selinux-policy-doc-3.12.1-153.el7_0.11> H HtxHFT%jt ?*}}H `$闊o&h=}L]^efb6o957b6e2a533c42893da447b55dea29e775ecbaaf FFc5lYFT%jt ?*}}XXɩt퉶+extrz#f-GX>8TH?T8d ) Flp     t (  xL(}89:~GHLIXY\] ^3b4d4e4f4l4t4u#Gxhg )4z ~dM[G 6ǬZqU\noOh_  !M1 i=S٢+; J#(@H!(f82 xIo7*>A큤A큤T%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hT%hf90d6642396bd107eb2bead87e1f4abd10f50053d71665ab6c4dc0292976a653846bbdba1149ef9edd39c6f18d37f29e5ed9cb3670521f142ed6d7d2bf9f2b8342d2c3aa4d008aad3243fd00e4723033e27e253289356cdf2cf9ec46135a8327bceb4f36b0f077b7a232a94e214b3b0a5a85152e4d89c193f92ddaba3ede1ad636143f526a3916c0b576bec80ebd5850108fb1be802edda44686f6083bad5ab1fa37bac62fa2652703459d0d28d5461fbd5c707f006adf0742f6b71d25ab332f52eec103da47bbe49e1225281c6ea7853187ba5bb452ee3ea79285dadf158405fb2603c814cd87371165468cac4e9e9183a45427140b1f1a0ce9edae8c0701fbba9630e097150a635a4888bd1b63ba32fe267a22ee2d65a91ed300365e43f54cd362a73b335564b783065ad39f15331cf4b3391343bc5e6777ad955c8c616dd95b0459fe89dfe352bb7d730c0104ab29fe7e5984256aef06e42ea576d50532373deac70a29319d87ea13558da54203bbcd74e7c69c76ec7738b4f4eb2e1f8b9f341fe9ac06ff0c79d1fc1724838e7c55e2994028735d2cf53e639af4859034f000398cc42ed0a362d005087a637a60c455ee42017e470591fdec6c8e6139d0b7fa2f3970d3ade4ebcfd7a0340108c26acb9be43bf9af722488c010cf66686af0255f3a612ec0cd69c85fa054c870f3e3396ac38d2ddde45b6db5d8983d2e88cd431c9df5c11356faae0b2a36c8b4b5aa8b303d14b2f3962c86bce7f3ed0c129f9bdecd99b568e3c5c6ce8708f981b1a88bf88302dcf2ea834ac15fc53960b01496b1542030f6295cf4bff39a18e41da4914b1fbc4cebdbdcd7bbe8ae9cca9017de989ddb6272ad3d282ee9392c356022bdac2308dce47f3c1b14e8026ad4bf9b1d10e878863eeecb5f4ac9496e6907179a1af9b29590007e3307552dcf93c7e2fed3af5009c896434e58cad7480946e9777855d43f7a66320aba2802459fc0d85fad40c9df330845dbf8012931e66975e8f33c6b6cc36bd383b0e52259e67e32631ac8c5d1d1d705a61335645fcb829d1b7766ff1c4dd9d49d387bc8a2c0ecbfb2876b4dc4a4155e6064e31f6437724a574138106f41405eb40205778f8ac542a9fc6119317c73374414bdbe02a871cccfff31518fbb7ee3b3ff97a1131675dfdad3961ebf3b1bd6d0ab7293b0435979f19280f400a25506450390dffddbbfec110bf9c76e9f9ec378cbcc18a3fab2dbc09bab835f4366699a08cc0014b25214c8fec52dc3192d64a161d03abf39c68f8d79f46c7eb232d93c1f7df7c08d3f40b5c5dc394f8ea2f73a11a2183e90742ceb2ca0a956f307b271c74626ffdb49e17626e0a3c493726b61ac978146b5c1d0ce767f7179458befe7d2f99e8be3d80fd862b356dbdb283175f971a29f53b35272eb045557a6d18d3e9cfcca266cef6a4530c7251c1e514b6b589ed95311e16f12325af91f2749956cbe88d06808b42381f0b2e634aa903f6f9973b37d766b1ab0e310ab4eeefcf4f29d92d9ce069ae2e27aede5756fecde40c5829d8ba92b53e8671d3c96560115df05682e887c7ed71cad026118b9218b0e98f973bc6aeb64e9fecc238a95bbb6fb4c5fe6da3407ad0e78327143615f019f80967ca9226e2f3a9232446f4bf5a1005c0d433e18e5deab48a56b6993d4d80ad1f82d3f96214335fabcc7fe84381901b22a0783b0f4c2f5429906fa0e4704d7152fe56ced00747494174b81395e29b43ed611dddc62de59df460aebf25165e1a275d27819f4d19e87c32f7505385d46b7adfea5c0565058bb5405336cc7d3ae52aeb74843c6ef7e9d38e5aed91aaebc05c9e10c574d7a8d51a2e05c52e57bb76db04a60b3b76a291f5d81b0774e01e9c2b7a553d3c454f9442616b3d56b6754465e3c33e893d12c3c28bab9c099d1a3283a914ec9a44d26c20a74769c70a25edbadbe7a246e25bd6e6be1e3811d9fbf4f22dabeb6e2f71747aecdbd9c8735b3e7024181fbe89c05b9bcb6390ea12fa232c1e6689076eb57199270f9bfd0cfcef38242fce8490019e4d4e12de79883358e5155ade1c008025b2470167dba08f66f8ebfb5849e06aa90096080183050563ddf69678477d320d68376e39b6ec8de0ef4dad38a65864be31adc8d64a5832a62b865076d01c660809228bf79db5c7dff6705bd119773bf5984f3910fa69130b69570b85385b5f375b3afd012738ad4fb63bca0368b8b5c03c4deb6d49dc4aa10ebc72913233be15518e32ae265587cbe1ab35f6163bd6d8bedfa1f169fd7d8aa5cfca913bfb7a27143521539befcf57b69f0feb0f26f4edd22243dca426c39d4d3d56c581aaaf3559303767e05dcf682d6962b0ff8bd09d6e0e2c9ec129164b36e13c91d049359aa1db1b1327452e63c219c6aa5632e9bdbf806c2ea21cdc72e60580f1fcfece365aa0fde7003fd562cbac4a81bf2022017d7e313f9e28a417b777c4f1fc487ce554cd341762932caf62d73497d3c1c1250b9de3c536269fd0b484277a570bb7ce11bed069e531ac5ca99937092fd99a7544b74c3f19a68af62718e48abfbd225a38b1f5e003339776b53e76ebf7da927980da6d06df2587a7a329c6a85e630b751d2f2b2137064594293b6aa2fa77e0c0224d3b822f5edf0c6b06796ea80f789e7165752b1c7bd4f496924076d495b6ce72a51c972cd30477fb22bee42f97324d584ea27a47e6ea189ec713137cce819a38a2cff97aa1b6758ce4d0da42e87437c877e393aa690e7185eb18a019261aea72ecb15bdbbce0f66b3bb538574bec72cba78ebbcb6159b718a7b2b29561efc9125636311853c3b7bc6415fb62a74ff2478a3c965ef6b0efd8ddcc64cbaeb50df99dc802a96c55ef6122525e1859d19cc6fc6b5293b07e2e0d7d584d258507dffa4100490136e441099127ea9fc919644960eaa42b3e5a90f2f56297ac9d2ebc08a4ea473308597520623602b7157f61cb960f6799265e717a3db2fc92a5a280aee36ae0a2ac0e4a817be45e4a8ffe26ff9edf072649740a14d05dc4f457b4e7a21bca7084ce1f562a3e166924c144aef5aa9de02abcb44c57972a554ee8571a071d8d7270d7a77d54c75369e82301662fb987b06f6ed91822d0ee92b37ef471458900e53fdcabe27297e292d380b65b67644652aa2e8f7fbffffb9c0f45370417f29304673fe73f21539a50056c1c0b5ccee18ab36ae48e4d83edd1d33898e2841f74e2b05bbdea1c10ffb63b43fe37ecd89924b3e28caa76be3de11a67bbedb1e9d565f0aaecea7040b5222018b9fdac1a8401a18f10c0aa44ccd2c61f07df9fb1695d415e3802bdfb06af679ee49017923c14d554f1def8494d9ab39e0a2591b588a8f8024fedf079ef5e98873851f02428aef78c7b41cc718446201d0f464bd0b278573de7856c7db0adf70de80a63434e958b8732578bf985e965fba2ac2f7d21e1d492ddffa9f613a0819e38f512432bb3743cabf55d8e8f41d15e0250124fd056dda99e477e01a9e12a0993385c828c7274ecfafaa329eba09c46886f00ce60ccb12e990bfe87ba8240a6ae3020d43590085302934fcc419f4748eff08f6adb8ca208d25139631c3dc41b9aeabb0e7beb3935a6f1557cd7d0c668ebd2033249fcbe32e8b3a8b45617e0452382dcc78a7a72f7665a63f8af33b60bb38f1eeec88e8ab1dd796553b4db2e63a0ed5fbfd8fca5a1e91d8cc3c7b1f8f43c4ca1b6a1d43c2e2cc8ff7678d0d3eb6bfe593a78aef3f40a063ec4e3928b3202db9cc41a66d552d0883bfaf67f23a0fdd5accbd99858badc7df8d3542d7ec4534ec5c2fa4ec22c9d9cd3e8c6b98c1922e009b0bb573adca239db68b03bb4739d7ffbc5d78d0bcd03593122595a4aa77e6a152ab86aeb2f44b4241e4875fa9baacbf60bb3eef0c8badfba7bf7eb72c9d64fdc0070058d60944c3206a9d3eb04fe940713d4cc1c1eab7249798218f9b92c58ed8e7fd50413fba2b53ad04fe1d4d9a81c21fbc955d444df4b714ce61d2bfeafce4567ba820fa02c3b372416397c1cf0d67d209e8845c1054a558cde1955afe6b17475983d75cb75f789923074a665f22fbd1a224f473dad332d0309394f3d44b96606828cc64cb8adfbf59fa5a2baaef4b22520a3b97f65ea765c4a4e68a10826bd8e58f594f86e41ae264f88e669eef249f67f5240aabaadf48eb36377f7b79e6ae7a78a6a246f9819edf913a0fad879d95f54fa80c501e73da43a98774dc72e70ab66ef03b85c772fbaa9daaa3cd8813c9318a9a423a7f23213f036550932c404cf4f137dc08b5bb6432668658d13bdb0d94afff017f24e76b3cf23ced3a1a9ab128fa43617548ec58490de97413523fdafa1225cd29bf28119b03ab9b1d4aa15b0d5ada320c0e6269e30ba0a86c22e7a55acae9ada3f8c99e28caed70e7d945957eb4518971cc82c1015c4a17abffc021c95d1ce708dac995fb8cbb629c5df466ab4c2118a74f6ca9d369db9f9e199b0f89e736ca0c006bb9843aeb403aae3937947fd3c73c6c5177ce9451ae9798f703ee4a572f097b3250c356d0c0a5f854b8082b9e0f7b9a641dc1688229fdbfcab6a169a3a9b6947283f8148349073aefda533fe853adca621de432595c7622bf6dd79922d1cf2ae0205d28ac4c83b2058e152be982f1d876ec5e36d7e4d3b7b85221532291ebffe06708d82a097907aacefa3b532746ab7599e11a3249ec50b1974d8c99bcd2705dc175ad07466ddafe64c1be775c3259d22780c932faad72c528bcde0fbd67a32f116f3a55d00cf6fdb43ff2d8ffaca9042e2304b7e158f9e076ce90c543f784c31a3f699c86b4ba1288919e2dc6693d9fa095048cb1d296262941f0dc45bdf6791e7a6b8c1214189a14fbfb9ddb484f7ef0e3c3432ea3aede3dc80bb8e7cd5658c7905d67c309f0c75534a211b8d624b9af228a94101c0498a731434f294b97f4ab88cff2b0b12c32879b1306989461053b84a2527c2c74ab06d4c31fc1dc9bf872c1857a8866f48e29ef8896d981ecbe3d7dd2567e75c327d7e056b8ae7539f00f042298ee26d216bc7666d73203dba5c04b6795491e36b31cf15e543aa6c3d0d4d11476e0f60345a67d0f5a6967bb4a1db2648e351707ff194a8bcdf3ae2890006f196a0b517aa8da7f200746aa10b0a602c157e5840c2386efa8aa24c44869be4a4742e9045c9ed9ac744dfe657712a60177c5083d71c3918ca5e9612e72b1afe88b4e2dc098fb85e7b42fd729955f8498b6483fc800256297396e62818d4ba14afc4f119f7023dcacc99ab266d02b52c79619b8dfdfa3621c97f3186afc0a12dfc76bc540d2e6ebeb1c85f2d01ebce3be93482c4ae3471ee7081122a94ab16ab1c014bb2cf4f5649da23eb0075213e072c79eab6a5525407292ccb70cc5a394e766cdfe64fa45288cdfef499d8cf5d089ecfdde4b8e928087839c47717124be597b24913494bc22a2c64e4cd5c6b98745e206afba8242dcb145a35c4e8a10f310f20cfbea1e6038b7f0ef83c21575d39d945ad71bd95b0ae47317b7f54416af16796862868f8db6f1fa78c545ebe2ebfe40e96dd74c829c3fc2b753d39a9927b9f9990afe75ee5f9dd237e825e5476cb4e5c327af97c079cf12242cafd8a4bf9af3c6f0725377b8da49c49e2d1655dbae427bbea01936c0dcedf7a1f7fa49204bda0a69eab7685e916bde196c889e64a9cbc39b020b39e91bac70ad846153c2b1c9dfc7696fd97d2acb69e35d74155d2f917cef6fd0b675acd4694c2c5e482a23b7d1fde39e8990a6d6179c6e1ea648d9fc667f7a74e93b332cf0fc5541975b9436f5f07715c8dad8d7aa6cd25fb46f4323b4feb62a368d6ee8df039650a148f0ff21a1137f666dad53ea4e34c5e011e4882933a815d3c57e8e4ddf6b229a9c78528b73c0a64588fa4aee0a2fde322a1dabacce53474ac8ee3d3fd9c795933c93b875589ee4eb256f990208cffbe4d52f36d4bd3fa4e1275a138373fe137f26fb15f26afc76803b732065d91874fdde7a811ccd74eaa0f0fa2d7e67e7f882beff4027dfa6bd84de3f9fb49cf944b4b2a1869aa36494dd5713aa1da389957be6842c68442c31fee08be960c3882bd15705f65d3e06378cfb1b0232e3d67bb89aae19884c0f20e84895c07e803f3f694d94f17e306b06336e86ad4f5e1cc1fff766f5292e9f4cd15fd1cd08e92c0e1013bdbd8e26baf0fe635c1cfbadc404731229bce8768766cd5b31bb49686d116070469cd78b5a79eee6f7769d82c9e0c8c0beb4d74c4bfb52d4848fe7a7ad507907c446c4b7a4819eda5b789c3ade8bb9d6238de5153f24ad7d7814945dff697374dc35851b73718d04d06b5d1b0299cdf269c0d14c9eb20bd8cf52b0df3d0d4989d2c1e10c1fa7fc91835250fc4c4a4bc5f2ab0197c33900f1d38971c569de4621657be1084c81ec065bb28816cd9267a047973127c48635f0b5db465a3558e06c25dbcb6da6f37da610711e1ee7b263743eff5de5a2f1910bc5073333be05bea4176b572c2c8a66df58e1560005374d4af677cf0c546afc022bff119064b2463f48ae5a16d675c1e3378c12c1bcbab265c80e6a1e2a2cea0f907e86a0e8cb0761a2fe408ee648df18b0344568d08f420519e3aa9d2894b4f090e4e2723c170b34de4bf8470fa3654caab3a98f2908c17d5aa9f1164efe33365767056900760d295632ca18dce13c3a3b3a2d4eb1c8ff7902d3a2794ec98b24000ddd3915f3f4fce18cf1b4a51b3fc370775187e2af15999c23537b434505909b6f5474e0d9b6c80d3b9c638f0edfe33cfbaf86d39daf465b36949476419a08de306b004bf46e73dcd84100d6593259d5f9ebf219a689ce9316ddc6aec13fc470ffd25948368ff012f5c37c26afcbeb5fc2f51fc8b951746f42ba38f007f098df7238653c517a4ece25fd30e5032c6a936eacc47e9fef11ce966c480c02d2ce18154c38f20447dbb0da2c168ebdae506fb5e6da81bc547b46a77226206da14d0c044ec91f8b3354a0320da04bec5891a2d90155307d9e232511304cede544c806d97ff8b6603fceebae70b3d77e319a4fdcffa94e509d5cfc5ae43662161f645655e99927f2e8462ceed8f8630f25def88f938526a180186ce70a439b0fb30a07cbdce083c858c108ef2eb0433dfaf680bb6c1f98e12cd5c9a9b9ff8e84ba89582827e440a962c3ae4dbb3db68dc19ecfb5f69a6ad9f41c40141105df1537903feebc3848143323ae08c5c7337d97e1fad40b563e6f05f5c31f6e5777f3102899edb82d658e479bfee4b3b67b5150c9652a2ee4761b3c6977ba0cdcac02650b6d0d24dd6b6ab6f7bb98435b88df8a79259c55de4c4703938ba7806801c4272a8db2851be04cabe670e77613b9ede36481ade14f9174941b0665e4d15b3ad92fff4d845274ef0c68ac81e320bbbb6e32f37899bf6c4936eeb0deae64d13ab3d9b645e0740f634c4f2129ecea8975c7f514c52d582011d9f1bffe995251b4c7627e1d4a81f1cceccc5c3c4c11732709f79b983d2e58bd32498849d46dad535dfb7f5ce4a21f21a8d506e4970b3b407ae0f3b91180ddf726fd4c2a8fcdc2fbbd557d192bf54e96d1bc21ec0331b45ac6280217c93884e4874e1ca143c7884a718d2616d4694a5b131ed35d847b3f5ccefd64f123981c43396c5c851b81cf072a1fb98a417697957b161c16056972f74221c52bb1c13e92c3b84a83b068df1b35fe81cc7a0edb64f5cf039f7dd2fead9dd99e44ab16b4baef27fdff1a0365fd3c68eb3c7d1591f6f5dbf1ff01dae227a4e283a5ac59eeb0316593baf2ea3bc288557458d447136cd0bea2f375777a554f88b3f3732b26064965fada3718f78de3b36a4152cd7cce62586c1b2604d30e70a8dba8d10f7e08572bf00c8eb3401b2497f04c91bbba903f6b7cc0e617646e09fa7e23a5566b749d4ff8b81dcb129270fc65bb62919270d6063445697238d7a01dbaf52baa6cb350dbcd41b2f1b3dc55668a3fd15f1c84e9fb75c77baaea658cfbe1c2533955cb346630b444c019eb50c675448145a1f9a7b8ac0c7daa3829a272f6806db078ee6f504d6868192224718aed7efb2794f756635a50f54faa2cf8cc05af680ae26fc38791b6c254d85c83f2cc7d4297186baf1671b91c734c98d7d3ee1543eccf5ac59c65d05da8a71b8df202a99b0897df8cd0a3f337c91eecc3946c6d725a278fe5bc75c1eef77967d69d1d80b24add4244e3f04229303af50045ee33168ff2e7f1ce6fb836550f6a4626c7347c3463de2578127c64b1841bbf3a01f67acf6c7a66fa8a3dddade17c7528860fde7071569601fcecc52d877b526f40071ae2dad7f4ecb1c031dfd3ffe851228035b4a41822bb74627236ce7eea0a1dce826c1a1fbe2b5d774db383108d94392c5228416088cdd75a8b4ded9aabfb7443d0b341a3c681cbc9036e95f9066f4f3a857a746bf6b3f8d15590954d79bfec69cf221f67367e52e889c6f6575f122aec9fd24add2901474a4935670d8899fcdd21368b38fa42b5b6e5230e653f9ba2999bb402212a5c59c69dcc7ba92ab9e85eb32180c174beb4f406897ea4aacd27a62146ba48ddbe7ff2951e61756de46db8dae194a771c3b08e33d48fa6746bdbad563f7ccdf78c6c03daf1bafb94b10b6c148787269c927bc9c008e6902d96b72936b63e51161594733671de3c97e49ddfc5a1858a6767efb84d69bd2f090986dabf2d38eb6b5cf5467996384fb39fbcd0b86a059fbbbbd32ed4e8f44355dc5a86189cfc012660681214254cf5cb4c841632f436c1dc8e368d8188e1494f61e2528c25c97bb40514da83d9cf51de8557d80fbcc3a5a1c0aecdd371d6ff8170cb1ce8ae24a6f06f6d6281ade625babc372ec7e98ba71beb4e43c313874c087ca88d080bb889cff1ef95ace2e41be3640870efa59854717e05b0a7518bc303ab02b76c2d4002e38b57bea3191202f6f4d3fe00452c42337d7f7176397a970b3575646c279dc6b2e497576bd18f099ff5a66328e17463f0606c9cf2b5bcd9021f620aedb026b870d263a948e76dc403480229100c9fbd8300d17ee326ea9fa06186ffb5ea3704b98e0ab05b4159f2ccd91591b660ccb63146b4d2b8f3f30dd5ebcc64390954986fd0243e9ada47fdc50c5097097c108b3bc131949864568e1885254808fcd2bf2cd6a440a6007a44361bf861322f7dfadee4081610490be55ff9934e44d54e108c24f8b387805c326a9209fe64e2c0d560da6eb2eb0a772c7d3878ce29ea094e71f4a19efe6f46832e34cfe4e030aafa787f219b3fd0c0227c42189d766d2e38541d89a25c6b155c67599924a0078523dcf5852be6bbc90188bf4b4dce36cefd55f63903b3a0e97aad22bd661cade9d9e6eff4da681164e2a8b95fd91694e3cd74eccc1e7a643e66cf8b2abeb0c0d7b2741086e84d82e33711e6bb3427d4abec24dc7adbb58fe01fe689fd4673608a4a69e4004f89735717703e1e52c85bbe9d7fe5c9cfbe6be758ecf3fb7c6661d8def127e3979eca374e7bd46d7b7320bbced1a96cdb4d42d4c03ef0ae90ffc5ced57212da9b2cea0d6b2ae236643f338c5c599d7206e757093cd80e54b7eba41e8c3053baee62af50724197917f6d4a246c2c969d0796fa0a1ccb3f29683b96561bdfa1afe8d3b0c3114b44a97b5f66d9ea6e6c4fcf3c84f039010cf281b5520d54427b4c631b755f949eef93bdad12634e356c1e00dc0dce4b14e42bee72eccc4ec1d4027ff83e05494ea5da13732ea657e72a7186402b9824aa3c307baa5cac44acfc051dca2a77c8474a79fc9d10b005f0b128f44eb4c7569a32c96d191b9a50a1f9a7ca8d33113ad62a0d54a9f6cdcd64608fadb5d8653a582489a28663ecac19041db7778ceed81e3bdeb223629836f0441380a26c5b80a9f45f594eb2968f07ab72ad4223388363209421e17012b7b932f06791fb4364c117aea4a0cf8828c21108de4f3ec4446f6f90c78a803260803dec7788c1d81a3db309caa2363f0eb789ec5521784dc0521acc5f6f42d6650378eceead32beeeb0310b53aba103acffe869418febd7a35b4f3b6f6fa652af48bcd13207e841ab3f42dcd6836c550906a98c8f31079f9b6531bbd0caedb3dc257061220a3e6494601ab7d7a609a5f43bc97571e8502af1008e18dd65353bc1e1dc8828c74748432109175e849c845a1609a59919b966174fd06c46c4cc5ebaab675f6d055416dc258119bc8b0e083728764ceb934d4acc5817bd6f76929774f5e93181468ccc0becef7040be37cc129d9aca7c739f68efc4caaf40a60342508851528c4bfb06b685b425338fb436beb4e743535915a8c7e2c6d7e69eac2a697f713d3592ed3f3c98c797fa8edb8ef474cc727915cc1a44bc694e80a20bbffc88af484c196d56c52dd0fbda265af34ec347a80b12113e286314bf13e856f48840d7cc91d3cb4e79cb2c9453a5da620c186a4838fe1aefd5cf2ae285603f5a934fc2829bafbcdfb8e4966c3e54389910996bfd8888c7760427cdc23d9483c26ebb30c9533fb324387081a3a27efe4ab1651d4ddb4fdce744a3592bc47d4461ed10f86925fa903e11e45c7752c90f21f1618efaa4e9bfb713bf44442620f54abe9476e043c9e61911555ab48c456a2df0b7967154c2589bb13cb26bc8521efaaba2cb6857057fc57163bf3619be108d993fb7ef2ced3b2133dd8bce83640770030cb79a758a79fd6eb740a112d73190aaed96b017e3bfc6c6953488c7d42a43e5985f8acfb49b53dd41ba50debb9b1fc6d74338a307a5717a045f5465b85d4e9487f97149eaaae978cca0fd26eb97137c307032ae7289413a3d0a73ba870e6d241a78d6d4073295267801fffb674cfe2d6758191647dcf281aac9f4d0e313dd33cc78739f1780f35cd5203ff7e795d32eaa55006ce5238df3f904e635a7d83fa651a97478e3921a3fea7a838494a12a3618049a4e0d7a127166d44e1f21ab84a54e47422b0863181463ad1097347effff51fa9c0501c6bbb164b075983bf5bbd022d8070224f51a0dcec627377824800531b566a1e0f8447212ebd43dd3693f3f27618e7f7ea904adda28386ef825bb87101196a28ecea53815f08e37993781acf6f23e7903e3dfa8ed3ea9c3df1999789f745f1d1b95961ce00af6ff5370c3be92b04c06e27cb277e2cb44938afb8a646bf79ebfcb855c1c9b283d40b2ee18214ab53dd8e47c90cd72cb80f92fc1930562659b2ebe41476142b2d746ae11e173cd444406ee6c4d2b69080b2f7632dff6a7204f9f00289200df66153acabbe78a4ec99db2a46feb7279121f20ee321358ef58252d4d731d2951cad013a5d90f91c8d8e7cc4d19bf1b8ef0223a1ab3594db35cfe48e3ee1958d7dde623178acceb2022b32ef6c70d2450060be11d98a4b6f7641b61644a8736861419e08a04e059fdca61ee70b9700da11a7ceab3a67817be8a31887c92918338ee7c5fb8403bf3be077ea7ea58c8328a3249f682f97cbb0b12d64a3fee4458f2661b5d91a90d7d026b84f7e328c4f2978662cb9f16d958951df0e9373679976ed5b17d8c4940f95a14f710f68e49b99a8e642eee9c935ba55c2f13bcf2e5973a4d924d889608371ede2af01a387bc88a296500b5c220414c1ac531ee2cd32e35b4b3f5975a67cc5fd4a832c58a27e3d59f0beea3a8cf08f01c4bb1f092fe3f4236e442767a6307928778398570125d1fb81f800e1de67a181ac70da00db4ede97a59b696e72b11b395b2f83093e3846630e0c14a30c98af7ebbf673fc70cd793a345fc3ae39bf53e7cfa10a3e2b08a2de16bf8f0e3c00dac20b77e76f21afc8ecd0f9badd997802ef8da4a9e0c7d82c0e619b5329597a8e55e516a386b914712c0c2a2f1298997597f0bdd5e27e09f61dfc8a9ebfa919eb477a12d3b6ef8d420858e7e01fb1fc86e82053baff42bf800cb9edb5662810becffa147c0b1ec9869922de1e48086135ed9b2a470c83465465b8252a356584a4e29a3be4ce54dabb51c958d3a8c0f889bf2d2a7629682d05a491abf8d1566c3e3ae50faf1b71938cd26605539acd2ec42687bdb74fce94369c020842724e44ab6f6a107b6d4c7358e9c3029c6dd5023fb5c927683c9c36f18db0eff1bcb2d76d3aeb8de084fafab73bb9e0319dc99d5bcfe8902618a89e0317816d640f8166e153536b06e917e7673bcc6c9035f5429dce211a38bdbc292739eb578d35b6b3a9c81c7e93dfc01ea5671df041a01249758ef1562b767680f6fe2a1ad206e3b8e878e2953effacc725b643c7773c250b7abacba5028a541d49c5296c46b38494c6073b8cef99c75d990421db9ab84a9c27133e89c5a5413adb084d19d68de1fe0476ce75023563d0b7fc06bf72afb234f68a4d5d2847bcabab622d6051c38579829de812de23c0b4fa29d15f4de827db608c926ed4fef05ed4b624d4bd158136166da8711d7cd77d2e0d9735c3d8c453cb27680b5ce98d5132fe4decc218532bcb6ccc7aea02708b2bed0c41e822cbc77c909e01613c7ec632a3d4bf8b00213c36ca6abd04e3ac5d39a453d79a7696123996a5772de9870cde6982923c1fe5be880bb7dc386f620badf5ece208e673ef3d3d66a39fd07614566cae40b84e700e7dbca452327e1082582de133a7d4ab9e74dcfb8a1bac573a67d68cefd973e65a008748c2473dfad54ed88850808ee0f21b9daceb1e26e5d738bc2714d0bdb4bc2648e19a99a99157ddf84fa84c007401d704d9525a801106baa18d1333e111f0c578adb0871671719cdfd1c2469c7a34ed0ff589b4f8212a8718bfa918d2466b173f9ddfddd30e495dbe6f5cd75691532d0876627da7078a12f4781be8abe2353a3528f85d1dd633df96f578aab04a8934125d9cc04494a71e866d73932249fc256a6bb16676839a0ad68466768a0a01450307fa0f95a338da5226d8afaf4e19c62142ae8b2913c3ffcd1af1ff57798f44de918846a7d4b7cc76d43e26e3b944bce4be9c4c923da41e06fe18662e280a252a9afb3d61cf6e50d69a101ce4e50977ce72cf1ecfaed757f09d6b660628a44ec983057f6cbe79bfadcc3d45ca07bd1db9ad74492b53099996418c1a26ec535069cb2994523a4ab7177e1f87b78ff3c78ecb0c23f7c86cbd4e0f17effdce22753c06ded4db4732e972ba1cd1156f5e791ecaaaaa30dcff86af679b0a4a992bbc41dc5f716f000f74ef78d45b2ef45031f14e5c27d3c214a9eff398172f1cdea289132fe264fb42284d3bb93f19591d59b1e92466fd378dff851fc43520163cd4f99fd1925e15ca8abad1e4a60ebd77295bbc35a2122487c04293aae617bcb401304f28c5c2f0cf6eb16a5f1ae4462c6ed8a7dc8548f4c0d04bddae2dad4d18140c3def4d183c9b57a1a7b7bcc9b8bb9bef0a7299a2d2f0a55e3f773a8cd4a1cb91cec49aef94980f96c2c1b97dacb6be79eef062f31d8b6e026750838f9ef9f74ad26d1456b139f32e6e4198d7e82e5595bf8ffef333070deba1af1a85f85e78c4a7274a7665cb42f02a2c5caa64938164d2e00651032f9a061355e78c15b103b25fe7d6c6b05385396484d4ba1d14f17d5669d092c6d5dd26761acdce161cffe7bd4f34c1eec5017d131c2a1cf53c3656c024ba9cb30cd2a96900f383ff22ecc3532af1d416ef238fedd9793ed464fdc1e7558d2bb4765593adce723d712ae437ef3146eed2e18082c8a48b03ea2675ab4291ac38044c0c71801e233aae9556317d499a5efb18e041b185b3de78ed2ea58f4613a148e53bcada4519deb8e071b59821daca50834477c7a299c6a71bfc9cf77548c9127ec861e3754cb38a047e0a80138cd8449f889c548d3813d591ecfd209d08d40a635b71dabc9d561a443dcb7c2cb1a416781b2f86174064b8dadca3d12ce54fc6a681f1372255c4cee5b2828cdf2ee99363dced07778dade04be1ea8a92eb1dea73f1ecd0b94be8575310a3adc2a15fdba53042365b7be45973ec4fc3cdbb78d74630ff8b5e2996420022b436247c0d062fd13d49b12a99d2bd7a8beadee5684d0548ec09e89dbfdeb62cc64e1fb31f34394f86a51c8a5238131b713100525dfa3c08e617420fec41c3dac656923763097a15764e83458889f54875c72178f3712ee017e2c94d192b0e19e68efb6b02eb73189e210e214499042d494e7f2faeeb1572a6504929ae128129acfb9e3a26851dda9a54dc53a8a88b234bc60c45f4608f0e0a54b08e1a2cbf339ffe36a0c6e900d86531dfece5d282cfea3ad265ec86a5177de244d1fbc8fa849da4d4647db5c374d24d178443d3ec902b0965ff8f8fa0a2fadfb7ddba43699db3ebb13a9af6f83d508209d2e91d6df8892c9876b8771bc452c72cd39bd0978227ab279892bc9efb48d6ef7135562245a4caa78f16c7e538f51b49fcc9d8ff642bf2fe05950fd7855025892171b2f784894a6fa2b05101e7dee9be262b1e1917d5cf99e3d690e613e23242aa7146039e48bf51bc7459ac82f63d517a96134be97f236a34217633186ce6913a325bd1c30b05ce3f7a82a9a22ca23a8e98fd52e365f3574ac8f26d6aa33454085d7142042d262b022751abb4dd274954f381495c5acd1ec182c8a231f612475ef129101a2bbe6f5bc30aba0950d7e9a439ea0578571d89d38afaa49db4dd36987b4e44546b88fbe086627a39036adedd367ccd79b5b498e1405cc07b6654ce42bc7a5ed5c7af54555ff43e32ced0d249cd530564dcf8cf4ec2574dee39d5d874a21ff87ebd184984b612faece8915a7156294c5fc48af009549621190330fe41ec98f837697499a029b2ab75a2cba286dcb4fefa436ffb8e32eeb56ebc4180a75ca2d5a8f047baa3392e033a74d14e60a89f1f5cbe7f15ea6d80f8ac4556882fb9e6e2c599b4e296855a4e9e344345f11fba8c52326b8c0351923b70cfdb0241315e43627cd577295195b935d43cb37f65b499c83db6ceabf32adfe0c23ae7e3a15888657423456150e77fd10e502126e180bdb8e97b2ca6b476339f7a89ebb3c22f2d1eba256bbc9864daa1b38b181a93eaedb8371c981ddfcf0afbc7d0bee0f8b5a1df6516609207b537cdfd688042221e6e282c76ab5443719af678ac3059ca6efeac18771a41a60e11dbc7e60ebc72bedc874a22f95a497deeee1a0b7f72d0a445baf10b7e82adc145eea275c02850b65d2ec5f5c1bda738706987fd008f07dd1f35e2b5f85320c64f9cf3bac081b78a3564876a78a6295434b748fd7abf794013d397d1af869cd8a9f0f782d465ca214429c7546655b3b382f1de9fe07ce2802d97327c08923f1b24e5c34b05db7d2001921d3494cafb183f2b18045aa4e3da5f2635a75c94c8d03e8caf5b5bcba28157ab802fee813b6ad0497cf4c0bfe9851a031bda14175d8d008df86029fb3962bd60d20de1fd8f93e93605f49d4fce1db6e8d81b39e2c037318f0f26869c8ff50e348f1da32ba3ac17a6bb1b8c029573714c61dc10c54dd1a4e9c4cd20333c3b675370575bade21b82e448664ddb18db7b5ed4f4ef48bded89b28bd2db08a4e3145afade0ab82c820d945303b1f436f9eda6b47ed5166aa753f8fbe58081355d9cb172f403a35c9236332b9329c28e56e0a045d59997230a4894f24a8a23073af9b1c2793ea249eff0015de4f896bba22f0e5d6a91f45cc4ec613cf2fe33fb5b792125a7b34046b98050137b4dc74f3ab06c36921b8a9889677ab7a960e45a7e16d7651c46504205a04e3d034a16a64ccf710cf6ac03924be57fd9cf5029d30e5097610a0ec9f72c2a2e29046e783b36b662d3f4fc60f2689053e031aebdd277babfb5e065bde98b6236dfb9c7b1d55bc2decf80de9e03373a50cbf7e93461a0d4e37ff0fdbe9f8b04f9e912b97a25f5d1546236935362989225a11290edc5a62cc2bcf3e1acc41367cc1cb8f6d3d8fca4dbdfeafd265ef49e9af4bf0abab48c232017a6423c300197c812353cc4edd3660685fc363f2f47b3ff3417a802e102e0052e02d050d9d2048d38f24e3a017444a1c4ce68c6c40efef9fd2b40b5b0e1bc7188903ea4eb2644a25e7a8af603f3d5cbd6d5ab4d1ed35aaafa414bd4968e8b3dbd83329a418b8894124aab858392b55f3c54af79833881979efba18215ff5e5403445991014f393710487b0a4df2acadc5fbe9143ecae61261306874a02bea19594cce9d482b93353f9889d35f7735530aef810da2075ac9ef25ee68d89cb63b55c53f3f73dbb40b995eba5e1ee4a3dac3d80d4bfcfd36b4c43fd6e700c8d479e613426934d0216e574894ff4ae60a1cddab83a18be1c6d7df764ed074f02b34f91d6025052d555509ae2c3574b3ee5c7f6ad4147e0fd2a7c01559b99938fa31cfa753c52b61a3718033a25726e4dcd958b65ac791b200621923582dde54648d2af4d4b73b6523b1e8076173ed3d787e5f1bfdaa93dc7380baebf54431e30f1a95ec994819b2d39b1b6c0e218dff577e3f56edc3ba9f43f4ed5c45691f48a29300922f20e4fef241146dcaffa2bc13083c8bca788fe829d3d3b234799bac8d2c20b0d0df5303a71cd2bc67156a71deb86e4598db37729ff34e956eb36dec050587a44b386091e4caf05fddcb36ef13d38c0c2807e23bf0fe5e130866b28456d4b1c0b168d28425c05ee3d13ef99b4ef86fe47af49faee0e3209d5eabd959087d993799f98dab944a806f234f3ff3c8fb5a7b303c5025d517b28782bbe814a5a50f29139696788699a80710cee1d8a099b0299ef28e8505f9e5f20ef8f7c38cb1f53189c77bc2520ea1c455902d7035222f8f0ee14fd1d275e04b26a7163085f03e70d5f04c0351903f86b029f56f533e4eeb441e97bb791b9856accab15cbc9c1517f3400584b077bffeebd7cebdbeedb6b46fa78d3f786f1c062fc5eb807a0de2c9e73e87646f417450743729a6cfcb4a5555a5ff88f853b750d5c2c04fbc3c8e36f043aa345712266a91b554a6f5dd97b102d2726d339659cc43ba2995a557c13cbafe9dd1fd9a7fa20a6b933244f9c7d9fb55d7f7490e835521541517239ba0fbe84ae98b6cb1e4e7bfac75ba9fe1bd680767bcb58d0a3298b5934fab877c71c10acb29a8567457adcad870018d437acc96121b11ed8576cb2b740ec0cd939fe8d16de62301629922fc9d6e5312af4f4e22cef2d305733c11c1a56c7341c5d68330b21aa8bf95791eced526e3b0fb2c8d571c1c2ad83307785f490095fe2b3f5f6ae9671073aa3a4929e4b0adda5201aa4595dd5ce8336679d870b6e445897b991f036a005c3bc157da3fb1c414e7889843d2e57d0038d9ccdde518a8ccaaed2ed4597a9966432f60c654795999d91bcce52b16f04ceee4b643aeb188aab31eab77be86cc1018c0d3d5d352b2c7b83ac7e00e57e3bc77d84a47e58b4cca3c48224ee2c057a8b1501005ad35ce4ec813b7a7ca88fac3d836110bfa8142fb6e62daa3ff0d371f00996e354eea8f61ce5c4178b5a33b6cd326470b743f459eb5dc159795fad8f7f35771084cf5d6150ca365621bcb9a8cd5f70adb408c29fd55685562dd3ac5f6299aff99bcc3303a92d67a0a0d3bb0d97a897cb04c949642edec0cc77562b0c8b88885869cc2205107c7460733b26eeaef6eb6842af974bf2d2968c8876fc9ac8ba6945f87ade2d04f41999c503ff51c91656451595e3985da20eee317de3ed14fc619690a37737ded32ccc5203649cfe687bab02b48175a081c986364c49c750893ddff94a9e036e11e76520d67360a2f67c323ee70a060595137dcd14c66678f9282ecc57df76b97932e4cb4ffca1ac653f94be4c61d83043959bfeca05203e48af89131e8351668e1c14174e171275f0547082797e1f09a9c1ad58fdbc80d804ae61b175b9b4805d71bad1b8086ff13b0cb8b46024a9d396636de131f7595cec2fe9b62d5256566b0b6bba44caebb6d7a6601ed7b491271e6e449ff01695681639a58940b1b44f68f3e1026fb22489c2f5246077ff2d8587fb788da7ab321cd37178a6a1a453b5d9427ca8a8180dc1757c043daa52f910ee7b275a2b6f2917a07571fc097c7de9b2032eed1ee4fa315e9a381d12584942cd25969316b886c86dc73ef5882b450d860f4843c7847d3dc5e5fb2d2711595a96cf0d01fa11290552fafa58b0afca65e9de20f2249658295a51a54d3656e3ae2959ede86796d5a3ba4995b8bdf79a51558e94d5af39d5b14dd60c92d098354382243a947941793983c76dc6daa54abb4ce3377475a6b4275771c931a522a7f7972f9cd8ee0b2e1ee6bfa6a943a5fde0f3f5ebcdeb5631c4412bd3bb4102827916428fa59cd8b00dc648a5c31dc379e3962fb0edeb30ae1f6cf8645dd5520a6a650fa90e3a54c0e939fecb9de573854aa98b67800492e711a831bbbe37fa25f8a56adbcfc20e329c0748f01f2020b430ac3edb7d2280857b545f3b0aa0edca3e5bc8c8b7316b8f804f9f11744dcfa6b10221012289fa8fe976861ab65bdd4d595df11fe54465373d095929c885520223138a374167f75ab8e81a734e26dad28d171627da7bddb76c747150c1108bd37d35d8dfb109559521781c35a1eb372ae4455be21b0aac95dc0374abb8e9403e9f54426345ca16795d71f1727e1a9bfce99cfb11e14a487beae7503101e611b29e6ea158a818af1c966719eef089d2ccf2ef394c3eb22eacdd6e9ce1495de5df76d3f8e67e4aa7196ef92952042544a08bd66f6c2a8e162328c6a6c0a8d2056d6fac70fce3ad2b6c73b6627257eb71b5001ee86f2512495c2927b75cfd139b9728e2c98b612c85d9fa2c378f5f70d72ebe5a117be4ca05060a07791caa27dcd4fb6ef38b204e8802bccef95b691557adc78208b1e906059b423b9ac18ac68ce9a35f872ee0fc019f963e2ee8dceffff9a39ab0692910441fce15539300fad700f935d8bf0de8d6a17c6370637f38c19cb05bcb02dcebb14cf5d1ac50bac908ed9e18ad90df795a4949ef2612eded2aa9e4619ede8bf68f56fe41620b356cc20468e8cf6fd8c5618a0a74bc8763abd70e3d51d305762a5fe15f4a893b83150a66009d53e3a09068d232c2d9d8523ed1b3daaa0e1599b71d92a9bd365954e3fbe1887e6b81f7d5b97edd64babe00aae5df6a9d478dcfbac75271c20c27adf87f23ef79900b57e1be4510bd60f2a36693ae82fa2e39cbcd2b0055fc6a797ae6b4ac4015d4cc016ea3350ce3eaaca595473525e082203024922c353af8cecd1656502a5271f4f446ff05b46325cda409c64bae94961a3060d8003104b838fe030cd204aaa455f5eb24ae8cf80486fc616798a9579a9292005b24ba3d6a48098bcc388fbdd7b309310e35ff555b62f7aa726756da038ceaeea3994a0c015040f804673fe0a23eff9cc112509db062ea529b631da6870646dc6e3a47011841d3080c8de1d81362787c836f66249b8e39979f2a64df60a63b448e90cce7a2725590d19c44a992c4df517e113580fe943852942dd333f0ec9964900bf5a1dcb1554cecdd53cb935c50a711cb0e86bb02f3e29febf82b3451418dbcb19533b746e61514dc4311d679c2be683a3a375e52bcff1b32a2216d8bf09ded1a5c8ffcd0c0513bb729f4b6c1756bb5939b8c87303fa68ba9b8a7034dc6c9470b916052fc7efe7c7848cf913844b39d692cf4205dc402b255db9bffc9e8767f98a86df910e36a7d5c638ddf883a296dd680d7876c54be57bb13fd459220f374f346fa4af38dc4981d793c12dbe3488e579383f20857c8f5d7e4f590d7199861eacd6ecd4c19906874dfe90b68e55d708022d31902034a19ae8add324950dbdd7d334e47675c7e761a0f8878274528d9d1ec19ebc6839a65f73b8a3ea2694854426b31cfa2c1df6a884effc4ab08065b848cdd728f6ed70bc0ffe8469c5cae5b2e8c7cf2b7d83eb326c4ebdfe1d244b8f76f7762f3d3416d37592cbb8761066fcfa2ebf172aa8c913ab89cc045acf274bbf8d6973500e39f1352bcdbd045586608920a4b0f945d085e7e5b868154dff118b09e18ba77bc212185226d3d09ad14a3cfe7b8f0374a2695c0b9e8ee5d3d5be38925fdeac4cadef8034fe55e34a68a9c550f52256ede1e2cbd0dec7df45dc2f735b427fe476136aff47feb7369e115c4ff48785b82bb11e206730c6cfe88f8b6f1d59b87bf399ae393bd21b4dc5ecd4eb791dec80a087c89428f760f9ef09f774ba21638f333b0912232f3e5c09bd6a109787e5319a9185393e251e16b28edf9c4153e87863919d065c042520c95d325ba47e67f5bb333ec2eeaa5e4f5d070791aafc976674c4faa6932fdc478925168f5b9d5d28365dfa8d05bc8ba60c4d78dfe4f3496eaec7da85c9ad71fccee16c5886ea5b4254956af8d9d2e114e7c378d7fb4cd7c684aef905a04ea5ce0cb4e861c9bacd2a78de931cbca54d9285bad681ac10b7be0a59784f18dcbb49b30b6daeae34a7aa1345400f65dbe176319f26619c9a3ed3276434e60674e3ed7f5127654429a3bcd211e2de9dd0e5065de14e1b01e781d93212d922e57c0fd708d2fe6a7ab8b8ea7a71bec0de42076f7245d4c4484eddeae161c671b7645d3ce85c13d0d49e7891041e7ac5c067bb3a3c50d73e409b3b70d77bfab21605ccd83dc549c4ca6b38d12a55d554ebe8e5fdfa9282ec50d90a6c9c279333b500d31ad7033e81347d7e462532bb04b6877bc71ee320254f0338ff44f2aca315804ddc224b85f79bfef4dbeea624244d5422713ff34f5935a7da29732b5de52def73bdb9cd21ebe0176981b9966a72a2c4b2f0125767e901756d026cbb4662df67b662158d01ca7c1983b830b4ece5cbbabe9eb8b42ea1103f6b75896035fc6148ec5c61f664b315954d108934424463f30d86bac7a55ee6df50ef35974e697549c7fca7d5b0833dc49217639455c8071e6017f17d1156711ab1a474d2270a7a26229d63de10d86980a0f4f4fa8560ba3ebe8d1e894a60d0a0d0b83097d6b351bdabb1a773cd22c86f0584b27a3a9f28e6874b5b1094b41566f1c5dff89797edbe40ccfb5d74ebc0cac2de26b1a5803c4ba76d2e5f07d51330af91adf9ea6c0d1d572255e6a59be77d6e6e21c6cc6921f4dbd29c2ffeba523178f8da8e0584f20ba60fc5cd90118b9b43afb2f84fef5947e93f3a80f948e276892a0fd0b155b4453c0856c5b7316faae1c05b0c78c6a9dc5b63dacf6d1686da486a11d55779ce5e95b181f2b180862ada8c6346af1481c057882a6690355ce2a805ac4a5ea847b57d2a1c26a16a09a4a6b7769412afb0ff55fedfee349824f26f321cdb380d2ec29de46f569f4de0cbb538cff229048e100fd8f1e804021746b298c528256ca4a3bb756b877cfe635473bf67b1f8876dda54d7bac332a6eb9f9b1eac1e2226ed4df310eac2f5cd3dcdf58f5b5c923c475d6650c7c67964ab04ceba8992a0f0a9e0053cc6b3281a7643c3c73252beeac02dc9c3bbf021c85e62aba4050263773a0efcbafff88014b86ed6305cb9ab687e43fc20c257868abf580f8dafa60862bc8d677c9863084c84ecc8b563ecc5e831c0fd455bf1eba477d439b3fa65ace06a7a30b6cd1b38c7082b813df9d964d83e391828efea38c9cf541ecf4bd950599f8027496ea48998fe4ebcf4503e027c46a25fee8439ef81958ed92b98a8f302ce06e8c97dc690fadec47d717c5ff0d374a9f11009d4f29a0f7ef5566b0ff2aa648370b7dd9492795049a2a1c7272e6e78ecff687b675f79b06910a7ef08133ba45b58671270999eab919e5d4ca24abce90b5c1da2380b48a752fd7db8935bf4211b14ece33fd9ef14938397a091b956efefd26296a6267c6b630f2d86f47936be0981e03163c0de467035e6339e10c83d6eb72bdc7a458ce98b9523f33ec76437e3ec6cfc82dc8c58fd3f8df8b0297c36d421693a05f737b48c04db656774c5552238a949c9f4f461a9f58d79e4e20fc18326a5eb73276b53a99af58fffb66ec94e3ac35995e25c068d41277d20c808dfd89a7f744995851675a04e3f7751467f1d83fd98b45d2910d4920120fee50d2fbc193ec2db0e5d7331704a9463d6c26746284e8439647eacb65101fde10fe06ae272357216cd7ed99f4afe14aa4a82ee07ce311182490074bd740c6023bd9d92d7b1e76e3fa4bacddeea48623c20e44c30360b9c535cc638eff2b53bdc9c6eb6eb504e5deb4rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootselinux-policy-3.12.1-153.el7_0.11.src.rpmselinux-policy-doc    /usr/bin/xdg-openrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)selinux-policyrpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-13.12.1-153.el7_0.115.2-14.11.1S0SSS|@Sy@SpSj @Sj @Sj @Sg}@Sg}@SB@S>S;S:@S9XS5d@S4S2@S0@S,)S*@S)S)S&S&S"@S!S L@SSS@SSc@SSnS @S SK@RRR@RRJ@Ra@RRR&R&RRR=RʚRR@R@R@Rv@Rv@R@RR@R R@R@R|@Rz/@Rz/@RsRpRnQRi RfhR_@R_@R[R[RSRNRNRL RIgRB@RB@R:@R1R-@R-@R(r@R' R%@R7RRNRR@Q@QQdQQ@QQޞ@Q@QکQکQ@QzQQ4Q@@Q@QKQQ@Q@Q@Q@QQ@QQQQ@Q@QQQ@Qzl@Qw@QvwQo@Qo@QnQm=@QkQfQb@Q`@Q^QZ@QQQIQGQ@j@Q9Q8@Q4Q0@Q-@Q& @Q$QQ@QQ@Q @Qh@QsPP@P@PP@P[PP!@P8@PO@P @Pf@PPqP @PP7@P@PPPYP@P@PPPM@PPd@P@PoP{@P{@P@PP5@P@P~P}L@Px@PvPvPuc@Puc@Pr@Pmz@Pmz@Pmz@Pj@Pd?Pd?Pb@PaPaP[@PXb@PWPS@PQPO'PM@PIP@@P>@P8@P7lP2&P2&P,P,P*=P(@P#@P#@P!@P!@P@PkPw@Pw@PP

@NNU@NNl@N@N@NåN@NNNN@NNN@N@NGNGNGN@N@NNS@NS@N^N^N @N @NNj@Nj@NN$@NN@N/N@N@NFNFN@NNN@N@N@N]Ni@Ni@Ni@N|tNyNx@Ns:@NoENoENiNf @N^"@N\N[@NTNS@NS@NC@NBrN:N98@N7N6@N2N.@N*N)f@N(N%qN$ @N@N7@N e@NpNpM@M@Md@Md@MM{@M@M۝M@M@M‘@M@M@M@My@My@M3@M@M@MMM@MMMMTMx@Mx@Mv@MlMbSM[@MRMQ0@MQ0@MJMGMGMA^@M>@M9u@M6@M5M4/@M4/@M0:M,F@M$]@M@M9MMMMM\@M M M@L!L!L@LL@L@L@LOLOL[@L@L@Lr@L L,@L,@Lډ@L7LLLNL@LΫLeL|L@LB@LB@LB@L@LMLL@LdLL{L*@L@L5LLA@LLLL@LcL@L@L@LzL)@L|L|L|L{@LvW@LvW@Ls@Ls@LrbLrbLmLk@LjyLe3Lc@La?@LZLYV@LXLN@LN@LMxLMxLI@LH2LF@LEL=L=L=L;L7@L LT@L@LL@L@L0LLGL@K^K^KKKj@K$@KKK@K@KK@K]K޺K@KtK#@KKՀ@K:@KK͗@KŮ@K\K\K @KKKKK9@KK@KK@K@KKKKrKK~@K,K,K,K@KK8@KKK@KK@KqKqK}+K{@K{@KuBKs@KqN@KjKie@Kf@Ka|@K`*K]KXAKTM@KPXKEKEKEKD{@KC)KA@K;@K2@K0K/c@K+nK*@K(K"4@KK>K>K>JJęJH@JH@JJJ_@J@JjJjJ@Jv@Jv@Jv@Jv@J$J@JJ0@J@J@JG@JG@J@JJ@J@J@JJJ#J@JJJ@J:J@JJQJ@J J J|@JzJyt@Jyt@Jx"JrJrJq@Jn@Jn@JmJhPJeJ\s@JW-@JT@JS8JKOJI@JCfJCfJB@J@J@J?r@J<@J;}J:,@J7@J67J2C@J0J/@J,@J%@JJB@JJMJ J dJ@J@JJ@J*@J*@II@IIA@IIII@I@IIIX@IX@IX@II@I@IcIIo@Io@IzI)@I@IܑI@@II@I@I@IԨIд@I̿In@I3I3I@II@I@IV@IIaIIm@I@I'@II2III@IIIIIIII@III@I1I@III~@I}Iy@Ix_Iw@IuItk@Itk@Io%@Ik0IeIcGIa@I`IVIO@IJ;@IHIAI>]I= @I7@I6tI3I-I@III9@I9@II IP@I@IIg@Ig@HHH@HrH~@H,H@HCHHH @H @Hf@Hf@H@H+H@H׈H׈H7@HBH@HǶH@HH|@HHH@H{@H)HHL@H@H@H@HnH}H|@Ht@HsVHr@Hl@HkmHgy@HcH`H_@H^>HRa@HQHQHO@HFHFH$@DX@DU@DN@DN@DLDH@DGwDGwDDD@@D?D?D;@D;@D:HD:HD2_D1@D1@D-D+@D+@D'D!<@D!<@D!<@DDD@D@D@DDDDDD@D@D@D@D uD $@D D @D @DDDFC@C@C@C@CCCCCR@CCCCC@Ci@CC@C@CtC@C@CC:@CECCC @C @CعCعCعCعCC@C-C-C-C@C@CCǖ@C@CáCáCP@CP@C[C @C @CCg@Cg@CCC!@C~@C,C@CCCCC@CC@C@C@CZCZC @C @CCCf@Cf@Cf@CC@CqCqC @C @C @CCC}@C7@C7@C7@CBCBCYC@C@CC}@CqCqMiroslav Grepl 3.12.1-153.el7_0.11Miroslav Grepl 3.12.1-153.el7_0.10Miroslav Grepl 3.12.1-153.el7_0.9Miroslav Grepl 3.12.1-153.el7_0.8Miroslav Grepl 3.12.1-153.el7_0.7Miroslav Grepl 3.12.1-153.el7_0.6Miroslav Grepl 3.12.1-153.el7_0.5Miroslav Grepl 3.12.1-153.el7_0.4Miroslav Grepl 3.12.1-153.el7_0.3Miroslav Grepl 3.12.1-153.el7_0.2Miroslav Grepl 3.12.1-153.el7_0.1Miroslav Grepl 3.12.1-153Miroslav Grepl 3.12.1-152Miroslav Grepl 3.12.1-151Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-148Miroslav Grepl 3.12.1-147Miroslav Grepl 3.12.1-146Miroslav Grepl 3.12.1-145Miroslav Grepl 3.12.1-144Lukas Vrabec 3.12.1-143Miroslav Grepl 3.12.1-142Miroslav Grepl 3.12.1-141Miroslav Grepl 3.12.1-140Miroslav Grepl 3.12.1-139Lukas Vrabec 3.12.1-138Miroslav Grepl 3.12.1-137Miroslav Grepl 3.12.1-136Miroslav Grepl 3.12.1-135Miroslav Grepl 3.12.1-134Miroslav Grepl 3.12.1-133Miroslav Grepl 3.12.1-132Miroslav Grepl 3.12.1-131Miroslav Grepl 3.12.1-130Miroslav Grepl 3.12.1-129Miroslav Grepl 3.12.1-128Miroslav Grepl 3.12.1-127Miroslav Grepl 3.12.1-126Miroslav Grepl 3.12.1-125Miroslav Grepl 3.12.1-124Miroslav Grepl 3.12.1-123Miroslav Grepl 3.12.1-122Miroslav Grepl 3.12.1-121Miroslav Grepl 3.12.1-120Miroslav Grepl 3.12.1-119Miroslav Grepl 3.12.1-118Miroslav Grepl 3.12.1-117Miroslav Grepl 3.12.1-116Miroslav Grepl 3.12.1-115Miroslav Grepl 3.12.1-114Miroslav Grepl 3.12.1-113Miroslav Grepl 3.12.1-112Miroslav Grepl 3.12.1-111Miroslav Grepl 3.12.1-110Miroslav Grepl 3.12.1-109Miroslav Grepl 3.12.1-108Miroslav Grepl 3.12.1-107Dan Walsh 3.12.1-106Miroslav Grepl 3.12.1-105Miroslav Grepl 3.12.1-104Miroslav Grepl 3.12.1-103Miroslav Grepl 3.12.1-102Miroslav Grepl 3.12.1-101Miroslav Grepl 3.12.1-100Miroslav Grepl 3.12.1-99Miroslav Grepl 3.12.1-98Miroslav Grepl 3.12.1-97Miroslav Grepl 3.12.1-96Miroslav Grepl 3.12.1-95Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-93Miroslav Grepl 3.12.1-92Miroslav Grepl 3.12.1-91Miroslav Grepl 3.12.1-90Miroslav Grepl 3.12.1-89Miroslav Grepl 3.12.1-88Miroslav Grepl 3.12.1-87Miroslav Grepl 3.12.1-86Miroslav Grepl 3.12.1-85Miroslav Grepl 3.12.1-84Miroslav Grepl 3.12.1-83Miroslav Grepl 3.12.1-82Miroslav Grepl 3.12.1-81Miroslav Grepl 3.12.1-80Miroslav Grepl 3.12.1-79Miroslav Grepl 3.12.1-78Miroslav Grepl 3.12.1-77Miroslav Grepl 3.12.1-76Miroslav Grepl 3.12.1-75Miroslav Grepl 3.12.1-74Miroslav Grepl 3.12.1-73Miroslav Grepl 3.12.1-72Miroslav Grepl 3.12.1-71Miroslav Grepl 3.12.1-70Miroslav Grepl 3.12.1-69Miroslav Grepl 3.12.1-68Miroslav Grepl 3.12.1-67Miroslav Grepl 3.12.1-66Miroslav Grepl 3.12.1-65Miroslav Grepl 3.12.1-64Miroslav Grepl 3.12.1-63Miroslav Grepl 3.12.1-62Miroslav Grepl 3.12.1-61Miroslav Grepl 3.12.1-60Miroslav Grepl 3.12.1-59Miroslav Grepl 3.12.1-58Miroslav Grepl 3.12.1-57Miroslav Grepl 3.12.1-56Miroslav Grepl 3.12.1-55Miroslav Grepl 3.12.1-54Miroslav Grepl 3.12.1-53Miroslav Grepl 3.12.1-52Miroslav Grepl 3.12.1-51Miroslav Grepl 3.12.1-50Miroslav Grepl 3.12.1-49Miroslav Grepl 3.12.1-48Miroslav Grepl 3.12.1-47Miroslav Grepl 3.12.1-46Miroslav Grepl 3.12.1-45Miroslav Grepl 3.12.1-44Miroslav Grepl 3.12.1-43Miroslav Grepl 3.12.1-42Miroslav Grepl 3.12.1-41Miroslav Grepl 3.12.1-40Miroslav Grepl 3.12.1-39Miroslav Grepl 3.12.1-38Miroslav Grepl 3.12.1-37Miroslav Grepl 3.12.1-36Miroslav Grepl 3.12.1-35Miroslav Grepl 3.12.1-34Miroslav Grepl 3.12.1-33Miroslav Grepl 3.12.1-32Miroslav Grepl 3.12.1-31Miroslav Grepl 3.12.1-30Miroslav Grepl 3.12.1-29Dan Walsh 3.12.1-28Dan Walsh 3.12.1-27Miroslav Grepl 3.12.1-26Miroslav Grepl 3.12.1-25Miroslav Grepl 3.12.1-24Miroslav Grepl 3.12.1-23Miroslav Grepl 3.12.1-22Miroslav Grepl 3.12.1-21Miroslav Grepl 3.12.1-20Miroslav Grepl 3.12.1-19Miroslav Grepl 3.12.1-18Miroslav Grepl 3.12.1-17Miroslav Grepl 3.12.1-16Miroslav Grepl 3.12.1-15Miroslav Grepl 3.12.1-14Miroslav Grepl 3.12.1-13Miroslav Grepl 3.12.1-12Miroslav Grepl 3.12.1-11Miroslav Grepl 3.12.1-10Miroslav Grepl 3.12.1-9Miroslav Grepl 3.12.1-8Miroslav Grepl 3.12.1-7Miroslav Grepl 3.12.1-6Miroslav Grepl 3.12.1-5Miroslav Grepl 3.12.1-4Miroslav Grepl 3.12.1-3Miroslav Grepl 3.12.1-2Miroslav Grepl 3.12.1-1Dan Walsh 3.11.1-69.1Miroslav Grepl 3.11.1-69Miroslav Grepl 3.11.1-68Miroslav Grepl 3.11.1-67Miroslav Grepl 3.11.1-66Miroslav Grepl 3.11.1-65Miroslav Grepl 3.11.1-64Miroslav Grepl 3.11.1-63Miroslav Grepl 3.11.1-62Miroslav Grepl 3.11.1-61Miroslav Grepl 3.11.1-60Miroslav Grepl 3.11.1-59Miroslav Grepl 3.11.1-58Miroslav Grepl 3.11.1-57Miroslav Grepl 3.11.1-56Miroslav Grepl 3.11.1-55Miroslav Grepl 3.11.1-54Miroslav Grepl 3.11.1-53Miroslav Grepl 3.11.1-52Miroslav Grepl 3.11.1-51Miroslav Grepl 3.11.1-50Miroslav Grepl 3.11.1-49Miroslav Grepl 3.11.1-48Miroslav Grepl 3.11.1-47Miroslav Grepl 3.11.1-46Miroslav Grepl 3.11.1-45Miroslav Grepl 3.11.1-44Miroslav Grepl 3.11.1-43Miroslav Grepl 3.11.1-42Miroslav Grepl 3.11.1-41Miroslav Grepl 3.11.1-40Miroslav Grepl 3.11.1-39Miroslav Grepl 3.11.1-38Miroslav Grepl 3.11.1-37Miroslav Grepl 3.11.1-36Miroslav Grepl 3.11.1-35Miroslav Grepl 3.11.1-34Miroslav Grepl 3.11.1-33Miroslav Grepl 3.11.1-32Miroslav Grepl 3.11.1-31Miroslav Grepl 3.11.1-30Miroslav Grepl 3.11.1-29Miroslav Grepl 3.11.1-28Miroslav Grepl 3.11.1-27Miroslav Grepl 3.11.1-26Miroslav Grepl 3.11.1-25Miroslav Grepl 3.11.1-24Miroslav Grepl 3.11.1-23Miroslav Grepl 3.11.1-22Miroslav Grepl 3.11.1-21Miroslav Grepl 3.11.1-20Miroslav Grepl 3.11.1-19Miroslav Grepl 3.11.1-18Miroslav Grepl 3.11.1-17Miroslav Grepl 3.11.1-16Dan Walsh 3.11.1-15Miroslav Grepl 3.11.1-14Dan Walsh 3.11.1-13Miroslav Grepl 3.11.1-12Miroslav Grepl 3.11.1-11Miroslav Grepl 3.11.1-10Dan Walsh 3.11.1-9Dan Walsh 3.11.1-8Dan Walsh 3.11.1-7Dan Walsh 3.11.1-6Miroslav Grepl 3.11.1-5Miroslav Grepl 3.11.1-4Miroslav Grepl 3.11.1-3Miroslav Grepl 3.11.1-2Miroslav Grepl 3.11.1-1Miroslav Grepl 3.11.1-0Miroslav Grepl 3.11.0-15Miroslav Grepl 3.11.0-14Miroslav Grepl 3.11.0-13Miroslav Grepl 3.11.0-12Fedora Release Engineering - 3.11.0-11Miroslav Grepl 3.11.0-10Miroslav Grepl 3.11.0-9Miroslav Grepl 3.11.0-8Miroslav Grepl 3.11.0-7Miroslav Grepl 3.11.0-6Miroslav Grepl 3.11.0-5Miroslav Grepl 3.11.0-4Miroslav Grepl 3.11.0-3Miroslav Grepl 3.11.0-2Miroslav Grepl 3.11.0-1Miroslav Grepl 3.10.0-128Miroslav Grepl 3.10.0-127Miroslav Grepl 3.10.0-126Miroslav Grepl 3.10.0-125Miroslav Grepl 3.10.0-124Miroslav Grepl 3.10.0-123Miroslav Grepl 3.10.0-122Miroslav Grepl 3.10.0-121Miroslav Grepl 3.10.0-120Miroslav Grepl 3.10.0-119Miroslav Grepl 3.10.0-118Miroslav Grepl 3.10.0-117Miroslav Grepl 3.10.0-116Miroslav Grepl 3.10.0-115Miroslav Grepl 3.10.0-114Miroslav Grepl 3.10.0-113Miroslav Grepl 3.10.0-112Miroslav Grepl 3.10.0-111Miroslav Grepl 3.10.0-110Miroslav Grepl 3.10.0-109Miroslav Grepl 3.10.0-108Miroslav Grepl 3.10.0-107Miroslav Grepl 3.10.0-106Miroslav Grepl 3.10.0-105Miroslav Grepl 3.10.0-104Miroslav Grepl 3.10.0-103Miroslav Grepl 3.10.0-102Miroslav Grepl 3.10.0-101Miroslav Grepl 3.10.0-100Miroslav Grepl 3.10.0-99Miroslav Grepl 3.10.0-98Miroslav Grepl 3.10.0-97Miroslav Grepl 3.10.0-96Miroslav Grepl 3.10.0-95Miroslav Grepl 3.10.0-94Miroslav Grepl 3.10.0-93Miroslav Grepl 3.10.0-92Miroslav Grepl 3.10.0-91Miroslav Grepl 3.10.0-90Miroslav Grepl 3.10.0-89Miroslav Grepl 3.10.0-88Miroslav Grepl 3.10.0-87Miroslav Grepl 3.10.0-86Miroslav Grepl 3.10.0-85Miroslav Grepl 3.10.0-84Miroslav Grepl 3.10.0-83Miroslav Grepl 3.10.0-82Dan Walsh 3.10.0-81.2Miroslav Grepl 3.10.0-81Miroslav Grepl 3.10.0-80Miroslav Grepl 3.10.0-79Miroslav Grepl 3.10.0-78Miroslav Grepl 3.10.0-77Miroslav Grepl 3.10.0-76Miroslav Grepl 3.10.0-75Dan Walsh 3.10.0-74.2Miroslav Grepl 3.10.0-74Miroslav Grepl 3.10.0-73Miroslav Grepl 3.10.0-72Miroslav Grepl 3.10.0-71Miroslav Grepl 3.10.0-70Miroslav Grepl 3.10.0-69Miroslav Grepl 3.10.0-68Miroslav Grepl 3.10.0-67Miroslav Grepl 3.10.0-66Miroslav Grepl 3.10.0-65Miroslav Grepl 3.10.0-64Miroslav Grepl 3.10.0-63Miroslav Grepl 3.10.0-59Miroslav Grepl 3.10.0-58Dan Walsh 3.10.0-57Dan Walsh 3.10.0-56Dan Walsh 3.10.0-55.2Dan Walsh 3.10.0-55.1Miroslav Grepl 3.10.0-55Dan Walsh 3.10.0-54.1Miroslav Grepl 3.10.0-54Dan Walsh 3.10.0-53.1Miroslav Grepl 3.10.0-53Miroslav Grepl 3.10.0-52Miroslav Grepl 3.10.0-51Dan Walsh 3.10.0-50.2Dan Walsh 3.10.0-50.1Miroslav Grepl 3.10.0-50Miroslav Grepl 3.10.0-49Miroslav Grepl 3.10.0-48Miroslav Grepl 3.10.0-47Dan Walsh 3.10.0-46.1Miroslav Grepl 3.10.0-46Dan Walsh 3.10.0-45.1Miroslav Grepl 3.10.0-45Miroslav Grepl 3.10.0-43Miroslav Grepl 3.10.0-42Miroslav Grepl 3.10.0-41Dan Walsh 3.10.0-40.2Miroslav Grepl 3.10.0-40Dan Walsh 3.10.0-39.3Dan Walsh 3.10.0-39.2Dan Walsh 3.10.0-39.1Miroslav Grepl 3.10.0-39Dan Walsh 3.10.0-38.1Miroslav Grepl 3.10.0-38Miroslav Grepl 3.10.0-37Dan Walsh 3.10.0-36.1Miroslav Grepl 3.10.0-36Dan Walsh 3.10.0-35Dan Walsh 3.10.0-34.7Dan Walsh 3.10.0-34.6Dan Walsh 3.10.0-34.4Miroslav Grepl 3.10.0-34.3Dan Walsh 3.10.0-34.2Dan Walsh 3.10.0-34.1Miroslav Grepl 3.10.0-34Miroslav Grepl 3.10.0-33Dan Walsh 3.10.0-31.1Miroslav Grepl 3.10.0-31Miroslav Grepl 3.10.0-29Miroslav Grepl 3.10.0-28Miroslav Grepl 3.10.0-27Miroslav Grepl 3.10.0-26Miroslav Grepl 3.10.0-25Miroslav Grepl 3.10.0-24Miroslav Grepl 3.10.0-23Miroslav Grepl 3.10.0-22Miroslav Grepl 3.10.0-21Dan Walsh 3.10.0-20Miroslav Grepl 3.10.0-19Miroslav Grepl 3.10.0-18Miroslav Grepl 3.10.0-17Miroslav Grepl 3.10.0-16Miroslav Grepl 3.10.0-14Miroslav Grepl 3.10.0-13Miroslav Grepl 3.10.0-12Miroslav Grepl 3.10.0-11Miroslav Grepl 3.10.0-10Miroslav Grepl 3.10.0-9Miroslav Grepl 3.10.0-8Miroslav Grepl 3.10.0-7Miroslav Grepl 3.10.0-6Miroslav Grepl 3.10.0-5Miroslav Grepl 3.10.0-4Miroslav Grepl 3.10.0-3Miroslav Grepl 3.10.0-2Miroslav Grepl 3.10.0-1Miroslav Grepl 3.9.16-30Dan Walsh 3.9.16-29.1Miroslav Grepl 3.9.16-29Dan Walsh 3.9.16-28.1Miroslav Grepl 3.9.16-27Miroslav Grepl 3.9.16-26Miroslav Grepl 3.9.16-25Miroslav Grepl 3.9.16-24Miroslav Grepl 3.9.16-23Miroslav Grepl 3.9.16-22Miroslav Grepl 3.9.16-21Miroslav Grepl 3.9.16-20Miroslav Grepl 3.9.16-19Miroslav Grepl 3.9.16-18Miroslav Grepl 3.9.16-17Dan Walsh 3.9.16-16.1Miroslav Grepl 3.9.16-16Miroslav Grepl 3.9.16-15Miroslav Grepl 3.9.16-14Miroslav Grepl 3.9.16-13Miroslav Grepl 3.9.16-12Miroslav Grepl 3.9.16-11Miroslav Grepl 3.9.16-10Miroslav Grepl 3.9.16-7Miroslav Grepl 3.9.16-6Miroslav Grepl 3.9.16-5Miroslav Grepl 3.9.16-4Miroslav Grepl 3.9.16-3Miroslav Grepl 3.9.16-2Miroslav Grepl 3.9.16-1Miroslav Grepl 3.9.15-5Miroslav Grepl 3.9.15-2Miroslav Grepl 3.9.15-1Fedora Release Engineering - 3.9.14-2Dan Walsh 3.9.14-1Miroslav Grepl 3.9.13-10Miroslav Grepl 3.9.13-9Dan Walsh 3.9.13-8Miroslav Grepl 3.9.13-7Miroslav Grepl 3.9.13-6Miroslav Grepl 3.9.13-5Miroslav Grepl 3.9.13-4Miroslav Grepl 3.9.13-3Miroslav Grepl 3.9.13-2Miroslav Grepl 3.9.13-1Miroslav Grepl 3.9.12-8Miroslav Grepl 3.9.12-7Miroslav Grepl 3.9.12-6Miroslav Grepl 3.9.12-5Dan Walsh 3.9.12-4Dan Walsh 3.9.12-3Dan Walsh 3.9.12-2Miroslav Grepl 3.9.12-1Dan Walsh 3.9.11-2Miroslav Grepl 3.9.11-1Miroslav Grepl 3.9.10-13Dan Walsh 3.9.10-12Miroslav Grepl 3.9.10-11Miroslav Grepl 3.9.10-10Miroslav Grepl 3.9.10-9Miroslav Grepl 3.9.10-8Miroslav Grepl 3.9.10-7Miroslav Grepl 3.9.10-6Miroslav Grepl 3.9.10-5Dan Walsh 3.9.10-4Miroslav Grepl 3.9.10-3Miroslav Grepl 3.9.10-2Miroslav Grepl 3.9.10-1Miroslav Grepl 3.9.9-4Dan Walsh 3.9.9-3Miroslav Grepl 3.9.9-2Miroslav Grepl 3.9.9-1Miroslav Grepl 3.9.8-7Dan Walsh 3.9.8-6Miroslav Grepl 3.9.8-5Miroslav Grepl 3.9.8-4Dan Walsh 3.9.8-3Dan Walsh 3.9.8-2Dan Walsh 3.9.8-1Dan Walsh 3.9.7-10Dan Walsh 3.9.7-9Dan Walsh 3.9.7-8Dan Walsh 3.9.7-7Dan Walsh 3.9.7-6Dan Walsh 3.9.7-5Dan Walsh 3.9.7-4Dan Walsh 3.9.7-3Dan Walsh 3.9.7-2Dan Walsh 3.9.7-1Dan Walsh 3.9.6-3Dan Walsh 3.9.6-2Dan Walsh 3.9.6-1Dan Walsh 3.9.5-11Dan Walsh 3.9.5-10Dan Walsh 3.9.5-9Dan Walsh 3.9.5-8Dan Walsh 3.9.5-7Dan Walsh 3.9.5-6Dan Walsh 3.9.5-5Dan Walsh 3.9.5-4Dan Walsh 3.9.5-3Dan Walsh 3.9.5-2Dan Walsh 3.9.5-1Dan Walsh 3.9.4-3Dan Walsh 3.9.4-2Dan Walsh 3.9.4-1Dan Walsh 3.9.3-4Dan Walsh 3.9.3-3Dan Walsh 3.9.3-2Dan Walsh 3.9.3-1Dan Walsh 3.9.2-1Dan Walsh 3.9.1-3Dan Walsh 3.9.1-2Dan Walsh 3.9.1-1Dan Walsh 3.9.0-2Dan Walsh 3.9.0-1Dan Walsh 3.8.8-21Dan Walsh 3.8.8-20Dan Walsh 3.8.8-19Dan Walsh 3.8.8-18Dan Walsh 3.8.8-17Dan Walsh 3.8.8-16Dan Walsh 3.8.8-15Dan Walsh 3.8.8-14Dan Walsh 3.8.8-13Dan Walsh 3.8.8-12Dan Walsh 3.8.8-11Dan Walsh 3.8.8-10Dan Walsh 3.8.8-9Dan Walsh 3.8.8-8Dan Walsh 3.8.8-7Dan Walsh 3.8.8-6Dan Walsh 3.8.8-5Dan Walsh 3.8.8-4Dan Walsh 3.8.8-3Dan Walsh 3.8.8-2Dan Walsh 3.8.8-1Dan Walsh 3.8.7-3Dan Walsh 3.8.7-2Dan Walsh 3.8.7-1Dan Walsh 3.8.6-3Miroslav Grepl 3.8.6-2Dan Walsh 3.8.6-1Dan Walsh 3.8.5-1Dan Walsh 3.8.4-1Dan Walsh 3.8.3-4Dan Walsh 3.8.3-3Dan Walsh 3.8.3-2Dan Walsh 3.8.3-1Dan Walsh 3.8.2-1Dan Walsh 3.8.1-5Dan Walsh 3.8.1-4Dan Walsh 3.8.1-3Dan Walsh 3.8.1-2Dan Walsh 3.8.1-1Dan Walsh 3.7.19-22Dan Walsh 3.7.19-21Dan Walsh 3.7.19-20Dan Walsh 3.7.19-19Dan Walsh 3.7.19-17Dan Walsh 3.7.19-16Dan Walsh 3.7.19-15Dan Walsh 3.7.19-14Dan Walsh 3.7.19-13Dan Walsh 3.7.19-12Dan Walsh 3.7.19-11Dan Walsh 3.7.19-10Dan Walsh 3.7.19-9Dan Walsh 3.7.19-8Dan Walsh 3.7.19-7Dan Walsh 3.7.19-6Dan Walsh 3.7.19-5Dan Walsh 3.7.19-4Dan Walsh 3.7.19-3Dan Walsh 3.7.19-2Dan Walsh 3.7.19-1Dan Walsh 3.7.18-3Dan Walsh 3.7.18-2Dan Walsh 3.7.18-1Dan Walsh 3.7.17-6Dan Walsh 3.7.17-5Dan Walsh 3.7.17-4Dan Walsh 3.7.17-3Dan Walsh 3.7.17-2Dan Walsh 3.7.17-1Dan Walsh 3.7.16-2Dan Walsh 3.7.16-1Dan Walsh 3.7.15-4Dan Walsh 3.7.15-3Dan Walsh 3.7.15-2Dan Walsh 3.7.15-1Dan Walsh 3.7.14-5Dan Walsh 3.7.14-4Dan Walsh 3.7.14-3Dan Walsh 3.7.14-2Dan Walsh 3.7.14-1Dan Walsh 3.7.13-4Dan Walsh 3.7.13-3Dan Walsh 3.7.13-2Dan Walsh 3.7.13-1Dan Walsh 3.7.12-1Dan Walsh 3.7.11-1Dan Walsh 3.7.10-5Dan Walsh 3.7.10-4Dan Walsh 3.7.10-3Dan Walsh 3.7.10-2Dan Walsh 3.7.10-1Dan Walsh 3.7.9-4Dan Walsh 3.7.9-3Dan Walsh 3.7.9-2Dan Walsh 3.7.9-1Dan Walsh 3.7.8-11Dan Walsh 3.7.8-9Dan Walsh 3.7.8-8Dan Walsh 3.7.8-7Dan Walsh 3.7.8-6Dan Walsh 3.7.8-5Dan Walsh 3.7.8-4Dan Walsh 3.7.8-3Dan Walsh 3.7.8-2Dan Walsh 3.7.8-1Dan Walsh 3.7.7-3Dan Walsh 3.7.7-2Dan Walsh 3.7.7-1Dan Walsh 3.7.6-1Dan Walsh 3.7.5-8Dan Walsh 3.7.5-7Dan Walsh 3.7.5-6Dan Walsh 3.7.5-5Dan Walsh 3.7.5-4Dan Walsh 3.7.5-3Dan Walsh 3.7.5-2Dan Walsh 3.7.5-1Dan Walsh 3.7.4-4Dan Walsh 3.7.4-3Dan Walsh 3.7.4-2Dan Walsh 3.7.4-1Dan Walsh 3.7.3-1Dan Walsh 3.7.1-1Dan Walsh 3.6.33-2Dan Walsh 3.6.33-1Dan Walsh 3.6.32-17Dan Walsh 3.6.32-16Dan Walsh 3.6.32-15Dan Walsh 3.6.32-13Dan Walsh 3.6.32-12Dan Walsh 3.6.32-11Dan Walsh 3.6.32-10Dan Walsh 3.6.32-9Dan Walsh 3.6.32-8Dan Walsh 3.6.32-7Dan Walsh 3.6.32-6Dan Walsh 3.6.32-5Dan Walsh 3.6.32-4Dan Walsh 3.6.32-3Dan Walsh 3.6.32-2Dan Walsh 3.6.32-1Dan Walsh 3.6.31-5Dan Walsh 3.6.31-4Dan Walsh 3.6.31-3Dan Walsh 3.6.31-2Dan Walsh 3.6.30-6Dan Walsh 3.6.30-5Dan Walsh 3.6.30-4Dan Walsh 3.6.30-3Dan Walsh 3.6.30-2Dan Walsh 3.6.30-1Dan Walsh 3.6.29-2Dan Walsh 3.6.29-1Dan Walsh 3.6.28-9Dan Walsh 3.6.28-8Dan Walsh 3.6.28-7Dan Walsh 3.6.28-6Dan Walsh 3.6.28-5Dan Walsh 3.6.28-4Dan Walsh 3.6.28-3Dan Walsh 3.6.28-2Dan Walsh 3.6.28-1Dan Walsh 3.6.27-1Dan Walsh 3.6.26-11Dan Walsh 3.6.26-10Dan Walsh 3.6.26-9Bill Nottingham 3.6.26-8Dan Walsh 3.6.26-7Dan Walsh 3.6.26-6Dan Walsh 3.6.26-5Dan Walsh 3.6.26-4Dan Walsh 3.6.26-3Dan Walsh 3.6.26-2Dan Walsh 3.6.26-1Dan Walsh 3.6.25-1Dan Walsh 3.6.24-1Dan Walsh 3.6.23-2Dan Walsh 3.6.23-1Dan Walsh 3.6.22-3Dan Walsh 3.6.22-1Dan Walsh 3.6.21-4Dan Walsh 3.6.21-3Tom "spot" Callaway 3.6.21-2Dan Walsh 3.6.21-1Dan Walsh 3.6.20-2Dan Walsh 3.6.20-1Dan Walsh 3.6.19-5Dan Walsh 3.6.19-4Dan Walsh 3.6.19-3Dan Walsh 3.6.19-2Dan Walsh 3.6.19-1Dan Walsh 3.6.18-1Dan Walsh 3.6.17-1Dan Walsh 3.6.16-4Dan Walsh 3.6.16-3Dan Walsh 3.6.16-2Dan Walsh 3.6.16-1Dan Walsh 3.6.14-3Dan Walsh 3.6.14-2Dan Walsh 3.6.14-1Dan Walsh 3.6.13-3Dan Walsh 3.6.13-2Dan Walsh 3.6.13-1Dan Walsh 3.6.12-39Dan Walsh 3.6.12-38Dan Walsh 3.6.12-37Dan Walsh 3.6.12-36Dan Walsh 3.6.12-35Dan Walsh 3.6.12-34Dan Walsh 3.6.12-33Dan Walsh 3.6.12-31Dan Walsh 3.6.12-30Dan Walsh 3.6.12-29Dan Walsh 3.6.12-28Dan Walsh 3.6.12-27Dan Walsh 3.6.12-26Dan Walsh 3.6.12-25Dan Walsh 3.6.12-24Dan Walsh 3.6.12-23Dan Walsh 3.6.12-22Dan Walsh 3.6.12-21Dan Walsh 3.6.12-20Dan Walsh 3.6.12-19Dan Walsh 3.6.12-16Dan Walsh 3.6.12-15Dan Walsh 3.6.12-14Dan Walsh 3.6.12-13Dan Walsh 3.6.12-12Dan Walsh 3.6.12-11Dan Walsh 3.6.12-10Dan Walsh 3.6.12-9Dan Walsh 3.6.12-8Dan Walsh 3.6.12-7Dan Walsh 3.6.12-6Dan Walsh 3.6.12-5Dan Walsh 3.6.12-4Dan Walsh 3.6.12-3Dan Walsh 3.6.12-2Dan Walsh 3.6.12-1Dan Walsh 3.6.11-1Dan Walsh 3.6.10-9Dan Walsh 3.6.10-8Dan Walsh 3.6.10-7Dan Walsh 3.6.10-6Dan Walsh 3.6.10-5Dan Walsh 3.6.10-4Dan Walsh 3.6.10-3Dan Walsh 3.6.10-2Dan Walsh 3.6.10-1Dan Walsh 3.6.9-4Dan Walsh 3.6.9-3Dan Walsh 3.6.9-2Dan Walsh 3.6.9-1Dan Walsh 3.6.8-4Dan Walsh 3.6.8-3Dan Walsh 3.6.8-2Dan Walsh 3.6.8-1Dan Walsh 3.6.7-2Dan Walsh 3.6.7-1Dan Walsh 3.6.6-9Dan Walsh 3.6.6-8Fedora Release Engineering - 3.6.6-7Dan Walsh 3.6.6-6Dan Walsh 3.6.6-5Dan Walsh 3.6.6-4Dan Walsh 3.6.6-3Dan Walsh 3.6.6-2Dan Walsh 3.6.6-1Dan Walsh 3.6.5-3Dan Walsh 3.6.5-1Dan Walsh 3.6.4-6Dan Walsh 3.6.4-5Dan Walsh 3.6.4-4Dan Walsh 3.6.4-3Dan Walsh 3.6.4-2Dan Walsh 3.6.4-1Dan Walsh 3.6.3-13Dan Walsh 3.6.3-12Dan Walsh 3.6.3-11Dan Walsh 3.6.3-10Dan Walsh 3.6.3-9Dan Walsh 3.6.3-8Dan Walsh 3.6.3-7Dan Walsh 3.6.3-6Dan Walsh 3.6.3-3Dan Walsh 3.6.3-2Dan Walsh 3.6.3-1Dan Walsh 3.6.2-5Dan Walsh 3.6.2-4Dan Walsh 3.6.2-3Dan Walsh 3.6.2-2Dan Walsh 3.6.2-1Dan Walsh 3.6.1-15Dan Walsh 3.6.1-14Dan Walsh 3.6.1-13Dan Walsh 3.6.1-12Dan Walsh 3.6.1-11Dan Walsh 3.6.1-10Dan Walsh 3.6.1-9Dan Walsh 3.6.1-8Dan Walsh 3.6.1-7Dan Walsh 3.6.1-4Ignacio Vazquez-Abrams - 3.6.1-2Dan Walsh 3.5.13-19Dan Walsh 3.5.13-18Dan Walsh 3.5.13-17Dan Walsh 3.5.13-16Dan Walsh 3.5.13-15Dan Walsh 3.5.13-14Dan Walsh 3.5.13-13Dan Walsh 3.5.13-12Dan Walsh 3.5.13-11Dan Walsh 3.5.13-9Dan Walsh 3.5.13-8Dan Walsh 3.5.13-7Dan Walsh 3.5.13-6Dan Walsh 3.5.13-5Dan Walsh 3.5.13-4Dan Walsh 3.5.13-3Dan Walsh 3.5.13-2Dan Walsh 3.5.13-1Dan Walsh 3.5.12-3Dan Walsh 3.5.12-2Dan Walsh 3.5.12-1Dan Walsh 3.5.11-1Dan Walsh 3.5.10-3Dan Walsh 3.5.10-2Dan Walsh 3.5.10-1Dan Walsh 3.5.9-4Dan Walsh 3.5.9-3Dan Walsh 3.5.9-2Dan Walsh 3.5.9-1Dan Walsh 3.5.8-7Dan Walsh 3.5.8-6Dan Walsh 3.5.8-5Dan Walsh 3.5.8-4Dan Walsh 3.5.8-3Dan Walsh 3.5.8-1Dan Walsh 3.5.7-2Dan Walsh 3.5.7-1Dan Walsh 3.5.6-2Dan Walsh 3.5.6-1Dan Walsh 3.5.5-4Dan Walsh 3.5.5-3Dan Walsh 3.5.5-2Dan Walsh 3.5.4-2Dan Walsh 3.5.4-1Dan Walsh 3.5.3-1Dan Walsh 3.5.2-2Dan Walsh 3.5.1-5Dan Walsh 3.5.1-4Dan Walsh 3.5.1-3Dan Walsh 3.5.1-2Dan Walsh 3.5.1-1Dan Walsh 3.5.0-1Dan Walsh 3.4.2-14Dan Walsh 3.4.2-13Dan Walsh 3.4.2-12Dan Walsh 3.4.2-11Dan Walsh 3.4.2-10Dan Walsh 3.4.2-9Dan Walsh 3.4.2-8Dan Walsh 3.4.2-7Dan Walsh 3.4.2-6Dan Walsh 3.4.2-5Dan Walsh 3.4.2-4Dan Walsh 3.4.2-3Dan Walsh 3.4.2-2Dan Walsh 3.4.2-1Dan Walsh 3.4.1-5Dan Walsh 3.4.1-3Dan Walsh 3.4.1-2Dan Walsh 3.4.1-1Dan Walsh 3.3.1-48Dan Walsh 3.3.1-47Dan Walsh 3.3.1-46Dan Walsh 3.3.1-45Dan Walsh 3.3.1-44Dan Walsh 3.3.1-43Dan Walsh 3.3.1-42Dan Walsh 3.3.1-41Dan Walsh 3.3.1-39Dan Walsh 3.3.1-37Dan Walsh 3.3.1-36Dan Walsh 3.3.1-33Dan Walsh 3.3.1-32Dan Walsh 3.3.1-31Dan Walsh 3.3.1-30Dan Walsh 3.3.1-29Dan Walsh 3.3.1-28Dan Walsh 3.3.1-27Dan Walsh 3.3.1-26Dan Walsh 3.3.1-25Dan Walsh 3.3.1-24Dan Walsh 3.3.1-23Dan Walsh 3.3.1-22Dan Walsh 3.3.1-21Dan Walsh 3.3.1-20Dan Walsh 3.3.1-19Dan Walsh 3.3.1-18Dan Walsh 3.3.1-17Dan Walsh 3.3.1-16Dan Walsh 3.3.1-15Bill Nottingham 3.3.1-14Dan Walsh 3.3.1-13Dan Walsh 3.3.1-12Dan Walsh 3.3.1-11Dan Walsh 3.3.1-10Dan Walsh 3.3.1-9Dan Walsh 3.3.1-8Dan Walsh 3.3.1-6Dan Walsh 3.3.1-5Dan Walsh 3.3.1-4Dan Walsh 3.3.1-2Dan Walsh 3.3.1-1Dan Walsh 3.3.0-2Dan Walsh 3.3.0-1Dan Walsh 3.2.9-2Dan Walsh 3.2.9-1Dan Walsh 3.2.8-2Dan Walsh 3.2.8-1Dan Walsh 3.2.7-6Dan Walsh 3.2.7-5Dan Walsh 3.2.7-3Dan Walsh 3.2.7-2Dan Walsh 3.2.7-1Dan Walsh 3.2.6-7Dan Walsh 3.2.6-6Dan Walsh 3.2.6-5Dan Walsh 3.2.6-4Dan Walsh 3.2.6-3Dan Walsh 3.2.6-2Dan Walsh 3.2.6-1Dan Walsh 3.2.5-25Dan Walsh 3.2.5-24Dan Walsh 3.2.5-22Dan Walsh 3.2.5-21Dan Walsh 3.2.5-20Dan Walsh 3.2.5-19Dan Walsh 3.2.5-18Dan Walsh 3.2.5-17Dan Walsh 3.2.5-16Dan Walsh 3.2.5-15Dan Walsh 3.2.5-14Dan Walsh 3.2.5-13Dan Walsh 3.2.5-12Dan Walsh 3.2.5-11Dan Walsh 3.2.5-10Dan Walsh 3.2.5-9Dan Walsh 3.2.5-8Dan Walsh 3.2.5-7Dan Walsh 3.2.5-6Dan Walsh 3.2.5-5Dan Walsh 3.2.5-4Dan Walsh 3.2.5-3Dan Walsh 3.2.5-2Dan Walsh 3.2.5-1Dan Walsh 3.2.4-5Dan Walsh 3.2.4-4Dan Walsh 3.2.4-3Dan Walsh 3.2.4-1Dan Walsh 3.2.4-1Dan Walsh 3.2.3-2Dan Walsh 3.2.3-1Dan Walsh 3.2.2-1Dan Walsh 3.2.1-3Dan Walsh 3.2.1-1Dan Walsh 3.1.2-2Dan Walsh 3.1.2-1Dan Walsh 3.1.1-1Dan Walsh 3.1.0-1Dan Walsh 3.0.8-30Dan Walsh 3.0.8-28Dan Walsh 3.0.8-27Dan Walsh 3.0.8-26Dan Walsh 3.0.8-25Dan Walsh 3.0.8-24Dan Walsh 3.0.8-23Dan Walsh 3.0.8-22Dan Walsh 3.0.8-21Dan Walsh 3.0.8-20Dan Walsh 3.0.8-19Dan Walsh 3.0.8-18Dan Walsh 3.0.8-17Dan Walsh 3.0.8-16Dan Walsh 3.0.8-15Dan Walsh 3.0.8-14Dan Walsh 3.0.8-13Dan Walsh 3.0.8-12Dan Walsh 3.0.8-11Dan Walsh 3.0.8-10Dan Walsh 3.0.8-9Dan Walsh 3.0.8-8Dan Walsh 3.0.8-7Dan Walsh 3.0.8-5Dan Walsh 3.0.8-4Dan Walsh 3.0.8-3Dan Walsh 3.0.8-2Dan Walsh 3.0.8-1Dan Walsh 3.0.7-10Dan Walsh 3.0.7-9Dan Walsh 3.0.7-8Dan Walsh 3.0.7-7Dan Walsh 3.0.7-6Dan Walsh 3.0.7-5Dan Walsh 3.0.7-4Dan Walsh 3.0.7-3Dan Walsh 3.0.7-2Dan Walsh 3.0.7-1Dan Walsh 3.0.6-3Dan Walsh 3.0.6-2Dan Walsh 3.0.6-1Dan Walsh 3.0.5-11Dan Walsh 3.0.5-10Dan Walsh 3.0.5-9Dan Walsh 3.0.5-8Dan Walsh 3.0.5-7Dan Walsh 3.0.5-6Dan Walsh 3.0.5-5Dan Walsh 3.0.5-4Dan Walsh 3.0.5-3Dan Walsh 3.0.5-2Dan Walsh 3.0.5-1Dan Walsh 3.0.4-6Dan Walsh 3.0.4-5Dan Walsh 3.0.4-4Dan Walsh 3.0.4-3Dan Walsh 3.0.4-2Dan Walsh 3.0.4-1Dan Walsh 3.0.3-6Dan Walsh 3.0.3-5Dan Walsh 3.0.3-4Dan Walsh 3.0.3-3Dan Walsh 3.0.3-2Dan Walsh 3.0.3-1Dan Walsh 3.0.2-9Dan Walsh 3.0.2-8Dan Walsh 3.0.2-7Dan Walsh 3.0.2-5Dan Walsh 3.0.2-4Dan Walsh 3.0.2-3Dan Walsh 3.0.2-2Dan Walsh 3.0.1-5Dan Walsh 3.0.1-4Dan Walsh 3.0.1-3Dan Walsh 3.0.1-2Dan Walsh 3.0.1-1Dan Walsh 2.6.5-3Dan Walsh 2.6.5-2Dan Walsh 2.6.4-7Dan Walsh 2.6.4-6Dan Walsh 2.6.4-5Dan Walsh 2.6.4-2Dan Walsh 2.6.4-1Dan Walsh 2.6.3-1Dan Walsh 2.6.2-1Dan Walsh 2.6.1-4Dan Walsh 2.6.1-2Dan Walsh 2.6.1-1Dan Walsh 2.5.12-12Dan Walsh 2.5.12-11Dan Walsh 2.5.12-10Dan Walsh 2.5.12-8Dan Walsh 2.5.12-5Dan Walsh 2.5.12-4Dan Walsh 2.5.12-3Dan Walsh 2.5.12-2Dan Walsh 2.5.12-1Dan Walsh 2.5.11-8Dan Walsh 2.5.11-7Dan Walsh 2.5.11-6Dan Walsh 2.5.11-5Dan Walsh 2.5.11-4Dan Walsh 2.5.11-3Dan Walsh 2.5.11-2Dan Walsh 2.5.11-1Dan Walsh 2.5.10-2Dan Walsh 2.5.10-1Dan Walsh 2.5.9-6Dan Walsh 2.5.9-5Dan Walsh 2.5.9-4Dan Walsh 2.5.9-3Dan Walsh 2.5.9-2Dan Walsh 2.5.8-8Dan Walsh 2.5.8-7Dan Walsh 2.5.8-6Dan Walsh 2.5.8-5Dan Walsh 2.5.8-4Dan Walsh 2.5.8-3Dan Walsh 2.5.8-2Dan Walsh 2.5.8-1Dan Walsh 2.5.7-1Dan Walsh 2.5.6-1Dan Walsh 2.5.5-2Dan Walsh 2.5.5-1Dan Walsh 2.5.4-2Dan Walsh 2.5.4-1Dan Walsh 2.5.3-3Dan Walsh 2.5.3-2Dan Walsh 2.5.3-1Dan Walsh 2.5.2-6Dan Walsh 2.5.2-5Dan Walsh 2.5.2-4Dan Walsh 2.5.2-3Dan Walsh 2.5.2-2Dan Walsh 2.5.2-1Dan Walsh 2.5.1-5Dan Walsh 2.5.1-4Dan Walsh 2.5.1-2Dan Walsh 2.5.1-1Dan Walsh 2.4.6-20Dan Walsh 2.4.6-19Dan Walsh 2.4.6-18Dan Walsh 2.4.6-17Dan Walsh 2.4.6-16Dan Walsh 2.4.6-15Dan Walsh 2.4.6-14Dan Walsh 2.4.6-13Dan Walsh 2.4.6-12Dan Walsh 2.4.6-11Dan Walsh 2.4.6-10Dan Walsh 2.4.6-9Dan Walsh 2.4.6-8Dan Walsh 2.4.6-7Dan Walsh 2.4.6-6Dan Walsh 2.4.6-5Dan Walsh 2.4.6-4Dan Walsh 2.4.6-3Dan Walsh 2.4.6-1Dan Walsh 2.4.5-4Dan Walsh 2.4.5-3Dan Walsh 2.4.5-2Dan Walsh 2.4.5-1Dan Walsh 2.4.4-2Dan Walsh 2.4.4-2Dan Walsh 2.4.4-1Dan Walsh 2.4.3-13Dan Walsh 2.4.3-12Dan Walsh 2.4.3-11Dan Walsh 2.4.3-10Dan Walsh 2.4.3-9Dan Walsh 2.4.3-8Dan Walsh 2.4.3-7Dan Walsh 2.4.3-6Dan Walsh 2.4.3-5Dan Walsh 2.4.3-4Dan Walsh 2.4.3-3Dan Walsh 2.4.3-2Dan Walsh 2.4.3-1Dan Walsh 2.4.2-8Dan Walsh 2.4.2-7James Antill 2.4.2-6Dan Walsh 2.4.2-5Dan Walsh 2.4.2-4Dan Walsh 2.4.2-3Dan Walsh 2.4.2-2Dan Walsh 2.4.2-1Dan Walsh 2.4.1-5Dan Walsh 2.4.1-4Dan Walsh 2.4.1-3Dan Walsh 2.4.1-2Dan Walsh 2.4-4Dan Walsh 2.4-3Dan Walsh 2.4-2Dan Walsh 2.4-1Dan Walsh 2.3.19-4Dan Walsh 2.3.19-3Dan Walsh 2.3.19-2Dan Walsh 2.3.19-1James Antill 2.3.18-10James Antill 2.3.18-9Dan Walsh 2.3.18-8Dan Walsh 2.3.18-7Dan Walsh 2.3.18-6Dan Walsh 2.3.18-5Dan Walsh 2.3.18-4Dan Walsh 2.3.18-3Dan Walsh 2.3.18-2Dan Walsh 2.3.18-1Dan Walsh 2.3.17-2Dan Walsh 2.3.17-1Dan Walsh 2.3.16-9Dan Walsh 2.3.16-8Dan Walsh 2.3.16-7Dan Walsh 2.3.16-6Dan Walsh 2.3.16-5Dan Walsh 2.3.16-4Dan Walsh 2.3.16-2Dan Walsh 2.3.16-1Dan Walsh 2.3.15-2Dan Walsh 2.3.15-1Dan Walsh 2.3.14-8Dan Walsh 2.3.14-7Dan Walsh 2.3.14-6Dan Walsh 2.3.14-4Dan Walsh 2.3.14-3Dan Walsh 2.3.14-2Dan Walsh 2.3.14-1Dan Walsh 2.3.13-6Dan Walsh 