domains that transition to ssh_t to manipulate its keyring - Define oracleasm_t as a device node - Change to handle /root as a symbolic link for os-tree - Allow sysadm_t to create packet_socket, also move some rules to attributes - Add label for openvswitch port - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label. - Allow postfix_local to read .forward in pcp lib files - Allow pegasus_openlmi_storage_t to read lvm metadata - Add additional fixes for pegasus_openlmi_storage_t - Allow bumblebee to manage debugfs - Make bumblebee as unconfined domain - Allow snmp to read etc_aliases_t - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem - Allow pegasus_openlmi_storage_t to read /proc/1/environ - Dontaudit read gconf files for cupsd_config_t - make vmtools as unconfined domain - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig. - Allow collectd_t to use a mysql database - Allow ipa-otpd to perform DNS name resolution - Added new policy for keepalived - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd - Add additional fixes new pscs-lite+polkit support - Add labeling for /run/krb5kdc - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20 - Allow pcscd to read users proc info - Dontaudit smbd_t sending out random signuls - Add boolean to allow openshift domains to use nfs - Allow w3c_validator to create content in /tmp - zabbix_agent uses nsswitch - Allow procmail and dovecot to work together to deliver mail - Allow spamd to execute files in homedir if boolean turned on - Allow openvswitch to listen on port 6634 - Add net_admin capability in collectd policy - Fixed snapperd policy - Fixed bugsfor pcp policy - Allow dbus_system_domains to be started by init - Fixed some interfaces - Add kerberos_keytab_domain attribute - Fix snapperd_conf_t def- Addopt corenet rules for unbound-anchor to rpm_script_t - Allow runuser to send send audit messages. - Allow postfix-local to search .forward in munin lib dirs - Allow udisks to connect to D-Bus - Allow spamd to connect to spamd port - Fix syntax error in snapper.te - Dontaudit osad to search gconf home files - Allow rhsmcertd to manage /etc/sysconf/rhn director - Fix pcp labeling to accept /usr/bin for all daemon binaries - Fix mcelog_read_log() interface - Allow iscsid to manage iscsi lib files - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it. - Make tuned_t as unconfined domain for RHEL7.0 - Allow ABRT to read puppet certs - Add sys_time capability for virt-ga - Allow gemu-ga to domtrans to hwclock_t - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages - Fix some AVCs in pcp policy - Add to bacula capability setgid and setuid and allow to bind to bacula ports - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t - Add access rhnsd and osad to /etc/sysconfig/rhn - drbdadm executes drbdmeta - Fixes needed for docker - Allow epmd to manage /var/log/rabbitmq/startup_err file - Allow beam.smp connect to amqp port - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t - Allow systemd_tmpfiles_t to manage all non security files on the system - Added labels for bacula ports - Fix label on /dev/vfio/vfio - Add kernel_mounton_messages() interface - init wants to manage lock files for iscsi- Added osad policy - Allow postfix to deliver to procmail - Allow bumblebee to seng kill signal to xserver - Allow vmtools to execute /usr/bin/lsb_release - Allow docker to write system net ctrls - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix pcp.te - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl- Turn on bacula, rhnsd policy - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl - Fixes for *_admin interfaces - Add pegasus_openlmi_storage_var_run_t type def - Add support for /var/run/openlmi-storage - Allow tuned to create syslog.conf with correct labeling - Add httpd_dontaudit_search_dirs boolean - Add support for winbind.service - ALlow also fail2ban-client to read apache logs - Allow vmtools to getattr on all fs - Add support for dey_sapi port - Add logging_filetrans_named_conf() - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring- Update snapper policy - Allow domains to append rkhunter lib files - Allow snapperd to getattr on all fs - Allow xdm to create /var/gdm with correct labeling - Add label for snapper.log - Allow fail2ban-client to read apache log files - Allow thumb_t to execute dbus-daemon in thumb_t- Allow gdm to create /var/gdm with correct labeling - Allow domains to append rkhunterl lib files. #1057982 - Allow systemd_tmpfiles_t net_admin to communicate with journald - Add interface to getattr on an isid_type for any type of file - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory - Allow initrc_t domtrans to authconfig if unconfined is enabled - Allow docker and mount on devpts chr_file - Allow docker to transition to unconfined_t if boolean set - init calling needs to be optional in domain.te - Allow uncofined domain types to handle transient unit files - Fix labeling for vfio devices - Allow net_admin capability and send system log msgs - Allow lldpad send dgram to NM - Add networkmanager_dgram_send() - rkhunter_var_lib_t is correct type - Back port pcp policy from rawhide - Allow openlmi-storage to read removable devices - Allow system cron jobs to manage rkhunter lib files - Add rkhunter_manage_lib_files() - Fix ftpd_use_fusefs boolean to allow manage also symlinks - Allow smbcontrob block_suspend cap2 - Allow slpd to read network and system state info - Allow NM domtrans to iscsid_t if iscsiadm is executed - Allow slapd to send a signal itself - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA. - Fix plymouthd_create_log() interface - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container - Allow postfix and cyrus-imapd to work out of box - Allow fcoemon to talk with unpriv user domain using unix_stream_socket - Dontaudit domains that are calling into journald to net_admin - Add rules to allow vmtools to do what it does - snapperd is D-Bus service - Allow OpenLMI PowerManagement to call 'systemctl --force reboot' - Add haproxy_connect_any boolean - Allow haproxy also to use http cache port by default Resolves:#1058248- Allow apache to write to the owncloud data directory in /var/www/html... - Allow consolekit to create log dir - Add support for icinga CGI scripts - Add support for icinga - Allow kdumpctl_t to create kdump lock file Resolves:#1055634 - Allow kdump to create lnk lock file - Allow nscd_t block_suspen capability - Allow unconfined domain types to manage own transient unit file - Allow systemd domains to handle transient init unit files - Add interfaces to handle transient- Add cron unconfined role support for uncofined SELinux user - Call corenet_udp_bind_all_ports() in milter.te - Allow fence_virtd to connect to zented port - Fix header for mirrormanager_admin() - Allow dkim-milter to bind udp ports - Allow milter domains to send signull itself - Allow block_suspend for yum running as mock_t - Allow beam.smp to manage couchdb files - Add couchdb_manage_files() - Add labeling for /var/log/php_errors.log - Allow bumblebee to stream connect to xserver - Allow bumblebee to send a signal to xserver - gnome-thumbnail to stream connect to bumblebee - Allow xkbcomp running as bumblebee_t to execute bin_t - Allow logrotate to read squid.conf - Additional rules to get docker and lxc to play well with SELinux - Allow bumbleed to connect to xserver port - Allow pegasus_openlmi_storage_t to read hwdata- Allow init_t to work on transitient and snapshot unit files - Add logging_manage_syslog_config() - Update sysnet_dns_name_resolve() to allow connect to dnssec por - Allow pegasus_openlmi_storage_t to read hwdata Resolves:#1031721 - Fix rhcs_rw_cluster_tmpfs() - Allow fenced_t to bind on zented udp port - Added policy for vmtools - Fix mirrormanager_read_lib_files() - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files - Allow ctdb to create sock files in /var/run/ctdb - Add sblim_filetrans_named_content() interface - Allow rpm scritplets to create /run/gather with correct labeling - Allow gnome keyring domains to create gnome config dirs - Dontaudit read/write to init stream socket for lsmd_plugin_t - Allow automount to read nfs link files - Allow lsm plugins to read/write lsmd stream socket - Allow certmonger to connect ldap port to make IPA CA certificate renewal working. - Add also labeling for /var/run/ctdb - Add missing labeling for /var/lib/ctdb - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446 - Dontaudit hypervkvp to search homedirs - Dontaudit hypervkvp to search admin homedirs - Allow hypervkvp to execute bin_t and ifconfig in the caller domain - Dontaudit xguest_t to read ABRT conf files - Add abrt_dontaudit_read_config() - Allow namespace-init to getattr on fs - Add thumb_role() also for xguest - Add filename transitions to create .spamassassin with correct labeling - Allow apache domain to read mirrormanager pid files - Allow domains to read/write shm and sem owned by mozilla_plugin_t - Allow alsactl to send a generic signal to kernel_t- Add back rpm_run() for unconfined user- Add missing files_create_var_lib_dirs() - Fix typo in ipsec.te - Allow passwd to create directory in /var/lib - Add filename trans also for event21 - Allow iptables command to read /dev/rand - Add sigkill capabilityfor ipsec_t - Add filename transitions for bcache devices - Add additional rules to create /var/log/cron by syslogd_t with correct labeling - Add give everyone full access to all key rings - Add default lvm_var_run_t label for /var/run/multipathd - Fix log labeling to have correct default label for them after logrotate - Labeled ~/.nv/GLCache as being gstreamer output - Allow nagios_system_plugin to read mrtg lib files - Add mrtg_read_lib_files() - Call rhcs_rw_cluster_tmpfs for dlm_controld - Make authconfing as named_filetrans domain - Allow virsh to connect to user process using stream socket - Allow rtas_errd to read rand/urand devices and add chown capability - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp Resolves:#1051497 - Add also chown cap for abrt_upload_watch_t. It already has dac_override - Allow sosreport to manage rhsmcertd pid files - Add rhsmcertd_manage_pid_files() - Allow also setgid cap for rpc.gssd - Dontaudit access check for abrt on cert_t - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind- Fix semanage import handling in spec file- Add default lvm_var_run_t label for /var/run/multipathd Resolves:#1051430 - Fix log labeling to have correct default label for them after logrotate - Add files_write_root_dirs - Add new openflow port label for 6653/tcp and 6633/tcp - Add xserver_manage_xkb_libs() - Label tcp/8891 as milter por - Allow gnome_manage_generic_cache_files also create cache_home_t files - Fix aide.log labeling - Fix log labeling to have correct default label for them after logrotate - Allow mysqld-safe write access on /root to make mysqld working - Allow sosreport domtrans to prelikn - Allow OpenvSwitch to connec to openflow ports - Allow NM send dgram to lldpad - Allow hyperv domains to execute shell - Allow lsmd plugins stream connect to lsmd/init - Allow sblim domains to create /run/gather with correct labeling - Allow httpd to read ldap certs - Allow cupsd to send dbus msgs to process with different MLS level - Allow bumblebee to stream connect to apmd - Allow bumblebee to run xkbcomp - Additional allow rules to get libvirt-lxc containers working with docker - Additional allow rules to get libvirt-lxc containers working with docker - Allow docker to getattr on itself - Additional rules needed for sandbox apps - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled - httpd should be able to send signal/signull to httpd_suexec_t - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.- Add neutron fixes- Allow sshd to write to all process levels in order to change passwd when running at a level - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range - Allow apcuspd_t to status and start the power unit file - Allow udev to manage kdump unit file - Added new interface modutils_dontaudit_exec_insmod - Allow cobbler to search dhcp_etc_t directory - systemd_systemctl needs sys_admin capability - Allow sytemd_tmpfiles_t to delete all directories - passwd to create gnome-keyring passwd socket - Add missing zabbix_var_lib_t type - Fix filename trans for zabbixsrv in zabbix.te - Allow fprintd_t to send syslog messages - Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port - Allow mozilla plugin to chat with policykit, needed for spice - Allow gssprozy to change user and gid, as well as read user keyrings - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly - Allow polipo to connect to http_cache_ports - Allow cron jobs to manage apache var lib content - Allow yppassword to manage the passwd_file_t - Allow showall_t to send itself signals - Allow cobbler to restart dhcpc, dnsmasq and bind services - Allow certmonger to manage home cert files - Add userdom filename trans for user mail domains - Allow apcuspd_t to status and start the power unit file - Allow cgroupdrulesengd to create content in cgoups directories - Allow smbd_t to signull cluster - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t - Add label for /var/spool/cron.aquota.user - Allow sandbox_x domains to use work with the mozilla plugin semaphore - Added new policy for speech-dispatcher - Added dontaudit rule for insmod_exec_t in rasdaemon policy - Updated rasdaemon policy - Allow system_mail_t to transition to postfix_postdrop_t - Clean up mirrormanager policy - Allow virt_domains to read cert files, needs backport to RHEL7 - Allow sssd to read systemd_login_var_run_t - Allow irc_t to execute shell and bin-t files: - Add new access for mythtv - Allow rsync_t to manage all non auth files - allow modemmanger to read /dev/urand - Allow sandbox apps to attempt to set and get capabilties- Add labeling for /var/lib/servicelog/servicelog.db-journal - Add support for freeipmi port - Add sysadm_u_default_contexts - Make new type to texlive files in homedir - Allow subscription-manager running as sosreport_t to manage rhsmcertd - Additional fixes for docker.te - Remove ability to do mount/sys_admin by default in virt_sandbox domains - New rules required to run docker images within libivrt - Add label for ~/.cvsignore - Change mirrormanager to be run by cron - Add mirrormanager policy - Fixed bumblebee_admin() and mip6d_admin() - Add log support for sensord - Fix typo in docker.te - Allow amanda to do backups over UDP - Allow bumblebee to read /etc/group and clean up bumblebee.te - type transitions with a filename not allowed inside conditionals - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7 - Make new type to texlive files in homedir- Allow freeipmi_ipmidetectd_t to use freeipmi port - Update freeipmi_domain_template() - Allow journalctl running as ABRT to read /run/log/journal - Allow NM to read dispatcher.d directory - Update freeipmi policy - Type transitions with a filename not allowed inside conditionals - Allow tor to bind to hplip port - Make new type to texlive files in homedir - Allow zabbix_agent to transition to dmidecode - Add rules for docker - Allow sosreport to send signull to unconfined_t - Add virt_noatsecure and virt_rlimitinh interfaces - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port - Add sysadm_u_default_contexts - Add logging_read_syslog_pid() - Fix userdom_manage_home_texlive() interface - Make new type to texlive files in homedir - Add filename transitions for /run and /lock links - Allow virtd to inherit rlimit information Resolves:#975358- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t Resolves:#1039879 - Add labeling for /usr/lib/systemd/system/mariadb.service - Allow hyperv_domain to read sysfs - Fix ldap_read_certs() interface to allow acess also link files - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt - Allow tuned to run modprobe - Allow portreserve to search /var/lib/sss dir - Add SELinux support for the teamd package contains team network device control daemon. - Dontaudit access check on /proc for bumblebee - Bumblebee wants to load nvidia modules - Fix rpm_named_filetrans_log_files and wine.te - Add conman policy for rawhide - DRM master and input event devices are used by the TakeDevice API - Clean up bumblebee policy - Update pegasus_openlmi_storage_t policy - Add freeipmi_stream_connect() interface - Allow logwatch read madm.conf to support RAID setup - Add raid_read_conf_files() interface - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling - add rpm_named_filetrans_log_files() interface - Allow dkim-milter to create files/dirs in /tmp - update freeipmi policy - Add policy for freeipmi services - Added rdisc_admin and rdisc_systemctl interfaces - opensm policy clean up - openwsman policy clean up - ninfod policy clean up - Added new policy for ninfod - Added new policy for openwsman - Added rdisc_admin and rdisc_systemctl interfaces - Fix kernel_dontaudit_access_check_proc() - Add support for /dev/uhid - Allow sulogin to get the attributes of initctl and sys_admin cap - Add kernel_dontaudit_access_check_proc() - Fix dev_rw_ipmi_dev() - Fix new interface in devices.if - DRM master and input event devices are used by the TakeDevice API - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev() - Added support for default conman port - Add interfaces for ipmi devices- Allow sosreport to send a signal to ABRT - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t - Label /usr/sbin/htcacheclean as httpd_exec_t Resolves:#1037529 - Added support for rdisc unit file - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs - Allow runuser running as logrotate connections to system DBUS - Label bcache devices as fixed_disk_device_t - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t- Add back setpgid/setsched for sosreport_t- Added fix for clout_init to transition to rpm_script_t (dwalsh@redhat.com)- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel. - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on - Add lsmd_plugin_t for lsm plugins - Allow dovecot-deliver to search mountpoints - Add labeling for /etc/mdadm.conf - Allow opelmi admin providers to dbus chat with init_t - Allow sblim domain to read /dev/urandom and /dev/random - Allow apmd to request the kernel load modules - Add glusterd_brick_t type - label mate-keyring-daemon with gkeyringd_exec_t - Add plymouthd_create_log() - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6 - Allow sssd to request the kernel loads modules - Allow gpg_agent to use ssh-add - Allow gpg_agent to use ssh-add - Dontaudit access check on /root for myslqd_safe_t - Allow ctdb to getattr on al filesystems - Allow abrt to stream connect to syslog - Allow dnsmasq to list dnsmasq.d directory - Watchdog opens the raw socket - Allow watchdog to read network state info - Dontaudit access check on lvm lock dir - Allow sosreport to send signull to setroubleshootd - Add setroubleshoot_signull() interface - Fix ldap_read_certs() interface - Allow sosreport all signal perms - Allow sosreport to run systemctl - Allow sosreport to dbus chat with rpm - Add glusterd_brick_t files type - Allow zabbix_agentd to read all domain state - Clean up rtas.if - Allow smoltclient to execute ldconfig - Allow sosreport to request the kernel to load a module - Fix userdom_confined_admin_template() - Add back exec_content boolean for secadm, logadm, auditadm - Fix files_filetrans_system_db_named_files() interface - Allow sulogin to getattr on /proc/kcore - Add filename transition also for servicelog.db-journal - Add files_dontaudit_access_check_root() - Add lvm_dontaudit_access_check_lock() interface- Allow watchdog to read /etc/passwd - Allow browser plugins to connect to bumblebee - New policy for bumblebee and freqset - Add new policy for mip6d daemon - Add new policy for opensm daemon - Allow condor domains to read/write condor_master udp_socket - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift - Add back file_pid_filetrans for /var/run/dlm_controld - Allow smbd_t to use inherited tmpfs content - Allow mcelog to use the /dev/cpu device - sosreport runs rpcinfo - sosreport runs subscription-manager - Allow staff_t to run frequency command - Allow systemd_tmpfiles to relabel log directories - Allow staff_t to read xserver_log file - Label hsperfdata_root as tmp_t- More sosreport fixes to make ABRT working- Fix files_dontaudit_unmount_all_mountpoints() - Add support for 2608-2609 tcp/udp ports - Should allow domains to lock the terminal device - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - We need to require passwd rootok - Fix zebra.fc - Fix dnsmasq_filetrans_named_content() interface - Allow all sandbox domains create content in svirt_home_t - Allow zebra domains also create zebra_tmp_t files in /tmp - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services. - Fix labeling on neutron and remove transition to iconfig_t - abrt needs to read mcelog log file - Fix labeling on dnsmasq content - Fix labeling on /etc/dnsmasq.d - Allow glusterd to relabel own lib files - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd - Allow ipc_lock for abrt to run journalctl- Fix config.tgz- Fix passenger_stream_connect interface - setroubleshoot_fixit wants to read network state - Allow procmail_t to connect to dovecot stream sockets - Allow cimprovagt service providers to read network states - Add labeling for /var/run/mariadb - pwauth uses lastlog() to update system's lastlog - Allow account provider to read login records - Add support for texlive2013 - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - Allow passwd_t to connect to gnome keyring to change password - Update mls config files to have cronjobs in the user domains - Remove access checks that systemd does not actually do- Add support for yubikey in homedir - Add support for upd/3052 port - Allow apcupsd to use PowerChute Network Shutdown - Allow lsmd to execute various lsmplugins - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too - Update gluster_export_all_rw boolean to allow relabel all base file types - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling- Add files_relabel_base_file_types() interface - Allow netlabel-config to read passwd - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr() - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling - Allow pegasus to domtrans to mount_t - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts - Add support for unconfined watchdog scripts - Allow watchdog to manage own log files- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory. - Label /etc/yum.repos.d as system_conf_t - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t - Allow dac_override for sysadm_screen_t - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file. - Allow netlabel-config to read meminfo - Add interface to allow docker to mounton file_t - Add new interface to exec unlabeled files - Allow lvm to use docker semaphores - Setup transitons for .xsessions-errors.old - Change labels of files in /var/lib/*/.ssh to transition properly - Allow staff_t and user_t to look at logs using journalctl - pluto wants to manage own log file - Allow pluto running as ipsec_t to create pluto.log - Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files. - Additional access for docker - Added more rules to sblim policy - Fix kdumpgui_run_bootloader boolean - Allow dspam to connect to lmtp port - Included sfcbd service into sblim policy - rhsmcertd wants to manaage /etc/pki/consumer dir - Add kdumpgui_run_bootloader boolean - Add support for /var/cache/watchdog - Remove virt_domain attribute for virt_qemu_ga_unconfined_t - Fixes for handling libvirt containes - Dontaudit attempts by mysql_safe to write content into / - Dontaudit attempts by system_mail to modify network config - Allow dspam to bind to lmtp ports - Add new policy to allow staff_t and user_t to look at logs using journalctl - Allow apache cgi scripts to list sysfs - Dontaudit attempts to write/delete user_tmp_t files - Allow all antivirus domains to manage also own log dirs - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Add missing permission checks for nscd- Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Add file transition rules for content created by f5link - Rename quantum_port information to neutron - Allow all antivirus domains to manage also own log dirs - Rename quantum_port information to neutron - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Allow sysadm_t to read login information - Allow systemd_tmpfiles to setattr on var_log_t directories - Udpdate Makefile to include systemd_contexts - Add systemd_contexts - Add fs_exec_hugetlbfs_files() interface - Add daemons_enable_cluster_mode boolean - Fix rsync_filetrans_named_content() - Add rhcs_read_cluster_pid_files() interface - Update rhcs.if with additional interfaces from RHEL6 - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t - Allow glusterd_t to mounton glusterd_tmp_t - Allow glusterd to unmout al filesystems - Allow xenstored to read virt config - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label - Allow mozilla_plugin_t to mmap hugepages as an executable- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp- Allow sshd_t to read openshift content, needs backport to RHEL6.5 - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t - Make sur kdump lock is created with correct label if kdumpctl is executed - gnome interface calls should always be made within an optional_block - Allow syslogd_t to connect to the syslog_tls port - Add labeling for /var/run/charon.ctl socket - Add kdump_filetrans_named_content() - Allo setpgid for fenced_t - Allow setpgid and r/w cluster tmpfs for fenced_t - gnome calls should always be within optional blocks - wicd.pid should be labeled as networkmanager_var_run_t - Allow sys_resource for lldpad- Add rtas policy- Allow mailserver_domains to manage and transition to mailman data - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands - Allow mailserver_domains to manage and transition to mailman data - Allow svirt_domains to read sysctl_net_t - Allow thumb_t to use tmpfs inherited from the user - Allow mozilla_plugin to bind to the vnc port if running with spice - Add new attribute to discover confined_admins and assign confined admin to it - Fix zabbix to handle attributes in interfaces - Fix zabbix to read system states for all zabbix domains - Fix piranha_domain_template() - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files. - Allow lldpad sys_rouserce cap due to #986870 - Allow dovecot-auth to read nologin - Allow openlmi-networking to read /proc/net/dev - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t - Add zabbix_domain attribute for zabbix domains to treat them together - Add labels for zabbix-poxy-* (#1018221) - Update openlmi-storage policy to reflect #1015067 - Back port piranha tmpfs fixes from RHEL6 - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop - Add postfix_rw_spool_maildrop_files interface - Call new userdom_admin_user_templat() also for sysadm_secadm.pp - Fix typo in userdom_admin_user_template() - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey - Add new attribute to discover confined_admins - Fix labeling for /etc/strongswan/ipsec.d - systemd_logind seems to pass fd to anyone who dbus communicates with it - Dontaudit leaked write descriptor to dmesg- Activate motion policy- Fix gnome_read_generic_data_home_files() - allow openshift_cgroup_t to read/write inherited openshift file types - Remove httpd_cobbler_content * from cobbler_admin interface - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container - Allow httpd_t to read also git sys content symlinks - Allow init_t to read gnome home data - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it. - Allow virsh to execute systemctl - Fix for nagios_services plugins - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - Fix hypervkvp.te - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Fix logging policy - Allow syslog to bind to tls ports - Update labeling for /dev/cdc-wdm - Allow to su_domain to read init states - Allow init_t to read gnome home data - Make sure if systemd_logind creates nologin file with the correct label - Clean up ipsec.te- Add auth_exec_chkpwd interface - Fix port definition for ctdb ports - Allow systemd domains to read /dev/urand - Dontaudit attempts for mozilla_plugin to append to /dev/random - Add label for /var/run/charon.* - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service - Fix for nagios_services plugins - Fix some bugs in zoneminder policy - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - glusterd binds to random unreserved ports - Additional allow rules found by testing glusterfs - apcupsd needs to send a message to all users on the system so needs to look them up - Fix the label on ~/.juniper_networks - Dontaudit attempts for mozilla_plugin to append to /dev/random - Allow polipo_daemon to connect to flash ports - Allow gssproxy_t to create replay caches - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type- init reload from systemd_localed_t - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd - Allow systemd_localed_t to ask systemd to reload the locale. - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory - Allow readahead to read /dev/urand - Fix lots of avcs about tuned - Any file names xenstored in /var/log should be treated as xenstored_var_log_t - Allow tuned to inderact with hugepages - Allow condor domains to list etc rw dirs- Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Add additional fixes forpegasus_openlmi_account_t - Allow mdadm to read /dev/urand - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it - Add label/rules for /etc/mdadm.conf - Allow pegasus_openlmi_storage_t to transition to fsadm_t - Fixes for interface definition problems - Dontaudit dovecot-deliver to gettatr on all fs dirs - Allow domains to search data_home_t directories - Allow cobblerd to connect to mysql - Allow mdadm to r/w kdump lock files - Add support for kdump lock files - Label zarafa-search as zarafa-indexer - Openshift cgroup wants to read /etc/passwd - Add new sandbox domains for kvm - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on - Fix labeling for /usr/lib/systemd/system/lvm2.* - Add labeling for /usr/lib/systemd/system/lvm2.* - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules - Add sshd_keygen_t policy for sshd-keygen - Fix alsa_home_filetrans interface name and definition - Allow chown for ssh_keygen_t - Add fs_dontaudit_getattr_all_dirs() - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys - Fix up patch to allow systemd to manage home content - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled - Allow getty to exec hostname to get info - Add systemd_home_t for ~/.local/share/systemd directory- Fix lxc labels in config.tgz- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper - Allow tuned to search all file system directories - Allow alsa_t to sys_nice, to get top performance for sound management - Add support for MySQL/PostgreSQL for amavis - Allow openvpn_t to manage openvpn_var_log_t files. - Allow dirsrv_t to create tmpfs_t directories - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label - Dontaudit leaked unix_stream_sockets into gnome keyring - Allow telepathy domains to inhibit pipes on telepathy domains - Allow cloud-init to domtrans to rpm - Allow abrt daemon to manage abrt-watch tmp files - Allow abrt-upload-watcher to search /var/spool directory - Allow nsswitch domains to manage own process key - Fix labeling for mgetty.* logs - Allow systemd to dbus chat with upower - Allow ipsec to send signull to itself - Allow setgid cap for ipsec_t - Match upstream labeling- Do not build sanbox pkg on MLS- wine_tmp is no longer needed - Allow setroubleshoot to look at /proc - Allow telepathy domains to dbus with systemd logind - Fix handling of fifo files of rpm - Allow mozilla_plugin to transition to itself - Allow certwatch to write to cert_t directories - New abrt application - Allow NetworkManager to set the kernel scheduler - Make wine_domain shared by all wine domains - Allow mdadm_t to read images labeled svirt_image_t - Allow amanda to read /dev/urand - ALlow my_print_default to read /dev/urand - Allow mdadm to write to kdumpctl fifo files - Allow nslcd to send signull to itself - Allow yppasswd to read /dev/urandom - Fix zarafa_setrlimit - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add additional alias for user_tmp_t because wine_tmp_t is no longer used - More handling of ther kernel keyring required by kerberos - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed- Dontaudit attempts by sosreport to read shadow_t - Allow browser sandbox plugins to connect to cups to print - Add new label mpd_home_t - Label /srv/www/logs as httpd_log_t - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add labels for apache logs under miq package - Allow irc_t to use tcp sockets - fix labels in puppet.if - Allow tcsd to read utmp file - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys - Define svirt_socket_t as a domain_type - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t - Fix label on pam_krb5 helper apps- Allow ldconfig to write to kdumpctl fifo files - allow neutron to connect to amqp ports - Allow kdump_manage_crash to list the kdump_crash_t directory - Allow glance-api to connect to amqp port - Allow virt_qemu_ga_t to read meminfo - Add antivirus_home_t type for antivirus date in HOMEDIRS - Allow mpd setcap which is needed by pulseaudio - Allow smbcontrol to create content in /var/lib/samba - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts - amanda_exec_t needs to be executable file - Allow block_suspend cap for samba-net - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t - Allow init_t to run crash utility - Treat usr_t just like bin_t for transitions and executions - Add port definition of pka_ca to port 829 for openshift - Allow selinux_store to use symlinks- Allow block_suspend cap for samba-net - Allow t-mission-control to manage gabble cache files - Allow nslcd to read /sys/devices/system/cpu - Allow selinux_store to use symlinks- Allow xdm_t to transition to itself - Call neutron interfaces instead of quantum - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t - Make sure directories in /run get created with the correct label - Make sure /root/.pki gets created with the right label - try to remove labeling for motion from zoneminder_exec_t to bin_t - Allow inetd_t to execute shell scripts - Allow cloud-init to read all domainstate - Fix to use quantum port - Add interface netowrkmanager_initrc_domtrans - Fix boinc_execmem - Allow t-mission-control to read gabble cache home - Add labeling for ~/.cache/telepathy/avatars/gabble - Allow memcache to read sysfs data - Cleanup antivirus policy and add additional fixes - Add boolean boinc_enable_execstack - Add support for couchdb in rabbitmq policy - Add interface couchdb_search_pid_dirs - Allow firewalld to read NM state - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files()- Split out rlogin ports from inetd - Treat files labeld as usr_t like bin_t when it comes to transitions - Allow staff_t to read login config - Allow ipsec_t to read .google authenticator data - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files() - Call the correct interface - corenet_udp_bind_ktalkd_port() - Allow all domains that can read gnome_config to read kde config - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work - Allow mdadm to getattr any file system - Allow a confined domain to executes mozilla_exec_t via dbus - Allow cupsd_lpd_t to bind to the printer port - Dontaudit attempts to bind to ports < 1024 when nis is turned on - Allow apache domain to connect to gssproxy socket - Allow rlogind to bind to the rlogin_port - Allow telnetd to bind to the telnetd_port - Allow ktalkd to bind to the ktalkd_port - Allow cvs to bind to the cvs_port- Cleanup related to init_domain()+inetd_domain fixes - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain - svirt domains neeed to create kobject_uevint_sockets - Lots of new access required for sosreport - Allow tgtd_t to connect to isns ports - Allow init_t to transition to all inetd domains: - openct needs to be able to create netlink_object_uevent_sockets - Dontaudit leaks into ldconfig_t - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls - Move kernel_stream_connect into all Xwindow using users - Dontaudit inherited lock files in ifconfig o dhcpc_t- Also sock_file trans rule is needed in lsm - Fix labeling for fetchmail pid files/dirs - Add additional fixes for abrt-upload-watch - Fix polipo.te - Fix transition rules in asterisk policy - Add fowner capability to networkmanager policy - Allow polipo to connect to tor ports - Cleanup lsmd.if - Cleanup openhpid policy - Fix kdump_read_crash() interface - Make more domains as init domain - Fix cupsd.te - Fix requires in rpm_rw_script_inherited_pipes - Fix interfaces in lsm.if - Allow munin service plugins to manage own tmpfs files/dirs - Allow virtd_t also relabel unix stream sockets for virt_image_type - Make ktalk as init domain - Fix to define ktalkd_unit_file_t correctly - Fix ktalk.fc - Add systemd support for talk-server - Allow glusterd to create sock_file in /run - Allow xdm_t to delete gkeyringd_tmp_t files on logout - Add fixes for hypervkvp policy - Add logwatch_can_sendmail boolean - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb - Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add selinux-policy-sandbox pkg0 - Allow rhsmcertd to read init state - Allow fsetid for pkcsslotd - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service - Allow fetchmail to create own pid with correct labeling - Fix rhcs_domain_template() - Allow roles which can run mock to read mock lib files to view results - Allow rpcbind to use nsswitch - Fix lsm.if summary - Fix collectd_t can read /etc/passwd file - Label systemd unit files under dracut correctly - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh - Add support for .Xauthority-n - Label umount.crypt as lvm_exec_t - Allow syslogd to search psad lib files - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files- Add policy for lsmd - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory - Update condor_master rules to allow read system state info and allow logging - Add labeling for /etc/condor and allow condor domain to write it (bug) - Allow condor domains to manage own logs - Allow glusterd to read domains state - Fix initial hypervkvp policy - Add policy for hypervkvpd - Fix redis.if summary- Allow boinc to connect to @/tmp/.X11-unix/X0 - Allow beam.smp to connect to tcp/5984 - Allow named to manage own log files - Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t - Add virt_transition_userdomain boolean decl - Allow httpd_t to sendto unix_dgram sockets on its children - Allow nova domains to execute ifconfig - bluetooth wants to create fifo_files in /tmp - exim needs to be able to manage mailman data - Allow sysstat to getattr on all file systems - Looks like bluetoothd has moved - Allow collectd to send ping packets - Allow svirt_lxc domains to getpgid - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff - Allow frpintd_t to read /dev/urandom - Allow asterisk_t to create sock_file in /var/run - Allow usbmuxd to use netlink_kobject - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket - More cleanup of svirt_lxc policy - virtd_lxc_t now talks to dbus - Dontaudit leaked ptmx_t - Allow processes to use inherited fifo files - Allow openvpn_t to connect to squid ports - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert() - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files - Allow user roles to connect to the journal socket- selinux_set_enforce_mode needs to be used with type - Add append to the dontaudit for unix_stream_socket of xdm_t leak - Allow xdm_t to create symlinks in log direcotries - Allow login programs to read afs config - Label 10933 as a pop port, for dovecot - New policy to allow selinux_server.py to run as semanage_t as a dbus service - Add fixes to make netlabelctl working on MLS - AVCs required for running sepolicy gui as staff_t - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC - New dbus server to be used with new gui - After modifying some files in /etc/mail, I saw this needed on the next boot - Loading a vm from /usr/tmp with virt-manager - Clean up oracleasm policy for Fedora - Add oracleasm policy written by rlopez@redhat.com - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache - Add label for /var/crash - Allow fenced to domtrans to sanclok_t - Allow nagios to manage nagios spool files - Make tfptd as home_manager - Allow kdump to read kcore on MLS system - Allow mysqld-safe sys_nice/sys_resource caps - Allow apache to search automount tmp dirs if http_use_nfs is enabled - Allow crond to transition to named_t, for use with unbound - Allow crond to look at named_conf_t, for unbound - Allow mozilla_plugin_t to transition its home content - Allow dovecot_domain to read all system and network state - Allow httpd_user_script_t to call getpw - Allow semanage to read pid files - Dontaudit leaked file descriptors from user domain into thumb - Make PAM authentication working if it is enabled in ejabberd - Add fixes for rabbit to fix ##992920,#992931 - Allow glusterd to mount filesystems - Loading a vm from /usr/tmp with virt-manager - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device - Add fix for pand service - shorewall touches own log - Allow nrpe to list /var - Mozilla_plugin_roles can not be passed into lpd_run_lpr - Allow afs domains to read afs_config files - Allow login programs to read afs config - Allow virt_domain to read virt_var_run_t symlinks - Allow smokeping to send its process signals - Allow fetchmail to setuid - Add kdump_manage_crash() interface - Allow abrt domain to write abrt.socket- Add more aliases in pegasus.te - Add more fixes for *_admin interfaces - Add interface fixes - Allow nscd to stream connect to nmbd - Allow gnupg apps to write to pcscd socket - Add more fixes for openlmi provides. Fix naming and support for additionals - Allow fetchmail to resolve host names - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te - Fix corecmd_exec_chroot() - Fix logging_relabel_syslog_pid_socket interface - Fix typo in unconfineduser.te - Allow system_r to access unconfined_dbusd_t to run hp_chec- Allow xdm_t to act as a dbus client to itsel - Allow fetchmail to resolve host names - Allow gnupg apps to write to pcscd socket - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te -httpd_t does access_check on certs- Add support for cmpiLMI_Service-cimprovagt - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t - Add support for pycmpiLMI_Storage-cimprovagt - Add support for cmpiLMI_Networking-cimprovagt - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working - Allow virtual machines and containers to run as user doains, needed for virt-sandbox - Allow buglist.cgi to read cpu info- Allow systemd-tmpfile to handle tmp content in print spool dir - Allow systemd-sysctl to send system log messages - Add support for RTP media ports and fmpro-internal - Make auditd working if audit is configured to perform SINGLE action on disk error - Add interfaces to handle systemd units - Make systemd-notify working if pcsd is used - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t - Instead of having all unconfined domains get all of the named transition rules, - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default. - Add definition for the salt ports - Allow xdm_t to create link files in xdm_var_run_t - Dontaudit reads of blk files or chr files leaked into ldconfig_t - Allow sys_chroot for useradd_t - Allow net_raw cap for ipsec_t - Allow sysadm_t to reload services - Add additional fixes to make strongswan working with a simple conf - Allow sysadm_t to enable/disable init_t services - Add additional glusterd perms - Allow apache to read lnk files in the /mnt directory - Allow glusterd to ask the kernel to load a module - Fix description of ftpd_use_fusefs boolean - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t - Allow glusterds to request load a kernel module - Allow boinc to stream connect to xserver_t - Allow sblim domains to read /etc/passwd - Allow mdadm to read usb devices - Allow collectd to use ping plugin - Make foghorn working with SNMP - Allow sssd to read ldap certs - Allow haproxy to connect to RTP media ports - Add additional trans rules for aide_db - Add labeling for /usr/lib/pcsd/pcsd - Add labeling for /var/log/pcsd - Add support for pcs which is a corosync and pacemaker configuration tool- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1 - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown - consolekit needs to be able to shut down system - Move around interfaces - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints - Allow gconf-defaults-m to read /etc/passwd - Fix pki_rw_tomcat_cert() interface to support lnk_files- Add support for gluster ports - Make sure that all keys located in /etc/ssh/ are labeled correctly - Make sure apcuspd lock files get created with the correct label - Use getcap in gluster.te - Fix gluster policy - add additional fixes to allow beam.smp to interact with couchdb files - Additional fix for #974149 - Allow gluster to user gluster ports - Allow glusterd to transition to rpcd_t and add additional fixes for #980683 - Allow tgtd working when accessing to the passthrough device - Fix labeling for mdadm unit files- Add mdadm fixes- Fix definition of sandbox.disabled to sandbox.pp.disabled- Allow mdamd to execute systemctl - Allow mdadm to read /dev/kvm - Allow ipsec_mgmt_t to read l2tpd pid content- Allow nsd_t to read /dev/urand - Allow mdadm_t to read framebuffer - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t - Allow mozilla_plugin_config_t to create tmp files - Cleanup openvswitch policy - Allow mozilla plugin to getattr on all executables - Allow l2tpd_t to create fifo_files in /var/run - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory - Allow mdadm to connecto its own unix_stream_socket - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now. - Allow apache to access smokeping pid files - Allow rabbitmq_beam_t to getattr on all filesystems - Add systemd support for iodined - Allow nup_upsdrvctl_t to execute its entrypoint - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch - add labeling for ~/.cache/libvirt-sandbox - Add interface to allow domains transitioned to by confined users to send sigchld to screen program - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs. - Allow staff to getsched all domains, required to run htop - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Add prosody policy written by Michael Scherer - Allow nagios plugins to read /sys info - ntpd needs to manage own log files - Add support for HOME_DIR/.IBMERS - Allow iptables commands to read firewalld config - Allow consolekit_t to read utmp - Fix filename transitions on .razor directory - Add additional fixes to make DSPAM with LDA working - Allow snort to read /etc/passwd - Allow fail2ban to communicate with firewalld over dbus - Dontaudit openshift_cgreoup_file_t read/write leaked dev - Allow nfsd to use mountd port - Call th proper interface - Allow openvswitch to read sys and execute plymouth - Allow tmpwatch to read /var/spool/cups/tmp - Add support for /usr/libexec/telepathy-rakia - Add systemd support for zoneminder - Allow mysql to create files/directories under /var/log/mysql - Allow zoneminder apache scripts to rw zoneminder tmpfs - Allow httpd to manage zoneminder lib files - Add zoneminder_run_sudo boolean to allow to start zoneminder - Allow zoneminder to send mails - gssproxy_t sock_file can be under /var/lib - Allow web domains to connect to whois port. - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t. - We really need to add an interface to corenet to define what a web_client_domain is and - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain. - Add labeling for cmpiLMI_LogicalFile-cimprovagt - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules - Update policy rules for pegasus_openlmi_logicalfile_t - Add initial types for logicalfile/unconfined OpenLMI providers - mailmanctl needs to read own log - Allow logwatch manage own lock files - Allow nrpe to read meminfo - Allow httpd to read certs located in pki-ca - Add pki_read_tomcat_cert() interface - Add support for nagios openshift plugins - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab- Make DSPAM to act as a LDA working - Allow ntop to create netlink socket - Allow policykit to send a signal to policykit-auth - Allow stapserver to dbus chat with avahi/systemd-logind - Fix labeling on haproxy unit file - Clean up haproxy policy - A new policy for haproxy and placed it to rhcs.te - Add support for ldirectord and treat it with cluster_t - Make sure anaconda log dir is created with var_log_t- Allow