selinux-policy-doc-3.12.1-153.el7_0.12> H HtxHFTu ?*}}\r]DV!8maa341f3082a1dddc146f0d032a96ce8dd6f937936 xte(`԰FTu ?*}}YfꆥX1BIv txB|t V[V+GX>8T?Td ) Flp     t (  xL(}89:GHI|XlYp\] 8^4b4d5e5f5!l5#t5<u<vDwEHxLTCselinux-policy-doc3.12.1153.el7_0.12SELinux policy documentationSELinux policy documentation packageTusl7.fnal.govScientific LinuxScientific LinuxGPLv2+Scientific LinuxSystem Environment/Basehttp://oss.tresys.com/repos/refpolicy/linuxnoarch[ P i 0'iv./VQx~*GK:= N6="3 -(?$TK|rGtFx3zjD*!y@ %KE "  EIKv/s ?(@(9#mO+7TN)22L0A +W`jbD#/6o ;IT TYA?Ii;^'D6QF-Nc5 yKjuFDs&MDY 5<j"#_tHa 0vTm(4s$ 535pV=JlF4:"6!X:Sf `9>#Gxhg )4z ~dM[G 6ǬZqU\noOh_  !M1 i=S٢+; J#(@H!(f82 xIo7*>A큤A큤TuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuETuEf90d6642396bd107eb2bead87e1f4abd10f50053d71665ab6c4dc0292976a653846bbdba1149ef9edd39c6f18d37f29e5ed9cb3670521f142ed6d7d2bf9f2b8342d2c3aa4d008aad3243fd00e4723033e27e253289356cdf2cf9ec46135a8327bceb4f36b0f077b7a232a94e214b3b0a5a85152e4d89c193f92ddaba3ede1ad636143f526a3916c0b576bec80ebd5850108fb1be802edda44686f6083bad5ab1fa37bac62fa2652703459d0d28d5461fbd5c707f006adf0742f6b71d25ab332f52eec103da47bbe49e1225281c6ea7853187ba5bb452ee3ea79285dadf158405fb2603c814cd87371165468cac4e9e9183a45427140b1f1a0ce9edae8c0701fbba9630e097150a635a4888bd1b63ba32fe267a22ee2d65a91ed300365e43f54cd362a73b335564b783065ad39f15331cf4b3391343bc5e6777ad955c8c616dd95b0459fe89dfe352bb7d730c0104ab29fe7e5984256aef06e42ea576d50532373deac70a29319d87ea13558da54203bbcd74e7c69c76ec7738b4f4eb2e1f8b9f341fe9ac06ff0c79d1fc1724838e7c55e2994028735d2cf53e639af4859034f000398cc42ed0a362d005087a637a60c455ee42017e470591fdec6c8e6139d0b7fa2f3970d3ade4ebcfd7a0340108c26acb9be43bf9af722488c010cf66686af0255f3a612ec0cd69c85fa054c870f3e3396ac38d2ddde45b6db5d8983d2e88cd431c9df5c11356faae0b2a36c8b4b5aa8b303d14b2f3962c86bce7f3ed0c129f9bdecd99b568e3c5c6ce8708f981b1a88bf88302dcf2ea834ac15fc53960b01496b1542030f6295cf4bff39a18e41da4914b1fbc4cebdbdcd7bbe8ae9cca9017de989ddb6272ad3d282ee9392c356022bdac2308dce47f3c1b14e8026ad4bf9b1d10e878863eeecb5f4ac9496e6907179a1af9b29590007e3307552dcf93c7e2fed3af5009c896434e58cad7480946e9777855d43f7a66320aba2802459fc0d85fad40c9df330845dbf8012931e66975e8f33c6b6cc36bd383b0e52259e67e32631ac8c5d1d1d705a61335645fcb829d1b7766ff1c4dd9d49d387bc8a2c0ecbfb2876b4dc4a4155e6064e31f6437724a574138106f41405eb40205778f8ac542a9fc6119317c73374414bdbe02a871cccfff31518fbb7ee3b3ff97a1131675dfdad3961ebf3b1bd6d0ab7293b0435979f19280f400a25506450390dffddbbfec110bf9c76e9f9ec378cbcc18a3fab2dbc09bab835f4366699a08cc0014b25214c8fec52dc3192d64a161d03abf39c68f8d79f46c7eb232d93c1f7df7c08d3f40b5c5dc394f8ea2f73a11a2183e90742ceb2ca0a956f307b271c74626ffdb49e17626e0a3c493726b61ac978146b5c1d0ce767f7179458befe7d2f99e8be3d80fd862b356dbdb283175f971a29f53b35272eb045557a6d18d3e9cfcca266cef6a4530c7251c1e514b6b589ed95311e16f12325af91f2749956cbe88d06808b42381f0b2e634aa903f6f9973b37d766b1ab0e310ab4eeefcf4f29d92d9ce069ae2e27aede5756fecde40c5829d8ba92b53e8671d3c96560115df05682e887c7ed71cad026118b9218b0e98f973bc6aeb64e9fecc238a95bbb6fb4c5fe6da3407ad0e78327143615f019f80967ca9226e2f3a9232446f4bf5a1005c0d433e18e5deab48a56b6993d4d80ad1f82d3f96214335fabcc7fe84381901b22a0783b0f4c2f5429906fa0e4704d7152fe56ced00747494174b81395e29b43ed611dddc62de59df460aebf25165e1a275d27819f4d19e87c32f7505385d46b7adfea5c0565058bb5405336cc7d3ae52aeb74843c6ef7e9d38e5aed91aaebc05c9e10c574d7a8d51a2e05c52e57bb76db04a60b3b76a291f5d81b0774e01e9c2b7a553d3c454f9442616b3d56b6754465e3c33e893d12c3c28bab9c099d1a3283a914ec9a44d26c20a74769c70a25edbadbe7a246e25bd6e6be1e3811d9fbf4f22dabeb6e2f71747aecdbd9c8735b3e7024181fbe89c05b9bcb6390ea12fa232c1e6689076eb57199270f9bfd0cfcef38242fce8490019e4d4e12de79883358e5155ade1c008025b2470167dba08f66f8ebfb5849e06aa90096080183050563ddf69678477d320d68376e39b6ec8de0ef4dad38a65864be31adc8d64a5832a62b865076d01c660809228bf79db5c7dff6705bd119773bf5984f3910fa69130b69570b85385b5f375b3afd012738ad4fb63bca0368b8b5c03c4deb6d49dc4aa10ebc72913233be15518e32ae265587cbe1ab35f6163bd6d8bedfa1f169fd7d8aa5cfca913bfb7a27143521539befcf57b69f0feb0f26f4edd22243dca426c39d4d3d56c581aaaf3559303767e05dcf682d6962b0ff8bd09d6e0e2c9ec129164b36e13c91d049359aa1db1b1327452e63c219c6aa5632e9bdbf806c2ea21cdc72e60580f1fcfece365aa0fde7003fd562cbac4a81bf2022017d7e313f9e28a417b777c4f1fc487ce554cd341762932caf62d73497d3c1c1250b9de3c536269fd0b484277a570bb7ce11bed069e531ac5ca99937092fd99a7544b74c3f19a68af62718e48abfbd225a38b1f5e003339776b53e76ebf7da927980da6d06df2587a7a329c6a85e630b751d2f2b2137064594293b6aa2fa77e0c0224d3b822f5edf0c6b06796ea80f789e7165752b1c7bd4f496924076d495b6ce72a51c972cd30477fb22bee42f97324d584ea27a47e6ea189ec713137cce819a38a2cff97aa1b6758ce4d0da42e87437c877e393aa690e7185eb18a019261aea72ecb15bdbbce0f66b3bb538574bec72cba78ebbcb6159b718a7b2b29561efc9125636311853c3b7bc6415fb62a74ff2478a3c965ef6b0efd8ddcc64cbaeb50df99dc802a96c55ef6122525e1859d19cc6fc6b5293b07e2e0d7d584d258507dffa4100490136e441099127ea9fc919644960eaa42b3e5a90f2f56297ac9d2ebc08a4ea473308597520623602b7157f61cb960f6799265e717a3db2fc92a5a280aee36ae0a2ac0e4a817be45e4a8ffe26ff9edf072649740a14d05dc4f457b4e7a21bca7084ce1f562a3e166924c144aef5aa9de02abcb44c57972a554ee8571a071d8d7270d7a77d54c75369e82301662fb987b06f6ed91822d0ee92b37ef471458900e53fdcabe27297e292d380b65b67644652aa2e8f7fbffffb9c0f45370417f29304673fe73f21539a50056c1c0b5ccee18ab36ae48e4d83edd1d33898e2841f74e2b05bbdea1c10ffb63b43fe37ecd89924b3e28caa76be3de11a67bbedb1e9d565f0aaecea7040b5222018b9fdac1a8401a18f10c0aa44ccd2c61f07df9fb1695d415e3802bdfb06af679ee49017923c14d554f1def8494d9ab39e0a2591b588a8f8024fedf079ef5e98873851f02428aef78c7b41cc718446201d0f464bd0b278573de7856c7db0adf70de80a63434e958b8732578bf985e965fba2ac2f7d21e1d492ddffa9f613a0819e38f512432bb3743cabf55d8e8f41d15e0250124fd056dda99e477e01a9e12a0993385c828c7274ecfafaa329eba09c46886f00ce60ccb12e990bfe87ba8240a6ae3020d43590085302934fcc419f4748eff08f6adb8ca208d25139631c3dc41b9aeabb0e7beb3935a6f1557cd7d0c668ebd2033249fcbe32e8b3a8b45617e0452382dcc78a7a72f7665a63f8af33b60bb38f1eeec88e8ab1dd796553b4db2e63a0ed5fbfd8fca5a1e91d8cc3c7b1f8f43c4ca1b6a1d43c2e2cc8ff7678d0d3eb6bfe593a78aef3f40a063ec4e3928b3202db9cc41a66d552d0883bfaf67f23a0fdd5accbd99858badc7df8d3542d7ec4534ec5c2fa4ec22c9d9cd3e8c6b98c1922e009b0bb573adca239db68b03bb4739d7ffbc5d78d0bcd03593122595a4aa77e6a152ab86aeb2f44b4241e4875fa9baacbf60bb3eef0c8badfba7bf7eb72c9d64fdc0070058d60944c3206a9d3eb04fe940713d4cc1c1eab7249798218f9b92c58ed8e7fd50413fba2b53ad04fe1d4d9a81c21fbc955d444df4b714ce61d2bfeafce4567ba820fa02c3b372416397c1cf0d67d209e8845c1054a558cde1955afe6b17475983d75cb75f789923074a665f22fbd1a224f473dad332d0309394f3d44b96606828cc64cb8adfbf59fa5a2baaef4b22520a3b97f65ea765c4a4e68a10826bd8e58f594f86e41ae264f88e669eef249f67f5240aabaadf48eb36377f7b79e6ae7a78a6a246f9819edf913a0fad879d95f54fa80c501e73da43a98774dc72e70ab66ef03b85c772fbaa9daaa3cd8813c9318a9a423a7f23213f036550932c404cf4f137dc08b5bb6432668658d13bdb0d94afff017f24e76b3cf23ced3a1a9ab128fa43617548ec58490de97413523fdafa1225cd29bf28119b03ab9b1d4aa15b0d5ada320c0e6269e30ba0a86c22e7a55acae9ada3f8c99e28caed70e7d945957eb4518971cc82c1015c4a17abffc021c95d1ce708dac995fb8cbb629c5df466ab4c2118a74f6ca9d369db9f9e199b0f89e736ca0c006bb9843aeb403aae3937947fd3c73c6c5177ce9451ae9798f703ee4a572f097b3250c356d0c0a5f854b8082b9e0f7b9a641dc1688229fdbfcab6a169a3a9b6947283f8148349073aefda533fe853adca621de432595c7622bf6dd79922d1cf2ae0205d28ac4c83b2058e152be982f1d876ec5e36d7e4d3b7b85221532291ebffe06708d82a097907aacefa3b532746ab7599e11a3249ec50b1974d8c99bcd2705dc175ad07466ddafe64c1be775c3259d22780c932faad72c528bcde0fbd67a32f116f3a55d00cf6fdb43ff2d8ffaca9042e2304b7e158f9e076ce90c543f784c31a3f699c86b4ba1288919e2dc6693d9fa095048cb1d296262941f0dc45bdf6791e7a6b8c1214189a14fbfb9ddb484f7ef0e3c3432ea3aede3dc80bb8e7cd5658c7905d67c309f0c75534a211b8d624b9af228a94101c0498a731434f294b97f4ab88cff2b0b12c32879b1306989461053b84a2527c2c74ab06d4c31fc1dc9bf872c1857a8866f48e29ef8896d981ecbe3d7dd2567e75c327d7e056b8ae7539f00f042298ee26d216bc7666d73203dba5c04b6795491e36b31cf15e543aa6c3d0d4d11476e0f60345a67d0f5a6967bb4a1db2648e351707ff194a8bcdf3ae2890006f196a0b517aa8da7f200746aa10b0a602c157e5840c2386efa8aa24c44869be4a4742e9045c9ed9ac744dfe657712a60177c5083d71c3918ca5e9612e72b1afe88b4e2dc098fb85e7b42fd729955f8498b6483fc800256297396e62818d4ba14afc4f119f7023dcacc99ab266d02b52c79619b8dfdfa3621c97f3186afc0a12dfc76bc540d2e6ebeb1c85f2d01ebce3be93482c4ae3471ee7081122a94ab16ab1c014bb2cf4f5649da23eb0075213e072c79eab6a5525407292ccb70cc5a394e766cdfe64fa45288cdfef499d8cf5d089ecfdde4b8e928087839c47717124be597b24913494bc22a2c64e4cd5c6b98745e206afba8242dcb145a35c4e8a10f310f20cfbea1e6038b7f0ef83c21575d39d945ad71bd95b0ae47317b7f54416af16796862868f8db6f1fa78c545ebe2ebfe40e96dd74c829c3fc2b753d39a9927b9f9990afe75ee5f9dd237e825e5476cb4e5c327af97c079cf12242cafd8a4bf9af3c6f0725377b8da49c49e2d1655dbae427bbea01936c0dcedf7a1f7fa49204bda0a69eab7685e916bde196c889e64a9cbc39b020b39e91bac70ad846153c2b1c9dfc7696fd97d2acb69e35d74155d2f917cef6fd0b675acd4694c2c5e482a23b7d1fde39e8990a6d6179c6e1ea648d9fc667f7a74e93b332cf0fc5541975b9436f5f07715c8dad8d7aa6cd25fb46f4323b4feb62a368d6ee8df039650a148f0ff21a1137f666dad53ea4e34c5e011e4882933a815d3c57e8e4ddf6b229a9c78528b73c0a64588fa4aee0a2fde322a1dabacce53474ac8ee3d3fd9c795933c93b875589ee4eb256f990208cffbe4d52f36d4bd3fa4e1275a138373fe137f26fb15f26afc76803b732065d91874fdde7a811ccd74eaa0f0fa2d7e67e7f882beff4027dfa6bd84de3f9fb49cf944b4b2a1869aa36494dd5713aa1da389957be6842c68442c31fee08be960c3882bd15705f65d3e06378cfb1b0232e3d67bb89aae19884c0f20e84895c07e803f3f694d94f17e306b06336e86ad4f5e1cc1fff766f5292e9f4cd15fd1cd08e92c0e1013bdbd8e26baf0fe635c1cfbadc404731229bce8768766cd5b31bb49686d116070469cd78b5a79eee6f7769d82c9e0c8c0beb4d74c4bfb52d4848fe7a7ad507907c446c4b7a4819eda5b789c3ade8bb9d6238de5153f24ad7d7814945dff697374dc35851b73718d04d06b5d1b0299cdf269c0d14c9eb20bd8cf52b0df3d0d4989d2c1e10c1fa7fc91835250fc4c4a4bc5f2ab0197c33900f1d38971c569de4621657be1084c81ec065bb28816cd9267a047973127c48635f0b5db465a3558e06c25dbcb6da6f37da610711e1ee7b263743eff5de5a2f1910bc5073333be05bea4176b572c2c8a66df58e1560005374d4af677cf0c546afc022bff119064b2463f48ae5a16d675c1e3378c12c1bcbab265c80e6a1e2a2cea0f907e86a0e8cb0761a2fe408ee648df18b0344568d08f420519e3aa9d2894b4f090e4e2723c170b34de4bf8470fa3654caab3a98f2908c17d5aa9f1164efe33365767056900760d295632ca18dce13c3a3b3a2d4eb1c8ff7902d3a2794ec98b24000ddd3915f3f4fce18cf1b4a51b3fc370775187e2af15999c23537b434505909b6f5474e0d9b6c80d3b9c638f0edfe33cfbaf86d39daf465b36949476419a08de306b004bf46e73dcd84100d6593259d5f9ebf219a689ce9316ddc6aec13fc470ffd25948368ff012f5c37c26afcbeb5fc2f51fc8b951746f42ba38f007f098df7238653c517a4ece25fd30e5032c6a936eacc47e9fef11ce966c480c02d2ce18154c38f20447dbb0da2c168ebdae506fb5e6da81bc547b46a77226206da14d0c044ec91f8b3354a0320da04bec5891a2d90155307d9e232511304cede544c806d97ff8b6603fceebae70b3d77e319a4fdcffa94e509d5cfc5ae43662161f645655e99927f2e8462ceed8f8630f25def88f938526a180186ce70a439b0fb30a07cbdce083c858c108ef2eb0433dfaf680bb6c1f98e12cd5c9a9b9ff8e84ba89582827e440a962c3ae4dbb3db68dc19ecfb5f69a6ad9f41c40141105df1537903feebc3848143323ae08c5c7337d97e1fad40b563e6f05f5c31f6e5777f3102899edb82d658e479bfee4b3b67b5150c9652a2ee4761b3c6977ba0cdcac02650b6d0d24dd6b6ab6f7bb98435b88df8a79259c55de4c4703938ba7806801c4272a8db2851be04cabe670e77613b9ede36481ade14f9174941b0665e4d15b3ad92fff4d845274ef0c68ac81e320bbbb6e32f37899bf6c4936eeb0deae64d13ab3d9b645e0740f634c4f2129ecea8975c7f514c52d582011d9f1bffe995251b4c7627e1d4a81f1cceccc5c3c4c11732709f79b983d2e58bd32498849d46dad535dfb7f5ce4a21f21a8d506e4970b3b407ae0f3b91180ddf726fd4c2a8fcdc2fbbd557d192bf54e96d1bc21ec0331b45ac6280217c93884e4874e1ca143c7884a718d2616d4694a5b131ed35d847b3f5ccefd64f123981c43396c5c851b81cf072a1fb98a417697957b161c16056972f74221c52bb1c13e92c3b84a83b068df1b35fe81cc7a0edb64f5cf039f7dd2fead9dd99e44ab16b4baef27fdff1a0365fd3c68eb3c7d1591f6f5dbf1ff01dae227a4e283a5ac59eeb0316593baf2ea3bc288557458d447136cd0bea2f375777a554f88b3f3732b26064965fada3718f78de3b36a4152cd7cce62586c1b2604d30e70a8dba8d10f7e08572bf00c8eb3401b2497f04c91bbba903f6b7cc0e617646e09fa7e23a5566b749d4ff8b81dcb129270fc65bb62919270d6063445697238d7a01dbaf52baa6cb350dbcd41b2f1b3dc55668a3fd15f1c84e9fb75c77baaea658cfbe1c2533955cb346630b444c019eb50c675448145a1f9a7b8ac0c7daa3829a272f6806db078ee6f504d6868192224718aed7efb2794f756635a50f54faa2cf8cc05af680ae26fc38791b6c254d85c83f2cc7d4297186baf1671b91c734c98d7d3ee1543eccf5ac59c65d05da8a71b8df202a99b0897df8cd0a3f337c91eecc3946c6d725a278fe5bc75c1eef77967d69d1d80b24add4244e3f04229303af50045ee33168ff2e7f1ce6fb836550f6a4626c7347c3463de2578127c64b1841bbf3a01f67acf6c7a66fa8a3dddade17c7528860fde7071569601fcecc52d877b526f40071ae2dad7f4ecb1c031dfd3ffe851228035b4a41822bb74627236ce7eea0a1dce826c1a1fbe2b5d774db383108d94392c5228416088cdd75a8b4ded9aabfb7443d0b341a3c681cbc9036e95f9066f4f3a857a746bf6b3f8d15590954d79bfec69cf221f67367e52e889c6f6575f122aec9fd24add2901474a4935670d8899fcdd21368b38fa42b5b6e5230e653f9ba2999bb402212a5c59c69dcc7ba92ab9e85eb32180c174beb4f406897ea4aacd27a62146ba48ddbe7ff2951e61756de46db8dae194a771c3b08e33d48fa6746bdbad563f7ccdf78c6c03daf1bafb94b10b6c148787269c927bc9c008e6902d96b72936b63e51161594733671de3c97e49ddfc5a1858a6767efb84d69bd2f090986dabf2d38eb6b5cf5467996384fb39fbcd0b86a059fbbbbd32ed4e8f44355dc5a86189cfc012660681214254cf5cb4c841632f436c1dc8e368d8188e1494f61e2528c25c97bb40514da83d9cf51de8557d80fbcc3a5a1c0aecdd371d6ff8170cb1ce8ae24a6f06f6d6281ade625babc372ec7e98ba71beb4e43c313874c087ca88d080bb889cff1ef95ace2e41be3640870efa59854717e05b0a7518bc303ab02b76c2d4002e38b57bea3191202f6f4d3fe00452c42337d7f7176397a970b3575646c279dc6b2e497576bd18f099ff5a66328e17463f0606c9cf2b5bcd9021f620aedb026b870d263a948e76dc403480229100c9fbd8300d17ee326ea9fa06186ffb5ea3704b98e0ab05b4159f2ccd91591b660ccb63146b4d2b8f3f30dd5ebcc64390954986fd0243e9ada47fdc50c5097097c108b3bc131949864568e1885254808fcd2bf2cd6a440a6007a44361bf861322f7dfadee4081610490be55ff9934e44d54e108c24f8b387805c326a9209fe64e2c0d560da6eb2eb0a772c7d3878ce29ea094e71f4a19efe6f46832e34cfe4e030aafa787f219b3fd0c0227c42189d766d2e38541d89a25c6b155c67599924a0078523dcf5852be6bbc90188bf4b4dce36cefd55f63903b3a0e97aad22bd661cade9d9e6eff4da681164e2a8b95fd91694e3cd74eccc1e7a643e66cf8b2abeb0c0d7b2741086e84d82e33711e6bb3427d4abec24dc7adbb58fe01fe689fd4673608a4a69e4004f89735717703e1e52c85bbe9d7fe5c9cfbe6be758ecf3fb7c6661d8def127e3979eca374e7bd46d7b7320bbced1a96cdb4d42d4c03ef0ae90ffc5ced57212da9b2cea0d6b2ae236643f338c5c599d7206e757093cd80e54b7eba41e8c3053baee62af50724197917f6d4a246c2c969d0796fa0a1ccb3f29683b96561bdfa1afe8d3b0c3114b44a97b5f66d9ea6e6c4fcf3c84f039010cf281b5520d54427b4c631b755f949eef93bdad12634e356c1e00dc0dce4b14e42bee72eccc4ec1d4027ff83e05494ea5da13732ea657e72a7186402b9824aa3c307baa5cac44acfc051dca2a77c8474a79fc9d10b005f0b128f44eb4c7569a32c96d191b9a50a1f9a7ca8d33113ad62a0d54a9f6cdcd64608fadb5d8653a582489a28663ecac19041db7778ceed81e3bdeb223629836f0441380a26c5b80a9f45f594eb2968f07ab72ad4223388363209421e17012b7b932f06791fb4364c117aea4a0cf8828c21108de4f3ec4446f6f90c78a803260803