2.3.13-5Dan Walsh 2.3.13-4Dan Walsh 2.3.13-3Dan Walsh 2.3.13-2Dan Walsh 2.3.13-1Dan Walsh 2.3.12-2Dan Walsh 2.3.12-1Dan Walsh 2.3.11-1Dan Walsh 2.3.10-7Dan Walsh 2.3.10-6Dan Walsh 2.3.10-3Dan Walsh 2.3.10-1Dan Walsh 2.3.9-6Dan Walsh 2.3.9-5Dan Walsh 2.3.9-4Dan Walsh 2.3.9-3Dan Walsh 2.3.9-2Dan Walsh 2.3.9-1Dan Walsh 2.3.8-2Dan Walsh 2.3.7-1Dan Walsh 2.3.6-4Dan Walsh 2.3.6-3Dan Walsh 2.3.6-2Dan Walsh 2.3.6-1Dan Walsh 2.3.5-1Dan Walsh 2.3.4-1Dan Walsh 2.3.3-20Dan Walsh 2.3.3-19Dan Walsh 2.3.3-18Dan Walsh 2.3.3-17Dan Walsh 2.3.3-16Dan Walsh 2.3.3-15Dan Walsh 2.3.3-14Dan Walsh 2.3.3-13Dan Walsh 2.3.3-12Dan Walsh 2.3.3-11Dan Walsh 2.3.3-10Dan Walsh 2.3.3-9Dan Walsh 2.3.3-8Dan Walsh 2.3.3-7Dan Walsh 2.3.3-6Dan Walsh 2.3.3-5Dan Walsh 2.3.3-4Dan Walsh 2.3.3-3Dan Walsh 2.3.3-2Dan Walsh 2.3.3-1Dan Walsh 2.3.2-4Dan Walsh 2.3.2-3Dan Walsh 2.3.2-2Dan Walsh 2.3.2-1Dan Walsh 2.3.1-1Dan Walsh 2.2.49-1Dan Walsh 2.2.48-1Dan Walsh 2.2.47-5Dan Walsh 2.2.47-4Dan Walsh 2.2.47-3Dan Walsh 2.2.47-1Dan Walsh 2.2.46-2Dan Walsh 2.2.46-1Dan Walsh 2.2.45-3Dan Walsh 2.2.45-2Dan Walsh 2.2.45-1Dan Walsh 2.2.44-1Dan Walsh 2.2.43-4Dan Walsh 2.2.43-3Dan Walsh 2.2.43-2Dan Walsh 2.2.43-1Dan Walsh 2.2.42-4Dan Walsh 2.2.42-3Dan Walsh 2.2.42-2Dan Walsh 2.2.42-1Dan Walsh 2.2.41-1Dan Walsh 2.2.40-2Dan Walsh 2.2.40-1Dan Walsh 2.2.39-2Dan Walsh 2.2.39-1Dan Walsh 2.2.38-6Dan Walsh 2.2.38-5Dan Walsh 2.2.38-4Dan Walsh 2.2.38-3Dan Walsh 2.2.38-2Dan Walsh 2.2.38-1Dan Walsh 2.2.37-1Dan Walsh 2.2.36-2Dan Walsh 2.2.36-1James Antill 2.2.35-2Dan Walsh 2.2.35-1Dan Walsh 2.2.34-3Dan Walsh 2.2.34-2Dan Walsh 2.2.34-1Dan Walsh 2.2.33-1Dan Walsh 2.2.32-2Dan Walsh 2.2.32-1Dan Walsh 2.2.31-1Dan Walsh 2.2.30-2Dan Walsh 2.2.30-1Dan Walsh 2.2.29-6Russell Coker 2.2.29-5Dan Walsh 2.2.29-4Dan Walsh 2.2.29-3Dan Walsh 2.2.29-2Dan Walsh 2.2.29-1Dan Walsh 2.2.28-3Dan Walsh 2.2.28-2Dan Walsh 2.2.28-1Dan Walsh 2.2.27-1Dan Walsh 2.2.25-3Dan Walsh 2.2.25-2Dan Walsh 2.2.24-1Dan Walsh 2.2.23-19Dan Walsh 2.2.23-18Dan Walsh 2.2.23-17Karsten Hopp 2.2.23-16Dan Walsh 2.2.23-15Dan Walsh 2.2.23-14Dan Walsh 2.2.23-13Dan Walsh 2.2.23-12Jeremy Katz - 2.2.23-11Jeremy Katz - 2.2.23-10Dan Walsh 2.2.23-9Dan Walsh 2.2.23-8Dan Walsh 2.2.23-7Dan Walsh 2.2.23-5Dan Walsh 2.2.23-4Dan Walsh 2.2.23-3Dan Walsh 2.2.23-2Dan Walsh 2.2.23-1Dan Walsh 2.2.22-2Dan Walsh 2.2.22-1Dan Walsh 2.2.21-9Dan Walsh 2.2.21-8Dan Walsh 2.2.21-7Dan Walsh 2.2.21-6Dan Walsh 2.2.21-5Dan Walsh 2.2.21-4Dan Walsh 2.2.21-3Dan Walsh 2.2.21-2Dan Walsh 2.2.21-1Dan Walsh 2.2.20-1Dan Walsh 2.2.19-2Dan Walsh 2.2.19-1Dan Walsh 2.2.18-2Dan Walsh 2.2.18-1Dan Walsh 2.2.17-2Dan Walsh 2.2.16-1Dan Walsh 2.2.15-4Dan Walsh 2.2.15-3Dan Walsh 2.2.15-1Dan Walsh 2.2.14-2Dan Walsh 2.2.14-1Dan Walsh 2.2.13-1Dan Walsh 2.2.12-1Dan Walsh 2.2.11-2Dan Walsh 2.2.11-1Dan Walsh 2.2.10-1Dan Walsh 2.2.9-2Dan Walsh 2.2.9-1Dan Walsh 2.2.8-2Dan Walsh 2.2.7-1Dan Walsh 2.2.6-3Dan Walsh 2.2.6-2Dan Walsh 2.2.6-1Dan Walsh 2.2.5-1Dan Walsh 2.2.4-1Dan Walsh 2.2.3-1Dan Walsh 2.2.2-1Dan Walsh 2.2.1-1Dan Walsh 2.1.13-1Dan Walsh 2.1.12-3Dan Walsh 2.1.11-1Dan Walsh 2.1.10-1Jeremy Katz - 2.1.9-2Dan Walsh 2.1.9-1Dan Walsh 2.1.8-3Dan Walsh 2.1.8-2Dan Walsh 2.1.8-1Dan Walsh 2.1.7-4Dan Walsh 2.1.7-3Dan Walsh 2.1.7-2Dan Walsh 2.1.7-1Dan Walsh 2.1.6-24Dan Walsh 2.1.6-23Dan Walsh 2.1.6-22Dan Walsh 2.1.6-21Dan Walsh 2.1.6-20Dan Walsh 2.1.6-18Dan Walsh 2.1.6-17Dan Walsh 2.1.6-16Dan Walsh 2.1.6-15Dan Walsh 2.1.6-14Dan Walsh 2.1.6-13Dan Walsh 2.1.6-11Dan Walsh 2.1.6-10Dan Walsh 2.1.6-9Dan Walsh 2.1.6-8Dan Walsh 2.1.6-5Dan Walsh 2.1.6-4Dan Walsh 2.1.6-3Dan Walsh 2.1.6-2Dan Walsh 2.1.6-1Dan Walsh 2.1.4-2Dan Walsh 2.1.4-1Dan Walsh 2.1.3-1Jeremy Katz - 2.1.2-3Dan Walsh 2.1.2-2Dan Walsh 2.1.2-1Dan Walsh 2.1.1-3Dan Walsh 2.1.1-2Dan Walsh 2.1.1-1Dan Walsh 2.1.0-3Dan Walsh 2.1.0-2.Dan Walsh 2.1.0-1.Dan Walsh 2.0.11-2.Dan Walsh 2.0.11-1.Dan Walsh 2.0.9-1.Dan Walsh 2.0.8-1.Dan Walsh 2.0.7-3Dan Walsh 2.0.7-2Dan Walsh 2.0.6-2Dan Walsh 2.0.5-4Dan Walsh 2.0.5-1Dan Walsh 2.0.4-1Dan Walsh 2.0.2-2Dan Walsh 2.0.2-1Dan Walsh 2.0.1-2Dan Walsh 2.0.1-1- Back port OpenStack fixes - Allow mdadm to connect to own socket created by mdadm running as kernel_t Resolves:#1132828- Allow swift to execute bin_t - Allow swift to bind http_cache - Label /var/log/horizon as an apache log- Allow neutron to bind xserver port - Allow neutron to execute kmod in insmod_t - Allow neutron to execute udevadm in udev_t - Allow keepalived to execute bin_t/shell_exec_t - Allow neutron to create sock files - Label swift-proxy-server as swift_exec_t- Allow rsync to create swift_server.lock with swift.log labeling - Add labeling for swift lock files - Make neutron_t as unconfined domain- Add more fixes for OpenStack - Add fixes for geard - Make openwsman as unconfined_domain in RHEL7.0- Back port openstack fixes - svirt sandbox domains to read gear content in /run - Allow gear_t to manage openshift files- More rules for gears and openshift Resolves:#1092405- Bump release to rebuild as z-stream Resolves:#1092405- Add fixes for gear to just execute ifconfig - More fixes for mongod_t Resolves:#1092405- Bump release Resolves:#1092405- Allow mongod to create sock files Resolves:#1092405 - Add additional fixes related to docker and upgrade issues- Change hsperfdata_root to have as user_tmp_t Resolves:#1076523- Fix Multiple same specifications for /var/named/chroot/dev/zero - Add labels for /var/named/chroot_sdb/dev devices - Add support for strongimcv - Use kerberos_keytab_domains in auth_use_nsswitch - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to - Allow net_raw cap for neutron_t and send sigkill to dnsmasq - Fix ntp_filetrans_named_content for sntp-kod file - Add httpd_dbus_sssd boolean - Dontaudit exec insmod in boinc policy - Rename kerberos_keytab_domain to kerberos_keytab_domains - Add kerberos_keytab_domain() - Fix kerberos_keytab_template() - Make all domains which use kerberos as kerberos_keytab_domain Resolves:#1083670 - Allow kill capability to winbind_t- varnishd wants chown capability - update ntp_filetrans_named_content() interface - Add additional fixes for neutron_t. #1083335 - Dontaudit getattr on proc_kcore_t - Allow pki_tomcat_t to read ipa lib files - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign - Allow init_t run /sbin/augenrules - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces - Allow unpriv SELinux user to use sandbox - Add default label for /tmp/hsperfdata_root- Add file subs also for /var/home- Allow xauth_t to read user_home_dir_t lnk_file - Add labeling for lightdm-data - Allow certmonger to manage ipa lib files - Add support for /var/lib/ipa - Allow pegasus to getattr virt_content - Added some new rules to pcp policy - Allow chrome_sandbox to execute config_home_t - Add support for ABRT FAF- Allow kdm to send signull to remote_login_t process - Add gear policy - Turn on gear_port_t - Allow cgit to read gitosis lib files by default - Allow vdagent to read xdm state - Allow NM and fcoeadm to talk together over unix_dgram_socket- Back port fixes for pegasus_openlmi_admin_t from rawhide Resolves:#1080973 - Add labels for ostree - Add SELinux awareness for NM - Label /usr/sbin/pwhistory_helper as updpwd_exec_t- add gnome_append_home_config() - Allow thumb to append GNOME config home files - Allow rasdaemon to rw /dev/cpu//msr - fix /var/log/pki file spec - make bacula_t as auth_nsswitch domain - Identify pki_tomcat_cert_t as a cert_type - Define speech-dispater_exec_t as an application executable - Add a new file context for /var/named/chroot/run directory - update storage_filetrans_all_named_dev for sg* devices - Allow auditctl_t to getattr on all removeable devices - Allow nsswitch_domains to stream connect to nmbd - Allow unprivusers to connect to memcached - label /var/lib/dirsrv/scripts-INSTANCE as bin_t- Allow also unpriv user to run vmtools - Allow secadm to read /dev/urandom and meminfo Resolves:#1079250 - Add booleans to allow docker processes to use nfs and samba - Add mdadm_tmpfs support - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t - Allow vmware-user-sui to use user ttys - Allow talk 2 users logged via console too - Allow ftp services to manage xferlog_t - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies - allow anaconda to dbus chat with systemd-localed- allow anaconda to dbus chat with systemd-localed - Add fixes for haproxy based on bperkins@redhat.com - Allow cmirrord to make dmsetup working - Allow NM to execute arping - Allow users to send messages through talk - Add userdom_tmp_role for secadm_t- Add additional fixes for rtas_errd - Fix transitions for tmp/tmpfs in rtas.te - Allow rtas_errd to readl all sysctls- Add support for /var/spool/rhsm/debug - Make virt_sandbox_use_audit as True by default - Allow svirt_sandbox_domains to ptrace themselves- Allow docker containers to manage /var/lib/docker content- Allow docker to read tmpfs_t symlinks - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets- Allow collectd to talk to libvirt - Allow chrome_sandbox to use leaked unix_stream_sockets - Dontaudit leaks of sockets into chrome_sandbox_t - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t - Run vmtools as unconfined domains - Allow snort to manage its log files - Allow systemd_cronjob_t to be entered via bin_t - Allow procman to list doveconf_etc_t - allow keyring daemon to create content in tmpfs directories - Add proper labelling for icedtea-web - vpnc is creating content in networkmanager var run directory - Label sddm as xdm_exec_t to make KDE working again - Allow postgresql to read network state - Allow java running as pki_tomcat to read network sysctls - Fix cgroup.te to allow cgred to read cgconfig_etc_t - Allow beam.smp to use ephemeral ports - Allow winbind to use the nis to authenticate passwords- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least. - Allow net_admin cap for fence_virtd running as fenced_t - Make abrt-java-connector working - Make cimtest script 03_defineVS.py of ComputerSystem group working - Fix git_system_enable_homedirs boolean - Allow munin mail plugins to read network systcl- Allow vmtools_helper_t to execute bin_t - Add support for /usr/share/joomla - /var/lib/containers should be labeled as openshift content for now - Allow docker domains to talk to the login programs, to allow a process to login into the container - Allow install_t do dbus chat with NM - Fix interface names in anaconda.if - Add install_t for anaconda. A new type is a part of anaconda policy - sshd to read network sysctls- Allow zabbix to send system log msgs - Allow init_t to stream connect to ipsec Resolves:#1060775- Add docker_connect_any boolean- Allow unpriv SELinux users to dbus chat with firewalld - Add lvm_write_metadata() - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type - Allow pegasus_openlmi_storage_t to write lvm metadata - Add hide_broken_symptoms for kdumpgui because of systemd bug - Make kdumpgui_t as unconfined domain Resolves:#1044299 - Allow docker to connect to tcp/5000- Allow numad to write scan_sleep_millisecs - Turn on entropyd_use_audio boolean by default - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf. - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo - Fix label on irclogs in the homedir - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix - Allow postgresql to use ldap - Add missing syslog-conn port - Add support for /dev/vmcp and /dev/sclp Resolves:#1069310- Modify xdm_write_home to allow create files/links in /root with xdm_home_ - Allow virt domains to read network state Resolves:#1072019- Added pcp rules - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6 - clean up ctdb.te - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow certmonger to list home dirs- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask - Add sysnet_filetrans_named_content_ifconfig() interface - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow kerberos keytab domains to manage sssd/userdomain keys" - Allow to run ip cmd in neutron_t domain- Allow block_suspend cap2 for systemd-logind and rw dri device - Add labeling for /usr/libexec/nm-libreswan-service - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working - Add xserver_rw_xdm_keys() - Allow rpm_script_t to dbus chat also with systemd-located - Fix ipa_stream_connect_otpd() - update lpd_manage_spool() interface - Allow krb5kdc to stream connect to ipa-otpd - Add ipa_stream_connect_otpd() interface - Allow vpnc to unlink NM pids - Add networkmanager_delete_pid_files() - Allow munin plugins to access unconfined plugins - update abrt_filetrans_named_content to cover /var/spool/debug - Label /var/spool/debug as abrt_var_cache_t - Allow rhsmcertd to connect to squid port - Make docker_transition_unconfined as optional boolean - Allow certmonger to list home dirs- Make snapperd as unconfined domain and add additional fixes for it - Remove nsplugin.pp module on upgrade- Add snapperd_home_t for HOME_DIR/.snapshots directory - Make sosreport as unconfined domain - Allow sosreport to execute grub2-probe - Allow NM to manage hostname config file - Allow systemd_timedated_t to dbus chat with rpm_script_t - Allow lsmd plugins to connect to http/ssh/http_cache ports by default - Add lsmd_plugin_connect_any boolean - Allow mozilla_plugin to attempt to set capabilities - Allow lsdm_plugins to use tcp_socket - Dontaudit mozilla plugin from getattr on /proc or /sys - Dontaudit use of the keyring by the services in a sandbox - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t - Allow rabbitmq_beam to connect to jabber_interserver_port - Allow logwatch_mail_t to transition to qmail_inject and queueu - Added new rules to pcp policy - Allow vmtools_helper_t to change role to system_r - Allow NM to dbus chat with vmtools - Fix couchdb_manage_files() to allow manage couchdb conf files - Add support for /var/run/redis.sock - dontaudit gpg trying to use audit - Allow consolekit to create log directories and files - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow pkcsslotd to read users state - Add ioctl to init_dontaudit_rw_stream_socket - Add systemd_hostnamed_manage_config() interface - Remove transition for temp dirs created by init_t - gdm-simple-slave uses use setsockopt - sddm-greater is a xdm type program- Add lvm_read_metadata() - Allow auditadm to search /var/log/audit dir - Add lvm_read_metadata() interface - Allow confined users to run vmtools helpers - Fix userdom_common_user_template() - Generic systemd unit scripts do write check on / - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files - Add additional fixes needed for init_t and setup script running in generic unit files - Allow general users to create packet_sockets - added connlcli port - Add init_manage_transient_unit() interface - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t - Fix userdomain.te to require passwd class - devicekit_power sends out a signal to all processes on the message bus when power is going down - Dontaudit rendom domains listing /proc and hittping system_map_t - Dontauit leaks of var_t into ifconfig_t - Allow domains that transition to ssh_t to manipulate its keyring - Define oracleasm_t as a device node - Change to handle /root as a symbolic link for os-tree - Allow sysadm_t to create packet_socket, also move some rules to attributes - Add label for openvswitch port - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label. - Allow postfix_local to read .forward in pcp lib files - Allow pegasus_openlmi_storage_t to read lvm metadata - Add additional fixes for pegasus_openlmi_storage_t - Allow bumblebee to manage debugfs - Make bumblebee as unconfined domain - Allow snmp to read etc_aliases_t - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem - Allow pegasus_openlmi_storage_t to read /proc/1/environ - Dontaudit read gconf files for cupsd_config_t - make vmtools as unconfined domain - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig. - Allow collectd_t to use a mysql database - Allow ipa-otpd to perform DNS name resolution - Added new policy for keepalived - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd - Add additional fixes new pscs-lite+polkit support - Add labeling for /run/krb5kdc - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20 - Allow pcscd to read users proc info - Dontaudit smbd_t sending out random signuls - Add boolean to allow openshift domains to use nfs - Allow w3c_validator to create content in /tmp - zabbix_agent uses nsswitch - Allow procmail and dovecot to work together to deliver mail - Allow spamd to execute files in homedir if boolean turned on - Allow openvswitch to listen on port 6634 - Add net_admin capability in collectd policy - Fixed snapperd policy - Fixed bugsfor pcp policy - Allow dbus_system_domains to be started by init - Fixed some interfaces - Add kerberos_keytab_domain attribute - Fix snapperd_conf_t def- Addopt corenet rules for unbound-anchor to rpm_script_t - Allow runuser to send send audit messages. - Allow postfix-local to search .forward in munin lib dirs - Allow udisks to connect to D-Bus - Allow spamd to connect to spamd port - Fix syntax error in snapper.te - Dontaudit osad to search gconf home files - Allow rhsmcertd to manage /etc/sysconf/rhn director - Fix pcp labeling to accept /usr/bin for all daemon binaries - Fix mcelog_read_log() interface - Allow iscsid to manage iscsi lib files - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it. - Make tuned_t as unconfined domain for RHEL7.0 - Allow ABRT to read puppet certs - Add sys_time capability for virt-ga - Allow gemu-ga to domtrans to hwclock_t - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages - Fix some AVCs in pcp policy - Add to bacula capability setgid and setuid and allow to bind to bacula ports - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t - Add access rhnsd and osad to /etc/sysconfig/rhn - drbdadm executes drbdmeta - Fixes needed for docker - Allow epmd to manage /var/log/rabbitmq/startup_err file - Allow beam.smp connect to amqp port - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t - Allow systemd_tmpfiles_t to manage all non security files on the system - Added labels for bacula ports - Fix label on /dev/vfio/vfio - Add kernel_mounton_messages() interface - init wants to manage lock files for iscsi- Added osad policy - Allow postfix to deliver to procmail - Allow bumblebee to seng kill signal to xserver - Allow vmtools to execute /usr/bin/lsb_release - Allow docker to write system net ctrls - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix pcp.te - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl- Turn on bacula, rhnsd policy - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl - Fixes for *_admin interfaces - Add pegasus_openlmi_storage_var_run_t type def - Add support for /var/run/openlmi-storage - Allow tuned to create syslog.conf with correct labeling - Add httpd_dontaudit_search_dirs boolean - Add support for winbind.service - ALlow also fail2ban-client to read apache logs - Allow vmtools to getattr on all fs - Add support for dey_sapi port - Add logging_filetrans_named_conf() - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring- Update snapper policy - Allow domains to append rkhunter lib files - Allow snapperd to getattr on all fs - Allow xdm to create /var/gdm with correct labeling - Add label for snapper.log - Allow fail2ban-client to read apache log files - Allow thumb_t to execute dbus-daemon in thumb_t- Allow gdm to create /var/gdm with correct labeling - Allow domains to append rkhunterl lib files. #1057982 - Allow systemd_tmpfiles_t net_admin to communicate with journald - Add interface to getattr on an isid_type for any type of file - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory - Allow initrc_t domtrans to authconfig if unconfined is enabled - Allow docker and mount on devpts chr_file - Allow docker to transition to unconfined_t if boolean set - init calling needs to be optional in domain.te - Allow uncofined domain types to handle transient unit files - Fix labeling for vfio devices - Allow net_admin capability and send system log msgs - Allow lldpad send dgram to NM - Add networkmanager_dgram_send() - rkhunter_var_lib_t is correct type - Back port pcp policy from rawhide - Allow openlmi-storage to read removable devices - Allow system cron jobs to manage rkhunter lib files - Add rkhunter_manage_lib_files() - Fix ftpd_use_fusefs boolean to allow manage also symlinks - Allow smbcontrob block_suspend cap2 - Allow slpd to read network and system state info - Allow NM domtrans to iscsid_t if iscsiadm is executed - Allow slapd to send a signal itself - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA. - Fix plymouthd_create_log() interface - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container - Allow postfix and cyrus-imapd to work out of box - Allow fcoemon to talk with unpriv user domain using unix_stream_socket - Dontaudit domains that are calling into journald to net_admin - Add rules to allow vmtools to do what it does - snapperd is D-Bus service - Allow OpenLMI PowerManagement to call 'systemctl --force reboot' - Add haproxy_connect_any boolean - Allow haproxy also to use http cache port by default Resolves:#1058248- Allow apache to write to the owncloud data directory in /var/www/html... - Allow consolekit to create log dir - Add support for icinga CGI scripts - Add support for icinga - Allow kdumpctl_t to create kdump lock file Resolves:#1055634 - Allow kdump to create lnk lock file - Allow nscd_t block_suspen capability - Allow unconfined domain types to manage own transient unit file - Allow systemd domains to handle transient init unit files - Add interfaces to handle transient- Add cron unconfined role support for uncofined SELinux user - Call corenet_udp_bind_all_ports() in milter.te - Allow fence_virtd to connect to zented port - Fix header for mirrormanager_admin() - Allow dkim-milter to bind udp ports - Allow milter domains to send signull itself - Allow block_suspend for yum running as mock_t - Allow beam.smp to manage couchdb files - Add couchdb_manage_files() - Add labeling for /var/log/php_errors.log - Allow bumblebee to stream connect to xserver - Allow bumblebee to send a signal to xserver - gnome-thumbnail to stream connect to bumblebee - Allow xkbcomp running as bumblebee_t to execute bin_t - Allow logrotate to read squid.conf - Additional rules to get docker and lxc to play well with SELinux - Allow bumbleed to connect to xserver port - Allow pegasus_openlmi_storage_t to read hwdata- Allow init_t to work on transitient and snapshot unit files - Add logging_manage_syslog_config() - Update sysnet_dns_name_resolve() to allow connect to dnssec por - Allow pegasus_openlmi_storage_t to read hwdata Resolves:#1031721 - Fix rhcs_rw_cluster_tmpfs() - Allow fenced_t to bind on zented udp port - Added policy for vmtools - Fix mirrormanager_read_lib_files() - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files - Allow ctdb to create sock files in /var/run/ctdb - Add sblim_filetrans_named_content() interface - Allow rpm scritplets to create /run/gather with correct labeling - Allow gnome keyring domains to create gnome config dirs - Dontaudit read/write to init stream socket for lsmd_plugin_t - Allow automount to read nfs link files - Allow lsm plugins to read/write lsmd stream socket - Allow certmonger to connect ldap port to make IPA CA certificate renewal working. - Add also labeling for /var/run/ctdb - Add missing labeling for /var/lib/ctdb - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446 - Dontaudit hypervkvp to search homedirs - Dontaudit hypervkvp to search admin homedirs - Allow hypervkvp to execute bin_t and ifconfig in the caller domain - Dontaudit xguest_t to read ABRT conf files - Add abrt_dontaudit_read_config() - Allow namespace-init to getattr on fs - Add thumb_role() also for xguest - Add filename transitions to create .spamassassin with correct labeling - Allow apache domain to read mirrormanager pid files - Allow domains to read/write shm and sem owned by mozilla_plugin_t - Allow alsactl to send a generic signal to kernel_t- Add back rpm_run() for unconfined user- Add missing files_create_var_lib_dirs() - Fix typo in ipsec.te - Allow passwd to create directory in /var/lib - Add filename trans also for event21 - Allow iptables command to read /dev/rand - Add sigkill capabilityfor ipsec_t - Add filename transitions for bcache devices - Add additional rules to create /var/log/cron by syslogd_t with correct labeling - Add give everyone full access to all key rings - Add default lvm_var_run_t label for /var/run/multipathd - Fix log labeling to have correct default label for them after logrotate - Labeled ~/.nv/GLCache as being gstreamer output - Allow nagios_system_plugin to read mrtg lib files - Add mrtg_read_lib_files() - Call rhcs_rw_cluster_tmpfs for dlm_controld - Make authconfing as named_filetrans domain - Allow virsh to connect to user process using stream socket - Allow rtas_errd to read rand/urand devices and add chown capability - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp Resolves:#1051497 - Add also chown cap for abrt_upload_watch_t. It already has dac_override - Allow sosreport to manage rhsmcertd pid files - Add rhsmcertd_manage_pid_files() - Allow also setgid cap for rpc.gssd - Dontaudit access check for abrt on cert_t - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind- Fix semanage import handling in spec file- Add default lvm_var_run_t label for /var/run/multipathd Resolves:#1051430 - Fix log labeling to have correct default label for them after logrotate - Add files_write_root_dirs - Add new openflow port label for 6653/tcp and 6633/tcp - Add xserver_manage_xkb_libs() - Label tcp/8891 as milter por - Allow gnome_manage_generic_cache_files also create cache_home_t files - Fix aide.log labeling - Fix log labeling to have correct default label for them after logrotate - Allow mysqld-safe write access on /root to make mysqld working - Allow sosreport domtrans to prelikn - Allow OpenvSwitch to connec to openflow ports - Allow NM send dgram to lldpad - Allow hyperv domains to execute shell - Allow lsmd plugins stream connect to lsmd/init - Allow sblim domains to create /run/gather with correct labeling - Allow httpd to read ldap certs - Allow cupsd to send dbus msgs to process with different MLS level - Allow bumblebee to stream connect to apmd - Allow bumblebee to run xkbcomp - Additional allow rules to get libvirt-lxc containers working with docker - Additional allow rules to get libvirt-lxc containers working with docker - Allow docker to getattr on itself - Additional rules needed for sandbox apps - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled - httpd should be able to send signal/signull to httpd_suexec_t - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.- Add neutron fixes- Allow sshd to write to all process levels in order to change passwd when running at a level - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range - Allow apcuspd_t to status and start the power unit file - Allow udev to manage kdump unit file - Added new interface modutils_dontaudit_exec_insmod - Allow cobbler to search dhcp_etc_t directory - systemd_systemctl needs sys_admin capability - Allow sytemd_tmpfiles_t to delete all directories - passwd to create gnome-keyring passwd socket - Add missing zabbix_var_lib_t type - Fix filename trans for zabbixsrv in zabbix.te - Allow fprintd_t to send syslog messages - Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port - Allow mozilla plugin to chat with policykit, needed for spice - Allow gssprozy to change user and gid, as well as read user keyrings - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly - Allow polipo to connect to http_cache_ports - Allow cron jobs to manage apache var lib content - Allow yppassword to manage the passwd_file_t - Allow showall_t to send itself signals - Allow cobbler to restart dhcpc, dnsmasq and bind services - Allow certmonger to manage home cert files - Add userdom filename trans for user mail domains - Allow apcuspd_t to status and start the power unit file - Allow cgroupdrulesengd to create content in cgoups directories - Allow smbd_t to signull cluster - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t - Add label for /var/spool/cron.aquota.user - Allow sandbox_x domains to use work with the mozilla plugin semaphore - Added new policy for speech-dispatcher - Added dontaudit rule for insmod_exec_t in rasdaemon policy - Updated rasdaemon policy - Allow system_mail_t to transition to postfix_postdrop_t - Clean up mirrormanager policy - Allow virt_domains to read cert files, needs backport to RHEL7 - Allow sssd to read systemd_login_var_run_t - Allow irc_t to execute shell and bin-t files: - Add new access for mythtv - Allow rsync_t to manage all non auth files - allow modemmanger to read /dev/urand - Allow sandbox apps to attempt to set and get capabilties- Add labeling for /var/lib/servicelog/servicelog.db-journal - Add support for freeipmi port - Add sysadm_u_default_contexts - Make new type to texlive files in homedir - Allow subscription-manager running as sosreport_t to manage rhsmcertd - Additional fixes for docker.te - Remove ability to do mount/sys_admin by default in virt_sandbox domains - New rules required to run docker images within libivrt - Add label for ~/.cvsignore - Change mirrormanager to be run by cron - Add mirrormanager policy - Fixed bumblebee_admin() and mip6d_admin() - Add log support for sensord - Fix typo in docker.te - Allow amanda to do backups over UDP - Allow bumblebee to read /etc/group and clean up bumblebee.te - type transitions with a filename not allowed inside conditionals - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7 - Make new type to texlive files in homedir- Allow freeipmi_ipmidetectd_t to use freeipmi port - Update freeipmi_domain_template() - Allow journalctl running as ABRT to read /run/log/journal - Allow NM to read dispatcher.d directory - Update freeipmi policy - Type transitions with a filename not allowed inside conditionals - Allow tor to bind to hplip port - Make new type to texlive files in homedir - Allow zabbix_agent to transition to dmidecode - Add rules for docker - Allow sosreport to send signull to unconfined_t - Add virt_noatsecure and virt_rlimitinh interfaces - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port - Add sysadm_u_default_contexts - Add logging_read_syslog_pid() - Fix userdom_manage_home_texlive() interface - Make new type to texlive files in homedir - Add filename transitions for /run and /lock links - Allow virtd to inherit rlimit information Resolves:#975358- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t Resolves:#1039879 - Add labeling for /usr/lib/systemd/system/mariadb.service - Allow hyperv_domain to read sysfs - Fix ldap_read_certs() interface to allow acess also link files - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt - Allow tuned to run modprobe - Allow portreserve to search /var/lib/sss dir - Add SELinux support for the teamd package contains team network device control daemon. - Dontaudit access check on /proc for bumblebee - Bumblebee wants to load nvidia modules - Fix rpm_named_filetrans_log_files and wine.te - Add conman policy for rawhide - DRM master and input event devices are used by the TakeDevice API - Clean up bumblebee policy - Update pegasus_openlmi_storage_t policy - Add freeipmi_stream_connect() interface - Allow logwatch read madm.conf to support RAID setup - Add raid_read_conf_files() interface - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling - add rpm_named_filetrans_log_files() interface - Allow dkim-milter to create files/dirs in /tmp - update freeipmi policy - Add policy for freeipmi services - Added rdisc_admin and rdisc_systemctl interfaces - opensm policy clean up - openwsman policy clean up - ninfod policy clean up - Added new policy for ninfod - Added new policy for openwsman - Added rdisc_admin and rdisc_systemctl interfaces - Fix kernel_dontaudit_access_check_proc() - Add support for /dev/uhid - Allow sulogin to get the attributes of initctl and sys_admin cap - Add kernel_dontaudit_access_check_proc() - Fix dev_rw_ipmi_dev() - Fix new interface in devices.if - DRM master and input event devices are used by the TakeDevice API - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev() - Added support for default conman port - Add interfaces for ipmi devices- Allow sosreport to send a signal to ABRT - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t - Label /usr/sbin/htcacheclean as httpd_exec_t Resolves:#1037529 - Added support for rdisc unit file - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs - Allow runuser running as logrotate connections to system DBUS - Label bcache devices as fixed_disk_device_t - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t- Add back setpgid/setsched for sosreport_t- Added fix for clout_init to transition to rpm_script_t (dwalsh@redhat.com)- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel. - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on - Add lsmd_plugin_t for lsm plugins - Allow dovecot-deliver to search mountpoints - Add labeling for /etc/mdadm.conf - Allow opelmi admin providers to dbus chat with init_t - Allow sblim domain to read /dev/urandom and /dev/random - Allow apmd to request the kernel load modules - Add glusterd_brick_t type - label mate-keyring-daemon with gkeyringd_exec_t - Add plymouthd_create_log() - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6 - Allow sssd to request the kernel loads modules - Allow gpg_agent to use ssh-add - Allow gpg_agent to use ssh-add - Dontaudit access check on /root for myslqd_safe_t - Allow ctdb to getattr on al filesystems - Allow abrt to stream connect to syslog - Allow dnsmasq to list dnsmasq.d directory - Watchdog opens the raw socket - Allow watchdog to read network state info - Dontaudit access check on lvm lock dir - Allow sosreport to send signull to setroubleshootd - Add setroubleshoot_signull() interface - Fix ldap_read_certs() interface - Allow sosreport all signal perms - Allow sosreport to run systemctl - Allow sosreport to dbus chat with rpm - Add glusterd_brick_t files type - Allow zabbix_agentd to read all domain state - Clean up rtas.if - Allow smoltclient to execute ldconfig - Allow sosreport to request the kernel to load a module - Fix userdom_confined_admin_template() - Add back exec_content boolean for secadm, logadm, auditadm - Fix files_filetrans_system_db_named_files() interface - Allow sulogin to getattr on /proc/kcore - Add filename transition also for servicelog.db-journal - Add files_dontaudit_access_check_root() - Add lvm_dontaudit_access_check_lock() interface- Allow watchdog to read /etc/passwd - Allow browser plugins to connect to bumblebee - New policy for bumblebee and freqset - Add new policy for mip6d daemon - Add new policy for opensm daemon - Allow condor domains to read/write condor_master udp_socket - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift - Add back file_pid_filetrans for /var/run/dlm_controld - Allow smbd_t to use inherited tmpfs content - Allow mcelog to use the /dev/cpu device - sosreport runs rpcinfo - sosreport runs subscription-manager - Allow staff_t to run frequency command - Allow systemd_tmpfiles to relabel log directories - Allow staff_t to read xserver_log file - Label hsperfdata_root as tmp_t- More sosreport fixes to make ABRT working- Fix files_dontaudit_unmount_all_mountpoints() - Add support for 2608-2609 tcp/udp ports - Should allow domains to lock the terminal device - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - We need to require passwd rootok - Fix zebra.fc - Fix dnsmasq_filetrans_named_content() interface - Allow all sandbox domains create content in svirt_home_t - Allow zebra domains also create zebra_tmp_t files in /tmp - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services. - Fix labeling on neutron and remove transition to iconfig_t - abrt needs to read mcelog log file - Fix labeling on dnsmasq content - Fix labeling on /etc/dnsmasq.d - Allow glusterd to relabel own lib files - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd - Allow ipc_lock for abrt to run journalctl- Fix config.tgz- Fix passenger_stream_connect interface - setroubleshoot_fixit wants to read network state - Allow procmail_t to connect to dovecot stream sockets - Allow cimprovagt service providers to read network states - Add labeling for /var/run/mariadb - pwauth uses lastlog() to update system's lastlog - Allow account provider to read login records - Add support for texlive2013 - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - Allow passwd_t to connect to gnome keyring to change password - Update mls config files to have cronjobs in the user domains - Remove access checks that systemd does not actually do- Add support for yubikey in homedir - Add support for upd/3052 port - Allow apcupsd to use PowerChute Network Shutdown - Allow lsmd to execute various lsmplugins - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too - Update gluster_export_all_rw boolean to allow relabel all base file types - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling- Add files_relabel_base_file_types() interface - Allow netlabel-config to read passwd - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr() - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling - Allow pegasus to domtrans to mount_t - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts - Add support for unconfined watchdog scripts - Allow watchdog to manage own log files- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory. - Label /etc/yum.repos.d as system_conf_t - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t - Allow dac_override for sysadm_screen_t - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file. - Allow netlabel-config to read meminfo - Add interface to allow docker to mounton file_t - Add new interface to exec unlabeled files - Allow lvm to use docker semaphores - Setup transitons for .xsessions-errors.old - Change labels of files in /var/lib/*/.ssh to transition properly - Allow staff_t and user_t to look at logs using journalctl - pluto wants to manage own log file - Allow pluto running as ipsec_t to create pluto.log - Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files. - Additional access for docker - Added more rules to sblim policy - Fix kdumpgui_run_bootloader boolean - Allow dspam to connect to lmtp port - Included sfcbd service into sblim policy - rhsmcertd wants to manaage /etc/pki/consumer dir - Add kdumpgui_run_bootloader boolean - Add support for /var/cache/watchdog - Remove virt_domain attribute for virt_qemu_ga_unconfined_t - Fixes for handling libvirt containes - Dontaudit attempts by mysql_safe to write content into / - Dontaudit attempts by system_mail to modify network config - Allow dspam to bind to lmtp ports - Add new policy to allow staff_t and user_t to look at logs using journalctl - Allow apache cgi scripts to list sysfs - Dontaudit attempts to write/delete user_tmp_t files - Allow all antivirus domains to manage also own log dirs - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Add missing permission checks for nscd- Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Add file transition rules for content created by f5link - Rename quantum_port information to neutron - Allow all antivirus domains to manage also own log dirs - Rename quantum_port information to neutron - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Allow sysadm_t to read login information - Allow systemd_tmpfiles to setattr on var_log_t directories - Udpdate Makefile to include systemd_contexts - Add systemd_contexts - Add fs_exec_hugetlbfs_files() interface - Add daemons_enable_cluster_mode boolean - Fix rsync_filetrans_named_content() - Add rhcs_read_cluster_pid_files() interface - Update rhcs.if with additional interfaces from RHEL6 - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t - Allow glusterd_t to mounton glusterd_tmp_t - Allow glusterd to unmout al filesystems - Allow xenstored to read virt config - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label - Allow mozilla_plugin_t to mmap hugepages as an executable- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp- Allow sshd_t to read openshift content, needs backport to RHEL6.5 - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t - Make sur kdump lock is created with correct label if kdumpctl is executed - gnome interface calls should always be made within an optional_block - Allow syslogd_t to connect to the syslog_tls port - Add labeling for /var/run/charon.ctl socket - Add kdump_filetrans_named_content() - Allo setpgid for fenced_t - Allow setpgid and r/w cluster tmpfs for fenced_t - gnome calls should always be within optional blocks - wicd.pid should be labeled as networkmanager_var_run_t - Allow sys_resource for lldpad- Add rtas policy- Allow mailserver_domains to manage and transition to mailman data - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands - Allow mailserver_domains to manage and transition to mailman data - Allow svirt_domains to read sysctl_net_t - Allow thumb_t to use tmpfs inherited from the user - Allow mozilla_plugin to bind to the vnc port if running with spice - Add new attribute to discover confined_admins and assign confined admin to it - Fix zabbix to handle attributes in interfaces - Fix zabbix to read system states for all zabbix domains - Fix piranha_domain_template() - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files. - Allow lldpad sys_rouserce cap due to #986870 - Allow dovecot-auth to read nologin - Allow openlmi-networking to read /proc/net/dev - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t - Add zabbix_domain attribute for zabbix domains to treat them together - Add labels for zabbix-poxy-* (#1018221) - Update openlmi-storage policy to reflect #1015067 - Back port piranha tmpfs fixes from RHEL6 - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop - Add postfix_rw_spool_maildrop_files interface - Call new userdom_admin_user_templat() also for sysadm_secadm.pp - Fix typo in userdom_admin_user_template() - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey - Add new attribute to discover confined_admins - Fix labeling for /etc/strongswan/ipsec.d - systemd_logind seems to pass fd to anyone who dbus communicates with it - Dontaudit leaked write descriptor to dmesg- Activate motion policy- Fix gnome_read_generic_data_home_files() - allow openshift_cgroup_t to read/write inherited openshift file types - Remove httpd_cobbler_content * from cobbler_admin interface - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container - Allow httpd_t to read also git sys content symlinks - Allow init_t to read gnome home data - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it. - Allow virsh to execute systemctl - Fix for nagios_services plugins - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - Fix hypervkvp.te - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Fix logging policy - Allow syslog to bind to tls ports - Update labeling for /dev/cdc-wdm - Allow to su_domain to read init states - Allow init_t to read gnome home data - Make sure if systemd_logind creates nologin file with the correct label - Clean up ipsec.te- Add auth_exec_chkpwd interface - Fix port definition for ctdb ports - Allow systemd domains to read /dev/urand - Dontaudit attempts for mozilla_plugin to append to /dev/random - Add label for /var/run/charon.* - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service - Fix for nagios_services plugins - Fix some bugs in zoneminder policy - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - glusterd binds to random unreserved ports - Additional allow rules found by testing glusterfs - apcupsd needs to send a message to all users on the system so needs to look them up - Fix the label on ~/.juniper_networks - Dontaudit attempts for mozilla_plugin to append to /dev/random - Allow polipo_daemon to connect to flash ports - Allow gssproxy_t to create replay caches - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type- init reload from systemd_localed_t - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd - Allow systemd_localed_t to ask systemd to reload the locale. - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory - Allow readahead to read /dev/urand - Fix lots of avcs about tuned - Any file names xenstored in /var/log should be treated as xenstored_var_log_t - Allow tuned to inderact with hugepages - Allow condor domains to list etc rw dirs- Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Add additional fixes forpegasus_openlmi_account_t - Allow mdadm to read /dev/urand - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it - Add label/rules for /etc/mdadm.conf - Allow pegasus_openlmi_storage_t to transition to fsadm_t - Fixes for interface definition problems - Dontaudit dovecot-deliver to gettatr on all fs dirs - Allow domains to search data_home_t directories - Allow cobblerd to connect to mysql - Allow mdadm to r/w kdump lock files - Add support for kdump lock files - Label zarafa-search as zarafa-indexer - Openshift cgroup wants to read /etc/passwd - Add new sandbox domains for kvm - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on - Fix labeling for /usr/lib/systemd/system/lvm2.* - Add labeling for /usr/lib/systemd/system/lvm2.* - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules - Add sshd_keygen_t policy for sshd-keygen - Fix alsa_home_filetrans interface name and definition - Allow chown for ssh_keygen_t - Add fs_dontaudit_getattr_all_dirs() - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys - Fix up patch to allow systemd to manage home content - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled - Allow getty to exec hostname to get info - Add systemd_home_t for ~/.local/share/systemd directory- Fix lxc labels in config.tgz- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper - Allow tuned to search all file system directories - Allow alsa_t to sys_nice, to get top performance for sound management - Add support for MySQL/PostgreSQL for amavis - Allow openvpn_t to manage openvpn_var_log_t files. - Allow dirsrv_t to create tmpfs_t directories - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label - Dontaudit leaked unix_stream_sockets into gnome keyring - Allow telepathy domains to inhibit pipes on telepathy domains - Allow cloud-init to domtrans to rpm - Allow abrt daemon to manage abrt-watch tmp files - Allow abrt-upload-watcher to search /var/spool directory - Allow nsswitch domains to manage own process key - Fix labeling for mgetty.* logs - Allow systemd to dbus chat with upower - Allow ipsec to send signull to itself - Allow setgid cap for ipsec_t - Match upstream labeling- Do not build sanbox pkg on MLS- wine_tmp is no longer needed - Allow setroubleshoot to look at /proc - Allow telepathy domains to dbus with systemd logind - Fix handling of fifo files of rpm - Allow mozilla_plugin to transition to itself - Allow certwatch to write to cert_t directories - New abrt application - Allow NetworkManager to set the kernel scheduler - Make wine_domain shared by all wine domains - Allow mdadm_t to read images labeled svirt_image_t - Allow amanda to read /dev/urand - ALlow my_print_default to read /dev/urand - Allow mdadm to write to kdumpctl fifo files - Allow nslcd to send signull to itself - Allow yppasswd to read /dev/urandom - Fix zarafa_setrlimit - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add additional alias for user_tmp_t because wine_tmp_t is no longer used - More handling of ther kernel keyring required by kerberos - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed- Dontaudit attempts by sosreport to read shadow_t - Allow browser sandbox plugins to connect to cups to print - Add new label mpd_home_t - Label /srv/www/logs as httpd_log_t - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add labels for apache logs under miq package - Allow irc_t to use tcp sockets - fix labels in puppet.if - Allow tcsd to read utmp file - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys - Define svirt_socket_t as a domain_type - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t - Fix label on pam_krb5 helper apps- Allow ldconfig to write to kdumpctl fifo files - allow neutron to connect to amqp ports - Allow kdump_manage_crash to list the kdump_crash_t directory - Allow glance-api to connect to amqp port - Allow virt_qemu_ga_t to read meminfo - Add antivirus_home_t type for antivirus date in HOMEDIRS - Allow mpd setcap which is needed by pulseaudio - Allow smbcontrol to create content in /var/lib/samba - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts - amanda_exec_t needs to be executable file - Allow block_suspend cap for samba-net - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t - Allow init_t to run crash utility - Treat usr_t just like bin_t for transitions and executions - Add port definition of pka_ca to port 829 for openshift - Allow selinux_store to use symlinks- Allow block_suspend cap for samba-net - Allow t-mission-control to manage gabble cache files - Allow nslcd to read /sys/devices/system/cpu - Allow selinux_store to use symlinks- Allow xdm_t to transition to itself - Call neutron interfaces instead of quantum - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t - Make sure directories in /run get created with the correct label - Make sure /root/.pki gets created with the right label - try to remove labeling for motion from zoneminder_exec_t to bin_t - Allow inetd_t to execute shell scripts - Allow cloud-init to read all domainstate - Fix to use quantum port - Add interface netowrkmanager_initrc_domtrans - Fix boinc_execmem - Allow t-mission-control to read gabble cache home - Add labeling for ~/.cache/telepathy/avatars/gabble - Allow memcache to read sysfs data - Cleanup antivirus policy and add additional fixes - Add boolean boinc_enable_execstack - Add support for couchdb in rabbitmq policy - Add interface couchdb_search_pid_dirs - Allow firewalld to read NM state - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files()- Split out rlogin ports from inetd - Treat files labeld as usr_t like bin_t when it comes to transitions - Allow staff_t to read login config - Allow ipsec_t to read .google authenticator data - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files() - Call the correct interface - corenet_udp_bind_ktalkd_port() - Allow all domains that can read gnome_config to read kde config - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work - Allow mdadm to getattr any file system - Allow a confined domain to executes mozilla_exec_t via dbus - Allow cupsd_lpd_t to bind to the printer port - Dontaudit attempts to bind to ports < 1024 when nis is turned on - Allow apache domain to connect to gssproxy socket - Allow rlogind to bind to the rlogin_port - Allow telnetd to bind to the telnetd_port - Allow ktalkd to bind to the ktalkd_port - Allow cvs to bind to the cvs_port- Cleanup related to init_domain()+inetd_domain fixes - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain - svirt domains neeed to create kobject_uevint_sockets - Lots of new access required for sosreport - Allow tgtd_t to connect to isns ports - Allow init_t to transition to all inetd domains: - openct needs to be able to create netlink_object_uevent_sockets - Dontaudit leaks into ldconfig_t - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls - Move kernel_stream_connect into all Xwindow using users - Dontaudit inherited lock files in ifconfig o dhcpc_t- Also sock_file trans rule is needed in lsm - Fix labeling for fetchmail pid files/dirs - Add additional fixes for abrt-upload-watch - Fix polipo.te - Fix transition rules in asterisk policy - Add fowner capability to networkmanager policy - Allow polipo to connect to tor ports - Cleanup lsmd.if - Cleanup openhpid policy - Fix kdump_read_crash() interface - Make more domains as init domain - Fix cupsd.te - Fix requires in rpm_rw_script_inherited_pipes - Fix interfaces in lsm.if - Allow munin service plugins to manage own tmpfs files/dirs - Allow virtd_t also relabel unix stream sockets for virt_image_type - Make ktalk as init domain - Fix to define ktalkd_unit_file_t correctly - Fix ktalk.fc - Add systemd support for talk-server - Allow glusterd to create sock_file in /run - Allow xdm_t to delete gkeyringd_tmp_t files on logout - Add fixes for hypervkvp policy - Add logwatch_can_sendmail boolean - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb - Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add selinux-policy-sandbox pkg0 - Allow rhsmcertd to read init state - Allow fsetid for pkcsslotd - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service - Allow fetchmail to create own pid with correct labeling - Fix rhcs_domain_template() - Allow roles which can run mock to read mock lib files to view results - Allow rpcbind to use nsswitch - Fix lsm.if summary - Fix collectd_t can read /etc/passwd file - Label systemd unit files under dracut correctly - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh - Add support for .Xauthority-n - Label umount.crypt as lvm_exec_t - Allow syslogd to search psad lib files - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files- Add policy for lsmd - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory - Update condor_master rules to allow read system state info and allow logging - Add labeling for /etc/condor and allow condor domain to write it (bug) - Allow condor domains to manage own logs - Allow glusterd to read domains state - Fix initial hypervkvp policy - Add policy for hypervkvpd - Fix redis.if summary- Allow boinc to connect to @/tmp/.X11-unix/X0 - Allow beam.smp to connect to tcp/5984 - Allow named to manage own log files - Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t - Add virt_transition_userdomain boolean decl - Allow httpd_t to sendto unix_dgram sockets on its children - Allow nova domains to execute ifconfig - bluetooth wants to create fifo_files in /tmp - exim needs to be able to manage mailman data - Allow sysstat to getattr on all file systems - Looks like bluetoothd has moved - Allow collectd to send ping packets - Allow svirt_lxc domains to getpgid - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff - Allow frpintd_t to read /dev/urandom - Allow asterisk_t to create sock_file in /var/run - Allow usbmuxd to use netlink_kobject - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket - More cleanup of svirt_lxc policy - virtd_lxc_t now talks to dbus - Dontaudit leaked ptmx_t - Allow processes to use inherited fifo files - Allow openvpn_t to connect to squid ports - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert() - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files - Allow user roles to connect to the journal socket- selinux_set_enforce_mode needs to be used with type - Add append to the dontaudit for unix_stream_socket of xdm_t leak - Allow xdm_t to create symlinks in log direcotries - Allow login programs to read afs config - Label 10933 as a pop port, for dovecot - New policy to allow selinux_server.py to run as semanage_t as a dbus service - Add fixes to make netlabelctl working on MLS - AVCs required for running sepolicy gui as staff_t - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC - New dbus server to be used with new gui - After modifying some files in /etc/mail, I saw this needed on the next boot - Loading a vm from /usr/tmp with virt-manager - Clean up oracleasm policy for Fedora - Add oracleasm policy written by rlopez@redhat.com - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache - Add label for /var/crash - Allow fenced to domtrans to sanclok_t - Allow nagios to manage nagios spool files - Make tfptd as home_manager - Allow kdump to read kcore on MLS system - Allow mysqld-safe sys_nice/sys_resource caps - Allow apache to search automount tmp dirs if http_use_nfs is enabled - Allow crond to transition to named_t, for use with unbound - Allow crond to look at named_conf_t, for unbound - Allow mozilla_plugin_t to transition its home content - Allow dovecot_domain to read all system and network state - Allow httpd_user_script_t to call getpw - Allow semanage to read pid files - Dontaudit leaked file descriptors from user domain into thumb - Make PAM authentication working if it is enabled in ejabberd - Add fixes for rabbit to fix ##992920,#992931 - Allow glusterd to mount filesystems - Loading a vm from /usr/tmp with virt-manager - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device - Add fix for pand service - shorewall touches own log - Allow nrpe to list /var - Mozilla_plugin_roles can not be passed into lpd_run_lpr - Allow afs domains to read afs_config files - Allow login programs to read afs config - Allow virt_domain to read virt_var_run_t symlinks - Allow smokeping to send its process signals - Allow fetchmail to setuid - Add kdump_manage_crash() interface - Allow abrt domain to write abrt.socket- Add more aliases in pegasus.te - Add more fixes for *_admin interfaces - Add interface fixes - Allow nscd to stream connect to nmbd - Allow gnupg apps to write to pcscd socket - Add more fixes for openlmi provides. Fix naming and support for additionals - Allow fetchmail to resolve host names - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te - Fix corecmd_exec_chroot() - Fix logging_relabel_syslog_pid_socket interface - Fix typo in unconfineduser.te - Allow system_r to access unconfined_dbusd_t to run hp_chec- Allow xdm_t to act as a dbus client to itsel - Allow fetchmail to resolve host names - Allow gnupg apps to write to pcscd socket - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te -httpd_t does access_check on certs- Add support for cmpiLMI_Service-cimprovagt - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t - Add support for pycmpiLMI_Storage-cimprovagt - Add support for cmpiLMI_Networking-cimprovagt - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working - Allow virtual machines and containers to run as user doains, needed for virt-sandbox - Allow buglist.cgi to read cpu info- Allow systemd-tmpfile to handle tmp content in print spool dir - Allow systemd-sysctl to send system log messages - Add support for RTP media ports and fmpro-internal - Make auditd working if audit is