lvm_t to create default targets for filesystem handling - Fix labeling for razor-lightdm binaries - Allow insmod_t to read any file labeled var_lib_t - Add policy for pesign - Activate policy for cmpiLMI_Account-cimprovagt - Allow isnsd syscall=listen - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler - Allow ctdbd to use udp/4379 - gatherd wants sys_nice and setsched - Add support for texlive2012 - Allow NM to read file_t (usb stick with no labels used to transfer keys for example) - Allow cobbler to execute apache with domain transition- condor_collector uses tcp/9000 - Label /usr/sbin/virtlockd as virtd_exec_t for now - Allow cobbler to execute ldconfig - Allow NM to execute ssh - Allow mdadm to read /dev/crash - Allow antivirus domains to connect to snmp port - Make amavisd-snmp working correctly - Allow nfsd_t to mounton nfsd_fs_t - Add initial snapper policy - We still need to have consolekit policy - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow dirsrv to read network state - Fix pki_read_tomcat_lib_files - Add labeling for /usr/libexec/nm-ssh-service - Add label cert_t for /var/lib/ipa/pki-ca/publish - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant - Allow nfsd_t to mounton nfsd_fs_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow passwd_t to change role to system_r from unconfined_r- Don't audit access checks by sandbox xserver on xdb var_lib - Allow ntop to read usbmon devices - Add labeling for new polcykit authorizor - Dontaudit access checks from fail2ban_client - Don't audit access checks by sandbox xserver on xdb var_lib - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream - Fix labeling for all /usr/bim/razor-lightdm-* binaries - Add filename trans for /dev/md126p1- Make vdagent able to request loading kernel module - Add support for cloud-init make it as unconfined domain - Allow snmpd to run smartctl in fsadm_t domain - remove duplicate openshift_search_lib() interface - Allow mysqld to search openshift lib files - Allow openshift cgroup to interact with passedin file descriptors - Allow colord to list directories inthe users homedir - aide executes prelink to check files - Make sure cupsd_t creates content in /etc/cups with the correct label - Lest dontaudit apache read all domains, so passenger will not cause this avc - Allow gssd to connect to gssproxy - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS - Allow systemd-tmpfiles to relabel also lock files - Allow useradd to add homdir in /var/lib/openshift - Allow setfiles and semanage to write output to /run/files- Add labeling for /dev/tgt - Dontaudit leak fd from firewalld for modprobe - Allow runuser running as rpm_script_t to create netlink_audit socket - Allow mdadm to read BIOS non-volatile RAM- accountservice watches when accounts come and go in wtmp - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket - Add httpd_use_sasl boolean - Allow net_admin for tuned_t - iscsid needs sys_module to auto-load kernel modules - Allow blueman to read bluetooth conf - Add nova_manage_lib_files() interface - Fix mplayer_filetrans_home_content() - Add mplayer_filetrans_home_content() - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t - Revert "Allow thumb_t to append inherited xdm stream socket" - Add iscsi_filetrans_named_content() interface - Allow to create .mplayer with the correct labeling for unconfined - Allow iscsiadmin to create lock file with the correct labeling- Allow wine to manage wine home content - Make amanda working with socket actiovation - Add labeling for /usr/sbin/iscsiadm - Add support for /var/run/gssproxy.sock - dnsmasq_t needs to read sysctl_net_t- Fix courier_domain_template() interface - Allow blueman to write ip_forward - Allow mongodb to connect to mongodb port - Allow mongodb to connect to mongodb port - Allow java to bind jobss_debug port - Fixes for *_admin interfaces - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality - Need to assign attribute for courier_domain to all courier_domains - Fail2ban reads /etc/passwd - postfix_virtual will create new files in postfix_spool_t - abrt triggers sys_ptrace by running pidof - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it - Add passenger fixes needed by foreman - Remove dup interfaces - Add additional interfaces for quantum - Add new interfaces for dnsmasq - Allow passenger to read localization and send signull to itself - Allow dnsmasq to stream connect to quantum - Add quantum_stream_connect() - Make sure that mcollective starts the service with the correct labeling - Add labels for ~/.manpath - Dontaudit attempts by svirt_t to getpw* calls - sandbox domains are trying to look at parent process data - Allow courior auth to create its pid file in /var/spool/courier subdir - Add fixes for beam to have it working with couchdb - Add labeling for /run/nm-xl2tpd.con - Allow apache to stream connect to thin - Add systemd support for amand - Make public types usable for fs mount points - Call correct mandb interface in domain.te - Allow iptables to r/w quantum inherited pipes and send sigchld - Allow ifconfig domtrans to iptables and execute ldconfig - Add labels for ~/.manpath - Allow systemd to read iscsi lib files - seunshare is trying to look at parent process data- Fix openshift_search_lib - Add support for abrt-uefioops-oops - Allow colord to getattr any file system - Allow chrome processes to look at each other - Allow sys_ptrace for abrt_t - Add new policy for gssproxy - Dontaudit leaked file descriptor writes from firewalld - openshift_net_type is interface not template - Dontaudit pppd to search gnome config - Update openshift_search_lib() interface - Add fs_list_pstorefs() - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18 - Better labels for raspberry pi devices - Allow init to create devpts_t directory - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18 - Allow sysadm_t to build kernels - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18 - Allow userdomains to stream connect to gssproxy - Dontaudit leaked file descriptor writes from firewalld - Allow xserver to read /dev/urandom - Add additional fixes for ipsec-mgmt - Make SSHing into an Openshift Enterprise Node working- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime - with the proper label. - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files - Allow systemd-timedated to create adjtime - Add clock_create_adjtime() - Additional fix ifconfing for #966106 - Allow kernel_t to create boot.log with correct labeling - Remove unconfined_mplayer for which we don't have rules - Rename interfaces - Add userdom_manage_user_home_files/dirs interfaces - Fix files_dontaudit_read_all_non_security_files - Fix ipsec_manage_key_file() - Fix ipsec_filetrans_key_file() - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t - Fix labeling for ipse.secrets - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid - Add files_dontaudit_read_all_non_security_files() interface - /var/log/syslog-ng should be labeled var_log_t - Make ifconfig_var_run_t a mountpoint - Add transition from ifconfig to dnsmasq - Allow ifconfig to execute bin_t/shell_exec_t - We want to have hwdb.bin labeled as etc_t - update logging_filetrans_named_content() interface - Allow systemd_timedate_t to manage /etc/adjtime - Allow NM to send signals to l2tpd - Update antivirus_can_scan_system boolean - Allow devicekit_disk_t to sys_config_tty - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories - Make printing from vmware working - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes - Add virt_qemu_ga_data_t for qemu-ga - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both - Fix typo in virt.te - Add virt_qemu_ga_unconfined_t for hook scripts - Make sure NetworkManager files get created with the correct label - Add mozilla_plugin_use_gps boolean - Fix cyrus to have support for net-snmp - Additional fixes for dnsmasq and quantum for #966106 - Add plymouthd_create_log() - remove httpd_use_oddjob for which we don't have rules - Add missing rules for httpd_can_network_connect_cobbler - Add missing cluster_use_execmem boolean - Call userdom_manage_all_user_home_type_files/dirs - Additional fix for ftp_home_dir - Fix ftp_home_dir boolean - Allow squit to recv/send client squid packet - Fix nut.te to have nut_domain attribute - Add support for ejabberd; TODO: revisit jabberd and rabbit policy - Fix amanda policy - Add more fixes for domains which use libusb - Make domains which use libusb working correctly - Allow l2tpd to create ipsec key files with correct labeling and manage them - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files - Allow rabbitmq-beam to bind generic node - Allow l2tpd to read ipse-mgmt pid files - more fixes for l2tpd, NM and pppd from #967072- Dontaudit to getattr on dirs for dovecot-deliver - Allow raiudusd server connect to postgresql socket - Add kerberos support for radiusd - Allow saslauthd to connect to ldap port - Allow postfix to manage postfix_private_t files - Add chronyd support for #965457 - Fix labeling for HOME_DIR/\.icedtea - CHange squid and snmpd to be allowed also write own logs - Fix labeling for /usr/libexec/qemu-ga - Allow virtd_t to use virt_lock_t - Allow also sealert to read the policy from the kernel - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content - Dontaudit listing of users homedir by sendmail Seems like a leak - Allow passenger to transition to puppet master - Allow apache to connect to mythtv - Add definition for mythtv ports- Add additional fixes for #948073 bug - Allow sge_execd_t to also connect to sge ports - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files - Add networkmanager_stream_connect() - Make gnome-abrt wokring with staff_t - Fix openshift_manage_lib_files() interface - mdadm runs ps command which seems to getattr on random log files - Allow mozilla_plugin_t to create pulseaudit_home_t directories - Allow qemu-ga to shutdown virtual hosts - Add labelling for cupsd-browsed - Add web browser plugins to connect to aol ports - Allow nm-dhcp-helper to stream connect to NM - Add port definition for sge ports- Make sure users and unconfined domains create .hushlogin with the correct label - Allow pegaus to chat with realmd over DBus - Allow cobblerd to read network state - Allow boicn-client to stat on /dev/input/mice - Allow certwatch to read net_config_t when it executes apache - Allow readahead to create /run/systemd and then create its own directory with the correct label- Transition directories and files when in a user_tmp_t directory - Change certwatch to domtrans to apache instead of just execute - Allow virsh_t to read xen lib files - update policy rules for pegasus_openlmi_account_t - Add support for svnserve_tmp_t - Activate account openlmi policy - pegasus_openlmi_domain_template needs also require pegasus_t - One more fix for policykit.te - Call fs_list_cgroups_dirs() in policykit.te - Allow nagios service plugin to read mysql config files - Add labeling for /var/svn - Fix chrome.te - Fix pegasus_openlmi_domain_template() interfaces - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks - Fix location of google-chrome data - Add support for chome_sandbox to store content in the homedir - Allow policykit to watch for changes in cgroups file system - Add boolean to allow mozilla_plugin_t to use spice - Allow collectd to bind to udp port - Allow collected_t to read all of /proc - Should use netlink socket_perms - Should use netlink socket_perms - Allow glance domains to connect to apache ports - Allow apcupsd_t to manage its log files - Allow chrome objects to rw_inherited unix_stream_socket from callers - Allow staff_t to execute virtd_exec_t for running vms - nfsd_t needs to bind mountd port to make nfs-mountd.service working - Allow unbound net_admin capability because of setsockopt syscall - Fix fs_list_cgroup_dirs() - Label /usr/lib/nagios/plugins/utils.pm as bin_t - Remove uplicate definition of fs_read_cgroup_files() - Remove duplicate definition of fs_read_cgroup_files() - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd - Additional interfaces needed to list and read cgroups config - Add port definition for collectd port - Add labels for /dev/ptp* - Allow staff_t to execute virtd_exec_t for running vms- Allow samba-net to also read realmd tmp files - Allow NUT to use serial ports - realmd can be started by systemctl now- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid - Allow virsh to read xen lock file - Allow qemu-ga to create files in /run with proper labeling - Allow glusterd to connect to own socket in /tmp - Allow glance-api to connect to http port to make glance image-create working - Allow keystonte_t to execute rpm- Fix realmd cache interfaces- Allow tcpd to execute leafnode - Allow samba-net to read realmd cache files - Dontaudit sys_tty_config for alsactl - Fix allow rules for postfix_var_run - Allow cobblerd to read /etc/passwd - Allow pegasus to read exports - Allow systemd-timedate to read xdm state - Allow mout to stream connect to rpcbind - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki- Allow thumbnails to share memory with apps which run thumbnails - Allow postfix-postqueue block_suspend - Add lib interfaces for smsd - Add support for nginx - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t - Allow pki apache domain to create own tmp files and execute httpd_suexec - Allow procmail to manger user tmp files/dirs/lnk_files - Add virt_stream_connect_svirt() interface - Allow dovecot-auth to execute bin_t - Allow iscsid to request that kernel load a kernel module - Add labeling support for /var/lib/mod_security - Allow iw running as tuned_t to create netlink socket - Dontaudit sys_tty_config for thumb_t - Add labeling for nm-l2tp-service - Allow httpd running as certwatch_t to open tcp socket - Allow useradd to manager smsd lib files - Allow useradd_t to add homedirs in /var/lib - Fix typo in userdomain.te - Cleanup userdom_read_home_certs - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t - Allow staff to stream connect to svirt_t to make gnome-boxes working- Allow lvm to create its own unit files - Label /var/lib/sepolgen as selinux_config_t - Add filetrans rules for tw devices - Add transition from cupsd_config_t to cupsd_t- Add filetrans rules for tw devices - Cleanup bad transition lines- Fix lockdev_manage_files() - Allow setroubleshootd to read var_lib_t to make email_alert working - Add lockdev_manage_files() - Call proper interface in virt.te - Allow gkeyring_domain to create /var/run/UID/config/dbus file - system dbus seems to be blocking suspend - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need - When you enter a container from root, you generate avcs with a leaked file descriptor - Allow mpd getattr on file system directories - Make sure realmd creates content with the correct label - Allow systemd-tty-ask to write kmsg - Allow mgetty to use lockdev library for device locking - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music - When you enter a container from root, you generate avcs with a leaked file descriptor - Make sure init.fc files are labeled correctly at creation - File name trans vconsole.conf - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow certmonger to dbus communicate with realmd - Make realmd working- Fix mozilla specification of homedir content - Allow certmonger to read network state - Allow tmpwatch to read tmp in /var/spool/{cups,lpd} - Label all nagios plugin as unconfined by default - Add httpd_serve_cobbler_files() - Allow mdadm to read /dev/sr0 and create tmp files - Allow certwatch to send mails - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow realmd to run ipa, really needs to be an unconfined_domain - Allow sandbox domains to use inherted terminals - Allow pscd to use devices labeled svirt_image_t in order to use cat cards. - Add label for new alsa pid - Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition - Add support for sshd_unit_file_t - Add oracleasmfs_t - Allow unlabeled_t files to be stored on unlabeled_t filesystems- Fix description of deny_ptrace boolean - Remove allow for execmod lib_t for now - Allow quantum to connect to keystone port - Allow nova-console to talk with mysql over unix stream socket - Allow dirsrv to stream connect to uuidd - thumb_t needs to be able to create ~/.cache if it does not exist - virtd needs to be able to sys_ptrace when starting and stoping containers- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms... - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets - Fix deny_ptrace boolean, certain ptrace leaked into the system - Allow winbind to manage kerberos_rcache_host - Allow spamd to create spamd_var_lib_t directories - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs - Fix vmware_role() interface - Fix cobbler_manage_lib_files() interface - Allow nagios check disk plugins to execute bin_t - Allow quantum to transition to openvswitch_t - Allow postdrop to stream connect to postfix-master - Allow quantum to stream connect to openvswitch - Add xserver_dontaudit_xdm_rw_stream_sockets() interface - Allow daemon to send dgrams to initrc_t - Allow kdm to start the power service to initiate a reboot or poweroff- Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Don't audit attempts to write to stream socket of nscld by thumbnailers - Allow git_system_t to read network state - Allow pegasas to execute mount command - Fix desc for drdb_admin - Fix condor_amin() - Interface fixes for uptime, vdagent, vnstatd - Fix labeling for moodle in /var/www/moodle/data - Add interface fixes - Allow bugzilla to read certs - /var/www/moodle needs to be writable by apache - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Fix sys_nice for cups_domain - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Kernel_t needs mac_admin in order to support labeled NFS - Fix systemd_dontaudit_dbus_chat() interface - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Allow consolehelper domain to write Xauth files in /root - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Allow consolehelper more access discovered by Tom London - Allow fsdaemon to send signull to all domain - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Fix file_contexts.subs to label /run/lock correctly- Try to label on controlC devices up to 30 correctly - Add mount_rw_pid_files() interface - Add additional mount/umount interfaces needed by mock - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk - Fix tabs - Allow initrc_domain to search rgmanager lib files - Add more fixes which make mock working together with confined users * Allow mock_t to manage rpm files * Allow mock_t to read rpm log files * Allow mock to setattr on tmpfs, devpts * Allow mount/umount filesystems - Add rpm_read_log() interface - yum-cron runs rpm from within it. - Allow tuned to transition to dmidecode - Allow firewalld to do net_admin - Allow mock to unmont tmpfs_t - Fix virt_sigkill() interface - Add additional fixes for mock. Mainly caused by mount running in mock_t - Allow mock to write sysfs_t and mount pid files - Add mailman_domain to mailman_template() - Allow openvswitch to execute shell - Allow qpidd to use kerberos - Allow mailman to use fusefs, needs back port to RHEL6 - Allow apache and its scripts to use anon_inodefs - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7 - Realmd needs to connect to samba ports, needs back port to F18 also - Allow colord to read /run/initial-setup- - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock - Add virt_kill() interface - Add rgmanager_search_lib() interface - Allow wdmd to getattr on all filesystems. Back ported from RHEL6- Allow realmd to create tmp files - FIx ircssi_home_t type to irssi_home_t - Allow adcli running as realmd_t to connect to ldap port - Allow NetworkManager to transition to ipsec_t, for running strongswan - Make openshift_initrc_t an lxc_domain - Allow gssd to manage user_tmp_t files - Fix handling of irclogs in users homedir - Fix labeling for drupal an wp-content in subdirs of /var/www/html - Allow abrt to read utmp_t file - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6 - fix labeling for (oo|rhc)-restorer-wrapper.sh - firewalld needs to be able to write to network sysctls - Fix mozilla_plugin_dontaudit_rw_sem() interface - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains - Add mozilla_plugin_dontaudit_rw_sem() interface - Allow svirt_lxc_t to transition to openshift domains - Allow condor domains block_suspend and dac_override caps - Allow condor_master to read passd - Allow condor_master to read system state - Allow NetworkManager to transition to ipsec_t, for running strongswan - Lots of access required by lvm_t to created encrypted usb device - Allow xdm_t to dbus communicate with systemd_localed_t - Label strongswan content as ipsec_exec_mgmt_t for now - Allow users to dbus chat with systemd_localed - Fix handling of .xsession-errors in xserver.if, so kde will work - Might be a bug but we are seeing avc's about people status on init_t:service - Make sure we label content under /var/run/lock as <> - Allow daemon and systemprocesses to search init_var_run_t directory - Add boolean to allow xdm to write xauth data to the home directory - Allow mount to write keys for the unconfined domain - Add unconfined_write_keys() interface- Add labeling for /usr/share/pki - Allow programs that read var_run_t symlinks also read var_t symlinks - Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports - Fix labeling for /etc/dhcp directory - add missing systemd_stub_unit_file() interface - Add files_stub_var() interface - Add lables for cert_t directories - Make localectl set-x11-keymap working at all - Allow abrt to manage mock build environments to catch build problems. - Allow virt_domains to setsched for running gdb on itself - Allow thumb_t to execute user home content - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000 - Allow certwatch to execut /usr/bin/httpd - Allow cgred to send signal perms to itself, needs back port to RHEL6 - Allow openshift_cron_t to look at quota - Allow cups_t to read inhered tmpfs_t from the kernel - Allow yppasswdd to use NIS - Tuned wants sys_rawio capability - Add ftpd_use_fusefs boolean - Allow dirsrvadmin_t to signal itself- Allow localectl to read /etc/X11/xorg.conf.d directory - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors"" - Allow mount to transition to systemd_passwd_agent - Make sure abrt directories are labeled correctly - Allow commands that are going to read mount pid files to search mount_var_run_t - label /usr/bin/repoquery as rpm_exec_t - Allow automount to block suspend - Add abrt_filetrans_named_content so that abrt directories get labeled correctly - Allow virt domains to setrlimit and read file_context- Allow nagios to manage nagios spool files - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6 - Add swift_alias.* policy files which contain typealiases for swift types - Add support for /run/lock/opencryptoki - Allow pkcsslotd chown capability - Allow pkcsslotd to read passwd - Add rsync_stub() interface - Allow systemd_timedate also manage gnome config homedirs - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t - Fix filetrans rules for kdm creates .xsession-errors - Allow sytemd_tmpfiles to create wtmp file - Really should not label content under /var/lock, since it could have labels on it different from var_lock_t - Allow systemd to list all file system directories - Add some basic stub interfaces which will be used in PRODUCT policies- Fix log transition rule for cluster domains - Start to group all cluster log together - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update - cups uses usbtty_device_t devices - These fixes were all required to build a MLS virtual Machine with single level desktops - Allow domains to transiton using httpd_exec_t - Allow svirt domains to manage kernel key rings - Allow setroubleshoot to execute ldconfig - Allow firewalld to read generate gnome data - Allow bluetooth to read machine-info - Allow boinc domain to send signal to itself - Fix gnome_filetrans_home_content() interface - Allow mozilla_plugins to list apache modules, for use with gxine - Fix labels for POkemon in the users homedir - Allow xguest to read mdstat - Dontaudit virt_domains getattr on /dev/* - These fixes were all required to build a MLS virtual Machine with single level desktops - Need to back port this to RHEL6 for openshift - Add tcp/8891 as milter port - Allow nsswitch domains to read sssd_var_lib_t files - Allow ping to read network state. - Fix typo - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them- Adopt swift changes from lhh@redhat.com - Add rhcs_manage_cluster_pid_files() interface - Allow screen domains to configure tty and setup sock_file in ~/.screen directory - ALlow setroubleshoot to read default_context_t, needed to backport to F18 - Label /etc/owncloud as being an apache writable directory - Allow sshd to stream connect to an lxc domain- Allow postgresql to manage rgmanager pid files - Allow postgresql to read ccs data - Allow systemd_domain to send dbus messages to policykit - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them - All systemd domains that create content are reading the file_context file and setfscreate - Systemd domains need to search through init_var_run_t - Allow sshd to communicate with libvirt to set containers labels - Add interface to manage pid files - Allow NetworkManger_t to read /etc/hostname - Dontaudit leaked locked files into openshift_domains - Add fixes for oo-cgroup-read - it nows creates tmp files - Allow gluster to manage all directories as well as files - Dontaudit chrome_sandbox_nacl_t using user terminals - Allow sysstat to manage its own log files - Allow virtual machines to setrlimit and send itself signals. - Add labeling for /var/run/hplip- Fix POSTIN scriptlet- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp- Fix authconfig.py labeling - Make any domains that write homedir content do it correctly - Allow glusterd to read/write anyhwere on the file system by default - Be a little more liberal with the rsync log files - Fix iscsi_admin interface - Allow iscsid_t to read /dev/urand - Fix up iscsi domain for use with unit files - Add filename transition support for spamassassin policy - Allow web plugins to use badly formated libraries - Allow nmbd_t to create samba_var_t directories - Add filename transition support for spamassassin policy - Add filename transition support for tvtime - Fix alsa_home_filetrans_alsa_home() interface - Move all userdom_filetrans_home_content() calling out of booleans - Allow logrotote to getattr on all file sytems - Remove duplicate userdom_filetrans_home_content() calling - Allow kadmind to read /etc/passwd - Dontaudit append .xsession-errors file on ecryptfs for policykit-auth - Allow antivirus domain to manage antivirus db links - Allow logrotate to read /sys - Allow mandb to setattr on man dirs - Remove mozilla_plugin_enable_homedirs boolean - Fix ftp_home_dir boolean - homedir mozilla filetrans has been moved to userdom_home_manager - homedir telepathy filetrans has been moved to userdom_home_manager - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd() - Might want to eventually write a daemon on fusefsd. - Add policy fixes for sshd [net] child from plautrba@redhat.com - Tor uses a new port - Remove bin_t for authconfig.py - Fix so only one call to userdom_home_file_trans - Allow home_manager_types to create content with the correctl label - Fix all domains that write data into the homedir to do it with the correct label - Change the postgresql to use proper boolean names, which is causing httpd_t to - not get access to postgresql_var_run_t - Hostname needs to send syslog messages - Localectl needs to be able to send dbus signals to users - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default - Allow user_home_manger domains to create spam* homedir content with correct labeling - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working - Declare userdom_filetrans_type attribute - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute - fusefsd is mounding a fuse file system on /run/user/UID/gvfs- Man pages are now generated in the build process - Allow cgred to list inotifyfs filesystem- Allow gluster to get attrs on all fs - New access required for virt-sandbox - Allow dnsmasq to execute bin_t - Allow dnsmasq to create content in /var/run/NetworkManager - Fix openshift_initrc_signal() interface - Dontaudit openshift domains doing getattr on other domains - Allow consolehelper domain to communicate with session bus - Mock should not be transitioning to any other domains, we should keep mock_t as mock_t - Update virt_qemu_ga_t policy - Allow authconfig running from realmd to restart oddjob service - Add systemd support for oddjob - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd - Add labeling for gnashpluginrc - Allow chrome_nacl to execute /dev/zero - Allow condor domains to read /proc - mozilla_plugin_t will getattr on /core if firefox crashes - Allow condor domains to read /etc/passwd - Allow dnsmasq to execute shell scripts, openstack requires this access - Fix glusterd labeling - Allow virtd_t to interact with the socket type - Allow nmbd_t to override dac if you turned on sharing all files - Allow tuned to created kobject_uevent socket - Allow guest user to run fusermount - Allow openshift to read /proc and locale - Allow realmd to dbus chat with rpm - Add new interface for virt - Remove depracated interfaces - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t - Remove some more unconfined_t process transitions, that I don't believe are necessary - Stop transitioning uncofnined_t to checkpc - dmraid creates /var/lock/dmraid - Allow systemd_localed to creatre unix_dgram_sockets - Allow systemd_localed to write kernel messages. - Also cleanup systemd definition a little. - Fix userdom_restricted_xwindows_user_template() interface - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t - User accounts need to dbus chat with accountsd daemon - Gnome requires all users to be able to read /proc/1/- virsh now does a setexeccon call - Additional rules required by openshift domains - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work - Allow spamd_update_t to search spamc_home_t - Avcs discovered by mounting an isci device under /mnt - Allow lspci running as logrotate to read pci.ids - Additional fix for networkmanager_read_pid_files() - Fix networkmanager_read_pid_files() interface - Allow all svirt domains to connect to svirt_socket_t - Allow virsh to set SELinux context for a process. - Allow tuned to create netlink_kobject_uevent_socket - Allow systemd-timestamp to set SELinux context - Add support for /var/lib/systemd/linger - Fix ssh_sysadm_login to be working on MLS as expected- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file - Add missing files_rw_inherited_tmp_files interface - Add additional interface for ecryptfs - ALlow nova-cert to connect to postgresql - Allow keystone to connect to postgresql - Allow all cups domains to getattr on filesystems - Allow pppd to send signull - Allow tuned to execute ldconfig - Allow gpg to read fips_enabled - Add additional fixes for ecryptfs - Allow httpd to work with posgresql - Allow keystone getsched and setsched- Allow gpg to read fips_enabled - Add support for /var/cache/realmd - Add support for /usr/sbin/blazer_usb and systemd support for nut - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t - bitlbee wants to read own log file - Allow glance domain to send a signal itself - Allow xend_t to request that the kernel load a kernel module - Allow pacemaker to execute heartbeat lib files - cleanup new swift policy- Fix smartmontools - Fix userdom_restricted_xwindows_user_template() interface - Add xserver_xdm_ioctl_log() interface - Allow Xusers to ioctl lxdm.log to make lxdm working - Add MLS fixes to make MLS boot/log-in working - Add mls_socket_write_all_levels() also for syslogd - fsck.xfs needs to read passwd - Fix ntp_filetrans_named_content calling in init.te - Allow postgresql to create pg_log dir - Allow sshd to read rsync_data_t to make rsync working - Change ntp.conf to be labeled net_conf_t - Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it - Allow xdm_t to execute gstreamer home content - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp - New policy for openstack swift domains - More access required for openshift_cron_t - Use cupsd_log_t instead of cupsd_var_log_t - rpm_script_roles should be used in rpm_run - Fix rpm_run() interface - Fix openshift_initrc_run() - Fix sssd_dontaudit_stream_connect() interface - Fix sssd_dontaudit_stream_connect() interface - Allow LDA's job to deliver mail to the mailbox - dontaudit block_suspend for mozilla_plugin_t - Allow l2tpd_t to all signal perms - Allow uuidgen to read /dev/random - Allow mozilla-plugin-config to read power_supply info - Implement cups_domain attribute for cups domains - We now need access to user terminals since we start by executing a command outside the tty - We now need access to user terminals since we start by executing a command outside the tty - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen - Add containment of openshift cron jobs - Allow system cron jobs to create tmp directories - Make userhelp_conf_t a config file - Change rpm to use rpm_script_roles - More fixes for rsync to make rsync wokring - Allow logwatch to domtrans to mdadm - Allow pacemaker to domtrans to ifconfig - Allow pacemaker to setattr on corosync.log - Add pacemaker_use_execmem for memcheck-amd64 command - Allow block_suspend capability - Allow create fifo_file in /tmp with pacemaker_tmp_t - Allow systat to getattr on fixed disk - Relabel /etc/ntp.conf to be net_conf_t - ntp_admin should create files in /etc with the correct label - Add interface to create ntp_conf_t files in /etc - Add additional labeling for quantum - Allow quantum to execute dnsmasq with transition- boinc_cliean wants also execmem as boinc projecs have - Allow sa-update to search admin home for /root/.spamassassin - Allow sa-update to search admin home for /root/.spamassassin - Allow antivirus domain to read net sysctl - Dontaudit attempts from thumb_t to connect to ssd - Dontaudit attempts by readahead to read sock_files - Dontaudit attempts by readahead to read sock_files - Create tmpfs file while running as wine as user_tmpfs_t - Dontaudit attempts by readahead to read sock_files - libmpg ships badly created librarie- Change ssh_use_pts to use macro and only inherited sshd_devpts_t - Allow confined users to read systemd_logind seat information - libmpg ships badly created libraries - Add support for strongswan.service - Add labeling for strongswan - Allow l2tpd_t to read network manager content in /run directory - Allow rsync to getattr any file in rsync_data_t - Add labeling and filename transition for .grl-podcasts- mount.glusterfs executes glusterfsd binary - Allow systemd_hostnamed_t to stream connect to systemd - Dontaudit any user doing a access check - Allow obex-data-server to request the kernel to load a module - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info) - Allow gpg-agent to read /proc/sys/crypto/fips_enabled - Add new types for antivirus.pp policy module - Allow gnomesystemmm_t caps because of ioprio_set - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t - Allow gnomesystemmm_t caps because of ioprio_set - Allow NM rawip socket - files_relabel_non_security_files can not be used with boolean - Add interface to thumb_t dbus_chat to allow it to read remote process state - ALlow logrotate to domtrans to mdadm_t - kde gnomeclock wants to write content to /tmp- kde gnomeclock wants to write content to /tmp - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde - Allow blueman_t to rwx zero_device_t, for some kind of jre - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre - Ftp full access should be allowed to create directories as well as files - Add boolean to allow rsync_full_acces, so that an rsync server can write all - over the local machine - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6 - Add missing vpnc_roles type line - Allow stapserver to write content in /tmp - Allow gnome keyring to create keyrings dir in ~/.local/share - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Add interface to colord_t dbus_chat to allow it to read remote process state - Allow colord_t to read cupsd_t state - Add mate-thumbnail-font as thumnailer - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data. - Allow qpidd to list /tmp. Needed by ssl - Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18 - - Added systemd support for ksmtuned - Added booleans ksmtuned_use_nfs ksmtuned_use_cifs - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow - Looks like qpidd_t needs to read /dev/random - Lots of probing avc's caused by execugting gpg from staff_t - Dontaudit senmail triggering a net_admin avc - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port - Logwatch does access check on mdadm binary - Add raid_access_check_mdadm() iterface- Fix systemd_manage_unit_symlinks() interface - Call systemd_manage_unit_symlinks(() which is correct interface - Add filename transition for opasswd - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow sytstemd-timedated to get status of init_t - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow gpg_t to manage all gnome files - Stop using pcscd_read_pub_files - New rules for xguest, dontaudit attempts to dbus chat - Allow firewalld to create its mmap files in tmpfs and tmp directories - Allow firewalld to create its mmap files in tmpfs and tmp directories - run unbound-chkconf as named_t, so it can read dnssec - Colord is reading xdm process state, probably reads state of any apps that sends dbus message - Allow mdadm_t to change the kernel scheduler - mythtv policy - Update mandb_admin() interface - Allow dsspam to listen on own tpc_socket - seutil_filetrans_named_content needs to be optional - Allow sysadm_t to execute content in his homedir - Add attach_queue to tun_socket, new patch from Paul Moore - Change most of selinux configuration types to security_file_type. - Add filename transition rules for selinux configuration - ssh into a box with -X -Y requires ssh_use_ptys - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated - New allow rules found by Tom London for systemd_hostnamed- Allow systemd-tmpfiles to relabel lpd spool files - Ad labeling for texlive bash scripts - Add xserver_filetrans_fonts_cache_home_content() interface - Remove duplicate rules from *.te - Add support for /var/lock/man-db.lock - Add support for /var/tmp/abrt(/.*)? - Add additional labeling for munin cgi scripts - Allow httpd_t to read munin conf files - Allow certwatch to read meminfo - Fix nscd_dontaudit_write_sock_file() interfac - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling- Allow gnomeclock to talk to puppet over dbus - Allow numad access discovered by Dominic - Add support for HOME_DIR/.maildir - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain - Allow udev to relabel udev_var_run_t lnk_files - New bin_t file in mcelog- Remove all mcs overrides and replace with t1 != mcs_constrained_types - Add attribute_role for iptables - mcs_process_set_categories needs to be called for type - Implement additional role_attribute statements - Sodo domain is attempting to get the additributes of proc_kcore_t - Unbound uses port 8953 - Allow svirt_t images to compromise_kernel when using pci-passthrough - Add label for dns lib files - Bluetooth aquires a dbus name - Remove redundant files_read_usr_file calling - Remove redundant files_read_etc_file calling - Fix mozilla_run_plugin() - Add role_attribute support for more domains- Mass merge with upstream- Bump the policy version to 28 to match selinux userspace - Rebuild versus latest libsepol- Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Add labeling for /var/named/chroot/etc/localtim- Allow setroubleshoot_fixit to execute rpm - zoneminder needs to connect to httpd ports where remote cameras are listening - Allow firewalld to execute content created in /run directory - Allow svirt_t to read generic certs - Dontaudit leaked ps content to mozilla plugin - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - init scripts are creating systemd_unit_file_t directories- systemd_logind_t is looking at all files under /run/user/apache - Allow systemd to manage all user tmp files - Add labeling for /var/named/chroot/etc/localtime - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6 - Keystone is now using a differnt port - Allow xdm_t to use usbmuxd daemon to control sound - Allow passwd daemon to execute gnome_exec_keyringd - Fix chrome_sandbox policy - Add labeling for /var/run/checkquorum-timer - More fixes for the dspam domain, needs back port to RHEL6 - More fixes for the dspam domain, needs back port to RHEL6 - sssd needs to connect to kerberos password port if a user changes his password - Lots of fixes from RHEL testing of dspam web - Allow chrome and mozilla_plugin to create msgq and semaphores - Fixes for dspam cgi scripts - Fixes for dspam cgi scripts - Allow confine users to ptrace screen - Backport virt_qemu_ga_t changes from RHEL - Fix labeling for dspam.cgi needed for RHEL6 - We need to back port this policy to RHEL6, for lxc domains - Dontaudit attempts to set sys_resource of logrotate - Allow corosync to read/write wdmd's tmpfs files - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set - Allow cron jobs to read bind config for unbound - libvirt needs to inhibit systemd - kdumpctl needs to delete boot_t files - Fix duplicate gnome_config_filetrans - virtd_lxc_t is using /dev/fuse - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift - apcupsd can be setup to listen to snmp trafic - Allow transition from kdumpgui to kdumpctl - Add fixes for munin CGI scripts - Allow deltacloud to connect to openstack at the keystone port - Allow domains that transition to svirt domains to be able to signal them - Fix file context of gstreamer in .cache directory - libvirt is communicating with logind - NetworkManager writes to the systemd inhibit pipe- Allow munin disk plugins to get attributes of all directories - Allow munin disk plugins to get attributes of all directorie - Allow logwatch to get attributes of all directories - Fix networkmanager_manage_lib() interface - Fix gnome_manage_config() to allow to manage sock_file - Fix virtual_domain_context - Add support for dynamic DNS for DHCPv6- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch - Add additional labeling for /var/www/openshift/broker - Fix rhev policy - Allow openshift_initrc domain to dbus chat with systemd_logind - Allow httpd to getattr passenger log file if run_stickshift - Allow consolehelper-gtk to connect to xserver - Add labeling for the tmp-inst directory defined in pam_namespace.conf - Add lvm_metadata_t labeling for /etc/multipath- consoletype is no longer used- Add label for efivarfs - Allow certmonger to send signal to itself - Allow plugin-config to read own process status - Add more fixes for pacemaker - apache/drupal can run clamscan on uploaded content - Allow chrome_sandbox_nacl_t to read pid 1 content- Fix MCS Constraints to control ingres and egres controls on the network. - Change name of svirt_nokvm_t to svirt_tcg_t - Allow tuned to request the kernel to load kernel modules- Label /var/lib/pgsql/.ssh as ssh_home_t - Add labeling for /usr/bin/pg_ctl - Allow systemd-logind to manage keyring user tmp dirs - Add support for 7389/tcp port - gems seems to be placed in lots of places - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus - Add back tcp/8123 port as http_cache port - Add ovirt-guest-agent\.pid labeling - Allow xend to run scsi_id - Allow rhsmcertd-worker to read "physical_package_id" - Allow pki_tomcat to connect to ldap port - Allow lpr to read /usr/share/fonts - Allow open file from CD/DVD drive on domU - Allow munin services plugins to talk to SSSD - Allow all samba domains to create samba directory in var_t directories - Take away svirt_t ability to use nsswitch - Dontaudit attempts by openshift to read apache logs - Allow apache to create as well as append _ra_content_t - Dontaudit sendmail_t reading a leaked file descriptor - Add interface to have admin transition /etc/prelink.cache to the proper label - Add sntp support to ntp policy - Allow firewalld to dbus chat with devicekit_power - Allow tuned to call lsblk - Allow tor to read /proc/sys/kernel/random/uuid - Add tor_can_network_relay boolean- Add openshift_initrc_signal() interface - Fix typos - dspam port is treat as spamd_port_t - Allow setroubleshoot to getattr on all executables - Allow tuned to execute profiles scripts in /etc/tuned - Allow apache to create directories to store its log files - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6 - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM - Add filename transition for /etc/tuned/active_profile - Allow condor_master to send mails - Allow condor_master to read submit.cf - Allow condor_master to create /tmp files/dirs - Allow condor_mater to send sigkill to other condor domains - Allow condor_procd sigkill capability - tuned-adm wants to talk with tuned daemon - Allow kadmind and krb5kdc to also list sssd_public_t - Allow accountsd to dbus chat with init - Fix git_read_generic_system_content_files() interface - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler" - Fix mozilla_plugin_can_network_connect to allow to connect to all ports - Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t - dspam wants to search /var/spool for opendkim data - Revert "Add support for tcp/10026 port as dspam_port_t" - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6 - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain - Allow systemd_tmpfiles_t to setattr on mandb_cache_t- consolekit.pp was not removed from the postinstall script- Add back consolekit policy - Silence bootloader trying to use inherited tty - Silence xdm_dbusd_t trying to execute telepathy apps - Fix shutdown avcs when machine has unconfined.pp disabled - The host and a virtual machine can share the same printer on a usb device - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob - Allow abrt_watch_log_t to execute bin_t - Allow chrome sandbox to write content in ~/.config/chromium - Dontaudit setattr on fontconfig dir for thumb_t - Allow lircd to request the kernel to load module - Make rsync as userdom_home_manager - Allow rsync to search automount filesystem - Add fixes for pacemaker- Add support for 4567/tcp port - Random fixes from Tuomo Soini - xdm wants to get init status - Allow programs to run in fips_mode - Add interface to allow the reading of all blk device nodes - Allow init to relabel rpcbind sock_file - Fix labeling for lastlog and faillog related to logrotate - ALlow aeolus_configserver to use TRAM port - Add fixes for aeolus_configserver - Allow snmpd to connect to snmp port - Allow spamd_update to create spamd_var_lib_t directories - Allow domains that can read sssd_public_t files to also list the directory - Remove miscfiles_read_localization, this is defined for all domains- Allow syslogd to request the kernel to load a module - Allow syslogd_t to read the network state information - Allow xdm_dbusd_t connect to the system DBUS - Add support for 7389/tcp port - Allow domains to read/write all inherited sockets - Allow staff_t to read kmsg - Add awstats_purge_apache_log boolean - Allow ksysguardproces to read /.config/Trolltech.conf - Allow passenger to create and append puppet log files - Add puppet_append_log and puppet_create_log interfaces - Add puppet_manage_log() interface - Allow tomcat domain to search tomcat_var_lib_t - Allow pki_tomcat_t to connect to pki_ca ports - Allow pegasus_t to have net_admin capability - Allow pegasus_t to write /sys/class/net//flags - Allow mailserver_delivery to manage mail_home_rw_t lnk_files - Allow fetchmail to create log files - Allow gnomeclock to manage home config in .kde - Allow bittlebee to read kernel sysctls - Allow logrotate to list /root- Fix userhelper_console_role_template() - Allow enabling Network Access Point service using blueman - Make vmware_host_t as unconfined domain - Allow authenticate users in webaccess via squid, using mysql as backend - Allow gathers to get various metrics on mounted file systems - Allow firewalld to read /etc/hosts - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t - Allow kdumpgui to read/write to zipl.conf - Commands needed to get mock to build from staff_t in enforcing mode - Allow mdadm_t to manage cgroup files - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files - dontaudit ifconfig_t looking at fifo_files that are leaked to it - Add lableing for Quest Authentication System- Fix filetrans interface definitions - Dontaudit xdm_t to getattr on BOINC lib files - Add systemd_reload_all_services() interface - Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files - Allow accountsd to dbus chat with gdm - Allow realmd to getattr on all fs - Allow logrotate to reload all services - Add systemd unit file for radiusd - Allow winbind to create samba pid dir - Add labeling for /var/nmbd/unexpected - Allow chrome and mozilla plugin to connect to msnp ports- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file - Dontaudit setfiles reading /dev/random - On initial boot gnomeclock is going to need to be set buy gdm - Fix tftp_read_content() interface - Random apps looking at kernel file systems - Testing virt with lxc requiers additional access for virsh_t - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container - Allow MPD to read /dev/radnom - Allow sandbox_web_type to read logind files which needs to read pulseaudio - Allow mozilla plugins to read /dev/hpet - Add labeling for /var/lib/zarafa-webap - Allow BOINC client to use an HTTP proxy for all connections - Allow rhsmertd to domain transition to dmidecod - Allow setroubleshootd to send D-Bus msg to ABRT- Define usbtty_device_t as a term_tty - Allow svnserve to accept a connection - Allow xend manage default virt_image_t type - Allow prelink_cron_system_t to overide user componant when executing cp - Add labeling for z-push - Gnomeclock sets the realtime clock - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd - Allow lxc domains to use /dev/random and /dev/urandom- Add port defintion for tcp/9000 - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API - Allow shorewall_t to create netlink_socket - Allow krb5admind to block suspend - Fix labels on /var/run/dlm_controld /var/log/dlm_controld - Allow krb5kdc to block suspend - gnomessytemmm_t needs to read /etc/passwd - Allow cgred to read all sysctls- Allow all domains to read /proc/sys/vm/overcommit_memory - Make proc_numa_t an MLS Trusted Object - Add /proc/numactl support for confined users - Allow ssh_t to connect to any port > 1023 - Add openvswitch domain - Pulseaudio tries to create directories in gnome_home_t directories - New ypbind pkg wants to search /var/run which is caused by sd_notify - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans - Allow sanlock to read /dev/random - Treat php-fpm with httpd_t - Allow domains that can read named_conf_t to be able to list the directories - Allow winbind to create sock files in /var/run/samba- Add smsd policy - Add support for OpenShift sbin labelin - Add boolean to allow virt to use rawip - Allow mozilla_plugin to read all file systems with noxattrs support - Allow kerberos to write on anon_inodefs fs - Additional access required by fenced - Add filename transitions for passwd.lock/group.lock - UPdate man pages - Create coolkey directory in /var/cache with the correct label- Fix label on /etc/group.lock - Allow gnomeclock to create lnk_file in /etc - label /root/.pki as a home_cert_t - Add interface to make sure rpcbind.sock is created with the correct label - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules - opendkim should be a part of milter - Allow libvirt to set the kernel sched algorythm - Allow mongod to read sysfs_t - Add authconfig policy - Remove calls to miscfiles_read_localization all domains get this - Allow virsh_t to read /root/.pki/ content - Add label for log directory under /var/www/stickshift- Allow getty to setattr on usb ttys - Allow sshd to search all directories for sshd_home_t content - Allow staff domains to send dbus messages to kdumpgui - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t - Dontaudit setfiles reading urand - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir - Allow systemd-timedated to read /dev/urandom - Allow entropyd_t to read proc_t (meminfo) - Add unconfined munin plugin - Fix networkmanager_read_conf() interface - Allow blueman to list /tmp which is needed by sys_nic/setsched - Fix label of /etc/mail/aliasesdb-stamp - numad is searching cgroups - realmd is communicating with networkmanager using dbus - Lots of fixes to try to get kdump to work- Allow loging programs to dbus chat with realmd - Make apache_content_template calling as optional - realmd is using policy kit- Add new selinuxuser_use_ssh_chroot boolean - dbus needs to be able to read/write inherited fixed disk device_t passed through it - Cleanup netutils process allow rule - Dontaudit leaked fifo files from openshift to ping - sanlock needs to read mnt_t lnk files - Fail2ban needs to setsched and sys_nice- Change default label of all files in /var/run/rpcbind - Allow sandbox domains (java) to read hugetlbfs_t - Allow awstats cgi content to create tmp files and read apache log files - Allow setuid/setgid for cupsd-config - Allow setsched/sys_nice pro cupsd-config - Fix /etc/localtime sym link to be labeled locale_t - Allow sshd to search postgresql db t since this is a homedir - Allow xwindows users to chat with realmd - Allow unconfined domains to configure all files and null_device_t service- Adopt pki-selinux policy- pki is leaking which we dontaudit until a pki code fix - Allow setcap for arping - Update man pages - Add labeling for /usr/sbin/mcollectived - pki fixes - Allow smokeping to execute fping in the netutils_t domain- Allow mount to relabelfrom unlabeled file systems - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working - Add label to get bin files under libreoffice labeled correctly - Fix interface to allow executing of base_ro_file_type - Add fixes for realmd - Update pki policy - Add tftp_homedir boolean - Allow blueman sched_setscheduler - openshift user domains wants to r/w ssh tcp sockets- Additional requirements for disable unconfined module when booting - Fix label of systemd script files - semanage can use -F /dev/stdin to get input - syslog now uses kerberos keytabs - Allow xserver to compromise_kernel access - Allow nfsd to write to mount_var_run_t when running the mount command - Add filename transition rule for bin_t directories - Allow files to read usr_t lnk_files - dhcpc wants chown - Add support for new openshift labeling - Clean up for tunable+optional statements - Add labeling for /usr/sbin/mkhomedir_helper - Allow antivirus domain to managa amavis spool files - Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool- Add interfaces to read kernel_t proc info - Missed this version of exec_all - Allow anyone who can load a kernel module to compromise kernel - Add oddjob_dbus_chat to openshift apache policy - Allow chrome_sandbox_nacl_t to send signals to itself - Add unit file support to usbmuxd_t - Allow all openshift domains to read sysfs info - Allow openshift domains to getattr on all domains- MLS fixes from Dan - Fix name of capability2 secure_firmware->compromise_kerne- Allow xdm to search all file systems - Add interface to allow the config of all files - Add rngd policy - Remove kgpg as a gpg_exec_t type - Allow plymouthd to block suspend - Allow systemd_dbus to config any file - Allow system_dbus_t to configure all services - Allow freshclam_t to read usr_files - varnishd requires execmem to load modules- Allow semanage to verify types - Allow sudo domain to execute user home files - Allow session_bus_type to transition to user_tmpfs_t - Add dontaudit caused by yum updates - Implement pki policy but not activated- tuned wants to getattr on all filesystems - tuned needs also setsched. The build is needed for test day- Add policy for qemu-qa - Allow razor to write own config files - Add an initial antivirus policy to collect all antivirus program - Allow qdisk to read usr_t - Add additional caps for vmware_host - Allow tmpfiles_t to setattr on mandb_cache_t - Dontaudit leaked files into mozilla_plugin_config_t - Allow wdmd to getattr on tmpfs - Allow realmd to use /dev/random - allow containers to send audit messages - Allow root mount any file via loop device with enforcing mls policy - Allow tmpfiles_t to setattr on mandb_cache_t - Allow tmpfiles_t to setattr on mandb_cache_t - Make userdom_dontaudit_write_all_ not allow open - Allow init scripts to read all unit files - Add support for saphostctrl ports- Add kernel_read_system_state to sandbox_client_t - Add some of the missing access to kdumpgui - Allow systemd_dbusd_t to status the init system - Allow vmnet-natd to request the kernel to load a module - Allow gsf-office-thum to append .cache/gdm/session.log - realmd wants to read .config/dconf/user - Firewalld wants sys_nice/setsched - Allow tmpreaper to delete mandb cache files - Firewalld wants sys_nice/setsched - Allow firewalld to perform a DNS name resolution - Allown winbind to read /usr/share/samba/codepages/lowcase.dat - Add support for HTTPProxy* in /etc/freshclam.conf - Fix authlogin_yubike boolean - Extend smbd_selinux man page to include samba booleans - Allow dhcpc to execute consoletype - Allow ping to use inherited tmp files created in init scripts - On full relabel with unconfined domain disabled, initrc was running some chcon's - Allow people who delete man pages to delete mandb cache files- Add missing permissive domains- Add new mandb policy - ALlow systemd-tmpfiles_t to relabel mandb_cache_t - Allow logrotate to start all unit files- Add fixes for ctbd - Allow nmbd to stream connect to ctbd - Make cglear_t as nsswitch_domain - Fix bogus in interfaces - Allow openshift to read/write postfix public pipe - Add postfix_manage_spool_maildrop_files() interface - stickshift paths have been renamed to openshift - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes - Update man pages, adding ENTRYPOINTS- Add mei_device_t - Make sure gpg content in homedir created with correct label - Allow dmesg to write to abrt cache files - automount wants to search virtual memory sysctls - Add support for hplip logs stored in /var/log/hp/tmp - Add labeling for /etc/owncloud/config.php - Allow setroubleshoot to send analysys to syslogd-journal - Allow virsh_t to interact with new fenced daemon - Allow gpg to write to /etc/mail/spamassassiin directories - Make dovecot_deliver_t a mail server delivery type - Add label for /var/tmp/DNS25- Fixes for tomcat_domain template interface- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes - Add attribute to all base os types. Allow all domains to read all ro base OS types- Additional unit files to be defined as power unit files - Fix more boolean names- Fix boolean name so subs will continue to work- dbus needs to start getty unit files - Add interface to allow system_dbusd_t to start the poweroff service - xdm wants to exec telepathy apps - Allow users to send messages to systemdlogind - Additional rules needed for systemd and other boot apps - systemd wants to list /home and /boot - Allow gkeyringd to write dbus/conf file - realmd needs to read /dev/urand - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded- Fixes to safe more rules - Re-write tomcat_domain_template() - Fix passenger labeling - Allow all domains to read man pages - Add ephemeral_port_t to the 'generic' port interfaces - Fix the names of postgresql booleans- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer - Move netlable_peer check out of booleans - Remove call to recvfrom_netlabel for kerberos call - Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules - Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface - Allow rndc to block suspend - tuned needs to modify the schedule of the kernel - Allow svirt_t domains to read alsa configuration files - ighten security on irc domains and make sure they label content in homedir correctly - Add filetrans_home_content for irc files - Dontaudit all getattr access for devices and filesystems for sandbox domains - Allow stapserver to search cgroups directories - Allow all postfix domains to talk to spamd- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check - Change pam_t to pam_timestamp_t - Add dovecot_domain attribute and allow this attribute block_suspend capability2 - Add sanlock_use_fusefs boolean - numad wants send/recieve msg - Allow rhnsd to send syslog msgs - Make piranha-pulse as initrc domain - Update openshift instances to dontaudit setattr until the kernel is fixed.- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd - Remove pam_selinux.8 which conflicts with man page owned by the pam package - Allow glance-api to talk to mysql - ABRT wants to read Xorg.0.log if if it detects problem with Xorg - Fix gstreamer filename trans. interface- Man page fixes by Dan Walsh- Allow postalias to read postfix config files - Allow man2html to read man pages - Allow rhev-agentd to search all mountpoints - Allow rhsmcertd to read /dev/random - Add tgtd_stream_connect() interface - Add cyrus_write_data() interface - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t - Add port definition for tcp/81 as http_port_t - Fix /dev/twa labeling - Allow systemd to read modules config- Merge openshift policy - Allow xauth to read /dev/urandom - systemd needs to relabel content in /run/systemd directories - Files unconfined should be able to perform all services on all files - Puppet tmp file can be leaked to all domains - Dontaudit rhsmcertd-worker to search /root/.local - Allow chown capability for zarafa domains - Allow system cronjobs to runcon into openshift domains - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories- nmbd wants to create /var/nmbd - Stop transitioning out of anaconda and firstboot, just causes AVC messages - Allow clamscan to read /etc files - Allow bcfg2 to bind cyphesis port - heartbeat should be run as rgmanager_t instead of corosync_t - Add labeling for /etc/openldap/certs - Add labeling for /opt/sartest directory - Make crontab_t as userdom home reader - Allow tmpreaper to list admin_home dir - Add defition for imap_0 replay cache file - Add support for gitolite3 - Allow virsh_t to send syslog messages - allow domains that can read samba content to be able to list the directories also - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd - Separate out sandbox from sandboxX policy so we can disable it by default - Run dmeventd as lvm_t - Mounting on any directory requires setattr and write permissions - Fix use_nfs_home_dirs() boolean - New labels for pam_krb5 - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0 - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs - Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles- Allow realmd to read resolv.conf - Add pegasus_cache_t type - Label /usr/sbin/fence_virtd as virsh_exec_t - Add policy for pkcsslotd - Add support for cpglockd - Allow polkit-agent-helper to read system-auth-ac - telepathy-idle wants to read gschemas.compiled - Allow plymouthd to getattr on fs_t - Add slpd policy - Allow ksysguardproces to read/write config_usr_t- Fix labeling substitution so rpm will label /lib/systemd content correctly- Add file name transitions for ttyACM0 - spice-vdagent(d)'s are going to log over to syslog - Add sensord policy - Add more fixes for passenger policy related to puppet - Allow wdmd to create wdmd_tmpfs_t - Fix labeling for /var/run/cachefilesd\.pid - Add thumb_tmpfs_t files type- Allow svirt domains to manage the network since this is containerized - Allow svirt_lxc_net_t to send audit messages- Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working - Allow dlm_controld to execute dlm_stonith labeled as bin_t - Allow GFS2 working on F17 - Abrt needs to execute dmesg - Allow jockey to list the contents of modeprobe.d - Add policy for lightsquid as squid_cron_t - Mailscanner is creating files and directories in /tmp - dmesg is now reading /dev/kmsg - Allow xserver to communicate with secure_firmware - Allow fsadm tools (fsck) to read /run/mount contnet - Allow sysadm types to read /dev/kmsg -- Allow postfix, sssd, rpcd to block_suspend - udev seems to need secure_firmware capability - Allow virtd to send dbus messages to firewalld so it can configure the firewall- Fix labeling of content in /run created by virsh_t - Allow condor domains to read kernel sysctls - Allow condor_master to connect to amqp - Allow thumb drives to create shared memory and semaphores - Allow abrt to read mozilla_plugin config files - Add labels for lightsquid - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow - dovecot_auth_t uses ldap for user auth - Allow domains that can read dhcp_etc_t to read lnk_files - Add more then one watchdog device - Allow useradd_t to manage etc_t files so it can rename it and edit them - Fix invalid class dir should be fifo_file - Move /run/blkid to fsadm and make sure labeling is correct- Fix bogus regex found by eparis - Fix manage run interface since lvm needs more access - syslogd is searching cgroups directory - Fixes to allow virt-sandbox-service to manage lxc var run content- Fix Boolean settings - Add new libjavascriptcoregtk as textrel_shlib_t - Allow xdm_t to create xdm_home_t directories - Additional access required for systemd - Dontaudit mozilla_plugin attempts to ipc_lock - Allow tmpreaper to delete unlabeled files - Eliminate screen_tmp_t and allow it to manage user_tmp_t - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors - Allow web plugins to connect to the asterisk ports - Condor will recreate the lock directory if it does not exist - Oddjob mkhomedir needs to connectto user processes - Make oddjob_mkhomedir_t a userdom home manager- Put placeholder back in place for proper numbering of capabilities - Systemd also configures init scripts- Fix ecryptfs interfaces - Bootloader seems to be trolling around /dev/shm and /dev - init wants to create /etc/systemd/system-update.target.wants - Fix systemd_filetrans call to move it out of tunable - Fix up policy to work with systemd userspace manager - Add secure_firmware capability and remove bogus epolwakeup - Call seutil_*_login_config interfaces where should be needed - Allow rhsmcertd to send signal to itself - Allow thin domains to send signal to itself - Allow Chrome_ChildIO to read dosfs_t- Add role rules for realmd, sambagui- Add new type selinux_login_config_t for /etc/selinux//logins/ - Additional fixes for seutil_manage_module_store() - dbus_system_domain() should be used with optional_policy - Fix svirt to be allowed to use fusefs file system - Allow login programs to read /run/ data created by systemd_login - sssd wants to write /etc/selinux//logins/ for SELinux PAM module - Fix svirt to be allowed to use fusefs file system - Allow piranha domain to use nsswitch - Sanlock needs to send Kill Signals to non root processes - Pulseaudio wants to execute /run/user/PID/.orc- Fix saslauthd when it tries to read /etc/shadow - Label gnome-boxes as a virt homedir - Need to allow svirt_t ability to getattr on nfs_t file systems - Update sanlock policy to solve all AVC's - Change confined users can optionally manage virt content - Handle new directories under ~/.cache - Add block suspend to appropriate domains - More rules required for containers - Allow login programs to read /run/ data created by systemd_logind - Allow staff users to run svirt_t processes- Update to upstream- More fixes for systemd to make rawhide booting from Dan Walsh- Add systemd fixes to make rawhide booting- Add systemd_logind_inhibit_var_run_t attribute - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type - Add interface for mysqld to dontaudit signull to all processes - Label new /var/run/journal directory correctly - Allow users to inhibit suspend via systemd - Add new type for the /var/run/inhibit directory - Add interface to send signull to systemd_login so avahi can send them - Allow systemd_passwd to send syslog messages - Remove corenet_all_recvfrom_unlabeled() calling fro policy files - Allow editparams.cgi running as httpd_bugzilla_script_t to read /etc/group - Allow smbd to read cluster config - Add additional labeling for passenger - Allow dbus to inhibit suspend via systemd - Allow avahi to send signull to systemd_login- Add interface to dontaudit getattr access on sysctls - Allow sshd to execute /bin/login - Looks like xdm is recreating the xdm directory in ~/.cache/ on login - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald - Fix semanage to work with unconfined domain disabled on F18 - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls - Virt seems to be using lock files - Dovecot seems to be searching directories of every mountpoint - Allow jockey to read random/urandom, execute shell and install third-party drivers - Add aditional params to allow cachedfiles to manage its content - gpg agent needs to read /dev/random - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write - Add a bunch of dontaudit rules to quiet svirt_lxc domains - Additional perms needed to run svirt_lxc domains - Allow cgclear to read cgconfig - Allow sys_ptrace capability for snmp - Allow freshclam to read /proc - Allow procmail to manage /home/user/Maildir content - Allow NM to execute wpa_cli - Allow amavis to read clamd system state - Regenerate man pages- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild- Add realmd and stapserver policies - Allow useradd to manage stap-server lib files - Tighten up capabilities for confined users - Label /etc/security/opasswd as shadow_t - Add label for /dev/ecryptfs - Allow condor_startd_t to start sshd with the ranged - Allow lpstat.cups to read fips_enabled file - Allow pyzor running as spamc_t to create /root/.pyzor directory - Add labelinf for amavisd-snmp init script - Add support for amavisd-snmp - Allow fprintd sigkill self - Allow xend (w/o libvirt) to start virtual machines - Allow aiccu to read /etc/passwd - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes - Add condor_startd_ranged_domtrans_to() interface - Add ssd_conf_t for /etc/sssd - accountsd needs to fchown some files/directories - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit - Allow xend_t to read the /etc/passwd file- Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t - Add init_access_check() interface - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t - Allow tcpdump to create a netlink_socket - Label newusers like useradd - Change xdm log files to be labeled xdm_log_t - Allow sshd_t with privsep to work in MLS - Allow freshclam to update databases thru HTTP proxy - Allow s-m-config to access check on systemd - Allow abrt to read public files by default - Fix amavis_create_pid_files() interface - Add labeling and filename transition for dbomatic.log - Allow system_dbusd_t to stream connect to bluetooth, and use its socket - Allow amavisd to execute fsav - Allow tuned to use sys_admin and sys_nice capabilities - Add php-fpm policy from Bryan - Add labeling for aeolus-configserver-thinwrapper - Allow thin domains to execute shell - Fix gnome_role_gkeyringd() interface description - Lot of interface fixes - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files - Allow OpenMPI job to use kerberos - Make deltacloudd_t as nsswitch_domain - Allow xend_t to run lsscsi - Allow qemu-dm running as xend_t to create tun_socket - Add labeling for /opt/brother/Printers(.*/)?inf - Allow jockey-backend to read pyconfig-64.h labeled as usr_t - Fix clamscan_can_scan_system boolean - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11- initrc is calling exportfs which is not confined so it attempts to read nfsd_files - Fixes for passenger running within openshift. - Add labeling for all tomcat6 dirs - Add support for tomcat6 - Allow cobblerd to read /etc/passwd - Allow jockey to read sysfs and and execute binaries with bin_t - Allow thum to use user terminals - Allow cgclear to read cgconfig config files - Fix bcf2g.fc - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains - Allow dbomatic to execute ruby - abrt_watch_log should be abrt_domain - Allow mozilla_plugin to connect to gatekeeper port- add ptrace_child access to process - remove files_read_etc_files() calling from all policies which have auth_use_nsswith() - Allow boinc domains to manage boinc_lib_t lnk_files - Add support for boinc-client.service unit file - Add support for boinc.log - Allow mozilla_plugin execmod on mozilla home files if allow_ex - Allow dovecot_deliver_t to read dovecot_var_run_t - Allow ldconfig and insmod to manage kdumpctl tmp files - Move thin policy out from cloudform.pp and add a new thin poli - pacemaker needs to communicate with corosync streams - abrt is now started on demand by dbus - Allow certmonger to talk directly to Dogtag servers - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c - Allow mozila_plugin to execute gstreamer home files - Allow useradd to delete all file types stored in the users hom - rhsmcertd reads the rpm database - Add support for lightdm- Add tomcat policy - Remove pyzor/razor policy - rhsmcertd reads the rpm database - Dontaudit thumb to setattr on xdm_tmp dir - Allow wicd to execute ldconfig in the networkmanager_t domain - Add /var/run/cherokee\.pid labeling - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too - Allow postfix-master to r/w pipes other postfix domains - Allow snort to create netlink_socket - Add kdumpctl policy - Allow firstboot to create tmp_t files/directories - /usr/bin/paster should not be labeled as piranha_exec_t - remove initrc_domain from tomcat - Allow ddclient to read /etc/passwd - Allow useradd to delete all file types stored in the users homedir - Allow ldconfig and insmod to manage kdumpctl tmp files - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those - Transition xauth files within firstboot_tmp_t - Fix labeling of /run/media to match /media - Label all lxdm.log as xserver_log_t - Add port definition for mxi port - Allow local_login_t to execute tmux- apcupsd needs to read /etc/passwd - Sanlock allso sends sigkill - Allow glance_registry to connect to the mysqld port - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl - Allow firefox plugins/flash to connect to port 1234 - Allow mozilla plugins to delete user_tmp_t files - Add transition name rule for printers.conf.O - Allow virt_lxc_t to read urand - Allow systemd_loigind to list gstreamer_home_dirs - Fix labeling for /usr/bin - Fixes for cloudform services * support FIPS - Allow polipo to work as web caching - Allow chfn to execute tmux- Add support for ecryptfs * ecryptfs does not support xattr * we need labeling for HOMEDIR - Add policy for (u)mount.ecryptfs* - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache - Allow dovecot to manage Maildir content, fix transitions to Maildir - Allow postfix_local to transition to dovecot_deliver - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code - Cleanup interface definitions - Allow apmd to change with the logind daemon - Changes required for sanlock in rhel6 - Label /run/user/apache as httpd_tmp_t - Allow thumb to use lib_t as execmod if boolean turned on - Allow squid to create the squid directory in /var with the correct labe - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com) - Allow virtd to exec xend_exec_t without transition - Allow virtd_lxc_t to unmount all file systems- PolicyKit path has changed - Allow httpd connect to dirsrv socket - Allow tuned to write generic kernel sysctls - Dontaudit logwatch to gettr on /dev/dm-2 - Allow policykit-auth to manage kerberos files - Make condor_startd and rgmanager as initrc domain - Allow virsh to read /etc/passwd - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs - xdm now needs to execute xsession_exec_t - Need labels for /var/lib/gdm - Fix files_filetrans_named_content() interface - Add new attribute - initrc_domain - Allow systemd_logind_t to signal, signull, sigkill all processes - Add filetrans rules for etc_runtime files- Rename boolean names to remove allow_- Mass merge with upstream * new policy topology to include contrib policy modules * we have now two base policy patches- Fix description of authlogin_nsswitch_use_ldap - Fix transition rule for rhsmcertd_t needed for RHEL7 - Allow useradd to list nfs state data - Allow openvpn to manage its log file and directory - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly - Allow thumb to use nvidia devices - Allow local_login to create user_tmp_t files for kerberos - Pulseaudio needs to read systemd_login /var/run content - virt should only transition named system_conf_t config files - Allow munin to execute its plugins - Allow nagios system plugin to read /etc/passwd - Allow plugin to connect to soundd port - Fix httpd_passwd to be able to ask passwords - Radius servers can use ldap for backing store - Seems to need to mount on /var/lib for xguest polyinstatiation to work. - Allow systemd_logind to list the contents of gnome keyring - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL - Add policy for isns-utils- Add policy for subversion daemon - Allow boinc to read passwd - Allow pads to read kernel network state - Fix man2html interface for sepolgen-ifgen - Remove extra /usr/lib/systemd/system/smb - Remove all /lib/systemd and replace with /usr/lib/systemd - Add policy for man2html - Fix the label of kerberos_home_t to krb5_home_t - Allow mozilla plugins to use Citrix - Allow tuned to read /proc/sys/kernel/nmi_watchdog - Allow tune /sys options via systemd's tmpfiles.d "w" type- Dontaudit lpr_t to read/write leaked mozilla tmp files - Add file name transition for .grl-podcasts directory - Allow corosync to read user tmp files - Allow fenced to create snmp lib dirs/files - More fixes for sge policy - Allow mozilla_plugin_t to execute any application - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain - Allow mongod to read system state information - Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t - Allow polipo to manage polipo_cache dirs - Add jabbar_client port to mozilla_plugin_t - Cleanup procmail policy - system bus will pass around open file descriptors on files that do not have labels on them - Allow l2tpd_t to read system state - Allow tuned to run ls /dev - Allow sudo domains to read usr_t files - Add label to machine-id - Fix corecmd_read_bin_symlinks cut and paste error- Fix pulseaudio port definition - Add labeling for condor_starter - Allow chfn_t to creat user_tmp_files - Allow chfn_t to execute bin_t - Allow prelink_cron_system_t to getpw calls - Allow sudo domains to manage kerberos rcache files - Allow user_mail_domains to work with courie - Port definitions necessary for running jboss apps within openshift - Add support for openstack-nova-metadata-api - Add support for nova-console* - Add support for openstack-nova-xvpvncproxy - Fixes to make privsep+SELinux working if we try to use chage to change passwd - Fix auth_role() interface - Allow numad to read sysfs - Allow matahari-rpcd to execute shell - Add label for ~/.spicec - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it - Devicekit_disk wants to read the logind sessions file when writing a cd - Add fixes for condor to make condor jobs working correctly - Change label of /var/log/rpmpkgs to cron_log_t - Access requires to allow systemd-tmpfiles --create to work. - Fix obex to be a user application started by the session bus. - Add additional filename trans rules for kerberos - Fix /var/run/heartbeat labeling - Allow apps that are managing rcache to file trans correctly - Allow openvpn to authenticate against ldap server - Containers need to listen to network starting and stopping events- Make systemd unit files less specific- Fix zarafa labeling - Allow guest_t to fix labeling - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean - add lxc_contexts - Allow accountsd to read /proc - Allow restorecond to getattr on all file sytems - tmpwatch now calls getpw - Allow apache daemon to transition to pwauth domain - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t - The obex socket seems to be a stream socket - dd label for /var/run/nologin- Allow jetty running as httpd_t to read hugetlbfs files - Allow sys_nice and setsched for rhsmcertd - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports - Allow setfiles to append to xdm_tmp_t - Add labeling for /export as a usr_t directory - Add labels for .grl files created by gstreamer- Add labeling for /usr/share/jetty/bin/jetty.sh - Add jetty policy which contains file type definitios - Allow jockey to use its own fifo_file and make this the default for all domains - Allow mozilla_plugins to use spice (vnc_port/couchdb) - asterisk wants to read the network state - Blueman now uses /var/lib/blueman- Add label for nodejs_debug - Allow mozilla_plugin_t to create ~/.pki directory and content- Add clamscan_can_scan_system boolean - Allow mysqld to read kernel network state - Allow sshd to read/write condor lib files - Allow sshd to read/write condor-startd tcp socket - Fix description on httpd_graceful_shutdown - Allow glance_registry to communicate with mysql - dbus_system_domain is using systemd to lauch applications - add interfaces to allow domains to send kill signals to user mail agents - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t - Lots of new access required for secure containers - Corosync needs sys_admin capability - ALlow colord to create shm - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific - Add boolean to control whether or not mozilla plugins can create random content in the users homedir - Add new interface to allow domains to list msyql_db directories, needed for libra - shutdown has to be allowed to delete etc_runtime_t - Fail2ban needs to read /etc/passwd - Allow ldconfig to create /var/cache/ldconfig - Allow tgtd to read hardware state information - Allow collectd to create packet socket - Allow chronyd to send signal to itself - Allow collectd to read /dev/random - Allow collectd to send signal to itself - firewalld needs to execute restorecon - Allow restorecon and other login domains to execute restorecon- Allow logrotate to getattr on systemd unit files - Add support for tor systemd unit file - Allow apmd to create /var/run/pm-utils with the correct label - Allow l2tpd to send sigkill to pppd - Allow pppd to stream connect to l2tpd - Add label for scripts in /etc/gdm/ - Allow systemd_logind_t to ignore mcs constraints on sigkill - Fix files_filetrans_system_conf_named_files() interface - Add labels for /usr/share/wordpress/wp-includes/*.php - Allow cobbler to get SELinux mode and booleans- Add unconfined_execmem_exec_t as an alias to bin_t - Allow fenced to read snmp var lib files, also allow it to read usr_t - ontaudit access checks on all executables from mozilla_plugin - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode - Allow systemd_tmpfiles_t to getattr all pipes and sockets - Allow glance-registry to send system log messages - semanage needs to manage mock lib files/dirs- Add policy for abrt-watch-log - Add definitions for jboss_messaging ports - Allow systemd_tmpfiles to manage printer devices - Allow oddjob to use nsswitch - Fix labeling of log files for postgresql - Allow mozilla_plugin_t to execmem and execstack by default - Allow firewalld to execute shell - Fix /etc/wicd content files to get created with the correct label - Allow mcelog to exec shell - Add ~/.orc as a gstreamer_home_t - /var/spool/postfix/lib64 should be labeled lib_t - mpreaper should be able to list all file system labeled directories - Add support for apache to use openstack - Add labeling for /etc/zipl.conf and zipl binary - Turn on allow_execstack and turn off telepathy transition for final release- More access required for virt_qmf_t - Additional assess required for systemd-logind to support multi-seat - Allow mozilla_plugin to setrlimit - Revert changes to fuse file system to stop deadlock- Allow condor domains to connect to ephemeral ports - More fixes for condor policy - Allow keystone to stream connect to mysqld - Allow mozilla_plugin_t to read generic USB device to support GPS devices - Allow thum to file name transition gstreamer home content - Allow thum to read all non security files - Allow glance_api_t to connect to ephemeral ports - Allow nagios plugins to read /dev/urandom - Allow syslogd to search postfix spool to support postfix chroot env - Fix labeling for /var/spool/postfix/dev - Allow wdmd chown - Label .esd_auth as pulseaudio_home_t - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now- Add support for clamd+systemd - Allow fresclam to execute systemctl to handle clamd - Change labeling for /usr/sbin/rpc.ypasswd.env - Allow yppaswd_t to execute yppaswd_exec_t - Allow yppaswd_t to read /etc/passwd - Gnomekeyring socket has been moved to /run/user/USER/ - Allow samba-net to connect to ldap port - Allow signal for vhostmd - allow mozilla_plugin_t to read user_home_t socket - New access required for secure Linux Containers - zfs now supports xattrs - Allow quantum to execute sudo and list sysfs - Allow init to dbus chat with the firewalld - Allow zebra to read /etc/passwd- Allow svirt_t to create content in the users homedir under ~/.libvirt - Fix label on /var/lib/heartbeat - Allow systemd_logind_t to send kill signals to all processes started by a user - Fuse now supports Xattr Support- upowered needs to setsched on the kernel - Allow mpd_t to manage log files - Allow xdm_t to create /var/run/systemd/multi-session-x - Add rules for missedfont.log to be used by thumb.fc - Additional access required for virt_qmf_t - Allow dhclient to dbus chat with the firewalld - Add label for lvmetad - Allow systemd_logind_t to remove userdomain sock_files - Allow cups to execute usr_t files - Fix labeling on nvidia shared libraries - wdmd_t needs access to sssd and /etc/passwd - Add boolean to allow ftp servers to run in passive mode - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with - Fix using httpd_use_fusefs - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox- Rename rdate port to time port, and allow gnomeclock to connect to it - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda - /etc/auto.* should be labeled bin_t - Add httpd_use_fusefs boolean - Add fixes for heartbeat - Allow sshd_t to signal processes that it transitions to - Add condor policy - Allow svirt to create monitors in ~/.libvirt - Allow dovecot to domtrans sendmail to handle sieve scripts - Lot of fixes for cfengine- /var/run/postmaster.* labeling is no longer needed - Alllow drbdadmin to read /dev/urandom - l2tpd_t seems to use ptmx - group+ and passwd+ should be labeled as /etc/passwd - Zarafa-indexer is a socket- Ensure lastlog is labeled correctly - Allow accountsd to read /proc data about gdm - Add fixes for tuned - Add bcfg2 fixes which were discovered during RHEL6 testing - More fixes for gnome-keyring socket being moved - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown - Fix description for files_dontaudit_read_security_files() interface- Add new policy and man page for bcfg2 - cgconfig needs to use getpw calls - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt - gnome-keyring wants to create a directory in cache_home_t - sanlock calls getpw- Add numad policy and numad man page - Add fixes for interface bugs discovered by SEWatch - Add /tmp support for squid - Add fix for #799102 * change default labeling for /var/run/slapd.* sockets - Make thumb_t as userdom_home_reader - label /var/lib/sss/mc same as pubconf, so getpw domains can read it - Allow smbspool running as cups_t to stream connect to nmbd - accounts needs to be able to execute passwd on behalf of users - Allow systemd_tmpfiles_t to delete boot flags - Allow dnssec_trigger to connect to apache ports - Allow gnome keyring to create sock_files in ~/.cache - google_authenticator is using .google_authenticator - sandbox running from within firefox is exposing more leaks - Dontaudit thumb to read/write /dev/card0 - Dontaudit getattr on init_exec_t for gnomeclock_t - Allow certmonger to do a transition to certmonger_unconfined_t - Allow dhcpc setsched which is caused by nmcli - Add rpm_exec_t for /usr/sbin/bcfg2 - system cronjobs are sending dbus messages to systemd_logind - Thumnailers read /dev/urand- Allow auditctl getcap - Allow vdagent to use libsystemd-login - Allow abrt-dump-oops to search /etc/abrt - Got these avc's while trying to print a boarding pass from firefox - Devicekit is now putting the media directory under /run/media - Allow thumbnailers to create content in ~/.thumbails directory - Add support for proL2TPd by Dominick Grift - Allow all domains to call getcap - wdmd seems to get a random chown capability check that it does not need - Allow vhostmd to read kernel sysctls- Allow chronyd to read unix - Allow hpfax to read /etc/passwd - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them - Allow rpcd to read quota_db_t - Update to man pages to match latest policy - Fix bug in jockey interface for sepolgen-ifgen - Add initial svirt_prot_exec_t policy- More fixes for systemd from Dan Walsh- Add a new type for /etc/firewalld and allow firewalld to write to this directory - Add definition for ~/Maildir, and allow mail deliver domains to write there - Allow polipo to run from a cron job - Allow rtkit to schedule wine processes - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label - Allow users domains to send signals to consolehelper domains- More fixes for boinc policy - Allow polipo domain to create its own cache dir and pid file - Add systemctl support to httpd domain - Add systemctl support to polipo, allow NetworkManager to manage the service - Add policy for jockey-backend - Add support for motion daemon which is now covered by zoneminder policy - Allow colord to read/write motion tmpfs - Allow vnstat to search through var_lib_t directories - Stop transitioning to quota_t, from init an sysadm_t- Add svirt_lxc_file_t as a customizable type- Add additional fixes for icmp nagios plugin - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin - Add certmonger_unconfined_exec_t - Make sure tap22 device is created with the correct label - Allow staff users to read systemd unit files - Merge in previously built policy - Arpwatch needs to be able to start netlink sockets in order to start - Allow cgred_t to sys_ptrace to look at other DAC Processes- Back port some of the access that was allowed in nsplugin_t - Add definitiona for couchdb ports - Allow nagios to use inherited users ttys - Add git support for mock - Allow inetd to use rdate port - Add own type for rdate port - Allow samba to act as a portmapper - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev - New fixes needed for samba4 - Allow apps that use lib_t to read lib_t symlinks- Add policy for nove-cert - Add labeling for nova-openstack systemd unit files - Add policy for keystoke- Fix man pages fro domains - Add man pages for SELinux users and roles - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon - Add policy for matahari-rpcd - nfsd executes mount command on restart - Matahari domains execute renice and setsched - Dontaudit leaked tty in mozilla_plugin_config - mailman is changing to a per instance naming - Add 7600 and 4447 as jboss_management ports - Add fixes for nagios event handlers - Label httpd.event as httpd_exec_t, it is an apache daemon- Add labeling for /var/spool/postfix/dev/log - NM reads sysctl.conf - Iscsi log file context specification fix - Allow mozilla plugins to send dbus messages to user domains that transition to it - Allow mysql to read the passwd file - Allow mozilla_plugin_t to create mozilla home dirs in user homedir - Allow deltacloud to read kernel sysctl - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself - Allow postgresql_t to connectto itself - Add login_userdomain attribute for users which can log in using terminal- Allow sysadm_u to reach system_r by default #784011 - Allow nagios plugins to use inherited user terminals - Razor labeling is not used no longer - Add systemd support for matahari - Add port_types to man page, move booleans to the top, fix some english - Add support for matahari-sysconfig-console - Clean up matahari.fc - Fix matahari_admin() interfac - Add labels for/etc/ssh/ssh_host_*.pub keys- Allow ksysguardproces to send system log msgs - Allow boinc setpgid and signull - Allow xdm_t to sys_ptrace to run pidof command - Allow smtpd_t to manage spool files/directories and symbolic links - Add labeling for jetty - Needed changes to get unbound/dnssec to work with openswan- Add user_fonts_t alias xfs_tmp_t - Since depmod now runs as insmod_t we need to write to kernel_object_t - Allow firewalld to dbus chat with networkmanager - Allow qpidd to connect to matahari ports - policykit needs to read /proc for uses not owned by it - Allow systemctl apps to connecto the init stream- Turn on deny_ptrace boolean- Remove pam_selinux.8 man page. There was a conflict.