dec7788c1d81a3db309caa2363f0eb789ec5521784dc0521acc5f6f42d6650378eceead32beeeb0310b53aba103acffe869418febd7a35b4f3b6f6fa652af48bcd13207e841ab3f42dcd6836c550906a98c8f31079f9b6531bbd0caedb3dc257061220a3e6494601ab7d7a609a5f43bc97571e8502af1008e18dd65353bc1e1dc8828c74748432109175e849c845a1609a59919b966174fd06c46c4cc5ebaab675f6d055416dc258119bc8b0e083728764ceb934d4acc5817bd6f76929774f5e93181468ccc0becef7040be37cc129d9aca7c739f68efc4caaf40a60342508851528c4bfb06b685b425338fb436beb4e743535915a8c7e2c6d7e69eac2a697f713d3592ed3f3c98c797fa8edb8ef474cc727915cc1a44bc694e80a20bbffc88af484c196d56c52dd0fbda265af34ec347a80b12113e286314bf13e856f48840d7cc91d3cb4e79cb2c9453a5da620c186a4838fe1aefd5cf2ae285603f5a934fc2829bafbcdfb8e4966c3e54389910996bfd8888c7760427cdc23d9483c26ebb30c9533fb324387081a3a27efe4ab1651d4ddb4fdce744a3592bc47d4461ed10f86925fa903e11e45c7752c90f21f1618efaa4e9bfb713bf44442620f54abe9476e043c9e61911555ab48c456a2df0b7967154c2589bb13cb26bc8521efaaba2cb6857057fc57163bf3619be108d993fb7ef2ced3b2133dd8bce83640770030cb79a758a79fd6eb740a112d73190aaed96b017e3bfc6c6953488c7d42a43e5985f8acfb49b53dd41ba50debb9b1fc6d74338a307a5717a045f5465b85d4e9487f97149eaaae978cca0fd26eb97137c307032ae7289413a3d0a73ba870e6d241a78d6d4073295267801fffb674cfe2d6758191647dcf281aac9f4d0e313dd33cc78739f1780f35cd5203ff7e795d32eaa55006ce5238df3f904e635a7d83fa651a97478e3921a3fea7a838494a12a3618049a4e0d7a127166d44e1f21ab84a54e47422b0863181463ad1097347effff51fa9c0501c6bbb164b075983bf5bbd022d8070224f51a0dcec627377824800531b566a1e0f8447212ebd43dd3693f3f27618e7f7ea904adda28386ef825bb87101196a28ecea53815f08e37993781acf6f23e7903e3dfa8ed3ea9c3df1999789f745f1d1b95961ce00af6ff5370c3be92b04c06e27cb277e2cb44938afb8a646bf79ebfcb855c1c9b283d40b2ee18214ab53dd8e47c90cd72cb80f92fc1930562659b2ebe41476142b2d746ae11e173cd444406ee6c4d2b69080b2f7632dff6a7204f9f00289200df66153acabbe78a4ec99db2a46feb7279121f20ee321358ef58252d4d731d2951cad013a5d90f91c8d8e7cc4d19bf1b8ef0223a1ab3594db35cfe48e3ee1958d7dde623178acceb2022b32ef6c70d2450060be11d98a4b6f7641b61644a8736861419e08a04e059fdca61ee70b9700da11a7ceab3a67817be8a31887c92918338ee7c5fb8403bf3be077ea7ea58c8328a3249f682f97cbb0b12d64a3fee4458f2661b5d91a90d7d026b84f7e328c4f2978662cb9f16d958951df0e9373679976ed5b17d8c4940f95a14f710f68e49b99a8e642eee9c935ba55c2f13bcf2e5973a4d924d889608371ede2af01a387bc88a296500b5c220414c1ac531ee2cd32e35b4b3f5975a67cc5fd4a832c58a27e3d59f0beea3a8cf08f01c4bb1f092fe3f4236e442767a6307928778398570125d1fb81f800e1de67a181ac70da00db4ede97a59b696e72b11b395b2f83093e3846630e0c14a30c98af7ebbf673fc70cd793a345fc3ae39bf53e7cfa10a3e2b08a2de16bf8f0e3c00dac20b77e76f21afc8ecd0f9badd997802ef8da4a9e0c7d82c0e619b5329597a8e55e516a386b914712c0c2a2f1298997597f0bdd5e27e09f61dfc8a9ebfa919eb477a12d3b6ef8d420858e7e01fb1fc86e82053baff42bf800cb9edb5662810becffa147c0b1ec9869922de1e48086135ed9b2a470c83465465b8252a356584a4e29a3be4ce54dabb51c958d3a8c0f889bf2d2a7629682d05a491abf8d1566c3e3ae50faf1b71938cd26605539acd2ec42687bdb74fce94369c020842724e44ab6f6a107b6d4c7358e9c3029c6dd5023fb5c927683c9c36f18db0eff1bcb2d76d3aeb8de084fafab73bb9e0319dc99d5bcfe8902618a89e0317816d640f8166e153536b06e917e7673bcc6c9035f5429dce211a38bdbc292739eb578d35b6b3a9c81c7e93dfc01ea5671df041a01249758ef1562b767680f6fe2a1ad206e3b8e878e2953effacc725b643c7773c250b7abacba5028a541d49c5296c46b38494c6073b8cef99c75d990421db9ab84a9c27133e89c5a5413adb084d19d68de1fe0476ce75023563d0b7fc06bf72afb234f68a4d5d2847bcabab622d6051c38579829de812de23c0b4fa29d15f4de827db608c926ed4fef05ed4b624d4bd158136166da8711d7cd77d2e0d9735c3d8c453cb27680b5ce98d5132fe4decc218532bcb6ccc7aea02708b2bed0c41e822cbc77c909e01613c7ec632a3d4bf8b00213c36ca6abd04e3ac5d39a453d79a7696123996a5772de9870cde6982923c1fe5be880bb7dc386f620badf5ece208e673ef3d3d66a39fd07614566cae40b84e700e7dbca452327e1082582de133a7d4ab9e74dcfb8a1bac573a67d68cefd973e65a008748c2473dfad54ed88850808ee0f21b9daceb1e26e5d738bc2714d0bdb4bc2648e19a99a99157ddf84fa84c007401d704d9525a801106baa18d1333e111f0c578adb0871671719cdfd1c2469c7a34ed0ff589b4f8212a8718bfa918d2466b173f9ddfddd30e495dbe6f5cd75691532d0876627da7078a12f4781be8abe2353a3528f85d1dd633df96f578aab04a8934125d9cc04494a71e866d73932249fc256a6bb16676839a0ad68466768a0a01450307fa0f95a338da5226d8afaf4e19c62142ae8b2913c3ffcd1af1ff57798f44de918846a7d4b7cc76d43e26e3b944bce4be9c4c923da41e06fe18662e280a252a9afb3d61cf6e50d69a101ce4e50977ce72cf1ecfaed757f09d6b660628a44ec983057f6cbe79bfadcc3d45ca07bd1db9ad74492b53099996418c1a26ec535069cb2994523a4ab7177e1f87b78ff3c78ecb0c23f7c86cbd4e0f17effdce22753c06ded4db4732e972ba1cd1156f5e791ecaaaaa30dcff86af679b0a4a992bbc41dc5f716f000f74ef78d45b2ef45031f14e5c27d3c214a9eff398172f1cdea289132fe264fb42284d3bb93f19591d59b1e92466fd378dff851fc43520163cd4f99fd1925e15ca8abad1e4a60ebd77295bbc35a2122487c04293aae617bcb401304f28c5c2f0cf6eb16a5f1ae4462c6ed8a7dc8548f4c0d04bddae2dad4d18140c3def4d183c9b57a1a7b7bcc9b8bb9bef0a7299a2d2f0a55e3f773a8cd4a1cb91cec49aef94980f96c2c1b97dacb6be79eef062f31d8b6e026750838f9ef9f74ad26d1456b139f32e6e4198d7e82e5595bf8ffef333070deba1af1a85f85e78c4a7274a7665cb42f02a2c5caa64938164d2e00651032f9a061355e78c15b103b25fe7d6c6b05385396484d4ba1d14f17d5669d092c6d5dd26761acdce161cffe7bd4f34c1eec5017d131c2a1cf53c3656c024ba9cb30cd2a96900f383ff22ecc3532af1d416ef238fedd9793ed464fdc1e7558d2bb4765593adce723d712ae437ef3146eed2e18082c8a48b03ea2675ab4291ac38044c0c71801e233aae9556317d499a5efb18e041b185b3de78ed2ea58f4613a148e53bcada4519deb8e071b59821daca50834477c7a299c6a71bfc9cf77548c9127ec861e3754cb38a047e0a80138cd8449f889c548d3813d591ecfd209d08d40a635b71dabc9d561a443dcb7c2cb1a416781b2f86174064b8dadca3d12ce54fc6a681f1372255c4cee5b2828cdf2ee99363dced07778dade04be1ea8a92eb1dea73f1ecd0b94be8575310a3adc2a15fdba53042365b7be45973ec4fc3cdbb78d74630ff8b5e2996420022b436247c0d062fd13d49b12a99d2bd7a8beadee5684d0548ec09e89dbfdeb62cc64e1fb31f34394f86a51c8a5238131b713100525dfa3c08e617420fec41c3dac656923763097a15764e83458889f54875c72178f3712ee017e2c94d192b0e19e68efb6b02eb73189e210e214499042d494e7f2faeeb1572a6504929ae128129acfb9e3a26851dda9a54dc53a8a88b234bc60c45f4608f0e0a54b08e1a2cbf339ffe36a0c6e900d86531dfece5d282cfea3ad265ec86a5177de244d1fbc8fa849da4d4647db5c374d24d178443d3ec902b0965ff8f8fa0a2fadfb7ddba43699db3ebb13a9af6f83d508209d2e91d6df8892c9876b8771bc452c72cd39bd0978227ab279892bc9efb48d6ef7135562245a4caa78f16c7e538f51b49fcc9d8ff642bf2fe05950fd7855025892171b2f784894a6fa2b05101e7dee9be262b1e1917d5cf99e3d690e613e23242aa7146039e48bf51bc7459ac82f63d517a96134be97f236a34217633186ce6913a325bd1c30b05ce3f7a82a9a22ca23a8e98fd52e365f3574ac8f26d6aa33454085d7142042d262b022751abb4dd274954f381495c5acd1ec182c8a231f612475ef129101a2bbe6f5bc30aba0950d7e9a439ea0578571d89d38afaa49db4dd36987b4e44546b88fbe086627a39036adedd367ccd79b5b498e1405cc07b6654ce42bc7a5ed5c7af54555ff43e32ced0d249cd530564dcf8cf4ec2574dee39d5d874a21ff87ebd184984b612faece8915a7156294c5fc48af009549621190330fe41ec98f837697499a029b2ab75a2cba286dcb4fefa436ffb8e32eeb56ebc4180a75ca2d5a8f047baa3392e033a74d14e60a89f1f5cbe7f15ea6d80f8ac4556882fb9e6e2c599b4e296855a4e9e344345f11fba8c52326b8c0351923b70cfdb0241315e43627cd577295195b935d43cb37f65b499c83db6ceabf32adfe0c23ae7e3a15888657423456150e77fd10e502126e180bdb8e97b2ca6b476339f7a89ebb3c22f2d1eba256bbc9864daa1b38b181a93eaedb8371c981ddfcf0afbc7d0bee0f8b5a1df6516609207b537cdfd688042221e6e282c76ab5443719af678ac3059ca6efeac18771a41a60e11dbc7e60ebc72bedc874a22f95a497deeee1a0b7f72d0a445baf10b7e82adc145eea275c02850b65d2ec5f5c1bda738706987fd008f07dd1f35e2b5f85320c64f9cf3bac081b78a3564876a78a6295434b748fd7abf794013d397d1af869cd8a9f0f782d465ca214429c7546655b3b382f1de9fe07ce2802d97327c08923f1b24e5c34b05db7d2001921d3494cafb183f2b18045aa4e3da5f2635a75c94c8d03e8caf5b5bcba28157ab802fee813b6ad0497cf4c0bfe9851a031bda14175d8d008df86029fb3962bd60d20de1fd8f93e93605f49d4fce1db6e8d81b39e2c037318f0f26869c8ff50e348f1da32ba3ac17a6bb1b8c029573714c61dc10c54dd1a4e9c4cd20333c3b675370575bade21b82e448664ddb18db7b5ed4f4ef48bded89b28bd2db08a4e3145afade0ab82c820d945303b1f436f9eda6b47ed5166aa753f8fbe58081355d9cb172f403a35c9236332b9329c28e56e0a045d59997230a4894f24a8a23073af9b1c2793ea249eff0015de4f896bba22f0e5d6a91f45cc4ec613cf2fe33fb5b792125a7b34046b98050137b4dc74f3ab06c36921b8a9889677ab7a960e45a7e16d7651c46504205a04e3d034a16a64ccf710cf6ac03924be57fd9cf5029d30e5097610a0ec9f72c2a2e29046e783b36b662d3f4fc60f2689053e031aebdd277babfb5e065bde98b6236dfb9c7b1d55bc2decf80de9e03373a50cbf7e93461a0d4e37ff0fdbe9f8b04f9e912b97a25f5d1546236935362989225a11290edc5a62cc2bcf3e1acc41367cc1cb8f6d3d8fca4dbdfeafd265ef49e9af4bf0abab48c232017a6423c300197c812353cc4edd3660685fc363f2f47b3ff3417a802e102e0052e02d050d9d2048d38f24e3a017444a1c4ce68c6c40efef9fd2b40b5b0e1bc7188903ea4eb2644a25e7a8af603f3d5cbd6d5ab4d1ed35aaafa414bd4968e8b3dbd83329a418b8894124aab858392b55f3c54af79833881979efba18215ff5e5403445991014f393710487b0a4df2acadc5fbe9143ecae61261306874a02bea19594cce9d482b93353f9889d35f7735530aef810da2075ac9ef25ee68d89cb63b55c53f3f73dbb40b995eba5e1ee4a3dac3d80d4bfcfd36b4c43fd6e700c8d479e613426934d0216e574894ff4ae60a1cddab83a18be1c6d7df764ed074f02b34f91d6025052d555509ae2c3574b3ee5c7f6ad4147e0fd2a7c01559b99938fa31cfa753c52b61a3718033a25726e4dcd958b65ac791b200621923582dde54648d2af4d4b73b6523b1e8076173ed3d787e5f1bfdaa93dc7380baebf54431e30f1a95ec994819b2d39b1b6c0e218dff577e3f56edc3ba9f43f4ed5c45691f48a29300922f20e4fef241146dcaffa2bc13083c8bca788fe829d3d3b234799bac8d2c20b0d0df5303a71cd2bc67156a71deb86e4598db37729ff34e956eb36dec050587a44b386091e4caf05fddcb36ef13d38c0c2807e23bf0fe5e130866b28456d4b1c0b168d28425c05ee3d13ef99b4ef86fe47af49faee0e3209d5eabd959087d993799f98dab944a806f234f3ff3c8fb5a7b303c5025d517b28782bbe814a5a50f29139696788699a80710cee1d8a099b0299ef28e8505f9e5f20ef8f7c38cb1f53189c77bc2520ea1c455902d7035222f8f0ee14fd1d275e04b26a7163085f03e70d5f04c0351903f86b029f56f533e4eeb441e97bb791b9856accab15cbc9c1517f3400584b077bffeebd7cebdbeedb6b46fa78d3f786f1c062fc5eb807a0de2c9e73e87646f417450743729a6cfcb4a5555a5ff88f853b750d5c2c04fbc3c8e36f043aa345712266a91b554a6f5dd97b102d2726d339659cc43ba2995a557c13cbafe9dd1fd9a7fa20a6b933244f9c7d9fb55d7f7490e835521541517239ba0fbe84ae98b6cb1e4e7bfac75ba9fe1bd680767bcb58d0a3298b5934fab877c71c10acb29a8567457adcad870018d437acc96121b11ed8576cb2b740ec0cd939fe8d16de62301629922fc9d6e5312af4f4e22cef2d305733c11c1a56c7341c5d68330b21aa8bf95791eced526e3b0fb2c8d571c1c2ad83307785f490095fe2b3f5f6ae9671073aa3a4929e4b0adda5201aa4595dd5ce8336679d870b6e445897b991f036a005c3bc157da3fb1c414e7889843d2e57d0038d9ccdde518a8ccaaed2ed4597a9966432f60c654795999d91bcce52b16f04ceee4b643aeb188aab31eab77be86cc1018c0d3d5d352b2c7b83ac7e00e57e3bc77d84a47e58b4cca3c48224ee2c057a8b1501005ad35ce4ec813b7a7ca88fac3d836110bfa8142fb6e62daa3ff0d371f00996e354eea8f61ce5c4178b5a33b6cd326470b743f459eb5dc159795fad8f7f35771084cf5d6150ca365621bcb9a8cd5f70adb408c29fd55685562dd3ac5f6299aff99bcc3303a92d67a0a0d3bb0d97a897cb04c949642edec0cc77562b0c8b88885869cc2205107c7460733b26eeaef6eb6842af974bf2d2968c8876fc9ac8ba6945f87ade2d04f41999c503ff51c91656451595e3985da20eee317de3ed14fc619690a37737ded32ccc5203649cfe687bab02b48175a081c986364c49c750893ddff94a9e036e11e76520d67360a2f67c323ee70a060595137dcd14c66678f9282ecc57df76b97932e4cb4ffca1ac653f94be4c61d83043959bfeca05203e48af89131e8351668e1c14174e171275f0547082797e1f09a9c1ad58fdbc80d804ae61b175b9b4805d71bad1b8086ff13b0cb8b46024a9d396636de131f7595cec2fe9b62d5256566b0b6bba44caebb6d7a6601ed7b491271e6e449ff01695681639a58940b1b44f68f3e1026fb22489c2f5246077ff2d8587fb788da7ab321cd37178a6a1a453b5d9427ca8a8180dc1757c043daa52f910ee7b275a2b6f2917a07571fc097c7de9b2032eed1ee4fa315e9a381d12584942cd25969316b886c86dc73ef5882b450d860f4843c7847d3dc5e5fb2d2711595a96cf0d01fa11290552fafa58b0afca65e9de20f2249658295a51a54d3656e3ae2959ede86796d5a3ba4995b8bdf79a51558e94d5af39d5b14dd60c92d098354382243a947941793983c76dc6daa54abb4ce3377475a6b4275771c931a522a7f7972f9cd8ee0b2e1ee6bfa6a943a5fde0f3f5ebcdeb5631c4412bd3bb4102827916428fa59cd8b00dc648a5c31dc379e3962fb0edeb30ae1f6cf8645dd5520a6a650fa90e3a54c0e939fecb9de573854aa98b67800492e711a831bbbe37fa25f8a56adbcfc20e329c0748f01f2020b430ac3edb7d2280857b545f3b0aa0edca3e5bc8c8b7316b8f804f9f11744dcfa6b10221012289fa8fe976861ab65bdd4d595df11fe54465373d095929c885520223138a374167f75ab8e81a734e26dad28d171627da7bddb76c747150c1108bd37d35d8dfb109559521781c35a1eb372ae4455be21b0aac95dc0374abb8e9403e9f54426345ca16795d71f1727e1a9bfce99cfb11e14a487beae7503101e611b29e6ea158a818af1c966719eef089d2ccf2ef394c3eb22eacdd6e9ce1495de5df76d3f8e67e4aa7196ef92952042544a08bd66f6c2a8e162328c6a6c0a8d2056d6fac70fce3ad2b6c73b6627257eb71b5001ee86f2512495c2927b75cfd139b9728e2c98b612c85d9fa2c378f5f70d72ebe5a117be4ca05060a07791caa27dcd4fb6ef38b204e8802bccef95b691557adc78208b1e906059b423b9ac18ac68ce9a35f872ee0fc019f963e2ee8dceffff9a39ab0692910441fce15539300fad700f935d8bf0de8d6a17c6370637f38c19cb05bcb02dcebb14cf5d1ac50bac908ed9e18ad90df795a4949ef2612eded2aa9e4619ede8bf68f56fe41620b356cc20468e8cf6fd8c5618a0a74bc8763abd70e3d51d305762a5fe15f4a893b83150a66009d53e3a09068d232c2d9d8523ed1b3daaa0e1599b71d92a9bd365954e3fbe1887e6b81f7d5b97edd64babe00aae5df6a9d478dcfbac75271c20c27adf87f23ef79900b57e1be4510bd60f2a36693ae82fa2e39cbcd2b0055fc6a797ae6b4ac4015d4cc016ea3350ce3eaaca595473525e082203024922c353af8cecd1656502a5271f4f446ff05b46325cda409c64bae94961a3060d8003104b838fe030cd204aaa455f5eb24ae8cf80486fc616798a9579a9292005b24ba3d6a48098bcc388fbdd7b309310e35ff555b62f7aa726756da038ceaeea3994a0c015040f804673fe0a23eff9cc112509db062ea529b631da6870646dc6e3a47011841d3080c8de1d81362787c836f66249b8e39979f2a64df60a63b448e90cce7a2725590d19c44a992c4df517e113580fe943852942dd333f0ec9964900bf5a1dcb1554cecdd53cb935c50a711cb0e86bb02f3e29febf82b3451418dbcb19533b746e61514dc4311d679c2be683a3a375e52bcff1b32a2216d8bf09ded1a5c8ffcd0c0513bb729f4b6c1756bb5939b8c87303fa68ba9b8a7034dc6c9470b916052fc7efe7c7848cf913844b39d692cf4205dc402b255db9bffc9e8767f98a86df910e36a7d5c638ddf883a296dd680d7876c54be57bb13fd459220f374f346fa4af38dc4981d793c12dbe3488e579383f20857c8f5d7e4f590d7199861eacd6ecd4c19906874dfe90b68e55d708022d31902034a19ae8add324950dbdd7d334e47675c7e761a0f8878274528d9d1ec19ebc6839a65f73b8a3ea2694854426b31cfa2c1df6a884effc4ab08065b848cdd728f6ed70bc0ffe8469c5cae5b2e8c7cf2b7d83eb326c4ebdfe1d244b8f76f7762f3d3416d37592cbb8761066fcfa2ebf172aa8c913ab89cc045acf274bbf8d6973500e39f1352bcdbd045586608920a4b0f945d085e7e5b868154dff118b09e18ba77bc212185226d3d09ad14a3cfe7b8f0374a2695c0b9e8ee5d3d5be38925fdeac4cadef8034fe55e34a68a9c550f52256ede1e2cbd0dec7df45dc2f735b427fe476136aff47feb7369e115c4ff48785b82bb11e206730c6cfe88f8b6f1d59b87bf399ae393bd21b4dc5ecd4eb791dec80a087c89428f760f9ef09f774ba21638f333b0912232f3e5c09bd6a109787e5319a9185393e251e16b28edf9c4153e87863919d065c042520c95d325ba47e67f5bb333ec2eeaa5e4f5d070791aafc976674c4faa6932fdc478925168f5b9d5d28365dfa8d05bc8ba60c4d78dfe4f3496eaec7da85c9ad71fccee16c5886ea5b4254956af8d9d2e114e7c378d7fb4cd7c684aef905a04ea5ce0cb4e861c9bacd2a78de931cbca54d9285bad681ac10b7be0a59784f18dcbb49b30b6daeae34a7aa1345400f65dbe176319f26619c9a3ed3276434e60674e3ed7f5127654429a3bcd211e2de9dd0e5065de14e1b01e781d93