configured to perform SINGLE action on disk error - Add interfaces to handle systemd units - Make systemd-notify working if pcsd is used - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t - Instead of having all unconfined domains get all of the named transition rules, - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default. - Add definition for the salt ports - Allow xdm_t to create link files in xdm_var_run_t - Dontaudit reads of blk files or chr files leaked into ldconfig_t - Allow sys_chroot for useradd_t - Allow net_raw cap for ipsec_t - Allow sysadm_t to reload services - Add additional fixes to make strongswan working with a simple conf - Allow sysadm_t to enable/disable init_t services - Add additional glusterd perms - Allow apache to read lnk files in the /mnt directory - Allow glusterd to ask the kernel to load a module - Fix description of ftpd_use_fusefs boolean - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t - Allow glusterds to request load a kernel module - Allow boinc to stream connect to xserver_t - Allow sblim domains to read /etc/passwd - Allow mdadm to read usb devices - Allow collectd to use ping plugin - Make foghorn working with SNMP - Allow sssd to read ldap certs - Allow haproxy to connect to RTP media ports - Add additional trans rules for aide_db - Add labeling for /usr/lib/pcsd/pcsd - Add labeling for /var/log/pcsd - Add support for pcs which is a corosync and pacemaker configuration tool- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1 - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown - consolekit needs to be able to shut down system - Move around interfaces - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints - Allow gconf-defaults-m to read /etc/passwd - Fix pki_rw_tomcat_cert() interface to support lnk_files- Add support for gluster ports - Make sure that all keys located in /etc/ssh/ are labeled correctly - Make sure apcuspd lock files get created with the correct label - Use getcap in gluster.te - Fix gluster policy - add additional fixes to allow beam.smp to interact with couchdb files - Additional fix for #974149 - Allow gluster to user gluster ports - Allow glusterd to transition to rpcd_t and add additional fixes for #980683 - Allow tgtd working when accessing to the passthrough device - Fix labeling for mdadm unit files- Add mdadm fixes- Fix definition of sandbox.disabled to sandbox.pp.disabled- Allow mdamd to execute systemctl - Allow mdadm to read /dev/kvm - Allow ipsec_mgmt_t to read l2tpd pid content- Allow nsd_t to read /dev/urand - Allow mdadm_t to read framebuffer - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t - Allow mozilla_plugin_config_t to create tmp files - Cleanup openvswitch policy - Allow mozilla plugin to getattr on all executables - Allow l2tpd_t to create fifo_files in /var/run - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory - Allow mdadm to connecto its own unix_stream_socket - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now. - Allow apache to access smokeping pid files - Allow rabbitmq_beam_t to getattr on all filesystems - Add systemd support for iodined - Allow nup_upsdrvctl_t to execute its entrypoint - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch - add labeling for ~/.cache/libvirt-sandbox - Add interface to allow domains transitioned to by confined users to send sigchld to screen program - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs. - Allow staff to getsched all domains, required to run htop - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Add prosody policy written by Michael Scherer - Allow nagios plugins to read /sys info - ntpd needs to manage own log files - Add support for HOME_DIR/.IBMERS - Allow iptables commands to read firewalld config - Allow consolekit_t to read utmp - Fix filename transitions on .razor directory - Add additional fixes to make DSPAM with LDA working - Allow snort to read /etc/passwd - Allow fail2ban to communicate with firewalld over dbus - Dontaudit openshift_cgreoup_file_t read/write leaked dev - Allow nfsd to use mountd port - Call th proper interface - Allow openvswitch to read sys and execute plymouth - Allow tmpwatch to read /var/spool/cups/tmp - Add support for /usr/libexec/telepathy-rakia - Add systemd support for zoneminder - Allow mysql to create files/directories under /var/log/mysql - Allow zoneminder apache scripts to rw zoneminder tmpfs - Allow httpd to manage zoneminder lib files - Add zoneminder_run_sudo boolean to allow to start zoneminder - Allow zoneminder to send mails - gssproxy_t sock_file can be under /var/lib - Allow web domains to connect to whois port. - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t. - We really need to add an interface to corenet to define what a web_client_domain is and - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain. - Add labeling for cmpiLMI_LogicalFile-cimprovagt - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules - Update policy rules for pegasus_openlmi_logicalfile_t - Add initial types for logicalfile/unconfined OpenLMI providers - mailmanctl needs to read own log - Allow logwatch manage own lock files - Allow nrpe to read meminfo - Allow httpd to read certs located in pki-ca - Add pki_read_tomcat_cert() interface - Add support for nagios openshift plugins - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab- Make DSPAM to act as a LDA working - Allow ntop to create netlink socket - Allow policykit to send a signal to policykit-auth - Allow stapserver to dbus chat with avahi/systemd-logind - Fix labeling on haproxy unit file - Clean up haproxy policy - A new policy for haproxy and placed it to rhcs.te - Add support for ldirectord and treat it with cluster_t - Make sure anaconda log dir is created with var_log_t- Allow lvm_t to create default targets for filesystem handling - Fix labeling for razor-lightdm binaries - Allow insmod_t to read any file labeled var_lib_t - Add policy for pesign - Activate policy for cmpiLMI_Account-cimprovagt - Allow isnsd syscall=listen - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler - Allow ctdbd to use udp/4379 - gatherd wants sys_nice and setsched - Add support for texlive2012 - Allow NM to read file_t (usb stick with no labels used to transfer keys for example) - Allow cobbler to execute apache with domain transition- condor_collector uses tcp/9000 - Label /usr/sbin/virtlockd as virtd_exec_t for now - Allow cobbler to execute ldconfig - Allow NM to execute ssh - Allow mdadm to read /dev/crash - Allow antivirus domains to connect to snmp port - Make amavisd-snmp working correctly - Allow nfsd_t to mounton nfsd_fs_t - Add initial snapper policy - We still need to have consolekit policy - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow dirsrv to read network state - Fix pki_read_tomcat_lib_files - Add labeling for /usr/libexec/nm-ssh-service - Add label cert_t for /var/lib/ipa/pki-ca/publish - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant - Allow nfsd_t to mounton nfsd_fs_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow passwd_t to change role to system_r from unconfined_r- Don't audit access checks by sandbox xserver on xdb var_lib - Allow ntop to read usbmon devices - Add labeling for new polcykit authorizor - Dontaudit access checks from fail2ban_client - Don't audit access checks by sandbox xserver on xdb var_lib - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream - Fix labeling for all /usr/bim/razor-lightdm-* binaries - Add filename trans for /dev/md126p1- Make vdagent able to request loading kernel module - Add support for cloud-init make it as unconfined domain - Allow snmpd to run smartctl in fsadm_t domain - remove duplicate openshift_search_lib() interface - Allow mysqld to search openshift lib files - Allow openshift cgroup to interact with passedin file descriptors - Allow colord to list directories inthe users homedir - aide executes prelink to check files - Make sure cupsd_t creates content in /etc/cups with the correct label - Lest dontaudit apache read all domains, so passenger will not cause this avc - Allow gssd to connect to gssproxy - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS - Allow systemd-tmpfiles to relabel also lock files - Allow useradd to add homdir in /var/lib/openshift - Allow setfiles and semanage to write output to /run/files- Add labeling for /dev/tgt - Dontaudit leak fd from firewalld for modprobe - Allow runuser running as rpm_script_t to create netlink_audit socket - Allow mdadm to read BIOS non-volatile RAM- accountservice watches when accounts come and go in wtmp - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket - Add httpd_use_sasl boolean - Allow net_admin for tuned_t - iscsid needs sys_module to auto-load kernel modules - Allow blueman to read bluetooth conf - Add nova_manage_lib_files() interface - Fix mplayer_filetrans_home_content() - Add mplayer_filetrans_home_content() - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t - Revert "Allow thumb_t to append inherited xdm stream socket" - Add iscsi_filetrans_named_content() interface - Allow to create .mplayer with the correct labeling for unconfined - Allow iscsiadmin to create lock file with the correct labeling- Allow wine to manage wine home content - Make amanda working with socket actiovation - Add labeling for /usr/sbin/iscsiadm - Add support for /var/run/gssproxy.sock - dnsmasq_t needs to read sysctl_net_t- Fix courier_domain_template() interface - Allow blueman to write ip_forward - Allow mongodb to connect to mongodb port - Allow mongodb to connect to mongodb port - Allow java to bind jobss_debug port - Fixes for *_admin interfaces - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality - Need to assign attribute for courier_domain to all courier_domains - Fail2ban reads /etc/passwd - postfix_virtual will create new files in postfix_spool_t - abrt triggers sys_ptrace by running pidof - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it - Add passenger fixes needed by foreman - Remove dup interfaces - Add additional interfaces for quantum - Add new interfaces for dnsmasq - Allow passenger to read localization and send signull to itself - Allow dnsmasq to stream connect to quantum - Add quantum_stream_connect() - Make sure that mcollective starts the service with the correct labeling - Add labels for ~/.manpath - Dontaudit attempts by svirt_t to getpw* calls - sandbox domains are trying to look at parent process data - Allow courior auth to create its pid file in /var/spool/courier subdir - Add fixes for beam to have it working with couchdb - Add labeling for /run/nm-xl2tpd.con - Allow apache to stream connect to thin - Add systemd support for amand - Make public types usable for fs mount points - Call correct mandb interface in domain.te - Allow iptables to r/w quantum inherited pipes and send sigchld - Allow ifconfig domtrans to iptables and execute ldconfig - Add labels for ~/.manpath - Allow systemd to read iscsi lib files - seunshare is trying to look at parent process data- Fix openshift_search_lib - Add support for abrt-uefioops-oops - Allow colord to getattr any file system - Allow chrome processes to look at each other - Allow sys_ptrace for abrt_t - Add new policy for gssproxy - Dontaudit leaked file descriptor writes from firewalld - openshift_net_type is interface not template - Dontaudit pppd to search gnome config - Update openshift_search_lib() interface - Add fs_list_pstorefs() - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18 - Better labels for raspberry pi devices - Allow init to create devpts_t directory - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18 - Allow sysadm_t to build kernels - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18 - Allow userdomains to stream connect to gssproxy - Dontaudit leaked file descriptor writes from firewalld - Allow xserver to read /dev/urandom - Add additional fixes for ipsec-mgmt - Make SSHing into an Openshift Enterprise Node working- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime - with the proper label. - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files - Allow systemd-timedated to create adjtime - Add clock_create_adjtime() - Additional fix ifconfing for #966106 - Allow kernel_t to create boot.log with correct labeling - Remove unconfined_mplayer for which we don't have rules - Rename interfaces - Add userdom_manage_user_home_files/dirs interfaces - Fix files_dontaudit_read_all_non_security_files - Fix ipsec_manage_key_file() - Fix ipsec_filetrans_key_file() - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t - Fix labeling for ipse.secrets - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid - Add files_dontaudit_read_all_non_security_files() interface - /var/log/syslog-ng should be labeled var_log_t - Make ifconfig_var_run_t a mountpoint - Add transition from ifconfig to dnsmasq - Allow ifconfig to execute bin_t/shell_exec_t - We want to have hwdb.bin labeled as etc_t - update logging_filetrans_named_content() interface - Allow systemd_timedate_t to manage /etc/adjtime - Allow NM to send signals to l2tpd - Update antivirus_can_scan_system boolean - Allow devicekit_disk_t to sys_config_tty - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories - Make printing from vmware working - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes - Add virt_qemu_ga_data_t for qemu-ga - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both - Fix typo in virt.te - Add virt_qemu_ga_unconfined_t for hook scripts - Make sure NetworkManager files get created with the correct label - Add mozilla_plugin_use_gps boolean - Fix cyrus to have support for net-snmp - Additional fixes for dnsmasq and quantum for #966106 - Add plymouthd_create_log() - remove httpd_use_oddjob for which we don't have rules - Add missing rules for httpd_can_network_connect_cobbler - Add missing cluster_use_execmem boolean - Call userdom_manage_all_user_home_type_files/dirs - Additional fix for ftp_home_dir - Fix ftp_home_dir boolean - Allow squit to recv/send client squid packet - Fix nut.te to have nut_domain attribute - Add support for ejabberd; TODO: revisit jabberd and rabbit policy - Fix amanda policy - Add more fixes for domains which use libusb - Make domains which use libusb working correctly - Allow l2tpd to create ipsec key files with correct labeling and manage them - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files - Allow rabbitmq-beam to bind generic node - Allow l2tpd to read ipse-mgmt pid files - more fixes for l2tpd, NM and pppd from #967072- Dontaudit to getattr on dirs for dovecot-deliver - Allow raiudusd server connect to postgresql socket - Add kerberos support for radiusd - Allow saslauthd to connect to ldap port - Allow postfix to manage postfix_private_t files - Add chronyd support for #965457 - Fix labeling for HOME_DIR/\.icedtea - CHange squid and snmpd to be allowed also write own logs - Fix labeling for /usr/libexec/qemu-ga - Allow virtd_t to use virt_lock_t - Allow also sealert to read the policy from the kernel - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content - Dontaudit listing of users homedir by sendmail Seems like a leak - Allow passenger to transition to puppet master - Allow apache to connect to mythtv - Add definition for mythtv ports- Add additional fixes for #948073 bug - Allow sge_execd_t to also connect to sge ports - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files - Add networkmanager_stream_connect() - Make gnome-abrt wokring with staff_t - Fix openshift_manage_lib_files() interface - mdadm runs ps command which seems to getattr on random log files - Allow mozilla_plugin_t to create pulseaudit_home_t directories - Allow qemu-ga to shutdown virtual hosts - Add labelling for cupsd-browsed - Add web browser plugins to connect to aol ports - Allow nm-dhcp-helper to stream connect to NM - Add port definition for sge ports- Make sure users and unconfined domains create .hushlogin with the correct label - Allow pegaus to chat with realmd over DBus - Allow cobblerd to read network state - Allow boicn-client to stat on /dev/input/mice - Allow certwatch to read net_config_t when it executes apache - Allow readahead to create /run/systemd and then create its own directory with the correct label- Transition directories and files when in a user_tmp_t directory - Change certwatch to domtrans to apache instead of just execute - Allow virsh_t to read xen lib files - update policy rules for pegasus_openlmi_account_t - Add support for svnserve_tmp_t - Activate account openlmi policy - pegasus_openlmi_domain_template needs also require pegasus_t - One more fix for policykit.te - Call fs_list_cgroups_dirs() in policykit.te - Allow nagios service plugin to read mysql config files - Add labeling for /var/svn - Fix chrome.te - Fix pegasus_openlmi_domain_template() interfaces - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks - Fix location of google-chrome data - Add support for chome_sandbox to store content in the homedir - Allow policykit to watch for changes in cgroups file system - Add boolean to allow mozilla_plugin_t to use spice - Allow collectd to bind to udp port - Allow collected_t to read all of /proc - Should use netlink socket_perms - Should use netlink socket_perms - Allow glance domains to connect to apache ports - Allow apcupsd_t to manage its log files - Allow chrome objects to rw_inherited unix_stream_socket from callers - Allow staff_t to execute virtd_exec_t for running vms - nfsd_t needs to bind mountd port to make nfs-mountd.service working - Allow unbound net_admin capability because of setsockopt syscall - Fix fs_list_cgroup_dirs() - Label /usr/lib/nagios/plugins/utils.pm as bin_t - Remove uplicate definition of fs_read_cgroup_files() - Remove duplicate definition of fs_read_cgroup_files() - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd - Additional interfaces needed to list and read cgroups config - Add port definition for collectd port - Add labels for /dev/ptp* - Allow staff_t to execute virtd_exec_t for running vms- Allow samba-net to also read realmd tmp files - Allow NUT to use serial ports - realmd can be started by systemctl now- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid - Allow virsh to read xen lock file - Allow qemu-ga to create files in /run with proper labeling - Allow glusterd to connect to own socket in /tmp - Allow glance-api to connect to http port to make glance image-create working - Allow keystonte_t to execute rpm- Fix realmd cache interfaces- Allow tcpd to execute leafnode - Allow samba-net to read realmd cache files - Dontaudit sys_tty_config for alsactl - Fix allow rules for postfix_var_run - Allow cobblerd to read /etc/passwd - Allow pegasus to read exports - Allow systemd-timedate to read xdm state - Allow mout to stream connect to rpcbind - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki- Allow thumbnails to share memory with apps which run thumbnails - Allow postfix-postqueue block_suspend - Add lib interfaces for smsd - Add support for nginx - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t - Allow pki apache domain to create own tmp files and execute httpd_suexec - Allow procmail to manger user tmp files/dirs/lnk_files - Add virt_stream_connect_svirt() interface - Allow dovecot-auth to execute bin_t - Allow iscsid to request that kernel load a kernel module - Add labeling support for /var/lib/mod_security - Allow iw running as tuned_t to create netlink socket - Dontaudit sys_tty_config for thumb_t - Add labeling for nm-l2tp-service - Allow httpd running as certwatch_t to open tcp socket - Allow useradd to manager smsd lib files - Allow useradd_t to add homedirs in /var/lib - Fix typo in userdomain.te - Cleanup userdom_read_home_certs - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t - Allow staff to stream connect to svirt_t to make gnome-boxes working- Allow lvm to create its own unit files - Label /var/lib/sepolgen as selinux_config_t - Add filetrans rules for tw devices - Add transition from cupsd_config_t to cupsd_t- Add filetrans rules for tw devices - Cleanup bad transition lines- Fix lockdev_manage_files() - Allow setroubleshootd to read var_lib_t to make email_alert working - Add lockdev_manage_files() - Call proper interface in virt.te - Allow gkeyring_domain to create /var/run/UID/config/dbus file - system dbus seems to be blocking suspend - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need - When you enter a container from root, you generate avcs with a leaked file descriptor - Allow mpd getattr on file system directories - Make sure realmd creates content with the correct label - Allow systemd-tty-ask to write kmsg - Allow mgetty to use lockdev library for device locking - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music - When you enter a container from root, you generate avcs with a leaked file descriptor - Make sure init.fc files are labeled correctly at creation - File name trans vconsole.conf - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow certmonger to dbus communicate with realmd - Make realmd working- Fix mozilla specification of homedir content - Allow certmonger to read network state - Allow tmpwatch to read tmp in /var/spool/{cups,lpd} - Label all nagios plugin as unconfined by default - Add httpd_serve_cobbler_files() - Allow mdadm to read /dev/sr0 and create tmp files - Allow certwatch to send mails - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow realmd to run ipa, really needs to be an unconfined_domain - Allow sandbox domains to use inherted terminals - Allow pscd to use devices labeled svirt_image_t in order to use cat cards. - Add label for new alsa pid - Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition - Add support for sshd_unit_file_t - Add oracleasmfs_t - Allow unlabeled_t files to be stored on unlabeled_t filesystems- Fix description of deny_ptrace boolean - Remove allow for execmod lib_t for now - Allow quantum to connect to keystone port - Allow nova-console to talk with mysql over unix stream socket - Allow dirsrv to stream connect to uuidd - thumb_t needs to be able to create ~/.cache if it does not exist - virtd needs to be able to sys_ptrace when starting and stoping containers- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms... - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets - Fix deny_ptrace boolean, certain ptrace leaked into the system - Allow winbind to manage kerberos_rcache_host - Allow spamd to create spamd_var_lib_t directories - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs - Fix vmware_role() interface - Fix cobbler_manage_lib_files() interface - Allow nagios check disk plugins to execute bin_t - Allow quantum to transition to openvswitch_t - Allow postdrop to stream connect to postfix-master - Allow quantum to stream connect to openvswitch - Add xserver_dontaudit_xdm_rw_stream_sockets() interface - Allow daemon to send dgrams to initrc_t - Allow kdm to start the power service to initiate a reboot or poweroff- Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Don't audit attempts to write to stream socket of nscld by thumbnailers - Allow git_system_t to read network state - Allow pegasas to execute mount command - Fix desc for drdb_admin - Fix condor_amin() - Interface fixes for uptime, vdagent, vnstatd - Fix labeling for moodle in /var/www/moodle/data - Add interface fixes - Allow bugzilla to read certs - /var/www/moodle needs to be writable by apache - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Fix sys_nice for cups_domain - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Kernel_t needs mac_admin in order to support labeled NFS - Fix systemd_dontaudit_dbus_chat() interface - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Allow consolehelper domain to write Xauth files in /root - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Allow consolehelper more access discovered by Tom London - Allow fsdaemon to send signull to all domain - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Fix file_contexts.subs to label /run/lock correctly- Try to label on controlC devices up to 30 correctly - Add mount_rw_pid_files() interface - Add additional mount/umount interfaces needed by mock - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk - Fix tabs - Allow initrc_domain to search rgmanager lib files - Add more fixes which make mock working together with confined users * Allow mock_t to manage rpm files * Allow mock_t to read rpm log files * Allow mock to setattr on tmpfs, devpts * Allow mount/umount filesystems - Add rpm_read_log() interface - yum-cron runs rpm from within it. - Allow tuned to transition to dmidecode - Allow firewalld to do net_admin - Allow mock to unmont tmpfs_t - Fix virt_sigkill() interface - Add additional fixes for mock. Mainly caused by mount running in mock_t - Allow mock to write sysfs_t and mount pid files - Add mailman_domain to mailman_template() - Allow openvswitch to execute shell - Allow qpidd to use kerberos - Allow mailman to use fusefs, needs back port to RHEL6 - Allow apache and its scripts to use anon_inodefs - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7 - Realmd needs to connect to samba ports, needs back port to F18 also - Allow colord to read /run/initial-setup- - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock - Add virt_kill() interface - Add rgmanager_search_lib() interface - Allow wdmd to getattr on all filesystems. Back ported from RHEL6- Allow realmd to create tmp files - FIx ircssi_home_t type to irssi_home_t - Allow adcli running as realmd_t to connect to ldap port - Allow NetworkManager to transition to ipsec_t, for running strongswan - Make openshift_initrc_t an lxc_domain - Allow gssd to manage user_tmp_t files - Fix handling of irclogs in users homedir - Fix labeling for drupal an wp-content in subdirs of /var/www/html - Allow abrt to read utmp_t file - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6 - fix labeling for (oo|rhc)-restorer-wrapper.sh - firewalld needs to be able to write to network sysctls - Fix mozilla_plugin_dontaudit_rw_sem() interface - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains - Add mozilla_plugin_dontaudit_rw_sem() interface - Allow svirt_lxc_t to transition to openshift domains - Allow condor domains block_suspend and dac_override caps - Allow condor_master to read passd - Allow condor_master to read system state - Allow NetworkManager to transition to ipsec_t, for running strongswan - Lots of access required by lvm_t to created encrypted usb device - Allow xdm_t to dbus communicate with systemd_localed_t - Label strongswan content as ipsec_exec_mgmt_t for now - Allow users to dbus chat with systemd_localed - Fix handling of .xsession-errors in xserver.if, so kde will work - Might be a bug but we are seeing avc's about people status on init_t:service - Make sure we label content under /var/run/lock as <> - Allow daemon and systemprocesses to search init_var_run_t directory - Add boolean to allow xdm to write xauth data to the home directory - Allow mount to write keys for the unconfined domain - Add unconfined_write_keys() interface- Add labeling for /usr/share/pki - Allow programs that read var_run_t symlinks also read var_t symlinks - Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports - Fix labeling for /etc/dhcp directory - add missing systemd_stub_unit_file() interface - Add files_stub_var() interface - Add lables for cert_t directories - Make localectl set-x11-keymap working at all - Allow abrt to manage mock build environments to catch build problems. - Allow virt_domains to setsched for running gdb on itself - Allow thumb_t to execute user home content - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000 - Allow certwatch to execut /usr/bin/httpd - Allow cgred to send signal perms to itself, needs back port to RHEL6 - Allow openshift_cron_t to look at quota - Allow cups_t to read inhered tmpfs_t from the kernel - Allow yppasswdd to use NIS - Tuned wants sys_rawio capability - Add ftpd_use_fusefs boolean - Allow dirsrvadmin_t to signal itself- Allow localectl to read /etc/X11/xorg.conf.d directory - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors"" - Allow mount to transition to systemd_passwd_agent - Make sure abrt directories are labeled correctly - Allow commands that are going to read mount pid files to search mount_var_run_t - label /usr/bin/repoquery as rpm_exec_t - Allow automount to block suspend - Add abrt_filetrans_named_content so that abrt directories get labeled correctly - Allow virt domains to setrlimit and read file_context- Allow nagios to manage nagios spool files - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6 - Add swift_alias.* policy files which contain typealiases for swift types - Add support for /run/lock/opencryptoki - Allow pkcsslotd chown capability - Allow pkcsslotd to read passwd - Add rsync_stub() interface - Allow systemd_timedate also manage gnome config homedirs - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t - Fix filetrans rules for kdm creates .xsession-errors - Allow sytemd_tmpfiles to create wtmp file - Really should not label content under /var/lock, since it could have labels on it different from var_lock_t - Allow systemd to list all file system directories - Add some basic stub interfaces which will be used in PRODUCT policies- Fix log transition rule for cluster domains - Start to group all cluster log together - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update - cups uses usbtty_device_t devices - These fixes were all required to build a MLS virtual Machine with single level desktops - Allow domains to transiton using httpd_exec_t - Allow svirt domains to manage kernel key rings - Allow setroubleshoot to execute ldconfig - Allow firewalld to read generate gnome data - Allow bluetooth to read machine-info - Allow boinc domain to send signal to itself - Fix gnome_filetrans_home_content() interface - Allow mozilla_plugins to list apache modules, for use with gxine - Fix labels for POkemon in the users homedir - Allow xguest to read mdstat - Dontaudit virt_domains getattr on /dev/* - These fixes were all required to build a MLS virtual Machine with single level desktops - Need to back port this to RHEL6 for openshift - Add tcp/8891 as milter port - Allow nsswitch domains to read sssd_var_lib_t files - Allow ping to read network state. - Fix typo - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them- Adopt swift changes from lhh@redhat.com - Add rhcs_manage_cluster_pid_files() interface - Allow screen domains to configure tty and setup sock_file in ~/.screen directory - ALlow setroubleshoot to read default_context_t, needed to backport to F18 - Label /etc/owncloud as being an apache writable directory - Allow sshd to stream connect to an lxc domain- Allow postgresql to manage rgmanager pid files - Allow postgresql to read ccs data - Allow systemd_domain to send dbus messages to policykit - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them - All systemd domains that create content are reading the file_context file and setfscreate - Systemd domains need to search through init_var_run_t - Allow sshd to communicate with libvirt to set containers labels - Add interface to manage pid files - Allow NetworkManger_t to read /etc/hostname - Dontaudit leaked locked files into openshift_domains - Add fixes for oo-cgroup-read - it nows creates tmp files - Allow gluster to manage all directories as well as files - Dontaudit chrome_sandbox_nacl_t using user terminals - Allow sysstat to manage its own log files - Allow virtual machines to setrlimit and send itself signals. - Add labeling for /var/run/hplip- Fix POSTIN scriptlet- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp- Fix authconfig.py labeling - Make any domains that write homedir content do it correctly - Allow glusterd to read/write anyhwere on the file system by default - Be a little more liberal with the rsync log files - Fix iscsi_admin interface - Allow iscsid_t to read /dev/urand - Fix up iscsi domain for use with unit files - Add filename transition support for spamassassin policy - Allow web plugins to use badly formated libraries - Allow nmbd_t to create samba_var_t directories - Add filename transition support for spamassassin policy - Add filename transition support for tvtime - Fix alsa_home_filetrans_alsa_home() interface - Move all userdom_filetrans_home_content() calling out of booleans - Allow logrotote to getattr on all file sytems - Remove duplicate userdom_filetrans_home_content() calling - Allow kadmind to read /etc/passwd - Dontaudit append .xsession-errors file on ecryptfs for policykit-auth - Allow antivirus domain to manage antivirus db links - Allow logrotate to read /sys - Allow mandb to setattr on man dirs - Remove mozilla_plugin_enable_homedirs boolean - Fix ftp_home_dir boolean - homedir mozilla filetrans has been moved to userdom_home_manager - homedir telepathy filetrans has been moved to userdom_home_manager - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd() - Might want to eventually write a daemon on fusefsd. - Add policy fixes for sshd [net] child from plautrba@redhat.com - Tor uses a new port - Remove bin_t for authconfig.py - Fix so only one call to userdom_home_file_trans - Allow home_manager_types to create content with the correctl label - Fix all domains that write data into the homedir to do it with the correct label - Change the postgresql to use proper boolean names, which is causing httpd_t to - not get access to postgresql_var_run_t - Hostname needs to send syslog messages - Localectl needs to be able to send dbus signals to users - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default - Allow user_home_manger domains to create spam* homedir content with correct labeling - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working - Declare userdom_filetrans_type attribute - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute - fusefsd is mounding a fuse file system on /run/user/UID/gvfs- Man pages are now generated in the build process - Allow cgred to list inotifyfs filesystem- Allow gluster to get attrs on all fs - New access required for virt-sandbox - Allow dnsmasq to execute bin_t - Allow dnsmasq to create content in /var/run/NetworkManager - Fix openshift_initrc_signal() interface - Dontaudit openshift domains doing getattr on other domains - Allow consolehelper domain to communicate with session bus - Mock should not be transitioning to any other domains, we should keep mock_t as mock_t - Update virt_qemu_ga_t policy - Allow authconfig running from realmd to restart oddjob service - Add systemd support for oddjob - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd - Add labeling for gnashpluginrc - Allow chrome_nacl to execute /dev/zero - Allow condor domains to read /proc - mozilla_plugin_t will getattr on /core if firefox crashes - Allow condor domains to read /etc/passwd - Allow dnsmasq to execute shell scripts, openstack requires this access - Fix glusterd labeling - Allow virtd_t to interact with the socket type - Allow nmbd_t to override dac if you turned on sharing all files - Allow tuned to created kobject_uevent socket - Allow guest user to run fusermount - Allow openshift to read /proc and locale - Allow realmd to dbus chat with rpm - Add new interface for virt - Remove depracated interfaces - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t - Remove some more unconfined_t process transitions, that I don't believe are necessary - Stop transitioning uncofnined_t to checkpc - dmraid creates /var/lock/dmraid - Allow systemd_localed to creatre unix_dgram_sockets - Allow systemd_localed to write kernel messages. - Also cleanup systemd definition a little. - Fix userdom_restricted_xwindows_user_template() interface - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t - User accounts need to dbus chat with accountsd daemon - Gnome requires all users to be able to read /proc/1/- virsh now does a setexeccon call - Additional rules required by openshift domains - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work - Allow spamd_update_t to search spamc_home_t - Avcs discovered by mounting an isci device under /mnt - Allow lspci running as logrotate to read pci.ids - Additional fix for networkmanager_read_pid_files() - Fix networkmanager_read_pid_files() interface - Allow all svirt domains to connect to svirt_socket_t - Allow virsh to set SELinux context for a process. - Allow tuned to create netlink_kobject_uevent_socket - Allow systemd-timestamp to set SELinux context - Add support for /var/lib/systemd/linger - Fix ssh_sysadm_login to be working on MLS as expected- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file - Add missing files_rw_inherited_tmp_files interface - Add additional interface for ecryptfs - ALlow nova-cert to connect to postgresql - Allow keystone to connect to postgresql - Allow all cups domains to getattr on filesystems - Allow pppd to send signull - Allow tuned to execute ldconfig - Allow gpg to read fips_enabled - Add additional fixes for ecryptfs - Allow httpd to work with posgresql - Allow keystone getsched and setsched- Allow gpg to read fips_enabled - Add support for /var/cache/realmd - Add support for /usr/sbin/blazer_usb and systemd support for nut - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t - bitlbee wants to read own log file - Allow glance domain to send a signal itself - Allow xend_t to request that the kernel load a kernel module - Allow pacemaker to execute heartbeat lib files - cleanup new swift policy- Fix smartmontools - Fix userdom_restricted_xwindows_user_template() interface - Add xserver_xdm_ioctl_log() interface - Allow Xusers to ioctl lxdm.log to make lxdm working - Add MLS fixes to make MLS boot/log-in working - Add mls_socket_write_all_levels() also for syslogd - fsck.xfs needs to read passwd - Fix ntp_filetrans_named_content calling in init.te - Allow postgresql to create pg_log dir - Allow sshd to read rsync_data_t to make rsync working - Change ntp.conf to be labeled net_conf_t - Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it - Allow xdm_t to execute gstreamer home content - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp - New policy for openstack swift domains - More access required for openshift_cron_t - Use cupsd_log_t instead of cupsd_var_log_t - rpm_script_roles should be used in rpm_run - Fix rpm_run() interface - Fix openshift_initrc_run() - Fix sssd_dontaudit_stream_connect() interface - Fix sssd_dontaudit_stream_connect() interface - Allow LDA's job to deliver mail to the mailbox - dontaudit block_suspend for mozilla_plugin_t - Allow l2tpd_t to all signal perms - Allow uuidgen to read /dev/random - Allow mozilla-plugin-config to read power_supply info - Implement cups_domain attribute for cups domains - We now need access to user terminals since we start by executing a command outside the tty - We now need access to user terminals since we start by executing a command outside the tty - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen - Add containment of openshift cron jobs - Allow system cron jobs to create tmp directories - Make userhelp_conf_t a config file - Change rpm to use rpm_script_roles - More fixes for rsync to make rsync wokring - Allow logwatch to domtrans to mdadm - Allow pacemaker to domtrans to ifconfig - Allow pacemaker to setattr on corosync.log - Add pacemaker_use_execmem for memcheck-amd64 command - Allow block_suspend capability - Allow create fifo_file in /tmp with pacemaker_tmp_t - Allow systat to getattr on fixed disk - Relabel /etc/ntp.conf to be net_conf_t - ntp_admin should create files in /etc with the correct label - Add interface to create ntp_conf_t files in /etc - Add additional labeling for quantum - Allow quantum to execute dnsmasq with transition- boinc_cliean wants also execmem as boinc projecs have - Allow sa-update to search admin home for /root/.spamassassin - Allow sa-update to search admin home for /root/.spamassassin - Allow antivirus domain to read net sysctl - Dontaudit attempts from thumb_t to connect to ssd - Dontaudit attempts by readahead to read sock_files - Dontaudit attempts by readahead to read sock_files - Create tmpfs file while running as wine as user_tmpfs_t - Dontaudit attempts by readahead to read sock_files - libmpg ships badly created librarie- Change ssh_use_pts to use macro and only inherited sshd_devpts_t - Allow confined users to read systemd_logind seat information - libmpg ships badly created libraries - Add support for strongswan.service - Add labeling for strongswan - Allow l2tpd_t to read network manager content in /run directory - Allow rsync to getattr any file in rsync_data_t - Add labeling and filename transition for .grl-podcasts- mount.glusterfs executes glusterfsd binary - Allow systemd_hostnamed_t to stream connect to systemd - Dontaudit any user doing a access check - Allow obex-data-server to request the kernel to load a module - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info) - Allow gpg-agent to read /proc/sys/crypto/fips_enabled - Add new types for antivirus.pp policy module - Allow gnomesystemmm_t caps because of ioprio_set - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t - Allow gnomesystemmm_t caps because of ioprio_set - Allow NM rawip socket - files_relabel_non_security_files can not be used with boolean - Add interface to thumb_t dbus_chat to allow it to read remote process state - ALlow logrotate to domtrans to mdadm_t - kde gnomeclock wants to write content to /tmp- kde gnomeclock wants to write content to /tmp - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde - Allow blueman_t to rwx zero_device_t, for some kind of jre - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre - Ftp full access should be allowed to create directories as well as files - Add boolean to allow rsync_full_acces, so that an rsync server can write all - over the local machine - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6 - Add missing vpnc_roles type line - Allow stapserver to write content in /tmp - Allow gnome keyring to create keyrings dir in ~/.local/share - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Add interface to colord_t dbus_chat to allow it to read remote process state - Allow colord_t to read cupsd_t state - Add mate-thumbnail-font as thumnailer - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data. - Allow qpidd to list /tmp. Needed by ssl - Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18 - - Added systemd support for ksmtuned - Added booleans ksmtuned_use_nfs ksmtuned_use_cifs - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow - Looks like qpidd_t needs to read /dev/random - Lots of probing avc's caused by execugting gpg from staff_t - Dontaudit senmail triggering a net_admin avc - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port - Logwatch does access check on mdadm binary - Add raid_access_check_mdadm() iterface- Fix systemd_manage_unit_symlinks() interface - Call systemd_manage_unit_symlinks(() which is correct interface - Add filename transition for opasswd - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow sytstemd-timedated to get status of init_t - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow gpg_t to manage all gnome files - Stop using pcscd_read_pub_files - New rules for xguest, dontaudit attempts to dbus chat - Allow firewalld to create its mmap files in tmpfs and tmp directories - Allow firewalld to create its mmap files in tmpfs and tmp directories - run unbound-chkconf as named_t, so it can read dnssec - Colord is reading xdm process state, probably reads state of any apps that sends dbus message - Allow mdadm_t to change the kernel scheduler - mythtv policy - Update mandb_admin() interface - Allow dsspam to listen on own tpc_socket - seutil_filetrans_named_content needs to be optional - Allow sysadm_t to execute content in his homedir - Add attach_queue to tun_socket, new patch from Paul Moore - Change most of selinux configuration types to security_file_type. - Add filename transition rules for selinux configuration - ssh into a box with -X -Y requires ssh_use_ptys - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated - New allow rules found by Tom London for systemd_hostnamed- Allow systemd-tmpfiles to relabel lpd spool files - Ad labeling for texlive bash scripts - Add xserver_filetrans_fonts_cache_home_content() interface - Remove duplicate rules from *.te - Add support for /var/lock/man-db.lock - Add support for /var/tmp/abrt(/.*)? - Add additional labeling for munin cgi scripts - Allow httpd_t to read munin conf files - Allow certwatch to read meminfo - Fix nscd_dontaudit_write_sock_file() interfac - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling- Allow gnomeclock to talk to puppet over dbus - Allow numad access discovered by Dominic - Add support for HOME_DIR/.maildir - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain - Allow udev to relabel udev_var_run_t lnk_files - New bin_t file in mcelog- Remove all mcs overrides and replace with t1 != mcs_constrained_types - Add attribute_role for iptables - mcs_process_set_categories needs to be called for type - Implement additional role_attribute statements - Sodo domain is attempting to get the additributes of proc_kcore_t - Unbound uses port 8953 - Allow svirt_t images to compromise_kernel when using pci-passthrough - Add label for dns lib files - Bluetooth aquires a dbus name - Remove redundant files_read_usr_file calling - Remove redundant files_read_etc_file calling - Fix mozilla_run_plugin() - Add role_attribute support for more domains- Mass merge with upstream- Bump the policy version to 28 to match selinux userspace - Rebuild versus latest libsepol- Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Add labeling for /var/named/chroot/etc/localtim- Allow setroubleshoot_fixit to execute rpm - zoneminder needs to connect to httpd ports where remote cameras are listening - Allow firewalld to execute content created in /run directory - Allow svirt_t to read generic certs - Dontaudit leaked ps content to mozilla plugin - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - init scripts are creating systemd_unit_file_t directories- systemd_logind_t is looking at all files under /run/user/apache - Allow systemd to manage all user tmp files - Add labeling for /var/named/chroot/etc/localtime - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6 - Keystone is now using a differnt port - Allow xdm_t to use usbmuxd daemon to control sound - Allow passwd daemon to execute gnome_exec_keyringd - Fix chrome_sandbox policy - Add labeling for /var/run/checkquorum-timer - More fixes for the dspam domain, needs back port to RHEL6 - More fixes for the dspam domain, needs back port to RHEL6 - sssd needs to connect to kerberos password port if a user changes his password - Lots of fixes from RHEL testing of dspam web - Allow chrome and mozilla_plugin to create msgq and semaphores - Fixes for dspam cgi scripts - Fixes for dspam cgi scripts - Allow confine users to ptrace screen - Backport virt_qemu_ga_t changes from RHEL - Fix labeling for dspam.cgi needed for RHEL6 - We need to back port this policy to RHEL6, for lxc domains - Dontaudit attempts to set sys_resource of logrotate - Allow corosync to read/write wdmd's tmpfs files - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set - Allow cron jobs to read bind config for unbound - libvirt needs to inhibit systemd - kdumpctl needs to delete boot_t files - Fix duplicate gnome_config_filetrans - virtd_lxc_t is using /dev/fuse - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift - apcupsd can be setup to listen to snmp trafic - Allow transition from kdumpgui to kdumpctl - Add fixes for munin CGI scripts - Allow deltacloud to connect to openstack at the keystone port - Allow domains that transition to svirt domains to be able to signal them - Fix file context of gstreamer in .cache directory - libvirt is communicating with logind - NetworkManager writes to the systemd inhibit pipe- Allow munin disk plugins to get attributes of all directories - Allow munin disk plugins to get attributes of all directorie - Allow logwatch to get attributes of all directories - Fix networkmanager_manage_lib() interface - Fix gnome_manage_config() to allow to manage sock_file - Fix virtual_domain_context - Add support for dynamic DNS for DHCPv6- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch - Add additional labeling for /var/www/openshift/broker - Fix rhev policy - Allow openshift_initrc domain to dbus chat with systemd_logind - Allow httpd to getattr passenger log file if run_stickshift - Allow consolehelper-gtk to connect to xserver - Add labeling for the tmp-inst directory defined in pam_namespace.conf - Add lvm_metadata_t labeling for /etc/multipath- consoletype is no longer used- Add label for efivarfs - Allow certmonger to send signal to itself - Allow plugin-config to read own process status - Add more fixes for pacemaker - apache/drupal can run clamscan on uploaded content - Allow chrome_sandbox_nacl_t to read pid 1 content- Fix MCS Constraints to control ingres and egres controls on the network. - Change name of svirt_nokvm_t to svirt_tcg_t - Allow tuned to request the kernel to load kernel modules- Label /var/lib/pgsql/.ssh as ssh_home_t - Add labeling for /usr/bin/pg_ctl - Allow systemd-logind to manage keyring user tmp dirs - Add support for 7389/tcp port - gems seems to be placed in lots of places - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus - Add back tcp/8123 port as http_cache port - Add ovirt-guest-agent\.pid labeling - Allow xend to run scsi_id - Allow rhsmcertd-worker to read "physical_package_id" - Allow pki_tomcat to connect to ldap port - Allow lpr to read /usr/share/fonts - Allow open file from CD/DVD drive on domU - Allow munin services plugins to talk to SSSD - Allow all samba domains to create samba directory in var_t directories - Take away svirt_t ability to use nsswitch - Dontaudit attempts by openshift to read apache logs - Allow apache to create as well as append _ra_content_t - Dontaudit sendmail_t reading a leaked file descriptor - Add interface to have admin transition /etc/prelink.cache to the proper label - Add sntp support to ntp policy - Allow firewalld to dbus chat with devicekit_power - Allow tuned to call lsblk - Allow tor to read /proc/sys/kernel/random/uuid - Add tor_can_network_relay boolean- Add openshift_initrc_signal() interface - Fix typos - dspam port is treat as spamd_port_t - Allow setroubleshoot to getattr on all executables - Allow tuned to execute profiles scripts in /etc/tuned - Allow apache to create directories to store its log files - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6 - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM - Add filename transition for /etc/tuned/active_profile - Allow condor_master to send mails - Allow condor_master to read submit.cf - Allow condor_master to create /tmp files/dirs - Allow condor_mater to send sigkill to other condor domains - Allow condor_procd sigkill capability - tuned-adm wants to talk with tuned daemon - Allow kadmind and krb5kdc to also list sssd_public_t - Allow accountsd to dbus chat with init - Fix git_read_generic_system_content_files() interface - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler" - Fix mozilla_plugin_can_network_connect to allow to connect to all ports - Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t - dspam wants to search /var/spool for opendkim data - Revert "Add support for tcp/10026 port as dspam_port_t" - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6 - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain - Allow systemd_tmpfiles_t to setattr on mandb_cache_t- consolekit.pp was not removed from the postinstall script- Add back consolekit policy - Silence bootloader trying to use inherited tty - Silence xdm_dbusd_t trying to execute telepathy apps - Fix shutdown avcs when machine has unconfined.pp disabled - The host and a virtual machine can share the same printer on a usb device - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob - Allow abrt_watch_log_t to execute bin_t - Allow chrome sandbox to write content in ~/.config/chromium - Dontaudit setattr on fontconfig dir for thumb_t - Allow lircd to request the kernel to load module - Make rsync as userdom_home_manager - Allow rsync to search automount filesystem - Add fixes for pacemaker- Add support for 4567/tcp port - Random fixes from Tuomo Soini - xdm wants to get init status - Allow programs to run in fips_mode - Add interface to allow the reading of all blk device nodes - Allow init to relabel rpcbind sock_file - Fix labeling for lastlog and faillog related to logrotate - ALlow aeolus_configserver to use TRAM port - Add fixes for aeolus_configserver - Allow snmpd to connect to snmp port - Allow spamd_update to create spamd_var_lib_t directories - Allow domains that can read sssd_public_t files to also list the directory - Remove miscfiles_read_localization, this is defined for all domains- Allow syslogd to request the kernel to load a module - Allow syslogd_t to read the network state information - Allow xdm_dbusd_t connect to the system DBUS - Add support for 7389/tcp port - Allow domains to read/write all inherited sockets - Allow staff_t to read kmsg - Add awstats_purge_apache_log boolean - Allow ksysguardproces to read /.config/Trolltech.conf - Allow passenger to create and append puppet log files - Add puppet_append_log and puppet_create_log interfaces - Add puppet_manage_log() interface - Allow tomcat domain to search tomcat_var_lib_t - Allow pki_tomcat_t to connect to pki_ca ports - Allow pegasus_t to have net_admin capability - Allow pegasus_t to write /sys/class/net//flags - Allow mailserver_delivery to manage mail_home_rw_t lnk_files - Allow fetchmail to create log files - Allow gnomeclock to manage home config in .kde - Allow bittlebee to read kernel sysctls - Allow logrotate to list /root- Fix userhelper_console_role_template() - Allow enabling Network Access Point service using blueman - Make vmware_host_t as unconfined domain - Allow authenticate users in webaccess via squid, using mysql as backend - Allow gathers to get various metrics on mounted file systems - Allow firewalld to read /etc/hosts - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t - Allow kdumpgui to read/write to zipl.conf - Commands needed to get mock to build from staff_t in enforcing mode - Allow mdadm_t to manage cgroup files - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files - dontaudit ifconfig_t looking at fifo_files that are leaked to it - Add lableing for Quest Authentication System- Fix filetrans interface definitions - Dontaudit xdm_t to getattr on BOINC lib files - Add systemd_reload_all_services() interface - Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files - Allow accountsd to dbus chat with gdm - Allow realmd to getattr on all fs - Allow logrotate to reload all services - Add systemd unit file for radiusd - Allow winbind to create samba pid dir - Add labeling for /var/nmbd/unexpected - Allow chrome and mozilla plugin to connect to msnp ports- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file - Dontaudit setfiles reading /dev/random - On initial boot gnomeclock is going to need to be set buy gdm - Fix tftp_read_content() interface - Random apps looking at kernel file systems - Testing virt with lxc requiers additional access for virsh_t - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container - Allow MPD to read /dev/radnom - Allow sandbox_web_type to read logind files which needs to read pulseaudio - Allow mozilla plugins to read /dev/hpet - Add labeling for /var/lib/zarafa-webap - Allow BOINC client to use an HTTP proxy for all connections - Allow rhsmertd to domain transition to dmidecod - Allow setroubleshootd to send D-Bus msg to ABRT- Define usbtty_device_t as a term_tty - Allow svnserve to accept a connection - Allow xend manage default virt_image_t type - Allow prelink_cron_system_t to overide user componant when executing cp - Add labeling for z-push - Gnomeclock sets the realtime clock - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd - Allow lxc domains to use /dev/random and /dev/urandom- Add port defintion for tcp/9000 - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API - Allow shorewall_t to create netlink_socket - Allow krb5admind to block suspend - Fix labels on /var/run/dlm_controld /var/log/dlm_controld - Allow krb5kdc to block suspend - gnomessytemmm_t needs to read /etc/passwd - Allow cgred to read all sysctls- Allow all domains to read /proc/sys/vm/overcommit_memory - Make proc_numa_t an MLS Trusted Object - Add /proc/numactl support for confined users - Allow ssh_t to connect to any port > 1023 - Add openvswitch domain - Pulseaudio tries to create directories in gnome_home_t directories - New ypbind pkg wants to search /var/run which is caused by sd_notify - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans - Allow sanlock to read /dev/random - Treat php-fpm with httpd_t - Allow domains that can read named_conf_t to be able to list the directories - Allow winbind to create sock files in /var/run/samba- Add smsd policy - Add support for OpenShift sbin labelin - Add boolean to allow virt to use rawip - Allow mozilla_plugin to read all file systems with noxattrs support - Allow kerberos to write on anon_inodefs fs - Additional access required by fenced - Add filename transitions for passwd.lock/group.lock - UPdate man pages - Create coolkey directory in /var/cache with the correct label- Fix label on /etc/group.lock - Allow gnomeclock to create lnk_file in /etc - label /root/.pki as a home_cert_t - Add interface to make sure rpcbind.sock is created with the correct label - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules - opendkim should be a part of milter - Allow libvirt to set the kernel sched algorythm - Allow mongod to read sysfs_t - Add authconfig policy - Remove calls to miscfiles_read_localization all domains get this - Allow virsh_t to read /root/.pki/ content - Add label for log directory under /var/www/stickshift- Allow getty to setattr on usb ttys - Allow sshd to search all directories for sshd_home_t content - Allow staff domains to send dbus messages to kdumpgui - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t - Dontaudit setfiles reading urand - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir - Allow systemd-timedated to read /dev/urandom - Allow entropyd_t to read proc_t (meminfo) - Add unconfined munin plugin - Fix networkmanager_read_conf() interface - Allow blueman to list /tmp which is needed by sys_nic/setsched - Fix label of /etc/mail/aliasesdb-stamp - numad is searching cgroups - realmd is communicating with networkmanager using dbus - Lots of fixes to try to get kdump to work- Allow loging programs to dbus chat with realmd - Make apache_content_template calling as optional - realmd is using policy kit- Add new selinuxuser_use_ssh_chroot boolean - dbus needs to be able to read/write inherited fixed disk device_t passed through it - Cleanup netutils process allow rule - Dontaudit leaked fifo files from openshift to ping - sanlock needs to read mnt_t lnk files - Fail2ban needs to setsched and sys_nice- Change default label of all files in /var/run/rpcbind - Allow sandbox domains (java) to read hugetlbfs_t - Allow awstats cgi content to create tmp files and read apache log files - Allow setuid/setgid for cupsd-config - Allow setsched/sys_nice pro cupsd-config - Fix /etc/localtime sym link to be labeled locale_t - Allow sshd to search postgresql db t since this is a homedir - Allow xwindows users to chat with realmd - Allow unconfined domains to configure all files and null_device_t service- Adopt pki-selinux policy- pki is leaking which we dontaudit until a pki code fix - Allow setcap for arping - Update man pages - Add labeling for /usr/sbin/mcollectived - pki fixes - Allow smokeping to execute fping in the netutils_t domain- Allow mount to relabelfrom unlabeled file systems - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working - Add label to get bin files under libreoffice labeled correctly - Fix interface to allow executing of base_ro_file_type - Add fixes for realmd - Update pki policy - Add tftp_homedir boolean - Allow blueman sched_setscheduler - openshift user domains wants to r/w ssh tcp sockets- Additional requirements for disable unconfined module when booting - Fix label of systemd script files - semanage can use -F /dev/stdin to get input - syslog now uses kerberos keytabs - Allow xserver to compromise_kernel access - Allow nfsd to write to mount_var_run_t when running the mount command - Add filename transition rule for bin_t directories - Allow files to read usr_t lnk_files - dhcpc wants chown - Add support for new openshift labeling - Clean up for tunable+optional statements - Add labeling for /usr/sbin/mkhomedir_helper - Allow antivirus domain to managa amavis spool files - Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool- Add interfaces to read kernel_t proc info - Missed this version of exec_all - Allow anyone who can load a kernel module to compromise kernel - Add oddjob_dbus_chat to openshift apache policy - Allow chrome_sandbox_nacl_t to send signals to itself - Add unit file support to usbmuxd_t - Allow all openshift domains to read sysfs info - Allow openshift domains to getattr on all domains- MLS fixes from Dan - Fix name of capability2 secure_firmware->compromise_kerne- Allow xdm to search all file systems - Add interface to allow the config of all files - Add rngd policy - Remove kgpg as a gpg_exec_t type - Allow plymouthd to block suspend - Allow systemd_dbus to config any file - Allow system_dbus_t to configure all services - Allow freshclam_t to read usr_files - varnishd requires execmem to load modules- Allow semanage to verify types - Allow sudo domain to execute user home files - Allow session_bus_type to transition to user_tmpfs_t - Add dontaudit caused by yum updates - Implement pki policy but not activated- tuned wants to getattr on all filesystems - tuned needs also setsched. The build is needed for test day- Add policy for qemu-qa - Allow razor to write own config files - Add an initial antivirus policy to collect all antivirus program - Allow qdisk to read usr_t - Add additional caps for vmware_host - Allow tmpfiles_t to setattr on mandb_cache_t - Dontaudit leaked files into mozilla_plugin_config_t - Allow wdmd to getattr on tmpfs - Allow realmd to use /dev/random - allow containers to send audit messages - Allow root mount any file via loop device with enforcing mls policy - Allow tmpfiles_t to setattr on mandb_cache_t - Allow tmpfiles_t to setattr on mandb_cache_t - Make userdom_dontaudit_write_all_ not allow open - Allow init scripts to read all unit files - Add support for saphostctrl ports- Add kernel_read_system_state to sandbox_client_t - Add some of the missing access to kdumpgui - Allow systemd_dbusd_t to status the init system - Allow vmnet-natd to request the kernel to load a module - Allow gsf-office-thum to append .cache/gdm/session.log - realmd wants to read .config/dconf/user - Firewalld wants sys_nice/setsched - Allow tmpreaper to delete mandb cache files - Firewalld wants sys_nice/setsched - Allow firewalld to perform a DNS name resolution - Allown winbind to read /usr/share/samba/codepages/lowcase.dat - Add support for HTTPProxy* in /etc/freshclam.conf - Fix authlogin_yubike boolean - Extend smbd_selinux man page to include samba booleans - Allow dhcpc to execute consoletype - Allow ping to use inherited tmp files created in init scripts - On full relabel with unconfined domain disabled, initrc was running some chcon's - Allow people who delete man pages to delete mandb cache files- Add missing permissive domains- Add new mandb policy - ALlow systemd-tmpfiles_t to relabel mandb_cache_t - Allow logrotate to start all unit files- Add fixes for ctbd - Allow nmbd to stream connect to ctbd - Make cglear_t as nsswitch_domain - Fix bogus in interfaces - Allow openshift to read/write postfix public pipe - Add postfix_manage_spool_maildrop_files() interface - stickshift paths have been renamed to openshift - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes - Update man pages, adding ENTRYPOINTS- Add mei_device_t - Make sure gpg content in homedir created with correct label - Allow dmesg to write to abrt cache files - automount wants to search virtual memory sysctls - Add support for hplip logs stored in /var/log/hp/tmp - Add labeling for /etc/owncloud/config.php - Allow setroubleshoot to send analysys to syslogd-journal - Allow virsh_t to interact with new fenced daemon - Allow gpg to write to /etc/mail/spamassassiin directories - Make dovecot_deliver_t a mail server delivery type - Add label for /var/tmp/DNS25- Fixes for tomcat_domain template interface- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes - Add attribute to all base os types. Allow all domains to read all ro base OS types- Additional unit files to be defined as power unit files - Fix more boolean names- Fix boolean name so subs will continue to work- dbus needs to start getty unit files - Add interface to allow system_dbusd_t to start the poweroff service - xdm wants to exec telepathy apps - Allow users to send messages to systemdlogind - Additional rules needed for systemd and other boot apps - systemd wants to list /home and /boot - Allow gkeyringd to write dbus/conf file - realmd needs to read /dev/urand - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded- Fixes to safe more rules - Re-write tomcat_domain_template() - Fix passenger labeling - Allow all domains to read man pages - Add ephemeral_port_t to the 'generic' port interfaces - Fix the names of postgresql booleans- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer - Move netlable_peer check out of booleans - Remove call to recvfrom_netlabel for kerberos call - Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules - Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface - Allow rndc to block suspend - tuned needs to modify the schedule of the kernel - Allow svirt_t domains to read alsa configuration files - ighten security on irc domains and make sure they label content in homedir correctly - Add filetrans_home_content for irc files - Dontaudit all getattr access for devices and filesystems for sandbox domains - Allow stapserver to search cgroups directories - Allow all postfix domains to talk to spamd- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check - Change pam_t to pam_timestamp_t - Add dovecot_domain attribute and allow this attribute block_suspend capability2 - Add sanlock_use_fusefs boolean - numad wants send/recieve msg - Allow rhnsd to send syslog msgs - Make piranha-pulse as initrc domain - Update openshift instances to dontaudit setattr until the kernel is fixed.- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd - Remove pam_selinux.8 which conflicts with man page owned by the pam package - Allow glance-api to talk to mysql - ABRT wants to read Xorg.0.log if if it detects problem with Xorg - Fix gstreamer filename trans. interface- Man page fixes by Dan Walsh- Allow postalias to read postfix config files - Allow man2html to read man pages - Allow rhev-agentd to search all mountpoints - Allow rhsmcertd to read /dev/random - Add tgtd_stream_connect() interface - Add cyrus_write_data() interface - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t - Add port definition for tcp/81 as http_port_t - Fix /dev/twa labeling - Allow systemd to read modules config- Merge openshift policy - Allow xauth to read /dev/urandom - systemd needs to relabel content in /run/systemd directories - Files unconfined should be able to perform all services on all files - Puppet tmp file can be leaked to all domains - Dontaudit rhsmcertd-worker to search /root/.local - Allow chown capability for zarafa domains - Allow system cronjobs to runcon into openshift domains - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories- nmbd wants to create /var/nmbd - Stop transitioning out of anaconda and firstboot, just causes AVC messages - Allow clamscan to read /etc files - Allow bcfg2 to bind cyphesis port - heartbeat should be run as rgmanager_t instead of corosync_t - Add labeling for /etc/openldap/certs - Add labeling for /opt/sartest directory - Make crontab_t as userdom home reader - Allow tmpreaper to list admin_home dir - Add defition for imap_0 replay cache file - Add support for gitolite3 - Allow virsh_t to send syslog messages - allow domains that can read samba content to be able to list the directories also - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd - Separate out sandbox from sandboxX policy so we can disable it by default - Run dmeventd as lvm_t - Mounting on any directory requires setattr and write permissions - Fix use_nfs_home_dirs() boolean - New labels for pam_krb5 - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0 - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs - Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles- Allow realmd to read resolv.conf - Add pegasus_cache_t type - Label /usr/sbin/fence_virtd as virsh_exec_t - Add policy for pkcsslotd - Add support for cpglockd - Allow polkit-agent-helper to read system-auth-ac - telepathy-idle wants to read gschemas.compiled - Allow plymouthd to getattr on fs_t - Add slpd policy - Allow ksysguardproces to read/write config_usr_t- Fix labeling substitution so rpm will label /lib/systemd content correctly- Add file name transitions for ttyACM0 - spice-vdagent(d)'s are going to log over to syslog - Add sensord policy - Add more fixes for passenger policy related to puppet - Allow wdmd to create wdmd_tmpfs_t - Fix labeling for /var/run/cachefilesd\.pid - Add thumb_tmpfs_t files type- Allow svirt domains to manage the network since this is containerized - Allow svirt_lxc_net_t to send audit messages- Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working - Allow dlm_controld to execute dlm_stonith labeled as bin_t - Allow GFS2 working on F17 - Abrt needs to execute dmesg - Allow jockey to list the contents of modeprobe.d - Add policy for lightsquid as squid_cron_t - Mailscanner is creating files and directories in /tmp - dmesg is now reading /dev/kmsg - Allow xserver to communicate with secure_firmware - Allow fsadm tools (fsck) to read /run/mount contnet - Allow sysadm types to read /dev/kmsg -- Allow postfix, sssd, rpcd to block_suspend - udev seems to need secure_firmware capability - Allow virtd to send dbus messages to firewalld so it can configure the firewall- Fix labeling of content in /run created by virsh_t - Allow condor domains to read kernel sysctls - Allow condor_master to connect to amqp - Allow thumb drives to create shared memory and semaphores - Allow abrt to read mozilla_plugin config files - Add labels for lightsquid - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow - dovecot_auth_t uses ldap for user auth - Allow domains that can read dhcp_etc_t to read lnk_files - Add more then one watchdog device - Allow useradd_t to manage etc_t files so it can rename it and edit them - Fix invalid class dir should be fifo_file - Move /run/blkid to fsadm and make sure labeling is correct- Fix bogus regex found by eparis - Fix manage run interface since lvm needs more access - syslogd is searching cgroups directory - Fixes to allow virt-sandbox-service to manage lxc var run content- Fix Boolean settings - Add new libjavascriptcoregtk as textrel_shlib_t - Allow xdm_t to create xdm_home_t directories - Additional access required for systemd - Dontaudit mozilla_plugin attempts to ipc_lock - Allow tmpreaper to delete unlabeled files - Eliminate screen_tmp_t and allow it to manage user_tmp_t - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors - Allow web plugins to connect to the asterisk ports - Condor will recreate the lock directory if it does not exist - Oddjob mkhomedir needs to connectto user processes - Make oddjob_mkhomedir_t a userdom home manager- Put placeholder back in place for proper numbering of capabilities - Systemd also configures init scripts- Fix ecryptfs interfaces - Bootloader seems to be trolling around /dev/shm and /dev - init wants to create /etc/systemd/system-update.target.wants - Fix systemd_filetrans call to move it out of tunable - Fix up policy to work with systemd userspace manager - Add secure_firmware capability and remove bogus epolwakeup - Call seutil_*_login_config interfaces where should be needed - Allow rhsmcertd to send signal to itself - Allow thin domains to send signal to itself - Allow Chrome_ChildIO to read dosfs_t- Add role rules for realmd, sambagui- Add new type selinux_login_config_t for /etc/selinux//logins/ - Additional fixes for seutil_manage_module_store() - dbus_system_domain() should be used with optional_policy - Fix svirt to be allowed to use fusefs file system - Allow login programs to read /run/ data created by systemd_login - sssd wants to write /etc/selinux//logins/ for SELinux PAM module - Fix svirt to be allowed to use fusefs file system - Allow piranha domain to use nsswitch - Sanlock needs to send Kill Signals to non root processes - Pulseaudio wants to execute /run/user/PID/.orc- Fix saslauthd when it tries to read /etc/shadow - Label gnome-boxes as a virt homedir - Need to allow svirt_t ability to getattr on nfs_t file systems - Update sanlock policy to solve all AVC's - Change confined users can optionally manage virt content - Handle new directories under ~/.cache - Add block suspend to appropriate domains - More rules required for containers - Allow login programs to read /run/ data created by systemd_logind - Allow staff users to run svirt_t processes- Update to upstream- More fixes for systemd to make rawhide booting from Dan Walsh- Add systemd fixes to make rawhide booting- Add systemd_logind_inhibit_var_run_t attribute - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type - Add interface for mysqld to dontaudit signull to all processes - Label new /var/run/journal directory correctly - Allow users to inhibit suspend via systemd - Add new type for the /var/run/inhibit directory - Add interface to send signull to systemd_login so avahi can send them - Allow systemd_passwd to send syslog messages - Remove corenet_all_recvfrom_unlabeled() calling fro policy files - Allow editparams.cgi running as httpd_bugzilla_script_t to read /etc/group - Allow smbd to read cluster config - Add additional labeling for passenger - Allow dbus to inhibit suspend via systemd - Allow avahi to send signull to systemd_login- Add interface to dontaudit getattr access on sysctls - Allow sshd to execute /bin/login - Looks like xdm is recreating the xdm directory in ~/.cache/ on login - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald - Fix semanage to work with unconfined domain disabled on F18 - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls - Virt seems to be using lock files - Dovecot seems to be searching directories of every mountpoint - Allow jockey to read random/urandom, execute shell and install third-party drivers - Add aditional params to allow cachedfiles to manage its content - gpg agent needs to read /dev/random - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write - Add a bunch of dontaudit rules to quiet svirt_lxc domains - Additional perms needed to run svirt_lxc domains - Allow cgclear to read cgconfig - Allow sys_ptrace capability for snmp - Allow freshclam to read /proc - Allow procmail to manage /home/user/Maildir content - Allow NM to execute wpa_cli - Allow amavis to read clamd system state - Regenerate man pages- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild- Add realmd and stapserver policies - Allow useradd to manage stap-server lib files - Tighten up capabilities for confined users - Label /etc/security/opasswd as shadow_t - Add label for /dev/ecryptfs - Allow condor_startd_t to start sshd with the ranged - Allow lpstat.cups to read fips_enabled file - Allow pyzor running as spamc_t to create /root/.pyzor directory - Add labelinf for amavisd-snmp init script - Add support for amavisd-snmp - Allow fprintd sigkill self - Allow xend (w/o libvirt) to start virtual machines - Allow aiccu to read /etc/passwd - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes - Add condor_startd_ranged_domtrans_to() interface - Add ssd_conf_t for /etc/sssd - accountsd needs to fchown some files/directories - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit - Allow xend_t to read the /etc/passwd file- Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t - Add init_access_check() interface - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t - Allow tcpdump to create a netlink_socket - Label newusers like useradd - Change xdm log files to be labeled xdm_log_t - Allow sshd_t with privsep to work in MLS - Allow freshclam to update databases thru HTTP proxy - Allow s-m-config to access check on systemd - Allow abrt to read public files by default - Fix amavis_create_pid_files() interface - Add labeling and filename transition for dbomatic.log - Allow system_dbusd_t to stream connect to bluetooth, and use its socket - Allow amavisd to execute fsav - Allow tuned to use sys_admin and sys_nice capabilities - Add php-fpm policy from Bryan - Add labeling for aeolus-configserver-thinwrapper - Allow thin domains to execute shell - Fix gnome_role_gkeyringd() interface description - Lot of interface fixes - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files - Allow OpenMPI job to use kerberos - Make deltacloudd_t as nsswitch_domain - Allow xend_t to run lsscsi - Allow qemu-dm running as xend_t to create tun_socket - Add labeling for /opt/brother/Printers(.*/)?inf - Allow jockey-backend to read pyconfig-64.h labeled as usr_t - Fix clamscan_can_scan_system boolean - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11- initrc is calling exportfs which is not confined so it attempts to read nfsd_files - Fixes for passenger running within openshift. - Add labeling for all tomcat6 dirs - Add support for tomcat6 - Allow cobblerd to read /etc/passwd - Allow jockey to read sysfs and and execute binaries with bin_t - Allow thum to use user terminals - Allow cgclear to read cgconfig config files - Fix bcf2g.fc - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains - Allow dbomatic to execute ruby - abrt_watch_log should be abrt_domain - Allow mozilla_plugin to connect to gatekeeper port- add ptrace_child access to process - remove files_read_etc_files() calling from all policies which have auth_use_nsswith() - Allow boinc domains to manage boinc_lib_t lnk_files - Add support for boinc-client.service unit file - Add support for boinc.log - Allow mozilla_plugin execmod on mozilla home files if allow_ex - Allow dovecot_deliver_t to read dovecot_var_run_t - Allow ldconfig and insmod to manage kdumpctl tmp files - Move thin policy out from cloudform.pp and add a new thin poli - pacemaker needs to communicate with corosync streams - abrt is now started on demand by dbus - Allow certmonger to talk directly to Dogtag servers - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c - Allow mozila_plugin to execute gstreamer home files - Allow useradd to delete all file types stored in the users hom - rhsmcertd reads the rpm database - Add support for lightdm- Add tomcat policy - Remove pyzor/razor policy - rhsmcertd reads the rpm database - Dontaudit thumb to setattr on xdm_tmp dir - Allow wicd to execute ldconfig in the networkmanager_t domain - Add /var/run/cherokee\.pid labeling - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too - Allow postfix-master to r/w pipes other postfix domains - Allow snort to create netlink_socket - Add kdumpctl policy - Allow firstboot to create tmp_t files/directories - /usr/bin/paster should not be labeled as piranha_exec_t - remove initrc_domain from tomcat - Allow ddclient to read /etc/passwd - Allow useradd to delete all file types stored in the users homedir - Allow ldconfig and insmod to manage kdumpctl tmp files - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those - Transition xauth files within firstboot_tmp_t - Fix labeling of /run/media to match /media - Label all lxdm.log as xserver_log_t - Add port definition for mxi port - Allow local_login_t to execute tmux- apcupsd needs to read /etc/passwd - Sanlock allso sends sigkill - Allow glance_registry to connect to the mysqld port - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl - Allow firefox plugins/flash to connect to port 1234 - Allow mozilla plugins to delete user_tmp_t files - Add transition name rule for printers.conf.O - Allow virt_lxc_t to read urand - Allow systemd_loigind to list gstreamer_home_dirs - Fix labeling for /usr/bin - Fixes for cloudform services * support FIPS - Allow polipo to work as web caching - Allow chfn to execute tmux- Add support for ecryptfs * ecryptfs does not support xattr * we need labeling for HOMEDIR - Add policy for (u)mount.ecryptfs* - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache - Allow dovecot to manage Maildir content, fix transitions to Maildir - Allow postfix_local to transition to dovecot_deliver - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code - Cleanup interface definitions - Allow apmd to change with the logind daemon - Changes required for sanlock in rhel6 - Label /run/user/apache as httpd_tmp_t - Allow thumb to use lib_t as execmod if boolean turned on - Allow squid to create the squid directory in /var with the correct labe - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com) - Allow virtd to exec xend_exec_t without transition - Allow virtd_lxc_t to unmount all file systems- PolicyKit path has changed - Allow httpd connect to dirsrv socket - Allow tuned to write generic kernel sysctls - Dontaudit logwatch to gettr on /dev/dm-2 - Allow policykit-auth to manage kerberos files - Make condor_startd and rgmanager as initrc domain - Allow virsh to read /etc/passwd - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs - xdm now needs to execute xsession_exec_t - Need labels for /var/lib/gdm - Fix files_filetrans_named_content() interface - Add new attribute - initrc_domain - Allow systemd_logind_t to signal, signull, sigkill all processes - Add filetrans rules for etc_runtime files- Rename boolean names to remove allow_- Mass merge with upstream * new policy topology to include contrib policy modules * we have now two base policy patches- Fix description of authlogin_nsswitch_use_ldap - Fix transition rule for rhsmcertd_t needed for RHEL7 - Allow useradd to list nfs state data - Allow openvpn to manage its log file and directory - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly - Allow thumb to use nvidia devices - Allow local_login to create user_tmp_t files for kerberos - Pulseaudio needs to read systemd_login /var/run content - virt should only transition named system_conf_t config files - Allow munin to execute its plugins - Allow nagios system plugin to read /etc/passwd - Allow plugin to connect to soundd port - Fix httpd_passwd to be able to ask passwords - Radius servers can use ldap for backing store - Seems to need to mount on /var/lib for xguest polyinstatiation to work. - Allow systemd_logind to list the contents of gnome keyring - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL - Add policy for isns-utils- Add policy for subversion daemon - Allow boinc to read passwd - Allow pads to read kernel network state - Fix man2html interface for sepolgen-ifgen - Remove extra /usr/lib/systemd/system/smb - Remove all /lib/systemd and replace with /usr/lib/systemd - Add policy for man2html - Fix the label of kerberos_home_t to krb5_home_t - Allow mozilla plugins to use Citrix - Allow tuned to read /proc/sys/kernel/nmi_watchdog - Allow tune /sys options via systemd's tmpfiles.d "w" type- Dontaudit lpr_t to read/write leaked mozilla tmp files - Add file name transition for .grl-podcasts directory - Allow corosync to read user tmp files - Allow fenced to create snmp lib dirs/files - More fixes for sge policy - Allow mozilla_plugin_t to execute any application - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain - Allow mongod to read system state information - Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t - Allow polipo to manage polipo_cache dirs - Add jabbar_client port to mozilla_plugin_t - Cleanup procmail policy - system bus will pass around open file descriptors on files that do not have labels on them - Allow l2tpd_t to read system state - Allow tuned to run ls /dev - Allow sudo domains to read usr_t files - Add label to machine-id - Fix corecmd_read_bin_symlinks cut and paste error- Fix pulseaudio port definition - Add labeling for condor_starter - Allow chfn_t to creat user_tmp_files - Allow chfn_t to execute bin_t - Allow prelink_cron_system_t to getpw calls - Allow sudo domains to manage kerberos rcache files - Allow user_mail_domains to work with courie - Port definitions necessary for running jboss apps within openshift - Add support for openstack-nova-metadata-api - Add support for nova-console* - Add support for openstack-nova-xvpvncproxy - Fixes to make privsep+SELinux working if we try to use chage to change passwd - Fix auth_role() interface - Allow numad to read sysfs - Allow matahari-rpcd to execute shell - Add label for ~/.spicec - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it - Devicekit_disk wants to read the logind sessions file when writing a cd - Add fixes for condor to make condor jobs working correctly - Change label of /var/log/rpmpkgs to cron_log_t - Access requires to allow systemd-tmpfiles --create to work. - Fix obex to be a user application started by the session bus. - Add additional filename trans rules for kerberos - Fix /var/run/heartbeat labeling - Allow apps that are managing rcache to file trans correctly - Allow openvpn to authenticate against ldap server - Containers need to listen to network starting and stopping events- Make systemd unit files less specific- Fix zarafa labeling - Allow guest_t to fix labeling - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean - add lxc_contexts - Allow accountsd to read /proc - Allow restorecond to getattr on all file sytems - tmpwatch now calls getpw - Allow apache daemon to transition to pwauth domain - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t - The obex socket seems to be a stream socket - dd label for /var/run/nologin- Allow jetty running as httpd_t to read hugetlbfs files - Allow sys_nice and setsched for rhsmcertd - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports - Allow setfiles to append to xdm_tmp_t - Add labeling for /export as a usr_t directory - Add labels for .grl files created by gstreamer- Add labeling for /usr/share/jetty/bin/jetty.sh - Add jetty policy which contains file type definitios - Allow jockey to use its own fifo_file and make this the default for all domains - Allow mozilla_plugins to use spice (vnc_port/couchdb) - asterisk wants to read the network state - Blueman now uses /var/lib/blueman- Add label for nodejs_debug - Allow mozilla_plugin_t to create ~/.pki directory and content- Add clamscan_can_scan_system boolean - Allow mysqld to read kernel network state - Allow sshd to read/write condor lib files - Allow sshd to read/write condor-startd tcp socket - Fix description on httpd_graceful_shutdown - Allow glance_registry to communicate with mysql - dbus_system_domain is using systemd to lauch applications - add interfaces to allow domains to send kill signals to user mail agents - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t - Lots of new access required for secure containers - Corosync needs sys_admin capability - ALlow colord to create shm - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific - Add boolean to control whether or not mozilla plugins can create random content in the users homedir - Add new interface to allow domains to list msyql_db directories, needed for libra - shutdown has to be allowed to delete etc_runtime_t - Fail2ban needs to read /etc/passwd - Allow ldconfig to create /var/cache/ldconfig - Allow tgtd to read hardware state information - Allow collectd to create packet socket - Allow chronyd to send signal to itself - Allow collectd to read /dev/random - Allow collectd to send signal to itself - firewalld needs to execute restorecon - Allow restorecon and other login domains to execute restorecon- Allow logrotate to getattr on systemd unit files - Add support for tor systemd unit file - Allow apmd to create /var/run/pm-utils with the correct label - Allow l2tpd to send sigkill to pppd - Allow pppd to stream connect to l2tpd - Add label for scripts in /etc/gdm/ - Allow systemd_logind_t to ignore mcs constraints on sigkill - Fix files_filetrans_system_conf_named_files() interface - Add labels for /usr/share/wordpress/wp-includes/*.php - Allow cobbler to get SELinux mode and booleans- Add unconfined_execmem_exec_t as an alias to bin_t - Allow fenced to read snmp var lib files, also allow it to read usr_t - ontaudit access checks on all executables from mozilla_plugin - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode - Allow systemd_tmpfiles_t to getattr all pipes and sockets - Allow glance-registry to send system log messages - semanage needs to manage mock lib files/dirs- Add policy for abrt-watch-log - Add definitions for jboss_messaging ports - Allow systemd_tmpfiles to manage printer devices - Allow oddjob to use nsswitch - Fix labeling of log files for postgresql - Allow mozilla_plugin_t to execmem and execstack by default - Allow firewalld to execute shell - Fix /etc/wicd content files to get created with the correct label - Allow mcelog to exec shell - Add ~/.orc as a gstreamer_home_t - /var/spool/postfix/lib64 should be labeled lib_t - mpreaper should be able to list all file system labeled directories - Add support for apache to use openstack - Add labeling for /etc/zipl.conf and zipl binary - Turn on allow_execstack and turn off telepathy transition for final release- More access required for virt_qmf_t - Additional assess required for systemd-logind to support multi-seat - Allow mozilla_plugin to setrlimit - Revert changes to fuse file system to stop deadlock- Allow condor domains to connect to ephemeral ports - More fixes for condor policy - Allow keystone to stream connect to mysqld - Allow mozilla_plugin_t to read generic USB device to support GPS devices - Allow thum to file name transition gstreamer home content - Allow thum to read all non security files - Allow glance_api_t to connect to ephemeral ports - Allow nagios plugins to read /dev/urandom - Allow syslogd to search postfix spool to support postfix chroot env - Fix labeling for /var/spool/postfix/dev - Allow wdmd chown - Label .esd_auth as pulseaudio_home_t - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now- Add support for clamd+systemd - Allow fresclam to execute systemctl to handle clamd - Change labeling for /usr/sbin/rpc.ypasswd.env - Allow yppaswd_t to execute yppaswd_exec_t - Allow yppaswd_t to read /etc/passwd - Gnomekeyring socket has been moved to /run/user/USER/ - Allow samba-net to connect to ldap port - Allow signal for vhostmd - allow mozilla_plugin_t to read user_home_t socket - New access required for secure Linux Containers - zfs now supports xattrs - Allow quantum to execute sudo and list sysfs - Allow init to dbus chat with the firewalld - Allow zebra to read /etc/passwd- Allow svirt_t to create content in the users homedir under ~/.libvirt - Fix label on /var/lib/heartbeat - Allow systemd_logind_t to send kill signals to all processes started by a user - Fuse now supports Xattr Support- upowered needs to setsched on the kernel - Allow mpd_t to manage log files - Allow xdm_t to create /var/run/systemd/multi-session-x - Add rules for missedfont.log to be used by thumb.fc - Additional access required for virt_qmf_t - Allow dhclient to dbus chat with the firewalld - Add label for lvmetad - Allow systemd_logind_t to remove userdomain sock_files - Allow cups to execute usr_t files - Fix labeling on nvidia shared libraries - wdmd_t needs access to sssd and /etc/passwd - Add boolean to allow ftp servers to run in passive mode - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with - Fix using httpd_use_fusefs - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox- Rename rdate port to time port, and allow gnomeclock to connect to it - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda - /etc/auto.* should be labeled bin_t - Add httpd_use_fusefs boolean - Add fixes for heartbeat - Allow sshd_t to signal processes that it transitions to - Add condor policy - Allow svirt to create monitors in ~/.libvirt - Allow dovecot to domtrans sendmail to handle sieve scripts - Lot of fixes for cfengine- /var/run/postmaster.* labeling is no longer needed - Alllow drbdadmin to read /dev/urandom - l2tpd_t seems to use ptmx - group+ and passwd+ should be labeled as /etc/passwd - Zarafa-indexer is a socket- Ensure lastlog is labeled correctly - Allow accountsd to read /proc data about gdm - Add fixes for tuned - Add bcfg2 fixes which were discovered during RHEL6 testing - More fixes for gnome-keyring socket being moved - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown - Fix description for files_dontaudit_read_security_files() interface- Add new policy and man page for bcfg2 - cgconfig needs to use getpw calls - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt - gnome-keyring wants to create a directory in cache_home_t - sanlock calls getpw- Add numad policy and numad man page - Add fixes for interface bugs discovered by SEWatch - Add /tmp support for squid - Add fix for #799102 * change default labeling for /var/run/slapd.* sockets - Make thumb_t as userdom_home_reader - label /var/lib/sss/mc same as pubconf, so getpw domains can read it - Allow smbspool running as cups_t to stream connect to nmbd - accounts needs to be able to execute passwd on behalf of users - Allow systemd_tmpfiles_t to delete boot flags - Allow dnssec_trigger to connect to apache ports - Allow gnome keyring to create sock_files in ~/.cache - google_authenticator is using .google_authenticator - sandbox running from within firefox is exposing more leaks - Dontaudit thumb to read/write /dev/card0 - Dontaudit getattr on init_exec_t for gnomeclock_t - Allow certmonger to do a transition to certmonger_unconfined_t - Allow dhcpc setsched which is caused by nmcli - Add rpm_exec_t for /usr/sbin/bcfg2 - system cronjobs are sending dbus messages to systemd_logind - Thumnailers read /dev/urand- Allow auditctl getcap - Allow vdagent to use libsystemd-login - Allow abrt-dump-oops to search /etc/abrt - Got these avc's while trying to print a boarding pass from firefox - Devicekit is now putting the media directory under /run/media - Allow thumbnailers to create content in ~/.thumbails directory - Add support for proL2TPd by Dominick Grift - Allow all domains to call getcap - wdmd seems to get a random chown capability check that it does not need - Allow vhostmd to read kernel sysctls- Allow chronyd to read unix - Allow hpfax to read /etc/passwd - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them - Allow rpcd to read quota_db_t - Update to man pages to match latest policy - Fix bug in jockey interface for sepolgen-ifgen - Add initial svirt_prot_exec_t policy- More fixes for systemd from Dan Walsh- Add a new type for /etc/firewalld and allow firewalld to write to this directory - Add definition for ~/Maildir, and allow mail deliver domains to write there - Allow polipo to run from a cron job - Allow rtkit to schedule wine processes - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label - Allow users domains to send signals to consolehelper domains- More fixes for boinc policy - Allow polipo domain to create its own cache dir and pid file - Add systemctl support to httpd domain - Add systemctl support to polipo, allow NetworkManager to manage the service - Add policy for jockey-backend - Add support for motion daemon which is now covered by zoneminder policy - Allow colord to read/write motion tmpfs - Allow vnstat to search through var_lib_t directories - Stop transitioning to quota_t, from init an sysadm_t- Add svirt_lxc_file_t as a customizable type- Add additional fixes for icmp nagios plugin - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin - Add certmonger_unconfined_exec_t - Make sure tap22 device is created with the correct label - Allow staff users to read systemd unit files - Merge in previously built policy - Arpwatch needs to be able to start netlink sockets in order to start - Allow cgred_t to sys_ptrace to look at other DAC Processes- Back port some of the access that was allowed in nsplugin_t - Add definitiona for couchdb ports - Allow nagios to use inherited users ttys - Add git support for mock - Allow inetd to use rdate port - Add own type for rdate port - Allow samba to act as a portmapper - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev - New fixes needed for samba4 - Allow apps that use lib_t to read lib_t symlinks- Add policy for nove-cert - Add labeling for nova-openstack systemd unit files - Add policy for keystoke- Fix man pages fro domains - Add man pages for SELinux users and roles - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon - Add policy for matahari-rpcd - nfsd executes mount command on restart - Matahari domains execute renice and setsched - Dontaudit leaked tty in mozilla_plugin_config - mailman is changing to a per instance naming - Add 7600 and 4447 as jboss_management ports - Add fixes for nagios event handlers - Label httpd.event as httpd_exec_t, it is an apache daemon- Add labeling for /var/spool/postfix/dev/log - NM reads sysctl.conf - Iscsi log file context specification fix - Allow mozilla plugins to send dbus messages to user domains that transition to it - Allow mysql to read the passwd file - Allow mozilla_plugin_t to create mozilla home dirs in user homedir - Allow deltacloud to read kernel sysctl - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself - Allow postgresql_t to connectto itself - Add login_userdomain attribute for users which can log in using terminal- Allow sysadm_u to reach system_r by default #784011 - Allow nagios plugins to use inherited user terminals - Razor labeling is not used no longer - Add systemd support for matahari - Add port_types to man page, move booleans to the top, fix some english - Add support for matahari-sysconfig-console - Clean up matahari.fc - Fix matahari_admin() interfac - Add labels for/etc/ssh/ssh_host_*.pub keys- Allow ksysguardproces to send system log msgs - Allow boinc setpgid and signull - Allow xdm_t to sys_ptrace to run pidof command - Allow smtpd_t to manage spool files/directories and symbolic links - Add labeling for jetty - Needed changes to get unbound/dnssec to work with openswan- Add user_fonts_t alias xfs_tmp_t - Since depmod now runs as insmod_t we need to write to kernel_object_t - Allow firewalld to dbus chat with networkmanager - Allow qpidd to connect to matahari ports - policykit needs to read /proc for uses not owned by it - Allow systemctl apps to connecto the init stream- Turn on deny_ptrace boolean- Remove pam_selinux.8 man page. There was a conflict.- Add proxy class and read access for gssd_proxy - Separate out the sharing public content booleans - Allow certmonger to execute a script and send signals to apache and dirsrv to reload the certificate - Add label transition for gstream-0.10 and 12 - Add booleans to allow rsync to share nfs and cifs file sytems - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it - Fix filename transitions for cups files - Allow denyhosts to read "unix" - Add file name transition for locale.conf.new - Allow boinc projects to gconf config files - sssd needs to be able to increase the socket limit under certain loads - sge_execd needs to read /etc/passwd - Allow denyhost to check network state - NetworkManager needs to read sessions data - Allow denyhost to check network state - Allow xen to search virt images directories - Add label for /dev/megaraid_sas_ioctl_node - Add autogenerated man pages- Allow boinc project to getattr on fs - Allow init to execute initrc_state_t - rhev-agent package was rename to ovirt-guest-agent - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly - sytemd writes content to /run/initramfs and executes it on shutdown - kdump_t needs to read /etc/mtab, should be back ported to F16 - udev needs to load kernel modules in early system boot- Need to add sys_ptrace back in since reading any content in /proc can cause these accesses - Add additional systemd interfaces which are needed fro *_admin interfaces - Fix bind_admin() interface- Allow firewalld to read urand - Alias java, execmem_mono to bin_t to allow third parties - Add label for kmod - /etc/redhat-lsb contains binaries - Add boolean to allow gitosis to send mail - Add filename transition also for "event20" - Allow systemd_tmpfiles_t to delete all file types - Allow collectd to ipc_lock- make consoletype_exec optional, so we can remove consoletype policy - remove unconfined_permisive.patch - Allow openvpn_t to inherit user home content and tmp content - Fix dnssec-trigger labeling - Turn on obex policy for staff_t - Pem files should not be secret - Add lots of rules to fix AVC's when playing with containers - Fix policy for dnssec - Label ask-passwd directories correctly for systemd- sshd fixes seem to be causing unconfined domains to dyntrans to themselves - fuse file system is now being mounted in /run/user - systemd_logind is sending signals to processes that are dbus messaging with it - Add support for winshadow port and allow iscsid to connect to this port - httpd should be allowed to bind to the http_port_t udp socket - zarafa_var_lib_t can be a lnk_file - A couple of new .xsession-errors files - Seems like user space and login programs need to read logind_sessions_files - Devicekit disk seems to be being launched by systemd - Cleanup handling of setfiles so most of rules in te file - Correct port number for dnssec - logcheck has the home dir set to its cache- Add policy for grindengine MPI jobs- Add new sysadm_secadm.pp module * contains secadm definition for sysadm_t - Move user_mail_domain access out of the interface into the te file - Allow httpd_t to create httpd_var_lib_t directories as well as files - Allow snmpd to connect to the ricci_modcluster stream - Allow firewalld to read /etc/passwd - Add auth_use_nsswitch for colord - Allow smartd to read network state - smartdnotify needs to read /etc/group- Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory - lxdm startup scripts should be labeled bin_t, so confined users will work - mcstransd now creates a pid, needs back port to F16 - qpidd should be allowed to connect to the amqp port - Label devices 010-029 as usb devices - ypserv packager says ypserv does not use tmp_t so removing selinux policy types - Remove all ptrace commands that I believe are caused by the kernel/ps avcs - Add initial Obex policy - Add logging_syslogd_use_tty boolean - Add polipo_connect_all_unreserved bolean - Allow zabbix to connect to ftp port - Allow systemd-logind to be able to switch VTs - Allow apache to communicate with memcached through a sock_file- Fix file_context.subs_dist for now to work with pre usrmove- More /usr move fixes- Add zabbix_can_network boolean - Add httpd_can_connect_zabbix boolean - Prepare file context labeling for usrmove functions - Allow system cronjobs to read kernel network state - Add support for selinux_avcstat munin plugin - Treat hearbeat with corosync policy - Allow corosync to read and write to qpidd shared mem - mozilla_plugin is trying to run pulseaudio - Fixes for new sshd patch for running priv sep domains as the users context - Turn off dontaudit rules when turning on allow_ypbind - udev now reads /etc/modules.d directory- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out - Cups exchanges dbus messages with init - udisk2 needs to send syslog messages - certwatch needs to read /etc/passwd- Add labeling for udisks2 - Allow fsadmin to communicate with the systemd process- Treat Bip with bitlbee policy * Bip is an IRC proxy - Add port definition for interwise port - Add support for ipa_memcached socket - systemd_jounald needs to getattr on all processes - mdadmin fixes * uses getpw - amavisd calls getpwnam() - denyhosts calls getpwall()- Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there - bluetooth says they do not use /tmp and want to remove the type - Allow init to transition to colord - Mongod needs to read /proc/sys/vm/zone_reclaim_mode - Allow postfix_smtpd_t to connect to spamd - Add boolean to allow ftp to connect to all ports > 1023 - Allow sendmain to write to inherited dovecot tmp files - setroubleshoot needs to be able to execute rpm to see what version of packages- Merge systemd patch - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online - Allow deltacloudd dac_override, setuid, setgid caps - Allow aisexec to execute shell - Add use_nfs_home_dirs boolean for ssh-keygen- Fixes to make rawhide boot in enforcing mode with latest systemd changes- Add labeling for /var/run/systemd/journal/syslog - libvirt sends signals to ifconfig - Allow domains that read logind session files to list them- Fixed destined form libvirt-sandbox - Allow apps that list sysfs to also read sympolicy links in this filesystem - Add ubac_constrained rules for chrome_sandbox - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra - Allow postgresql to be executed by the caller - Standardize interfaces of daemons - Add new labeling for mm-handler - Allow all matahari domains to read network state and etc_runtime_t files- New fix for seunshare, requires seunshare_domains to be able to mounton / - Allow systemctl running as logrotate_t to connect to private systemd socket - Allow tmpwatch to read meminfo - Allow rpc.svcgssd to read supported_krb5_enctype - Allow zarafa domains to read /dev/random and /dev/urandom - Allow snmpd to read dev_snmp6 - Allow procmail to talk with cyrus - Add fixes for check_disk and check_nagios plugins- default trans rules for Rawhide policy - Make sure sound_devices controlC* are labeled correctly on creation - sssd now needs sys_admin - Allow snmp to read all proc_type - Allow to setup users homedir with quota.group- Add httpd_can_connect_ldap() interface - apcupsd_t needs to use seriel ports connected to usb devices - Kde puts procmail mail directory under ~/.local/share - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now - Add labeling for /sbin/iscsiuio- Add label for /var/lib/iscan/interpreter - Dont audit writes to leaked file descriptors or redirected output for nacl - NetworkManager needs to write to /sys/class/net/ib*/mode- Allow abrt to request the kernel to load a module - Make sure mozilla content is labeled correctly - Allow tgtd to read system state - More fixes for boinc * allow to resolve dns name * re-write boinc policy to use boinc_domain attribute - Allow munin services plugins to use NSCD services- Allow mozilla_plugin_t to manage mozilla_home_t - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain - Add label for tumblerd- Fixes for xguest package- Fixes related to /bin, /sbin - Allow abrt to getattr on blk files - Add type for rhev-agent log file - Fix labeling for /dev/dmfm - Dontaudit wicd leaking - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it - Label /etc/locale.conf correctly - Allow user_mail_t to read /dev/random - Allow postfix-smtpd to read MIMEDefang - Add label for /var/log/suphp.log - Allow swat_t to connect and read/write nmbd_t sock_file - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf - Allow systemd-tmpfiles to change user identity in object contexts - More fixes for rhev_agentd_t consolehelper policy- Use fs_use_xattr for squashf - Fix procs_type interface - Dovecot has a new fifo_file /var/run/dovecot/stats-mail - Dovecot has a new fifo_file /var/run/stats-mail - Colord does not need to connect to network - Allow system_cronjob to dbus chat with NetworkManager - Puppet manages content, want to make sure it labels everything correctly- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it - Allow all postfix domains to use the fifo_file - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t - Allow apmd_t to read grub.cfg - Let firewallgui read the selinux config - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp - Fix devicekit_manage_pid_files() interface - Allow squid to check the network state - Dontaudit colord getattr on file systems - Allow ping domains to read zabbix_tmp_t files- Allow mcelog_t to create dir and file in /var/run and label it correctly - Allow dbus to manage fusefs - Mount needs to read process state when mounting gluster file systems - Allow collectd-web to read collectd lib files - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr - Allow colord to get the attributes of tmpfs filesystem - Add sanlock_use_nfs and sanlock_use_samba booleans - Add bin_t label for /usr/lib/virtualbox/VBoxManage- Add ssh_dontaudit_search_home_dir - Changes to allow namespace_init_t to work - Add interface to allow exec of mongod, add port definition for mongod port, 27017 - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t - Allow spamd and clamd to steam connect to each other - Add policy label for passwd.OLD - More fixes for postfix and postfix maildro - Add ftp support for mozilla plugins - Useradd now needs to manage policy since it calls libsemanage - Fix devicekit_manage_log_files() interface - Allow colord to execute ifconfig - Allow accountsd to read /sys - Allow mysqld-safe to execute shell - Allow openct to stream connect to pcscd - Add label for /var/run/nm-dns-dnsmasq\.conf - Allow networkmanager to chat with virtd_t- Pulseaudio changes - Merge patches- Merge patches back into git repository.- Remove allow_execmem boolean and replace with deny_execmem boolean- Turn back on allow_execmem boolean- Add more MCS fixes to make sandbox working - Make faillog MLS trusted to make sudo_$1_t working - Allow sandbox_web_client_t to read passwd_file_t - Add .mailrc file context - Remove execheap from openoffice domain - Allow chrome_sandbox_nacl_t to read cpu_info - Allow virtd to relabel generic usb which is need if USB device - Fixes for virt.if interfaces to consider chr_file as image file type- Remove Open Office policy - Remove execmem policy- MCS fixes - quota fixes- Remove transitions to consoletype- Make nvidia* to be labeled correctly - Fix abrt_manage_cache() interface - Make filetrans rules optional so base policy will build - Dontaudit chkpwd_t access to inherited TTYS - Make sure postfix content gets created with the correct label - Allow gnomeclock to read cgroup - Fixes for cloudform policy- Check in fixed for Chrome nacl support- Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_overide to communicate with users TTY's - Allow svirt_lxc domains to send kill signals within their container- Remove qemu.pp again without causing a crash- Remove qemu.pp, everything should use svirt_t or stay in its current domain- Allow policykit to talk to the systemd via dbus - Move chrome_sandbox_nacl_t to permissive domains - Additional rules for chrome_sandbox_nacl- Change bootstrap name to nacl - Chrome still needs execmem - Missing role for chrome_sandbox_bootstrap - Add boolean to remove execmem and execstack from virtual machines - Dontaudit xdm_t doing an access_check on etc_t directories- Allow named to connect to dirsrv by default - add ldapmap1_0 as a krb5_host_rcache_t file - Google chrome developers asked me to add bootstrap policy for nacl stuff - Allow rhev_agentd_t to getattr on mountpoints - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets- Fixes for cloudform policies which need to connect to random ports - Make sure if an admin creates modules content it creates them with the correct label - Add port 8953 as a dns port used by unbound - Fix file name transition for alsa and confined users- Turn on mock_t and thumb_t for unconfined domains- Policy update should not modify local contexts- Remove ada policy- Remove tzdata policy - Add labeling for udev - Add cloudform policy - Fixes for bootloader policy- Add policies for nova openstack- Add fixes for nova-stack policy- Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain - Allow init process to setrlimit on itself - Take away transition rules for users executing ssh-keygen - Allow setroubleshoot_fixit_t to read /dev/urand - Allow sshd to relbale tunnel sockets - Allow fail2ban domtrans to shorewall in the same way as with iptables - Add support for lnk files in the /var/lib/sssd directory - Allow system mail to connect to courier-authdaemon over an unix stream socket- Add passwd_file_t for /etc/ptmptmp- Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK) - Make corosync to be able to relabelto cluster lib fies - Allow samba domains to search /var/run/nmbd - Allow dirsrv to use pam - Allow thumb to call getuid - chrome less likely to get mmap_zero bug so removing dontaudit - gimp help-browser has built in javascript - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t - Re-write glance policy- Move dontaudit sys_ptrace line from permissive.te to domain.te - Remove policy for hal, it no longer exists- Don't check md5 size or mtime on certain config files- Remove allow_ptrace and replace it with deny_ptrace, which will remove all ptrace from the system - Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;- Fixes for bootloader policy - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore - Allow nsplugin to read /usr/share/config - Allow sa-update to update rules - Add use_fusefs_home_dirs for chroot ssh option - Fixes for grub2 - Update systemd_exec_systemctl() interface - Allow gpg to read the mail spool - More fixes for sa-update running out of cron job - Allow ipsec_mgmt_t to read hardware state information - Allow pptp_t to connect to unreserved_port_t - Dontaudit getattr on initctl in /dev from chfn - Dontaudit getattr on kernel_core from chfn - Add systemd_list_unit_dirs to systemd_exec_systemctl call - Fixes for collectd policy - CHange sysadm_t to create content as user_tmp_t under /tmp- Shrink size of policy through use of attributes for userdomain and apache- Allow virsh to read xenstored pid file - Backport corenetwork fixes from upstream - Do not audit attempts by thumb to search config_home_t dirs (~/.config) - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t - allow thumb to read generic data home files (mime.type)- Allow nmbd to manage sock file in /var/run/nmbd - ricci_modservice send syslog msgs - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly - Allow systemd_logind_t to manage /run/USER/dconf/user- Fix missing patch from F16- Allow logrotate setuid and setgid since logrotate is supposed to do it - Fixes for thumb policy by grift - Add new nfsd ports - Added fix to allow confined apps to execmod on chrome - Add labeling for additional vdsm directories - Allow Exim and Dovecot SASL - Add label for /var/run/nmbd - Add fixes to make virsh and xen working together - Colord executes ls - /var/spool/cron is now labeled as user_cron_spool_t- Stop complaining about leaked file descriptors during install- Remove java and mono module and merge into execmem- Fixes for thumb policy and passwd_file_t- Fixes caused by the labeling of /etc/passwd - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide- Add support for Clustered Samba commands - Allow ricci_modrpm_t to send log msgs - move permissive virt_qmf_t from virt.te to permissivedomains.te - Allow ssh_t to use kernel keyrings - Add policy for libvirt-qmf and more fixes for linux containers - Initial Polipo - Sanlock needs to run ranged in order to kill svirt processes - Allow smbcontrol to stream connect to ctdbd- Add label for /etc/passwd- Change unconfined_domains to permissive for Rawhide - Add definition for the ephemeral_ports- Make mta_role() active - Allow asterisk to connect to jabber client port - Allow procmail to read utmp - Add NIS support for systemd_logind_t - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t - Fix systemd_manage_unit_dirs() interface - Allow ssh_t to manage directories passed into it - init needs to be able to create and delete unit file directories - Fix typo in apache_exec_sys_script - Add ability for logrotate to transition to awstat domain- Change screen to use screen_domain attribute and allow screen_domains to read all process domain state - Add SELinux support for ssh pre-auth net process in F17 - Add logging_syslogd_can_sendmail boolean- Add definition for ephemeral ports - Define user_tty_device_t as a customizable_type- Needs to require a new version of checkpolicy - Interface fixes- Allow sanlock to manage virt lib files - Add virt_use_sanlock booelan - ksmtuned is trying to resolve uids - Make sure .gvfs is labeled user_home_t in the users home directory - Sanlock sends kill signals and needs the kill capability - Allow mockbuild to work on nfs homedirs - Fix kerberos_manage_host_rcache() interface - Allow exim to read system state- Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t- Allow collectd to read hardware state information - Add loop_control_device_t - Allow mdadm to request kernel to load module - Allow domains that start other domains via systemctl to search unit dir - systemd_tmpfiles, needs to list any file systems mounted on /tmp - No one can explain why radius is listing the contents of /tmp, so we will dontaudit - If I can manage etc_runtime files, I should be able to read the links - Dontaudit hostname writing to mock library chr_files - Have gdm_t setup labeling correctly in users home dir - Label content unde /var/run/user/NAME/dconf as config_home_t - Allow sa-update to execute shell - Make ssh-keygen working with fips_enabled - Make mock work for staff_t user - Tighten security on mock_t- removing unconfined_notrans_t no longer necessary - Clean up handling of secure_mode_insmod and secure_mode_policyload - Remove unconfined_mount_t- Add exim_exec_t label for /usr/sbin/exim_tidydb - Call init_dontaudit_rw_stream_socket() interface in mta policy - sssd need to search /var/cache/krb5rcache directory - Allow corosync to relabel own tmp files - Allow zarafa domains to send system log messages - Allow ssh to do tunneling - Allow initrc scripts to sendto init_t unix_stream_socket - Changes to make sure dmsmasq and virt directories are labeled correctly - Changes needed to allow sysadm_t to manage systemd unit files - init is passing file descriptors to dbus and on to system daemons - Allow sulogin additional access Reported by dgrift and Jeremy Miller - Steve Grubb believes that wireshark does not need this access - Fix /var/run/initramfs to stop restorecon from looking at - pki needs another port - Add more labels for cluster scripts - Allow apps that manage cgroup_files to manage cgroup link files - Fix label on nfs-utils scripts directories - Allow gatherd to read /dev/rand and /dev/urand- pki needs another port - Add more labels for cluster scripts - Fix label on nfs-utils scripts directories - Fixes for cluster - Allow gatherd to read /dev/rand and /dev/urand - abrt leaks fifo files- Add glance policy - Allow mdadm setsched - /var/run/initramfs should not be relabeled with a restorecon run - memcache can be setup to override sys_resource - Allow httpd_t to read tetex data - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.