- Add proxy class and read access for gssd_proxy - Separate out the sharing public content booleans - Allow certmonger to execute a script and send signals to apache and dirsrv to reload the certificate - Add label transition for gstream-0.10 and 12 - Add booleans to allow rsync to share nfs and cifs file sytems - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it - Fix filename transitions for cups files - Allow denyhosts to read "unix" - Add file name transition for locale.conf.new - Allow boinc projects to gconf config files - sssd needs to be able to increase the socket limit under certain loads - sge_execd needs to read /etc/passwd - Allow denyhost to check network state - NetworkManager needs to read sessions data - Allow denyhost to check network state - Allow xen to search virt images directories - Add label for /dev/megaraid_sas_ioctl_node - Add autogenerated man pages- Allow boinc project to getattr on fs - Allow init to execute initrc_state_t - rhev-agent package was rename to ovirt-guest-agent - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly - sytemd writes content to /run/initramfs and executes it on shutdown - kdump_t needs to read /etc/mtab, should be back ported to F16 - udev needs to load kernel modules in early system boot- Need to add sys_ptrace back in since reading any content in /proc can cause these accesses - Add additional systemd interfaces which are needed fro *_admin interfaces - Fix bind_admin() interface- Allow firewalld to read urand - Alias java, execmem_mono to bin_t to allow third parties - Add label for kmod - /etc/redhat-lsb contains binaries - Add boolean to allow gitosis to send mail - Add filename transition also for "event20" - Allow systemd_tmpfiles_t to delete all file types - Allow collectd to ipc_lock- make consoletype_exec optional, so we can remove consoletype policy - remove unconfined_permisive.patch - Allow openvpn_t to inherit user home content and tmp content - Fix dnssec-trigger labeling - Turn on obex policy for staff_t - Pem files should not be secret - Add lots of rules to fix AVC's when playing with containers - Fix policy for dnssec - Label ask-passwd directories correctly for systemd- sshd fixes seem to be causing unconfined domains to dyntrans to themselves - fuse file system is now being mounted in /run/user - systemd_logind is sending signals to processes that are dbus messaging with it - Add support for winshadow port and allow iscsid to connect to this port - httpd should be allowed to bind to the http_port_t udp socket - zarafa_var_lib_t can be a lnk_file - A couple of new .xsession-errors files - Seems like user space and login programs need to read logind_sessions_files - Devicekit disk seems to be being launched by systemd - Cleanup handling of setfiles so most of rules in te file - Correct port number for dnssec - logcheck has the home dir set to its cache- Add policy for grindengine MPI jobs- Add new sysadm_secadm.pp module * contains secadm definition for sysadm_t - Move user_mail_domain access out of the interface into the te file - Allow httpd_t to create httpd_var_lib_t directories as well as files - Allow snmpd to connect to the ricci_modcluster stream - Allow firewalld to read /etc/passwd - Add auth_use_nsswitch for colord - Allow smartd to read network state - smartdnotify needs to read /etc/group- Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory - lxdm startup scripts should be labeled bin_t, so confined users will work - mcstransd now creates a pid, needs back port to F16 - qpidd should be allowed to connect to the amqp port - Label devices 010-029 as usb devices - ypserv packager says ypserv does not use tmp_t so removing selinux policy types - Remove all ptrace commands that I believe are caused by the kernel/ps avcs - Add initial Obex policy - Add logging_syslogd_use_tty boolean - Add polipo_connect_all_unreserved bolean - Allow zabbix to connect to ftp port - Allow systemd-logind to be able to switch VTs - Allow apache to communicate with memcached through a sock_file- Fix file_context.subs_dist for now to work with pre usrmove- More /usr move fixes- Add zabbix_can_network boolean - Add httpd_can_connect_zabbix boolean - Prepare file context labeling for usrmove functions - Allow system cronjobs to read kernel network state - Add support for selinux_avcstat munin plugin - Treat hearbeat with corosync policy - Allow corosync to read and write to qpidd shared mem - mozilla_plugin is trying to run pulseaudio - Fixes for new sshd patch for running priv sep domains as the users context - Turn off dontaudit rules when turning on allow_ypbind - udev now reads /etc/modules.d directory- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out - Cups exchanges dbus messages with init - udisk2 needs to send syslog messages - certwatch needs to read /etc/passwd- Add labeling for udisks2 - Allow fsadmin to communicate with the systemd process- Treat Bip with bitlbee policy * Bip is an IRC proxy - Add port definition for interwise port - Add support for ipa_memcached socket - systemd_jounald needs to getattr on all processes - mdadmin fixes * uses getpw - amavisd calls getpwnam() - denyhosts calls getpwall()- Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there - bluetooth says they do not use /tmp and want to remove the type - Allow init to transition to colord - Mongod needs to read /proc/sys/vm/zone_reclaim_mode - Allow postfix_smtpd_t to connect to spamd - Add boolean to allow ftp to connect to all ports > 1023 - Allow sendmain to write to inherited dovecot tmp files - setroubleshoot needs to be able to execute rpm to see what version of packages- Merge systemd patch - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online - Allow deltacloudd dac_override, setuid, setgid caps - Allow aisexec to execute shell - Add use_nfs_home_dirs boolean for ssh-keygen- Fixes to make rawhide boot in enforcing mode with latest systemd changes- Add labeling for /var/run/systemd/journal/syslog - libvirt sends signals to ifconfig - Allow domains that read logind session files to list them- Fixed destined form libvirt-sandbox - Allow apps that list sysfs to also read sympolicy links in this filesystem - Add ubac_constrained rules for chrome_sandbox - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra - Allow postgresql to be executed by the caller - Standardize interfaces of daemons - Add new labeling for mm-handler - Allow all matahari domains to read network state and etc_runtime_t files- New fix for seunshare, requires seunshare_domains to be able to mounton / - Allow systemctl running as logrotate_t to connect to private systemd socket - Allow tmpwatch to read meminfo - Allow rpc.svcgssd to read supported_krb5_enctype - Allow zarafa domains to read /dev/random and /dev/urandom - Allow snmpd to read dev_snmp6 - Allow procmail to talk with cyrus - Add fixes for check_disk and check_nagios plugins- default trans rules for Rawhide policy - Make sure sound_devices controlC* are labeled correctly on creation - sssd now needs sys_admin - Allow snmp to read all proc_type - Allow to setup users homedir with quota.group- Add httpd_can_connect_ldap() interface - apcupsd_t needs to use seriel ports connected to usb devices - Kde puts procmail mail directory under ~/.local/share - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now - Add labeling for /sbin/iscsiuio- Add label for /var/lib/iscan/interpreter - Dont audit writes to leaked file descriptors or redirected output for nacl - NetworkManager needs to write to /sys/class/net/ib*/mode- Allow abrt to request the kernel to load a module - Make sure mozilla content is labeled correctly - Allow tgtd to read system state - More fixes for boinc * allow to resolve dns name * re-write boinc policy to use boinc_domain attribute - Allow munin services plugins to use NSCD services- Allow mozilla_plugin_t to manage mozilla_home_t - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain - Add label for tumblerd- Fixes for xguest package- Fixes related to /bin, /sbin - Allow abrt to getattr on blk files - Add type for rhev-agent log file - Fix labeling for /dev/dmfm - Dontaudit wicd leaking - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it - Label /etc/locale.conf correctly - Allow user_mail_t to read /dev/random - Allow postfix-smtpd to read MIMEDefang - Add label for /var/log/suphp.log - Allow swat_t to connect and read/write nmbd_t sock_file - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf - Allow systemd-tmpfiles to change user identity in object contexts - More fixes for rhev_agentd_t consolehelper policy- Use fs_use_xattr for squashf - Fix procs_type interface - Dovecot has a new fifo_file /var/run/dovecot/stats-mail - Dovecot has a new fifo_file /var/run/stats-mail - Colord does not need to connect to network - Allow system_cronjob to dbus chat with NetworkManager - Puppet manages content, want to make sure it labels everything correctly- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it - Allow all postfix domains to use the fifo_file - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t - Allow apmd_t to read grub.cfg - Let firewallgui read the selinux config - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp - Fix devicekit_manage_pid_files() interface - Allow squid to check the network state - Dontaudit colord getattr on file systems - Allow ping domains to read zabbix_tmp_t files- Allow mcelog_t to create dir and file in /var/run and label it correctly - Allow dbus to manage fusefs - Mount needs to read process state when mounting gluster file systems - Allow collectd-web to read collectd lib files - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr - Allow colord to get the attributes of tmpfs filesystem - Add sanlock_use_nfs and sanlock_use_samba booleans - Add bin_t label for /usr/lib/virtualbox/VBoxManage- Add ssh_dontaudit_search_home_dir - Changes to allow namespace_init_t to work - Add interface to allow exec of mongod, add port definition for mongod port, 27017 - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t - Allow spamd and clamd to steam connect to each other - Add policy label for passwd.OLD - More fixes for postfix and postfix maildro - Add ftp support for mozilla plugins - Useradd now needs to manage policy since it calls libsemanage - Fix devicekit_manage_log_files() interface - Allow colord to execute ifconfig - Allow accountsd to read /sys - Allow mysqld-safe to execute shell - Allow openct to stream connect to pcscd - Add label for /var/run/nm-dns-dnsmasq\.conf - Allow networkmanager to chat with virtd_t- Pulseaudio changes - Merge patches- Merge patches back into git repository.- Remove allow_execmem boolean and replace with deny_execmem boolean- Turn back on allow_execmem boolean- Add more MCS fixes to make sandbox working - Make faillog MLS trusted to make sudo_$1_t working - Allow sandbox_web_client_t to read passwd_file_t - Add .mailrc file context - Remove execheap from openoffice domain - Allow chrome_sandbox_nacl_t to read cpu_info - Allow virtd to relabel generic usb which is need if USB device - Fixes for virt.if interfaces to consider chr_file as image file type- Remove Open Office policy - Remove execmem policy- MCS fixes - quota fixes- Remove transitions to consoletype- Make nvidia* to be labeled correctly - Fix abrt_manage_cache() interface - Make filetrans rules optional so base policy will build - Dontaudit chkpwd_t access to inherited TTYS - Make sure postfix content gets created with the correct label - Allow gnomeclock to read cgroup - Fixes for cloudform policy- Check in fixed for Chrome nacl support- Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_overide to communicate with users TTY's - Allow svirt_lxc domains to send kill signals within their container- Remove qemu.pp again without causing a crash- Remove qemu.pp, everything should use svirt_t or stay in its current domain- Allow policykit to talk to the systemd via dbus - Move chrome_sandbox_nacl_t to permissive domains - Additional rules for chrome_sandbox_nacl- Change bootstrap name to nacl - Chrome still needs execmem - Missing role for chrome_sandbox_bootstrap - Add boolean to remove execmem and execstack from virtual machines - Dontaudit xdm_t doing an access_check on etc_t directories- Allow named to connect to dirsrv by default - add ldapmap1_0 as a krb5_host_rcache_t file - Google chrome developers asked me to add bootstrap policy for nacl stuff - Allow rhev_agentd_t to getattr on mountpoints - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets- Fixes for cloudform policies which need to connect to random ports - Make sure if an admin creates modules content it creates them with the correct label - Add port 8953 as a dns port used by unbound - Fix file name transition for alsa and confined users- Turn on mock_t and thumb_t for unconfined domains- Policy update should not modify local contexts- Remove ada policy- Remove tzdata policy - Add labeling for udev - Add cloudform policy - Fixes for bootloader policy- Add policies for nova openstack- Add fixes for nova-stack policy- Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain - Allow init process to setrlimit on itself - Take away transition rules for users executing ssh-keygen - Allow setroubleshoot_fixit_t to read /dev/urand - Allow sshd to relbale tunnel sockets - Allow fail2ban domtrans to shorewall in the same way as with iptables - Add support for lnk files in the /var/lib/sssd directory - Allow system mail to connect to courier-authdaemon over an unix stream socket- Add passwd_file_t for /etc/ptmptmp- Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK) - Make corosync to be able to relabelto cluster lib fies - Allow samba domains to search /var/run/nmbd - Allow dirsrv to use pam - Allow thumb to call getuid - chrome less likely to get mmap_zero bug so removing dontaudit - gimp help-browser has built in javascript - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t - Re-write glance policy- Move dontaudit sys_ptrace line from permissive.te to domain.te - Remove policy for hal, it no longer exists- Don't check md5 size or mtime on certain config files- Remove allow_ptrace and replace it with deny_ptrace, which will remove all ptrace from the system - Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;- Fixes for bootloader policy - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore - Allow nsplugin to read /usr/share/config - Allow sa-update to update rules - Add use_fusefs_home_dirs for chroot ssh option - Fixes for grub2 - Update systemd_exec_systemctl() interface - Allow gpg to read the mail spool - More fixes for sa-update running out of cron job - Allow ipsec_mgmt_t to read hardware state information - Allow pptp_t to connect to unreserved_port_t - Dontaudit getattr on initctl in /dev from chfn - Dontaudit getattr on kernel_core from chfn - Add systemd_list_unit_dirs to systemd_exec_systemctl call - Fixes for collectd policy - CHange sysadm_t to create content as user_tmp_t under /tmp- Shrink size of policy through use of attributes for userdomain and apache- Allow virsh to read xenstored pid file - Backport corenetwork fixes from upstream - Do not audit attempts by thumb to search config_home_t dirs (~/.config) - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t - allow thumb to read generic data home files (mime.type)- Allow nmbd to manage sock file in /var/run/nmbd - ricci_modservice send syslog msgs - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly - Allow systemd_logind_t to manage /run/USER/dconf/user- Fix missing patch from F16- Allow logrotate setuid and setgid since logrotate is supposed to do it - Fixes for thumb policy by grift - Add new nfsd ports - Added fix to allow confined apps to execmod on chrome - Add labeling for additional vdsm directories - Allow Exim and Dovecot SASL - Add label for /var/run/nmbd - Add fixes to make virsh and xen working together - Colord executes ls - /var/spool/cron is now labeled as user_cron_spool_t- Stop complaining about leaked file descriptors during install- Remove java and mono module and merge into execmem- Fixes for thumb policy and passwd_file_t- Fixes caused by the labeling of /etc/passwd - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide- Add support for Clustered Samba commands - Allow ricci_modrpm_t to send log msgs - move permissive virt_qmf_t from virt.te to permissivedomains.te - Allow ssh_t to use kernel keyrings - Add policy for libvirt-qmf and more fixes for linux containers - Initial Polipo - Sanlock needs to run ranged in order to kill svirt processes - Allow smbcontrol to stream connect to ctdbd- Add label for /etc/passwd- Change unconfined_domains to permissive for Rawhide - Add definition for the ephemeral_ports- Make mta_role() active - Allow asterisk to connect to jabber client port - Allow procmail to read utmp - Add NIS support for systemd_logind_t - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t - Fix systemd_manage_unit_dirs() interface - Allow ssh_t to manage directories passed into it - init needs to be able to create and delete unit file directories - Fix typo in apache_exec_sys_script - Add ability for logrotate to transition to awstat domain- Change screen to use screen_domain attribute and allow screen_domains to read all process domain state - Add SELinux support for ssh pre-auth net process in F17 - Add logging_syslogd_can_sendmail boolean- Add definition for ephemeral ports - Define user_tty_device_t as a customizable_type- Needs to require a new version of checkpolicy - Interface fixes- Allow sanlock to manage virt lib files - Add virt_use_sanlock booelan - ksmtuned is trying to resolve uids - Make sure .gvfs is labeled user_home_t in the users home directory - Sanlock sends kill signals and needs the kill capability - Allow mockbuild to work on nfs homedirs - Fix kerberos_manage_host_rcache() interface - Allow exim to read system state- Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t- Allow collectd to read hardware state information - Add loop_control_device_t - Allow mdadm to request kernel to load module - Allow domains that start other domains via systemctl to search unit dir - systemd_tmpfiles, needs to list any file systems mounted on /tmp - No one can explain why radius is listing the contents of /tmp, so we will dontaudit - If I can manage etc_runtime files, I should be able to read the links - Dontaudit hostname writing to mock library chr_files - Have gdm_t setup labeling correctly in users home dir - Label content unde /var/run/user/NAME/dconf as config_home_t - Allow sa-update to execute shell - Make ssh-keygen working with fips_enabled - Make mock work for staff_t user - Tighten security on mock_t- removing unconfined_notrans_t no longer necessary - Clean up handling of secure_mode_insmod and secure_mode_policyload - Remove unconfined_mount_t- Add exim_exec_t label for /usr/sbin/exim_tidydb - Call init_dontaudit_rw_stream_socket() interface in mta policy - sssd need to search /var/cache/krb5rcache directory - Allow corosync to relabel own tmp files - Allow zarafa domains to send system log messages - Allow ssh to do tunneling - Allow initrc scripts to sendto init_t unix_stream_socket - Changes to make sure dmsmasq and virt directories are labeled correctly - Changes needed to allow sysadm_t to manage systemd unit files - init is passing file descriptors to dbus and on to system daemons - Allow sulogin additional access Reported by dgrift and Jeremy Miller - Steve Grubb believes that wireshark does not need this access - Fix /var/run/initramfs to stop restorecon from looking at - pki needs another port - Add more labels for cluster scripts - Allow apps that manage cgroup_files to manage cgroup link files - Fix label on nfs-utils scripts directories - Allow gatherd to read /dev/rand and /dev/urand- pki needs another port - Add more labels for cluster scripts - Fix label on nfs-utils scripts directories - Fixes for cluster - Allow gatherd to read /dev/rand and /dev/urand - abrt leaks fifo files- Add glance policy - Allow mdadm setsched - /var/run/initramfs should not be relabeled with a restorecon run - memcache can be setup to override sys_resource - Allow httpd_t to read tetex data - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.- Allow Postfix to deliver to Dovecot LMTP socket - Ignore bogus sys_module for lldpad - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock - systemd_logind_t sets the attributes on usb devices - Allow hddtemp_t to read etc_t files - Add permissivedomains module - Move all permissive domains calls to permissivedomain.te - Allow pegasis to send kill signals to other UIDs- Allow insmod_t to use fds leaked from devicekit - dontaudit getattr between insmod_t and init_t unix_stream_sockets - Change sysctl unit file interfaces to use systemctl - Add support for chronyd unit file - Allow mozilla_plugin to read gnome_usr_config - Add policy for new gpsd - Allow cups to create kerberos rhost cache files - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly- Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten- Add policy for sa-update being run out of cron jobs - Add create perms to postgresql_manage_db - ntpd using a gps has to be able to read/write generic tty_device_t - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev - fix spec file - Remove qemu_domtrans_unconfined() interface - Make passenger working together with puppet - Add init_dontaudit_rw_stream_socket interface - Fixes for wordpress- Turn on allow_domain_fd_use boolean on F16 - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Add abrt_handle_event_t domain for ABRT event scripts - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change - Allow httpd_git_script_t to read passwd data - Allow openvpn to set its process priority when the nice parameter is used- livecd fixes - spec file fixes- fetchmail can use kerberos - ksmtuned reads in shell programs - gnome_systemctl_t reads the process state of ntp - dnsmasq_t asks the kernel to load multiple kernel modules - Add rules for domains executing systemctl - Bogus text within fc file- Add cfengine policy- Add abrt_domain attribute - Allow corosync to manage cluster lib files - Allow corosync to connect to the system DBUS- Add sblim, uuidd policies - Allow kernel_t dyntrasition to init_t- init_t need setexec - More fixes of rules which cause an explosion in rules by Dan Walsh- Allow rcsmcertd to perform DNS name resolution - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts - Allow tmux to run as screen - New policy for collectd - Allow gkeyring_t to interact with all user apps - Add rules to allow firstboot to run on machines with the unconfined.pp module removed- Allow systemd_logind to send dbus messages with users - allow accountsd to read wtmp file - Allow dhcpd to get and set capabilities- Fix oracledb_port definition - Allow mount to mounton the selinux file system - Allow users to list /var directories- systemd fixes- Add initial policy for abrt_dump_oops_t - xtables-multi wants to getattr of the proc fs - Smoltclient is connecting to abrt - Dontaudit leaked file descriptors to postdrop - Allow abrt_dump_oops to look at kernel sysctls - Abrt_dump_oops_t reads kernel ring buffer - Allow mysqld to request the kernel to load modules - systemd-login needs fowner - Allow postfix_cleanup_t to searh maildrop- Initial systemd_logind policy - Add policy for systemd_logger and additional proivs for systemd_logind - More fixes for systemd policies- Allow setsched for virsh - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories - iptables: the various /sbin/ip6?tables.* are now symlinks for /sbin/xtables-multi- A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit - Allow colord to interact with the users through the tmpfs file system - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files - Add label for /var/log/mcelog - Allow asterisk to read /dev/random if it uses TLS - Allow colord to read ini files which are labeled as bin_t - Allow dirsrvadmin sys_resource and setrlimit to use ulimit - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first. - Also lists /var and /var/spool directories - Add openl2tpd to l2tpd policy - qpidd is reading the sysfs file- Change usbmuxd_t to dontaudit attempts to read chr_file - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains - Allow pppd to search /var/lock dir - Add rhsmcertd policy- Update to upstream- More fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git- Fix spec file to not report Verify errors- Add dspam policy - Add lldpad policy - dovecot auth wants to search statfs #713555 - Allow systemd passwd apps to read init fifo_file - Allow prelink to use inherited terminals - Run cherokee in the httpd_t domain - Allow mcs constraints on node connections - Implement pyicqt policy - Fixes for zarafa policy - Allow cobblerd to send syslog messages- Add policy.26 to the payload - Remove olpc stuff - Remove policygentool- Fixes for zabbix - init script needs to be able to manage sanlock_var_run_... - Allow sandlock and wdmd to create /var/run directories... - mixclip.so has been compiled correctly - Fix passenger policy module name- Add mailscanner policy from dgrift - Allow chrome to optionally be transitioned to - Zabbix needs these rules when starting the zabbix_server_mysql - Implement a type for freedesktop openicc standard (~/.local/share/icc) - Allow system_dbusd_t to read inherited icc_data_home_t files. - Allow colord_t to read icc_data_home_t content. #706975 - Label stuff under /usr/lib/debug as if it was labeled under /- Fixes for sanlock policy - Fixes for colord policy - Other fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Add rhev policy module to modules-targeted.conf- Lot of fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Allow logrotate to execute systemctl - Allow nsplugin_t to getattr on gpmctl - Fix dev_getattr_all_chr_files() interface - Allow shorewall to use inherited terms - Allow userhelper to getattr all chr_file devices - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t - Fix labeling for ABRT Retrace Server- Dontaudit sys_module for ifconfig - Make telepathy and gkeyringd daemon working with confined users - colord wants to read files in users homedir - Remote login should be creating user_tmp_t not its own tmp files- Fix label for /usr/share/munin/plugins/munin_* plugins - Add support for zarafa-indexer - Fix boolean description - Allow colord to getattr on /proc/scsi/scsi - Add label for /lib/upstart/init - Colord needs to list /mnt- Forard port changes from F15 for telepathy - NetworkManager should be allowed to use /dev/rfkill - Fix dontaudit messages to say Domain to not audit - Allow telepathy domains to read/write gnome_cache files - Allow telepathy domains to call getpw - Fixes for colord and vnstatd policy- Allow init_t getcap and setcap - Allow namespace_init_t to use nsswitch - aisexec will execute corosync - colord tries to read files off noxattr file systems - Allow init_t getcap and setcap- Add support for ABRT retrace server - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners - Allow telepath_msn_t to read /proc/PARENT/cmdline - ftpd needs kill capability - Allow telepath_msn_t to connect to sip port - keyring daemon does not work on nfs homedirs - Allow $1_sudo_t to read default SELinux context - Add label for tgtd sock file in /var/run/ - Add apache_exec_rotatelogs interface - allow all zaraha domains to signal themselves, server writes to /tmp - Allow syslog to read the process state - Add label for /usr/lib/chromium-browser/chrome - Remove the telepathy transition from unconfined_t - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts - Allow initrc_t domain to manage abrt pid files - Add support for AEOLUS project - Virt_admin should be allowed to manage images and processes - Allow plymountd to send signals to init - Change labeling of fping6- Add filename transitions- Fixes for zarafa policy - Add support for AEOLUS project - Change labeling of fping6 - Allow plymountd to send signals to init - Allow initrc_t domain to manage abrt pid files - Virt_admin should be allowed to manage images and processes- xdm_t needs getsession for switch user - Every app that used to exec init is now execing systemdctl - Allow squid to manage krb5_host_rcache_t files - Allow foghorn to connect to agentx port - Fixes for colord policy- Add Dan's patch to remove 64 bit variants - Allow colord to use unix_dgram_socket - Allow apps that search pids to read /var/run if it is a lnk_file - iscsid_t creates its own directory - Allow init to list var_lock_t dir - apm needs to verify user accounts auth_use_nsswitch - Add labeling for systemd unit files - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added - Add label for matahari-broker.pid file - We want to remove untrustedmcsprocess from ability to read /proc/pid - Fixes for matahari policy - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on- Fix typo- Add /var/run/lock /var/lock definition to file_contexts.subs - nslcd_t is looking for kerberos cc files - SSH_USE_STRONG_RNG is 1 which requires /dev/random - Fix auth_rw_faillog definition - Allow sysadm_t to set attributes on fixed disks - allow user domains to execute lsof and look at application sockets - prelink_cron job calls telinit -u if init is rewritten - Fixes to run qemu_t from staff_t- Fix label for /var/run/udev to udev_var_run_t - Mock needs to be able to read network state- Add file_contexts.subs to handle /run and /run/lock - Add other fixes relating to /run changes from F15 policy- Allow $1_sudo_t and $1_su_t open access to user terminals - Allow initrc_t to use generic terminals - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs -systemd is going to be useing /run and /run/lock for early bootup files. - Fix some comments in rlogin.if - Add policy for KDE backlighthelper - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems - sssd wants to read .k5login file in users homedir - setroubleshoot reads executables to see if they have TEXTREL - Add /var/spool/audit support for new version of audit - Remove kerberos_connect_524() interface calling - Combine kerberos_master_port_t and kerberos_port_t - systemd has setup /dev/kmsg as stderr for apps it executes - Need these access so that init can impersonate sockets on unix_dgram_socket- Remove some unconfined domains - Remove permissive domains - Add policy-term.patch from Dan- Fix multiple specification for boot.log - devicekit leaks file descriptors to setfiles_t - Change all all_nodes to generic_node and all_if to generic_if - Should not use deprecated interface - Switch from using all_nodes to generic_node and from all_if to generic_if - Add support for xfce4-notifyd - Fix file context to show several labels as SystemHigh - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs - Add etc_runtime_t label for /etc/securetty - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly - login.krb needs to be able to write user_tmp_t - dirsrv needs to bind to port 7390 for dogtag - Fix a bug in gpg policy - gpg sends audit messages - Allow qpid to manage matahari files- Initial policy for matahari - Add dev_read_watchdog - Allow clamd to connect clamd port - Add support for kcmdatetimehelper - Allow shutdown to setrlimit and sys_nice - Allow systemd_passwd to talk to /dev/log before udev or syslog is running - Purge chr_file and blk files on /tmp - Fixes for pads - Fixes for piranha-pulse - gpg_t needs to be able to encyprt anything owned by the user- mozilla_plugin_tmp_t needs to be treated as user tmp files - More dontaudits of writes from readahead - Dontaudit readahead_t file_type:dir write, to cover up kernel bug - systemd_tmpfiles needs to relabel faillog directory as well as the file - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost- Add policykit fixes from Tim Waugh - dontaudit sandbox domains sandbox_file_t:dir mounton - Add new dontaudit rules for sysadm_dbusd_t - Change label for /var/run/faillock * other fixes which relate with this change- Update to upstream - Fixes for telepathy - Add port defition for ssdp port - add policy for /bin/systemd-notify from Dan - Mount command requires users read mount_var_run_t - colord needs to read konject_uevent_socket - User domains connect to the gkeyring socket - Add colord policy and allow user_t and staff_t to dbus chat with it - Add lvm_exec_t label for kpartx - Dontaudit reading the mail_spool_t link from sandbox -X - systemd is creating sockets in avahi_var_run and system_dbusd_var_run- gpg_t needs to talk to gnome-keyring - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd - enforce MCS labeling on nodes - Allow arpwatch to read meminfo - Allow gnomeclock to send itself signals - init relabels /dev/.udev files on boot - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t - dnsmasq can run as a dbus service, needs acquire service - mysql_admin should be allowed to connect to mysql service - virt creates monitor sockets in the users home dir- Allow usbhid-ups to read hardware state information - systemd-tmpfiles has moved - Allo cgroup to sys_tty_config - For some reason prelink is attempting to read gconf settings - Add allow_daemons_use_tcp_wrapper boolean - Add label for ~/.cache/wocky to make telepathy work in enforcing mode - Add label for char devices /dev/dasd* - Fix for apache_role - Allow amavis to talk to nslcd - allow all sandbox to read selinux poilcy config files - Allow cluster domains to use the system bus and send each other dbus messages- Update to upstream- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild- Update to ref policy - cgred needs chown capability - Add /dev/crash crash_dev_t - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability- New labeling for postfmulti #675654 - dontaudit xdm_t listing noxattr file systems - dovecot-auth needs to be able to connect to mysqld via the network as well as locally - shutdown is passed stdout to a xdm_log_t file - smartd creates a fixed disk device - dovecot_etc_t contains a lnk_file that domains need to read - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot- syslog_t needs syslog capability - dirsrv needs to be able to create /var/lib/snmp - Fix labeling for dirsrv - Fix for dirsrv policy missing manage_dirs_pattern - corosync needs to delete clvm_tmpfs_t files - qdiskd needs to list hugetlbfs - Move setsched to sandbox_x_domain, so firefox can run without network access - Allow hddtemp to read removable devices - Adding syslog and read_policy permissions to policy * syslog Allow unconfined, sysadm_t, secadm_t, logadm_t * read_policy allow unconfined, sysadm_t, secadm_t, staff_t on Targeted allow sysadm_t (optionally), secadm_t on MLS - mdadm application will write into /sys/.../uevent whenever arrays are assembled or disassembled.- Add tcsd policy- ricci_modclusterd_t needs to bind to rpc ports 500-1023 - Allow dbus to use setrlimit to increase resoueces - Mozilla_plugin is leaking to sandbox - Allow confined users to connect to lircd over unix domain stream socket which allow to use remote control - Allow awstats to read squid logs - seunshare needs to manage tmp_t - apcupsd cgi scripts have a new directory- Fix xserver_dontaudit_read_xdm_pid - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. * These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t - Allow readahead to manage readahead pid dirs - Allow readahead to read all mcs levels - Allow mozilla_plugin_t to use nfs or samba homedirs- Allow nagios plugin to read /proc/meminfo - Fix for mozilla_plugin - Allow samba_net_t to create /etc/keytab - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t - nslcd can read user credentials - Allow nsplugin to delete mozilla_plugin_tmpfs_t - abrt tries to create dir in rpm_var_lib_t - virt relabels fifo_files - sshd needs to manage content in fusefs homedir - mock manages link files in cache dir- nslcd needs setsched and to read /usr/tmp - Invalid call in likewise policy ends up creating a bogus role - Cannon puts content into /var/lib/bjlib that cups needs to be able to write - Allow screen to create screen_home_t in /root - dirsrv sends syslog messages - pinentry reads stuff in .kde directory - Add labels for .kde directory in homedir - Treat irpinit, iprupdate, iprdump services with raid policy- NetworkManager wants to read consolekit_var_run_t - Allow readahead to create /dev/.systemd/readahead - Remove permissive domains - Allow newrole to run namespace_init- Add sepgsql_contexts file- Update to upstream- Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on - Add puppetmaster_use_db boolean - Fixes for zarafa policy - Fixes for gnomeclock poliy - Fix systemd-tmpfiles to use auth_use_nsswitch- gnomeclock executes a shell - Update for screen policy to handle pipe in homedir - Fixes for polyinstatiated homedir - Fixes for namespace policy and other fixes related to polyinstantiation - Add namespace policy - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts - Fixes for init, psad policy which relate with confined users - Do not audit bootloader attempts to read devicekit pid files - Allow nagios service plugins to read /proc- Add firewalld policy - Allow vmware_host to read samba config - Kernel wants to read /proc Fix duplicate grub def in cobbler - Chrony sends mail, executes shell, uses fifo_file and reads /proc - devicekitdisk getattr all file systems - sambd daemon writes wtmp file - libvirt transitions to dmidecode- Add initial policy for system-setup-keyboard which is now daemon - Label /var/lock/subsys/shorewall as shorewall_lock_t - Allow users to communicate with the gpg_agent_t - Dontaudit mozilla_plugin_t using the inherited terminal - Allow sambagui to read files in /usr - webalizer manages squid log files - Allow unconfined domains to bind ports to raw_ip_sockets - Allow abrt to manage rpm logs when running yum - Need labels for /var/run/bittlebee - Label .ssh under amanda - Remove unused genrequires for virt_domain_template - Allow virt_domain to use fd inherited from virtd_t - Allow iptables to read shorewall config- Gnome apps list config_home_t - mpd creates lnk files in homedir - apache leaks write to mail apps on tmp files - /var/stockmaniac/templates_cache contains log files - Abrt list the connects of mount_tmp_t dirs - passwd agent reads files under /dev and reads utmp file - squid apache script connects to the squid port - fix name of plymouth log file - teamviewer is a wine app - allow dmesg to read system state - Stop labeling files under /var/lib/mock so restorecon will not go into this - nsplugin needs to read network state for google talk- Allow xdm and syslog to use /var/log/boot.log - Allow users to communicate with mozilla_plugin and kill it - Add labeling for ipv6 and dhcp- New labels for ghc http content - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy- Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot- Update selinux policy to handle new /usr/share/sandbox/start script- Update to upstream - Fix version of policy in spec file- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs - remove per sandbox domains devpts types - Allow dkim-milter sending signal to itself- Allow domains that transition to ping or traceroute, kill them - Allow user_t to conditionally transition to ping_t and traceroute_t - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup- Turn on systemd policy - mozilla_plugin needs to read certs in the homedir. - Dontaudit leaked file descriptors from devicekit - Fix ircssi to use auth_use_nsswitch - Change to use interface without param in corenet to disable unlabelednet packets - Allow init to relabel sockets and fifo files in /dev - certmonger needs dac* capabilities to manage cert files not owned by root - dovecot needs fsetid to change group membership on mail - plymouthd removes /var/log/boot.log - systemd is creating symlinks in /dev - Change label on /etc/httpd/alias to be all cert_t- Fixes for clamscan and boinc policy - Add boinc_project_t setpgid - Allow alsa to create tmp files in /tmp- Push fixes to allow disabling of unlabeled_t packet access - Enable unlabelednet policy- Fixes for lvm to work with systemd- Fix the label for wicd log - plymouthd creates force-display-on-active-vt file - Allow avahi to request the kernel to load a module - Dontaudit hal leaks - Fix gnome_manage_data interface - Add new interface corenet_packet to define a type as being an packet_type. - Removed general access to packet_type from icecast and squid. - Allow mpd to read alsa config - Fix the label for wicd log - Add systemd policy- Fix gnome_manage_data interface - Dontaudit sys_ptrace capability for iscsid - Fixes for nagios plugin policy- Fix cron to run ranged when started by init - Fix devicekit to use log files - Dontaudit use of devicekit_var_run_t for fstools - Allow init to setattr on logfile directories - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t- Fix up handling of dnsmasq_t creating /var/run/libvirt/network - Turn on sshd_forward_ports boolean by default - Allow sysadmin to dbus chat with rpm - Add interface for rw_tpm_dev - Allow cron to execute bin - fsadm needs to write sysfs - Dontaudit consoletype reading /var/run/pm-utils - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin - certmonger needs to manage dirsrv data - /var/run/pm-utils should be labeled as devicekit_var_run_t- fixes to allow /var/run and /var/lock as tmpfs - Allow chrome sandbox to connect to web ports - Allow dovecot to listem on lmtp and sieve ports - Allov ddclient to search sysctl_net_t - Transition back to original domain if you execute the shell- Remove duplicate declaration- Update to upstream - Cleanup for sandbox - Add attribute to be able to select sandbox types- Allow ddclient to fix file mode bits of ddclient conf file - init leaks file descriptors to daemons - Add labels for /etc/lirc/ and - Allow amavis_t to exec shell - Add label for gssd_tmp_t for /var/tmp/nfs_0- Put back in lircd_etc_t so policy will install- Turn on allow_postfix_local_write_mail_spool - Allow initrc_t to transition to shutdown_t - Allow logwatch and cron to mls_read_to_clearance for MLS boxes - Allow wm to send signull to all applications and receive them from users - lircd patch from field - Login programs have to read /etc/samba - New programs under /lib/systemd - Abrt needs to read config files- Update to upstream - Dontaudit leaked sockets from userdomains to user domains - Fixes for mcelog to handle scripts - Apply patch from Ruben Kerkhof - Allow syslog to search spool dirs- Allow nagios plugins to read usr files - Allow mysqld-safe to send system log messages - Fixes fpr ddclient policy - Fix sasl_admin interface - Allow apache to search zarafa config - Allow munin plugins to search /var/lib directory - Allow gpsd to read sysfs_t - Fix labels on /etc/mcelog/triggers to bin_t- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp - Fix xserver interface - Fix definition of /var/run/lxdm- Turn on mediawiki policy - kdump leaks kdump_etc_t to ifconfig, add dontaudit - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap- Allow groupd transition to fenced domain when executes fence_node - Fixes for rchs policy - Allow mpd to be able to read samba/nfs files- Fix up corecommands.fc to match upstream - Make sure /lib/systemd/* is labeled init_exec_t - mount wants to setattr on all mountpoints - dovecot auth wants to read dovecot etc files - nscd daemon looks at the exe file of the comunicating daemon - openvpn wants to read utmp file - postfix apps now set sys_nice and lower limits - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly - Also resolves nsswitch - Fix labels on /etc/hosts.* - Cleanup to make upsteam patch work - allow abrt to read etc_runtime_t- Add conflicts for dirsrv package- Update to upstream - Add vlock policy- Fix sandbox to work on nfs homedirs - Allow cdrecord to setrlimit - Allow mozilla_plugin to read xauth - Change label on systemd-logger to syslogd_exec_t - Install dirsrv policy from dirsrv package- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it - Udev needs to stream connect to init and kernel - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory- Allow NetworkManager to read openvpn_etc_t - Dontaudit hplip to write of /usr dirs - Allow system_mail_t to create /root/dead.letter as mail_home_t - Add vdagent policy for spice agent daemon- Dontaudit sandbox sending sigkill to all user domains - Add policy for rssh_chroot_helper - Add missing flask definitions - Allow udev to relabelto removable_t - Fix label on /var/log/wicd.log - Transition to initrc_t from init when executing bin_t - Add audit_access permissions to file - Make removable_t a device_node - Fix label on /lib/systemd/*- Fixes for systemd to manage /var/run - Dontaudit leaks by firstboot- Allow chome to create netlink_route_socket - Add additional MATHLAB file context - Define nsplugin as an application_domain - Dontaudit sending signals from sandboxed domains to other domains - systemd requires init to build /tmp /var/auth and /var/lock dirs - mount wants to read devicekit_power /proc/ entries - mpd wants to connect to soundd port - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit - Treat lib_t and textrel_shlib_t directories the same - Allow mount read access on virtual images- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs. - Allow devicekit_power to domtrans to mount - Allow dhcp to bind to udp ports > 1024 to do named stuff - Allow ssh_t to exec ssh_exec_t - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used - Fix clamav_append_log() intefaces - Fix 'psad_rw_fifo_file' interface- Allow cobblerd to list cobler appache content- Fixup for the latest version of upowed - Dontaudit sandbox sending SIGNULL to desktop apps- Update to upstream-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access - dovecot-auth_t needs ipc_lock - gpm needs to use the user terminal - Allow system_mail_t to append ~/dead.letter - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf - Add pid file to vnstatd - Allow mount to communicate with gfs_controld - Dontaudit hal leaks in setfiles- Lots of fixes for systemd - systemd now executes readahead and tmpwatch type scripts - Needs to manage random seed- Allow smbd to use sys_admin - Remove duplicate file context for tcfmgr - Update to upstream- Fix fusefs handling - Do not allow sandbox to manage nsplugin_rw_t - Allow mozilla_plugin_t to connecto its parent - Allow init_t to connect to plymouthd running as kernel_t - Add mediawiki policy - dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. - Disable transition from dbus_session_domain to telepathy for F14 - Allow boinc_project to use shm - Allow certmonger to search through directories that contain certs - Allow fail2ban the DAC Override so it can read log files owned by non root users- Start adding support for use_fusefs_home_dirs - Add /var/lib/syslog directory file context - Add /etc/localtime as locale file context- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user - Turn off iptables from unconfined user - Allow sudo to send signals to any domains the user could have transitioned to. - Passwd in single user mode needs to talk to console_device_t - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio - locate tried to read a symbolic link, will dontaudit - New labels for telepathy-sunshine content in homedir - Google is storing other binaries under /opt/google/talkplugin - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15 - modemmanger and bluetooth send dbus messages to devicekit_power - Samba needs to getquota on filesystems labeld samba_share_t- Dontaudit attempts by xdm_t to write to bin_t for kdm - Allow initrc_t to manage system_conf_t- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets - Allow confined users to read xdm_etc_t files - Allow xdm_t to transition to xauth_t for lxdm program- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home - Allow clamd to send signals to itself - Allow mozilla_plugin_t to read user home content. And unlink pulseaudio shm. - Allow haze to connect to yahoo chat and messenger port tcp:5050. Bz #637339 - Allow guest to run ps command on its processes by allowing it to read /proc - Allow firewallgui to sys_rawio which seems to be required to setup masqerading - Allow all domains to search through default_t directories, in order to find differnet labels. For example people serring up /foo/bar to be share via samba. - Add label for /var/log/slim.log- Pull in cleanups from dgrift - Allow mozilla_plugin_t to execute mozilla_home_t - Allow rpc.quota to do quotamod- Cleanup policy via dgrift - Allow dovecot_deliver to append to inherited log files - Lots of fixes for consolehelper- Fix up Xguest policy- Add vnstat policy - allow libvirt to send audit messages - Allow chrome-sandbox to search nfs_t- Update to upstream- Add the ability to send audit messages to confined admin policies - Remove permissive domain from cmirrord and dontaudit sys_tty_config - Split out unconfined_domain() calls from other unconfined_ calls so we can d - virt needs to be able to read processes to clearance for MLS- Allow all domains that can use cgroups to search tmpfs_t directory - Allow init to send audit messages- Update to upstream- Allow mdadm_t to create files and sock files in /dev/md/- Add policy for ajaxterm- Handle /var/db/sudo - Allow pulseaudio to read alsa config - Allow init to send initrc_t dbus messagesAllow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr intd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port- Merge upstream fix of mmap_zero - Allow mount to write files in debugfs_t - Allow corosync to communicate with clvmd via tmpfs - Allow certmaster to read usr_t files - Allow dbus system services to search cgroup_t - Define rlogind_t as a login pgm- Allow mdadm_t to read/write hugetlbfs- Dominic Grift Cleanup - Miroslav Grepl policy for jabberd - Various fixes for mount/livecd and prelink- Merge with upstream- More access needed for devicekit - Add dbadm policy- Merge with upstream- Allow seunshare to fowner- Allow cron to look at user_cron_spool links - Lots of fixes for mozilla_plugin_t - Add sysv file system - Turn unconfined domains to permissive to find additional avcs- Update policy for mozilla_plugin_t- Allow clamscan to read proc_t - Allow mount_t to write to debufs_t dir - Dontaudit mount_t trying to write to security_t dir- Allow clamscan_t execmem if clamd_use_jit set - Add policy for firefox plugin-container- Fix /root/.forward definition- label dead.letter as mail_home_t- Allow login programs to search /cgroups- Fix cert handling- Fix devicekit_power bug - Allow policykit_auth_t more access.- Fix nis calls to allow bind to ports 512-1024 - Fix smartmon- Allow pcscd to read sysfs - systemd fixes - Fix wine_mmap_zero_ignore boolean- Apply Miroslav munin patch - Turn back on allow_execmem and allow_execmod booleans- Merge in fixes from dgrift repository- Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0- New paths for upstart- New permissions for syslog - New labels for /lib/upstart- Add mojomojo policy- Allow systemd to setsockcon on sockets to immitate other services- Remove debugfs label- Update to latest policy- Fix eclipse labeling from IBMSupportAssasstant packageing- Make boot with systemd in enforcing mode- Update to upstream- Add boolean to turn off port forwarding in sshd.