212d922e57c0fd708d2fe6a7ab8b8ea7a71bec0de42076f7245d4c4484eddeae161c671b7645d3ce85c13d0d49e7891041e7ac5c067bb3a3c50d73e409b3b70d77bfab21605ccd83dc549c4ca6b38d12a55d554ebe8e5fdfa9282ec50d90a6c9c279333b500d31ad7033e81347d7e462532bb04b6877bc71ee320254f0338ff44f2aca315804ddc224b85f79bfef4dbeea624244d5422713ff34f5935a7da29732b5de52def73bdb9cd21ebe0176981b9966a72a2c4b2f0125767e901756d026cbb4662df67b662158d01ca7c1983b830b4ece5cbbabe9eb8b42ea1103f6b75896035fc6148ec5c61f664b315954d108934424463f30d86bac7a55ee6df50ef35974e697549c7fca7d5b0833dc49217639455c8071e6017f17d1156711ab1a474d2270a7a26229d63de10d86980a0f4f4fa8560ba3ebe8d1e894a60d0a0d0b83097d6b351bdabb1a773cd22c86f0584b27a3a9f28e6874b5b1094b41566f1c5dff89797edbe40ccfb5d74ebc0cac2de26b1a5803c4ba76d2e5f07d51330af91adf9ea6c0d1d572255e6a59be77d6e6e21c6cc6921f4dbd29c2ffeba523178f8da8e0584f20ba60fc5cd90118b9b43afb2f84fef5947e93f3a80f948e276892a0fd0b155b4453c0856c5b7316faae1c05b0c78c6a9dc5b63dacf6d1686da486a11d55779ce5e95b181f2b180862ada8c6346af1481c057882a6690355ce2a805ac4a5ea847b57d2a1c26a16a09a4a6b7769412afb0ff55fedfee349824f26f321cdb380d2ec29de46f569f4de0cbb538cff229048e100fd8f1e804021746b298c528256ca4a3bb756b877cfe635473bf67b1f8876dda54d7bac332a6eb9f9b1eac1e2226ed4df310eac2f5cd3dcdf58f5b5c923c475d6650c7c67964ab04ceba8992a0f0a9e0053cc6b3281a7643c3c73252beeac02dc9c3bbf021c85e62aba4050263773a0efcbafff88014b86ed6305cb9ab687e43fc20c257868abf580f8dafa60862bc8d677c9863084c84ecc8b563ecc5e831c0fd455bf1eba477d439b3fa65ace06a7a30b6cd1b38c7082b813df9d964d83e391828efea38c9cf541ecf4bd950599f8027496ea48998fe4ebcf4503e027c46a25fee8439ef81958ed92b98a8f302ce06e8c97dc690fadec47d717c5ff0d374a9f11009d4f29a0f7ef5566b0ff2aa648370b7dd9492795049a2a1c7272e6e78ecff687b675f79b06910a7ef08133ba45b58671270999eab919e5d4ca24abce90b5c1da2380b48a752fd7db8935bf4211b14ece33fd9ef14938397a091b956efefd26296a6267c6b630f2d86f47936be0981e03163c0de467035e6339e10c83d6eb72bdc7a458ce98b9523f33ec76437e3ec6cfc82dc8c58fd3f8df8b0297c36d421693a05f737b48c04db656774c5552238a949c9f4f461a9f58d79e4e20fc18326a5eb73276b53a99af58fffb66ec94e3ac35995e25c068d41277d20c808dfd89a7f744995851675a04e3f7751467f1d83fd98b45d2910d4920120fee50d2fbc193ec2db0e5d7331704a9463d6c26746284e8439647eacb65101fde10fe06ae272357216cd7ed99f4afe14aa4a82ee07ce311182490074bd740c6023bd9d92d7b1e76e3fa4bacddeea48623c20e44c30360b9c535cc638eff2b53bdc9c6eb6eb504e5deb4rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootselinux-policy-3.12.1-153.el7_0.12.src.rpmselinux-policy-doc    /usr/bin/xdg-openrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)selinux-policyrpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-13.12.1-153.el7_0.125.2-14.11.1TXS0SSS|@Sy@SpSj @Sj @Sj @Sg}@Sg}@SB@S>S;S:@S9XS5d@S4S2@S0@S,)S*@S)S)S&S&S"@S!S L@SSS@SSc@SSnS @S SK@RRR@RRJ@Ra@RRR&R&RRR=RʚRR@R@R@Rv@Rv@R@RR@R R@R@R|@Rz/@Rz/@RsRpRnQRi RfhR_@R_@R[R[RSRNRNRL RIgRB@RB@R:@R1R-@R-@R(r@R' R%@R7RRNRR@Q@QQdQQ@QQޞ@Q@QکQکQ@QzQQ4Q@@Q@QKQQ@Q@Q@Q@QQ@QQQQ@Q@QQQ@Qzl@Qw@QvwQo@Qo@QnQm=@QkQfQb@Q`@Q^QZ@QQQIQGQ@j@Q9Q8@Q4Q0@Q-@Q& @Q$QQ@QQ@Q @Qh@QsPP@P@PP@P[PP!@P8@PO@P @Pf@PPqP @PP7@P@PPPYP@P@PPPM@PPd@P@PoP{@P{@P@PP5@P@P~P}L@Px@PvPvPuc@Puc@Pr@Pmz@Pmz@Pmz@Pj@Pd?Pd?Pb@PaPaP[@PXb@PWPS@PQPO'PM@PIP@@P>@P8@P7lP2&P2&P,P,P*=P(@P#@P#@P!@P!@P@PkPw@Pw@PP

@NNU@NNl@N@N@NåN@NNNN@NNN@N@NGNGNGN@N@NNS@NS@N^N^N @N @NNj@Nj@NN$@NN@N/N@N@NFNFN@NNN@N@N@N]Ni@Ni@Ni@N|tNyNx@Ns:@NoENoENiNf @N^"@N\N[@NTNS@NS@NC@NBrN:N98@N7N6@N2N.@N*N)f@N(N%qN$ @N@N7@N e@NpNpM@M@Md@Md@MM{@M@M۝M@M@M‘@M@M@M@My@My@M3@M@M@MMM@MMMMTMx@Mx@Mv@MlMbSM[@MRMQ0@MQ0@MJMGMGMA^@M>@M9u@M6@M5M4/@M4/@M0:M,F@M$]@M@M9MMMMM\@M M M@L!L!L@LL@L@L@LOLOL[@L@L@Lr@L L,@L,@Lډ@L7LLLNL@LΫLeL|L@LB@LB@LB@L@LMLL@LdLL{L*@L@L5LLA@LLLL@LcL@L@L@LzL)@L|L|L|L{@LvW@LvW@Ls@Ls@LrbLrbLmLk@LjyLe3Lc@La?@LZLYV@LXLN@LN@LMxLMxLI@LH2LF@LEL=L=L=L;L7@L LT@L@LL@L@L0LLGL@K^K^KKKj@K$@KKK@K@KK@K]K޺K@KtK#@KKՀ@K:@KK͗@KŮ@K\K\K @KKKKK9@KK@KK@K@KKKKrKK~@K,K,K,K@KK8@KKK@KK@KqKqK}+K{@K{@KuBKs@KqN@KjKie@Kf@Ka|@K`*K]KXAKTM@KPXKEKEKEKD{@KC)KA@K;@K2@K0K/c@K+nK*@K(K"4@KK>K>K>JJęJH@JH@JJJ_@J@JjJjJ@Jv@Jv@Jv@Jv@J$J@JJ0@J@J@JG@JG@J@JJ@J@J@JJJ#J@JJJ@J:J@JJQJ@J J J|@JzJyt@Jyt@Jx"JrJrJq@Jn@Jn@JmJhPJeJ\s@JW-@JT@JS8JKOJI@JCfJCfJB@J@J@J?r@J<@J;}J:,@J7@J67J2C@J0J/@J,@J%@JJB@JJMJ J dJ@J@JJ@J*@J*@II@IIA@IIII@I@IIIX@IX@IX@II@I@IcIIo@Io@IzI)@I@IܑI@@II@I@I@IԨIд@I̿In@I3I3I@II@I@IV@IIaIIm@I@I'@II2III@IIIIIIII@III@I1I@III~@I}Iy@Ix_Iw@IuItk@Itk@Io%@Ik0IeIcGIa@I`IVIO@IJ;@IHIAI>]I= @I7@I6tI3I-I@III9@I9@II IP@I@IIg@Ig@HHH@HrH~@H,H@HCHHH @H @Hf@Hf@H@H+H@H׈H׈H7@HBH@HǶH@HH|@HHH@H{@H)HHL@H@H@H@HnH}H|@Ht@HsVHr@Hl@HkmHgy@HcH`H_@H^>HRa@HQHQHO@HFHFH$@DX@DU@DN@DN@DLDH@DGwDGwDDD@@D?D?D;@D;@D:HD:HD2_D1@D1@D-D+@D+@D'D!<@D!<@D!<@DDD@D@D@DDDDDD@D@D@D@D uD $@D D @D @DDDFC@C@C@C@CCCCCR@CCCCC@Ci@CC@C@CtC@C@CC:@CECCC @C @CعCعCعCعCC@C-C-C-C@C@CCǖ@C@CáCáCP@CP@C[C @C @CCg@Cg@CCC!@C~@C,C@CCCCC@CC@C@C@CZCZC @C @CCCf@Cf@Cf@CC@CqCqC @C @C @CCC}@C7@C7@C7@CBCBCYC@C@CC}@CqCqMiroslav Grepl 3.12.1-153.el7_0.12Miroslav Grepl 3.12.1-153.el7_0.11Miroslav Grepl 3.12.1-153.el7_0.10Miroslav Grepl 3.12.1-153.el7_0.9Miroslav Grepl 3.12.1-153.el7_0.8Miroslav Grepl 3.12.1-153.el7_0.7Miroslav Grepl 3.12.1-153.el7_0.6Miroslav Grepl 3.12.1-153.el7_0.5Miroslav Grepl 3.12.1-153.el7_0.4Miroslav Grepl 3.12.1-153.el7_0.3Miroslav Grepl 3.12.1-153.el7_0.2Miroslav Grepl 3.12.1-153.el7_0.1Miroslav Grepl 3.12.1-153Miroslav Grepl 3.12.1-152Miroslav Grepl 3.12.1-151Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-148Miroslav Grepl 3.12.1-147Miroslav Grepl 3.12.1-146Miroslav Grepl 3.12.1-145Miroslav Grepl 3.12.1-144Lukas Vrabec 3.12.1-143Miroslav Grepl 3.12.1-142Miroslav Grepl 3.12.1-141Miroslav Grepl 3.12.1-140Miroslav Grepl 3.12.1-139Lukas Vrabec 3.12.1-138Miroslav Grepl 3.12.1-137Miroslav Grepl 3.12.1-136Miroslav Grepl 3.12.1-135Miroslav Grepl 3.12.1-134Miroslav Grepl 3.12.1-133Miroslav Grepl 3.12.1-132Miroslav Grepl 3.12.1-131Miroslav Grepl 3.12.1-130Miroslav Grepl 3.12.1-129Miroslav Grepl 3.12.1-128Miroslav Grepl 3.12.1-127Miroslav Grepl 3.12.1-126Miroslav Grepl 3.12.1-125Miroslav Grepl 3.12.1-124Miroslav Grepl 3.12.1-123Miroslav Grepl 3.12.1-122Miroslav Grepl 3.12.1-121Miroslav Grepl 3.12.1-120Miroslav Grepl 3.12.1-119Miroslav Grepl 3.12.1-118Miroslav Grepl 3.12.1-117Miroslav Grepl 3.12.1-116Miroslav Grepl 3.12.1-115Miroslav Grepl 3.12.1-114Miroslav Grepl 3.12.1-113Miroslav Grepl 3.12.1-112Miroslav Grepl 3.12.1-111Miroslav Grepl 3.12.1-110Miroslav Grepl 3.12.1-109Miroslav Grepl 3.12.1-108Miroslav Grepl 3.12.1-107Dan Walsh 3.12.1-106Miroslav Grepl 3.12.1-105Miroslav Grepl 3.12.1-104Miroslav Grepl 3.12.1-103Miroslav Grepl 3.12.1-102Miroslav Grepl 3.12.1-101Miroslav Grepl 3.12.1-100Miroslav Grepl 3.12.1-99Miroslav Grepl 3.12.1-98Miroslav Grepl 3.12.1-97Miroslav Grepl 3.12.1-96Miroslav Grepl 3.12.1-95Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-93Miroslav Grepl 3.12.1-92Miroslav Grepl 3.12.1-91Miroslav Grepl 3.12.1-90Miroslav Grepl 3.12.1-89Miroslav Grepl 3.12.1-88Miroslav Grepl 3.12.1-87Miroslav Grepl 3.12.1-86Miroslav Grepl 3.12.1-85Miroslav Grepl 3.12.1-84Miroslav Grepl 3.12.1-83Miroslav Grepl 3.12.1-82Miroslav Grepl 3.12.1-81Miroslav Grepl 3.12.1-80Miroslav Grepl 3.12.1-79Miroslav Grepl 3.12.1-78Miroslav Grepl 3.12.1-77Miroslav Grepl 3.12.1-76Miroslav Grepl 3.12.1-75Miroslav Grepl 3.12.1-74Miroslav Grepl 3.12.1-73Miroslav Grepl 3.12.1-72Miroslav Grepl 3.12.1-71Miroslav Grepl 3.12.1-70Miroslav Grepl 3.12.1-69Miroslav Grepl 3.12.1-68Miroslav Grepl 3.12.1-67Miroslav Grepl 3.12.1-66Miroslav Grepl 3.12.1-65Miroslav Grepl 3.12.1-64Miroslav Grepl 3.12.1-63Miroslav Grepl 3.12.1-62Miroslav Grepl 3.12.1-61Miroslav Grepl 3.12.1-60Miroslav Grepl 3.12.1-59Miroslav Grepl 3.12.1-58Miroslav Grepl 3.12.1-57Miroslav Grepl 3.12.1-56Miroslav Grepl 3.12.1-55Miroslav Grepl 3.12.1-54Miroslav Grepl 3.12.1-53Miroslav Grepl 3.12.1-52Miroslav Grepl 3.12.1-51Miroslav Grepl 3.12.1-50Miroslav Grepl 3.12.1-49Miroslav Grepl 3.12.1-48Miroslav Grepl 3.12.1-47Miroslav Grepl 3.12.1-46Miroslav Grepl 3.12.1-45Miroslav Grepl 3.12.1-44Miroslav Grepl 3.12.1-43Miroslav Grepl 3.12.1-42Miroslav Grepl 3.12.1-41Miroslav Grepl 3.12.1-40Miroslav Grepl 3.12.1-39Miroslav Grepl 3.12.1-38Miroslav Grepl 3.12.1-37Miroslav Grepl 3.12.1-36Miroslav Grepl 3.12.1-35Miroslav Grepl 3.12.1-34Miroslav Grepl 3.12.1-33Miroslav Grepl 3.12.1-32Miroslav Grepl 3.12.1-31Miroslav Grepl 3.12.1-30Miroslav Grepl 3.12.1-29Dan Walsh 3.12.1-28Dan Walsh 3.12.1-27Miroslav Grepl 3.12.1-26Miroslav Grepl 3.12.1-25Miroslav Grepl 3.12.1-24Miroslav Grepl 3.12.1-23Miroslav Grepl 3.12.1-22Miroslav Grepl 3.12.1-21Miroslav Grepl 3.12.1-20Miroslav Grepl 3.12.1-19Miroslav Grepl 3.12.1-18Miroslav Grepl 3.12.1-17Miroslav Grepl 3.12.1-16Miroslav Grepl 3.12.1-15Miroslav Grepl 3.12.1-14Miroslav Grepl 3.12.1-13Miroslav Grepl 3.12.1-12Miroslav Grepl 3.12.1-11Miroslav Grepl 3.12.1-10Miroslav Grepl 3.12.1-9Miroslav Grepl 3.12.1-8Miroslav Grepl 3.12.1-7Miroslav Grepl 3.12.1-6Miroslav Grepl 3.12.1-5Miroslav Grepl 3.12.1-4Miroslav Grepl 3.12.1-3Miroslav Grepl 3.12.1-2Miroslav Grepl 3.12.1-1Dan Walsh 3.11.1-69.1Miroslav Grepl 3.11.1-69Miroslav Grepl 3.11.1-68Miroslav Grepl 3.11.1-67Miroslav Grepl 3.11.1-66Miroslav Grepl 3.11.1-65Miroslav Grepl 3.11.1-64Miroslav Grepl 3.11.1-63Miroslav Grepl 3.11.1-62Miroslav Grepl 3.11.1-61Miroslav Grepl 3.11.1-60Miroslav Grepl 3.11.1-59Miroslav Grepl 3.11.1-58Miroslav Grepl 3.11.1-57Miroslav Grepl 3.11.1-56Miroslav Grepl 3.11.1-55Miroslav Grepl 3.11.1-54Miroslav Grepl 3.11.1-53Miroslav Grepl 3.11.1-52Miroslav Grepl 3.11.1-51Miroslav Grepl 3.11.1-50Miroslav Grepl 3.11.1-49Miroslav Grepl 3.11.1-48Miroslav Grepl 3.11.1-47Miroslav Grepl 3.11.1-46Miroslav Grepl 3.11.1-45Miroslav Grepl 3.11.1-44Miroslav Grepl 3.11.1-43Miroslav Grepl 3.11.1-42Miroslav Grepl 3.11.1-41Miroslav Grepl 3.11.1-40Miroslav Grepl 3.11.1-39Miroslav Grepl 3.11.1-38Miroslav Grepl 3.11.1-37Miroslav Grepl 3.11.1-36Miroslav Grepl 3.11.1-35Miroslav Grepl 3.11.1-34Miroslav Grepl 3.11.1-33Miroslav Grepl 3.11.1-32Miroslav Grepl 3.11.1-31Miroslav Grepl 3.11.1-30Miroslav Grepl 3.11.1-29Miroslav Grepl 3.11.1-28Miroslav Grepl 3.11.1-27Miroslav Grepl 3.11.1-26Miroslav Grepl 3.11.1-25Miroslav Grepl 3.11.1-24Miroslav Grepl 3.11.1-23Miroslav Grepl 3.11.1-22Miroslav Grepl 3.11.1-21Miroslav Grepl 3.11.1-20Miroslav Grepl 3.11.1-19Miroslav Grepl 3.11.1-18Miroslav Grepl 3.11.1-17Miroslav Grepl 3.11.1-16Dan Walsh 3.11.1-15Miroslav Grepl 3.11.1-14Dan Walsh 3.11.1-13Miroslav Grepl 3.11.1-12Miroslav Grepl 3.11.1-11Miroslav Grepl 3.11.1-10Dan Walsh 3.11.1-9Dan Walsh 3.11.1-8Dan Walsh 3.11.1-7Dan Walsh 3.11.1-6Miroslav Grepl 3.11.1-5Miroslav Grepl 3.11.1-4Miroslav Grepl 3.11.1-3Miroslav Grepl 3.11.1-2Miroslav Grepl 3.11.1-1Miroslav Grepl 3.11.1-0Miroslav Grepl 3.11.0-15Miroslav Grepl 3.11.0-14Miroslav Grepl 3.11.0-13Miroslav Grepl 3.11.0-12Fedora Release Engineering - 3.11.0-11Miroslav Grepl 3.11.0-10Miroslav Grepl 3.11.0-9Miroslav Grepl 3.11.0-8Miroslav Grepl 3.11.0-7Miroslav Grepl 3.11.0-6Miroslav Grepl 3.11.0-5Miroslav Grepl 3.11.0-4Miroslav Grepl 3.11.0-3Miroslav Grepl 3.11.0-2Miroslav Grepl 3.11.0-1Miroslav Grepl 3.10.0-128Miroslav Grepl 3.10.0-127Miroslav Grepl 3.10.0-126Miroslav Grepl 3.10.0-125Miroslav Grepl 3.10.0-124Miroslav Grepl 3.10.0-123Miroslav Grepl 3.10.0-122Miroslav Grepl 3.10.0-121Miroslav Grepl 3.10.0-120Miroslav Grepl 3.10.0-119Miroslav Grepl 3.10.0-118Miroslav Grepl 3.10.0-117Miroslav Grepl 3.10.0-116Miroslav Grepl 3.10.0-115Miroslav Grepl 3.10.0-114Miroslav Grepl 3.10.0-113Miroslav Grepl 3.10.0-112Miroslav Grepl 3.10.0-111Miroslav Grepl 3.10.0-110Miroslav Grepl 3.10.0-109Miroslav Grepl 3.10.0-108Miroslav Grepl 3.10.0-107Miroslav Grepl 3.10.0-106Miroslav Grepl 3.10.0-105Miroslav Grepl 3.10.0-104Miroslav Grepl 3.10.0-103Miroslav Grepl 3.10.0-102Miroslav Grepl 3.10.0-101Miroslav Grepl 3.10.0-100Miroslav Grepl 3.10.0-99Miroslav Grepl 3.10.0-98Miroslav Grepl 3.10.0-97Miroslav Grepl 3.10.0-96Miroslav Grepl 3.10.0-95Miroslav Grepl 3.10.0-94Miroslav Grepl 3.10.0-93Miroslav Grepl 3.10.0-92Miroslav Grepl 3.10.0-91Miroslav Grepl 3.10.0-90Miroslav Grepl 3.10.0-89Miroslav Grepl 3.10.0-88Miroslav Grepl 3.10.0-87Miroslav Grepl 3.10.0-86Miroslav Grepl 3.10.0-85Miroslav Grepl 3.10.0-84Miroslav Grepl 3.10.0-83Miroslav Grepl 3.10.0-82Dan Walsh 3.10.0-81.2Miroslav Grepl 3.10.0-81Miroslav Grepl 3.10.0-80Miroslav Grepl 3.10.0-79Miroslav Grepl 3.10.0-78Miroslav Grepl 3.10.0-77Miroslav Grepl 3.10.0-76Miroslav Grepl 3.10.0-75Dan Walsh 3.10.0-74.2Miroslav Grepl 3.10.0-74Miroslav Grepl 3.10.0-73Miroslav Grepl 3.10.0-72Miroslav Grepl 3.10.0-71Miroslav Grepl 3.10.0-70Miroslav Grepl 3.10.0-69Miroslav Grepl 3.10.0-68Miroslav Grepl 3.10.0-67Miroslav Grepl 3.10.0-66Miroslav Grepl 3.10.0-65Miroslav Grepl 3.10.0-64Miroslav Grepl 3.10.0-63Miroslav Grepl 3.10.0-59Miroslav Grepl 3.10.0-58Dan Walsh 3.10.0-57Dan Walsh 3.10.0-56Dan Walsh 3.10.0-55.2Dan Walsh 3.10.0-55.1Miroslav Grepl 3.10.0-55Dan Walsh 3.10.0-54.1Miroslav Grepl 3.10.0-54Dan Walsh 3.10.0-53.1Miroslav Grepl 3.10.0-53Miroslav Grepl 3.10.0-52Miroslav Grepl 3.10.0-51Dan Walsh 3.10.0-50.2Dan Walsh 3.10.0-50.1Miroslav Grepl 3.10.0-50Miroslav Grepl 3.10.0-49Miroslav Grepl 3.10.0-48Miroslav Grepl 3.10.0-47Dan Walsh 3.10.0-46.1Miroslav Grepl 3.10.0-46Dan Walsh 3.10.0-45.1Miroslav Grepl 3.10.0-45Miroslav Grepl 3.10.0-43Miroslav Grepl 3.10.0-42Miroslav Grepl 3.10.0-41Dan Walsh 3.10.0-40.2Miroslav Grepl 3.10.0-40Dan Walsh 3.10.0-39.3Dan Walsh 3.10.0-39.2Dan Walsh 3.10.0-39.1Miroslav Grepl 3.10.0-39Dan Walsh 3.10.0-38.1Miroslav Grepl 3.10.0-38Miroslav Grepl 3.10.0-37Dan Walsh 3.10.0-36.1Miroslav Grepl 3.10.0-36Dan Walsh 3.10.0-35Dan Walsh 3.10.0-34.7Dan Walsh 3.10.0-34.6Dan Walsh 3.10.0-34.4Miroslav Grepl 3.10.0-34.3Dan Walsh 3.10.0-34.2Dan Walsh 3.10.0-34.1Miroslav Grepl 3.10.0-34Miroslav Grepl 3.10.0-33Dan Walsh 3.10.0-31.1Miroslav Grepl 3.10.0-31Miroslav Grepl 3.10.0-29Miroslav Grepl 3.10.0-28Miroslav Grepl 3.10.0-27Miroslav Grepl 3.10.0-26Miroslav Grepl 3.10.0-25Miroslav Grepl 3.10.0-24Miroslav Grepl 3.10.0-23Miroslav Grepl 3.10.0-22Miroslav Grepl 3.10.0-21Dan Walsh 3.10.0-20Miroslav Grepl 3.10.0-19Miroslav Grepl 3.10.0-18Miroslav Grepl 3.10.0-17Miroslav Grepl 3.10.0-16Miroslav Grepl 3.10.0-14Miroslav Grepl 3.10.0-13Miroslav Grepl 3.10.0-12Miroslav Grepl 3.10.0-11Miroslav Grepl 3.10.0-10Miroslav Grepl 3.10.0-9Miroslav Grepl 3.10.0-8Miroslav Grepl 3.10.0-7Miroslav Grepl 3.10.0-6Miroslav Grepl 3.10.0-5Miroslav Grepl 3.10.0-4Miroslav Grepl 3.10.0-3Miroslav Grepl 3.10.0-2Miroslav Grepl 3.10.0-1Miroslav Grepl 3.9.16-30Dan Walsh 3.9.16-29.1Miroslav Grepl 3.9.16-29Dan Walsh 3.9.16-28.1Miroslav Grepl 3.9.16-27Miroslav Grepl 3.9.16-26Miroslav Grepl 3.9.16-25Miroslav Grepl 3.9.16-24Miroslav Grepl 3.9.16-23Miroslav Grepl 3.9.16-22Miroslav Grepl 3.9.16-21Miroslav Grepl 3.9.16-20Miroslav Grepl 3.9.16-19Miroslav Grepl 3.9.16-18Miroslav Grepl 3.9.16-17Dan Walsh 3.9.16-16.1Miroslav Grepl 3.9.16-16Miroslav Grepl 3.9.16-15Miroslav Grepl 3.9.16-14Miroslav Grepl 3.9.16-13Miroslav Grepl 3.9.16-12Miroslav Grepl 3.9.16-11Miroslav Grepl 3.9.16-10Miroslav Grepl 3.9.16-7Miroslav Grepl 