- Allow Postfix to deliver to Dovecot LMTP socket - Ignore bogus sys_module for lldpad - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock - systemd_logind_t sets the attributes on usb devices - Allow hddtemp_t to read etc_t files - Add permissivedomains module - Move all permissive domains calls to permissivedomain.te - Allow pegasis to send kill signals to other UIDs- Allow insmod_t to use fds leaked from devicekit - dontaudit getattr between insmod_t and init_t unix_stream_sockets - Change sysctl unit file interfaces to use systemctl - Add support for chronyd unit file - Allow mozilla_plugin to read gnome_usr_config - Add policy for new gpsd - Allow cups to create kerberos rhost cache files - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly- Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten- Add policy for sa-update being run out of cron jobs - Add create perms to postgresql_manage_db - ntpd using a gps has to be able to read/write generic tty_device_t - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev - fix spec file - Remove qemu_domtrans_unconfined() interface - Make passenger working together with puppet - Add init_dontaudit_rw_stream_socket interface - Fixes for wordpress- Turn on allow_domain_fd_use boolean on F16 - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Add abrt_handle_event_t domain for ABRT event scripts - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change - Allow httpd_git_script_t to read passwd data - Allow openvpn to set its process priority when the nice parameter is used- livecd fixes - spec file fixes- fetchmail can use kerberos - ksmtuned reads in shell programs - gnome_systemctl_t reads the process state of ntp - dnsmasq_t asks the kernel to load multiple kernel modules - Add rules for domains executing systemctl - Bogus text within fc file- Add cfengine policy- Add abrt_domain attribute - Allow corosync to manage cluster lib files - Allow corosync to connect to the system DBUS- Add sblim, uuidd policies - Allow kernel_t dyntrasition to init_t- init_t need setexec - More fixes of rules which cause an explosion in rules by Dan Walsh- Allow rcsmcertd to perform DNS name resolution - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts - Allow tmux to run as screen - New policy for collectd - Allow gkeyring_t to interact with all user apps - Add rules to allow firstboot to run on machines with the unconfined.pp module removed- Allow systemd_logind to send dbus messages with users - allow accountsd to read wtmp file - Allow dhcpd to get and set capabilities- Fix oracledb_port definition - Allow mount to mounton the selinux file system - Allow users to list /var directories- systemd fixes- Add initial policy for abrt_dump_oops_t - xtables-multi wants to getattr of the proc fs - Smoltclient is connecting to abrt - Dontaudit leaked file descriptors to postdrop - Allow abrt_dump_oops to look at kernel sysctls - Abrt_dump_oops_t reads kernel ring buffer - Allow mysqld to request the kernel to load modules - systemd-login needs fowner - Allow postfix_cleanup_t to searh maildrop- Initial systemd_logind policy - Add policy for systemd_logger and additional proivs for systemd_logind - More fixes for systemd policies- Allow setsched for virsh - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories - iptables: the various /sbin/ip6?tables.* are now symlinks for /sbin/xtables-multi- A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit - Allow colord to interact with the users through the tmpfs file system - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files - Add label for /var/log/mcelog - Allow asterisk to read /dev/random if it uses TLS - Allow colord to read ini files which are labeled as bin_t - Allow dirsrvadmin sys_resource and setrlimit to use ulimit - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first. - Also lists /var and /var/spool directories - Add openl2tpd to l2tpd policy - qpidd is reading the sysfs file- Change usbmuxd_t to dontaudit attempts to read chr_file - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains - Allow pppd to search /var/lock dir - Add rhsmcertd policy- Update to upstream- More fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git- Fix spec file to not report Verify errors- Add dspam policy - Add lldpad policy - dovecot auth wants to search statfs #713555 - Allow systemd passwd apps to read init fifo_file - Allow prelink to use inherited terminals - Run cherokee in the httpd_t domain - Allow mcs constraints on node connections - Implement pyicqt policy - Fixes for zarafa policy - Allow cobblerd to send syslog messages- Add policy.26 to the payload - Remove olpc stuff - Remove policygentool- Fixes for zabbix - init script needs to be able to manage sanlock_var_run_... - Allow sandlock and wdmd to create /var/run directories... - mixclip.so has been compiled correctly - Fix passenger policy module name- Add mailscanner policy from dgrift - Allow chrome to optionally be transitioned to - Zabbix needs these rules when starting the zabbix_server_mysql - Implement a type for freedesktop openicc standard (~/.local/share/icc) - Allow system_dbusd_t to read inherited icc_data_home_t files. - Allow colord_t to read icc_data_home_t content. #706975 - Label stuff under /usr/lib/debug as if it was labeled under /- Fixes for sanlock policy - Fixes for colord policy - Other fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Add rhev policy module to modules-targeted.conf- Lot of fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Allow logrotate to execute systemctl - Allow nsplugin_t to getattr on gpmctl - Fix dev_getattr_all_chr_files() interface - Allow shorewall to use inherited terms - Allow userhelper to getattr all chr_file devices - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t - Fix labeling for ABRT Retrace Server- Dontaudit sys_module for ifconfig - Make telepathy and gkeyringd daemon working with confined users - colord wants to read files in users homedir - Remote login should be creating user_tmp_t not its own tmp files- Fix label for /usr/share/munin/plugins/munin_* plugins - Add support for zarafa-indexer - Fix boolean description - Allow colord to getattr on /proc/scsi/scsi - Add label for /lib/upstart/init - Colord needs to list /mnt- Forard port changes from F15 for telepathy - NetworkManager should be allowed to use /dev/rfkill - Fix dontaudit messages to say Domain to not audit - Allow telepathy domains to read/write gnome_cache files - Allow telepathy domains to call getpw - Fixes for colord and vnstatd policy- Allow init_t getcap and setcap - Allow namespace_init_t to use nsswitch - aisexec will execute corosync - colord tries to read files off noxattr file systems - Allow init_t getcap and setcap- Add support for ABRT retrace server - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners - Allow telepath_msn_t to read /proc/PARENT/cmdline - ftpd needs kill capability - Allow telepath_msn_t to connect to sip port - keyring daemon does not work on nfs homedirs - Allow $1_sudo_t to read default SELinux context - Add label for tgtd sock file in /var/run/ - Add apache_exec_rotatelogs interface - allow all zaraha domains to signal themselves, server writes to /tmp - Allow syslog to read the process state - Add label for /usr/lib/chromium-browser/chrome - Remove the telepathy transition from unconfined_t - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts - Allow initrc_t domain to manage abrt pid files - Add support for AEOLUS project - Virt_admin should be allowed to manage images and processes - Allow plymountd to send signals to init - Change labeling of fping6- Add filename transitions- Fixes for zarafa policy - Add support for AEOLUS project - Change labeling of fping6 - Allow plymountd to send signals to init - Allow initrc_t domain to manage abrt pid files - Virt_admin should be allowed to manage images and processes- xdm_t needs getsession for switch user - Every app that used to exec init is now execing systemdctl - Allow squid to manage krb5_host_rcache_t files - Allow foghorn to connect to agentx port - Fixes for colord policy- Add Dan's patch to remove 64 bit variants - Allow colord to use unix_dgram_socket - Allow apps that search pids to read /var/run if it is a lnk_file - iscsid_t creates its own directory - Allow init to list var_lock_t dir - apm needs to verify user accounts auth_use_nsswitch - Add labeling for systemd unit files - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added - Add label for matahari-broker.pid file - We want to remove untrustedmcsprocess from ability to read /proc/pid - Fixes for matahari policy - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on- Fix typo- Add /var/run/lock /var/lock definition to file_contexts.subs - nslcd_t is looking for kerberos cc files - SSH_USE_STRONG_RNG is 1 which requires /dev/random - Fix auth_rw_faillog definition - Allow sysadm_t to set attributes on fixed disks - allow user domains to execute lsof and look at application sockets - prelink_cron job calls telinit -u if init is rewritten - Fixes to run qemu_t from staff_t- Fix label for /var/run/udev to udev_var_run_t - Mock needs to be able to read network state- Add file_contexts.subs to handle /run and /run/lock - Add other fixes relating to /run changes from F15 policy- Allow $1_sudo_t and $1_su_t open access to user terminals - Allow initrc_t to use generic terminals - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs -systemd is going to be useing /run and /run/lock for early bootup files. - Fix some comments in rlogin.if - Add policy for KDE backlighthelper - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems - sssd wants to read .k5login file in users homedir - setroubleshoot reads executables to see if they have TEXTREL - Add /var/spool/audit support for new version of audit - Remove kerberos_connect_524() interface calling - Combine kerberos_master_port_t and kerberos_port_t - systemd has setup /dev/kmsg as stderr for apps it executes - Need these access so that init can impersonate sockets on unix_dgram_socket- Remove some unconfined domains - Remove permissive domains - Add policy-term.patch from Dan- Fix multiple specification for boot.log - devicekit leaks file descriptors to setfiles_t - Change all all_nodes to generic_node and all_if to generic_if - Should not use deprecated interface - Switch from using all_nodes to generic_node and from all_if to generic_if - Add support for xfce4-notifyd - Fix file context to show several labels as SystemHigh - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs - Add etc_runtime_t label for /etc/securetty - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly - login.krb needs to be able to write user_tmp_t - dirsrv needs to bind to port 7390 for dogtag - Fix a bug in gpg policy - gpg sends audit messages - Allow qpid to manage matahari files- Initial policy for matahari - Add dev_read_watchdog - Allow clamd to connect clamd port - Add support for kcmdatetimehelper - Allow shutdown to setrlimit and sys_nice - Allow systemd_passwd to talk to /dev/log before udev or syslog is running - Purge chr_file and blk files on /tmp - Fixes for pads - Fixes for piranha-pulse - gpg_t needs to be able to encyprt anything owned by the user- mozilla_plugin_tmp_t needs to be treated as user tmp files - More dontaudits of writes from readahead - Dontaudit readahead_t file_type:dir write, to cover up kernel bug - systemd_tmpfiles needs to relabel faillog directory as well as the file - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost- Add policykit fixes from Tim Waugh - dontaudit sandbox domains sandbox_file_t:dir mounton - Add new dontaudit rules for sysadm_dbusd_t - Change label for /var/run/faillock * other fixes which relate with this change- Update to upstream - Fixes for telepathy - Add port defition for ssdp port - add policy for /bin/systemd-notify from Dan - Mount command requires users read mount_var_run_t - colord needs to read konject_uevent_socket - User domains connect to the gkeyring socket - Add colord policy and allow user_t and staff_t to dbus chat with it - Add lvm_exec_t label for kpartx - Dontaudit reading the mail_spool_t link from sandbox -X - systemd is creating sockets in avahi_var_run and system_dbusd_var_run- gpg_t needs to talk to gnome-keyring - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd - enforce MCS labeling on nodes - Allow arpwatch to read meminfo - Allow gnomeclock to send itself signals - init relabels /dev/.udev files on boot - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t - dnsmasq can run as a dbus service, needs acquire service - mysql_admin should be allowed to connect to mysql service - virt creates monitor sockets in the users home dir- Allow usbhid-ups to read hardware state information - systemd-tmpfiles has moved - Allo cgroup to sys_tty_config - For some reason prelink is attempting to read gconf settings - Add allow_daemons_use_tcp_wrapper boolean - Add label for ~/.cache/wocky to make telepathy work in enforcing mode - Add label for char devices /dev/dasd* - Fix for apache_role - Allow amavis to talk to nslcd - allow all sandbox to read selinux poilcy config files - Allow cluster domains to use the system bus and send each other dbus messages- Update to upstream- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild- Update to ref policy - cgred needs chown capability - Add /dev/crash crash_dev_t - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability- New labeling for postfmulti #675654 - dontaudit xdm_t listing noxattr file systems - dovecot-auth needs to be able to connect to mysqld via the network as well as locally - shutdown is passed stdout to a xdm_log_t file - smartd creates a fixed disk device - dovecot_etc_t contains a lnk_file that domains need to read - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot- syslog_t needs syslog capability - dirsrv needs to be able to create /var/lib/snmp - Fix labeling for dirsrv - Fix for dirsrv policy missing manage_dirs_pattern - corosync needs to delete clvm_tmpfs_t files - qdiskd needs to list hugetlbfs - Move setsched to sandbox_x_domain, so firefox can run without network access - Allow hddtemp to read removable devices - Adding syslog and read_policy permissions to policy * syslog Allow unconfined, sysadm_t, secadm_t, logadm_t * read_policy allow unconfined, sysadm_t, secadm_t, staff_t on Targeted allow sysadm_t (optionally), secadm_t on MLS - mdadm application will write into /sys/.../uevent whenever arrays are assembled or disassembled.- Add tcsd policy- ricci_modclusterd_t needs to bind to rpc ports 500-1023 - Allow dbus to use setrlimit to increase resoueces - Mozilla_plugin is leaking to sandbox - Allow confined users to connect to lircd over unix domain stream socket which allow to use remote control - Allow awstats to read squid logs - seunshare needs to manage tmp_t - apcupsd cgi scripts have a new directory- Fix xserver_dontaudit_read_xdm_pid - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. * These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t - Allow readahead to manage readahead pid dirs - Allow readahead to read all mcs levels - Allow mozilla_plugin_t to use nfs or samba homedirs- Allow nagios plugin to read /proc/meminfo - Fix for mozilla_plugin - Allow samba_net_t to create /etc/keytab - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t - nslcd can read user credentials - Allow nsplugin to delete mozilla_plugin_tmpfs_t - abrt tries to create dir in rpm_var_lib_t - virt relabels fifo_files - sshd needs to manage content in fusefs homedir - mock manages link files in cache dir- nslcd needs setsched and to read /usr/tmp - Invalid call in likewise policy ends up creating a bogus role - Cannon puts content into /var/lib/bjlib that cups needs to be able to write - Allow screen to create screen_home_t in /root - dirsrv sends syslog messages - pinentry reads stuff in .kde directory - Add labels for .kde directory in homedir - Treat irpinit, iprupdate, iprdump services with raid policy- NetworkManager wants to read consolekit_var_run_t - Allow readahead to create /dev/.systemd/readahead - Remove permissive domains - Allow newrole to run namespace_init- Add sepgsql_contexts file- Update to upstream- Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on - Add puppetmaster_use_db boolean - Fixes for zarafa policy - Fixes for gnomeclock poliy - Fix systemd-tmpfiles to use auth_use_nsswitch- gnomeclock executes a shell - Update for screen policy to handle pipe in homedir - Fixes for polyinstatiated homedir - Fixes for namespace policy and other fixes related to polyinstantiation - Add namespace policy - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts - Fixes for init, psad policy which relate with confined users - Do not audit bootloader attempts to read devicekit pid files - Allow nagios service plugins to read /proc- Add firewalld policy - Allow vmware_host to read samba config - Kernel wants to read /proc Fix duplicate grub def in cobbler - Chrony sends mail, executes shell, uses fifo_file and reads /proc - devicekitdisk getattr all file systems - sambd daemon writes wtmp file - libvirt transitions to dmidecode- Add initial policy for system-setup-keyboard which is now daemon - Label /var/lock/subsys/shorewall as shorewall_lock_t - Allow users to communicate with the gpg_agent_t - Dontaudit mozilla_plugin_t using the inherited terminal - Allow sambagui to read files in /usr - webalizer manages squid log files - Allow unconfined domains to bind ports to raw_ip_sockets - Allow abrt to manage rpm logs when running yum - Need labels for /var/run/bittlebee - Label .ssh under amanda - Remove unused genrequires for virt_domain_template - Allow virt_domain to use fd inherited from virtd_t - Allow iptables to read shorewall config- Gnome apps list config_home_t - mpd creates lnk files in homedir - apache leaks write to mail apps on tmp files - /var/stockmaniac/templates_cache contains log files - Abrt list the connects of mount_tmp_t dirs - passwd agent reads files under /dev and reads utmp file - squid apache script connects to the squid port - fix name of plymouth log file - teamviewer is a wine app - allow dmesg to read system state - Stop labeling files under /var/lib/mock so restorecon will not go into this - nsplugin needs to read network state for google talk- Allow xdm and syslog to use /var/log/boot.log - Allow users to communicate with mozilla_plugin and kill it - Add labeling for ipv6 and dhcp- New labels for ghc http content - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy- Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot- Update selinux policy to handle new /usr/share/sandbox/start script- Update to upstream - Fix version of policy in spec file- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs - remove per sandbox domains devpts types - Allow dkim-milter sending signal to itself- Allow domains that transition to ping or traceroute, kill them - Allow user_t to conditionally transition to ping_t and traceroute_t - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup- Turn on systemd policy - mozilla_plugin needs to read certs in the homedir. - Dontaudit leaked file descriptors from devicekit - Fix ircssi to use auth_use_nsswitch - Change to use interface without param in corenet to disable unlabelednet packets - Allow init to relabel sockets and fifo files in /dev - certmonger needs dac* capabilities to manage cert files not owned by root - dovecot needs fsetid to change group membership on mail - plymouthd removes /var/log/boot.log - systemd is creating symlinks in /dev - Change label on /etc/httpd/alias to be all cert_t- Fixes for clamscan and boinc policy - Add boinc_project_t setpgid - Allow alsa to create tmp files in /tmp- Push fixes to allow disabling of unlabeled_t packet access - Enable unlabelednet policy- Fixes for lvm to work with systemd- Fix the label for wicd log - plymouthd creates force-display-on-active-vt file - Allow avahi to request the kernel to load a module - Dontaudit hal leaks - Fix gnome_manage_data interface - Add new interface corenet_packet to define a type as being an packet_type. - Removed general access to packet_type from icecast and squid. - Allow mpd to read alsa config - Fix the label for wicd log - Add systemd policy- Fix gnome_manage_data interface - Dontaudit sys_ptrace capability for iscsid - Fixes for nagios plugin policy- Fix cron to run ranged when started by init - Fix devicekit to use log files - Dontaudit use of devicekit_var_run_t for fstools - Allow init to setattr on logfile directories - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t- Fix up handling of dnsmasq_t creating /var/run/libvirt/network - Turn on sshd_forward_ports boolean by default - Allow sysadmin to dbus chat with rpm - Add interface for rw_tpm_dev - Allow cron to execute bin - fsadm needs to write sysfs - Dontaudit consoletype reading /var/run/pm-utils - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin - certmonger needs to manage dirsrv data - /var/run/pm-utils should be labeled as devicekit_var_run_t- fixes to allow /var/run and /var/lock as tmpfs - Allow chrome sandbox to connect to web ports - Allow dovecot to listem on lmtp and sieve ports - Allov ddclient to search sysctl_net_t - Transition back to original domain if you execute the shell- Remove duplicate declaration- Update to upstream - Cleanup for sandbox - Add attribute to be able to select sandbox types- Allow ddclient to fix file mode bits of ddclient conf file - init leaks file descriptors to daemons - Add labels for /etc/lirc/ and - Allow amavis_t to exec shell - Add label for gssd_tmp_t for /var/tmp/nfs_0- Put back in lircd_etc_t so policy will install- Turn on allow_postfix_local_write_mail_spool - Allow initrc_t to transition to shutdown_t - Allow logwatch and cron to mls_read_to_clearance for MLS boxes - Allow wm to send signull to all applications and receive them from users - lircd patch from field - Login programs have to read /etc/samba - New programs under /lib/systemd - Abrt needs to read config files- Update to upstream - Dontaudit leaked sockets from userdomains to user domains - Fixes for mcelog to handle scripts - Apply patch from Ruben Kerkhof - Allow syslog to search spool dirs- Allow nagios plugins to read usr files - Allow mysqld-safe to send system log messages - Fixes fpr ddclient policy - Fix sasl_admin interface - Allow apache to search zarafa config - Allow munin plugins to search /var/lib directory - Allow gpsd to read sysfs_t - Fix labels on /etc/mcelog/triggers to bin_t- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp - Fix xserver interface - Fix definition of /var/run/lxdm- Turn on mediawiki policy - kdump leaks kdump_etc_t to ifconfig, add dontaudit - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap- Allow groupd transition to fenced domain when executes fence_node - Fixes for rchs policy - Allow mpd to be able to read samba/nfs files- Fix up corecommands.fc to match upstream - Make sure /lib/systemd/* is labeled init_exec_t - mount wants to setattr on all mountpoints - dovecot auth wants to read dovecot etc files - nscd daemon looks at the exe file of the comunicating daemon - openvpn wants to read utmp file - postfix apps now set sys_nice and lower limits - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly - Also resolves nsswitch - Fix labels on /etc/hosts.* - Cleanup to make upsteam patch work - allow abrt to read etc_runtime_t- Add conflicts for dirsrv package- Update to upstream - Add vlock policy- Fix sandbox to work on nfs homedirs - Allow cdrecord to setrlimit - Allow mozilla_plugin to read xauth - Change label on systemd-logger to syslogd_exec_t - Install dirsrv policy from dirsrv package- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it - Udev needs to stream connect to init and kernel - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory- Allow NetworkManager to read openvpn_etc_t - Dontaudit hplip to write of /usr dirs - Allow system_mail_t to create /root/dead.letter as mail_home_t - Add vdagent policy for spice agent daemon- Dontaudit sandbox sending sigkill to all user domains - Add policy for rssh_chroot_helper - Add missing flask definitions - Allow udev to relabelto removable_t - Fix label on /var/log/wicd.log - Transition to initrc_t from init when executing bin_t - Add audit_access permissions to file - Make removable_t a device_node - Fix label on /lib/systemd/*- Fixes for systemd to manage /var/run - Dontaudit leaks by firstboot- Allow chome to create netlink_route_socket - Add additional MATHLAB file context - Define nsplugin as an application_domain - Dontaudit sending signals from sandboxed domains to other domains - systemd requires init to build /tmp /var/auth and /var/lock dirs - mount wants to read devicekit_power /proc/ entries - mpd wants to connect to soundd port - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit - Treat lib_t and textrel_shlib_t directories the same - Allow mount read access on virtual images- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs. - Allow devicekit_power to domtrans to mount - Allow dhcp to bind to udp ports > 1024 to do named stuff - Allow ssh_t to exec ssh_exec_t - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used - Fix clamav_append_log() intefaces - Fix 'psad_rw_fifo_file' interface- Allow cobblerd to list cobler appache content- Fixup for the latest version of upowed - Dontaudit sandbox sending SIGNULL to desktop apps- Update to upstream-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access - dovecot-auth_t needs ipc_lock - gpm needs to use the user terminal - Allow system_mail_t to append ~/dead.letter - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf - Add pid file to vnstatd - Allow mount to communicate with gfs_controld - Dontaudit hal leaks in setfiles- Lots of fixes for systemd - systemd now executes readahead and tmpwatch type scripts - Needs to manage random seed- Allow smbd to use sys_admin - Remove duplicate file context for tcfmgr - Update to upstream- Fix fusefs handling - Do not allow sandbox to manage nsplugin_rw_t - Allow mozilla_plugin_t to connecto its parent - Allow init_t to connect to plymouthd running as kernel_t - Add mediawiki policy - dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. - Disable transition from dbus_session_domain to telepathy for F14 - Allow boinc_project to use shm - Allow certmonger to search through directories that contain certs - Allow fail2ban the DAC Override so it can read log files owned by non root users- Start adding support for use_fusefs_home_dirs - Add /var/lib/syslog directory file context - Add /etc/localtime as locale file context- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user - Turn off iptables from unconfined user - Allow sudo to send signals to any domains the user could have transitioned to. - Passwd in single user mode needs to talk to console_device_t - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio - locate tried to read a symbolic link, will dontaudit - New labels for telepathy-sunshine content in homedir - Google is storing other binaries under /opt/google/talkplugin - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15 - modemmanger and bluetooth send dbus messages to devicekit_power - Samba needs to getquota on filesystems labeld samba_share_t- Dontaudit attempts by xdm_t to write to bin_t for kdm - Allow initrc_t to manage system_conf_t- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets - Allow confined users to read xdm_etc_t files - Allow xdm_t to transition to xauth_t for lxdm program- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home - Allow clamd to send signals to itself - Allow mozilla_plugin_t to read user home content. And unlink pulseaudio shm. - Allow haze to connect to yahoo chat and messenger port tcp:5050. Bz #637339 - Allow guest to run ps command on its processes by allowing it to read /proc - Allow firewallgui to sys_rawio which seems to be required to setup masqerading - Allow all domains to search through default_t directories, in order to find differnet labels. For example people serring up /foo/bar to be share via samba. - Add label for /var/log/slim.log- Pull in cleanups from dgrift - Allow mozilla_plugin_t to execute mozilla_home_t - Allow rpc.quota to do quotamod- Cleanup policy via dgrift - Allow dovecot_deliver to append to inherited log files - Lots of fixes for consolehelper- Fix up Xguest policy- Add vnstat policy - allow libvirt to send audit messages - Allow chrome-sandbox to search nfs_t- Update to upstream- Add the ability to send audit messages to confined admin policies - Remove permissive domain from cmirrord and dontaudit sys_tty_config - Split out unconfined_domain() calls from other unconfined_ calls so we can d - virt needs to be able to read processes to clearance for MLS- Allow all domains that can use cgroups to search tmpfs_t directory - Allow init to send audit messages- Update to upstream- Allow mdadm_t to create files and sock files in /dev/md/- Add policy for ajaxterm- Handle /var/db/sudo - Allow pulseaudio to read alsa config - Allow init to send initrc_t dbus messagesAllow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr intd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port- Merge upstream fix of mmap_zero - Allow mount to write files in debugfs_t - Allow corosync to communicate with clvmd via tmpfs - Allow certmaster to read usr_t files - Allow dbus system services to search cgroup_t - Define rlogind_t as a login pgm- Allow mdadm_t to read/write hugetlbfs- Dominic Grift Cleanup - Miroslav Grepl policy for jabberd - Various fixes for mount/livecd and prelink- Merge with upstream- More access needed for devicekit - Add dbadm policy- Merge with upstream- Allow seunshare to fowner- Allow cron to look at user_cron_spool links - Lots of fixes for mozilla_plugin_t - Add sysv file system - Turn unconfined domains to permissive to find additional avcs- Update policy for mozilla_plugin_t- Allow clamscan to read proc_t - Allow mount_t to write to debufs_t dir - Dontaudit mount_t trying to write to security_t dir- Allow clamscan_t execmem if clamd_use_jit set - Add policy for firefox plugin-container- Fix /root/.forward definition- label dead.letter as mail_home_t- Allow login programs to search /cgroups- Fix cert handling- Fix devicekit_power bug - Allow policykit_auth_t more access.- Fix nis calls to allow bind to ports 512-1024 - Fix smartmon- Allow pcscd to read sysfs - systemd fixes - Fix wine_mmap_zero_ignore boolean- Apply Miroslav munin patch - Turn back on allow_execmem and allow_execmod booleans- Merge in fixes from dgrift repository- Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0- New paths for upstart- New permissions for syslog - New labels for /lib/upstart- Add mojomojo policy- Allow systemd to setsockcon on sockets to immitate other services- Remove debugfs label- Update to latest policy- Fix eclipse labeling from IBMSupportAssasstant packageing- Make boot with systemd in enforcing mode- Update to upstream- Add boolean to turn off port forwarding in sshd.- Add support for ebtables - Fixes for rhcs and corosync policy-Update to upstream-Update to upstream-Update to upstream- Add Zarafa policy- Cleanup of aiccu policy - initial mock policy- Lots of random fixes- Update to upstream- Update to upstream - Allow prelink script to signal itself - Cobbler fixes- Add xdm_var_run_t to xserver_stream_connect_xdm - Add cmorrord and mpd policy from Miroslav Grepl- Fix sshd creation of krb cc files for users to be user_tmp_t- Fixes for accountsdialog - Fixes for boinc- Fix label on /var/lib/dokwiki - Change permissive domains to enforcing - Fix libvirt policy to allow it to run on mls- Update to upstream- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t - Fix /var/run/abrtd.lock label- Allow login programs to read krb5_home_t Resolves: 594833 - Add obsoletes for cachefilesfd-selinux package Resolves: #575084- Allow mount to r/w abrt fifo file - Allow svirt_t to getattr on hugetlbfs - Allow abrt to create a directory under /var/spool- Add labels for /sys - Allow sshd to getattr on shutdown - Fixes for munin - Allow sssd to use the kernel key ring - Allow tor to send syslog messages - Allow iptabels to read usr files - allow policykit to read all domains state- Fix path for /var/spool/abrt - Allow nfs_t as an entrypoint for http_sys_script_t - Add policy for piranha - Lots of fixes for sosreport- Allow xm_t to read network state and get and set capabilities - Allow policykit to getattr all processes - Allow denyhosts to connect to tcp port 9911 - Allow pyranha to use raw ip sockets and ptrace itself - Allow unconfined_execmem_t and gconfsd mechanism to dbus - Allow staff to kill ping process - Add additional MLS rules- Allow gdm to edit ~/.gconf dir Resolves: #590677 - Allow dovecot to create directories in /var/lib/dovecot Partially resolves 590224 - Allow avahi to dbus chat with NetworkManager - Fix cobbler labels - Dontaudit iceauth_t leaks - fix /var/lib/lxdm file context - Allow aiccu to use tun tap devices - Dontaudit shutdown using xserver.log- Fixes for sandbox_x_net_t to match access for sandbox_web_t ++ - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory - Add dontaudit interface for bluetooth dbus - Add chronyd_read_keys, append_keys for initrc_t - Add log support for ksmtuned Resolves: #586663- Allow boinc to send mail- Allow initrc_t to remove dhcpc_state_t - Fix label on sa-update.cron - Allow dhcpc to restart chrony initrc - Don't allow sandbox to send signals to its parent processes - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t Resolves: #589136- Fix location of oddjob_mkhomedir Resolves: #587385 - fix labeling on /root/.shosts and ~/.shosts - Allow ipsec_mgmt_t to manage net_conf_t Resolves: #586760- Dontaudit sandbox trying to connect to netlink sockets Resolves: #587609 - Add policy for piranha- Fixups for xguest policy - Fixes for running sandbox firefox- Allow ksmtuned to use terminals Resolves: #586663 - Allow lircd to write to generic usb devices- Allow sandbox_xserver to connectto unconfined stream Resolves: #585171- Allow initrc_t to read slapd_db_t Resolves: #585476 - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf Resolves: #585963- Allow rlogind_t to search /root for .rhosts Resolves: #582760 - Fix path for cached_var_t - Fix prelink paths /var/lib/prelink - Allow confined users to direct_dri - Allow mls lvm/cryptosetup to work- Allow virtd_t to manage firewall/iptables config Resolves: #573585- Fix label on /root/.rhosts Resolves: #582760 - Add labels for Picasa - Allow openvpn to read home certs - Allow plymouthd_t to use tty_device_t - Run ncftool as iptables_t - Allow mount to unmount unlabeled_t - Dontaudit hal leaks- Allow livecd to transition to mount- Update to upstream - Allow abrt to delete sosreport Resolves: #579998 - Allow snmp to setuid and gid Resolves: #582155 - Allow smartd to use generic scsi devices Resolves: #582145- Allow ipsec_t to create /etc/resolv.conf with the correct label - Fix reserved port destination - Allow autofs to transition to showmount - Stop crashing tuned- Add telepathysofiasip policy- Update to upstream - Fix label for /opt/google/chrome/chrome-sandbox - Allow modemmanager to dbus with policykit- Fix allow_httpd_mod_auth_pam to use auth_use_pam(httpd_t) - Allow accountsd to read shadow file - Allow apache to send audit messages when using pam - Allow asterisk to bind and connect to sip tcp ports - Fixes for dovecot 2.0 - Allow initrc_t to setattr on milter directories - Add procmail_home_t for .procmailrc file- Fixes for labels during install from livecd- Fix /cgroup file context - Fix broken afs use of unlabled_t - Allow getty to use the console for s390- Fix cgroup handling adding policy for /cgroup - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set- Merge patches from dgrift- Update upstream - Allow abrt to write to the /proc under any process- Fix ~/.fontconfig label - Add /root/.cert label - Allow reading of the fixed_file_disk_t:lnk_file if you can read file - Allow qemu_exec_t as an entrypoint to svirt_t- Update to upstream - Allow tmpreaper to delete sandbox sock files - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems - Fixes for gitosis - No transition on livecd to passwd or chfn - Fixes for denyhosts- Add label for /var/lib/upower - Allow logrotate to run sssd - dontaudit readahead on tmpfs blk files - Allow tmpreaper to setattr on sandbox files - Allow confined users to execute dos files - Allow sysadm_t to kill processes running within its clearance - Add accountsd policy - Fixes for corosync policy - Fixes from crontab policy - Allow svirt to manage svirt_image_t chr files - Fixes for qdisk policy - Fixes for sssd policy - Fixes for newrole policy- make libvirt work on an MLS platform- Add qpidd policy- Update to upstream- Allow boinc to read kernel sysctl - Fix snmp port definitions - Allow apache to read anon_inodefs- Allow shutdown dac_override- Add device_t as a file system - Fix sysfs association- Dontaudit ipsec_mgmt sys_ptrace - Allow at to mail its spool files - Allow nsplugin to search in .pulse directory- Update to upstream- Allow users to dbus chat with xdm - Allow users to r/w wireless_device_t - Dontaudit reading of process states by ipsec_mgmt- Fix openoffice from unconfined_t- Add shutdown policy so consolekit can shutdown system- Update to upstream- Update to upstream- Update to upstream - These are merges of my patches - Remove 389 labeling conflicts - Add MLS fixes found in RHEL6 testing - Allow pulseaudio to run as a service - Add label for mssql and allow apache to connect to this database port if boolean set - Dontaudit searches of debugfs mount point - Allow policykit_auth to send signals to itself - Allow modcluster to call getpwnam - Allow swat to signal winbind - Allow usbmux to run as a system role - Allow svirt to create and use devpts- Add MLS fixes found in RHEL6 testing - Allow domains to append to rpm_tmp_t - Add cachefilesfd policy - Dontaudit leaks when transitioning- Change allow_execstack and allow_execmem booleans to on - dontaudit acct using console - Add label for fping - Allow tmpreaper to delete sandbox_file_t - Fix wine dontaudit mmap_zero - Allow abrt to read var_t symlinks- Additional policy for rgmanager- Allow sshd to setattr on pseudo terms- Update to upstream- Allow policykit to send itself signals- Fix duplicate cobbler definition- Fix file context of /var/lib/avahi-autoipd- Merge with upstream- Allow sandbox to work with MLS- Make Chrome work with staff user- Add icecast policy - Cleanup spec file- Add mcelog policy- Lots of fixes found in F12- Fix rpm_dontaudit_leaks- Add getsched to hald_t - Add file context for Fedora/Redhat Directory Server- Allow abrt_helper to getattr on all filesystems - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so- Add gstreamer_home_t for ~/.gstreamer- Update to upstream- Fix git- Turn on puppet policy - Update to dgrift git policy- Move users file to selection by spec file. - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t- Update to upstream- Remove most of the permissive domains from F12.- Add cobbler policy from dgrift- add usbmon device - Add allow rulse for devicekit_disk- Lots of fixes found in F12, fixes from Tom London- Cleanups from dgrift- Add back xserver_manage_home_fonts- Dontaudit sandbox trying to read nscd and sssd- Update to upstream- Rename udisks-daemon back to devicekit_disk_t policy- Fixes for abrt calls- Add tgtd policy- Update to upstream release- Add asterisk policy back in - Update to upstream release 2.20091117- Update to upstream release 2.20091117- Fixup nut policy- Update to upstream- Allow vpnc request the kernel to load modules- Fix minimum policy installs - Allow udev and rpcbind to request the kernel to load modules- Add plymouth policy - Allow local_login to sys_admin- Allow cupsd_config to read user tmp - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t- Update rhcs policy- Allow users to exec restorecond- Allow sendmail to request kernel modules load- Fix all kernel_request_load_module domains- Fix all kernel_request_load_module domains- Remove allow_exec* booleans for confined users. Only available for unconfined_t- More fixes for sandbox_web_t- Allow sshd to create .ssh directory and content- Fix request_module line to module_request- Fix sandbox policy to allow it to run under firefox. - Dont audit leaks.- Fixes for sandbox- Update to upstream - Dontaudit nsplugin search /root - Dontaudit nsplugin sys_nice- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service - Remove policycoreutils-python requirement except for minimum- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)- Add wordpress/wp-content/uploads label - Fixes for sandbox when run from staff_t- Update to upstream - Fixes for devicekit_disk- More fixes- Lots of fixes for initrc and other unconfined domains- Allow xserver to use netlink_kobject_uevent_socket- Fixes for sandbox- Dontaudit setroubleshootfix looking at /root directory- Update to upsteam- Allow gssd to send signals to users - Fix duplicate label for apache content- Update to upstream- Remove polkit_auth on upgrades- Add back in unconfined.pp and unconfineduser.pp - Add Sandbox unshare- Fixes for cdrecord, mdadm, and others- Add capability setting to dhcpc and gpm- Allow cronjobs to read exim_spool_t- Add ABRT policy- Fix system-config-services policy- Allow libvirt to change user componant of virt_domain- Allow cupsd_config_t to be started by dbus - Add smoltclient policy- Add policycoreutils-python to pre install- Make all unconfined_domains permissive so we can see what AVC's happen- Add pt_chown policy- Add kdump policy for Miroslav Grepl - Turn off execstack boolean- Turn on execstack on a temporary basis (#512845)- Allow nsplugin to connecto the session bus - Allow samba_net to write to coolkey data- Allow devicekit_disk to list inotify- Allow svirt images to create sock_file in svirt_var_run_t- Allow exim to getattr on mountpoints - Fixes for pulseaudio- Allow svirt_t to stream_connect to virtd_t- Allod hald_dccm_t to create sock_files in /tmp- More fixes from upstream- Fix polkit label - Remove hidebrokensymptoms for nss_ldap fix - Add modemmanager policy - Lots of merges from upstream - Begin removing textrel_shlib_t labels, from fixed libraries- Update to upstream- Allow certmaster to override dac permissions- Update to upstream- Fix context for VirtualBox- Update to upstream- Allow clamscan read amavis spool files- Fixes for xguest- fix multiple directory ownership of mandirs- Update to upstream- Add rules for rtkit-daemon- Update to upstream - Fix nlscd_stream_connect- Add rtkit policy- Allow rpcd_t to stream connect to rpcbind- Allow kpropd to create tmp files- Fix last duplicate /var/log/rpmpkgs- Update to upstream * add sssd- Update to upstream * cleanup- Update to upstream - Additional mail ports - Add virt_use_usb boolean for svirt- Fix mcs rules to include chr_file and blk_file- Add label for udev-acl- Additional rules for consolekit/udev, privoxy and various other fixes- New version for upstream- Allow NetworkManager to read inotifyfs- Allow setroubleshoot to run mlocate- Update to upstream- Add fish as a shell - Allow fprintd to list usbfs_t - Allow consolekit to search mountpoints - Add proper labeling for shorewall- New log file for vmware - Allow xdm to setattr on user_tmp_t- Upgrade to upstream- Allow fprintd to access sys_ptrace - Add sandbox policy- Add varnishd policy- Fixes for kpropd- Allow brctl to r/w tun_tap_device_t- Add /usr/share/selinux/packages- Allow rpcd_t to send signals to kernel threads- Fix upgrade for F10 to F11- Add policy for /var/lib/fprint-Remove duplicate line- Allow svirt to manage pci and other sysfs device data- Fix package selection handling- Fix /sbin/ip6tables-save context - Allod udev to transition to mount - Fix loading of mls policy file- Add shorewall policy- Additional rules for fprintd and sssd- Allow nsplugin to unix_read unix_write sem for unconfined_java- Fix uml files to be owned by users- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less- Allow confined users to manage virt_content_t, since this is home dir content - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection- Fix labeling on /var/lib/misc/prelink* - Allow xserver to rw_shm_perms with all x_clients - Allow prelink to execute files in the users home directory- Allow initrc_t to delete dev_null - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead- Update to latest milter code from Paul Howarth- Additional perms for readahead- Allow pulseaudio to acquire_svc on session bus - Fix readahead labeling- Allow sysadm_t to run rpm directly - libvirt needs fowner- Allow sshd to read var_lib symlinks for freenx- Allow nsplugin unix_read and write on users shm and sem - Allow sysadm_t to execute su- Dontaudit attempts to getattr user_tmpfs_t by lvm - Allow nfs to share removable media- Add ability to run postdrop from confined users- Fixes for podsleuth- Turn off nsplugin transition - Remove Konsole leaked file descriptors for release- Allow cupsd_t to create link files in print_spool_t - Fix iscsi_stream_connect typo - Fix labeling on /etc/acpi/actions - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed- Allow audioentroy to read etc files- Add fail2ban_var_lib_t - Fixes for devicekit_power_t- Separate out the ucnonfined user from the unconfined.pp package- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.- Upgrade to latest upstream - Allow devicekit_disk sys_rawio- Dontaudit binds to ports < 1024 for named - Upgrade to latest upstream- Allow podsleuth to use tmpfs files- Add customizable_types for svirt- Allow setroubelshoot exec* privs to prevent crash from bad libraries - add cpufreqselector- Dontaudit listing of /root directory for cron system jobs- Fix missing ld.so.cache label- Add label for ~/.forward and /root/.forward- Fixes for svirt- Fixes to allow svirt read iso files in homedir- Add xenner and wine fixes from mgrepl- Allow mdadm to read/write mls override- Change to svirt to only access svirt_image_t- Fix libvirt policy- Upgrade to latest upstream- Fixes for iscsid and sssd - More cleanups for upgrade from F10 to Rawhide.- Add pulseaudio, sssd policy - Allow networkmanager to exec udevadm- Add pulseaudio context- Upgrade to latest patches- Fixes for libvirt- Update to Latest upstream- Fix setrans.conf to show SystemLow for s0- Further confinement of qemu images via svirt- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild- Allow NetworkManager to manage /etc/NetworkManager/system-connections- add virtual_image_context and virtual_domain_context files- Allow rpcd_t to send signal to mount_t - Allow libvirtd to run ranged- Fix sysnet/net_conf_t- Fix squidGuard labeling- Re-add corenet_in_generic_if(unlabeled_t)* Tue Feb 10 2009 Dan Walsh 3.6.5-2 - Add git web policy- Add setrans contains from upstream- Do transitions outside of the booleans- Allow xdm to create user_tmp_t sockets for switch user to work- Fix staff_t domain- Grab remainder of network_peer_controls patch- More fixes for devicekit- Upgrade to latest upstream- Add boolean to disallow unconfined_t login- Add back transition from xguest to mozilla- Add virt_content_ro_t and labeling for isos directory- Fixes for wicd daemon- More mls/rpm fixes- Add policy to make dbus/nm-applet work- Remove polgen-ifgen from post and add trigger to policycoreutils-python- Add wm policy - Make mls work in graphics mode- Fixed for DeviceKit- Add devicekit policy- Update to upstream- Define openoffice as an x_domain- Fixes for reading xserver_tmp_t- Allow cups_pdf_t write to nfs_t- Remove audio_entropy policy- Update to upstream- Allow hal_acl_t to getattr/setattr fixed_disk- Change userdom_read_all_users_state to include reading symbolic links in /proc- Fix dbus reading /proc information- Add missing alias for home directory content- Fixes for IBM java location- Allow unconfined_r unconfined_java_t- Add cron_role back to user domains- Fix sudo setting of user keys- Allow iptables to talk to terminals - Fixes for policy kit - lots of fixes for booting.- Cleanup policy- Rebuild for Python 2.6- Fix labeling on /var/spool/rsyslog- Allow postgresl to bind to udp nodes- Allow lvm to dbus chat with hal - Allow rlogind to read nfs_t- Fix cyphesis file context- Allow hal/pm-utils to look at /var/run/video.rom - Add ulogd policy- Additional fixes for cyphesis - Fix certmaster file context - Add policy for system-config-samba - Allow hal to read /var/run/video.rom- Allow dhcpc to restart ypbind - Fixup labeling in /var/run- Add certmaster policy- Fix confined users - Allow xguest to read/write xguest_dbusd_t- Allow openoffice execstack/execmem privs- Allow mozilla to run with unconfined_execmem_t- Dontaudit domains trying to write to .xsession-errors- Allow nsplugin to look at autofs_t directory- Allow kerneloops to create tmp files- More alias for fastcgi- Remove mod_fcgid-selinux package- Fix dovecot access- Policy cleanup- Remove Multiple spec - Add include - Fix makefile to not call per_role_expansion- Fix labeling of libGL- Update to upstream- Update to upstream policy- Fixes for confined xwindows and xdm_t- Allow confined users and xdm to exec wm - Allow nsplugin to talk to fifo files on nfs- Allow NetworkManager to transition to avahi and iptables - Allow domains to search other domains keys, coverup kernel bug- Fix labeling for oracle- Allow nsplugin to comminicate with xdm_tmp_t sock_file- Change all user tmpfs_t files to be labeled user_tmpfs_t - Allow radiusd to create sock_files- Upgrade to upstream- Allow confined users to login with dbus- Fix transition to nsplugin- Add file context for /dev/mspblk.*- Fix transition to nsplugin '- Fix labeling on new pm*log - Allow ssh to bind to all nodes- Merge upstream changes - Add Xavier Toth patches- Add qemu_cache_t for /var/cache/libvirt- Remove gamin policy- Add tinyxs-max file system support- Update to upstream - New handling of init scripts- Allow pcsd to dbus - Add memcache policy- Allow audit dispatcher to kill his children- Update to upstream - Fix crontab use by unconfined user- Allow ifconfig_t to read dhcpc_state_t- Update to upstream- Update to upstream- Allow system-config-selinux to work with policykit- Fix novel labeling- Consolodate pyzor,spamassassin, razor into one security domain - Fix xdm requiring additional perms.- Fixes for logrotate, alsa- Eliminate vbetool duplicate entry- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t - Change dhclient to be able to red networkmanager_var_run- Update to latest refpolicy - Fix libsemanage initial install bug- Add inotify support to nscd- Allow unconfined_t to setfcap- Allow amanda to read tape - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi - Add support for netware file systems- Allow ypbind apps to net_bind_service- Allow all system domains and application domains to append to any log file- Allow gdm to read rpm database - Allow nsplugin to read mplayer config files- Allow vpnc to run ifconfig- Allow confined users to use postgres - Allow system_mail_t to exec other mail clients - Label mogrel_rails as an apache server- Apply unconfined_execmem_exec_t to haskell programs- Fix prelude file context- allow hplip to talk dbus - Fix context on ~/.local dir- Prevent applications from reading x_device- Add /var/lib/selinux context- Update to upstream- Add livecd policy- Dontaudit search of admin_home for init_system_domain - Rewrite of xace interfaces - Lots of new fs_list_inotify - Allow livecd to transition to setfiles_mac- Begin XAce integration- Merge Upstream- Allow amanada to create data files- Fix initial install, semanage setup- Allow system_r for httpd_unconfined_script_t- Remove dmesg boolean - Allow user domains to read/write game data- Change unconfined_t to transition to unconfined_mono_t when running mono - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work- Remove old booleans from targeted-booleans.conf file- Add boolean to mmap_zero - allow tor setgid - Allow gnomeclock to set clock- Don't run crontab from unconfined_t- Change etc files to config files to allow users to read them- Lots of fixes for confined domains on NFS_t homedir- dontaudit mrtg reading /proc - Allow iscsi to signal itself - Allow gnomeclock sys_ptrace- Allow dhcpd to read kernel network state- Label /var/run/gdm correctly - Fix unconfined_u user creation- Allow transition from initrc_t to getty_t- Allow passwd to communicate with user sockets to change gnome-keyring- Fix initial install- Allow radvd to use fifo_file - dontaudit setfiles reading links - allow semanage sys_resource - add allow_httpd_mod_auth_ntlm_winbind boolean - Allow privhome apps including dovecot read on nfs and cifs home dirs if the boolean is set- Allow nsplugin to read /etc/mozpluggerrc, user_fonts - Allow syslog to manage innd logs. - Allow procmail to ioctl spamd_exec_t- Allow initrc_t to dbus chat with consolekit.