- Add support for ebtables - Fixes for rhcs and corosync policy-Update to upstream-Update to upstream-Update to upstream- Add Zarafa policy- Cleanup of aiccu policy - initial mock policy- Lots of random fixes- Update to upstream- Update to upstream - Allow prelink script to signal itself - Cobbler fixes- Add xdm_var_run_t to xserver_stream_connect_xdm - Add cmorrord and mpd policy from Miroslav Grepl- Fix sshd creation of krb cc files for users to be user_tmp_t- Fixes for accountsdialog - Fixes for boinc- Fix label on /var/lib/dokwiki - Change permissive domains to enforcing - Fix libvirt policy to allow it to run on mls- Update to upstream- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t - Fix /var/run/abrtd.lock label- Allow login programs to read krb5_home_t Resolves: 594833 - Add obsoletes for cachefilesfd-selinux package Resolves: #575084- Allow mount to r/w abrt fifo file - Allow svirt_t to getattr on hugetlbfs - Allow abrt to create a directory under /var/spool- Add labels for /sys - Allow sshd to getattr on shutdown - Fixes for munin - Allow sssd to use the kernel key ring - Allow tor to send syslog messages - Allow iptabels to read usr files - allow policykit to read all domains state- Fix path for /var/spool/abrt - Allow nfs_t as an entrypoint for http_sys_script_t - Add policy for piranha - Lots of fixes for sosreport- Allow xm_t to read network state and get and set capabilities - Allow policykit to getattr all processes - Allow denyhosts to connect to tcp port 9911 - Allow pyranha to use raw ip sockets and ptrace itself - Allow unconfined_execmem_t and gconfsd mechanism to dbus - Allow staff to kill ping process - Add additional MLS rules- Allow gdm to edit ~/.gconf dir Resolves: #590677 - Allow dovecot to create directories in /var/lib/dovecot Partially resolves 590224 - Allow avahi to dbus chat with NetworkManager - Fix cobbler labels - Dontaudit iceauth_t leaks - fix /var/lib/lxdm file context - Allow aiccu to use tun tap devices - Dontaudit shutdown using xserver.log- Fixes for sandbox_x_net_t to match access for sandbox_web_t ++ - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory - Add dontaudit interface for bluetooth dbus - Add chronyd_read_keys, append_keys for initrc_t - Add log support for ksmtuned Resolves: #586663- Allow boinc to send mail- Allow initrc_t to remove dhcpc_state_t - Fix label on sa-update.cron - Allow dhcpc to restart chrony initrc - Don't allow sandbox to send signals to its parent processes - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t Resolves: #589136- Fix location of oddjob_mkhomedir Resolves: #587385 - fix labeling on /root/.shosts and ~/.shosts - Allow ipsec_mgmt_t to manage net_conf_t Resolves: #586760- Dontaudit sandbox trying to connect to netlink sockets Resolves: #587609 - Add policy for piranha- Fixups for xguest policy - Fixes for running sandbox firefox- Allow ksmtuned to use terminals Resolves: #586663 - Allow lircd to write to generic usb devices- Allow sandbox_xserver to connectto unconfined stream Resolves: #585171- Allow initrc_t to read slapd_db_t Resolves: #585476 - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf Resolves: #585963- Allow rlogind_t to search /root for .rhosts Resolves: #582760 - Fix path for cached_var_t - Fix prelink paths /var/lib/prelink - Allow confined users to direct_dri - Allow mls lvm/cryptosetup to work- Allow virtd_t to manage firewall/iptables config Resolves: #573585- Fix label on /root/.rhosts Resolves: #582760 - Add labels for Picasa - Allow openvpn to read home certs - Allow plymouthd_t to use tty_device_t - Run ncftool as iptables_t - Allow mount to unmount unlabeled_t - Dontaudit hal leaks- Allow livecd to transition to mount- Update to upstream - Allow abrt to delete sosreport Resolves: #579998 - Allow snmp to setuid and gid Resolves: #582155 - Allow smartd to use generic scsi devices Resolves: #582145- Allow ipsec_t to create /etc/resolv.conf with the correct label - Fix reserved port destination - Allow autofs to transition to showmount - Stop crashing tuned- Add telepathysofiasip policy- Update to upstream - Fix label for /opt/google/chrome/chrome-sandbox - Allow modemmanager to dbus with policykit- Fix allow_httpd_mod_auth_pam to use auth_use_pam(httpd_t) - Allow accountsd to read shadow file - Allow apache to send audit messages when using pam - Allow asterisk to bind and connect to sip tcp ports - Fixes for dovecot 2.0 - Allow initrc_t to setattr on milter directories - Add procmail_home_t for .procmailrc file- Fixes for labels during install from livecd- Fix /cgroup file context - Fix broken afs use of unlabled_t - Allow getty to use the console for s390- Fix cgroup handling adding policy for /cgroup - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set- Merge patches from dgrift- Update upstream - Allow abrt to write to the /proc under any process- Fix ~/.fontconfig label - Add /root/.cert label - Allow reading of the fixed_file_disk_t:lnk_file if you can read file - Allow qemu_exec_t as an entrypoint to svirt_t- Update to upstream - Allow tmpreaper to delete sandbox sock files - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems - Fixes for gitosis - No transition on livecd to passwd or chfn - Fixes for denyhosts- Add label for /var/lib/upower - Allow logrotate to run sssd - dontaudit readahead on tmpfs blk files - Allow tmpreaper to setattr on sandbox files - Allow confined users to execute dos files - Allow sysadm_t to kill processes running within its clearance - Add accountsd policy - Fixes for corosync policy - Fixes from crontab policy - Allow svirt to manage svirt_image_t chr files - Fixes for qdisk policy - Fixes for sssd policy - Fixes for newrole policy- make libvirt work on an MLS platform- Add qpidd policy- Update to upstream- Allow boinc to read kernel sysctl - Fix snmp port definitions - Allow apache to read anon_inodefs- Allow shutdown dac_override- Add device_t as a file system - Fix sysfs association- Dontaudit ipsec_mgmt sys_ptrace - Allow at to mail its spool files - Allow nsplugin to search in .pulse directory- Update to upstream- Allow users to dbus chat with xdm - Allow users to r/w wireless_device_t - Dontaudit reading of process states by ipsec_mgmt- Fix openoffice from unconfined_t- Add shutdown policy so consolekit can shutdown system- Update to upstream- Update to upstream- Update to upstream - These are merges of my patches - Remove 389 labeling conflicts - Add MLS fixes found in RHEL6 testing - Allow pulseaudio to run as a service - Add label for mssql and allow apache to connect to this database port if boolean set - Dontaudit searches of debugfs mount point - Allow policykit_auth to send signals to itself - Allow modcluster to call getpwnam - Allow swat to signal winbind - Allow usbmux to run as a system role - Allow svirt to create and use devpts- Add MLS fixes found in RHEL6 testing - Allow domains to append to rpm_tmp_t - Add cachefilesfd policy - Dontaudit leaks when transitioning- Change allow_execstack and allow_execmem booleans to on - dontaudit acct using console - Add label for fping - Allow tmpreaper to delete sandbox_file_t - Fix wine dontaudit mmap_zero - Allow abrt to read var_t symlinks- Additional policy for rgmanager- Allow sshd to setattr on pseudo terms- Update to upstream- Allow policykit to send itself signals- Fix duplicate cobbler definition- Fix file context of /var/lib/avahi-autoipd- Merge with upstream- Allow sandbox to work with MLS- Make Chrome work with staff user- Add icecast policy - Cleanup spec file- Add mcelog policy- Lots of fixes found in F12- Fix rpm_dontaudit_leaks- Add getsched to hald_t - Add file context for Fedora/Redhat Directory Server- Allow abrt_helper to getattr on all filesystems - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so- Add gstreamer_home_t for ~/.gstreamer- Update to upstream- Fix git- Turn on puppet policy - Update to dgrift git policy- Move users file to selection by spec file. - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t- Update to upstream- Remove most of the permissive domains from F12.- Add cobbler policy from dgrift- add usbmon device - Add allow rulse for devicekit_disk- Lots of fixes found in F12, fixes from Tom London- Cleanups from dgrift- Add back xserver_manage_home_fonts- Dontaudit sandbox trying to read nscd and sssd- Update to upstream- Rename udisks-daemon back to devicekit_disk_t policy- Fixes for abrt calls- Add tgtd policy- Update to upstream release- Add asterisk policy back in - Update to upstream release 2.20091117- Update to upstream release 2.20091117- Fixup nut policy- Update to upstream- Allow vpnc request the kernel to load modules- Fix minimum policy installs - Allow udev and rpcbind to request the kernel to load modules- Add plymouth policy - Allow local_login to sys_admin- Allow cupsd_config to read user tmp - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t- Update rhcs policy- Allow users to exec restorecond- Allow sendmail to request kernel modules load- Fix all kernel_request_load_module domains- Fix all kernel_request_load_module domains- Remove allow_exec* booleans for confined users. Only available for unconfined_t- More fixes for sandbox_web_t- Allow sshd to create .ssh directory and content- Fix request_module line to module_request- Fix sandbox policy to allow it to run under firefox. - Dont audit leaks.- Fixes for sandbox- Update to upstream - Dontaudit nsplugin search /root - Dontaudit nsplugin sys_nice- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service - Remove policycoreutils-python requirement except for minimum- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)- Add wordpress/wp-content/uploads label - Fixes for sandbox when run from staff_t- Update to upstream - Fixes for devicekit_disk- More fixes- Lots of fixes for initrc and other unconfined domains- Allow xserver to use netlink_kobject_uevent_socket- Fixes for sandbox- Dontaudit setroubleshootfix looking at /root directory- Update to upsteam- Allow gssd to send signals to users - Fix duplicate label for apache content- Update to upstream- Remove polkit_auth on upgrades- Add back in unconfined.pp and unconfineduser.pp - Add Sandbox unshare- Fixes for cdrecord, mdadm, and others- Add capability setting to dhcpc and gpm- Allow cronjobs to read exim_spool_t- Add ABRT policy- Fix system-config-services policy- Allow libvirt to change user componant of virt_domain- Allow cupsd_config_t to be started by dbus - Add smoltclient policy- Add policycoreutils-python to pre install- Make all unconfined_domains permissive so we can see what AVC's happen- Add pt_chown policy- Add kdump policy for Miroslav Grepl - Turn off execstack boolean- Turn on execstack on a temporary basis (#512845)- Allow nsplugin to connecto the session bus - Allow samba_net to write to coolkey data- Allow devicekit_disk to list inotify- Allow svirt images to create sock_file in svirt_var_run_t- Allow exim to getattr on mountpoints - Fixes for pulseaudio- Allow svirt_t to stream_connect to virtd_t- Allod hald_dccm_t to create sock_files in /tmp- More fixes from upstream- Fix polkit label - Remove hidebrokensymptoms for nss_ldap fix - Add modemmanager policy - Lots of merges from upstream - Begin removing textrel_shlib_t labels, from fixed libraries- Update to upstream- Allow certmaster to override dac permissions- Update to upstream- Fix context for VirtualBox- Update to upstream- Allow clamscan read amavis spool files- Fixes for xguest- fix multiple directory ownership of mandirs- Update to upstream- Add rules for rtkit-daemon- Update to upstream - Fix nlscd_stream_connect- Add rtkit policy- Allow rpcd_t to stream connect to rpcbind- Allow kpropd to create tmp files- Fix last duplicate /var/log/rpmpkgs- Update to upstream * add sssd- Update to upstream * cleanup- Update to upstream - Additional mail ports - Add virt_use_usb boolean for svirt- Fix mcs rules to include chr_file and blk_file- Add label for udev-acl- Additional rules for consolekit/udev, privoxy and various other fixes- New version for upstream- Allow NetworkManager to read inotifyfs- Allow setroubleshoot to run mlocate- Update to upstream- Add fish as a shell - Allow fprintd to list usbfs_t - Allow consolekit to search mountpoints - Add proper labeling for shorewall- New log file for vmware - Allow xdm to setattr on user_tmp_t- Upgrade to upstream- Allow fprintd to access sys_ptrace - Add sandbox policy- Add varnishd policy- Fixes for kpropd- Allow brctl to r/w tun_tap_device_t- Add /usr/share/selinux/packages- Allow rpcd_t to send signals to kernel threads- Fix upgrade for F10 to F11- Add policy for /var/lib/fprint-Remove duplicate line- Allow svirt to manage pci and other sysfs device data- Fix package selection handling- Fix /sbin/ip6tables-save context - Allod udev to transition to mount - Fix loading of mls policy file- Add shorewall policy- Additional rules for fprintd and sssd- Allow nsplugin to unix_read unix_write sem for unconfined_java- Fix uml files to be owned by users- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less- Allow confined users to manage virt_content_t, since this is home dir content - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection- Fix labeling on /var/lib/misc/prelink* - Allow xserver to rw_shm_perms with all x_clients - Allow prelink to execute files in the users home directory- Allow initrc_t to delete dev_null - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead- Update to latest milter code from Paul Howarth- Additional perms for readahead- Allow pulseaudio to acquire_svc on session bus - Fix readahead labeling- Allow sysadm_t to run rpm directly - libvirt needs fowner- Allow sshd to read var_lib symlinks for freenx- Allow nsplugin unix_read and write on users shm and sem - Allow sysadm_t to execute su- Dontaudit attempts to getattr user_tmpfs_t by lvm - Allow nfs to share removable media- Add ability to run postdrop from confined users- Fixes for podsleuth- Turn off nsplugin transition - Remove Konsole leaked file descriptors for release- Allow cupsd_t to create link files in print_spool_t - Fix iscsi_stream_connect typo - Fix labeling on /etc/acpi/actions - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed- Allow audioentroy to read etc files- Add fail2ban_var_lib_t - Fixes for devicekit_power_t- Separate out the ucnonfined user from the unconfined.pp package- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.- Upgrade to latest upstream - Allow devicekit_disk sys_rawio- Dontaudit binds to ports < 1024 for named - Upgrade to latest upstream- Allow podsleuth to use tmpfs files- Add customizable_types for svirt- Allow setroubelshoot exec* privs to prevent crash from bad libraries - add cpufreqselector- Dontaudit listing of /root directory for cron system jobs- Fix missing ld.so.cache label- Add label for ~/.forward and /root/.forward- Fixes for svirt- Fixes to allow svirt read iso files in homedir- Add xenner and wine fixes from mgrepl- Allow mdadm to read/write mls override- Change to svirt to only access svirt_image_t- Fix libvirt policy- Upgrade to latest upstream- Fixes for iscsid and sssd - More cleanups for upgrade from F10 to Rawhide.- Add pulseaudio, sssd policy - Allow networkmanager to exec udevadm- Add pulseaudio context- Upgrade to latest patches- Fixes for libvirt- Update to Latest upstream- Fix setrans.conf to show SystemLow for s0- Further confinement of qemu images via svirt- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild- Allow NetworkManager to manage /etc/NetworkManager/system-connections- add virtual_image_context and virtual_domain_context files- Allow rpcd_t to send signal to mount_t - Allow libvirtd to run ranged- Fix sysnet/net_conf_t- Fix squidGuard labeling- Re-add corenet_in_generic_if(unlabeled_t)* Tue Feb 10 2009 Dan Walsh 3.6.5-2 - Add git web policy- Add setrans contains from upstream- Do transitions outside of the booleans- Allow xdm to create user_tmp_t sockets for switch user to work- Fix staff_t domain- Grab remainder of network_peer_controls patch- More fixes for devicekit- Upgrade to latest upstream- Add boolean to disallow unconfined_t login- Add back transition from xguest to mozilla- Add virt_content_ro_t and labeling for isos directory- Fixes for wicd daemon- More mls/rpm fixes- Add policy to make dbus/nm-applet work- Remove polgen-ifgen from post and add trigger to policycoreutils-python- Add wm policy - Make mls work in graphics mode- Fixed for DeviceKit- Add devicekit policy- Update to upstream- Define openoffice as an x_domain- Fixes for reading xserver_tmp_t- Allow cups_pdf_t write to nfs_t- Remove audio_entropy policy- Update to upstream- Allow hal_acl_t to getattr/setattr fixed_disk- Change userdom_read_all_users_state to include reading symbolic links in /proc- Fix dbus reading /proc information- Add missing alias for home directory content- Fixes for IBM java location- Allow unconfined_r unconfined_java_t- Add cron_role back to user domains- Fix sudo setting of user keys- Allow iptables to talk to terminals - Fixes for policy kit - lots of fixes for booting.- Cleanup policy- Rebuild for Python 2.6- Fix labeling on /var/spool/rsyslog- Allow postgresl to bind to udp nodes- Allow lvm to dbus chat with hal - Allow rlogind to read nfs_t- Fix cyphesis file context- Allow hal/pm-utils to look at /var/run/video.rom - Add ulogd policy- Additional fixes for cyphesis - Fix certmaster file context - Add policy for system-config-samba - Allow hal to read /var/run/video.rom- Allow dhcpc to restart ypbind - Fixup labeling in /var/run- Add certmaster policy- Fix confined users - Allow xguest to read/write xguest_dbusd_t- Allow openoffice execstack/execmem privs- Allow mozilla to run with unconfined_execmem_t- Dontaudit domains trying to write to .xsession-errors- Allow nsplugin to look at autofs_t directory- Allow kerneloops to create tmp files- More alias for fastcgi- Remove mod_fcgid-selinux package- Fix dovecot access- Policy cleanup- Remove Multiple spec - Add include - Fix makefile to not call per_role_expansion- Fix labeling of libGL- Update to upstream- Update to upstream policy- Fixes for confined xwindows and xdm_t- Allow confined users and xdm to exec wm - Allow nsplugin to talk to fifo files on nfs- Allow NetworkManager to transition to avahi and iptables - Allow domains to search other domains keys, coverup kernel bug- Fix labeling for oracle- Allow nsplugin to comminicate with xdm_tmp_t sock_file- Change all user tmpfs_t files to be labeled user_tmpfs_t - Allow radiusd to create sock_files- Upgrade to upstream- Allow confined users to login with dbus- Fix transition to nsplugin- Add file context for /dev/mspblk.*- Fix transition to nsplugin '- Fix labeling on new pm*log - Allow ssh to bind to all nodes- Merge upstream changes - Add Xavier Toth patches- Add qemu_cache_t for /var/cache/libvirt- Remove gamin policy- Add tinyxs-max file system support- Update to upstream - New handling of init scripts- Allow pcsd to dbus - Add memcache policy- Allow audit dispatcher to kill his children- Update to upstream - Fix crontab use by unconfined user- Allow ifconfig_t to read dhcpc_state_t- Update to upstream- Update to upstream- Allow system-config-selinux to work with policykit- Fix novel labeling- Consolodate pyzor,spamassassin, razor into one security domain - Fix xdm requiring additional perms.- Fixes for logrotate, alsa- Eliminate vbetool duplicate entry- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t - Change dhclient to be able to red networkmanager_var_run- Update to latest refpolicy - Fix libsemanage initial install bug- Add inotify support to nscd- Allow unconfined_t to setfcap- Allow amanda to read tape - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi - Add support for netware file systems- Allow ypbind apps to net_bind_service- Allow all system domains and application domains to append to any log file- Allow gdm to read rpm database - Allow nsplugin to read mplayer config files- Allow vpnc to run ifconfig- Allow confined users to use postgres - Allow system_mail_t to exec other mail clients - Label mogrel_rails as an apache server- Apply unconfined_execmem_exec_t to haskell programs- Fix prelude file context- allow hplip to talk dbus - Fix context on ~/.local dir- Prevent applications from reading x_device- Add /var/lib/selinux context- Update to upstream- Add livecd policy- Dontaudit search of admin_home for init_system_domain - Rewrite of xace interfaces - Lots of new fs_list_inotify - Allow livecd to transition to setfiles_mac- Begin XAce integration- Merge Upstream- Allow amanada to create data files- Fix initial install, semanage setup- Allow system_r for httpd_unconfined_script_t- Remove dmesg boolean - Allow user domains to read/write game data- Change unconfined_t to transition to unconfined_mono_t when running mono - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work- Remove old booleans from targeted-booleans.conf file- Add boolean to mmap_zero - allow tor setgid - Allow gnomeclock to set clock- Don't run crontab from unconfined_t- Change etc files to config files to allow users to read them- Lots of fixes for confined domains on NFS_t homedir- dontaudit mrtg reading /proc - Allow iscsi to signal itself - Allow gnomeclock sys_ptrace- Allow dhcpd to read kernel network state- Label /var/run/gdm correctly - Fix unconfined_u user creation- Allow transition from initrc_t to getty_t- Allow passwd to communicate with user sockets to change gnome-keyring- Fix initial install- Allow radvd to use fifo_file - dontaudit setfiles reading links - allow semanage sys_resource - add allow_httpd_mod_auth_ntlm_winbind boolean - Allow privhome apps including dovecot read on nfs and cifs home dirs if the boolean is set- Allow nsplugin to read /etc/mozpluggerrc, user_fonts - Allow syslog to manage innd logs. - Allow procmail to ioctl spamd_exec_t- Allow initrc_t to dbus chat with consolekit.- Additional access for nsplugin - Allow xdm setcap/getcap until pulseaudio is fixed- Allow mount to mkdir on tmpfs - Allow ifconfig to search debugfs- Fix file context for MATLAB - Fixes for xace- Allow stunnel to transition to inetd children domains - Make unconfined_dbusd_t an unconfined domain- Fixes for qemu/virtd- Fix bug in mozilla policy to allow xguest transition - This will fix the libsemanage.dbase_llist_query: could not find record value libsemanage.dbase_llist_query: could not query record value (No such file or directory) bug in xguest- Allow nsplugin to run acroread- Add cups_pdf policy - Add openoffice policy to run in xguest- prewika needs to contact mysql - Allow syslog to read system_map files- Change init_t to an unconfined_domain- Allow init to transition to initrc_t on shell exec. - Fix init to be able to sendto init_t. - Allow syslog to connect to mysql - Allow lvm to manage its own fifo_files - Allow bugzilla to use ldap - More mls fixes- fixes for init policy (#436988) - fix build- Additional changes for MLS policy- Fix initrc_context generation for MLS- Fixes for libvirt- Allow bitlebee to read locale_t- More xselinux rules- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t- Prepare policy for beta release - Change some of the system domains back to unconfined - Turn on some of the booleans- Allow nsplugin_config execstack/execmem - Allow nsplugin_t to read alsa config - Change apache to use user content- Add cyphesis policy- Fix Makefile.devel to build mls modules - Fix qemu to be more specific on labeling- Update to upstream fixes- Allow staff to mounton user_home_t- Add xace support- Add fusectl file system- Fixes from yum-cron - Update to latest upstream- Fix userdom_list_user_files- Merge with upstream- Allow udev to send audit messages- Add additional login users interfaces - userdom_admin_login_user_template(staff)- More fixes for polkit- Eliminate transition from unconfined_t to qemu by default - Fixes for gpg- Update to upstream- Fixes for staff_t- Add policy for kerneloops - Add policy for gnomeclock- Fixes for libvirt- Fixes for nsplugin- More fixes for qemu- Additional ports for vnc and allow qemu and libvirt to search all directories- Update to upstream - Add libvirt policy - add qemu policy- Allow fail2ban to create a socket in /var/run- Allow allow_httpd_mod_auth_pam to work- Add audisp policy and prelude- Allow all user roles to executae samba net command- Allow usertypes to read/write noxattr file systems- Fix nsplugin to allow flashplugin to work in enforcing mode- Allow pam_selinux_permit to kill all processes- Allow ptrace or user processes by users of same type - Add boolean for transition to nsplugin- Allow nsplugin sys_nice, getsched, setsched- Allow login programs to talk dbus to oddjob- Add procmail_log support - Lots of fixes for munin- Allow setroubleshoot to read policy config and send audit messages- Allow users to execute all files in homedir, if boolean set - Allow mount to read samba config- Fixes for xguest to run java plugin- dontaudit pam_t and dbusd writing to user_home_t- Update gpg to allow reading of inotify- Change user and staff roles to work correctly with varied perms- Fix munin log, - Eliminate duplicate mozilla file context - fix wpa_supplicant spec- Fix role transition from unconfined_r to system_r when running rpm - Allow unconfined_domains to communicate with user dbus instances- Fixes for xguest- Let all uncofined domains communicate with dbus unconfined- Run rpm in system_r- Zero out customizable types- Fix definiton of admin_home_t- Fix munin file context- Allow cron to run unconfined apps- Modify default login to unconfined_u- Dontaudit dbus user client search of /root- Update to upstream- Fixes for polkit - Allow xserver to ptrace- Add polkit policy - Symplify userdom context, remove automatic per_role changes- Update to upstream - Allow httpd_sys_script_t to search users homedirs- Allow rpm_script to transition to unconfined_execmem_t- Remove user based home directory separation- Remove user specific crond_t- Merge with upstream - Allow xsever to read hwdata_t - Allow login programs to setkeycreate- Update to upstream- Update to upstream- Allow XServer to read /proc/self/cmdline - Fix unconfined cron jobs - Allow fetchmail to transition to procmail - Fixes for hald_mac - Allow system_mail to transition to exim - Allow tftpd to upload files - Allow xdm to manage unconfined_tmp - Allow udef to read alsa config - Fix xguest to be able to connect to sound port- Fixes for hald_mac - Treat unconfined_home_dir_t as a home dir - dontaudit rhgb writes to fonts and root- Fix dnsmasq - Allow rshd full login privs- Allow rshd to connect to ports > 1023- Fix vpn to bind to port 4500 - Allow ssh to create shm - Add Kismet policy- Allow rpm to chat with networkmanager- Fixes for ipsec and exim mail - Change default to unconfined user- Pass the UNK_PERMS param to makefile - Fix gdm location- Make alsa work- Fixes for consolekit and startx sessions- Dontaudit consoletype talking to unconfined_t- Remove homedir_template- Check asound.state- Fix exim policy- Allow tmpreadper to read man_t - Allow racoon to bind to all nodes - Fixes for finger print reader- Allow xdm to talk to input device (fingerprint reader) - Allow octave to run as java- Allow login programs to set ioctl on /proc- Allow nsswitch apps to read samba_var_t- Fix maxima- Eliminate rpm_t:fifo_file avcs - Fix dbus path for helper app- Fix service start stop terminal avc's- Allow also to search var_lib - New context for dbus launcher- Allow cupsd_config_t to read/write usb_device_t - Support for finger print reader, - Many fixes for clvmd - dbus starting networkmanager- Fix java and mono to run in xguest account- Fix to add xguest account when inititial install - Allow mono, java, wine to run in userdomains- Allow xserver to search devpts_t - Dontaudit ldconfig output to homedir- Remove hplip_etc_t change back to etc_t.- Allow cron to search nfs and samba homedirs- Allow NetworkManager to dbus chat with yum-updated- Allow xfs to bind to port 7100- Allow newalias/sendmail dac_override - Allow bind to bind to all udp ports- Turn off direct transition- Allow wine to run in system role- Fix java labeling- Define user_home_type as home_type- Allow sendmail to create etc_aliases_t- Allow login programs to read symlinks on homedirs- Update an readd modules- Cleanup spec file- Allow xserver to be started by unconfined process and talk to tty- Upgrade to upstream to grab postgressql changes- Add setransd for mls policy- Add ldconfig_cache_t- Allow sshd to write to proc_t for afs login- Allow xserver access to urand- allow dovecot to search mountpoints- Fix Makefile for building policy modules- Fix dhcpc startup of service- Fix dbus chat to not happen for xguest and guest users- Fix nagios cgi - allow squid to communicate with winbind- Fixes for ldconfig- Update from upstream- Add nasd support- Fix new usb devices and dmfm- Eliminate mount_ntfs_t policy, merge into mount_t- Allow xserver to write to ramfs mounted by rhgb- Add context for dbus machine id- Update with latest changes from upstream- Fix prelink to handle execmod- Add ntpd_key_t to handle secret data- Add anon_inodefs - Allow unpriv user exec pam_exec_t - Fix trigger- Allow cups to use generic usb - fix inetd to be able to run random apps (git)- Add proper contexts for rsyslogd- Fixes for xguest policy- Allow execution of gconf- Fix moilscanner update problem- Begin adding policy to separate setsebool from semanage - Fix xserver.if definition to not break sepolgen.if- Add new devices- Add brctl policy- Fix root login to include system_r- Allow prelink to read kernel sysctls- Default to user_u:system_r:unconfined_t- fix squid - Fix rpm running as uid- Fix syslog declaration- Allow avahi to access inotify - Remove a lot of bogus security_t:filesystem avcs- Remove ifdef strict policy from upstream- Remove ifdef strict to allow user_u to login- Fix for amands - Allow semanage to read pp files - Allow rhgb to read xdm_xserver_tmp- Allow kerberos servers to use ldap for backing store- allow alsactl to read kernel state- More fixes for alsactl - Transition from hal and modutils - Fixes for suspend resume. - insmod domtrans to alsactl - insmod writes to hal log- Allow unconfined_t to transition to NetworkManager_t - Fix netlabel policy- Update to latest from upstream- Update to latest from upstream- Update to latest from upstream- Allow pcscd_t to send itself signals- Fixes for unix_update - Fix logwatch to be able to search all dirs- Upstream bumped the version- Allow consolekit to syslog - Allow ntfs to work with hal- Allow iptables to read etc_runtime_t- MLS Fixes- Fix path of /etc/lvm/cache directory - Fixes for alsactl and pppd_t - Fixes for consolekit- Allow insmod_t to mount kvmfs_t filesystems- Rwho policy - Fixes for consolekit- fixes for fusefs- Fix samba_net to allow it to view samba_var_t- Update to upstream- Fix Sonypic backlight - Allow snmp to look at squid_conf_t- Fixes for pyzor, cyrus, consoletype on everything installs- Fix hald_acl_t to be able to getattr/setattr on usb devices - Dontaudit write to unconfined_pipes for load_policy- Allow bluetooth to read inotifyfs- Fixes for samba domain controller. - Allow ConsoleKit to look at ttys- Fix interface call- Allow syslog-ng to read /var - Allow locate to getattr on all filesystems - nscd needs setcap- Update to upstream- Allow samba to run groupadd- Update to upstream- Allow mdadm to access generic scsi devices- Fix labeling on udev.tbl dirs- Fixes for logwatch- Add fusermount and mount_ntfs policy- Update to upstream - Allow saslauthd to use kerberos keytabs- Fixes for samba_var_t- Allow networkmanager to setpgid - Fixes for hal_acl_t- Remove disable_trans booleans - hald_acl_t needs to talk to nscd- Fix prelink to be able to manage usr dirs.- Allow insmod to launch init scripts- Remove setsebool policy- Fix handling of unlabled_t packets- More of my patches from upstream- Update to latest from upstream - Add fail2ban policy- Update to remove security_t:filesystem getattr problems- Policy for consolekit- Update to latest from upstream- Revert Nemiver change - Set sudo as a corecmd so prelink will work, remove sudoedit mapping, since this will not work, it does not transition. - Allow samba to execute useradd- Upgrade to the latest from upstream- Add sepolgen support - Add bugzilla policy- Fix file context for nemiver- Remove include sym link- Allow mozilla, evolution and thunderbird to read dev_random. Resolves: #227002 - Allow spamd to connect to smtp port Resolves: #227184 - Fixes to make ypxfr work Resolves: #227237- Fix ssh_agent to be marked as an executable - Allow Hal to rw sound device- Fix spamassisin so crond can update spam files - Fixes to allow kpasswd to work - Fixes for bluetooth- Remove some targeted diffs in file context file- Fix squid cachemgr labeling- Add ability to generate webadm_t policy - Lots of new interfaces for httpd - Allow sshd to login as unconfined_t- Continue fixing, additional user domains- Begin adding user confinement to targeted policy- Fixes for prelink, ktalkd, netlabel- Allow prelink when run from rpm to create tmp files Resolves: #221865 - Remove file_context for exportfs Resolves: #221181 - Allow spamassassin to create ~/.spamassissin Resolves: #203290 - Allow ssh access to the krb tickets - Allow sshd to change passwd - Stop newrole -l from working on non securetty Resolves: #200110 - Fixes to run prelink in MLS machine Resolves: #221233 - Allow spamassassin to read var_lib_t dir Resolves: #219234- fix mplayer to work under strict policy - Allow iptables to use nscd Resolves: #220794- Add gconf policy and make it work with strict- Many fixes for strict policy and by extension mls.- Fix to allow ftp to bind to ports > 1024 Resolves: #219349- Allow semanage to exec it self. Label genhomedircon as semanage_exec_t Resolves: #219421 - Allow sysadm_lpr_t to manage other print spool jobs Resolves: #220080- allow automount to setgid Resolves: #219999- Allow cron to polyinstatiate - Fix creation of boot flags Resolves: #207433- Fixes for irqbalance Resolves: #219606- Fix vixie-cron to work on mls Resolves: #207433Resolves: #218978- Allow initrc to create files in /var directories Resolves: #219227- More fixes for MLS Resolves: #181566- More Fixes polyinstatiation Resolves: #216184- More Fixes polyinstatiation - Fix handling of keyrings Resolves: #216184- Fix polyinstatiation - Fix pcscd handling of terminal Resolves: #218149 Resolves: #218350- More fixes for quota Resolves: #212957- ncsd needs to use avahi sockets Resolves: #217640 Resolves: #218014- Allow login programs to polyinstatiate homedirs Resolves: #216184 - Allow quotacheck to create database files Resolves: #212957- Dontaudit appending hal_var_lib files Resolves: #217452 Resolves: #217571 Resolves: #217611 Resolves: #217640 Resolves: #217725- Fix context for helix players file_context #216942- Fix load_policy to be able to mls_write_down so it can talk to the terminal- Fixes for hwclock, clamav, ftp- Move to upstream version which accepted my patches- Fixes for nvidia driver- Allow semanage to signal mcstrans- Update to upstream- Allow modstorage to edit /etc/fstab file- Fix for qemu, /dev/- Fix path to realplayer.bin- Allow xen to connect to xen port- Allow cups to search samba_etc_t directory - Allow xend_t to list auto_mountpoints- Allow xen to search automount- Fix spec of jre files- Fix unconfined access to shadow file- Allow xend to create files in xen_image_t directories- Fixes for /var/lib/hal- Remove ability for sysadm_t to look at audit.log- Fix rpc_port_types - Add aide policy for mls- Merge with upstream- Lots of fixes for ricci- Allow xen to read/write fixed devices with a boolean - Allow apache to search /var/log- Fix policygentool specfile problem. - Allow apache to send signals to it's logging helpers. - Resolves: rhbz#212731- Add perms for swat- Add perms for swat- Allow daemons to dump core files to /- Fixes for ricci- Allow mount.nfs to work- Allow ricci-modstorage to look at lvm_etc_t- Fixes for ricci using saslauthd- Allow mountpoint on home_dir_t and home_t- Update xen to read nfs files- Allow noxattrfs to associate with other noxattrfs- Allow hal to use power_device_t- Allow procemail to look at autofs_t - Allow xen_image_t to work as a fixed device- Refupdate from upstream- Add lots of fixes for mls cups- Lots of fixes for ricci- Fix number of cats- Update to upstream- More iSCSI changes for #209854- Test ISCSI fixes for #209854- allow semodule to rmdir selinux_config_t dir- Fix boot_runtime_t problem on ppc. Should not be creating these files.- Fix context mounts on reboot - Fix ccs creation of directory in /var/log- Update for tallylog- Allow xend to rewrite dhcp conf files - Allow mgetty sys_admin capability- Make xentapctrl work- Don't transition unconfined_t to bootloader_t - Fix label in /dev/xen/blktap- Patch for labeled networking- Fix crond handling for mls- Update to upstream- Remove bluetooth-helper transition - Add selinux_validate for semanage - Require new version of libsemanage- Fix prelink- Fix rhgb- Fix setrans handling on MLS and useradd- Support for fuse - fix vigr- Fix dovecot, amanda - Fix mls- Allow java execheap for itanium- Update with upstream- mls fixes- Update from upstream- More fixes for mls - Revert change on automount transition to mount- Fix cron jobs to run under the correct context- Fixes to make pppd work- Multiple policy fixes - Change max categories to 1023- Fix transition on mcstransd- Add /dev/em8300 defs- Upgrade to upstream- Fix ppp connections from network manager- Add tty access to all domains boolean - Fix gnome-pty-helper context for ia64- Fixed typealias of firstboot_rw_t- Fix location of xel log files - Fix handling of sysadm_r -> rpm_exec_t- Fixes for autofs, lp- Update from upstream- Fixup for test6- Update to upstream- Update to upstream- Fix suspend to disk problems- Lots of fixes for restarting daemons at the console.- Fix audit line - Fix requires line- Upgrade to upstream- Fix install problems- Allow setroubleshoot to getattr on all dirs to gather RPM data- Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform - Fix spec for /dev/adsp- Fix xen tty devices- Fixes for setroubleshoot- Update to upstream- Fixes for stunnel and postgresql - Update from upstream- Update from upstream - More java fixes- Change allow_execstack to default to on, for RHEL5 Beta. This is required because of a Java compiler problem. Hope to turn off for next beta- Misc fixes- More fixes for strict policy- Quiet down anaconda audit messages- Fix setroubleshootd- Update to the latest from upstream- More fixes for xen- Fix anaconda transitions- yet more xen rules- more xen rules- Fixes for Samba- Fixes for xen- Allow setroubleshootd to send mail- Add nagios policy- fixes for setroubleshoot- Added Paul Howarth patch to only load policy packages shipped with this package - Allow pidof from initrc to ptrace higher level domains - Allow firstboot to communicate with hal via dbus- Add policy for /var/run/ldapi- Fix setroubleshoot policy- Fixes for mls use of ssh - named has a new conf file- Fixes to make setroubleshoot work- Cups needs to be able to read domain state off of printer client- add boolean to allow zebra to write config files- setroubleshootd fixes- Allow prelink to read bin_t symlink - allow xfs to read random devices - Change gfs to support xattr- Remove spamassassin_can_network boolean- Update to upstream - Fix lpr domain for mls- Add setroubleshoot policy- Turn off auditallow on setting booleans- Multiple fixes- Update to upstream- Update to upstream - Add new class for kernel key ring- Update to upstream- Update to upstream- Break out selinux-devel package- Add ibmasmfs- Fix policygentool gen_requires- Update from Upstream- Fix spec of realplay- Update to upstream- Fix semanage- Allow useradd to create_home_dir in MLS environment- Update from upstream- Update from upstream- Add oprofilefs- Fix for hplip and Picasus- Update to upstream- Update to upstream- fixes for spamd- fixes for java, openldap and webalizer- Xen fixes- Upgrade to upstream- allow hal to read boot_t files - Upgrade to upstream- allow hal to read boot_t files- Update from upstream- Fixes for amavis- Update from upstream- Allow auditctl to search all directories- Add acquire service for mono.- Turn off allow_execmem boolean - Allow ftp dac_override when allowed to access users homedirs- Clean up spec file - Transition from unconfined_t to prelink_t- Allow execution of cvs command- Update to upstream- Update to upstream- Fix libjvm spec- Update to upstream- Add xm policy - Fix policygentool- Update to upstream - Fix postun to only disable selinux on full removal of the packages- Allow mono to chat with unconfined- Allow procmail to sendmail - Allow nfs to share dosfs- Update to latest from upstream - Allow selinux-policy to be removed and kernel not to crash- Update to latest from upstream - Add James Antill patch for xen - Many fixes for pegasus- Add unconfined_mount_t - Allow privoxy to connect to httpd_cache - fix cups labeleing on /var/cache/cups- Update to latest from upstream- Update to latest from upstream - Allow mono and unconfined to talk to initrc_t dbus objects- Change libraries.fc to stop shlib_t form overriding texrel_shlib_t- Fix samba creating dirs in homedir - Fix NFS so its booleans would work- Allow secadm_t ability to relabel all files - Allow ftp to search xferlog_t directories - Allow mysql to communicate with ldap - Allow rsync to bind to rsync_port_t- Fixed mailman with Postfix #183928 - Allowed semanage to create file_context files. - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t to bind to reserved ports. #149030 - Don't allow devpts_t to be associated with tmp_t. - Allow hald_t to stat all mountpoints. - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts. - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of /etc/mtab. - Changed the file_contexts to not have a regex before the first ^/[a-z]/ whenever possible, makes restorecon slightly faster. - Correct the label of /etc/named.caching-nameserver.conf - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src hit by this. - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed xenstored_t rw access to the xen device node.- More textrel_shlib_t file path fixes - Add ada support- Get auditctl working in MLS policy- Add mono dbus support - Lots of file_context fixes for textrel_shlib_t in FC5 - Turn off execmem auditallow since they are filling log files- Update to upstream- Allow automount and dbus to read cert files- Fix ftp policy - Fix secadm running of auditctl- Update to upstream- Update to upstream- Fix policyhelp- Fix pam_console handling of usb_device - dontaudit logwatch reading /mnt dir- Update to upstream- Get transition rules to create policy.20 at SystemHigh- Allow secadmin to shutdown system - Allow sendmail to exec newalias- MLS Fixes dmidecode needs mls_file_read_up - add ypxfr_t - run init needs access to nscd - udev needs setuid - another xen log file - Dontaudit mount getattr proc_kcore_t- fix buildroot usage (#185391)- Get rid of mount/fsdisk scan of /dev messages - Additional fixes for suspend/resume- Fake make to rebuild enableaudit.pp- Get xen networking running.- Fixes for Xen - enableaudit should not be the same as base.pp - Allow ps to work for all process- more xen policy fixups- more xen fixage (#184393)- Fix blkid specification - Allow postfix to execute mailman_que- Blkid changes - Allow udev access to usb_device_t - Fix post script to create targeted policy config file- Allow lvm tools to create drevice dir- Add Xen support- Fixes for cups - Make cryptosetup work with hal- Load Policy needs translock- Fix cups html interface- Add hal changes suggested by Jeremy - add policyhelp to point at policy html pages- Additional fixes for nvidia and cups- Update to upstream - Merged my latest fixes - Fix cups policy to handle unix domain sockets- NSCD socket is in nscd_var_run_t needs to be able to search dir- Fixes Apache interface file- Fixes for new version of cups- Turn off polyinstatiate util after FC5- Fix problem with privoxy talking to Tor- Turn on polyinstatiation- Don't transition from unconfined_t to fsadm_t- Fix policy update model.- Update to upstream- Fix load_policy to work on MLS - Fix cron_rw_system_pipes for postfix_postdrop_t - Allow audotmount to run showmount- Fix swapon - allow httpd_sys_script_t to be entered via a shell - Allow httpd_sys_script_t to read eventpolfs- Update from upstream- allow cron to read apache files- Fix vpnc policy to work from NetworkManager- Update to upstream - Fix semoudle polcy- Update to upstream - fix sysconfig/selinux link- Add router port for zebra - Add imaze port for spamd - Fixes for amanda and java- Fix bluetooth handling of usb devices - Fix spamd reading of ~/ - fix nvidia spec- Update to upsteam- Add users_extra files- Update to upstream- Add semodule policy- Update from upstream- Fix for spamd to use razor port- Fixes for mcs - Turn on mount and fsadm for unconfined_t- Fixes for the -devel package- Fix for spamd to use ldap- Update to upstream- Update to upstream - Fix rhgb, and other Xorg startups- Update to upstream- Separate out role of secadm for mls- Add inotifyfs handling- Update to upstream - Put back in changes for pup/zen- Many changes for MLS - Turn on strict policy- Update to upstream- Update to upstream - Fixes for booting and logging in on MLS machine- Update to upstream - Turn off execheap execstack for unconfined users - Add mono/wine policy to allow execheap and execstack for them - Add execheap for Xdm policy- Update to upstream - Fixes to fetchmail,- Update to upstream- Fix for procmail/spamassasin - Update to upstream - Add rules to allow rpcd to work with unlabeled_networks.- Update to upstream - Fix ftp Man page- Update to upstream- fix pup transitions (#177262) - fix xen disks (#177599)- Update to upstream- More Fixes for hal and readahead- Fixes for hal and readahead- Update to upstream - Apply- Add wine and fix hal problems- Handle new location of hal scripts- Allow su to read /etc/mtab- Update to upstream- Fix "libsemanage.parse_module_headers: Data did not represent a module." problem- Allow load_policy to read /etc/mtab- Fix dovecot to allow dovecot_auth to look at /tmp- Allow restorecon to read unlabeled_t directories in order to fix labeling.- Add Logwatch policy- Fix /dev/ub[a-z] file context- Fix library specification - Give kudzu execmem privs- Fix hostname in targeted policy- Fix passwd command on mls- Lots of fixes to make mls policy work- Add dri libs to textrel_shlib_t - Add system_r role for java - Add unconfined_exec_t for vncserver - Allow slapd to use kerberos- Add man pages- Add enableaudit.pp- Fix mls policy- Update mls file from old version- Add sids back in - Rebuild with update checkpolicy- Fixes to allow automount to use portmap - Fixes to start kernel in s0-s15:c0.c255- Add java unconfined/execmem policy- Add file context for /var/cvs - Dontaudit webalizer search of homedir- Update from upstream- Clean up spec - range_transition crond to SystemHigh- Fixes for hal - Update to upstream- Turn back on execmem since we need it for java, firefox, ooffice - Allow gpm to stream socket to itself- fix requirements to be on the actual packages so that policy can get created properly at install time- Allow unconfined_t to execmod texrel_shlib_t- Update to upstream - Turn off allow_execmem and allow_execmod booleans - Add tcpd and automount policies- Add two new httpd booleans, turned off by default * httpd_can_network_relay * httpd_can_network_connect_db- Add ghost for policy.20- Update to upstream - Turn off boolean allow_execstack- Change setrans-mls to use new libsetrans - Add default_context rule for xdm- Change Requires to PreReg for requiring of policycoreutils on install- New upstream releaseAdd xdm policyUpdate from upstreamUpdate from upstreamUpdate from upstream- Also trigger to rebuild policy for versions up to 2.0.7.- No longer installing policy.20 file, anaconda handles the building of the app.