3.9.16-6Miroslav Grepl 3.9.16-5Miroslav Grepl 3.9.16-4Miroslav Grepl 3.9.16-3Miroslav Grepl 3.9.16-2Miroslav Grepl 3.9.16-1Miroslav Grepl 3.9.15-5Miroslav Grepl 3.9.15-2Miroslav Grepl 3.9.15-1Fedora Release Engineering - 3.9.14-2Dan Walsh 3.9.14-1Miroslav Grepl 3.9.13-10Miroslav Grepl 3.9.13-9Dan Walsh 3.9.13-8Miroslav Grepl 3.9.13-7Miroslav Grepl 3.9.13-6Miroslav Grepl 3.9.13-5Miroslav Grepl 3.9.13-4Miroslav Grepl 3.9.13-3Miroslav Grepl 3.9.13-2Miroslav Grepl 3.9.13-1Miroslav Grepl 3.9.12-8Miroslav Grepl 3.9.12-7Miroslav Grepl 3.9.12-6Miroslav Grepl 3.9.12-5Dan Walsh 3.9.12-4Dan Walsh 3.9.12-3Dan Walsh 3.9.12-2Miroslav Grepl 3.9.12-1Dan Walsh 3.9.11-2Miroslav Grepl 3.9.11-1Miroslav Grepl 3.9.10-13Dan Walsh 3.9.10-12Miroslav Grepl 3.9.10-11Miroslav Grepl 3.9.10-10Miroslav Grepl 3.9.10-9Miroslav Grepl 3.9.10-8Miroslav Grepl 3.9.10-7Miroslav Grepl 3.9.10-6Miroslav Grepl 3.9.10-5Dan Walsh 3.9.10-4Miroslav Grepl 3.9.10-3Miroslav Grepl 3.9.10-2Miroslav Grepl 3.9.10-1Miroslav Grepl 3.9.9-4Dan Walsh 3.9.9-3Miroslav Grepl 3.9.9-2Miroslav Grepl 3.9.9-1Miroslav Grepl 3.9.8-7Dan Walsh 3.9.8-6Miroslav Grepl 3.9.8-5Miroslav Grepl 3.9.8-4Dan Walsh 3.9.8-3Dan Walsh 3.9.8-2Dan Walsh 3.9.8-1Dan Walsh 3.9.7-10Dan Walsh 3.9.7-9Dan Walsh 3.9.7-8Dan Walsh 3.9.7-7Dan Walsh 3.9.7-6Dan Walsh 3.9.7-5Dan Walsh 3.9.7-4Dan Walsh 3.9.7-3Dan Walsh 3.9.7-2Dan Walsh 3.9.7-1Dan Walsh 3.9.6-3Dan Walsh 3.9.6-2Dan Walsh 3.9.6-1Dan Walsh 3.9.5-11Dan Walsh 3.9.5-10Dan Walsh 3.9.5-9Dan Walsh 3.9.5-8Dan Walsh 3.9.5-7Dan Walsh 3.9.5-6Dan Walsh 3.9.5-5Dan Walsh 3.9.5-4Dan Walsh 3.9.5-3Dan Walsh 3.9.5-2Dan Walsh 3.9.5-1Dan Walsh 3.9.4-3Dan Walsh 3.9.4-2Dan Walsh 3.9.4-1Dan Walsh 3.9.3-4Dan Walsh 3.9.3-3Dan Walsh 3.9.3-2Dan Walsh 3.9.3-1Dan Walsh 3.9.2-1Dan Walsh 3.9.1-3Dan Walsh 3.9.1-2Dan Walsh 3.9.1-1Dan Walsh 3.9.0-2Dan Walsh 3.9.0-1Dan Walsh 3.8.8-21Dan Walsh 3.8.8-20Dan Walsh 3.8.8-19Dan Walsh 3.8.8-18Dan Walsh 3.8.8-17Dan Walsh 3.8.8-16Dan Walsh 3.8.8-15Dan Walsh 3.8.8-14Dan Walsh 3.8.8-13Dan Walsh 3.8.8-12Dan Walsh 3.8.8-11Dan Walsh 3.8.8-10Dan Walsh 3.8.8-9Dan Walsh 3.8.8-8Dan Walsh 3.8.8-7Dan Walsh 3.8.8-6Dan Walsh 3.8.8-5Dan Walsh 3.8.8-4Dan Walsh 3.8.8-3Dan Walsh 3.8.8-2Dan Walsh 3.8.8-1Dan Walsh 3.8.7-3Dan Walsh 3.8.7-2Dan Walsh 3.8.7-1Dan Walsh 3.8.6-3Miroslav Grepl 3.8.6-2Dan Walsh 3.8.6-1Dan Walsh 3.8.5-1Dan Walsh 3.8.4-1Dan Walsh 3.8.3-4Dan Walsh 3.8.3-3Dan Walsh 3.8.3-2Dan Walsh 3.8.3-1Dan Walsh 3.8.2-1Dan Walsh 3.8.1-5Dan Walsh 3.8.1-4Dan Walsh 3.8.1-3Dan Walsh 3.8.1-2Dan Walsh 3.8.1-1Dan Walsh 3.7.19-22Dan Walsh 3.7.19-21Dan Walsh 3.7.19-20Dan Walsh 3.7.19-19Dan Walsh 3.7.19-17Dan Walsh 3.7.19-16Dan Walsh 3.7.19-15Dan Walsh 3.7.19-14Dan Walsh 3.7.19-13Dan Walsh 3.7.19-12Dan Walsh 3.7.19-11Dan Walsh 3.7.19-10Dan Walsh 3.7.19-9Dan Walsh 3.7.19-8Dan Walsh 3.7.19-7Dan Walsh 3.7.19-6Dan Walsh 3.7.19-5Dan Walsh 3.7.19-4Dan Walsh 3.7.19-3Dan Walsh 3.7.19-2Dan Walsh 3.7.19-1Dan Walsh 3.7.18-3Dan Walsh 3.7.18-2Dan Walsh 3.7.18-1Dan Walsh 3.7.17-6Dan Walsh 3.7.17-5Dan Walsh 3.7.17-4Dan Walsh 3.7.17-3Dan Walsh 3.7.17-2Dan Walsh 3.7.17-1Dan Walsh 3.7.16-2Dan Walsh 3.7.16-1Dan Walsh 3.7.15-4Dan Walsh 3.7.15-3Dan Walsh 3.7.15-2Dan Walsh 3.7.15-1Dan Walsh 3.7.14-5Dan Walsh 3.7.14-4Dan Walsh 3.7.14-3Dan Walsh 3.7.14-2Dan Walsh 3.7.14-1Dan Walsh 3.7.13-4Dan Walsh 3.7.13-3Dan Walsh 3.7.13-2Dan Walsh 3.7.13-1Dan Walsh 3.7.12-1Dan Walsh 3.7.11-1Dan Walsh 3.7.10-5Dan Walsh 3.7.10-4Dan Walsh 3.7.10-3Dan Walsh 3.7.10-2Dan Walsh 3.7.10-1Dan Walsh 3.7.9-4Dan Walsh 3.7.9-3Dan Walsh 3.7.9-2Dan Walsh 3.7.9-1Dan Walsh 3.7.8-11Dan Walsh 3.7.8-9Dan Walsh 3.7.8-8Dan Walsh 3.7.8-7Dan Walsh 3.7.8-6Dan Walsh 3.7.8-5Dan Walsh 3.7.8-4Dan Walsh 3.7.8-3Dan Walsh 3.7.8-2Dan Walsh 3.7.8-1Dan Walsh 3.7.7-3Dan Walsh 3.7.7-2Dan Walsh 3.7.7-1Dan Walsh 3.7.6-1Dan Walsh 3.7.5-8Dan Walsh 3.7.5-7Dan Walsh 3.7.5-6Dan Walsh 3.7.5-5Dan Walsh 3.7.5-4Dan Walsh 3.7.5-3Dan Walsh 3.7.5-2Dan Walsh 3.7.5-1Dan Walsh 3.7.4-4Dan Walsh 3.7.4-3Dan Walsh 3.7.4-2Dan Walsh 3.7.4-1Dan Walsh 3.7.3-1Dan Walsh 3.7.1-1Dan Walsh 3.6.33-2Dan Walsh 3.6.33-1Dan Walsh 3.6.32-17Dan Walsh 3.6.32-16Dan Walsh 3.6.32-15Dan Walsh 3.6.32-13Dan Walsh 3.6.32-12Dan Walsh 3.6.32-11Dan Walsh 3.6.32-10Dan Walsh 3.6.32-9Dan Walsh 3.6.32-8Dan Walsh 3.6.32-7Dan Walsh 3.6.32-6Dan Walsh 3.6.32-5Dan Walsh 3.6.32-4Dan Walsh 3.6.32-3Dan Walsh 3.6.32-2Dan Walsh 3.6.32-1Dan Walsh 3.6.31-5Dan Walsh 3.6.31-4Dan Walsh 3.6.31-3Dan Walsh 3.6.31-2Dan Walsh 3.6.30-6Dan Walsh 3.6.30-5Dan Walsh 3.6.30-4Dan Walsh 3.6.30-3Dan Walsh 3.6.30-2Dan Walsh 3.6.30-1Dan Walsh 3.6.29-2Dan Walsh 3.6.29-1Dan Walsh 3.6.28-9Dan Walsh 3.6.28-8Dan Walsh 3.6.28-7Dan Walsh 3.6.28-6Dan Walsh 3.6.28-5Dan Walsh 3.6.28-4Dan Walsh 3.6.28-3Dan Walsh 3.6.28-2Dan Walsh 3.6.28-1Dan Walsh 3.6.27-1Dan Walsh 3.6.26-11Dan Walsh 3.6.26-10Dan Walsh 3.6.26-9Bill Nottingham 3.6.26-8Dan Walsh 3.6.26-7Dan Walsh 3.6.26-6Dan Walsh 3.6.26-5Dan Walsh 3.6.26-4Dan Walsh 3.6.26-3Dan Walsh 3.6.26-2Dan Walsh 3.6.26-1Dan Walsh 3.6.25-1Dan Walsh 3.6.24-1Dan Walsh 3.6.23-2Dan Walsh 3.6.23-1Dan Walsh 3.6.22-3Dan Walsh 3.6.22-1Dan Walsh 3.6.21-4Dan Walsh 3.6.21-3Tom "spot" Callaway 3.6.21-2Dan Walsh 3.6.21-1Dan Walsh 3.6.20-2Dan Walsh 3.6.20-1Dan Walsh 3.6.19-5Dan Walsh 3.6.19-4Dan Walsh 3.6.19-3Dan Walsh 3.6.19-2Dan Walsh 3.6.19-1Dan Walsh 3.6.18-1Dan Walsh 3.6.17-1Dan Walsh 3.6.16-4Dan Walsh 3.6.16-3Dan Walsh 3.6.16-2Dan Walsh 3.6.16-1Dan Walsh 3.6.14-3Dan Walsh 3.6.14-2Dan Walsh 3.6.14-1Dan Walsh 3.6.13-3Dan Walsh 3.6.13-2Dan Walsh 3.6.13-1Dan Walsh 3.6.12-39Dan Walsh 3.6.12-38Dan Walsh 3.6.12-37Dan Walsh 3.6.12-36Dan Walsh 3.6.12-35Dan Walsh 3.6.12-34Dan Walsh 3.6.12-33Dan Walsh 3.6.12-31Dan Walsh 3.6.12-30Dan Walsh 3.6.12-29Dan Walsh 3.6.12-28Dan Walsh 3.6.12-27Dan Walsh 3.6.12-26Dan Walsh 3.6.12-25Dan Walsh 3.6.12-24Dan Walsh 3.6.12-23Dan Walsh 3.6.12-22Dan Walsh 3.6.12-21Dan Walsh 3.6.12-20Dan Walsh 3.6.12-19Dan Walsh 3.6.12-16Dan Walsh 3.6.12-15Dan Walsh 3.6.12-14Dan Walsh 3.6.12-13Dan Walsh 3.6.12-12Dan Walsh 3.6.12-11Dan Walsh 3.6.12-10Dan Walsh 3.6.12-9Dan Walsh 3.6.12-8Dan Walsh 3.6.12-7Dan Walsh 3.6.12-6Dan Walsh 3.6.12-5Dan Walsh 3.6.12-4Dan Walsh 3.6.12-3Dan Walsh 3.6.12-2Dan Walsh 3.6.12-1Dan Walsh 3.6.11-1Dan Walsh 3.6.10-9Dan Walsh 3.6.10-8Dan Walsh 3.6.10-7Dan Walsh 3.6.10-6Dan Walsh 3.6.10-5Dan Walsh 3.6.10-4Dan Walsh 3.6.10-3Dan Walsh 3.6.10-2Dan Walsh 3.6.10-1Dan Walsh 3.6.9-4Dan Walsh 3.6.9-3Dan Walsh 3.6.9-2Dan Walsh 3.6.9-1Dan Walsh 3.6.8-4Dan Walsh 3.6.8-3Dan Walsh 3.6.8-2Dan Walsh 3.6.8-1Dan Walsh 3.6.7-2Dan Walsh 3.6.7-1Dan Walsh 3.6.6-9Dan Walsh 3.6.6-8Fedora Release Engineering - 3.6.6-7Dan Walsh 3.6.6-6Dan Walsh 3.6.6-5Dan Walsh 3.6.6-4Dan Walsh 3.6.6-3Dan Walsh 3.6.6-2Dan Walsh 3.6.6-1Dan Walsh 3.6.5-3Dan Walsh 3.6.5-1Dan Walsh 3.6.4-6Dan Walsh 3.6.4-5Dan Walsh 3.6.4-4Dan Walsh 3.6.4-3Dan Walsh 3.6.4-2Dan Walsh 3.6.4-1Dan Walsh 3.6.3-13Dan Walsh 3.6.3-12Dan Walsh 3.6.3-11Dan Walsh 3.6.3-10Dan Walsh 3.6.3-9Dan Walsh 3.6.3-8Dan Walsh 3.6.3-7Dan Walsh 3.6.3-6Dan Walsh 3.6.3-3Dan Walsh 3.6.3-2Dan Walsh 3.6.3-1Dan Walsh 3.6.2-5Dan Walsh 3.6.2-4Dan Walsh 3.6.2-3Dan Walsh 3.6.2-2Dan Walsh 3.6.2-1Dan Walsh 3.6.1-15Dan Walsh 3.6.1-14Dan Walsh 3.6.1-13Dan Walsh 3.6.1-12Dan Walsh 3.6.1-11Dan Walsh 3.6.1-10Dan Walsh 3.6.1-9Dan Walsh 3.6.1-8Dan Walsh 3.6.1-7Dan Walsh 3.6.1-4Ignacio Vazquez-Abrams - 3.6.1-2Dan Walsh 3.5.13-19Dan Walsh 3.5.13-18Dan Walsh 3.5.13-17Dan Walsh 3.5.13-16Dan Walsh 3.5.13-15Dan Walsh 3.5.13-14Dan Walsh 3.5.13-13Dan Walsh 3.5.13-12Dan Walsh 3.5.13-11Dan Walsh 3.5.13-9Dan Walsh 3.5.13-8Dan Walsh 3.5.13-7Dan Walsh 3.5.13-6Dan Walsh 3.5.13-5Dan Walsh 3.5.13-4Dan Walsh 3.5.13-3Dan Walsh 3.5.13-2Dan Walsh 3.5.13-1Dan Walsh 3.5.12-3Dan Walsh 3.5.12-2Dan Walsh 3.5.12-1Dan Walsh 3.5.11-1Dan Walsh 3.5.10-3Dan Walsh 3.5.10-2Dan Walsh 3.5.10-1Dan Walsh 3.5.9-4Dan Walsh 3.5.9-3Dan Walsh 3.5.9-2Dan Walsh 3.5.9-1Dan Walsh 3.5.8-7Dan Walsh 3.5.8-6Dan Walsh 3.5.8-5Dan Walsh 3.5.8-4Dan Walsh 3.5.8-3Dan Walsh 3.5.8-1Dan Walsh 3.5.7-2Dan Walsh 3.5.7-1Dan Walsh 3.5.6-2Dan Walsh 3.5.6-1Dan Walsh 3.5.5-4Dan Walsh 3.5.5-3Dan Walsh 3.5.5-2Dan Walsh 3.5.4-2Dan Walsh 3.5.4-1Dan Walsh 3.5.3-1Dan Walsh 3.5.2-2Dan Walsh 3.5.1-5Dan Walsh 3.5.1-4Dan Walsh 3.5.1-3Dan Walsh 3.5.1-2Dan Walsh 3.5.1-1Dan Walsh 3.5.0-1Dan Walsh 3.4.2-14Dan Walsh 3.4.2-13Dan Walsh 3.4.2-12Dan Walsh 3.4.2-11Dan Walsh 3.4.2-10Dan Walsh 3.4.2-9Dan Walsh 3.4.2-8Dan Walsh 3.4.2-7Dan Walsh 3.4.2-6Dan Walsh 3.4.2-5Dan Walsh 3.4.2-4Dan Walsh 3.4.2-3Dan Walsh 3.4.2-2Dan Walsh 3.4.2-1Dan Walsh 3.4.1-5Dan Walsh 3.4.1-3Dan Walsh 3.4.1-2Dan Walsh 3.4.1-1Dan Walsh 3.3.1-48Dan Walsh 3.3.1-47Dan Walsh 3.3.1-46Dan Walsh 3.3.1-45Dan Walsh 3.3.1-44Dan Walsh 3.3.1-43Dan Walsh 3.3.1-42Dan Walsh 3.3.1-41Dan Walsh 3.3.1-39Dan Walsh 3.3.1-37Dan Walsh 3.3.1-36Dan Walsh 3.3.1-33Dan Walsh 3.3.1-32Dan Walsh 3.3.1-31Dan Walsh 3.3.1-30Dan Walsh 3.3.1-29Dan Walsh 3.3.1-28Dan Walsh 3.3.1-27Dan Walsh 3.3.1-26Dan Walsh 3.3.1-25Dan Walsh 3.3.1-24Dan Walsh 3.3.1-23Dan Walsh 3.3.1-22Dan Walsh 3.3.1-21Dan Walsh 3.3.1-20Dan Walsh 3.3.1-19Dan Walsh 3.3.1-18Dan Walsh 3.3.1-17Dan Walsh 3.3.1-16Dan Walsh 3.3.1-15Bill Nottingham 3.3.1-14Dan Walsh 3.3.1-13Dan Walsh 3.3.1-12Dan Walsh 3.3.1-11Dan Walsh 3.3.1-10Dan Walsh 3.3.1-9Dan Walsh 3.3.1-8Dan Walsh 3.3.1-6Dan Walsh 3.3.1-5Dan Walsh 3.3.1-4Dan Walsh 3.3.1-2Dan Walsh 3.3.1-1Dan Walsh 3.3.0-2Dan Walsh 3.3.0-1Dan Walsh 3.2.9-2Dan Walsh 3.2.9-1Dan Walsh 3.2.8-2Dan Walsh 3.2.8-1Dan Walsh 3.2.7-6Dan Walsh 3.2.7-5Dan Walsh 3.2.7-3Dan Walsh 3.2.7-2Dan Walsh 3.2.7-1Dan Walsh 3.2.6-7Dan Walsh 3.2.6-6Dan Walsh 3.2.6-5Dan Walsh 3.2.6-4Dan Walsh 3.2.6-3Dan Walsh 3.2.6-2Dan Walsh 3.2.6-1Dan Walsh 3.2.5-25Dan Walsh 3.2.5-24Dan Walsh 3.2.5-22Dan Walsh 3.2.5-21Dan Walsh 3.2.5-20Dan Walsh 3.2.5-19Dan Walsh 3.2.5-18Dan Walsh 3.2.5-17Dan Walsh 3.2.5-16Dan Walsh 3.2.5-15Dan Walsh 3.2.5-14Dan Walsh 3.2.5-13Dan Walsh 3.2.5-12Dan Walsh 3.2.5-11Dan Walsh 3.2.5-10Dan Walsh 3.2.5-9Dan Walsh 3.2.5-8Dan Walsh 3.2.5-7Dan Walsh 3.2.5-6Dan Walsh 3.2.5-5Dan Walsh 3.2.5-4Dan Walsh 3.2.5-3Dan Walsh 3.2.5-2Dan Walsh 3.2.5-1Dan Walsh 3.2.4-5Dan Walsh 3.2.4-4Dan Walsh 3.2.4-3Dan Walsh 3.2.4-1Dan Walsh 3.2.4-1Dan Walsh 3.2.3-2Dan Walsh 3.2.3-1Dan Walsh 3.2.2-1Dan Walsh 3.2.1-3Dan Walsh 3.2.1-1Dan Walsh 3.1.2-2Dan Walsh 3.1.2-1Dan Walsh 3.1.1-1Dan Walsh 3.1.0-1Dan Walsh 3.0.8-30Dan Walsh 3.0.8-28Dan Walsh 3.0.8-27Dan Walsh 3.0.8-26Dan Walsh 3.0.8-25Dan Walsh 3.0.8-24Dan Walsh 3.0.8-23Dan Walsh 3.0.8-22Dan Walsh 3.0.8-21Dan Walsh 3.0.8-20Dan Walsh 3.0.8-19Dan Walsh 3.0.8-18Dan Walsh 3.0.8-17Dan Walsh 3.0.8-16Dan Walsh 3.0.8-15Dan Walsh 3.0.8-14Dan Walsh 3.0.8-13Dan Walsh 3.0.8-12Dan Walsh 3.0.8-11Dan Walsh 3.0.8-10Dan Walsh 3.0.8-9Dan Walsh 3.0.8-8Dan Walsh 3.0.8-7Dan Walsh 3.0.8-5Dan Walsh 3.0.8-4Dan Walsh 3.0.8-3Dan Walsh 3.0.8-2Dan Walsh 3.0.8-1Dan Walsh 3.0.7-10Dan Walsh 3.0.7-9Dan Walsh 3.0.7-8Dan Walsh 3.0.7-7Dan Walsh 3.0.7-6Dan Walsh 3.0.7-5Dan Walsh 3.0.7-4Dan Walsh 3.0.7-3Dan Walsh 3.0.7-2Dan Walsh 3.0.7-1Dan Walsh 3.0.6-3Dan Walsh 3.0.6-2Dan Walsh 3.0.6-1Dan Walsh 3.0.5-11Dan Walsh 3.0.5-10Dan Walsh 3.0.5-9Dan Walsh 3.0.5-8Dan Walsh 3.0.5-7Dan Walsh 3.0.5-6Dan Walsh 3.0.5-5Dan Walsh 3.0.5-4Dan Walsh 3.0.5-3Dan Walsh 3.0.5-2Dan Walsh 3.0.5-1Dan Walsh 3.0.4-6Dan Walsh 3.0.4-5Dan Walsh 3.0.4-4Dan Walsh 3.0.4-3Dan Walsh 3.0.4-2Dan Walsh 3.0.4-1Dan Walsh 3.0.3-6Dan Walsh 3.0.3-5Dan Walsh 3.0.3-4Dan Walsh 3.0.3-3Dan Walsh 3.0.3-2Dan Walsh 3.0.3-1Dan Walsh 3.0.2-9Dan Walsh 3.0.2-8Dan Walsh 3.0.2-7Dan Walsh 3.0.2-5Dan Walsh 3.0.2-4Dan Walsh 3.0.2-3Dan Walsh 3.0.2-2Dan Walsh 3.0.1-5Dan Walsh 3.0.1-4Dan Walsh 3.0.1-3Dan Walsh 3.0.1-2Dan Walsh 3.0.1-1Dan Walsh 2.6.5-3Dan Walsh 2.6.5-2Dan Walsh 2.6.4-7Dan Walsh 2.6.4-6Dan Walsh 2.6.4-5Dan Walsh 2.6.4-2Dan Walsh 2.6.4-1Dan Walsh 2.6.3-1Dan Walsh 2.6.2-1Dan Walsh 2.6.1-4Dan Walsh 2.6.1-2Dan Walsh 2.6.1-1Dan Walsh 2.5.12-12Dan Walsh 2.5.12-11Dan Walsh 2.5.12-10Dan Walsh 2.5.12-8Dan Walsh 2.5.12-5Dan Walsh 2.5.12-4Dan Walsh 2.5.12-3Dan Walsh 2.5.12-2Dan Walsh 2.5.12-1Dan Walsh 2.5.11-8Dan Walsh 2.5.11-7Dan Walsh 2.5.11-6Dan Walsh 2.5.11-5Dan Walsh 2.5.11-4Dan Walsh 2.5.11-3Dan Walsh 2.5.11-2Dan Walsh 2.5.11-1Dan Walsh 2.5.10-2Dan Walsh 2.5.10-1Dan Walsh 2.5.9-6Dan Walsh 2.5.9-5Dan Walsh 2.5.9-4Dan Walsh 2.5.9-3Dan Walsh 2.5.9-2Dan Walsh 2.5.8-8Dan Walsh 2.5.8-7Dan Walsh 2.5.8-6Dan Walsh 2.5.8-5Dan Walsh 2.5.8-4Dan Walsh 2.5.8-3Dan Walsh 2.5.8-2Dan Walsh 2.5.8-1Dan Walsh 2.5.7-1Dan Walsh 2.5.6-1Dan Walsh 2.5.5-2Dan Walsh 2.5.5-1Dan Walsh 2.5.4-2Dan Walsh 2.5.4-1Dan Walsh 2.5.3-3Dan Walsh 2.5.3-2Dan Walsh 2.5.3-1Dan Walsh 2.5.2-6Dan Walsh 2.5.2-5Dan Walsh 2.5.2-4Dan Walsh 2.5.2-3Dan Walsh 2.5.2-2Dan Walsh 2.5.2-1Dan Walsh 2.5.1-5Dan Walsh 2.5.1-4Dan Walsh 2.5.1-2Dan Walsh 2.5.1-1Dan Walsh 2.4.6-20Dan Walsh 2.4.6-19Dan Walsh 2.4.6-18Dan Walsh 2.4.6-17Dan Walsh 2.4.6-16Dan Walsh 2.4.6-15Dan Walsh 2.4.6-14Dan Walsh 2.4.6-13Dan Walsh 2.4.6-12Dan Walsh 2.4.6-11Dan Walsh 2.4.6-10Dan Walsh 2.4.6-9Dan Walsh 2.4.6-8Dan Walsh 2.4.6-7Dan Walsh 2.4.6-6Dan Walsh 2.4.6-5Dan Walsh 2.4.6-4Dan Walsh 2.4.6-3Dan Walsh 2.4.6-1Dan Walsh 2.4.5-4Dan Walsh 2.4.5-3Dan Walsh 2.4.5-2Dan Walsh 2.4.5-1Dan Walsh 2.4.4-2Dan Walsh 2.4.4-2Dan Walsh 2.4.4-1Dan Walsh 2.4.3-13Dan Walsh 2.4.3-12Dan Walsh 2.4.3-11Dan Walsh 2.4.3-10Dan Walsh 2.4.3-9Dan Walsh 2.4.3-8Dan Walsh 2.4.3-7Dan Walsh 2.4.3-6Dan Walsh 2.4.3-5Dan Walsh 2.4.3-4Dan Walsh 2.4.3-3Dan Walsh 2.4.3-2Dan Walsh 2.4.3-1Dan Walsh 2.4.2-8Dan Walsh 2.4.2-7James Antill 2.4.2-6Dan Walsh 2.4.2-5Dan Walsh 2.4.2-4Dan Walsh 2.4.2-3Dan Walsh 2.4.2-2Dan Walsh 2.4.2-1Dan Walsh 2.4.1-5Dan Walsh 2.4.1-4Dan Walsh 2.4.1-3Dan Walsh 2.4.1-2Dan Walsh 2.4-4Dan Walsh 2.4-3Dan Walsh 2.4-2Dan Walsh 2.4-1Dan Walsh 2.3.19-4Dan Walsh 2.3.19-3Dan Walsh 2.3.19-2Dan Walsh 2.3.19-1James Antill 2.3.18-10James Antill 2.3.18-9Dan Walsh 2.3.18-8Dan Walsh 2.3.18-7Dan Walsh 2.3.18-6Dan Walsh 2.3.18-5Dan Walsh 2.3.18-4Dan Walsh 2.3.18-3Dan Walsh 2.3.18-2Dan Walsh 2.3.18-1Dan Walsh 2.3.17-2Dan Walsh 2.3.17-1Dan Walsh 2.3.16-9Dan Walsh 2.3.16-8Dan Walsh 2.3.16-7Dan Walsh 2.3.16-6Dan Walsh 2.3.16-5Dan Walsh 2.3.16-4Dan Walsh 2.3.16-2Dan Walsh 2.3.16-1Dan Walsh 2.3.15-2Dan Walsh 2.3.15-1Dan Walsh 2.3.14-8Dan Walsh 2.3.14-7Dan Walsh 2.3.14-6Dan Walsh 2.3.14-4Dan Walsh 2.3.14-3Dan Walsh 2.3.14-2Dan Walsh 2.3.14-1Dan Walsh 2.3.13-6Dan Walsh 2.3.13-5Dan Walsh 2.3.13-4Dan Walsh 2.3.13-3Dan Walsh 2.3.13-2Dan Walsh 2.3.13-1Dan Walsh 2.3.12-2Dan Walsh 2.3.12-1Dan Walsh 2.3.11-1Dan Walsh 2.3.10-7Dan Walsh 2.3.10-6Dan Walsh 2.3.10-3Dan Walsh 2.3.10-1Dan Walsh 2.3.9-6Dan Walsh 2.3.9-5Dan Walsh 2.3.9-4Dan Walsh 2.3.9-3Dan Walsh 2.3.9-2Dan Walsh 2.3.9-1Dan Walsh 2.3.8-2Dan Walsh 2.3.7-1Dan Walsh 2.3.6-4Dan Walsh 2.3.6-3Dan Walsh 2.3.6-2Dan Walsh 2.3.6-1Dan Walsh 2.3.5-1Dan Walsh 2.3.4-1Dan Walsh 2.3.3-20Dan Walsh 2.3.3-19Dan Walsh 2.3.3-18Dan Walsh 2.3.3-17Dan Walsh 2.3.3-16Dan Walsh 2.3.3-15Dan Walsh 2.3.3-14Dan Walsh 2.3.3-13Dan Walsh 2.3.3-12Dan Walsh 2.3.3-11Dan Walsh 2.3.3-10Dan Walsh 2.3.3-9Dan Walsh 2.3.3-8Dan Walsh 