- Additional access for nsplugin - Allow xdm setcap/getcap until pulseaudio is fixed- Allow mount to mkdir on tmpfs - Allow ifconfig to search debugfs- Fix file context for MATLAB - Fixes for xace- Allow stunnel to transition to inetd children domains - Make unconfined_dbusd_t an unconfined domain- Fixes for qemu/virtd- Fix bug in mozilla policy to allow xguest transition - This will fix the libsemanage.dbase_llist_query: could not find record value libsemanage.dbase_llist_query: could not query record value (No such file or directory) bug in xguest- Allow nsplugin to run acroread- Add cups_pdf policy - Add openoffice policy to run in xguest- prewika needs to contact mysql - Allow syslog to read system_map files- Change init_t to an unconfined_domain- Allow init to transition to initrc_t on shell exec. - Fix init to be able to sendto init_t. - Allow syslog to connect to mysql - Allow lvm to manage its own fifo_files - Allow bugzilla to use ldap - More mls fixes- fixes for init policy (#436988) - fix build- Additional changes for MLS policy- Fix initrc_context generation for MLS- Fixes for libvirt- Allow bitlebee to read locale_t- More xselinux rules- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t- Prepare policy for beta release - Change some of the system domains back to unconfined - Turn on some of the booleans- Allow nsplugin_config execstack/execmem - Allow nsplugin_t to read alsa config - Change apache to use user content- Add cyphesis policy- Fix Makefile.devel to build mls modules - Fix qemu to be more specific on labeling- Update to upstream fixes- Allow staff to mounton user_home_t- Add xace support- Add fusectl file system- Fixes from yum-cron - Update to latest upstream- Fix userdom_list_user_files- Merge with upstream- Allow udev to send audit messages- Add additional login users interfaces - userdom_admin_login_user_template(staff)- More fixes for polkit- Eliminate transition from unconfined_t to qemu by default - Fixes for gpg- Update to upstream- Fixes for staff_t- Add policy for kerneloops - Add policy for gnomeclock- Fixes for libvirt- Fixes for nsplugin- More fixes for qemu- Additional ports for vnc and allow qemu and libvirt to search all directories- Update to upstream - Add libvirt policy - add qemu policy- Allow fail2ban to create a socket in /var/run- Allow allow_httpd_mod_auth_pam to work- Add audisp policy and prelude- Allow all user roles to executae samba net command- Allow usertypes to read/write noxattr file systems- Fix nsplugin to allow flashplugin to work in enforcing mode- Allow pam_selinux_permit to kill all processes- Allow ptrace or user processes by users of same type - Add boolean for transition to nsplugin- Allow nsplugin sys_nice, getsched, setsched- Allow login programs to talk dbus to oddjob- Add procmail_log support - Lots of fixes for munin- Allow setroubleshoot to read policy config and send audit messages- Allow users to execute all files in homedir, if boolean set - Allow mount to read samba config- Fixes for xguest to run java plugin- dontaudit pam_t and dbusd writing to user_home_t- Update gpg to allow reading of inotify- Change user and staff roles to work correctly with varied perms- Fix munin log, - Eliminate duplicate mozilla file context - fix wpa_supplicant spec- Fix role transition from unconfined_r to system_r when running rpm - Allow unconfined_domains to communicate with user dbus instances- Fixes for xguest- Let all uncofined domains communicate with dbus unconfined- Run rpm in system_r- Zero out customizable types- Fix definiton of admin_home_t- Fix munin file context- Allow cron to run unconfined apps- Modify default login to unconfined_u- Dontaudit dbus user client search of /root- Update to upstream- Fixes for polkit - Allow xserver to ptrace- Add polkit policy - Symplify userdom context, remove automatic per_role changes- Update to upstream - Allow httpd_sys_script_t to search users homedirs- Allow rpm_script to transition to unconfined_execmem_t- Remove user based home directory separation- Remove user specific crond_t- Merge with upstream - Allow xsever to read hwdata_t - Allow login programs to setkeycreate- Update to upstream- Update to upstream- Allow XServer to read /proc/self/cmdline - Fix unconfined cron jobs - Allow fetchmail to transition to procmail - Fixes for hald_mac - Allow system_mail to transition to exim - Allow tftpd to upload files - Allow xdm to manage unconfined_tmp - Allow udef to read alsa config - Fix xguest to be able to connect to sound port- Fixes for hald_mac - Treat unconfined_home_dir_t as a home dir - dontaudit rhgb writes to fonts and root- Fix dnsmasq - Allow rshd full login privs- Allow rshd to connect to ports > 1023- Fix vpn to bind to port 4500 - Allow ssh to create shm - Add Kismet policy- Allow rpm to chat with networkmanager- Fixes for ipsec and exim mail - Change default to unconfined user- Pass the UNK_PERMS param to makefile - Fix gdm location- Make alsa work- Fixes for consolekit and startx sessions- Dontaudit consoletype talking to unconfined_t- Remove homedir_template- Check asound.state- Fix exim policy- Allow tmpreadper to read man_t - Allow racoon to bind to all nodes - Fixes for finger print reader- Allow xdm to talk to input device (fingerprint reader) - Allow octave to run as java- Allow login programs to set ioctl on /proc- Allow nsswitch apps to read samba_var_t- Fix maxima- Eliminate rpm_t:fifo_file avcs - Fix dbus path for helper app- Fix service start stop terminal avc's- Allow also to search var_lib - New context for dbus launcher- Allow cupsd_config_t to read/write usb_device_t - Support for finger print reader, - Many fixes for clvmd - dbus starting networkmanager- Fix java and mono to run in xguest account- Fix to add xguest account when inititial install - Allow mono, java, wine to run in userdomains- Allow xserver to search devpts_t - Dontaudit ldconfig output to homedir- Remove hplip_etc_t change back to etc_t.- Allow cron to search nfs and samba homedirs- Allow NetworkManager to dbus chat with yum-updated- Allow xfs to bind to port 7100- Allow newalias/sendmail dac_override - Allow bind to bind to all udp ports- Turn off direct transition- Allow wine to run in system role- Fix java labeling- Define user_home_type as home_type- Allow sendmail to create etc_aliases_t- Allow login programs to read symlinks on homedirs- Update an readd modules- Cleanup spec file- Allow xserver to be started by unconfined process and talk to tty- Upgrade to upstream to grab postgressql changes- Add setransd for mls policy- Add ldconfig_cache_t- Allow sshd to write to proc_t for afs login- Allow xserver access to urand- allow dovecot to search mountpoints- Fix Makefile for building policy modules- Fix dhcpc startup of service- Fix dbus chat to not happen for xguest and guest users- Fix nagios cgi - allow squid to communicate with winbind- Fixes for ldconfig- Update from upstream- Add nasd support- Fix new usb devices and dmfm- Eliminate mount_ntfs_t policy, merge into mount_t- Allow xserver to write to ramfs mounted by rhgb- Add context for dbus machine id- Update with latest changes from upstream- Fix prelink to handle execmod- Add ntpd_key_t to handle secret data- Add anon_inodefs - Allow unpriv user exec pam_exec_t - Fix trigger- Allow cups to use generic usb - fix inetd to be able to run random apps (git)- Add proper contexts for rsyslogd- Fixes for xguest policy- Allow execution of gconf- Fix moilscanner update problem- Begin adding policy to separate setsebool from semanage - Fix xserver.if definition to not break sepolgen.if- Add new devices- Add brctl policy- Fix root login to include system_r- Allow prelink to read kernel sysctls- Default to user_u:system_r:unconfined_t- fix squid - Fix rpm running as uid- Fix syslog declaration- Allow avahi to access inotify - Remove a lot of bogus security_t:filesystem avcs- Remove ifdef strict policy from upstream- Remove ifdef strict to allow user_u to login- Fix for amands - Allow semanage to read pp files - Allow rhgb to read xdm_xserver_tmp- Allow kerberos servers to use ldap for backing store- allow alsactl to read kernel state- More fixes for alsactl - Transition from hal and modutils - Fixes for suspend resume. - insmod domtrans to alsactl - insmod writes to hal log- Allow unconfined_t to transition to NetworkManager_t - Fix netlabel policy- Update to latest from upstream- Update to latest from upstream- Update to latest from upstream- Allow pcscd_t to send itself signals- Fixes for unix_update - Fix logwatch to be able to search all dirs- Upstream bumped the version- Allow consolekit to syslog - Allow ntfs to work with hal- Allow iptables to read etc_runtime_t- MLS Fixes- Fix path of /etc/lvm/cache directory - Fixes for alsactl and pppd_t - Fixes for consolekit- Allow insmod_t to mount kvmfs_t filesystems- Rwho policy - Fixes for consolekit- fixes for fusefs- Fix samba_net to allow it to view samba_var_t- Update to upstream- Fix Sonypic backlight - Allow snmp to look at squid_conf_t- Fixes for pyzor, cyrus, consoletype on everything installs- Fix hald_acl_t to be able to getattr/setattr on usb devices - Dontaudit write to unconfined_pipes for load_policy- Allow bluetooth to read inotifyfs- Fixes for samba domain controller. - Allow ConsoleKit to look at ttys- Fix interface call- Allow syslog-ng to read /var - Allow locate to getattr on all filesystems - nscd needs setcap- Update to upstream- Allow samba to run groupadd- Update to upstream- Allow mdadm to access generic scsi devices- Fix labeling on udev.tbl dirs- Fixes for logwatch- Add fusermount and mount_ntfs policy- Update to upstream - Allow saslauthd to use kerberos keytabs- Fixes for samba_var_t- Allow networkmanager to setpgid - Fixes for hal_acl_t- Remove disable_trans booleans - hald_acl_t needs to talk to nscd- Fix prelink to be able to manage usr dirs.- Allow insmod to launch init scripts- Remove setsebool policy- Fix handling of unlabled_t packets- More of my patches from upstream- Update to latest from upstream - Add fail2ban policy- Update to remove security_t:filesystem getattr problems- Policy for consolekit- Update to latest from upstream- Revert Nemiver change - Set sudo as a corecmd so prelink will work, remove sudoedit mapping, since this will not work, it does not transition. - Allow samba to execute useradd- Upgrade to the latest from upstream- Add sepolgen support - Add bugzilla policy- Fix file context for nemiver- Remove include sym link- Allow mozilla, evolution and thunderbird to read dev_random. Resolves: #227002 - Allow spamd to connect to smtp port Resolves: #227184 - Fixes to make ypxfr work Resolves: #227237- Fix ssh_agent to be marked as an executable - Allow Hal to rw sound device- Fix spamassisin so crond can update spam files - Fixes to allow kpasswd to work - Fixes for bluetooth- Remove some targeted diffs in file context file- Fix squid cachemgr labeling- Add ability to generate webadm_t policy - Lots of new interfaces for httpd - Allow sshd to login as unconfined_t- Continue fixing, additional user domains- Begin adding user confinement to targeted policy- Fixes for prelink, ktalkd, netlabel- Allow prelink when run from rpm to create tmp files Resolves: #221865 - Remove file_context for exportfs Resolves: #221181 - Allow spamassassin to create ~/.spamassissin Resolves: #203290 - Allow ssh access to the krb tickets - Allow sshd to change passwd - Stop newrole -l from working on non securetty Resolves: #200110 - Fixes to run prelink in MLS machine Resolves: #221233 - Allow spamassassin to read var_lib_t dir Resolves: #219234- fix mplayer to work under strict policy - Allow iptables to use nscd Resolves: #220794- Add gconf policy and make it work with strict- Many fixes for strict policy and by extension mls.- Fix to allow ftp to bind to ports > 1024 Resolves: #219349- Allow semanage to exec it self. Label genhomedircon as semanage_exec_t Resolves: #219421 - Allow sysadm_lpr_t to manage other print spool jobs Resolves: #220080- allow automount to setgid Resolves: #219999- Allow cron to polyinstatiate - Fix creation of boot flags Resolves: #207433- Fixes for irqbalance Resolves: #219606- Fix vixie-cron to work on mls Resolves: #207433Resolves: #218978- Allow initrc to create files in /var directories Resolves: #219227- More fixes for MLS Resolves: #181566- More Fixes polyinstatiation Resolves: #216184- More Fixes polyinstatiation - Fix handling of keyrings Resolves: #216184- Fix polyinstatiation - Fix pcscd handling of terminal Resolves: #218149 Resolves: #218350- More fixes for quota Resolves: #212957- ncsd needs to use avahi sockets Resolves: #217640 Resolves: #218014- Allow login programs to polyinstatiate homedirs Resolves: #216184 - Allow quotacheck to create database files Resolves: #212957- Dontaudit appending hal_var_lib files Resolves: #217452 Resolves: #217571 Resolves: #217611 Resolves: #217640 Resolves: #217725- Fix context for helix players file_context #216942- Fix load_policy to be able to mls_write_down so it can talk to the terminal- Fixes for hwclock, clamav, ftp- Move to upstream version which accepted my patches- Fixes for nvidia driver- Allow semanage to signal mcstrans- Update to upstream- Allow modstorage to edit /etc/fstab file- Fix for qemu, /dev/- Fix path to realplayer.bin- Allow xen to connect to xen port- Allow cups to search samba_etc_t directory - Allow xend_t to list auto_mountpoints- Allow xen to search automount- Fix spec of jre files- Fix unconfined access to shadow file- Allow xend to create files in xen_image_t directories- Fixes for /var/lib/hal- Remove ability for sysadm_t to look at audit.log- Fix rpc_port_types - Add aide policy for mls- Merge with upstream- Lots of fixes for ricci- Allow xen to read/write fixed devices with a boolean - Allow apache to search /var/log- Fix policygentool specfile problem. - Allow apache to send signals to it's logging helpers. - Resolves: rhbz#212731- Add perms for swat- Add perms for swat- Allow daemons to dump core files to /- Fixes for ricci- Allow mount.nfs to work- Allow ricci-modstorage to look at lvm_etc_t- Fixes for ricci using saslauthd- Allow mountpoint on home_dir_t and home_t- Update xen to read nfs files- Allow noxattrfs to associate with other noxattrfs- Allow hal to use power_device_t- Allow procemail to look at autofs_t - Allow xen_image_t to work as a fixed device- Refupdate from upstream- Add lots of fixes for mls cups- Lots of fixes for ricci- Fix number of cats- Update to upstream- More iSCSI changes for #209854- Test ISCSI fixes for #209854- allow semodule to rmdir selinux_config_t dir- Fix boot_runtime_t problem on ppc. Should not be creating these files.- Fix context mounts on reboot - Fix ccs creation of directory in /var/log- Update for tallylog- Allow xend to rewrite dhcp conf files - Allow mgetty sys_admin capability- Make xentapctrl work- Don't transition unconfined_t to bootloader_t - Fix label in /dev/xen/blktap- Patch for labeled networking- Fix crond handling for mls- Update to upstream- Remove bluetooth-helper transition - Add selinux_validate for semanage - Require new version of libsemanage- Fix prelink- Fix rhgb- Fix setrans handling on MLS and useradd- Support for fuse - fix vigr- Fix dovecot, amanda - Fix mls- Allow java execheap for itanium- Update with upstream- mls fixes- Update from upstream- More fixes for mls - Revert change on automount transition to mount- Fix cron jobs to run under the correct context- Fixes to make pppd work- Multiple policy fixes - Change max categories to 1023- Fix transition on mcstransd- Add /dev/em8300 defs- Upgrade to upstream- Fix ppp connections from network manager- Add tty access to all domains boolean - Fix gnome-pty-helper context for ia64- Fixed typealias of firstboot_rw_t- Fix location of xel log files - Fix handling of sysadm_r -> rpm_exec_t- Fixes for autofs, lp- Update from upstream- Fixup for test6- Update to upstream- Update to upstream- Fix suspend to disk problems- Lots of fixes for restarting daemons at the console.- Fix audit line - Fix requires line- Upgrade to upstream- Fix install problems- Allow setroubleshoot to getattr on all dirs to gather RPM data- Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform - Fix spec for /dev/adsp- Fix xen tty devices- Fixes for setroubleshoot- Update to upstream- Fixes for stunnel and postgresql - Update from upstream- Update from upstream - More java fixes- Change allow_execstack to default to on, for RHEL5 Beta. This is required because of a Java compiler problem. Hope to turn off for next beta- Misc fixes- More fixes for strict policy- Quiet down anaconda audit messages- Fix setroubleshootd- Update to the latest from upstream- More fixes for xen- Fix anaconda transitions- yet more xen rules- more xen rules- Fixes for Samba- Fixes for xen- Allow setroubleshootd to send mail- Add nagios policy- fixes for setroubleshoot- Added Paul Howarth patch to only load policy packages shipped with this package - Allow pidof from initrc to ptrace higher level domains - Allow firstboot to communicate with hal via dbus- Add policy for /var/run/ldapi- Fix setroubleshoot policy- Fixes for mls use of ssh - named has a new conf file- Fixes to make setroubleshoot work- Cups needs to be able to read domain state off of printer client- add boolean to allow zebra to write config files- setroubleshootd fixes- Allow prelink to read bin_t symlink - allow xfs to read random devices - Change gfs to support xattr- Remove spamassassin_can_network boolean- Update to upstream - Fix lpr domain for mls- Add setroubleshoot policy- Turn off auditallow on setting booleans- Multiple fixes- Update to upstream- Update to upstream - Add new class for kernel key ring- Update to upstream- Update to upstream- Break out selinux-devel package- Add ibmasmfs- Fix policygentool gen_requires- Update from Upstream- Fix spec of realplay- Update to upstream- Fix semanage- Allow useradd to create_home_dir in MLS environment- Update from upstream- Update from upstream- Add oprofilefs- Fix for hplip and Picasus- Update to upstream- Update to upstream- fixes for spamd- fixes for java, openldap and webalizer- Xen fixes- Upgrade to upstream- allow hal to read boot_t files - Upgrade to upstream- allow hal to read boot_t files- Update from upstream- Fixes for amavis- Update from upstream- Allow auditctl to search all directories- Add acquire service for mono.- Turn off allow_execmem boolean - Allow ftp dac_override when allowed to access users homedirs- Clean up spec file - Transition from unconfined_t to prelink_t- Allow execution of cvs command- Update to upstream- Update to upstream- Fix libjvm spec- Update to upstream- Add xm policy - Fix policygentool- Update to upstream - Fix postun to only disable selinux on full removal of the packages- Allow mono to chat with unconfined- Allow procmail to sendmail - Allow nfs to share dosfs- Update to latest from upstream - Allow selinux-policy to be removed and kernel not to crash- Update to latest from upstream - Add James Antill patch for xen - Many fixes for pegasus- Add unconfined_mount_t - Allow privoxy to connect to httpd_cache - fix cups labeleing on /var/cache/cups- Update to latest from upstream- Update to latest from upstream - Allow mono and unconfined to talk to initrc_t dbus objects- Change libraries.fc to stop shlib_t form overriding texrel_shlib_t- Fix samba creating dirs in homedir - Fix NFS so its booleans would work- Allow secadm_t ability to relabel all files - Allow ftp to search xferlog_t directories - Allow mysql to communicate with ldap - Allow rsync to bind to rsync_port_t- Fixed mailman with Postfix #183928 - Allowed semanage to create file_context files. - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t to bind to reserved ports. #149030 - Don't allow devpts_t to be associated with tmp_t. - Allow hald_t to stat all mountpoints. - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts. - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of /etc/mtab. - Changed the file_contexts to not have a regex before the first ^/[a-z]/ whenever possible, makes restorecon slightly faster. - Correct the label of /etc/named.caching-nameserver.conf - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src hit by this. - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed xenstored_t rw access to the xen device node.- More textrel_shlib_t file path fixes - Add ada support- Get auditctl working in MLS policy- Add mono dbus support - Lots of file_context fixes for textrel_shlib_t in FC5 - Turn off execmem auditallow since they are filling log files- Update to upstream- Allow automount and dbus to read cert files- Fix ftp policy - Fix secadm running of auditctl- Update to upstream- Update to upstream- Fix policyhelp- Fix pam_console handling of usb_device - dontaudit logwatch reading /mnt dir- Update to upstream- Get transition rules to create policy.20 at SystemHigh- Allow secadmin to shutdown system - Allow sendmail to exec newalias- MLS Fixes dmidecode needs mls_file_read_up - add ypxfr_t - run init needs access to nscd - udev needs setuid - another xen log file - Dontaudit mount getattr proc_kcore_t- fix buildroot usage (#185391)- Get rid of mount/fsdisk scan of /dev messages - Additional fixes for suspend/resume- Fake make to rebuild enableaudit.pp- Get xen networking running.- Fixes for Xen - enableaudit should not be the same as base.pp - Allow ps to work for all process- more xen policy fixups- more xen fixage (#184393)- Fix blkid specification - Allow postfix to execute mailman_que- Blkid changes - Allow udev access to usb_device_t - Fix post script to create targeted policy config file- Allow lvm tools to create drevice dir- Add Xen support- Fixes for cups - Make cryptosetup work with hal- Load Policy needs translock- Fix cups html interface- Add hal changes suggested by Jeremy - add policyhelp to point at policy html pages- Additional fixes for nvidia and cups- Update to upstream - Merged my latest fixes - Fix cups policy to handle unix domain sockets- NSCD socket is in nscd_var_run_t needs to be able to search dir- Fixes Apache interface file- Fixes for new version of cups- Turn off polyinstatiate util after FC5- Fix problem with privoxy talking to Tor- Turn on polyinstatiation- Don't transition from unconfined_t to fsadm_t- Fix policy update model.- Update to upstream- Fix load_policy to work on MLS - Fix cron_rw_system_pipes for postfix_postdrop_t - Allow audotmount to run showmount- Fix swapon - allow httpd_sys_script_t to be entered via a shell - Allow httpd_sys_script_t to read eventpolfs- Update from upstream- allow cron to read apache files- Fix vpnc policy to work from NetworkManager- Update to upstream - Fix semoudle polcy- Update to upstream - fix sysconfig/selinux link- Add router port for zebra - Add imaze port for spamd - Fixes for amanda and java- Fix bluetooth handling of usb devices - Fix spamd reading of ~/ - fix nvidia spec- Update to upsteam- Add users_extra files- Update to upstream- Add semodule policy- Update from upstream- Fix for spamd to use razor port- Fixes for mcs - Turn on mount and fsadm for unconfined_t- Fixes for the -devel package- Fix for spamd to use ldap- Update to upstream- Update to upstream - Fix rhgb, and other Xorg startups- Update to upstream- Separate out role of secadm for mls- Add inotifyfs handling- Update to upstream - Put back in changes for pup/zen- Many changes for MLS - Turn on strict policy- Update to upstream- Update to upstream - Fixes for booting and logging in on MLS machine- Update to upstream - Turn off execheap execstack for unconfined users - Add mono/wine policy to allow execheap and execstack for them - Add execheap for Xdm policy- Update to upstream - Fixes to fetchmail,- Update to upstream- Fix for procmail/spamassasin - Update to upstream - Add rules to allow rpcd to work with unlabeled_networks.- Update to upstream - Fix ftp Man page- Update to upstream- fix pup transitions (#177262) - fix xen disks (#177599)- Update to upstream- More Fixes for hal and readahead- Fixes for hal and readahead- Update to upstream - Apply- Add wine and fix hal problems- Handle new location of hal scripts- Allow su to read /etc/mtab- Update to upstream- Fix "libsemanage.parse_module_headers: Data did not represent a module." problem- Allow load_policy to read /etc/mtab- Fix dovecot to allow dovecot_auth to look at /tmp- Allow restorecon to read unlabeled_t directories in order to fix labeling.- Add Logwatch policy- Fix /dev/ub[a-z] file context- Fix library specification - Give kudzu execmem privs- Fix hostname in targeted policy- Fix passwd command on mls- Lots of fixes to make mls policy work- Add dri libs to textrel_shlib_t - Add system_r role for java - Add unconfined_exec_t for vncserver - Allow slapd to use kerberos- Add man pages- Add enableaudit.pp- Fix mls policy- Update mls file from old version- Add sids back in - Rebuild with update checkpolicy- Fixes to allow automount to use portmap - Fixes to start kernel in s0-s15:c0.c255- Add java unconfined/execmem policy- Add file context for /var/cvs - Dontaudit webalizer search of homedir- Update from upstream- Clean up spec - range_transition crond to SystemHigh- Fixes for hal - Update to upstream- Turn back on execmem since we need it for java, firefox, ooffice - Allow gpm to stream socket to itself- fix requirements to be on the actual packages so that policy can get created properly at install time- Allow unconfined_t to execmod texrel_shlib_t- Update to upstream - Turn off allow_execmem and allow_execmod booleans - Add tcpd and automount policies- Add two new httpd booleans, turned off by default * httpd_can_network_relay * httpd_can_network_connect_db- Add ghost for policy.20- Update to upstream - Turn off boolean allow_execstack- Change setrans-mls to use new libsetrans - Add default_context rule for xdm- Change Requires to PreReg for requiring of policycoreutils on install- New upstream releaseAdd xdm policyUpdate from upstreamUpdate from upstreamUpdate from upstream- Also trigger to rebuild policy for versions up to 2.0.7.- No longer installing policy.20 file, anaconda handles the building of the app.- Fixes for dovecot and saslauthd- Cleanup pegasus and named - Fix spec file - Fix up passwd changing applications-Update to latest from upstream- Add rules for pegasus and avahi- Start building MLS Policy- Update to upstream- Turn on bash- Initial version  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~3.12.1-153.el7_0.11selinux-policyMakefile.exampleexample.fcexample.ifexample.tehtmladmin.htmladmin_bootloader.htmladmin_consoletype.htmladmin_dmesg.htmladmin_netutils.htmladmin_su.htmladmin_sudo.htmladmin_usermanage.htmlapps.htmlapps_seunshare.htmlbooleans.htmlcontrib.htmlcontrib_abrt.htmlcontrib_accountsd.htmlcontrib_acct.htmlcontrib_ada.htmlcontrib_afs.htmlcontrib_aiccu.htmlcontrib_aide.htmlcontrib_aisexec.htmlcontrib_ajaxterm.htmlcontrib_alsa.htmlcontrib_amanda.htmlcontrib_amavis.htmlcontrib_amtu.htmlcontrib_anaconda.htmlcontrib_antivirus.htmlcontrib_apache.htmlcontrib_apcupsd.htmlcontrib_apm.htmlcontrib_apt.htmlcontrib_arpwatch.htmlcontrib_asterisk.htmlcontrib_authbind.htmlcontrib_authconfig.htmlcontrib_automount.htmlcontrib_avahi.htmlcontrib_awstats.htmlcontrib_backup.htmlcontrib_bacula.htmlcontrib_bcfg2.htmlcontrib_bind.htmlcontrib_bird.htmlcontrib_bitlbee.htmlcontrib_blueman.htmlcontrib_bluetooth.htmlcontrib_boinc.htmlcontrib_brctl.htmlcontrib_bugzilla.htmlcontrib_bumblebee.htmlcontrib_cachefilesd.htmlcontrib_calamaris.htmlcontrib_callweaver.htmlcontrib_canna.htmlcontrib_ccs.htmlcontrib_cdrecord.htmlcontrib_certmaster.htmlcontrib_certmonger.htmlcontrib_certwatch.htmlcontrib_cfengine.htmlcontrib_cgroup.htmlcontrib_chrome.htmlcontrib_chronyd.htmlcontrib_cipe.htmlcontrib_clamav.htmlcontrib_clockspeed.htmlcontrib_clogd.htmlcontrib_cloudform.htmlcontrib_cmirrord.htmlcontrib_cobbler.htmlcontrib_collectd.htmlcontrib_colord.htmlcontrib_comsat.htmlcontrib_condor.htmlcontrib_conman.htmlcontrib_consolekit.htmlcontrib_corosync.htmlcontrib_couchdb.htmlcontrib_courier.htmlcontrib_cpucontrol.htmlcontrib_cpufreqselector.htmlcontrib_cron.htmlcontrib_ctdb.htmlcontrib_cups.htmlcontrib_cvs.htmlcontrib_cyphesis.htmlcontrib_cyrus.htmlcontrib_daemontools.htmlcontrib_dante.htmlcontrib_dbadm.htmlcontrib_dbskk.htmlcontrib_dbus.htmlcontrib_dcc.htmlcontrib_ddclient.htmlcontrib_ddcprobe.htmlcontrib_denyhosts.htmlcontrib_devicekit.htmlcontrib_dhcp.htmlcontrib_dictd.htmlcontrib_dirmngr.htmlcontrib_dirsrv-admin.htmlcontrib_dirsrv.htmlcontrib_distcc.htmlcontrib_djbdns.htmlcontrib_dkim.htmlcontrib_dmidecode.htmlcontrib_dnsmasq.htmlcontrib_dnssec.htmlcontrib_dnssectrigger.htmlcontrib_docker.htmlcontrib_dovecot.htmlcontrib_dpkg.htmlcontrib_drbd.htmlcontrib_dspam.htmlcontrib_entropyd.htmlcontrib_evolution.htmlcontrib_exim.htmlcontrib_fail2ban.htmlcontrib_fcoe.htmlcontrib_fetchmail.htmlcontrib_finger.htmlcontrib_firewalld.htmlcontrib_firewallgui.htmlcontrib_firstboot.htmlcontrib_fprintd.htmlcontrib_freeipmi.htmlcontrib_freqset.htmlcontrib_ftp.htmlcontrib_games.htmlcontrib_gatekeeper.htmlcontrib_gear.htmlcontrib_gift.htmlcontrib_git.htmlcontrib_gitosis.htmlcontrib_glance.htmlcontrib_glusterd.htmlcontrib_gnome.htmlcontrib_gnomeclock.htmlcontrib_gpg.htmlcontrib_gpm.htmlcontrib_gpsd.htmlcontrib_gssproxy.htmlcontrib_guest.htmlcontrib_hadoop.htmlcontrib_hal.htmlcontrib_hddtemp.htmlcontrib_howl.htmlcontrib_hypervkvp.htmlcontrib_i18n_input.htmlcontrib_icecast.htmlcontrib_ifplugd.htmlcontrib_imaze.htmlcontrib_inetd.htmlcontrib_inn.htmlcontrib_iodine.htmlcontrib_ipa.htmlcontrib_irc.htmlcontrib_ircd.htmlcontrib_irqbalance.htmlcontrib_iscsi.htmlcontrib_isns.htmlcontrib_jabber.htmlcontrib_java.htmlcontrib_jetty.htmlcontrib_jockey.htmlcontrib_journalctl.htmlcontrib_kde.htmlcontrib_kdump.htmlcontrib_kdumpgui.htmlcontrib_keepalived.htmlcontrib_kerberos.htmlcontrib_kerneloops.htmlcontrib_keyboardd.htmlcontrib_keystone.htmlcontrib_kismet.htmlcontrib_ksmtuned.htmlcontrib_ktalk.htmlcontrib_kudzu.htmlcontrib_l2tp.htmlcontrib_ldap.htmlcontrib_lightsquid.htmlcontrib_likewise.htmlcontrib_lircd.htmlcontrib_livecd.htmlcontrib_lldpad.htmlcontrib_loadkeys.htmlcontrib_lockdev.htmlcontrib_logrotate.htmlcontrib_logwatch.htmlcontrib_lpd.htmlcontrib_lsm.htmlcontrib_mailman.htmlcontrib_mailscanner.htmlcontrib_man2html.htmlcontrib_mandb.htmlcontrib_mcelog.htmlcontrib_mcollective.htmlcontrib_mediawiki.htmlcontrib_memcached.htmlcontrib_milter.htmlcontrib_mip6d.htmlcontrib_mirrormanager.htmlcontrib_mock.htmlcontrib_modemmanager.htmlcontrib_mojomojo.htmlcontrib_mongodb.htmlcontrib_mono.htmlcontrib_monop.htmlcontrib_motion.htmlcontrib_mozilla.htmlcontrib_mpd.htmlcontrib_mplayer.htmlcontrib_mrtg.htmlcontrib_mta.htmlcontrib_munin.htmlcontrib_mysql.htmlcontrib_mythtv.htmlcontrib_nagios.htmlcontrib_namespace.htmlcontrib_ncftool.htmlcontrib_nessus.htmlcontrib_networkmanager.htmlcontrib_ninfod.htmlcontrib_nis.htmlcontrib_nova.htmlcontrib_nscd.htmlcontrib_nsd.htmlcontrib_nslcd.htmlcontrib_nsplugin.htmlcontrib_ntop.htmlcontrib_ntp.htmlcontrib_numad.htmlcontrib_nut.htmlcontrib_nx.htmlcontrib_oav.htmlcontrib_obex.htmlcontrib_oddjob.htmlcontrib_oident.htmlcontrib_openca.htmlcontrib_openct.htmlcontrib_openhpi.htmlcontrib_openhpid.htmlcontrib_openshift-origin.htmlcontrib_openshift.htmlcontrib_opensm.htmlcontrib_openvpn.htmlcontrib_openvswitch.htmlcontrib_openwsman.htmlcontrib_oracleasm.htmlcontrib_osad.htmlcontrib_pacemaker.htmlcontrib_pads.htmlcontrib_passenger.htmlcontrib_pcmcia.htmlcontrib_pcp.htmlcontrib_pcscd.htmlcontrib_pegasus.htmlcontrib_perdition.htmlcontrib_pesign.htmlcontrib_pingd.htmlcontrib_piranha.htmlcontrib_pkcsslotd.htmlcontrib_pki.htmlcontrib_plymouthd.htmlcontrib_podsleuth.htmlcontrib_policykit.htmlcontrib_polipo.htmlcontrib_portage.htmlcontrib_portmap.htmlcontrib_portreserve.htmlcontrib_portslave.htmlcontrib_postfix.htmlcontrib_postfixpolicyd.htmlcontrib_postgrey.htmlcontrib_ppp.htmlcontrib_prelink.htmlcontrib_prelude.htmlcontrib_privoxy.htmlcontrib_procmail.htmlcontrib_prosody.htmlcontrib_psad.htmlcontrib_ptchown.htmlcontrib_publicfile.htmlcontrib_pulseaudio.htmlcontrib_puppet.htmlcontrib_pwauth.htmlcontrib_pxe.htmlcontrib_pyzor.htmlcontrib_qemu.htmlcontrib_qmail.htmlcontrib_qpid.htmlcontrib_quantum.htmlcontrib_quota.htmlcontrib_rabbitmq.htmlcontrib_radius.htmlcontrib_radvd.htmlcontrib_raid.htmlcontrib_rasdaemon.htmlcontrib_razor.htmlcontrib_rdisc.htmlcontrib_readahead.htmlcontrib_realmd.htmlcontrib_redis.htmlcontrib_remotelogin.htmlcontrib_resmgr.htmlcontrib_rgmanager.htmlcontrib_rhcs.htmlcontrib_rhev.htmlcontrib_rhgb.htmlcontrib_rhnsd.htmlcontrib_rhsmcertd.htmlcontrib_ricci.htmlcontrib_rkhunter.htmlcontrib_rlogin.htmlcontrib_rngd.htmlcontrib_roundup.htmlcontrib_rpc.htmlcontrib_rpcbind.htmlcontrib_rpm.htmlcontrib_rshd.htmlcontrib_rssh.htmlcontrib_rsync.htmlcontrib_rtas.htmlcontrib_rtkit.htmlcontrib_rwho.htmlcontrib_samba.htmlcontrib_sambagui.htmlcontrib_samhain.htmlcontrib_sandbox.htmlcontrib_sandboxX.htmlcontrib_sanlock.htmlcontrib_sasl.htmlcontrib_sblim.htmlcontrib_screen.htmlcontrib_sectoolm.htmlcontrib_sendmail.htmlcontrib_sensord.htmlcontrib_setroubleshoot.htmlcontrib_sge.htmlcontrib_shorewall.htmlcontrib_shutdown.htmlcontrib_slocate.htmlcontrib_slpd.htmlcontrib_slrnpull.htmlcontrib_smartmon.htmlcontrib_smokeping.htmlcontrib_smoltclient.htmlcontrib_smsd.htmlcontrib_smstools.htmlcontrib_snapper.htmlcontrib_snmp.htmlcontrib_snort.htmlcontrib_sosreport.htmlcontrib_soundserver.htmlcontrib_spamassassin.htmlcontrib_speech-dispatcher.htmlcontrib_speedtouch.htmlcontrib_squid.htmlcontrib_sssd.htmlcontrib_stapserver.htmlcontrib_stunnel.htmlcontrib_svnserve.htmlcontrib_swift.htmlcontrib_swift_alias.htmlcontrib_sxid.htmlcontrib_sysstat.htmlcontrib_tcpd.htmlcontrib_tcsd.htmlcontrib_telepathy.htmlcontrib_telnet.htmlcontrib_tftp.htmlcontrib_tgtd.htmlcontrib_thin.htmlcontrib_thumb.htmlcontrib_thunderbird.htmlcontrib_timidity.htmlcontrib_tmpreaper.htmlcontrib_tomcat.htmlcontrib_tor.htmlcontrib_transproxy.htmlcontrib_tripwire.htmlcontrib_tuned.htmlcontrib_tvtime.htmlcontrib_tzdata.htmlcontrib_ucspitcp.htmlcontrib_ulogd.htmlcontrib_uml.htmlcontrib_updfstab.htmlcontrib_uptime.htmlcontrib_usbmodules.htmlcontrib_usbmuxd.htmlcontrib_userhelper.htmlcontrib_usernetctl.htmlcontrib_uucp.htmlcontrib_uuidd.htmlcontrib_uwimap.htmlcontrib_varnishd.htmlcontrib_vbetool.htmlcontrib_vdagent.htmlcontrib_vhostmd.htmlcontrib_virt.htmlcontrib_vlock.htmlcontrib_vmtools.htmlcontrib_vmware.htmlcontrib_vnstatd.htmlcontrib_vpn.htmlcontrib_w3c.htmlcontrib_watchdog.htmlcontrib_wdmd.htmlcontrib_webadm.htmlcontrib_webalizer.htmlcontrib_wine.htmlcontrib_wireshark.htmlcontrib_wm.htmlcontrib_xen.htmlcontrib_xfs.htmlcontrib_xguest.htmlcontrib_xprint.htmlcontrib_xscreensaver.htmlcontrib_yam.htmlcontrib_zabbix.htmlcontrib_zarafa.htmlcontrib_zebra.htmlcontrib_zoneminder.htmlcontrib_zosremote.htmlglobal_booleans.htmlglobal_tunables.htmlindex.htmlinterfaces.htmlkernel.htmlkernel_corecommands.htmlkernel_corenetwork.htmlkernel_devices.htmlkernel_domain.htmlkernel_files.htmlkernel_filesystem.htmlkernel_kernel.htmlkernel_mcs.htmlkernel_mls.htmlkernel_selinux.htmlkernel_storage.htmlkernel_terminal.htmlkernel_ubac.htmlkernel_unlabelednet.htmlroles.htmlroles_auditadm.htmlroles_logadm.htmlroles_secadm.htmlroles_staff.htmlroles_sysadm.htmlroles_sysadm_secadm.htmlroles_unconfineduser.htmlroles_unprivuser.htmlservices.htmlservices_postgresql.htmlservices_ssh.htmlservices_xserver.htmlstyle.csssystem.htmlsystem_application.htmlsystem_authlogin.htmlsystem_clock.htmlsystem_fstools.htmlsystem_getty.htmlsystem_hostname.htmlsystem_hotplug.htmlsystem_init.htmlsystem_ipsec.htmlsystem_iptables.htmlsystem_libraries.htmlsystem_locallogin.htmlsystem_logging.htmlsystem_lvm.htmlsystem_miscfiles.htmlsystem_modutils.htmlsystem_mount.htmlsystem_netlabel.htmlsystem_selinuxutil.htmlsystem_setrans.htmlsystem_sysnetwork.htmlsystem_systemd.htmlsystem_udev.htmlsystem_unconfined.htmlsystem_userdomain.htmltemplates.htmltunables.htmlpolicyhelp/usr/share/doc//usr/share/doc/selinux-policy//usr/share/doc/selinux-policy/html//usr/share/selinux/devel/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz2noarch-redhat-linux-gnudirectoryASCII textSE Linux policy interface sourceSE Linux policy module sourceHTML document, ASCII textC++ source, ASCII textassembler source, ASCII text?7zXZ !#,xq] b2u jӫ`(fC^xv3|BI:@=l &!oťuYtFC/y<i\Bگ$E2_ⱭTO(W}owWz@ wW<B]I-C-uZA(DT%b-,c=Ј4{\lNdƚt 4@2W1'Օ913Ѷg0\ҮeuxuþCJz)gt7zQ,1xAccapg t#ڧaAr:}@  RG_Q"ۓZecB;׆@hsLƖ/A\8Γc}@6)F,(ߣD(A;quĊ#$KlJ>I O9) [ɳ8={+lg7Sg4>~fCqԲ5hw M&Yh/vUOwKrQN?p7Y^z^(Hw7J Tv7bC EYF4۠;nhG}(Mǿ8&Ʈ2ſ.DsT`?Paf^GLKԺS;\KXW-caoQL\ #봧Lf7/I3B%Lumb),d;oPbY3LM VNQBJNƾ.,4]Co 4 YB!ŞWj3#KCNcwHweG>vQpM׹ %ӃqA;]%7HP )7r ٠1yp.D6v>_E4 [:w==޲g@DrlP8#^Ƈ]{vSAM*{N<5̊5ǍuV3vsO }4~F'N4aĽQ0ܧhf[:U(}׼s_07R7[=-َEs^ErYrvP,o!_< H#gyGi*N<= |7^e95gAl=:ٴFx[W\L˃Wυ>|Nj&>9@e.݋zC/h4#8^ʱxEz{^f"ugkP<\{p.+إ$DMW,I3තHv`$phpuB-' ^~_iz>_%fgKwFĐv4hzrbZm8)ה϶[h~l9[̀SLU%PmEnPO/8-\'2"/Tn.,*ZdU/1a1+j2ݰXNTNkf`);$CW׽}6GHlA36Ij@!*2=nIs|u>%ijB'!iB-?V&*&m|V<8nѝNꞦ.jhNOv6 "2Nc!UFvdmj4?^PMIyyZjK[1̙hPNV 5|zk:Pn.]U-IFOYYnv,ѯyx|ѻ8RDi9}\x{ |J<qeUçㆁUE[a!lb+EV_ݡ0W2. `?Q$M핥%%p@ g1ZGld4#QAn2/CؑV *D|˃DJyƠ^$b>{[ZT :dٻ7Pg3B7ۋJ>X,n" f/++DHӏ;dDROgi247ةʎI+y/öjb5~i)iT0?NL4=U?n11HW-F}u9B_ (l*tG2N$ G,h9ض=ݢ@ t6؝,i?-= <\(oB}{ur1 ̽s˟B>[<.gR&b.{-5i|©g" *u$n(/Z6a4d壟62+NV s`jj0<gDsZh |<vqS&[3f ! $[3 r?YX+!IJnhv3Bl8H|UIK8̨>]>ufI&9kh7Q`"&N#E4G,vEϻ1C^b4bOQQ;o1j1Z:z^V)}f%N^V/-us*viux=Pv Ehč=s;eX/%MBUFݝtEzgc: ,-ae(Pauv"K/OW:(#.(VeMuw %PuWC>H"_kL$@cy}؃oiys*3Xa4 n"k;b`ƶJk^#H2/ΫryÌno>t'z.kk/=Bf>iaVr" d=q(y0f|^miH\&A MÎ `ǪpMŠ 4Yt6eӝwGAf%0M2 >i0-'"92vO1{X),%*j0_7?Bۀn1a5Mݡj]pv۾Yd 3z@!"C&n9âyrH>B ]`7r̎mPQ?r1M9{<UR :V: 2hdVMIɣ"THfm&;6Μ+)8yc)A ˻(OW~)|A{) ڻ"=Lvo8i2wReAw%oV<OWz UfS>(՞i$i% @4~bԿP4VDARklj54M)y7^ѻy+4p ۣuɑ~SCmK'11CoD(\٠ZZ_)&mb9}nڀ231FDI| e@_[yAxX5tŗ EVwT,\m$J0yKh_IdgNVm")ƭ [8f+x`Oȹ,s,f|)&*PE̤%7v'8%l4-ە( 2ϼ)Q3@l Ϣl<y Q؛o%4BZ_1Ԩ59l/N#La6Ze*3y^Wfn -?Sur塊a|CR zzuztu_ ټ~x9vd KD|RWM$]2H͊r;_/Blt|eΦX\*KrVy:3<JIctB=7>%qJƑL΄L_֧D.+ 8OO)N֖B3(X!U 6Jպ_v#qЬslutҞ]w@7h́g< > CG2 h˦"ֆ*uORq]^"閻i,Trj.NBU!l-q?M0oOLa+~۽6g"q 6B8O#)nnF.~Bt." 7YT,-P.F> ŊTo9@{Uַ/o&3&8"=iJ@b6+.qa&?Cј ;+GA-<5z)JcFw>g4\n+tEu H?SFRx S >eڹ!SX=jZ;Hz< ⺵#& ~?|ߚ!P깇@ÇY fRc=rO']N)> ȣB^4ϕXki8fMn50Lyn);ma 4/PVgy((zOI-n^!?њGt05f[|;<(XKg°,B$>1/m\^T8 76( e:ٔ`3^l& n;@O7B ̹mxxSf1ɪ "4&܌}VOp8('5=$o7iJbsD=TuLNF1v=oeo7퍖Ls|KqzY.gG@.0!]8#Y64%f_UTJĐ!]pAy<_3?-&Oڙb'@ !h @㧣afp  HQE>lцD,WGG3GU'R'RCH CĴYB̤ўKpk)4fW@ýv=)4y4?3bT)P//[Ƨa1 ?:`fZ0ʱ lC"J.qzVW0u5cB:A=TV)ԅWRHe^ѧ͑@ȬM+ZބוjplV)$Ð^1ס*Yt gaLPLaѕsd?QU9NY58h>/s!uL\dS"SM5f:E~kdަgAmC| sFZK7-THb ڂ(@,ϟ fs<ڢɵI}=Q`W(9o(gYH²葨t$~c:bl۞= -V:/\ J7oA_-M!~5^CF38A z'Sb bfT&5hǗ&t< $64jf(* gYWnqd*P[cM 0A:pi(K0^A jW-ܷfuTv8n ~0ey dH^D?k=H iA CF U19<ґ.NAy|'2n }B mgrEHgE,5#t|\0</ƹz&UjI ~ЩX%п?oTi,x^lN}7w)*=lh}Hz:brAe,6FDF=/Cf?&υ0>vEc('aES$N&R Zvl-ND`U߯5gUŞ=y@[ͭџUf J} c /CwߎsU[-ey(QvY=j>7Ԅ >x/$x}Ǻc9~&xADY2/1fb]}I쀍Qu=vX>> lXCQjE0q6F/.pʝO8,!vk4*T p6X(pXu5q'prvGtK9`5 uF͔TiϽMѻsS\0(x>%"9_oB/!{QY\=5O"m vv,(104: +UFH7ϑIti{ &z>}yD}na 8ƓX< q'LHMFW󠊏QBcO'J)/_&>+XՃu4tJȬb3ԐF$>uh qmNYA뭝ծp* .6kbE|L; z6˗9y42}O B9)Ÿkk0uF)$6ܣan~}n*.)c "9Ҭ(;Y!^ LMK7l(:ݞ*5p"az>g ]8QӾ~y2#0نti?>,gx"#!@c6`|3Z۩ #-woRZ8o6h*MN"d[H4y p4ZgqpytͮE 'v8piƞ2HA`й_* - DC8Wb5]ztFUУKK[!< TFw"q~_{S~‱`r#^­.Af-o\m+PsX_Y6rH |ɱ 5pϋ٨Q`>aGclV(ДU߉SR!"L.K!̟6#2#eɯ$f[wqIn q L;/tc,hac]`:.e\{6CRFa{ps sG|VZ9YV"r{3<牸).BQrU WB@J+9fC\no'iƖ?FH'j{q3Ȑ-w㭯>[j_*U|| pUȽ uѽ>r-qz.8܀NXL ^!*NFA!tkYAsJ"9tC9rL\.9"p }{-|w; tFzb>RZ_W)jv\W$'KsY$M%"Tvof?e!8êSyEh# ?Q匳tN]u|Ei^@ {]<;[>Fj#E~0{6TO%⡬z0Z|mMiTUwp̍h p/w=#XmgPkI'6cTP#KX':_JT. d;'\FG,6KaiɁbP,m6 }@_5>jmXg]8sZoU-zfMp]JHo&4^>YnJ~oe»knnLT$0'ԜI4̵td mk*/a˖PL,h YDWFxCRhv@jO&0N8yEnwN8WӁ^HUm@v{oCS*Gi|x7*j=2ts^7\adYb m9m+OC7apQ# k<N[Z6*פyHZrAdLXW,hO0U9WjHR1!IЏ-Ef~% M>T ;-F²qIJ_,>`v2_-F%F&& h8"Rnw\gq\7hDC`ܧ5O˯z]C_*' Mi_lhD#o 3ρ++/#>]EJ"9{@葰[, |PQ N?Mf{6RwX<Ps[:~__z>YC&X_i^O@2u=E/ :LKXVDhF| r9w{zܴ;V(N: FlisaVĜ]*8Gc]Y]wb:'9ʤ`\)3B9=M5웶H ?&F9sR`eT+]L-+zY[q4j%.E+g?E!-nPSm3g[~t`0YU;v;r_] "VA6Yw\en{#䊒Al;Ym<:_?f ;+iS;ٯF:G;kT$WJ$^8]>n}\x5[iR/~#VVTL+aY3rړR*5^j _ѸdVa>I?џ 4޵ַnArV+L/dYDB%s}j@gˈeP:lqvnMt)j^=Ů/a 1Qfz4#/ kk#c:g(c!l>؉f}S(r",FTb|<IpWlp^qp3&ftDV"#N/o:ir⺆! m %1n"+cf.*>SZD9ӯ8Ʉ2 `ڜ^GbI}\HnP!cI\pH~B֠FhXiRI _+Ab kP3RWA/_Z^QS"Ik 3(֜J2z+T)Or)u .O<FW0j @(N@w\oSDe5Zn Wdm/ob w8jT(҉"!3v*!j "8[UY?W\o eL3puVnGΥ>s7v:{j6"Xʛ_j4A]&Mટ(Q1;Os@|9֓C".80Ǒ&5Y(B!%[U^XM%g!(\B.9^Rlvե+gWczF-}JW6ɱ[U$[让~p0 l]A/bf&I:Ar\NtK hqx= P# c:Ʈsη'UfJw7?pA8k8]zDa} [Yv;{MQ*}j}!Ch-87ٙm^ZH:8l,~sNޓ 2s\t;`y$&^:NWz9f[_Nohf=dBe 1k0QF_\:~i+o+B wܳQi@^Z}FMSz#yaQ~R߿PFwOKyY#i 7hAg$ ;ˤsfV7Q5SHCB:#k6=ǯ=KJN܊ijL2-lank~IHܓh&übXCFS!8QvCBK'Z72rZ3*lKjUY:]ϧ&%LmV,ߩTnddLoLҊnTyuw0_d6R+l%E.UW5!x@"Y4tzn%F63YþL& 3-)R oprRV(ξ¡4=0Lَ2+_ڱ㣉MZ@ܓ `yZ ÚyCfe0wLQyAFޭe6zz3Ԭ|Ұz˶ed:Pts誊mv+.@bb_f|}V,à CZȓyt r9e;)X-r>l[u69z> PUzY\ w?*\W#!K"mܖZk⋳o6x&>L K8'a:z}1/_T=bR2t|i ?$!%woYnHbwv'=آdW4tK܊Śy=;PJQ(x/(}m8獢`ۿ/EeTYo t I7 ftNy;!v >?P4t o #.H!8,J $q yIj8xD"Ŧ'j V8s .{OĊ(Ys)Qp֡[HK\g9胭V\arwЫh2:plpaƦWQt*ѱbTֶ{]{Gq+zdMB<;^j_- Y (S-I&= 縤ƥ@"1AC0陜:*5b3#vuըZïT A7ɳcs\ʮ[0Vm|#G[ ol R'ySVFDWt͆\ %2:$Z0K $[4ea=tzO \>ˆ!x}Q }+D]l%7pitg2zrRAάFAVcD.o(U<3'4[#Ra=~++o[b5bc:SZmïm1* Te>s+ J/^e۷Gɜ_MJttYTNG=O^0;cV`La`n~{ 3?I@uw$sER=dbS-o傘HN-ermxZY\6*H E~_I>yl֕MwH e.N}+sw@ǝE$\F-X\m*: I9e j8twuIKNBpК ]x$EK[ :bV묮2h-~L=1dWZۗN9&ͩAY查38`/ޮïgLU赹t1 n`* '#yyO|"їx6(XMJf+ћdXH]9dNBhƪ=~PQFwK_$WWͩ^7֠9+4.Dْzĺ0}M,~fV*GoWJTyK2Ck>~8zAkN>̾GCW8M,ި:Έ^'.nqDJcT945-,bpeEN'׏[a|aߜm]?ma||?hY*x^Jf]lY[ \U#ړ "~Y;5BCN@k)HܷC^B%,k On'4a$E}Ұ9_(/vm檏n38*ΚCYx6 Ҋ*~.p=U!VdftC coJJEp]qȹ;,PNplʪ3`P9(wCWxzS%m)κ7WrA0v^W$ Ĩ|cMLyǸmޞҧq_~{wp%Ía2 >ҭgU J#G6ZQH0" Ogi5xdޓWU~}|ES61%=ѡ;K9Jf`r¾ޔ W)/vSiqH*.^W)B]C{1[r3J)h\FAJ &G=GIk"em~a3+c]G8#@y wr&闽ҴyIJqr13 忷8D\ߗ_/ LB>LD`HAS7'˾< %z"Ejp+y~twC*U"_5[(UKc;6K0|;'Kٹ 0S$ I e_7b0ߙ:]O!/}l]aie)Jd.RC6חN,BZό;NC|*X(2r?3ZSʢ Uz9LD*X}ؑ!dž~'L#܋ۭ:l?"nU;d`yM4@- p3+ G1&qu4j1-=s׉xWœ?;3a*;#2Jk`w0!u8^eY 91xesg^pƉ<=||_)}o<vUm*8:Yqfy;d OH^ E<{ؓv?}9ɐdsM?j4y,Y=(㺩_&9_"lu]ڏ.axkY,6iwMҐ28O>ΫTGkF"<:nZKI,#0Q׸cO&-PZSo|ClA1aP8mӴydgdϥ9ǿJ6n6圪zaXj>Rs**$M5Qgs0'^D>Gf ,m[jѢ5SV>K_w\I8ya-P}cc;!@΃x}cN .;>hM2^Fys]W!ɔ8$؋Y'0D@] |5<`n^!`:$o&6*?BKX;nue>ki8J[ ny=Y#Ca)śK6<#vd.buD<@{wpG0αF-<ۃ1tt]lc7a6f@)%FD$̞Uȭ=%`G"27e JbI$t~Sod G+qk6owǛ?մ pW簴gnѷW#w;+Ϊ:B\܊]dDðggj !'HvwܯV,{"\˓TTI䩏¢PN$>k3 Wt鞥{ .kJosƂ;(N'31X⃛(WHxt\G~f0&g)Q 6-]8'̑85"p; '%C3N`!/XLxo xi[~ Du,7 "]$ؽ 4cד]ow|BA&C&k 7/߶7Jz qknQ$)"I$ί'5r=-1yD?mXLT>9)JeAD9WB]:AiZJ,$t n({,F;ί/!Q j[ 'ݧJE!7 ^f?Z"6&g?E "|pfuimȪbwvD0PONzsu M% sm\M4Sc+.p+Vlj ڹ tҐ=y" q*=O\m@u jg}.$6aMl>L1$/閷Y% MP_Z H,2Y|3o7bQ\IoE kuUStwMj2C]C -ƷY^ ;nkͥީ ЩĐR+]|FȓjH-͟gWW uLL HzT,nx.峌[ބ!?rBDDgH)z/<^g.F4"kg|?0mƀb7 :&R"i{XQsu@{w@ڐB鎓]l%^g>'PiwQ]i.5^]tId4 -ܽq۴=1g|DNTg~cn@ۍ ;}-y}"koa{!taU/u9mg2X*~\)n]]&#kBt}4["!trO}3^W+bp'8 ZɮY.=O:eK]_e3_4պ{S\ńՔKh$^ ;cNA h=s :,}'+ 1]L9!o `WhQx=v]1 @$l02ˆׂrz>iS7g>e˅YUW_C#M @C?]X5է{Q]Xq Cm K=<0 Ch;@ %\'`D} ? q88&1q!nq͔O:5ąܸ˩KʸC $>3sMtBfubMRSP%pB oM&N FX$F %uQbGz=!x@g^~QfliW"tA7W?QiYcӡLb\L2=-5mK4O̚"4/uJG?ڶzĒGB :p3UIQ+->U*&(tf,bC&5N1Qۄ}H nYr9{%9zQdTρT*z49AF ,5WJ?\Jj[ErQD:&CC(=1ޚR[ "F@ޞ\Msú(Ϙ=4kWk $o6SY.>װ,-,oJTor}0/J m(~mӚ.{y%&U ZMs):K%͘FƭԂs; ;g-fPRc>pqۼd.$_4~^_̂[;D򶥶Tپ2/t`\cwB7ek[nytfbŘG`8&6ExwXLofjKU1Z/K91Ϧ͎S$~IϫZ3ȠP?8vH9O4<=B2UF{~-1kTۀZZzYts{ z a ɇy9}Se&J,#-h)b-Si {p}9ۭ6_S5f^|2΂?DZeT&z7`v1&ɾX4ΐY!$+ZQgzsWde2w#RMv癰qW< sF{qȪ^Xdz\y~w{imo28SFjsGr6LLevH֊f/A]55bj&(moӉ d% BF۵3xI }=@F-)v,%[ l<!?$d))u&E^͜?59p-sf+6O6(+Yw!A7~QI[$ix~#qnunޗ`*LHɛ?Elv=m7jrcu_ >>Ik5L9PDTE~Rk0 ErUE~Ŝ4U6`S!!=eW4TQ>~^Qp-WP\s }W5@N*$Eh1^YN[ZZqՂ*m*풆CV1S(M8mʥHzp72^/ИיQv@gR &WMyb}57p2 37]y%):Y 1wd  `M?P%oRe|KX/S]!C:t*rV)vs̱g\̀ZT $S#Zy=^\vwۄcb vI|0M& 1}\j]x8,&E1ySŽU($YH,PsxZB&r1M99S ^(B{\{hiOutl*3o iD^M՝_gQ!*?1@3!Q^]|$C^UU5MyΫmo/ȥ3$]ȩR-LL{tT}SZBOE|*Hӏጹ,Bg-}0JA((ۃ.Nj-0A{\ 薳'-D3/H~;ȳRL YNb'ݪ删4w̍h6/,Y=O,=&18섬pMn~4ݹWךG\J`UC E*6qABl&@8ugiE}aek|ˆۄ6sG[kt"(_w[`&v65\R.^X~֕mg/9-G>*,LGw&. 2O GL nW#u1$RDDjzAhIŷqѠqFR;ݲmw ߖMfG|oMh%&bxB@'(?ZvTО\S!9IRp#{4JS;X;jHr[7mh14=ZF63B9ڡ+T4K8Z%;'MWoHvEfl`-ׯ/+7?n.B9CK)c^ƭNDn=.o%KVryPjuz5cž " IP5R4T.ǚ, slx!; >Zᐮ 0EhQ* `ʋhR5p3{ p<Ηh d5NZ@l];?jkIB,,I*IdE>&8۱ ֫ AL9 {lS"# ֔Pnņs̘3G*R ف&8O78XJ{mY93`yYsרJi @ZB7OWHߒ$6(ےŦ۠π!50BF8ڦI4+rF`Gy,o)hTM. Z6@^ ! &iIf^K"aG͔͐k#zLtcdWzcS3×gY9YӳWE Jx!PY"j3zg]3B(`1 oq㘆o#³^f^6CUy)B ?%yw$̤!` Պg;[ ib,"t, bE CFbBDs$ C>w?:VHaO/Lt]Ajlo i>nɗ'3o4SeU;_:p0\0sctj \%K)93$~xC("ЪM%e1>~P_`0ȧbo:WӆeƴO|_OR U@%XP ^Mg-h&B硩as6oO#Ʀ˘jǞXշN1S,NOfʤ6]b't7:JDZP#)J>,z6 XtҥrOKa}Waیw((ط>RA^bo붇n6ru&,!g H/D2Kƀ2]cTp;&(vj\}1d\L{4w' `. d]U8F^ŗOh^B+ΏGYu1cM ^L5IŴ&{@^n$&c@)][ z>}a٘H[SXwF\MJּTȟ#VLJ @z%x3,,ܲ/ swY'(yW!=/#h50^u #LxRk;H|r㹳ٞTB5IR{oOp{%1*|YhSGWNm%}6@o5> 'vzmDNB8ݸ x;->6y@9m6@\x# +} d$zס68I$ć'i n@CQn9Yii-bQ ~*]tpev>g vv7@81GS_ƽ=.|&5%ןƷ֑<*C 0v4{5 hnݺ򱟪dfcVdJ-AW!@{W5f]=_aB68!g;vy=j\$.MnNfB,C[uBz^Bp9qqY]jGi'Km1ġg}U{|a؈Kj/-9vg[Bb-!ҐLcu#MXa4q ZLug9Qӵn- rqiUͅk.r:x΂>3]-^Bv-nz%R?rB9}bo2'1ʭclW[xۧH#v~%OmL#Gf;z"+L0Ɠa@:m{BHH l~402.*lo}oɡҿAHx#[vn93Rމ9Vx ,GJz("y vmŞiޛ fvt6^ɽ(| =č/fAzQY&0Tlgt~&/EZq5҆J>yUtJR:'q\PĀDfTM;hb`a~]{-}Kwlfr] dvșp.@I(c*0NU1O9j EOeh\n){@tzZQ4B*Ng k, j4 tXj أa6XճOR7h@nnx{¿?ˆDW.yRS=Rbm՜㣇,O2e~\飘$dk+j5>WglŸ]sPa \K $*,Br2 =ap'2ϥY%k;ҬYVhi`R6!4 I*g10y[oEN;Zn}.e~!WuKުtV^OԀ|g <^(dZǴ ž?u!kD-uxd+dC5]40H۲D@^2mY1 Q-y^ TMpm)=<1N|@k:i%z}VYMez*PkFMj.+E2)Wi3`GvТ'+6=E$>R6Z}eY q(w(rwT4'3kK K{AC~C -f2 @E`` YF;6HMŲ%rL%(z}^t>'0O,A5 _ HSAe)v&NU=J#vxEhu ~|=0NYM fwO+HfpR F7 9xrý@pjGuka K.L4RpN,}cv.cx4xd{EW,JUwEΓ/W8hu}o]_ͶsJ4;gG{uzbAv`QݨA5Qy>]̜ǵ 2Y {'ѣ @+ 0֑ĀL0t Zegj#J3e2IqbRyc?a@ N4/Yy&YVKom,5J+%$╧ĴDzYX1mvS"}O\+uIYkA M7R*uga\69ҫd7F"u}+NWc৙ zwަ%!~oKNgTGH@rw3 7 :!ł0M}+Xʲym #"jrċ@Tu†u>ظ}1r9ɗ\}Y3?Df_fjvX&ˑM -GuZK\c?匿]-@d64E";y8E`SϞrålwݺP54Gz=k13j>4 UEјDpGE{:䒩ѳIk|k`\=_gaoS {955Ϗ(h}Adn3f*f3rMv1" 2' .y5=0`#=(^|7N`cBWIGU8!qm>^?p`Wܭ6%xB%#oprO qeȨFZp˱c&×,m'E]j*x?B1}$to 9 :i"kjy6ZazL{ב6g߿ʊ%FUtdN̷r6BJuSD*O*[`٩x/vCNT!a JMPnV/_j&҉d\CasX铚coT%꧓kĥA8@싋=UDsXU|J)SXIՌ=ݢ_hXEfP '*]=*DhхR[t_;k9)_4,ݭC}Y:>7-KJKʎ781/2&j zF@ܟpgVj87lUETAIw"H[AD :ܚUE߯WC5(ϽDD `%WM&h%x&ΏG 'i1X_"Sj--~]wW= LE_sxg1 E.ڼ$j@'o,$ ~a>r ȍQ}G^ C_{>'L@ڒ:s7+4+QLuRd k$9#AS$tU #;t41˛z%SufJz '?[Q1+_R+B@U2~6k50*J82;QlG/RF/aVN.TQD %8-I:G>*!;px=Q27 ȝr %=<Z+Zb;[u2XMPXNښ`'2{r }}\ R~1Èdu.]Ȯ}qp0}uY3j71SQ^mpw_6< 6efW^t5<Ǿפw-:˚.o GjY~ӓU(l.I\G#e:^_AZ#C\K`1O},J fVCl *cӢ٘-hMXNx9H4F$^ĵNHX'%mvaR鉾J,5i"t$1BI̝tWl5ز"meIHW\y'@sYޅx fb@NLܥ Xo5 uދ!ޯ7,4jy[VnXv_K%.UyJݐ5/UZ XlGۮ]e/`,Ϯuu2*o$eckv:T?sx tK#5z\Bd'$Hy *Vk~H P,:FRL#eBXe{˚LxѐI J#NTu?X[ɍDq\\ęVX*(RGֆ"_Dgx a2Νv8ڦ+wߕIFUj.tG@|;4=gLbX \K}O@~ƑvNb$$=e[P_小[ ؝:-?*2ȢW֔Pϕ@w,Wr- |.Xjva`-'D[,]-QEr$%L}iƔCب$3bD,kpQ@H{ceA'Q]u2[uԼe{5XFLa:l'vEb3OlcK0/_4ASO9UK$ KѠ`.xɇc,XoӨٺԈ|>8SHčS;bBc։GY75@GnNd@?T.RNc`TOpP)BLDp5p mO@!قbt[ 3/=ߊ'R6^* m b@BZs)7w] 97 viZ$[b7HԔB Ɯp/0-WsLaQ*p}mC/dќI3{Cf3rgd:3l.j %+JxA^bUh$Xǟ{ 0HѷOHSjy'YC=f؍yu\,::e8yHsFjpX Pxt5P$llęl7?DZƨ(m.B1r2èIy'pdgU:df @6Xd0zEDSm5G P[SBϼo=Ld5#5BKpիq!I #4Cgޒ1^;o+5$OI?X˞GWm~5Re HD4#W |,JY f鉯 },qD__hw%a&|Fny|î>$ófHGҭ]ʹh$l/@*2r((Rua3~}>$/n ]R8ܒ,duMOtI"!ѓT^).8sk {Q=L,Z_=t2)JO8$,T :δkL͈. W }oRc0ftH;~Ƶ >Zc 39zHMЋ:k#Ĕ T%O@2<Ӯ4ìA1NtqyFz}M$,3wZ(D WdaY#}sT::8i;9oVnQ3oևOe]`lW^jJ0'B) Y90Yb\[|V^=Y=H `i"w`Oo JRURF{)bzVۆ-h!#[0 Ip"*u;jB:%)BRABNSVv\a9C!քL$A=ĻB-Hw߾.^M>`gZ\f))5T jmQ˭IɌU^ uэ9,XQD]Ub}l0m k[iE3tN(evN#z"EsDH5h8UnDZ!F 3SC' dB2[w,; ^'HЬ^c<8OO 6ȀBW̾kj8[;eٻh7(^-${WչDf;3FZpAc Δ_d.#4gIdφNb { QNtC {)7lI+kx.UCJјɷ^c0hѤ6+,zٶdfPɅJ=6FqOfhr &..fC5 oB"E +YQC]n3v$Oؾ,~UUqXSqVh\mw޳AR[h YՀ'_rt#Gwfel߽pmP(s$fհڻe~oONU0_}<=݂VrVwE{ro%a'v,XglL 8q)"ju_BOyӹΘ"zgd./y} M{.(sM.KH: kV,d;ѝl([Ru޶Ue`eUtu:E-KYS1aa[LN*nG#xlO+QlP#q7AlQGŧʊ>* 3-u=)vNVGCkhrЛIyFa[NafIbG5G-8ƠW1_cm=U@hø8/Ɋ.^CozĿD]n*pHk>/I!BXxU07oTPAz Į KPxe?T}Qf ݹu{b&\>0|^^t\^Ec^<-=u*yiZ'R18n^;%Nϥ, ~-S31r~bA$FyZ\D>} {H9HlTNLR.y6'ʋz߉4jk :5Q%OQZQD8f@/[I^<w;רD)r-Vc+d恍]@-~?,u'\n-8PLCw$?e`h1c$*S*֫4uS nHL NR:,qW|r>Z?TfHC.CyѵSǿhqs{:m-c>~#Sw2$}ܷyGS8D"sitٯeaA&"Gۛ!jcS;E<0 ~WBK1nA8yoCn>lXp|MIX#wQ#(*B#ggg{} 73Ĩ Fslbk˳;;34 wR6!* r@*cpxEISV,cDw^} |oj1J 8p0pzH7ڜ*x_v@&F;F^OWrg/\yD w/L;dW'F%\jA2/wjfkrt Z)/V&q:6!Ax0NO;VIcCZwЅ֤qM,0wD)N{%@veu+'-}[[R6 mGY \Y ^Чz" GThL&F~} ٺ; ֘/>_+ѬR  pHk> jX,zb7L}xFlsB3 Y旝5º'XZ%]\i'.l f$̠?ISAǹO"J051Jc6rnO[B[1KK֟xńkDgl|v^f`l2qpշc~ka%,Cԣ9~{rG${Ezt=3MAڕvCoyX1ɇ7bX[pWfE<1EOro`9C/ ?kr`H} qm6h܋,#IYCv$7!9tdPG&>qB]@[rc$W c029ɺ m[ܒTF/m5-1 sHreCG7`++[BNBQoj0x{z6,D+~%İvg7F5:20 h/SPA%biWܪBB1v`|[O`?0vI)`X9n52[dP3%trx+8Oq_0,Gj?JEb%QL/ fn>4˵(Ӎ{+ӻG XOQGhja'33$ԥ^*BEj$MT_P(R pXIY<4ߙ[ՁB,[X#EPZlE %536H $zK, C!s Z԰P1aЛ] OaU[\w(/f쇦25Rw7?ݲX }z`r5ޱ50oFyޫyzj`ÔүB0.-FvSEuFP2Zlo7؅*n?)3h\ ȷ >VmOCt"hcF:vc>SZ 6O&dSDWj/M5|51ivr:RBV*^44lڰRQi{ 8~]` ^Ԗ%ZpB#$޾x<@m'}fImM0cs1tŷd-JVW&&T'C (( Eĝ d7RaNavŌ%p&*4I~ e& GL,' "ˢ#5Z$t/6f]A[a4H㼰ڵxxLBy:6/EM(Gh 7Y,1Ԇ:!A KM9~wm>E>2{Y+z2Q LAy#XS}>ɜU" q[M0ܗXBPЊ1{3i12BaajFq=YdLpcv `qχl@z4ۙۢR DSymT@W4$b8ޑϚD`ru#jk&%J@(E jvGP1c>byE _P8!Iej|B;: o3apU藎'}6N,jEXqW4D}kgPsͻsk} =q\eBl筐+9u[O,Cw"~,B,mG>DlHªfAE#QLH/0!P}פ+gn靻*Z$ۄZZfv M@VD h'E$r ;ߗދtx)sxGjjk;0!R5Bzh@QP>i'J"vYٷPֹCN0yP>>g `X|U#w: 3C^Zg9j?u05R>k3e{qMN-mxARW=x<2we`j!ih(tLMc{U-^q&ރ7δ\S{rTך+XI fsMxs`0z?CKi?sx9 ~Z&s.zrL`V}6wO`qꛒg80``dWp"N!_&G]5t?@υ؞ha4c+g AvM jhVeP tL3,m3ق9_5fUڅD:iT$ywTK=\i%sʼ:<-IPsܓ 0Ϛ.~*0x/0,-, @9 %b8f.'CB&w_ G2?nݳeK<3,ypـtnZSeY}Z _# 7[VіCۯ"Dfc4ْ8XkVSF4?i.>0V-Uٹ%p K`g;%<|mW80M[ 7 ʼn`ri}J]^[I?jHS ,PB;x#ڽ_SXA{ڽg)j~IO V,ڟ0Fbܰz _gv7|p#]A7Fc8Z#6pTlbSFԨP?l;~gzTTEeOC3uUiE|63nr.?KG'I]tA9h 23)?19 MIs<'<4bL ~#Yx@1AQ ijJd2I>}Ï}NЊщcÂfyd@0#T GE"!{4 ^ډ~~jD ˈY'^*2&|!YQ; ;7{'G!PXߜ WCݿ,R :6 -Enܖ׼8&8+iV%= SXw>!6>mǀB*Wݧ6v L׏Sw0XiИ[BJtGg9<{-pn͈p^ɥe#Asz ŢLϘzd![ݸŇ(<t"7+ :cJ90Ҁ-VizwͬM둳I1$%CiX6ϰ+QWOH2YaWp_sLl6k'2  GuD@ҒSѶ/ {c味;{OB ٝó^o/pTˇ*L0o#> Ս-_ܠxԴIDΝ 6G;.G(2( 4Ml6i+[hJ5Gow+~W"&"y0vLj*Ԣ=0VM#ЍFd%xܝ&yLڝc_gA.k&F+^f.Yo%`Dy)LR$}(x7&Q1G>o#Ю"j́#պUvo{pDs-ɘ4 /`jʢoa.hpΎ-;$yyX#7# M/v/|^\ U#JD m).r$<3M Ki|!I+s|j/)GWHqugƢxor#?cy?A|8c^QcJ2>'Y_`!ͼ*h|iH*, ag״3}͡(2X)7gA~qc jxܬogvOϋKYf\h!;N5sm*^m(dT2+?w bųS3Ÿ $h}.okY8ccXHչ$82XqI(G)<<'9 k AbN].1aK>N^ZM`#U4ţ1JH_9=krq :@P|^H8u3Ԧ-gg-Fu-0aZoҳU§agBnn^"oXyw"Maū*h1z<\,s<-lײv?tOM@ "B_<@dΑX0dJkFd۵-g~DB ]F**Vo7=>I~4 O=ʟ8E^RdꗰXXPVҶ:i[h[TNSl^ A`MI\medUD_ťN;0Lvsl1AȒIO'P#>Nd#wIc*9bڙSKs,75`" n9'd F 1)F`g{Y1 l{ ҍl_avH[\D cD'4ߩ~"֓JJW1@>Cl_vs"ݴ}}M%D83JPqyBШS^b px{f?}zc},2f 񉴺)d Mm%c[-˰%9+F򟅀꫼ ~uȾ/JAB񱾏w=BmkJ{ݑ[uf+q`gT H0K͍Yut֔ڌ w|z jn(#%};nVp0-L򹏊3d!sx da]9flZq$? 0Ab0-˜F|RFlFJrn sX1|W(#`'t_鋚C))dwhDN ھH2ǹ1T-~yT@s X|6[b2y/ ag?5$ RH.#=xӜrޥIť| @Ư7ϩM 0\. 9*7GJΕ+bqH%yP;w/٫R8iڈc xd j~N1d{=]r]I AT4~@xM؆ӯYzW,`Gyab`dQW؉;?bFi"hZ7-0Ey i=G#bcXyʴ[ݒQ"Sg ^ ^4YT2KT$Ⱥ= \EU0OR!+uB)2ҎJ3zItBtiN!o֋lRvA8f뒂$ #Dz5O=~GJ7r^Ckj9(jN#&5k46v#l8hGSv CjHeu<()(szx2|N z>!H }p^{WKχUC*R%ա=F⽒BHĢvV  I Ē{TI> onE54|mЍۿ P'TS㏄7Nq D}{ @(a*Œ͜6᝜[q;,_fof'9CL #yɱ#o>*ˍTiPVv_<#UMStmUh4b x}{l1+wrv ~]&l 햊B,rdmqW9 >ZDcZi9 /)0 Zl^{O[1 Nzݩ_Fx39_ Y,h{lJy 8NoaW^6ww8fۍ)ϱ|'Cd)C=.|QdXu'Y<"|i#İ^eqBg9 cǖj&Nh7;3#ԅ:o~ƅ/ 7~#Lnq$3T)]Td Ma=qsl@CE 򈬭Bmd9yH D創gwV!նB+kVMiJT*K%`c;!:"X$Ƅߏ xO۬44"i[‰yz+2?Tm8pL2U fS>NdJI\0i jPObqN쩙8Rc#W=|# O0\ێC}8"8%kX4q2f`ٖQ ru @}W;J.Β%5 ɦE(pF{?c^l2h$q EWpPpcKUV#$ϳ7\Vuf=? ˅z$/>xyp>Lo{7G7 E׃0R%GVF JRjSryA(]xCI@d}GB\1ەrg"<eM3RB zh A?Thh'RmL}qK 4 ůQ=\?HnzӕnO֜p<\*ѿ ǟkʘ ۃ>cm#ny`%SZuIoJX,6W߅& G KG=!* ѳi_l HGJF%[{ '^vŹhsjþE pl3,Ƴ:6o¼kh'm^.;)f9:P? %!+}Po.`n(uDiLӅ)C2(;;ChnLX[ӛV[r@i5F56׳ǤqS98r9]d}о<^ k> ϗҤ%C 5!f{C^f-wl]?ptA נPз2kb11*!tNvC[I cfPE(0aRuxS)r#иՏ ͚lgS|Pފ$] f&&PONYTbU#^D,&C` +&1Q |ssl'P@KXegЖ  -H՘"IpgKN,ⱜjͰ0~;ҫ f%3u.Բ9z/ažGMAn<ϔNʜ/AԧuTqT5^֌:Jv}W^CzH%~ /Г1i̟F_ȽYIpml(Ҏ$fqfZB8IN%}ϏNbDLN&;EDvcG3 0T:|aܖe/OS >6G.Xi26oYܣ1ĔW5P<1)k3c! ntC|6y)) ܧt#_d‘4 O6#{-"p%;эjOVˣDgŷX_M1}bSRNamO:+EIEx撑̴QF%pJT){g 3ӓH(Q'Sް0`&`4c$U7N¥/\k#tt#!G~"%VX !"oe OCiL& pNIpe6ŏ\Kfݾ^o Dގ{s95 KL1*ë#6;~0(udT_ D_Adn_GIiƫ1\`}, Bwx~bPaL@ad)$,iyI!$%-6s[NY>xFVjgW2ʙ W) cxNa2].:K0`N4N\˥"D6qS!R㭒bezҴ*|b'W2L[)hx`d+M^;Tp(ZnI ac8lLyiUOދTI>%ovY#a?و =6|,] ʧnC @)u2ӄSHAdž`c) fkEH{5eޙ%ݮ@M#C=_Ko5 j /r_,S YB/ƗM9mX0{`Yr wDFCDcJ@ekZ" W7]X&@bqK D7gM∃[_~7󊗅dHsFT{K'/ G#H/VЍ ;l?v}R0L0 Ti4" VJ%[NmXzO48 p+D{ĆV}2Nݨ $XVB`l#DkhݖԍT"OFy8U.^~i]7 Z4u1ܱ욲HHxGk_SR.[j)33n,eYڥ%DSe$h7ﮈ[ z>`g85Y5;I Gi~j}kΉe'qt'` T EMl5:'"=#E:(S,;*#ߌytY/.'3o8vuv=j-Q ψM]Z_:۲W4~ 0jkN1(,W8][5IVeXRvz' FSb5V 2>-LunĥUl0z8+;^Մ zE_uPi0GtU\vb)+̠/lLYW+ҽ;v{ U6p_[ff8SXErB!s뙝f,Pq a:~v{+PH{LYoVߚw};>h}~,f^6ÖKg0rztJP w T] k w${#ߍ*6Æ@r^[yVnyy;A,^XšL hZXd D[̛9G,{ \a1CL{sq~ %-S]ԏ}ܪ;3)* d,2iC|غ_.?A&HOw0ڊb;pXckAU&5ѿD7*czdFx}x;]?3֮9|?tGdl.k0p{\ZW&@Ks: pJAӽph=Q"?2?t~<>?;*\/ |Bxj5sT>ES=#^QJ&ɛ6mA~bO1Dl[SV8V8Իv T!' l#GB*g`>' oEӋ-EqlC`NjLrdbDBlSoz>kD.d>wm\. ic1i+na9c Q1Tm| Aƒ1$~l}M_@M4,^KAdC"JRݒiԵcN(>Κg)\Eu6v6.y2BuW_o{d(!/.FT)|=ƪ R,^^TUxK|"TLc.gLkW22 Cwkp9̐HJrJ*:Me 661/"CH;ϦȪ+Sq1-0s2WP֡yc<νpqmbRaÀV#u6hJUX#6(R]/ yAg!hQN5g>"x PhY8Qڶ3c?gC|ͪzq&i]4P=-4q͔f Zx]D2;,U\rtFpZyq% >': Р㝕Sn:J>"_USD/-ΎYY%9Q`rNn󡘕0H4SrJ 4"i'=!y{4%eZ%mn=YRN FͻOrN| WM(]Jܲnl2[xW7۔L_[|QW7UnfwWPЬ[>&*Њ9H}eΡKL'0y^W$vE9 ;zp}uz`OVKKޥ6þ92pv`oqvr%I? KVTNuStJ_km\oɋD /Cfr&sUl,Xz YERجi0fvx:,ZV~.g` CE2  W fF8 u/nq {oTlz0q,xR ޑjhۄ8o  y:]R[oHYWަ9r:1;; d{E VeMlrn9ǽؙ'5?4y乧S+}ɳKq=e_6FTL>``KYprö_tؒ-C2jZ.$$*DR3_ɠI&Ц֪+oU >;P4{ˎw*gOxz 4x&K|h0 Tdɖa5t>:v뀱6diˈy-,jcy_g%% ~ |  C4@Q}WL /:brM~Q^{d` hk'uX AL' 0JR4)329t1PX E+Av0OD(:}3Ih/r즴=Z>5+|lψ*,8;8zPmyQZ2$ 31Ϝ:LQޭRE?2?vUA(ɡFYEJ }Y[WS 1'`ѵ!7E䝵JꘙaL6HXIFE2Y1m>˓ʆO(^՚L8,d cCCՃY5.c=5TA!Rf>±k_L\5= 5L_ gu|jjׄ!ûb4PT;I}xl:zSaYa5r*g뤡HX|`֡"_:&c%fS9(d5`$f l)HAk=W 7}[CbCPc.9 ] Hy22OCvt{'uh%XE @] ❸pfNg59lmS w^c'&~? E=à ۟b<|̑Q`!/}=͠1pJDqw$P};?/w*) X50KC.4YZAw?;R*ph/t\C=NlP0O*VI-KIA^ZS 1WeY ]ُ߹s)p%"!aS-[$8T3d/|KX7 or5{E*bVߘuaٵؽӋ)Sj#%ÙѶ,oO}iU0bQu mz)q!EoE(S.xLqg43^E(0}ӭ^ANiYRLEpfbO#O4ak8yD$S~q>a?J\@!ͼRwmm4r;` ?:s-)ys!)^:r`A G[:F=uޓS1-N"dJ25D^n3TwA]@H&r㲟^`U᛾o '| (xG3}˺MN;e7R?҂e6%ԫN(#9a_οof3.? 7X@϶ ,N1,>DlP7r;j4L^E|.t&'1D>Fz8^q5@⍾lj]CXH8:9\Vzq1[G@WYf<:NtDݵquW,[P9K dn]gMp )1 ~)U n!9JB&Zj>bnFGAu>=a.:fnCb^e7飏Xǂct!Z-P+}VF3X:$yjzza_EFiGЃ%iװ= 0L7Zm /A7G/cCX6$6r- ʎ'Gt9btFKxdsк+/BcN8ztps+:ٮq)FzE@2KU/Clv!5gR#^P gybM78w:CN} g9(4g4 ˬ"H!Tiα#(Y 8b JWSud:Yt[:?unba YRfQ[4UݹvoڇؒpYF ,Z ~7 QXoߔ-࠰e/ÆC%em N|hH<ĐG5o9@1ЌUMn^qSYMX<}ec>NܶP:VǃMvLQxs†H)KT\5dE@w' *6Uucnp30HFY7bۢ<.&nR{ Y=sm"zJ%TrqG*[ōgPO0&(Q辗;I!~NJek2A$ΰ4 C"83fT}3?!LON嵶nmPN[{;LKV*o)gorݓn̈j;Ai2LZrN%QgA\fIj;X9%}Qhf*2o9D >RA]e?l2`{Fh=x&K%{T&eL'5aɶv gdDHy*_! |s'd;jqDq(ȫl!T1׃_^B~à)XBd(B:k::RZtH Cqov' zbu .l%rǘ~P׫s x_Vel}2#7қ*\=75O%eFSYǫueR|=z|m~>±TFHi2%P*mu`:8U0PɐWHƸ#]qEPZ̍3h&wz]h%ng5L"Vefdimtn!% ЊW@W@jiLp/=ȹ} ?VRRJ`ޢ8q`0= +oyay`'puKL;!537,sI4ONJafi8 7ݝ4I'G@>ypÖFMqA@3(ȅP/y fA9sF$Sg=Oɮr5 ntdH{֯Nދ;0Yv*XTJh>_>{F~ˉ.hma[K ~0gI> K jD}Gy {4158X FdU^Cd޴&2TȤ*dAN .i([eU\P5Dh~!NN%KʧZ`hEUSelK;i27x41@Ud|XbHUy̠nnVV^z(s͵ QNTzKˈofêIhׁFW%)lcUjbGQr>*)T?r|~Ⱦ5 eX`}%%Xa*Aq 5W;f쌯%V^(1-% ˇ @?xI-l@%7pE+"}#썜𔹍  .91cM*CjE0G 8_bن%N @ϙv,'|  lȬI6-/7UGYtjui*`Q*3^J˲I_|,C ʴYؙA +J5*3w7JuYrZ/]g*?uƘ -xjXT'j4!QqcxO&RI`uP)N7̎yL(1&J]7#7$\ֻ3UZdk/md!T,d,E`"FY*D ɜ o&,䁆4Wi%d-:itLOӭZ͠1"Û ^4:$T7?7o??v>${ʬDWp9g[Ͷl& w饩~jy Y}F @l$lk5ʘ@4HSqfsy\1)\eZFr_4VEP-(qa7NAa)R+RR䯠ЈnU;>+Wv_=_%ܜ';86#$F y,(>߳*AX(fy>wLMShy5':FUSV=2[}ZhQu$8 =!!vh0\ˆ#WC3ؐD?k} &6$v](| ^˯z0RtQY~ts274ٰt-=~vazGlu_?@%jL휵{H3՞>cJZ-Śo`;Gݦl_<ȃT2ª# \5ZLCCvOW 5g6* kBhsabrl3VE,sh~Pәd(y@CT)O{ `ߛs}Q$mN;4i,pЋm 3!NE uL=m#ڠ=ˏ(Aô"ivzBu[bu1š9TZp}@0&P4 Kؾc2QO:T͒~$HY,m6wV~]KY ?1֪z/r itS/U;66n<:!P'ioCq[GO>M p[ :0 aqG ط{R.[|'|-s bɕhpa4_yL7-6w-7ؠqFZoi(Y vހN~nC\CBT0p`y d9$"sr\8Si'w_4:M[:*}+HU n-IAڶCɹdr,U(a~q92u_ QJ(3740#Z y׌uQҊ4oY3煾*J[>A b̏Ǝ 9bڀ^'tC 4Œ4(Za<U[,J;[ev{H:Q+vSM}!D@*Y3XV\tN*(G(#{{.A 1xzhhttYw6j#X)Ҽ"E&z:z8ځj'Vӂ,K*ڼkp4(CwAKFƶ@M#P;˯k#dq/og6% oRo0䡖ao罔M& =;VjE:x.cl!WY/Wy[I2hdn6.4s&\54xi\(Z]W=]ul8ǘ K=-c:7{5l#3ԡfQիێ]`I8IPQٯ[:SqT*Iq1Z!OSI*%؛Cʎ:up3H Xеq;ϵUr.cVʺ>r!; ӟmTr؄6{T\x:n&8ؾʧ-4ANCH2t#LYTkfͣ]3>J+YI4}'9=Ym ;u<&[~߾SDACh7̟Oe?c2c{'8¶M#7Ië᰸X apuMhtU7$>HC+V@x .d&Z<:dD9a֌;G%)bZ(:S;ZH甫!Wq{UE]Ъ:.G͹a7-q^fp #4TSS&34 s-9kΞ;kt=+ a :a ]J{HHx(B BhGhS @XgrVeK61+XW?٤cdIMZl.俯L9A_[Çe%Sa;>]K*cLwf֏9BF(Ej&έHI!Vȹȷl-`QDpf-BEŞo0}8jU.8zA8 ZcSM9Ϗ3`W'b q_OurWEUWGը('+G'*T%h#1 s 2FZ6r(<5 P^~?9n' .9qRRUFPġMRN4Q]_)RnJ?`Ooj)Lq !zy0j? 8$n++al8Gѿ$9:/nmi ?6+Pvԟfv嵖,piS;JD߶$վ%Wڎ61ec';  H? Ew'ssk&XK\.Cst8])@kNEd2yBb{cdf0"ɇRH0*Gzзܔ"EEg9?;z] _P2S3;'%M Ϋ/1)X{:X&ֈ`pMg])uX괥KCJSoa+3U;) [Om}4Yߨ2]KV٨=,{q.?x0rIb ;o 9:yonW-Pu\Z77`  R~W ]& E7 lnBd3VoN1Ms؍t"ZG~Еqpy [1IzPa#+/IDp"IQk~]J|FG[{^mO6~)JJV\%<Wn[i=ۗѠu ^8Iɜz3R0$*VZ[$ȂߨV),Kۇ]yG&[-W\>Ժ6f)rRAN73eu%5ꝡcfg*%>Io=K}2r 'o!Kid"P-FUz>f!5P"=I/QYZHC,|j$KH>7\C"AK ZsqPE~73&Ub$o ʫE7'e#s$eX7ق=F'? =ߙWP~B6;gUT"B*Fo]l4 Ln?2XDPxӰƄKW^꧷fNg!K~"&p]FV8Nٳ"Z\%U7& Asr#c"Z ڛK1OwZvc3.ћ օkN,^ biGRtG(?&;.Y6:":$м~}MRo+yO"^J)($Fu^ \Nx&9bK>4?gVSIB2k Zp15G*k 8R~B.fDg&(683۠ԗN!q\r} lHMD78C>{*؝Dp oHOʥ;o3/bݟ>팶QIJk+sQO)P籂V3359e֚EQ3޻ _K#m6c@ 5*/ BP8*1Šhrٽ+, O|AjK:/CVfL#а#oe.H~T21xeBIH/Fkuax^*^ڊ]xDt?J.p\x\8I<]+?׹'V9~K/kNCI!dm*`uTm鋟kjrMFH9w+}]}ky;4HєHS>Xj#DCVF'6rοk VL٨/Kpګ&mow!dlIf,F`zCVN|I|NcPǎ1 v{]źq]NȀ>!;.. g,"˻|;"b p 1JTb|lO ajpW/{凥|5xQqQKYi߶kRAN% T3V =z-iWEK@zCpIoج$ k: )?'xAze oNyYtxK!uB8ZMM$58ϳ)x@vNT=X}c/3U;a,xFkoݵhj,6ξ@R/OTH|{ +qUuL.'o ^Lצ&j@Z%mK< {”k&U3_.o׳퀘_-e׆\轜G3>SάeCŖl$Ξ T6{nlS/*xT$'6cZƜuU?~1p22b DɈ8%M`OX o_?A4=|e2`P~'BjOhrj"21XNd!lxaP8SH|&5y#FERqbJ)VygL|)c=x.%6z}h>`A+gO"0YҴdID<׾5!og7YBp3yST7r A3wEZN#S?M:LK[pM ^E+nζG̛~Lېm OɂaO!~p^cB"rr>K˳F#o`r,GCy'6jsPS ፹4p9(mBc&f:O~햘'#z<6xT\rPҳ5,7,HZ4drrnh~sn胐L^Mu DKeX/ISc;3(5`h)wX|!0[,0T7k u{"߮M'hk67Kt PL3ۂ@dSv rOƄRUK3 N(n "H_Q8oSH{sWV)wM<%cX8!u ,|cQ-q S Ƨ#}$[%Xm9~sՐJqK^Gf*DKO~)玞QN]TjhBϼJubgAㆦqݣa :('ԟ}a~hr,HkAn S-#wE`b;U轘Z%|r%ՙ(~e&tI\))_qJyۥVUk;#R`6hwZh>~]aG+1xtf(vIxHצ8N&W xFɣr8 &+ǃI#<2j\+ΝI9,nn46*M (!xjze1{sq|clJ}RR=XHQM4e%:KγΪ2O8#E|"%LYWx+:8͸y*i˻؀ګm`q21-zjƥ6ZE=Jᠲh`rVJuMF;BB;Z~d0Gj"Ge E* b =,?#_:UUu@C-lalMkWqra9^Vn0?G( ^ EZPnôJ#`Rv\M'rC˓5o@1|∑ ,"m]'!]p'棇u d,]H4z\Sijq$#?iedeceOgh@л[N595LOqKWyov?ҘC }{Rxq_8}GQm4 o4LV s6#vBT 8R#|!G@yzg|y֬&ʰqmƪzr(zM>'pܐ9̐WWrsbIjK!G-3߱7ԲEw|2&U͟*w୤}Nb5bhG-!X_"wKt4l[U҃mY p6kz+v&Rh_d4L6%қChTx򔗐CaCpT)S9 $ѕw0Ij's8{[yS\'x;,fQUgOaDh-Dp'mE_DODs@%T_͢L}(gg+~Ě,#&yL%iU|\I|k,(x v,6Oik~M||<`ԒQ18JWa3'cZɢ*ϴbHHK2{W.mٯ6!N&*'odŋ"R${r]N5i d)dq݆N1 Y}ku4]z|-uCLK1viб;bhجljmvqɶ}BP") 2Hs9NOe~r+MsG1EC;ּ}LBR:BqaO;P*lbN3}|tb(oMmlܞ]BQ'.UϘT|_pNPi,Gb9}k_r:T{etwt fl)ȗPӛ{3طȉWRu7;l@ֳԞGPV1 ԆT$L@%?fN^K.d /0Yk#d1[)x.iX7|YOr6zEyq Ѓ>σ1Ј&kNJndEdvP(ePe-F`*˼yI *ΉN43Ga?hM4MjC" 1"9b%^4 v Y!۞F++Ə)GG\ 74u#::~K"6wFC.xlxSD,HdebGm@cVUsWMH.I_37i_fc\0 d~'{ 3XVRȪ$Ǔ5vL;51*e.Mcȏ[>j4pRf>NFˠJ@+{vKn p^.]hD1͌AV>` ֽX]Rw9VEыO]e?kMᏻ{Jpwlf]$oDY%Wy;:JBǓ=fE0L:i$jJ;@܅ળ|"h`Wߤ n 98!0koM$ ,%&V%%|Ś Ю2gʲRN~GbOZ$lUBd,U}^QkCD&4 m7d Gm)e#΋GoG/`3FovO!T5T-6y>y02u%6h=X< }jj@2bG8;3 &RmA*#S+!5u6UX+z+bJelndtF]c5'SmCcђ6AA>d&AduS3u~'d<#x–0ےr`[wX+-CQA=-tJtӂ{TtD (Jţ`ƽ)EB?m>Yw9a ČLdU Q7niD ӡGpcsq/Ts~NB4ڋt`VQ1ɗzE(Į =իZĸΊS(ʝ9B/uӴ*2am1늣8T4\ =:蠩&y]9z>8 h0ST%t ˃'#9Nn |3xN\02)Ši!5}'% H@"qj7fu}nJtXhf0P82wpgVe?P337C4aTI84ޅ wۋpcOBaL>rX\ ]ے&vwi2W` ́v3X.QFs?{L&M >m\)0,ϳDZ78eꡊ/T7sFa21: ו=`xT#J֗Vg\kUA,p2wݑ lkK!Bs8z2St;b T+^Xg3v(*A0l~0M̀:DWsHgb΋  1|IzJ4ۏ58A.Aj@賂;֔|O-Q>Gsl|~Vm 3t*QbxicOg?1.ñ'4;GpYv6vu2h[12G+Y0?0[S1lWNG^5]WW @`*C4(.v"#A$ljGg9)u~'ڋ&8]y/.\2*% 56s5_B [_y~2k Ncߨ{ d΃=9.] GЖ&؊z+[wdIE W!R9zic393d %*x:8؊vlNB)6Lz}lW.uRȟJ #矒T&ֵAXBd\E ۢ!QSF#] U%KĪ9#ẔIӬu0#W2ܷ!k9S1ߺ OW\PI?q7)B!sÊ&2G2fl{3:ELoÀq2#ޕbw&KQu}~::wϟN[<*^Vuh'1/xL\ijz { #=W7w786IИk5Brc']d⽊lnO9C=大 aBXUoKWMOSt6tgElOI ʿk}`vvϮG rxO nIqPu\{L4J)淀xӭrLH5}Q=l2J{ԗG@q@Wq2atL)zM bOjs<_ ==A4KxxÏ`Ǥn\1=& "; L=ϐYൔ5Rکzw'H/QpD_vD!#j()5Bg*9Q^8J"ʧO){]ɪA ~eK _l~96yjWtzx`} ͳ*6bׁ2 x߽,<󧒰MJ,YKu7ŁHx6cģ5D)K=ڸF{ xm1kT]Ə{a_]-TjNJ,#ܜpp J?g45Z\w?+O$s*I!>}2* Df@\TU9|g`]:;4(N$cD _S3&۱j!^/X"ި(eϨ:릂lU)?׵X 瑛M6yrJ_ F/PQ(!oI]znWܣ_.ͼT\A($+ϳJp%lJ!b=+S6EE'pwjcC6{1+s :N׽H 8DZ"p Ju^76_a@`9h"P4LA"'K@hb?`6k#rW#6`͡' #*\! Q]koyy߇յ7K.9^$0x+1$u=h,rŞ+KRKHJ'YB[r1;C߿}n6K4Oo伒ޥ 6a 7ƬKR߰ܚ9y`UMj p`,TAL+o&4+W`-cS7Z?OKW3/k4tױPj&fq0TSl=bbֶ(t]%@|6k{BB´b$[\U5fx{&ZɎ^7U9p60;H.ب-'6&b8do6V:hhnϴ*M̐{m8rh~O!B/aP؃;.gƝ2d e (6y lE?]_~ZFRЕi'pɹ!_~4fdAҒ ؿ^_g(7rwcenx_uAZ@jg. !EB`B?uEic!dEB(RG.,*"+QD#H M:T 16:Ⱟ˪Y'hL*^iϸi? hžЅpx`;k_L+,sCj Mz] &9²ז\]9Ot5ݬ `KAMlMz mT%^Ă?9IVY" rnC@IQ}2:HiaI 0vNYؠj/:{*!x6Uf0sWϕݰ@nI`8W"|]"-uJPg^r w(/ oGR؝ o4J%f #K_Nm(thTmctU TDDm,@ASE=@h1GH7`H; `Q@]!*,gXц 4,b613@CJ8ǜ}q*#.۴־۾p>*1|ys\*e^BxK{;F + zsw bnW_e ^*G:Z9t f/7ͪK,78H1.VC=5S\ds$혃dW~Xвx_` "4MJ_8,. ]V"M$a?<}X}Vsصu`^rb~[3XH\{n$?n6be%NyA_Do{s 5y!ƹ59BjmK0OL+&Pa<g<% ]R+2DwL;< Zu:R]&TO:~3B8>ͫA0(g[g0?eC +nQuSpWBf RjlIuz3ào@ZJUT4 FbfO Jh ŖtK2ԬĀۙj<`I qU̾ϗ0ۤ!F B]ݙĨW cTQ ky76iձȞE/ sH:8^e 601kN-sk -85nB)r@R] Q^Inch5P!neݐMA " XLsp; a6,\|>p$zgY QEY3QX F 餏AՂr(eƀ7hQ$IYk"w"z:$L@cIϘwyEd]ʿGLuMUkc%[k~|S7<,z-| U,>,D<AT)eﲺN%ϔ 6_a-qq_ Ȏ:/ #grouad&U=+ɼdi/ㅆ ]Eӝ6G^؄ 5Ekhbo@B/o`;Iʾln mꨤ;@Ncܰ!k>H#JdUŎkΐoݿyJ%r ?ޟ= V@ߛu\U_QdE$h?8lg4XqiF[)X1 G⫙EcAǟ {DIC.VGwk`Q>9D/[<O^toÕ<.;9wFޙ aN1щ(*2 XcߐbUoa @AVCr>e>֪0($CE/4&3]8!r^Yi1POQ B=ڟk@ T%{%$2 >ZԠ#:+M,:G8R}@oLL9ha0*O+~Pk7Ƈ/1?„x &:WesR"O4WonL3 ,Y,4օ 0-[ae}i)zҤFƖH0.N7ľz!>":olRY}/78 J Ux&6DZu25S:GD^de4 A A&Ci-MeUU{N`!5&<=EX|B&OߛǦC:00:$Y9}QZ ?p&RF+ 6&@p3gyקF Q;`|IV Jfq` yci8Mh~'ԿCtw) cYcao"vN̿MEYR*d#Ivqim#gױnS/9X?iO`_8CGIU%Nf{nTgb*xLܚPEțY, xӰUA_$'osՒ}K |o=e6?ҾͲ$) Z%D T\m-q!;暴M[53Oj.V5_Xt x[&[C#$OoB̜KF)Ř\NSW;|S] Z.10-c~> GWA 4iÈ/ty2ݲcL[fEx}|t㽬 u`, fyxMf CY'72sY' T th46G=m_-maWp'=3 4M:U9]A<ž%x@*r߭慘~X YehkX/j L,إ.Vf%?w 58KѮ|ItD./v5c $޵~!|)3[nS^S` ^Z$rۡ,ĵchXy՚4zɈɒQ2>_aV6Hdi"|]M{R5Gp)p70MVߖ`Y8\5P(nV+(˒䑝[c=8/TrF-?<`!Qp3bulg'ms[`vdf%38o^͢,?C?KxPVپ@$6- ɌIf*B┉WބtiA=)!ZQ2"Q[׺Yp/KvL|g#Qo >W܎GQl8Rq 7j"-^' c' ?Dh0o^:XlUTk|}&ҙDj@z#feKǮA%3EΧϘ|2:7=X!`aZ^r>xD|tywMڃ7dU-@Y0.$uتnW-bfCZջ|Xʥ]gf/JFcO?%_@ ᩱ9#N"ZORq$!Nnsp^TorӍm,d[RB-9Ǩp/1o4%u{b0zZ-+A1_>YV:A>c =t1;B7eZ`O"UQg. K#XgƘ}~ D ƖŰ cَ,8)U R`Nm#:@NUG۱Dvoӊ1C%T7>y,^]oȤ,ETx=3>Ly=3ܞf|) syaڣ*}?0ܔ9"D& E3?m2[#6`Qea Gk]?£J-7ə̣^8$iwd`ODj7RawGv>8A'T\D5H6wG\))R o}()`KX ~+dǾ A;3@ȸ C8I[J 6atnꮀ]xWoTL ti$>tqa@*ͨ &7E )H+J~ԙx'ۆ`K1E0!Tjj"w߆~1oo| 6JT?N ^Jl52H5`8pi1kc}I,u8-{6)ѭxJy[]S͔G v;iݥo ΢GuσےZ'rNcpao臲XӀ[SKtwSnp5mř0H*69_tH h8ZW,btZEy?փ-IV5jaٖ#= 23uZ7{A]œxAo,pL Jq.oz2Rv2MܾslUJ^fzZGkG2OhtG,. ufv4>:قvd޹FY&ԌfcnS\ѷĐqTv 7!/g`'.ݥV9WtW4݋NZUñP'%?oYZ5GrSWpu|Ebv^SvO̟(0'ߗyHkoox*etd7!HE ]nVh{#mxxEkGBczY*\p)tnb?l~q%ە7J[ #Gyel!$Wy ϼ3iDE׳4J>+eFN [+G$[SLpg+&L(Ҥ Mr4D88%P/p3 /wI#4bҮZJPes7nu8"4C4ykRXzRjgY ]ogPR@ol-rᗭJ'_Oו 0`KiX ғ3׾?