- Fixes for dovecot and saslauthd- Cleanup pegasus and named - Fix spec file - Fix up passwd changing applications-Update to latest from upstream- Add rules for pegasus and avahi- Start building MLS Policy- Update to upstream- Turn on bash- Initial version  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~3.12.1-153.el7_0.10selinux-policyMakefile.exampleexample.fcexample.ifexample.tehtmladmin.htmladmin_bootloader.htmladmin_consoletype.htmladmin_dmesg.htmladmin_netutils.htmladmin_su.htmladmin_sudo.htmladmin_usermanage.htmlapps.htmlapps_seunshare.htmlbooleans.htmlcontrib.htmlcontrib_abrt.htmlcontrib_accountsd.htmlcontrib_acct.htmlcontrib_ada.htmlcontrib_afs.htmlcontrib_aiccu.htmlcontrib_aide.htmlcontrib_aisexec.htmlcontrib_ajaxterm.htmlcontrib_alsa.htmlcontrib_amanda.htmlcontrib_amavis.htmlcontrib_amtu.htmlcontrib_anaconda.htmlcontrib_antivirus.htmlcontrib_apache.htmlcontrib_apcupsd.htmlcontrib_apm.htmlcontrib_apt.htmlcontrib_arpwatch.htmlcontrib_asterisk.htmlcontrib_authbind.htmlcontrib_authconfig.htmlcontrib_automount.htmlcontrib_avahi.htmlcontrib_awstats.htmlcontrib_backup.htmlcontrib_bacula.htmlcontrib_bcfg2.htmlcontrib_bind.htmlcontrib_bird.htmlcontrib_bitlbee.htmlcontrib_blueman.htmlcontrib_bluetooth.htmlcontrib_boinc.htmlcontrib_brctl.htmlcontrib_bugzilla.htmlcontrib_bumblebee.htmlcontrib_cachefilesd.htmlcontrib_calamaris.htmlcontrib_callweaver.htmlcontrib_canna.htmlcontrib_ccs.htmlcontrib_cdrecord.htmlcontrib_certmaster.htmlcontrib_certmonger.htmlcontrib_certwatch.htmlcontrib_cfengine.htmlcontrib_cgroup.htmlcontrib_chrome.htmlcontrib_chronyd.htmlcontrib_cipe.htmlcontrib_clamav.htmlcontrib_clockspeed.htmlcontrib_clogd.htmlcontrib_cloudform.htmlcontrib_cmirrord.htmlcontrib_cobbler.htmlcontrib_collectd.htmlcontrib_colord.htmlcontrib_comsat.htmlcontrib_condor.htmlcontrib_conman.htmlcontrib_consolekit.htmlcontrib_corosync.htmlcontrib_couchdb.htmlcontrib_courier.htmlcontrib_cpucontrol.htmlcontrib_cpufreqselector.htmlcontrib_cron.htmlcontrib_ctdb.htmlcontrib_cups.htmlcontrib_cvs.htmlcontrib_cyphesis.htmlcontrib_cyrus.htmlcontrib_daemontools.htmlcontrib_dante.htmlcontrib_dbadm.htmlcontrib_dbskk.htmlcontrib_dbus.htmlcontrib_dcc.htmlcontrib_ddclient.htmlcontrib_ddcprobe.htmlcontrib_denyhosts.htmlcontrib_devicekit.htmlcontrib_dhcp.htmlcontrib_dictd.htmlcontrib_dirmngr.htmlcontrib_dirsrv-admin.htmlcontrib_dirsrv.htmlcontrib_distcc.htmlcontrib_djbdns.htmlcontrib_dkim.htmlcontrib_dmidecode.htmlcontrib_dnsmasq.htmlcontrib_dnssec.htmlcontrib_dnssectrigger.htmlcontrib_docker.htmlcontrib_dovecot.htmlcontrib_dpkg.htmlcontrib_drbd.htmlcontrib_dspam.htmlcontrib_entropyd.htmlcontrib_evolution.htmlcontrib_exim.htmlcontrib_fail2ban.htmlcontrib_fcoe.htmlcontrib_fetchmail.htmlcontrib_finger.htmlcontrib_firewalld.htmlcontrib_firewallgui.htmlcontrib_firstboot.htmlcontrib_fprintd.htmlcontrib_freeipmi.htmlcontrib_freqset.htmlcontrib_ftp.htmlcontrib_games.htmlcontrib_gatekeeper.htmlcontrib_gear.htmlcontrib_gift.htmlcontrib_git.htmlcontrib_gitosis.htmlcontrib_glance.htmlcontrib_glusterd.htmlcontrib_gnome.htmlcontrib_gnomeclock.htmlcontrib_gpg.htmlcontrib_gpm.htmlcontrib_gpsd.htmlcontrib_gssproxy.htmlcontrib_guest.htmlcontrib_hadoop.htmlcontrib_hal.htmlcontrib_hddtemp.htmlcontrib_howl.htmlcontrib_hypervkvp.htmlcontrib_i18n_input.htmlcontrib_icecast.htmlcontrib_ifplugd.htmlcontrib_imaze.htmlcontrib_inetd.htmlcontrib_inn.htmlcontrib_iodine.htmlcontrib_ipa.htmlcontrib_irc.htmlcontrib_ircd.htmlcontrib_irqbalance.htmlcontrib_iscsi.htmlcontrib_isns.htmlcontrib_jabber.htmlcontrib_java.htmlcontrib_jetty.htmlcontrib_jockey.htmlcontrib_journalctl.htmlcontrib_kde.htmlcontrib_kdump.htmlcontrib_kdumpgui.htmlcontrib_keepalived.htmlcontrib_kerberos.htmlcontrib_kerneloops.htmlcontrib_keyboardd.htmlcontrib_keystone.htmlcontrib_kismet.htmlcontrib_ksmtuned.htmlcontrib_ktalk.htmlcontrib_kudzu.htmlcontrib_l2tp.htmlcontrib_ldap.htmlcontrib_lightsquid.htmlcontrib_likewise.htmlcontrib_lircd.htmlcontrib_livecd.htmlcontrib_lldpad.htmlcontrib_loadkeys.htmlcontrib_lockdev.htmlcontrib_logrotate.htmlcontrib_logwatch.htmlcontrib_lpd.htmlcontrib_lsm.htmlcontrib_mailman.htmlcontrib_mailscanner.htmlcontrib_man2html.htmlcontrib_mandb.htmlcontrib_mcelog.htmlcontrib_mcollective.htmlcontrib_mediawiki.htmlcontrib_memcached.htmlcontrib_milter.htmlcontrib_mip6d.htmlcontrib_mirrormanager.htmlcontrib_mock.htmlcontrib_modemmanager.htmlcontrib_mojomojo.htmlcontrib_mongodb.htmlcontrib_mono.htmlcontrib_monop.htmlcontrib_motion.htmlcontrib_mozilla.htmlcontrib_mpd.htmlcontrib_mplayer.htmlcontrib_mrtg.htmlcontrib_mta.htmlcontrib_munin.htmlcontrib_mysql.htmlcontrib_mythtv.htmlcontrib_nagios.htmlcontrib_namespace.htmlcontrib_ncftool.htmlcontrib_nessus.htmlcontrib_networkmanager.htmlcontrib_ninfod.htmlcontrib_nis.htmlcontrib_nova.htmlcontrib_nscd.htmlcontrib_nsd.htmlcontrib_nslcd.htmlcontrib_nsplugin.htmlcontrib_ntop.htmlcontrib_ntp.htmlcontrib_numad.htmlcontrib_nut.htmlcontrib_nx.htmlcontrib_oav.htmlcontrib_obex.htmlcontrib_oddjob.htmlcontrib_oident.htmlcontrib_openca.htmlcontrib_openct.htmlcontrib_openhpi.htmlcontrib_openhpid.htmlcontrib_openshift-origin.htmlcontrib_openshift.htmlcontrib_opensm.htmlcontrib_openvpn.htmlcontrib_openvswitch.htmlcontrib_openwsman.htmlcontrib_oracleasm.htmlcontrib_osad.htmlcontrib_pacemaker.htmlcontrib_pads.htmlcontrib_passenger.htmlcontrib_pcmcia.htmlcontrib_pcp.htmlcontrib_pcscd.htmlcontrib_pegasus.htmlcontrib_perdition.htmlcontrib_pesign.htmlcontrib_pingd.htmlcontrib_piranha.htmlcontrib_pkcsslotd.htmlcontrib_pki.htmlcontrib_plymouthd.htmlcontrib_podsleuth.htmlcontrib_policykit.htmlcontrib_polipo.htmlcontrib_portage.htmlcontrib_portmap.htmlcontrib_portreserve.htmlcontrib_portslave.htmlcontrib_postfix.htmlcontrib_postfixpolicyd.htmlcontrib_postgrey.htmlcontrib_ppp.htmlcontrib_prelink.htmlcontrib_prelude.htmlcontrib_privoxy.htmlcontrib_procmail.htmlcontrib_prosody.htmlcontrib_psad.htmlcontrib_ptchown.htmlcontrib_publicfile.htmlcontrib_pulseaudio.htmlcontrib_puppet.htmlcontrib_pwauth.htmlcontrib_pxe.htmlcontrib_pyzor.htmlcontrib_qemu.htmlcontrib_qmail.htmlcontrib_qpid.htmlcontrib_quantum.htmlcontrib_quota.htmlcontrib_rabbitmq.htmlcontrib_radius.htmlcontrib_radvd.htmlcontrib_raid.htmlcontrib_rasdaemon.htmlcontrib_razor.htmlcontrib_rdisc.htmlcontrib_readahead.htmlcontrib_realmd.htmlcontrib_redis.htmlcontrib_remotelogin.htmlcontrib_resmgr.htmlcontrib_rgmanager.htmlcontrib_rhcs.htmlcontrib_rhev.htmlcontrib_rhgb.htmlcontrib_rhnsd.htmlcontrib_rhsmcertd.htmlcontrib_ricci.htmlcontrib_rkhunter.htmlcontrib_rlogin.htmlcontrib_rngd.htmlcontrib_roundup.htmlcontrib_rpc.htmlcontrib_rpcbind.htmlcontrib_rpm.htmlcontrib_rshd.htmlcontrib_rssh.htmlcontrib_rsync.htmlcontrib_rtas.htmlcontrib_rtkit.htmlcontrib_rwho.htmlcontrib_samba.htmlcontrib_sambagui.htmlcontrib_samhain.htmlcontrib_sandbox.htmlcontrib_sandboxX.htmlcontrib_sanlock.htmlcontrib_sasl.htmlcontrib_sblim.htmlcontrib_screen.htmlcontrib_sectoolm.htmlcontrib_sendmail.htmlcontrib_sensord.htmlcontrib_setroubleshoot.htmlcontrib_sge.htmlcontrib_shorewall.htmlcontrib_shutdown.htmlcontrib_slocate.htmlcontrib_slpd.htmlcontrib_slrnpull.htmlcontrib_smartmon.htmlcontrib_smokeping.htmlcontrib_smoltclient.htmlcontrib_smsd.htmlcontrib_smstools.htmlcontrib_snapper.htmlcontrib_snmp.htmlcontrib_snort.htmlcontrib_sosreport.htmlcontrib_soundserver.htmlcontrib_spamassassin.htmlcontrib_speech-dispatcher.htmlcontrib_speedtouch.htmlcontrib_squid.htmlcontrib_sssd.htmlcontrib_stapserver.htmlcontrib_stunnel.htmlcontrib_svnserve.htmlcontrib_swift.htmlcontrib_swift_alias.htmlcontrib_sxid.htmlcontrib_sysstat.htmlcontrib_tcpd.htmlcontrib_tcsd.htmlcontrib_telepathy.htmlcontrib_telnet.htmlcontrib_tftp.htmlcontrib_tgtd.htmlcontrib_thin.htmlcontrib_thumb.htmlcontrib_thunderbird.htmlcontrib_timidity.htmlcontrib_tmpreaper.htmlcontrib_tomcat.htmlcontrib_tor.htmlcontrib_transproxy.htmlcontrib_tripwire.htmlcontrib_tuned.htmlcontrib_tvtime.htmlcontrib_tzdata.htmlcontrib_ucspitcp.htmlcontrib_ulogd.htmlcontrib_uml.htmlcontrib_updfstab.htmlcontrib_uptime.htmlcontrib_usbmodules.htmlcontrib_usbmuxd.htmlcontrib_userhelper.htmlcontrib_usernetctl.htmlcontrib_uucp.htmlcontrib_uuidd.htmlcontrib_uwimap.htmlcontrib_varnishd.htmlcontrib_vbetool.htmlcontrib_vdagent.htmlcontrib_vhostmd.htmlcontrib_virt.htmlcontrib_vlock.htmlcontrib_vmtools.htmlcontrib_vmware.htmlcontrib_vnstatd.htmlcontrib_vpn.htmlcontrib_w3c.htmlcontrib_watchdog.htmlcontrib_wdmd.htmlcontrib_webadm.htmlcontrib_webalizer.htmlcontrib_wine.htmlcontrib_wireshark.htmlcontrib_wm.htmlcontrib_xen.htmlcontrib_xfs.htmlcontrib_xguest.htmlcontrib_xprint.htmlcontrib_xscreensaver.htmlcontrib_yam.htmlcontrib_zabbix.htmlcontrib_zarafa.htmlcontrib_zebra.htmlcontrib_zoneminder.htmlcontrib_zosremote.htmlglobal_booleans.htmlglobal_tunables.htmlindex.htmlinterfaces.htmlkernel.htmlkernel_corecommands.htmlkernel_corenetwork.htmlkernel_devices.htmlkernel_domain.htmlkernel_files.htmlkernel_filesystem.htmlkernel_kernel.htmlkernel_mcs.htmlkernel_mls.htmlkernel_selinux.htmlkernel_storage.htmlkernel_terminal.htmlkernel_ubac.htmlkernel_unlabelednet.htmlroles.htmlroles_auditadm.htmlroles_logadm.htmlroles_secadm.htmlroles_staff.htmlroles_sysadm.htmlroles_sysadm_secadm.htmlroles_unconfineduser.htmlroles_unprivuser.htmlservices.htmlservices_postgresql.htmlservices_ssh.htmlservices_xserver.htmlstyle.csssystem.htmlsystem_application.htmlsystem_authlogin.htmlsystem_clock.htmlsystem_fstools.htmlsystem_getty.htmlsystem_hostname.htmlsystem_hotplug.htmlsystem_init.htmlsystem_ipsec.htmlsystem_iptables.htmlsystem_libraries.htmlsystem_locallogin.htmlsystem_logging.htmlsystem_lvm.htmlsystem_miscfiles.htmlsystem_modutils.htmlsystem_mount.htmlsystem_netlabel.htmlsystem_selinuxutil.htmlsystem_setrans.htmlsystem_sysnetwork.htmlsystem_systemd.htmlsystem_udev.htmlsystem_unconfined.htmlsystem_userdomain.htmltemplates.htmltunables.htmlpolicyhelp/usr/share/doc//usr/share/doc/selinux-policy//usr/share/doc/selinux-policy/html//usr/share/selinux/devel/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz2noarch-redhat-linux-gnudirectoryASCII textSE Linux policy interface sourceSE Linux policy module sourceHTML document, ASCII textC++ source, ASCII textassembler source, ASCII text?7zXZ !#,xq] b2u jӫ`(fh(=˅d\z|`3amgD7@wImޯ3 Mj,+e+k%u 6U3a\v%l&]R`sl!hA1C_W[y0ܙLlqEu[T8LK͵Gyw恶 ilQ RYF;}R@-k]O^S=qv=xFORmЈm2DO&ňFL>GʬM ;V) NuG" MynJ֨o`ʏ0VvrRTs$XlEK)/C܌qMRqfɻB4 D1$qCy|-D vBV^PxJϕX'A 3pRrAJ*VDx/]9X'Q'cH<_7yN"HDuj;T4d 0XW6tXd;̪ߡZF;t?pOi2!߭F1Q!oTVm3M3r2y*o[e8̀p%~(WO60{}c$A&G% %Gdv.LFO[>3VpJ^8x.֌= }i%=-yU@e-26e=s6q2睲vlu-K\&Qz?8ŋ(з}iA۶ Xk>\\%%rLط6#I/sFU?1:9[xƅsEO`LN=o+5c؇F NK5*+Hh.H g^ox;j6E3",  O?Ve̸U4WMwƴ|ɥGڿ~F}c*NImG0c>D[:`s/Lӷ&j_qޭY`d=ĹE1 -]RĉR9[a@G9dMܪdBb}j4LsۻadyY#х_J='.WlO©Y,0 uR%\p(WezSsӫ)<+J\Jk 9'MjDSV̓Cy09ӥNngU'#HA% m"UY(.i58qnGdW6za;7i2̳^рVKuOb bSsjj &)!r'+ْEH@Iwb)oMsUQV+ MuON* ?Jt\đy>-ps/7,ɋEhȫ.X,ܯm9Fc{[Ԩ6i9_vK5> iq1E#eZfq6m_!W<^Ǘ$m[\\ ~c1 H"h'#8ˬ%aJ=ΞP8lc1#?] D.:s)-ʩ7<%y;jŨ7)ؒz.,c|UtoGF##S DA^!S3,`<ݶ'J?6rx֑`\e0M>䢶;6I3mFBq_jΞL+xhM]ax}^ο$!jx5SߵHt&4D˲vMT#b?2 P3E_>]C"V/mCFv ;:HlE\\CbӁG'fycxPס*MU1!׀4u {! a1J *AOo󘡘lp;yu /q9R Ȗ^Mg^l"+$0 7+|r @SΗ$F!3!:ǒܶUDJxȈ`H 18ԯ:'|bə~i/w5n!l?Ќ8uy5 -6a72A\Lrx &6n4mu {QSY$>?ZaUtN Y3|1_ Q 'DB'oޢyV|hN[)x'݁wWISt!f|@o;E2lފ$&w֟ =[L6~' 0'_LO6*?R#T˴klz4#.bծ eG;'rqCKڑD! 4lMF \kc׸{]YUmD" i*ҭ!+ezn+<\aYPNlDQ^r <,YF@N3{<>Kxb$.?ەKֿHSyRŢ5Pa|qے2ᇒ":(6]^Q*ն9ǼЙ'oY?i{??_EH6(VεG~ &X0(݈?'׼E3ϒG.9LpHZӬzktOuL>=E˵6hGc.+Tqj'oRK˞;$SfoY\ 4`#:! :TUi& Ƅq lmFd,lW3,lqAzr}_5]35hG%]:-T.¹%2@G+ "AC w̮%i s JRI@1EE0vXkw"8A S8.7%xC\vYLn. 0QaOgmOj_O;-JȉOQ.8j3&EYyGB>g!^A MqBq #NjU^Ù~tL27粘T{3dI?$]g ?-=N49% |/cޘ6h]@Lu~ʝKo(wc@ハ~1Hҵ`xI)[l> 5J=Qf՗ J}R {x{syE?rR0Cɝͥ1\W7 24PAfʓl}AcD#i}oyٌ_I5cc_ -8WR6dٺÿm,ҩXnud {y#Ŏf:Ely`ttxx,cd.LmGCEGdž:a|д گ!x(Ԫ@ |ݫ3[`BhP3Ԋ>XÆP c2k_%SY^a8[x%D"`[KtMZ^'3aԫ ]<7czfJ^Tt#K'XAױ#Hʾwh,!?T#}%k%%Jl\2!hLRunoWJ:+)8i4mu`%0ȧwIpm[EҪRK" 4K]Y~rɓ`wtOB Jf&<5'eJ R2Г.#E"U-F(Z}'[PNa$_%e'Ra0S+0`"ߤ͟zvZ(AnahkZҬ^W)5GZ"#ʉzSuHZq}d'mLhFIdW++9M ZG{o%`hz[7]FY C6܅6*Jir;YBM1kB),0'82!A\5ŦXH)') PK`;pչxju3(DK^rb4fggDHLk"}`~w):6 )pؓ0BkY=!d)O_V_^R=) tW 0^ ]VC|sd+]7/8B`UãHB,VI/dӳ~F݀}!WӴm\?m8#3KFb$>ĥ[j|s>&mJU?':'w0GCZ| 35ღÅ p(_eGhIJ+T5y pP` `޳#7]UKmmL'I3+h\It L.kF BWk,%R}Nt"ziZRҧw]/u$"лir<+yYy&>ج6Hcg}d fYU.tN +3BPF3߲@Eee 2u] '7 2O M[$<9SLW:[@nQL,4*cXt?M*Wc .h%4i l0F4]Ug9d4,jsf~5gYX+ jyAވBeգٙ4#2@d0cvWw"I?P.ZZ4l`'Y&F[8F!kx~.1hfkS>ShҝNGw8PGo5 =w;NyKx+5>BJCpu6#Nԫ) m}qC꘧y)( 8lW>/ypY 0yZou aW8IՃƱŲ 5 kEg>D>!e|*  * Ųm~.E;!}\DP0揄^{uj⦰7ೈt6E?E+NֽV9b3MU_#JoǾT]C _ ]2ig$2VT!RHӄcPc 6fs" jd~sn] 0Ŕ,FYhM.ǩ1e.uCv`M^TURg a}h=2 "=aB|@7Qlݞ2R/H5Cv't#ˉz~Pa~'cFِ&ZVY.s$U=`ZgQ׀ =MzЉc=0.O0XЩw[|a10>VHOZCDr6ksq> o*N:mI\KMIjV 3F@]j/jS#iB@ 0V?>/e~X)y;'zR .ߵdŞ%8>Ū s^Qs_}:i07UץF@*? 6geo4*l[ īYm=MNt-SyZd`}5JqғrHS:-Surc)N +Ļ_ӥc 4+%<*)-u;sx^vD=V1a&QimS͜N7}L~dM>V{a6]G֜Twj1#,/YQ*ik/C-] i|fd@aN?)SӰ,9vIݰ3J qZ[vfkE5Ph A!]'0%q=}  d nU2>7fzOKCEejQAuY̎&r /L6Q,X8DEZ=͌ TC˨N0|@]&ၚ4*dzZ4Ѫ)[nls8!>pz5۫'^:yx\[ dߙ[8ޢ[i`H-KZ1q-[-5.*$03kfd|+G5U$;q.ޡ*.VrvZ#-n6^ehbL:G" YF%DKPQp\{EC!ȠPꁭ 1vi+ދUD"ٽ%Zբw5Ɣ愡{@TzhCQMwB JQ!<{ti33;o5dUN{s#xUB"< !Dx_Um/[`~"ˀl=#yk_5,Lئɚ>Cr3`ɍb~ ^S'YlVA;$Ǒp@_fJ#)b:9RZhT@L"6n4a5!mѽũvMSKܾbT^Sdطh>q..n?t=AgRRdv{Fu]pњư9FP.x1̨y&~D)s La!z>p@&=>;OgUEīhd|^XLw;smR l>лqp9TD{?5cԷ5wE.BRpΗѨںN/*7ΞiAk- 4]=IeC0s˿;{s 4UL[\GK#k0j!w.t`繬&<"ZX:lrFWq]gS@ 2޾qg[U=q"x j]BDz$BdJO h40zvvތ5ߙbΔ&]N121Kt-l C *5LeQңvy5ɭp-~kEu08x7lKekћzs)) *faҊҖBOj!va&CaV3T#S75 ܘzS]{sG&7%`I4QG λ&I 59 '>_JŤY~hWYef2` S\qƜ'V9<N|FCRig4~C=mi7DDmaf+ns8PXGVcXT'|(Uu@ZKr-Kaeh6n\Ȼ2/$P?sz iwzBncGޞ1vPH:]s,眎l$yxW\bvٞ-&vǞľiҁJØTay;Bcd7!G ~ԸՁ`TTjccB)w bdͮ{RĄ̬bCX.I?hmV 0:冗mޔNԁZ넡ΐ>=%r.% ̣۞ͦMpuɯlb3}I)[ %gTi"級kM.%%E%}ijRG6;5oWYV6Q"R`g+fd!W YK\[ٓ I[fi&[~-.NڜSkoembQ$#oi!O544܎Kqм(pw'aW^%t"d3yp\ꁂkd=Jo|u;" a~*X oػ@ARvuN4VMluh#l Ir)E9e&v׾zZEy3@3LVԬptr< AEoogE3 &<^Fc#3 ͫP&qOS;E1/YK%[chy0%F:,w<3 ϐ-Gveu+t5Z{/5! G.5eW?!dg8MgW@d 'qavrqEʗUmy+ce|G/ER(|s|S;ÒN [>'0wkot@^ ;* sě9ܜ_)ÚC 'h}SNM hTl."GȆZņ^O .+Qm`JWɼ njWzTil3Єrm}^ɴq&)m/-_VܾMf]xVȈB!;R$۱j> _3oD hWfFCREk q8,=Aogu|pk8+D(K]e@J хQ֡r$4(o}]uV(>?cyb- rz b]D}Q-uIz)>oKyXH3} R؈ό!Px/ <hƈN\ucUB%P!6(_%xuD0[ z5!]koMI{zKU]p%2?-`ΓrIOakwf7}:A˧6^!"fLxU=M7H&s˛t:+t[N)YVPMD>_d&}0fc{n^)M|!,x:[ɑ@{LݒXl?sBi_X_v&GeeYy5j]}E(Я&愤6oM;#`N %-K>\:w̃~͍|wBz!\rT!6Mn:kٕ$f5ېt#b !:=`Y}&ǖW۬Yjgi̳UzO?a~/}s1/ao'XIY|P+Cqw~܈ .4;Lm5a¼7 jh;;chU0n{ga NEl"HvJ w8@E0 K /*O:Qxo)f&ny.)%\3Lʦ1[- Sj!G u#4-.Yc~sIT#5\ډټ}B1~qH UFuc !{(LR:o"JYϹW+dHm'bF^ vU>Řcrf gjEurw;1KwWDwH_bkeC.-=axn2:E(!M<}؎kA_mW (9u.sqSZ];sM$w+,T&IBoM{P~hanZ v{Sb?!FXO=L7eiu|,Wұ۟a&yK{{!KotI<ȸ~DTG4w O1ώZU7ή:QpIe}۽,UyՃZmG<6;m=BnED({t E(c!/윒&Bpg9䰡2W)dsA.E2rl9n|\Dq⑄6@yy.ߙWWBe*6{n$n_dŒ["'W;Jʂsrs'na,Y _B7AϰFT.aM cS+.H {@S ρ¾r4a%(U.|gņeUh^o#1֥hf8ᕀ؂4Ȼ{["zӺ{aS.s##~~H\ V^ѼLHqMpHz'`11J;yCo걣.8iܥڠ"y">1jc$ϞLbQ" l;ZDz+pm|w5g2k )rI/H ,h4b}רa83kMfVt@fB;,Z MD3 *&7Xm*S'3Paz*~mnӉؠW8*=UQrg:Y~94p.#W|ˎF[fo6Ag*%W(kp?[X,#tKR!Fһ>w+Vo,뵤wk!-@zoQ\@03KDUJ]#}߫n&%}.n~KCPQ׼, .c r#JG^a<7_y6zS*oq:3ouFJҒa $t .[Vfl#H}iV 3~t rü6Md iWy5#h vQÈEm6֓cdRCwC MΘߦ;ThzEzD?/\|ZB_oh!V~V),Ldr+T6TK,Wȶs%^%H7-%Q/@`}*FpkO1AVg*ەLtFP!neA@+fD+DZt%5+dD&wI񓀳ɋc8]2VX< /s `ɭBGAC’X?u6F$kj*yDwR] gBSI S+!N.16>\z@wZ`BEolz۩Ol">ľ)'E`HAA4SUbŅpPY/DǢW.|XB2׹cb6/j.CnTI6i"j.5XMP1,o eC"}p*v{İii] }{n1DX8lM`#`Pg'1 a+U稶Y5/gm x Š3h!"J08=B?ɳ:"_s@6lϪRTg}'d݁sypN@S+!ݭɹ:[ )9d=UBӏL ʅp'I$$J[.D_5GFoCmQᖢSb&t -mr/=Ԯxzm亢BjPNyqLK}@!峉CF<@:+wK <{k.]`n| &CVxB0MaJ@C %d6+/j)©[#޳ +c#&0GqS&Q#/?G(]?h /!"TcX(pnQ] <<8X]8p }-G3_4*0jt8(wWZX%`[g{?$;pgbƹ# ˌnA{rpzUuC\–M vbo[ħ]GvbD6vBvSI\e̳9ʌq Rj&˰_ /C?p׃rӬs9h=Zoy omq#Evc4$|-ұƆKA.␱Q 745>V$Mqޔj|zH0@ɷf :vv_PƵltvUTRin>!(kOQHRv&wS&dx?[zO cV)St)b7WrwͮPHh6ʕxĊ  gաLMg.291)µ]zEJ`\ _=p=W]ᲧX#Ej= H-+8"7d>P q=]:xz-}ԙآm0iX,#wDh:a s<ØYTW#\oɋQ]0 Xoi.' )TԢTKiLB%wח=륰s6C>U`ڻ S1Œ3w!KNv`($AriN뾢+4jr'L|P>K!-Vmܟl38uzd|1LSߐx^וtEn/iDZ ­މQg:VGARCgß*Cn=zPdFT*[G"x\ fCV~rݼ|+9ɻǍCnRujhcf4 IgYm c,gy1>nㄍV^-:b}B}_}&A 7:1v/˙Tu;{?]^xұK~u585xς1m2ҫ+k<ڍ/fTl@X`%.HKu.cuL|->U NFbpIam^u-2N#EEh~^U7>k+.=:Y0P=2 /ªOuQA!e-8dv 70 Y@+p*wƞfYc }yhfc3، #qKa.'{rUu2U`V{3S7YIFu7Sl2-zy*lphVA…,9cMegf)Ny.'{nluCT=ٴ~9p/>19)Z˩&Wc4k( '4(h}_-fdagNZ{_I8䡻y07Xh91e GȓTi G](`DrΨ_/Fґ>4:nFV~-NFc 2a[X+|8(]l6?sq=TV,U\XT<=|\^lh֘aJ),4$\ɍ! >dLaaW~QV#p$ĩWFmlOtrh߹B-h!K7⮁P -l !j`Ĩ!.|29n6{_@ftɨJC0Z:8$ ZN_0ZN!9wN*nz1ސĜm =HpL4em"H7=2mOMgJK;ޛ)q;Y ZS7~=JrU61,nip>Oq+Ue؟{bUWQY\&Hd!|r29u :^qR׍ >m~x!+6&׭~ r "'ܽefޏkL|>PgT>tx쏀f :NOY?[㻽 Ǥ:ьyכs#h:}ǡh ItߎLjOCNlP M4WVUxQ!zdkPD{q=rjk~5;hQFg1`CxpG=>T:6+Ȇf]q&uW?+`D{X9Sr1a 1,Vf[O퓗lC=۶d,JEF?!ҀyFOIu/+f*db\-gDZ*O@Muz:~9uX+L*m:7J!Q5mp!H޵bi 3mdXR<[dO#4@ijK' Uȝ OqOgU;1gpKE_#1DKiOnxt[|W.څ(ixqji UhaCN dy{T5To$jSӃ#nfͧ2BX=5Uvi~CMf!zb'^a%[U(Ǘghy%bF)1d`Tu/)G5&,qqSͣ7ćg{;fj! _LXb( +c)hcp7a!PҾRmHX2){r!Osehgz3!N&WYjaLc2&גd =1(P󺫝 g3^?Gۉ}PO-(Oa༮vWu#%ȃ)OUgaAY};/r} R ׿^mћ.|y* FQ< {qŞ|X0!U[U_"SA%[䥿TN1{Twu*MTB݊g\zɧuid֬HHXϕ69) U6Urb>v{۸`ߘ,G/93@Ui+e4(n]8 ]i4f BL~XE9H*5Vd?c9呆3Vߋ5%"b JQ` :`s5=Z;*w=|9lǹX.^؋;C$dɻ0] x>2+^D '?~ \E"MM-ӑli z?dY ik(M3g:ZB%F2]J/Db<6M8usJ9i;:w(5H4Z B:E("h4<zT-oȭ5}k_(kCD_svU#]t&硧@:4`Ⱨ%#wFЯ37Fj"ʣ; 4uV'7}xO.Lvcv9 H2>>QE) MI \*}c rN?[ =* ُ~ᑯF<C>,' B69tRu/#{;)lj vܢte=AWZ@(7*Q<٤AM2޷ (f}5SY o'mgT<:}$v]_z&̩Bz 2[K5᲼lKJH$~J509SJF\(KvFln~kb0L^&#wQ%1A1Eo#|?W?xn^\_]ZHc0+QەqL2Iέ|^'hİV!545\̗U$N}cF$Q6 a5< iݟuSggy^YbUjj2?agj[&V4 EEX3F>b>1 Z 5IOCa@J wx[[EʁWQU TX!/sw!05 {Hdu'UX C96&Մ)]nӳ!Sy͠jyW|n9 7@O&TnTOzIfU_zNukQ@cݮL/?йî :y )34,>UT[u(kPޫ:wfc^@O ek.g7ݒyi<`bdT]*)'wdA35Z!"<*qNjM_J/Lr)dF}!%r X2WFx)aa"^fFFkr蔿GIFGD*`zE蟹P:r%snݐ1;WN_sU < H"'X Ĭ314Pcp(H-Dm+e2aIhfMc#-p+YU93njI+xy̠E^CNFaT8,4mP|F++{%+thX"ՅfGHmmQ>~JǦ+ڭ6,~Ow6 llW`j Q!aM4LH2i2j (ΩfqHNt車wFAKبI ZNo#L ?TJ~~,3z%+xm# T0>?p;`c"~\h6 fy~Up+<'A_Z?OdԐӋdr}Gyeؕs{4Ȳ%78FX9cTUd cЉ554,.Y Ԛ٤RݑzQl,a9 7r\E\˂mI `- ݹ#T̏\W|Q\cXʐs<[<ۧ ,-h7G%F2Usy`{˜r^{X1Jr ڜ=$q wB%ÓqJ.ACNK~% UmvtO Std]\W灷3 VL2Q.|O[gf4WU}G< ѓOsWH ~? _ 9 f᭄)+ɂFcGb@w)xeqD]7_ڐ og;;fv7^r ޞ4Rqr{FRY&<<єpt_HĸG%xQ:~Rs$`W|hkrye\\j}MPrƸkDi:"a++u ˮa^s)\6rӝG7DŽB)llU5<™8Ո 2uFI⨸Oii~R^!LU7X=C !0QoA?#R/[ȘuօIU(~&N|MNĬI(]2(!3xkZG4 &lΉ]u*tnsvJurd5ƫ/mY]g!+|=l/$ <<=ed?J[5:ie5ι􅕗ZВGmѸ%߉GL.' n{p#7ȧJT%)5ZY60T2'&ӄrx@i߅N "4#u!ƙk,LZ 8EAlE.8YG RP͔ 3G~ +p^`=|ND?E^3KKg[3⁉=A$:qPRLūP l,*Ƅ#h&xuN[rZ NB_"pOfm 8gjO  0txĹ?B!%eωGYĭδnS#gN/ &ӿD9f u'+Dlz`$ `?`xzM,i=ISΆثo{R D5tLn^'O @[rxoP&7羾x/쟸zJ,;#q]A=kv򌃮lR*ԈDUzi-nf'<},/~ϰ,]TKip(e2RvU{d 92ȞC (*zFM)ztRl ЂAmL@ #]'W~"b] a'p ,ɬфUz[l5 E$uvͱ-^U"f-DiX NL+vFDt*<mews2?- m焤¹`l#M wmw0B]ׇ&!NQHL,BsCKDރOgL! |Qf %+0q.+C88L# N.Bcē|J?dthgb2]1+%lAF=aF/7'-dwqșlqDէxR_`< f'i&IqsuDn^dh3ߣ l63yV1Ӄxs @9Rr)c}St:֗E(,$l ^,mFX4{$.Ӽih>kح$:H 4l`#f́V*+nz""/`7pd$ E ^(~@(>܆"rg%@5ˬ jb,mҬK6VAԴ626rD.aC445.,aCE^[_ `a#%jYZϪ",GpjuQ,ij0*%W5,ߩr!23^vo 0 7YD*\NuM v6ո6uB4iH_}Nq+$s '&C`hlKI@FWa>X &ݼ'ߒ* һB >IG^j;JxBMdv5|cIO ^Qz)ytg-yΞf3m}lj~\bś qjbF #c6Ғ abKۣb!^:rn+ͱ(ۄsjO4Y*՞ڴ"̕o4BJ'@o;EiRy ƁǝPYxnV;iXJP7%T9Ǩ3J WkG:v,k m)c~Gɕ*k$ʱԇ?&`y P&i|K^O43(pt29Z %+- wߘ6}Yɣt:>n@T8-WEP4 IG''ҍ RȕVi ɽy Ԫc0t8\~\#Dj@$c =TD4\]utKU/ 87IS2 o„T  bȐW݅Pdj曉E4`zKJ!Zn̍z4i0ƛ Viۜ 6iuO-#5YDhqwKz0_^/<1?ɗCH̐/]@Azn@ $G CFMqB9VSw%pu7Rd>flC$[ &߯'nzC[;N V<'=Զe0EKըFGT,UBH{&ksľcfZ.;NO'T Dr)d=냃HbN?P7Kt"NsMݣ*ܝSW[e~x=w>4_:Uĭ!Kt#ðfk [z +.Ck``y:iޖS󣾕Q+b<\e;ħ Bx?c;4Àla+K*Yhh+ :`G\BّŲ p-.Ln ӋFv dO&v(8F1\x'j-@|:R_ @uåFa[Rs DYGtDAi.~Pr~1/OP:*i7*[Qg+Xj (y=nȒPZC̅.=|)([lM%~S "֕ᐵ47Ҕ}[u/VB  QYk2 5]Q9:5O"3D'^#l u-{AXWQ'B'U4\ JAQg^:2-4Z){KTa䞳>+xt1;aȲpVV^dTV3C6fZ@E$ pa`~, g' exU)̿6`]^šW6g"G [:6`lH!=dxIɘ_c8fLnfM}S2>xD) 8GgO9"JƬ !f`bL\Ȩ_L50>uUE BJΆօqK*_:2c$7 fv'bI _ez  (:,uРtɽoԔO1:_VW̦Nɫ6 Mʥl)pA+ϩ5?LaR4ao,Y(CW+|a vk,dM,xBkSZ_uxziqLl95QO[}3a6y/gaf٤/LsK%^V}(ˌ,/W`L`g$H29|'%ry5{d}ڧtњTb|na/|ӝ@^ ֭(Gnt7o#%K4W0fKnR;*Ybida? c>#k0 !P֧)5ƀUg>hT~hheM!&>(mᢅu!}w+ Ȣ Ho04,Z1ۦ4AQxZdOOc?^=X8<9Z# -MG j;|*l`F y`>$^ؼ_a\5]ޣzYATyE2AmƬzKDwIW@l䠷E!k iD" fl m{qɯW@0^WqKrJȓ\E&O'1EވQ@l+ T_ 8UU|?v|*>%h7^pMVSl͹fg[#Iҍ@? MPxȆ6fAli|5dwҶ򨫆Emu:9;j%yaպ_f \)S'.Cs kd?g:}"N"rFyq [5p@=P2GPaBTHnp" ">hctG*FS=b1( "jAEkEp'Tt^]6lN á-yrWh& T͍!y@V]ɺ~wv>"r+.Z95K@/e){FULg<}Ouq$(`;9h|HX0c2& >>+<;[I46XY׻IMtFF;IY}̻[>}6|jmo⛉P0QM7\)Q,Jd?L|cpR[po z)"i$? Iױ@;Kya_3ŧ] mۊ{2֤k21}0#ʺ^$_ vxd/w<»W2nl)RzH^^'He_9[iMI`]ġ$<M}HhO1ʗ,ݐgz #O2K)vXZDpv⸹Zys+:P7_+gا$* &"ћ![j!V*~#UR'm0@JD.Tz}UucwOkaiUEC\&%6LtAo;8l  sNۭ:xQ۩ e9B:,4:ceXS¡CV[G`a`=˂!OҴͩo)*{&;;~Za,TN%dž%G\ܽvwEG$oj֤2W͍="qaf޽]t~ 7(nz)q;XD7T )|LA"Bq7Rg5WBh_ɜ8AŌ X+7VDC'FX2 GuY$:O\/XTn"k"8p2œnӠO$8z 2%K4BgU'#[aR׮˼QB!'?`q;Jv~ <ĘVzg\Zڽa$14[n+>ܤAjde[6= t%d7BvUɚjk׋ԶMoKvy(Ld(F%)CZ2+!\*)=IJs/T¿Di-7RD1lI0+,m!:9&StT qU "p > Wv=Ɨ3ɮ"|u$C#jP؅D-#k+dsk|KlZ,!󒻒`p%< SfoRcAe'F`Y# K\CoKf jl߭,v6/j{7LrZP=k-7p/WNޘ~XV.۟|$0tJ=r㈱P%D_Ӣ!Ri_`Al}KröMRbߏuf;g_<C(Eu_$2 t8tss$Ŵ3,x&Y`,?A}Pc\RNI0ԙcأwuv:ee/GUq=fm8c;,7QU 1tA{%_!Fu<.=5Bšo_$ Ǣmyq+a8wFQF 5e+9iСllmqEp0~UC{Vi]ைϾ/J7GJC6` A{A(״G{O"((]J %wՏ~baK*w>@!=J./R.̓Z׈7p m: +-2a5}RI3RHV]"J TM"-ɼRAmT%Hl?+x\:喬/7Asgl +ẓ%{(7b t3 1sKa?jUr>Y&ECma֨<5^ cV5L Yh-MO٢\$",FndZ$HYk$0nwПbB1bKg^đz` ?"ѭfWQJTxGB40Aq[/!UhD@˕y6`j.D *>tV2;fΦ \qq@u{,XvA51eJ|QJ5=}9z(%l L\ kƛ):-l,*@OmMI[bғvN:iqʽ˃~ 15FaW}0 nG~.*z(hCuB\Tk H'.U#fI㝃={ʍ̖戽X\vlFmRʆMO_p{zhj)5\;a⢢~s7R~aBQ>Ӝu^:- KVnu8~OB3 27/yٍe ĔѮc}@ gl+c῟r;3(IM ~wW0_1z,\GQ)起!T1x=9dtSںUpNڎ@Up'T#`7ql^!bV!!eRإ+#!;%@$ D M*h;Ǐ-"ԃt09<(b@Qih'1·E)^ΆHHdd_7 cKx]G&}Y$%瀖YKB)_+jE_A:-rb_Xԧrk AXK C-GRٛJS6=E. Kmr.y5Y/Awjp9Iwv(>hj%V%jCt\IeQx+9XTTw%*QA\㼇/Cj`r&v]q/dҋrlԛh).+ȹTYat^;= 8bt*(@9ةD~k (Hb؊v0um콶1 ve[km1 A Sts@\f=ѣ!AOd֠ț#\!AK:GBTP؛ka==(Nx\w1L鞆5>2.%{UO$ NB&| JPsPi4X_/ԻPt1As]Du{ncJ}"ٮۗ)E0*):Q?p R/LJݘ8cdoRkrc+E(K|K ˻^CL J*#2ڐ7M>6ӏ+zNT%ձِk635!۴<[csuUKit'=\7f4Jaz[1 ~rò^=CĹg zKɛH;yR V-7) `q(+I: {T|ig Dȓ 4:tѿE8&4_>7-d9c ~!oHo{#zy_'[8`]*1 Gj00Ӷþ=ц} ;5vWW)ȪcV :g6 z'21,Ux _ uJ\Gh|]\Տfbǯ$)~Օ2ͨ{:KEVݔ4-ՓؓN5uYܘL_2`[/ksg~p=҇?Vʥ⼆O |?'߰5L ŷrvdpOܥסc = 2ZvK-2 :ȷfNt^,S2 Éxox7KO=+ߎhWLá䖻tԕ1/y?Q'/atLec}F&nh u/ʨX7_DpL`/|j΄VqZ.oӳkekB~fzyGRŲ+`ܦH;2]6}0j֢Zfinp*!#n\ڂ WbB"͡~]GZ#0D66 eVSհHr6u4E@W _t4Za[Ӻ]P`8Syh5yՈkO%e!ZؖÊ ,E|殧N܆5ٹ7|XsbIac5˃̰

aVkLb@`Ԭ}9t(*[6<ŴoE~I? ]![49tM,vohPo)}$}6Ѣ.+TUIr3\\{PO{[l@d65OҶj(DNu˞#Wn<7pDPF!g{(DTI018]P1{Ewr(cݦjḒu\aˏY5bn{AEW5A"{z TPZ妝T̘L:td/Jۿ5IU/in ީUtͥ[(`Vt"]pTXNSKWiL5q[q&\bgQ)|wQcO.:Yɥ,2r)qz՜aӚqp?RV#Kz(Ye75(!\yBfI!uQ%"6q)teLtEW?bcqk8 icNNHB[̨ WRlCTƭͻ Is<xΓ;թS bi8WF +QQJTkȪmw0GKI&)-Rtq`h.kj]@Y,9t Mlqņo7 s&Vm\\S\-?\ kSh7bloEJM1?|SIByNYPb]f&Gі]j85K1|xp~:2C+i;&pV%,l;@d}k _ځk8^W@Sc*=u[#S+ ?Ȫmy rED)*썪~F9biQ5oFfePU~WWgֺD mՎ%TĂ@=Eq ;)Evu:?PZw;&}aO,AゟL>!wɳBIjtFJ6 m=sD7W & ҫ.WqAG09D""j5JGX΃1Cd^O6b(АbLeoO+l]BjY}RRx5縊fq{23#3&OU |A: &2ey6;KZ ?9{58`1i8FtVXaqs<5M;) i>Z.y 85CLv,S+v)+tens 'Z={kȽ &3P䝿Up{=?aHM7J1Dۛ+?8H۩);,KQQw p;=DЊAoj184pB(JĉgƁvrt_l?1 Y:WԤmKeʒ$/ɟ??&{.ʊd$\z0`NTIT*__XbiNqytX~"ⷼD "ytAJKKixd=n6Y??H8s2,+ށxvݦO{(1YNT`mA Z#/7-&> i0s)o5{1S;}9_/ TZZob9ۍx/+\ϡC]jY _W/mB7hOn[)%܌o:H-9ZiE ؂!$A@ZF!Fb*Pr6lmT3n|魯F;Cf^L*Ϡi#66\i ($ĜVGYy˭oEDN]ID_[4-]aI X ;w`";KuWЌضJ~`Y 4H+&;#`dW]ɡdb:ֵbj Dg~|Q8?}qԗi孃ULd;tnWYD9k'd@/]܃mP/CX]d&I(~Sgp%ʔnNdj6y:g#rFwι8,3Dw}Gs$)g-Exv"[ @G97ԑwPgjpWc}9MEo[4`"kG&˾jP޾)x}:S-P@I$O&ŵ CUcKuFR~=v)0 u"UFDe>\ghئ,S:~%o*C;s}Fi R"cn(B^Lw)VIp-a쵋<3?}[#U okNfg$]+֊.ҳ^2ޑ75;:@uK7YsZ!/ >7:w|xNyh_{TsVG2􃘗UudF`~=8`'sy8CX f =ʴ{Ҝ)x^w;2k؜N͛}qd=@6=rݷ^O`ܡvclmVSwk }5?w%fh R38$DC]MCû&)!@ϺkyA׊VEJ\RuTx?xg8Hso4F8I1cKrMiyEƮ X3o8ɐb8qҋVNgmy_}:!,=!* ` YSbBX\ 4fLsdw^QY1\K(xrUocBu(#=˜&5nj"Lv( ?On8M*Z !WܭZed&v:G_x@5 4eDti[}<9e85)c^dN@ŖvV!!]O޲֙XclL#jVt"b8ZY^9,šJY 37ՙu)܎[6$.H[@%.R=Gw\@DZ[bc_@B{zũ5%#V; $3U~YGb|u'%>C_au(?@l:H)mnj+Y}1NW/>>kSc`-9qL_f7~e!*p:R&u*Z1 l(dڙ-kaDN38$03R.vXd3t %7ݰl$efJs.*,lu~ӅRc&qo(T)}eT>*ֿa(Ȥ)FcV{m/\ [+/ JVKQz%W*ߟS  .`16 خ0@QTp veY]sj3(ՍHK\V~G͊m6+p%-Ɖ$lu-ԋ3"B@Gl4& @t 4Sy_S*7#چmu5T DGG@СE[$"̯? KRMg!ӋA ,KJ>lO|CmM |%,>* QGIV^pQQ&?U2}4nStq-\C0z貤SAh-/ŖrI(f:6t(7}ܼLL^-L(#_H3XǑezHt> ZP}CȻR+6.UlTq2+f~(ɼviFDl4|ewfj;lKG,>u\_ y{sӃ+ 13La&$bL\p:h)D)ʗWN܂#x>\z蟿[[Lv5ȞS3][w>FaCY%wjlV }4O&[ȯ8A +ZD6>͊{du͟*ה/8ӑcA[D%f@ǭ`{{$ ֒k=\:S/ׇ:g$A2Bκ  yb k_cd5wr\N4'>VZ  FR-z~ ,=zZZID)7G/h.gLXlu(7ZRDd fo=+@n,^E,kl(EB%PJ Y3@~s\#B kjC9VS*z2Nmr5x꽝*xnժ#owp1 Lt*}J~R:i8ޅ@9[0Po(>pxhMre;6c)ؿ^&9vnioal'vB׌,|֖8 oq&)RI5gaAdzzcdHY` 7dxMd@@_aE8c}쩑r઀=O, t0 Yt,,H }/sX2I}S0/n(hLrAIr fj)nXjn+<ΠxJ\5%,PMyA0wK\5R)ȸWiaHE'>VdY!fL!~m h{hZ7 x[)c:k+Wʵz5C|L⪤azĸh=bU\wگl0dJX}?IRwV%R m+jO 1b[e$[s.4mwr-SI Yg WL-tZc$]@r7rіBƍmYbߑ [}Ȓ<2;m9.H,K*fzbPld-G0KI*1ߔ1]+'8@i[lݙxNtvvשƬ9ӌژ%US3+3U|,rmYktz1ےİM>[׊@,b5 2f[[?W /&'K~< }HΞ&1Ǘ*pDeMI:w;< Q0ouþ>=D݋vCIq1 ~{o3C#1VbE g>%гAþ$,YLҌ3^7([}<7s= trs[njx؟.C X«8ˍ/(m B7' [#O N1ڧ{`oBE)|O0Z. "]t v8V6$r K]Ƅ,!zX:~-|Uc$<7ևM诈P)U~13k/ 8I`;-=(#"1*|m:U3@fb H7%g?d^&FdĝTZn/>Yt.r),"}NKy7̱Bs&?;YELz1+ЌHcnCŬ=},lNV(IB!󾄉` Z!ȣ bJ{5e@gQ7y W\efI#)/N=|\d5޳uxMqi(]Z׆p2i #oͽ9@P{DhVtҘTNf2 <B[Pol1WJ_L _PxY~m-3E`W׸StP%ui1׾||M"G8AO)N}Go#>|-~,a3eAh$U&ntuE^e|3%mLj {4 qܘs4ZLZ3;h6ưi>jجٙi!1>j ? Y1]Kne$i5aqNh? 6b9⮏|"Au'rT}R ΎAw5E8u݅ӝ[8YdjpF B 1~#AP}cEG;&Fqh` \n&h辁4–|\:)4p e{$ȉ[V{#uhK}kg# ɷ>łal>42vݳ[;v̓mޘzh;f)Uy&_;<)GU+AXw;5#vq=V|6P;&IlACp;}Sl;3Cu Frw$8 Pq4|O$ge2WLJ#Mk tbJ]+5q9vV|I@B&Wɺ(ZuTiK[d3 'U'D_b(EʶVi4a}"u J7ϯ8w |/9'fO'svle: ݄ߙoRVX~k۝!/7*5[gH{rfc@lJnCzG93I0x=DUJ81ΝS{Yc)UkjщܘfQfE:AV}}%sV'^NfHe ,0~;gpY[+V Rd]W2:~ItV'XЧ1٦CC2(}ke A-lT/#61LhJRI;lΧ؈8CHJEkPJļâMΫq*U &4S?o;Q os':y͑fYDw`zHb 1gF/3xr%/@EGkK+TC ԷqO LW+skµuw S4Ga 9ۗ8Iѫ2>yIb?~_l<,p YOв#6# /;G*{,YY ꉑm'zԖA˲X͖ԹXl'{Mq<_G_tȂDs֯HrM=έsH,?@dbPLKk3%]"PI/aoq_é/hL=X,XusWhȷ0F-9-Mi@*B,1wX(m\$A;~62`'ԢI9m5x)0xy o! m~ fxX ߯ꖘb2{;]svl42)0qI4ʬ2qRmAA[a([|2 2.-qVo4uiX“Th]Ym2ԩ'nKCe-~pҐCL2K -\kFЭ>+;4'&J.!F{6T2 t_ *Cfj쮐ѥƵ^+3Ov0fB6Oi@sv*É%=rsKۋ0%(i{G%Ys|F~qw$rі~烊!6u6jepW4riĪ.|4غҀ^0mW?ܐrܙ?E|1EӒ ;#\"'\mဓ6i۟fL#7`< rkM^J'wۙej7D_Ldi 싆G~%Rk9hxz#ҨN#K. 1ZtgcTFV18UwXD&r0l śu!KII5W+ａWXdpZ/uhUVO@HCmi| 9IY 쪳ܩ-DN8} _0\GA9q; *Ыޢ,9@f0yt`zӧs6O}$o-mPI䣅yL/ +JpA}s:LQ쵄j!+(OqXWjb1zpi"(s{Kv'3ӮFx1ZyC J.޴v;cSL\O03Lrd+t4^ܬͶzuk>Ֆg:@I" vk8 }(D7~|IJݵ`}bG)S S?nb2¢*!of{R{MŊ=t2/7PХ<Alv%i}V_ d%{_dsw@ʹ`#b2[pc :G6RTX_g;T/ 0,V_bpiX'_~Γ_16Y1n܄_ʸu^F|%L=]uϓjO^V%3thA[ʛ#|gꄯAA<,0G{]q˕qb{h_H4%87zdG9) Y4ZCP vHd3MF~CNNdy"Yd^?T'z<Q9*fe=^0#+s rK+| 859`/]ghJO8(hO,rkeAd 4'L^{h둼+OIĜmTwc"d:e~/Ym|Yml ء }ϒAxeP]ɨPF.о`^^r-˿ցDej0:&lsn KF4O>׬&5Bx4u'T _{8]]z~=d.zΣ] `'4f,ޞL9~nnn_5PS7J4٘>ߜ^6N0@ 35J&혽QO/ȬͤfgŢ96Q+cY+(=mICr1zڜZIJIq:l#I'{G cW SDUoh.si>eټpK7恸1U1q_PY\j^F{1ѝ@L8hlAƪ9FBbM2!y@Ќ^=wdD/ʂEBu.%\B%:-yeM6MVS7wGnF΂+48 `Ua%|'ʁ~hзcYZ*KjݲqQ}Y"ЖBzdR-GQ9?+ QD`5ގ =t~!`7S;T9Ws}æ5Pv# b.BNpҬ7wEic ne'%=4Z NEpZ3Ʋ+K%i,v[q3)TCh19W9V7p泌J!s4 A9qoD܄E;$j+ Ϗ7BlM QΨƍ+7h奴wf-wlx*dN=[ZI"H/ReAX\FGv)NIh)nn1ᦂgpa`NĢ0 uy G*t?#wTܞ{ݧވKjaEɫM̈́wDv[K ۄb )[Ϗ#>bt8mMV\ںEj Obx[I=^Low2,);\x:CJoz8ݢ kvX^WS9\- Wi՟[gJYj!D=XN<<=T܀#3YkY@\i+Cn  FJN !|.d.w1&5*5gܷfg[osczBiK Dln`a;/+\a$'0[|4KOXL-LpKoxőt;8F-8^G8=mwyI¸(@|nߨ0Q sos'[;]<ƕ*# Dd s]K;!CCb8v?!vD'91 ݓKS PpXXU%th5>LP ,uw*-!d\}6O;f(ԑUe gwሊ a~\PlrvLmvVh`Ʋf襧~w/ppKap|8J= 8 <^ ČA ̝SRi'JB ?`v(_e}fKQ`-@X"-e9"hiSbnQ$Y'wy]՝5Pb*Gs=kq G9F EH 便JO|Z jB>NV=*Í':@Kin9>K{4TҿLE/u/;纮-^R'"i@W&=]{?f cF7:º` vT<~L '/ Waoz}Ĭ8H\*s 3et57Y6Sri͡v`Yw.7kql-BQQv?G~YP֕'Qg-ro-1?Pُ؃K PV Wc*)9gFtOU嶷@7+EM FS>pNV A՝7P~BJfRt0T1뚦xNjcT.c *|e >LI9lޏxi-Qr qY&6cTaA9vBt ec`r?9ե#︑adqP%^9vpT;Ns&M>XΕ۟^Ē!7;GAn 9Âp{xZXԜ݁5c%R!ɏmU$7Q3grw?KtStF".38&6x `"wtBdjD9+^-[vQ\^ n54ENÂcui.ᚤ!>"8W҆`Qsοܜ@̮Raʜbo 9;7_5'2-v=3wlƃcUu K]q %l>-"XbU{D0+o⽧ͬ.});C6@8HmVH1ݕ,ضm#l!q}+ʜV.%Y,#:Zt[v?\vڮ SYV ']ٔjԑb,8\`O]=jNh0zuٿzvtIϾ^v2|i_ OSXa<7x_ 3.8D3EͯE<<Yh1KLM#Ga5:3hPo4Qo؎旰L`60 '-}?E64/a%7de oN'7|_ 5 UL1/ Kⷥ/jüvu#Rkqt~LXF j~T7Nų$AulOx;w>pll թ8a+c2*R ET8kWWW}tF[~Ո3Q,SHS?xB9pu6Bw~k#@fd f̸imA5"#`;OdF-Ś6rd|9!7HKW<T q~.vxcCf[IM6[ƾ]&) r7;3leJƋ2Qi9dԹtì#ZTqqIs/ڈ}Okg{80wgmin}AiD'5& +[}așћP_?7I ̹{oHPLS%hdܖt+Ad2Y}ç^ gx?!q4M.S* gW\ܾ a3!}%SywO- cO!yJ542ZوkW{+0u I 8F↘ߍ/PG eO#uq~LlߎIq$e20⠄mģGgӟL?4ð0?X)-Gb FZm |7TI>i.s,j0{T^E7УroI[(ƥuQ6.(`lN0^L/n`[r]\x{W'LG;3u0fRdɸТ:Zq f ļ"gPlFh %vUH (DhupE$UW 3x6!]Xr_i@X^)rԒp8 ۃSøo#e4H{,?&7rSpb,xZ]d_5pj\>CkcRZ>68m=&YU[J Tw~djsTLC/I =<2EwXV8$TPǾms]/)ksC+-U,T%=~ZqP W/SJ Z#=(t%rEhRդ0gC"~~1wsj4^y9R#LLi5g: y]Odے,|Ʊ]ĚӨ L4EBXӍ %hbJ|cUD1gc8\3F WҌilDt[2*9) B?f\| ,Rj+a0\.zLq-]5I鑘W~ݬE͈O^Wd V7OXWWvL<'Ɉ-8\ `?ݒGWs¼)x9胊1E^XFxm=T mh7HgyS Y%V+5 _hK٩)e9ORjhˇw9#݆aбSI(2]3\\БXvߔ/X0κ)n X|DH|R= j$@U: kSڡM碜Z+4'`?%F^?EHD l^yOS֟dm)io߁YVkhh9Ω%fv05"WBDlpَ1AX6g;F[TMu1̆);ߏ$ l8B0Zv=^Rފjފ zW*$YNOsq_h)%h`SR>Y8kKOzZ> i9(3<*xK8̀ .u2{,xo[ALMs[?R.tQ+OZ`[3rx2.MN.Df➈m)g@YdqȚRrQE2_3yhF"m&rk}g~PDNԘ*Y/!m[6[@T  ے\W] i_ #6:‹VmRx&z'3C<|;t*dt{+X9|kP2 2T7{9~z;4ZM:g.5綠C+3c\mfȯ]2s]5-++!2 P= 9kz(Q4l,6a9ۋW%BZ+W~u-pc6:ZX p#U!;z `G4좍bK(9,۽npT+^ۧ+1\ΎOspS$/cdH l[Ej|h_; s; }nXfauSz4od[cF#.@&#MArժ=A>ó p1cc`>ŧrp68 Th`T3mشԻ)c5$j6۷$T4ÁQZ+jAAE7@ lPF BDŁv3]ȃhs4ƙ9kض,6?fƶr϶d͉dyHV畨ĦƨG6Gnc6*.'!δrl_eeT㔭VNo%M67 wn܈c*Q ` "֯gHhq!IgcV^Dy@3"oNEb bX g =Nq}Ip'P+lWn2[!.EY91^dt--Ji۰:xRKøE*ͯID%'ᙯC&vj{8jϦv9(DƝ '}ѹeq"~ם췺D[PqEg- uU+ -w,Gc3p6(QmpTL#s^r<"΍#  8~>_BpR0gǤIY:r2l!7TW+}Rk ZpqTd2N(08("%m29c O2RX+1 l6 'nnàկɼ~((# Y}Y [W!=iu_EB +]4Iop,Xsg:XA[%BO5]+*G Ą,:k_*JtV߼˕ z~O}Xs70XAc+ XŔKL5b,y6;o[pH ӲP i0,rbOljAP[PTrtX}WF'% ]]hw ZOeaMlgk;ГgMH2p$C`օb3E-oD"b1J/m4c5kiFю0 S9C .ߊNR*UVOsߙ}LI(K/3!w̧ߦeIojA]79.ЊG:HR~r<.gfz8W4_tTԬ }:')Ќy,A6cv#w\>dXDnT8{ey XLC$_U9`&I#1ݑHi2!7,-7qِyD gsj+r;KXoVOhBL8qӎ^åp?88mTP>u%ʄR@/6@+ޫ=,Wfra[1Qo 1= nخ987)0`@GLͷxcMT?/g$bM,M8 01)I ZN~D{iwt`wɐmtF2EUC "n)jjGn R@ 6t ]l Ke.~T?KG5x7NRC!nP@zEeh͋{m;Uit< v/PVvE4sVޫA_/:Ϗ9&$ʼ9zɱq{(ɶ OQ t`-mG5c{.s%/卍xc T23i#xŸnYC=/1&KN vvÕF2@溇؝ûέ_ 4%CNX34ݕȊ'h6 7'q <]mC9Nn jQ֥фǢ MժkQü4ߤ]\3BP֓k..ŀq_tċJ!D2kmIuv'ud6ބdk̀7dx>aiI.Ôs!3gB[R*z4䒝Nbv[o#lӀ ,u:yQד֪]yV[Ex"e .~^HFF^/^{pz*Xo9S̛f#f3*o *D@o4L#mG",T\A$<&bdsm#|a= O zsySwyY:𲋜SPeEc.Ru쫨pvW)47dM*aڗxݏUT2 Ifru9m+_DaY~sd0\[^tOL">bΆSe%"75 'xR V^"}r8ls1O yPL> Sph7PXΒ!K\7[10`kQ)+f !A$AM`=hɜRBSѝ*RqZˇroͦi%bNƌϰm35h`f&-UkCk].ZLHF$WXH,Hf/LRo& Szvs计E0h]{Z-Xcڮ^/n}W":6+D;=#q_ 2ўR>J7Ӻmxq4D\tKVv܈ݒ#=PG%qI3f_hpzDŽVSz]xaIF`못cN8]fI49]`gVI=? \b[пk/kP$qF6D]*iILmg+' @cW "4 栓ļV%3#COg. C~,Lkt@WXzi(W݆G5tp"+:Tf۱ }#Q]=X Yp]ὠM/B Zl\5%rHZ~8yx9Dnaso6 lEm:j&8wW:5&2L[K&˔ⴐB1/,yL:_P kp&PYx9溾eڞILA| qSe{FP + u!Zsc3sN5HEr1>X>5QC=;ڵ5g${̽粽Ff@s7Mav* H<28RZ~Qŀ#P_\\Mzju}I򴣔;% F5|-`}8̯ϻf Awv (e(I?%d|*=FFkZLc=!H |9Id5r\=p.By6{ xX\+{5ɚ} y}wi@"\.&]WyI1{us$Yj+uKY $͝S˦fksE .ԼĻ8㈏nG a&Z*z\Wp?[*gV!WDXH^x h"l*R+\`wZ!AK^୕(:@KyqJmCP9|qy 2=n_ i iz1BPZ Ҭ(˷tƱ_}%D z\Úq!eR5>/ETlq%{9|WPx7 Gs[Q-XzRҹZ?^U\V*睽UŌKXglFR[tՕ vϒJ{094~0G‡17G:'}_gq며A@~[%l jX=h_8 RЖT}'g=H x% &р&9mIXA;mg*ΡZ,,Uf\M n58Ahm-p@v dp-Dxэvh/sKl&aZ'-W-V-<ţ77[ba/jNRם~ZeSECFZv{D'T {k_s".1!L+6փ~767-{;pe (3 umz3/ DcTDkEv:r&Vb-l&w7ܬ3GNb-©oZ9 YіmK&JLd H* 4d q  ^7D;#J:AL}ӕ1W` ẒՋN9'ˢx jT*`mpSw!.A_lV?tD̠e^1E=JQH/uk_,*0Ddݙ}XUuEcҟDY蛤[{?ׯdʤ!XVYLYw8N3I8aWY|>wC9j.prC>߉O%`z>M)#ƻ@.FR6N;<omi$j[$+& 9{MJWbQ9)M`(?ژ"GEYZq(n0כw}WV"%8ڂ"yT LBXk_ihOUܻ֧\Pǣ&dsRyK)7Aq_+M(vԙO*?HA'ƈ]qEŜ Hyi~\h7dny/j>YvyDjl6"YJ`|nKk>2ݴ4,}k{nm40tM HckΣ^1F[I:YxT>tx.錇^]0t7]@b+aT\SD0z(c󕦽FNh -J 3޷)hR[^Qe\+y{ p![H;;2&"7)EQ=ǁ6a, Zjz$*P)}BX^z߰ Yqk"qdhоBS%S;O!`;"B5' Ϗ@eZ8`bJ=Qeph3ƜO kp0E8M.C1euI.0\Phsb@DXx~BZ1Ľ0u,:ժz\5Un* ~? >A'X}>UG/yϊHό_hWӏR-jaGAOE1OJ2ғڞή D?l[] fXwY:#"Qz=( s+ѽ!G#mkK 3|OuT=Ѧ&B p>?]e2g(1xn䓧 ewdTC菴)(-k9h|^é8%eϵ(|ifr*>#k+ktʬ P؀0+wGWZ9ɞl gm`/밼)AJ𔨘x^T 6=`\kl1DkіCbb㛇$m_kMi)8whݹt>mgyݩN e5]@qin*J|6r`8ƴO( ?'ׇLDvP!怮N3M|:QFPҨ`⽽w$IByk$#KnV`wPMÀ7dUfiu:6 ?XokćI\e!*?=TER9_ 7hѐ9-wF/H[㊑׭;Dž@9(5L|.8oļžJn|h5Kb|j]C'ׅd:j_l+S{ <w՛aīXK?th(Ļ+9NA%CY&*{&)0,#*A ,yCϐ.7-ܙXQMt%aQLJHT5LRJx͂Cf7\T^ⱏ"k4^dNKyЯUg"COj;ĤB' x,6nVW-&IpzhJ+TVh%vxQpIMfa<5%hWHK73;^Ja[^NԠNQBcWds)c4* _e:ȗ5$pu [(ܺ8%Q]Xh}ZNM1h'Wg49iv=XdhP՘gpb6΂ecsϣ̚]w?NlN(=f㪩Jq2G_@ZˠΎoDo^팉ų2LVېUZAwBc|ju 6SCp6,ږn1X'aRP70s'Sƣ.tAeq 9 *s"Õ 1KĔ&:Iӊ3TNS9Vk>q7'XM$LLȷzv4\iM˿O'ByZ02W-J{C3JwOg'yNﱺAYOƈZՐO܍ntJR) ~e9ݣW_ c=Z^^^=2;͘U?~:b2H}vҰN |IąZ'il`\vCXD^!(s9PLZvJs`ܤa{L.C<֎qslUVϊ8!LNC2H1H޸;b9~\ _}l[f^$7egr$d)pU,E'ts@hh zMKMe݇#$6y>jne>GLLǺZepg%8n孽y1>kq"Xw_M*IPlȥ՛_(Wd& (2anLn;jHKj_tc4:,F%\Hb T~{AЅkh_`/?:˵C4Q=Qd"UUWQe,fG|{WTɠDx+vYXvS,{G̃D[` Va R;DPdiu8wI?˔QpjWVy !v띇A('a'EG$E: VZWSTD/B ^, 2JgU)`Ԡd|G [7cM%F"} t,amPVLW>JꯛL EBӁW43^x:q#;A%Lz *wՄC)SBG*W^Xԯ3vLOڗy5!j\DԤp>q4QK-릋7I3-7(W>{+PwGeG:<{#ʹݛZ99i7lxC2ܬz趚`d1cA ~]Vο t잻3"P8EQ=85 淂'h&O?ƀ9m=vu@жce~s7oxBh o(9X{/1U2ѵÔxN/ڒi5߆pzZAsD04Uu?mn,8wBqqLe`6*.Gɡ.`2=Y~mC&0>qȏZ1QK5 pwc; ̏DYS2^ը-dS0G6ݓ;z'd|Rh`:"G½'cT,gIŒ o2Y";de ItҫɰeixSX `{ovyA)wʪ*,mp1uq0nbZ `!}ցscd*IH_5tۑ:v`G/ZXNxjfMG~4"ki8Yִvѷf 8,**swR L4Vlo4SMjl9ma[FlYtÓv8A|c. =%;\1\c [D@F = C>3o䌆i>XRsjӽI=qRN0.>+8zu\znĨYy~[][ RuGi1al|>+2Zc:s},G*irӆ>3 NG O~NEM~Dt|=+QY:[,q"¬>3`g胏-d]v܁JR}7NfY*ǘ+p_wbƭs'GįYA[#"givdz 5 Xk 82vļxV ~/ %p]ܲ^c{akƼad`,!O[QN;]Y3 4gڞ5+C^PPG9Bh hD'XHB?!/ǟمVgH|Ǫ*4ԸNz1+?qv8| Ax!W.y=)!N =*e3|lMQvy^wj\jK Dƾay+Wfveu*Ht Yx4q[I*X")-lA|#"7 DajVFg<&(IFr.H~-l& v Sw ={Z,0آۥV\czl}29w+:y3< |nq^1i8w >lHzd*ȇP _G糂p=K:tؕv!/ Ƶ&CxKgalsV>^^tR:>&Mw)Ň}ަ~Ү5t#[W5ܕA)D />L3=Pőn] 4&TO|lJ'gJiOQ|VxߒPGYL Ha͒B8.tTƩ,d-Hbns%BbBUScߠ[(!G{}f%%idZ0ߨ ǴV޶U""t"ETQu_y&=[ΐ@ӂc%~N@aqW&Y,pݴVՍ;opNZ^Dk4(srb `,D7,6VݴG0\W2;FpRf iJ{4B6-_lB*m')|E{A ]8Mp+6 QأΏ t_IFnKsRkR`a\Ws[2 $نԁט*L)cUTNTI'/" _JBb7b"sxZH?5p^ӭD"odszz Gab5j'wG1tk9D(UN#7)@ .h^SFnjJU駄y-#ꐭς~e\APS^ LGXGa?*J^HW0ÓN%GMw wT~ɤ,ُ'Ѧӭס3G9dޘ_O53piIr7#Z%~"YD%m=JI+g?JZA$7e "]&vatڝ71 /GCF a*EtL[//- ^sBemHY}+E.g#GYa-pҘ!Z.{z^~.X7W!Urh6?l\*- )& َMr (Ou;IvMsg#Ooj4'a6F`T>*` T-Iq{"Bz3$a3-(p)]S>ҟO>x?Lڇ(WT(`5G}(# w0sXziN <ŷ _SFczrN9A;oMtծ\>W4;GP<&M zwSF)CƐϾb(sxvhE:/~ۯc:D]ȂF;:9[aD]2G'PW@);#-܈laM Ū4I|d닃FqM[yRrLIqn5[J}2},)sceݵ"|+B4' Ź)~Gp"+9-咛vTFBYR8!ԭ82s!;ncpL~*P\cWF67U+1cPߡ1P/HHW8;C&D%F;2ܺfv^_|ޑw= jCQ.%}i9ɰ O~Zw"_m4<;u$ Ez\3YR}}J~zkV}y^^Bx̞di mt ڇ4,Q{:;8.,eR(T攗?pM u  & F+ KRߑ?G~>#ocNsEcKV]Qs8u͘8}u݋iA5_B#Wzh%:ކ!wݖ@?͌E?EWP>Kl7Z`><ğr1,u%.9&fC]?)+ Gh[H r@t͙אE!E3whb#%!HR~gc?+PdH 7Ȥ( O({Wb`vۥ!<3JiC(Luobrğ֚ d5QbWW P4w+ǫG(3UcUj\u\Og<7ԨۆϽS{w ! JnM}؄wP.ι7,IiE&UB[P"GXy 9욫R{>`Jٺ4Ip ;F_/2qL~DZ!Aܺ{Š[ GJ9'Dfկ32 $"L@S> G&c3{&@v@ ;fJvg̃ihN~m3;߸L3ԎE*cJ_~n*[86h\0F1IgpxZT ho^' 7 *7M|O -m @6}sr!KQDIaog3:Ƞ#:\R^ů϶:e3Sdoh1%I+Njun%j{lB30>Ġ?5'{]uŸD|⨮ RCt8zdE j!{xD"ybӒg@rcWd5k_0DêU&F`>A6+Bjv3QT,7(.5 YQ)rYMm!.(_@$8 SӄI.c"F-2 ђǐSstSeuFXnpU>#ɢx?jbn H:DS@ۖA62 fYH|Z c3l+pEn):NJ ?MS (5٩=P:*)D50e8x<9>»2*K!{0_Jc -H%vE;yb8kʸy&qbM{oAc\W3(d+;CaIYk՛XfHs_) k %V@^v#3xxιbx.G8YE'nh\ 7Z.Cx8TPk@>ճEX,i~3zLWnx%E~ uF)ZxV7FN- ɎBH6_*ӿRar~QѽI^[Qk{WKqKD0y ׼9E%3=\W~l$9s_XiDܗ74>_ +@GɵpN=Fp +|m1|r~ҟuLMPD!oO)i@R(f%wl@2qlP<_OrRst{ 8d|v(m@ϊ>U:<]X.S)n_rywQ|CLͫ~5#43B-89$a^o%*Qr'$=|<ޖӈѮQu0$[A!X뫚dbY]'0. ( ;K", IӜ0.o'Tx}Gw@#&:C$4|ۆ5h,fp}Oa!@pp l8iz1|glXA.8UcyB`$Cz=i{i&f Piն[2dS=5žŁ4WNǬdzUB?8B*GϮBnv{O`C/>D5҃3$APz^^ƃ(V!+Udl6&5uN>X΃slHCYKwMTol|J2;ف=>41?PMq);}2 VtLm Iׄn3;'K:?"Y7wbŠ4A<pLXE0PLo/znCtZ?uVhw>3R"6ś-clbʫ3z24bX;4hTl;pghL qh)4\J55" xDZ4#xZp+IX̾+535jbbU钑!nc~`$(kXzɻ0!Ñf.`,D&f(W`,oܠsδQ'l˦ 6*T_S.o)_1TcQͰȂW[l5 U:7O\..7&R$NkOCbȟBZ2q[܋#Z#Q`[e-&:A)_8Zv!5(RW C[\G&qݑz a "4O3o1 6QAz߯|jM1PFl9nW| *DhA/TJxyU+ [z CXVG~D&>'X]yi*zue{6ZK%a".] am|SC3rZπm˚'/uAb@yoe dž{Y4C%\q6$i쪁3?ʈL\b{;Itay euX FIE,oQ-܇7* tP-!ra|}-3fk :uyVY==bXZDRoYmO;N73(6Ҟ"-Q{( 5 t$+Q/W2/RoJ~Ey| t'xj],4A&ݮ݊\G[5ڇ9#rZP nJ&KH|wNQN2(9wA .SUj_OXQcC(q^ {wEݾ`%`%RQ]!(-r.N=1`>X|Wbۀ臜s"7RB/%^dQ ۨM[Q@IH ^"A0fZ4̍K- 2 :CAQQIߒ/(^3p X}јNzs71_;K:A2〱lGc[Gd~Bz@]YXcwΈRsQ_1Ni>¸`[7)[V,9mt6ڜ^>ѵH,iH:+w0ޏXӅXN_ΠԊdzӊ)c/8\vuݖZC?쒫R^L)Z%1 vkyB+חKcϒ]lIS(lQ6i0~_ś~c5cWz|.jq+)PL!ǒJ2{-r8nSMxwq903=yG K%s+Ë4܀QKϥ1͗fmR$bGno3%8[G4;Lo%* wٳzӲi|7N(^"VOJ3< >xYn\Kz7͟l(xs, cj;wo)_0dȺ~_Qcϟr=iYiӦ|E`gBRH{z vzM3f+Ir ݽ|ྦྷb"I @;4%Xoe7Q$0 r[G~X<|Ccb-YT2 RƷ&9㚈SHmM]z:Sʧ-logƚS%7C`?ɫ1l\#xȫo'mG2:N]PkE L.Iށ(S6rE~:s ‘z7+/IUGdyX"d1a LT%d;5bVJmy7&L{]9_yu:enنWS6lǐ^Z'[_*,fnd3Mʱ0k+8ҢEK,+]!U]*/~P7_X6, [-[`L) 5Ko]!*/&Oq||^sE:]lbS%ղ%lg6 `] 'Ai#߾kl6 Sū^]M⌽%`V/M}{>y.=RA[_7QWw9VWnK}w`Z{{!sekIipmw/n"_R lb=^lW+٣uGj \=gD%<7?<.+b9ā¿%tJ%TjJ| A2l{қ3N>Af0 G6 @_2c(c&$j5Iz$T R?f7f>m#8h2t~$ .ɦxn5*yHHTVA_-V/k΋A w*?SEAyY& <ݱ;˳B"+ n%й[X*L诨SU>g` 0٣Υa#$ȩ34]*eW۟̊pY%_u^z?33QgzpꍉP]~.qGW0~(ٻ$1EJWf(AG4V9p5Gn׬긚+3 5[.ΧŐDܝ>ccd֏ΆEU:0;MOvʎgdϜ>IwA|V5&%eAn |Q;w.I%I=8y]Pψ/Q;f]}zu)xY13\W Eb4xUD ت\v7 ) 4u }6 ix6삑λW[SNrҚ/1JP*e%m*hf9'PBԷ,[efE?|$}C MRif.R;n;;L0cs.L'pk7uJi<&BfDmfOܴCxgSIy&1odҾkCx{S'v(KR6e. |mF[/Aΰ~$$A "b1aR72+" u&Fmݭkl l1=tFX?ܐcӯm:C/z f~-r썳:pg*Y{Sufq 0( d*t(bᓶ~ &gyb`63꾱$evb("%uGxDzL C`_o7-5Xbas7$k_Dņ!P}j)(4ӷo>m|Rep2k7Qmk~/T[P:."׾s+j[Z0 -i+l.xzTYYD> ھY£E,E'/XӘBohO?=?2 wǴg.+ p5nKRfiJ5mCsq8Cǣm`)n - 2];^YM(%y<1hIv~/z8,+l؛Rp0ج삹O[3B' .(bYN:®E\C.xU w7oEx G5/"p@HΟ&RK.UZ3[ ^0@\Z]:e++rG%-zK*mޠ,:hlFpV+ݓ \A~uԨexTV^,QAR̥mr5{z,ǒ~J#nH>]!Ɖzde:,LFl=4pMÐE NL܁@ j{4v2Z(m'nn|`9Y-Ox.Wϻ*E NY)kT7l1Z6՝48~⬂$e(CD\sUe'FQWېBщ]ɞ9SefؕE8OJ26gwHmPV^#zMt++f2t5 ! Q<XrfrK>Đ;|!1T@Ij񆺰oØTgCybBD{zCx A \q~_7Z'2h'oN/A!XD3ҦLmC0'`Î_H]b)6S{䱝$YFo}Hfe¿fK9Ǧ+ )[ |IJ54BJv[V+qxmNToXFH'.\!<5Qfѷ*18|t%awY'~9H5%4N֑U2ob( Ԃղ6<XF&a)+\*ʵ^LFS:>A~}CiC="uHK2l^Pk<PȫԼ`%6y\wkbepA8 ?V.Vv%6qO DU/(M՘BC0_}4FU>8inc](md21LJ9NP:]ن-mq= jMQ}PW9hРoe) diג^DnK~;Yc^WYiv)a1""j27Dv+4ѡ6o ˆRcYDm֝Cc|2Mf/ m^(UDK{o<p5xWɌuӥq3BiՖNJUSë1T EbH}Z@p#S6 96@+\ͻ;sABLC`K k s#db51s5eQ}' g[gӳ+R۪9XPn>ĩ1nZXN3m%`:T;k29oZ;X%bca&#0k+n0˚5U!u:ByI rM9zxGʖhZ5f^dЬuo- [H%pc][gٯQkSӃd($UV~ys? -t~5| N[z8_X .phB(m**Ŧ$J:%wL j†RN T:4-dJ旮XXxŸ: oɫtyGraZ͚s'!< 9E(3^Q3ZB;T|'؟X?bd!tc[ : U2XWp[&UOrj*! ]2[h};=Б3Y.GJa7EJe0/<8x LҮ T)u֊PR/Q#"-7X#,ùd`}~W* /d:ƣ)s5 O,M~Mg,R8%j9IA6zFfBv6HsZ2lHBρliET.;&߻ʡ94Ԍ=JAqcܑ f,R vHR9UfcV65W0(?IZ2j~R\[ϹҌaif(Rd{XSRD4V 2u`*a u P;E ={[1VVDLW*!j`tu_1q۝ORkИSi:L;hWɂhW* o*KA3Zqhz/R?p.C9Y;K ZG[åN/Μ#uI¥C?<ō{B ifyX&G H|JxvoarݟM`{\>@8D޲4{nY d񚽫r\}mg8w(胑\vq /YP0SqK&'z%׎ E]tbVcNBWe QPC[o֪L-:G]N4SG6سd#иjԌ7_xǶU"[&c9Ro~}Zd|1|::)"[cXiO>PNmw Ɇ,>:gb88Aj?`iē΋+8jVQY+zzJ9q\xᇯp2FdDž dΐdG<MQ/ aQ_3ZsmYhqah:TvzNzJvv'pׂƎwR+Sbrf= rê~Tһtv?@}"dN)1$m.-.(@2$#9xB c$84q4:l]7lB%40W9`CyΫ֛~۹3aa$dv?= ɐh>TT/B/i"[rd}T m=ODt)GCE？ 9'/3'B\'%'Gr;d~i2}M3l$/Wcפ . 7P咣_H f!C>lkXJ֠7 sz! %xT?P\A^tSGDgj76I K'7>GbnY9sxOVx^9[ ,ozeБ ]fzDֿڔ[33t4X]bGg;YjUHthؗ*iz^#LD\Sdb%T*oQyEA`p!|(YZ!QBazԒ%Mp'Z+rN/s%= hJǗ9ެw alٜ'Ƨ!|AR{ۃJ|xtqʢ J4ˬo_J`>yj2zD99=[2۝#s p kX2|@qݯxLgMa[&`fz~_⻼klgX4Q"ZU0z3KQ*Z{ʶXW\fZ#ʎRyI"oG&Xu99Ɵ 7}@ GӐQEޘHRcv,6bZ|z=uaZUr~G׫#&06:b?\ş7Ы9QhƁ}C^xxF(ZtdhtxNV}wG/Jy=x3\wxlAp&f' Tʶtue,I9KUUW{_vzVÝuka=tCzuF;q=ֶ[8 OycDpZ rdaU3Fjb@7 $t~W 骸84yhD^0M]BJ8v:;p-ٶ)V,C쩔"yOǣ5z|zKO]lugKz:{}jϜMan}HkB, "==D\_xYFl=F` 7ӹopNo61TYi , m}ٜgǻ3`>p8zGt΋A^$9,$cWC*㯄'ʵRF&J:%# u^H܌hcza0l^'▸P#*,*-wV3^JrpU6C+ཻ\IR6 79O_;i(n}/)D =\ bSOueцlQo"XDh87m6{‡8ȟEC-Ibkqb yaa,^I:b\ᣙ\A7sVhاp~A" Sz _]]aBYn*=/EjH9brgl!vZz0p2E04Bh:_L:3 B;tظP*#rխ\%[z~h6%Z8>r# ҠP8BS=+_$7[Fk\$ʃJvcZۣc!ixJdiP)%[ma+!lw j[6"7 'Rk[\FxX}= !mWJkՄ{h̀ G6 HFVyQ B=,Z!D)۔;es]ymSzyR"cVwZ~)w\bJw^>7Kg:jLk7qdAqP@;8a<<%"O|95"!M>(l6$Ir\“v/?LaN‹v:})1p}VxSetcOBۛ*5iAf%Mdy}"9W*-](#j;GgfUGllJ|L 'K-ɀ^-j#Q{jP03L4G G2O6K+sYŬQ`1Y7) ;QXZ8`J>:嵾 :НθBCQS\ZSM:[PHdnSq*]ڿTyҒxhӰ1$5ʒ] : #^]Ů˸Kֶp]N,Eftqw4r&l:tOq*eUcL&Gzޒ5seQ=C: QV! (0\J=P[ J«"d}~k{auΠv6`dsn{ p%ݕ+$"Sy7 5Uak+f"xr"h&áRX퉭jurǖ}*kʻ cIX` RjAe9GWBMF] ߇VWq\Uw>;֧ >qVNuP5]w3UKbҷ?@*4M'Oo"\Hzl]S;ٕ Fƫ⫈Qd:sĝcsڰE_K!Pi.|A 4`(8FǘtR^Bj_PRѢʾ Hr&5m/*' AvߔS7kB=ZOE/m?<̈ftG$ ʁk[۔^%tY`"ʰ\Fkяz^h!'$zO?5,(P(ln+p@iRri/:/:P@,@Q.E\W#<2*j p)dUI8sYt-u6>k 4ؕ-~5l >8Jҭ'NJY'?5 /n\|@ ++H sV*[:<}[>9v61#UyK1.!Kmg,zTУ9I3_brLc!:p!u/-T/V 3Nd pY>}$)~km3AZ3ԪGS!Qv=P}qX2Vɻ[B9Mo-!{%HL@׿nMy05L'l{1NLj?n {) *|ƿX{Nis .C/6_\ӼR@#Ő|‘S1;fىs\ϫa`"Utb ښqM!@[|ΟElkbЉN){:TռbĖDx"UM[Z˶<.f'֑H'Y֧;mɿ(@XD!-0Ot*aaEEu?ohA&ta"K_CF `E?nLnCqcO|%T*~RkXy("歼$p&A.trx'ŃDûs,a"" jo~+`8@!r焝#Q@nT-U3h_P5 9gZbWV2TS"Ph{G $3\36Z\\6< y6('o Z3x zw+KL ()Ϡ+LM1o&%Ҥ4J{"[Xtʈjsݮ#ގ! 45*MtTnDobX]^MMNJEֹzKLg˚B%e9gȼCe(ROeX:ǟY ) ʄ]8?o `B+kR󈵢Xƴi s9:ٺuSnN)xx|0Z4G3 Á"'gp" -ä?r\(,.\ W-WVr*=S=CpmHsfkç27fRΌhn^SpM#gJoʡX_|uW_</'W ݡz>+eD ITׯX-oƴ̖f"묐U48R^ %Lpֶ+,K?nt:E0Zs6&IE͔ "/~T8wGa.)E,Qܑ?cnᜧV<,QηxS72_1GCYPGtjiۡ)(-gc K|鞏㳍VY *hfq5 GN.z=M5{Ηsz@x^ʤvj_3%˗*|7\F<i|+C 7$/['Yt"n-#o4dz9*Klze-jhQ@7R0 UE>i9/#ƪ4 jaW\fOu\< SL /}YD}ÑAJ|hF`%xQr~,%$~0aA|ly~G}Gw+ )a!ơ$/l;:q㒇D<9n!a7Fᥦi+yxKz%"D>{=ڛJaN R1u }O͜,Ы׳Mbo520ԓO42KBLvWR{HE`آûXZi:<'}bYηI7K(ok_jB|J4UjwWн#v񱠃HrDJ~Aڀ+}Y!3F2њ4^V@Jj))XIw9iZ#MYʙvPN!axsP7eJ/~lzeyTzi`ez Iє,mLÇ%CPnb9e6' 28N0G^Bcы*`*r3IFIq`OgtSV$VJs *ZxfO3ū!M<%Zv'z7 :%9pzZLNKD6m1I:$@+ܬCJgH&$2}\ToP8&]\ʙOѻ }O(ʟPp:HgXߺI" A<ުmHe&kϚ7skXO^f)`:?Z*r05XRZ.7C]t =u~LD9IPi8/SVS>O1?zcNfE%AJW(ں>!ݝee=]] nIdt R>%zzolzC#)XZ},GOT_<wS@ĪjL4ۊNW D鼅è[qY#ʷ ,V<2Gp|YɳMX}؄G<)&A*?ЙBY9/=Oi!TSřrx(&t"i{~)JA@XTE%]#f TmTuc=xtʎլEP<8]M5yiH+"Rb͆&&-j%Y4If3{4Taε},I6(; yjKUpۏPid,"*<Z] X. M1xǜy@a@1q{ ?&'A% o-xz)-jκO`I~.'C@ҝ3`o+~m.a -9ׇHhLcJ͍պ(٫MB8~:~zVn4GMZnq>?Bp 4SjEzG`o#{:W5X;3^/BGB[(MsZGݿIڤYV EdLLϹb%ZJl&zn_AŠrD))(SD$d87Y>9eF\zۃy9\V:p,]JDDHWaW5HF6% WwL<#f'XstZf'zQ*vj)RoDZ|w쐛u Z_9<-ӻZXgSeԾdo$̍y0)Lꎍ. *ew8GJ8%y֠B {#ux7MJvCsTNM cK(COM9HW2cc4%]K.rW^VN: F.f]gApIt"n2ET!;+23ophڿRV *c}_D{BD xn2(oCy!9GpCL0[35r;;GzJXB(;|CoG:|zsK34-N%xU~[W/D)VX|WzWf)PqݓIAw0{d%G{iCOMpd KJe~ߠ{V\{y.SCg#^ViX|3 (2 ƷTǏÈ1~A6ܼ#s~81Ic0sUG6;1[G?D f]۳+4LZJ.cVc콕.],A -_Vs<便Ybxp.i=g\ՔY(1=rnzK+}p睟_~4f9HG2J&=Ɍw^"*U浶]>A/ϭ0(Jt.kqEU#Nsrp4ڬKۻ2t(xb#DN!s,bM~֚>V_Vӯ\+ҲuJWbK?+t). ˽,UGP%) Xtg%-kI1Ntb5k9-W4": -F\ۀ$雎~-C!k; \&zLJ8 ;4RrٗtOyR Ҿ[DY(ILIMU#$b*m[#[y )=D_Ǽ: k1v{4;P!&MОKZU@mgQPpP(6_W##7O%݈mbb1fSFxq;qH:_\= wCV$#f/Etąa{a^2 #;8vi?Is|> #IkH gXIElyxnnM "AurhJ\qtނ+JL$|IsnO8mheoIZK9)U.WjS¦;S7A"&/Kӟ%&HW^Ƙհ\F.> ipw0E|Hqw֙|H(Ց].7PGmOaD| Ǥ@?n}E\N.MjHHY6V☜.` {AUベJF<|}Ô?Ru*canQۢ,ܖbuZ2eGd:WwkJyoO<{+D,b'E9gPai<8ϙ(W7!TIGc O¤(.lRHܚJMzR VL΋4#6^C Gp˺r&%R<@e؟a+lW?'WTpN$!s$< 8BH@kZ:b]ÏT,H=eJ4BZkcRLN".!+@@W\0]{n697DsL 5ow\J.iE#ѫz% dRڻF/UL^%fiGj %}lbb c8\T1BnO2RstLѰx2>{|1!]X)٥#Гt>n+)T?߱eE&{Rv>lh"u[ˆrṄy6).*Y~㵭3&tu0ӌjｯ׮ l:Cf*)E5[JjJ\9]mfkLHZ(ŽSĞ9&!w@I{q Ug:PfG'Tm։VBϜhj'k*F`7o=2Vnɿz-rxIVFZ'(vj)WĔs5n GgʴO d5(y͐3?61*TA1J1 Dd@8<]Mt!p9M*5H[$uI9;C|a`a)б9R795T}I l*3儼d/{hF2;$k"FpT'NT0+a䑷a{ĩQx.)^섉ZZ )p,S ڮ;s[AR.ޕyY2sbDFP8b59CϮQg*F_3Oe `0|V8Wb"+2?[~eXCtP__f]>7Y=4&ȒRflyLGa:Yɡ|V"M\~D9/c[Qb@/ld!]B[[E:$Y=:2gYFC!6F@#V( g5ݏ")cUq3ը+*6=;eŕ"U:?ks(Bvp:,묯ΰJ|1sn'oX(ȩOM\:`VUM8֊K]4(f8η#r\3mu*T6d=-4ZC ċ*.BliW0*FcXs-:c/Lcqmx:mPWJQpH90X8DoG2j ľf`drx?3=P[UHrO7b¹ۦ v>*~vn dzp4!#tX峥@کO~ɶ[w6)Q]f-K0G/\hP 1H Q x^ǗTeBK#ƶqX5o"dGqu|4s33hyz9Akt8U"Ͼ^ŶvB9\ؚUcޓʹa,$UiE@YjEH)VfX81JhE2$4JI[dll?=_6.g\E/5 >84*7H+NRTbZR};@jZ3]5^OəU1mZ!({j~EmxϜ@u^pnj#.3q/ݱ b* yd&`RwZ9^{%{B,%7u *MÅ]c2Kނk$UZLp8A z,>Njfz<Խ}!)iՓ"aolT8wî@ 5M 8X2.76JU{MR;Ya\;r*C\Q;2 9"쇻ÒQ_hC 9w:S'ek]6;%a&;\23RF|,ZJn6*1|sJV5>`xп.Oі@w:|}H>#u^=Kҳ,e1yF~Է"qɗ(3 ,#;;YV'H\jz#l +(jrKagkYHVbn@9F[΃H e&ᗋ S4*ئK^%ylFUmS@)bL͜V7d0s,S k'v9QǎQk*v#*Ui\_nb?eS:UVci>wYz3i5Ϥ=rlwT^)+R%M]MexH,B@{`h8'N+ۚnNԈR|Jz+9i6jɵPBF;n%4(UrP)?|;'4.vuā6p bFo0\uAx+x488aJ{`" Rgy4憸$ϔbj5. S瞋󬤤t!o03p0tV9iC(7kCzB%,ugqU'r:P2f窮<$㌁HchU#a.Ԏ p A!Mhh U|APg ͕roB@nVHfșce8*I "f^2:b+=yK,Ǻ+1s#7BXe2S'&{4ZOϳ\=45KݥHbWmC\ 7sQH r']p(W9Qo#iOƯٗ &OYAc;j ]xgq/|?]‘Ix 8KshaE'Cn,pgV4sJ<)체B0DÏc*bِӮRSL5}s4ҫcTPXD ju,(K Z:k&pU Yv򲭾mש=vfK5_nɅK|\_0%+svPL׊`zDwЄ#28̼'f&ŋwXҞ$&d0PXbvo.ֵ\aXcYKllu-,| vM'mr% șwg#Vhᆑ%7)s6V֑ _JǨtF y`),Km3Uߨ GgCJHP` uuLPAfQG>y\;ZoU"D/p~77Jk.A`4E/ X4h) !F L&ޛWv8>V1mMNjQcq5Nf'!`&-Qy@)h?XՕv>5)htZv+OZ"VhG2FgTMd?O4{\{,,s0*gƅ)d^ "u tp*jڠ섪K,*VHץ?%H] G\⧻WoAB:Cľ'MK>YB" #k$V=kN{!;OPԲ69ѱ*LZ W.m{AbzDϸ;XVg\vSg,H=BW~VÑz8gFo1=p܁^/4 "KVѢ9*Zlcox,=msD-~V~≆tJ~+*,!{ ڃ>3Ӱ˾:{VIvhնހ f͘3T~}T2l!\(A,AKs;NId"Th"Wս,_p,JnCdŨ|(LJ,82#ph J@XɻsW1[=۸$:xMjJX:Yq1!M9q\]pgihqeFNF?ba(7Pj t+ MuFtppoarK^(ammbj/E(Ү-|2UΉ.. z,=IYsHN,KxRۡb Sϖ,Dfo nnm%Å "{* Vvk%zA gA{Šv1yIsnDŎ ǟȅ\ o])B݊ͩb'BPǰ u|UJ]H(Hs)jGL2Uf# ap̿S$`Y9#:-&Jz &EVqhfoLNtΞFFd[}a P=ftNri#wT_IDIzXpj^qARd<8ҧ(##負P†{m|=j3 Z}^bLB$2qC^͗+$U Ƿ[늬S{fBKpw:1'_O-"6yI`=o !B8~brR;}@F67juPY}Z_h'PFCLف.7p"_wKeZ6pMs?XD?^l djh3I 1's$)rB2RAû֯W?׃'RLqmHqUj|18/K~]:-B]A89s24I/[ka%G5I &r&Pr/b&/zZ^FC{|Ylc{==os^'+0. TDMA?N3Jve֑/NKü1sDӉ6#sZ->wKj,&{E.Yy\'<8kDص\uL?S4r&ж^uG Zġj~W6@-5Ek{@Rs 꿗;6~nJ&M{kd1{*_`H}pfwR]ͪ%{}f8xU/Q7h**R 9"`qbWUR=$Cڝ()&ZElg-+(䁛ӑ;L k D;$Y,j=S51D,9gH+' ĝf4;q,#I)TQG;v5LMw]™ií΀/4'}歨'ٌ+o^z{#@Y#/M2>HH %A e>ioy~Ngv5}Dkt4yNcU`?B}oNq V3%4զds>Wɬr/B)e.r4)j#0k L(nO4I__;M,&w*r*D%(EVY)˰0 Lq^e t8ddֽX}^zA~wwx״pM4 Ѯ(F.whn[̃> Ȇ l)g܏N^C4bw>SF>_Rj45$瑰]S' ՈɇbM;!,)\)Ouæ *o@M۽Ÿ\"Yp"8RkvzAZ%<eғ#e#/$[AݏzbWϧX}>*}/U \ʟrR $5>7^`Sxہ<"T8 ]T}~`+ VoA y;-+ɺo:},s14=|5ϻSPͫm RxIU*]pC JW+|\&ڪux;}wo(RM,x.+Pz\0 ]W:r`3E蝈qm,Z ?]Jsg%H)!PޜqC5A!;1P Dլ1WKo\,VEU\px:x/" F?\jah1F.+pU?MsJ.,)`fq˥% &!RO7fy8ЏL. ըi+G{1C)F9<?w9"RAde)1<)O&e]DefO{>ϼ3BzB3H5ɛ'r=A͸5t2&WqǠA{N*GУ|]E* ?\NGێM *6(_"C#ZmDQD/7~V>kM 0WB<.BtfSR=Q$QUF@AΗ uB-jBg\ggV$˴&[d.&ߴ9LEWV݄Kpvན&qݨ[Xy},3*4Y؉V~Ov+|2əjFS1⬂ 'z μii7vffV$+OfKʭ'~AׅJ<&2hvb, $9YLe\QTP-OJU9)P#-r6 \Zu6~\~:b^&?O /KV'wRAqBO3K*k8j\̖ܶ LT 5AjAQ˅ϵviq+]9;i+7;{8a81pՍ/t' i46=1Q$SZF4~R7?2֏1/u@o%}oToG)ǐ\)D6qh~XLslO&n {i_h81Gӥ;+1أk|7f0%^͐RfC9qmz .( mO{VV[0Rs-䉋>QJ}d m*Rz՞F_Hk|!!;ҠЗg~hJS7;w)Hs~|wjzHC);? K%6*f7SPBcyTKw2 '(8:SRa8J0knW'~68˪ kyl0z԰8=:BVAKBS_[ urf/3݄4utQ.Trה"P*t ! E}|^c,0Ymȅώ[4 Y[/.~ڰg azY(^Q-j0kB}a70לsX?LZ'7YQl1!qY)OS}?8{ZgRY?yUg`p&ٟ}P5:lϼUdp }UJ ̖W˺L9{ij;Z{[ߤ3P7oO$c")x/?ƭ~Y۬.4N'RXiǾm#OMpV֘k2g R5Y[6q+ه-&Kh%4' po!&`qLSrF%`]0ekl[8RhD Q _Qpڻ@Y|WAt-=hm6q/@pۧrMϡf 1!0ėM% }'VȂ̹" Ǽj2F(!Ӑ/qmr2p5>KmIm(| *<,zW9,+iJk^x[=799l"Hs~&? Bm^Uf>86GNѶ:V;"pו KJuiAFQ䩮gB<&5;'͡]ǯcLZݭds G,!]`k6diAE5KF`=N>mu$+./'cn0𮿳U6sLJ\vqʵN6LHZD+=j}M*!uaTS zb&m8Hڇn 7G=ED~{*MK;:dB¬$z㨫Ը+Xd;3HVSeK)X0e㓓g">,&_5! Bm.t]uC_QxXBx;Ut .PCMZ.z̨N+0ިJ+E$4gk"H@<]I{w"roVjOGK *Qlq1A`!A {7ݲ'̍/e佣eCvq_qNncvꘑJ2L9~&x)iA22,4-4KnO/;H4^0aA2'b pHBK3ct~JqeMGс^u`CB+%tCM'_k&KiWx YQ4E>t|>) +'BF@ úm1?XJ^ɝ ~2GfUr3@fs"jE]^KY%K!I†%;әڣҾy]cCh%erS<焫s=M$mɷ}@laV[`Sp)Yb"-5u|ZG6!+Ǖ((xA{xXP_p3b[]eɓDz&T)f=V$)LC""@~^Te13Tgru*ѯ *l[ :B>c0|BL{>%dSe"-zCĭ)Z+KO-1&sd>㽽po6z$//uX,O zF ^pF pMYwdg[kL #:FNg? E pѬyۤVD<($/V%ה$}=*'KPP=(*a_{hl:s{oYXXݑ<<֍KA@qa/pGzm?KKOW pe/ӎ'/J و"zLz  u:Zw'~v ZK:XWf9DS[yA6?y>-ZAF/;`Xc;MIn+#.L%W-XnE[X| T̼~" x uwfx.uRj_[VY]ps>^6F8O|Yh:\ tKZ֘=X]IDt.ׂx,)s{wW뷆iR^Á5K0IM 궤/!-O3!zye.85Ml9 mgۦ$ ')$wV*"pK-iiQf,5to$LA΀ l-EfH7k@O@&_҄]yt@Z+% (uaQ<FH׍To> ~eɘ|yG/:lJfS;-mR:Xz{k xOwC*K{r"M/UV1qg0ƦOiNnfb~gq CuFtiu؎%@bcq\z@pH(裌tt0XK+"|wTzoec2z>:EhN+_R%!jg>RHgAé~-#]!5JL:KDH jež B l 講ۍlPpVNYK>+5CmJAnF|XcS/l?M{sb\jjȾpd2K)Xʵ[_a&6le=' NU:{ut.> [qOVa_L6WИ6ǫ5hF {9zC)ˆB>_7*lH^)N q`g K^zi6 ,\[O%ejr )kf=?l8,k}T 1}) ȗ44'.t~m?x}"<]?PuE&'DN&cl${1,Ht)ut`ϋ*/W1*j[w @t36]*"G/ (n/xhqP38e3F{%'ω==oɲp,"Чի5~,d0/8/ DK})<= `kTHk;Q_ۡ4zHh1s@Vl/kq?# *D$Dp]b7,ϥQ] * 2~+$#MdNLjMmֆIw"th6)N |KmR=-|ZS Lkp":{=ηOߣ EZt.^n;OPiEtk6 IYMCV:Թbl"|-52ɈoNv"5H[ș =Ve_M'CH)=kMkΉ5S%Cp<99X>n5|lӬȣMmm"%Xo* g33*^`$9|'SAb7ھ=ߋl¤ KUxۋ 5ʆj|r y8ЉRᕴ&=\HThQUkhr'A" 50r=aH7?Y ;ƁIޥ+GҊX&$OJ[0\N>+F7.=Zc,7>W7^ \0sS3ERTPt'eNyڐOP1=7h}@tޠ1?ESn(Mt_Gi 9[oȌI&lZɐa:b4s9Wث~=Y \.1C(3KF2R_Fb64e7)a:RAxK49LF8H7ғHtKƋ[xElz*%ɠ>]iV$LHu}D-Vz {m[b5gyไrOnVzx jWYۏD 搕mH"uD.A||Gܸhj+!'XðKMZ.&e0>e$ x)K$a{wL%Ѕ=h %0EMyRڧ3+TסN2 @ޏDpL,Oqx>T"-MB{4ɅfPT vzfk\rQAsΝ% X" xRQmXJs!G-oYHc; c.fG]&5cS;L)K]h ћuC ䷹VG:ƵwǛtˍV~cx&ڹ'n=K 5^0amS= d|BʀK#EÎSkW4#|kg&#\i~fB^Z*AI1\)Ss*]@MFORe*s&C ϋ%7w![[&ﺄo,~ʥ^%c*AkFwr>b;`MӘڙ53y?Ad'!f r`s[]nY4,iY梏r0~hFE?#)c-&]LOr}-v p6Q`~0Ŭ7g1҆>|[D.x} 3hFPY,6YVMa*7qGnI1vUSԅZ|d.rvSe/5/w{2ܶ~}-jiZo3a/>zT,{6GirږSDp]:|Gww<'| \IU1j~*1fqunD}H™;ףi 4~u)>MA=})Lc9C$<0CЈ*/FF.gi&}F һCfUE'sfڹ)HDi:F %-pq0 iяEh~EY2j-jx-o>Ǎx;.̚J]o.Ns~לty͒VW-T*bAae.JFZ{ҵzUs}+E们MTduK gi`rj'1},Cx} u}034#+ q͇?OYɼSiE;1 f'wB_}4z;HJ|3͵ ͦ1 `g?z'c ŗ*~XDPԪ*_RvʧZ@E6N!1'cl.3YP^T`Dgm4=W̲/%%L:RZ<&:X-;l֨B_\T"iQ~WjZ8M IQrjl ؃1y#3 MdMB3*2HMTL)Lu08?J&@0]d>B4/}AWu}J%Wà[[݂>TW{-Z:1שL<"gI1Rj|: -ws'ŝu0 6.EH/S47MUx@ ]E(x G881m*.AߏZ,6v9FNQdD.T@v5=^՝`Gt٩lU|ߔ 0 1NFPR胬"s,]g~}O:Z܃^y Uܔ!~bKt?";#a=2{1Bz)zm$Vx P{B>*g~-3t<3:"ggm灞G\oXb/ƏH9랈#i-C/ =OcBU!h,?։Z=fI3G>g*i=[&ݨS^$:X[UquF[^N_ bC>㲄YuJxϓ<oGE \c7*Stz6?J(qZq}sE2"Y81?(VX$Έxav9m'ζg0cS67xPFoȑI>L G[RC,s~Y, n cىu䧇MH ,&UKԜ,iZypʱvP]\. JboB B@+EUy*Ŀ%"L, RپE CkR>& xlDŽMu&ΫJA :*3$I_%Tp%y= 1bz]<*/ҕD-dNIo7m;:ᇰQ(H['BO9`t(+sS|%;"a^[7ǡ*ۯdm\F<;'EL mZFӝVi\ UXlEZQuV)x3lܬg~6ڊ'Zvnww%ԇ6w5@֒TPb7H܏vX,;fh^ﱶ`㈀3E)mr౳a<St\zsGm(T?-ϖ{[3+Ӏ lEq 6[zpqo>*2F\dPx3ͥsZ HgIUjB`Lu?`YA-@ Bj0C| Yg{M-aeؐ~V a(17 &h³~bSYh'j1>_DNudɿSL5h>ɲ[IZlRN}o=`JA<hjéW:[H'UdfiDrnr(#̽J^x˨9~xmd~"s)'2y.:"A$`I[c)yr4p72b:,1g3,ӚJdz[ pʝ4aIlM`ʍ8od6qV7ԤchX!ya0*4(EaˤCD}]l(뽆b=0 /d<ɝ:ksy1߁sIT1EzC_Vh 019+Y.%5 !7/byv@9z~C}Z.YĞ?7[i(/$aBST^4ж$T1UH`J\eW/62vml9=H ' cpv%g9~ģ_]w_ʂѤ;,ATx#}T[hvfEs߯E$է~*6^lɾP>D@K) Bd& r˟HiH(2Wj"]Q{o@=\go=oih{DjIbI0R)qj|P5t)8"  lrgΎErzP "<="ϲ*EO > P]6 .&d)E}LW -WT)xvy 'gEq2*5Nc,UuOYB MJ]qQ\1۫x;gW_G 9VK3K@}b05s6HT95[Y31~ o^k-]&fIuxn O$)wÈ氝S8T%1PTcѽe˜X'QnDi6#+)j6Măg fJrZwѭ"zFI9w/nJߍ-jl6Xo󹠴bID0qPWhqr.=< iPNz&ȇkS'B]q>|Iy}oc0m˜;t8P /tԉ8Ѽb-5n$gr;5Z‰!ז:6K"qqEUN/fy2 ;(;/[~/<ԙЀYZ_:j䍴,?[ U4\Ȓ#nK.7#%7%QN~(}.0<]a2B aCDe/C)f($ϟ[x{};hdhSW#.+TA$wMӡpJ;빗aZ n&\."}G3|^Ei򾱳l2\R2ukc2bht8xa*? 9ͣɡv*I텼&~WD7Y=a^52e>ގI]L#oRʀ!2Tl{c%{g}DhhEC9^z J22ߩ=DNBu7j1܂F@gJ[Ppz/ #Lfp4/ܲXe) iŚasW zJ/ 0#9\al'u RkїΔqq,nT7?b 8yWZC]0#Xbxvt@RdUxͳż$b~mwR`v툨KO^^p֨5v 8*rQ NYA%j,Ri2tTz' 邪CM4ZOL(9!fz:Lc, w\U޶Ն`QIp_B#~2&S`W e _唄͵$l@gzmfMkI記.qEw^J0a -5_T1Zo PIp"cyYo۷_/&'tfD4aLM`>DZ>>YxC*~^.\d τ#.6|,o;SS_kt8 Ӂ5ONكM ]t&F.VKy-E1h ‘A9n1NTȳXO" ԃ@˰AeQt+3%ggCAPofF mTVAcuH Y}:8HP?V<=;ԗ$s'[KQzJKڪwsGe~!66Ps {/"FX4k @L)3ã?>`NbFd54O5,nBQsHmsusגCf*Q }/"uL{y.z>Al?q{MC:È쩕ju 1>ϲ؍: (̫sa|'fGQ8Z{vR4]JrM@EќI '}9{C)7b:b_)!ziLK `V8vu6eͫx}હl{gی%}E%/RP e%O„Lb-45V̗V$%sJ=Z_K8?s.2jYiAƋB_]PV] [ArI|!ݿ`Ԁ2}K1(; sDpStM (%L _S ԔpG@=F╃Lؕ(L:Z zi%WHtXQi7FA< [3(xĆ3<Ԕ{EP2r8k\RGAMdzd+.лhEQiG>Klx]Y/j!Vk剌Mfe !ݫ4 B ,PQ7[_mv,oxkыIj&-'Mr w)? 9}߰3%4(8?5 EC.|{X2\1v8!)t C tÿr? pcԅXcx̱NBsM{ e~+U!:55bcک^-}BWsiXe[A=h]:F^0֯dr0C2b`Tt*wI@Z ;Fxc<󴆡xLFIH, T.A"?`9C~X:>LC|Zmt ~43FL)ǐ@T,mݘH(H7%4F;| {+&qqE+^շe2i~3KOE]~fcS4ZW!!P?+r|!d!! e(@d3޹;TJ.DioLq/#{֥G>sUS&P6QZTŬڮ'5zto[XHQ`Tp+{ĬR#2g0"X"Ǖio+M 5$8^Q{ z½wxw_x`NTo<E`̲s)u{ 7 GqȾcy#A.?LnŝwV#)J=TyJ73bY!кxOVa8.#X`(_c`v38H[ G?.Ņu V˿]:WۨmLNdZ9SY=2F "wd#;* ѳ(?뉍r9>G&h'&L2j)f$LxK_b[]KXh\xo̿Dlt+ZCIJYGTNK j[))fFx.-x ?Ҩ A*_u{eHYMVfk*N?T{TvHf3B5J!1Dn)0oQ4> @pP‚>j<G>(!Npt+ƷSMXYfE3 sqEV- %(2nd2j:緖!yu9MQD aͤ Hػ닠3DTZ)_9%.ND:=(zȽ]+'bK@s{X Xyiğ'HK-WD3 I=-;zYF]4ݟHﺗDف}f#bQxL@4&T/]Ϻ3 ,&58MJiZTWP({^ ^kDul|5;=vR{m;,xQЅ㑨 Nn|φb. GbB"WF[? ) T> "c@?ϕ_ll@np@Xr\m7zĸ]ߪ*J = r'#ŠC @83^&o ?Hp{)agÓAaz[ EzeK374؈r + A qkGK<XdK r'|ωz.lOȬ ՝:Y;Q(aF%Ց#>vA/I~VOQ/վ-1ӱ.euK:NN17=Ri1"h{{1#Y<>[(U城fU&T@8+Y1Jex s|oRuņ9FTsO7Bޞs PfZ<#,v scT(1 `=2}êSMFMV&{l* $xExh!Xz7.5F#BԴLHq=qDHq 4ǂcܻ8nA~K}Η &UtF<$Z)C׊lIh5I1Z췟9w1ǁP0 3?4ӤS~$Lm@vj[Žw _jZ)arX0 Nj-*ʷXP(PYy~E}VqN<ݛuu3w@g?@'jP9$i6VRv|whX%o>"" JuU{^{mhW0 Ȼ}Ma5lV?J3Qc& [H,;ѓa;ñt&泑J]CZ~'S^gYOW;,S |ޞ~'<ǔ.](%z=McRo7ygu.bŷ;Fc^ߦDu/vU[ƫ + ѻkqmtUCw\#ԯLE ~4MU-~9Zb9H'U62:lȇ<:+e.`or@s$hWV"ytgy!XI)J\U8/ngAojre w&7()lci[Dr%UA`k_2fԴ5x=4wSDl%@O2Gy,z. ň(r?OPoFk3Zobm׍;Ҙ!U($&>.Zyt.{o23#*'-G;g Ex8tD tWt\dU=>*n_O4FcTD&߀y:<ŭ8N1 AV ua.D@JypB" dGen]2K#E/^em/);;3*,g6;&ٙ{3.:J^O*!RQ`A!RWxt>|5v sg]AW"i0mH%ʗF-SQX}jE*yD:ٔ1١"dFXC캸/%WJ@S*xK<=QuoIJ%yťY%N0A r?r< 8N(X?ٖ׻->7tU/-zszϥjJ?֠6ͪ}(iY(_Evdjm2lYHv= ]w tIHh9d>7kIA۪u9wZ@DmTo5J.o} #S;SlhZ(-Θ|k8(&=nSs ϑ^A4RxEOzcpMMotnW]ֱaeWJ`rvN^J]/ոdrN %^e36? K0f-(TAe*x2eohV$0Ur~ $F+]NSE/ EQ/`S=.9=˕P@d _4_.Wҽ@c'g9)x?,z"'U9rGJFNTU!wadd_E"'(HK̓?Uӱyg ]MB.QP2PU*ۛ}mV̡恇N&,7?gѰŌˆz׀Cra; *> ׆đ&ӣ:J'x }` >ATSLW3M2tO+$˷:[&7HS)&ڌ=x*/FqLjYe~#RK$uxj<K1LbRRI栳ՒeҋvѸ/XΧ~%s[^_Ur=gQ (np63M̹ŸMBu[u[hofX/2+-FfhߙW4ݤ)Z~9[4`0Ju:HL+u'/[EVAJd) )׍}~f8 A XiD\bۻ.-uETj{T]<tZ2ȡ@&io!W8ҥOB6b*~`JqWѷ<冂s H>CgCn,;@*h*mdk|_ijgXƪ?_遖6|m!7_X ֓Mdeںk+k9hxk.ɽѱU>)9NIjƤMjLNH_t$X- IҲڟ8d_F 20ӆnfth3ЀqSvސ1#k8؂^1uLwZ+5"OmƩҎ2ޛw4lB^!wjo bQNx\ D@4LP0Ƴ:ClUMѦC*@y>73pOBs L+="Pފ)e CqQDrii6yEfzq@d~ojƥŽr⢱|BP/AH02hI׌p6Uqkr0:]/eݣe7J5(c+Ofl^ GY7;ԾrAlm$5 T@1]†љ$9U;ǜ(/Ҭp& C! *!C>fS%a0缀cAs,1M[?*?*H͹vb]IFSalq ڝt *Snc^#䖦:<5bOaCX(ZSO'nsRֆy7xC( Sk\?vC9} YǕysH N#emvshܸioޤ[]uF飑U :{ݞ9ֹ)# y&&xX5Iy CBznH pvpr h/wXM}EҷdML%مI&~ * zVC6-^tKΝ2f{ؖGG"]Gw1 /CMGɪ}ɐ'&5DJ" T2xbr>2+D`qƨzM B`P, %KQc=aʾPg9E)WނEbh*[J]΄y)**\.%ߧ=oӠŧ/Bb>^LT<$t %[$ דyd?^ 16yi HQO7YEL!MӮ~ #~gV˰IL])79q^HS)7ņ|UDD/rzڤT*Tn#,FHHְc"CX ك٭ab!`NP\HZcr>-v҅ y*˘tj/ \ d9A@ģeBN+}NqW/վ,cʷ^ݛ'y5DWv[.H&ҡߚ6N: ?B_ϘK -WѶӶU /w\V= h`@.H.^r_eiݓG| M&eʖs~]2 .w@ ڴ|J-Dv1OFtk瑼be@d)Rcfi^sQȌ,\)Wz6sմ WOyPl!s}y]7{m 0|Qf]MCm>{"9Aj IL^T 1YӪJ2SP-uٯ|8\T11(k5wv6cAUoE% {$s54֗UPu*Ng'6p0-S$|R6)K_v jAs.I.p e A=:4J^B%b/Ezxlxʯm mhUevN1<',ġln~й,IA=c"U>&~'Th7 *Iaqn66X(-r(V8X;S=Rqg#6k8!Dk#?u(fut09JtX4[2@ 3uL`Hz PjsIG}A9Gy!.rkv@Uf0'$ 5h/lNc #ɳo]P&qѧУ⒠9 Ɓfl^o`Ik8x5͠c u7p:d{Da!pPZY._B y:m4 OmYG.i Y<;Up$xk4M &D|0hHcрP%vUF?&ag[h ^!6 6z#۴6#ϣZܡu|vj1vm~Y{G r=]X|`{lmD.?> 7 QX,Qƴ; $`;dibɸd.W!NE6EFe]YyBud뵜Uh/Z*-Nl@D^W, k|{Mk>|5ӃμjٴRvgbl{ԥ! Ɯ R|1\K@))<̯xC|Ɂ0vEb؄~K02կAa3 CAZ[PV ?vTzviv2vc)`cow5շq]z&QyVۮPsŊ·{u5Ke4c_K&]Jf}: SyM_Nƌ w ߅Vo?:u#@YhOx (r/pV qrb4^of2H<\зEvSxyGmpF*x)r|.SKS#dp۪,LXoڭp)`JeӦ8"sU_z~HG,j(< ccX?%Y%L2jGT8 :)q" mќVf\F4i3%2]u-Y̾*PlS!Ⓘ '7 7 .cOʹZqK6pŷZYB.$Զ_]~@Xi.4eɾΈX5/Q0Gs+Bigk[ɷ(BKW\76b;câz/vŘ'EFK@EkT=1c?҆R7CMqŋ*і2,sV 7_W E<(cFM`8O:Oq|~R\hהT69*,:}z@Ͼ_6 NՍ0p]L[I3!QuR}YKpz_g7uYp^;C 4mS.yAC'{{Q3֝+6|:ISxn1oz‘Bϑ"qWhG=;`q_U#u 8,5.x[K*f(0iH]DwVQ//~ `U iө 6@~F|O=GR!HײZΫ'/ޓ)hEh Vv[)//*Sߑi(v1/.BHVN305 qڶbNE< Z1 !=8/w jc.KOp0#IX{|OR?>x}kpgp7qiԎMV4HȢ㬢xY,v5Cج_#]C~Jh߼8bC8S+fO0^yKV#ÃPls+ltzm> U*1l]Tys.\ /=֗LdJ>xq\r[ BdVI׏o 'rWhU2J)M J+&3^&ťE[N3-:LJe|IxY4aXRX3kF{ G[(|UysqMR}Yg[Sdp!F§W:sLRZl("h A>c`Nlow21p$f%0_Κ懬K 0˟w⨧͝Z%޺;YH;L}t٥%[te8, ה(Z{CY*Sq$0N_+p@BwtI#̷t[xmM2>r6[)◁7K8V&LM9/UL6,!ĶFn@4j`+V^nu %au"X#x)t, Fi9a-qZ5O <"6CێD!ED%"Evgq7O'T(\ؿGC-C#b ~-Ÿr!V(Y>$R)$**h)"6I4qB=1qCO&N^+Ou@ E8FN{J?pqZGb0W ed܁!"3R(x1[GΙo&\̦m&pp Nb ]Qzg^;,nUqi9/t͡$1,<տ[I]w=QH)sZDIaŎN;W|4\ ޅQ-}I$KⲆȱth3<~uQnx='{B2gdCW(+PiڪİG v60n45 Q^6<'hP@'(a&-F[fLMϺ&ݶ/MFj$s[mHI ]/([\yC?ɛkIF0aTgvo{Ԡ}rs#UApT?GVwd~=x',Kaךl5ʆ))!jq£%bPN)dEwi2_ZDm1n.}O|UzT%ӖVK8iÜd8_}LS냦keC"AWK3E}0N8lƿjEʡ2Hw΍c_<=eL LU&(S+z4*ҥڡρI{#Y"CbL>% Iz2_"kGDG+1dL (A<<ݖ0OhWE  0ۣہX.Mg|:A nʷbrzjR&>5v)/#=:dbo؞(T0-; cZ'!㱓NI/z, pU7` &~L~H sjA^jʎYR!rj^h̓g0Tc -bt~Q? 'i:޻cQ卍.Fbg4/\Q)9*C>~TXTsjF%PXEcs:{b`td5~~Yǡ&3ᄧ9z&q?8 ҪiعV] cXY~1)1]A xu!7Wˬ3@?i#ܓ? .A)j@ (zpB$C6 7 ^M :A;sYCvꂴt"?41["ןC{Uiy\C J_:Y,-PLvfչV?[:\Z+ZZD=i.:2C+_3%R}qج?n@Y+?:)*:xނMTA"7H[&Wm\f#V?*Ĉxc/݇H{3eJ!6>df4Bxt,'宆, %v>xsHPte&K0whMo=n=F@SQﱲ[!bGCҋ܃Xa?KkG'c1q:SG&COM5dIs Ty5Oo1(v[q JG>'&@_4L3-N)g4*6wNjqAU +2a "<+J +UۘyM8;/[QT(cbKz4FM5h+hC ݦ w d0,1VwLN,Nۜޯ7l C1#CW!Y oL[*mꑔiv b//*P=qKl5scZXh"Q:'غ_eՕ8IMw{ݾ7}j)|w;UM(CԟF0;L\`Q8`WB*h Eϴ>`n"r?LxM.``L+yКܯG\~b޶LP߹d%1LPr:m Vs*JPwDJ[͗DQBWM䰋gT %w~<[OB!v I"m=Olz<ğF}3$5m14ѵ)e|=A,axZ5ayـ" ԐF9p֛3*oGMA'QNM0O:b5^}"q>Nn )%m5mNr.ܩ4T C)r7neQj!e /o6ZŰ[8ihI3ǏvA 9ʑG&U<]~pe:)`6"ЪU!^7h@Ea0!1l]!Mb(prq5'|R31aU 9CYzSzŘeos8{cƚbDybJl/)t֛̐Q&P8 RzauA3 (>!1*uרI!d:m6H GWηQ^14ZP-Ob E6A`g6{$nNG~#uW8Քف,yVS"D_z):# ,K:v Q(QX7 e#4#Ng,\!~64\)"VHy {+c<tb bX>)((?|3[BV|imWd)"; X[ 1o]KjD1 e>hh"&!$ctW=#k%| I6k|MzP+ɞ嗫EGdwcZ|5iusP~QN"kܜ{lmY5̥uFpQ !@Me+[#΀[ װǓj4ɱ$FA LX4P5x ^;pMQp`dL롒r %#@N#ًܿ=HtO9 .8|]؛DrGU; 4KS;GAk+@Q)'IR?Yw`XR.LNmxRt:һU"X.m.Te! X3/|*HTeЯ'=oLf=h )W_X_B>C@°_$Z{LR?JgLDPRV5% ^8o+(wɡMdYCg4*!xlHK="]GoG.f;v,)dt''o Zh o? 3ZO"A_@y3M[[tJYe"}qvc>|BhŹ惹ɡ6|%`u_:[}Z)C~ д]5|-vLtO*P.#ɼ`98FjDOL3ݯѮ v){ xfĢn5knP%jzYJnBE{ۃ! HvdĩA;kKR(.H1Kzj*lk,2]CgYzwr{VXQC8{`$.zfcр2[XPGw^{.z( tІg1UVǰ2tC>a{w-!r'C1Km7{Ik\=FF8yds5t{bSm 0uRE'a Ӆ)ңL|pA\-zvu8yPܨp, u\^rHqKa>-rU*x꿳+frRr  4Ո"XVNf4ZlWwI[$mX !-zI-q;WV{!(CKԜֺFʄFQu;uyѝwaG"}Y7p ;TǓ14ߴ&`XOe/B! kLbR'P*c֦ZB.uw'wFgYr;q;Q0s'(M[P4!|ť ) '*~1XJd5>Ȋ=Nt&XwCX`ϔs*=-fe$bX 3t]!7~O~A6Sv)$ xHkl* ֒iD߯s"0="c(N#.$8< ϟ[d QĪQ߾OEyz|`Y A$p#r+rf*%s6L[NdִO9?cFcOĿkr+V0,FaPVՃ2Ǒ {s00/UkDT0嚡觲׌>q /@Z;ƕthrQ¥!