2.3.3-7Dan Walsh 2.3.3-6Dan Walsh 2.3.3-5Dan Walsh 2.3.3-4Dan Walsh 2.3.3-3Dan Walsh 2.3.3-2Dan Walsh 2.3.3-1Dan Walsh 2.3.2-4Dan Walsh 2.3.2-3Dan Walsh 2.3.2-2Dan Walsh 2.3.2-1Dan Walsh 2.3.1-1Dan Walsh 2.2.49-1Dan Walsh 2.2.48-1Dan Walsh 2.2.47-5Dan Walsh 2.2.47-4Dan Walsh 2.2.47-3Dan Walsh 2.2.47-1Dan Walsh 2.2.46-2Dan Walsh 2.2.46-1Dan Walsh 2.2.45-3Dan Walsh 2.2.45-2Dan Walsh 2.2.45-1Dan Walsh 2.2.44-1Dan Walsh 2.2.43-4Dan Walsh 2.2.43-3Dan Walsh 2.2.43-2Dan Walsh 2.2.43-1Dan Walsh 2.2.42-4Dan Walsh 2.2.42-3Dan Walsh 2.2.42-2Dan Walsh 2.2.42-1Dan Walsh 2.2.41-1Dan Walsh 2.2.40-2Dan Walsh 2.2.40-1Dan Walsh 2.2.39-2Dan Walsh 2.2.39-1Dan Walsh 2.2.38-6Dan Walsh 2.2.38-5Dan Walsh 2.2.38-4Dan Walsh 2.2.38-3Dan Walsh 2.2.38-2Dan Walsh 2.2.38-1Dan Walsh 2.2.37-1Dan Walsh 2.2.36-2Dan Walsh 2.2.36-1James Antill 2.2.35-2Dan Walsh 2.2.35-1Dan Walsh 2.2.34-3Dan Walsh 2.2.34-2Dan Walsh 2.2.34-1Dan Walsh 2.2.33-1Dan Walsh 2.2.32-2Dan Walsh 2.2.32-1Dan Walsh 2.2.31-1Dan Walsh 2.2.30-2Dan Walsh 2.2.30-1Dan Walsh 2.2.29-6Russell Coker 2.2.29-5Dan Walsh 2.2.29-4Dan Walsh 2.2.29-3Dan Walsh 2.2.29-2Dan Walsh 2.2.29-1Dan Walsh 2.2.28-3Dan Walsh 2.2.28-2Dan Walsh 2.2.28-1Dan Walsh 2.2.27-1Dan Walsh 2.2.25-3Dan Walsh 2.2.25-2Dan Walsh 2.2.24-1Dan Walsh 2.2.23-19Dan Walsh 2.2.23-18Dan Walsh 2.2.23-17Karsten Hopp 2.2.23-16Dan Walsh 2.2.23-15Dan Walsh 2.2.23-14Dan Walsh 2.2.23-13Dan Walsh 2.2.23-12Jeremy Katz - 2.2.23-11Jeremy Katz - 2.2.23-10Dan Walsh 2.2.23-9Dan Walsh 2.2.23-8Dan Walsh 2.2.23-7Dan Walsh 2.2.23-5Dan Walsh 2.2.23-4Dan Walsh 2.2.23-3Dan Walsh 2.2.23-2Dan Walsh 2.2.23-1Dan Walsh 2.2.22-2Dan Walsh 2.2.22-1Dan Walsh 2.2.21-9Dan Walsh 2.2.21-8Dan Walsh 2.2.21-7Dan Walsh 2.2.21-6Dan Walsh 2.2.21-5Dan Walsh 2.2.21-4Dan Walsh 2.2.21-3Dan Walsh 2.2.21-2Dan Walsh 2.2.21-1Dan Walsh 2.2.20-1Dan Walsh 2.2.19-2Dan Walsh 2.2.19-1Dan Walsh 2.2.18-2Dan Walsh 2.2.18-1Dan Walsh 2.2.17-2Dan Walsh 2.2.16-1Dan Walsh 2.2.15-4Dan Walsh 2.2.15-3Dan Walsh 2.2.15-1Dan Walsh 2.2.14-2Dan Walsh 2.2.14-1Dan Walsh 2.2.13-1Dan Walsh 2.2.12-1Dan Walsh 2.2.11-2Dan Walsh 2.2.11-1Dan Walsh 2.2.10-1Dan Walsh 2.2.9-2Dan Walsh 2.2.9-1Dan Walsh 2.2.8-2Dan Walsh 2.2.7-1Dan Walsh 2.2.6-3Dan Walsh 2.2.6-2Dan Walsh 2.2.6-1Dan Walsh 2.2.5-1Dan Walsh 2.2.4-1Dan Walsh 2.2.3-1Dan Walsh 2.2.2-1Dan Walsh 2.2.1-1Dan Walsh 2.1.13-1Dan Walsh 2.1.12-3Dan Walsh 2.1.11-1Dan Walsh 2.1.10-1Jeremy Katz - 2.1.9-2Dan Walsh 2.1.9-1Dan Walsh 2.1.8-3Dan Walsh 2.1.8-2Dan Walsh 2.1.8-1Dan Walsh 2.1.7-4Dan Walsh 2.1.7-3Dan Walsh 2.1.7-2Dan Walsh 2.1.7-1Dan Walsh 2.1.6-24Dan Walsh 2.1.6-23Dan Walsh 2.1.6-22Dan Walsh 2.1.6-21Dan Walsh 2.1.6-20Dan Walsh 2.1.6-18Dan Walsh 2.1.6-17Dan Walsh 2.1.6-16Dan Walsh 2.1.6-15Dan Walsh 2.1.6-14Dan Walsh 2.1.6-13Dan Walsh 2.1.6-11Dan Walsh 2.1.6-10Dan Walsh 2.1.6-9Dan Walsh 2.1.6-8Dan Walsh 2.1.6-5Dan Walsh 2.1.6-4Dan Walsh 2.1.6-3Dan Walsh 2.1.6-2Dan Walsh 2.1.6-1Dan Walsh 2.1.4-2Dan Walsh 2.1.4-1Dan Walsh 2.1.3-1Jeremy Katz - 2.1.2-3Dan Walsh 2.1.2-2Dan Walsh 2.1.2-1Dan Walsh 2.1.1-3Dan Walsh 2.1.1-2Dan Walsh 2.1.1-1Dan Walsh 2.1.0-3Dan Walsh 2.1.0-2.Dan Walsh 2.1.0-1.Dan Walsh 2.0.11-2.Dan Walsh 2.0.11-1.Dan Walsh 2.0.9-1.Dan Walsh 2.0.8-1.Dan Walsh 2.0.7-3Dan Walsh 2.0.7-2Dan Walsh 2.0.6-2Dan Walsh 2.0.5-4Dan Walsh 2.0.5-1Dan Walsh 2.0.4-1Dan Walsh 2.0.2-2Dan Walsh 2.0.2-1Dan Walsh 2.0.1-2Dan Walsh 2.0.1-1- Allow logrotate to manage virt_cache_t type Resolves:#1159834- Back port OpenStack fixes - Allow mdadm to connect to own socket created by mdadm running as kernel_t Resolves:#1132828- Allow swift to execute bin_t - Allow swift to bind http_cache - Label /var/log/horizon as an apache log- Allow neutron to bind xserver port - Allow neutron to execute kmod in insmod_t - Allow neutron to execute udevadm in udev_t - Allow keepalived to execute bin_t/shell_exec_t - Allow neutron to create sock files - Label swift-proxy-server as swift_exec_t- Allow rsync to create swift_server.lock with swift.log labeling - Add labeling for swift lock files - Make neutron_t as unconfined domain- Add more fixes for OpenStack - Add fixes for geard - Make openwsman as unconfined_domain in RHEL7.0- Back port openstack fixes - svirt sandbox domains to read gear content in /run - Allow gear_t to manage openshift files- More rules for gears and openshift Resolves:#1092405- Bump release to rebuild as z-stream Resolves:#1092405- Add fixes for gear to just execute ifconfig - More fixes for mongod_t Resolves:#1092405- Bump release Resolves:#1092405- Allow mongod to create sock files Resolves:#1092405 - Add additional fixes related to docker and upgrade issues- Change hsperfdata_root to have as user_tmp_t Resolves:#1076523- Fix Multiple same specifications for /var/named/chroot/dev/zero - Add labels for /var/named/chroot_sdb/dev devices - Add support for strongimcv - Use kerberos_keytab_domains in auth_use_nsswitch - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to - Allow net_raw cap for neutron_t and send sigkill to dnsmasq - Fix ntp_filetrans_named_content for sntp-kod file - Add httpd_dbus_sssd boolean - Dontaudit exec insmod in boinc policy - Rename kerberos_keytab_domain to kerberos_keytab_domains - Add kerberos_keytab_domain() - Fix kerberos_keytab_template() - Make all domains which use kerberos as kerberos_keytab_domain Resolves:#1083670 - Allow kill capability to winbind_t- varnishd wants chown capability - update ntp_filetrans_named_content() interface - Add additional fixes for neutron_t. #1083335 - Dontaudit getattr on proc_kcore_t - Allow pki_tomcat_t to read ipa lib files - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign - Allow init_t run /sbin/augenrules - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces - Allow unpriv SELinux user to use sandbox - Add default label for /tmp/hsperfdata_root- Add file subs also for /var/home- Allow xauth_t to read user_home_dir_t lnk_file - Add labeling for lightdm-data - Allow certmonger to manage ipa lib files - Add support for /var/lib/ipa - Allow pegasus to getattr virt_content - Added some new rules to pcp policy - Allow chrome_sandbox to execute config_home_t - Add support for ABRT FAF- Allow kdm to send signull to remote_login_t process - Add gear policy - Turn on gear_port_t - Allow cgit to read gitosis lib files by default - Allow vdagent to read xdm state - Allow NM and fcoeadm to talk together over unix_dgram_socket- Back port fixes for pegasus_openlmi_admin_t from rawhide Resolves:#1080973 - Add labels for ostree - Add SELinux awareness for NM - Label /usr/sbin/pwhistory_helper as updpwd_exec_t- add gnome_append_home_config() - Allow thumb to append GNOME config home files - Allow rasdaemon to rw /dev/cpu//msr - fix /var/log/pki file spec - make bacula_t as auth_nsswitch domain - Identify pki_tomcat_cert_t as a cert_type - Define speech-dispater_exec_t as an application executable - Add a new file context for /var/named/chroot/run directory - update storage_filetrans_all_named_dev for sg* devices - Allow auditctl_t to getattr on all removeable devices - Allow nsswitch_domains to stream connect to nmbd - Allow unprivusers to connect to memcached - label /var/lib/dirsrv/scripts-INSTANCE as bin_t- Allow also unpriv user to run vmtools - Allow secadm to read /dev/urandom and meminfo Resolves:#1079250 - Add booleans to allow docker processes to use nfs and samba - Add mdadm_tmpfs support - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t - Allow vmware-user-sui to use user ttys - Allow talk 2 users logged via console too - Allow ftp services to manage xferlog_t - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies - allow anaconda to dbus chat with systemd-localed- allow anaconda to dbus chat with systemd-localed - Add fixes for haproxy based on bperkins@redhat.com - Allow cmirrord to make dmsetup working - Allow NM to execute arping - Allow users to send messages through talk - Add userdom_tmp_role for secadm_t- Add additional fixes for rtas_errd - Fix transitions for tmp/tmpfs in rtas.te - Allow rtas_errd to readl all sysctls- Add support for /var/spool/rhsm/debug - Make virt_sandbox_use_audit as True by default - Allow svirt_sandbox_domains to ptrace themselves- Allow docker containers to manage /var/lib/docker content- Allow docker to read tmpfs_t symlinks - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets- Allow collectd to talk to libvirt - Allow chrome_sandbox to use leaked unix_stream_sockets - Dontaudit leaks of sockets into chrome_sandbox_t - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t - Run vmtools as unconfined domains - Allow snort to manage its log files - Allow systemd_cronjob_t to be entered via bin_t - Allow procman to list doveconf_etc_t - allow keyring daemon to create content in tmpfs directories - Add proper labelling for icedtea-web - vpnc is creating content in networkmanager var run directory - Label sddm as xdm_exec_t to make KDE working again - Allow postgresql to read network state - Allow java running as pki_tomcat to read network sysctls - Fix cgroup.te to allow cgred to read cgconfig_etc_t - Allow beam.smp to use ephemeral ports - Allow winbind to use the nis to authenticate passwords- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least. - Allow net_admin cap for fence_virtd running as fenced_t - Make abrt-java-connector working - Make cimtest script 03_defineVS.py of ComputerSystem group working - Fix git_system_enable_homedirs boolean - Allow munin mail plugins to read network systcl- Allow vmtools_helper_t to execute bin_t - Add support for /usr/share/joomla - /var/lib/containers should be labeled as openshift content for now - Allow docker domains to talk to the login programs, to allow a process to login into the container - Allow install_t do dbus chat with NM - Fix interface names in anaconda.if - Add install_t for anaconda. A new type is a part of anaconda policy - sshd to read network sysctls- Allow zabbix to send system log msgs - Allow init_t to stream connect to ipsec Resolves:#1060775- Add docker_connect_any boolean- Allow unpriv SELinux users to dbus chat with firewalld - Add lvm_write_metadata() - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type - Allow pegasus_openlmi_storage_t to write lvm metadata - Add hide_broken_symptoms for kdumpgui because of systemd bug - Make kdumpgui_t as unconfined domain Resolves:#1044299 - Allow docker to connect to tcp/5000- Allow numad to write scan_sleep_millisecs - Turn on entropyd_use_audio boolean by default - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf. - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo - Fix label on irclogs in the homedir - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix - Allow postgresql to use ldap - Add missing syslog-conn port - Add support for /dev/vmcp and /dev/sclp Resolves:#1069310- Modify xdm_write_home to allow create files/links in /root with xdm_home_ - Allow virt domains to read network state Resolves:#1072019- Added pcp rules - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6 - clean up ctdb.te - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow certmonger to list home dirs- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask - Add sysnet_filetrans_named_content_ifconfig() interface - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow kerberos keytab domains to manage sssd/userdomain keys" - Allow to run ip cmd in neutron_t domain- Allow block_suspend cap2 for systemd-logind and rw dri device - Add labeling for /usr/libexec/nm-libreswan-service - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working - Add xserver_rw_xdm_keys() - Allow rpm_script_t to dbus chat also with systemd-located - Fix ipa_stream_connect_otpd() - update lpd_manage_spool() interface - Allow krb5kdc to stream connect to ipa-otpd - Add ipa_stream_connect_otpd() interface - Allow vpnc to unlink NM pids - Add networkmanager_delete_pid_files() - Allow munin plugins to access unconfined plugins - update abrt_filetrans_named_content to cover /var/spool/debug - Label /var/spool/debug as abrt_var_cache_t - Allow rhsmcertd to connect to squid port - Make docker_transition_unconfined as optional boolean - Allow certmonger to list home dirs- Make snapperd as unconfined domain and add additional fixes for it - Remove nsplugin.pp module on upgrade- Add snapperd_home_t for HOME_DIR/.snapshots directory - Make sosreport as unconfined domain - Allow sosreport to execute grub2-probe - Allow NM to manage hostname config file - Allow systemd_timedated_t to dbus chat with rpm_script_t - Allow lsmd plugins to connect to http/ssh/http_cache ports by default - Add lsmd_plugin_connect_any boolean - Allow mozilla_plugin to attempt to set capabilities - Allow lsdm_plugins to use tcp_socket - Dontaudit mozilla plugin from getattr on /proc or /sys - Dontaudit use of the keyring by the services in a sandbox - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t - Allow rabbitmq_beam to connect to jabber_interserver_port - Allow logwatch_mail_t to transition to qmail_inject and queueu - Added new rules to pcp policy - Allow vmtools_helper_t to change role to system_r - Allow NM to dbus chat with vmtools - Fix couchdb_manage_files() to allow manage couchdb conf files - Add support for /var/run/redis.sock - dontaudit gpg trying to use audit - Allow consolekit to create log directories and files - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow pkcsslotd to read users state - Add ioctl to init_dontaudit_rw_stream_socket - Add systemd_hostnamed_manage_config() interface - Remove transition for temp dirs created by init_t - gdm-simple-slave uses use setsockopt - sddm-greater is a xdm type program- Add lvm_read_metadata() - Allow auditadm to search /var/log/audit dir - Add lvm_read_metadata() interface - Allow confined users to run vmtools helpers - Fix userdom_common_user_template() - Generic systemd unit scripts do write check on / - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files - Add additional fixes needed for init_t and setup script running in generic unit files - Allow general users to create packet_sockets - added connlcli port - Add init_manage_transient_unit() interface - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t - Fix userdomain.te to require passwd class - devicekit_power sends out a signal to all processes on the message bus when power is going down - Dontaudit rendom domains listing /proc and hittping system_map_t - Dontauit leaks of var_t into ifconfig_t - Allow domains that transition to ssh_t to manipulate its keyring - Define oracleasm_t as a device node - Change to handle /root as a symbolic link for os-tree - Allow sysadm_t to create packet_socket, also move some rules to attributes - Add label for openvswitch port - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label. - Allow postfix_local to read .forward in pcp lib files - Allow pegasus_openlmi_storage_t to read lvm metadata - Add additional fixes for