$*Zʳ+=Q&yyit$Hq,nēZInZ-ƒ̡ ߤ?10@+6jg:S=]$%5?9I ܏95uX K  _ߟ_{OR9w@Yr A SdEhEV^4po}^7y,+mMXrA\(O55kgZc{4O%3&LDZo fw0'/,0:Qś~ IAPuVЬk`9f)AZ :\Ƹyaqq^OxW'' 0*c>qtSy+/<bW꿢J1M}"0)+%~E\{j[w8YyyޣU+d}MGrŐ:~.[?$lg(&PtjįA-W!'QpYL="8֐.,o qZᏠVC35R%muZwc4%1pݘm4 [׌[fVL倥@{ W 92.E $̘_5HA]iv1Z兺K@;I0,2,dx ej=3I2,sչv$%W9e&*ͽ v}18 C WP셏[0MƆ#j>flEVyE2b$z9k MK^l!MfoWm@3HJ9PSoOrBd DDUì "7= 2h]Fw F5D"W;LX7sD^1)D;9%㯡FON~.P39ṧbY$Dg ٮѬ@*|G-D1Ap~WB̉zTk"U!rإ=S]PU37u>u6˪SF7qFEp'YȱXZNFPGDHm~RP惚|鬯7y'ڼH1 p$O^=Jb8\A Ѩʖ,kSu+QL#kj6}t&*'FXAKR+J~7t fYݱx_,{ӲOG[NAN2b@J]6% %4R6*V~-<jS\[;s& !xk)Ķ-1J,0Yg2|RYHa̝{JQ#܌ߩS?a Vݘ@#^ĥLmzV ̪C$`i@>abBtߔO"nUZP q#S2Oz+Q=5gW-\-yp % n T-0f 2$y5 `–anxRrSmcE>. B@ZGй-y5 mx˚)SY=,ID2Wf 8[CipB.۪Lki+.v3V{< rmWPCl).dOp!xc.fk# ckT>(eKnv!ryoiH \Y6,?W-_/ ݶVFn~Z+ ~]Uk"`2M#+i`pFvBgP1PG(mq끟t4!TRSHHn*AWZC6\:Z.hl^)ނ ?BoPD<Cr L:9\hݪ.?c O"@{Wi@0a}5ߪ:D's BZW15{Lb[ecICZSޚ)MI8of(h=bLhm+J52)ӸGkhKRx$bBrO\G%|RY G68P:ئ>>2|޺up %8# sL( C߳՚|rJYo*ne =cApub;A?)wQ.[P$=Fхv'>9wb"7_t}jia)6gW1fi :*J`4ݯvJ@q︉Z϶rCQE:~sϻiξR~3KEEwGX,.fŁo^8Mu>+ ^0,7{&jDgIlu0F;:Q+ZAn6p{/ˤ&@9OcU(BB` o; d_|%FHMP+#iGe39s2jd)ȗ=뷌= H}M.NP^X=2mf_xc]!g j0&傠> /Y{ܭVrk[Yyh=|6ϸb'm ޔ1'!pi Yt($2wGeޗ5vq/{AX`+0N3;ztMT}$M6p+lgWg+&~ty-Kv;XZ>ZѰҍ'X\H&,)8rOߨ' Hi&D *frbYq Z6m]W ,XG[GM sMΐǒ]Y{o(,su;*"۔` { ,^Cs)DBHiH ,* QWc47Ča]8fr&K"9-dPyx9{u. lF-+8џ Bm9Oe |mXR)/BVS"kO7 (t=ȷ+\To)?;Ib-/'K髗Vş8bpG拯V "zIu>Յ%  ȯ$ѣLC RT)eNgC'R,Ugm }Β x@rfbGaZjt.uAq/.@'Y:]17l\m 209y Ulu `lCM*%GlOhJl6>pPe"!7$&$Vϙ?Imīj@eڗTGZ-\"}k|% "[Ay?b¤32Pov] oJ⫍~(LraeCYy8a2 Fw8A|f,'W ܯǸ64a4(?r{āB"N4UYiAqVr ` JEd7C$2„Y_*yZr)j1 RH.A +yf{&# }`m^-8:$ɫ)gZ)~C+~[*[ ,}B/2LAzm"q! HfESs 9=M{>Ŏ8n]Y(r>So, u~J+<-,5D\T0 6Z0Jov >4ʵۂfH',.So(x 1 %YiE!-C3hApi9Cjۃ0CJY,KaApY$[ƞ4N4/Ɉt\|Gz}5拵fY&؈hCL!a2?9թEc,|J^ bG%B&uV۾jF #*>2g-E5>CwEN[6zȜv ТYYBׯ0+>H%AHM*m 8͇;40X~= VX:V+EvI_G!/AlN wEEx%o(TcyimPa~65сiK$ŦQ( H}{X(_Ww&ca;̑R&pkJx"륩#T̓} 2NǫY7f+ݖ_6j qk^}B*@F 9J!8!* M0I{2W]'.^\ͻ`_]u*$=S(c#qSnbu.:& 䰥b29dhZVuYꔾYH) :y.r:2Μ<`os4BcYkDt0g!a~[y ?SC>*X$)\W!,nN;rm,F&R_Phߛ{<,gЈ%]WZť;JtֳX=2e# g/dYEa0e/}젲 /V!ʩ9sS#WB J)ou)PUj*ݞd)E<)[^ܗHa(BWDQeQk ,4NvV} N~ѯO g.IC$]~ip߅^~u}/hxgP Y=qꈙ{BE[N<ʏU&=$BSopϻ)sìb;\ut% /d.(_2w,.c޵=>7f*-fLYck"ix#|Q&)j92!vq-_A9M EGAtϖB(X_;Q][h0g]57qi!o1BzKb^ҭ9.fڽ?@SEI MceF}4ڢi$1,O}/Xwf1bySm#OzۉB+gJ6ώC Te#6pՇ7:J{,v6֐J7VJ]!QXOɁq:B q1.܅IoԽp濷loPFV9X{g(\LFcۭy)FC~Cc5TVDڏxFFtQ76Hb Li]rΩIJsQպ׮P?ae+#' Q=I-~\, zO [!9_Ml>G~)w?e2SSkTJeWb ײg葁`Yl Seb:| 0xb*ڵjO6yR^#㞸z: %GñёVgbLMGy܇[O.Oxw<%sA%>,dk kI7Afr'M_$4ʅmyFiD^dT s88pd' G >)E ,-? ,cf_"Ruyzb?uhD1Aѕ#MJ/&gT(ˤd(YAZ5m J=q2Rį+)RawrP$ST^} R(x ( 7<!]tXm Olt`"uf-)9c/u]9h p|eSn 7<6qmŷ \UCGi/B],).bf&=87SGrS5CvK0O0Dgz`@7{c! fN b a3y qkLm^?Zm28M7Ie\12B"50̵j6ZܜxQJ.2u.eCOSޡ 3R}C?mBT*Iq2Y&TiǥR1mSQ鞒 mW78)ee3pCyv*'٣]+SRWq!9pqeV[qSMBzR,m1^,BLOD-Wbvz6j ©TM,Tr8:R(/ YȦ^}% %A? ͊0A@Ka$4C Ic椘}`ӻJcΕ @M{B3PrĖ 䠝40Y뚣bVjsD:!o;BIuGw+t: q{pR˼!N38MXyi%k躅u8!l7\?rQ Upc@N|uuBs䬉 zGLYWϨ/uCρZy}M3֭7 KUYnzVqL/^67{U3X$4•+mT3] g`>J>M_D;nY- K;peAJ7q=a/0);T'dd/N͓чZzD6W] ̈@Jj^H|Jz<3-Zn(qSWx\p-xqYwIܦI!JxǒQwR 8DBʙƿ}]8$EOf,v2^ig&3? o/aϿxD/r v,_#z'6.>=ZGhzYPV10rB'ù~~E0ՋsŸT)rd}xIC|:=rيPT R~+3q1Xj<-EG aM5O'JaA> <^SRH,QP r9:̕EnGRSOƄKqI$YNi8_SDixq +L\nǞ?&d%/?v9ZcRp-Lg膻ERuZp6;w.mqAy`oJ HBwVNHL 1}-wFgxύCP4\ bYc8[G6,wOQ[A5e?ӟ;%3KR gShN|ck`gDIܡ*?MÐrtusrEOuwB?pj1Mw2~w;f\ĝ,u\0P ~[ l?zDz5I&nm{Qg%&+h!K*I Fru!$su#jҀ'IIWaDL+"RZ*ʴ Cf倳?xɤkUvSöτsAWoT;] Z6GRkMY(:ja5d/-wu5_1U %un -y,Y~>uck,,_B}7x  GQEX""Hɹn gZ:R 7@,AgaCU (G:_ `3]}\?$ЪgfzTEO5of\ݗYxO(;Eeh=F²Qa߮ln!:S򻲫l8VeώG;.Y2&D[W { ,'+ѽVk 1A%u+tMǀOpk}[KMU#:$Y%z:(đ?' 2|on{YވI@ hHԂ-E3oꇹKD^Ow|Go3AZFm=ӃpĜ >Q x.UWǭ@m*x8$1ud4[?Qotkk0Ou!2% I8_WoB w϶ڢ0WAZhȶʿ27o˓*s+jnL Tk o$I9`f}^LRoTNxS}E'~8ZېG98a7`L6;'t$2u_g݄=05_tcXn੄ iI7ԥkUO'p;4o6Z1PX#974Ysї[hI+ki0Ҍha+s>bwxpQX-}AI]j̩c*3}St/Ĩ M VuQ9}kg⟵R{rɟh5U$ykdI*]hc{i}F,? Zf-aT~ ,P?@,ɸOw] [(VFMb0fRX6)m1j>h!j̐ Mx3O|Z9OՋY+ڙrW76{vp۟j@UbS&ZRijzlviHSqHiil{^] L_e9xZ|=*B|=ΔA>7,6>zEAPC{)dP  x1Ž!*}oI~!E-Yey3T&x!TvqQ&6m#ܝ=^h.1[ľvDlp8tHLWWn YQ " fq ;P5>-"[g:U뉶%2ߥ2iFQ c,*IICXNz,(#:-'%CT^_?1tw\+eITnENЭ#U[ O P5I4|Zu+QTZ !7N4F;hj!y V%?"56_E6Ǥb0̆<Y<``reH#J;0ɡ`w=j^IJoT7OF3~{Ɠ"@#҉vX6}e̓cҁYS^.I" $Uk 7uFYQA4 ڥj0lAd^ludKX8zM@Gb7K҃(]jw&WfP8m&m^gkoA{KqjCH X'h>X}=u/]gYC6 3yɧ| ѽv&c#"H'9öV^ x\iW q"Zۍx5\}2>Oɧ8?wuh@XD-5йk/1.ٸOs9 rtE?Z2ʟlJ\o d-Fx<+2 +$A0rHsu$\h&/qwntD[CP8%z/YwkӍ |(ZB"J;w%X=򦊛ݸ}EaQQc1gi Q=/fXb˚6^?Be΃I{hsBWeEߟ9X2KtĘ c.?Zp53G usCRI-gM'j-hћzppxTƴ](ڦjkMB6Y-XoujW3/r1ĞLq-Qt5pt-5G=c[F!xƶa7Z\y"ӫJyQbjAi\}f`ŽuƽEfB6/b~NC`@.35?RgE ѲZHl./{=ИX1Rm-|qlJn"wpſo1ٰ>3ӎ M^6|fw>֑G_?0ɶ ΅gZ*I hiy-8ڎɁtb!1Gv@k0y7_1o,,rA%^ȣW/l%}&lNX5T/ /g52b^?xG@+O2mESabf|gcO;YLUVLQרRvd Apةz*LQOl pҨ_O[1u ,!tIQ j"¯%wYCd~Dd@UyW&lc>g#AbDIBFl:E|*1}'%O#  5:L8=RSuj7+YnU\|X 4jNGgqw+VqXslV S Mw$F."1 䕜g.H0qxV=xxmIT+ɗ],,fC:]'5Vȧ*@ DŀjkeطXl2Ikks5k0PH݊Et;mrѶfN3zҬ!rS(RkD_ݵO A^L8dROf(ۉN7PiyVҷ>n\k?lŽ ZY,iRf;v&hVq k^0XoIB祄OLhcJ Sy/*>K nJv]2x*9@Hv-g1ӒF6sIWPV^s]d(NovVp@8G0ղ#k ޻A'}nѦSauY*˽Zu`\A =4fS >҆nK޳TG>5uA FX:=Tƿ `{=fNxa,29ly6.>:%Μ)" ɒqf6#9C3s.ډ҆ {8~fV7mat\`HzRV]2>fٞ(s k2䚰ɮH*⾦ DբIek5FJ]2N4\-R"5 8vR'tyψ-$dlV4N |o70NGn޻'Eqg"52r+SC#Lz,Ar̾̇ooF+ z;TQ\=bL)N7>OGlج+bY+EZ›;YB8oP?n-hgqBA2_n~QLhd[6"4;!/n`(} z9Ϫ\%S .Qϫ Iң0>YqH^BYH8y+W)o%#_ڹXu{_sGo[HwP2Ng(z$L0hJ ӊԻϚ3͑1(~Hv]o[ʆ\S 5Ɉ>ߊۅ֖QW5#g'"R5&0=cwJrd4[r` ›=Z1sմ⮺ᙙ1&9iG+ }95Dk~W:-NMUkSnZvC |h۪Nw%)w6os.a0E?+t7߯Y(&Hpjx9# -~3aF,nݞ V^z t)S,+N?99W#b=uhgcjK}S8xtrЛ#"5Q7WP,x,Wxff8`Ԣzd'KkNj zpY?բ *咖qVS#!<`ł͜׎ w3K>U]+wE}?Agkqw(3/m=Vg5J+E, Ҭ"Lt-*4liGvbDi2PQ55FEhKqn IO3/׾b~(d*Pz%kē:' z>F% "N pkmU011 ߙ?$38(Qs^b}uX~ ڊ9[DGӽhZ@(bT9tz`+&]q`pN/cf wq#ngĦ,>f#o^QXNpRAH,{ SX70]*m(9+xP?6ZpN5z݀"y jmEd{O 9Kb h 3ݐOjBC-pkLnw6F\hi?yT !|BNP`zb=4V/0U YM^X,p {G^|G;£gxOQCDoNMu\4Iڤ9BqiA7ÂmS+/zE}lF2 jHmK ]K/'/ |s' ԜV>+~Dh֍U"_vx݆c_p!FAQО3xAp!3m6wd;}at.ThRcӀ^j;J@۲*Udf%mX Ư2:SjZJa]QT.@áki+Vx WsvH]rf& [͋y3ؖ8f h]<}1w$G9DZ!?!h <ΓaꂹbtLl lSZ_BA='8c`鯪n+[I n+"0j awLVܢL咩K̅$c1șA>*6.]rw1$Ӏ6N:&㦦 5A'/#Ml+eO]V]_If5- ( *[ޓ[%m9.;LSĸ ДIk#$o׌^o sE_$kZ1~X"7->Yv8Yo/MGvn<9H.$6ٓ5Qkb?Zu J ?|@:Iy AF;Ok09쁋,(d HVS>?BCP~%oZ6NWǔ 3ݘRkocY޾w[YLHYI]X<Ɨ W{Dmfd"АH EX\;( [dr4+wzԩ}ބ9uJ6 ꥸG'JʆU}8 -qӢȫO顷#^hbL a;nG|~kE^:<& 㥚kKs {F.7W[,u g}1.LAw7e]]tV%>kooǩVKvNQ̔`3QΗP5Qj &S\̍Wb\o72mIV"C]d*;3+>rXX~}*.#HBqeȐa]5gD_ʊxw5bl]36VuftH`7||Vy[k A+ Q>3ƳdQoliQB rnneMq|jkuڒV:-j!S_ "0)y`eݷ3{"yD,Ğniܶ9 t)CK "3цn!PGi{E |Ow }Җ@/D2|NK5!s#:Y; )2-ijbZHSrLs "%ϴ2TGZŰˢL+ hBZb/Gua`}r,{:Pwd klIDqz?pjƜD.s?V6F"ppcPp*>TZ:k r;7F?@&d21*;j1,[]D j,Rbo|h^aR](\KMÜw̶拚\SS}}?Mcf?ق)YQH)`Bc(|{ IlU`c'zwH깜>8;/fF gtR| $¥~2|D1H!mK$xxp @o&U y\IH_#hIӪRXlhTﶽ5 HX.]Q4rlŕYdžxNXOK_A8VҠ<ɔG c+!0wEwYZV1/Q!ͩ:Dơ;lY̚ G+$=g=U \b<Y1\)2_qh2\c<=6qΡrfS_mcG!hH$>}͚TD RyR?Ѳҽ\銱vh B4oʝ1.r nqTN\yeOl3_㝷!@-y].VKI wH826;oA4}@vo$u80tw+ssq jk$X ~&F`l޲mm__WݲJ 2F%\  r|iM8 3y:,xYݡ`'j?WC, a!Mh@59:Nمu.c[>~:(V%ACiSnWB٧qUD]ؙ[nc8`7\fBdbqԛ^+#)* ŃJR|o}dJ۩K{e Iyi p ή%gW[X:o{Y1Qx*_qdG;3?Nʣ[d N]"=ΰd3 hd0), 2USCk$ *4GHg~`p a] %kU5ڥ %w]εOOfGRq`z4 Lp?Q~2Vx`:EQǺMByJcLQXWN2En>u^Z`5_ӹ͗A {ͮ`4w7Az䉅á/h':peP1skp]M1ߵeFccWtƉ<̀? 4zvZZ1M%:yv`Nx}J8ވ,R~EP1ZG2dt8ެ8( wE&L,g~RU-w>VCCYƷ!@V=rîKV-~'ك^EdF.Ί٧U6Υ=3ĸHQ!)`ck:?a퓱W~|Ie,^E~sʍV!"̸:6L`#<Teg6!E>_$s`)׼=p~ScdWXƣoz>[l/[mga/טb+KoO5vy4<_/'>[5P^PCSb`,JQ ~0ffrEY+̓_ʀe]tÆp Df~'7# qNP^rVg+}i}%&lXCjɕ nf\XUV'kOoHSYB)1ʽN711rJ+'Zhro[ɼY`ʫ">ɜzF!ePߤ9_MP!h8;sB8"a P̂<a]\G[M$4fESIrS` )SrSTyFLqf)8qߠ~#:BoK|0S{i.>^ p`B nnrBxF,Zh)k k\PIG;}m]۵?DGY^'ȵL_trrDߓAnYt)Ys79(ԃЀ]pe`暧NeX|{{ gҸ΢NI 4IA )5ٜ'w 4g ˅׎$ۘ)vJyW R댅4ЛGoz(shB](ӲiA*} eAuoVv,ǸP<0 |%Sl +&W]KߠO!># ҘD̤jHxǽߟ??]_Y:_KkΟ׈ 0nR@IA4$n eON+/UzSgow4wa-prnh9w!d@yR]Js;$r Cg -@{;`np}?Sc.ӖD""=&7֭#n#ݱۨR)]޶CȜυKN]4/)d~oJהkv- 69dR@~G+-nh{~/swmкF¨e.U~.zu+'QHAWu70xgaL.4J]:MM!ICF܋_f3@26}0=7J'8gVz߽}b9WXPs|@ʛ_Q[;tm!MIDrLI~ _¡nOe_uz$2eUG0%'%nW1oVH-k'tZ.nx,Ⓖ[39M>f{@RWLX#'׭q H3M>/OJp|숉pS>o|`Yi$cm8Q/t(*笈'ޠcҠE#Q Ecyn5HvqZVr !I0N>!D B i3W qT0D2]W\$WưIHޞebEtZ-<\ 4-i5YT}bL zT6HxcKe*˒ˈ.IfqpK836b_la'Wv&nbi{˝4 &dTuPy{lw{!і԰_@, =3}=hV\$č&6h\;5ǹ>}'Gr\'M*ʷZnC>e4L zT߻rYp)&pY:> S¹sղizS;c7* g}ʙ񴞽€#m^NUˆkD VXlB<1~b`CJlco«9uO8gmA>t,wK:>ZYQܒlPtS2( 2q/sBCl!øfa~8 Z!Wo|ѥyU&刺 ܂tm-YqrT4U禝voN=|b W-YfRcG{w )})s"C~RTvʖ GrnHnf;w"leSAj3erwhɖBoUGjϟ G-~:жv(ٜ}/ Bph† 蟬Ҡ`aRkV3sTrwcƳ7}tV[V|*Q0uV %Lfws%Q7Smb/+:l8 y@/:x BlG tw.IM- J .EH^~W9l{ߴW.P\V ]WW;FO˙$*!em: ys)=J/DO*oV7?[煉}X垷AA /!]֫_nt~5?إq0nۮ 3pcsA0 $#ynaݞfߪC= :IEN96bLmMWLVxj S~4YÏ`@Xٺ^m6E9ؗlDk,-q'9ԒYќ}u$r*9 '3zEL-QT@ǃbO$)z>f 1rKyh7g&hC4_m1f&tTdC%U."]װq$gC,MUxzZ)'5Vg Mٮr[2;4=E37S4#6c4H\?hV}nv>ï]Uy]܋Y򄘄YU ŋJFCO~" Tb,28 |;F÷ ,k+@͝F~`GW*$I˫@GLz7GT uó-*.37yu%Oc _SSVgm{2ޞ;x865I^s;3.,å2wp"^F"E]hT &oq!Y*Gxi!d޲2J写7Oi]v&TLZn0R?C,R L2G{ %LqP9wCW5N(*ឡ_R3~#;H(T(!zt$4n0Fbk#\o|ʨӽ1YZc 1a6#)R! }?͊S˲uV".`7Q{~OF4یldP;לNZ m*ȬoՄe) 1=EX} }R :t=daD3^QS■՛.*5F`0N"J\ڬZLJvxO#NkU[,PطWul@[ ȩ>yPwwb>ĒamPײ~`UOJӜ)@uCum ďvXCp+#VRϰY(؉[8eO(W4~:e'cmٵ: 9e='>H^tw#xef u𬶪z;斫Ԗmd؊7H%7#8B5 |\u񥝻>~&Zy^mQz{R.x׋򙛘0H=~煵I[L>O6<6U&--E;4OJ9')B} Xnֆv ˆnYې\߭yb98(lRx :DkUh{ ~u7"¾ՕDڼl~V@$8PodmSsX@Y5s$2U=#ׇw_(RPL_o>Ah ?HVL7>jV|;{aA>gxwYb6^G`EsUAu4턹48@OT@0TgMrĈcy+ xͫ?jqk  w8e}ҩaK+F)W[WQDRߓ05ֆk% a  e՚:K' MڀÐk=UFQ~$na*@<խh7`r}'HWrxdSXc#e5 V,u'qϘ@pWؑv%M ::L2'{0Z{ "_:iOlѯH0 =vEsϏ0q0T 5*pL(ƄnFƿ#`Y_BMv#n$C$^$zcIsI?_+UϹ(ui0ި#yE|=8lFu1GH á+e," Md;e-):f j4|I"c *gV, @'ÅʙXe;CKRn~ D"ʊDcg] - ~&b{ȚB 3b{GI=2 /s EC &#ᵜ@yaܦ+ow{Zcd*BR0u W1cU!4Zm sd8aY. c򖠐RP ډCIu_9%ekOz8KbXN b-@-axMd/fܷ5NΝ$".\)2 Ic7u z8wqMtFEQJ;}„k8iA<*Ed?xi|7ή9")amG#`@R@r^IHCy E`^gHgprdh*l ^Gw&d^s ~y| bKiТN E!H`3jQ?;A n[24[R]YЂՍ6$:[Oo{J~~SZZ0 0[iCi &l}op,iA H:;݇,6p_k;`0/c #`N9aj..a+ ?(UoSH>k,}9DH6΄ BdM|9ňvK!yڈ  ^<,'@8uNl))FWOb>2œmY)~l,,KWyoYJ&5[1E3܋} 9:]4Um!HeI@HE kX,! 1߿Fr}L8yy]laQY/ .!A0JgIA}ZptD~wd 4ȟ]0H1Th}ދ[1'BY7wHYvnǦ΄+~/ԲM 7Y:H7Rorj=pa#"v U\g /!X@Щ  m~\E6;K.k"gHgɠk4 ЛRP12wQ7#8GY@0*]V@ \ 䒨Qb[€%Nml/D3 tABKpf?J~eM9^rCц7/}cr>ӮHg A<1AF5MFE21H|_B ]FF=!M*ݖԑJG (B)DG굁ęQ@24b6ԥR|mm:OQdfGHy硸~ހqfԂp6vQUtWL' җFgSX] c36cwjAƎｷ{_L%R)9ů~ yi31z)E *J\D/bQp0T: ?x{5wm&\Asx P `?wMo< 2c"dݛr{(e~I$P|B@3vde\ a'8|Bj;SfX5V"Q#:iaJۭif^5y5M&yT:Z2̖$.M߰ipJ^qWac2V+M6ދr[?9?( m!)Ԃ\#W`1<<8Z 1ه#pm'|5|Ąêc2-pwR_x3VŠ/ 4:-Æi88۱")'jp6(T sqUeP-(j EDХ0h@Հ:b^KG`ߕ|;;UoCyRTT*_u:dYqe*7ơMluJ.D` }XTÒ g%޸$k(t:C6K#C# FyŒh30F$EjX:tЇձ}}hU 5~9Xnx : xtÿ'~gަ,4,k.X“L4`3Y)2:d\qCU+ qc`$?YS$boqXRrECIqm楕 BVC+?x͝ Pm>9[lmMC !^ˌ) +RkUIuds3=C& CÈ[D-%qGM%^Xv.ʭKbУN'N_9W$rZxuos>Ӂ%ދ䒹Kv7E LfFE'+'w?;a ]Zςn]_L ٌ}G312Pr}W{Dx@#!ZMavaG߸>l^F(DZP.oO.,gS)i E{z2T3SMz#B˛r(ob0Q\UWT[}_ ` &ovR:І-Cdʛ/pI_Nf?0}+Jz %m'|]Lb\Yz#%v|^!2֌N RlC*͋^ɺ@—!qUb]Y :UkZ颀N'9VqAx{X=t!\m|8^?߄bǎd Ge[]Y3>7oڠh%N,Ia+̇>rtӰ{?;a8#]ʎRV"q\HI.-~?XS/E@Pd(fh6JQk;K!"$NWt\Vs#8iErG8Pq?p'|ahX 'N:/?jh˔Tf6/uR'R:uYg)sQ\-'+>2WjA;P!BҺAZt!agmUh#.YVyK2}ZK Mn]j*I&CZ+Ba5n-/NN+7DtHK^9ٶD=:oEpGsϷP9ZOmjԍh*& ~"?g~Z#0er@IzD0y mJr 8Xr8qz17_k{9؁`387W Dq.Oqoѭ3mZ1ßl\Tߧh}Tê'iwZc%b2XJ6sgޜy=H9+/@\TC+Ԧ^! d`?aG[Z ǩx`6Ӊ{o9&P<.ݨ$t˶ ''/y.Q> C%16W8ԳN.XFOҶ+\#`]< HpU uVV4#8R6dqY /ZI,]f[ #W /;lAXnɭ l&߉o%P(`AR*\[ wIx8 C*zqYصꉍ~(Q!O<}2?g (82W&Y̶Q?=,U Q5+ Z蕃=YѡFj榽|Ssŭ kֹMM(7Jnqo`9?2IgN;f]SyǾc~)CO?D#%ig`p".@2u5u31qMƒg=w+ӮA: ֱH S_6@|N<1UL?h{b3GPaʁ׫59nZRC9#`|wnH9Q:TD1 O!Im1a 7xk6݃ݗΓ1c=5#Bo bR]vյyB8RknM_:of8HcHd$nl^*7چĵֹk2.aRQ,x5eA| lY?`z RLU\A$1Oͭ?=xY#b+ð F,br]\8φr{.dfLM<)BKZpE +Wf־v8ɰ8 T|mcvp&SfgWVD>6>+H*EU!*H/$3FʂY$rg؞hdEZ&-ul,ÀvV w aoN,J/"inݽEqt"!Q 0s%)fՄ32"K<Џkz/Q߄E%OlDaŽn5V䛇nśaFSPBȋ)7ٲ+?gJL<2sJ&SÔ⨶2CbSpalڈ/ci-ZF`vaDD %!ɳ2zsKxDbm4wa\ҖVw[~YJC5.^_ pIB`Wlc3VYSE+WI`+̞@&leJ=ө,&:3ֲ7養钯eU`8_M{by]Ƌ̢dM~0[hN1y@BJaxZdޜrv미O>j|eW4dYϻ{josdg= ;U/4 n+9˫ZB_Y's~ j/ue$9,&Wmz-7ч<\zA{\"d'Tr?܆ZXX"mgŹnunk8TUUFjAkAQ;1044:N o7D6 7^W m h*0p5#x,-຾s')(p1~ɷK'Ss:bD8za5GM3U7ɏY_)̷Xj]6.27{m#M]Pq*֦uT7RG%! j\5k6+ĭɤ"-DgPꢳ]8-D1.-Mbۯ|[K5tuJY ;@!c>dС(q#冔ڂø=jؐ o>Ow sqFӓ-xUFږ}G`qU܂_}(m?l AMͨP)L.\z76$>=$AXk{l>{!&:JqX;O$0#YN#`BJIIpBdI0S %{ >de>!Aiڼ~aОW(JhXvJENC Ec6aMlKO=w&=#zU}ZqAǍoR i/}tij\cwiaCgߝC71rg,jE1֏&fTH Z-eZy6WfPN-ٵIwjWJ-}fjԓruFYoLn Z8x:WST+]^'ڑe<%-.U׀A i"c-PI qZ%{>@8\ЛElxn7N}KG&^ $mrx = ҧS׫3mKtCĀV"WrF$ L]6jl"ь,zIH/L#F'ҲS}Y.?2jjE螔-wzgyz+q'm?2cQ6 We^QY9^ u/e*ѽ}@P$?iXZj?hu&ŷ'[mcQf*`F! N%'_ KqͣFՇMxGNV AZK~NV+yB< C sa?wq>*wNƂU= ~wL ~-x#L4j'xtsnߊj%l@iҳRe+nMa6r.(oܛb~8TG;P|X" T/#f"_ bFؙ1%],h`A3t#%Xe%94_MDJ.39tFFDlLN;y}dϬ}Vl|T%n >oR5-6G"(][3K .tas[W~+[Bn(Lojlְ :]N2tpxԖ[5XZQbyMm伍:txf+C`pW&}vpBIdeJy%̻=>Q*. C5|9gȡ3 i@| tǮx`)W5qȼ֏,J 7`o7 L(VAnN aבwl4 EJl>Jhn<(P01_]D¬Σ!T-Awp3֕|X5ĪYS|ekp%S)[PڳiL_m9w `foh7s4v]9cs49\FC6a1l0"m6%ĨWgsk5 J1$sZZ Gx0RN4)T{pF eIY̼Z0vb؂ʀW~֙IoF6%OPݗ:M8W#=v)uriw1/EGDZE]@! SB;I yiSA"3fغ]8 (:Go Љ-R.^ s*ۏ>@=7y6CYRWfcBK\kglrQ#jӅ"%!/Oa8C'8՚PS4[59(,K <bzS[Ml!x^:l9&/-%|ltRjFµ,zp 5nʭs&yjÓ݌*J4hIGUzpQ_֤BywlԑL a{_c]&soʩY`*J?%t>#RE18jGNDʝd2'H҄9v߰uuoEov}sazIHs+[a>~U5 / -'sRӈ EIapp23~ C3ݠj+{8¤)LBRTw; ЪHc3NpOӧ?Fr2$s2k7]*}y@6H knꝱиCX?TciQ'Ofш#"\DVZ+< Gޜp0R\"NWcԗC>sk-<7(rL1iʼC'pIrX8"Ùjʼ]N/O=sE"5ou9K^}Vzͪj*#QWҀ3}\h1w 9|Sӏ2.cvNg[i>phW!YL`)c3!AvDAgY0+JRW.8Gץ}[]oQ~iٴ! Q *ohӟ1z9 gg_8h9Θx,yf@!]\$ {ō<&R$a+"q, f1 4&6ṸG+~ݡ{MIdd6H~6<9;@O)H2 ,i006k?Aw>J嘪Pvm('¦V3:|EƋ1oq/EivA}[-հlQ-4!֙,R8~:[%Ùi G[a*!^[ *. Lc6LkbI5;LL%:OdKoI8ZB 2QYfS%#W8 UH9/\ 0m'p5tp Hs2 G"Y?X)EAq3&Eb[7JxѱdkHXAW曭6. 3d^b%5.CG$U9& MǪi+G`-X7 gP69Ē4?ȶ@D}=Ipu !V #"B"pWҘd$-fͿ[q-։|5nЎJY] SPۓ("[JdZ@`D9 Š* Bʧ_ڧl eq;^y8 m cu$UZj/LzD?>jB\0JZ6joNgǖZ ?[A#e>LyefJ[àOQ&p.;XuńnHۊl  9-Ȃ)[4ow.ꢙ'+}UIGҩbk@]"UUdZRz{"ǯsyhn5 e7Kz )]jU՘3a=[!m??x1/tn`\A z )~,wT]0Fec)|J{u~FUv7C0[ux!#+B; *UqR~[vݔv::U{-,0D:='݆g\hj%jVP4e+[M=4%hĊ HOINRbGTAXXz(򯀤@NQ汌DXA]9?#O 0y;StG:gl/ˏүyђ_4zvPjץR0 M*Q&.,*@MPUQ֫?j$tmR#^]Ȭ dgtT @am5C-Kemz2t x4_K\lCpbs*HPEJ0PGW Ô!xn 3N W'йFԋ$i}߳lH/?{gѨ@ΏBFoqGyTlvv$cZhN@Re&e21s;^SCLm. Cߗݍ$k"$9Csѻ!-dS4ЗTWgؐB ƴrȎmNh'1GgD "]W\ͨS sQa9 Nϣ^ZM j`eY.^6N5>[ɣ*B mGǥrQrYwQ;b}ʊɱEJt ģ8x[ղ7]u!7 |:MgŐ&Iglx@ITY{.ӓP&S TіB3&xduO0^? :Vt7Fo۔ 7چ׎mKe^3~A]%kn}oӥ?N.Yf)<*:`@k<`ʹP zmz*1%&#x~i~j1 }'i.'(+cG#LxTbC~*LB&gi]>e#K@1EYj'yK ^8v`3XNT9!`M qЁ J 8ԉ3P]>b$܃˧d"r,9dPlz d8 PGhE]&T)AeH<ض.Go~H -ze9#UP#c)XܯTpOAF8+ˣH0 or?o@Zdh_igkWpE\i>J־?D!-\ \~otS#?iQ:CFkw rkF+ r]Z5Sj2d\{ ֣^\ɞ&]: Lr,K}Zl-C&pܫf/c%I-"ΧP2 uukuDrcñף*Wn[6%>5Ge}qp> wͭ"Ȫ#^ ,pW!0,Gbi=:T:#}H ˅XG{C4~²5"^sYJX\[pd]88E5)e:!Ca}-. GH2?5̄s_+caՀg=#ҼE(Zq*6mdE0fq$$F|ӑ,G$$:04tVNNaTAX_hs0` GDۤhmNPꨆw$s +]3BAh ^8P1QgX349Bb;ԳPT Bk#θ٪r?hj䮼Ȫ*onR?/T3;oTr8{@bF"y 5L|r~ 4xLOIb HfXN wRxh~hGWe!(Xl*qyene \mH_b#x:ږoWZփK[*xRZ{t9})=%y^]+s;a&!!^/{X7^|ɳtD&M隺*hF.m<]~~z0 CUqoʙt l%^Fdc bC@&m`wDؽoZ~m^#rc>J|wܠDK҅F݃x Q~mVp*n~̘6ahV'k,EcڑY!鷘2\usIa9$-)(\+7h0%ޖ3ws_?gՁ xHQ U3{8]2ɠ/n24TDGR?g:g!0d{@mbC~ i!ٚ1Ԓ.b]e|ѧ!-/ Ghti ˝QLK[J2?m8#ɠ L{m=[WOs,7= P$/sihcD 64Xok[r%bP!Yd(=6E*R׭ Z+Vgi+l @5DVeTv ҫiMDBEYmR%Yf Em@aIVYBoaCLuh`EZR˙%cK-*zЅbmggBŕs  9=us]+B&Yl7"k={۱gpop2p w ׼ZjF]޶He<׹\c {GdhInʨp{B3#BJGGDKʌ]e3$ fk 88}z,kkD?b!&;V+8[^c:Cy~˂*GT PXגQL?z@ngSr'ʛTw.㤡"HܶI!<9b=ftds2-VLh9>v*un%Bc<Z{I!4lk|Ɉ]Ϫ,pU9]a=b"u(L^?Q bl2 4 Q,; wU=9r#_GS3nARLc 1'&p r>j%΄Ȭw r x׽Q$dx`o8S'BgYo%*Cb=? 'S`W6D`X-QSh XH<WDP!_)`TB>{Ioڵ]D@T໻ɚFLE(pcX=el1 \,0vc#]s2_os9χɾB.Sr58 ! ALʹ˴ &A%ݎ]}[DXeyxmsg0 pZ4.J eńyTq}*»e@aфymC{>W )&SDmL.B}B)<v>נqbktS*0s:x[]x,R8$Lmqē2G5TfQ)\AI[5\(l8Iˢ t4d*ow%ۓĵ!5J(4NqiFΊevwHy{;hObUqjv٭_;O cJv&8Wt3n?lᅘS,BJ~d Om`8pZ,$H.lkW8irr, $iM,{]3;3p݈[TupKYQ3M:m'N~Rl׃m9)`po_I*|P c~*Y4j)ԧ, 'F8C.~one c#rM@ '1@,rQGYIwC_2fKfN/Σ63V_&F~B2ɠzT8yǭ|TNס4lK9ϑ -`t\qY|H}K%?ysbS,a$Ui>Չ>;@+O XèQ0Ӧis@q%Z4X&b_P=FJ0aoх$QMTx>< &% !Ǖ[I6` O*[ #*uh:՞={>wF&{;]Qm\3 rw˄/NVXF8{Ӣ>Pf2*hcMhPţLIߖKVZ=Snw-w jՍMƢj!lrڂh'nPn5AlQبT`ܖjb+j%3.õt};qVNϹ3?'Hh6 E̗W9FЃ9$IEc. h6a,e l SV|zYuzW4ĴȀwLAi(mTآ!JO!Rw@39ҿbL,G%_['"sw*R&%_~nz- ?!̼-bW?ü7|3Ѡ}fUJ,KH/I]9 E;כ`?ms>ukУȅ}~v+jEhjYGz(mz|gˠjݶHgD&aTp5vNZTxnw:`2z/契ߔ)-{::beߑA30'iӚ RK`B0ldɍZTn90"v,֎EvWoRGIE3R(Ԉ7d1$AN3b4u%"Xbq ^$QF*>y\T[$toꛒ sKRJna{J@\7e9݌l6w`Vpsw(H֟~AJ vGHrP-Tsq bx[ kqtfON-%s 0FA(x!; H75)Z՜4XŁx= BQ ]o+@>5V߹7f; %?;ll}>ߨQ NݮO|ε9r;/R憺(|;0;s5K Ёi-F 4~So2B _eݟv* zY3|^6ίA LlxHfV y4>➩7LQV\xVt^Waa`n2&)TMߓ!<3; R goeuF#Э7kc3D}؛7k#- rCFmnkQZ]w%%^.YcgcrϨf0CQuki&&NT.aN%5`Gi:y!5Ne[fURM)9*Jjbh|ή|^+7iDķc~uBݞ"{X7ۉGDK\/v34v}G!:$od-L3DO1bc=ҋEb4sr̪kM oj)^"ʤ-ldY+>>NK-L9H+׼7YIN%P]xMV_oҞ?S*:fatusIkI2:cĐn/DAPB ҵ({Kc-h%柾 l7 XĞԺ+4;PDDN8<ն= ]1uFV* W|t'[`o F6, JaK0Լ ov;^2]_\-tP^[ua2qM1z2[^"e:f;sEoB>ێЯYn" vC?ۍώMNYPz1?az}=S0K/" *m]K7VΖ?$j7y>i9O5gXֶ@b%N҉; i騷 4$,Q@\)Y8 )`Q7b)jj⩆uf?[J?i@0VH3&TLZ2 ,V׌On6)mg8MݲպEO$w ٯ_p1t* \tcv8?$/X#i~W&Eƀ<zBh=>&E(υaDty$}!?Y&zh=i#Gh{ZF>O%sjnYk1 BFb)e(tFdmi^bõ$OM.D7.eG蘊\ U5ag뒏l }mq{h徣TO`>_K$1{7 pI=!9kec1 ڥ(ɣ$]iLK2W%2.~ ơ>Te* T+ VT3m!wr3yaW_@8I!gP"%fFo@5ukѓHIػ0A&( `:%amew2R΋ xJ;TpW+sh9  p-dMLm v_AFGn#YR(&+c}SwVmCz˄BLhhihP[+R}ehûM1HMEtHɬ~XmϽ^p:N"1"i|E}L;E{d'Sdӏ6_EVpExcn<㓢D$VG%ŗS8" }; Z঺ cX}cfP4*hZgQ] 9n*kڹ¤Ad M%\"7MW=ې#n3HK+9x}"Bqw< $_%fLڢ4f˒vEl1٥7XjaJZReP :Ф1cQ[%NݓB*G DHgG!Gp .Y z&'pJyuY XB^"UG4X S{xd6a 䁚&3 :#{J`4jd6b;ol9}S 3dO l]&7aT  i2WCj?n{LIef*>( kb Wh[ͮP-Ӟ Oc,>yᒹjuC@;Gz@ ~eQ4.؀KʝpSi Yvv Iˌ,bbMF"xoGԲ-QU=5YSL b&8^j\0)GSD^v<v+>Q[ lL{08Y@|]Nn _(`Q$ld -0XybkgMuEC$_'t. si=S lC B G/kU#O Vx5}(I#-+VND0PNl_ͭc7 ۈf8oVIKx44ÙVg5tK#y:H7n3dS.mPgk&K v6[N1;|4\#u`;4}: Y\7~p=PVpp? D]o:[͂noR>Ndد7]^o~1 U›mƠѨ\Ab\>tr< wݝEp^=K+cZX~Wo+\i jkR#a=ELu̸Ywja06yf{} >B+l$\>yD&$y|H+2I]aDj$;ڗĕ*$\:5' ^gҸ9K t#ߢ޺;w\ 1G|+;,.Xq!n -^EAF`J?^yxPy:tNqQ;\S+&-R-ʫՂ(OK`9VO ^Tb} ʐ447qg*9CW%F4! sLzK(MЯrS!lm>Zo3#SӊYV y<ȭ6NCFf;"-'Q(fSs: yn:guUqޡи9)>p|tEs: &`K 6_؈i>Yz)ĢHdIyd12ZztmaW lnI.\ I&Ə6# u]0apX`Kx(Γ0a? _Zx w{Nr/N`w3 \ ̈[A TV۪: 1R jG'g%O<՛r\NՀ\-Ce m6eXҳzv>0~b8!sNqf?D D/J5!P?sw:|} `eAȴɆl tn /D9 Kh,амc(ԏ&c` #ElsSw|BeXc;%8th|At:ZNhe.SZA%2z. ]qV'Fä$XS/H`ìEe+(vOo:ܢ^l+(UBVkJҾga05Imߣw$QFW?$$zCq&:K&$$&zѹ=} | vԅzǏg]5|xi&ؼ!KS@)9 ^!Ci6FLs#pN-Q\GeBSfӕ[ '?L}18~é0ThHYB ,&Y!X . rig,1{.kXV_TjboaKpsd%h^FCS\yGKrJM3Jjb(G/⠐ivctD Q'2 Q sxx9`„uGz!3Yfb_JR6CoFׂ49V)n}\C^da4o`|n5Haa>na+24x#DeYnT%P8fθE-|Ͼlk*~"703mgd`ru9F}0A\.;dGO(L؆p}OY9_n.O5:wECIpU^~J`J8&@ҙs^c({3xv RzlR<(Z"t# ڱYp#,G=?6h@VD[oY8Cz38oM'w 5 zm;;,hC(A!IF,;BQA`P ީl^Nst]"BBf{9udGj%#G[ FApQ $lRU:9i'p6;ahYe ZyWTfPQ\D9z&^,"d .~clYDzo]غd=2J4r wAY!upi2 iG~lu,$ު+Ud(MsB`&E: 7 tjThy4|p֖eFy>p' BHfS3c@SX7zZs> 0(XYE v<+nx`R[cJH73I~)b97">̅oM+L]r*j[^(3T#Ϗǥz0cͰ:)zEXaxe0pxi ς2/QLa>hsOMe-[ƬO1% .J>2t.4Z,1@pnYU o`. ƴ-kFy-Nuy> dzCJ{3Rm>}vyu@>Ѕm'fزkZrJ!ӑ?μ<׮j;\CK!}Œ{ixF *o4*)}˕5UHjJbmxUk8+fk'FȐ>4E`{-,~&O򉭛Y+h.Xgq@8閲{%'ODK%ە!m)g3p K$kV*ʟ?qkuDs~]CS;;wt[:sИzc9Cw@*O0|Q 6ӑj2`MH V+05nqL)a@1ڬF5,<˦.<>{/BߏAx.ҽy)T7bUțYCO:}h'"@.ӿ԰_gJ=*U Ӫ@志@{06 dQLo助b|M1zV@Wirr)(O{㲣.Ebs }/] 냄BL!PzIGr$M爕V5PS88A\d9DI. VeVa7? ca* G{^<7bj.F0np6y* =?_*2pa*/7 h-/8(ܽXC`Nv!i0G"&ecrLr@O4ȇ M!t#3ETF5%@'?&T (T8z$mWU$6Aq2<@WJz[GZl"3 K2 =)}ǥk;/ 7ʐ2OVBjlO_~9 WuRJv#"\ʻat`Tt)~YU`ܝAQ͐q hcѪSO6&;ȣϷ)H FwNa2^#EDMͻbjh[.rlŅv-m)\P _T̹Q`vc넉4ZHb ikhNG A  Wz9}]=}邖=9 >״1DD&. #{} +anߚM {d:sA}$T4Fѯ]}}?/=: IHKOzh!0hGHVRf78bz# E^rK1My9nTyVCd9"gk䥎D/z9nO=H6OjY O(I`rDa~7HrɪcAeǿ}JCK Z". hftN`"Pk,wF_a,ICqb?<%&~R[,ܭIv~pFXE/D '[ŎYP2@83=3.vg/<1*@ҦŲ jh[KV$oἻkDN;1}t4CU‰W޲ )09qVMw.o"1ՂkD؆Vsw_fEXGwGmIw\DPnz0} iC-:>qzȆY9FӸڕ:г Dk˜pX(8bah$_\b ; "f:Mc(24+`hwN/0m'K5Zh'Oݞ}hő2Aó܄::?&G4l @,Bپ{,ɗ_ 8K4&P%!m4 Lt!H C>'o0gCaӍ>8 D՟Q /@չ'p"~XŶ7G"uh0Iɩ Ie e;Z&^%{.@4qaU C|h)-R-)7Fq"">4ܐĺ~}>L@nʴ7;c>V!~6 b?֏ ^m?cxк#!XvGao h68oH>;?K{ȗdw7^'مZӁ06 $m+6(Q`SON`L0ص8 of!HYOW[Sr4㾉< Dy" הJ_%1: N?\g9t,ތ遝DŽ U+c6 9QUGB!َj\}KQGVZi2e<$;-M0LWNPD%2H_F=q }Ի_óAg,,oOJDCY>8'3_XdcϤy j;FN5E7R{96#Tyv>Z+p"&08d-}|%,ѐvfϬxtOZ>*?9@=J9&nΟշé׵yųe?νUzu #O*Nv SH&2A:fPG^ږzV 9rز6))3<.YxǣSD#+VO$HAZ^0aQ _IeJfۖ!X-J+9iޗto"`*'qe~NAI Vڪ?׶s 60iCͼLLo$"|iw0o5g%pWk]T)70ص>a OI{(ܠF/= .zYPuΧB3bЙ$go\eNyt%Y =1gnH^@7'clߐOv3 |ku<8+h!FSZ`#jQ̸f3Y4XD P~Ԙ{u`8|-=a3u~muS3_9XD~̆d7Um/ԁyE$&=e!@V'lu [/C32iZg[eLGHilZ^ZW<p<_^c.) yOO 7V~Bsl 6٘pb1HluU{x7( ;"j2ZO *nT=LX0pϓqXvS82dC2wyC@<KWϋG{(Ԃv +ш$>YgW4m^]|Q. Ra 4{&!UQ:xª#9 '=qCVkT䶴j՚Y/K)JQ=[eU~ 8]:dwPK4<2R?%Jfs̝k/WVF*Y: LK,:AI62]'.,8 2r6k"*T(^ɠ* V&k_/eju_=T&xx15Pf|Kx9ٵ]ULg/V^y0Y"la}Ķ{WK1１oQl˴v8C%@5zdj0Q@!Fb|(\0OqC&xF+“sx3VƝP;9Z&Y ͉u bwZ鑁~Vg%xgTBxJ!i7ڞZO?8.E$Z$,>35+3 jFl~keC'M\ZL*x xjx;<2_9õS |̨=J@ʥiCPۿN9ՁBiй]2(fѻnӔRÉx|> Lm]YpE'X["ol4 ܦǤrE'0&QQ`2kg=ٔF;@stXIg I=|)!'W\lj>f)lQuDxY\~Cў\_$&l0I\ b)uEU*b(<ߚ\[Wl.#n{'b/8 =dꐔ}UU)> >Vhؑ/݇05V>K/0>g0Ifm o$mȏuV;Xe'¤6~?٢`aFn[XПjٙ/? ^QĈr8j57i@OڐE&Mtsش ^"&sy;`G[F+<0Æ;W,2P/DCYw;7:Iba}3p9/Xd߯X3Jݗ/6.s=_#oVpOq\Z6ҊԢPC 7R, ͛H=&ym%~)=ww-)00Fe'bjdM  T}ύbٻ/USh4Uo^УTX*S)}f왅0]sm#]HlC3̯^Bi U]Q +`LfH~XT}U]G6lEiP ^P"|s =+E*)j4#Bs3x~yNRaB?lGKƦc-F47?kwLL JDS2b Ų_>Cp2{EŠf)6K4h6E*vv $t#KZst|w$sGܐSٛ7E;.C n0Zjς ]#ݫ3ҭJL6hziЦ0hNx[qI,Gpt}Jphpb4clcц53ѡv.# ־3P`D%8[Fע'W>]B-Fӯh;OH ]Rq>Z1Mt>xCY:yigf0esʻ~.Nf]&&N}xAhDxgI _l۶`5ӕP{(3A05goj:('"".G?3Vv=Y4?,#L= م1-HqSKCX)SGj'"q{T$#c, xKla\bPJ;1c^p F.,Tӏm\kFLc!ޫ8X] @@02ʘL 6w 5O >*Euk" oҥQ?lZVz*|Be+8>o?U`挑RL]@&>.d'/}hBǽ'OM;c1jAO4z#$w/" Zܥ5(GzxF{+8@C  -X@2r>PS}>'yٌ) [^o9&UH_a$] cArjo}H{q敖;qA:^g׍l"X-| svmgI=x#_N#`EZ>❬UЫt s-Qd"dm5R0<~6`v3Ŵe lK=&a͌2A :o3gԋ}WuW ~0`5HvWI-%T܌X8+9ѪbzF,z!0)- D %8-1kRm|v`,2/IѮkIх.rW;>Ӝɐ~IF xY콓zHO?N~> /眙/7c(5#O 8}c&f͸s"Qhr(S .׬ T, ;!֌2b5Y{3OP(XIEu`_bIbaH9bAYz &g_龳[#L6Y:Z˨(ٲ \U&,4*ۗ9[7n#0[( IS7݅{ DЦ8:R {pv;o!ψս`:g8dc  FSpܙŧXZ^ƈV(w'6נFX-PRgZJж-PJ"c q٫DOg)ˆ]EN=& s+H㘌hadre]D:ܶyKKjW g`\6.,deZ?B o*@"Q<CZi':$$ʰ!-{:3 m[%L+ \$v82 ,RJn7i_%}o \}~qe<=pJ|rE(Σ,ilҪ)ҔMD"PKxOHk7愆+|Y/BҕOC TpҰ|DB∦KHݞ"ۙ`XeYi2˅OoTN|'LlwPMNZKFām< !d*>j_tTA qT7I_oE h98MENQ% 3E7c9 qW/ 9=V"cOUkڈ: 8z5!cUldIx'a< lэvr'Dɐ .4RG8R?ٓ~P!=8o"  #&Y8ZLr>w3~(qTۧAg+"}#&>htjJ;XZ Vt= O-ԇAow`3f SZ3h;=9jSm[YoL%хom,m'Q%bCkuUc&W5" *_PITNLa <{;<7=KhiZ2th^4uSCj[-+@+zagؒ5sXɖ #GDec%s|<4%KG]yZWby׊x*Mꗤh@[[6 N9Csh2*_jр'i1~.KJc gSJ򌲗TSU7lĵ/b%b߅Jr;MpiC%9&t-l1p@X4WV}]j(,^*iǣ - U n c͠&g~BMUr26EكH$O,./@%B[MоP 2O=7U "p?;gk? C,) ;m ,49B e2*nѝN(&\Z`0wMO}62 ?=/f:u90! Dڄ% %iBz7л818^k=ڷ2'fPM!0i=:LBТL2<:QN?bF{q04elٖN>aBߟaJSԟ@/E &NPލU=(g2$M%{Etd^s5P Kd;auَѓ,nXOԖD"N]b<ȼ?fu a>P!y;Rvv[@CyՔM8 Fϯl*/LX~e"F:E}3Ź Z(עE^h,|lgaZ :hDliQ{Fr'rЍUKˈFũQ~/~ X2NtSr,YvF}$XX,Is ƹ¼1(NY.0Uq $N|YDG4B߭lWH+lm@d*!svC^ 1`lc/l{)R$v ?6 {!즪@x E J?\ʼnaw5'V꼼HuɎkNf:u$iħ(+Ɖ{ >>Hq$fZ&Frro$^]N{iPbm!"ЀSk&5M8ϻLRi3dd)4u;< EE`"Rmjb8D]uw'xoKǵ%t{$5>eY3[CBвUɟm}m~=q쿂>'4d|SS9ta?Z8,Bל+L}LI&#.Zq0&<‹n ~(.MG;7Md/f)S*cH#,}"sɈh{ > =_'@=m (qoEA)FQPduxb@6W^IH/U"sOJT#0o5 5[l< _[fO]Tʣ|qL,ƫEdoks@pe0n$?q; fL'+tN<-4"u \~ЁLF.youGuzz⡌;/@է 0_dH3ug.4IB,,qR"dY 27 kWHblY)X(|M4[gb}ꀩԩGRFH$}~78c:߻oL_*aޤz1c x?҆YoSDGRLYF3I-W (:5ad[] |u /VU­jsѨFuR ps|9y$K捁JQlcWAqw~Pu Y&ʙi~9J>NU4jC rd 8eE.xht2AGt>&^HX]`; 4J4*Giϊ6w~H%ϰ:1l$T%4B6$g{s1֖ ~_t9U/eVNHd9oVKz:~)NLJG͔N\ܩژvq ;;X֠9;Cz UQ%]5*wFC|R(Ii[J%8G$}\낌_2Z9@Tq};#5.3$2ҝѫaK_tcMYrU.pU# J;d8A;Ox%p5JVϜe'TV5iB+jk';G=ΜQۗNL 9mݳݬzW~BVPi]sUq)25`P(7'Oz͊V4SFV2?ϼ~H! {IDo& Ô g@ܐn@3 &x49%XҞ=pQr-rTX"4Gx#۬7{*&q.NgbO`"%҉UX؀€$}"9w\{"c6LUsQמ܀5dC%=jTDY~ !"l]o{ ][TY6Ճ46 ,ڼ(ᣂdhQg AɄy2zɣM{ӤK0hk0V1@(y9DƊW5H~ N/.vUֺ5\cۀ L!X7Mkh&կdH#kZJ 9E88GӸ򻖑[کzzmn1gw9T(-FO/JPjpkz1]}sQ׋ˑ8l,˟4S|cmn{..+ECQjs uJi'Qpſ:n4Hxm̶4ѨzWɩxE'm챠3.>0@@W(T_&V1o~Yd.>* [=B!⑭Ģ "Dq'ǘI;kp53 l"r_f!t"P֬W$Ua3b!ی @AVmuxV":8]`D!$O 32|u?p=L \KL45uf3V d+$.6GސދwMJu=(KbByk"d1WcHs=)/ ώ70;Q8G~ kt)=QsdwZ"s"Kר:%B^YWlx!L!+aB`] - zUjؑT8W&*xXUDȍi 27(wO|85樉b 'tj[,4+fl fQN;0 x_fu>1{V.?`_T䴪("vizq.(̰1*5?Cd6=4ôdW55׃Nfuە@^GY4϶2Ob|< Bf9WMޭ֬ו*F(V{<<u"\@k:yu$m0Ch"Vp`vH`;ȅL($a[eAgULcA2cүuGHn@պ>=#|Bn\VˁHٛaqWc{UHCEMWDE0Ӆ &K̍,pόMj׾gq^ iCd. =v.uY^)!f/tO"E3 Bg";z*>ad`.7i=B{{"g\u^UPM"Ŕx|(pL~?1)Y\QrW|j#w N! Ip `>L˲}Q|]X Bh^ w2oM﬩}IT":HӅHcȓ/+ F2cc_ _kN# hG#"-{Xiʣ>8f %"C3NvDTj0ޟmCZhw}FBӍ0-^ojomVxFIY{!'#b Ȩf耕Nٸ>MK+5GDWDڇ}}-:*l6?FFI>ۿǙ9YT- _$څCK^vKǾza h\Ҳ@ϼz rk%kTKRruyDa$TZiGg]kTstVH1ڈ/gMx' S D(btG PZBFmbiw V!=M͵u-5$D8-bkPWxJ6i4ȜGd1K9qO" sL`OꞫ~g̨U^c0FYx+Q*`i&xb:63ĺ|xD_hOQUML^$B+sb؂8Ὥ.jnLDsWL5N8lCXܼZ{0(d1V' k} G.#X)X8I<_N8FgU%פNn1^ آ/j)%w`­ Q,pmsHvƼkT ?!JϑVr6qRh$ͤ3vm5ϼp)3ºzIbܭln %z0EEtݜQ(:]_Av}e[4%ٶڃY斻Y= E*ʠ*RoDf;L.%ˁrG:x/PKq:Q!G)޹cM-nlep]1Z\Pntsassr@+?_m c'ǔv`yMNȰv,~lVI sQo&C+@*9=NQ 9]ƀۧP*XK(%­P._f7g(5*Ig;k,hqcҜ-5+ /P|0Mq۠jˑc7A\z`g׆͓oi;.1 KO~nF\s(1TunzV:2 "Rj-(ugU{x\\,_ &[+&b\ Dwk _ɭoQDnSo͞ bNX;lRJQ2y5/XM.QB0n^dl5lCM5#J_2QA VKk=^3gz ifQ[%  ?wAl6ktI6ugWT#̹E]+g>EG2ڀ"q w,q;7飖nT]ʫJΈ̅-`DP'A)ٿjVf)=J7m>l^0VXjl'Cͧ1iHk2N3'D`eAjRre?נG)8Aˮ6!ŶĊ6(%ɲ hjayno&ʩ\$$O[،zU=>YB"25^hEh.Q}C9]5<IJPr/IRm;҂{;bɣԩ1QMm A:>B^1E{+z1wW{Ҏ< ([8X"g.3Sy59QVV{7' ;!E&yjYnvG4. هe1 ֳ# JvQApW?njD$D2cLEʨYJbYg`"c. r(HyZgWO>: סe?jtc,d]MXpcL]pJ g91Ir}\Y.@,ы;{Ym3&4g ު7 l>Z$ښ)D7F8- `=n[f:ӓDɀJfk4l3xԗ Z$v#Lnח̼%k*aW|F=YQUhw=a 8/2E)4X{Q}Y7>?#POCdgݯSL#vR7ܘۖAhu]O<fTGfq:*|гgG2UがC^4eSk%91vX/`P5훧74&syab(1Q-#3K%j|9ћjNI$9?iQG̚*)5 YqBeW;r?n ._Ÿ5e5zNzAH'v^;2g7ơ_e龲nv-Uɐzp(6Vvb ֨kt68ƇuFSR$IMBdrv"s } :=r?E$E@=P @ٱZ}$a&-OaޔpL<'agohTqvV@"rB"lYv[t*QLnL53!# uc >rvBZRCWC@*!VH) Sj,ʨO3U߸FwAjJsxmKE x֛oIr}Z&e%B;N+Ӣj 9ru&cy$R7zxNz9*"B 3梱-ܘy=ӎ,'į3o OD~p6MYJdmc" ;B^FƢ@j|^J$|WdtiLjliݒ](I\T4Fђ!X{ ["$jT8D-OrҌ]N3yUr||Yb0wHf35!7KV`0{[m2LH*\WNQgeJ_XfȻ<(1}d:gd5Y/d߾O`S" TEx輆eY`%g1 _ s>Ob!j]h :]ܠB.gZn)2R̙ v>hՉ:n³ .vBƑ+QaV n/D ^]P aH g녚>1wDنR!V&2kp1ĻӼXB80m]~G3fw}C4X:wiGWADsOJ;PƷ4Ϣ$U|>xբgjs]j}jS nm /WdMy3bGߊ#Q}U߃6>˜T-2]1 Zµ`Rf`Hu]BڣU]\\K ib&MP*[S`(D7fРmT$y5Zۋ_=uYQp'6z{S`늭,V')PU͒tV6)|CID 2ۊ=u[nĆ6Zٽ*NvI\s+IZ)~`m,">WJUdu*^Quˋ94 AA~~86>Mcxp $DK_ 7k4UdhUB9/u=37Di1E?;U]ϐ,SZ{)Ww]vLn ĊnO[:=D>f?aqn0r 9WUG-#F ʀ욈5Z.i8҄`@)DJBoD̅1ƨYV7nxaDty )T49(ϰF{/4WE-`rTI{!xqI7߹*ULy.§6_s LX*Ts#"BQ 4(O<^v]s&ǎÓNKg\!.0J0ݯMc$>[ׇRt\!v,wDU8 P;"Wy@!H K*Z2>S,"妋2]ԉzn? :\>{ s>vCS@VtE֢eĺ>{9jxSwhTb,cb ԜL8wtr&:)8M_eօ"soXznxgsM “ zGE*zoo{K|P;m<"Q;oM 0X{2 ct)(1\4'sи;2< _GV 9<*&.q(MpҜt TbTiWNj?bv)+_ j:&"1[X Fɰ"i>mNʗ. 8JUmg 1 B3e${k):ؠ{lah-6jē_DR;6rm\hV m:4߻҅3ZHۅKS뇦\@4&8k%M3wt,w\mY>1"Tt\4){yY'_4Z #mgB`K(O D߃]"x'_(z dށ}kvATL{ld#O<*?k3K@&wF4;^.4.e>ɻMLƳybFM2^{--?LfoHL%5L$ %sKƕq ~8ROtP>4\lT}d-S` QGʠ>WzN5_ޒ;um؋ )"j}koy !NVs8=3+ÀO`(2l'륲z 4Z kWQmEzXU5Tu|=4spcit.H+_8=\&~nfvi|>ʖP:4&Fj>G5xEs[Q^(UK>'.w dn8)ƿKRb(U5Z:[ofr0 [Pa ;Ӵ;dsu k3LznM}f"Bh0mJ%'񏁽aъEjwn) 23 ,/~OgE+{ٷ%la}(f*Sx["d'硄Qj6gbRs[#ćm&{X혚h0X*D'#FB,¡Jb@E{U4lz2 Ktۨ&˄&MPUXTޙz;1;,MvgFƱ M뤪;dWtAywpaIBgYf=+umda< ʃЪиeYR.x3;btN2q[;$,6^&O]Sv '\|z ; *Cr"~өU8@q"d_\~f n&;(:`lGmFA~ᅀ=!2\]f'0}_*4!ԣk1[\ (wQNYoKz%HC6I!CdhXRZ%*# /l%Gu׌ȎǤ! Ù{"`08LUU,)H!Xz?w@DqȒK"|Q7鏗Kں`TGOTa(PB4ҤlR8!}ikEA91"ծNuը2: eXzDa<L$P e$Mdy 2j@WSdvl$ˆ&ϐ vɔE{W6qn,FVT qۛw r16zPFv[:kv^I.v5~5|RPHaW4uQ w GW]t#9}1瞜u*'kE9"Mj P̮Ҿ;f'͡'rݳApf,3yl+)vtq`lu9 30W@S>56J4A#;p/(nj%8g*ɕ̈́0YIs{SpSD'5$]){tr4zT;}FY 'a1z|Wmclo?M`Ge747Y!qOSd2/ [Yo{pKS3l/&~SvBzg9@`Ix٤aR*VxQ4!WʐpRV\P|" B-w(@y;aU]TsE4bYUMu_7s]1ѐɀ}C* BhĽ !TLK 4(zgs)Ӷoh7ԁ3w6ڛ8*=;Oی,iF Q@2kEiވt!|ߧ Pg:S>/hCbXvlD@G AadQ\UUD lcܳ_ŀ"G_j{!Niɧb$Թ3l)ޚD/AHd+M!/0"RHt;Gة)=VKjۖm'H:U Q׏$Q2,N0]Ma u1J{ƇJ&Wzm^yv&~?bW@~SG9̀xpQk e"Aʑ*}Aze[4xڊΚ,AtYtsI^c%0uP)@dh;7J#ugwXJxӢ С~ !v^@+dKn[yF̈́g5e[a`49uS} +ҋ2iƳ|3P6i]uH+CtUx n!u6$\ T`<:>`S19k.egj廏x㯨ro'rDft]gIqh/'qETb_,;ֹ4[HvО+\fTæcM wRE>,#PwA=s6-a ޾ ģCO U? l(e=y~Vv]p$~+p(Zxwġ^2SwnԔg3Z= U9L㫮*aMA63ÝRb ENig!lP;(emp6:7/~Ua(.n`כ~-&kAW?,4 +IѰ @lQtC+x:I6_/ؤ\V6)P\ϩ~an4T X%yU>vVšD6wD$Ty-X B=u չsB.; sos-z'UOaՑe/'[ "T>N%֐GF!nSyAE~o1-1U-QShJ.6K!e~2^ąϾ/.Or~J6oӮcͿaDRyP 1_("̫HC j'y_5}q%AΒ@YL[&՛i ъ¡6^C`qsVȘ P=Fb  ?tay$pY |fwyWP%]Qd1 Ƈ ͕E3BHQ,A Ț#V2h3U }'!8BTc/ŝ0֐3v*M,}e,7Ы+O3k勺0Nj0!biϡ!QJ̶s滩(_|>eMW}HnǏ S?-#! +WresQ+UC &]n{&cNM fneh>T32Tl2N+Gx#MaYͺtNY*5+wL}k+mguXP&74ll*,:LeΎvL!3uH;tݫYE]Tu?h=xgt@j uu1&khq+<9YYȸ1vcJ9]uV!Sokт/*|o1tע$yC)Hb1Z?kg!7F}:1"r+ٰ {}Hׄr0}*̛w0jP]qSf, ztĩ;\֓V*#w5! 3h(dJ5.Ԍdi UyӐNqЗi땥 -O)Yy ˤ`C߸tHUҞëD=*&sg>gzm#3~B?FDŽ 3 VO ZGr[tEuP͊V[?ߍ)bұG$z&t4d-]jrL ~aE JS7ezWI!6XP 9]_#nn9àIi9=2=>xQ4|1sRLN`ݧ ưO( |8Ba+eot.aI 7_QaY-mp7m{.6+[)7vNH}Y Tud殽zbq ߑhkp#L BntzI&xH.y~dMZ>\0x r\/=_.j Nb YK-Ҭ,Ž"Na2j' H\Vlb/s+w7|)˩ò=}t6BsUspzèӣ<>ГI4qK(Ԫ*؟}Ӯ+i,^[Rú\|2sk&&ZѠBV? Q[ {"H:ЦD"^4y:.\HgHKxڡj\ Q*=zOͣ\< qQscůkZu鬙~G+\Qb ''L:Y|=E@um)珟 6v%2 !Fb!ꑛը۩1 z"1=i*8ff` "50mN$l*837*18P6dܼsPpHaϨoQ:3ܕ Gi C}Lo;x#Mn^и4C̣Gr8#?ؾ#i&s(֒iUQz.43% ݵIGQZڧPV;KǪn"H mX|u<1ui5X"c5@^:z@Ӌ~*-h6ےr*jK 4QN! ÿ¡ER{m"8erEK|8M!j7};R-Se'}aN,aQ0* V(?7 >zxm)׆bYod')ѹb'cXhl[lH #0,ї4|ǰ8<ժ=^kg8S.8|RjI~N<ܭ/+y߅vd"mRW9^8L~ymF}e̺O 2D[16[O 8LbglG#qBwh:5=]?l5rgڍ e?]g h Y\\IQZ]>%IF4Ҧ`~Y?*x)9"37LW %3] t2zs~g Vh1vs|ZUA&\p8թ_ɋ y#בU>^>~ ?z8TV%8=҅~ 2`-eHPT@kH|Njg-A݌=Rl)zl.Jô +N$Z>Sc$ae^}cЩ5z/N==˨J?Dq8ǒ$oyF 6Kc!Z`0)ވ=| Xz-I`ф*\t-KD'G?&MG D lG!DRT=q*)>x4{ً7n+cEwI&wgdYJVaD6*?8 k}+s"%QX3f^ [N1{zuJ>(&d?<"Р*:[E?贪T/5%*Lz$,p1 g!w#y ,/Z6#>_Dw9 mDo`ʚ!] dYpZ.|qT$c=wz R//U"tTv?&|dHw %}\NkvY\\}򂲳_; %#ZH}Rw쉳JOhIx 8ګ^WDj3u2ʏ :Bw*p_! O"@C';Q۷]QǪ. T< r͏^ yP0AL3ZO8ٱPdCg;wvV 2-+b pm?v[!pD>U`\ ;9|Wbyg vᓷtjNxm$bې@s.RM@!7N\G2qUvP'p'KޣrvemzaEgP=?X>k.XB&3<_ #*O7HfS\JG%.{صf(&uP."Ϭ >3o{l'.YpDP#(woC' 7-T8Qh OOb`SBuЬ%hQ lwca:$N@R*P-*ۡfZܫ6 ~p2{x2daﰃetk*Y{'&eTb[`!l Of=zt i/]mGX/CH)幮!{ Dh<^Pj={_'>-BUpw,6MwnZXW65an0)S)I Ã"~};F@`Q0CBt?.{2nFuXv$5ДEVZK'%L0|@06a#J hPKcXb\KFC7gu2_C b4^-R hmHd 96,Y T+5^8f @g(;dRư#f'pϕПȮzU]{,:Sq^Nڊyy :Fv\ڥYj>F{$J]Iuq3~+@4f8,u|ky:߃2F?0 3 z.mӄP\Tԅ~Kb>CZ88uou\V[3+E&MAd'oY~9n^h:BiDeR ޾4"V][b*͗̈H~T'Wَ/VԳQk[]<ءY IN֒PSdx,}뗐E9Ё uԏCi=HcLڢuIzx'bR@+ϒ湌=gǒִȁ]x8dhZ]^~?*gArdZ ;F2`Xp"gu=|85ssL (ϲgp*sVb,;.ˑg’qJxUfɻ3ݬ@c|oķ}'E.Ăwmڞ6aM]z'(Ĭ,K6d#_4CTٮP"&oL݃:YNb6d QY%4QcʩgۻaA xX<]K])oQ@\NgQ*W&ʹyCv*F*7 K ö,pR|e#}G fOf~^ !Ky{$y7G#H<ԸDy-3,MPN &x0[7&cs*K>%D*ɠ;B\ I$yˎwJwjk, +\2FI50'U\HvDABv#YǭPsΜ&{:ZNc#ݎb/!"ԸB *$QSi7IMI9[F{eLFRF<,T[|A8aOI׍ qAz4 (~~;Qag5EZebD_B4$xGXy`b{|$kbTUgu ʫ%Sى$^K8 Y]xNnvgM]B9ἇ4gU9+{ @yKGW̢#]؊Svp+3~5Q7-F) V(g1={aP_%p}*MDvSjAq~U@_<[dbɪ.+5%Z݌dmg+i9 4{CO6=8@{K9ÚbڟqEp_l=bbXO4ۜ̾D2Cx`5x4;C8YL LG3Z0j=FWge?V Ń>M]Ÿ1غ7DiT|4JUX_I}TMTa>5ZBo|"}%%*|A1D5ȘwQ2Uj!+/qEm^kq_g.uӹ^1Qu 8 I}H]9#nv$ߚamO4#14X8ejD`)n©4SR[k\fU 01TT YşMfD~"snАex 5M:LfȨCy ͳ'Jz\D@DۡGD ;Rz*<*Ĩy:50KHUb^=XH?"Uvk2 -U)cF{O4x-ѧUsyֆd[R|EMu I8op?%r aвghڴ3d\ǽ,)S@T[;4(nߤqA!y-&Y.5ξZ@u3TqQvߤ5[ٍq;F4D<FSУtc7EW3|K>:^T5']zx6EǑZt&\{ݜWaQ@tK@Sj @(׌9qeG|"an(/ffC©^DISDCWjGW,ئaH,{N:A$m) xmlɆ̪r^NgőE|56d#fgGfj\zk957tA.R43t]`j =|c[b/jz*[6k0*KKƨ2 "`: YBJSV VDʢ93ڌ2(/sP :9jF9%'p 8 i`w"|S-ǵ'5#w.vL!?;7N)J&][{k7݇kNdtzKNWpSnPL3ݣ=4VzِOr_v$ى^+TB;2!~73;C{٨Պ2ɂrV Xo{8꒿C#x?՞8=*79~2ubqxRG׬*]IjAӢYd(' Q*%y-0ʅ?9b3X=߹Y 5l ġ\ |9 -,?RTz]+rUdͳ+4 6oQsJ_+r@;|t:^U_RA<|Wn=x:wN{QbE=f'H0+,8&[(Vm,C=PeÁӝN tCnPݭIIھms^<&&?w!fJYiQ[u|WsIq󩓚Ƿ*Ic?{?]`X#sLބv?,'jQUQ ]GӆrE~;ÔUCr^b Fzk^zɱN9*C idB*i(Aȩm%7/GZRaRsB%:A1#w]mPabH/goxTQuf8R-PdQ"0tW<^tM5o_hv>)lm4Q _^XBwbD9A؃ڥPùlX*T*l$i; u֯>q u7?;mjKrNq^a^xcZp 7𾊻|6Z%J7z``_xtkëSbsǧA.W  =ށ GwkX5:Mvsy ",D?Jȿf[. ."^sH/8P- i0G1m=w$VӪر߾@XƜ*W{'MTjcmWIt"_x!`J'^‚7Fں# بgYǯA/̸i;$M= +9ECdĕ5߷Zi腎>Zd謤-\ n;͑ygr| l.c֞Fr28ѩeq tPjMJ^jF3^ސW]AagG%:ꂬTLO-r vN_OP&G8ܕѹmưkXg >T?;ՑGumDJv#4 Q u[]bk0Pըq%aP׿Oi_"\ žC{ʁ-xW\ 4~#KhwhO eq:G@&֐2E&+eѓAe8м/y>\Ž)%J`o}>GVkzC1|pmdϟ?8&84K`ԃcT XA $T^Nh>OZJisݗa ́!Tmshd֙Hd{V.r2CkzQ5y\XO>B/4&oJy(H(Ӌ;!ίR_( zzs1|M Ʒ4ǴI0'?JɁQʽhCW;0"h@,of'pǓ4f^]c4ye" 'pJ|gj&ydA:Y1 SM=~n;KkiHޯ~ǍF)'lzcZ@+~teM EbT6 &c)ɞBhc ;<%a݁=xYr=N=*WFN\ % u;>-:g0|t9Oq܎~N@D7Vi[ "s0EVϒ_R39^i" dPJ;,An;#w/ ?f/b řY 2Zu| :+& oئ}ڢJ'8H1vrZ<żY?S-HW}^h De Ni=a=zj>vXzsBzl굵ARƴqƒoLpeFq* J!HB]]XJEH Ѭ79ΓS]"IMS.hfmpfz1 lbhë#b@ kj̞s%_9cM iË~7|ܬ{I۽ H&b)$qYo^:msv蛝؏Qt  +)6^A?Zޓ_gBb$~x` ph-+?IUUXgUEO;{+$=i- )/uBҠ=֡:6#3ʎP==˞;]x_7G @Xǧ^4n9[;DzQgj-x[}ez={РBܘj<.% ϝH~6Ðڒ]P]' C~B&S =a yz[,*u-eSnA*FQ/;e/` ͗jU\$Z@I; &r ύ%6Le[ƝB7>g 7i붮â9>:ܭ7Kƽ!xPn /5G]7K>oo| :1szQ }Io C faC #UFм%@HI$gT=9=yplIGJL5P1vu[F3i᭬ooRc, ^ "#%Ww>R:c;۪|nR4ڊS O]/-`%vF#VK"it^5aV⹷y,B`|,@T!{r4U[~]5 5-% Lfν9y Qm QK \c ˵AE 94@:s,/4^j0$* ^ Gbn aI$Jd /AZ(0*:Уdñ&aPqnPkeW |t+->񈮁|`MI4W# ؙ)*~o|_"3ʈ = iHp)yYWXXWhaf_G⮠Ϣҙ 3ӼBT_d:Wn. xz+ZC¶S1r$2;M/dǸ{1Tt1Nߟ`Nlɣ+XuvkEWBq4 9THUկCi`+zǡK@G#>V;@g.X$ 6Um6؁!L42Mvh\zIkii "JAdVNN5Jk'耴IQ0:9 mۓaCR+"]{hȽM۠r_R5jAnXK}i;i\]LT}h{sy+F@hA'#V~$ :/$ \A@Aƈ9 q׹rP˪6 35_&꾝BKd1jw̪j\Xd ^x(j O6S)b{/}5Q}1l뜚٘X_oE`ɻ|eYpDŢ>2PT]#/]ςMM(/7'ҳzcY H;Z/M~{JSw~Yl4뛽~:6T+˶0#4-`L ~kAvB@g1 lTR $c4(`'Sc;xӪxa@0W4' lDA,!_cy3>"a/J|q4OO&5.(FsS }5Te:_ $[WQCڈ 6X7k RJCoJlNd$dU?|?U;?%֏Tڰ(<" t]6 ,ɵUʓҷ_'I;ߪyptwN33Oّ얠LDOZ"lTTlR7w r8CDG~˱t7HCTz76c'%\Q/pBXVv i%t̤#!\p@U L6Wfɇ^/9_DKFg]ۀd Rn?(#R 2h4RGf], B@O( {4FM[yUW%jr}uv"kr+Ho-Qdcu6"rdJ<8H5\'Kz 4.0q4<Pw~`1@ΊUwĩI*somxWDYyi) , f昍NBa?j" Lc Fs?_ }wr fwslM*&ض ^;iu?9=dw$3}tיmiӓ ph>}#Z15ukٹ˹M*HUe:gnXC}/׆ ƯW/OTD]i:VpkM^xԨ ["A5( $.-E«urM 5i5ͼ($GalQ.µ F_}fŠ0T7[V^ L G9nR]p"*Of1_fŖH娒/AuaYi;$GUБ6؟a]5TJ+A~-ALwd}PgQZ7WOQP*\\e~m #VUxCvZZd`)´hiKk/]Mx%~&rJ;j(dÈV&hWi{{}Jy=TUӑ(8O(VS7[((@ bO@g|N)3]2mzj$s-;`QvcYP{d6"4~jh8 R#GN_V&W4U*̡ܳ h{$$rPr7h=@wxϻ3p0njys!O5@/מ@L_U}ڣGe<hT0XKvOjLR Yp?=8,9U~3QuyCNbw,%)e- l[ΎnUR𺑨c wdۿfXɊq߈_9fxʠZ^_qkI*"@RNc% =ox)tQLxjthc_% vذFN+vIf$5X[v K/8XNBM@.4NvT$3 ֈkk<:h̾ݒ\:u, [g-2nʦV5ߐGJs9Fx 'JK{fTf_rRaf 7[+6\!MI1-QRFMo\?=Ă=t-gΘy :C:*hGbaMhyV6 MTvd-3*aq,=, m_MWsN6_cmMqh4g|cܗB֕\q2n%(1t^䱃͞7&bf`HV4:觉͡;^Rh, c%{)qC'upW )w#-ØDnPoz1zr+iӮ;`aG !oYrE^a{(NRӫ羬 =\EgF7;t5@kwN{!4]H-_},'LW%:|i7AkwLjs0d`kdgLr95Mj_SL+ fA?,Vl)) (W(U=Ua#]JGs>zpwW D忪f g/0t׺=ZDW(^#ٱ{^ æQ :ScQ/]>2׈‚h>`23bWЍuQa޷pĂ!ugDDavx.b |ݮ8(dZRXAYn76`o :vW\oD5:QH2Ε2Zx9Zi2ۻ 퀕7d̊:b>|Vd.p_2o帩oT Gl7Kk1n3xSc?'_tPYmBbO#Ǟ9,q4CĈ;GTFwCx0Xq̲F{%tj(r΂}׋m{Yct̯~N"q/%f47ɅktlJZg3v!h\ +cZLi[[g1.BNs_xn@Oq 4Id }Tz} Yi+|g!Mv2N E7``ǖo|ߺujKK)(UjmG8R' ! _!Ж7/d]%%`dN︗ȆRR! 6Vf9x]h睖B e_!\oEe_-m4l`/}/w>FlJ2kH^J{-DM&C7HhG61Q_rS "з֝ol@W^u/ы 3(I*^6_vj19( ]d-s|X6Cz)+"AW"nD=xrZ;nM^9=kFD=/J ?P(^GP ]gqtth5aTT.Dڒɳw"`Q%_*2C7tɂCH8[5FHC3kFbsBc.* ɮTF*-gė{ꑎ@n??iȣWo&:O`rNũk3QьW 9h8(ޅbqY竑/Zu:4 ݘEewڐD؊mSt5xnHRe~[T.""xd1ŗX.4%YZ`Gk ,6%&i@v_Iq0| ՘ۄߔ{j@%8 PRCJĄD9ɚ7j _I*JZ.z3u㺘>q#vM͙qs<e8g9}l갪^ quvX(6/5-~M \i?uU/iYx4s:Sʸ~slqv|ʖ9\Zn `*ە${u$k;+uuc_/>}y?N;M+)VT5O'ȳ6મK+Db&ۢ=?iRyCLQj w)0Z AixK# Q&IP5T05 2#3kWQhM);@2ٙl`/y q;ί{LҫghP?Ôa Ȑcw1 ?I;YhV%ii,z)OmLpR\3sOj{*e`$ǝaDũn\,0Վ0-OIA픵RӶ=u+2/9m_0>%aa"3sniwħLP'**0. 7sEK 3/4:R5}FC)qiz#Ůcv!i).9g}s?ԻfC}i$qC.rw- TVyg PҨ]ڝz{w`bmwTĜӘw ,0M+Q,Y$8NE_Ǽ$~+SD=r>qLa/F%Hp.DDaI6OR_ޏj p戾 nJZZfϯ_{D̶qڌ"}( ji=1d_ݨkELUrت1ˋaMMlɣmm ra%Q[pwۢ;,6kɴY { jM D?[k/\̾$pI9kΆsJ4Z0'Z0U`y =ƮrW($ec(LbWݐSNs$URFBvR^\n 6̋pᣄ,I,AL9/!\mO)M\UGC5A=ZP29WufAC@=[iu m*8x;eC-p1Rtn"u #}젻*S}ٸn- Ϻ:88+!r#CiV2-v(*< VTZh"ô蹷 Mftf1#9@!cAydaZx"X i'4++DXq@.0Za10)ܮvچ`5MGV%:т4Ҥb n&~S#V7 7tdE('~s+E!H|FQI`uEpgyH*@< ߭Q翠b;iI E[ MB)//hr` GYW՝!c1O,<+mRad[+%)@bZ3]tQ#L&C%m~M*6D=Mu/Y顟`酁iB`tb+O4Pk#%5DUbݤ(XgS|%U%p其B-wXzRk;LXS̢Z`dӚ-j B[hC]u$n~5'gT7^f_q|$]{PsJ>kV-u'g? ~듾0o>xeiEd{^\&LXP(7yTیQ'ˉ {%ءf Mcxt|wʖBeavhŌve#*3HIyu=A|'(thZS%\/\ڇ1OhHw_%V;qk`ǹWգ#tߧ ;iR:c6Ʌe*rBbckD:P n3n59co!4,FT ˗hTˤzdďlK旓 k($| F2 Л%ūYD6eHGg>xuAa\uw ɜWQm)R2Qn2JAEOD,_Ȇ=^re`>M$%y)՚ uaV/}ã>:z {rVgPHRdk״[X;RIR'&[BvJ.9%_;Ig )+|^sw䩣QΗ!S[Af8|UJ=$9sڋVɁBOMw` ݋b(6Wu> TC=\l18ŕMQʾ|$c\^+wʱZrFa&.iD*a#/kF-<2(ݎ]YV]-%5G|kkL Ƞmz\4~0lB°ɈΉ+_N-ɉ0ۺ{sۍ!VvO9r) x0 04%邔w )k\SHrߖtwlGXB辦.u"*oY]*;Ej͜uyXF|N468*STRp%(S2&1N/)8JTQ>@W6& !s )!L Ώ(cVdX2Υgm06Ww_1@=_(kSN]4% P IS!qLg`=>p{+9 ʼnnJH~S@eR,/mXe]潋w>E{J$Llv(Ù^Q\<`_ 2~\^^ O WJ^Yj F>m/[TagW%CGuj$Qu2g 9j ^E+,M9f梪_6`ܚJ@R>z!yr Qʇ],MG̙/ -RE} :"E˩0^,?Zm#oJ굚 / bcq'㦎VYCfu<={; ҘBmd]R~RG >ZM7Xo$o)kzt-U%r񅊸,wJ rVG?$%Ɣ鋌տsh9?EJJ "^x-V-?W+s<|H)ѡ_6b.jgIZc]eS>VиYt'eaiيrr06fqj9s_Ct]>6'V\yݽ/`De5pU(+Q[!H+x 4T Dpu\>Ȁ4O9H+cEJ5 I %A=RMs׽RWP`4x{N e8<y;TC2aSulR"& %`zP9 ºB*Y o^8c@0GT)<u :Ŀ6y|EL(QX'n(@*Р;-=ʨMz4z n 8~(ԯ٠Wͣnc@vy5Y%{ s.P7 rt )uhmaTԫfszlzGߢ;:x*욌px.}gR*W m p"/]O{<9wcb!/G?d}o,%x m`h#7A@|7d=~sp/kgŸ^T ͊hU%`1V#d>pAڕ˼l$w(ρEH,Ռ- af/BI֭1@G5mYR*DMXC3a btecq+SmS) ^芯rI[%X e?G~Rstc@^zE7 a;TGR&ہ -̊p=qjnG08Mr @6O]_!BsBjܽJ$[￮84pzDA>i aU@UJȆJA _ _CK;M>I_wط%w+ _D#rzԿ-c$:Ko/eQt_%BX婝zJݨ~~wlsEϿ%h~Drv!#}_68GHQ{8/dlc:L%4K7.( s7_>ņr`&>Of2۬fX~ƍE 04v옭i#tg!L01C IX!y{*$aU-:ҳ_lГog?1Dyaλ7{J<`*1Y/`8[m~Kv;ns1{5ߦ7O%ߔ62X, +HjH]`[yUTC5&DЫ#{{o- ا1-0KM}u)Wg, NbhPGHjx28&]5(bAwIzY U/GQ b:Hu1 G3~ɁlD#\ :*nfQěև]GVbd"+|j.@&-9'2=4iI[A;;69psnDq6 "iM: 3;F !t&`mmzi圴)4B[}2gi;G ~z33hB{lj똂zL53$c kcm*߶ry'lj/)&\ ~Ϋ*6)g2眭Kr@^uPf23/Z Aņ+%$yrveq]*AAvo3[[݊ fcz#r8soFd,D:O'] M$UKsj*y:C|];%"- dZNGtf`q]/}C#*nNR11wC@SDe@5uCr+Vs|Z QCL ^QKq]WSf<I/Թy®PV6ln 5{ A7fLP=F?@9&%իq~$$RkVtUhU*$ژ)t=.cG{gZN8rTSP+bm[SN]W9Fmh:_.?/KE% jKO`F~~\7&i+ M'Oa]nE XXXKD08@oqϢ񾃺dIѱԼDt\REufө5$@ExNCU^q+O?T,X9fs?7w>Wfq |6D \:?!(^޼] mM#\ch0:vNQ:;"ņaV]jELA9{ $ ~%Գ\k0%Y9]3*|[ҧ@ՔM/S}F$Pcr@.) ۞{HqM[ 8ߖ˴dž}< p׆?؛:)J20pm1T3Rpț7Lһ 0!!D5Ѣ_aa4TRZ.115zrb (==!8egzw$UV~?@K%hx%h=䩧Wᓏ'^o [V+J `аTFx %ԅ 1fSƱ,)}켄i .m jS@αO,_Z2QN}n:'u`;P^(_r/$!RFۊB[*Z}V':tm7pr*PjVϨ0tD[0&6v"MxzxAHq pV7ESȨ$k=1[D5d~H`AP#~]00UcQo>TԽ"<(7 (QTJ^xpYކKu1 gwڪq |䶱pRZCv,7Mh]^CN!wbi;Pv 󔂘̾9M{.o5N:g3itoK+Ϸ%׊5uO |uPS941$>ya$Z:3:0A9=vzVնaz!;h1{p8z;gceׁ5 n72 @t M`Hh*p=,m FqN~6sf462F0E]mEggINt?uV-'7ϱ0.6vfRA<ۖ|&~R~ EI ̠u'fxc^P~;sF^t'QHu~ D 2kOnoWf;Pnx aG9|BYŴcj\ 9G㘑[]F kkeJGv-IVR6\єIEsmyf8k8ʠ6N7]*eXϙnJ_b߃${-צg:G,PeizKS>/)x6ˆ3"BBha>]'7cԔ\@:0wm? 8Y 3/e Z&)vw:7by~JrkuC;νب4Kv}AH[@=+!]f6~ 㙛 I e]p2 VS |'!c6 fĽY-q\;kޗ%hf{sEvsjoR\v4/khc}.ŭAvdF-z $p Q1vJG2KCc\h=`@`f?'*W'ԣ+{ՁrDTza @t6^UK׸1",cnxסh26ZSgH!If&pC6S>R_DTE9`,8jܡazuhdg}cJwv)uTB\2(GC.o$45(UԞ[3U$AIsͷjY)F0[՞ W]oy{gNƦ|Z(\X.o@Y*6N긍M#a@2^#ZC]x}0o kwhrξ-^-c 1qAyeA3k}՗Jʤs "X.N&|+ {ƒS8aHin?vjwbLù *KC]#z;bMuԍ3Le\O=<:4jϧ9m5kR]EyLki$Iu᥼"H]NHDv^uȤY+Yt}]ԍ!tխCfgFU! v0M';8X<Gє]CAٟK GHū3.>%F=|eZZG1 yS$ "L{im̪ ̿rfxT=>K<`=gNȭ:T"Z}!^ppQF>KߪhUoPpm.3`L '/d2kkƯ&!˟~:6aKkT<Hq)R8p8 ;-r '.ju-gceYFOp71*ڻXYD?p&Jb+d #>+rq&!lNh K?#|O ^GĬ5gՐUӖSy)ܪ͑Z񁵞|$!f;nTEGHRU]`s*A)X뵌 ʮ u31ooP ஬+txEp|72"_Y, *k\]="^f %.c#jW`W.^ S6'zP70ׇTK[Uuzr1]ٶ*? D)N N-:iim|cEh a6 (=x w`VԏӖB{94Rh?Zv @+>?RHDthtf,NCG8@6M3$e"ⷻ*쩑 چxayE"1%xFcj;x-cTiCd˳pw{ ?bh53saS1:#B \^qxYؾFyll?~*(,Z8Tƃޱzs:t ԣ< +Q %wpI|='^rv*1S782&INOP!W;{Zu]7e `9\-QZ\X%( l}=>>vsj~_ǎ~˓5 CZvl=gG r[cw:z<XqΙI1pMx4u>#l{W tݴUƂIw w[K Wq4MkԼa .TjT07lEuJ4WVy &pm,l~, gp3%M4y}]h[=c%3o$(u-9ȸF׈ %x`*j֐+In;N)̊~.pM.3?k_#.޽ĩ:} %BE/oLA[v{$=VnŻZ9ԟyyL 5dlNABX틔%r4X PE<]et [4C~3dh;ѼNz'V(m;THy&%8vkj2gP/60=M.'I2#XQ%s7eٺr} JM. /xi.CB.J14BA-ޅil(Q\*KI{^g@h_ :9l'FNӅ [vO~gbHsf[uKn$AFB9H U%w55 k ˛ N5t0XZH΂5_irpp>,S6Ќht94!L-? k$Ozw$jj#wqv)U}!:iVݪIQGfTcjopNI#_11ϵLW[`U%jG]4e>M\h O|n\T`m².]t#o9sz{4[ضm}*udK<|-_ A\k/kq*_%w+@ fe1QW/Ũ ID8/n)X^vcsZa2_(k>쒜]MeIt\Fdj́(XBݑv؁o0U$z5mʶJml~!`zx,Ù-+fB6,3uU²Z,8M,оޙr)K r;th2сgj)j$-4 kǽSw!l!mW(y-1ڋIcX:Jc,=5matvXSeG I %Z'}9mykgJ{N_pPe&PAv%)Z62@AF/@,&W0! pz_bR7ʈzv8@*l9sz@Lptk b)v4 8Ho*|K}DRv\%=*6F nF`Ԫk 2]`q s(bt;_BLl>=XH;m :PZJVGX&0H6CLN>,~2tqmTPY\jbiL_y4m46>grfm rA皚m6D_do(=.RQ unJL43v 䟗 M@[{DR¹\aYzZ)_D[Hp㾺^C\uX6E.U{B==}3q V}-uY8-ohtx;dhB'zL!t5"Jh ;8#W2:U,ҿ綛U80?+Ħ16 /k`CQYRFtrViE4>Z $ޞddR@sXb+J sr"F陆k)|5e^;ELuC!?%Wj#-{34pѓeuuw$G.V-,?"u|.jFt^z_U0SlE8 |gf2U#vjw~]WUoqC2mg˜Zf&czGSکe&Hiu%gf5-d/}irpGsxjQLU y Sgl)z`_SU6uN%.|V^rz< *k_fo0j.Fob C*lj1 lV SlƄ5[XPZN󇣽1uSlbڿ/Cq֬oHѐB 5$ΌO+q:0Qb~lA;~? 0?1Gia0]u%eD;~+‡)<.+Z3(.5mŠocR[ny| +>Z] X;UT{5 7bqӡ⃽n3WiM~“aM =%^D7jukлPb3;B 5lc!PǦ+<%W ({}M0/G%7wt*ʭgK &W܊ 6w؁;\j\g6`^=DU}jV>*{(3;CSCZ4d9xvR#ֿ#4鏎F}D\:daO`=}FTj "ZTǚ9n![hvyOE5đ*>(D&q0E'bֽuH5<3e폛,! 7\z~Sϓ19^XUlY^7*aT3yӄtpuTcW^2yaj!dn^X.(4ϣn g$:#tp4\HB6V}'M?x9޽#`- mHORB8  &G[1BbE7FDeUЃ1ɫG'FcspJ YLS_zV;=sBj{)PЃ'ވ|M̛Sw"]NKtLZy(<;Y~b{chH%N\NkKHDZF^/I,Z57Op.;=t'Li~P w#3=mCn1|FMk ï@d|B.'b>#N KM6P/Ertpӣ6壙8d7YG=ZZ?dH~m! 7veuTd4ڊ?1EGT#϶-&̈́S_lE&~oj)n&ظPb xE_& $ {âb/_*00`pՄjf :G,;FWT6cjE3B昢h {{/T75<4s1#޸ J6h>ZmAW!x }Ms 9,QQ[Uz#<1IeBy '"|(sO4?3\ W--f5kTGYd惔nV! 6lk$ Rd9ά]ݜ3 9ץFor῞L{%?0%җ!iKu۳(YYҡg`M¿j2z>pS:oA+Y81ɚN0Ӧf9Oi#o{.DQb4pã9S޻_GF堣Z)Һ7n<H .2L<'.DtK`'C!ח`DKCGz*ʞPf *gwiׯ*<-׹Dn4YYƔie-Y ^eM4q˩;\" t <⹯]2vm| &h=ϋ4˵wo^d+qxޡ"Us[!$Svl?jߩR]96k|mг`)鈄GLANΞQWl™t![t^%>833rK:Ip~;UKjJdA!=kTָ8+]<} .j *̡baQK)g^{@sɵP-G3*|ZĪ%HͮL+g$-kȝ4= \Psjld) 6J2^Y _v.50s \ӶGf'ߵ)J4ZFAեu$wI+&,M۫|܂y9^1M.KC 1;_,90Z0`Y-<`&܊᩶cv5/wHtH*W=FjdM´'5/'ԔjB)(FݟT]n]3"bKOׅ@%Av.h6=4KSp%="}UDMJDV-8"'u~@<;5ڹwU3>{!ر}!KRi#!n[5*[#1p vyz1)!\x 焀E{6g E8XHsp{_y[[wXuXciD#Ԏex;VԢh˵a&PJbMk8xv0]۴4/Kzg.51*M]j5}YZ#[O"ʬmC[M^jX\ >|Y˦w(jxw-5|_p,'XJ5LhG0Wܠ aY #>v`Iu/-Xȯ83N̍+5` Vbced}8rw!to`0Ay # \=!Q_*r09A^z@Tyr2U=I`SkM)%joҦj4_J*aC\8& $@zm(~GuK!V ?Q@jFbۥmVy9Ȅѭ 3pU>ǚѽ#kV_գ>(@w*!1aLΏ9Mk:պBt{c}tYq$;\,r_Jx~N\ؿѵoЛC~ZhG+yIcqQN ZRbjV%57d<ـ^:w}R}nN"KI>A^?)4GZq+lHD(r5 @KYF,bƛFگiATwCMKX{J޵mӁ5־~j"ܣG-e7U,-yow ,sKގc3yӘ6@|irz6~רN%lq(.Ppv7ǹⅵN]A^ڭr.6|{4E^3`!e+'5h҂8 5Cc:FLΰ?H5i! 1o'<*AzӀXB Gd/IUnі3V1N僬bVہ!uǎL%oY3uf`)/#(iq` q$vĴXMa.:`MVHcrnK9. %Xl6 <8uω/ Ud} 2J/1κ$w#rDyaxRG4ouiat R$#0xИKp;gj-f [.pN/apѴ%Qe\>b*2$ss!N<2(-_sp柅8ex~=m;y2{]ɳ2P0_cݫs[CC &2A@Ik|B*-i<1sJ1 eӇMd?]ԫ%K`4"cF6ӕ.)+˧$%*G6{lkѳ1ɷ6pckXiK>83~ws@~ש]1WD7<TSU&03i,zEnLT!PԆvyԵIpeW;$<x~2@_igJ8H%m1j`ڕ`|nuZ47~p3"0'@*Khq)9'3{1&wbna#?wo6JNŦDe'X{oju5SF6k*bl[mvĮӂ;w:)7)[4Co!x2W[#ٶqGWʠi`܋ $H!l >$9j[M3卐eB=r4MI{ߦCf9 ا5v(];æ8b f6 2Y.Es_e>9*y)!*HUSTZW5ߢp11hI(%YU*\`@3NTЗ?5҅)YwO%I,zkb%8}6}e6JPhܤͼyp9Q(R: ~hy=Tj96r/j^ ʐ( (v*A0*BIG۔;+ b֌gu C\+Kxtr$OMS9/#-ؓU%# pw!*C oڞN^l7b!6+LTB$ ~9D{% F zM"aF2R E^MI(Kz_ƣL!qq,'O ކ&@A8x]hoA4~q' &E0\q0D迊@E3糾Dp|W8ZL%Vo̗x`ܽ$rX[ƄTC//tBU$81X\T}=S.vYkb y `U=qM =[UR -4.M1s>\5D&ҕˑ0Ӄ&WN&S;F'm6F ُ+9]tCFl@r"™n88%6>l.KfLUo'h8T28_&~U򩻉xzYRRQ5|t 7点t&P?C PKq=|Y>v`ZTOQ 8t `?.jop/ܗٌЩS&AUꝁd ZnsL%^ ?La#<+3LT%|sd,1U!7'9pvn3,Y}\<ˉhQ>QىOF/ŹW:NI edūqw#_l膗g kf u*g5ޖ;] w#6Jn' A{ac`_5G]|M#GRE# ՖRYi&kWj?.!.nF,o+\@T‰$|M)#k nh- “u3~ҵ-r9Lԓ<`@_5@*8o#wOy:LY?#/=yٖz!w fS6u:8SKsieq+AMmy"Mo3]32уU}Nuu!# cFԺ"8 F+bZpv֭*R<D]8lII{Tƾ7 $>{i0 y^*zY*iI~f\*Wu<]=]_^;{Ma@W4,"xof8-/o_D|$Lܕu_>*词~_J$,:f"1H0^ɿ/BN Is(1DD<-6bU|uu @aB}8k{%PBʺD[ Eyҿ:,"Qu{tַ.D#7,n*@͗v)w)璜-JW O̒<]>K5Oi@X}V 2R*᥯-l7 bKP$}/.՚8#{KACpvňO8x$cW5aG}=vQ 6Ip|eMŬMpybdޖ ?<d/gD@,2 Cک VcX\.HYW* ΅>j@ %]mE IKLjIZlMlΧŕ^RR]:Y%.Wj i>^+֎(^(lK=}bmң/r,\yF#(D -1Վ&(PGabgy(y(0m(+s#QC.͇d,aQv#V~)rй~0%u’GT^:n*Im]6½oPPf(53Gt)%8,rz{}%;0r̳H93ߕޤ!jIPu2B1 VFLՀmqlnBB N{=h-5iWH5$؋fKUWt,4~ȥbdgϺƛ6۶6)ܞ)(}5kܿyXcJ`crF é2frײ272J*TBXx1Ud K?{&ڂ=i·y94g~7Ʌˍ C˺2`,t Xw񠲊ۧBҬ9;f\]8 }C#=(n9Pi3yYe_GF7ph]7C}ZMo)]{v)YOd#9`sVj;[>8ā5U!լ xeDƳȶ#(YG̔RbI~{0?L1 _#[zCM4Axtd>tiQ{1n}H( ݖBJ/N],s`=*P:xf{Oaي2'$~iS¶36%+M7dF0WFϏ@fNhظ$NK$DaIB(;"%h ޑqha:5hm1x7Bxzdz_O ŝ`'<Z|򕏿Q?iU p*܊d:F6*1ܑSYoZ-ɘ@%ՃEA ',Z:?~<-9^mMWa\dZ`arg.יr%-5[GVatMgu>2FTY,jN7iQKI3VR&WwHyt_Չ?6S183VnKCػXKO+@;2dIRnq5a ?@7O4`0{*8σgnF|TG YiIut΢.żFTYqYXFK'>Rt] #:xg@Gw5*a:^Os<ؑ>65 JSkgL1SŌ'  r$*2 M)\ɲN;3L~ߔ0xFcvT9 S ;n5fe/=U6~x8.* 'YGR.1}jF":eŬ!' QhH\vkocg|@0W:ԈM"T=b_}D8\; F5av3)YiBٞ{|]b|r+ݗJ vj_o$<)<]~ZIQ \u&䔉?‰F0ɼSEC\uxB9Ќa$Eh1m Zk3z8VBp2a>%<?ڱPH3RL~*+%eC}g9l>rwl&#zz}K0LtjrODRk"g3{EJ⿏7h9!Ty,'|v׈CtiQM@{g=jv؜ AKp`xq\s9߾¿_ixh$1 O ЭsTS`n˖\SOO"7ʼn W$5h 㬰Riq)ɎY{d;׽2X,W>$uˮ}#>؃L#DXuނSklp"@҂ꮯi1sSL$m_t1Fr!m+y[U]v)1}@mg͆Tuofㅂ=C'[P&ψ+Y &‘9Laɘ;6YNԽ\ ce!qx9ِd (qZᖞ҄C"z.0d7O1"@FM}  +֦5nk*XZeVVyJjJsR @d]X/xl!( DSr<9;@ŬZwدSs"~'Rv[آL|` ԋ̄z7cWW˴lB_ y/N06DhTms_X\&<||-SEPcp7if\eHf깯8 r{e?K2I{YJ@W8>XM}xxXnu1-HQ;<^@ijF. 8y3EY[%ʊl<5㏥ '1_;O HmS b Oqv  0xV t:I acyL0r=+f;߱uPGJ {8W'vІ-x'H+up4qT9?d/scsXZ̖SO)!x9i]<=-`r E36>!pw=a0+ؔM=?rGrQI!%[dDKΛ٣ʏ7;脊Ɛa:?f63:8jZg)֚u9aNjuut7}kD[)ZjaVC-n`š N2BrDmHb+wts[;e3 AԆAPF8*8ڌ͂ݘ_ăBoGfܿ&!KD[_0]D9w-RE!%L*ǔW2Bima#yDPz\,F7h5eP Nj)iOhmݖg$"dPO*\J_%X :䁫6e d:PE@]d!D;JJ@\jY g( P:),8lrZ,¸Fx渶ѡAp_]^"LLo&j o|qE9E}e  =G%)*pbYs FXM_MjZ-ncADmJyxeB MjkXݫ_8+0( ^->&` TqEq 6a~ׂbZgI>~+0,W!+`{M ߮zj%C0죆6ʂ8DWG^h!0nK`iۡT*(p^ H_z6WFKh"Iz<}/t#,ͮT^3aU6S 0*N6:|kF1b:y /S0p墀UP@x vdxzܷ WY!O/b!36BƐl@ufz5'}}ntK>'ꜽahp pB,}W&JZ>UM_ߌ┻$;̣b ,I*(ۅƎٶp Q-6 gUCe'~Wjzm`֔ t 2G (vM=%XSvs!>[?[xbgH) \ ؀/zPP T,W}q]bMG}V!6b t~d+$ŻaQ(GNoi%E0,P9YxB !_gf [Q 9>/:dJgxBDc iribǜ~\'TTŌ+R4t nEHi{)Y9vXN*pz#]m6q_=[=#C@$!O7wHB[DV'-L9|wkb"&hpUTe[FP(.\M<̼-1dYUZ2B4w}P( Ѐ7N03D@s( wU6>rOqA` [2ϙFܮg&o|Qǐ $=4WE<-`t.}a1Ne57?Z`M 7Dl3 ȫoJ -C<ڶR7^y{2^Hc ҇5_*Feԉ3͊XL$dxmOD$cˇoa3Ѱ(CkL@:ḛ̆E!2ĨO.Q'iOˉ4^(֢WM"E2~EqvZj#~xRR n,\E@oQcOO%IȚJlƹkĎ0z'4"=J~hK,7IpHn:ߊnޠj-jHM/3tlptkZIV^fJ*e0- UNI(*8מ޹{|D!\y^aq(qcieA?iA'/dc&bMO8ϞJ1EjVtHԁ<090wCc|Z5D@nI#U$HQ!_9TX Ws{#9)^.Ho ܟMχ%3ZvJk$d8Ru̱,ss_035x)\RgAUIXH"T')iwEVT0$zJݥvI. | Ap _֡EOEߞ< Mg[)4Q(Qb+[72 z 8יT(a)(HrQ9 b-wS)}#lg25 9 MO[5~wG 1gG͛&m-hB :\fCąNܦV,Td87,'3EBJg73\1m31b7^"e}1wv6BÛ- س hyzZ*˰mlD*}c/+]Ȧmq!MsinOmesa 2M/D #9{>sVdJQyMsb@=lWl[AӞޙra0ilnz2M m(}E}z}a!gY3~]WfY? MoOSJq ;N9%/b |y^? `bjvf5W:,Q|cv^mlLn GB}SR=p.{!XiNWUŦY4dqk6 tP} i9XrD\8"9r87b _&5Q <}'I-w8NǗ+Gv6ֶn΂ԂGyK]iJRei**}rϽmϲ42|·{);$!d4ys 3s'9J]+MOBٗMUרvY?IUzS1BۥX9GhV>H4H` /}}4)x~|FO&5G[ ח@Y@MyiZVdɐJOlѝ%{ۃ2$ӿfBTF;+W: S4v4R=e$vcKJy*+jy]6:u(ƿ>U(Sa[G:O?W9۶:TQh.*h IyN"jU` _,Kǀ U=ӫY^#k/@_\ܻ1rd >}aڀ.@mp0qj5)}.aCylo=zSf.$cf8vw? v%+ <',Mea׉^DziU{fu| :|z?-ߐ5Ƚ<df0Aܲ=5g_X:ɗ@TBd 1[X& 2&%p 䎜Z-#|-t>tsNۚfag tP= ]vOlg\e8i(m^1iɾK./zkqBn贷)12j/*k~2wDm'$h#<.ߋ#_ٓy/~"I?DTU $@x|879~pG~7 ]o)=LY\U/%۟\¹T#ߌ0{/֮(0 vL?<#>vNV%py[{{LtY^Xk'/;;$yjT|V3.^i5i0!Nx1!D1u' 2~v,6q>?=yy*dvXQ%y&)c xv5}ȌmVseF <@vAYa܀`vp 32yt$ JE5nwfn A=NF&UmSK>VG>ƢC}O4[[׬=5P&w~ws5mk%J P={ #(UGMEFᆹw y:O[ε0QabA"ݻ0h$\W.YSCf21rg6>*YsSs #=`vg,X=rdC#4jWX٨(ĝ/Ƅm5Zt\-`I0+H WFE-VVr48VC8Hoy?M5]SZ@:a, CP3mkteܽ"**wؤU^DMңޙ\cx:E!0OH`Ab|w´bs󠿃CY[q4CK><sQ1Mu)۬ߐ<--L Ǘ˭A;\SD`a<Q % 61Uڸs?UkH^x> `8߾R$]>]r7$9#%SP~!PvbFLaA3i㱧hy⯰gGÙ[ l? ^|իc[1nϖ (([ *@co˝H],6?g{hCrV鐨?f~yl/>ߔ^鳴jzka<XQmYY)|ɳ뮡bK4c*/:NO4+g읠oRеx0RZhIxnnf%Uiz+ϛs'^|[Olr|>PGpo5T~V}z)|Z䇹;;gp*W+?:C,ZTq,!HqyzTulçwU5`i ՗wi=pv[OF&e?^L(-@WveQ\,[y#='$]t`kY,Lʨ6Hrw]&K>69w;-(35S?T\@m&E@Ҩ!\oi5ȄZ6*ܤH,4u+bWtBվ)#*:LǮztLEKy{iK)`p dD0#2!ws|^{뤌Ͽ[tk0' `kmU :7l- y,, s+^?ػbHftʔ4s>=?P|g(VSZv vpW)^VETkL&p1qF1Q]i ʹJ2gtp_nAq8r)_GЁMY>7Z'GdYY~G-("4c|Kȹ@Z!fs rmA6NְT} -7`?kϏ.v~DUitPzvnuz գŬw1gHQWN/eTb0P%Ϛ{!iNZwxʯxRz|ڽh/!Nhÿe#yU-.$g/ 3yDHEʦ{EfbU>:gȅ w:,rJN$2MRUCOm) ?§#E _Mω=Ju-7krZ$aЭ6S'A]X0}絲?(,vM=scX?MXͽ l[]c'a;j!,F>\}Kϻn bGcுep{k ]zܥ&NL]  OMkiǫx t`s^kZ g^ ׮@UnvYt!|\=@g㮨WU  TxFmX<]OvS7Nbգx]g6&lDRci'Wg]L6@s,>DQ)Ё/ǃ`r;P/cqL巘Akzu j Vӣk%s>hF: ]"~G7`M'MW#4 /*e8E^84}46%ǟg҂sˤ–I:^aM3Z6a4y_Fǁ< NR7Q g}/E;%҆B|]iFN UA@>J͚c\Ki֨`fn.TMf];ďfL_V`fQ3=b-#z2X"A}0خwr\n.\0qͶ $QFT1yXN.; 1uJYEؓ׳Ptfƅ:(SEӚo۪sp2hX{hx pJ(<׽NLTZ;9~cqp@G'^G[ܛۉ~f0$Nӟ#ְ_imy(!g,5s]G&o!Lme߬Y34_\vǧPL=a#>⤸[$EtAR@7r6y ҴU@1 h^F.6O(H5l-V_.fazMϢ\eSL[~Fž U2T󨗋<<ޑD1%,Y3Cc${!,&l?H24nkޅiyeF8AUm4E*u{b*}(vSJٕ׹>;Qs?DE ՘*kLy =_WCwsPU= jF|,qC^ԢwX#!8E#YUHd-S@LDxOcm]sۙ6\3 /<۵&!Sa%E 1Eiڭ/s6 C7)7}ʞYpJeu1vHF[d"Ir Y}Vr͹1B݀S}h9F1uvV,k6ya4-YJ-xv"蠷#YC(X=_* 7&{Ӌ=/Tiې7s;QIJDރMS={LcjS<зfy5K x]wF+(GEt歪0XN+Hq~(襞WlCroIäTP#dVB ̅I%lMB~r'E$ R%B:9TFi/n_ (JJ২4ȐE䰤v e)|N[߅fߪ_XzȿSx1/6&'c5R[  U\T钷u៉9YuWOE/or-y@BnǺZZ?a]?F]ghoE(pfhAj$JIpTI#/67@__OBXX8 #~[`nB2D$t*Nbz3le^%?&iy-(vj1iѥ˪G0Yh9Q#3[YÿC%;I,cױ# q;K_ً҃#챺NO,Ӡ2|佈{ A5ֺ6ЖFbɀiĂ).-YW2Ð8qrI(Z0"D-M[>^kcE+HׇB+%9(H ή[̧22͍fwPg[/eVJ9` R9_9zqh̡2#lF9w~}TNeJG՗hzʛl HAZ%B%myOM⬷׾򁸚˦:ڽ5h*C>A(=gWY G T׏/:m$eqm #HrQ7I7=OwSj23}Y(&C"gj;n,slRbp='~ hAb-Icwc,lY/nLlf䷆[a  dW#w"%+m`{E\Mw@-[P~7bMN ZY`}ֺL* [2,e!>/MrgXɀ(&kfnm&Ӗ.Vn'W%eLsho'ߘujnZ[;q:*\; \az0kz Mѧ4#Žsͻ6%9Eapvrx CQ{wثk+- pҧuY-XMz*V?R½`Oѵ5ce0л:p0IEj|PIo=0o{kιNGW?@6#οF~5]se2}s#0#|j<Ο,@Z{"Bƽ8K:2R9b!fMKiy۞DŌܻj*F'rd6sv4 m\JNzݭԈ",% _0&V}" H`|ͱ! r7jt-|s`([8r4 \v9}_[.٬r{J#d0#㞝7˗/F\5iYAYulVwرtں)";}j_#vK[,P˿ &Ot}y,ѮOhT t=cSUjw߿}x Lj̇s_~RKjIH#pN)#/ӾEI1TwjÕP-ehC ӡY |[!K$P\FJ*\\;!07|v*,-M2etkb W⠵҉g&[eWN[/[Wc/M>{_ĉRؾW A]ڐ?YJt[/*q,PlDʶ2 !Qi7O#t"_ھ PhL>W #}7fŪGDVsh4wʎMǏ#F> ȅ3q3w^@ƛ^Naʻ;-wiwPb?w?~i-[Eh~^#5|$CrOzxgHs À{~IY e& A]5//g"e6Yd-0͉+xEUF+?,ܥGNl'VFt9m`KCAbJ8~gIig}ZVgImFbPy1\-euh?aL&hZo~#{y Mg"k!eV)5vU-FL6p-ݼ[=.otlstw׆s ]CPҬTs#Kl~)@M -5&2 m~`P"_ֶԪEU ZE  bk(w}ֻzcJ@$˻Fρ WuY3F9-67vOC\t-&ltr? ~rpd'7 2o!.N?xpk+w+ޘ~$B $8Loܨ!\5l%:"Zk8T?s_xMEEAzb$i3(X"&-^2AlL؞HV2x=';9'᪱&ri~) 2p$YՌ"Z ݨ .!vU-d so7aBBbKIs iI Ū250Jځ#؇&Z\]o ē,;uy܃0 0F^NK6J "/s08炞UMdf^P^ϺٞRMUa|Mkn;KlfsP[ QuW;jՂ2贕yE'fo4ɧE/ٟ<ZW?Y^PxNǾ~o zbh-<[nktuLt~KH_gԚsM8eE*=#a}Bu#1 :82烺EZNg)A:҄pm(OrS}p TA A"} 6! $WdTZSe6Z;X^FC\ ߂/V^mV,V¬KK) r줃'N/'l_y@छq0;=c+7%u}U%́=HزCe&o^ïN@^/)OF _j >aLf G^ 1R~Ҕ%ҧfW{Qv j}ź3v,e8L^N#6qX-6漴# " e4jȅr?Q#<{oh!#ěioQXLMT|Ѻ`kh[U5~Lh^rwh]Ub <3|q%(*+ 3sWI"2_KGءh3EWtUkbe)_|.FC^z#431RJ'4DInԒJ(imK]+=FڈI+=2Hm}x1Ʊ }Ie'=8`>[FjXn'g,DZO3/] zK/]U $:#Qy/'q-=na3CYG=7ZXtti F`*RgB{V$t²vb]Q "2w>|\lbPƪC^pѹ ̮FW`8Fv'YɮM1 4O6BN҈:fu`H|3S[wԪcypR/: 5POP\6L=/- Ȉ7Ml=_$VǷ*"\9"qPk`O߸ݤn:Kih CA&5pe'*yߩBNB*<p@nu8eexrƜIŰh{jW~zؐ 3v& gB9#WK5XI@d0'hꖚ%<|ݐ#nn}In?R[l:իQ'u47fAW/ F7C@p$Ͻ۷Ѩ?n PLA; 0ϙ Zma4V``,WH<݊ u[wl%X-6xh\(湰LA|y!݀x SbN)$'7[i ! e]IwaB}θVu Ⱦr&YH]Fc%ܐ2 FKH Uz%nk=cHM7R~,ܜP[EaX3v-Z(m9o2iv% a5jP6.{ZmDjf0 TYߧp qgFgȵV< Z^QG V,'s "y qhx9TJ[H;oJn9`'=e5|Pj^@,/#.ߵX>'*j2r\h9*a[Dg]MNVXO&UՊ 2Gb|\2YLeA"d`XW>)}c#|J H88*?RZb \$ 'Y(g%hC\kÅfq Z7IFzPev ' ]*~/өyQJTZ;q8$h"2jvPPrvSE i͗ec )I!#~͑M} uEkf<$2cr Ft՚_Z]qH}xe~xf9}7w$McAwlgTټGz5K4r.8P\f<30Lta lI]2: KH(#VmG+r.Yif {F^( Pئ㝛o Ê υn7M+qEVR4b~H7:}H.' )2Z#)EҐPe{9+Zz2̃s 7O(g(f7O_BzHᢊ6V?D,ԅ#=6!f<9-ZJ*<YI2]$50%v~Ë#~*sg_bޝ0.$ئ @ط؞sfLZ}I qh,k,mUOwxxJThᏲ;Q|^o!Q =Ew !aQ۞brtc'/VU+dawe0zx~FqCz+|h_OUbˎg~= 7*0+˦ Ĉ b˸)YĦwbќ\^^x _(w.<#kUץst/nعƔ Qoie GF\i=uqnub^̒Sogoڵ(}/mfס&B\:'prwQ>r~X1%fB:ƺUg BC.玧mM V}{!o̬N!AAIJ"):U/*?_EAI#?\ N",aTK_pˇgxG8Ks )j 5mJ.zYM3%_~ `YrY2"#$7:a%$])e PvrsCp,,]9r# 'G0\ǒ^,=}{^ gS}PUA-L-obf{וJuJSk8.j{€Rn~ ba՚Vd ›-08̟3>4S(ϩ(?*^tڹ4.nP}^7);nѪT|tg)Jx|Sb_ymUbl  | ƟJɵQvZSDZR"[9T*QXLih]3ë#~nryy+lLqI[S`_1)E q5URz\OvP2W|McJ ӅznSiXf-`J Ǘ&e۾P Fy}3?mT6qb򬛷{k_#qrD&=VS SfL$?܃>0E,c]pSt hdz.ϔVUkM!IiDVs>t#daqh8~XQj \7W+L\j.91O0.R λs"nUlEVb:^fpO4Q;qg*Gev+1 1d>3t2~n6yXo{S޵u l)dߪk +zB88ty!Ad烙͒Y* JMϜЭ&n׊OO4iGZX췴B|=)zp?cLQF aS^V&[OهVM{IAVMFf^QO\CKBoszuRM$T t2rp;U}q2gyg{Gzs>8,51Sno:F6t֔@'݈zQ _aIk}EIN͋jW>U蚐KƲw939AoU~POIUg "CqhR΀% 28ŮiyIKQTωr qDEbM^H}Wh3Gn7|`P!SRc ܼ_px8Z6@X%c}~h8hn t˄,4vXχo~ h٧LjۀE\ADzaHW~W >7R\ЕW1h‚kO վ1Pi]`c:=>#`F XVKgkK"jk-^fmܺ| iK c]l5Knތq{w4o᭭4ԕkp;`΁,ڎb!+O&ꄢ Y^a:+bejg. TϮ>} D}K>C%Npf?ah<.$-Z {"|e8PXu߲4@LlrMS> iLomRKɷQ| [Ud6NϬ ]8H-v |ܦO3d{seC' SF|(k߿b&,͗3@2mTB>" tf]IZN?F@)VGlJ3z3@H 0b#gFUC5˵}5osL9], i N3| X :~=9&J3DLJLm~5]vзiL.p3iUD{zݹxxܺ#e26SI&bR*rqDSNd/_`ԯ._J|Pͤ([Zj/N+ը\#X2 &9Un,);ZHD TlH SOHkP&tس'2Tqn1?îU8ӶѲ5NcشKK_G'a btkfO_>qjDՁ8sඒǕ"oPKP੾7S8> G6mi^n,~3ĖoCS7t!GEe}uM]QzF Eەא)٘aIN+$xEҠ r[!jD0w]}Fni8J$Ew'S(!J gxa(JP`se6Wf PrtXޫ(p-zcyvہlt"%r;Rx A~ o2uQzպO'v/B]Olp|t`\`|jȒN7ٕMi'vŻ8Q}=]'` 0EEڂեbD<6'7 ia5N{=4phLeck%]Rx8rexH,+a FN3W cǃ&W"&V|׭ܚ7 NŝGBWhM2=W(|x1R{4VSs!LVqƽP ) x]2}k17l tC)oti)LU,7#R"{/{mқJ~d+aP4zsMmPQ ;(\#iv|L(f1 =^EzP~ d5E8u0߸d]։N+OblIE EHair#t8QwUyd b/EAqGhѧVjVJȦI۞EыZ( )h&[f6M&YEˍ[K߅9EmI3Wyڡ՜R W\~֧<15S:8Sf,ztĪoׯbgPPo,NSZsBF-/jZ;+jL#.KǼXpBt=Ь42.4yW0vsU3vϑR̗:n_A!g/s.YٚJL!/ 5ϔKoEzl0RPZ/ L+ t+tӌ{_8BWˆ8"wH\Jf}At;RR>pcy#SQ0ns -=,lW>(nќ-V31Hq=pVm%OS$JպPD&_a=* 1;>ȍv$ {3BָnKtPYwq=X 2Ӈk z"x}%9 #]^+ذmIԁW5H.oPMT̙@HM(Jw;EP7\vk-wiy$AfGۃnkY\agJȄuC~~r'*X/wnF4SB[dzYT[Vݖ$ Z%d7}G\L,k>j`26 $*qќn{of <So$]GPLy{ŬoOVK&-˺`CFM4Q(ӫVӤu g:Ɛ o'Y1jk ^uA ")tvZ}HU  dKN1Zx,1b/2 ŞxR4{ hu@}޽W + : %N|f LܠNTf6;U`At~Ř#XU ǜvޫ5 u:ܜs੾|MhS1} .ю:UOL10͵/ ~n{t St@Y3Vv_5R/5Go ![Do}vŶ#d6l3LTl>{Kv5IѢW3nztJw"|A)__J-DuM`ºBNh* F߳Oz^[3V=-]rj@+S>6f`iZQĦ8E}7X|Z[(3]2;1E.ִt&ɪـ8-<"YH UfS57!@ g#x+轏% .0Y֊.qH7Mxɤv9AtYrN'be#jZ7[b!c|DQU,X罳<6G 0M$bC 'nRX5X}ųP1uUx u%c"zP8"ApneEvFN`ݧŷj'ߚ#1;UOJ9l"ja?J`|ZdGÍU]:ŸPs%uD!!XãݜdPԮ>" ,B_A{Uhm̺wW~ao; &*R/&?on9X1 ڴVׄghmٴ.pwxjjWjD2|f֟Ǔq7RrlSnhq*V~ʨ9a_O(жH6l!kNәl-Jp'sw6FGvdiA? ΛIＨr(%M>'*0\K`BUNBK#B &qRG ?u= :atkxfK {!yxf.פ8o9~/)ֲ} ]g! [축$7X}uS{1Z?{q> `Á~ \cm*6)6.-8-b( I0u1wtPE/wI,Nj'8+Kj#w莃Up\T[U}*[CF|}&.*kOJU6ő `4tfAY$_vf F(}"{tZg-CJ}(l! cA GZO(ɸD2Fq (;y+7t(^[SҢ6O"K$Cx}RKX;Is(SiezUz{DEc6v 箺N(.+F8 <%,?׌1Ot:sI{;8fNI4ueÅvW}j ' ѩ?j&Ac [kKWHj(Xo¬@C3Jݻ Jn#:%39׆w53yCY5CzY6s+lӖ#c:(<؝\⮾B c݂D냙x UeV!c,pc|x-ERr:Xq?>LzM$&$A:KOpp i$ܫ?}N,]YŖVi ^τYGF Qy\`Zt)Mԯf*Cj0r?u0uȊ#5/3'8լ "1Q|Ucj4(ZrDk|b,o+O]Jx"hɐ6h<= nT@ޝ>EU;~j̫(Ԍ9ڙ{g3y`28bTȩ7EU> nP+23gS>iuj/N5W[.@>h:^OЪHk~VAU5eS\Bdyߏʟ ‘T =U:E4HD:CSnaYbjRǷ AG$@4%mIseY 2`+x$ӟߛh%N3.c^+\ ]2sLEQboL-t46䉮V%D@ lؙ.]C|ذCu.U옴4ɶiӠ{!HXA^03TPRuGt^>KEiSKxy3F! tY@[+x n Jͫ8eR)ɿ-/#u^V/?m`/D6PRdwJjUa K*9z+z869 ZJpB:N~ \>pX?0rL;~`OZJj…)XR~.F6 iocsQ2X>q$==ءn#6r*p0n'& dj^Eϐijy0{FIrm,AV,.f0`3ЍęѪ..V e,waˮ*J؀8x#ڟӤO 2g.i7MmwA 'F4bGܲ)1#gV;X] 1 4_oQxnGtQ=4+ P<YU,_-yj?>Ñئ[UMXJՄ7H ѹחda,0l-Ei?a,=?g:4%^=|I tnZ]?F:Y,9[glo~fzO!h|Wh$;[˞SQ3Ahp-6WXYot'%U?rr80ԙւ8JSߌ53oZ4Asjk~Ы4lA/lW+y,?/@` oJrqӆC ~#(>g= e-.[T[4=ŔTu;)H U<xvUY[Vua|YY,2F 9MlRNNNvExCO¶o놬@=V5jYDe¶V <2:lj{^>֜J)gk͓TÒ NcRp,m=ܹ$4QD -+􇰮-%[CPkFp'h;6)-53#枃 q/{+ f%8-8֧_]'k&3էvhXܥ YKǂmظ%jun_haޠq[~a/5.4,/7 4$mJr =0bۻGe*p eӎ:W^ֲ3?/? ¤p5 hJ!n>-G7_{Z̒Ahq/%{2|ښb-*:Wؼ}—x,NC3J^Wz w~@-#ٓj'aS=g2R9`4Qv3W#ӵO˧H^[m̙{ȄLӅ+3w9\0^kSi[3™SKÙO7k 2:j2j D\톼c[MmV 7+vttAJg B@G}$ Bt#+@Mv;ʯ9|3dtNjK(ʎ@nnnl+˞ AnNHoj$ƣ?CoB%5^@3Ÿnҡױێ9|GGsJirTx%O$ow *f۠9'ա23$?2c[zT Nęq( F_>6^2]uw6juY{GN}x.M7n`aho+^h>>ydEIj lܱ"!:2l MJ dHx8#%iOv]Sqrqʲ 8Aw`30kmTGrZ=q=p2zjښ:oIF'XeL\0ux_aqowM:1LУ)oV&</BƤulߑ܍Gt롤=eUC֜*,5Ю,@ 1dj2r˽\Չ-g!ߖOCCnotI a#w\|,wԖ1/#6ۇ0)g .$H::KxҧZ@4@ Gtjf +}4>~ˏ•7e5\Llytؗvu6Rkp6f*iLD&KuLypl$5aN5C~mV{qm/kQ\ O)b uE(/H/.e2Rw!7qKUJeDgѼs S55chv%LSͨ`X/^^lM˜XPf|;P5ﱻ?ϋDdNuG%)O ٌs׭n7 !Я`.]6T.Fm]C1y=e-)A#@B3ĂN&]39G7×_ð[ۧ]nt B[ .*v8IQo%.G Yl5<8OE%hErհ;}&ÖfB16uUh.kDJ@un0)]samY:4DzSmG֫gw‹ O4`NS|֔ .%jm`{w06_dž'_۬Q%!TfL%g]+jw=cO\lq¹b3amm9{$F`׉p'.+1ʅ4 ı?~T_f--2ƏO$o﷓M&`w,2I按i/?9zxU3͍#8]2Pp{pO5gۯaQr] ,\qv*^".HvOc.Ѣu"|cpt+`UO(i2{lSO^QUS~FA:_ ^>gV&73ǾZAAZ[@ξ2GDJ@)nɳfUAsZsg荢yV$&*&& &;:h͆1/fGJw,ތM ) $OK"4ltxج %(M&]*zjߝ x=][YUߛB2HPca&Ph.&{Ɠ  y6TcUaDu k1{~P't b=g86.#9"F lԶ pc=W Yg{+,Oi1?t" Qlķ|$>RUzM4p/)~5]^ ,2nRRI=Խs+YJV%ڻ\Gqɽjz!' =Q xE7ckeY*؎'pש(.+6X Efo˗yfƐqD`K֋#n''i񕾳Q&_ Pr-9:挰zx~6B/t M~-mCr띈^ӧ~JWomLn[ m0C٦Cܥz"9Q[9T]j?ѥڣPҩ)W0YkZUGWoHS6^wsC2wq̓q;&PV_yj~rk*6q~VOZx['Ir%Q==c-X'˾)ʽQ~dR JLtJ"v7I%б Qo9q* nQ֛F1i7 >8RY%wX]oLxtf1_VvzL@&ȌHb'3w}9,CrfmXG_SY}k'' ]>m6`Ъ;so;8C9+ C Os7F]Rz1ܻ]/EWa_-LI-)=l1x Iퟑ凌38!CSAXizo܇*frԖj8=^&/5Gf>H'%z&-W"ZjC{ti4$:ꮦlfjNC˸s;j|d8:ôkT8;̛tWx>u|@@)7Lw%ꛠ`+#RJ E[cLéݦ*iH,^rM߬ёEK$40EQR,d_꽰&e|{T,,V*-䪈p ҌrZ$=tF4?eQk*hۮ`"ڞuajIyʗGN7u[(Ͱi`F6^n6ivVs q`":HG)Nx1|Kg ˧PxE<}i&YYG6,` j(ʽZ3Q2%/'zǵ:xC&cuK=}kT)+?CT_GC*= MP02'Hq/_"oMأI?H{_*YyDLOs}ua 0U\< re-:z #v?ih1o!T91 Bm Qb0O[Qd9-!'lqPh9j% kmycp5A8M]E8 )s' Y.-3K],AtrX,uj&" {@hI!mߦvvR@Q쓠vcu/l4]djcuE.u=&ɬ`)=bmo}L5X9/\fX]"әol[ڔ$cp9췋тg)WOƁ;bÕ%(K X9QjqdQ(&[ln)aNI F<󃴀UYL ElΊ0dm7S*bC7yhXlP:*r@P4~]u)@W3m=&1pNn/Rd j2%+eL8Wϻ^mJ/Ei!){IHd[ՇD߉bjxX5^` 5+#qw\0+ Q 6ˍr ěaS5@^f#~-V?9TҚʉ<`ĸޭ)Vhb!aE,d 86Utf\8,-Pjل;dnBRM&[z4ت8}Mm4ԦE]6YS]!AœVʄ!IZE']` OW*XSD߉>Kg-o8%YnnP0 В>;Uu^pW`h(j?G>[= jn$<=G'4d C?=raz`IͶB^ҥUA'dY)F5΃Qo>U~m1,.;o",zzGM'3c퀵-˳x̱;[)qb0-pR(/5r8TxY1 r`9T \|x+ɰ1#~h0zA839 }럆^$c`u@Ð~ɧ|uyGj7C.< yh8'vCΣDҋ)Vsqf*^AFToW*eZ ,> zQHHe ]aF D!=`b~{nS J6if9271GϘBo)To݈$tm! u fB\{H9bd;t;A5tz2ICAxbTwbrCHD(5r¯ɱ5USh.Gk|?)WwHr1BzhȓZR {`EWKgU|~\-zA {, +7; OI 4zjՖD*$20 p"dEJt%n\ Wݩ]ND'ЩE-ĚEHK3sʩouW;bS#}NsQꙴzeH0 J7Vt$9'NE_BϜ;kjd *`XC[!s¨}` I.,MPzaiљ? 7"PZ&ߵXO+J4u-5\elo 5@,瘩$FvTe#XAr{0-[ (84!#wٓmOlg9P!>kiC^їQ>*vEJ*ų>$|-7`[JFqYһ@GJry -7`Oϧh>ǵ9H ]*RN$tT3f?M|1,c9c;X Ê\*7D0'k ZO=IY-}FӳFyB3Pu푠8gO@f*U) N5 >Ohć#9yJIB:]O#8;B0S2PB`$gMH`Ҽ[ tf_a= ϳ䦵_*~ljoHHPkaM>&\xL^>  'fab|e9AkI$RBֈ7a)ך'e0"*d4C4pb}:a>&/;ǐx.:7L8LmWr6Yioo,!INEˆ &v0.[ l~k3t@) MOl9bx#U49N4v X.O'CTX~Ϥp #U={kdiK?+s cQJIH(!6 a͙}̉OG܇b%o~lWl/+V} eSLpiXIJrCR #ʛ?; 9Cɣv%rV3o|T*c0"\3mj&17= ]k_ 3MV-Ocs)?eyp ->#~͇끚_~\TM^>[Kg>#%8E"?Ccc\NɈ:9,b&|B>,Ua4vQ.lSd'x \ؽ" 97>yh˭g>? 6VôaϤ?wQ:'>{KBѥ͛2g}RYs6.GḪ̂vMx扑 [XQ=0# #m;2.qz Z $ۡᐞ &$#)V26tJFb"-j61G f߯@eN*R&j S:X b'`^{ܼ٭U+" ,]u5;$Tl]Tҭ lTLQֻ3,ERb AלmQT6k\7aAJne΄Y7;OCDx3JcIWqE#OCf 4k|WJ0t $a1җVN$v-7{cJ6+.^&udR^dJ]L$6]bt@יR`ن>ٛ&`"^UAˊS8MN'x뎒4vgxr p/ݓ$M7>atauğ3=c+} W " a2 vt0P,Mu YBmA$ ]rc|zr crN OK0(Eֽar\ID4:G^`).R]*/$8"!oߏ&U I@#{:@*OթB.?Ȇg =O;~_@,'_U֙KI-Qw΄N(oz]<ډkd7ڛu奲z%}MHFE>By)Z-֚[=;M[W-O v{VO[\Q1|ۯh$$@a.3)Fl2grGd&% !Cb,e^, *VX' ʜBgxW;ǿqEC'?ukv=%3~*!M$ϡ;qCF!7ts ֆ`(Dl-vYϧcᦙN8WM^s:J04=%9!,#+S AO扁e0 cZSO[v5?d4;36w=ZԶVJ:y \J^.Z/% Y3L<CHDZyaB>X zܦm39 iXLQ /Ӳ&GE%w}m} ,{%Y'nWLc2(kԁ_>G$?h {bEK KK [c5 <Ҡ$ &՛ ~"[ f S%8uJbLL>) :A\ɔ5E-@;?iͰ&_Qֶzaa  c (n1htgI_IބG`,8锿[5TުrAJ9ZRBbojgLdbhȰu\Q˜m~5O I'}I_;Tb_)p}$+ Ё \C¢ yw=q"%sVTIl`<蛑N{PccZ&}P׌y^}E+ƗPD)EDdw jbw3 xo\028$UFmB jl ˉ $ꄒKDq:rTH)u.7 O/pЙ(PLV\Rm}sV+$k׳gy9uIB_浼Mw}nAj{m,Ks,soY{@]E%>˹`KPV+v [˧o_uA?Vkz:sD2 +s2;ם~qQhx(jP. 4/ȆXSb BKHNk$dGVvX?宬ɿ޷u~]6,0pEӾz%LGYv;/`ךSo$?GǼ~Y'c ӟ1EI,3<9Z'r2sH~+6tWv=,mIux?EJ@`pX[czAͬ{KIX~ +lSuj"tőaA:/dzLCi'߅nqj+7K)9 ϧM'suUQJX|K^?|E^១r~rmf'< '|a/ Y("0VDya$WGȼ] gc@m% y&z6(=LhuuQ˙˽N;3.|:-XZ#B5$0!Y+ةTe>'#e'l6One) ZR pE4M[4{PPf@m4ԙJQS7\w1$ǫJj7;S?qrnrAEV1eKjOJdG񨪴PLO}<(0#<.BWW ^iB9SNK6~LFj xXyK6s{7ºEPhݐRD&=b:$9J&8@擙؀@D:>F QxXU,YJQc~tRgivFG3&oMxG.3"BNruV^ZQU5xGOh;q0**h ?6zT2*&i khPpPs3 ROF_BZ85.^9hqsX&8/vb>DV ̬BLLcEnפvQXG"9(4дz׎)qTUiNdSUPG\1n/B8}z<])-5EEq(7ZH2*( Q3{#P?A%p~s*; -␞`#ܵKN9!yY}< - g ِ9kt\a,>7KfQn:e\Gp!ٛ2;k:KӉú˳[_vf^Z2,ZyQ!ؚLC v'MBb*ڍFPP_%\:VgH+1T%+_zox3n}ܛ=c 9E1r.ҢwppծV`"H^7K5}*J5t" Wtū@IUB-F⭕`i&"V[S RrJ8ɟI*|RpԜtZ(7KZ82֫f ̞i. LNŰ=+8 6lq5ٻq[I7'o*=G(qO{7$uY {-"a0rhb U\g8q2=\i'2g_T|j-V][`3b} Y9k[eW/f 9H%Pq ~nM)/2hʓ(.zJ(!XreąF>BhkWB+7%"FdB* u`ݣmytp\쮀*xq ٠mxV{i~(R4&xZ/Ϙ2%jM£&"oǠoxmlu0[1檷ޝEϲFXeX_ nѤEQ=c6'B oV{FT㒺>Y-zsTv!FzYRĚ|rwЪzV¤{A!"3d),. s65)F9pRYY(mF },S,Tk {@ 2gODluD@L@!\dga2f2 ?|ۤ I/|^^WxZf`U"'ҙ`)J;ܟ\! Fӷ$ˏ;g`i/&#@I;h8ě{̷> x ?Qh[M_!aSo4e vp=(hJ=+ϒ[%O).0qkr+v\P9xy?rd{sͭ2@UZ!x WCAb.iPǂ9N&O6X%'C}_iv3oo|M,+@z4=+0QBbu~-HȞm%o\So0HKa<x)묩٧b9`D~n!A"Ӧ ǭXmb*^LŶW7poZ)b chtR&?^sA5R;R,LܒWs\9.|pgSG-qv1n24.^ݸ4࿼r~;X oBl62d?Kɕ>\dCq`Ocژ4[:: "|VEGgа'z/!!4qx,&SLO[qw4 M粖!:dNiL~/Qgdw5U ŕ_x" Zx{و᳧mU|*˛%lUUzB)`Ϊ: )-,ݞFKfRb9M n2F?,1~I*sF1g<,SOVjz[-gSͲoŕ7%b6'y ?{x WĶ{ {CǑ+1i&.6?<(ݴp 2[v2s֭LyWy[`ƛ,oc[*+OadV۝h ܥh#,{:nf2!`$>%HDi_]6ѹۼFS38΢8F>: *3vTs;w# @;Kf@'7}N ZdL Wax!4dٵnσfZm,$˨#\S@5Znn-/IOJiPpTb6&sy /e#Fn=rvg: FO$wf]W>''_ ,d]ۗ?^=`ipz٤sOD>\hiwCoiS.tF3TbLˬG,-͍˅ֈo`q7қk-5̾6(2{2o%tHq7|zS ܹR9$?o$c. (I&as>|s&סq\_xWl|l$jjnN(||?Cb$*4lGDNH|\Oc%}ɵL+ckzB"Е-;m?fR$թ,X%%(dh@[JD[P5PWƠWj&ӯ cqvЀr)A~լ! ^>N%Zؖ1c~27&ϋzڔ]uv|+}\ƅ-5{ HswT?"7=6#^e`sy=THP%.L3ڸD IB׸1[;CBcʘlFk8j!])"ϭ|rE0 ڗV ݚegV*xf(] ?IQ~ja\8"2iF ,B^6ߦrSL/un25jhnsE77*{pY :zMι@R(&lo"lDr '_7uvwKKH: K[9e1ϘM^.6 aǃ4̴ _u'…ZDvxU8s8ٮxNj*V#VUd‹HʌfcV]Jz3 Eruvs\,Q*!!6^:Ggº # d ,Sc|p-[*my] ~TN@y4"WvMJ$.S#P}`S}']DecS_&8 (|y03,y2߱ff7MW:9DRZhn_ZCG:ip)WD,G˪+ly "OzAZAEn. .u=Ŭ [xb}]4ֵֻ4iL>`4 o[%e`^ mxݲHRc.<1!ec-촉g8X11M`Zn@ѬUCl}G3FiBU-P o#R]ucdv h2 y#qSwxxMIyQ \-a)ds+D$<^7{PWPa`ϸ8yF_i>&&H+|CGs>T5A<|7~+oF %@vBՑ)8^ Bv }̬D#\FAvt"4i7I)I'525 c~VJz bP9R;YcKz4嗈 hZv-taG]aڟLi4 #IH_N^? Ȉ/ߕn|Ĵp#l?3ĜZs-2xlHG^n&w[Ezq#hԶmfaB؎86}qX 詋*ztzOK@hL/LcaP71i,c'8ݑh#&R*Sud*s\(Jsm 8~>a 5bo+j)Zf$~dCbc4/#V2J̆+"?ׂLe #v3_ =4,\S0Vm۫d!1";hU7-MIl9װa3mnZx^cPWBh"nFS,0K; 0 pI_B+hhDMiwI8Da[R/[BXrV}QD? %kgzccp-.y,Y^7w 'WVYX W9{cl:tmX:'yɰFRaecla>꧂.GIEa |n_r-Hmȵj?@lوB=3o|lqP-*JHS#q!{W/u" V;@;r5͕33xN||A$,UDQsP,K347! ]k{P t,n4ӼAT\w9Jiݻcu=KC,Ũ3δuW}鶔')8#`;yy엻nwYtgt7j8L~tVTM|a?}8%^as&ɳ=[[´e$n0vTnkۛbV,U7싩e#•DZZʹIBjraP{c'j JIcMx@ܑ1[chзvPuz qTs7$^fN󠓝"tb*vP@a'׀aͻ|ȗ)3v>xdB{fႾEG;aK#Gf0rP `Ga?CbIbCiX8FH* =PV>S51W7 yE E&2|\LN#'p-L,>~yVb3 wġi/lMmhSI|яM;.J63MLi&ڳ,a>8Aʝ3Own9 ~"K8={/ nljhoNbs_%lfuêsH^WN?(u>_᚝T#qEEqgu7MBիl_ mQuroǑEbd +h )V> x|eS%ڌqg@V#S13wbW0PI~mORE]I8[KtQS/oU&щhت,A}QI$zV7/?/@M5s~/܎7Y<̋A/0U|{pͭN%W0`_os#nkUc.,}y|aY1R%D.yf4?fq8Ӯ·BwV;'YA.OMWgó|$u$Eį+yC,PzX#x"匇H­c?7R2*|ePtϮjm-!&J)hf\ (ŵor? OJ.J +&PPΞD߆{!$l3ڿ4RdFZ;hv%2bΓrl/1zwWZ;3۴I|Q"t3EGAq]йq{Q\Y7HX HBd^y7RπQt-7q/{xk?Vʵh@T:@0?,tΟX@*+t Թ^(O=Ezm>䶐SԳsC^*8ǠgdԪ.8!F!}oկNBp1;&~:\=U{MdVjc$LARU. =1˾p$sr;]w%]9 w9Po< [RbYA:}F5w4CZ|=F ^K}p#_{=Cbi9Q5\ܤqo:@̲\eщ #N=zb "SWII=֝ K6ͮElNQ Sk-O)Gr ?spFZF{ڷv~^h}.S |6KI?VbB[eRy$u1U.<8Ep~YQBO/<:&f_ݖW'>Q> $!8VXb:DSAN2>7>('*cb#7p쨅ar N7za!HQ,4NXs:+k ܀[?Y~MWpK kU]mDxijB%P b 6" cx"ycbp$ Q2:eė+%K[G YTb/{pdTN 6 ȋR{WM^ U]*/..h&܇C%2Y{BJxo!+C&QXZrUo%Mob& |q*45~XbKN;yL+;o6wr̭l]8~f^ mR~L;υL:q9UddyUTN21S|$Xoca,bg]C@noXÍy@|fqggImT~a/Fria]RHsC̪J{:ֲh%pp"586In/- (m؛;2f8Rۣqq  [/4`h{3-W}'[ѡWj=(ŭWܵLHhyT[iZ]t5N6QVHjfRqG>p|eoq .y B8}-l($-Vzv/ Bc|*τC"r%wP^DG)'prKU4^i8=gxyw*:~2@g}Ӯ6.jCЊe -S9@bYz3o',iwyKAFżЎn36ܪPo\`s? ?!9{z*zUxh1xzѳ\RKvAbv#8,.{=Y5?{?Y"ɂ60ӣT{缆PIeIO:63PV*,bрL]e,SޓV@cmNr>7ԟ(-u> 8L"4${n#&*bp,]r>P&D _[;N]"m򻽱p|h&^kچH$$Ԥ pTc݊ȹpbNJ*Ua $ހIY88qٳYRe?mOC-Bg~pAT r8ʏـUis9Yϟ\tXiw=zPOwOl3}ZzwUKojy+NYN[fzD.gMytsǂp 8 UW=фh`ZkAHջaɜva9Z[XOmpYߧٗ3pƮgw4X>ČG_1Ehu׈~KN̳@XRd Colt;-ɟC;mTQtC;È=F;Ӿjk{IE,r;1 U,evNcYʑۥv|QLl260Sk?gHUUQ'_) 94"IΎ̗2jfm&UeST=|kz}KC%lDYi濄l;ڳm0)^w0j}][EpB9p||3LhkfSҫPɻޯNאoy̚Z)d Xb Z~"l:BK;?u/&(C"m锲?2$>nY==E Q)d(hJy9)z)ն&rv}w)6qMF觧vIq0Y BcQt+`dهʏQpYūӝ`bݩoߥ tLg_w`[+>/[&]tಹpp%m;;*`HԹݥD6u4ܮm4jUqkZ8VTs ~uB#9%%3eY0A dw`czuL$&󡪺3&]gv⤎*PUBLp%OKCqWj,|~0Y`}ϽniLXl&=_\i ziNImMr},5P5!hc;?4R"616 pK(_VJwI * ek9, ު4cjlH*FɐP ZND8^w7Qi7vow"&s8;}l3cX Hxl×_  :R.ّfK}z $St|q߁!a2t\ߣ ɓWgP2E +/2#Jo,?.q;Ř~4rc)".vq?!uWF!6UL-Q :c+q3d6ENiY2~fpvUYlI#n-)-%%cd Eoc^D>|fV_enʇ5FߧvN_xڗ_ƚh)H? {PQ}T ~Jt /2.$V1U>o5M%r/>5<&!6f::UNLP6\+N=b$Ch*vNJqU*￫rl75GS?Q3eߨ%+_۱Ļj.NW<449d'!T]&:BJp{E*N;fmX)O {ڱU'keJЕ+8jpǖm-4 3o&Y w>Ccʆ)sw-N+@mTUdn j爗n39`|ڨKq[Re^a}f9wb3> P}D7Ib <=JX䗷P9ֿcl0fB#<K(v\sC[|؞a|s&?q) /A:蓣$9L!:CN uӶ]K?>5S8n 'TZ/pPw"cT٫gN%89ET. *pSo[R Gk|"Ӌh Cm7jHPh(JMSQlrի@TWo՗5 d$.j~O:p@z9mq=3KceL#|ܠ[Y5wI̟4H~ =wTm. :IB]VЃF2+omGJXX$V_eZ.j58>FV oO!~ڏFX#%5@0tfkr/ÉXP)isx/Qhe2B;[C5ԧ9`=PAqmc R_`0~קbCqhQ62q\ 5[Sl=dPu(Fz%Mthr7U韣4רrGAӞvJFX7̒ip ?6t8z0ФP6\7JI>'D!_^݅׳2tC/=68tjlkB4: `&rMÅ˔FwN;AMwYo Z@!a3aQGC"! ?ޫkJ!ER(OV܋ì!~rd:'ς$^G\zyX$fܶ1~2`fcox(a)E: !L]) L@R-9,c*8?1ՙO'̴} O^c˕M((iUr<b;g>`Tl iٕoU #USa lMX "4u)I^2K$_r܍nQ 'ji4GD o{󥾐0-K"+`v+KcP ]u-L?m 0vˆK.;r/G87KSKeDCzVǛ5)=8 d:.B,9V~H}J惀F]2J0f3憰z*oEuK/f8g-cm*7u ~=ɛj%С@$!ZcGĜ)N};=ގ?72 nrBQ8mY%3C/I{B!,P.*+؆E83^0jWeڧ28mmYTg8qeo2  j~#{,膙{~G`FPKس\'ev  [Ej؀DѶӪ4MWPfs'~{Wm=(? IуC^`.^ |!\8D ʂX+Ea#vQM0Ǘcf.QLqzÞ^apk^B -Tߢֈ^&TO؃׼ΉxTeeP1jNNr2׀k|\$KIJ TmFh?e&8g[w9]+"[p/ )]C;[zn-ZȎ!.ø J @9lBi/dſ.sG)?+K E~BƢD3|j|&ʋ5Fnay:tz_ÙKY-n$*{oS] fьϗKhh!!4"y79tibk 'D?VO?p%O`T2nMQ%0Ujl㡉 ߵUj;kIuk*pяпGΒPyFBzpY& J# rGo=M]dcQL2>B$p*Ž[Nq?> TW0GKw5#|[5p- p_ZӫbQ¿<o*>8_<=j*IVZ)W%Yj^mWWch$?V0Nnd"WJ-e[c . gAΓl 2ƴRdL`2Y:gAgK\/ HFkq2)m01E7{v|EJ25qze[=O4PHpeЯZ} <b`) ϐ{dDե|*?&.ΝQ;y`Ooyr9)%nd7۫wBbaMoJMs@+3?Lڧk5Tۖ3 ٶfTsK')^~{\s7PYf+iɪrb9ncQIL_2RXxK01+eHs.>X&I5)*HJvXҤ H%9c7)0ސҽ )z6a`Z>װc2.}/6?%,vH. u{# Pq@Lʷa႒T9z0B-zQbHtDY \v:ifMAksˣ+z)W=y\$^jW}Ct 'aF{sK̈́Uq%펐C82pc~^"-c;<׸}&оthF:1̲[%5&RȻX fD.VD,dSyN璹"@b!)/ M?OIސ ː#l[-, <7<%eF#h66z+SEͦK; Z#-m=P2dHBs<^G5>kD }LP9Hߦ UeR(h*NWjW/@@KBnIT+n9}"X EJBmFM,?IQnP.qBR4Ȏ-42B'\呱ƽ)XfPVct2햧Bw[Dޭ"3$S+ݘzgnU_:0߂嬣RP !q-3o69' lB֤T\S^G:x@J0 #4wJio]0ȄI8\&_YL7(rB5pjjtӌcFnHIj\&^!mt[@3W ÝI6CM2u؛Y̹][?Kw9fX&^0t5"SmDWJ/zh ҔɣzQLZzE "@ACT L!VI[５w xgpN,Ŷqg쓿F`f2M˲¿4"+f9Sɳ3M1qƑȧ-=E)YQ$ۮEӑGwlOiuoiڞO,Tb+rgSe,]wɂUA| )w;Ta@Ѽ38hFV-a鸶8ϋgD]gTBRҺKq)]p9Bl C` ݹA*h-PuRYW6qlwDZa:T?