(x_wSE+)*Xm A"|"qlR ^+5~"(֦{ZG Z *U{hl L ?/Y,3,MXM%n:t16=N 4|+P<',SI]L)lFd}́皓Ȃ=#+Ŏ7J"#𻩚Y"SA0_I* Í뵞 6:;KHJ mˮng%^Z2#qj <5,ŗK^tpz].8 ZNY5_]~ăѼT*L9ٸI\^nSۤTu69`"~Жt+`II>ϸSHR] ׄʶOBff,sQf7Zl'G}V@q_7-|@pNq>[s,#W( S]A(΃$8'{GN;Y$4a 0qWij~6X9ckj7N20+k$Z/t;B?-oWY:nj 4x 2t& h%5f!v/kr4udϪ2;:'`S]8iPq h6<ᴿӉ+R>$>5TBC7\= wWf3!P~4 OwId[r]z7dҨbXJؓȢ(3G5l4 GV/\z,2yВ5O}0NM{6!dXKQ>HNv w"I24BMv%qg)[hv hxUA !];S[N bGܝwU˔e)0(qxfMJF#%mZJ{ g`Z;2M3Dڠ-Ϧޕ)gzV?Њ̗/-Z`kRfXB 3 /iMR${?|d_>JuLvmb]bxoXp%_md| @hM6/lmIg`5zkO~^+&78 AaJ`D-Eǧ7ȷp=q#[0ǠIv[ 3`pE0Bm8 C%dD:`^"m0pE@#5t75r ڕ2pB86<hv!Wt8n5Rؙ,wSҫ,fG^:>8(3u9+iYQ3mNǖZ>/`XuP,:eEG=&8^J\De423PZxA+k1g*L .d/4t+tn36Ъ A̼34g$qV1k#r7n "* q dG:b?X}g* DN(uWeL&"1p.Dy~҂ '(Ȕ 3> 3_n͵ bPli3}/h3(Fٹ{eiXߛ¾X wJBQ4&r se[ch"1Ne9|H=cm<*z8`ݳ'fPR7ul2^-uึT?u'cu$AF r?`S64 2`n6δ%8X֪1- > F'Dll51ۚxF;~D$CP*^%s=u79y:8]^ ZP ; ͝#b6z.. n{>b;EL:(5`WS%:ÄjJQ;mp( ۹hK#EN;Ap~]1iٸ!.UVmET` ܮ\Íq0% Z]L"CD4?6Vca fҵxYNv*L:΋$m)*Ӟqv?|؀XX W3$Yo  S y[00"0\ٝ\IS1ˠ^{0/7Pځ-&f?мwl.,GnRq"(qHCdm#S3,E¸E"ROFX׵h Uj7`htgF| wZӓpvTs^F_3q;ܾX ,]7 Lq f\VsU%^!Pˠk;ށ@BhP[3E+BUv%RweNdLB͉cA /GQ's衰^(Y`Q ( @ľzʠ}Ay;u ͗2:_qf^h4qBS  =Kюd{c.1 }Nk"x33dcqyVDts5x5 QpIYk]ՠT=rg܇ꁣ浠b >b[,#VC'' -LK鯻`5LR.)x|;q6izȈcdK"~!G[ QmΏQ;ysLɘmҭ@p01q0i%lѿTzc)4dBa\ڕ{Sхj#8 ;X\/\ }32mfH UNi_w3N-~!䊦`;})U*HG%YT ,_aaA)YC;5at s:c]6Iל a\i\A }mɒe@piqmF[u/TO.%+[|F1_;iƦw Ӟ56@Dᅱ$ $>lwn@WY@џ,CrUNUTƚ_&) Aa>!,:l1upQ؅ gl&so040s]v@(\R_bŐ__>c4vl^|R&8s3;b7y]i[u4]mrt\vY24Y$NYLkK&̢\r\uthпIa+HN#f̟B?HM'nnfIVnuT`]%["`EU_cI9{Jߴ.:F;dW|q1\evEϙG֮|]9-RS-߉VlMuGL߹B0ۦU9+DKP#.𐤊S<(IkX]0'Xn; ؈KڞIy2 ^==;exhn(ط4 ~Bp3&{fQR\)uIVď|8Ov:]NБhč:saN|fd>icAaд2zN|'[vcI_-$25sB1V֥!PYOc3b&n\"-su%;V*1D~.$AN1EAne#ZIA R'ݭmn=BI6Hd+xe ]>W҅B͚>R۾_vqY%MNgSZA*zX3Yy0w[dv㩀KyUr7C]V>t@u^ez7D(68IB̼ыy%dVMT"ZW=pOy}ki!њ ,녽@:5Fq`ꨋ3M*mnX{$'~{'n66U n4`=H:p?( VD腏-u2+gUʹsLk|cr|`^Ƌ0 bԵ`4Ƃ?kE+WzV*kBG "#F"og9ȥuo o~o:a^ )rYN_GD7"c,K_y,xF岍 +6>8,P#VV.S:-["!A+zm okJVWЁ `Xqzwp*"smS!ooṮƞ6p^y&L/`h;1r#~wYd404Q&;8GɪZ.:RN x^F? ?W{"i7qg (qAxLzv7|Cwj:[_jqz͸KߏZrG~%:lj,c6 M2ɡ ut!֏⯻E 7=@8&hK`We-`Hi-#9,OGjY/%qk[Ah#Q&ĤB"﷫f~kiV4Sѱ;W0tEԥpbWQ XrAdsRKt:wYj4j,3@b5ypCusn} ےV;QspOLWoy/^v1Ze$aġ_U@k$M|K/1rl]%ʱO؂\G=љȯc\cͷ7@5K7'#\t'B5־ٍk4P,FWk |mi?X$Ҋgr{㣼o!b|@~WGI=E_ W"@焴gcDZ 9:2Aӧqpykd 3W|.H'R*i7e_7QJńhw\#HUQS94eC5B*#=ӥtU-1ڏ;yEݧ5)Fauƨg{bkbnoQl 08 /†A]qxK-nr]={$4ȀuouX 7M*X;p䝯8SGvŏ]0ːBD|w'y|by^%P!ܧsu``6rYw -,Y/7X H~1f ro\ʕtA*svE ϛQT4:` ^p:+L灍Qw%۽<;7dS\j_̴[%}6G1Z؛gZzDH^?G x3FzS] JldtLXGsR:3cF̆&pl?C1(ӏ kҋ5MBhugLaclw:RǏ`d"l%]8 (k&6>3>&?g^,${ D9%)QT\Ŀ]fk//oBt G,^N$G޽ŜR.ܥ5`­rhMAɓe1u3*pԓɂ ˵[ʢ 7ӗOg_ܨPf?@b*fanփY2zp \9p'-@;5rS{ݻ_w.XG'忣N@^5BӕģW~C=S0b Kx=9E4CBrҭ#,b1F/e_?vdvB2* `c2Wk61"~tz6{ ?: nh~_D Q ;]-QxQ궺sm,> @6Nr mH0 dD.TPpg"xi,юs!dT1Cd"{>,Wԉe:|ݶŮWp|EvBϷtR JY}JIveez|l`#Ll{{x8esǣG6 WŕjL13 ~dD$9ľut)bL0VoRjlzg>mD߁մsxhX) SDJ 1aS/.-ON|vw^'zZ--q.?wn}s'UI{M(cs pwI3C;.^H& PfB JCoHx1 <+j/  `9|VQM)۬y)2uxa Cꆿ^|T]H[MASg(Y,?.T,)ڿ%&|$=380i)XZG7 VKozN_%.5JM!B0 @#~ܢ]0^( 5hglmߛg+(DzM_hR{Jk<ӽ?9G$.ٱ(v/lNW ;&C9~4!!? M\x!Lu0oX~Aׇt@2ي\ $#oq!7"wY$ÈiQE7U?r%} =B@-~j'֘Nl&Nw?C83 -2e}SchUțsgMfU28F/ɰ323˒> Q?őwϞX7=!K/X9mYݚ226KOJpk68mZ[Z@r ۊ<5D='Ghfm/.&) &A| o~u|c)SPGُ1,us]AΦ#uֻ&]gϚC[_l H_~.ac# Y hWh%;Y]VrKڄ,AFeFNp,ׄ{{#$@y$1DyK*y#%Ԯ#*kRb<gcZY}lL?K5yvu`: -aB}  owS|NW^R!;8Y)]=9mg="],nap L{)5p?&2# dM+JDT;vϤ h5e7IBue// i2t[1^LNjfi5:mqф!@Uc8_g~Wpsl:d9׺;@ILĭz"jZ8Su^dA7j]viUի2ԒZBnΡP_Eׁ;ʒn٤U8CɈT7p_⑤sO3Hg^W w'X5ɩ BNy=.Ϋ1"R%2[ڿqhn#X*5PW:6mtfăA^F}jR)]J]_&f cK"I8d9bݨ2= =7~[SWp hgS_\~6BBuk{ZO|_xe4Gab1 9.y}eVD*w!i)Ђz LypLinqfbA^Wa)BaSTB˜v-;G`ߟWН진pBY]=ĩԼ6d^59Jdqg/B1>ZKT<vp 8;턶AE Z Ipy#atnŠljȥ'OiR@F<]݋ew!\a<K?}VtW8=L AsڄCIj.(Cˁ5vrbiDgXzMRoh FP/{$;f18?A} !Vgz{HӞF Sp_C;;(,yӑ%f`}8o+9Nq%rO*  pL1s !MD݆ܚhI#03fJ$n&')`ߙ6}7JpWm&ћr4y r ޹gH 9t_a3mػiH@[ګ̬`e kmxΔ]0'2AmJ*!yT3Q=SGCQ!P-+95 =>̹_ƥ6l_& g SuHk682eq41O~L~f]a/0^y97 XR d2WtisvtF^_5oKvpA,붽b)ZGRlWM K! N@L'֚N!esfCg7x @R⫣!!8U/fRyT[;m\Zj?Uj8*V6C6Ov؋v"_6(9iywiL^Sr}eA[ӥGWE蟡i_!mIaqS51b.𐺄~}2>$-Ii { -<ʔ.ULAG<>u^¸j V#9̓)}rA hc+R3GP 7N<*t`\.j$J^6b0w ܨUH8MG m;AR7YW~֞K-VuŎ|͡ 9F&5,!s*+օoPu>=F, ZܨeJ$2WO4 cdlCbIѫ_BMu$ 2sg4.^Y95qTug%Io<]tfQ@ʴrFs3~q FɎ`e-^ryp+NԤNe dΦE{l3m9x5ȁjYTUxdi1Uh[Z;Mpg*aE1}ȉ5d NE ?3.^EhFHđח_ՔD ~d $D:ef.bx$:6QF1vsLdG0Y0UXvq#)>Nu(98;`OZUp|uX4,+=MpIMjM-(R$̿4C@]7®Ke[6W[P-[ɂL#2ՆmM7#/Y { p .0JIf`Xf{O1x?o:7͚EwN!SEд+*{^Y4DxfZ]=+ [~RqF0ڢS4AW'hh)3Œ:ӅkdV\S}P ޵70Lb} x\J;\hƇ@Ǣ7M{(MNА8X;1CwO^oo83Mn h_NJ"c|JEiC 5/w9qbPemGsS>&," `7ϐzσΟS.H6k?ދouǧ*x*qKy곞Gzy5lIhx?da7zxR[uM |oIf5AB˦bQyQQRߊvQouFPUb󽓆p:̘* Db=a7JKлFv Qq"&((db.X"D45L:aT#Pzcu !I4 ]SbMvB; ͔!SFGXK& ]j-闎Fjx^4e]t_c jdjLL/uk|H2j$5>wKQBY(M9h3q?ɺ󬱆)oJٗ,qR$Q/ A I3v?qEz~\f!D/M!Շ38hqi- %sUmJj(  ˏNh@t^"xLFZ_𴻣k6h, %?rzq][(7'Xb_ ) d+{Jߏŋ3(QxlQ)KaJB#:J{CLqΞ~v\k)n}WꀅŒÙo^'0DOpQt}u z(V7C(]ii oM݅KVo{saL pX:.GD 7.`|zdR;tĚML7Y$8@[,l1N >e̸" 7Dqs{B8i{1!Ģ;8cZBNZ\*z~PZ3fֱKpJ~B=!g<>~fڄ;K`@b iQ+7Ñ^°k?x]0lMZm5ncl J9к?K9J WܮWt ~yࠚQن3h/u1 KSM9FMQƵ"H1uoǎ`&K1Fo_Og 8`OI 9'֙RlלF?AS#-kR8t~nq; Jgf~NT8atVKJXjS+jS/ùZ1_Ad{" *>.=a^9`hrSz{.#uv?"F+`4]ɧ!^gԎHh~27zTBq̏1V!:44Nѝ9duH0FdN `8PMGfLTmhX{ly$%6s9@q cT8bl7KSc+;kWn^ ~mj~EÆ $>9-eҙf.} '0s9QhD1$CzrbpuWn*ӏ. Oh0iMJ#:V4 $:;}1O2sjD=&2s76ywO:0'IE2KӐeU-K>.]r"QqD)Q%0⅂L3QO{ lj9АE qK(S1 5:کĕBA nDNi:+ӭ'â><=voP`/ysAyV9rOF-b#vMd>[]yx6CֶU!zIԃz-9J֍3ZeH$Ke KBz99euO˹6:"i<H.(sUnP _>dso/Yq`Es6ab(hiH21NVT*x]Oܘ:$1Qgd!!(6wbb0dL 3!̢ ƫwFUؿ*ouu5lSNp)pƄ pOкi-afJ}KQ)Q,(0A}E0y΅9#?Mqp.s90I|uPP} DxXʾ< =ZuK)LJB{mI#<|߀]q,8X[QM&%aJ -Dao)u:$h-׽|[ tņbC^({ FdRbطr.oAn@:*k;0n8 cͲ'^sbh<&I_kr3",' R MĄNr=%]rQ?hU"V/jRD1;y ɗ*:!"!RHCpwZz*ʹ] ;,1`}~ t@=i:&M5MQ˜%2dE)\QP&{_)4B%v.d7&8D?O?!/mU*Ӟi;T,>hmGy,(Iul袄As|7 85piNOgSzy`5^5싦"k9Sx^69z]Bw565:}S(-W7F͝K"urZ~cK.` 燪tV^vB(OhL@Llrx8Nk_Ju.\Lv`K)I.Kk^iy6k󳅘l?/$a$ZDx|KPuT \zjՏ~*|uHѿE_;v˿Rf+ 3㓺CEAkث:IlR+RҼ!t'ZLA6Q*.t2VFJ(bdaZ"$1E= _(~T2YO,Iyq):ir3-)RҩK4Tqu/MM@+L#XK_ȭG&:e&AVU"J7Iz3Tb߰,5]!rT7+qĩ/_p`"c"@o| ӌ(ws^ýx$3*zEe{@k4z*ͺxOfՌT& x\U:I#/Up..-lض~Cc­? oKplZG8$ifZ0G>:ڔ?Ns';U~>A.qixGF #sMy G]nؒ)NDѯcۘ/e j0F;yR?! HR£|KtyBTi 5q=̴Gcf +s5@jPn,.5Nj^I4tNd1Ѡװ_. r 7+̫@ L\^tjKy J/.΋kCxOi/ߢ@\:ɁU4i0f~e*E:Ncbhm!g} H"vQ7{L)٢vH%،gB:fïvIgY;]QٛeZ;޴ߔd \J8F$TٚAN(OzIhKNP=e@]*E7,.'T( vg(Fql5mj+*+z 'j$sLBՐQ#eEE7~a-x&~ =Ս.jn9U@EPM#>'lŬch Kch Goaxwhn.c[I>mzId r5.*sOvs,,L;!^2s),Q'`_hϙL&qӺ&N ʸ8vj a]ء E* u4y)cSBi7_?ӈM-O(qJhGS$Uu(SVAX;aǟ]Au@B,n`d8eG3^χͥօƖo8]ۣIꁻFZ!~L ׄ5&ԾP!֟ Y2\{&$e`G.Vika_5%W - o,#' f1)뷶Fo6Zwޘ۴ɣg/ptU8QZτ>]L!,.GpdhV dj^R<,kp̿p_UmN#Pvz8v7R6.)lKyQ 4Ѧ^ 6«X>_V%= T$o֞ϰ.,Ilf&)dl+RY x,ud0ZExp`@CkE!7~͢'⻟FU 19j_v"ziƺ9kHwnW sAU~fg]ƺu@U&ʍw8:.~LS/!dcƺ"k Y=[/,J Z'7 lV,臘Axr[1)ߺMy^xS/2{-Z4@슭wA8x / бp@/NLğ>]UC=mPa,D ~+0 Ns*̞6* *m}_9侩ӊpzrҴhLtR2w=,VP䉂_Vcsds@3G(O4-9Љfuw匜$KґkZ1#C8ezSk֯)uGs+4V`DozSy$/ hfˏOqycpmIs=Y~悹ˢp5Ԇ/2LR[%ag (=hJ-"}̄ 1xp 9%ݹY/_zEK ~wΣWHiB+D T%,玶Nʞ#_m𢸲Os7V-Zgю$h:w5,:s1$!$5E]_Fg wtPy&ʧ 5K\ ${^L-&+1/Գq8E]\,/e,<(G7(h#5,=nʎ U"+ŵd_ze])V ID2*?C9.veJTXt &7oEPƺW"(^<(%%5u`D0Ɖ?'`K'Ҵmf,XTh]ŤtHkj',&攱(ܻ $IH~bxh>xLi^+C:[}XCqE-(}&;r}Oςd3$%VӱSh遆bDS 'S~8r|6q=jȪ5,K#']FkwND' ǻ[_ɡYtXȗ=7G"u*>Yd׉22,rjd+G,{Ut:IԚ},Qk9đ,JD#?'eP+L4<-.W}bW=2I3|#v"&ylJ/~h2>UC̴iJ-7!GEi<ԠW†PkT\Iu)Ȫ'7_W 8Fwkh-80mƥ =.'3; }ش7xLNaT݌1Pwr=?QE?lNIlp~>PFY{Z=>|~Ly"Hg8#g/? 5txv"uq0-L,u60!dG5`6bm#ilX+]G}E,z~`bT?Y˼_CR]^C @Eͧ<5&|{u.D}`VيC+k:)n@ΐ9E"pj]E`K72A$lCd\ot#O&GMcŞ`u(mLOReli7"17f!*( X*ݒR)ia : 6(T. :FY HgS#ǫ[Ⱥ hhfZO0ľm-Nci"]HЩV{Hk)Eҩ$y#&o`P6AXMTOSl /8iX%V`F5+k o;ԧ٬ 铮Iihٜ*5=~Yv+[]R/F.dٛ0nJJ4J\$L7S/+TI\eWd| @ z?W~`1G4MELpx e5?dYsiH~k^p}+ OdT5p;l46mB"!q;I͐9kNuZhy(d#L❫ֆ:ͭG¼]]O3l:'K0.$e%n01T1NZ!)`kqa:Ka([>3Vmzr-d)dyE/F%'.pʞEW1zRJj<#_#kʿA_lMQFLtIv+Nsjl `ŪR}c,H㔈s4Vh%|] #^ ԗȺ$1A,>PjA)p`VutT FPl@92&~h8!q!58): G~l'gT;憼ﷺET鿆ʅ I5*׍xWoy[ վiYD-Tcٽ-j 9jԅpH WKsxhO <2 H8xw 2gV?00g~uk`'Bư[}J]Vtu ۋeeH6xSfԆ쳉 1eJ&C'u%^ a@u X4CT%?Ϛ: 2(fom{GFD Y,BcfyYV,7p|+tweܹK <ݴ 3;p󓘳jVW0).[u>KOT*.v'e,nAʰNi8߉|$7ކ)"O5_0ٕa^̖mǣUgYi_RȖgV a ЉvP{&-(hHnΏTڌڵ6m3<<fnC˚LH$^w;:F'D@uyI& wVO.=F(dxl/Eɡ!x=Eqs'ފ*X{J g&R]I6Gaj sfU P ,hCp&H3\kFEC&#}+}F Sz_g#fm B2"#6u0;je k.1 9~%SVdO0?',VWIXS?aa X> 6p|qԞQ?BL{I 9C [1u2TVb QϚ-mP`9HY=<)2m~v}WCYQ $Q]^_>_P8d: %،.F?u:Nt[G6ʣRR!s@S=P+yw lgdzm $Wk< FN [jt%QIRD|TAl &H#V˴R]WG'hݵԉ8CG AI^;#D}KO͙ { Pr?U(oV~ӘXFRÕQŕuWi" R\v3 4~*3# ' x5XUv8j/;8O+SwQ;ډ!-"x׼턛>#\63Ol>˦l}̟Ʉ7H Լ0.Vwe3 =S~1mn]w>/{쌈&@D -*|A{kW/t%SY˒GXf^Xs4&`ruQ2:N8%c]^.Ũ;<9uIeeIߑ-9w':,ZP0"'[NlePVÍ^$6BpaIZB̕0U@ 8_'_$&؝0k^wjJ]ŐEK7F-*VyCpC"4%i$)+LZ/n@7fv.k  ȩv+=ᑺiӊ\4PC+AS߿Gqggn"gg$NjjXW=<1 h4J$> ci$zѪ֊[ChÞQ"* '[qH lv"Ӡ8u =TK |ޑ>|F83Pj76j,3,d[`ZQ[ţerE`zk}Xt\hFXW=Kl¨nLmqA˹!3lNZ|w|{Ǜ >|}-.;8J)b0Na^Aa+7k㖈XWiO9ۧqN6xcc}l[Ԍ ?25Ort!ix9eij/'aĪ=w3bHNb]۞\KaL`ﭹdϐ Wx'g2b*[0~Z˨Ò)*\5b(mc폦\ =zhA9nV5p{rj/g|BPSC_ lhƿm lg+s)jk;!I9`Zo N% y-\uGĄ O 6[He4>tZ܎ zeɊ´ӄ}+kXe2&bP+UQe7XHd fϻ\μgG7gFlK-QwE☩P[`nGHqHNU[|b1Z l%Q qvT o3?p F\n%ԟꦎ!7q료r,ʇ 1=<9^~q쳏ۋw#iF4?kv P/3Xs@"[-Es6AEY߀;;S{!3^.(:N:ᾐ5Bp2=!=66C{v[r ($@Й@ZQZ1%BA8П)Kz.AOэamƎ:G6#sb)yٚ(;Ƴ.1Քpc`!')W%$BMD}3ÑL]IS~Iu; I\|ȹ}V.`fusս%$z1c^+BiuYB>Je8bU^+^$ǰB0"?r\""H;X8ֺ9-,31S''?C9*7SU )6ȎlgL)S\(쯺LYf,9Agl H;㮶^ l椘б%;0W\pBI+(_ad\ d6Ag^{:R༉xǯ-qZ1fGe7j2O9b;=otߖr%VQfK*:x)ИdgH]JI}~1in3*gkl[dЇ/QcѾAPg;a.D8.͞- /^$j`JB_0f/ۓ]M"gc&f}lK ޷?' |WrnfdhM8<ʶ$pp{zZ1I#mHSnrP ==&KfeT0^ŭWx*}y/CEBٿ"–qױB.%(~lv[ tݡ+'VBO ^A gN9683rIԜk4g'SoLywEAs`ӹo6-㹞"3aBdPw!;;ʚ|яoq 5dX=oJoļ1x"#$0p8xP-z 2r7Y"Ŕ;o?UgB nH5I{G*e)j̧uS4qE&ՙ6vBx]*c@>#GG>,O]8:sl@mcR p,Bw{:$rf(E֒F#sg'0y(-om i SE\[;$yدKnr 9%;>5݄3 3'1AgZnr(FGU uY: kQ ⾑hX9pDX%Y)z9Bnmq3dD?m[*Byz9ߒr9Toi<ی+L 9IT}7~w)h}wb/Q8O$LG,`x O]5rFeQWfyǖ:xc*, Cǰ$q<SBb)oPvqR$́8>uiT}N0FAL3":pW[53bEb"굥 PcHJl9!;az\=k޵ڞՌfFAe(h BKT/ಠ Bdk˞ qnT x#̖Fegl(s6C]ZOݝ坏s/ h[ (/sǹ]l2wLoϷ[r"#x7,KE)j/d_4~ntaUծҤR99bBҐN #!+p ԱKVP'P쬷8}.Y.A05 ._p&g[AZCؙ?3ܹ0L.%OZ24>c{aht(궾Q ujx0~%]pOYePd1vβZZ8tEAĪf zbj+z`~NpYA\:W;Dx""r}4uY(0g?T%@7j/"C])V^%g0}/b2HN&_4W>ꍬp^oFG8 f텮W,/=/"$nY{c7/CLHvkF/&?RYL7S49,Ky1+3݊\@mBk;Bp\G>@ORȰ8Xk훕5q!l9MhlJ:̩n)o"N茵Ps AVPyghxeJ@CۯNF!zG=vGFFu,E[$OT]adfjD30 aM?; pj`w,C:=fj_ڀp kx?g\fP,犜&q[X+t(_wcu+~fa-?{GDa&Est.p<[CHןBIVf=֐k |0/qpc8. ,HaNo/;ERT|נ\#F1m!B$Z;tχ?b\FZ+j&1Oߓg2+_g ̽b;隬1AfxHS vAA ~1P'E|l ]T/BC8TRW _B82uD{ׅ< rT1r I].D-PDj~q|5ϲ^0 TS.vb^Z;%F|rJط1.'HnP9g ; ٴp:,ƼuB< zoJ=wzτ +"| T=~e#sUu_JvИf{'4칦 5>7)ۛ VDDJ\5:3VuLr }rE?G'-ȃ.l98c + F""F FHB.vZsWwLЛDs.ɖ":d*F 9oUfzY*4\Uv q]0{g;p*zHgG~|}--Of3& 5Cqdf#2`ҤKRWȼ8L q~~&3K*ίK ޾b. AcZ4K15| 7(o>~m V',߃NzN _zǾKpr0In{0[ I/I@k{R?ĔYC|frD`!tP`Fh;,~ UsSHd>ܓ'C/LV?k7&PҺ2zLtL!}g$(a6i fl&krXt&sI@ɑݸ$F"X5lBAhkd+k&Wl#SUu8 >k䨋NcNȿ:3ɧI./ڭ~ƒ|u.?o nj̵}JCA TD Js X}y8cZ2fLKoH9eK`6B-3ECMIlL/Q!Үڣ#jX )qw1U#b`GY;=IcX8?^[`N6Ȯ w<˭Uq~",wvmbP<,"{Mqv Yo衖nH~[t.p푗+0"7wX!:ial_6lEG-gQjq oDZ8ײU;>K'(&mmsm Ko[̯&{l Ĕ5T-(1mQС7Nżj{0?*ɓom,-0%1ӶH̱>R5̯<$cb椠87ƉK@{%"uڪ'BbeS m|]ދDz (+%I Xn#Q‘n@U,>t*:IDväWu4ݶRd[dO=p|b zݗ0$ZEr+^kcRaӍbb׿qsDY>\WYq=BJg[qX}8 Rz3<`* hn~y3;U'ګ&GA. %L;݄I%up& $ć[]gO e*rdsM :#~'38W7!Nx%_B2lG:-Pc[AEIɄ]J7F$4Ԛ`Ux\ ۆYԵ똫=0/l$FF@;9)䟄z'hYJAٷ؉Q]d"kwaܫk_o>R6։p=1RDfئ.8"Hiq{#a^(>&z3lk0_Cb 6:tUKKUm=E3%[9(v.҂Zn09 l5[ו_4y}ig9}*ZPr\:uS5SQ DE-Lj)ݡm딿fEbYI<~JAKi_E\ޞeJۊ2Nj^Gߏ5j۩Sd/0?==cbT9 (/>!E|% P@dW>2棱 L/(8 ?Xlh]d4QfLH: 3)+2Mon/(0x|U԰1^t .fjBItt2V7T ABW'lW5xƑE&l,^b䪕ΟQ5]S3]w9 œoҴ< $`|VQx++s41D2PEC;fUO- S;G\(gpVZN~DpXEM`G\2úrkBG,_OT^3~Ey =s-sW V|ΕX!E|(0:{Wc®U֯] 5ު>ՇBZTRyˡd4԰a{I/d8h)ਞRZ86oeI&mt:TvkR`~Y0Py7>d fDV{{4s g^Vuz _l ^zh"[gϋ%&:"}3 v$M&Tk[ׂcY<˾** ДyMcs#.~*y@9SP>ƸF||%P\pgS9r-ao zHJT iO,պUOpYU1z0ܰ}jR!bNg| 6 #k$_Bע1ÏYL9a:q{@VHde}<ŕH<@~(K5#[芽gRUji%TA?VjuGd.s%:|a'vM5Mbjv}S/bt ۅ bϤ`oO48x_z6DMa;d=Z2 '!_؛E@jeBÆ~ˍ1=1WN1Mmd-̱ A$ZLYg|X~4@-Q2e*)Ŗr8Bѝ}|'}k˵&Mr}Js#+ݜLB`?T? ?Dc_:XāPp*5nuH׃@"8CEAJ \W0<-:F4I Z4*d$%"s>*49^`nm9̝1!0Mml)O mXV(kٛ8P>ug_aoZL;f n{ִh_>G㋍ndDaVnObMVj!NGq,rvi@]IЛ!Ї>l3j0 >UϜv WuKY,V<6 j>%rǪ2lAq .itx)pT"Mxcw8]NnC9CG<*f>q^ru> @?c 蚨?%q.-8YVٰ.铐] C73S7ы.`ma3R\=@e;9yJyWEy@f TS^$~-j{Ԫ AيuD^dF؀  ťr 6BdFy G5}MyZuQb?c U:qѱpO@"dRBȜ $=r '*!!hO|{e)i3;h2.4 tL%F6' k7̃ŷa::l. O޷ꃙ}~moj3 ~VO0/fJ;I8ݛ|͆}N,uU X$tETAẢ* JLF"ς0 4ǯg~噆TX [6VVG?1&g;XuW*OsB{D.W<¹RmTŕ8Rf ?gC] xBVN]*_kQȘWeq`*6bNh=lP ֿd| a]m5&;|/ =O6~SZG@s-Gh磦㲷!f0FcD=PV_ݱd9p}jU oSYM΂&%Қ )JC IG]:}N9fˈ^ņ!m3@N¢ `[=r=~K$J±{T^iVXJx_]~7Cߥ`D Is[y˅6ՏպO`phthI"kÂ`l?oVq_^d 3v~ĽY" WY/ h=l[huX̆,o : _ןY96ϓn`wwS}p}ΰ8![,.?&7ү&**Y'!~K7Cw0+&#f? SkK9fϼEҰ.D [ DјO lL4*ڀKS'ټ rsxPÉ:&Wy>t>ER?vV. ރfϑ24zѪǽ&sCkb/غ1aOKiMCfo{L uɍүAoRrFV7r܍ғ(ɫX[Bc"vW/Lj3l/$i&t49Nߤפ1F)C˨*obTDV:0 a4IMx56ZP*Dawv?箫=IE,`9a1 _|̵KS! !+; 5a{,^rVa{P'F4KhWB,Gϔ~Rɮ]^04g3Y6]xDl t>  ;cݘƎ8m b/f(BPXX;}j` sу(T(m(/)Nf$qށj (t"ҵޤvOzO4k<8~#L2uTPH ,e6S Aۣ0Q;X@·YKGwhF%ۣno$J[k:Rz9/cn^`eռ)9"q<(Z>$LUM>aCr<;jn6g PXQ' 'V(bMwJN eZQ==Xlx}E5)%09JMQr+QQjQ<7J8S&ł ;qZW}CP.Ș=-=i0m7> IC9V(UtJ7#{&+afy5 p+2]W" ]8xYu7yүvsB:{+Sw L fG5iyZ5rk]FuiIN70H>W%w`ݹ>RR(q~L淪$HؘNX,IƓ:F ZRڼc7@̬b5&OL!eǙSy$㆓5HqRombI8yuPbvw,͜o6l[K_C ^7E$N #47EPbG~-clvr?S;xb^kk$~Znىc Y͵j>F(ѥ1Sn sJF 95١. 1 4Um@Etzzs%b * *Q90b2+}(S=`ڄKB'S12FSj+ ߺ&RI,hrmB} ߯`e%IN.L0ԾNp %ί\bdBBY]E#7! h<(u:kyNr.S"z2+5.ir )"񟊒q|hinۖrBoY!g)$eҗvg5.Kx9QY7/}%7ϲIL-߱_ɸK b{CʑY+Ɔ 7U|hnc 'z:D2cbX6L98ZVf/1UNY~.u>~_i.k*]tT/Ā)*{Jң4_u}+iMKMJqo`|y~DXevQfS'[c5տ.U &P=[LXd6r~[O56?o HOyeAfᬤoid)3{V@"4- VCU7B#!}u庲N$& )yza%.hyʭ馍T'* :(ϓ.r|WBU^^WϾBhFȶ9 pB-ޙ}NCPX- ϔ3AB ':OXzXl׉*s{tޘ)'^8RZQM'X АA%ï)ͻM=8΂ޤI+e%5+J~%R +iCBd扦bw*uy&;#g)r|w?u q7pNQJaҮd,KI35GC!i񻐤y?,i]r˟ZKZ9OC(WYԫ0ce;QgIc9yBba/1~'2ܖE~M;$BfcW !{PoFL:~ts4l8@nVt TFT[kgnz҅!re\=ˉ8'O?g]NMkw7rka\ڀ_T-Ga>o Z:itb8=NMSzd\)U(C`]ˊd LƉ!h paSf^s"K@IHf37C9A DC Oe@6qhg˲ >&$52B=T2uerйc&a=ij`h2"nx!Xnͦ"|"yDHRJb~oϐٙ& ځ~"> 7ZkY/g0-l:^;hJ8xD]$vڻ ͎o5rO(}eA1zFE[v?~bz#U>{=/$,˺5J"wJ :BO$eQ8$EQ"ZitBk/?}U&pDxU:VM2C 'hC?Ѿ_2 C3JwOGct(sTW3NDܲTQ갺#"k(m*OcشHiz•rMlj_Plɻ||NhK&w]O˰#OW-xVD)i#9 vlK#Gl˼-rqq6ӽ䩣2hZ-74іN" .;I[QDz0Q'ƚV\/6D=̈`XrNj{q&~wA8țy38*WEa':m}먕$Zp4(W0nӄs灾TE#,$5`N,rf߮4_ˌ;.K7!>φjVlfT(ϥ#|#es͑Vi jyTU!=T!.zbAl|4稀y~@؂Qa{9C-/2JtXfE!u{7 .xJް/Uh3Řo>ogmGws1 ~tЮʔ>7jH.oHM]nChHM+ 5K5pn51YrHIHMZJ6čP_yf3TuG&mڶzvXp:\)z}sx JvrJe\3д .%00D唛ٌL!s𔚵2(2 ,Naf"M0oy N[1o^]w"a 3uy'|;khD!RS+jPZuH-m4]8<{[޸{OdzsoRWd3nh|)j&-jrjKDcDe<2 f@oT2=2^XO*)E#ͺ۠g]ЎYGlhzQm,p ܓxP`LDr'0zN͚#sW$5 )'1LSPY}ƯG $&y&g߈:z+!x[2o%'e®<]}{ H`n6C%@i=+14UlPFX?φ[ES[ˉ.nBH%t'ɗqe}_HtWfױj@9` &u"Jy/;u#VX! 9ZN1h۷e-@<:YImY.{!޶/ 2רw0"?.1M%નI5 }n}U:6A{ay;5mS [h`d,cvF.DԯMXֶВ(z`m$@XΩHKSsh8h2иrˈ/Zi2"DJ>D.'!~eqThU|cyb9qs.T7+˯ Y?ZL ͸:ZLЭFYy,"㙇Db<|GewTNj]r CW#n(K/ WC:!5kbAF%nT5&OhMEk KDW)5pP]bQ )uqEMgD.{erJj4;70dh5ۗdykha]?zqOOF:*X60+%I0$`)"WN[ؓ /T,h9q!-z|~zso}WR I595Y@mwCcSF2 yC*^cshvW#6 @ k bP!2FF [yF)&wRHB,8nb,EPޘ!-U:ŭlAg,вqEqZ]azϹ6a&6yYc5R:8A0NcZn}N|?'j$EN]_ќI`8*c'j%֙CYAx]CIl p<VjrGX MqtEyAl?'$1;:* ZM~ce'q p/'n dK>YƝKA ftF(~q ,z RfJՆјˆhk*JYlx`_mЀ!NQa C@e<ч"n /9\mj7n77XmodP<)Crg0r|tIt֖(Ha jy`H_Hwb1~K_bvCFOB_lv1om3URU&0gEhl4jK_cS Y]lx3[0wx_T+J!LSJi ×ee:!,0vtgҢmAK=B*ċ GV.6 HURIjwbȯ4PU\41.ㅣqLvTy& :L4UX"]I5mdúQ(P{kڴ]/>|a`cN kZ:`g^MmK*M̹:9-__ˉHe2XϯKȐ0tlٓZy['oa4Us?>@N"4twaN.qRgg֮ɰsR\~:sI%+T$`I#=ډ!{uNbIVD:t I=2^՛j!H.^'6:6y}d )[$`mܖ; q;3د2I2Sc"ꆦ0neEymjdX-Gz=q w]VJ%8ݚ¨>4EA / ,FnCV<]gaؠ1w05$ NW -0Sڰ M _nYw]>&#Գ 7NTӨQL5ZN#)pVD SrNeV2`|<_Le0\Lj8xpFayPm DhC40)bڔ`pR!LC [=ġIS 32V%QX|%vu!P%0D0#t::=I5-^VdjgVZFs aG917&,̃ןUpŎ@<<vkVB=p_܏3(9_aq;F!KL|Nm; }kTʛB h?sE&}$-vSaV 0)^BQ|vSpp=azLfcF14Z+ҢnT;:Lva~q](3rfl:ue9-~PbYҟEaa/+&]#Ok{ib r>YM:C – ǀ}mԫ$1~Y6e<)_Xv:9P [vCwO8Pԇ-?}̌lN%JwМw"N>7\~_Ty\ sҲg"5*7"xi3X4K.EraVA3[:0]6mӤ~SKB8*Pi mrW,6^sLoAJkM#CVisX 0`oAS%4̯&SkJ> }bӖ ȅoMހj32ʔn.E%nT漼)(Dl\nsjү+{]WY-.YavKP!B-_Բq!?~ SGDHzT7)Nq=~=t0g)=Xxxиfٻ 64{omI62aVp8$aMФu/4e~*pBm֒^ ԃ9h7!um5r8(DPφdZT& 7m N "dOi2Fœ'\Vu+L1 ځ% Iqɑ햍􅚡Lڽ 2Sw+`Լ.yyGj"ƋWɪq(6tF0e ,*G)[VQ*m$RsQݜ_0!ibtg1cC C=Y4oJjTJi0WP{,@"q?|\ (}2-N%+E%9VZ-n'<Vú9)Mkpl(*! d}j;z_\Bfi;/lWIt[t)1,FVF)l!q[_3tS!1ԙrE%"Phs/L[7sO3Mt(fwJ?͎ka~\ \eOarT[!VP4A3#JnA_Ύ3JQ Ii'ݎP ]Ո.2D'%i qERfτt,T/#jIr>\ Ŭ.֭z'l/ڴ E-(ذMWrTvepQmNJ|c)XLY>ת*{BNŝI͓,0|:PG6Ѱ?fLjŖui mȄ d]p؍)6;Nb3C 1՗YN~D^An9`|iM`r_6{5J[a1`YnpMZuf J^kGZ@,^#ֳzn@R*w{#v~`6Bv_Kz޻),<͌ -Fִ.FApngԚ[F=UcR^ne 9BF8ԃ#9ފ&p / >1{- $t6hRXWs&=~m*0kPܓJbemȶi3C:rplޮ2DjTQC 4>և#.QbōY@Nf˩fFH)T*QzrkEjuFD5n R;_/NԀB\p{H,u21~[3%PudqpղW9!y5`5OeWxHsEۚ/݃ '*+Dsր# A$6c7¼HWtIXdA4&`2+ML•7 6$]|)Thbi8ry' Kfa-oX-]x&LΰC9>^K5~8y9nDRwJf9isKP}QOfvM~OeX0 f 炆ੑ ?V?'.t@WڦW?-%G#~k6U|/Ka}\otD'3@}~&olLO[1@Ҡ~)[UƔ1X6{&2/xBsNIT]pn88Z .<3;xi=^D6@ʷivRϺ d;a;Z0eS C-uuE$`8X;%;DޮcO Z6&=aLJe֒bo}i}2u =N ڙ0ڣֵPϴ& 7pFڀr0w>bmпN-&t1 (yxzGŮú9))LAah^ ¶dqygɣgp"Ƶ$7vPֱqϷX(>N [Xؒ pQT?6?&o $·td>4Kcf;Xa_CV/ڰn2tV6JA+p3\L9#fs `&.)?wr;;˪Ak_eu/4~e^!]j<)CUnkUt։b>4jZ`9ΑػhiBc|5=q/J=+>zf"'(1^3ٌRǮK*C雡T%=Dz0כWPN2yM %GpeL}~=o7ҹe0Ax%Bg@ڮ PxʷW;Z\FZ*uW땴i Xt~ˢ^l0s#|?uɎnQ&2DV媰((LU%CR߹m޼ܜw"K>7:oH+`(Gj11rwq GE1aUL% Y|q^~-W@ s{kDٿnC4Ǔ# 75!U |~d\=V~hR]Ex͖#7@c#\.x,J-*,tV2 VpL\A%&j Wt @M; !$g`Bt^}娼;WF~KpȦ;Tz8d{`>lQT/𻫈aHKZl}-~MUR (}fN Y]>C^Hߩ<{YRF$SE@_o?"gm#n(^lǬk&gvפӓ಍R:%<;A5#sU3BcH mXfbQ M\jЮ Ďޢ(Ұd*[&]ﰫbE^;wi뼵02qGoВnLЮTItr|;5+UzĪ:Nk-ì~z>Ecw*OIDhjEd)͙8C<O'h-O/_"fU2/IkwU-vP%'S.a9rǔN]dXRᤏNJ֢kT9Yz[k]WO T[>3Ѫ<]q\lXg>Lbj O^!-4z1Ez;ρqtE&vqSf ߾sMa7[equcSB^H[d/TA0aNm\ w6J%3YytNqr̫6iP2~;J"P%c17xn)?~ɃhХm~q*3Vᱳf zDLLCt cWZNhY| {3u>ަ~maphClvNP:I8gޞ^aHX_G 4\(8}gTrŎO\/ZS]VMnq0=l4)ƳGˆ-nⱞ7)!"b@̂]O#&IS.X#(o&{>QL@Q&e?%K6FZ]HQӬ]*>q2װ aǚ=Ђ?*j)Vs+\6A蹊r^$/\v{'@tHAϝd' ~͝s4́_~C$DS~)6 kW|9,xy.'oTppovx,%vܚOA׌d@F V04%";vg=s >1}LTSS[zފmJn*kPLCJۉm #zm&RT鸝-BtӡCvJ4,` %\d&X]@ UŅLXsTnYicN8'鿐M䄓d%z(JG~mn7'Czt芆qރZ&wvJ]¿]Rߌ(o3RѲK^x~ X͡x:1{ J7+.T 8YĔI(jdb1Hg>|JZz3d\_UTQޗ #d؊ NCGeOkk}%bqk"_m تK5ڶpΎ==7%'pe$EKKB[`aD-wSuQmǟk*,%F\ӸW70<8X CV$r"vg_{%'w1\?\qwnA]6eū!K[vy?cD2L}N,$.h{fqa,?"ZI\ΥYB [Fx9sލs4tbY pbN TYwon(lJw*Dܾ&6mpc!ͻ,K[x5}j\7Jݹ(eE>t'ׁm? xB`n:% <&=.1eY)oތtFT91Pr{Pl'OxoĚ儗u=MScyK+\믲F)i#]s;ճ-z)1y.3Q\)̳yFU칛AkF/AuUH3kϻBJ:@xa, {J+3RG3ڄKcL 5427㖻YShsN|]t9:͆/UhYv-6w xK}mL_4p8Wq F8jB&Xb_ȶ[:: (`z«yPs+x/]!#6nzBzjsqN*l!.$ٱ~=\u ['y4FyY~JwUJPdooo Vd~0{6K̏6T K^|O"GLh\*Ѕ~>t*{GIn A_@s[7xl5॓(@㔤gZ5hvcܒSNC{i;%?"k$sVB~ED9; 9D+a/]dU98Q+^M,ݸ kk'/#ׂR<7) `VES2,hd^Me(la ;p!Bo _PRjW3* щ.WgWF|PaՔQxU,>߯T_J YsPz6%@9b/(9δ\U( EwSt?Tvx7T:n0q̎4֟%.ܝƺ4ͻ& aA8BlgVN~؋YiްoぜT<0 3PUwK?@4:we "C4/n[}Eyi\NЩ]-ۦΟ6>-- ɏ/(cva}T5 K~yeZox:BHn$'UF^c묲|)ޤ\W}!tuzSԑi1y+_l|7%{P+ mWXR..@Uf{7!Ye1xtow{A1eTmxeԏ{ݧ6p,w1D!eN}AˈRM7oAݠd}5sO]ڴ)<rW%inhUB $*`"5I.X~9<Qhӆ~L{WtQa`xd!GRBݎoEƔIQrڗi|HAA}gsŲwVOoWeo%@RH.Rtg<(&UHnn2Bu,\ۀ7t 3gwbCd^h*fo-3I U|-/' 7/mUߣL'urү['dѲX5ڒ{遼5g_Xbv; |f a3W%f%>M(*u8=ڦIY1*S qO(O`[:sHR60]d GC=鮹  S?0`p;U2gR: ߤdE6?QȻc<ׄT[aMGmk SċFg,1s5.p*i<ߪ|5 mCA,Yv?FfCxX^j~BDk&* 4!'HSxXNVF2ۻ7UgLmиӹ7RhMe2&y y $~KO FɩY~)w_YnhiRm:)qlTcb3l{v]F&_eU GQHBdmXiwNV%EEN ٖ ]Rh`L.LxW52 sn(`wgr@hLA`.>a{Cxв{.ϲ_a$P^CFm7fmݛSc }WUɿuNӪ%O@qRNU0ɊU`M:C(+АI㈓ݯ(!Ι1g0^ɎˍtRXknhT=JPF1~F HwéV] p;J (;/<:=rS I8耙q2l&dfž鋣'D4˙ސ*w&Z2W¹S<`4_N-qn`K;ѝu!'3Y9tH(C xmV? TK5-i-IW9K )9(4bmۢmQM)l6V>T&Og[-)Db[` 8m 㗒PbpLϳiжvl+<ȟj73 ?Y«= 7[dǖHφ1#ru]_/xh /=m8FJܿ @TKî$)9ϱ*x#ݧK\jg^U104j:'.1dq7$u H6tF+4Dْ}PGy8I]żu*w|v(c?kio}A]RZ8a#2H6n}<21LdvZ^#6ѲN_Ӏiሤb\:Mr,x$1QBmOI"71+-##<Ksx=`?2O,wFAmbM{JwFt&!8G۔B[6 . ~`6_fxձ{;PeC MqI2c*B $'`O"le:Ⱥ,G[cR PgnH _R#=ƕrrFRF⧬_[t~j?y6PknЉ!vSߒ׀ǎ'Z+W^A3{l9:_٤*Yot, d qEjNcU V"2lby?~,c9jge{娞(〷HMX Dzvw"=nmAW.$kURQgg[ˌGnE,OML(Y쥍J&'3 ́ؼʨ7 zlMY- Nv@;\A 7pbeոvv浫=x~d־eNn]0˟6 11Tc\y-J-7 mŤtz_w޲uH[AI^n8COtoO>ǒ3J!^&G D'{ASOO K 쯔#Vf.̠|T!V21Ok8kф&9&"p/gq}w8'rrj_*8^b u7C;d][bԐEӎ:wm1g$7wzwV`z $+fky|}$7j)JP9{<!(ZqLөK_{ݝw%Mv "J r>Jʅ1R5dc|?U#F9{Dcql4 Gi]r{L>$)5jʨ>T?#:t4dT/`W3H{!jMEəw*nMqUptbAg>T}4,ڌnklˮ A|c`O"HY12 : BH5X':, 2#fxtg6)}X+-8WJJz){:&5iPlfĬ2H+ '88 a={t,~;js34!r)E/Gw3ɉXlʛD-OG/Z̧D! 9 v) 'FOzXG^ ;mɮ{ʒ}iՖٶnsۋP^A=Z.sp2zrjJ:iU;nSM~09-E"&zBSu Fhq:ifFkXNqUM5tEmqW+QhgChPhfnYM#m z֪pkVp)N64zE^>d<;^4~/ B ԯarEu-vLJ:bavfK#%,,&0TG4u[qjh$`_ pғ{E ~EF} m#EHa~~!/pW,i=eˆy9eDqmϸIl1x7U,K3]`3kɖHh@%lyk#f# ~z+682TzNKR4Dk:K AИG]NVu Fs4JqQ>9($ yoU5;ϪVd$i3A)j+k[: ©VFeQռmC4\TlzMUK8hC-qlXl挞^;[ζ[4fvΎuH8"q#vTt PYХ";=M|8ӗn7B"s @b ;vG ֿSlHAsسod!ZȰs{%23Uo.b0]c  EГZ6%4J)Kv6|ܙ2؄yiu<]rP[\Aq"O HX 5b4{Ο)@}b.VX$dH}sZ^W.9"ޗ pj aqa~l{9c o%n |Kvd Z " X -hJ2x-AM474(|SGA:ٗ*+(%x"]@$=\lz}kju?U\.V!QMN\xy/۵Nӑ:Mr SY:3,i;n=dq>*z YvP>,ȉ9` ^Zw۲?i_/&d+ޤБ_8TO;;gXw]Kn4w֊ԁ55 iwjL cxG`XܘAq_]Zb: {TNs1)*}\kѮ`w #g9wOfT ysbNH^WkS""58͡BO jR .)pQEO,BlM],<+(+: TA`RL 4R9ZB̄"pD@C|k3Nw\ho(s.)(astsRE)[6wh/ IMHPiկтܧT6-jl7ɢw*<-OjF(ny'iJ3DPTM9#_݃O( Wd@xZ;f6nzj +\rS(0q&n1E>jciĘTSs`RPtdw uD xts%-*P@z*Y|{/tpl,nb5,@?b>NQz2ZhgfUn[㩮R/Dkd$Lݸ?鸹$\$dadmА,@V.6l|6)Fu^9?%_HwXɞI7s^7YS"32Fa ɟC6_WaS*Ɠ bdAO)t*5,5ش }l iͧx!.% $;]J4ր -x=ڬcF.[\\+!,?7T.>-҅~AQ #HeAdY;RDUTJ٥e2zLQ*GD;>|NA>iB *r>AOקӣF( V"E r %Z3Z3bh>_J'3qԓ3FӅ@kTzB@I,2;2ǡ<1i,i/36(kwHhz*- DɛEtu}0rN)dLTV6Jߧɮ37z1~9-+ (tbq*n{-f<Ktڡm:l~>Bk;y< 88 lŒgI6k9YןZ MwK _8cB+:wktgi QGa:K.t~cofS bi= .fA/.)(&"% $`.BJ5{; ю{uw*}0t`_Evl '-OP~Iي+(;䍐~~qMԷ5"wOT\,gK"a6R*|ҮKq9ڑTuڧY(,8U[`SD[͘tvNAՆT~HvL(& .+C@s!}@9  cEVmȸ?b([BKޓmH=:}@>E[D v`Z1=LYZ2 iZR`.޾H5wkW#xjgi㑬bkE{ oD)`l$٣J|5T[2;[~Q]>[:"߀籟jQt,Q7n^eTK.DGEf'9M0*>.f소X FW;yszDDw(0s =zU ɕ)#1Vx$Fe?.pQ8C:)@&+ֵ*>b]99Zl Han"/yA, Bf܌!`;1PW21AўBլN>:*OM >rkMhn5yL/Eߍd!m+57J X;^ iJ4 _A4w9KvgF;U|׉oLə"5J, LR,5qf'jRs'}y 详/Q"1BƸ ỉESמPk|BC¬ y)۽3\Ҁ2S6^;\nH^uuыl[ yS{!;?p$2T ;-*@W0a&[e %Zs-k::[OfhY%L q^@jrʢ]x@7!>7KTIe٪",4 J6[؃ @1q e)\*I87E Kw~ %_>obފL_ff7y==N~.PպHv- wď:*p*%U8^BM"k!~`Xf՘|vT0lU~͊}: ^N7[MJ .gy~HQ1T*ldT 'O5[=_ 2Dn\apnSN Nf#z K3 arvBdGRrS;_@F=|^Fe#[)s|<lȥs5fuZ$ԿZ ;0/%j#[WT>]Twe?6,ܲi2+$*Ci,y܀϶ }l;=4F*Ib6_Wwa2DJ{zwU~1ګm IoϩA{J 5j& תPrl'{MZ&mlA!;خjxYmz|SJeH\VW`Lcull4q s\N!T=(28&XzK?7͎Ҥ aKV\b9%RbܔI:l: 8M4"YG䭹O|F"!U[$($~O;YPH 8xQژ3zbEb`3y5ɝ!adJ[k}z?:˾{lR į|k-;'؆8L/:j.A'XDrKyPwꥨUKҐLxUo츎 6IQܩ?#|82#Z8A2X^Fv%nGH%KF K{p z&4ؔbh6u)BT@zc4gY GH'R,c4肪y01*Lw Hu%Ws/Q]/: y>[̀IZ X$+paFh.5 bZƖ}CO\\-DRP}Iɺ`wV M5ъq-G?I `Y׬Uɘw.:',E}gOR 7؜zCjB4{RN-3QFOOrUb5ȜK8Xt lpk|yŔJf I1bEBj bk#@07S̆-S즘9==?`(Qg UyPR,C RdvKzYH#[1mՑ%@3HU^WXŘ/lY$rǙ0v"ɟ9&}(i+H<0 QԴO6J)|N?RBS+x>D3$Pt^;l2aRuwOl*A9b3]y1lVU}vk3CPf. dadL{Urub33.w$HS ͑Ơ,N8 d CYקn  7OG;'\?/!Ko h`*_/ `)Hfs|+ׯ_uYO TuɠZ|ܱ$cjca=6#mEPUȒǞEo:KY^)5D-դG'9+bsK<M'(  cqr{}fu>1!sS;>qUӓ N &9p'""3gƊO~U·ؔs}MGY#NR,q""L 0n- '2OO!\@`JV@0+B mp_*viIIb#Ov_($3Ԇ9ٮP|q*Iuu?{G}9A×5dx9+0 l@[T[Zo`JSG;q ch>~gɂlTq}"kH6W#V咜 E/އb;G T.~ou !V#{A9NԿ<3u3T3[deZ ԪcsE,WnUE>YBA~_pEgIofm01jtFDޏÂ'S?6WpJ9 [aym o BVK!3- 3+v%Ƚ4H b"jmQwTKޑ4*[HQ A0n3$$Z b֒K6es~N.H6 '8)$*:!9X惍DZ5)^) uX{H{ ֏&ÅUd`pHڐk㷤qV ?֕!GFhI_7w@ /j:!u񊫒4ocyݖ8qT;4 CQ-dBe(eAO X٢(h{eeזEVc&b64`,z[4lÒX}ha&G ~շf%@ž`MWGtg;͟YmMh^7=7ۣ :V%ԹKIa/PBŤtZ x/djz-3mԎ!}MM'޵U@{ H̊ | j(#WVlrg5kea&>fYx41|MK^-kܱXW4y9~8yO]xCmg伂NAXo#z9أbX7B#OTѝ̝N_MLfoVaDb#AέDɿm,#"m[q"^*7DkGNBTFײW#P(77>牔 z ~Jҹ u2/܆ZXl2BanUq%츬1aGQ Ӛ nF {q;IYU9‡kGq- %+gds ~ V=ʷ.vn.S+zKU֓Msh>3m,E.YqOzsV2F|2(Ku4KUV nPxv ؖ+`{LNN$7 CB{e+f~ 4;`;k "[=Ks; 8Bm(dC]}so Qx(ʲb88%RA⧛a/ˇnۊ:0y9Qɹnr9=cgImsU@*^]Ln,2S6]2ʍX+iNȝոw*(0P/$M1Ƚ&aR'Ż?f $5S!|'6,0;`O_lq_{Tڬ%bc8a1;ʭ4th!=,A Eh.0"VdQ =B:E}#|i>tn3L-TI!1gxӰ+NFP`xAx&&'m vGI/ ɛQHޯ^̼'ی:32:~?`$Kot:iiyfXĩcdaRĆU1t%/IC\0sbl %~!<vj&BBVfޥ}eꃫ?asvs@JR|mD/-~-ʟ؀@ G="4`,\д5,oE k3hl[Ҽ&IwIiGq5l]Ad?87 ReK) Bȵ\"GL$Cҝ;!$>U=?}#A3F/I0\NM+yoO ^ (eog, AW%@5ӕ2#Q7VK09nq2x3NGY:k fKa[~ͦB rjΈ&z?>?X-!lx\> ec*_:9s,ĴF^zI;xPc:9ʂ)_˪a@UiA#uگ A 9|E~jW+K%eQ AlTUk "g!Z_ӓ"EL 4WE )|)I G^Mej%iy>ڱXKI-E7Bo< I^P@RZ[x-jDZ6s/] iDՏk-鯤l.`KK>m:Ѧ؞!i>$ Gyk!T<2c["@5 ?2ةL̄e""LN ErIPiK _0v^#w&e 4al:_E^=eʄ( g 5Aj4ǔ*uO,S?2dMڭH(oS:oBnL\Wp*Q %cjp.m{2/_>U.\ns"XG~0A^hUe YxS[e`Uoޫ*o#?\hU>ʏ!эbr(ਡ[Oq.k4JoM͠eq+hK.-5ȾG&ww9RR6 E(1M6@!-x8ܺGow%CLY/XB 1gMX1; 4i2="Z,rۍEC.@"B4/\Zx^*%sF!u&<69ˉZ =t~ӥf:fY&HNKK9-Д8aYe!Dt33sbDh; z'?r0/ʺ%"? K:zjy^Nw.*CgBZ%~ P6./dZyȽu5 Kj|]_Ag[~b"R E'}w qA.$o_;!_$/ $FPDjCyp6njjLΤ葊NU^!qҝ$tQ'XKkeYܪ3VE X! .Wqk>ŐuHC 2;)\(!oW[acımm4.h /XѴQx q&O3h6^Et=)B>7]?\>8~^|AP}^HZY4Pv 宩z Tn-GM^Qiv=e]HOhuEBzUE $RS$܍d%]*,}cxR9XJwZ_Wl7 caAyNǸDhD͗gI㢪/+O[ې3`Y<~4*y#t@7v'94egnntczh3~QmBV黰bt`bR) uWLv'HS-x#aIGs 6)ud+ݍMuzbB}J5^=e7S78p񺎪nE?A/f| oJŠLz,ޓ^qKG28=}k촙ٓK.?3ĝUť̽a;-\!;ݛy(:,"7&F.^Do`&bj1R,2v@O}= V>| )DaRpڞX0K V.J$ox(WbH5(9.q-A7=3U Xz8,z\CP353䥶QeN^m":T7 r1ː]Ae'ͥngֹȿTTTXLSr>DՖ77ζY="uzI/PMw(wcqc( $u uSևQ&9V%EDs4>Zw,gLVkG#QU{v=kP04(0&MݗbW_a!G.Nfe5 ݔ98m yģFlԽ*%vuYFpm {lLߦ%2CYXMdo-q0 BĵjeBt r[= wţƇ*ĕWJ]܂)r섦p;o^,ɣz*N7Dc}#.R{-q2Ѣ #eª.E1YkP\qȅ5*.<}`,G`p"e-4 ]a&'یMsP/"}&vbFjE0خTG>EK sw]K!nF%7+*MYm0PWcƄЧ3yE@1K$&&FmsZ; 㑷riWRH/BEͷ2?[ʶecsVҰC+o ie#jn)gL}^crKC`:`"׼4źn94z`&WeOei-L1d=JR 0|"b$ ,9 -ʮ0bc{Ô6Z;2Z#hЗO2#TO5bZIs"S\φϷE_(s;RP%M}b0`Q49/'1 7ǃk|KUF {V | 0.}UM6($M+R lȷ+|$M# bc'M  +@1lGP 6.L[;uNE;ZsjA0D%cd Qã%5)N̵|:|S1NG͙aVZlQ+tKc&JejhM4v}Ē=+[( >:A~\M ó&bTd䢷 )yRV (*ų+;Ƽ@8[N,! Сz\8m^pa9d.c,^#Z+G1[NPg}eb0٦ DHݕr|z1ͶF4}~t` 1xFUpI˧YO;_AQMɕ!&j sަO/Ne_[Nf'H]zšX;ʼ*lҏM$WʝCu%쮩'6K Nwc>\:j} x~#-dSQhy-Iˁ5`->Wo(%lMN/*3R&'5pu^E+]ɹfduu%nQqx)1qF{I0cF7<旣 ud66%R5b7$PgJmLMQXj͛ag8 oNӵ !.#tDz2+l p!Gυ,Ch¨u&J}cWRVw{Y8VDZa{viYkOcı"'G$w3 {-B-4ı|t^SPH+cPhLђ#8h^(; xIi$%JԉA!Ds,xBN hW*4u=Ld:(-VO;)P3`(6y%CZ{;o/SVunĺXtRǂ rބ[9%iS!ٱMMwMT̓.aw%l`S#}/BO6yZ5n7 RoJkX V_h-G!w*8l?ݵi}qg R] ad;(^^0lz" X;M;.6qΖB3#'w\nZ[rp&~q >#X&lȨ0] ho X*TėzTG&f;Pep5dVkUm nAy˥'c~0 p*]' x+ hw&WE̬"o7TJg~D2Q̖hID6ocDp;% j~aňԱ]ر b [q0rq$66A'j=siToV_(,@eWwF-X!\4hm/U8Ejɺ[jdAr颸UnH u8f|=.rAM3re!?k+ӖoO?:'DO $;nQ.dxVaZ[G0* 5. ղG$*v3/-VKPCڻFͯR̟'8(%݄68B8ؑ6":ݿkmCP5DjAFA**PyPvD 0%mLy_ :Konp8 ׽fy@rWz7qۣGhsx\EQZ+TLHR/HPda k ]˥AO=!ncLu 3FHn̠R!J}E(/LE_$dn n|VHhS]{EлUR|K020Kli45q@U/[5äfdQğ^0ui]DE=+9bcr,$C.5#}oF(^Mug#% ې4&o-vAa  <5}ɶ"1Sz,6D+hJo0 ̐NE, {#rc>=kG$ 'ZZ1rRGD*PT- ~w*T.?GBts'?P%%"8`~d}K!N*fW9ݕ50\O^^<,r! ˧c˘0^MUnM:+;5pyitvAfco4Gf.{ C`/LNKR}mS M o]e@,x+R`5mB Fnڒ,`XLETGg_}'%}긙Nל]=":{wMŭ&p`9`)>S5|0<{tDYjBx?$;X]za`69ƾzN@쩆16,Ò_e@ƒ,"S? 4$FZJcNY JX85Vu|VGA8`;c Čy "9v%&VkxgC-h>jQUGϳEMh?ڟjVҐHf\eO* SVbXZEGk_={$ >,~Zx* N8.Fw./Q"~"d[[){*m4dG>y:mpTHpgUPNb ,bTvb=0C#\fb8z${٠gyϖwik@$OֱJ6@*-}}h'--d>)%八P؃`Bo),yC%rt+mhrDO K؏.3>ƫl^*r@* awaoԶ.ڄl#wqxYdƞy{F-gS1oֵKR+!>Q$ }&nK26 <Ώpo[sWu$p£_- Rî]Xmb]GSx5'*zE[)ZN}jo6Ÿ"W%fSԻ獐},NlsWf&t 6 ,h^ĪWFys O:[$ݢ JZ5{V@ 'TFR-'?/܋t2R{ϑvZ>0x]rNF{6?ݮrZ·XGiϖnhp/kr甇@IbU U:޲%OV5-|ٌ6 馿fLuC Eݨe2X,Gy`|_j5xͧꍳ@Ȓ,چ\6yY("~zM*$Εe ,RQJ/Ym8=$g]n+S$Tv 4mCysF.J5hvCet"+,l}f_mDn̥NN+2# :dxzY Iďݔ%' OXj`ˀ[2ThW.q|NVvp<]6u}2 1eN L=Ţ^`tc_*HT$8TTgnYy (1a6dW%D7k\Iv1s )lDʵlw'ncyHz$j9ިCl] N,Pjx-1쓚Wd'l"wmw#g>7-=Wf-"`_d9u?rSoxO_T#㇋CꮤDL!G7mQ*`O<1ٷ< "-#8 _Fǜ;&BV|&v$TPe2.2cKtO/EJ.:Nd͘WAG/Du-˯*,#Q*>Hͼ#~>jS$S{('BQr\p Τ~%v7+~$^e`X#P`KPn|jOm~ݧvz&ŴIGHvG^@KK; yAG?o)[u #h+dv=rr^z|_ܿ;YӜdr$4|QuÙ! `ĦS6+Ɇ5Iŋ5U%{b`Cȫ4~IJf8O`jb3;HY:IepQtUL/RFT˫@UHP7K pRCU<*9zb%bec6qXUf$V (o..;͖-J]Zu4pay^y+2\ȳy >gx}Ϸl.☍ $nMHYvZKvСa>Q&t~qowHC%%5 T6SJRTW-D!JN)WkzD/*+Od8ӧ_5)=8(̗P4 *J=pjX-'ݏ/({L2@w.}HZvYtS0JmUrC41l?+68YBr9t3fdNr>>.bsGkj(GJg:ط1=ޭ Wf})ǘd#A:l_4Ua~u X,z =!j=Vl%(%?ВBdv^-!P& h=+h\os"I!<d}edۘ%B@M[$YZz L۔=A)%!VӨĝ+r0lhLL7˲;b jZ>Ap`J'AUaDeV2#Cy j>@[O.`@sSn5p8ɱVH'arj;`CB9y{ZKdE[ iUTҷ|o@ .411يJ7T[`3;3Eh5 6q+n6~a^rlLkg恾Qe@1f^Q KBDA!31.@ .$^T ۾3&!U=XL|u/6gvgUg-CϦðH NTItBLRz0_O ~s_f u\>>H)s~E^{5lkG⥌'qd.N?sV@~ nt%yOeLS[7SMJN6~ yZl ݇)Z1zynNF4G;lz_}Y%[9iT!9%Õ!m@+`fucCWv`1S򀽌56(t.TZ?m|eoKx>^[w{ Mv*=eI[X4,Wcwopp_yrAG]P${ a+i#l\rIXD l/j5H4$C`O,kDAYe.YD^HKXRco1TjC4L8j/ރR+3Wq F@]Z̟֨$qk]IМWK#"XN/k ['vtqdzK;8uXdڎ_C7 %7/T~O=Id!nER޷tuA,D88/]F(쫚X-TOZ]0 &%Ygo‹΢Uh]b/2̚ s阸hɞheRd~R'rKay"%X+Hص߃c )l埖U47ao8^~0󳨶8+ʺkwG1`fB<kxN6qhG?*N VU#4zJ T|DH3լAyPHHJWُע)3w_ Ҏ 6P<48q*7Ux6d韎]%Ʌ_ى `(vEV+>p_ vRs߳ +V;GV>kinT&Aj8*[o (0ƍ} BBJjM> pNT9|rÌy8W*ɳrE><&r9eF4k3eƴmFsVZ;Y`WH5 )Lߩwƀ2( #n]#>_ҪQ 4,UNt=Ot/5BTdH+m]"+L,$8TJ!IJU1נ$[zL&H@c%f>\ q+UorA޼֤yuٴ d Idy 2vZ4[=00% ]5,̅DeS{6/SIJ"}S 1 d+ŭ=A:>MOSL=iSYp3굏51 q<_sFzddlbtNUx ;h!q,P.{FM)co{o۔z9^x3#`]Ύ\BZ1Fic\ohɸ7mb(72IL>: ?3X;Ni|c.[wZy{݃OK5N"&ZMlm4 *ӀX-%#f >>ys 2bxes[y (%і;J4kWwltX'ZN>VJKEn:i˧xúJ)00Qq<O ߧ?X_F܏~DTΧNm"NcYW~19Hϓ-CK˫$Ni[*WqMtbq@!lᓴ[T ia}sUZO {}F1ɶ<$J7"EG"*_'W$ѠLnBW@.yOH"ӶeIeY1* ..9,Xj.uےx ik]93O񕴝`CZ-y\$ V疝c*Hr%,ߨvKjyw0N;`R+V \Kyu @"#$F]ֽ^oFXXfkH[h>j{xcїL1Mk]! 8SŒӷ*7ztǥ^?,ձveAKn֛mxNbG,%>e"GsFj?$Tu#]S{MOceҩ%p} 1V7j؟{*u5-d!.ѽsŨhAU"L\?2-*G2WJA GbJ1kp4N:+o5hnz_׫OGz@zfX>!ᢪn;롸]u3#_5T,&^gy|`*Ia6~l,&xNMӲ1`>Ւ`DJsA\_Y Il:q1l<^ح>[ho+9 LNyd _&"+W^c.ӛ?Xҵ֛t<C-BfBa.UAP;G4et~2 N]WD}a$ZsSn5n#Bl}DVO.,yB叁z`aFԉ~\ O^}g? )O ،^eU㭺^WxY" ̿SСy|"^x fW=zbJ>35F8#o)4.$Cb뱈I%+nX?gs%Q.s[i H!j[[$Oy]гxߋk5$m¡zB)}C wKxVLJYCIwgFld{-Rr?uy1vwA} Kakpzۇ!, X6uҠ8b88 eYO<$e!D e!QxYT uF˴Y:ò . 0qsHYAgXbvaR5oPoqKt*sI'٧$D vUH^YU+,s$ iMVz*5JAzo񾳝@f$ֻ!XCRiZ[=Ä o$2}^I(`\{D2Cx0P2XMȹiCqqd ܇.X7yʎMRg=.;YqїDW@8W8wT DA2YsPZvImi=VATiVS@7|2"PS "R8&׬ O '|4 1;G9naXl ~} :)Lכ(Af5ڒ޵ŏωiv(e< =wß^n,丼 o ' o٘y bOV198oZU ϥ~#+&^@~8`q'}Qre@j OK z4 .ޓ'/؏ahE'afzcR+EjcQß~S_;ujT1}B#֎8DbOW;A#3 +*b]8{x}.R89=fqwӒaW Tr`z<#LC,`aJ׸$u_~."䁠~Z "AāL v$\הsAgsMU:ŭ͓>jJǟlqD$f̓,~RDq&(xC5bE~fĖ ;g-%1LShNR;KrϾב#!iRQsY!_Dd?.G)'bX dKHYe{3ju hXUq:DhFTey8U_r[Ƃ0Lm4FǴ* ߻bq8ac`J\VcQZ{QI*.ϵ++8x3E1~=Usli|8V%v]`{ _XAx8Rv;5*E ]bD{/ +y@ov 1y=o&mB5t_(#(RK[ڄ-?usy8>Bn+ux4+`_C"N"~fcNGpƱOvWf蛆v|$v__J.#W #Ma=@{;߿ˢ}sCOj{?^-!=ZNHt.XT7dlTB(eP)5L-ʩ*r}_`^)z gH`0a!ǝ꼞 )j z\eF; ͳɪTh7@y2j lzq_(ap2 Y:U1kDU2% JH[ղA,i>Y@36>Ju'P,I iC rsu|ܴCZ>])rk -_jHgĂF)A'%?{aRZ' ƖΈXV-v:Юta7ur\Xlp+pץ7@7IB%"*l &+t#OXԷUCOo߈ں-x m݂pOJ*PY1M88z K I* LQs8 .$ZaWzg{HayfSM%߯ bϋ^&6mҮ2󔾏],v lv*ɾvye017%%P[%VX@Q#.D=[û!43[>n7#f/{-o}A&+x"A^ל:Z־z%iT?Lx ␮u]_kNbT[P>{QR ;=2E!r#`A*d&՛ ^KF`UOFV<A,4;u독AOoB>aUr||TdFYi؋*=[;н?)頍wxߘiEQMhV7xqzɿ1+O{=4TIOk :T{^@5sMsQZq 6C3)3Ns_ 7?:34=8X#J׀+-Dٽ~l~|H:h\|}Tvzi6x'Og]ɜ"lgվسS>o3C#9oQs-y+N7K.i-dL,"/"t8P:2K1?f W",2%1v@񉵞B@"#AO.L V֋لv'#\^V*g57K}`٨%6X$FN&)U@$~G-Og$~TP5'{ (2"еVX,/$;M'X >e-"<ŗqپ+?{DDÆ;+ eR]O9kШϗ%7FIYH|j <_L$9 vXJaZ\u4M3Royh6R[ͣ5*<[iHNQ G`C4KOv rSI}'Pl˓AI|L.WntwoTRnΜ"1V$S†ifW(wHcRfTDꄠoL ~L>(DT6A$Ns݋k2k1iF=gUt%32`Yo4BΧjU8Y`+7-S6̨uyik07t@YK&㛜Fl:c&iY܎>޾ L="'mú[LVv<dXZ9jS5̼9;+Y%8ysO6Jsُu8 GbMih et7ـVXAt*p?"hbwQ ]" `\ zތ)ἑlbDp?6Q!#>Fb25O5!; |*DfvŜW 5G]w:r2KإRV؂ uZB%NR P-(Bu\KZ21=͞垐RW0bcۦ_nw<UdԆ̖9]CHWh`!Tu9b25`1E#meF~[&ռjI"̒v{TV839rsV>tcBzoA~MW'^ 0DIr<\l$-(2T\WE9$?SW`+P˾ w`}AoH;5 OJ/B;kõ6\g3#׏Uti%]h.Z2m9t[J'dq%={9wY1.dܿFK?\p~ d~lKAcAȳ Vމ.(dE*|ծNF*u[fZ64[LP34! l8lre

)d4 @iE4s:A 铰]f?F"?V$O0Ng[Bo @"b;KCpiz|Ǟŗ cF q VUpw#=Kz nm[Gڵ8kR |iŁ.kFm`TyծL2K[K +}quϯreAr%u<a N?gg'piEbm*al]j [~@eهiai'iA%Nfy$VB%-DLIԧ1ͼns FIңd3_XT>A&;5z?y8 UDEnEKcZ#t5k i$ ;p .;7mi C(=y";[}7cPr=m`0D4ie;_Y,!岦/tv)e~$`늑,G"C)ʎ#`ɡQY7ڔ5цᥣ#g]&F.+{«ݚ^dDŽQ}ҲBxKʹXyǞwh9w5-9:Q 'Mx܊ ޶S@v ]fP㙟3hmb2>!0skdp˗xg:櫳dɠTůܯ 7_II]Â({3bwΓBĴ5CdG-(=N`u}35xCNa{w-ceqs(Stk֔*ImĽ,9+Q-nٰo0lkb1*륄+TxS8p=< lJڛ?7RXw}H0xɣeX`9XQadXfěr@f&%hC:N8:iabQϓ͕;lȤ`B2%\C֚oQYTJ cc:3{W(Iȗ6 SXl7OW2I!:VpGu/4ޗP+ãF'`_'7q8۬G ^%dX$K.ȃVF&}U>4^Zv~H ~$ȜTDAgBCD@ebZ6Bl{(hxOuG.v~Ql|VS?CT*cO&WF6SIAQ" 볶)2'q  4}ei_ 2="In{SqB?߉]A]Ve8]`ָu\ayQt&O{}mAm(mݑ "0RЙrx lQahi-lZcZ*M+ ?ҍ)0xbXigjsVv[CKqVDշ9ԕa6E|#V󷯲$L'+lw7(g[f)F|MP_r`ӆ0?#M(Pz[%ՠkKTM;krldR5DP?$R)@N'ZVǵ^tBe}`eƜ傆`s4(˾qϙdb$VgФ%'_N2캕BHok87˘Ye%% -?m<_lZ~3 w.p/ f"k3ϺE%Ԡ˂?>=KhIo7kxICrǓ&t.҂Ɓ1P$YW1o-mf2qŀ0@͆j.p?& Hܘ'GY|: uUw@tW@O}7B6Y&*P(Z,H?b/ȁÖ}0ʸ<3lk;EKЀ*Mc!s}z 9]sg$#tmԵul D1ᶬ08 MID*B2qc.+SW& A1g* 1ne.{> k9S0-78QhCu|}}\twdJPa핐q7߃ Qf R~[o Rl{me2"9dӦ`VS/אYKLAJ7e-[Ŏ\Q>kQ8 ,4Nӷٿb+=:Dxlte?BEEDi\ :5$ ,[* ;Y`،"`.njKae;Ur/|{&}zx3tx%\yCyA-Ve_yOZ<5xeqT! ]u[|ٝN &zE--a +o\yLm [o[(hvGma,C#m;$=jKnaSx5!._e!O8}TKHQ~Mm²/s8A<@u;s`@IuST T҄M){ɤ<q ~>A"dsЎBV_/7]o\G ,t:g?`Aˢ'#u )ؖԑV5M9:)) t杽~6_?hp?fcR$Yvf*r3yrm,R|a w-1ibh~ȫ*\GS<ӱ'R) YH^3k*k8iKR똸Wxql@R ^MatOFqƠhětr&IUBRy3e5nu0ca F6{R˔  T&#??1TuoM\|Ys{ә TLŇ"#d >BP 4mW`bG|:EJ+IMο&\Rzw,ҡ fѹA ic$ <;֨YF9yi@;0/Lo\ǴPFK1*BKƘGlA 8zvy[pLK`_Gp0DU ooW=+%n=jsU=煁E [yj2۬o"-3р۫%+sUhRR{hl# D2K,>lrlf\_,!]b*Wj@D3aiA,(k=end3σxn2sRl1 X6! $ؓJ$xmeFI#A4LW Cۅw/} b aOFB:\xv[Fxqr7L^gjی*tU;*er_ˢ_H@ۼs*p+"Fx.xMQV!jTBBvꇞ_OZ\BP/*Z7C#DZ= LJˤ<#g8|v1hu?mRX^Rn='ߕI&DĩRݷ?k%9aCY+~vI|XD E D4* s?BȰ !%K*Y؇". =hsl,hTlwAtM)ƆbSŽ:` vVJ>%LOzXn;ǝQn)$Mo4V1l;PHn<`7P1e~BPhYW_1Azo]ﯸ@$rd^ǂLJrK䄧8D,$#|LA#yZ^IPyYH㘻]4ПvUQ9B`' D6^JU%2zH`~{H3ԶY3Ȁ iZ:.@`ߐR:yd{ obhQ"1%a/ W݌#L lQ)0NZEUI?8BU$LNF3W[#Aqդj~̞ՏHDJgEwt TnjRw3* vD'\𧍔]nԜFk#ZӳY}鼛8"+;%<%ps0A-1]NINn:lO}?,zP\L=!X][ 1KK9\ N01 ċJuSh5|Q6 wN/S\Qۗ&;(㒥V}:k<:/AC&ybznq9-` 1?)VH1QFx-?P,KY ɹBURڈH9W~"㥭sH?43cI&A>zUǿRHY&܈ٲYrC|Q{ Ҹ,Jz_Ivqqx1cLjt<⚣!5NгwϗQWڐ `Z"y p:Ddg᣷=%mS%.qV2ןٷWAr~!YĊ8 Zk}xQYZflw:c8b 4 5ܥ֦E$_WFu$nIK9ueX[-shw8Krly(zľ4$-xd&a 1O04%xN-o 9?l:}LUU`,ڕ$V 4n_7 NzS ]JzܽU"&՚]nX=%:C REvNSGFS+Y\&QűOZZf7$}%| ޓ*+*[K3F(/Ϫ؇q0.ɿ?b>?( !\U5$ ܩHUZyЄ$і+zU!6v; GɃӼzǐXQ%V8`*{ņؔ uR(k j#nviFz6o? ѯLM@KqJM?^xYK7XV{\Rzm{f9,%~|fxZ=ڧXunۙ]ȰO.ѣbDb-GRfK,;hh~ MJC"MeA*'rד^ %bmtWu1F}@i$"^dH|.1d !i'cwa//!\?@*d8OQ3 T{kIxqbhrg۰UY!כ `2(210mxZ)D_w2>޽['i`ez9;pXaf8y\p3ex7cWlؘW ڽݜxd A!YsM&7jq W@U6}pYv@5c-/I~`>M˫-EÑ $LjؓuTΘ Yj!ZØl2ާ{ *[%_VhCOEsgBⱤ8UGC\;#]=hchzNqu'XAy%cƭ>=ߒݲ7hL+F1  ]|玈#*9H5G)tq흃eUʛޏ@q_ 9jK KW Mb2aUJaJlk[:lϲ}'#ޣ`Mh>Vz0g'XkX$z8>? )oUNﰬ'dS`En% )d&Eky(A\ S'8+4ОA&A:mzM;ޱa㐷&=^u9q#׈Z[ƌٰlYoCف;3kJu5_TkZH bW2<˃nY۽axƱB۪2/Am l8Wȡl)M霝+ZX{'ߞ\ڮv,+ězLC(I<) tQ~J߄yy6ZWE/d&#\Az1)A?ru7ɲd_қS5H|ⶍ>X [|¦3XH>Uj&Lsͽ b>1 j68y~w![gy&%Ch`z"{ R:Gh-vh,|&Ə2?wCaoj"W-}]>hu?nZD^R,24Ftp/:IӸOxs\hҍM(NԐc.r^)B"ZH bk~pG2,S<ʤfZ|~p~a.Xhbx')V>&/AC˲ykf0J6V+R1XKC"ƑؤQOՀsJja`#]E*(]v8%8PrYf@#UenJ#FKTǸ| {Vc};4?tWaәhޑ;ɻ]!IJJӵ-7*je7yHD >/-OZuN,=ݬ %0WHN;|u.S kw9X{Mnu+Qfds~'OB.MG_L|]O!3ԧb/LO==mgϔe2qo_hz!ك-A,*Aak@ <+>_R[6@dDϕ3z gePIӃxv eDGM- lJsh?[*)ͻD>A2]:%}ab7e^2u5@MhOXË7R+\T cG,Czmn rւ e1ZK+ ""8Dɱajq:lp@ ,@r'k:sh5BpFzJ'~%2yU??$/!5b!Td8CȐ h&+~5兪edh.eiT\=vѦMJJv] Ou +~)M%􉬭8̩n4$=a 'ۛm ,SKUt"GtB,ٴ}OFlfCަZײ B jRMPʙIEv)d"EH:c֍/R?/¢pʼf,ܮpVqwiJq%EG8~Ő u)Ħ9btO՝@*;VFt\x7[.Wts/,Whh͊^zؓحꊝq2_y :[hKا?)Ij5WOQO-cR&bk7]sX^\* mdOCoT92p S^OdJ+%*_߽z"̘uT$S0tU17BZLZg8 0uѲ2h3#AUe XمƎMКjM4j G<)L pegd=*ElN2 _ʿD 5|¢S?uR/pè^G!3Q|"rNUJgݫ8 HFثmF%M¿=Қ!zrʃ3u-gߑۅ~;} MGk\,STM{AKQݽуqtmy]Wc@lvA9yJ^ LBHlU% ¿_.P:sw5И0aeQ30%j: 1J5d9Hw1\~K1 Ty\%M`>>5Twݒ<%FAJRaƗ2y8$eGc.x4iDZn(…x'Z{ufE>ƺVó[4й'kI<^!6ς>C[%oKmGhWHzWdu>Mv~(j#U+sf5 y:fu+)].xKHGu3+(2u߃:pq7a"YD1.@2H 89Rzt>.#ꧾerX@C!!սx;,_QU:)PWPFn=ֆ8ahhl.dm>6~CmC3-n^#r9Snv]QwZ7P%3`rVKCB]i-5.n (ɔ x9F/ bxNϘaR~ۤRaWgVn΍BRb9)S5u21y_\^JBAyGI,IW}BNjWeiAv9q>%PXƉvܫ9fRvvBG?i bŃl9G):9 2滊WNlؓėlbH;b%(xQa9XqYͲT͠nJ"40f{N7qGeTXT ß^Lj[Xw2WBۥݺ?N~ xcuW8'I _c`f" 0FŐl6"Hrpc53̳9'lc ?$|: Un~xe K08~(caQ7??7L;h=h~!<+7?t/*!s5Lk0DY%変:lHdJEPXu~b> MTL5 >h7@ؑ$;/iO|eS$gM;oАQlw֪G?ߪ d>xcgJ~EYk=I,J·Xg#Z-Zc@Vf굕/?ͤoy%lռPl0C(f*]Rw&Q?JBT=U t@ib), 1*D/^'=N^7w>&r{<'zmU4%I66=[/#yzi:xj 6kFWRcIf phI1nPO_>jQdʄSmuAG>:7V*{+#8YlŮS|S^ n3\xϡ''W*R׫  hZ62`1dHPGt\޹Ud? MF)FADY~fP3Vf#i^J:_ XQQcqf# /jӟ!#igVOYT2ݴb xP0Lpu~`Ɯg=v90{B=^z,TmH|l01:]R.4oPe&7Qy?dDAJq%ty6:HM¬6nne AD)^p)_0D.ǁhy#@m{nR9<h9AGO<7u@6oKh |v2prOKm}![qࠁ̤Qݠ#BXS(*)}IIz*"hؓ =7 #愧{Γy#~>Y:+yM!_I 4qq=-0+9l.p^}Z&(< zm),-ݗQIf%L l./? {m`R{ @ۃ G0/ fHGEb &0TNy)Xۙe wI-Z u&.# ءy(Js | 9NԤ kIi_Yڡ }^QNwgVG й#0)ApŲPK4{116v}Іg _xQD$? W1REtQZJ&z?ksb{w҅T `bly(xCm[0hN+V(FȆ)kkaum& ՇwT۔ g}3[KK YkY/ͪ 8#:zBpw1|qqA6vsKѾCУ(&%ViF9(̬lX_ q$#k> y걅s &xEI $О5Q/ "]iU8{="YLw]+gl |\ν5f:@(6d%Z>hQa ԛE¶'bUH[HgsJv;l~NnջR9}`y\R m%?ZGUw@^9oBpu QG18jY]bڝt:i}Aдz[䨹)鿿eoS>(,@.X#hai1"S-ce<ǘ$fRMdA,yrNgZkF$/*I&pd M_\wr8 ԛ&eVWE&D:Eb@ũ_-~C7Wa"r֔מ6 vUdl@IZ XGme 7NR9f~'U}& ͬ,RsȽF,qտN;55>B[CғdK]e$)Cxs\Ǵ^$X8.o/-$Oećpdvs2@J{7Ѝ<,xjiA{ Vl3RQGBsGĹ|X'ُ[( >>KAWAKh&,v2 HX1ӹһ0":w$CW7h_Lâ3Ǧ5=uIX?AnF2)L}8F`4M{#ћ-w,@X@|5© ;Ǫb˅FcfzkIuGԶmqC#羢U$a63IqtSJȌ rAϳނ.x,l0YV܃3Stm-˺q;`;-W'KÙv) dٴ6Q@cNJ'r~ bi2CeBBu{ < cmalBPCt_.x`}Gw' rxB<U(,[IR2W%?鬦J RF(Ųqq`8,]1b(D^2Ì*P+`3u+'S&9pSJpʌD*ړyhlWa\,i@oA t횝YaOlʻboUkVqkS%M0yjѦ&{i&kSL%@lĊ2mqb*B4u*bjQ Cheu;dXOX{o Nmpz訟ij&wM [1{L*Qyp(+ eŇԐok$ӥ])Q\1ؐ:Ye<4q"e\VJJ;pp77j\x][21krц~Nt>BxʗkV tu& %F9+y5Q o>ř&hw1h|}1XLf!Yի˼1;n0߄p6#COf]^azTIN|<٢3bVg|)u\4|u {QN^i]̣CyZ0J+\/ r“U\7Y$0#\l=OvR]9̹=A O:v5}ZU}LRlm]sJ-)Yxv` AGYK'דDX#yNnSI ~U0pu @n=G? Ќ- ƟNoC|7:LL4mw8砡+ĵRLt$8iAԊZy"&IJRMʾԏjb zn]~?Z lWpAڊm١0Tek0ZzkLtQ{ho0ec:#+HdhVqU5>)iWRSPexf\盒{;b|Cbhdd ^F+NǼp~U|Q+v;w^-.qO1ƙ[6ipPA]&qNc%uئ{U!ىkOq xf6?sq!4՝T_P3W6Q9ݟ%?:k##n!jIH~v1?[g7ȟQa8/ .;=k4vjc})a,Mazc{MU @kK_^ UXP:R+B`-FŸ/gCB-z!)hhA' ݜi'Vւ:8F_/B̹j; uf^{~MM`j!D2^hFۨJzD^uY2oPZQnz< D4Jv>^J5yR6\ oz#ŘC\V)5n)Bjb h]ݸ"Tn9 f;D|L㋹{-ݓK&e5F$59a `Qz<#HLDu-Y SEtR4رY*KbI"I|F.֓2{X[Dj7biMS^Z O7^{Z!^s޸mw1kK:Tܴҍv}Sx (lWɈim#3Wwɚ+ <?ƍQM\00LTJink+.4ΝUPqfȫ, )ssN:SUD\@pӮƽYG/)Wp|} ⯲LwAΣ@Ş5&Ynt_VVmADZz-,[%v|=Fh3?g񖽀l>:0ԥ-;!{ȇQ{&3QF2D;3rxӫ^s"]6L%ƚ iF VDy9zv*4 ؿx^! ilqplH:JwkoswDR>yrKf>$mk^- : 'us†SoC:n,6%J7A_o!vaQ>L}~1܅GZg^t|-veFjCfR46|J,DNޣyȴ#XDA-rRT k|TZ?Ey0w jmMKRu+e+vY @}`1a sh34|O"dʠCL=f8:ჵwcv  ʵWEq#(#7fEZng۸g iIv ɏ>won❰VۙSc!rR( Kl:]-D3Jnɔ3%DUʴ֤x@TnLXBKe&^Θcqko Z42C9y=e" t=֡|{<'W)Q-ns?} Fꛒ8W&*{CDmR8YS^.GcѸs9>q?SڬյWhyk~]dr,xS D\~AзMd MHǤ^#E($a 2pT.3š7v3#}*![|JF((31QClFsm 'AQ*xl˥[i`L62xrr5ui (IV%o.d1aSTlŏ2qK IX\xo$1B!'3U7X'n̔Ǫpt>ݕAvN.dcrO`g5yVѸ XJAXz/OuJ`Yau##Eޓh0 "}zo4>yq%iuJ鲦irF[rU[pOX0>[93c_؞ISα{c.Iqy1f)=`K{1]퓼$,UL6LzwTfJԻ-d™ꪅ . *:7C.{#c6^Y.pNhnـa̓^ܪĹ%#ްc.)?I1( @[Y-6Yt/$_zVF?s^>D hr(Y4IoƋK޺GպffЋE [Xֹzԡ$ ":p,D\@ȳ ؑ}?[KH2:4u9 +:WB+c*0ʨw_HV*;6%"&TyބNQ zF96t4N@+$Ry!J3zai: P3H>@&`-3<+rI.R"D؅ 5ۡۥ~NFx$)۞,gS X`{=Y2nTphge?\ѠQb\Ypl92,K XD㛫p,:`^%Af\?FəS?D}V8cR"$NG}/SdQQTvUq@ %i?EOhv}כp0IF=:1<~fض]/;$%01eL!,v F̪whMe{v"q7f*2Ά ֓:r쭌Gf21f"% qPh߳—C-`]++UB6ҋsw> 醠rN7D׻+~W=00ã_H?ϹI-H^ }J&Ľ9ΈR&4`W -(D俊mjuF_uC0PdF}+pqZ_:G=e?{iH+v!rY*P?MWpXvklSOИuyԓv^4А9Y9NXK/H9 U; J!;P¢rp t={v}gZelyÏ$]Om*,V-8Y|h",s^Pp6gǷV2T7m>?}}mZɏakK(?|C_v0pEjkFqYCWZM֖S V^:GLJϓt,t'^ML Jt 埖luR"A]g& =~M $ݝ,3~l(DGO5Pg؃Qu$=}O[d;l0`'fE  ̇Bx`Adk,'s_+ߪuoeɮהWJ:/'&17 N5(qEl i*숲-:^~GhIRX_ $jLBhW^y^_ O`0GߓJ,|à-pR@uS@ #{ONDZGhO'L{2Æ ?v~&&c$Hs|t?>[mßضm<)ڪAudpQj^PHw{܉@œQU}?Up* sj1$Ƴm$|"/ Mբ,{> `q1cn7J&,z0x{/J%pc|AN~i*ԕhTǘuC:_W;|]ile2Ps) H;TC|1qb љ9®UůC;EO7{HNy`M:71l~kF.%ՌMҌ4cdL0X/Zl5lg[[ђtq58d Cnu̸3g} 1-z[9^!&ֲ1徎R s-҈#|] m.SI'|l)Ep;|B̺kRM:lܜ%+eՏŽ i }L!j΄WN%#r)SVҼS\rW?_ƀ^ K%-bQobP@E;Y2/WDp@Ϛ;V&ft4AC\GK9]#DNX/1F޲!|1qx0Ԣ ޤ>JhN%z@ F(eޱP7ljri>vuWBˆߛ?:C!Z3<.ǣЛT+ɒSdsH0'MxDI30݇2pO|1)8Ǭד0BVӳgjmc;z~uQY(*¬T38ƥ eȬk_Dpɜ5z<b2!m+Y u'ݙl$9?q%N"~}ǕNZB' B!q=yO-C^}*C7pCpD)"O4? o#SEuj"J%.dz!S/U+ '2(}~5l wj_v?_l#:;RI%H=L_D[:l,1!'C8 O_o&%,!4<:ι^%m@=PY/DSq' BG#jlS^2ؚa`џ&fSxnQ_oJagk7uR)%jCF`'Ĭ8af:Of.6(Rpd A/4Co ݰjs@Bcgfm_KG h }C'oDLJ t֜Ty].cp$\H0\4IFk7qڸ饐%E¿`(Gxrc 0Sŧ:$G@uۺd a/;TBՐ*kRQ^k|Jt vղb@Ù6;Q0J9q ?ix<C o:mS%RMdN(OwYFdnqy^`;vߠk*Ʋzq)@dLb-=뤙5Q~Ne3}7"ncVNV eɇmTTuGkOk/ӥ)+^A2pm&FWkPlĀʖJR6ͨZ=mz$%~}{Y Hf OhVNd8rL=-U Ntu}_t֘ S傲h)\sIQ2y*ud|!xE =W%$g+A AlHWe NB?bkF֘0/.Q[lQu|P ЏSnuVwQ3iė;SS.4bk DjHC  ۗS`:3euX.z頻uy,ء@)y(:O&|cʋ(߂NJ((anc˸%IV;דPdw1U9Sѩ`ky\EWܹF^Vq#Ѷ\~'J|_aD{F@m\vpY j0M=tvV}q gzI:~ҿ:ד_ӯ?[VZv?]AbxY{L8rPY<fרBiBi-'C\^X'gghhNf`#sclFdcn{Yk:#Ϙ*\=`a_s!B%vF/Cxۼ3M#oIa't˚();YE_'LtDX-.чNcW.6UaV9mdT6k^KwA7 ȭeÆq+s\-hALM"3}$M-/^`bm7[ "͙p-s0kY8,tXǰL/ؗʛڏטbɧ<:׀d.'ȠEL*fvb:|+g\-o^a*}VH*6y;a5#$ν;oySlَ+mAFxd܎9S%Hϣ2W C/={̢&. H: p;ʖanwCksT?qѥW?H=ZsWg6SAȱV!(v2hОy:'G'_oc<,X끻mybNvu&7vؿRQy~V^CajdNO[| ℈T7e$/49/Ya:Wt]yFӫvFzf}ЩE/fw;*a3CLztDŅ/w.E7<' zA7k-[I6g94juL%r]QU]@H>L%d M4~pME4쏴'kN?E'v߱0 "[ =_ ;SlG-voٗ00_?D+˺Mn>ܕAc>L$ʅof( <$;~lKiH!$dѺ!2 h8[ՇGL/&h:F+k=8}X̧_YCg{ E1%} Y0Ns9hvo ='|- *-L B0 e7ANIb͡Saw +EXWXf=l(k"uy@5Z!8Aqz0"ϵ?s0ϧw)쟄naVDSx~ G@N*3|땚?ߪ9 ^ȭJ?!&5X^81%9<3yvY`J|X+T9ĒP!{8PJ}R[%d7!J HWF'rReWr:r/&dL2u8L3~Xg2`'%/( f^cF]z+n;jC$R6E4X(|Z-[𽚆:*pGVķZ"p/Lu?5OWjԇYes!U!#ܘm4+{ִlod^:O?U,&*WɞQUIc'Ed'Qw280X71gQ/Z^ܯit5ֆkzc,KM7{a U27؎^zqFX2 OW-S9Ј`AB/oh`UOzgRpF9k>ҡ,3v~^Rbr;tjU4VDgHUÄ v!oc./5@?UČٟ)vW<"n7 qa<{@LFoKFP!(#*)e0 $n5ꑍ^QB,"F &N1r.'swZ1Jqޘݵy?f hzKslc'of+'RUW+6xMll08G KB2*~y֖r҇u\(Սy6(hի(ty%[}'M<m 5CʈJ 7QLnOW6Dۗqc] jjtӻPY8KQR_ _Xb<) ]5U!?hq,zH;A$W,_ %r0L[~u.``1y%1avlj)'ON&\30~ _Cs1~DswTgjau#ʩTdq(k [Ɯ>',^3z_ ,}+vzJf' :Щ{8 4 MK tUF3 6%RC2F2JS*;tڢ&c@Ek~b;,\5Xv˹JU2bfƾe<=ahܱ%T=Y^].5\xѼt9Ȕ-"9ci@oOڰ"[G11&Xt&D +aVRXߤ*1tyGXq͢N3p }9D kMm56sF5 [ @I+b>4s5'ϯrHް3O:%#Db*1ʚ/g}X[xз ebaN *zZJU_md  J^Țsf:iR)l "}zlG}[1ҲZge@/ipF9oi>g~_2Oh2. 9=!fp8>~( 7Y4 e%bvRUx~}tlՕ6~ Vw;: 15,c2zyܳ`[+߱~fNY_B?.}ki z=joqIW\93?-ѻV7Yd?="_Lkf{ӵ7&xN|EHܦ4NҠHI+7]n[nw[;7]3x뢦la6BmO'NL||4m!=Be=0()ҦXi!]TgrqdIegu,? \jW׾B=%0& k$51lvdٿnĿbv!C3 {# w/NWn;!]',Bkj}-'t[rA@$=31gQ䡌I:)xTBO2 d(s60%-FCv󿫌f6BI/fg+3m jhI "^_ɻ~@mR]ڴ_¡TV(Kl)#pDvZo]m'urM9Ϫx}S1p,SQ7b32p\ݴUeۊ WC!y0~H4ELNc{y-z+-g֝kM.O1 uUQ1a5_Q.gOAa6@_J9}s9E3QGHSBkg՝[x D &;dv*߮=S?bѦ~Yx7̐_nwVnLB8O^Wn-m("vUVHfF}+p܄#6H[% ORx:qՋ OH胙2&df3nL€Gvѭ:8]6?v5u "9Li◸jFE:do?E 2e.F@UD`YyDDR +ӡ=ljAfL0xW(3[`MLHpN[4@l r-gVC*Z+ ;z^`xS6Ѩng_xWhWCa4gk/Hw3iEl[f8ֶ%1ʘ*'kn3uORӽS&RyĀɃ6 qavܲl-9ELD6c4or`ُXf.](<"_ .ӕ_PUf,].J ^dq򕔂_Xr_L:p|)fXMZ 6o})90CAٌ,)G4fyx}ԶHh< Zw1sZMJm[xNJhT4Ƀ&!L3XYF;=:f=xѸ%rBw衞饺^4栯{n/Tk\vm~N,F; ڛOm*,s9@#C}rWxIƫendNFEHj}k(VZ2s:e+/=L?ndD9fGO4F~>pm$~8S)p*}dNYǘI'콪PA?Ų F͠(1=%/P8: w-bfVgS! `%Jgg5H h-Hf ZbC|;p]Lpҩ3=|^J OI!v\,C!p" iu\ȿM=/E8HDZ$Avp=;_Si 6}/:&s0=\'V! ?׫4>\D/(Yثr$6?0ө5441tMmn|.]svyܶ V[V"(vךjxK{,d%ZD8FF6Po>=Rac:Fb#͎}h[M<߃\R,/G6v]x3D7gr@kzã5a Z>(;vMmN~eԹV !*wzy{K>I,W"R<'߹ۂw5"IJɤm!m[VB}ٱ"RyQ.!X׻E"瀌5L8 +%[/ʬUJaj$F:@oWskO[I%t5[hcn{`v9_//DxǏikg_n׃"OM$E>7x4BB 50F iTDX^[vP0_֗ ,P7=Z|Ʉ\^sy^ {lPw#UKB .1!'? ;%:TKBdjp^,R_GRbጪv<2'8ٓiUp[@Ѥ0(-# ~if4"ieZkXS@o,=ݦX1ŋ[fؑ#MJW-L%rD1Hp39@ZXZp Ή'CAvtV*x!{eL(L4kwىBFSG-#weo?}Qu`!xFvO[%Gd+ P %o5s}?/ZRUfdNqqJ{5׀Zٶ^빚2lPbU@~Fl⍁@tOe]]9㾑 .83^w}iXw{_,=L|H zn^y̾Q%f5JSGJA#بdGTc߬yfqZQ7fa_ Cwp`pW]欂f22x'4ж[<=xwL3ᢰ_4Z.G 3+gY? ҳa5}ɸ'0gM-GH3j%$(lcB x2F)y^޺\~]{J)Ý2z*DNZH89sPY@*l :tpeE8) w)1 9GpN76P//v_?Wx^}TU1Db@KpF:ͽv#N'㣌=u*L؉׉T eoju}["5qb <ofm|k:y:Mʈlfʠa%O:N|rh^݃-`I/BgglbMsy}ɘ.;|(]'a"VIt'26{@mhqKAq{>C6;nWBIʂ%c޾ nw)2镞SaXO!PƢeU%pҫJ<~Tw`ަP5刍?r gX{ #m¿DeAu݀r0s oUVԜA%}xͩ4썊z)riR}"WHYQߴmZY A|'4ϐ1LÆj>vw'*fV[0 rrp]Rix|9i`Lxv oPcM1hNLսmNyNy31%ULu󁓒ui\@ #EMw /­BVz! ZB~h0 )%Rf%*20e +;w ;IZ/-NeEuliF^7=Fgf;Is- bG!&vV%fnl@u"XDC#֌|&s_<`p1GwX|9Xʟ_53NsZфֱP[9.LG_J\2fS>(Ԝ<0@vfV9Hv<7%%٪DY  r9@6ܱ&?%[Vq]}_S>F )ùcE+aq;c#X}vW1{7S`2Drpq:尋 )a{:a~@풿ebK8i ;e֏ M*AB!b 2aa-MDTcta"i$<سcѝ}7@ؕ%N2_%uP|8fReB:z6D˛]9+mTaUՔFy+C7`_eL 8!ce|;o<:t)yjDb"(O`4bXK؊&+?(sZ(CfD$J9JB_L UG2a.{ .Ӥ{*))sm*d LMC=#s+`v_m"NIvV#+ad+L, ճV0aQ  9[ ;^ S.*"NAV?9FI9s@-?^­XlREicj^mNv8089|hvF˨:Jl$w hphZ[go>lY ՘|׽44IxL$>Ĵ@sio17:V1KơۗЬSBvcFrxFR٥5Z7CPO YG,`!MQi(/#gTahZcu'H-jPf*`dmZKD w0a bY3UG4M=$YH0菿G3/ߘ=]g2a_҅/T@~;pό^ew߯e1AG_q#.|Bcv^:r@3*w7"%/*7)yNP #bv[@ Y/b\rx|oNdNR7Ϩ+ T{4Ǝ U'?"R 0rTk6i٘w}~}*md\v N#;dzmC5/#o^K}IE',bKFiITqfyRQf vݩVxnjj'/Q4%s3R6h&̺if3)"'Fr%پ_\xX%='щdQ4f/PhJk6.1͊]Yvɱu v@iRm!*b"%B̧ÐO8A(Aù~W6|iӢ~wqRV{Qv"]o>W;?^[$W/b2v7۲\gAwh @h'KQ.佸cĜ dJqi+P3hlnTEYB0+ڝ͐qUD_~/xsWs2o|uz+P#.-;UXtk:"۰@rQϖMLRIDױ9mwQKw/g2;+$Ӑg|5bᩧ|BJhf3T4Q[UY4k|Ah79 SZùJS?"ɿ n2k8BYK姏0j_b`/0uX:W) ~+$"A"}R+sERY!i0(WO 4aoeBo}XYG]1IMo*凃za!eh^}uƯrs2ЬѲj7EU+%"SGZKJ@ɷA2,X %exP>i繘:~%Am\[g/J eE pkˎ_z*c\W8ȯʴ*ou ˍv~Ř5z>ʊSLN33u-)CᠦK $(ˌ,odin4T[,n #ʧS# 8 ѿ'z+(mO:p+V}on`XMeuOp#RT'XdFVs<>5)^ fp+O,EPd[)ǽbpwDrC^Y @a(7Ayhr[+PZ ֦ @ǫp՟{5`U)H@( 莗M=[LΥ΃r~ yE[keR 2O_`բЂn3Zvy { K'b@\TL(oi͓<{H&{Vũ&mUڷ5(30r7V+E[9!D}iy(yj-ϫΩ=LFC:j&LY6 cQ] yWrXFZ WzbioǂZʩ(WNe7G g5_DvWK [> @ MgRj\.v|j99&1%7t1,- |fm ܆}A,/o]iHW ]חf̟0uRU(?Up=IgB>&;M]6;0H; 7ɇ8ti6?uN|krwE3KQtH @?NWy!*R[lVnLTU5}i1PTʦњZܔObfEJ! ip'~VIJlƀ M_H,\| Z=TPN'ϱk4#U4q̂R:,U+q^ltK !irxx%$l(%ޠO[.D8B%[3- > /mU M+j^6r a=z$5:V8Iv/B'1jf'BX~S.S$LUFHlb\n^ =ΑY6ь2Dibmz0jRg+XBw}p$>WNmKBd؅V%t> ő%x{0}EC;_4b#4b06i\ Dr(ѓB|,GvaU6# j_PJl:I?A$F00FrW0x2P GklSdgs7& 8D<Z6&3~{ˈG]LJ~մmܒr:QH!C9G @b;L,p[ Ngt=ivEtFp ڦ=KHEk"Ñ-|>L.02nA=d|AAEL?keHy* *hmKf'2 G:ẀhK:]L@f]Ui](ƛ>o;Kcx_*1V$X<*pU_'6pJugRf4Ğ (+ M9O4瞱W.U?1y$?#ۤ=oϻLӈ\b zõR*U|}5=zZ֠sߧt\"@Y]'v8r1y.~ 62P)aI) 2\\C]rBxg>TD@%mI"+ƘJc'zDF@=.#_1L[]e`!U4YLAzaƅe UHD,Vz&ŃGC뼷l8u_|=5:YӀ۱f=@sY/k6"򝺐ĦaAvDzof d^(#|ә u0֓`M? V4HR[UKW+𾀔U!z!oMj2i{A\xޚu򀑙l\? q(j JL˼$]<ĜO<*-nC5 M\#FK4ru?2qX5۶+} /kl}DŽ2Lo:jiUpVARFItazOC(X&C7|uڽ쳮̺JjH6 CzseK!eVb\s?B H>X)~xMø%| F6G% C,?|3 w83Tv$t\P*9x~@D3t_ri}wY@~^\61K~O[[9_j9n"¬n`g̗6R(AN7.ҧ"FM 5ӛhl}.@RKPD=~=]e9ZYG%8载ZEsy%R*cݴs: ؄K#inI󖖽Y>U:%SלM.¹ǥDuTzlcfF#1NM/wQ4C~ئ2׊f $, CMX-,^{d Lj@v8majd.S O3=hdˡ^ ,xj[c?Ļű|r9,uDjg C_Y`>۟*{٪3dGōCn+rޔ.|Gͽ΂wB% ]A]afk$Q=h[ IǏ} %|Z,< :pK>DwgNOd -@HB>=ك!S c:t?x|ΫX*5$4{U"KyOQ5t3M& ) p+^~DPV>:1>zf{uAT6CAH\M]ǵ  viҘ4Q% 灺iH¶^g2Pb.pIM7`Ϩ:<"d%is+˘=, ۙ@+T |~B6g4$lųõqQd^4K`p~]lj'vxM%EۄUѕi&~wKpYߊ_eλ{nit UR ۃnTLjR3)g&(V"-5-3M!O"h@j|*ߺ_2|;`[ M@6ְ?ڰaPH4Svt@g8=0ͨl;fcĩMkldud?Ps V Ԃ{dMs+N)uQS\ uN$aF{TnШp܈G(VE A]-p0Ƶ?g|Ē9ϔ%< ?*oxa)&ݼMY'V]p GEmfjXnk^hccY)L'$wtyg~GN؞eaO |H.-"ix{3QdpcǵduR:$'ei;iŷVC ipeԌQ*푁#]EdUX7f.CÄdO<\獳(]JJ&$T^1=YgԂóA cGphtI%m+YQkFMh ʈ媇UOȯ YǶ9xv[gBݚחºFJ]a{u-r+GGpʿܛܟЂz X.IIN.Gc< kiHIJ4l'aJ}OOϭZp?<$΀pe^ =Tyz(>[@QST^ "Ё#OtwE(\,bKK'pc05@{}Ҽw"B?#Gm4M0ׂq~K熆  BJqJYpB&`x$\fA {QInSl 4D,Rd}WY85;Du|*Xb# ؟0z`GNb"T Zi~丷U>R)KIz^ y{D8jr{Ν+Z;_Q>8G0a~mR" ѹ#,J +ko;Փ u -PDUj.W:P 6d5T%ȝNLPAմV)ZG3'nJpJCñ]lIv~8gr (m=ݘ #ceo&-%Y ml—k0\D' ~ݐ4MiiqOشn7jE_YyT?r uVYxw]Il5SXoAidQ~f/乴@BiC~<94t ]>{ϣ~S+ 4Voק$-ּy: CHWE{. !~Po3V:DoX X.a0*ypsCNl +zRq3 ?K-`ި* 6BSYAiu+nTIܩ:\jübŧvFPNי=-,Y,'4$: 5hGRٻPZ2G` 0-tu;y_Bj.9DB]i>gdZ,e-'%hFRy4eEFwi3ߵ8V0C<,Ჯ?AuVq=LmF"%@!WLMeH>yQ!9;B3@H\x34$'lo`$3tG75OXOP pAVsG@AuʐF10pnjL^u#z&JI- xZVn%U.@#ݮBx2Y/s>(_{{Kg0Di9XX n#Wof'/I|4!cA >$CւG|YHk+3[%!stY4nJƛ W`"̲ ޭ3=Dk"`DHh\oojʜp :k"Q m0k0~0m#'U8`[vI,%˹U:"ݬ FBm^|q+Un]؞6Kx^\^-p<["R5Kԛ~.xx*xk@G\e׿#,Mkg5,߂*ծ`;ǁލ'<^g>/fO"6<1) _F#(f |N_(k4"E&ɪ8v٨+elya\ ۇƊo;k`>38zoZ#7| [wF <ڀ.;yu6N~Uth]`$j6u}CqĿM7+o,}R18]5g qLa|*HV<]xxS?;R yvWՇ^ dO\񛎜]<@9ep<ש+Ѵvc0_x_5 z"K1ǨvydG `OXnijDVzwsL[PYFg&#CϿ}JW)cEVȪh=3ua$fް`~]\) :"ۡd0Y=|D,xI]A6v<#H1-IJu]߲1a-ܝ< 5$rjO G- %Z w]>5[ F*~g<ʸ{#_ʐ(dʝpѦI;Q"n(sEe7 &bc3Z  :OK[LaC6^ ! #O9rK\_KVʰ` Tx06%1ME8VWFaNw>0,kai6=!7G*H\-jzA "=IB;XɅj#C60PΞj4f EH.-=, <-x7ĽZ\D.6OhIl~)>)B7e\X^dTQ8숕$^ ]zbdZ]s/ײT7N`ID_$Wqp0ºxg3K^͐6fNޱe"Wk{9åﮀ[y3i#a*OyQC勘 ےoY/cj `zՂU@o}10A? tCuUrv 4O$z*Hj! q8qJF? us0VGh%2uH+u|u)b.]qDv۸@V, 1uwj& p)L¯`?>ukB:mF~sAuǪάӉS5Xb`(F3- %У$)L0վ1ut?}Bamx`0qPąݤy]:?{ Yq!#s_LSأn7iGDŽAǀXjGʽ!v0zOo2_ ň!"56Y3/$[?I㜶kݛUZ;; ")g p1T7;? dhQCfpω%$C`Ƥ"ψ7PpfW]C$ZU~5,-k͐,|NrE{sq*kT#t-ܸ Y (wnꎣ4ߙUiJn3K`AZ:\wg 0; t&^1o Q:W'AQ"r4Łb-un},&ʡ  ԛ+='+q :k/|pcMm7@ZLmJ6Az*]Z:h=ú(&bDRe*9x2㊀OitD f* 2pYu8k:+Y1wW1]n:K>Q񣒎>Ug(qND}3)+EyamZo^$HĬC 6h3;̓!9ZuE<%g׻haunx!1kܰ@ vBpa7I䆳\`deysտ}b:"*@x3LƵpoO.fNddn(f56!Kݷ C TXMA[Bg !Y,4%(XHr %bf\aq)!; +h ˨Zg:d8)o'#Rhxjڻ1oZӹ1򐐳4ug[5Cבb[mc՘SȒ()q5 eTrQ;:ⓑݲt! H*Lpi1~C&jB!&e0Ko95>:˕uRm*^'ol1h 9XlYgN劃/p$ַn VoI {}U;><0x9mG!vFVZfkFblW-6}' Yq*^ȥS ;cUM t5%,^[BA%}h?sHK߷1fuJUMdiZRo6_쌃+QsVb mF<7 *^MX[^MXI֮?qM 'hSFժpıgtBLN$w9UR9\ V.VafbM>K6 Y.9ҩyV_Nٿ{HOld9ED(.5.SJ CWLҀG%ףC:+?#BNPtX'c_*!GG̣S1[RℨVY]) JAT75wpφE7"O]: nxa($x1؄7I 4xiFIa5ߚv-c>6L)[HEQx5120B%|7 f@!y-TJ|pkuCIz6]Sj3RAܗ1[}-"ޕFys]~╩Y|xG>„$0"bԟFvef3h1NuZB2d[|3N3; PG5p}U"9IKL[&~ט .!Hq;T(>J@1LW8 yPH?rgVHɕٹқ\4/@(>%ɏ1h.#w緸/:#9`xVki)l8J߰ڄv:ѓWR ]dը;ΙJ:3\etdg\x>g(p,k.V9q٪R9ق"U$XK<&&͗קg)HxO2j@ʝ{Ts^e,²`w)hTb^ äш` !!,[JTV^ ht#jr04 L^KkZd_RmC*g>iށLSxuOR8 <$ t~fGC *<®bvQ=BMzi'<d× .S45翴8;ZD-\jaU5e.YUY$G ^ h f1^EVmOhpHC]B9'>P(i7uY{w@"A!~})]J ')\eUK[G KC-a$z`yaāzp/:9/n?QJ {"eu.ߔ7K_)<ܣC(sGOΦZ#])q35zrd0 0t|Pnz VK6Pv컵"~;kަye~.R *Y]`r>J3<*Q:\6 1!(e>^k%e fV>-`'YL5o<Ig닀}$J S$߱bO^CRlaFr[qrE%;b}PhB<ܡM|o#Zz ȫBhNUz50roKe3G9y $۰~?<O1&_I+ cרt$5iŠJxMrjϼ:$~ IVnoTƶL9d ><֞dYD:Of` +92פMZ՟ߧ+S=P۞ّ5BA%)'ˀr! :OJiW5*K J=:pH%gJnj*%X^*R\< yt@/ d !x/>ͱЛ6o _9vhrDG)jza a1l٩ĥڑī˻>H}s0LR`!BL/t-A[:7'ط sUuvn zyڕ䆭!߻w;PcGȟrc,tiZ="B:Uf_>1b2P-YK#,fsxJ 6ϾezP8\a^6E#ud}YLC 7Hȅs-L3Er !ܵ OJͦjC4)9V7/p(F _ݘ šuVI5JVNA3%C{sZ!sT\(T}c[$IJIXx7Qfx@քwX?G_dlczOZl`-J.g2|P@xOjNƝ{8AnO3xcB 323F]?X=0zhedo!-^r#ETs;$ 2B9y{i ᣚ&QY} ]Mhzph3u3QP~^D2ּ%h6 cT_"qBlӭ, ;=e`.ZP̶nFp_IAgĎxl5qݚ0t=OfY:!(+<%%F?Իj52Aw-B`jj|`Gl$<5i*$xU˅(u*O$9"Uc$d6/|z"ʨ mo{A{0ls9R,&ÄGɩI^W}zNI\SM;s>ܕ=2mT2#D > htP Ĭ$v2 ]!<#!G'5z .kظ(6ipZhPk͎f7aEuR\A!Ug=5 E &21ipJ:͌} nvU/-hNoJ S26T >Ktwi.Gݢ߭W\pRf\9lj|3Vlr u B3ey֬{4xz|=XHhinޤ' 6E"0\0^5z- ek|),cu@qOJ4>4+ϼp}ŋC^ STyS8}z0߲Sˢ5(4~Ee0 0_GeDL<}X:q.#@$ (6Kvǯ7@RfS¨bo+:8bC23DDqZCO]:}% JkEЂG h۩XHҵ^LʵETz!K8@N;lէp 01podլ/iHk朥F 'nm_%!"K^K z@ZtbˠoazAJ3*zg* |O`ްiu.~ [b7n֮A~CcM1(6$6QnSdx' Wּ ?O1k)HqE4ʎH8D;/ajd' q6.Y2?nA4UIB)g( Ee;\;b̪8-.5YM+.^!&۹ݲD_/- fO^i]KW8Ĩ5}YQC(mxp !e˙t $OgT͑Mϝ2X\)S<?udۼPT,_PEڛ[4a;xT1/I2Rtޗ-,憌z9 [ɎY?-{"M=NG{%P6Ys8 =ªGgeԨn{Bp <ܡ(1-R{,NR*V*4[G\[*iYH:?/H0Q@t2f6Y"M}6 '-4Gn^Y9@@H?9g|tW=9/yNjxT~R]>'*&2jߒDޮrڞf|>ǺEBYz,ƺeU Գj#)'P?K+Sބ ZNGFWVNJ±Zi^_yWf欁Yڡi-qۢ_mByڊZssgr3ҘslSmvV8k26!^S\e1X9QD(vboot(=pcRکL^CJɇd1N:sVUX $d|6fP%i3"g4MdAh?)MUdյJ0Ef5'Xp6䲶-#7:NU&dި$U3&Q.ƺz13!qd鞭/n.NJ5P&-9[u M͟ٴk2Ch*f*p70_yی X@P]^ ȦLL)b҄=Kˑ7370e#n~c U!B'2lR.Ig'r>?AC t q4:}wٿ6O=<VuQ(ðyXp31}2_ZwF,=<aX;| 4;pPR+~zX A$}O6oUɰń,HI;h%oypqoʈjlJ5*nU]$%ͽڸR4^jid_I7t$ 'ؖ yI4gYe$d!1}Y_\ҫW_cKd;,UX"wF%\a;F/PH3[ Ku pU\H6W|9p9*u`4#3!vѽ__d(ا?'PPb,݁ԭO"dl/(T"-R "Ejk!9d%\b"VIup4gkдѻiOd*DkԺbu`_Goq~FBaqLb:etPwj#9ľ~GدV!RS%L^> wQ_I1G QwLJu^$C K}Ḙs$"YR<^xՆP \bXl+WU?ؘ!O5 Mm ^V0 ?Cƌ7fיD|p+UD1e*0t.6-NRAcho77^kmNoԕ(f<w>Esyގ4FnD4լb(-:BpP^mU72").ze }< F j?tkp>`/)qBgCYp3v܄8'lnHܯB?h=iНoB+owNEz#% &7묽,›XrQ#4ACANZ` &2XS=ܐ!V{;Տ-s;2$-u!<)(mԎzkwU{(8 OiWwTAഒJ/O,[?mMfF@~f]Ѿ T4"B~ fQ6#ʠ?)pl5Zě6vqô:K]q@K,O;K2-sz+5!'yH$6Ns0ulӎ+<(D>fq0{Jx$zysӥ|\^6 S axlޝV%)2 'jIǵU_F{خӒ31oh>ڋY6p%S,O \ZV5vv,o9y3V0*0(EԧRK9a긏vmZFhbWU2[` d:_qȔ|ޠL^W|9HntwQ"Vh윌LQ"(N.Ϥmo>};= f:ippAr%)8ڳؔBc/oL<ԝG>4 N7*> Z܋ fz׺Y= +11Z!w>+}$}E sm-ZF)]DŶ2;fezn ƆY<ˁgR=/V2VC}J:ܾC?\py3|^ͭ(1Mi:T*%kvUJ"ֈ$*܆VGپx#喥j벂?I5VTRQLႶD3 hD$#Gئ,,U2Y(݊tH2ϔ1y7=6>gͦFW(" CH8mȗ&[ʛ w%`w~4 m >ǹ:9 c=[M1JR" FP)mǻ>)VxX#^3>rM>}d8tEJ6乢SB4Zulb+F~,2t5.?:#̖zӭmҲ4 y&yh@e@Es@ɧ#[oD5?/TҢQcjQ{z*jl ')8D 7{m 7Ջ,&&r~ ,%wj*/Aedl+'h[z&R_9΃2G`2.54:WEy 8+fm5hpԤSۚ#*E0xY e۳Wwcw:}G Nc=3h&˰Pn鹾0P0O?\l8M͘W1W6X}#Y-XoBYmqEKޜ s YêT8f֪ ڶcj 'LAV=pu;D\l}#!E}UlЇ{T]\GM* jꙍ3Q>p㘋аWϝds-=9~;L%鮊6l8[=[xۣ85YԦ|c߿z@¦Nhg$Ӱ4yR*sҜBhd t 2A]#50T "8!#^Z41-1W' }Qv0f̧sG84"Rʆ7pҍu}s\Md#jh[LD+dRv 5e0r5j$U[I։i@qS"ʽۈ})}_P;ƽַUB2>I EnR/01!4vD!b6l@6[XMx-˭C*xeUX&g6>Ϻ7cUrE:p4*RƗh {"f()+6 M&Lb:3fm2OC&I9]a4"\ǜK 3u$jt91(iK@R*dˎ ]x4Kr<[ k0"np$,oq+vv+b]H޹|z33thMQisoolHy:#W~Y';d«JC$7lNuS4 ]uCgzcOKE{Q#سS R<؇TАxHrWZ`NC3y "odn;7m-dˊYĽSS/xO"1N[Oi\чr>B;0l@,zhbpF6h#Y@U`yyq6g=0Uk}z <*uV{ce SN},|"fϻCgymnr@  JYQ)(.Oh*HHgyӔh})5Kabzh}޺U}wAyAVخ zx MS 9¼rU[ 6&4.zXx %*2<(Tu =lyXl$& ؈MCci88@2(P6W"`]aM@nOmXDmꃍ!,ͅGȦj6NZh4gWCF06jvY+3.ql8:ccV R!ܰx#iq&$sWdQ6Kh,lpkn29+0,Z3[|ɗjs[UgʺJ^#+ob{!r<APi r^i%C缻,Af%GDTg^_"Rl={PR=Huep#2zC0ů(ޑ)lTtk5X;f?,[c  %GSGCS!y;˄`zᦿpԹ?nmՔmgpm/  )_(Hr*d8`^| 9 ]?tVhE%Rظ@b4%y#k ̛f|STN UgFr=urZL[J^@'l[tŭtEN4QҦi8y:rDyP\.*.[j}/1% ؀AKHK3[ |!ǢU=$ua63AX{E1T#5xg|PLp`T/gJ u% uJ[!S;x5Yzs+[\ q`Gm:0|a8/Fh\?O[&d(rۺO9` ) )Pq/evLYHccYRU@TgmCwlc̑V<iw2M޸ kPPb6Bcq?=?-2Gnqwm$x0շ&u8 LLEP3@^&'CoIuiA>QPΠaW(JF8T+@g^tlkGf@{1NaK_R"*- {J%HOG-tY}YxоH[Ch1+^=%!ko3$|$&硔Ezv)-B=?{]JϤte@arz0ɉK(fLGGg͂˯8S_C-uh{8Cuj|.eXi@MHGV!:.e `0 @5Q K1R·(b'_7Ix^5[vHoTq,o~;s M4)Kzjp 6Sw>inINFOfrԆSE!rGl?-fVɋb)qRHF07e*ǙIVb,S!lm4H<;e&8( kJhDpNg(\j:H1u>nbX1L!XQNPJ] ; aR;!$=*7;& l4u}! 6)r-نR"0h9ÈE~ѷɎ$.jPe6Y^S *[_z ".b ~"NQV%%G]@dN^grDMCL/C *I"=Px9NDŽ.^p9Cr:`1:c"(RPCh.geox[-='nJ.Bp0w:%dI*^.h;vCq3l?0D2L@y i>AMoW+i&IƺFBjG$5{Vַ݀Evre)k\,sI ڼ7qq2OQݖ|8 z '[|P£̕QSc'0RZxNr.ܺ sсSjKb\[Оo#zFi~aLK.Q36<*:gƴf"ȑ7% !OyݰjxP?J2n#ō[[vPབྷFLyǠntf9ս㻷}z Pg]e5 RoLJGE zfw ,y&w\WKije >m_?̪}Bּ|.Qhtb=HtV}V3[4xuИH iN&Iq_eg3aF0 ΏA "3rE U$W?~b yM(AäA_5+GwzlP`Fe(.&m֠/F^m$v?݀rϺ,'v~^L5:Ss7[ .4H/XfbRi8PYpY'5n)rñD+.ϙl \P %D*򍣆J.?/6/$^E3A K- Ȏ]=>s__^=Ϗ y0\A ]I.&>|uʳ.zҋCO,%':/|:I{ӽ㏤\iU3h{'쁻E$'vv[HvnIOBd$t:yl9$߬5;2pEٙ%f{If8m&u*aE(#F\=.[#4k'#@3l?>TB;~4gϊx}MHjên^lJ6s>C e뼬b㍯̆J@L 8o7mbZߗ݉?A]Q HgȊ}@${u774y9"|ځ2-gY]ەݱKB V\5kS` /uNYxsڏݎ0@r1=r]J%xBXfVƅ\|l3o̓a'VYe~O]$-np=Dt?Ov}J.t@őaGVg^89k]B HP()yk'ʓ Ѹ !r*{1g]ʟi!,l(= @ѭIqv3%~t)|(j wW6:tn-;O_I^{c̺rsJòIi1@ Cv4 iſ[ZgsiT}$y|ì>R_o S["+sIҒτy_<(LOnP]R2 Uیx}(?:qꮓhyhy"^#a&@ mB\\H:"fy-P,=]WNoLV؟tR2]9"~."μG=9g#Xz0ajOcWm'xHcyR)oQJ,ꮺ7@0uJ0Cm\ԙwUJ jJx$ǜK,`ǂ |*> ߌ핐JBHpV~#@D!JiV,V 2n5=rF<;\OAڹ5aqN0.3qs}u3H&[k;((ءpdoD!mmrA5ZThR(= _LSc.4:_<С$K޷ m^ш3v6D?\`.)CK.ECUVJ$bɢߤ9uAR Mb R7+ک(M7 G'{xc} u_,[䝥K Z +Jʓ8ztxؖK+Um:)=sWcwKa/y 03e}#˅wӬE+2CtWp cz*'Rua[Jc މGNڷsJ<4L3 옊0%jfZX&9_tsp=n$яgQT,y+v2ATd~g;#M0ZQĶhJӒ ) @tS*ҿ;z;釱mEMQ!F:_{t:5vk}D~ fD9x аHUp?p][61Ip>@ gQuaDqB_/td)[x+ntt[:[W6LeIT@~U0Έ%h=|Yuߕ4f|S0%doyhpf.E*^.w]I#'EuWWb;qt7 d>'=As:/iH ސ*&2+B85$a$VVwG.[KP0':srMٝ6oD DQ[intxBܱ} E|&TPIӮ.V4hypPE(E[*OܒVx;Z9;}tD+tG[ۇRag Uvv%"%eb 9+_zu ?׈2 дx%x P%wRS@]9 Z5ٶ̗PCPJн^̶-\|xp3`"ڨn&|7(?NB8)h޷؇$,٬4HHE-Q dlsXw1%G;g K([w: %: Hn0ܘ㢫P 塯I!X3޽!BAƩEօ_,**W3)T^k7M;.[po (t,/±`/kKjG)i'f).