pegasus_openlmi_storage_t - Allow bumblebee to manage debugfs - Make bumblebee as unconfined domain - Allow snmp to read etc_aliases_t - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem - Allow pegasus_openlmi_storage_t to read /proc/1/environ - Dontaudit read gconf files for cupsd_config_t - make vmtools as unconfined domain - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig. - Allow collectd_t to use a mysql database - Allow ipa-otpd to perform DNS name resolution - Added new policy for keepalived - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd - Add additional fixes new pscs-lite+polkit support - Add labeling for /run/krb5kdc - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20 - Allow pcscd to read users proc info - Dontaudit smbd_t sending out random signuls - Add boolean to allow openshift domains to use nfs - Allow w3c_validator to create content in /tmp - zabbix_agent uses nsswitch - Allow procmail and dovecot to work together to deliver mail - Allow spamd to execute files in homedir if boolean turned on - Allow openvswitch to listen on port 6634 - Add net_admin capability in collectd policy - Fixed snapperd policy - Fixed bugsfor pcp policy - Allow dbus_system_domains to be started by init - Fixed some interfaces - Add kerberos_keytab_domain attribute - Fix snapperd_conf_t def- Addopt corenet rules for unbound-anchor to rpm_script_t - Allow runuser to send send audit messages. - Allow postfix-local to search .forward in munin lib dirs - Allow udisks to connect to D-Bus - Allow spamd to connect to spamd port - Fix syntax error in snapper.te - Dontaudit osad to search gconf home files - Allow rhsmcertd to manage /etc/sysconf/rhn director - Fix pcp labeling to accept /usr/bin for all daemon binaries - Fix mcelog_read_log() interface - Allow iscsid to manage iscsi lib files - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it. - Make tuned_t as unconfined domain for RHEL7.0 - Allow ABRT to read puppet certs - Add sys_time capability for virt-ga - Allow gemu-ga to domtrans to hwclock_t - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages - Fix some AVCs in pcp policy - Add to bacula capability setgid and setuid and allow to bind to bacula ports - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t - Add access rhnsd and osad to /etc/sysconfig/rhn - drbdadm executes drbdmeta - Fixes needed for docker - Allow epmd to manage /var/log/rabbitmq/startup_err file - Allow beam.smp connect to amqp port - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t - Allow systemd_tmpfiles_t to manage all non security files on the system - Added labels for bacula ports - Fix label on /dev/vfio/vfio - Add kernel_mounton_messages() interface - init wants to manage lock files for iscsi- Added osad policy - Allow postfix to deliver to procmail - Allow bumblebee to seng kill signal to xserver - Allow vmtools to execute /usr/bin/lsb_release - Allow docker to write system net ctrls - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix pcp.te - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl- Turn on bacula, rhnsd policy - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl - Fixes for *_admin interfaces - Add pegasus_openlmi_storage_var_run_t type def - Add support for /var/run/openlmi-storage - Allow tuned to create syslog.conf with correct labeling - Add httpd_dontaudit_search_dirs boolean - Add support for winbind.service - ALlow also fail2ban-client to read apache logs - Allow vmtools to getattr on all fs - Add support for dey_sapi port - Add logging_filetrans_named_conf() - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring- Update snapper policy - Allow domains to append rkhunter lib files - Allow snapperd to getattr on all fs - Allow xdm to create /var/gdm with correct labeling - Add label for snapper.log - Allow fail2ban-client to read apache log files - Allow thumb_t to execute dbus-daemon in thumb_t- Allow gdm to create /var/gdm with correct labeling - Allow domains to append rkhunterl lib files. #1057982 - Allow systemd_tmpfiles_t net_admin to communicate with journald - Add interface to getattr on an isid_type for any type of file - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory - Allow initrc_t domtrans to authconfig if unconfined is enabled - Allow docker and mount on devpts chr_file - Allow docker to transition to unconfined_t if boolean set - init calling needs to be optional in domain.te - Allow uncofined domain types to handle transient unit files - Fix labeling for vfio devices - Allow net_admin capability and send system log msgs - Allow lldpad send dgram to NM - Add networkmanager_dgram_send() - rkhunter_var_lib_t is correct type - Back port pcp policy from rawhide - Allow openlmi-storage to read removable devices - Allow system cron jobs to manage rkhunter lib files - Add rkhunter_manage_lib_files() - Fix ftpd_use_fusefs boolean to allow manage also symlinks - Allow smbcontrob block_suspend cap2 - Allow slpd to read network and system state info - Allow NM domtrans to iscsid_t if iscsiadm is executed - Allow slapd to send a signal itself - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA. - Fix plymouthd_create_log() interface - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container - Allow postfix and cyrus-imapd to work out of box - Allow fcoemon to talk with unpriv user domain using unix_stream_socket - Dontaudit domains that are calling into journald to net_admin - Add rules to allow vmtools to do what it does - snapperd is D-Bus service - Allow OpenLMI PowerManagement to call 'systemctl --force reboot' - Add haproxy_connect_any boolean - Allow haproxy also to use http cache port by default Resolves:#1058248- Allow apache to write to the owncloud data directory in /var/www/html... - Allow consolekit to create log dir - Add support for icinga CGI scripts - Add support for icinga - Allow kdumpctl_t to create kdump lock file Resolves:#1055634 - Allow kdump to create lnk lock file - Allow nscd_t block_suspen capability - Allow unconfined domain types to manage own transient unit file - Allow systemd domains to handle transient init unit files - Add interfaces to handle transient- Add cron unconfined role support for uncofined SELinux user - Call corenet_udp_bind_all_ports() in milter.te - Allow fence_virtd to connect to zented port - Fix header for mirrormanager_admin() - Allow dkim-milter to bind udp ports - Allow milter domains to send signull itself - Allow block_suspend for yum running as mock_t - Allow beam.smp to manage couchdb files - Add couchdb_manage_files() - Add labeling for /var/log/php_errors.log - Allow bumblebee to stream connect to xserver - Allow bumblebee to send a signal to xserver - gnome-thumbnail to stream connect to bumblebee - Allow xkbcomp running as bumblebee_t to execute bin_t - Allow logrotate to read squid.conf - Additional rules to get docker and lxc to play well with SELinux - Allow bumbleed to connect to xserver port - Allow pegasus_openlmi_storage_t to read hwdata- Allow init_t to work on transitient and snapshot unit files - Add logging_manage_syslog_config() - Update sysnet_dns_name_resolve() to allow connect to dnssec por - Allow pegasus_openlmi_storage_t to read hwdata Resolves:#1031721 - Fix rhcs_rw_cluster_tmpfs() - Allow fenced_t to bind on zented udp port - Added policy for vmtools - Fix mirrormanager_read_lib_files() - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files - Allow ctdb to create sock files in /var/run/ctdb - Add sblim_filetrans_named_content() interface - Allow rpm scritplets to create /run/gather with correct labeling - Allow gnome keyring domains to create gnome config dirs - Dontaudit read/write to init stream socket for lsmd_plugin_t - Allow automount to read nfs link files - Allow lsm plugins to read/write lsmd stream socket - Allow certmonger to connect ldap port to make IPA CA certificate renewal working. - Add also labeling for /var/run/ctdb - Add missing labeling for /var/lib/ctdb - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446 - Dontaudit hypervkvp to search homedirs - Dontaudit hypervkvp to search admin homedirs - Allow hypervkvp to execute bin_t and ifconfig in the caller domain - Dontaudit xguest_t to read ABRT conf files - Add abrt_dontaudit_read_config() - Allow namespace-init to getattr on fs - Add thumb_role() also for xguest - Add filename transitions to create .spamassassin with correct labeling - Allow apache domain to read mirrormanager pid files - Allow domains to read/write shm and sem owned by mozilla_plugin_t - Allow alsactl to send a generic signal to kernel_t- Add back rpm_run() for unconfined user- Add missing files_create_var_lib_dirs() - Fix typo in ipsec.te - Allow passwd to create directory in /var/lib - Add filename trans also for event21 - Allow iptables command to read /dev/rand - Add sigkill capabilityfor ipsec_t - Add filename transitions for bcache devices - Add additional rules to create /var/log/cron by syslogd_t with correct labeling - Add give everyone full access to all key rings - Add default lvm_var_run_t label for /var/run/multipathd - Fix log labeling to have correct default label for them after logrotate - Labeled ~/.nv/GLCache as being gstreamer output - Allow nagios_system_plugin to read mrtg lib files - Add mrtg_read_lib_files() - Call rhcs_rw_cluster_tmpfs for dlm_controld - Make authconfing as named_filetrans domain - Allow virsh to connect to user process using stream socket - Allow rtas_errd to read rand/urand devices and add chown capability - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp Resolves:#1051497 - Add also chown cap for abrt_upload_watch_t. It already has dac_override - Allow sosreport to manage rhsmcertd pid files - Add rhsmcertd_manage_pid_files() - Allow also setgid cap for rpc.gssd - Dontaudit access check for abrt on cert_t - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind- Fix semanage import handling in spec file- Add default lvm_var_run_t label for /var/run/multipathd Resolves:#1051430 - Fix log labeling to have correct default label for them after logrotate - Add files_write_root_dirs - Add new openflow port label for 6653/tcp and 6633/tcp - Add xserver_manage_xkb_libs() - Label tcp/8891 as milter por - Allow gnome_manage_generic_cache_files also create cache_home_t files - Fix aide.log labeling - Fix log labeling to have correct default label for them after logrotate - Allow mysqld-safe write access on /root to make mysqld working - Allow sosreport domtrans to prelikn - Allow OpenvSwitch to connec to openflow ports - Allow NM send dgram to lldpad - Allow hyperv domains to execute shell - Allow lsmd plugins stream connect to lsmd/init - Allow sblim domains to create /run/gather with correct labeling - Allow httpd to read ldap certs - Allow cupsd to send dbus msgs to process with different MLS level - Allow bumblebee to stream connect to apmd - Allow bumblebee to run xkbcomp - Additional allow rules to get libvirt-lxc containers working with docker - Additional allow rules to get libvirt-lxc containers working with docker - Allow docker to getattr on itself - Additional rules needed for sandbox apps - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled - httpd should be able to send signal/signull to httpd_suexec_t - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.- Add neutron fixes- Allow sshd to write to all process levels in order to change passwd when running at a level - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range - Allow apcuspd_t to status and start the power unit file - Allow udev to manage kdump unit file - Added new interface modutils_dontaudit_exec_insmod - Allow cobbler to search dhcp_etc_t directory - systemd_systemctl needs sys_admin capability - Allow sytemd_tmpfiles_t to delete all directories - passwd to create gnome-keyring passwd socket - Add missing zabbix_var_lib_t type - Fix filename trans for zabbixsrv in zabbix.te - Allow fprintd_t to send syslog messages - Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port - Allow mozilla plugin to chat with policykit, needed for spice - Allow gssprozy to change user and gid, as well as read user keyrings - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly - Allow polipo to connect to http_cache_ports - Allow cron jobs to manage apache var lib content - Allow yppassword to manage the passwd_file_t - Allow showall_t to send itself signals - Allow cobbler to restart dhcpc, dnsmasq and bind services - Allow certmonger to manage home cert files - Add userdom filename trans for user mail domains - Allow apcuspd_t to status and start the power unit file - Allow cgroupdrulesengd to create content in cgoups directories - Allow smbd_t to signull cluster - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t - Add label for /var/spool/cron.aquota.user - Allow sandbox_x domains to use work with the mozilla plugin semaphore - Added new policy for speech-dispatcher - Added dontaudit rule for insmod_exec_t in rasdaemon policy - Updated rasdaemon policy - Allow system_mail_t to transition to postfix_postdrop_t - Clean up mirrormanager policy - Allow virt_domains to read cert files, needs backport to RHEL7 - Allow sssd to read systemd_login_var_run_t - Allow irc_t to execute shell and bin-t files: - Add new access for mythtv - Allow rsync_t to manage all non auth files - allow modemmanger to read /dev/urand - Allow sandbox apps to attempt to set and get capabilties- Add labeling for /var/lib/servicelog/servicelog.db-journal - Add support for freeipmi port - Add sysadm_u_default_contexts - Make new type to texlive files in homedir - Allow subscription-manager running as sosreport_t to manage rhsmcertd - Additional fixes for docker.te - Remove ability to do mount/sys_admin by default in virt_sandbox domains - New rules required to run docker images within libivrt - Add label for ~/.cvsignore - Change mirrormanager to be run by cron - Add mirrormanager policy - Fixed bumblebee_admin() and mip6d_admin() - Add log support for sensord - Fix typo in docker.te - Allow amanda to do backups over UDP - Allow bumblebee to read /etc/group and clean up bumblebee.te - type transitions with a filename not allowed inside conditionals - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7 - Make new type to texlive files in homedir- Allow freeipmi_ipmidetectd_t to use freeipmi port - Update freeipmi_domain_template() - Allow journalctl running as ABRT to read /run/log/journal - Allow NM to read dispatcher.d directory - Update freeipmi policy - Type transitions with a filename not allowed inside conditionals - Allow tor to bind to hplip port - Make new type to texlive files in homedir - Allow zabbix_agent to transition to dmidecode - Add rules for docker - Allow sosreport to send signull to unconfined_t - Add virt_noatsecure and virt_rlimitinh interfaces - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port - Add sysadm_u_default_contexts - Add logging_read_syslog_pid() - Fix userdom_manage_home_texlive() interface - Make new type to texlive files in homedir - Add filename transitions for /run and /lock links - Allow virtd to inherit rlimit information Resolves:#975358- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t Resolves:#1039879 - Add labeling for /usr/lib/systemd/system/mariadb.service - Allow hyperv_domain to read sysfs - Fix ldap_read_certs() interface to allow acess also link files - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt - Allow tuned to run modprobe - Allow portreserve to search /var/lib/sss dir - Add SELinux support for the teamd package contains team network device control daemon. - Dontaudit access check on /proc for bumblebee - Bumblebee wants to load nvidia modules - Fix rpm_named_filetrans_log_files and wine.te - Add conman policy for rawhide - DRM master and input event devices are used by the TakeDevice API - Clean up bumblebee policy - Update pegasus_openlmi_storage_t policy - Add freeipmi_stream_connect() interface - Allow logwatch read madm.conf to support RAID setup - Add raid_read_conf_files() interface - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling - add rpm_named_filetrans_log_files() interface - Allow dkim-milter to create files/dirs in /tmp - update freeipmi policy - Add policy for freeipmi services - Added rdisc_admin and rdisc_systemctl interfaces - opensm policy clean up - openwsman policy clean up - ninfod policy clean up - Added new policy for ninfod - Added new policy for openwsman - Added rdisc_admin and rdisc_systemctl interfaces - Fix kernel_dontaudit_access_check_proc() - Add support for /dev/uhid - Allow sulogin to get the attributes of initctl and sys_admin cap - Add kernel_dontaudit_access_check_proc() - Fix dev_rw_ipmi_dev() - Fix new interface in devices.if - DRM master and input event devices are used by the TakeDevice API - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev() - Added support for default conman port - Add interfaces for ipmi devices- Allow sosreport to send a signal to ABRT - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t - Label /usr/sbin/htcacheclean as httpd_exec_t Resolves:#1037529 - Added support for rdisc unit file - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs - Allow runuser running as logrotate connections to system DBUS - Label bcache devices as fixed_disk_device_t - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t- Add back setpgid/setsched for sosreport_t- Added fix for clout_init to transition to rpm_script_t (dwalsh@redhat.com)- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel. - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on - Add lsmd_plugin_t for lsm plugins - Allow dovecot-deliver to search mountpoints - Add labeling for /etc/mdadm.conf - Allow opelmi admin providers to dbus chat with init_t - Allow sblim domain to read /dev/urandom and /dev/random - Allow apmd to request the kernel load modules - Add glusterd_brick_t type - label mate-keyring-daemon with gkeyringd_exec_t - Add plymouthd_create_log() - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6 - Allow sssd to request the kernel loads modules - Allow gpg_agent to use ssh-add - Allow gpg_agent to use ssh-add - Dontaudit access check on /root for myslqd_safe_t - Allow ctdb to getattr on al filesystems - Allow abrt to stream connect to syslog - Allow dnsmasq to list dnsmasq.d directory - Watchdog opens the raw socket - Allow watchdog to read network state info - Dontaudit access check on lvm lock dir - Allow sosreport to send signull to setroubleshootd - Add setroubleshoot_signull() interface - Fix ldap_read_certs() interface - Allow sosreport all signal perms - Allow sosreport to run systemctl - Allow sosreport to dbus chat with rpm - Add glusterd_brick_t files type - Allow zabbix_agentd to read all domain state - Clean up rtas.if - Allow smoltclient to execute ldconfig - Allow sosreport to request the kernel to load a module - Fix userdom_confined_admin_template() - Add back exec_content boolean for secadm, logadm, auditadm - Fix files_filetrans_system_db_named_files() interface - Allow sulogin to getattr on /proc/kcore - Add filename transition also for servicelog.db-journal - Add files_dontaudit_access_check_root() - Add lvm_dontaudit_access_check_lock() interface- Allow watchdog to read /etc/passwd - Allow browser plugins to connect to bumblebee - New policy for bumblebee and freqset - Add new policy for mip6d daemon - Add new policy for opensm daemon - Allow condor domains to read/write condor_master udp_socket - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift - Add back file_pid_filetrans for /var/run/dlm_controld - Allow smbd_t to use inherited tmpfs content - Allow mcelog to use the /dev/cpu device - sosreport runs rpcinfo - sosreport runs subscription-manager - Allow staff_t to run frequency command - Allow systemd_tmpfiles to relabel log directories - Allow staff_t to read xserver_log file - Label hsperfdata_root as tmp_t- More sosreport fixes to make ABRT working- Fix files_dontaudit_unmount_all_mountpoints() - Add support for 2608-2609 tcp/udp ports - Should allow domains to lock the terminal device - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - We need to require passwd rootok - Fix zebra.fc - Fix dnsmasq_filetrans_named_content() interface - Allow all sandbox domains create content in svirt_home_t - Allow zebra domains also create zebra_tmp_t files in /tmp - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services. - Fix labeling on neutron and remove transition to iconfig_t - abrt needs to read mcelog log file - Fix labeling on dnsmasq content - Fix labeling on /etc/dnsmasq.d - Allow glusterd to relabel own lib files - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd - Allow ipc_lock for abrt to run journalctl- Fix config.tgz- Fix passenger_stream_connect interface - setroubleshoot_fixit wants to read network state - Allow procmail_t to connect to dovecot stream sockets - Allow cimprovagt service providers to read network states - Add labeling for /var/run/mariadb - pwauth uses lastlog() to update system's lastlog - Allow account provider to read login records - Add support for texlive2013 - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - Allow passwd_t to connect to gnome keyring to change password - Update mls config files to have cronjobs in the user domains - Remove access checks that systemd does not actually do- Add support for yubikey in homedir - Add support for upd/3052 port - Allow apcupsd to use PowerChute Network Shutdown - Allow lsmd to execute various lsmplugins - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too - Update gluster_export_all_rw boolean to allow relabel all base file types - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling- Add files_relabel_base_file_types() interface - Allow netlabel-config to read passwd - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr() - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling - Allow pegasus to domtrans to mount_t - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts - Add support for unconfined watchdog scripts - Allow watchdog to manage own log files- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory. - Label /etc/yum.repos.d as system_conf_t - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t - Allow dac_override for sysadm_screen_t - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file. - Allow netlabel-config to read meminfo - Add interface to allow docker to mounton file_t - Add new interface to exec unlabeled files - Allow lvm to use docker semaphores - Setup transitons for .xsessions-errors.old - Change labels of files in /var/lib/*/.ssh to transition properly - Allow staff_t and user_t to look at logs using journalctl - pluto wants to manage own log file - Allow pluto running as ipsec_t to create pluto.log - Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files. - Additional access for docker - Added more rules to sblim policy - Fix kdumpgui_run_bootloader boolean - Allow dspam to connect to lmtp port - Included sfcbd service into sblim policy - rhsmcertd wants to manaage /etc/pki/consumer dir - Add kdumpgui_run_bootloader boolean - Add support for /var/cache/watchdog - Remove virt_domain attribute for virt_qemu_ga_unconfined_t - Fixes for handling libvirt containes - Dontaudit attempts by mysql_safe to write content into / - Dontaudit attempts by system_mail to modify network config - Allow dspam to bind to lmtp ports - Add new policy to allow staff_t and user_t to look at logs using journalctl - Allow apache cgi scripts to list sysfs - Dontaudit attempts to write/delete user_tmp_t files - Allow all antivirus domains to manage also own log dirs - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Add missing permission checks for nscd- Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Add file transition rules for content created by f5link - Rename quantum_port information to neutron - Allow all antivirus domains to manage also own log dirs - Rename quantum_port information to neutron - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Allow sysadm_t to read login information - Allow systemd_tmpfiles to setattr on var_log_t directories - Udpdate Makefile to include systemd_contexts - Add systemd_contexts - Add fs_exec_hugetlbfs_files() interface - Add daemons_enable_cluster_mode boolean - Fix rsync_filetrans_named_content() - Add rhcs_read_cluster_pid_files() interface - Update rhcs.if with additional interfaces from RHEL6 - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t - Allow glusterd_t to mounton glusterd_tmp_t - Allow glusterd to unmout al filesystems - Allow xenstored to read virt config - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label - Allow mozilla_plugin_t to mmap hugepages as an executable- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp- Allow sshd_t to read openshift content, needs backport to RHEL6.5 - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t - Make sur kdump lock is created with correct label if kdumpctl is executed - gnome interface calls should always be made within an optional_block - Allow syslogd_t to connect to the syslog_tls port - Add labeling for /var/run/charon.ctl socket - Add kdump_filetrans_named_content() - Allo setpgid for fenced_t - Allow setpgid and r/w cluster tmpfs for fenced_t - gnome calls should always be within optional blocks - wicd.pid should be labeled as networkmanager_var_run_t - Allow sys_resource for lldpad- Add rtas policy- Allow mailserver_domains to manage and transition to mailman data - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands - Allow mailserver_domains to manage and transition to mailman data - Allow svirt_domains to read sysctl_net_t - Allow thumb_t to use tmpfs inherited from the user - Allow mozilla_plugin to bind to the vnc port if running with spice - Add new attribute to discover confined_admins and assign confined admin to it - Fix zabbix to handle attributes in interfaces - Fix zabbix to read system states for all zabbix domains - Fix piranha_domain_template() - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files. - Allow lldpad sys_rouserce cap due to #986870 - Allow dovecot-auth to read nologin - Allow openlmi-networking to read /proc/net/dev - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t - Add zabbix_domain attribute for zabbix domains to treat them together - Add labels for zabbix-poxy-* (#1018221) - Update openlmi-storage policy to reflect #1015067 - Back port piranha tmpfs fixes from RHEL6 - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop - Add postfix_rw_spool_maildrop_files interface - Call new userdom_admin_user_templat() also for sysadm_secadm.pp - Fix typo in userdom_admin_user_template() - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey - Add new attribute to discover confined_admins - Fix labeling for /etc/strongswan/ipsec.d - systemd_logind seems to pass fd to anyone who dbus communicates with it - Dontaudit leaked write descriptor to dmesg- Activate motion policy- Fix gnome_read_generic_data_home_files() - allow openshift_cgroup_t to read/write inherited openshift file types - Remove httpd_cobbler_content * from cobbler_admin interface - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container - Allow httpd_t to read also git sys content symlinks - Allow init_t to read gnome home data - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it. - Allow virsh to execute systemctl - Fix for nagios_services plugins - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - Fix hypervkvp.te - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Fix logging policy - Allow syslog to bind to tls ports - Update labeling for /dev/cdc-wdm - Allow to su_domain to read init states - Allow init_t to read gnome home data - Make sure if systemd_logind creates nologin file with the correct label - Clean up ipsec.te- Add auth_exec_chkpwd interface - Fix port definition for ctdb ports - Allow systemd domains to read /dev/urand - Dontaudit attempts for mozilla_plugin to append to /dev/random - Add label for /var/run/charon.* - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service - Fix for nagios_services plugins - Fix some bugs in zoneminder policy - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - glusterd binds to random unreserved ports - Additional allow rules found by testing glusterfs - apcupsd needs to send a message to all users on the system so needs to look them up - Fix the label on ~/.juniper_networks - Dontaudit attempts for mozilla_plugin to append to /dev/random - Allow polipo_daemon to connect to flash ports - Allow gssproxy_t to create replay caches - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type- init reload from systemd_localed_t - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd - Allow systemd_localed_t to ask systemd to reload the locale. - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory - Allow readahead to read /dev/urand - Fix lots of avcs about tuned - Any file names xenstored in /var/log should be treated as xenstored_var_log_t - Allow tuned to inderact with hugepages - Allow condor domains to list etc rw dirs- Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Add additional fixes forpegasus_openlmi_account_t - Allow mdadm to read /dev/urand - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it - Add label/rules for /etc/mdadm.conf - Allow pegasus_openlmi_storage_t to transition to fsadm_t - Fixes for interface definition problems - Dontaudit dovecot-deliver to gettatr on all fs dirs - Allow domains to search data_home_t directories - Allow cobblerd to connect to mysql - Allow mdadm to r/w kdump lock files - Add support for kdump lock files - Label zarafa-search as zarafa-indexer - Openshift cgroup wants to read /etc/passwd - Add new sandbox domains for kvm - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on - Fix labeling for /usr/lib/systemd/system/lvm2.