敢*>Vup {[I^"_1wW6Ͱ).Ǡ{v%,9MK:k `!Cn\ྍY TI9XTSɪhJ_bxXcgT)j7;9\=-gvH e2Uqt{mr&jwCwKِG#'ߕr)IUj@3J&>DU@O43Lk7\VXڍnٟe)=.h:.JW*_9gp*Ez3lٜFQuu ~r*X>?>p+ ~At/y@Qq6|!80(=:/IJv|K<~+{s&sf{`.He LVpLǤ#uLthVT 7LR^ Zs160JlNCħw]K5F%z2Nh,fύI H0jejp$ E8'E'F"*~BɆ (5 HƳ2?[BS -HeFd_O9f叶l? %*a5t|:B[")E޶$Nbj$AaBeGC]._" "5])vu3 oKs)8MTK&DE?z}zuAhCpdz Vmd,4V(bQ-9?\EcܐU~d_v͘E6H0Rn4Hp$}3vT}!$e8+sؚy˩SAzY J]`MkE<,j|:RgT5JK|N)Ā|ŰyQ;sSt'QDbS5*}1U햭4Z@!b.jeI9&To@#B,z>ɿՁH.XȂqUo{ p F(^|d3T dMoff%nNsi"-PH =ѵ:Hr19^MMB`|^ʇs~<ԛK`3 }@"`L$[WROP #tG!0?OXhW?,jfE\ Mu?2x HpPe'|(~=m7u,ZLO5g{t}?4HRb Z[c Yz H1UaYzU3Ӥ;ABJM~;QJB].~'i+{99pĹ>(x L[A&yvO&tQ27?H.p(FM,F *$eN\Y 6XXC:{|F m η&zUI hMV^"0iU_눹sw bd>0l43IxU AIlm6a1چGRNaGzǗfPﲲ~+r<%)W'&gvN-pM]kgL!pKPtvJ" I tK_92,png|Ei;MX»KCDUsO,N ,Gw);eOӮٙm%QvT~~~lG[[{McVF ="p>UbtehvΠCwe7G mZqi7'j Ɲ߭x ֺSliB򀇖tciẘL;)K5DСɩ-88ȃ xs`v.Z%ԶrҨtSw}T*# ``Cg.jK*e T˻Ue@|_~qr1%h?0 !G5[\Azh!21=4Z9M+'~)E5'g}/hoMppA=rE8QQ:KώrŕsM?^bڒHT9GhѦnfþu-S dEm%~NOQG5&fg8EW@!U%lc{AĤֆ[+x-`ՆEO&MW/ʲ/2uk1h 6{9fXdL ~t- G}NwgIWh_T>P Ks&ݪ`$k75 ~G5Ge$l2{Х+C Co?Uc)ɰ[UV*Լ" % HNY\>f1b%Ct2+UNrÔ@`W"4F| "mY4iolޣvZ\`SAرk45,OW!lsGKZ~rnG'+_Bv?.{jF]F2cEC1}ՠ "CReI"P7)N9ᗕKk-ѣ"޽>-M Kk6#Sn}˛cm? t\Ź3$̄E' ŤW[x×V/Vʛ:ESY$ф!}`MoZKA=Z?=5/tLJ\ ĈD+v%^y5uؘAD>NR'MӎcZYv9h#yoGHCE(uq[?gkepdUMQ@AN] 6$ߜG4΢5RЬQa4"\,(vq"E^ ;,׫bvxצ~^<6h- <4mD˄^C.+h/?e-ITgnV1D̋ CiL&-mcc}aK`Orm^ck'8*"ɷa^?N|.˭}.yNkrʊ9kNhq 6n[>Ii@Ƥܐmm"ѝ e"hk$f'EvX{Jꦵ} lHÐcߦcgkɓ'ߚbB.¡^7*r4`cEN"U^)_ p4}˘nS֍ɦ]x'Y&!Da%L_}М|8P;178 wN=vg'*+jT[h-PkեOCm\, P@h8؄T#֨X&Alۮunxi!V|I-u0 {T'g}y"KG \*0 A;e%f=nڹ%G]]d- o9;tD*ԔۀX]UP mV )PpM*vU˔YߔT'.=ƓFb e8X!Έbe?pY>rSu!dU{8~ BT,5w!3\xf s %Nw77ؕw>U,y{?; ~GP0 x{x^erӘq]$dEMɘ}%~y|񭕐#DDsb=Վȱn/35rɶІ pRGr :їv*dǹiv%hے1(*[iMI!t_xCY8ᕈ()r,x7m bc5q dbp_rx|xZB+<-*fWC5[^PB~7T@Ov{|wD_KN +ʲC>wiZ{AXcD?wb{Eh@R>ˈ lj/ +iבFPsʔuuI-ntG‹o]X )Z`TаdFW:O9_z?> mo`Jh_]D(iI M9e澝b:( &fT*ߟ a h\L]t"Ee骧ZOƞy<\D_`^+IKa'QifR 4]u]q̽ZO˯Kϼcetּ R5ݛg"e ^!%ޗ,33_q!`WiԾ#2{gKVT:=˶mhn'@!jE?kӦDXnaub_Y :kMrb):x $:>Fq-3E4 CüvW(4gCϠC[3%g>5p'ﯺǷאZHly,p^&ezy0-i>ֽ*|\T26u[IQ^JøC\M֡ LBZfWN]LZx̿85?Hcef퇆 mq)% Pw4iک֣f(qjR_HZqZYe~L?AjWRw@TWk1-o}Q t-+h)vFDsu9cWP0=V)3S;W(d\  ݦt7C]0DMoȿ}~j΍Q:\o %bGNKYY-J޽xP1+56$x,wOjBr,>\eb\x8#J &{&~y0`#/ؤlfoCӣ `Nۄ*(.)9Z5ĀNj3B! cUjI`gsDH[=fN$7KS0} *ˇnTj1UO :Q5܅cr`sC}3_8]YgAsxȟ"V)$+VVedV*"MHZ#Y"Pjꉙ!XZ䛽604ĩ@Hg?Nb"s#/N;E8r*T,W{9}[S^HJyJ @hWc2~6\/ô3ȿ?pڨWsG]Yrnv.^Jo-- ?R~ˁ"%6vbԑS)(]9 l`xr~ZyzEcNӖ]\-cj G/pRL lcx (19'm3)/tLaA6 i_gիhdda=Et;Zc6w‘*W=WM3_&EQLmfU(o??psX%R}w9.T0m&&Ol6vقh&jONd@Fxu i37 zahwֽ0&SR(X6<=^JgA_ߊ ߘ|xPb);=yVqqDȢp# bEG [Jy)hL?6p?gj/,&r"pO t6Յ #8GXT=SHHbobX&$ oK]O>ݎe𶲹<᫇凕K(!TnIJ@ sz,Zݨ%tlOHHd.EFF`KbT?߽ccjx8H,+0[*9̕0̓ϰ h 8?B-e>6Ғh'/Vvѱi w$F!>T;7iF>#V{xRtW r% ѳ xkuDh5k]-}N5n4.6-s:l>^itgu2cG!/lTG9jI/+ tnnK|1.gqЧH+ o7BK9Uv.hŶP@FN{'hW( 3/ Q]NEI AWo%w>rVwӠ/K%]}t9iOv k xn;, YzM$@q%W Z߻fVXEr `d3^MHl&F|,OE,zbVKQY[@DyH. j:2*,89X֩j@6NRFr.0*M)K/jGvQGbsӉ&=7n>Ҩr'p"z i\ԍ÷^6G@:u ƘnKX{l!C]*iBċeXW ӝ| 7$M(8FLKG>{sP*M~s,+X<|u,kkZ`+l#f?a,}48q`ιmݦ 2[Jꋆ悻˩A+h$7֫ EGvww-oVӻԜPa( ~א[kB!1XƾESB:.7*\^ g8DrW'S "'11/"\94d n6ZݧɥJl +w[sȢH! |j3k8suu_D\$D`Ȟp.*_hh! @5/Wwފ9 N|2Z.`lvZ4Mw?Kx*Ԣ՞9E+`F%,1%3 scQ$)(;FcF=-Lq"Qݘ$ymO7Z ^éhWe tѾ !P4 zsӝ$@/(5ʇ4߼GE4D.|=O)ᅛQ5%xIв"*(l+WZ A-AGvqx _foҭu+U8I=U}!m߬E(VJȍnssGi <~Bk,~qs^ 8O9g.ĄYw e$^v#^VE}WriTH,t !6O:(E;!g;|kZ!=$c|(ֽ]MeΊ)%Z('icƬ5K'</ryүodI( p<_7{a 4d/me1DnW?W9^]䫬$t-Fݵ n%[jV'^wO%A-lL$`/- rQƎqj xJW(Oª^Rvś3&rtaBJh:aC%<.\KB.\9Ĺwn)GG VY-F?<AmwU?|NgujZ&v+BiƤ[c_B1-~'k-8=8-n cؔc+ARTl>`pPaBޯMHʜ6ՃWLVҤ61ߋ*qd]Yڤ9pZDt[5dgO_U %IsrJ~/lT ⦱Dž̀o U*h,!<|mytv -7ɢ.F.tbS ƁMkH jU_d%qGd(e6(-*03?LWquu4(""T>_vV#*]2m`֮:OSP$)ڡmtoX:D#A}ɗ; n ~1\w~: $E]wo_DhG̮3'ɛAA,`NMbG=I *$}Fɖj,8Phj$,X]V0K$7b̀va41g+[g /o"H}y ;g,ddcEbAPc4vBww.IiWԔI*Ott!و) _KX*ƗԔb ^(>H[GP2g`k%CɁW `ЊYX+8<}A{IdG#]tofxk&I|0fZ@uǓOWʡD=<{{piN/B `xR,;V)"`㙊 xy8^ΈTZpH}XF= "sܺOq 1 ,Ȩ1m>Dz ک96F\U)~{cNV~1ND3mE\NI/"QxLG9Q)5u4t}wV pE1;/<1bCM;,|cĘXK[Ah>Y{|5}'(>Ջ꧹ MAQǮҔU{ c6'#)MA)3x i$/0m5VCɴ 8w-dNӟU'doK9GUA#ثu8;v㗲Йdg%7![!?,aFϸ܈#Jg56;0 JF_- {ITMjI[qoo{MZnSNB}WWГV J0,cu~V ɳ|1Mvo{ǥ0zBd2XUfet_aٱm# ?BBDů%ڸ~Sށ |œrjrGc5?Dx(]޻RհLM&;DX.B!Qc!;BM*OR ЭpTD2%B35ʚ x  xY~p%oiM4P'+iE]§t&N$%Qfc~2r@B{a2Z*cKCzIY6MZ?썝kkbUnJ !~c] ?w.&*б7.ӈ`^% "hLB{jbj;NwPl(U~n[Chaj-{ w ?O؀8d26 nگOqhSz/CM򈝢h{[+8A }nlD#z[5 r<8}syyp8JYqUCK)Hp,S:렙$&H@'LiϽ֝U0o-̍UWºdA >~Kˌ-p)4~>B'u-Vi%Lf.S׻lNf6 {i`N[AXȈL 2"\\`^; !@)4EckF&#@77貊F63KɊ/DU¤'8GZBҎnl_<>Tϯ|9Cÿv 1e#|ѡvJfs{y "n&D\;kFFO5ԥu A߼s<@)-pp@۟Lų^IeLyX28F qb<=]/񎥬wmuڝ"/Sbq[cIģ7B,E*1ӻBQBJ8^OX(G"0TϬ]"]K0זG[Cg;l5_#dTˇR=:1-4i9coZΤ4:!]s"3m]C_MbX賟JGHCDFG$vϬhZ<=+VclWR`89CInBs\GhGK!a֋B2CN`_/MdߐhGHTO&w˩J5[kbcH:|29Z bht=y[RֺSvbI3Pm"/VWfP!Ё!HGSXq(K<Ri`MN0Q/WXWoeM*JiS&60'ʆmyJ93$'-RS q12d~3|n,~K}AtnH&$_׽M^Z3&xA㟎Ϧ&q8vM=ln-+D /iԐGWnrE;!)m+=ER{jy{p<ikKrY6IҢOV[nzZA~>f5©m3%IӬүU:bW2r4,-h)k& $ZTq$.7to`X /8bw%Dr?M{e=98S MDvZ}jIrv-2PY;ԇsg F,gN *q[&.ُ/}Ǣmt|Ave=B%o켧%l9~P}3}57fO{JHȐV2uKMdU<(,:F ̑_s)x' % 20/3UvEWð&0G RRi3R{aߟN9e&tRJ'& ZC@{,r?/hy|܅ NLg1٥hZ\»О0ηWMY?c$((@I`LsH}ieN6C5 <]֮`Uhx?B8/-鹸x9myI_vK 8o*! ~@yOA&X JbiR=H bqD_.hNTDw>vaQٶ0n߹zSx^VYϭP]0>M8,m+.9gKbH+h4~;=pXX-o ػ#'؜ ahNAz-Rqi=xb.wv%6KgKÎ/Xf ?Z^YMQ],]y<# w!^طqu)s!?8/DXr)nܹ8{з6fQio] ->S@,+P%bb' .Ǎ֎m_+WI7xDo" m{NzUAY)sxDqwS 7ZC)) fL Zko^4OD9r0"]a45mؖ6n7N{*{.IO>ebC&or/VPk d%h&t^թH8.bBo2mVQ`fcb>0Ktj7e'vh'O(*̾>܍;H!຦Y[~i ia~3 U e),h3V>jm1Yl4"oG2Zo'upV^ɧAgUNTށX\Lmڰ 9c %2cGԵx5Y(pwԛ:_͈"$dU+IpN!!K^DI︲cfD 2[v.n'VhLY-$e,rI;:}>/|Zp2~/!ŕMJ*_NTCM'ab1g\/r+fQOQio1A<)$yf-nvʨ+7hD"_Txv|tx0`.K*{_nj k"ES 4 ^حXLawW$1=ok*`&*iR(a` 2mx8,\ڗ-E YY7 0p׬׊ړڭz̆ɟqQԘ/ӯwxt0{/gM.ybwoZbzs@*Y щS)ZZ' E&ep^TkƁ#c!Dt+ ̄Ԋad?<  A/AM.sB); Ј~[M/Kz3ó-fۼ>McBEZ߰k4"`ϼFxI>#Iԩ®:)Gu"7mf51ef#ż"fAIT Ij@ w$A\"xعf]w~SX4B2B6,WLe@gHK̐-Yz$Hq|B?!(#oKCGlJ943A(JDvGEOup6F39η.Zݩ'Tc1]mmE;+}*:i \t hD {ED8 <:Lf`x^6R a娊~j[K4}\m^FZ $tؠA%Ks%r(KtӨ?NI#:hA mD<XMx*枟]ʮzdF1w[yj^,p,&*"4,"9&%>G$kmP[:e'&w'n;+#ݝ4\0\aK uJXHwJNiػN90jf{)(ߖ)E$f)ֽy.+q<;f'(yW-2C9]yyx eo9N4CjBR|޻d+~ mM,D3/9_;⹙jU@95("v uQ#^Q0? ^K\R˺NLF3cp+'rj!`*e%Ymib?cUܳEL) DG4M3Xug cj`mQC)i&cN?3\Ն> Ԡ$0TeCB:U]R= $dO=^@wŠ;u"r,>@a=1Q*4IoWv2r nx[T:z/ N,Wg=CI92P(YCV4D3FPՔrV@E+]EW)p1#WE=|o..{fsѫ)lRb3a4?X Pٟ`ܞNP{[296쎬Za8?+YeS'xc.d(m;|X^YP$.;3YA"/6-V `0f GR9vF:q7wN$^j D΀>?~;>N7T ]cM2aP(^{ AM8X׹ 6ՈQc;gp+H,诈Z[?A&=?< X;wu]$.yO re-㼓ўea>0O8J|`缺,#E\-K# oWx 5S}8QbMer| ҝOce)Y1~*L䅓39}& fiU( 8HOntBlx{yYuE@ aw9e5'wfXBC|)bԣЧH3cش0?@5'oJfåDoOX(o <^x)+|w5Jcn *kT;+frO+=fF؍Bnb{Cէ1DAټ]\Ф cbŠx9'+{"LP9cl_E^&@Iǵ#'*f (!* "jſݣ=,'VKrqH1 y =I]DAep(%,!qԸ IO L-0 76m9s 9/uW?Wyƭ@G?k]#}2 adiHC(vɥyI9RZcP&C -8˖480}[5vRϱ }oGȡP)`6E_ӧ$j4$ `ΘAf oE߅ZBF5WpjWnoRtt}w׬0#`0f*^M'T=_Gik) B;*P!)Eh5AR1*$ȬjN#ǚzsb6gA5t5U?sa(f`ZlcG|y g5"5̋Fl6 H]U^28ܽ1d:^El}JC$z0?[_+?@HD5,%&}j68 fU8˳|f}b#?YOclg(tuY44RL LcENw ִ5r4A:΅`YxhvwČ]]P[{3M@xr+wkFN7y$=3"ߨooY]_eX^]i|~܆XM-BFh֪04k^F,S,|IQyw-f/}wVMvr(~L/R:{Ơ39Ԕd&1؀vu,dm"a3ӇKQv8("m#rL6qLt.sY!屍c=n`@}6n 7xjҴBlj0i+ Tg&ҭbvE\HcCp70yQ3^zC D,uIZT02"){V# Ѝux"~-QS퉬əЭ%*|Ue`5;5=¡>{X'b͍w )r h+{DLKi.}d2GawIW6;Dd:{<]BQSgg +Vrphnl  UFx\Q5(k>3ϴo*7r9WK1Vh\"B{] W~?)v q\/拑wuյr)'<>&X&LI `bSĞ߲W_Jp'HYhqH-:Z;W cCWJ+ܩĉ#iWb\/1qy:Ij1\%b | FtrV߀4<4X'c)|!v*ؒdN9!kǤPє/R{I|ZUԽ*j(V:F; SvH4bTyB^6&nN:p*TIl?9ӉAlvZPD!P }Iߏ9280qSܞ2,۠O)rAoNC7dtg఍cu n mޙtCN|e#?sC18%-\8iS0BSh3KRhͿ)~8tRVnaybZr={culV7 Mo")7=lgP\N _A6W\h! 0:]uf,"C\ҸHcW6}*7FrBȆ2F4z[5yf5lҘtAܚC_3m6ץ!%:oahJ]46= <dg宥.TɘSUw/BXI` ܲTCZx/%xmǷGk9NT[кu[V3o ƻdJe,Go71t^4͒gmR>R| qDCN|xSTW3C0 '&05;UCŵ~'yV L/+ u $F3cq6o{sÇ$n>&#JGZނ37WW_Ig+2XovutTsDCqW !Ӭ%ĺ /bi8pf\CoG ~,,b&%{r :>"Zdx:Ðc '-(J JĖ7\*QTx[qmȀRs6j&Y{ߐZ?uWm+ϑ]Ÿڽ:_+N5 _qb@qzEv~[4w̿ 0{b$ I+dѤ.l:bʲ#TF1v~ TPQ/qBDvfW <iMȩbb_xJTe@™e f >^^s4gQ B[Sx X&X} pՉDOS *DcF8\zspOɗx92S(Hg9(]lȴFv߃,yVy4s1Pܝ@֮FY,>q-7iZ̼e7e%"vB*auu 2np29c`~(aNY6-V+2K dk> ܡHrK2lRkJz7I^-KYA_Cue>Ѯa6t,}FHvAxџw&+&v(OKϦU[ 7=.&rc I#bo);fݣZ mΘG?{j lETsQUb6t&! LS/ͺ륋ADMhKP MvE  gfLiVҡv& T2A%?mdi+=}˄9 İ؃.. TvDw-|ղ3C/]ZZE\G\hJD ;it69{!.˹^j~BQ I)oF\L> 7^+'yL. N,%^=dj5gbHݖy쇭# +5m$?Eg[/K2 )PADꣲy>;!$^MM  HN^jM Uΰ]*mav?u(֖S ^ӵS5MKɊTkewdGý\,Bal nT`u턣&Ɏ'YTy ^5׭|#?ashX_F#<Hk @cy\:nll30=Y[S\!Ak.NL B2.[(Wޜ9P%6**JBU|5+BNPyq8*.X-#E%T`;kL~2а|b3'@Uh&픙C;x16sfpMכ'}}P.r0WAeg_Uԕ]C󅐉 F:<(XȪJ=dDivٔ ?颞 \) WR Oeqg"LnIdﳩ_Ҟ|Ưsz06Ex?؇+ڢ sZѤHUԻ璆L|JF$$ Ges⢳J4Ig;vr% e4@1jmP`k-3$|(XN&[nwpknU(eM2lǦ&EHSp6x˪3}lo?$<ֲSybXql|I|NTN#XӱZ utRA+ 3.]G[◖nb ۟ BoCgZs:OAPGbLۺʸ92 R|_oX"fmƞ4}rv,J@ij%ߠRƄ>(7s+5%(%o\KRfCo{,թİ;&Ϩ(@!G)B*6o`h}HLe$ \+&rXӪxT:4٤҄(:de\ \9EXvWEb+"yUrʃ qmAg+l`u0TjmYGSU88BF9, qD7#WBw&1uIQ yw@9H~J1CW!dӤ+6817pwݺhM}4XR[tD3nhm#vYC]O" #n~xÄCO𵡯Į]81 9"2Fż@0UBQT/_hAR' & 'r"+d ?(ݲY5TLy6DO5 Oijcm-Szi;R&ˎ߄]a<7PXHh6n_gᲡC)50n4^78(猶7\@Exq9N~qc{i+Z7MZI7FQ]8?X 6mwJp@G P ?j⡯23t.Ǯ.,I]5HugOUU}0}P|$8=#ǐHȖb4rid,}S@쯕N5(1p "*(rY0c{ C}7rul8?e>_*E MbOR5pXϨG\DDfub_ S`AF2 &PU=]B.S}y?t2"-\V*p/ y/֝6zx-ajB|- 0"0ڑ*"q󳯑8#W #4AnUש6!ǿW#H4DUZAǭ\p Kst+Y |ϐgN|uw⸟flᲯ6Նb֩)|؄4\vǐ6>:8Vb3^N{(A{`Uf N"5WX/=?h4Iʄh(97zG,s:nTGL:m䚸A{ɫWa1mv% ]k={L6U&`8hnS3LX)1QSh^9,KbanT}G_Nx,Q[}(OZL:"E:r61;t/*+lR5Pa R9WH(~ <.gh?,r .&8$BD[B@vGr4c<~(z2ڷb[\p{c3;"n!\UWi_ѥRZȠR{ 4܈ʽ#0:~]I=cV&/+P*YU^h8N:gNm: 4m_4'0~͛謄ٚLRc1ye2N"Cq%%JH.ȱ*7JI JU|н$7 =BO-u .:#Tӻ5Ԁ6OZ3q gn61h{XT] JvjI;]A]dꭼ!x9%!,^#gmT>faXM9JM#Z]+gZ)F T@YFwŷn Qt=[1g%;#{,: fJZIMjQ[$9_F<*!2#XEb8T8rj-l KѼ@Եy=5] ܶU-4 >tO{wHIid F:v˜?*QqSdž1ސȏ\ Q/( N2~uTc:(T{VpL3\?,=!Wewk_Ћ 4%P+I@T[T+z~[( s2*,cDyHq - n-"iQᦚKa° {{5y}&DW T`q`~%aH]kcѲj MͶcG #?IκcG|Bpչ"d(w)aߪUDgՋjJ۔(qGl% mW!}, 8DZq{UI9Jqp𰉠p+ (/Ec']˼%j*"Ƒ%fINUBec׿rW.jEiaaHuxyHivcl 7^CW)vP!}ׁȋN]'h$q(~缴c4wNO6}T|K_d[s@Fn6c:k䏒ڹp$I&)-Y=pvr_ՄwlQ{"+rnK(mSe1^2%wYV(".O}˪ afgA w-+@X8 e<طCU[zz(]sxe=FFVmJ^w6wQ702Vyx# ݇:6vZYLv};J7da(M"d7R!W73N,Z oC@filKi//j(ҙs}19[#X0m78)v [gMۋT|ܹ^1L7e.O4ty jϨHśO2=ijN1ɅAF"%|dLKR_b4l2-Xa됚<ό7x?oeznjk;5Z M""e.XCJßyU?Ԇ 8q/4ݿE{6)j!6Й6,;3tzK}&DnF9q>z&4_w+3ńI \/mT3xb1-$!c*?S|+]> пa7Z(Z?R.[Zix/ʿ2,-}l/0F՞r&NФ30bPV_ywJH]D^ݢ.hMo,o*ɛ *T䢫5LAͿQwmulB"{u]k4#es\{bC?gb0Q!2] 5oN0GZW1A-Ut RA=Auq}[{J eLV`?YG@/f(`U>|Z(c rM:]{L':lPea+<jKf䢌[]`UgCD# >?PlYw~G.M/mWlncbC&CS3N3z0p}^;PPDžnRً++Ol=s3^Bw2:a~i⠏${SћӺxV!^#KOrW6!:wz1-h=*%7YDS#UK,ˏx*[d9>ZC-MT٣p*lKeTwٿWN !$_ na-"BEUHj=y)A؛eb_3냸"-_1&+Og:xKa.},98$#]#$.#VQ4lmH AL)Ÿ_r7V2ּ(#t{{:İo6~QJȏ*147`ǡ죰HO }I݊D}1|-;T ̦];y3MGK՟oiK׀cDWK_zI}4gJÏOI5r=W 7j?:z9 Ӣ{ÊpTvyˊYKT]shtvЃ U2JY2igm-\gDȘX4a^Y:Ft8R2C/)J{)R9-twShm߶f0&LUk}$vJZ<\x(%aՀbI7ݍ4XVՒ[/ULia_·bFޅ4˟W404>;ֺaf~5 rIH..:[`XG1=.ɩ9hc|E/|21Ϸ^FL`(t"s[lcţx%mxpU5C\/}T r]`Dv(ޱq& j^_V mno@ڈ>ꈩSb"`W%OHx f+igB`bG )(5m&'_ИcaÛDr -/5pAB$׉t);%B,.H林 Do7崦23nLEMp5M5&ՙoYibCB0*Nr!Bz }P sʩjFB,nlNmE?GpQ~3pK vHC>2 |]B:9;ќ*Unѐ."@h"=ciaR*ǫ).U8Cm t6;!}̯09C(xf7%84ޘ -/kynqXʳ MFWcvϘx?J8AbȽu~ >B맹>R'EC~݉^0Oc8#Uv[mE/&U,:BxN=l t^JxU9>N."O+Li&rK JDi!Ua)*(wc/<>HkDӂrLF͂k+sĠ>mX UDYm#v9_ +% JSF/W{$WDIVt4WjlF9H15xWjp@&/oEҠWUZ2x$:*G x6Jt!7i$)' 0ŚL˵>1B1Y9R9's{TU#ۖCU60t U"FT-q!~pml7[ eR4W6QtbVX(_qXթ|uzeR0εK5iEfmftd(h 1%-/^à6Lv˶rhK;uȻçoTRAܤO6T<2Ohes0*ͫMs/R Q EyÖcNSou]%z h|Z0ÍL'АV#"K!f bOȉHJś e!>:Y G&J/M i͚ Qwa!H/'ٯ#C;P'ټ[^ _ݬE+wS51eXѳRk0^>`q6%,i7$ljJOu+= NYm-S 8яJEkZ_B#f8qeu5 P(ix>L:|ȚӠ"Os:R].vȡbCcJ0qiu/]4^(/?_r :1lɧ>8uЖ!?(?yO>jF> .<)/ʢ N*?gr9@}1^>uW"}TH/9 7HSqJMP5xnR.oQ"/RBi SijIf/\ވPфVd;6SEiH`՞"pf=uDwV( $mQq,XH7?bIb#+/l,эNj&``&Μ>C2q*J?$ksoag|E쩶dp{d~. rHR߭K#:E"wx@4) 7UPƪ~717{~hDݝϥ@D^zRhw+! FksØY1š ZܺQBx@n] aw)/T[, 0gCT@>?kC%8fO+BC Ž"W$ Jq[x?rmR3x݅~ff0տ= {|KJ} 7GG$%֤ͯDə'-aC=ȷn>5hlَn͊!df#>K NW#[l%[,4w2qV%xoU ~›33&f 5K3(EIO3ծLhE21YH;Rc!?0ͨE,?<Π7.%.^©ہh*e~EZ4ώB#xB[8>]1HFcR?S.} ي|/'D*nKm(iwv8QZ]K=>Cu܂ b$ "%)tQdV)N. & EP_CULe9N8S"@|4|`D\xNSPQ@gP&kx g@z,\.-f,?H?SG֮( ezQhGLVt/GrϓZd9äGCL8o&7ʈipX5_^&ǦQ< ׭6Og"iI|,9bL*CChwn(v9u߭ve!- NjUfq YIe X؆fka ;jսnD`ןh0οX-̖I \qίu3r_d3'Guc"02Ո7=@Vtpk*z^h~&#o.W`,FVcQOWRPlkv80{q4!Ed!um7#E_C{Y 8@cAv|b"zuY}`Y3&c+Cl=Z9P:Nxz͟;a1H:6I;]^r[X-t!R"QQ,EUEƹtC0O*'`X锇n h%>*bﱮ()MC#ܭ=Y:SWk2\~ׯB|AsV\X%cf =(98EB#Y ^V5$a4w o9B>rÏIƪ pn@뙘]{41N0:]y)j.ZO_{ qT&A;Vϣf ~$iUŠƂ ۵1@ 5q *QSP]t,0 [Ӿ6U6[inc[~@R]LW^WnSVռ:Rok9|(?)ʮ4-a;Жg2FRcRX(ex֥CM E=1F"4 *єR8]=k[އ*Ƨ#''RڡD :⡧CG[v7M Yx0 @SL](0Rz-EBg[K qVz$UR:T݁JAPo>xAd dkrIu~/,6c|T'w^c%J6$ oc CDN_F=t}tCj-]/anS_j8Q^Q az$lMخlCRoH9Sb,GnRW‘-& yd/'0c(+upG50K*l#=>S 5nD H Ub7 I[i6cxxsU/e"bc&n97YP RU{Q4=Lo/ #<;1跫=$"e 1a; .bq>Jsl :m{":ܴC-d\{}q̺` `t} M5 .ژ~"UzjNs_K9Je,S~{0jl:JF|1؉e~+Q"ϻsbZwֽzH~ȏRv q?lR$ĺm`mPo00+0(OE 赤qg-ak SǴ)lF廊ֻhZ[BcJ@fәGd"*fT5$w. sa6cĔ+M/pV0#0p?\čX槶b{U;3M]tz&"1tلjEs=ꌻ1M8e{Fbua⁤}3쯷*[SUQd*@\a|iq@WeVnjdxG~1^tWH*Hx|2ge?%63P fFkAr-|cbOi Ղ.0,j@DRp^cOMZ8.: Q^7[<,P&\fnnGX|W<,V7 ~U/1FwRI0Y K*s!Cit:2!pU E`yD>׍5\wN\ff*y5Z{:IeqNhg{;6dِ8>=*c[V3ɶi;y`1hiej囲/hGsr=C4#«Q8FBam]6K\q\g)qFI!K Eq5WՐ73 2Y]>ZU؆6e=S16\sq<-]iZIg~(v^Uz8=)${?#5P6en/(kv:N`f@B k L8PkMVhU2c;\# J9 ww]c!5TZ)Zn񜀍؞&s ?2ܒB/ 瀠VI^TᅗPYqKq3:n^@Ò{ l.@þ>DݑBs]y *J;94$ XB \e/ndNXpk~sl'f2/ξtx`ԆY j`(WxB7/=R=2 x%($-8 ӂC*,珏S;L\,@eE=w*y]EwBWP<1Q(L-ݣb~#Z>]=tŋMRj| /Nb=;H^ `@i\X =FvJ8 ѵy7-b6T?.„PoŗF/Lq/[k󿜸o7,rBs/ZF!gb'o!*g&81tA5ʅ7ʡyȻI2~X^76n1|Vԏ5揥bOK911)^^KQ|$ rU=U%"S5MeFb0h'NT?DL0xּ]+p})jLO}丩FD*Y"%=I;DmcCG/Ԉ[N#}Drv~Ӓ:=L1^.s1/g臣ӜRoD{)8yUIKic;I|w̜ 78W.i idP2uJX_?- ܕ $0wn"aOT`iüaOcOkE]=9R'm[DG2brO9+6*_w[ U3鼃㈒QR[RHBO_'h|{$J䒌TVekC!Oa}bVx8h-g`I@[,/aG5Vo1Jed r׃Glq1PM-RyUXlesMKK#M@#{;Ӑrm?/êF j1m熫Kl(c?׭vۢ2a^a*TN~J(~P,j{|,oDD4Ho;`6U Y*D>M,Fa5,Z}[gX\nL2 UCN?:7¢T&fB YYS]aSnkShc #i /Wr5'v#׺!ei=Z@DPT,u: ̦>)ZZrQcjC#ha:pQ`"eXBd/-( 5boHa?ь+x(h (Jʦ.QmݺŕN1Pi5% >V SRlb;ژFZ n :LT LP87R-{x[xr ٺqߗng÷ f%c⤎0쎌Җ ׳&*|nʱ=E:T u'c{hMq6jk{H1Ʀo1dIDc{vVtws z7/ fs b*0@icaV;vz;ʉYkP+vn|J C*/4=xde5kAgWEc,og"1carPx^KNq?rЍ׼upagsud2-+_]@feYY.DNj8d 4VhV`h764uJj7E\N='ԔvDUik="7G g(?t8M|ޯPʄZYH yI.bO_լ $]1<,: =.vq˿PS)h5?kvW/CM*9q:N[&1 Z=k4 jI2]@$5c373/h}EdTlDr0RV WyrXZ9Wnϙq~f/`Lʱ -r[ 8h"|ڨ3k m'0g~`5r_hk *tey5i7`B-76k7<~M{mZDSLh&Yl~A-a1\ NAaQX@#'TXnD8D Hb 9D  f?@Iy) 1.v3(X b֘R?> RCHV( owx]~/./5μ2P&v5*g{5Gϖ^U!dAѳD*ώ܈ SxTӸg!j̘B Dm~2?[Xhm㉂܆ٯuqn(}G~ifF=1".:FmS[T ұU@dW# NW\7A9Ż9Bd>:If1Mٿ)W[:%8l% 5jPߖ5,n?ߓu3==W?h@$/hs,MxfE'G\Ff2=މWQ@Z;ef|^4ǟɎg*ޣ~ۏg yy9Pz|xpɁ<5>j A$dk(-Ϣsf鸊Sih#3PA%_',|(6L/#e^O~I QUi `eMXq""rBϟz~-+q :X`*nUMqkS-#;+zu(ۤ}, ꝧY1<33&|;ЧZfCI8_3ްjR({6%y$֤_<b0\yq"3@ofI%Hn /1gJWy4Yd$N܇% =RF0Ș]mm{igU& lc#g4Ѕ` 'iQC+g/}9aᄦk[ ;PQ%3Iz.[5p՜~zgB='Yſ /Խ;@/=4_!\-6-j: 2f)@t`g\/I ݅$ 9̃B5I{ks}q'ހ^ @qFdQ)Tp9^9m9bc"/2DUg>qv"5vöo퉔UВ12%57<2%z/$|l bI:|y" 4$cI*ʘv41[oKO 4m++њ)ǻ =I8Ta&]);S 9w\lp: =Xj^iYɀObnu0NFӭ_Ӣ=i.*1ڵkкҁ~ ll*R37#/URPe]9P=4׾}Ұg'OQDVUb@ܚWjJ}6f撎}Ɔ1.u[.~Z-&4U1JfphR_EnlzY,)JM6)p_]PT$G0T+J"r<񹱁R Ra{:zTDi0SFLY8]lt'CQȯf׈#k,z_{RđK1>Eo39I,v+,,"=#W$3$yU/}>>S"-]СB~M!LKpl7.B 8,5P<@&JwBR{ZrDڑF!ӓx;B..F7LG_rɑO76@.n"M:cl2z`o-I j|18;6?! ϣb+OvC&J~W5REw :XT7bdq<&ۇXL{=W_4, :_g= T*%:l>fY 2 u`?N߇};< j=%?k-ʿhi#*4o9 C|]ڡ3'ᠸEEBUm$x3BpGYl'},Uhe]$tyBaޱ6Qk㔜TT'5INSzVzM7%q)=U/|CELs~ΦzA1>j`%km(ą!5)e9+zx[b@JQ/^Z]SS}[F EA AKS^CY=_ FlrB4վ ,WCμ( k9HWk˒!^8BF˃\$:~n^$3.%xX1U^0SG΂N6G !l[/akyzljH!eb/0#*zrd1n"|m1]U%a!)hPhβQwZ1Wyٍ'ؙ:mͶ޼˛`_B EaIvGiIoЬm8;->.?"ԺHJa~p{ L%\|¡V6ch  {5%Q tTmlEv\"!dS['>dG0I NH4ia8e ,s]L\W͵FS,\({A`O(u`Cm\&3[cׄm@!퇄20).Hw6TDi 7/2s0PtUtI2o@%4>DRĊ0g9,t`6\ %#:I+sc>{G:Go2^EF1W&@;$#*c[p p6V꺷j}%%@~Vss_է$rm\SRWиK U =5Z[p@Өlj.t Z?,y'80kw'`bgz)pQDszD Dl LHEt|;gEu[h3R;TvA"ftU^ExI"@f70eX\%?TrsMgS3Ym~̚ )&LYoIm5;Zf \iB:jL G;hč%)ת~^=& h {TĄF;߿Юpَv1)m^< eL徺b2;a9ѲA{2]25ǂz*Dz|$!CTpUAp Q6dR٣>g KAytoMF|nyRzu sYX+Y M2W 0?\8GmAN[zL' C3$\7}[8̧͚}(C?MAEeYm Ͼ+v*Mc5:dט֊#k,hhw?dh<*%sO i5;m75G6vHASosA,ٍsNg!NmOQWyLBU3\6{EG3q[66)9 v)GJ*\eRBVWBE~ڶ5|,Fܸuv |,Î Nqd&Cc !yƍ2 -hu`)[SsTQ~9"k6Yq 6+O:j Jk[8I}82cSXLEb)\1hg#hKF0b=)gޫҖ()񅥙;Y ̝wq&r:F{6 QL J78{O5n4z8[9ގ`~ WMx2 Iʹw 6Ed B^Ut!61X sH! ii͈1= M U٤WngeA=MV*1Dך6T![UYeG8bqQ婡ȝ%Y!4Xz'v uwܶqSZ&ժ4+ӁԮRGw~^݋Ir:$g5xF7!d SO4moL=q%޳Zk]{TnCwxJ"2b`Bw^ xgF4\rCq-7ڻz8U̗d Mp6ΜDfAh.m.#A2]K[yƷ|S\ 4Iy L莻ˡ1ޑ/ b̫|h[Oy3*y R\v7Al};!l{CB̊@R/ۣE*123>5ax ק&nF\#.r̞AhWЗiQU^6C+CFV[i~ʊN|i"O8IPjPlnyJ7L$O Ӧ:%lQEP9p;O i ~♋?P^82ZI֞8  ]lu희W:| 6 g<*T9q f9yY;u۫5r>d> ϫ//NEI4p[ۿpOt5ܘybID ?swL?#LsJwlccAo & HIНlh2!N&ak/_$|䩤4\F+^|r˜t&,:ޓ<^Y.|{ZޝBwz Ld'W䙡+;L׼TX*;l|Cf|bB%w=@m AA}L4i!{r&fy5' 3^F{o 11 j_ci>Ai˦M.eŌ4]]eVNJap<&J 9o32CuT jq@fV=E'E ~BrC[E}]>Ф< g( B9 +89OC,Ƴ,)nK "JߤImws:tKF V# xWaѴ;l].VvDij>\nپmjzIgez !>Y*4G$6YŐ k5Y0{{yʜdqx$rH0Jv46~&XZ!ox0h0! !8^m{ ` g؞vbV6 bNjh'kDWCa6ԯ'zv`}=s:IVtTD!@/!*^N!d✪]l}֧ؤ,3h :,97 M ;k D<) 5a A+';hA8Ob1`xswZh;.ƚ Un0vk ;dt| bytܼJh 60Y lq%@ $_/Z{PkIuAݭ/!f/7r 'Mn{@}kX*f -X4SE%1t /b(!|@]YA-*^c\Cg[&[e7} pIPr#I'!Cͳ*܇ge^0QF6)4CB HWiH.^-+C\m -Z Ɗs+\U0Pҽ%lʕ Nץ{:ȋ'UL"!*0~CJ+t޾T׏c:q~ 2-l(X'+I(vM2}N`?=xTZp.Oڅ8c~h6;h5{6VXvUS$~PN_rܡ] |ƜƏcڍxRn`zL ߷vˏ/}I 2(>lv$B+RJo`Q^8-V9dA1{"cDT}xѲ.RT;D/"WTw \&QetF!{>Q*XԮG6ʸ ڗ:PJ;[ؗI?FzY>| U)*B SF 9/, vGK&Et!2/ɓrDĺiBdsӴ_4 Z:cd(iK"ރBhO3I}P6`t!x*Rov--{'yhlc8xmˀ5RHV̟X_k5ŪvZs,DQĩ؂,sЬـ@=:Zᵣuen|:0N[p5X<2 {:&/|؜*lK*w F<}%Ew,Z0N]AdД:V]}|lN5HH|9  k GA`5XXv< S|_€qJc-U8ڙfAbFɑh$⥱^b%3L,_ : ֓nE?8onmcˣsQ_\*ZEvATjk*CῸ~Y\0 tgp,r 8M`\ъlN+@@B(kKz`N'GN2%3!2Ơ^}&'\\pl%D%V)X@olaw2pl6߹$ȗ)5Y:uu˧d4V#oC|u:-i5T}ьNϗXlMH:f!(I=n- u 4d%᾵G_g.'NQ1l7A%`dqi@kڼ 4Kv!TBӹ BYYv_''.$/|/R&*!5N/[{2n(>*U-`G*&fQc \d4Uv\_HfLۮsA-@Dt``QNؠX>`sAg\zЛbԻ>ݲA2|Esϗmb \N \țȇ$Tyҧa*>l/an-dAS32yuZX1wJ&g|O# _9A3I|־e}F_яRbv[/0J)_m5~ !mS\TQb2 o53MCyVbɁCپ xQd]'oj[lj/xj=c!H8#. {$OPjbj&N T[$#З?G,&h KW|R,ɓłw{(Ħc^p]dΑin2ICjK3thüh83Nڤ 0Ν2?:l(5_oC0\WUwHW\뷘X?lȟI]tߕ WsElj sVy^Ed0XCp$kvDaJp9JnQ')d( |!o.V6Va!]j-Ed}V-~yH' m5bIZ3}]{lg =nezc?"d+Wqn .XgoOs'!ac9z`IC?y:V3Cd)wލgM6BA #MIfL6Yv/ SgDؓsP4"%iEX\HȦgl,t'R?6E,q ɮ=jz_xpvr¯2E. 2Gp Te8X@g oYu &F< k<}^nmUTU KA!4!lj.<87i@ysۗRn778->W$[Ӓ-!tZGzNd)//2ߗRpNKIz .DcxK$6*&nQ9W jpe;ǙWZ-#p ;gH1N[[˘0yMmiGk!|jN fy j]@P׆2t7ʣ^Ku@9_At,#R5*!\$[jz> /ic=$)n&=-fGcvt,\.QN?t&(z'D6yYrr((iT8dlo֖~.%Plr$;̻Dd50"p /ppG0?6W;ǔYx 'Dk {)h|Vg\{<&8Z$+RiMHp=%D\dR[UW/jzE hg> vv>ׂXNDκaB!.bH\u6x$(t ~>~ b1m>ˢ:"Bד òyPxsF,;-FG3 ~͝^PSJH +Y ;2]D%*&1c6QTZv-:O܄ui'_bdBQN/\-f83UKj~$é=|ybWi^Ҕ&`;ћy%8 ]UMoVQzכ&2p t}\tY%Db>IjÛ*ނֽz/N8-[ci8n0"ƕ: h­EgXmQ^)xtu0G}74UH b=",c.zKyd{\ X;r&Y 8CT\7=5?sYf9u? ^aLvo$T OL[ 32[oαqrucܛ:Y rwQq묟+gyvuډ?ɤȀi[㻊 1j!jUɳ [t#U.qׇIdf-Di.$&ԳwDHy҈*hD-hmls/3qdFY@;|JsjT [2%xx ֮#YT˿LqaJ_!)}1&Zk?tING^|{B>ԝSrceڿi%!G]Nmꚟvf4PeC+9r ɇ[e,S@9>o .sBA?AH{\i!\󗒀JTW5Bz YCwIE#3V)dJqφH#A)qeTPYQϲ~n/1l=jXb, 9ic̵%>r9Y+NȻEJEzWPH Z c[%8ʴIVi."guty? rz[lw8$2|1v sEt6Cv !KjTr^H_^7 W^I ;@e՞=nelNcrK=[aռe.-xٽ^ =eM)fVFV EEb#!4 AF[050G5C-_^n׮%"1y#OͲ&hZo4 C +۽&ML|!/쌕؎@|l 00bk'I}#9nּEDEcL(Ɇ֖u}K#՛mI3/,Jt xa`pA AkD()x!DrR՜ak5q@6(t HIؿUxqJ~kMD79[ )mRDDWƧk\/-& v,#[$l|RCGaFY&Y~{se8S0TJÔ!35@_7صd0 1}Opw諝6+b=v]`MY +C@V^H'ĕj.wӁl&+`Aj= YcbUzi: [ߨe=,SM e]DOam8>@Lt@-:j Z.vn,)ni9q<+1rCLs] ycJwKð1<;pφ ;Yʦs2_xD$5WrH}nǚ8 âD%Uk*;$Leq5_RFRC`ZͤnG 1} fҰonΈWr,OQ~vҷ;PCIJbE[s2Mұd3 O&XɬZw؂8Ђ35Le"v]"hʦ a,gpNAB&GFɏ94-&E%Ďvͣ[YTv E+D[2#jOC+)qkj :C`?rSDA#-qbu|!;}`yH?Kgwg)gB.?̝Ch _QNpHQ4`>\Lp#a>|X0;=Qb3E7 Os%.ۗ. ċYcN ufJzowG{s-AGQZn kLѵRBLki*tQ;YkN6+‡y$4kՆS*"|Ypu0&x1=%`PȚQrCa^RNu L)]_ijlt^y4Al{qMSRhQݐLn[e[O_&*Hpv+*дn+gN[)LH'ǺFfyjh!!Re[)H%k8%N+J}\0ϲ(H:WO֊v^5 \O0f[:nH1b o)A(ڀ@gy6g~BǧI ܡ\b+['۠inUӪVkr@ P_6JG_NţQv 9@.:hG]TEkU1?}Y \H,RnvzyN̠Eu<,SaG$ NJ^%3HOh1ߔp vzR@.4]{߀;׼xJCu `<,n"=I1ӉN v>cEgn!b/]q{JQ@^"~ g2)USpE.N6m? 2&5o{ȓg!z7$:m cW~Nj4YJ_W`Bvr|E"pM[CEg>Mv.&P5A֏VSxdAUl!^:T gxw" ؅[ ,:榃b,Oاz*eZzpFq.(7hz{!Ciy {:Ju5殯ב0CsNO={>-sA;?k%.Ao8"ZS}Bac{㭛dp #'n"!6 ";J{N!yeEWp^ùg)6M$-LQ{k+@UoCQ"cc2 n78dnu[mMG8M.hP1aB.[ZY@ C۔8(DHk4;~ZB}RO? vvk ,\d|pmEڈeG wm-ͅźx 1Is9a};ag]8)ZJyFO;>GN06-=R<ì!>+7N#:3vA/bcZq2?rk%JL?-VِYGr>2ڥvaV*aZ/u b{YI1SSk%W.骚ôoS Bc#`b!r|@iRĚ7n'.W]8#W=ହRgG$XX|6:eEqkN Z#:$ 1=s捧3z!;u Kd9v y% 8;'&st<226 ߬Yڍa㵳rS}N_o21W3\ SC)?!M415ŒF]ae{pX (c Jc1EP~EbmIk6ИIkKd'!oۣ+"o I1<*1^׋HTQ8S+/e\ ]Y 5]mqaw.:v^0KcF#L'ml4^t fЬgqRke EDxoiN$-cb(MQ67 @ ZJ+w6XffSHT>jTd<|[wދPŵxӓA&VʹƖUYᎹJ{O)"A=fn>a-7p{O5O_nm^^uO# v2/#P@n5b'>؆jplYȑJYmLJVf4 U⎐YltX$9b>+o<m:a5{ J3K~r4)ܼ71l<QioR͂!w(PGqQ>Cܺ=M]YT['YpBV0Q3rodJkH}LK7&O.Vpø׳5f5g~bH!U`bG¹ڸ!+P4c+BK%j+SE Mn4 Ckw`d]i'%q2CH$ VpJы5WYn3U]c Bd %b&15aOW<6yc}&^Xb/g n$}蓚sʔh!ϙh"B9Hs)s-Z:Sж*0N}*[k5)8- |kZ%3# d]TWBS\62yRBbU1-`ƑTW&zqNo &` krmX !1c'nzRͶ9dRC-Cʈ+AK b &+}?RÞթQ-bVp$恵f+]F>"Z}}ܺaoHznt΋ ]Jz$\qKfMM MٻsY$YӪ8{;Sue\ R +-*jdH'̕ a's{#a%G^Ozutî|v5xPe2sIC#tW#UO:UZCtZvh+"C"[&+z.4IŐ`D.o1+:$ʘՀ;Q2Z `VsUOIJ*kt1yףI`.n@$K[,gb"p9MWEKZ[\lWڜ=ܷ OU^g!+>(IlN5G,O \]-`BD/aӊ&Zg(MobG>?J>TWp$LސHЖ{ħ*z Q ['084 xs@v~F+j;;թt8ˣd"kp&&&pd "S\CkJqC'‚' *LזKCα)IU[o\EMrKc^8ηTN" iDz0(`Y+&Z xjnE)~JAd%" X+`lRYuoB&9X$Aɇ+sbvp#~|SO-|HvM}7E5˧+&M=ӇtZAz(bL| .BA.gEp~FUҳ_M{Lu=ʄ(C4FNE~*3~Bj(n #N4&7Q_9uP M^l$oc9<׌d-/P+7ʅ>L(F<º.&.2425gzhBIM0C)崙0z78.NCڱi% rGL]hBT5U4][T訍|٫`4S'J=N@ AJ H2 #DN0ߛ}a"j8s ,?_h`d$tGA>T%Vrfz\x+]iǁ > JGgpT׿qʇ]>`R[Rlv{SL/oKӽ!PvWnH*BCaɍcY1 tw(+7B8OrvAX] I2m&mI}A5}K׬1$0Eκ?W w=TFK|G쁅ە| #uz [lRZoQbvJܓyEQк`ҹ a]V'<9*/D{T%ޝ=KBu ti%×&fr3Hu| Te?"Ŝ/טC⥿c(㳽g-z])PLΑ!][t^\b;k+uՐv+m@ҟǪ&&` $ =u"w.HS,rn7sۻdlNq׹|{b_ is|"W @(֔l`h^Wd laEuch&nA*߉HȆl!̼P{@@ 7lEm9B0eSؚK傾[OʔJ=2MMaSE5rqa-pew*歪 yi _=G ]2:{.<&.m:Ut[5 =SET>WvIc5@9LJq(,s 42ҩze),*̊C&J Ϗ5aF4bA~^PЎt* Q(֗]g;m/PmqigU_:-T]aVOhݷx~⧛pg^̭ HeX_yjU=) _ftɀG*Q*#M98a9-yL 5 *z6g'@[Ca{ڊOW^ʋ#pTSݨIdN]-6b]|,JԋƙP駕}mEFnM'^hJUct T4Y e[wĖ7S%,+hwshu!=:_= Y/ ?^:JSSkȫQL)2^ +\IT߼pJ 񪉤aPˇ^9s<FC($kN">?;'hDR54hFL_`/ˌ.ÏgyIv7ɈYfMx/T,k1I!\x%Y NwgsN8:x*r<-ܬGpcwKw,:fǐ?&^ ﳮ̯Kv@4F3(4KXRո?ҳWn(mn(g|(qCMX}Zq?̉^t"!%Y$wq2s! ͔صH~Qi|zs9xnTM,0T1iN4buNUp0j:,nڀn_(wOI$Kd}] dR#c*j-=nP? ِRMgno- +Ij)-d!2X8e\+vy'X 1?w:%: ,>[Q^ jzT]2v# "ViE#QE+Lc4y5:)g oYǖ*A$An1 Pglj̇Gؚ.-hZޡ< /5؝33~lJC1P;^[woҍӋXd~=#"_e |ܲET8p-7ꍃ31df١4 ]hQթkF+E2_ôᑁɷ{%tĮ51oUʙk)N4țV~?NSS֍LJX؜!$x&E7gםFY4 5"DMEԮvÀc i$?(MlCU)b2StuM9{gPAi51B߀0M\D+:|OcLǢO?;2ַe~\(sFÏXA EUj/)B]gRB؎?t{[5&%ݭ2zh4bg!bL:pPh 5hPEz$-;K1+g];xāoyʄ>G/֫[^{ܛC;$&2BZZlɯQ?[w{߾,z!7 `2*cgW4P]EpJvC>WA0Ŧupķ0=IQډNV3kMY4dZ5>#to(2LoK0..`υ?m=e 6Qj7*sU/Gc nu )X@9_'%ĥ \0ekÆ{4 `4)ҐFW`czR—Ebal\<~gYu0& 1s->!Mͮ.,}6r+]lP_)71"/Wz;.C}ʃ|:$ԁXޜ-6g ]Ա,*h@QxCF|ޅȏLѫr yg""Cn7t{:3EV3 `lʪ6$iI4Qpt샃U\;Fh'TcP+,Ri/+SkK~Ƞc=A5-̺jų1SbvM[ښ04l"p(τ#u yb& xĥpZ0ư7Q3˚{\Ő:oՄzx:=`.X7f7[Jlלb\&jƱU[ɽvyS5`"-z7*?%}1 -PS4}%ѸBm@us)i]~adgGQ9z1-LeS q.8=CI,`=Y͎O5Ojb"4>v'ߜ$fkj8\zZ*fCs1S0A:w;{܌Wf3`1¤ԓ9-.lJbJ,iA*4݁$l<^\?9х'`f)\u]C_ ]~+ Dqe'Ӕx# -/b/L9TU Y3w3D98U]DS8>tjg$LlYr4Y؋J r2#3lh^ۥL! De&5Y&xm |^ڲGK^݋R%K#٠Z: &s)) u t ı )]?1yN3+#}MhYx ~bG5|(-qC` vrߘjV8_[D09Յ}%%0 `S;G'=v972LjHO3cS쑧0Qa/Eg>6qDm>=7I:E9f^+`J@=VcL 5t\߶@ <xw98`Jf?= ; p e ⚺Mmj5B2d""7@ąf'`b:xJ#ZX/鑚{P[a #-ߪc,ny-%U,b`xT]F3[s ];LFC>8T?뫋Dn=}דT6f3"D6_,HcNa AȨ"GΖl䶥-Okɞa5# GS蘪z oHL~2ZS3g}{%4i|:y@y ?gYfa:: ,i8Y4TRQ|Nl*e@ÍYC?l}jTX &b7l <ʷtThSl*Y{!gdI0 1ƺ"*Q`2F dYZ|QP7R;[Nݔ}9lo94q挗k6$[*JtvZthM;,Pho{[6&Ϗds[M"׉(*T-*i7.+0_*{1CYFYњ̓F32/hSlW:`Ƥ*}\=ycܨU{ܙUf @ )2?}Ah UZ*ݽ[*7faGF ocߥGfu $~$\=, 5N bcژ1(#BP{l|DHiTKqvf8puX DJ6nI<9\'Z4dp1"]5T3hqŊѕ(NxnalKE]23 EiO (.e7M{y0&&m?k4lʤu$Yx Ӗ /ROFoC GP7xq<C0ʤKv0|\߾'l k4eNӰMe"WUג>vV_ $7Ibl8G=>@H ~;.H%O=O#Be8:zAu+=bp'0MĬB; fy:8FʭH]Ua+?Hl Qlԑj׾=kX&W}__>1|C'27p_@^W䘐1WIra(l J9Rm9]?0 ?ek grfIGm.=i{GsjJQ\ Ho{!i - ȉb{Ty#/.4]*TN.ߢ=9(;w65 ^ :% ylNPvK #BvTӃDW. FK7ӁI/^ W ܤV`5DlqAc"1$>s-eL4 _7.E/]ܠ\a.9yZ}<(gD GZj 951U4ucR('Z4M\#H+jicpMs[;90"Yr&8YR F$&uV7C{u @HKmn1T(._;Zp#D3B^ Cq{5]HV:2_3 ZR3f̚VҧFz6VJfNje"|mi?\dsb} ,kcv)sSx94;O`)<kGd%[GW7BP;EVD_wDt`0߇g#A>-F4ln-`NF?Abndd~8D3@" \~Ժ Vc``t7 eWd8P)JCk4 5ϒH`%xfsIrCth݃ѾKhHwY20ʿ6b2`;D` Qɬ}xBզhskO$ֿkǚs״>*D:h:bEiqQkة=c3qWmBSI4--ȠB9 1zab_mek*.;Y+Q굷?( FIgX(SJ4Ƚ%\  /C+)W?TܧewͻJZ~AHBa྇[,'AX24b9PKr?(c-B^T^qӌ2d"_J[sNWأB]^$_xJz4N9G~Jfnwcyq{ṪH<݆XJ%RXvc#Z]q`w,'~Lט!m?y ط V=CY#4h秙q3{޿N"dop{]NMYk_mo-QN] aÆKD;R9&Ss AZB4*#H@'3!)bWd <&iL?,o!|VH{p@@2׫)k3ˁaq4G²0C?9!ŘF3'U4 KRG-,i.UJXf臿O*|[2)  f2~"eZg1F x-@`#%g/.ċTk!,EqDk*iw7 %~OgAgCH2l` *x":f+JJ)LR $)Úhn2Hi+򉿃ŝܵ]51~L4Z ܢ0}lf'Ah*̞-GR'DI1)|z #Uܤ)Qtj6[^TxڋBKenܤ OZO @*TB, dnT^ :O?N` #4zBfE1Jj(Bzl=Czf FD̛iJ(Wvv^PD޻&RsbaB7<#)W0/^~Q̃}dSc2+if3;T_*$̏tSL{CaS /<бb&4Xj$f־0*3ף5"{"CoԈpYƒ :"yEG,֟4BE;@!R6rԵuoݤj!oo88]N(*٩J5is.j4nP jNCUl=0_ f܂<ץ@jd*CD<8Gx^cS%{F>KvXk 3.ʆ~/f6r5:ccz<95GݰZU7>nY@`*z။}cT 8i=dbG̍N-VTbi.YLJ($`9y[O;D TJBO[m_cdJXǶ% h0- |;:$h+UZN6 ^\/LSQ[pPN"51x'S<g)mNaѕܨླྀڝsF{`L *V5wQ \5[,7R&GAҠ gH\Bvh+@.9I)9`2z"zGk̓>%}׀z9ZBgc(Lp ́kZyהtC7H#I*#pdq 1j UtMɩWCXWؐ|c~xma[Ùztu ā%5zA 3|8g{?qi> o.|֟UR$X*t<Иի>GTů↔_6 +r ?Ը1dmt=rᣱQ V7> u^( `@5+u1:YآE)$pbz)n E'^;]SVa Hj"CF .+T6vsH`hwh8K l<2MwC ;pGC(RpH<ߒ{JTJ̷kx{b}\TC"r Yb\l1SOvezBgWƢjwb_//Z+XI<[[k;:2$-tдj3hz2sQI@Zj@SWHw> j:i_lhŦxTf "riQ/\x申,X :%9r؇Y…ߟI`H ]){K*ߏYA2(޽mlDi3v)Me8OiUb%3[0U9UY%| ]b C=Au5!,Ibnz*_ٸեI1:Z׃FY3ZY J hH+ϫO|(C_ +PTc>_|H7dh]Ĕ̲Ȼ$i!葢^5giOx}zxܺ>]chA,9oDGcb/T[UpÄTL!\eY*4x6l "r"*>D\KDWLY9JaӋw[xk@ ƽDR LOrg_o>clyzɤZBXr6;wH&F-)WBVS֡AmJ&Ofb67 ~6jQDZMsGЄI}7j ]&s> TZ+ϴQ 1/e'!ck`2O*=f%<*u0(nMJ!ND?l+X3 9}kn$~x湃dE/lB,0B@A[l=(gGVH_Mq2ڦ3o?zD8QNg8kE7O톕Oo+>`vVwׁ9S15Q۔Mce{G|.y;^vmk.[*d á̺pXp;Kv 2]KTlv $ĘݩO "icCÌh_n)(9Եb@ž-jo5賯[%9gЍ]vv! Js Eq.M{(MZBѥ寊ݯѽf)UMΝ*_el2ˆ"DnbF%^'@f_y*^2_+[UZւwkfr a4yZX= VWЈ<@ꊹ}m]i^Z,#M72v/eU MG*wyC :U<MZm7 NGKK?ק)K#q<Z][buYLoygŷCŚs(ppkPDqj -ֵe[7Jg#"9rΈN&{A r&$p:S^ 7n{'I1^b3#,ö7F r>3gj'/]#6٫Nf4`ǣNf&W)4GMo@{)l#Di `i_se.A18+0IN慿[Tr[$58 rey6ƞN:l1ט/ו8΂nN2qGw9r%H`r!ڽg B6 ״NBNi~jOcXn'fd{z(I+C֞2*X<=bՄFGA/z $ӌ٦  Im?67'͓p_D:a%kSStp\qT,h21R'\wz5qJu|E2NY>+f˕X&[! q Jx7ҴsdS 4sz=Q1~*]/_`^j tj@FCkirq o(7!{7xKmW У}=ҫ|jUfe߼wm3w&h ֈdpkdD+ݣR-d5&¬4乭[4ՆB?>sORo 3+WEc ef{a P'&!eE~\{#8?B29/i(5p9.m}"&)? >%)6N\f<\H$+p샰gSbubCLnw& }s/aoUڣ>{Et$7+ź˫|a>ۗ0i , Xm9_Mrmn%rM"{H:3Ŀ$09Q4=+q/7%Z"%~uelS8KҔ׵) ],4p:Źǣ wVFa9z=cm#}(.ffKƒ2C_W^Dl'[UPc%}ԉU[_] :aںj 07\VU(#~rּYCkj&pݙj{<%ÅKݙ2dOUA$MS+?My&=hSjޣ<ȋܪj F,ݺtsz%2(0:S3VG^:D;3t'1A>̆u:ZHz}2Xk8dwt5 Ii_gfh,W0óR M e(VLp9P*KFfAXj˨π=JVٺ#(u0r!DÁp/0YWP})75ݞ|Ϙw$kz4h݉z+#1%eDZZy(v +-1:,\xcxX76WEluPs2󒫨d=ϨB `59krY+BT]GYґ.j$Khg QJ(n8DD{e-$U:ƢKUPX\lChGg=(")γ옋]Utz f_-kM5݉iF\$ToC'WEZ n#J&Ȏy7㯯t}~׵OY/?;nfDN.IB }i6XKCKuN.*+khjv>دL,`LF|vC,wUӾa TPP6.eAv0m` gpJzSІ*{QM]xM ;wiLҨ:H'.ϳ_]WҌABүV31gE0^FnЍR츸=JԈfn5|̊g:qcD u)8%fikChSlw݂?1rZ{Qisv76ТR2~f1ë2:D'OPe";YsV]jԅz) c$ۈ*AքwߜcWd vgBPS_گlZ=)mčbEz~ .t+*鹁ν|޸93Bo6DKwKN\)Q7E ڟXံ+k?| D6HH]|~j \|:]>ҬB@U-s)0fnrP5\~}A@>hi( ;o&f}P 299=p}4I)\O8UF­@!N~.?D{a'9MI [7z?naПEPa9adthyE#ă=n/J0@ЬQ@bNd: $^Zt$뾟67i>%CDY\TZEUpAbtdblNA~4[V?d@eD2n.㉨h"8-+s޺}/Gڟv5F}zk\.F!FzeB{ɳͮarx kBYltWfu$-Ȁ.8N0^ndD21<<nвݷ~dMuǤp{:d{4#'TǬs#N mlq Z``wc{ 4zwlܱ|8>jzhfVZ#VY%aߙz3xW3pNiA ΝvKh r(<#RG|{M,n]Lbe+,ѣIѱvh)%F(ܛQTL #^8Ȣ\blȃn ut@退Em2U}˨.4NɖGubO3 ]4t++}$G^O~,#׉׫@n"++Wros0D;&V*2'߄/o&$nEsV:%^Rb]5q;ck69t\ ؄q#+(LexhszWN(%*M1ԢCҰvŅnSӸ~>ϳбgőr Z8xw=Kwc=$ +cqm:[x ڦqV_yӸ2zټ]zY'ZO0Z\H4 \$FF :`|2V\3TWDQ{xU{,`D )r#c%MUL# ?w{U/=]M\kɴ5x1[5GZ[u]&9q1^g"=-R1쇲Q<,m9l#7Isؼny < 6ѱ{-$yyw;Uej.,j%|̊{'Dr KX(*䋂a:@chi][S]~31_R}]&P ~B07ԟSo]eS Č4,Za!"q 3ԫ8K^)\ ?J8~6j!#. ՗;nN_ m2ʪH, ]a9Rk&h/) CwO.RQxP>$ 'Mmfc}4цJoץ A=Q4BS2XAV-6U[l记.;@uzJ8Ƭ!`9|pm6>>*5PG^#{;^}aaC?qi@2ƥFV5p\:g=[2"~B[0m<+rQ_1a/y扚ṶI~Q:n:^Sr(P~Ћtw|3om`7i#,Ѵ!Tf'bv.uXzIl=Pl=jݽG,ibL0^ZiG)LΒ.nҞv0zWd!{r#.Ƶ3\v0E0%~ If?- ks,6%(2?N=0sF]"HGVwnxc>WC@AU)MQs^7k] Ld?uuy?Ʌ,ϖu쵈U?%.3[HqB:UP+(Ja(;EbXr72(XcI;w]'z72$`H[6Guؾ8L O]ykFC[x,Y58 vPcMu'#%|/b|^/-MF[v*̡0IhKS0 }&4EZ%`W= ݇y9`5U~fL*~3oRU6 2L~5QxY9 5w ),)J7-'v^x}#+W+3l hl x%F1Tksb!^/!<zA&*(x$W2dzk#G6&0^\$hY`\J|9u:f'XA y@F[#)VMdGZvuu-4MS#}`tל4v><n4Iβ-:] M0z(.pNTE-'Xva{+wF󖅲 ],";[\8|6mw걷 CM'ʡY 2HldAċz{ >[DeSPtszo^es^yL,MC' 'y`!qf7GAXݝ 8 yL.ܒ@tݷշ~w*b Rm]oQKuCݨ)t[u;e77NN$!tL[Y; ZpVaCJ/nhn{B (4Kx~c_=/ޖEW6Hrt<&&0fAƋ723u7%=k S<^765QD5uOٵKƒ1Aم%&1#ZH+ [럩 =J#E`[Q9 n[1@!xx! #@[s"Jм|F^La~?P9km"1?39T%SyǑuӑ.=xjp\CaO.[ؘ.p`ۏ^A޴;-;+Cي_,ZoJ bu+BL/!=zu癯G]'*fiJ)pΣ0K+Vt}kLyBhaW7-5^ dH/bz >KQGp l0LU|߾'#چ\ O@[^0z̒:%;mul{,^E_4TFv ` 81ŕtԆH2=?^.&qHKXpu3KҰ G7]0&bx\vUpH&-5;g$W8eNh8-%b}aُ6{vC`_AsbGꑝW:Pۍ;,9>;uM7^ C{D,GߔA**S8tZ-s"UBVp0* 0$T-&3'4oGZp5RN4 ] u& \%Z\ u\͏|+<;c^}˛Pt\ax\Ԟz==_)պ\!XܼA#p x}|9ڹ|/n1%*g5v->[{0IuOf:ӉAy1@#áH0iqF cAUE/+6"QAEslѦcîgrtlZ>MpDH/BmeëW/̅uThUZp]1C &4P{{Rh,w啻w YdwEt/_E4Z!jҫQ!Kf^ՄƲu, `6Eu{x{H6{1Jt#衣!eDYz艞1Иڨɜ& yB&N`A"1Y X4vF؊spqa?IS`x5֛]D"ZɸKU/Q&+ r Z%6lWwW2zA$sRKESq*!Z⹚j3~  F !va_Wg#l.B֮Xp״Z_ߐiY& 1 e0,K\nIU؎L$܃³S .vgO`ż?H6H5?>+4} pom~/Qx^:ED!t$ڠamhs;QA8k懁+lclec:0p)NK0Piƒm&ԻWfI Z"Nl sޤvPV?cT=l~9*=䲐1&@~aX3 i3H# 2dlHߪ((OZ$2.q O{uSxʉ4S:RKG!b!ֹS-v?f" [Mظ8\u)ѡOw؋J|ۻJ-5\Q ci^:Y4Q3KL8L%SO-6JLK옞a L'ux0\ +UZ!!j'P_^Z/PJY @##ys.bj#@a:E+LWG (E\7g-+6ӥ93M2,0m+C{wyUcRăA;^rvY;+[EI 29% ! SUx.E*=wb ]#,aP]~y[^M6ޜs9Bj}j+$L~.!8Αxm;"QekJ.;i=]qQ{q}`N_㩝SI¦_ Ml+΂y\qቲJm~ow@7[xHSd$Ӆk/^1@}pURe3ć'k6Dڢ7vqy@Rwl!Uā3;]hI-10EX5@L}M(ˉËg59U }{9|hg jN+!!/~GZ >4jZ]5x'8ͼn6X|5DŽ1alц;!n񝲂aL)8|='@8#1*e:pŎ?%2\x-ީx;"-#Uh c`V0C|uMDQؿɰ-ZPJHGˤUA!08-3&iFLxV7aN+ G/y2Q*K]0dSk k}uȲ徰3컦1'wU IOsŇG0,hR}ٗqpu  IJH VT*EW6"sܢQMjͪtxKLi&@O#Y,rQ=<UN)=Y)} @s T0|nC 1.dqz1o(V9wUHn|#z %p @`=jtJ[2 tZ0;~-)/X+:q !l-NۃPM:wѴ9_l͗g) P>CsW.qΥ|3Ru.T9skhU73n,J17s\l5w<fKJ҇E!t*v{I3pv~h?<9*2b~:ƽuX4GwV*[A2#E[`&jƁ߅o|@RXd8FbNrz.7GMzo`O6=>q|KA eC4bTpkY.;**zIRd/k>> J9UaBe:3bGXv =^z<]T"2$o*@ڧc2:D>;U6x;%p0cM*y]hlȞ+L'ER׊ɛB_G&Gs )WO?&{G.8b} DZ^}b*(hR>d|e'#c,CtR$<,0ǃE$.} hxW&Ox%B RX"(aYQ"ZS0)t+ᄒl$!Ofİ?Yt"75dV6 /a۴ԕCIhr4TN:tķ[F =g/h>T^njOXR=՜Fm!*4j%XEݓgYd;p1o+JOۨL(]= 0#rp3M1rWtio+,ZDQ0d~ v U0s[WM إjK57um4: ?"[#.$'Nο~SsfL䐎g-=$&o2Dta$3X58Q6~yuxVmՉ G"EI瘿^-B. $!.Z A!cX<|OpZ1y04CMIrwxXZ*< _oeH0g? BRQˉztt{0?낡MiAv~-ۥpH}hEC^>Zi˂q0&re hgrcAb& t_g|c@)'5z4:awš3ÅZI빘y&Mx.x6W(S4b eP8 RZU)W9Vn`d_q$vsGݥz(G$Tk.(vW:n$@ږ#H*RFwxx sw(w~=;%/ᦶͧ*A^9Q?T¤xdNS'\6_hK68/5'< |^J967A ?z^^I2M8PSP9G}^_B7mШI$:pm~O`j7 8fOCUi5^yȭTo[u#=%(4'iiR;qI;]zSDm2/u;wAd1s8)0ႀE:ǐSIVCxsI|EOFl2q@YhOGvN};3!9Ǥ sBKaG5VK9=~_ΐв$c/ 2`R2WM9'^F-GYi#)7kNǞ0ВlYTM>~_v,imDx 'S8%S*~Mu=ڽ'؈EQ/8'iît|-?ălCpi/t;QBTWy,8~ rFo8u_О_Im'kQ`cK5be(\c jT^y,=ĸ$|=y U6?oH&h`H ?M.0tZ4ny#3^t<`B oËClL9۪VD(>hc#^f_KCd<1zOf 31ls¬IckwսNJF?LTlXA6.נM`2JNc,!(Kh\6d?6H,.O:d4??:3딷CT?A`4`n/;*|Ԡ!X_[^Zޓj~e[򃸇McФ yY[JZhX8sP>՝t+7n`ŞBPIPӯ=y,1]1%vBv3_*3y {|r ЮԌ*܏"+f[‰R6D\p"OpK|a=N_Џ fBSqa-fSzIUѝ_u*+ùv΀F؈{ QpX1^w#s?z,ozg7#LCEop/v A#؄)GA2,_&%\` >wqx䒎܈2ʰ$4lIZoX^PY*Nl %c DbΣ%OLB~ Ė !xd+EhFv-&=jP-;Uڼ([ċUq5F1 ݒRݸP;%r$HbmLL,C ZoURU*P~0X;W}YƗeF6utD~>REܧ`iCx*}b:E30U*dgmGl6~^: t=K/љffGWC1n(xa[u7M9Qm ގ\cUw9|98?I\&˙"ravf kjU\A+[]1FMKh ]ڝ f=*=nVquX􂧢G9/ꀢ/󟭀Y)L&!hD&/&?) z~@pC aM˴v7fbZo d^3:NNi$+Rk$1m v vC)8!`G&I2̮6pjҥGw Oi'2t[>67L:-~=q0q'ubD; ~h|w0ĭpE;r[V#MRc"R>ꬭs$hCz$B,/b_'0gCSlGjr IC/axC*ī"1TTAC69t d 䡆TP:#b(UDr8O;,<04q FʣB |- Z1=@\lBU c$ѹfhbŁ0e{.΋\nHzJ6z %"2ݬEw iVNІCxYgK)1]cKd$83٘p4urSOy 8l]28O C0AW"JincTL+ #h}YS!5cj^5SnGfTǓ5'59a .&NtoZX`2Tf䰣ŝIY)V MlH #Haw^wtQEbBD>MS+:ͨ04Kwj$Ђl5(aK<jKU4]UW_Dbŷ7GC+<\j%q+9;MMcn;$. :7FZ'ӊ&k=Js=.R8R[=YZ;њ{'BuHIlVͶ](w65wROn;#I n:Q>0 XIhqVlDGOIrRGnuyzWg\أ{TL.q s9v;:β ?ZF&_q 2 'n'Kd&T%O@y^Q 8K Oi6mj $L A_ hD` "1ÿ=.*Pƒ?Z^0-8] 3S򲕨ޕe>(16-'&iO p.O;v'Z G V*@VY|Y}X/]і-Ü֐w7b o 1H svFڰR3LQ#0=;b<,N2$n?&i*wg;o`eI`R9Yd;&&=ώ Oe6! FX3Wf8#jX̓pPP̜J\ H(4(`Į~郄*ȬUl~wZ'^Ш=n3`M(#; v^((PZ^e밳.Td͊CY<տsVhY#9^~z!pYz,O-]U8A 3wŁ4NF 5Rګ[-kL=[bșu@]Q0j Adkd!u_ HMCy$k,$w@D2< ]pDRz-v P,+{R$ğQshX ,GT#O7ۉ[Cf bsU LoF јvh^Ѧ˵h>_Ȭzu`09AbK3(ۅ!gLP~FprNԴ桦I`--ozp22[ je6Fڌ7z7l+eܩ)Gem uH'|hwɗ1!Bkh8 ӔG)XTC j1[MS]vl)>b@"H{j-\?]tP/ur +Kyh!ǁ? 2JWmVJHCCyf9%06-HX(N8(}w+_Խ<bMHHc)z&`wZǸ)e V!Rs/zv-3trPq[evgpTB,ȭH|{>E:} y+&ЉG ~ 2;Lw(@k{clx ռl'Sciw_]Bw6r[LB3ﯗ0uq+q;OeEANTʯQ'w/9i C^l^S*3Ug/K{&as֖Az0e5[{Ցu" NJL & JG#ǩSIk"BVT lPp![`'s\%b)8 Ih XN`&OcCzjMzOƏYYӁOȱ(b ma ?WAYy[dJWQ7 Kqo'fj ؈Ŋ6xU kO!]7;4cH}bbjdxʉҺvf)"Ve R4zmAq5.钛M%]7H8t}A2uCcV) ;ZU <僼|ݳn~Q$XoH)%IbrR$ّͱ)`yeؾQ-TOm%Pu2(^9g8 N}mM}FӖHfPcۅh"~3vpl\V.dT ^Ka"$ /]WpOX721ڊTyv-|1P(}?'[4|AP!1 Ɂ}skOsMcܶ! ;B .7\ㅏR(O<{u589MOVO[3ZߢPHR +ݓ ]tBV,*@, e,n9.D1SHUu?J3 ȥNY)WyF#㉄41sS.ڱN`b,n80Z9ʍuKųe;X4Eт+cVGh je2qڟR4?i")U H/~Q:٫f-f~_s}9{ N$Nf?vH}I!?;4vZboE"Q+Z0%|Nյ%Oe"\+r 3[d|kT_h}("xb[%tT)*; ķ:\ȂTbve'yPx@JxNS +(3 ہ;#O|*} =%}C/aKمǻW<~79%MCƛ>-9v{1:G,6ŝ<?aAN;CnMh۽'[YBt{W!N"szwEM9+OwX5NJ]M }F`_J:ZTZF5Ff:L&Ihx_QXhE Ͽ#7$iz%aIL;Aю@N݊q/=I4S[RTzK"=USCTy8tM;RW+я4lx#*t&t7DƨsZ^YL_q]O2DosUpj_C"0|pZ҇6kyEV{Q{?IW&TL 㸩:3lA۽}ẗAV /1Йz[<̆s&nvj8';)S; ο?EBzV"'Af O ܸt 5*7&}6jqXAZXlTEp3uđe(ß-mzXS |x U`,0`K8tcbrX;V_BX3u , cQ.Ze)Z´3րk-Ecrfkziǔ;pGX4Tǟ^ӣFz̃LT!kG1.e [P/M@Ubǀ[|%#vԮAF%wr0MwB3JIӵq S18uCso36Om77a [ƶN4QH1FOL9pXv9g9hU 379k٤g,=Ӵ,ً sG%3y~'i&:ToV>D[Y4#d/j wDa<u&N_GS/j V_ޣ,K*N?~oeؠ8&tZdT^ѯ{S/fB79 :ڜ̜Db, $]!g@ '@Y+et]:fRW)R4 {(4 7y"f`*UmEbW[l@0T<5P-9e > t1 YZ2a?q-qTm*Kp]!}ag )Haۻee/$CJSס@*ᇑqe\fܺgzH7mID]L}#'p6s\>WŬsT/d@ GT]q[,c#s l4 ~sϸ8+0Q0T_y1/gq1I"HN|% Bl|'MKlK_ȴ sƼ}54B;}6A -{ؠB sgpIGuK63>Z'PcǦ܆,.N*ߴZ 3wUMd x0L5dĀ3Oqo:|91T/2JA^f#!%KK>АoL?]YxPЏ/<\p$ B^o·m>=yr\=33"SܧEqN Ec*hu4<]64^ MpЙRկC)4";:]-{D[KA<+B"J3(l-FWlr"D}y@צ KrW\Ńe J(=-igr׮ZVW%fOJ-+i6ґOsnZ;/:1ţ`ii 9a# ޹?%"- s>C꟥L enA Ցqjo]);AD Tz 7rr 6$nj=D&v e, |OV\*f3.6kKj$6:y2<{K$ ) 9rhKas9Xl>[ ynQQy%rE鮲pLwT-O̾A t$\k̎X^Z5%"0MXЫ7-ԀA3Z;'k%ة]c] " hrJ_xfkc'qf1W]y% «)!Պ]\W.w} WAkzA̭M|YLsL2ˇ ޶!qli^&P[!WRT3g,b+:u,zn9*:Lp*e<08Ʉ#rwnn(yb^a,0?LF_)RlR%SW͞!?x cn4 p> @]5㙎ەC8tYi9 "NU_^usZ fX ·؁|2q{cB2hiaS;nNXpRQBV\8Ԩ>Op~/ >?Ɍ -mj8yQ(&<=TOAϳH6oBЙŹfA( R;oŏwx8O7^Fr };1m }.{C# ,5 R5յG '-UjfA$s;RGi/ig$63rA#/FHzexN/LkzXt[4U%6Sd}X[5q .rȎ0J4ɔE6 g|,: >0n[hyA}xXsUhiCݻ׍Ѕ}:iW0 ;-NӁ=.9҄#;iS?z=3K" ci-u%H_!$RA$jbIUdXQTB|w: UyΗÕ`k͌ u0-(䞫"[g,e(H~)% 7i504vWLJ9;DQ=ykL^=X)!+IpA7O8Ss EUnLZK Z釭V'p[ad@(tQE9[-*)04,BljS+OQMh+rA SMSEdk?FnD]8YH-Bw!ks d:TzLp&-`rR 9?h-zH^pk\Z6F\W ס'o-c).}(֍;4P$"鯃o̘kT/)yus8y֑FP?Iz D\t.}>S?qJ9 x )HwqMX3̘1!̘þwNf5˴YOƵ9L+gԼ]F߰) qKYNr0`R Rg+EJnpsࠛO{b7si =0]pm«KMsjiBq^df:F4xuux4 (B?]«\gEJĐ MZZci[KRbO\C)p EQ&ie37N7QFPf=ϊM-X] &Z%o7+45!&{6Bxa5PK~֢4ThIN64;: ,ARzI#f Kt, U\fe@0?OfS*' nʦ%|弪5{!.'R0[Qq߁8pq(8*)Ě.&"h?m, Vi-z*'=$s=ofz~HwŸFXjWwZHg\'h~ Q1)+ȓo2J7e1upM^JqAGdbDxpz)ZǁtB<'dTV8ϡ"Zl5o# ^+nT5ެi`gᾱPai|)yhn3֥1ekMpEL/bu&AMD2`oK]1C'ь?lwѳ|⛱I㺧* LÂ] _cH}uP+hЛNXt/h}լ\}])f^ ȥjp*˱i&p=]Cap-6ezCmZ,=WyEd[w:\mW{IʱeQzԸ'ffdrM!eY,U[26(=IKDZ9aƴ2 fȧ'1fρyj )*-|Z4p6<ϓ-THQǸE;'7ܳ-Zq| 6qaV11'ós׵%Qtv")5[S934 ap7>qa#Fg*G7%yGa|}f4 F5* rS!^6ҜTuБOյy)T3gzyI fDB/@8v8֔8K7h.$Ǒ{[&QS%X)~}tK3_d<>fՎ̳(ŠX2Z.*#85&-} O]Szn<ڂ,e'9ݩelQvRE9jcPRQFC}ќNnt- Df_7WdL-"\RkUv% .%Yz]@ad/6)-&Pz0@ I[*$oȔ O9GNfIm@7H--Bg:WmܓZ?HC4k qbݑu0Zۨa ؇Np|/ N@0]{ Ox!n'E(fw;WO&9v*yX*ZA :jEE;ɯt E:-h:ҽlXoĔ0R$dL QښV/UgBq#fh{ޖJ?XKpԄ诃+ ѓ:K(^(a5 l:T fHp Y..1`)h.-tIg94stAS vom M4pVTQMշFy buS<yJf,Rxy1hoogXvN gIwuEkdZ3HCB8o hG/N[70,J1xy\C5_L V8$EKA$_BO#Ck]1Ĉ ?Pq+6+*QV.F HbD*GJOp%&!MR&%Ui CLJ-V ٚۘ/w^zsįEMn=RG2lMw%*Oȍ:ů`yf~5]7$H'ew~C-'~pΩV94>b*%}PKI4\y ^ Թډ]C~IDkl:;"vΠPӁS=]?Ũ:eV8 Nmyjh07X?c<ϝz| Xw Ow<a:ޖdYdRQ>NjZ550`@|(2MŅsDS'$UV"齎1'AU4rV{kW',O O9餗P/Ml.0lw60?q?%Tx!1ShwJBy.lc}k^ (^;|8dPvFvP.K3'j a3?Gڴok̡BD_Fe,*3A~EK#bςM胷o^Z/ 1EyXj.~8h}[!6_weJGóBP޾x/Dj@|aCvM>҆Z|00Kؐ/{Slc7lӃd]L 0}z%J#bZfRq DW aq]1(ZIO0 nWGt9xT*g%[\w)E𝡖z ~uptn3K`9`PS$TFdx( rQ,S fU \*y3a]^njV>tX(ADaJՃDeg5uΑQSBca&x#ޫ0D֩7[Ԋ1#w'"Pͻ1 Ƿ?g (c(yhjgH]jHAE!G7&z'}ֻLE<6q>q'^+V޻sW/WP“?0=&IJA=% @QD:{Xv ",TKt5:9?,@y![Oxݏ7dj,OCt:pss-#H8d]YgJh~=]4-Qɼ&K8üM8$Fkj^C=*W/ROu,?ȸ) S. JkJPWgZ>ų]#Vigp6f|.~_ӴD&+58 BHP5ݜ]+uVt u=hvThR'Փ\OjdBT)f"jq} hZ^;k]&cmLDlq ~-0kJ5lЈI `zݣ i@C~(*Kt91.Lf@ʌ0hk*ۍ6S$w.z.^׫ <0}O/O)<"G(TIgz-EY41tFIJb<`S'VV}f]n)F&<2Ϋ醄osщj7=ҜBO}E~fw Ս٩{|4N,ӌ> b΂)thKSwt_ub` Vs~-^;!X߲m NLgGL! g%Ţ AvoJr괯Ʀ͕9 8CW'C'bn5ԯjv|!>'vYQdQ_ІtxdwTk=Jco$>Fn:*dk6J- eʐ/C~?0#W]g㞝ZG;89㈩&\WTs!:^i8PEqqW>b"c>rn,!? nHl.mt#wN R7`~7~3i0HBq-63yHaLֳx |rZ&0׻=yR.S6z3"kE3{:Hbm;TﶬCbY<?[Q QFjW9wWݿd$_']#~kW88 >2XPS`2W#%(|-|.s abؔ zӬK+Xvx,Vs1ܻD(2WG njQ$̆ nzT+Gy #^\KHڀhw,7{n}L]sYع V%7b)RZ%U:[8o*l-݀WTN؜S?-Ifd`:&j %]gN]ؐJ_hUat lƘJ.=/n- D3,#IS:1g{`*ށ8|DihApU 4 syoŎSZk+Qpz#3PY%ԉ9/P/Ac!ήϣM#y7E-9(\(LI\ 3P M6Yٓ%QDum-:!WMFV&v?3 U(ȃ$2RNu ?|a!+VadDC%G$q\4iČd',CdF48xE1nDʇrAOQRD|?3S!vSHtV>31q22/7G!r/>/~'91:Z:᾽ah}~sQpßg%?i85\Nxzr1{ 2gCd/ {mtc4?8JESǂjBXy9g]NѺ{?{Jn+~Y\,#{68:i=EDQ;4mXRx UH}$ @ObBFфL\вL9W_n g.]-ۦ qg`,V1{H aR@Q!f±,Ntc Uf~OA%WJ/9[$`/bolg0tbc&S;f!l > ?ްwSU`LxՁ``ǴQ Y$!;&{"}HMP.)'C"|zC88B ijZ>c&XXo-- ҥ~_ל&FH-2+-"]萞@W@ɾ5߀JTtq*>UHg"s/t Z5~i'OyD_5@p^'.J4 Pņ2Hq>M&l\~95SlWPwЖ2ǠM,`G%&5+FPys[OGOr8W+-|Q^/x#UpcO96K1rJ2ʆ=ǎMJ=YNBqzރ@ΪZ) i~'DvD5.2͏1/i+[3B~k uyVw[AZ㽺MWw_T^L>ys ݲT#sukϨٙӑF'@-^}B} hdWd-wJAz/iWGs 7 ,0m&Yi+#mT{lk5LdAԇU~ę[+ UH쵓g i kBޘa n^o4#L=Iڙ55xy/rX|no6`;TЛ~Q閗o lD-*E޲$\ Ǫ8% QpKnLUWK| ztxHlt \cYSsukyB.@6$=$hh?\gח-WG/[ !FId/.?+c [&rp s4GO4V&915Z$\cVV:9xJRfZ}:w ޮqTA}0G<xIK [k9.&`(^Hmy~TkZ[yS'4":w%̃*(,R3,ꊇCEj"nK;{)և%E կ},2#Yn}a眝qF&"KU7˄wl:۬{.+Jmq$mG k,[Ɖ>10'b6T&L@0$K OP1KZ!Xl-J%!Qe6eF&ܸE.]" 6$/$k"~>o3d~;|/VФt+,iEdRSi=VRǟu,&VO] [ qP@FL@w?f9q3C#:՜d 1ߍ!??Y}<~P݆Jd 4zzXu\zkUי=W-'g$\Kv9gUB>> )Aſ"a=!,wyΰYDN18ޣu=ۇQV斿'(r:*BȪsSl U>J-]]76N_+xr'PF4W N,++mV7dͥ~_[WBKQEnr^G<u'Z䈎8h~nr< eho&+ΗIQr0,[opD>&:_DTr6J$Vy>fjGɑY@joPNTg=swX:IkV. R6l' 8泑n_|F!uH8 t[x4e>~y Z!.{4ד8S ԝm֤p<[GqCXIr/[e]Mwޒ5MOV?>H `vArӛurz&ZYG$hl[wx;I"eXuóޝ,8zx472 %cu\{$RlwMg]yBҝ 6>4/=~w+"!Vha_ʐ -XlH)CG Q\Fȝ+hLGB)ZZbKo?7YOhV`:cEÀ9VS8\{)JXriPh֝s;Ikk$P ,.!֖ ]5:ķHj/B?=k6XYW^6X1 9G?$d "",Z ]iPdi0B7󁬨6^$~ּ9e)6[Lam8uJdeP^}_}(K';qOei Z/3O8ɦ7ۿlwr*\S }+lRk-Ml]YDyB.U1rLL% :ah}k' p"wHXJ=C!"{d= qRЫjo` vjgMOg.H15&H:Qn97`' 8rfp_YCp=1$#%<1IN%KlAK$?\0#[YC#D6eȄgޥ"{Zxj/V b\hOMN@Ppŀ1r.y0 Rsw'Lhw?czEMq``b" glET^^8(EbM)E43 u?@W|јOjso*Hƾ *F5+!$= TEboU;\{_mǚWMx} mr궏[&EPAo2YSeh[6X3ʙtyp?TCyTaޘLyH9*Ɲ ;0U%a!6/[?J,9k-cF2إ7ˋl=bify* Wߘ/bFo Հ@de9' H筠@*SU@P~\αa7$Xf!CDHˌ3U gI1E*a􅌼J\GΞy]1wѡΛU4Kt;QY۹,"V$ Nz$ȠLf+Qs2ɤv+oTGRb_ P9vny -OĠ\ucxQ[ќ-ڔχ}OJP{Pnw=_.ޅiM>r_$EZm.e& }0۲:v㡐cLa5C5t80sN[Ңc1 B'$5p6|'Os֏+$Q0JyߩRgeMtPLHˈ=2u a0a+K`k ňpψIVK)OaU/PHz{X%/.\LOWș tw l|ckAB Anx  #p0RT"␢IdB1=6;^&>5/6?>Ì9N|@&׊ Xey>DR4GӱaRvI]>_Y4ڄ^,jT}1@EIT'r˟URbQv;Qmtj"aAOQV:k!6B"F|䯈VVB Jf 6 iR š@1u$q 2!Yd|9>/q%9p h%plR`?[)I4W仮Fk8Us@!ZPMQAr8gUkV<;2G9t_K[Fr=f W.a_C~t >e!Vaջcxz}g8 Ϣg&رO:ak-̷@Tu$662*n^%4?q@bI"5$+<2K:2B%Z=Y4CD|hp~I+!ozqvY0KG ~.}CO:c0TWgT'BC d_4cF1 %VQ%зu-B-YhGE0]9DLڽ`uUt '0$f:>vIh X4A""Q>ͬ}P{!YȨ%gW3UmhAE7WC Gn0L0+M7:6sܾG _?k:)x^j3ql)f.QNCK;;8~ZIOދF&cp讣V%CeFm*5.RqtWs2Tml($5"GfV֤-Vbhr* _)e, /bSwgL秷C'w! F;b[ gC{p6-+b9{}gž[pFBCzT5)M?5ĸzG iɷ@6ZY׺F~Y/0 `տpYvA 7`e[ 5!kԙtմ k /iR~81̾Z !Ӝs: 7rO 28/g*k<od-{V!dZ9Ϥ0&AY9;'Irv=uaJu'֠Q>KROA]h'חVݗZֆ6%= '_\aӍٿZ˽ B,ˁ;#hpt8%tJ80HP$Yp˜j ub:<3sx2r;> _S!h *c/[% ?8@9h$(tf߉[pi ;bb>A0&ڝc[w~p )"sF]En:rM^;2`}.W ƧyۂIIC1 rI` &}ƁY1T2^_ԆJ%Hot2l:{y~rr6ߎj|EN+O^]ly}m$&^h(;KqzǃF7۾x\8a?W}-Dʫ#tʌDlAp4%ڐYPP GZZ'..گ{8~g43p!RmV|"A_&ỉETO%=a5;֙gJQm¹ O>XܕJz%NW5 q8jeV3);C-A ^yP1:of5>SE}Yf]zk~$;O\߽wU Ԑ̏/ȏ4[p`u"-U0@x {v s,I&"659 .c歆ܫ|T֦H3AF "a0O:ohAm2ׅ-!;AR.s9$ċBHZefHV ɰ[ *eݦj.Xaaby&?DudmU#~M͔d=tX7Af[#R2JC_=F]:Չ{+йUd@lP)DC3a-~/Æ5>;fL#F;=uV/({ÇtJ;7Tk!q6=ccS6LL[0} /,z7C 9۫*ؿ/9=>LZ\ռ?Ax6u@,"`\2-=ʸ"B6W,?AŐ6Eᰄ޲<;*LtC}Ws􉏛Ac^)ˮT SrV-_M0>IK|6R!Xq&?4OMMoy2hs2{H *M7?Fzl{RtÃ2۷fxFQAȁhA\"Ϧʴ4Ϙpg m''c,PCRdJVpiBH֤vJ @<gJS/y֣CJ[;iӣ\CFg&. 086=h*51:* 8ws65ŽZmIzBs/Ї*hIY MͲg;e4 ^셣|";,Hd$>o1 wǨ2?%+ 9}w`>L?m [sIu]kPRkv =tXNWG+ķncաkP |W NYLH!+` 8%: iSl6>01؛3f"X1('^7u, mto/jlͤqq'rC"Qky{(]XW`<oaw]N@&H,I׉ _tr".Q_!mfsz$PYu |J6'_wҽ^ DDRI%yoK0AVq,sST{ȶ9kBi:*C0l^%i N[EOZjTPf9_ti>!y؃.~w< P Wem(;gH(K6}@Z;mMpM.)Mx8E` . Z1:N T%ͼH}BmpDh&r0r7P Ƈrk0rifD6՟!sjC@W c.fDR'Ƚ[V%{޴Ma7㬕mhbl,4$FuXKA*~!.ĊIOMLXf],,& w*C5 \LOtr1%]{$3u+9ua K,epʺ=mߎ4{ը$έ`N1r76JT=q})SNؒߕMb9BAB@3ߞrگg0|zb˃{:Tc~gԱ\ܸX~$_OGRo\ NH #qF˽"^Lt:9 ^ 8҈|aMT/b&(9gjH%澼V/YX9>ff,T<+նj<Be:]off!@KQ6a>#Uho9º}yԮm8~%EB"4ڞ|ZZ*Xz\`.k3&I8U4D`}2-r઺ngzO𹋚H}9b!3ȏa5JށY*k9 x4}XƖ}ݳ43@1q%2s(=_H9ymK\m g3ΫCpԐ@3ɝN 2~?lsɯzr EdSox1]Yb_v0 9("X 76Hrf-D>Yh\i!V1~\jMdw_}F#5Yad)c$2L Wlش (@%=q|;W`gh*_c+U9 qLBA aJ9ɛ9r-.EF%4pmb P<~z-.VL3C(kcA#LOʐrfjej:B80h Ǫ &;I֮8/_],ʾX%Ok^`!ğΤr*FE1̺7bVdLY 1Qoނ3!1X>+BFx5K@T<`$SL=2} [ngBH:pm TNЦid~^8èTU;xMY#wIg;!`Ď aZu%"1 yE1!5yV6N k^i Y)aLMQ3AÆ)NTdtŐt ^5R: xezxY357L{95NM3og%nU:Ko;R_ee %F)y Xd[ۻ:T%vVt( ۦSqD 'nȩU|~UunWԓdvL洉k|C$gu^c91p1^nTp*g@E`2Ĝ'Wg&} P[*shs&Dhܟ{*iԉD2&xl]0mv(\eV'/߼oƳ-.:%Ӛ %8LKM aZ8T7.!8y@#z"6Q,UzOE3Üc-^B$>LI4~}Q\J?3dR |B+&ԖVg7 t?%g[} ӳsٿ") Py,8pЁ+ m!a!kȰF-s )6K% ߬ZI5ۈ6Ó~HX<DR)4qv] N:"9w^ܝ#XNF0lt6De=_}Ɵ"균eIgBGJFX"hvnFi9y"OS<9׼wmu5 UD" 62Ğ&iu*M= y!?""$瘆4UװDh"j ^TUY1ld3 V>:7zGT0Sv10KX2s(6"EU2g k`!J+f*TؙS}GNf)Ɵl߬25\f oYfk .wL.ĩZS0q, 8I ~+Oݔq@Z`u-Op$H7Rm>*C -R;$d:+ԧ/#a-Nv t]D=-h^Ω,jU0ų~ldV4*0uc- *uΊ*D=}B ҁ:QPfO sN7a.f&&afi$!pgxV(g] e UXg@=a/C7 W]IVvimS'c5<*ls-oRkBTUʛJt:#rShnNM}y9uP}Fՠ#q=v,-7Uz$3s T|'o}E:Qy*4Ae*OqhS ,ݭ|I{} 9ˮ&"!S9;fʲֳE%K4=yhm4AKDo^ZN3=Ti 29[-[48b}Ր$ʙPԱMcx\-P=)<3r}=ߪ{(謒{1^۟~Az EQ_!P5w;J^5M'-< qfn8/; &qSM%J!ț:s0yקhe6(i fM+clF~52i=mR"vNAnZWibw4女\2߱A inTцab;\!ҿH\Rwćcn,|(B,<֥쭂η $^oBe>d& D= JDi62-kHU7]jZפWZV^FD܄%Y0V^ʁ3U3:Nz1G MlZBӨ B-r%P޺ c%&U(x4oH̽hțN<˄ֱCldLiak>2$ )"MZ% M3 O^/¿ s^Ʊx8dtiZMV4cV u33fDO.&ŕt]HÝz5+(a&spΘYUKp G!1첑23@wpKeW; 2œ,ʿk. \|{뀛?hB]Ar }#:t|m F6=uWL{ ,,pʷ9s_Di=Gξ+y TĿVcs -LeooLd^}KB"<-;>8(%Yr*9$ޮ%'gf"h\Ҧ/" ,P 0S,P  bG g\@nĦItY! *j`Vz@,BuwAB0c`EDWq EìA+ 9JB_kIqZgY"Qme]M!ixMTܝL5M6<>ۓMV@6VG~N d͞(~bR@zFeAI": Y:B8FS:LWx,چK]yV >qGxF!qR x˅OV406O;(;uz\:) ?oIe 3Bb30 G9Bʼ1 OYeAWҎ.j)C2  ╡Lc/2^<+qȵV4`(ɄJf7 hx^V(CDQGDhRp]0ʼ"W T8"yZ{PJE=J5mRϨT5gC-b 0iWG@)X9;/e+,.r[Ԃyb/ )AtzGՙOAR5t0wE +Z^^1O({GگVx,k>:).RKLP _Aՠ`uёq` Lݰvį3 @tYy9%&VfSZ{]0)`6>/c1t(R[Ddz -GgfPW6l IB׊rvd7mhn6@d%ήbdTfF4:WªGfDYz /S4%[Ñܸ;faj9d-u$DpQD;kwsg#/AދWg Oy_A{+ssc 䅷&ljfX5%0JkOHo$$GCۂv"&=z]&8}Yu~p^3(D9 vuL=_jv&2ۀ l- գoI$o`jGMo}My `HU4hK b`8 o?[Ӌ*ȴ0OPo quwRщtIoti,mF z58w쾵*>Aw HN)K4_r^. ڤ >ѥNraW[1xN읋Y,T.Lk%f,(:$Y'|nnov_r_A\J GԦ'W ͡ozڡ9MA}?pơf೻ X0plFҨD{ [~`kMk= ~;g(^W᭳{ %bLvg+U֍Z=PLPlzjҹ !MNS2~F\W]V[F㵹/"@6 [DOa_P~u2hsA/lH(vL8X =ΌTmĒ-B7L"7+ -OdEjuXI:%dwԦ1:Y#u#/n\+AUknj& O͕T6W٠r"9 2v@WMfxjZPCM`ΐuuh@ [؂EFAw&Z'_a(iE909Ne'YDY ^ VO[ڔpe~,A ?hs5JLMg7BpIfOS}gf3u!a7(R!),$e#mH> < Ģy_Ǫ~4/=og S}5OJp7ȪKCW?X.&ԓprzfg 80J~7j@ ]3RB~ü"qxk=b9_@tѭ{vꋦ a:)X }k+}%?Ԕ3jILM)IJsZ_JPؓuv#0KX> {_o~} TFNO ؗnqc?;ϭ^viOE#X!}1-َ'X(JY5hMh~+˹;DҕbItJۗ]dS>Ր\t"`DN\b5}bR|OhEL糾^pF8݃<6U-I#]墽o/tB&~RLd.VR)--7< dhI8}y!֓ }I w557(l~W 4d$u/;w b#&RKfDF/hPfAx?6B {$E_*XiUcὄ詨x>x1@~|2* s;$-J.NN&jp[ɡΪF;ݝ_Af aξֈ2XT`}㳭R#خ&n$JkJ٨r&5ࠧ$GD?0Ej]\O,A:om#^_ob6AAZhtJrtcj+҅G5׿3glסH|o4ЬWim No=&pWEN>F1"M}J?hQ2 ڸY ۩ n㿂C02>Q>?mo3){ƿN袳NldIi59$ĞXx_1RQnyχP `H6#36o RqYPFQ eS=eV %Eb(O={o\|If Mh:v<H7CiB`:ۮYWe (ڲ*쭦 ް2Iaꚶ3#]4`0 d"v(1xwSݪwYs:S꯷eiXHX*jI(:Ax qE{ V WHySM[mF7{}HRR*m.PiUNiS`.}mX * !O~PA*K+ i r"AK(\}Ԝ%/orBOG*ʺ4TT7 wd\yOs }p6&}{ VW";9v=;6qܝUlS@5.nZx"!;o+-apt`!09'0Y׈bv9mu1l=ӭSwhR6g$܇y'#o_o̧.ByՔ5R-IeSue'؎ 0׵ ]؂o\!iߔ|=0yx*EwۈՌ>xPN-VqtN'K7tv(9i+Nz1f_m9&1VG lÎ;oRO`U8c}(4i9j-.QBOda3ۆjqw~];O>6"CA?5耹u^ߓzr` ܋Նr! Z9"?hQU' aQB x$jycTZSOZ ޳E9Txч&*dXޫDFP|:T^Z|Ln:Dq:ڝJMDVƎ`,bV^: QV͏ yo?}WyB"OLd,Zk;tg>jM!š J3& 5d84x0 s\ >OK/#,֓P^sFtyu@rԋuB$W}ȁc{8# }t &d&k Q,X+>B<[-wg7CqiytpҾ5a=n-, dVQ YՅm X^Xc^*sP*ĤbCPNE]mN+7װpm xn?лsX,JDTpro ol:fmN1Y η;j# +H4$lJv_L!ЍymE0ϸ k71W<ޯҰet_{r<  x wLB$t4PmcgE6" p!Q.R$E}r+Kf|l¶rxJ8MXxߠbA2󯃵/7u )bHsR7|]%xX^Hж_ğoﶌ<.1d1cLbqoqkU3?N#Hrǝ;YB3֙ @uSN6?J:!vO"f7B'EmZØgӢזzDit"rc^]W3F%i=D#dN…`#L\Ły^ AqM;%[޲AkRHvq4-={+eؐj$طr-PvͩNE{&^;}/bK]Nn2C!rR\ 2N{qC2ʇ trFd@0o- `>/W)zDɆ|>a*W1"jN@ԑ0EcBOc>=Fڒc%*ކGԞ-# ˽ pfpbK#۽Kd<ĸKZrANr]e S *ḮK%qxD.#nek+(_NOn{*زdnP[OklU٨X}C.Y*%V,ܬ!#}̵Ti"֋$67[ (q 7O`u.F~`PhokN>B98;+ؙo(qalhxtEIr&< >hVE(;&`bђdY0u 3C߃Vu0]Ns> x)^@7 ~~ɅBPB2"00ۘ;k3ۖlU; ڻ:9NHص=GnOv/OM'M AvvBbjل W^ե-e=l,:'9J:)=9]brn3o[8')I:ɝ֘EJ% V4i8ŔDFRT[H,J>e,1o87-m04V 0 x, X2b1n6׌5 l@Z3&-k좡 9&%<oUJğc)cwQBwųt`hkӹqp!ZEԨ\BĤ\-;eA%i|1Kl"W2M&qNXh̯-߸$}x 5rD cªWDC+:Ӂ{h?ΛzwK KW@Dta޼h2%nB,|ΆZ{XCPpʹ%hn\oH7wq釢QIFJ-"HIw4(`3Zg֤+!OnoMvRxwSk|?Wiϒl-7i^9AԚԲ$OIKmXK4>IXLų{&f'j,A",W{Ot H׮JB L| 6ivn鄼-eK{Vk[P+*""#(ca&Sw6FU4J@Z8FN64}u /=2ʮn?(ՌߊiHv|YxY$g1HbN&.˚beƿ*)>'yoT˵|z&% id>!`X\u2Yrz S:-V̧bnՆgɯ!cKKAupEKJjop㇑g&;0jr݉ɯ^+ZN"fwg[2IP O:|Q?fB<-^>xہu!ZYX6B(Xq^5*=q;ٛd.0&LDH1MrJX%|!7+<UlDߑVIY` OXA9tbnD"A:p3{@%V_.B(slbM\|@0_`ρޝL/N@npMMf}XV[ۗx MY9hlwx7#Ms?Hid=1U8>[C[»uC$Gu#P<}:աߴsY&iZEr:yxpʜD i@w'Y,06$=xiAzLdWɖVHV_BjF0u['P~6E{2nAnr{(b E7$8UقFUV V+! `xNkh/ dNX?LՖ6mc()f󐯾iGȑ5cӣξ,s.TN0rG9b ٓ7Y@m4yY`KcͯZPǰlav2P%{y K)ƪymӠ -Tۻ>=7ʶT5ĶoSl¾L߮-,׀LPkr&~lXM4b Q `!0b5'H^\ތ+ (wpՒy *q rG geBA=+)žmEti}CrӅ#҆'ylH(7҉x/M:p$q^i@we] _:ß핝 4@w߭"HR,*vwB/gM?VH@[݈ITIzzL hZ^v b-D`i^- =W-l=EۄV |$d" H5鵴r$fg;8 v$`]G7w5:S.KqTymƙzDH3aKiM ^gFԿO)>NM]AI9+5Kb4Fl`*;D:Z^$*IJ6Fd oof>X݉_Ҩ'"`!4[q,PkoK -tJ ;((oP=1tk̡&tfҋ gvyėaBp2K ǩ/t >Lh eՍh "eHm ΂i ɢ$mr Ibz"Q`li8FI qj6 iSXː<4gf],CoD { "_'۱Mbq%JX=u6Z@XH1T+S ~_L,8&39e1Aa'G#W jZ+%iB?נv Q&xi%VXxa)&0~zU\NKC>7"k_' ] <.ÿ!{0%djr VPDy_lYrjQsE&L[-\(bMl4aG* ?bWU=؞1o_!Řa >d. W [h l@E׋>`}Z/yc{J7T^uL*%7vfVg0|_2֥ {)Z!p79P$;ϝXm,S##!g2>0"$>)?;RyK $0vv#W2o@Z ]7Qj*Jn.Ǧ_"DSOVI#Zɉ ߯^na=EܦN=^=?1] S բ~a _ džF_8/Tۡ!͕q5y\-dyoMP~cB:aHKDOnp+V,Y?YR]z6F3D %ϙ%'*K-@GDõLCܫ;D~q"A],`j<(7`rK6X6^N`/y7W.w+82!D+XQ Wbj̴hU; S!R{v: o"ItinǞU 5B2ǖ aN cMwQ:.p|!q+Z5Vvڿkܾ:[Lbyx6ok$׿:!(%#EGhYEqi-m{P X)0{u;38 6&L}i8С☊aupN"jDʞ-MMssvӴu9؋dC=+ͫCϹJ_\92@Blo08@Y ʝ 5*|P#[}fF 00#AݬHb>XPpbb]݊幅OH`zvpd0F?IgA{P9g'e4$7~rU1ןzsqw  *0 VPlPsɨ ԁ;^d#~㚼*BWsnC,xE:+BO"ceCXO% X>}dOJG|lȏ>R||4^ "O/GiTEj&+Tl# @g(bhɥr4)5:6 8Ͷk"`M+v:j6|-6&G4V6>ѧX$2X89PAd=o_%>ԣˏ6*ӣz{z,-<І@Px Jq/9iH(ETSiEZqUKm3SňqOA#x n7A ;\r 8 :+\@K evEoZ -wA&2Stb3%"]iϨ:T1F ;&E.aZ A|+mF鈵BN 7"T`,7E#m^ς.}6ʎ;zֲJ~o\PH7کm">L⟵X5 ud>rxځAcPz#1sZdڒ]F3òTerCuDE].nrHw y մ[)kncZY [4^[' ryf;$"|H~qԉ?pQxsut*Pݗ\ףRt /NLWaA{ԥS~StMlj٤;"$+WҏP|4.%\L4u&tR‘TsFxTL(mxRi.12̋ !8 $ȢUN_xخAGs`[ۚR=e<@?.hCx~koG-ntH=k+ pflg!1ICdE˴f KV >I\bh_3?,7fKA:Zvy_[?]QgrMn2B<ަ%YZRtD$m5Ł"[9;K 2 re/gSMFꊠjHN6~M~KvBD%T.y=b}l嘑jhvH3 4shR͛Pk@pq6!YU_38gaঠ`>:&G{y(CbJx-Sv+/П $"u*BU+56$/J7$mYldx5:䴺 m~U"c*Ѵ❇0[7p#,6㳟wsrK=$,4:]2!27@A8l(I<$w<bW͊)s26Z[~CYM͑9QQ>^eP]nt{Q7TT%n@+FueRh?+ZoRtNLqbd~IҊ5AxV@nUzo7b!%x{˽KEkLkciY5o=|>n%\4 WHoW`EEk ?W-Nd.gdÇ)#.+ej)4Ȋ5WF_rZ=XR"F]h|}pcx$( Sy$RU"s!z^3%o'6ώmC C&IcgDRsE (Eh#` sh3&C*ug4GegYl;{SHmtXrQ<'"y3V$=E6 WQl^ϓ'j1> `k_#4^'Ue_7Z1Iszy_:inXCm Jhȋ?E}r "%H+I3mûIQxz~! Qi 5Jj Q8g\dĄ:4m?񁠉˺L򢪰N6afRR%]QώܲRѧ.CT?2/p\Gy*mzum4Y{ l>Sߗ"MY7с^]tKoJ Dd x +s66QƸyVW`E^fί8ڝ` LucAhʍ0si"HF/8 lRկZh^K9C{2=S)&]k52K>V; Z47aD 0VO@FDxBڜq!&r1u>g{|[-pl.Wcʱw$IN![N54XɱV"3,o4x )5"{9qHcbt fn'q Q} %Rݘ&d5]ំw"t. W'J6;vm?a=/(EK\nm6q,6wROHPDT}Qe^!N(r\D]z`ytgH)@Ȗ?\ mc,W3Vn?:c E;&_IAxZ,ta{SzX|ep@ [K-tbyG#u_6 gaO "mB5~Iپ ~b&ǴL),a/c)ee.5/&{M ,j!VP[Q&dҥ % FC4BQQ*+#g?C3_⹥{ULkNAjdwK>MW/fʾx ].Էp0"S5nѰ_}QZX8\xuh7ᷣd Mьm\R\p+tB$cwr(YKxOU=,>:/?Ĺ-Z i|)DS( yзr64"m /(Yx݊薯ڷ8Zi3 ml;ai)b:|CV@/%VI#D0fxۏ&[(C4L}I/@Sq*)P ~XJN N8PiL;0uɕ۾/J+zt!,OCo^t;Efz7c[] ٠Yq@/NEUԆ{~sz]ue `;e7R_': rOAhB {a!ūᥜ!wt~14>x'vN]1c8Xގ7 _k#dW|ݴZO )2q;*b, -@;r cC.O"-+?ܦnOY=5Ym|9mdg-mwUcTǒBgvJb57yϠ'۠L`c`YD 7վ^>~rxfVKE3H/h;vF& IK?lEˣbBsJpv5wIKVMER1TZD}k]KEkvяZ t?B0&:ڬAH΍r~y_Efڹo=AO`7C.VD=l6=O u=Q! } x4b+Q6@&njNxJ©_x<`5Q奰 {R1qIqYfA>QNx{vꚨ0|u˱^ݔʕc_+8}/, 2/Z'U{j}Bh;Y0߲e/M)>ԕ'F:TF77M)X!<)hJ>nVV^Rѳm]q$ \-|=$( %?6hJ òYpYNS}{|"佻Mfkp=?b-:=Om:N:gBPQD5ߨALM3~(ۉ&a vB1d/'`>Bɋ0>ƮnzAǕu.عm8X*I?PQ'b M}‡&}}ØfNmݥ`%gG?@7`ܦdW1z6\R]zra@^Qyw#[N'no]R(qS"zQN -~jOl<4%Fʩ#wc< GMbK=90k vO*%APKb V |ᝆO1.JeM 6 U+]WOsq_fLK ӉI5!@JM6*' W] ;ͽu^fck[]m?`@+0gRw:_-w ^wȍڪ-a{vp̮zp1Xɕ L<|w$'8D T&SM&$YI_(;BoGoT@Qf~kWiT+++>aX&*hg0 ?v3`Mp0<'E,Qc %@Mb ApB9F4ӑ.oVfA{f99oL3#sr?W“#]%}xY1RZ%Gd]!3k%j2dQ&{$)'O|Ik5{R=E&8YAqіk`2rV>wlccy'悴=rҝnO\ƠR[wW! >Zl3øoR6g2 b1+66{t}6 Y|IE3tyfUCBmu@@ Ro;ggo 6n1a»#=v6Ӈ8o9m0@>`!&fl;Aa I첬Yl7ܚLVj|MQ9E?IzVrex\.rUPsK]MG3 G_VO$M{3$ġrP5{IgwHb}̍Ӷhj#ScAtig*zۄ4zE qj@H>" |J!cwh&r!O_MPH`*Bո);IoLaxN`fq&t0RPՙzyޕ4#2u)ɱW\?G%Kvӳ.S3Ii"f-1]]0gwdz u:$a }z{'үKpEnhض3ln޳q[T !\@ZWʕ5*$iJB zf k9KBZw>,m1ڣjb[U d_fm[I>9ia^)d/-@\7"ڀf0L-ZP`%".ϋ^l@VX RN=n) y+c08릪x~Zbg\+~Tv4(c6N#{7 9x!L'gtÝg~_ӶIX2l2f; zZ>PqNBM{UI5!%}p dBjkfגmm[b |,y|hWz_(@rbQ;|`Ґ6UZhK$@ *Л` )vo[H WRt%qRf1P]\W5%NfPރK$D\Y_|R f(|o{Bˇi!2˟w::{Rv|:_3L,`:*g9n؈3{R'5oBUb48tNj)rmFҩ,Q蜓sFJ6;Ȁ7`ZwƲm8P~CK:w :jTQSb<|n>5x"yo|O?y~ە4 b.崇@NF&4~ôۢ82(n,~kMa37u$B ߰Fb6O 2eXVٜKKj39u[ײ vǾ}l44}eUq ?`gD!6!.2AT+s?8Un[+hF@Q;AG3 @yN˲0~x 99yETAt'br#Tҁ7!+׌-{˚Z'f-{ZRxh0*A!1H@J_H@r=}JCkLT}Ui%6}036}C3e#8H{`ygˁo>4 9 1G /}SpF`۠2GO{)nxh{fYB#QJ"O{7@NáxMH0i[[-V[?k/.,Ns pFmckKg@1Op $ܣIٱ'bŮ, %HD\' هW:xz/ZNƫs6 f ^a=gJk($|YQ(-b#-O!Y zԬMmj''^E p*m%$C䱫6h?O@Y{KmO%Ҷ`ټ[`X6BbXah&k;Ae ]Dr! ؁X>dP7SoS#rulُb%kh~?Iɿ nY T2X1W 8#ir>oY)7:fsdF?ɩ5XHt{P"V.&ǠOO<_&2Ƶ.?eWˊMP@ʃkIOX]i]Q5 uhbdMﾹgUT5O }iuYJ#4 O`=;쒛n *qK LTrES4^6vLdY[I"w(S;XO-G$/rweCI Ȓ+-ocrRlw}eڹ?Ϊ6XnFvY%Kgxragpvh-4.Qk@hvV`嫇l(BMUvT+ sE<<X<3sbwV8}4j=liKHluZzOn7+! Qs5O# P^,F%M&{"sg%.f-FfPX|B es}$fż k/77浱Y٣(jP[1)3C4TތչŶ`3T=;XϦ8>o] gX=f4ί=T(F9'5ƒERg$`J5Xlz9L-*df}n?!9A7M37RwSLQ3a}ؗF2 ^GfW=j81s,C`MP*A*b'۸x&$cMɛ)k#h4+ V=dc;YzXq~IHT%O;8k2Z1.MѣD 8 oRhhD~B#.jd ޾]f1N/J0͍Mȶ@ox|؄7%E&-!#"\0k08}  ԺjKZC/~ƿa@ wR1.۽@ ,pN/3{n#D w4"rm ?5Gg Gz|͉/1Δv aIܘ(:Lc5wAn&@G"%ݣ|SjyPmY[e N<.^3tk&*BC.pg<\kbKKk1us2}/=n/G8R1aW8.m2P xNY'2aJ"U GpImù}tIg.4EO>˭0Y`%7S!ߺBXc},#P[t5'h|P"p!͢5[a S9tZ 3b@8>t>(V?|B\ L͈Ygo{LJuf Ix >>fcVKL[(BxU./Յ#z!SzeNZؐ$ -L=5H&t|=[_# f_ ?NHk i*١D+Fk? &\&cپ P\SW@KE>dyǭ%;Pb3$:VX.=E `OǛ`]> BE?Bz\ >]/Ֆt%вLa!ϵSe.mj`by 9$hzQgܢKM`+/sC9V`BĈaUZUO+2ҒeFtZF3sNN {VS_N5PNTCa(@oѤ/ȞT> ( mVU `|-#wM+h:/`]PO IFJkFt0LWa1W;ڗ'D،$(X&C6(+`BF|M!$ F&"Wu_pm_pUnHKEG+!ճ&l]bet֒#qbC8T157jEEj?Udz.ާǡ~2ݥC;$l ϫ%婪A?Rb bɴƃHR!+AMayD(KZQqrY9fɺ4$&f/lRqExpG$g<ȿ7i:O2 G8ԧ[GI+3:08H)!t`A~&qrfȘ%s+ͪ z\֮Wz忻aLu ?S3)>dN'bdp@ԶU D(T4!3 >˥gO5#Te𡾁$:Xi 9(@̿'[Uɭ J&iσWnډw-nJ#_ut{h7'S qUafR+Jem$2C}68'o\myc+|)wXăܾMF0  ?$ч$ h^tG[v9we1rk{^-_P!lj?16XRUK&Mj "-s݆3/v xSuHNW+Sa!l3et98×WSh ldVq` ej^pETWsf/2:I<3eL_U ”hi4|8 ݅+BWS!\mI1Kdbüe[?|; 휡81J⇨*z}&c&hX3WGZvlD2ΆV;DE릙[mO֜ŪS(Wv2ԣv*"$s_鋂LI3UD@a3 kFC#{Nlr$b{ FAmƢoř(k5VBmB:w{待>7k%J#4NoehX`Xѥ*@@8y}p8\"_r-31.IKHȴ -af٬pE5+U2n.;%y*Ithqet FU),u¤-2BO]x= E|df@\&;(չ ч8a.[1K %UlK>a\\rd9P=QPs`qTR(qp~_.6c~Ά3vEI|?N*GBav9h\5*ˊMUl jdȡ(߮dO( kmAMn$iڐffc}/u"**N%FH|UB/*`N)QEl1D馽="L& Lr`pJ s!{Kew=7 ς;iƂA+륷v3FZ/U]30qug햟n;7 >ǰhj$lk95ROBt&iYV(Q]QٴW3 Ջjſ(UKZUQ8 b: $M`Flg~ۊr:6 bXZgѫP;3[;v_†^PqRmspT_n4v[(TtTT"> /"qU39RO /Sc`۱>}|zxn-acaiݑMEvgQ2>$8"SgӞWmp+zD,JϏ\#tN=kGWa8], ?7_*ٚheaKFW <<7P-8r [ r'z涀Qclo`w ,~,Xc0Hk%=4 dI7r| 35+.`DppV@>L#ݙ!L`6e.l[B(3:TZUDqc]*p-P6pZY0#=iLP0*bQez86 ќAn>Qv =qOfl۬E.9C`FC#MƒfSt`{|Lyy%=^Je{H+PV$Zހ]aؗLϐ멧+Zg(g͔ rq &9zjpN@s4nATE':|f;CQХܣ9jW^CPM cձFcS/2tl= Q-jմ$$bQ9?SHjAPH#eQ'aJv25'="&*z<ˉ oZ \٭7R `50EK^C %޵S,O&zT!-R:nGM)-~H? `]cry{N܈@2gVyw+ruul۳Xp2ა ߉ ?^;"N X+1b"LuA_6:M;K:i!]dhҭx:'@"ZЈzthJB &LCJpfDkhLĵY3F٪dބ @u#X'~#й: rFAht OyP8;9Qlr7+ $vbй;>Qؽ)8{FYnk3{sIٜd+[1꩑S_spupLEEo T@"*@z+ QklR}Ա}LqydW|턋查JafI=vyuǍcM :el#(Mq=KYBV>W$& i='AO¼>'/9tͷtTB`{3hjk~|$s%YK%r# #c8~ZAVrUwwDŞЂ*ˮ0NwI~PcOѕR?sf~-6!8T3N@==^uƔämɢoZOސrA#'}j.hJ{Ev3z6-7,vk06v2Z򝶛 |Ӥ*ޑ?M"CWVn53!c aEڬ&rRSBa15ҭ ^U ,(u?PWJŀZt›xxx9u/P;bvp֝pUE0 n=G#|((ޅ֦j~pzFN I^^%RD 9quSV}~V&3w7$ P]\L { ̰y}H؏Z >d]^OopG{ gc哵ߤؿ;u`zTcQTCV =:zu#AN[JUÜEӈ(N{Hĭy2XS\dXtD"Y8O#V[qq[8,tɛ9αo7@scq735?U`<Ѷ8}Uow %Sl}#n{t[&ҍ .뉆_YUqe&@uO=:dGzA2OPd ;鉪 4,c392 l^tNw=mRf?X߇yBeT0ԗExTiÀniti),ZC:1מY3.Ⱥ̟  ev+/wlbB#,KXE@ܢHmp=Y3|ڰ?ww{}ΠzRJ!\կBXR4xPF;e Wd 61cy$?Y-L_(AOBe1fn{Q8&ò17ݸ4V_DH_:%j ;G/?3 vK#/Kʜ@s'AbY+V_"? ԖBBB/zJI*i{xEq*9^$.DV"eub. 4L$_b2m ? ԢڪZsBj\So-n<PMV;{'4l/dG Zqyis]>$MaeH)l"wx>IL hh`ͤB&HzRXt5K<31p*|=4ҬS9av_/7$.0ĊD.q[UDQ.Fˤ7I20f`BQ9H#Tb+s^xzuM喫ts片š1]v?QB}A..hRy9U /awZ-+:G%:ݰ}OM!t}0zOIcّTN$g:4#%PfĂKSdx'! U >F?@)Чd9f[U]nmG?BE,_j+ngCsŕ],^tUUcI׍jaa`䵴 9`X#(fQp6v X,(S M^쉑g癅_з(-0? ia=T%=up=6{1ݺ)^e+?-h}b0HuQe:T1m Aă6{;pՃR:40Kţmw i{Toʚ 1aLrJ; r<3)qt9w2F\`g'3îȣ."Y}f,/g0La.І-`Y*wq ѪJ+4Wo$C׮_<uas>Dkl^#Ͷ}SBٟlcIBGJطc<>P)7XhO/]e6O#"7 bK.(A>S4, Zzh#czi-!"sS <%?\oAy8'?RmQ߃Z]]MF$$u(/V4npN)́ R2[ɡ|c嵴L=*"3W=Wz[Ckv>s"K_R5}7ZwaQ1B H旃%\4Gt轖9=kЍ Zp~ӌ4̲1|Jȗϻt@B4O>9LCK.}NANߒn&Ko~Q.}'N&̉\,TS\``!>LDuǥf)3I6_vz/^-F V$1{6|զLki!OyF{KOERP?l~WEҙԵAJ!%qO9r㡌;6ƾ6avP9* 4=mzv1IלsCZ}sAnR{ȅ5tP:KV0Uw?xՍ \}`EWY5zV;@Њ%Z畒mu\Pp^T] ;0e4uڡ)Vցkѓ^ߡ'7"6^MʝFnjLB$vohr4l09ܦeCR,V*?Mv({SY'" *yF{lWU|0Mn+L X:~ ӓqjLR4"VH"tbA(Ȣ4ArC3 6B10ѦIa T:,9Y[3oɫBGH&|,k "%I!zIۥ$%UraFϲ G#t cF[&J9*(ᔺ. |Te d) +xJɀB p0a ,'䘻 s8Zbl *@jK! {;oHs=*M'fiͽ(Դo,,xmr_G4'AKx{5'&gMt{NlbJ3nT,",D}YGVɄQ DCQrO)y;A%6:О?3oȳOF1*<,GwY£f{h&aed`_6ƉE9xdp!8jH YF`oH6,Ak(tRpa!.!6s')?g̰s>u؈]E=k(`Zx U^j"|a<WD(k)Ny37wjNs6f `%*&yzߴ?6 sڊ+Mx"-X{&30 pLe hb"p[9ml!طlN:r8ªY"h<ʮ/! K=ғp ~LYHw}2| ڣtq@&1c8lJnb%/Nv>8lu+fH818g^ܵŶH% hڧi9 ? 7`2 TDf؍!2QnÑ{jFLs4 }Omm#N羅2J1uk`bz4(b.K~\J5|1:sc`£y1 'fP$\UO|) ܧ:gO ۧ˚+wGPzM `pS>v1N,Xg7|]:Ls0lۿ#<]:1|Fo_o,kݿ\o A=GWF@5DL;7fbm6iEi)>hֈ-; ZiQd \j߉q ?~^j*GCwu3}VJ#̪s #X ,qcZa8E;hy脽7",k?AgO{CBApT0)g任Ii5a$}'a@JMH2^(' ?&p]|upDjculS Q ]{'o16Rt>)u n먥 [y)+cu6gQGKM8צ:^9' -d÷?Ac_YT@qOojR֡k% lŲOkapn/ΫJ.!=~Ɗl lmI hf|xD <3^_'S(G,q_ؕPRI 2-pΔpUjd癜 |czx6Y!DeK^iEz2=Ér_@߭\_"bLlwSQX=s'Խo^A {ȩJAuUn;lĬ&JRîvȂ }mKX@vŃ_ HBKTA u֍@.hަ{aC&4~ =Pn.[SQ]I,FB~5Kojq\ r鹤< 8_ևzѨ?6nhܗŃ@R]aعbR% CA/-ee-{J-A;E niB-PK}*+E3|@zR]6ꈷ߂=XꡃrirDYW7?g":!yfkaFը6&:myuAmD ǯS Gk+((LzxgolD{*JU ^(M44 #z5Q|)rsZ7^ "NJ1wӍ` Xv3 IԚ&(ylJς2x 0wh. rl@3Qۻ[_^ uyVI$Ȁ-y[ a"Qot5\@"nW J6apޜ I4IbߦP?T}`dF|we}H\e6XJgR|,D+7>[%ȯ_r'-G6HAPؗ0ف]sS|\D_TÓ99`̄Q[8}o ]Sy'b}u[/4eG -ЋU5dY\;PPj*@iC罢":4&F\ "قNF(4#fج 0^ቢYB\b"kQ)|sh Ҁ+-?:BeCخGVNN7dD-zv7C̀+:5÷~3Q&ꓹiZmFPIECCs})St|Ë(JQ׻,5XXg2U]@qSWm>C ԯ_T!FXj گCfQ`n AUX6,ӿeuOwPq2RgZ( Bf"}IeK9~(CYzَW+ Qu*j3Wm>E|Re_X,G۶\eY7r}'"5nkh[N^YL5|tJ]2PJeFVWO^Vͷe$%LTHG`=.c]峫O#gOm^~|q$Z;^: 6O7ewi0bRܐL:+u zEdr4) auBV&b wjg7@ER는郡M"Hɯ:@{7޺!X6v*:aҺfI"h7*^6~ s9~>omxt)x|eu|lMb'"Crt=IQU]!٥hQzJQ:.,*t,ze KpC .I ?-{v 6`R$Va Xo3ssCJjye:V[%WIR 4a>W4 #" _ =y~/*XYu\Bg֯ۢ7(c. o)<'ZReDѢyh^K;-}~?_ r+ro?rU0%{C"kh$c?)lh='7LI)PssHAĢ`[ YU*۶qSaUQ:. OZV罟i=!uNz0u(c{MJE=$R!8GFmW?9,ogWk&RA$z7>F"_T\Qa_T࿕~ދ+iql-'0zRpInϫ]Y9B ^f`#Gd%l Bk jqp}$T㵑>H;ٸFXm o؄%{o4M}Ԁ8cڒG.,a1\Kv_qO#fKCX@@eY??B1yDs;Ⱥ^ѣyc|^|k>* "TmZ˳oeg2}A)?`.9oM&S% }fڕ:uc?>~9Fc pA E>'gk )8sp2J)$M@/:6" ]jAE<\./g5YMv qI:gą!h}l\la}tAr|}'zcRzo5Ɣb_ ۑ o$ѴM5.nZ$ D?T54ߒo:Q0Fyi}46DϏ>xX [I&=kQVs{m+z b6g%VA 2&"Y -veg=õ4 wf}I3wt"1>zXe?mI:rAfҳ6C,w=e2,˾iwGg7+Iw8^I{iz_EU.f9;evɫ؉urI7L!XNI_ƕ~W,jW[s5NjX, \H{onO+zV뵾*})bL|Z]pЁ_zUvgjL2z92̬e8N^=vF^OiMt7Λمu, e乩TˢFs۱ێ&˔FOq`vU&+vALk_gϝ4DnR2o~p(DgNz(>l@1NJ"3s"zkmhZZc ݑ)m=\t~܋_♋( 8 I'&HR k˅5I=4nD.Hrw 䓌0bCW{ 3Cg+"\s.ɳo,.xDWUr쭆{NwO6 1**-) i{Jz X%uô5VkL*t2/z:tO?ܚbj E^W2@tlF]^L7izY]w-]ďh+5k \ Ūo-V LqYk-[ku tZVllc$WՅ>QSFrf/Fzc Q):PaPSX3`vpZr'r;?#4 wwPjY\VsAg2&r)6Zb;nPD~iPbAQ^Ԏlv0Kϊ3rZr 2^S峦4=VA9Rx-zm5gZq&p7@ \'[ Ts(dv:$܀_ ̐D_qH^筟Ji1L re74%b?"ݸ<κr) f1';Jat߆󩙜3|PfPfݘ7t Okvrг_w^'%d>&s4{qD&ctז y?U;浹NHhBI0BaBB]5Ex]&˺ Wf։U̅CN+A&屭߁!RQȸplSۄ7K4TذLD;ڪYe9 T͒ o0i+GCEd?hO5)ri5 z(UgAzVН/!/KSvH~DjH:Fȶ FJ5~ Mt w9S4&j0^̹WY'PA/tܴ.XƜ٢)U99/K?LVa?9$3tr"ٺi]7FkTEZjXcS B { mBygQ-eJ[ ʱdO}11`( ʲC@[k]`0mpNԄ`]H`S*BH"`ז߹R\sΒ3 s?E|EթҜPK@䓹+hM0'\ csXs hԥwOa: PjQ̤%)\ aX ges3zDM)xXI^jXF4$cװZgE#J(`mqf&Ut x86 3H ig^P8z}vU_w\9>5H(frMC9VC0ZЙ lpLDo0hsYؙa*mIEra `lz#q\Q4UDpZ/]hXj8V8v@Tn\$-/mW#9r[ ws6AB[ʞ”v>CqoWR p6ՠ ahBXx_E\Nw(ڿJpᑟ^F<0w8"*"B"vb^1zL ZN@(Or/l*J/H7^ l܋)G:"+,%\}xfɇgFiu!Ἢ4;@J"YӠQ)'Őv;@[ f/V[\N_AswI{gPp!٣tuO,?iSot2Bv;o@]zoO9ΌM-QZںM G<+ 9{v`AB}Zj﯂== |BeT!t(?D7/o+0,s% P|J܈NeG`B_Hթo觵ߴ3|a _kNG#f0R8*e]o0( N^p9 Vx@>Wx b7CO]Iz :gGTtG*nww٣C><"eu']Ⱥ݉s;62.mhb_) 8c*4dgNpށ@W;N B/Fe8!H| r`ȳ@c;,J!jD#qN Oet>K Z' Zs QCHJ/Y"o+"<]k- XY# W |}PCbUu{85bJj7df&#mKUZQ pr *\(oNXo}å>s}1 O%JrOJg6NZ>@ig@j\mG$maW-y@!|I6=Y/+rmy=oс70/Ȋ]x{+ aӜ{6͖VQP6Tmu-[HLjl*tq $N޽r36ֵ@fL9m!t5vQeM| P$DJ!-l63X+~ib2fÆ5dj)ɑ,, ^Җq`ϧ,YRomۊ-TZzNktsY7GWgMFu4?豁2h$pDE>s987~,"UCry+gkhV6Yhx'U2 sMO\\XKd4r<Ʈ L&7 M6ټoZvJ#˱v<g{#YvQxp'\xC1iX|-l$2mV.VrfXSW_i,>#-bڱfK w-ygId-Ze@PYh#&gT]n"H>: ix@LAXw<\˸UK1I:`=D  m*B}ik%3*$yQwIPgͦb>&J4w0rWǸBgʼ j-TV/殾BDYDLpCUd[m=dPFmɳ ν!G#9I1/n,`droJ;rQgۮޜ) (Irt`vzN=C^`6Tk= uғڢ -ؐ`⤡\ }}Qd^>?ea)Yp 'zmaʸ%9s*qSQrlk *5Khyafُ}4$ׂ:ot3\d[-vP.a6Poi 6#4%QdRÎ*V([LHkO惈)A.,WHx{>, M1x/FbK0gSo.1.c׵ [ȯ\7Ms)#!4`/853K&d2k.\5snG# >՞t,kLeE0kqXUqDAviQ`Yc r`C APgcqVlc =ǫhɷ& 欸dE/ )MH|ReFBD-$ۛ$PV-gY/G,FuhI7s|1 rAU oLɯxEދAΗ ja.|_Gp}J9lhfN޸(፠0Пx&yhV[w5[Tw7}#M]ƻq2 92d@ӿuT9̢LAS!% p /  :cf/lCn7.OP%Yݥ*.ef+0$eqcD=a+$L /Mo 0ӥ_.rzP.F:$|o)*xr0E[Gp%3.PWŮ{UW2 WRYnùlgp3 [XlౝaqUetW -4݆@E#6(ŗkA .YQNsz/SLF\D>-T~"K\q)N< env(8'K8ښ X^@ Gh}\B_BF9e]ҀqcU :Yq {W=Fy-Clx¢g`p!7I+y^oˀ`P7%e%Z!Et^_KC ̝"Mt`0˞bQ@tIkLMf]3"Ҽr >T#0| O1KD dOٳvoΙ ô RטO}e ^\Q$BŢY{AȸHޝ4F ,t,JeyfzevY 7O ?x^a z;M. q7,s  {QQ1H$~Wk@S^oo>ggk)fs+lb9R o*^cEv̸] Ei1mf>f`Ԙj'F:Jnh:u{&>rQcZx Ȉ~ 6 w(@xʤK6AFZ3Π4ԏb] a%DA#.ʏnl;A P #ϷbiE{DjC5j/Jo~w<fjIʒ[i4(6픉b&R)1 Ck&-Iһjh& n3ni(Yj0 uSCh'!K~򌪻I`b{;"ty#sLZC]X.ǔ8_f;}y#.'Љ&;0]˃ j]Q/C@LK؜k Mnٲ{"kw~([%!Z baD]",]ĵK";ddيLa)N*ͅWhO>HZTKӚSoI i>l-ʩ&C=0 m E[v߉39ML!NӖȜPϥaLh[´kd=z~/C@oɿBl.MԬkN|~]rz;eA?%mԬb9e?W&>}2)v ňQ~ڵ cd0E$Ig*F}s鑠8D\=fg>Xgm_5K`ڲ_bL9cdU@yW/96殪ڗXy(9+s<ùOpgab}~tYrD]7,T]ڴ_M#͍8b%Ґd9LFtC`mZ(MESѻOO oenn}Ex=D56/D@_]X 0!%EilVjOg8bLcKD&`Pr!Q68-ƅrt6ruXMœgH_`xzmWbhME2t}fV zW\U?<ce_:9N}EsD-v@?=l HaVT[UOS6ڔH~qM_pB Ci_d.!Up>FĬo615I3dg#‡?3WƑ>n"V!/~SS(ac +ǕMkhwoqX TA@ d^E!*h`&EUn'RM.L=s'fE,ѹSxKٷ'b(J^|ISVI'NEְOc%?\j\]@Ȑ#FCB~FhBb1ǀ]K#P:5tA()3 rrl# ?D ⋦ v$&%.@hfzqѴЍjHХ0iU}\pm$ö `x><"bh5^z=^9]DCx:% @oҭbN{_rS6y~U:'8 SI*SM4[~y̆H79gqjr>f8̸~a=*pMw[:zɴGN0e~WՑ2Xnȹc&@⥛^~ 3}_C4lG@T$4i33 6Q 0BwV|q^C8}}(iF:_֎M7XSCx4!|OHit?ϔ^v@˸*}cpZi*Jk*>\H-d`Vx>p< #NXx:gI0tv%@JgMn4MaU][2*.P%t%5`Q.-21}%Ѿ =dۧ,GvK?_O$}`@|B}4I2Xk=в-?lq1րR3:@mDi5OI}[o[l+]bcVyRr ?dNqa `ǻu6džכj >.'Ӛ,%,wn({w$C rQ ~G`p~PNx­\͍܏V8'oRT80C{>.QpįR҄%! 6ZV.[r$g +\-i&]/1I[AT,)lK D쬨ȷZmsD,S0%v3w1]IXU_Fjq,ۡ*`?Ykmx,8vMZI} ouh< P$Z:*p딱ȓ#a}>.׬/󸪷ȁlU lϧ?}wĽQZ3ӂV 9(,CBFԫl~Eh1 >sɫ(Xw4sBO'gTQFReG<5>N,p+Ն-g?I~JdI4mܳ~91-Z$X (@3̯sAVQg;k]₊/+J˭}Պ+ N3|>>Ȕjl1)Ub B%m+[U!_HacURymp Ozo.LDX@XИ'[HFyYT.bҍGy[Ꮶ3H?(q^#1zPR]ddm4Vs) 5ac"V/Zix7~IDVHZ?1)\KYu ?d&g6a;-b(<{vݱ#gGMh' Qh C͛ C7E`=usNvòX} #ԫ"s)dp``_\){Dϭ W(G9/` Ϫ,:c#+5kFC"#=-2xZ|V[PEsZI:tyN q0I'c [IXV"HCxI6qUY  wQW]Jkh&>!Up5lCcy7FpQڠ /_;g,i-,F42ƭЕT%z'B(̶p:}2D2DV5vltGϩGMPIז*nkt&|ZRРEj,n>+QGGjY\iAԬXjlӪ`3^Jhbʋ/wh A1ޡf%eZ}m*hk" !3 f"ȔdF; kף]fĈ(*tqrZvkMH iDJΉnҔP$ZI I/ fiSI$60&T>ǙGܯp( f68_m{GKVny32T_$`&}пEឲ ID9A}{|:0MY톃st6kNq0[&UKxoMgTQ]tSRxr~D0 A {(ވOo 1boPuxݠv`gll{M M*,Jm }N'i^ C[ ;gDEu$x<4 M?̀, SyHnΚs,n\o}po^L]Fr`n-hrԨ5z?>{ i`JҸ-O[{kj^uW:K6 HOɭO+(D#2X?%.KFT?'<8[pJ "tK  7M +3 s r+:Ɗp,}/OAѷ&iNb5)0{TvJ9:s݁ Qֆ o@G[N,vApg:K>ZZX޹m95s`$n$()f 4{a@I X~xCߒs_ ڥǸl #U:5V[Q=g3yBl%Eǁs2 cg Q;B~ SBq-\2S]<jM'B/}Jc S*_Z^I)rgq_cG67 fߟfQ#1ca@6).)Ī r%xR>ۥsFE[&g콞(}\I>%LgjS{.J9z@7^X%!;wV._ݑOРܴ,l!G yE:NKt"0:G_WŅH.^JL `y)!D1.ht᥉N 9EϚeys;J2{1713@Xb@0a[ݩLFc/Nax[Go E'|2A\oXۯɴQ,5دqj[\n#"GCX."$эs$V (WB9XXzΎN=1!?TNjhf߾E.,]-vC3 b:: AD *)vM/2=A%ZE|BnP7SZ?@]?6Fۓ " ~,cgfP웿ֽtZl(jeZ|aYՕu9V#rm}%L!`n|vDɖomaC r!0S/m=9](~ठt y-.r&Gµs-i}JΥ2)h4(;Y>fVuw\ ? ` ,1VWiׅ~^t Oxz ӕfɇ h-Nۦr}gHH\P?τK-LiiG~f=$e3H-  -%V[GX.k\]/gdO'èt$aT 2q[ܦFy#uzb6˺ԉZi$c~r:+ʲ–{onM>/U)]nd?hM7y(=Z>t}OfΉbgos[p- P1s+Q6HO/`9:۰ː`Q܄̔g>[r5wuA67j,9NwȼB%I=s{v3cdž;}\giYzd)9S5ς2u c[zr5jTzʬ!C_T^zL_ewvˬpd*p+'@%)T]t(GIHWĴIȣKYnM TwoKjѦ;y5 (Tͻ|5(jF"L:N̢d:ѰbGȦm `4`NMEZ`bA8ύw'apdð darX=^qʸ>Y*3C|4#$vf|JoNa||wr3w3^AcHq([1I5=^o6|Pc6Ri~FR%ȧF&;-X\bYu tm|'ĐsKeD6)6}4D:mJt`Ј4(3AM|&D&^nNgWV %S./a\蜆Aմ\!lYS!GTIghn d6YLm%w5B\Ϟ|J)fjxʄaJ~G12/S/Ez yY{A.uhggX/R̹pjk,* Ô9U7+'x~i;m…Lzg7= "yvq 7CKv0H<(? 2-8MA.X<6q^K nҕIp  G ^D%ALұڙlw[5!,Z""|gmcPRٗ,L(@e 1}7[F6+/]r&m 9n. DJȭ892tbZ,œ#3'eug[Cv?UGk 4$$ [ZoҫqcKs\&;cDo[ CLХ%>YG;+uZ8`A`&x}£b4|Ũ|8}/ùOl !SqFՎ/}r^r! >P֑p3pL'Nݬ 1(zqhB.kHF N b:Ba+>DA vva9=) tz-/sαmo4oÞ]_OpyFq+hpֹZuo.~8j+F!897lpՙogc%dMp^]3G-0|'׃کrid˰hldꀘbXȊ ՟F1MlA-MC15Y0 ]jJȤSѽfkM T|.۔],ƠGakbV-!fxы~<WWpGK~x徊ݧy0!@:D^O}PdʗaG_l=ϟgU/0V}v8 d F;OKnfm}o lL_Jo>\t޾Y\k"!8JzMác-CWv!""valg&N TäAJi<=VeԎ'y]svcE["UzBG6ZB&z(!{XtMЏT~1M38?NWAg[#/,'E<`,#q36kȱgT|&-CL]lP;LvV S)1TW19z;nʉʽ/+ţИ) +*}雑Y(gSnqN&nHס%8Sֺ H4()MFc$ɗ~*|NIUYT%II y=j~MEA! :Tnߝ1JÚUJ8c<Tàޤ^"Z0vΗ|#@0PS|2IPlfUkp]6Qe ި$`e)ͼ[HEz:RJ>]Q]L9J![bV6E,&m:(jF}"C+զx(Cϲ 6@ J#LKh ICih:M>ՙMXpLP_}/~ 71#itF_ͼ@$"=~Q߇ћ@URy%w1jI"5F*i }fW3Ta E%BHt<G݄~[ p+RBbntdy- <(ņ+$+J@#d~fc3 ʍگ[]GǼL!"VAYCuͦd ~d Xr_Ö,Sbθ!ȋ(qg; |ؼ9N)O>g*R0yu:!/AiXxKCCjK)ֿ'='_U D2ʷmGɰċ4v |x:+e9*^yohKH>tȌ7G 'gTeGY sdc[ Cykڧ2$bD Z#J Q<QkT~,FƝ/'ZF6 '-:R$ 8C܈0mπc7YKr%SIGm)a}>XUzpBq)/WUƨ7dnfFխ+G띌{BEKqϓ6^*ʅ0)p6 D,1]q$! ExnVDh~ǽb#"5V%r,aHE7sNr1[ŨM]<vMjRYMA_8g̋j@nɻ*Vo;vO;S~n`ۨsr6] UI> 40KV'rT^T,7lDǚ`A4QNKibcHqnHB$s9e$_jd'JY,vdp70@iIѢH%ɸ7{W',Da'hx&&v:?Uoɘ0qԠ',Л(P]dKR@.///ބKLeBI'qaM6͞ggF +#',8kzo MF.:8/YOBkFwJ㸢B2"Q4:$N:PԤQU|Hҽj*dj!OX? df?Ri(dZΑZ<͜@)B C#BUm˯kPR^h1(TN4_M|R&5ze{123N-EAď84Pv/Wh N8P %&&1#>G| J^IBvE1/Dʁ]m YÍcԭq3F~~_H2D&f|FюMk㜣[8 u_)*t^{kA]mZsdV]_᥿.5[IfмVjK9.ʬ|E¬?H1-޼%[7՗4J$lfAސGCv/ zVĖԚ2 VqVA4, T@ZiZ a_?1$܌Țe"žcl]n(>5)Ws5gՄ{\ǩ.S .w X)אe#d9ꋣL030\ Zb}ZJd}jHͦߋ ;(N'>0N*ZFkqYI3. oO֋-QL,-A5y)&.Wb=G|G"uZ`x-=U7껈#g,_`s|+,z<Ⱦ'&YXFKG#n徝t]<@Afe芧c68䳒k-<ĐŃu/],;6#@!65mNsLHk=d tS4 V N-)ZMgP?ė *y%@-Q;tS4onXJ=M[i^p],L3 t/v{h>wiF . ,>OǗ9YAi8*ݎ\M=*|g5M |*Ax|WJZYOOb16%Z]>M€ap|Q8^:6ʷ;yN0^]]3 u-OPf[܂=d5+3֙PS%:kU&k#RbD e cl"}CJtxkHزAUn画/;|$d.$ť~"$n++5tA/~L≼fNYJ~[%k\ܔSoշ_ÁV4*hndל:ey[G7$c"Pf(C‰Kł~ q`=f<Ʃ$QppuE!X] F۹U wfHyɼBWFVyC$lrv#S/LeN2tfK6]QV.sPKӯ푳nXY4bvX/cr64.כ d4ާ"dN+<%%Rz^T, ٥em,gdY-/x8rl|([DoG^ˌg/G\LbQasG#H\/8Ϳ>-iғ?o+xPwco7ߖ[]L\JU~sFۺ$@9$3 ]5 6x/ӆgxS rB !uJ)Y U'z S)tvqk+Urt gTNjm֭p2wMa ULaOe $uҊ?cP eq,vӇqLZ \$1D4K' #ňY:f]Vz^P5{dFF!6=[}m2/'AFa5ˎ]qۍܒlkxS@pfnVQ;Gts}_ %6*Mv4o 3g'"QSބ-"r5 BwU/~EId2HUPqXkw'`,ߪp̀x k,LYB"4Tj'Ƚ:"靫W!M*`Op.g9Ur[imA LUmX}AVq0e9^0mUZ y@,py#Vu6u ⛸e-Ug,'bHSi&f@I 6㝇 S;lUqIdqA*=!J<֛_ ӣzk%V Aw8Ni'mp.—jQOa*9ᙿ-ؐ*-݊"+orʟvFC'ݾDxeը0.K$.(em:U!7q|?w 1YtWs`c%=*csHyE@'GJ/r ěw׌#=,;濼1a (yU$;nd#Q,)t`}vUצŝ a1nc*ٷuWS__qӒ8]w^7C/.ڐK`g;pOQaXՠ;$ٺDNbR==9lcF#+q.:v_j#qi_0rKhPi=P|ĩ9xߛ' h` j/m sjtM.19^4=inu;u Hhdޢ'!:I )YpJK%.CJñjH,`3Lv3FE Lu+]z RX1:ԋG6IҿC `i36T]gi1ÔưXEǮ ,~ċ9+'ܪ(xN`y,6f}XzKi+zO!K}`m|y/<"IIhb9"}B2ldtHA^M[r+ ,mnm40bkH/VW?@y *J&K|EVN#.#>weK*S|ϑF>9 .B ]sҜGZ!TE ca$u єԼp+S;U=d:/P6e s#PE0r(]qv6}Y1a;Q)yZ|YDmUCuV^$%P#^rkH q/زl2['$>sf9oA"s/6.aB֠ [Ak$`es85.Υ{ІN G3Ox\ 4>S`rwCNm@LE˒8fGi plN1泊6!'3P?49؛sDAüpY.?uDž'%a=*lX_U@].:vNouhjwB}:'O;[rNkMeVj# HNS Z"k B)hjn[@"ڢ%{!rӫȾ _] [ᧄu$l3JQ!`D3Y4LVܚͱ@l3&2vgA@D[oKܧ,* vW:p %Oj n%  sSAcG0th0XV֕,({¯7S& N*AtnUgZ=5 _mXIj%~ʒ;R !X"2MG䅘)_wa` y{6t6]%]V['`MV>6qJa d'5h2v,6t9 0Ep,G_$T `0"s/rgrJ/~`Ds؎ /: YZ