}3yA#Vj/Ύ{sdD]D>aƠi%\nMC*W~5{)8ZoXx$ rJ<{\jV鉰0]`clY ෎RaYF| /rGu=g02@3H[fqtja"c[|e#JIhAhwcctrStSS46Ǵ cL^cL %zk{9p Ѡ# >2 O2Vl&V) z~U\\c˱E7{r"skl84Oo8 O;fyXߺX,oH4c 6[D(܃ lc.7Ш -|i5/u_rzrEzDxM_3ۇPގ"obYAȧ i-B'㟷'(`(iEwG~AfH6ʛ)P jhKC{i_[^gD1ry΋jrRrd66A)CKe$Viry0ϞJ,i@5( 1$FuFӒ+˭"I6${H!"{\QwU5l}OͶ0@іR檓գ,h@qR{oƢ~ԹUCpRzܼk6zF'(#Ӟ1"YCszOT jZ8u.GjgW*L ? ٥*Gla|3J}MOrM wi"fα2'`vvL+7WD'x2:ʺ\抉3cyI<'D.wu7yPՋj:uL5Bv OL/\D@4BZj $,@7EUd1 1p\ i7>,ùN^ cu ʜ}mTmD2Ո$Rf7985+\o8L$L.96QaR%%@vϣ/Se^^_{_n},gX!Ji|Xp2JH ŝF6n{W9vH9>P2eQ=%+zgnG%(o2mʥ$LqBFQWfa#0Q5aVd$*hRc$fy\8wЀi0 "o| ݗpsvt, {|'X`EAbeբ;9wNMiA;5>vZ$K|b?|њ;516+r>A}is"'$e}DEpx/"NbTPį}K7k q;,I&[1H5wl! IMњ"uK7 uAGՃfaZGÙ4aQGӃ )GY)OYݤrYD4Dɍ?i}`]\=0b}-؜K9.>rxpJ. 88ɉ5s{I) Em5ol*1UL%fRyW׹~a ,kDa2w`!)zjtzӊ_3{L#LjE ~N KsM Y=n,+"RDž&#! }Y"-z'B0q}aFCvgmf3]?f)k 6c 'ub/cZ"cVE)LjS{ oW {PVj^~ҀĚ~_uϲiR7p# w}wI)w"')g؝Swf%@& M _v;8u_Jы&w.JbW/ -\fO= u|MOrnPcF="S`VKJ5R|r\><52 w<d~r2ŕ]3FCQJ f)=;w{5Sj6 k.ۆ2:_e1 :.+E| 7.V9wwZJፇ+p@~kS!iWt[ 1$ds7)*]Ms|bm*Hzq;,^sH{g(-Ɇ9I"SEH>0m͍ 45):}N$MN3;FKq>/0t)ۧS7="r扩ڄ-t8͛EHN;1E~O(<}Dqe]~_C$1>xcnŘx.7Rsz/#FX&S}ˠfWn.cA6*&uu3ZPoFadsk2B UVofK ] -@Ԇs+HNf"AQKֵgf-z$Dҋ)k?B"%%:d"XΛܽ)B[8EwLH80 &f CF"A$箿>=]HUNEhf6J`pS~J{09W0 jϚVFʳ fI%2.\!qZSp/l=Ct2GwaI:L/C (>D,cSv[$IcGάMxU.ل<1q'L7r,.;j|`lGȃnF hDW$>y@, o2 ]øf/3^vH+7 p9 ƖNWk)ߛ;1'{1K7M(#bк"vҤiަ^eHG7`Aĝ5eT2{uSʠ\@A6tT p3K$Z>L_-3%;KH%!TzKŗR4`o3~I \(oy\`{+^'JuO'Q#r0׭Xso \ =3tt"k,"jǰ Y96 YRtTr鋚j7}"ZB ŠsjJXu 6hm W2kpٿ7_6؂I NFMuQY-^s#J_aQh9d$:q{5²fN{oNM\:H,Zr57NETiT5Vh |8`#%nY! h/凱 j.CY% 3x`Z{.}5GFt TL!a, l^fRdLߣxRӜQXEkWow)`.0qD!MMS_rxm"lZ'@(=%NDžX S6)޾@ ڍp*zF}<A#4T?)7UE*yOZ1GH$ºOhj}!dT2\Z"0H83!]^f?I刢" 4+0ݿϱ̄o4-]{5qJ]UPG,RပŽ;©t9+'`wZm9&|~>1'wAM-I[u K˭?* W83b?Eƻ12xYS3Me!@`yaU$<=(T$?-~cUoׂC,҇|I7Jt95rVR q!} niˡmXJ8ũ&]mF tf=v, XS]0P;Ux,Oe gqXF$?d=|#$GA?XФn1>t+p;u|xq5ʹ:gvPYn﫧wtO-ZZu91ŻΔ:mk{%}j`%Z`Ti"pyEp\]iqu _PASjOV]1^f-SɁDpzwە4EW|p=J}-uQ:ڍz|z*e ەl֦@Yūc0nϽiڅ0Ҋ&)#A;zwD|_[15й߹9fC[+:CJByOrd%vH;yOE H[}s=Vgo.0)!#«r=y,eO&4-8y+p&i%4et;:Ã[&(_-v:=%l(͉:,߀1Ś#mh;zwUw DH5l?HX8 KM)<{yʰ`~"& [q$K9tohN ۡ5}lE;lCl=*WOQ 'On`ac1X\2ϧiX|b|Z Ca*0%;><ֈ&VPmip>:FJw v?f՚_Qߧn-&=2wq4RE8Ԛ|< 5"_M3aRvH;1|@1ɞpq4F°qր35"wRhlfbU[V/0Ku 4  5{+ozĴSܟ,F53AsWU[:ݣoAupF`R(I9=Ҙ $2yЬSj 9kfo6C]8{pؕR&gVx1sD19pqt} p0"5h[g^\"hD7 Aa;newh,9r 9c&so .]0sZL.j#NKjRtcwCvapvDA-|װJ7DVTֆFU;],GapݻAϚo0jm{ OP-ls;BJptЮ^PؗJ| ,&G%٥0iKFh_}cx(is$mdըmw B8S鬺j7\c*(D$t6}E:x8ϭbK~6_tHA†poVsQuP6mD<풓 =C4fLѹns` D#HD$4^ ܳ+duQ߳,"}Gd2Ӣ&ǹuXOD`MlZOʒ/h@.%0@j%^2,|ӗOv%d,Hb,(4A#Y/@ t %6Uǎ6YN 0'NJڨRB62mJ,ܞʜ3u^UI'6uKUߕ7cvM-zs`LwTW.ea sې);CSps%ѻL v`[<#CAr%$fV,;rVSXcz^Zn5fq- ˡ*d6緦DTyEE$ucƛ &-ٻ.-O6lFc%UܦF|˾KEnƐ0??x*~=9%:L-yii|# G \4q ^IbG%}6o$s4,f|xi(?Wz3DWa(PGbbWyM fAN'?JG(N} }՘edh] >ʕU] ^ QLii;u6;]M4d>Қ[,٪Um^w?CG7~H1f-0_wnŘ 8qB2p "j<.ɥK#7 EP@5(2 T+sAigh,tl4+2''Aiv9M~ 5?uWl=N~¬ 43-.\.l)ǀH_O6;%;T˝y QۿI.R IХ/z>tכamX3ՏqJg 'SbaqK\ 0|T6&@vN;YcwNXYlZ?35[Y@ EMa+d;̙;c'rkv@{ "$FyiVBZyRFWZ*z&0k5gBdIqlu$jzlh,҆eJ4.˯H ܞi1и薡z:ڒJ uVkzTC uֿxY! o~/ >cϊHF9:vO  S#xjsGR`p0kqVG B v>≙}NrvcFۺIɵAQ(j $=M-]X1,e}t U"Ր~ 70тE(jV>1@DrCyrz9৫HRp}9X kjL^ kR?gP?r'`K^N{Cdk9-Ε]saS0l7VKqBǻk#ol+(D)d9} O/z2~fg^k n'ȁEڛ)MomgozU.W"UDebFބ)h`4:TL]c[p'.(mF%'akaPZ2p/leQ}DRw=&cO@`y D6@REzfʲ:Qx|P j~GE|,ZU ?ȉn#dgNq:BwD_uiXũ&Ka g ?b[N(rf'ZpU^6Ajs +_$[jHx(pK ?ZW06W LDivF-;r) b d ^~ n=`p R^;=y&~WwFYp0N`1l3JD?ExWG=7J?) C]&ztnI=n !T Nj'lBU-˸klؐ3SF⩨`{ﻥpksFL3Gfis ы1")?mEK+k}p Z6%%E>?@'m$ }`YZoŕe ͢zo/h|ܭn|^li)DG,fA;^O ј)sjQerYպ=W7*6%guH⣁cr3sE)(xorՖD q/P=rLCЬHZ=p$Ou~OSߌy(N-,$$w⻊cB%+CxgFQXKŨ!&$H6Vg`'gKˍfJ9mo!I٨h8Ivd=EW13JO/ tV ?GF Pm:UWãx3Eat8S"̓ ݆l@WH,Z[-SqkQFEjJ~rXASfuWcvE$eB5[rFK[HK{.Qhh ﶟbs: 3hn#BX$~}؇(_jg/}|M}l2lr'B npLdᛃܴxhxaa`n 1&T&O]_DX{6g# oL3v!f4`]7غ}%!~âɾcmkW_;!tтk4(fژ2]c4?wWPEgMg42x(QO;h[|\o |w{-'ܖ gOOO/~وpnMGzd[4 8c7LO+=]Vj}+%Zps92a/! ³ZSorwLPfec,b;$l?GPY ]* ^B6"OuQs(+ o@6V"[dYumtqV'R(m͐cF+:#.ҦĎq ҫ=Xl=I/\w\6))-riZA X( !z4/-7%cJD:"xVE-,VVQ.jO2 83%ګ_v ޾V̂lȝ׌F)A^o Ո?P`B髯&}rH?R $E[XiÃwzjP'SrN-֥ ?eE=c敞ЙxWKVeN.^"Z*n>V.#.3|I^pB)wZV K؝kq fqoj)'Jx=T\1H&9( FFf1e %VhG^LWc#|cm!!j2-qDK@r:7lZ=@Lb8HO=:7 9Q>ilc m`b/a`=Lg.$IoH?_+%Dg/9BT)gw|~:YG͔nj2CʼnߡsH/9Lal@Hbf,~.@qu-#ayw>M/LE 2;J>ϙ#u`=UJNg,a z#D#&ZyIKFZ7~GRQ5u VUព2[AӣAE7 BES?Ƕ} 539)L[@p((pD^zVЋZw}9ŴdK MrEǙ5[f1D UeAEg,{7 w @k~zo^[Hy=qDT\NT~b|bxM agt9olPtMZ4>%,`1-vdڋ&vUN4zE㞂\zUyMKZ'UQojş~Y#/(U&SN5NN9a tVCfk64 >0jHjl[(s=身W4F ;ŷNd,JYy/Mgh^ghYe*^1|mRӈ\ KT] YW<(1hx]xz O͘ lcGxJs;Γ@8r<6U=Dr]Kwg^+ꎕmd4ͤH56/fEw@!.Oz{/*pvQ$$g%3'նݓny6&{&m;'[a:c Ӵ;NйF&1֒"M#ABYdCKA6sc>x>kSKym(aұ +"}{:`*++Su׀lnA^- UW?/y6A}Lȶl@DoWxMگ,)SsL/T~q 'jC%W)T;$sM Kv؀BCTҷ0Zߚ_3¤ϗh5v3[|t?;}+)#ä:i"uܟ|\NO [ylCj:jpfhfg".ܨZf:oDlڿe-űpZ(m]8N7Qw P!=PT_D3|?/$3alcWeߔfl4Uf!-n.y.j Eu hsB=ڹ}[h#Z!=ew:᥈ÞLoFĠ5CE}$Ƈ%ĭa-`ĬYX8ܺJީ:h#) Ɏ <jDN/qݤO&7> 31jS vs@Ț7H/x/]t1qs+=ƕ֯?U}ҋN v c !6ù ĺ@9Vj`U;&*P_;(S$(*r ,"@F7K~(8E5 } 4ė&sΔ_%lyw"=…KKf7i=šxi;a>>ФT4 nxֳZ8\ OavwX/pz 'g:аCٳ͉&L[8㲽hP Fg&ks]AFgNaۉov (::#?{l,O~"B';ٔex0 +lɞ{vҙ_H_/*}8 73Rf(InrV  h^H^/ۏ䌲.I_Ɓ0_0("w1bX.( s, M_džPWo>kGKe[lT ZP@d ÷)mM,M|Utf MpD ِ2hcΟr@ZM~7:ͯP#iDE㛑PR-WTLXz[3 DDujN& QKjDj }Q_Y]P*gEˍ> xHngeck*5D2?2)euQD;خzgdR]qa>NXl.lڥ{ Mi32V.&f "sԜ R-߄ts -Ϛ䇚{]96eMe̳ ͢U_[QZ> [?cK*v\=^!f6cejYt#j_U'<@u|"x&?+~w\>>c?OM{C!rlSw:RVr/4Լ/Aލeܣ,"*x3K˴H&-'.meͦ`µJ'RBq$WMsT*: :0話loIѬULi劁!C'];iqÑ[Y˒'=.a,^t?"`W™ĝM۰9ߞJE8 VsCqY{AB^ 3c%=$hV,dT& zY{y\d=4mg8 ~M,CW;7=m\ÆM~*FƓ{tYa u7j5a&W=TnHIud*XOmt'W;wWǠ5+3tL4e.IFm׫aQcR4 ҩN#0w [7;ms99k*V>y C(ۿxt#X ^Xh$]k' JTdК2}tY"} 0 siD4TNi1]Vӯ@5C$L]~`!a>&`oS.9h<``1!J9tvv άFdpa$hȣcfrbVS$ Tr%̳ʣPRnBbnEA9$htV7#!0X ]L[dZI+2yp4E)?L" B; 8g 2Iઋ"?\EiXC}mkbf=+?JBv v2iiȩR:~A Ad % ԪC0YpOVgϡd ߅s{IYR  ;:&_q [ed Q:9ȼ=ȉ.C}|"g}+,^BQ_?:lC͚XfN"NY';NJGbTgs5 ۼgj#&귕94PhVPH:$HNmY0ay!7z,*&15"FރJbxJ;9)B+D8k g۝0IP86vB-&2T^eEwVp -{Y:ȣ NklvXN|@W^|ˮVZaY5W@V &"Kl @<0 žx>Kj /Hk5-Tb*7/e &ZJdp #@Bm~MUبob^lYTB3,voK=p1{[}&֦[BHk=J̶kG߆=B2x+^]aw{@qѹˊ9J7UdJ}83#=P0 Wk`_ ma;;8HL4.(Q-W17ۉ!3fE7>,՞eCJ^5U6jK+6w\ XE@{(00qET@ X<7XT'o@Eg_TCQN8e1(e\^b8Ŭݜ, '׀;)L9x1 yjټ6ҭ]MWKe$A$3RJ~{K6Mܔ g{RNƒp"e`B7aW= F#t/u&25H!۰]tG͝?^& ?kԓݻ. n_n@tc@1Sb~n <DρlOcw@Vr&ۺ=QAŜpΪ$PWoji! BťWtRx?#OǑrb\Ճ0q@ q@d~@;-89*\"r 8N(QbM= _M*Ëe [#MgR8"ķʊ}ӵV= I Uy?hTPNV7VeZTg>r[&2M43G?xJ ,|S7lH6~EOїܟZp G&ΡVN8gsjYU0BF)}ǘ9 bx #yx@ؘhqNl62\ 3qސZΜ?+" N{^Iu5t+`f8ą\RWUGpHڈ>a-ÀB' ).J"D*Q'eȥ/ ȳsQiղhՆ#)&kDX/Q|̋n"(QOtSn?t*ĔzdNGpsGAe]Ssu r޳k=֣(9ߎe_a\X|wjϡ(1p-'Y} OhPr8 9>-<(KVEgD)b*< Oؘ`תG؏ .bE4ƿZ/t#·qAj' ^/N族w pJ( f5c]FOťdɟ%mu*à4\D<2/躼ΣA~{pCSeb@CBw}/\+N. k}jrB@u?<`X˓f@ Ni)ʗSBXt/lxH"^`C Q ;d8$V}7\-z썢߹5p2f O['j|m9RCLq@)Fz&BY\qbU&2m Wg|#Gh')|=xc\o&:,u,^Va)N^s+l[Jyv:aO12@ul=tIaob.jgleTu~Yμv ;5J~2*mu-7.JW#ۢY{ n  c`>hRF3Kgh)WH 7* 77Fbn_i5BBELRuIXXQ0Zɋ"T-^>"<õY,(4ӈ?I:Mw.BQ]FZU%tgȹ -qv/*tiu~oC-|onޤR&vFc TP{pV/q E$/Oo5ON6DBm䔿҄\siXD 5lP؀:H . MɵgG=&k^FCHMgo=0V?#Ij!FыQ?K&'D.>`L òll|X=h&Χ`?B2+Ms@Up6[ݞ9rƎdJI_ o9m-|G2AO0B9$s׫Z`)TshM~7VNT37c5pj=W^ ?I;M ք2V "fgRB!ՕJR;61>ޥ'֥Kd$>~9mu VmP yx\n_"#BGqa惜ɈԳY46t(,sf_Ac>V]^ \ltÍ|Z(w+V<@W8㼂%_>%Wݵ^+lSiA< KܐH u׹WbL :>&!xkU#: '') ?gz2cUn.[ɲ`vWhҳThF@觳v#!&Go+5U?{)Q@KPۨ OΦ`ZpT9תwmuj/ Dm^ėPpjDO&)d\&oަȔ/Ǫz^~"Չ^Sv[~nkǖԏ%ΉuWڣIۮ -SK15?檨7M%ӢnS{^)_Q`4 I٤:0pc } yLVwaRfh|`67ڳ'*[:sνّ`3h:>kRM*8/6h~w 7Y&Q-A;e2-c\Ub<הFo5QHɎj5(X'c:2_2 ϋ49\IYpHkO'b/3H'?/Hf\O\:# ޙK"w<3@B =M NK:_Bf@m^F:ﾩ#Sɢt"xpB^$>Ei~-,h.~浶ӢOYbKz .MFM.žYYU]9^Woo>#up|Jr*V>!8L-o f 0{^i?&LNG8\,PyQ )syiFJK۲9/Ȼ\#n#襌 @vX?πtH̙(⟖($u"<@Fzќ˦@lK۝Y]#wIWܭhMnm+(y6ǖ`u"A%.2{RmGt@QcoPф;{qij qa3@AW^1 8Ѐj֭FcO>ң?T0V>YT4馡kn A֑:A FN1z3hoq㊓Sӥ&ޚA;Pʞ1p. %ѩ8ծ˺Syz)vUnk)_e7/wu" ΕR~SZpBقL1EB(YnH^}Սm>-DcwP7;:W#F`l:G8Įwʝ-42& rzcdW0H+'mοA*ĀB\Kr0Gou&AjbvDNi~ٖ@$koܳVQM'"?,*D~z'\A[)Y 1vFvHFJY|#↹a );:٬U*Ҍg*M_k~27 g3P+jJCJ%]G".yE'5F&{L]*)1햽O9wTS.9DS'!3RDm.I+d &Z"sA?oV K!/ -@= z.~..Lw/mAYXD>׊DF+OJGd5Svh- EB<uNL4 m{G d,8-@zyfQ4t}AlE,e*Ր-E<\N I .ZGtblQ4]`* ޷ͼEX2}\ǽx%(V8MR]W_ͱGmEәsd]Kft,MDv`<}tvc@UAO=]Zq͓]-$ul!{tu2YsIDl "ZWSی! xx=6pNFC#x *Hϟ04˸c A8h>G0@")&Obv2+8X>Ѯh+_5]R $ȱ@Nny-5S3~h`|S ol);:#5ܘ e|GU=kZZyϑ)[F :$'dab]R%vDqMKOeBuzccx &(*[u{K*IH]}VNP-p[ARE騁Se᭮] ?CL>6^pLA>"޸WDGXL |8ͳ2δ&A|zΕMzJNvm8֜ž+Oer@wNS̭QJoz}YY:Cx2B-q:GiZtyV*MGM'Qf˨i ˯젠0ҏ.#QMǔ,21Jn^(Jip&C8ဟ-;8bL:M5phEpePwuFoθVo듪pJQlR [3` ܮTvh@)?I y`GyA`@ koqHu;YlaĢܽ8i@& !@,rBy|[{t;~I2P=H9~B%NLC^&/~E8GXs٩޹*A=/pZѿ= >.&wpd50 m hUݽID|ȝàinҷ7!SM(\4FU_$_9HdMEvr,ǐ"Q=mMU1&C*nU{?a86>im|춷DMVLE P$oB`O `f w@xa CE*[SeV*1r>Nv,cU̗ ?;AZV%=y;6't95Oxh%w\IՄBE)i.08Ú~T$f@{(mx\ռxDYz~ZqXH+@;M:"(.iH0C+ ij/k{?o,1]gr*6QU;LDh>IenFoAvuw9T Ȯ }=W-,#qA k>mjpȼ<)A]~tޅFhjd sp+ -& X4j!d>[񃪃qCia_ĥ:uE׍Ս9{hKL֮DK؄۲dVgR$k=e&`2@F<N3kǜ奜FsZ+Ğ )+2wq.02wDi~A?b冴8"I6{oέL>0`~)1IRk,9x]? q$fezF {= 瑷mb[j4^9msvk2h,iW$<"AT! 2zt䑚2 ]tS Pqد ar3:Y a?ϟtGb()aC[Gj{k9皞;Uny}iG኏6GVϯ:7j ݌s1yG\`%P4:#om7fQBC<\z(h@v"̄Yy6\kV'+T%veIw^4v.9!}6cs*A̙~JQȰTdB?`ީ$nb fE4EV}C29ܞҘ܁cM EɱS# #W^'ndUT2B} K5{\r67"\zaـ'6lD4Rlt[oma{E>v 샡z!TV$X&@pO'fo{H9 YFZ52vI\RC<œf0l%3 `~E a_*[wyޠV t<H`˿`SWᭆ[#eXȝrgir&xs!DN꒤8d~}?P IN%7 ۀ> Hѫ ͇/ESSeF&P|MFsFmKLJyRO ;C༾"ZVELd#ZQUBq2a}K6#%)͝~"uQK%e|$f;wvH>XiffEa"c0aX0: ۓC(:^wR.Ng{( +jGv_fHPg,sp]K$*`dyјsU ]|.#Em&nc*Ϙ2T%ߩ3A=# &$4# .ah|2Ȫ= GNJ+uئqNJŃmKWId`mjo^`@ZIajXO鐸+ 4- ZxF/P h"L-iʪ `O"nN7gȨ7L8q4mqmx[]t"9UJ f>.FYR#zW'Ib8x BT#%M2'qb kvPLddYP 8iyg + C6YeAbH{w'NJ?1/]^_k'x T7H]{ZelFиto(rg 1Mvm%G $vqv#ؑ )}!tD-<ӛPy5RcCcl[|L"m$2ڹǥ0nAO<Trw*G^!ҘHQ3]a`F9N2@:1 zQld]ὣ~Zb2LgtS8-2^/[gRJ_^{ ;nv:mＳb]mzjќy\ k}n|;ȼګt2z^P:_X 6BG!g\7T80{^}Q+tj&h-y}$*fwVq pYFQXGgKSٻ2;"up9y&Ur #m-6GR# Ru&?8Aۨ?4/2 T8yRA]bj&:7vغr\Wq x2R?R3. _r0хۣe{뼇ilB*$劭f7}ah82ˎeh!V:4eBv'VU_qM}/jj撹ل#B?EÍInڠ!J5[`!qa> |tıw`n=kLj]Kc]]}2S d&^Ҵ:Y^v}ld[sѦHMdu&Ї^Wd<D2"Bň3bDəJ|(f d;RTz%Iq`@^ZP!K1 m m Utuw8w %=2 J!8,:uǡ}nV>#8f~?݆:KcWUXz-c#١ =Je=ҥꗊc^40gߚ-mm:.V 4HVZۊTWYlE-1 <-mҾ-"y-g#rR+ݶx^ƒAdz뤈(1ie6ղ^%ˀE7{@f"{'dSo@VG,_٩41$ZJʣª-* ;2&lռ!_c4k+dZ4 2Y N T9L,VeQV+~=_XX >fΗoiVި,^5ͅ}D]l@^4DW$pJtv9Jc;ZX'߁E΍@ӓJ\_zB<קz YugZ|i? fx8mb[vb҉1/F0&+w\qCyzɡa[w ,̝:\"{ C]nAK1Jd5*4著o_gY!-ȪƟY2:En֝!_TmVgF@rPgBbYcTŝ-ڔBBi)O O}Pt8@VEW9unH5o PmgB&B; QpWWwQ C Ӗd- u:= 5ٹЋmfS"S`_՝>v$o S|ʐ@X{O '.^!Vk]T%ΊVqF Il>_ƬCdχxD'| f Q:4U3,&mYƛߦKݶ(afYl%ֲKC$8L+fsҿ[{^/G ,de8+{wpq Lkz9g(BöIH ^Gry+n ̋0Fsw^}!je:~pJN*d75,(E0Κd3ո+|'T;5&JV1b(I^&,i< Ark*+0]"@ 75}gY 4 O@ ʟMXIwmb)I+#eG BG8-pki[ -vIx_lOԘGmHI&Ej&t>V@gٷ `G'lh).lVLj@DTMM}ku6QtEP IiK: -ژ\R:l.kݢ(~Z)Q)*fWT{Fs476ӾS&t.Ţ7w1c.:Xl[Ԭر$c9euO p7gPa.Vpo(p5{h>b(4n* 8H)h'֔< uT~4\ ZapTrOds91ӉUm\rK3cJ|xĿbtb߶dvQhȉ0aMxdHb?YȞ|# E_zߜ<4&~2HJwgyb-hyÒoq:)܄B>ө8A<´.X0҄|Vk ai"P W鰟WK0Kp4ʲ&9D+T'u9uE`h#z#1mYEEcoZZ`zx¸hôÌx,]P94KC^(1(Ǘ97@`yiei4 z\}>@GM1EC-! >haܫSBf&?hP`R :LZDžI\}@ɓn] ;+G4CD6n}罼vO! SeGCYv_Ayy>˾,[g~g[JGC[55 vE*ҚzDo?U]hd{dQ`{T83:h%V7&c(!󐁀@YIBGhNѰݯHL :KRhXQw!TY;DAjMƑ`:PIDp[Q#ӝfާhiv (?32JSDGyE m$"q@=-qw ۜ>n4Reꦧ;ɀHjI_]ț:h"S|kck7]YrD!ьܮTXpP J;rq~Ydh2V7؟%_sAmu$iRU6Rĉ na#@VE%GጵgZkIlCJFkŹx8(4Xk/oaťy'I7V*N"ŸA1 j(d4Lo!UU}i.6`«ݬI]Z5$#_oUB $P0'\lhZ 5ޫixS|d$c416*4[&?1jB]\Tbb7/\|940<pyP'4Dۮw`L6y#%RIOBwSô\ZW [ҕGP"/* օ+<#{mydrs1+U *~f挚E I2H{QoK1Kd5ƣB eFI "Zk:Kx`"?Q"`wV.Sg£ Cԙ߬i7db,#l=aK@ fCӡ[B1AS㔡uÞ^F)/ LK~3>$fW|c J 2z迻?3zV_hk mEe/CEAtX^ct|T-5Lۊ3) 0J+.ϦK'F?G!y?ߞ>ƫF5 k6yC#,@ލ[=͸FKa'`m9&+26EKPO$\(%\t(#i]/]3HeGòoK}T#8sTDBk" /fI'}__ 5*t EV4D 0}dE}~nFnخmdOg5wWv*_\%c&seS 8' &4^TS *I sR`Ad2GUf͝oSp0_ @>ҷx)(3W撗)Qiwmη Ѵ1^h`?KUo: b!?I3FX|UPl,c<D,¥`9;"Հw`uWB"Q'4kjXšJDS1̮m@ZP8o~b#3H%DZ g: [y0`~Uq#-3_Mf點CRR.9yN{ ۍmSB;VRsY#P5ț yKSkjGbG'@+RGu'2l}c]qűԤ;')()8_[ovq_ q́ǁe~4oV5wS-%_4g~Uo+oC}g0 al*S~[Q02d+D;#0SCgR;=J=DxCD_:\WG~JKItnp_XN'>Нutp.[g9( U]HchYw*Ũܼ6<)sP`wMs0S"+.binS8r&" e_o9 zK{"/Z[Ʌ\,J;ʱE^ip~t_/PDKo:2^1*`c $Gx|w}OuWs)Ÿevev/FH6Aū{5p@[T@PTP©P:wjڭfp #@ Qq\FPhB赦TMQOwKQ^n/ ɞ {4 |ybu{P #m3}HR,HgBDRW`t' +'L_Ș+!LHP> QcYi9Dӛފ9>@ɕt/N~gaȟ&~*gdoJJ; 1E"7%D/  i).[s 2ȊJȓFF+BQe:^NcguMq j 'uE<{J_AlU!if_Sgx +ҔG0+x̯mO3(2Mj[W9 r*YG䡆TƮ#֓hZwe3+I7ēWw zmiezQBEh)uPNsy ̌F8Cd)1 " +iMŠI'jGC)Zm5=*_'ȯú> BqA])[T`*v˪L*]ikDFҚD,녖WUmUC!+ Umt~Z;&9SrMI̩]97uM)F񚓃;$#&1!t-L(a"ocAƪ=W9'{1M/w4ZcpwaJ=28e@Ԧj m͑߯ˮtZ f~r#:X2>RZsE*%ί0vT QaCdOE{f70S0c}͈`>'I͇H|DDF,Rp֙iӭ?Tl#c$f*K4{(}* ;υfB0? v &Ǵ[6] >" Áh(>Y7>$ի%OR`#v %9aݾ&ׄa#z ;9`02k^ zd຤ӫN[MXk4`1?'73!Y+B(1] `3*AOe%}]ƝBt~\gܶID\7▥-hTlFf ~$Fip*QxIx(~+Hw9S?iv֘_'-L?թP88+lz7"nyCq~QqGkd`e6 *г?v- ]$'me7hhFק<jcj<G( c±rn-*Ry~Oë ^R\{xKJn\1N }T`s;PLUAX{9#ߖ,E|pYNW^^kW@;^8U;¾ $Kh~rиyI`=3Κ氇+;<#3| ܔoeiiEy?U5{~v PPCb`HJT/o7_dm)ӎl1}N% sCF {x']P^spF')w>_=~79̲)/zA`/isxl72t6 k-, Tnֵ6neЉmJnt3-1ɶqwN2=ΌU~L{LdS6uY5+#:(_%p^M]|^pr!Pˍ|z/aJ2\f J&׋qP}^F'Q9k o{gt{VB*0K~%ɠ!6CHx1S(?$dHAlCTԝSk\*[.D;n^o#íQwFE OG66p0iEz|qP<, ERsퟮ"0ꊆ /8J텟k_Ϫ4LHJ91S+!':ULImVv:P|Kf~ȓs'PnEγ:Lp.d02Yaq_ D-x6;${l4`2;}!{)V a*U 3b]jgeeߖa >R v"켪e¯ tjnZPZJ&y]O+A nϿ.m$ʾA& X6=S; _pRxH~Z`z1[S}qHd C9hѓk(,݋G.dLI,'s>4ȅM פܯ[jЋ h<,wq$r!M#9S]B2x#';9 l1/HkeHިnЦ(̭[ `QwyZi0Vdy.QCT f|j k3hG r V9o(6Dž$]Vn? 1d?&ȇ rG {U/ثJ#ϖ"sqj~+bZފCyibe|ٓBH4aʕny]l\xʢPuȮq"y&-vf:h(-'#0Wق;ʽ(DI/CM}YjW)>;?`)K̂ hR˕rY};N@ƛGaDY}D$pfs'!£)O8t"1ޱբ'A_aý*wx:7d\cjeS Vxk&#zjh\bOcbC!Rۋ+Y[p]}U׏@[gP@*@p].cn$]EF

U3x ]g:!}s|vl?Et Ow},3y"ۃSyR*2jkV=r,?l?X1Җ)ks\WN t Mvv X@~쬕&,p̫PV{h@RI%)D%9y.0`dram %)ˑ[H2{4ϕe[YBtnil\uQ$oItyqO*bob-fͳ>h/nn<YSc@m9Ln R]Q& gȂhw ݼpLR J~\ +V׳- T(퓏vILE'JT)!;beijN,&){x3 #44xEt[a;VȨ/ǻ !D;yWM0NGtr[״9tFڦ6\y ȘYܝaOY>g~K 4"KZvk A-' ]u@*N4&]:Ffml۶#"8u*!V?zfo 2l'\wKއݾizyl^BeUzSwG` +ڴ Cr|v_|@Ž2H{a7oHO.- @\74"FY)c?w) +uQ4ʮ>RhKx1n21Iŕ8irȽq'>B%ܒs<Dw74&s>%MXr*e9TuO1z }0w?0f8k7޻ԛN=@q{%zr{sai0215BVZS>קta^Je<nek0yjP9vg] )KRtVG3`O^HG`^1!SqETap얶0%ώ+͘Q8^'rQTNMAY^Y U _3)!VrŠy# gP7s<%aC]k&VqfDV>pZʂo) ]~sH Ef.\d'sa- L՛ŊC}t 6V, 5Ck*tcUc^ %O~rKּiJ e$֝7u8Nɒ-+Z @e"UUT#_*$9'[d^IEKH ɇwZOM Or]b7рc->a'9*b(CQZUqVO]M] dd_\Z*ųn>TQh)ϳ{҃6gЊt9*x Q8KanJB7Zd*QBxh.9#v^=0]"\K@H| y~w呿_nԋNK1oj?t3-ԕ(5x%4[W'ۏ S*4Vp`7H`Kߺ$3КVh+`G-ű7*/2uZ,։iA?Q>r8:YqCj< 1/N*~敩?.hHNlLp=;LhNdE5jtch禅V1yک"A=W’Zo]3g6qp+"c*Yg1> r}_C.Lt,7o$v4am}~FZf{ht罟mG|ƌLj͚yՙ#[UB3̺MZfr 2 T-%}o;C.5Jǣ؝ =Ip Ts Y?Ds 0v)!6DʫDjЌ_g#W li;&~5Q[Y^^SzrSu$m͂nnEj]_u?'=xKmFHjj#k>p7[vi$<uS[,Π;X)A/^HTkC H!xtb:һt{ZXXlɜqGodz6>cK)"~W? qTmy\=2Ch.y)BkBīz֘B "*"=,4[pbŪϮCmfċ68H,'RIENKRp28CGix1w9h,qOڭEEf侥88aʃ%-y+e-N؇\䇌ԚlHj5P.;LŜ4nwL97b>x-'Dϡ;6vĪ(2RYZ~}BF;XFb)@9)wPDXkhBRNḓkT4 aE޳k1XtcZA&vp/ZX) _wEcۥё3'G 9qU~ h+LB~a uHR:i l}z;vNLt޶slkf,G(R 8yCØ$9f*Px5,߅ҳ>-~Ss,HRJf9{ oJYw"-$M!AHQI \,lwVcJ:H)^Oـ߁_UhwϹcq/Zyq(_g4 m7IM Ot.9<ҊE|]="2#Xx! `w0tewe^XWгWLaPJb#g?@C(`n#]0OZt>ie,osbbR_7XMJyoφ%-Fwa:G2ɗ%dw,\@L6\ݚ~kTn'P-[l;8aHCZUxR~? HC"п*{r)NX):7trGG;27]6S3U.9 =~v_z0HiVo?WJA 8zy%tߚgXfKS0g2pϤlvA{~4wLhok,d yNSTx|{po?6q)L%rdڧ[KUɔixpB8/ 3$y*bCLaodKB-v6ʛ ĶN̠!cf_2"yX)7!u?IvS0z vMNćY=VLW*ɓ͵Z'u< ^sL`[2;ޮ8<])E即e\#%h3Owt7@&b>7J3+HmK9HDuPG)ޡh=Qď`)t0ފCO)_5=}Hsf#<+J+nckF9()EɭЎʅ/ւEtv@Zku dɷ*ŧ)\2F!xWRϊѧVtZUHjr?|hh+zxkkU${Ӿ9RI;` {+DLVe,n?3zQFвXTCVIZ] w*ʌUәw; }\[#z6U7 Zr\d3L[hnH.MҬnVǨs Km o*(pI^;ia&5021#zέ#M";.wN3;C~1pJPOFy[;]} CqXM8̅u `+? yo!3x7 3 4*&ho˰V~m}`~[6.,y;Zg ?)ZXNoD}jO6|9"N&L[YҌXZ*.T+K/]}-iL"4Z>>CTFy51F9Q5/OPAa"hLGxyX5_iMFZYmZ׻h Ǥ/ek>qWbxTh e* l6D 5_~E@hX\v?ŏ!:`"4?|Xv uo HDyQ՝\ymF`ǫ_!*ia]]Y#E=S4;NHeol3`vʔܠ.__EA1VkwJo * Xa]mz~ pĜ~7| t_d&1ipMA!'kҤ !/q vt-ַp+x$>{@d φ( I1Tc_DjY#2+MpJ!C^4Ϋ%ȱ+ĩ|С ?6|1a7Xv8~w%Gs,JiXy҂ mSdy;_NR\.Uǣ'`3Xlc);> u5_6u)[68^M$*( x# NdVi6B:ml)?qH5 Q2&F{H@m:ugF dE.72z*Dޣ ƴɂpAג=nOck׍qx붞% \0 c%PLPHS#=}&y&j*@ G40Oqx4#KvXPW.j!Z|١I{?!O q[ 6`=΍e9/U1׊ 5Ic$ޘZֺ+)u6-%™ Lv|Ȭ.NpO<> ZvWslw4" pf.\?|κqn9*-#!PHv\^%Mk:K17jZt&x'xĹ$pSG 8% K'(Oߕ]Q(ζO6[ቿ]ݴ! |nm85`wS^[A\ X}%<> `@!x])"(ɒDh$JNc*\{e^oJ䈛gFr֟whc;X*v'b1|-{_:'`%GFr:% `SMT8w7io%i(ك~ԇaG;BN VUkV7 Y(ؐVص`jӏ{ f, "Aaܖ%GOM jw 9U4KX؛hUtw<7S8WVFvoA*ga ꑇV{䇼4dqZJɿy90W ޔ'/k.ӼY;j6ygJ&82r!̀!hp@РuT%%[9?U'\+v&%Hy~co D;XCPW<ҽ A+N%Gt<)tL ȊO޴6ꮕq|kr,\~Νe`_*@5.߈A $<Ɔ[F{`C@y/ܔ`hE( {d* ٵ)t(8 89c:O$ ^hSȱY$NmÞ`_{Õ>D-:(vET皲csN'y`\YfK>;Hc5cm';ݩXFOphq$t]\pL" ATtyPL+g裟"ù>i°!Y6wRFk\,S 8;Kb.7 8ݕlhp|M'5>ktw͟,0xXDv.*oJ22$7SvOloCZ5-&>p@AXHA5 &I.myozɲpO.S,S=zn/]9Pؖ!t ;*8&isM$M}.ϴ0E|͛H@:$nq?5ȵ7ELm2t#62j?EY:<_2j:5#Սpބdb2^&0Z5|Il@w<_8:(2/T.2()P--I<`8P&)Χ|vWzh<^l ,XFDXP:i:Ch\Djy@ctLD)j%f59pUF/g+k  g]",F3Dd֡ c:@i~'6 Exu,NG0+qu,de 2vKq1+jqN@2^uj7kơļn Sje` R|g0nrUӔ.'r^s,c@W%zP,P>4 ?&W+/{΋E̮ͽUKM"K6YL"YHvޤVzvp_ oHm h= rL4ddo8HN( 8JK%1bѣ^F0(L>rΣ;>?.}WK{.'M,b#>ˬ°P/yzߙdL4_=fIt!O'\ӳo#ÁMkQb[, , K+A$NDI n2J.nJ"ANx:V9oϔ>߸r~ pΛ%6~_ܛedFa)ֈb/\AQXqzrJtXZ`:wCȪ'3D#kI )Ic'R9s)rO[ SQ qhAqGi) G۵m7[+(ax@icUB[.07NqRNkrSTHgȢfxq+,r?+9LK([\lO&uİI+@a6~E@SԎQr5ɮ=#x~s 9bA͹δ*0<\a,. r:.>*(z.D3/3-Z#K"wH=!B<Ô(8 +ET|[3{US Bj e_d_Jᮎ ?ڌ2eSX-)`S?*օg/fY)~ 6Bڬ64sfu/gο^<_q8{3vnf41[60+"o{ȳT U#iW t6/!`h.y1"1'pLR%ӓ0t㖕P1:T)rxxFv,BӒXف\NkmfAa2Jed.hE!M*σ9S`"`vf\Y$4QȪYrMۃuQ}nMxǦ؍m ҄yAAz޸#搓²[2)-nW&|^د`D1^ &1æZ|j,27x,ODY{,7< R^H8AVLQ:S̃؀1;Ĩ4>#j`DqdGp BUqL6{ y_-@&F̞G"#|nתlzR,͞ۇ [hd]Bkː?YY[Žqu>|Xj(@WdA}_'%N.nC>LJˊt3ѡU;r;jmLNm{ IMGFsQiC@7>ثiW MpEC k[i}إ9ϖt)-,@@ڛKCVX5HBy3emYkhd>!cƼUx|XߙWREse%ĈΩX+V_: j~&?ͪR9[|Vs~t[8ոܘT2;z7E9  \me1J4,wՏ@{,Iٵ9ƨӋx<~m+̮$]x$'ZE%E} *P|B n|N!M!gq}:c'|#wLu +r m oX2v;*C<oc+CAmz~`7R}}-}xh= d(ƓO*w^5o! B씧գGؔ9C` 2kñ+k1hJۋb, qE~M7)j+X~ V~V)8ե˻եPЈOQ _ztE1i5&إZF0a24[at{u`Ӛ*v:bx5t}f\áob8.7 ܻ␽.= fC C|Z2a6$>'8E݈6s-p3тY hY7P`%-I oL'~ 1j;_n Ӱ%ZGYwJRn&l#zx(S^1Pg6TNSQCjzPiʁx]oXRQ%qXw9T7F%m a lDē:k=1ifĭ{+Y7:As;G|q DžBu5.  'w_qrnLsn1lRRqV?YQFI:|C_={oxvks}hcj.nLdm8-eo:vK(\m @`4 ,~D>u )59Htp)&Ȥ:D+B\~x+Iq3A <ƧF ]^{|{C"So0Qm_ͣjS[%?Ї,R&o]b 5W@Tw MaTp0:xTȉQ i~K qvV՘o6.O*u.&IJ,?Юȩ j>H(lА_}굸PVLVB<m L Bo+["3I/5oB$R'qSU[h;Yn{& rQIm\4De.Z#*_=K3Z+땎Zy^yB6Jw}ww32f+B~El`[E,1LP KRlt u8JD$.7Ӎ~t!YHeRY꿸b&rVw “ bvOMݙU^b[(|vǢB.RtF#u#ZKп'fCBE"Ԛ&*~ :D>\=يe44-̧w¤rjUGN8T#MU{C_ !y!N̔0f>i#j1O},rBU\噟,mVιF)>AhwnZx{-T}h2ӽ /K's;aS5N {q s IAXTj`G>œv4^`VlC{"l^B}԰rAFPrГRӕ`f_!urjՃwIJ(Uh D~KrcܿȵHƄ~zZ 8eC{":k)3-h6Ѯ`2@Jr%I˨VUe^+n\ҷoTW?U_1{GzPP%"bw:dj ESQk?n2f(_Cdp GUSȌN-vQcEB2i1A-7?4 mgvna_5]B-2 \"Ƣtx2*?%n_w׌=Pc7bۼ}ҎzWk 3N|r+ O rIs[OFKN u{ * (JYmiw;- l o_ +Π!O%-H5d)9g̵o,n'cLRbNpg\ m.13x=a F4A@Vۆ_iT@ Aƨ7"ȉ9>jJ쟠'UI0+ ϵfoZ {z_#T,XbdߗD@'_.ۮ5v`tB~&,ѳǭodQl/*3N۝7Nޠ)')aJ|^ PKA79j\F{lt ʴxL8fe\|(/JDfMzzv.|#~\'$.Gb}yZq)z l󩖰 }Gy qg=;zvҡqOUo1&Zpitct\e(#8sj7Q* #Bbr=@_U]cQ -FLX֭h=4Op u,U="c 6' ,9{uH狗uHb9A o?%Y (*`'fbJq}tL^0]}>]X\E S)mֳAfweţb uj2i3ŰIqPhٔDYcO`m&9YߠM(J.zQҕ$5%)uk_a5ܸ#/wF y6YģK0J@m!ȥkc *˜E7k^2Z-=հɲIh-ex Δ;bU6(nK2I7q+崘brmL )^g橩Sӫu.L!0X/2\#Ƃ+Za2$1s_Z!k%2emȁn0>6}FMǾZ %Te~keFiZGڮ:7q^; mʽWuKZ7JnWַ.]`g]}F~φ%2, z}]#U!F3Uϡ_㉙hz\8T`4GE8FvQ?/0ohq|-qƪ=4`.poiu[&$C;e4``u tv.#u $St )R_}$GOOy3Z]m3f | @81BA/O  M|TSxCk[ӿf!lO;DwA>OuDYD^ ށa(6a3M1 粞HמYVD3{vy3\cޞg_*IfJ3V;}Y2]̇U:Rm;$Nv_@'"psIf2G̈wvɋnK|dאˀV6HVrYj r91"Ixew ޙbmqC(>s⭕i+cN'^ny9a[|ELU$xEvqPŧ߽aN͜M@HN!; pdm_=@X.ɩ) ~(! 1<%Jxi5XOA'+wwg;IGOYlI ~K YnERbgh Tu!L.5`v/`cY/>"c%o?>]mgZ>۟,` E:Sϕ9I]7{$bH7B4 V;T?H:՝8XS^FhdGܢ)( Ϟ$Id9հ'gF>*G Hͷm6xԌ|h 6̊>>0 s`(LlB7vci&!jG=;H_-T{#NEcg}k1wQy^*yF{ 3z^ӓȹmP;$2[9@EsMi6i5j!t+#yc?|@Ǯ\|"ݏZ) d5|ms=XǩSuqB^Zl0"!qgw!lxE,/f("ݼ*ۘèSg$ ؎~DDЏ~ե;]MJ28*oH]yRB7mDwһ*q6Nj$Rĝ54B2ȯѳԫg@9D` 9IޱJV)vi4VPfWl oK恾_& v'@gsIRWbM CdT)F|ccQr7e {֞Z/Vt:v9~RA v!3-5t-F﷑Kkox<!X"?lo$T%"͟Q8ⰰ3 &!봕\+HG3V~};.wH<2jL@Ƽ  m߼UJi554X=d])Nl[ OT<1U]1} tH;ۚd9hI S×xG9AtI#1U; mw$7 5\uɗ|l铦2Ea2'0tYNuGMՐeע0ӆK>tCTfgfk`É=e~gIt¥_G{~۲L w~>hYw n9ąYObk Y <@iiaqz$=*s _77C=7 ƁH?K'Ωg+BQz&UhmZIXi p+@Y0njt T{O7m^L"T\Lae+!V1\8Gr]>-DPn)oϩ֮bg?YcF2HQZ8 w@x}D}=wh?iw7*?7jU՚el߁,f- v]1bz_-8zo w^>FQT \N^ԫJdы8Q3挃1Um71pp](B6J]967p %ߌJk̵. IYIJ*@: 

/~Dsm3H_%l\0]h i6ȷB˽NRhނ/͊H!+KbJ/"o3rYCe HtOB" "oQJ{6C\'0Bk2hFg+3d[gIv>L79JU_si&f"M%w~!moOޡk]q/S5~ Q}+`#۵֗\]?Gl5M`򔦺!Tnn[cպrvDAciȏr9Y쐽s3Jg0Ï @"ʿc9;yX2_= ar~ώTb p`׻$=XV;.+8UY=ۄ &qeim63{;%iap79]|DTW/Tj_ɈI䋘ȬDŏ0=.ϡ(n gP/}I1^Bן-yc|iɡ|,:| _0w kUl9ĪGsRIO5m/kA~ +28UU[oKt4v& U 6uz'ݴsc_aKht !sע9bZxͶ|jۦ̹af[(sjDh)3B 2Ӷ>?nKN )<`0HthT_JӡNbLS:W/0ȸD`֒ugQxgDUZ]*sH}Zۊ צK0`k&(54|xR~]w{T.Ġ_A;-8.dδ M1N豟&(~ ckFli{}f{ߌ̜`ԻVBET "74?OZpvHLaav'"gǒK+&YJLa %5?ս._ ]Ȓu w$xMmZkHQo{A! ݦ$1@owX`Bt; ȗle!iAĮOܚʎe $}cUaYcB(FSp@$7N Lb`*txgA[{.IdB?*Z{y_ډ 9-=zg#Gg<&%+Mb Grܯ3`ˀ*U8Xlp9DAV:PT Ģ)vȞW*OpW`|z]',pHxC(Ɏ7d9@< A\R ՄNĪFVxlG"bʪ MTptJvK+[[,RC.N8`|NvDu)r-PP,{]˭\:Up=UX]A<+<@JvޥBN}.TiQ??Le# л2K\!\SzmÛ>/^!iaZUs @zcB#Xm ߃𼡼.7e5@L Q_#lshiKnRH{'R\ {X7Q!d IϏ\2KO[ ׳QӅKh3\nBGK L0{/fF6\.81XGuWI5j;h͗5 F1q PM(- ,SEZ]w1_ύm܋/ wI=l~z\f3x,/gY3g* 3H޹ Z,WI1+dz) 2~)ҽd@G9=n^4ĮsY+h؏2fxcKg1Y˸q޽~[.>[,yA/-%}=krt`ߪoucwI}'BO(xNS*0zC:vT5a:^F/b˵yueὠQ%a29-ޟpިXlQKs}'" 'o:1Q9Gu|{=PTwҐS6pEjdcÌyF7)rۿoKO rZ0ڦWWÃ@8'õmr>ޞj>3('Os⸤"!:r |J[՘(&T`<]e[.V.(Zi 2[=\K8 6N$ҧMԀ:.ra-USuT/U19Of%'e>FHAٷfz)`ۀ c'G4{ ehҰlc8nKh)\7(Ts7c: 6#mZ^MA4Yy=C{βJ7#;OҁFUd%y1YG`mwD4͘:t}vq~yvjJI)( Z7w 7W0·:ŵF0aKG18 X('^U3YG WzlO sVp`H_Bi8h^t=CVcLouɌ8nijE`7U4Ur݊Cɲ4Up;!M!Z V=rq"HI!3@D+=x|MZ\Qw WhhBanq!=? ]3p'llѤZ "iHe#nn_^5TbefTh&j756)'&)| w9A/1_5iM[W"m,Bv:Q=6xuQ}"%.3fߢ ejքwoʖG؋6ٵaO^["2 Js%'Z"j H/ѣ2I 0J [tYTLK~7*£"$d0)!YU[PG-h8i9l?_s4`TJӐX۩QƮBZ~yj/njnHW~WBEOŝpeyZ.HAi2ȡ6i!J_xӵ%_.\8A Vrw{X2d"73cwTU6^dWۣjl ]' ]t=IE|Dۓ !p4)V,s);:?t>HǸl#$0-C@p*W]D> &ERnܐ|~Jktza#+alYorl̽ Cۿ*8Pq1Sڜ;c*ܭJӾ(ڋ"~p mGVoo:֥;)۸!~4S_/goXŠ!|u=¯rבss~%Bj ޴_-.*⹡y/(Y5|(-39er.9I_X#i$`e]>28KAzFΗaMY?DDAJEQ>oqQTi2Amja3nUZf贫ꯨ-a|_URECyO B+*TJ;inųlFB"of19w8$M&cERv0Z(]f%'H*Yi,ۭFc _&$*%*ky+Hеr,Iׯmi^vU6섉$P16 ԧho|G-nڑ `N8u)[Ƶ`)Z$Iwu`{j/NB<特լ<.2:,6N|JQG]rrNAM 7d|5g27ۡ)e,pHb*;L^9ˉV`Axu^w^K(jj u爋ގAaR!qR&6ı+C#9&˦Bmdg_TP %F :C[+|vy[C z jy߮~q|8$Z/^q r1{hE,axQE1g5ik\ALU$D 40xЁX>LKB?ЊPUnbB85\ck"R |:C쿣υKۭwF\mÛ2 ~ԏ rsd$ nh L"ֆa9Ȕڎc̦lJbˢP@ ߀x<]zu _ `ϠmB鹙2&c+PM\v[?絽6P9I{bbʔЕq//4h繄|sꚧc#qtQuz-uCRns|_KMK~epHedc1׃NDُ?FEiq klŒ;\gO!6ї1w .nD&ƖzΝm_vcBvSemѴ-TZEkbB6-svwRp*Y*~ s)9!v-:XeY t tm iaunO!)uQ4^/OFlιs{zIAOQg:$po&u8 kԼ]rpD7PHl.H*>~kVZƍ!XGN'+Ai XQ1pB5#+|3So -4)/sTWGnAZ$|R(?8G|3$SqdJ'G\"C,*!'NC,8c>~ Wtk縸)*PބRs S0V%Ro 6J:\JWvy'`>}AךX[th?W^z+)ƱM3Mgr2$:|SW{{O׆>&}9@ 8jcգ)\H,&mJy.?Ȍ74y{"݋^/`}`-VLIgu՜ u+ ox PdFx>iͼWAߣ]aDp6)%xKߩ64dniN /| }[ s0  rp[\ⰹW*E~cN'TeAMtt j!]ld]qߩx-׼/=5~}N$r}5Ucx֊-s0҃ߣIMAi~ 8a l i&f 雥w1X]2mBў~.ۏ1T=EGJ̼+J0زkx]wc`klE:V]FkB ^)pZQmTP>kZY 'M?1&?ޫ*˹yAJ@%!*4'EG\R<誌zWۇ%AxZuÏS_}-1ܻ&#2D=O #] hS2eINq+ԕgM$q}BcoWَ3s)xn&c(Ac]_߼P۹NiQ&i\a kg Թ[Ֆ&km_FPlG/h-.aÐؾWrEG+fVLWQFkSEwxsbϢyR)ȷɣv*d0mF$.}@2U2;6R|},:خ7 \w(DHƧ~(75"rsĻɦ,\{zD&' f ur 2]#0.x.+H eeHh{'M1 v=H:Hh UG ⷯ\s2E`[t1;)k'8R5D!EtuJE]tX B+VOyҷ[TEXhRKrU·M`2A4r/n}0tz4$̘2;ZY>ы\TfW}XB<2rA.p0r 1roOdq kV&[ջ&0@w͉LfbnuaMB`7wT 0:B{RQae_f9VU8τcl_dfmpf,jdCN};mE&2+/,2]kGd'iM${jU34J9ІoӛUR͋Q bɃ*W*5xwQŘN,/FU׎IlE籠V=+^˧ϩ߯0Lx\ jjOdGKPСP0CszͷMdWf6)3E+ x>K:/$y FFMp˿[ [>?)SQoH50̀se}Ԕp'x#;N,l_a+S#3>ZMl3JRk~DuQ͒a0wwb2YF^;%`4ZŮ@'?K*'۰Y*u J︦=Oo&.q?IJ*)Aghv%8׆5ywNJޤ9_-h2!C?qzpKGmhۇZVSEB\#tӹ:+GI,x0wyl"$0BYzX8\&@rU4xaI...wX$VS}l AM 4 GJ^01Ze<ʐ[ ܊ L OJ΁r&8a^(*+I9x$qV͉m=5m W|שevVW IIL7 k]3B3K*9 e j~l2q|V :fXcs8xT eҝe1`rXJ@\u?[ +kX:f"Xźz¹jXxc~m FQ $%.ߗ)9y,^`2SR/Eզ jD1klca+Ĉ AjUQy$gI!CnaOݱ_W`I7GfT^mL5bx0o(,xu |uxˁvvs?5].)t4NQy?-'~ >S3Pb+#5B:YF+n"Ѣ}eS:J1ZPv؇Pas:+l6[toUp]sJTw#f87-5%حLaϩ\aUAV+ibeBQGϏ|iLq9մ_LbhEw~rl# |XH_ / >8MqVSȧǏ/ǾKJ,/[tD>.$_Z9!O:9wt |Q6X!]Gd*\f3[t?EGy_.r$[YA ɀ`6%5j57_ zdD |S8 8$pAh- +\5%n|*|3:X-+4x}],/^$u,M]g?W MHH;^kg%P_7u nG`nۑC؈e4Vw"텣%;p]xcY>La30Raϸ.7DE ޔF`bSO+;UTE|>mzg96vC7(t̹tWz\P$ $Zד c[RF6Kl u)Y!AzހT ֤aZ s>ヽ~9Ŋ!% ZN1|U ^t8(%X[.ɹf0z[ҫ%CԩZˁqO! 5(ir$ܨ+ql;EOo$+0oav"ܙ[u/c;l6P0 Yn[^=0-q;LGw)kNJ 5B)S- +d:+< +;j{[JzDMpWfs?Ps,wFzseI>5O|Or5)2A_>u%^Ic9v{ٰݍ"OP~˄k&MkTu&}O8Nv1OT/r'I tL"D0;܄/lIDOTie^| Paf4 6ل ]/@ ruXAj2zFz RBǰ& @$mv0Y»~xj>ՙYrJ/vrBhv$y ;( BaBPMw2AF/Y&@FR0u1G֢PPG9;{ e&Hc2B/Xg#-R@w,T }K\mfqvCN5A'$+qqlmdMؔEԫ:8m[ G9HPωpk>pnّ xrY `=Og{⸱ C/C<@ /kֆ,yõeMRwRfintk{uSw־70jLhФ'n`}ve X+uIdtn'_}sn!l՗f ta Lu,Y-"UZEKذZBJ 8Cytc XW_ːE)Ǔy ԛ:j1oԏeZb{˜hwcl((b7>A]HIW5b3䙽Py6Mp0`G^V|~ |b|٩px_x5tbw߂|Yy*K3w+%xX& |/x?PI 8xV?jh ;U  NP^ag:DQ6G=զapwXL(*UJLNl1'ȏ#,c!#MܕkE]mx0Na6?=N'ps }dTv[x u" ǴJ%(q) ƒx>Mq&=@URw᛫|s_F='9#]T+&} k0 q+$r&- v.Λ=644kˆ²J+YOJb&` Dgv(02Bở˄)ckk{TNYz=@7faSKHh#) oBz\CɟF1 S/Ks/f2#)U9ziəY'LU 7 GQԻ{_: X}j&错&4k=6t%]\%LF8WCBn?K[͒k oxk(/bf,ijvT{)9&>vc ^muC {m#T9S ;FF1eqU! 椫+Qs0Et#\GA2A%\iZgi#hGeV ^)\ J>IA?ryhD*Β5Zʩ/hO`(=[R@{-vw%Ub P:Z/-U{8DS"&~g  nʻ,k8Æi'Ȓ84{Ei+DN^wl.,K?TLXᝪxL6pLğ{@b2al4͸p}ņV+J*Nd,8ch>86s-L\Eg&x/r6Ilh_#R$uϵPVYNJUYg.S]y>kK3הU/c[@5Xmf:) -KBC갧a&>q vāH^+03a_bBDm"ҊDa$:lӞuc篦Zu䄡 uֹBm{A!48jZqnry4ǰ}H$m@(T^BI Α[`PA*7wL$~XE?~n#ky&fȜEcrN\-& f'C-Gfhoqf.yD/ V!:j^9U~)u*hѣWSukg9@\  0w8k1f-%H_/7wFe0^=ʠ":׮硠\ Xc13oM8~?AITwq sXGW(@ Z < -ݖ9~@N}ه MxWҒ?.oRmk\SQ|B& v@9opKtf7 Z?8L_31 m!ø^,Ar)XZ\ $|ힱC7,K%ng$r - VVVCims⎇C^T0mby;9dpV*}/< dQ*=u=مlFȂmF)Fp^T7NN{،GtxF*gȯt.TI])j,ŵC+ ܫͼpNPJeAIa‰h5Pe|1WʃJ@òjƑ|s7]u2ImUU1FZ'#QrJ5y2Hcm H\jD@qD! nEdg8;R[8z}~-NA1ԐCsIŒ9hfw K#k1Kg4E_%5 j0M\>:vr]kW2_1"= _& -|=2f=\fq[Kȝ_|QO_-/a͖TB5hpPa>]8q {ZZpOZ+f} 9)7SMN" I0ue7\~B ^R2ܸ{yʧCOLVs:Fý^bvކ5a/UtJwXc߽ŝ2&_:=%~*9bʠôx'{miE4 8s[ 7e3:'?-.k<?q]ӱl>`R6Z2\њXA82v;;s.n!ЍH|1cNGiB) {j42֣A^l& -Q\&[6D$)[m7S'OxɅqA2fdlvtaJh218[DrJ>:J7 %)Svuaf/w$H=3/ aQ,Y?cz$nH^Z8o ,z inT8 i ˾3\uT)f:/X ˔xͶ5*| ?nv!j=\(b #L=(ljЅuKudUڼ(vAIZ?υ&ӅO,kAb!q}hr^8-bRt}_3Yy/XsnF+cj-5C=J1]l@*mUq&"ϪޯJ@bHd^GB`&p&/&D1_P|*k uxK]-9ۺOT *1ܵAM} a&*G Ry¬U`423Vￏz;)G!#3ep hfa7S>hh|TT0naFw<,PȦT![R%i'!<=S8ڞhZj@ m *2ZXKj:ؔyBR2C_HZZM `PM(ֳ$0*vW#īXiNZ(nIoG>-#6+\!Ro,l;Cq]|KЉF1x7{\+K{[ӃӉ;kʹvV443X283sqPM)H q42V/2uT+luD{KGh^;ܙNlޚ؁h3ܘ XۼKs-2Q +- Tsvbp}Z$`T[E.2CvI,LLkIufJ jtqJz}nA@|b8iInoeajC Rzb^X4iB_QGT($hX)qQ 6n> yBvKy2Ku/-W;ڕbDSys7/9mr J$uΜMm@WS4d^*(jEUL- =C?*Dc4I.{ZySrX#Qc͹wl+7LB+/#,N&h~IM,== ޽}GGwR.]%!/!QJf"[%Gܬ^r2Aq5S=l!t2 ͥKtB((/jʲ+w_ 볧0YG(Xp7t+Y=F\,UK>tFRla֓bBv<ГU9h֙2Hя|Z{ء䑗Z5ꋋSmq(A`).khxcةIkP$Wj7%4PŮG\wڢ+aZx!ZlIlwu.G!-o.l-! MJgjɞO?) p UJ.^/"OiDqm6{."F;se|[!Qu `S&3qX\fjX@#WS*WY԰ !f|bLc&YK0nV6x$U&= xB{9drwFZtn~cϻ\)|)Yvnڬa"& 鬙dw>%ҴW,sJɏBz04 qX0~&.eHeLʉ0L6dT3Jl70Ve))1]X oy3 ;',{2k䓸HaGc]Zv[U毦-i=&JA8-4' yq=+p}O=oW_(;bJ+{Y{2U nb;Ng݊<'hNJ ddd}| 8 Z-l km@|:oݝ[#b?0b[@8+UD75~u5r:-yKݟ $H͔8;s"OR BAʸ'kQʼG`lz=0˗mum4.1)Q\/HaSVҦa"e|#_ѡi'L%}iЛ /_N n-9Q}ᦷP({GAvņ5BMg,dNU}CJDѿԯgSj[2؀&T@"}[el澃z#Ũb4yZ%/> 無LIߑŊ\bnTcĺ#W{VCJ@Yء6q[V^U.[,o,}1F%(Yp5jD(]zj{F<}>^a+*0^ @mZ2,4t݈a 3‚{'Ktѱ854\2^Q\t !PIle(j *]\͓CK9Ogz'+ /$L‚Uifpre43&R ɿ&FZ%Wa6h):og锽,g-=Jϒ/BȻp ]$&J&*0tj*=&ElY1gڦ9hm`RH5/60r޺'$y~lo6mt5h>y#AύGU Gum\=8Ua {'b⴩q i~#-|ҵWf㯉|-PꁝA:8{`'d^,##YT v` R]LFA퍜N\w7y7QdUFwJ.RÆ+'Skw,^*a-3^?fvmԓ(2TNJpDե\[ZxD/2f g߰6Whp"a0/Tf=fؤ^&V@h<0RU;%q+ Zt=ed:W? \nr|\Z׬4>xû,@J%Sy|K*w=wy3;T\ >w$$cnA|,d;¦rn mh2rIlv͎20ZyxfЊ(f|'kYzcg`NAdi~J U%1 ־1<:E:H*VjC)* z(8BpP\w\r%,~.ϹAk1Ԑt36l1LԯC/[l`\R38VpmReX?Ț3m[Hx&4rAQBvrc&x?8]KM+hks!0;Ip‘d,pXvQ TX`s*v{o kMVŜRn4bOۉsŭKO3qiH,:&o-4e=3[\r&p(Ohѩwlڣcx,%{K.u@ /pߝ8%='̟H.'h|tDqs:m #f W@+=APܮ ?dZ ˴lcʒ q䳁b1V=ŶeyQX IO ЧEMgyMyD*AE`OC gF~Z.I:mZy:F AazQTb_6;z':t"U G3y3HM\ϋpwh,Af. yO.9t" _'ߢ0AS.P}:ޓVmWUK^0PICZu`G Zd<|-zqhU6XwOA+6iXĻ&P}ـ8V0\/Av{-.|`HbCdh*YܸJ/pm%ݩtvxl0켡clABsfeukb0nCΜG C cò^ 9~rFγl&p9NbW wg|G yg?ӓ^FNEcu_Nu +fpDh&{4ˣkt)w"iʯAo8FE]Ql}.di"@nzlhjhL׍ʧk(eldw)ۣURxsOsz7 \*ޣL|W]~eݧ;Q/+1S0v,DQ_eXUZlQ*e~Om/W eȹlm%+%)唔rT%c`ZsGhHN\dly$b+({ʯE8fmvĪL$qJJK1}q/lx kzǢVZ=WNM3$h{Ҿ&ag%1Խ&N48zI }E}/[bB~K,ȣۤ@\ ]sAx4Śiw>Oi4Ɉ'=eD͔ٗ+3 *|@q3D9*4{ޡGur٠ҐH1tf>3,j3%ֻB-X vdPܟ yE4H~3ߣ #o9d ϐ]u'p?&SR*U (Ώp5k޲+NrD@Y2m"]k/hR_xu~ $AFm0eyT* uzE{s_(Q.%Ӣy (i< @`Yw`. f ؐ`qςɂ:;R)?VE.;4i֍Fa_]$<ܷ u"5!OЎYGzixgU7ƕX9(l7c99ShBxS.u~c2[H=I72JuCĀEw_чAy_s*Z$ 6 CsCɖ@̎&=׺ϲ̱Dx? { [^Sp52{ n$O{]Fl8RBNt~ k JM͊lȎvA5*x< Lq1/XzA~'Fs{59mݪO߀-˜ (5[ommL “ #wہm|khJ/HDln-iHZ=v.̙. |@{\='r9ƀDg έTFLApBVC63q*r* ip;2UţNB%190}6%F,YYg`@HL5)(mXDnn\%U/G78 隡@7>gٚ$ر GRdTOZ9S4`7.2\UL3/"e|ul moRU#u7}0›%o"q%T 2HV7b;^q^t0|sf+5Șv6왩AwϤ~w<\;"6Ks%)|p)) Z., * 嘘`72 p%Y(}`!tK?b?!FAz3}m*Li&` U|*9RbqD?qui~^(#AGt!EM6m'RB6wPzK'6A䯵d_6"n\K')Ӭ|@RJN{SXfu*T*ؑtDUGC̗s^ }6^^[>{ͤI}\&h֔9I4vn9%1hHJvI#huԈ+ڵk 8=FuAӎUoJ:$-9r{0Eh/kٍJ^ ?Rd7JS:׎wXu|E贡 n 7Aa S,@`FĮ(Q_'6uTZҐ}AZ /:YDUU8,^dֶqRso0~_$@0Ǔ|Mbxת+P4 F]%y@H{Ji.bm[dq ^'˘yӬ{C2orIA(nӒr.lt@oj@;SU%ngmrW~:Լs_xgևU>H'|iB#~eU B f}ߴm'B)q瞊f@ .n?zXq/z8Rnw:(kA>-#kj_˿#&N:͹<4Fl`aCNCM*Ј$$+n"̈́kd t/MBws6Bhg'#G&o;#e'6%E8JD-pZAAߧP(Z9Rw.G<"ꎢ,?n(}E)B>&ɴ0ezS=>ז;5pWniɮ ,AP^o`D.Xvt ,nMgKQ @WSrn(.XUz*X>o|-ZI)ң*uKke) 8$\ŞVE(x駦Pb :?:U$DP!Ms4a~-;>iϱ87 eq1v䞾 IH8Z  a{6mӔ5,\H7i 4̿[:GX5 wBu C\_K("~JA3rt~I[WUK&C>| iQ=wGY/?IC8ۄ]19sC(bzZ X{:!̋ɼO9yM{U||sW*. yxK[TEU4C HRdYdi^cMR}u@7A(w7F '[Ef&R<~8`o>'%lb@Y$pZ+[Y(63M'>8N[rcIv_U+T\`nKS_&^ ~>7]uy|K:OhrߎJ0=^o狝º |ȡh֤X;>cX'P?'Q3 񸆧ݯdPcu:9tcP %/(a2I Je7#<Ov 5%/(ۣ*,W㛑5WoL gtKoRsCV|X"Ӯ564K5*EG/d;Z7a q-ĉ G!ɠB|nМ017^ﻜ#NPISS8Ay;TD`0at21 iE~YƤ,c){Jyo J{ g;OQr=F XeOLee "`/[p͝࿮2ID=fzQq{AYxoTv-?a @߽t QKs'V׶ aE]ǯ+E16OvFa8g dGsC|pX+?PaC90`,}0Orez.iXtK@Z>i~q'(19b!2A̓=k~?IU|5EQU{֠q '"&Ark`NWjsJi̚e̝Zmx+>Yhf69 ^ ?FN?WEZRϙॐ [ft 5ɝ/(PǰKRB,_&?LtE>]RW.o퀾 L=gt&&*? Y+cOwT煟˿Ė}Hf{.MRc1_S5BC Rٟ=f]pP GD2>LԈYTx 6Qb8Vp;ndٗCad݃Ԟ:S!{af  kӈwh\F:SY]jx_9#{֛JTxKKyRD" :A1K5Vv7P^4#c[]]H1@So NFQ`qUk@3lm Ca]})*?9ט^ʫY^o\6p'PU O_TǓ5,J /8'{Yq|u7;]=)pCsk&iɓ$^Ww-GqM^-ZL2\.P/ p}GctL*;'/+1'hAU֙ӼF,S$@xlGV'jzOMmzʖ B{Zh:d(֕!Z=%i4rea4M5IA?n/0{G쀯cCeU8!"MZ9q0Cħ `#Yu|GKJK20LWhwf=)C4a+&]uV%9>6z`::MX!ī_x`vUڗt>Юs3ǐńihʌRaأFt>޳ dyQ̢Di̫n24#,q(_ЩhrM:zO|[ZaD3\8:f`*Wjj/DÚ%>^~E2vVN3{Fr,0d~V?s_grbgz eL'XS, &mV|/v`]|xca=yR/_F  T8th׌4:&ߩ:dYUFo0~3# !9,Z.sLڝlb?-B;s1'W/P8)=o~FeؙF?x**˾=*;#tJ;s"` |Lv+<=BUmDs\XY?{6<7Uv` :8¡.s.A1& 8;YCƱI:ke:.:~ܜpBzu25Pv51~ 1)Gv݇Z|Nqޘ!S #{XF) !]Vmxl'/F# WydgϹo$/GTȱZQ<۔X__ e`U d\@+d^"iF4}EsumPd2F#ʵQU`)1wx66[DI?˃%~Q{T4 ~׍2g/4qKlo+Y簹 pc0XYsh%/e'Z/ ϣcBn>JC}ocxg9[ҥ:i(`-QrY3'fj z]Ҷg>C=> 0ʍ5%U/KLoyOOOىݙ^* R.b~Ҕ!^eoF_? rxe( ŏHI6_YmX Բ X;?sqz{`T`;)Q/&0ȧqKbMoz],]XH.fY&w=9M^$'f!`܀kB2|3q.j+(54Xm%žZG]Ɬ<#yFC/S_۰A&EM,3. Eq"2q-gdUCVS֧n4E{?7]A?ay\tp%6XS%DX|g X܄ YٓadLцJv(Zasi'(|.4"#A]qn/B; :}eR(}KE'vDt_ *Y :N,O<2U~Z؛ۓ~Wl" u3:`S\hJB}Z2F:0_dM~0HD#c$D4qSh4T jW~;(Py!oK2+,;,ď!<1%5l9)D ?v{U||7M 'n3"H9>a" qNzE^,MdbA|Uv c,vw@+uގLO3Xw0ȦoZ#< 0m;&266_U (>@k L;_NM&}tҫ:"(|5=}!8-+F tCM躩k=w.>]uyֳyz)Z9;}dLJ@0ȋtܙY]n[SE'[v5k}K_ oL{:~ΪaJd\*]h\FtX>nɝ4JΟ,[!ھBo(l/FKb/YpT% $H;]_L@KHEqv‡&ZӐY]-$ݲ&cJ>1ȬXޯOo*{p`;eiRn@%}/[Z;$+[vE eM? 0e3ɸ{$9nX`j Upfiz ?n5(^yVL{6~&|ѥԸ.mo=@b)J I)a`bBb:oP73!,w*/|}dMזkk5gjfkw=~C$3* >(Y,~<: lFzaYQ3[[QU5s 8dQFSRaoc4CSvu !S׶1~3@g8e'e6'.#$}Tix I3)B6׺_3 ڠM]\ \BȫXKO@S߭&UeUj-Y. Ǽ Q%Uz(I_ҺȜt)4;9[f^97Ls@C;$4#ôf+-kTC n ] 0Uݑ vЗ:AxS1#R!Հ[#l(_'ӆI}G)t&$lp4Btt)(7ouBQ>f4^\˛7/B'>uTn~$͉(~JR:/-¤z{rn&ƕՒ?5„Ta./mn=0ȷx/Ňfqt>C-%V "0I7eˀO}o C`n!,LR#7R ez^-RC}ooSsHX{xT㥁o=Bl{ 3'2FQK-ۈI֤VZvzDۀRǧd LCDySI)mWgA= 2,Mʀ^eSF5WPYص=( *$o6^"!ԭ=YʏvdUBV n'Usxw:Eg*S:3'%SYG\֓k?t;vm kǠ "h&\TA^uz,Xsa6a64ꔼk0Bs7.2`)pYsMYWx6廮bre|u&ݩ^lPbvzd2P{ j;%@(Typ:HpkH>ML \ޘB;(+0׍3_(Bs.s@YWLb)+c+E/$vu_*->6Q:/VµXzTfHzu]GutRγTfLO2 i;x@LOhXhl9J 8~Yb؆LZx=)όɢ6zO,P8t!z׵lҎς|A-h}u;hdֽN vNBJoCڅLwӉ')Q>y3 N^UL;Z:[.aCvNȃNc[%DMv p;\'ALgڨpmi[ ŐN}R"г*x +4 ڣ+ &ٸy$}re~;tJgn'Q(~FG#B="B׃LQ(9de]G *.!Jb}MRC KΈxj2`GV g),gJ5tMI;P)|klkN:Fc;J }iF7R A#׸+_"Т|c1]5,`,&YTA|2*m?!p K3@-Dj,\eo8߶puwT)4ԁgA+>L$I"vieZuڌBLQo3paإw?r`;v$b>cH7^P | c[¨ Ab=:O?&3q[@ ٥eLoMχc/178LG٭0vq涾Z5PM|~j"$& !gl~2kWH03Cwu@GaB$&7,8bRfKg%y*Ƣ|̴|#|h+r l#f~Ѵ 'Qޜ9'İ&h8G8/{Q2/|mM-DX^܌7W]Bo+1'ڷyS,P~ {VXbq5+!^*إP.toR)"湐HuVydMv  sJUyX#b1NM?-GCG:Caib Yeo'OD{b!TUܐs" h]5X}:@ {@y)q9*4hŧsf)Ro#/lBWݷ0ɘ}DַrҊ&Z|hk2D:7"raE/t" c4?NOJΖ=7ZMgh/K>kG9kfBj6U_XG։]p"a:j˂ %u|xf{h_O& jL('zB_c ^oYv#w"Gu,-_6SFLY(6oa^4Ҡ M uAcgݹTa8Fr༎_b*GDuߩ'/rm5uX@0i}9>q!U0Ri]Z{(H. .mلb3mm 궙ULd#c,,wGsjiR&кѕc1u}H ++/b0ܞ7= K ӜAX2%p%Af%Y"lƗ6GWϱ@rY ڞcɝKϒopokRa& ʈ`⺗2DIZB'Czy 9dxdqP㛨m5AhlO2pU;˙{m}Xj|(l@^c[pD)~TߤvՐpIIqɻkW Fw pS@|d(üiW)k2߭ Q:4Cȳ.0/>zVϤb\m_a-mY3藔7MsOG9lR,k B/o]h* Mw%! IF؃A.z:-üs]X~$VxFlY]7i3\Xfɴ=協 w^$QmEh`xpL@Ծ )~,tbiq1Nv,A/q vɮXf3 O8sE+U} x薑rP$1[HWE3v~"],^QljWW؏C^^eg+W~/!č6+PZQ`qfO7&~ V_c#D΂ YB r `i"1GQ޸IysaJE5 4{9u8`í7N7ڛeR\n3&5q~BwѧFfkEK $(cd0%ҡ8< P5j: I͘}'qmdHH!tDGD18$戤*~`+7`θG`+ThH )$[V^KLDN%xΔ=Ҡ/ b< mEE֕->~x>]?,+Mc7+=LRAu*U:&>xVчp'hnhȐ0jGj#7#Kv7hU%$J[g5H% 77'Ƭ\W .ވݦd) ڌ @Ji8}$ f["1tv=tqy".o`ˤs[U{߳N5oIC$q>G3"|˷AmNH| 7JvE<*nfH0T*W|8K|!9%wsᥗ)q6O :.]zp;][O[-*ů!b"k̐~-L7㋌5{vb8@/ٶr yqߑp O._ US`4=$*ɺtWY P+ս`k$}@+*nQ=8Ge,uS0םѐ3bFGLX <8ESO6ed9XJBBJKɔ-.gk!e>Qƭ2 uX _ ?h]ڮf-)A& 06Sf|gtKTG*d VnLt$Qd'1orfn#J[|׋!9Wԑ$!' '۳7hҩBlԨW7 {joZV9;G[֓0^x)}cq\;TLy 'C%OIҥ =vӟzX߳ۡR9+ 2)  YjK 0v>Ӕ|[ZA)psF]ˈyYye=/_Ȑћ8SP iAe ; –OH,)!Mn+pg"UR)[pgԟ2L%so+{]= Ј HyaC2|̗VŸ1 3eNM~牐J1 :UI[(4M'Y;xF=]M}sD%O1iz2=[W6]FV9~ Z$tfuz? 6<8M!:B ՝ Uq+ZScPXͰobbnȇO;vJΈ\ fOy8xi9m1V’۫&6\Lj1`JlI>!T`tT2&Ѕǰk0 n-h~]V8o1tݪfJ{kԚC~WRxȱ%6U&)@KrVMvY:]鄷T?`-`c`"*MSз*k=ҵdėCI ൪~r)0.(*8{%AUB;.VfO r{$].}+KhA(Ξ4nEt-e"V+L8$=4{"gPѮaxv8ߊSc8׊XXY8&XH|a" EO 80K淂2W#\\gR@HeNN'1Cij߀[ ~bֳ9X/zklbA igy4ۃGz~ٗiр#v2iFJH{p9ĝhw Ks/M 2kĽ Z*+@|ssڼAS?r7Gw%S^G0k8jXP$"49{AhxApݴCSPޚ?sZ*ww+FeEW#Q2 e ߶=. 7 }mu0$Gʙ3X#o|cwyM )L^MP &l[XDϔ&m`6lظ$,}&XC!SDώ;/?ĥ1xIiqt)Jm~;=GIn-]yvo$̍0߱oBHsBhԵӫ#=a4~.CE'MdCfDhX붛Z= 61j3-{$; ~9C+9ڏ% IS_0N.i mCzI5n_"ڬi'ԃq~WXmLÅ>._G}z2~apQ{"5x͌J.>+Eo޻e&z=Ifyݐ>qer4Zu%9(&e3+G%3z~S}eh']7 M7:أycn31Z #ə&x [H:%ͫ&JoD~xivｨFmHnuBXDg޽955,7o 5I)c NeK/@fVa5(`P{PSl)X}Y'Q91NČEQ)t8bI0'<G ]5M C';F #0B0nc@4B+>Z&d%?}K˩ ׏viJ)\h4ϗ74qg4wc_Š"Z=R{MmV?s6MiY͘R觷bwT) .kR_αd,0yNR'gJ5"3~C[ akX?Cj_, ~覣;?Tw d?~VRK4&UYUN1)2n2R^bƮ8;Xwe~0uQW-+byLIdWD.ѫڨxr+S6ejb$#*d֟<+G~Eeia! 7zZ~3<\?4Ymu{Ğ;RF zmȯڢ|0m\ڍux`xJ#<[@X/[VhrJ-Q#^9O+1ӸZa=Vj{Wi:Sڊ:(f1`ӒXwy:ƞAXMq) ٳ# 6m Lj5հ &DE/IOLYlˌT"݇Ofv!` >Pȵ#w(@)z_tL*O=rM,dr; TgyTNj^OإGgQF@jR uAY%M RyA>44\q[fJhvafZ !CST^+v: d `9@rveC嶈xOWT؅IsfD颫*9)ޛ Z~gѿS#wX#L'xB\P)nܓhR1' gk ]C/K!|hQ~Q,? ސ'{p@hfM=*P`ѐT}ȕ7oAS Wu0Fxm.}^P\9FُKQ׳$ /e~$C7^f RSIIz;.] &[M624H_`QM)GJ_aS:Idjyp[ "l+3IV]w'H!ơB`*OοǦD:IRQ8iCO{v@+P= S %7f@xI9\]d,JKsҽTcJr`PCCK ēu:I/2L?Lc.l4."i9uFMMXX+[[3/}x!цPi"]cr'_(lK/ J燲i &RF[nmi6862s%_3ujۊwGɁA0KW~%|`oG-P72zyY DKEk 79)XE"?ɘ  9L%]ҮLZ~@ _Ɉ yijWTFl7c6R/o}_6z[ /S{ Qnm8n9]5#=,$Vz :#OTKNɬrXɽ)>G*rP in q'3Cq'޻*3vtA$Gۢ/!YcZr@S OӔp1Wߪj#c% և(v\MN'^ Gz~hiOx=6Gܪх0#lK#+j1cM#։ϰ5?-WDc*X"TDuo`2L`;Ǐ&_o7 jnH"@Χ =/~ Zi?=vstg-sA h| ;χF* a$'m W KnhZVf;T#n'<+;\ǔ't`Lfw"&( )zn)=Cpa٨D Ͼ )') )yKk٘=W[;v4pp9hQVbLȱ*%Ijb/5=՚, 8īu6Lec6Ke1%˟7Q8&wR0GQJL! 2=yBx@#2CAxtBc23jb'psݿUĠ kTTQEµ=I;֑B? La[`n nIVs犷H*I@5#{` YXs{:-vggK0F90V`Էr+Y#J])pL2<XB,. = `~ԇFP|0eFVJ.1e[ U4Kt4m4?&^g9~ٹJ(cd>&[g(Cm[Re{'b{h=nGMaOapus΋wMy,Fݣï‚ hpr3ѫFu*e "Uƫx }-,D텇TfTUqR6[ ?`"aTv;|X"$7auLTk& AtɞD+뾏/z}[$le>aӻd@Ƽ.\)F^ }?81|ԘY,E`=@bh< Uh6UdɃx=ڪY+x=(0GY_Q f}~F9L5j#Ow4s/٠7W_~7w/8 DY6jg$uA*욻07^RFXYeZM I؁`,M{mfO&wԏ~C=x,ړ˭h_/D? ,fm., sPvD)kCҴibtA&pјO ;wJ؝Gk˸5z8wj"笒;ң1ZcpEvlDqX,PBˢ۶vp= kEIfF^ϊ }/74aNBAƘ,Qh Az`j/9ŠGTA&z߽X#A%Rc|ZgC~DC[cf<ֺaKf"J HxSv1kgfK6Bl_$3 &wDDjb֓T֡χv@@WbXapd]N79P.-K 5^+b"!HLh}~^`+_1~p FZpvQ˃T%Fؿx%Ռ" 'sBA S@9&*j˕4wn<'YmdLL 1!Ȝ=.@Ϟ)8Wd;՛8ТoZÔS\b6a#<^Kq&/뺪P_?^vcog!stS<;\F:h;9 ]֓6Ի[hϋ̓ε,ObEUHU".hs_"ݡobo?>6qkH3Wp^2'"˱&\x3`r*I%$##7:4h lraWXVT|UKR,̹h8%4Xr0|%K*>G`o1)g#dyEQo=r#05ٙ W{L'j`+C#Ue2L0I^{+*|D4+ u~6g=jrf 2#; ;e!%C!]QvbH0'B>}}>e6}!_믪L>sNIu<bi3?x<`{u6W=Ľ%YM'OٵC{SBJM:t)R{Ļ!y[qojKo5;H9GZʠ??vu މVBvin  0}n'PTz0z>T&@G6au5A%ܦ9cy*.;8?o+e+{4a{-۝8=qݓ BZP{`~H]ݜlw~{q1eI 9tHe=f|$.[JBބƋFR%ŃyI$Ǭxȍ@[ N i^<UeziKJrE˻*~,%f {ԖN3>^( r!z6?i `n̤+k&|ӴܨS0iԕFs(~MF[Kl|+;\*\ &g}GbU7|JzI$r!pGXB<{qva,XFOWFbG$.ɨ#$r}my b 0.>xުX/4@ǫ+CG%Fh˕=qfy^`(WUa/zlP./[;LIJ_1uhC]0Ll5.DLH#FHI7/M%2 fN>\>d2Y uqη;z݊,q"qFzK0Y/>X '80Wp@VZJOaw-9I'Z ֨k@;9V$$IeL.jLh@Yp˫ y:@ zùmL6b5XWuFu7wav2h8,'Jo-jo_`Zވ·0BĴʴar^ߖY]ƋU312{GC M1 N4 NbJW>hg,z7"f0yɽG4Bo&SC]ٙ M'w]9!or5LI Y67bI`9 C^Sʪ[l^4F&<6JY*}_:}^Ҩ '/Ur@8#s"MiΩ)=wh4l.89k 'k6p35L'և%ky7,8LޑUxUp$ g|&5qZ$vQㄱMZrn!v _5ulGoMԷR d2#{"丐r>%VSq7ul:H(0/& du$*mJqK } j}RT`znWEF@Tk\57{wzG <lVb=`&$*x$)J,7kNS$P>טT&IcT"Zgoz}!x)K㘙 ). sZ.0wΎ.0(~,81]=&bw!uAfT.#Uh~v.ś9R>"\9!A4 M4OvNC8˲D5ZTkR ѭ9bcKDn^T~ XvhL nuNS pzM..qI_ꦞ0pOC7KVu~.v{BMޣ 働Xtrq0 o> p_'Y˦}ŋ߮ {Xa:0 .wg*&,vyfZX⣝,u# }%V1Sۏ8 A!z*q0[+~fE}.7BhX_USym3qj-ϴ <ԆS:Fx9l^%qKW^(vչ6?|`L9SE xw98tz3f]SL8 qPA~xm@4#nYD(㔦u裗g^w6O_Q1s`xJS|DgTkp!#L~(&E띘ESC%T*ƺ"U,6MazHTĚ44NPQ(ac`dFEbB27sͣ/pʘ5| /?"hf ::&ťyڝ n L3ff O}.yBar^g9'tSut%-zAoo!_BGPLރ\}千OvQk=mX`U !Yቭ $9Y#޳L IFzB{m/>x:E/c@%Iٽu>6l)(\sT;8E+GOrk9{] j5юbHMb:qd U# Nm(RO@$VC'yg8'`q2[7-Π&$&IwBXTCq?dgOqeap5y .D "? vA;At=) WR6wֳV)3{7sǖ)Q;n 4L~s"ݩ%z.c46:Dh?jؔ/CَWwfk Ke}p=LmvP E2RIq!:Ƚ0@n IE&c/;ʊ]\*$zrb"]]a_75@9B͓N?o|.CHM]eR*6lJ@0*\NU5֢7*ь\#6O?VU&j1,wx_Kq|z6DLZ޸嵰^pGl0rVj*ל%_3I@V#sqWH f8~} QMC"iDci!ϭ  I .UD[v~~O蟞.JZ:, tD:]VOTifj ?Qێ8z hZdwsD\pc@iӑ%C5q\ID"2߈*@D}Z<% 9D?壍"|YOt,emw9`<3G#/?:T.\Ki~sT}"EiDc%UT&T_cpB,ކ?.ݕM֛=}9 1vP}騜~1 _C9"o(,0ب#Fw꒙4:lfzeuWopaVpX=# oJ! )R|pS!֬EgoSQe؆Z fu*sC-2v-?nI$sN?@٨ ]yM\e"|Sωi߻temX E֧%6RȘ}&)xFU 3Bg`f?aBPlE>Qժ6]4Ҥ@|İQW@pͺ@",bq/OT4EQw*;ߺ}~(jXZ%6*]u`}4> [W5;B8uo\:8V?LI|{~JkQp~ /8~Or""y b0 9x!\I-JXD;30b?M>iYaY{`a- S+;Rۭi=3 ])޿T unj]O"C=wb umQ{{=E(&Q hyV"/94WtbrhqWzەooڲB?س&]2;"R / s)8؂^Cq U*ظATӆGnRF@& 3Pi፝ĖPorIf#}O羊<+0&i>(~k}|-U!+w42Rbv>C:d ,˃ht`t}}L`Lf:!3R#;`m @=hn9o It.m7m]pP.J|ňX#z^0~M}j}h վ;o `&*TuHϏlROg5 t!ʵ= % DcY™BY EQa+3"H8;?rz;?|d-};V'g2IQe"[k4+Z8VAPj-D 'b3'(ьhKe*m7%4]Gr(*c@VH ο-e|#j,oFS^F~į"r>3󀆧(Z}GCG|h~a^Jy*#u@/ <2%EIOFQGz#6%?6*$:aC9 9Q9M{2ioAjLwp\P)^qy6m>"60}|K&²:"b6;ʵG%6bsV]5c|Fo e:h>jK13Qj9c#񅫋u)d:c$ᶬp,`_0)@89mPz-D, /_@^@6yb*B//r4§E%d0C8Eoƽvq;YT~GD;xu1u 4ጎ4Bơ4fuxX{?EO)ݥSKwUA.m#EQ_8_PCϮK +mX(d/7?o\ꇎR7ğx@ꨏ:xQY mDB8b1l2(.?uu>roKa5"`ʻ+J$Q=#hҽfK2=OZ$_EGWRkF Ov&4RMc]ۃb-Fb2a]Fh@LhYu+k/2LZ@]EJ>VSѨXuhzqIF6"|/(?t7cF0iXi!z|\.&?~;>r-Q>RJA& v'iUi[a4[FSt1W.`|Jl眘idҩe$>4kl_:^cOWNK\8 t"M02PoI׶sXHQLdpcQVP7 k4@Qf0ʩ4:K.1v{s(tR xO,c#JS$R@!+Z`>]F4'J]:z 3n,muݜp*?%mSU gBG4 q<#㛿ix0oΉ " RZ|p﵊=:U<31GAٵv3!Ek g DQi>hT<<8`*h$ݺ'_HrUZNlxcr^aWJE\ͷmL3*t7xOA|ջ/9VuxvQ;&}˖b`fJ@zn;U?{A#pRzl[s3p|6[Y' gU(-kyk~sB<\enJ\0lwAXiђ?lEwx<GA}zpS(ڃEBeƍ 6nDVu CmR"ׁ<)%{,@dhY#ݒM(I󒵆'B Ȝk(y &bѫ%%ZmGlrwu]?) ј< \;Z$:\`4^ PuDZLN!ʓD[;݅ZyEne 6kYD>-`2C#Գձjb\jTT&#^yPK K7\XA V'\w HN f㰨WDW9>DĂh#(k+ ftӭ'ۻS[Tg"؋ Qp3*ttc‘aFQR#H`Yʳk;BiN:~rٜvT(;YpqBgkoOxѾ}hQRP7lYԍt(BdӖô\mhqE/$e_②0-33M {[NNȏGP'y>Ѽa.[󨛆߿ IVo!b]>":PuF$:'*[S3d$cQ f͜f[@2h ?{W"y$to1;>VeU\ +$/ff,XQ)BՊMʢ lw^雠`U8:|I5~bƴExAS*H>s=;A1Jc~Ύ~:+yZmm̋lxzdBxT(\wk 0 2k)zkT92>>T!E>A#n޸87][8|srzCR<\^,=7"C gE 5fڕBAsbLs6abFLǮn-Y؁`;bNش"H M1e:s\u7n,[ۢ!oL xqrF's3XwE2 __Î `VZG`,.6!Ozgk30yQWZXAJKQ(fct׃^(FH1 J-kq.kK%:NU1(:ZYeuDPa}VKzHQ]&p2 ӕZ8,$oT"ќk#xc UP[_ׂϳuYFW+ v5*_H =Khm9-rݲ`메O5ZiE;:0+ukIT/qDEstWՖ֜:<[zu>Pǚ&@٢5}Q<n%2S7xkaΛ_.>>鿵tQ=\CЉ*((DD^PH"I%}ʗT8ezzvZowߔ\Dڠ3 $$ի in 2̜yMXC #G:T pz5i* Lp@>f>?4 ,C=͸,;SԐ<-2c?aC\oXVYi&Qq>zCXRX&nw:&bDa2g Mq-M§a۲f0eҤwIfEU顸5o$KJSW1S40P&_*vus.4}qt]o[2RGWI3{S5ϴPk \YYRh?Or_P+Y r[- N[>G݉a/M1<)5|6{޼ˬ+D~{) {>Ǧ 7߈3.(U @'s(kY53$%pI[XtiH~. rS-ô*%x!ӛxWJ>Bl* @RH,/Cڬ,4wQpPqYڂ66 ݽ7L׬1T p􊓓q]\9"CZX\.ֵ Ff_xK7d`F_r*JBLFޞARfwߠ,v( v5 UviqϛuT#JEg?'6/<(dW̶|hS%iֱ"2xʡ8ej-5zfAz[Y\FbK_Hu8ǨLt~UZeߐtaQsʟHyZ _,ˆoo_[oR$9wz<b3<탿M yQV6^U~S̢:I#'l,ܶ6ϲǒ4u ߊ]e'.sF ~8tB\ȢXԬ)uBLc اMg7b6bRJ  EAcW9JV:%cZc /B:N]μ: k"[j(k.S-=7k* ﵸ<1NOVB5hW藲,vˍxη6ٴ|]R:69 yHk)qH>3|.-d68!>_ [ñNǎ6`43L!(Ax5٩%6C6T-\mHIds g{w+.J0ȏ\ʢ)`wsGS3U's,g8)ܡt?N!ϛ+ IWz5j[@.Qx;'. 8fй݄\lv"wڷDbEDk$,Ufah[4nW]F`=f/YB^Wߩ꨸&ϻcHbe3,D.z zQ&]{6n7w\sq+,+1 åH霕oWJ U:E4{>V1n37P+&H"jü} Pk_pYcg;AG:~i/k:SLIp f&/VSg`Ҧw\Y9#0~ef݀YC!^?ת#7 M0<(dE%>ڜtEըz\\gB讽}m412s8W}7n'`NkcNm$g Ҧ6RW6mjo ,ʘֽqVj-/2{oflyBwU|NmPQ&QFR`=0|2M 0#jQKDŽSٞQWQ,u5{T\ʆ(ǥPweoHs+?ՖX:OʲuQ 4پѹ8 6'6.3Q$E}tnf" |EVaX˿9oYHMNU-$2muG ZF4-v.(Zv;#"!:2"qnYqUv2JBً57"JSFͿ>ϤfigZ`'{ABW"ѭXǨ}k@D'O,VL)%鿖;k/?ޖNer֬W!p򴰻OjOTUHUY}-~)1:04УAxV}D|}L5ZQ=g]- 9Ss-7 FNn 9>]&5nXସi9wmϨO-qQ9>XNABQf:9h$a+}EB<I姐U?c$+& y~[]=X&HM8ĜL]T 'S+ ɵ(.`_"WIZи{&@`1h[29"СOgI)rL4lGW- o~z%A3:xt'Fh9Ijo+iY:,(G3\%Qp MMVn>frWZs A]L թK`+d/:;r(f|C?EvBj-ѐ(9θ: \EI[U7(vTq9@!raK$ḷs謂jkkU $B"ٟ1+jT'}Y`$_o ᚹǧXn63iIׯ͝YbMْ=zwB1N ށԨtM?9Dt|Q* ;J'0U)AMWmR! 3*kx]~, x XUy,Ǹ- !%b vJh`Oh/3-sU{R\щhy8.}\ @̸T$AfRSd d K-C5SX<+$#LT Ϊ&ni^kFbfHƼmm0[ <֯|Z>]uZn#D|{FJPjj`k-"h흟MwK83t(!#A A#FAC%Jy{՗) 2COKB 3Ÿ|ez7\8Fy>-@rl`*ɰthYp,qI[^ԙ׷0JD{tOZ+0zz pfUk8!&y[m^2G}Wnx@T!I@-lz3t$|1e/hd< EIeC4)`b4,5F[R;ِX䂔ֶEeȣ!A3mu.z$ ?8Gl3i@O@V$Tq7<@ aKA®UĜۣI_78 0kvx>HCu<NUv Sۦɀet̽A siZo8u.h]'0"6I6h$H"Vh^ׇ'% a\ 738#Y<N$8ˈ Ƃaϱ8N\p ]_ejC߮ ^/uQ+`8<7b+cI`-Za*FI<*Wp憄4 :=l똯'_,tכZ҆W^h0b(eF Ѵsz2P*ÞPcCKR+#kǦ2ީDZ4ԛۈj Rf)ŀ`N|J~&fl%LfEZsX<5nOAiȫXIx}j{^CeXK0F*~~ #=hݚ E]ǻ\(x6zs쥫'߄#Ah<XAwj;2Uk`7'`QG JpdKzES- 5 [[8 0Hr0>_ TFjݹc#<Om9 /UJ٧,#E Pi W( d fDD4™V(g0%S^.}JRou[j6mT\1'bhM<ɾc;!1Uo;+ϐ5E.;=p7ˡʯ N}$x0u?"2,aʾm2YG&' Arn0䱽E*xOD{>ln| \19h] (Km=Q6A2~:Z?bEsե PB>-$QO !ajc>o7~4*žg .dq 2`bfqHfQHD>?=nb6v9:zw`[Ow)8ڥ>'L"G9:(}@ 1(EnV1 yH*^< %=~[[k+TWkx0{QՉJ/ ה8 '\5S7$sh\s9y &0 P{ɥsP ;D0(PTÚwxN8էG XF^9ԇ[X%W(7F ZTemzӚB)Ы.뚲q<^zX,46~t ]Vv@V yyRaW`41Cmϡ~)1b%2`3 djoom(;T$~j (ҸѰ+t+ːOqSzL.YQI+clnd9)ʫ_|#f@ F}z%Q ٬DvS./15c`xG Ř9~lϥ|_֥3CGry(u rCn$2;B*/߬3i%/l!=Y\X/v"?PO(<Í8^+mw/:aQn駽B *CBg3>gCcۮ%m7 Wx}zAf֙67GC58bHe2-(^!L p2²4'S?ƚC5)WP ,Uk({=pz7i{8qԃ29&xp K".:E^QM}ç)\*%W^hQ]hv&ӌ`<?6"a:]S11\og!?u.!x%QLrI[ EZHr؎ݤy9񦭞W7@e2 XAyK7тHOD',:> jh1/~B # jPE,"{WMs`Rݴ%6!JM>\Xz(׊NPR w4ǓCTxȢFq# Ĺa& =^)|QxgX:?Zg ^/I/>sii#.8A4,9)mf$33(9 2(j4PtjCKԉAo:v({ 7? Vإ)+<bd;p@2j$k{_[/s djV칸[ _ށ*%KLfҋ_"GZUIZ=J{Ǻ|̹cb"l;Pk,^PL“pDQvmiq7zLBxW\kgDI&Cy.LlVd\H!.Sg}9v&6>4We gCK\1ɛE7vv;`gS[Fl"I4z}Hx{*T7b3^D]} ּ\.mN]Y/?}Ӷʃ9w"޴Gfv0oexG O+Ҋ$D}]g瀖G[ehT ߞ}D3&\$V$YJx@+N9Oe&tŘzB>Z* 'zA뢩AcLk[C Mr<9?o7NjݓyDcO >]Pe?mJZ'' |Z@xJY=k5=b p$]hҀ#KIZyCky|2ʼ7{CiXHâ:\yXc.&+1$]68?EdA{ƻk|^g[u7\le} K,+ng;Dֻ)HުaDbs3%/ zDkYE*_9ZlPn ۋδívӉ<ǗIBWR5z5]$0Wm-X.0F@e\fQ0TF%}1":0B,JkgqԸR0,4a{+P+ypɴ-^?Er3@ tW{IEo8Oea*oz_Ԗ3]eh5fTIt*jp2ֶ݄:T]X+םE*([R=c7=wisF-;`wk1(q"*tЦ&k7`S$e|#7K+[)+|+'(1RMLIkv}̼v,)]ہ䋮 @o)XH4"p{}EW/q\Jg?_𳇵BC*bR"X?l@e^fw MY4%/?56,{ҷAnM]&kH'a}Av ?@rQXKqJV1Ua*0BR H%*~,ȟ b|"!hnf7?'c3s3z63[XJ=GfXt S tE2K=;F28SFOԔ\q."R* 6Է|g:ojU=gWiNET/Иԃߕ}*qؽHֹ{Y<452Ɯz|oUyp~f_Z%d<(7gLeV$[mbn,Rn4K`aU9w $qRpϏsPt;)" Zy&K123گ. *߸oU B) *):c汝\X=4ڄRAR@2EhL&DT~yI;lAg[^JerBCDǭ ɠ) HE+^sW9;,-ݺ>ƨ]+hzERSu{R\'_= DU)aBZcgY~B0yr|L]S eCԠqhl6s'#NRq}IZA&ޖ̛3;]с _j:| bGPv]$!.JH _X9f ޛd:+*b,{;Uy/h>'gY?9f[^`̀&[svû)m,uo[d]I5qRUG A }H$_xJ^ÀB&Zm+q+hY+^Ec%+N]do,Z)lcHp?OK;K&h{đ&|naJPyiR.,Q p8t(r?+,x@M )oz cSv˱$^(V4S@ ŋ@O=p1 g`;~ߢ; ~Y0)&úǻ]JKDlsf}i]aczAЪT7el:v.7r€͎NzBO4N)K/pçCyWq Lx&P?(`ۜu7T<,IGH>VR֪OmK=Cqqa4MH3٘ԆцC1E*湜__($؁n $ay$ixv!yvERH7zZ@~[_1:qBm5i[{GnFƉdN4Th%GOi-{w|Nîxhe .63N/#?VgJHjo#9X ej! lnM-( (~/V6MT0QDik[p2u~Ŏ[WjW>hq}_IfZ\Bzx~ uz!}z^6B+֨26+lS*r8 !y斶"&&1;,|ijјגcË~C6n9WIhHvgxP8Z+I\X"z!BJwz0Ye7fE]?\D9y|eB(Vf~Nk6|),kj=Xn4 ХWA׃pƾ8S&=F3Ж8|! [R9Fzla/쪃~͟G[ М*Cnb3gՏK~UGb-m1$+sy W0V$I^)mp4h(zJ3Uc DSJ­0+t'a#ABlDzp2(@T ;Ɋl˒iDĺ0Qj3q"QE=]Xl$}[Oޝ ,vGkgN壙ϕ{TjAyem tOcWPB9Z_3_O9d q"w&i>ބ>>FkJa-$@)ik'q+<.%9DJ@KyHsŏ&EeҲux=zX\8҇e2;oT\ MU߭lMqGC5PIBZ YBzq2J1\b<39|u#QZm]>M#$v7pHA L2qzdE“֬iZ,Q4&⥂*lP4TxN'6鼓Kcqm\WQ$߰GM~GOSg?I;= 0+^tlP~j=Q+|LA=t96ht=2h׾)*3F?w[ťDQRtc~6G;mo(iJ\($xLp:Cӣ#{p¡Ma sŇhb!{^M/fňEZ{K 5oRy{SY&l7a`Ҳە7SAz6lX IC;QS\i^Cwa*v8Zf~M<*6?BM&Rt`0O.rRk@#ȿ E÷Zy']iDJKq'ҲqO/]i!\Nk@7 7T]sʴ>ѵ=Mf|\n4Z$&C%szROTG*Tޠ4@h3)sk|.HP[ᖞGI8EZ \j. ]YkeSamے@%}f5MmDd"3 .㕗Lv'ec9ꝺ#&MN q}^Z gy!6dӪ+)P.jNa#8(MH?Do2Kꯣު`Ũy)W7Nh#&*ͮ?eez#$[J};5']{tgAbćYUmo#ꙷݒ4Y̵Fl)%\ܶKJklDg'EWjdy[R;nTӍ-b=by:|fK3,22k"s'(u8g(萕S:fÒ DEB4,OxJ҇ږāO~ؾYnf~VTU#+40d&TA,c6F ҤJ^4@ّ+|{7н-Y' {wNE9ⓓwT;)ɿ) +, q>3(Eˆto*J8u)ք.7Ch+_S.5HBZo(C.S5o)h%G-oqWJU0EtgW"?Z :]-F0i]z`;2|EZeɌ#5s. "Ө)"{}~ΘA"%*Ϳb:8e(51'\ o곧g,IV7)G^[f0j$5WgK d kJֽ,q=.Hv΀Eѹqt%` n#~sOm>ucvI؅H>"S[a QZ6R4:Je$n\QQC0NaBk`~h;FO=t1>F/<]bn9MQaPR`q ю`5'ZɢO#g13FӀe1_u-!n$s=-X XS]u7S39yvٗ%HD (psz[Lutv|kG't(SW,v/HYG5-5( Vd0ƽ)$a+x4+ӑΊkՏE+n yA_̃_MIiac̴~_{Ύd;as&Dzȟ1Qt+ }!)Y jZ#ѨAa{palu!:.WTԧZ>ɗHR7^\p('Op$y(vNm;8p;\&4JV%<Ҡ9DB qjK uPT`R=`N!P~T  vIw53h'%(-յA(-B~"PW$֌k?TG{G0jʼmb^ =~K2BҘU9xv;>ٮ)5 2?"Vr>eCd>6vD(+Ծ{#]H)Lf'+(6LͯH3|D ok\R=DvV)P{rN]Әi ]%~һ?hLwe[_K3x0nvɦUe053_ŋޏ+l&)kȱ[S#|L#翝 9L>bQp6/z]o%Ƈ0ld>I@GG0bcm&? v /g#ŗύ-MH8-ZX93en\9Y7s5{UN+%B̢ljۺ䭼 ^p"m?M'Uښ]W?{7OKtqn3W*H/fdeiW.S1n?^2LٝY,OvWle>"y9~3 +×3 ]pD!ŪM$kZI ĨQqsmP&.B|]Uyﮯ]Y>AC,Q& / N+yp6L%v/3w졛H>gV,o֯?AL!¸l}HŤja t.סU&uww\L&쬲[ "npa+2Q&<)RZllkJ261 u:[ ގl*g0::#NC2?zq>s ,0]R mfA>DM5Cuፓ\@ .A0V|t]-a6.zSaUBch5t;Wm :˞Чq*@\W3rw%| ^SxYc=Lґ+mz@j[riKL /P8 Zg iCNEwys= oʰ@.໴˭$g ]{%p(]'Z,b؈f0 W,i6Y魶5*5{hsPz)|jEt- XfT[H8#%Ξaw\pp%kP,7a>U^׭P]f{<C-DG_j@: yy}ktg<[J6`3:F?n!i<]ى}DY0~~Km'U-9xEӀ0W J30[bϽ+4[yJpTBѦb^fOOUyT#C'\aEНswS?h7c}'٬N' 0"3Q4&4kZ+rNSAFIQfR^aYruQ ⥍zY]G/GQY_4['muc7D$\M\ *O3WiT_ R 0? - ͵,6/~(e'x41aX 8Y[dUe9mm>GSPy$waO,~ )`;$$ )S?+JU2e i g`ˆU:iA)a<m3,L|4̸@.g[C@U "n2W`ubSO\s}_*,SQ?ʮӚiHN5Y'ZY̜dw`ܚ)h0 "/biN"bPK{rt=99V%815׏*)tk3 v [`(akpE|%+eQH绩R$|wA}BOOi\ O[q7ၨ1HyukdYx!dρү<\5@r'gEa׻/Adݙv/U6 /݆_.Oi @vŅ²nߚC> ))xhcrpPJ:7u0V}BxNY։h[RՠDqLhh< Rk1( 2_х}/Me֥hc%bӀ%:y'-SЮ[5^-z%VgPc8IFuQ.v FT,(fSNZ?ښ?"۲EϏ?AQ4ENYݤH: .k(:eWؽ ͏W7/"Yթ^lpUb|WnD J4vDÿq7XS.c;@먠A\`é+>K?XAaVI}_XY27rѰv*=_-:iEkT0M|/gp'=d̹!jql.G;xeS7*VÂNZcC%ӹstX(@U>K>q+R"픙1ZjpU,[QhBF-uAI L,}a_ \MXSerZp/s?w p)s^=WyV< G>_J2T{;Vk#as_YzSQz-k4\?ѩ8ڍ&?T.`Y .uN]7Hb8Y4]8?; ^ >1Fz7q)eޑA0 o+$@1d%ŁW.*1RW (8Sf?c.AHNz,';^b.@ַ8/pY砽IvXeZwy$E'# δWolv7vo@JWjԑ2utǾhdǮH q΄l4?Rb$_/^?e;TX3ʫ#ьA(\,آn]SAcuOELdp>ƩIS?p'%1q~ 9^eZ,AgJs`D@PMW8}PAs~3hJ7;"N d,]Qwq"tw5[L6u.#L~і:p@RSw3@Znp P^ԗ$|}r}_LB xB?HFu$:^SQcnr<,aFI}.%aV'lr8TKK:PG 7!w%q7D)24{*=P*<@n6sd{AQU_|k]bcB^ϖwN憬'a2RD 2*X@OT,P':(WS s%.t}~9BRvCrs$5qJ?=5qZ9V:rk1r#{.mqZퟫqb8;$e5Ū-C#_ W6\( /uh ,!OQS@1bCA*}}ZjX|t㡁&A*ធ_'f5IbbH[!? >Y]۔(ߌG?!Sڑo/+YĪs O*;"Nw%nS=.33`T ~պZD-Ukd]M4Ftsi"#/ܖyt0RD0 qn[rƳ!(QTE[wz}D{:Dx{lGKw46Bj&S FugDPm+jP+@(3il| PɃ@ZS TCB)oFv< ƩO8fW)&4;ɴ)AS1U \ܭ˗0̀9lPdl[a)+e]ʕBŊp p7#BnN1(zҒDjmQmƛ Yc;*hԖ2dw>G[%=jXsF8Ɨj'`CJc؈f&b9pu1 }{Я҈N\w &-Ĺ#SroM H,I*E2]Mo.?v׃!P7#o阏dTNM#fm5{)E{ k9ctHh"f(T2]30jWIc+ǰFYtH٥3?7R7yܨ/DR(BB bkqgFSsIEM%/od 4ռxY:fC_Hk޺gGw9#\k¶HSꊸ9f$,4(o'kX: "Q>,6Ek2S5y\氝`i a.=$]&HexZSJODg-.ZS W/䂸nv-(ø$[ԑ,kr"_uR1u-{PiZCFս)ijF-:<=% sƠ?M >NLy?N\ٝ#0a[1\ְ,_?i:͛37P^'bݪyS,$!_ȿiS ɆڮLޱAٶD ѰBh};z7pթF E h7C_Xv AFkXHYdv6E DL%2mwqdn&u'\Z"a❃iL*/Fi|bTa3{W1K܇E\,W"Xu2SxTe|nO+AGؕz\E %N珧X)Imi~Cٙ~RݢrJڔ[Һ3S 6Ch :oU5hCu{0cB-8{aW=dp,T-)FoΫ?CU8ItRO^lScA ץ·k;Avښ~'B!|&Zg #B)FyW0_QwLo,]Jԫ}QrVʭ= jpHfzˍ-j2(V~qxWI~̷DcKbB(ŮԛT,Fii"MSiǒc80A WW:;.ǧ⚕'ڣ8 M^ uƊEV'9E.g#VNjޝ4:ƽc5[E>rA+7G%0{_P1:1#ҎZ8fħ 6hK4DYeϠ^-VXFiW}! W `]/46(rm6H|.jI 춪R$lShqEv?w;1}5|:H4b`yz$ 1VfF^hCxtLU`˚Af^e3TؓUQs}FpЋ $UrQEXJ헪(Ņ+WN}b$[1'\#U- t֠o֍櫫(m@y m(0}¸qyjv"VUF+ˁq~YAbl8W 6Yޔ@ߡhm6<'·Q/x9fHVcm)wb3jZ{r2rʼ b|:N}$tߟ.lgS{.^hN*GySe3^@[୍2&bZZIi1pwF!ŧw! N\nŋq+]Ԥ yE)YY7'p"G8P~s+xx0v<~Ļ/p{<:J}(sQ]mW*VR߉X0%Q/8 [ ip`/d9-yiϒU<r>M|nr"Ā2ԘmKǿ~S=O6XV^ݦxc$iTlvIߌ ݛj RrMB=^N.|){2LXBkz$q1MR~4PrʴΉ:,S7yo `QW$z~j1ǎ:mHzBxMB뽽@ Fd.~=S-<+?Ĥ컽ʯoX ez6a4}f,a\QhGY&|<٠)p )@8fqA7X]ndwI:|𬊨rw  V4ڤZTI:qVܼw6 Cݭ?\͢BoSz=&+ş %}M8ƫ{O}܃c+Á(˲$w`Hŗښ~>BmW#E:a}rt,h_b*-HFB2&>!J]ͧ31X)' Oѐ!}39c/}[hF=f=HAhͲ@d +U33`')Zyڡs [ݶ?x銟R|cʲM/&ؙ]ܗ]IJhh"wϘeΐeƃ<+G("#)}m+ Aw_>+aˏa7?op3ݣ8 Fx 20H_E_pە`/"6i?]3+=g}ԛ.G9yFhI ˙ir8B;b~8p!srvT@>ݟ  1P6v{r3^8e.c@{ n+jaڱ7JM R H~^}z+ŀZb&䅬Ed)dXx\(TSFS€6|O``_Ga[G7bT0م砠aM\:W-/-u`Sh+:6TZk=DﺤGSTXF1QS7:Q3o(#K#TU83cL57Ǻ\6 /OMh gMs}S&wԆ  zw;/$G:" e nA/w~R 3)W Nkujĝ?tdQ չucmmcG{mvri#3.xv8/ !g_%2l!\]ÜOOuBTşsWZI2t cwJ{hf Y{Λ?:)c(O zOZ{S^'cl=y"0Wn&L}es ^#w\%-1dr[&O;ќ b]I\l\YHsd1)n}͗-~Z8жуŲV V)dO舶 *08"8(xj@@eu ^ׁЯj|o`WRz;R``ku1 )].Sy.bxcM =^l*g#^Guv룯Vp' ,R6̺w \x8~*`<•I<`>JT}.r A3˘ 6/>Gita )*n=M5}5ijI =Ww)RfW<e\6f 5C5'|& Hj?eL1oO t̊hu-w|%_J6ay!I`PM&uӼ(@QHk |Հ:/?G#-t 3*PQs촰Mտ `Hg'*%C4wkK?C9f!;:@hL3Iǭ<҂68bFWVLf6}_)'`UI֗x`Uzmu/\w5>Ѷ8}ia(F1(隁_bXܓAکoƦe>O'k5cDRydJ$U̍%&^ڬK%Ì~IنX#l(Z14 \^Z3M*bׯ6vw|p;nCk:\_33xBh ?WXK9a(饊;84go3P,+|[_U=1}*C()5S\F|Fyw_Aa uA039&!}-~$|2y? _ܣi/]bÏ /lWVyю.!~ě=E&"$ʎdt[G1>b-p%A: <12c5DJf͏#.eNnrTpK" Ja݈q 01Hd^^ᡛ D9'tS&4n ?MWAcЭOFݛdBVնҾv>9oj F(,^Zskxҟ`Fj^^ˈU%Zt櫌Rɱ-K^16jF2h'J-21fⰝ)g>[Qa/,R,_CnV3b7*H݀t;o3bGh?AT:}HO-H>^kZHrtc]DssL_-syV:ǚsJ (; z$awֈ<J!3i }nA>嗃͎B{4XEDrsZ_i$旽ӌr@r숃EsM8#vV%:Ӱ/㓉y `e3fvX.v`E*M(3 өKPaPly__Sltժw\.Db$|*Y[="YUN^۹,y 5"$W ˄tiA6oӿn1RjЉhiϬb"\v*ɍ7>^  lbUI6Pz TfO9^AHGh&od9ܗ8 ~F?a6/6P7JUX7nG\Hҙ2Q7ĵY*;VW!Wȝq$D) 0wiS*6Ko'/oD_~ ԟǐΪw)3F݂:̄*QjPk0OHP7?k׾žB7əs'/:+-Wh6+|VUd]FL'=j~gbCpHYȳGUxC;yẄ́eu4ķm&f@sD3d:z$KL+ć?.6 BuEVVF^[i.4R z9BY7?!|z>qoo-j N;m *THjNI!^Lzض>ble3 T.)ϰVX+?*,Pp;@=+_Ĥ`d%up}8OF y+DZyW,RXJs5%;nƯS\IAɄ~wJG܍{LQ pvHf* HmI籠&>G Sujg !EH &W20vx:ns->T=)#J +d%Rx&ӧp@@QH7"CЄReuG//;˰SQh39[M-K~(\o֘a"-9g)RNJo7;޵j܏2˵|)b G{.%A[|:{I2e/1\%ߥ v"ݺ\M:6zd+:AoԮ$=DD^7:CYKsZ81(Z:x.WREf2bƋ>PsF\ qD˲3ջu_MRG 4U43 fo|3V&!ˇQqn'@ x9<eZn>W@;/@ů2T/f1112T쐚yLݰ> g:7kĥTI`RIۘcȯ΢P-q:%hu%%aԡĄ[tIG.=\$,OȑxzH 4V C);PB 7^| clT+Dm7T~ʣf8 ' FOdunNx(B3\CCjcv&zBf_ge_Fz2INriņ*8ŧ׃e-cǝFTuNt7iUj$1F ;;11 Q-C*Q%h:W=cdPLIٳ}իDz4qX%ҥ}씪 .eĥ&>,4m% h*hvKPKZNjxATv~QnQHWݹ4|Rx_?`Pޛb˜(=s8ھ2å !eAq-@7ia<>k$l=bD%l,tX/|j?y]jmnj"߸RFTW{ln/rBSr󣞡%^AVs=j*CET~W^cq_sx+|hgD*`p+ұ±_Y=3Q1DA4qnGm ,D'Uxt< )9m0FkBپ8?c&tt vxt%YYHÜ} &GaH V9=/m tL};|? #eʂ4q8L+,YT+-\e"cw\WK|iB蠂ZJ@ngba6S7 Csaer /*ygVGY]aPu i %+~L6ñ?#OpQ|y+0_uDA'ϬH<#G9J)/2z>&gWB$Rw">X"~ 1 AH(H/'-WM toG .:EtGQdZg?<Ix'  XBG1k]5#MZ22O4l=( ᅳb\82rNVFA~$Twoe/"G^Qd0#i;أrt1Gt oI@.Oz"ំ'iRĖ^C]{"Q*hW\.ZC'7cz+_Ζ&ScA2!I_G)3;1P>UbvK$$ubm?.-Qlf7S A4jp 9ǔA!(NfZs7 -:MEٞI8)AqMFXRqWHy hͱ ,1t?tc=u2E1:d v0"Ƥ-$=-^(wĵnqWca,CK8Fm~,?8\3-f=(g).oJn]t03P b7Lד2GaؠyD9Kڔ"'.^ТU@[=~IGlY#A*RԳ$Z$v kcxˉ0h%O MJ 8]c-xe}_y^fKG%xG8+ƴDeKM{*A#V ]mC6!oh8<}g_gӵ*>=t;8ia+ID_6\v=a,n$QNq2"ɪN-jC :yZdowrP@>Kvw3+ؼ|tADy{S `9 PL:(?Xdi|,Qvt4:ЂTźZs 5B$&).w&|+W*}qۋ]!1rѩvwb4q~ןLY?{n6^NÀ49go.k-f%(Kϴ&^ŸHMW#S{vTr˃ޒCQ ے(*ρTHI-HC)S2 ,Yקwd\(Un ъ2\=UDlF6ߥ聧.j鿏ܘ^Gj{`g:zМo#J ̊|L{W!-Z|9zˆ+yVօXݿׇ2o\7M#uƩ{Sv˖7 T d^v;]WzXllI><"EI$v|W nwK|X &7FD %dѢ^3#)}Ζӕ=ﵢ D}2Kv_&l65;ʰ|DCxCPmrQmb0[˹g(W96ac׍ TX/1A=6'(Ov '2o帻u ݋>S)TC:ۙxe(T.PkOM,p^vnOp1E$94c`)tKb2L] Sќ/,lvdzg2$*#}|kRfL0{FRq"*.v^7Vz_",_W?z1cHkMחHDDWw ."W&r"|13%ČuBSl1QS=A=HCaƞ`?Q*(DMzt"J< vy&RVr>;A!fP *,ޱKvsP%{؛NM?$ eQ?PmG!"ȴKeI6hn;pȤHm={A4~IKLsΦLJY//jWD俻E2rթ2%U[ P9qCl2T26Hc!Lz73 u\Uܝ5q0j۞&]V#`:NɑO9vC` ]OPr1PW/ȳ c iÔYY/q3s dt ZH+ ~!eOJL5agp}{WzL~@x7ricOtjY'~AdkJz56⴬% :'Aq37l20ũ̴#kO/+.tЪ]E>9%V/*C5' 6d9sϓ3xKcK%+@+7,f dɮ>b*j)ť(,";[&&ֵ zZO ssÈx'BqMd(گ@ۊsՅu./!zwiG$9uifb[  bIpzͪk,LpqU#k:̀^H*%ƾMS:ojq)_w{F $gڮ|]!c>{l`ԑgtM-Jq09O6PI.t{3F2cT2(#quglR2Ѕ0 ~(łܤV2@L.BD YCbx vbC5dߩDzrd4% *>I5n ![rhݝa^"$fXA(rٶ9) ;'2O۫xBDFl4mApf6䔘 w`lN6 1BJe#'DjN~~Y=}OSZUkǬw6UpIJ+Ȇ Pj;^1_Xth4TG|uঢ় n9  wؤWb9U8FAP8!q_V Q9'd5 NL4Z%V]~orJ+1ôW}Jտp ϶6 {Qȉ:wğYH,{N"61&- U:c $ `UN>FM8'C]t!flfQ3:uaAe*JIq!pR?Pd}]#NRi5."j.6 ~=ֿ"cTw}6QG x1Mv bۏu8xα6Y~gk_PM% /< ={֒l}P6]td|5/-BDzB3u|'ȫ<סIA1O.DQ! F^F8]tQϵo.e=əAiE`)8\|#VWd,=YhtƩ4^U u+$prUx~S`Уws$ˊ̟"G0:#mPhwVNC}4(x*载e(igQ;^x 9v|ø.B23O //G t;ZdAhjW3P2zTnv7#woBw-sH8MQ.*kZ7sR@uVlL#} ہ#`EjdxđM೑m> hH'pn`D(_qD` 9+{\[=HͿC #,'>k5fj LEW) iȚ(+Uo%Q=?C1{tGd?uKu`S>z>ն)^匋M>ޢbXӞ.@9?F=,Z2ۻ{>F8x*P"u*($STxr.Ǵrt!O#ЖR> :)RjͲ" ~&Iy(դE#ˠf:RhOwT8$QryyX3yڳ q̜uƃΗ=R.Ob羜@:oL('SNG@2G|M?[P1sm҆n4'{޶TRM\?#"$rwFs d.'w]-̷ NIte%8S"93@ᤲa?vp>GX&4/|Qۭs5kuxY0Ciypp܇ vy?c7Fll0"w/&< C@E\.ڣnَlo-D7g|\b>n S~K9q0*b>CQANMxjd7hP>ûTk'Ʊe+Fshʢ OۙޙC4Guo<8(g7=qx U8,0 6Sr8ڀmˋp-s˪8S|0X[|JHvq>`MU?Gf7+:NWE_L A4JWs%eƑM Fck4O?9s׌>)q]o޹A5po\g MAXkGsVdWSܙ7ljRe{wO)GN l<eLDՇW4{ Bխ=P3,AB/tؑ#ms&i@$&`3L]K|)ҸJYq$o}[I1sdBI]VIXobE).tӅQmk9]U?z$צ9jM:X`eٜ kg`\6]߷2>?WnOKc#Z^4f">{Rx">G"VwVP#JQҞPq`m$&gx]?S֠\y_3  78T|CoS $b''@=X,xIsdP+d+~]k&#gCfv]2}"L^F- #*'p8ct,Eٻ~PXGJ,WDmv_97oԵvckz䲆8ńH)8ᨧ(? a6/'/%pt73bȋUE(VR9k*{"k0i#(p{(7^!]@ee`eN@P/TWTs)!b0!; ԣL}N[ƞL2ϮLջw8L^L3/9D{S=eK5]ΰq NKo?v_%a鐸%dEe!d%c*Im[5YޭƮ(6+ Sx|_LMpP9/eDBŮ"HiUjhӾl,Rnf$0G(BX1{>/F ߝ HHw7X2wCALR5޵Ps|-Y( >H<>Oto8{B, ?PLv 5Lˏ$7xA跥t+I}_L d;&G:w +,H#72&:Z( k1Nr'<"D6񅉇8~2\2+~HrAcƟ!eVY5coQo: )w^b8*,W5,T殹6j쾅p沦/c(=PjOZ/D1o!fZs#OE<29cMl#7wkofO3е&#q ]w,#9Ӣ$v(aJJ2ceaٲl8t!u@@TzKhc%+c 5z p'æGٛ컊?%,xɢur+Yt98Y XEaIlLT\(Y-#Z~Q$Inj}@5;' ,8C{,[z?2V06H% M 35n,%S*^ӔaTCRZĀY,!^QQRkKҙ NS8EG&D>rcܺ(!Tm| ߊct Oа2&r._àjW~,thK 5|"_"PG[ "ZZ=v;tg,a$N'u-l(<܆|uZc*)hMY?wiX\3$0 LB#McPk "iu;jk"Y*55 :<>iaYΜn}R/+gn_d ڣD'?ը* >5۵ jcS.467Feߜڡ/kA)Ҍ{{o]3lhQD2KeԍC}y3tT| 2# . %IK2LQIل$~yުj\;@hQ|d *7I2eL4&TRge m]B#h H41KyjL`/$v^9n(SAsN->C X?s{ :QW{\,^,X{/x7-D$vd{Xgs;9t9֖E]tP@X䦸TW{`ǐWNZnse}>]T#X7?8/CWTv٣@Z')9AKTZh|FK$-3 p1rk g'<o: u(l@ՐHʭgWNh.MDQLe7ڨ7)j#n)^l}kIA >qZyr)s+\P<ɨ6mĶKvs|ȹzM \t-$kl&5t@/vs]Lw1e]XUɝj?Rr`bPXuJ*DԵH&T8wPI-*$-H=HدۄH̵>%L8# Fx0B0F}|?g@*;7P>۝C+RJ0}7Fc〆weL=u]iXzZr} GFe%yByq- I$Wy*EAk"|LI,*!Fy:?Dme*Ǣ6 *wT9sB#꽡–MUcmƝ-%'U/ 0\8ܹuҺ wD`w v$DŤIjyt0F]ç{^r/س;6W`ƠoW{Pчo'`P#=)薓Ei5*#.&to}S+nh.k+h_:]uZhq2Cw03ucK1srzkCuė24cNLĎt]*.nȔֆD߶_Wwe@0F93L:o Y[`Ɲ§$K`rzgb%syv[~vG'V%XnJ/U*2g,($Juϭ?J!d ӃDHxI;9@NJ@Hx4za{Thu \9nuۧ9w4[ ̡0pEZ[}YdjO 鍓@LC;l]3yoBмtV5.> E%#{`fgCaKN^ٕYr36 Y: YZ