* - Add labeling for /usr/lib/systemd/system/lvm2.* - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules - Add sshd_keygen_t policy for sshd-keygen - Fix alsa_home_filetrans interface name and definition - Allow chown for ssh_keygen_t - Add fs_dontaudit_getattr_all_dirs() - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys - Fix up patch to allow systemd to manage home content - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled - Allow getty to exec hostname to get info - Add systemd_home_t for ~/.local/share/systemd directory- Fix lxc labels in config.tgz- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper - Allow tuned to search all file system directories - Allow alsa_t to sys_nice, to get top performance for sound management - Add support for MySQL/PostgreSQL for amavis - Allow openvpn_t to manage openvpn_var_log_t files. - Allow dirsrv_t to create tmpfs_t directories - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label - Dontaudit leaked unix_stream_sockets into gnome keyring - Allow telepathy domains to inhibit pipes on telepathy domains - Allow cloud-init to domtrans to rpm - Allow abrt daemon to manage abrt-watch tmp files - Allow abrt-upload-watcher to search /var/spool directory - Allow nsswitch domains to manage own process key - Fix labeling for mgetty.* logs - Allow systemd to dbus chat with upower - Allow ipsec to send signull to itself - Allow setgid cap for ipsec_t - Match upstream labeling- Do not build sanbox pkg on MLS- wine_tmp is no longer needed - Allow setroubleshoot to look at /proc - Allow telepathy domains to dbus with systemd logind - Fix handling of fifo files of rpm - Allow mozilla_plugin to transition to itself - Allow certwatch to write to cert_t directories - New abrt application - Allow NetworkManager to set the kernel scheduler - Make wine_domain shared by all wine domains - Allow mdadm_t to read images labeled svirt_image_t - Allow amanda to read /dev/urand - ALlow my_print_default to read /dev/urand - Allow mdadm to write to kdumpctl fifo files - Allow nslcd to send signull to itself - Allow yppasswd to read /dev/urandom - Fix zarafa_setrlimit - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add additional alias for user_tmp_t because wine_tmp_t is no longer used - More handling of ther kernel keyring required by kerberos - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed- Dontaudit attempts by sosreport to read shadow_t - Allow browser sandbox plugins to connect to cups to print - Add new label mpd_home_t - Label /srv/www/logs as httpd_log_t - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add labels for apache logs under miq package - Allow irc_t to use tcp sockets - fix labels in puppet.if - Allow tcsd to read utmp file - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys - Define svirt_socket_t as a domain_type - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t - Fix label on pam_krb5 helper apps- Allow ldconfig to write to kdumpctl fifo files - allow neutron to connect to amqp ports - Allow kdump_manage_crash to list the kdump_crash_t directory - Allow glance-api to connect to amqp port - Allow virt_qemu_ga_t to read meminfo - Add antivirus_home_t type for antivirus date in HOMEDIRS - Allow mpd setcap which is needed by pulseaudio - Allow smbcontrol to create content in /var/lib/samba - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts - amanda_exec_t needs to be executable file - Allow block_suspend cap for samba-net - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t - Allow init_t to run crash utility - Treat usr_t just like bin_t for transitions and executions - Add port definition of pka_ca to port 829 for openshift - Allow selinux_store to use symlinks- Allow block_suspend cap for samba-net - Allow t-mission-control to manage gabble cache files - Allow nslcd to read /sys/devices/system/cpu - Allow selinux_store to use symlinks- Allow xdm_t to transition to itself - Call neutron interfaces instead of quantum - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t - Make sure directories in /run get created with the correct label - Make sure /root/.pki gets created with the right label - try to remove labeling for motion from zoneminder_exec_t to bin_t - Allow inetd_t to execute shell scripts - Allow cloud-init to read all domainstate - Fix to use quantum port - Add interface netowrkmanager_initrc_domtrans - Fix boinc_execmem - Allow t-mission-control to read gabble cache home - Add labeling for ~/.cache/telepathy/avatars/gabble - Allow memcache to read sysfs data - Cleanup antivirus policy and add additional fixes - Add boolean boinc_enable_execstack - Add support for couchdb in rabbitmq policy - Add interface couchdb_search_pid_dirs - Allow firewalld to read NM state - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files()- Split out rlogin ports from inetd - Treat files labeld as usr_t like bin_t when it comes to transitions - Allow staff_t to read login config - Allow ipsec_t to read .google authenticator data - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files() - Call the correct interface - corenet_udp_bind_ktalkd_port() - Allow all domains that can read gnome_config to read kde config - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work - Allow mdadm to getattr any file system - Allow a confined domain to executes mozilla_exec_t via dbus - Allow cupsd_lpd_t to bind to the printer port - Dontaudit attempts to bind to ports < 1024 when nis is turned on - Allow apache domain to connect to gssproxy socket - Allow rlogind to bind to the rlogin_port - Allow telnetd to bind to the telnetd_port - Allow ktalkd to bind to the ktalkd_port - Allow cvs to bind to the cvs_port- Cleanup related to init_domain()+inetd_domain fixes - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain - svirt domains neeed to create kobject_uevint_sockets - Lots of new access required for sosreport - Allow tgtd_t to connect to isns ports - Allow init_t to transition to all inetd domains: - openct needs to be able to create netlink_object_uevent_sockets - Dontaudit leaks into ldconfig_t - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls - Move kernel_stream_connect into all Xwindow using users - Dontaudit inherited lock files in ifconfig o dhcpc_t- Also sock_file trans rule is needed in lsm - Fix labeling for fetchmail pid files/dirs - Add additional fixes for abrt-upload-watch - Fix polipo.te - Fix transition rules in asterisk policy - Add fowner capability to networkmanager policy - Allow polipo to connect to tor ports - Cleanup lsmd.if - Cleanup openhpid policy - Fix kdump_read_crash() interface - Make more domains as init domain - Fix cupsd.te - Fix requires in rpm_rw_script_inherited_pipes - Fix interfaces in lsm.if - Allow munin service plugins to manage own tmpfs files/dirs - Allow virtd_t also relabel unix stream sockets for virt_image_type - Make ktalk as init domain - Fix to define ktalkd_unit_file_t correctly - Fix ktalk.fc - Add systemd support for talk-server - Allow glusterd to create sock_file in /run - Allow xdm_t to delete gkeyringd_tmp_t files on logout - Add fixes for hypervkvp policy - Add logwatch_can_sendmail boolean - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb - Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add selinux-policy-sandbox pkg0 - Allow rhsmcertd to read init state - Allow fsetid for pkcsslotd - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service - Allow fetchmail to create own pid with correct labeling - Fix rhcs_domain_template() - Allow roles which can run mock to read mock lib files to view results - Allow rpcbind to use nsswitch - Fix lsm.if summary - Fix collectd_t can read /etc/passwd file - Label systemd unit files under dracut correctly - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh - Add support for .Xauthority-n - Label umount.crypt as lvm_exec_t - Allow syslogd to search psad lib files - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files- Add policy for lsmd - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory - Update condor_master rules to allow read system state info and allow logging - Add labeling for /etc/condor and allow condor domain to write it (bug) - Allow condor domains to manage own logs - Allow glusterd to read domains state - Fix initial hypervkvp policy - Add policy for hypervkvpd - Fix redis.if summary- Allow boinc to connect to @/tmp/.X11-unix/X0 - Allow beam.smp to connect to tcp/5984 - Allow named to manage own log files - Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t - Add virt_transition_userdomain boolean decl - Allow httpd_t to sendto unix_dgram sockets on its children - Allow nova domains to execute ifconfig - bluetooth wants to create fifo_files in /tmp - exim needs to be able to manage mailman data - Allow sysstat to getattr on all file systems - Looks like bluetoothd has moved - Allow collectd to send ping packets - Allow svirt_lxc domains to getpgid - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff - Allow frpintd_t to read /dev/urandom - Allow asterisk_t to create sock_file in /var/run - Allow usbmuxd to use netlink_kobject - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket - More cleanup of svirt_lxc policy - virtd_lxc_t now talks to dbus - Dontaudit leaked ptmx_t - Allow processes to use inherited fifo files - Allow openvpn_t to connect to squid ports - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert() - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files - Allow user roles to connect to the journal socket- selinux_set_enforce_mode needs to be used with type - Add append to the dontaudit for unix_stream_socket of xdm_t leak - Allow xdm_t to create symlinks in log direcotries - Allow login programs to read afs config - Label 10933 as a pop port, for dovecot - New policy to allow selinux_server.py to run as semanage_t as a dbus service - Add fixes to make netlabelctl working on MLS - AVCs required for running sepolicy gui as staff_t - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC - New dbus server to be used with new gui - After modifying some files in /etc/mail, I saw this needed on the next boot - Loading a vm from /usr/tmp with virt-manager - Clean up oracleasm policy for Fedora - Add oracleasm policy written by rlopez@redhat.com - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache - Add label for /var/crash - Allow fenced to domtrans to sanclok_t - Allow nagios to manage nagios spool files - Make tfptd as home_manager - Allow kdump to read kcore on MLS system - Allow mysqld-safe sys_nice/sys_resource caps - Allow apache to search automount tmp dirs if http_use_nfs is enabled - Allow crond to transition to named_t, for use with unbound - Allow crond to look at named_conf_t, for unbound - Allow mozilla_plugin_t to transition its home content - Allow dovecot_domain to read all system and network state - Allow httpd_user_script_t to call getpw - Allow semanage to read pid files - Dontaudit leaked file descriptors from user domain into thumb - Make PAM authentication working if it is enabled in ejabberd - Add fixes for rabbit to fix ##992920,#992931 - Allow glusterd to mount filesystems - Loading a vm from /usr/tmp with virt-manager - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device - Add fix for pand service - shorewall touches own log - Allow nrpe to list /var - Mozilla_plugin_roles can not be passed into lpd_run_lpr - Allow afs domains to read afs_config files - Allow login programs to read afs config - Allow virt_domain to read virt_var_run_t symlinks - Allow smokeping to send its process signals - Allow fetchmail to setuid - Add kdump_manage_crash() interface - Allow abrt domain to write abrt.socket- Add more aliases in pegasus.te - Add more fixes for *_admin interfaces - Add interface fixes - Allow nscd to stream connect to nmbd - Allow gnupg apps to write to pcscd socket - Add more fixes for openlmi provides. Fix naming and support for additionals - Allow fetchmail to resolve host names - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te - Fix corecmd_exec_chroot() - Fix logging_relabel_syslog_pid_socket interface - Fix typo in unconfineduser.te - Allow system_r to access unconfined_dbusd_t to run hp_chec- Allow xdm_t to act as a dbus client to itsel - Allow fetchmail to resolve host names - Allow gnupg apps to write to pcscd socket - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te -httpd_t does access_check on certs- Add support for cmpiLMI_Service-cimprovagt - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t - Add support for pycmpiLMI_Storage-cimprovagt - Add support for cmpiLMI_Networking-cimprovagt - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working - Allow virtual machines and containers to run as user doains, needed for virt-sandbox - Allow buglist.cgi to read cpu info- Allow systemd-tmpfile to handle tmp content in print spool dir - Allow systemd-sysctl to send system log messages - Add support for RTP media ports and fmpro-internal - Make auditd working if audit is configured to perform SINGLE action on disk error - Add interfaces to handle systemd units - Make systemd-notify working if pcsd is used - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t - Instead of having all unconfined domains get all of the named transition rules, - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default. - Add definition for the salt ports - Allow xdm_t to create link files in xdm_var_run_t - Dontaudit reads of blk files or chr files leaked into ldconfig_t - Allow sys_chroot for useradd_t - Allow net_raw cap for ipsec_t - Allow sysadm_t to reload services - Add additional fixes to make strongswan working with a simple conf - Allow sysadm_t to enable/disable init_t services - Add additional glusterd perms - Allow apache to read lnk files in the /mnt directory - Allow glusterd to ask the kernel to load a module - Fix description of ftpd_use_fusefs boolean - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t - Allow glusterds to request load a kernel module - Allow boinc to stream connect to xserver_t - Allow sblim domains to read /etc/passwd - Allow mdadm to read usb devices - Allow collectd to use ping plugin - Make foghorn working with SNMP - Allow sssd to read ldap certs - Allow haproxy to connect to RTP media ports - Add additional trans rules for aide_db - Add labeling for /usr/lib/pcsd/pcsd - Add labeling for /var/log/pcsd - Add support for pcs which is a corosync and pacemaker configuration tool- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1 - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown - consolekit needs to be able to shut down system - Move around interfaces - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints - Allow gconf-defaults-m to read /etc/passwd - Fix pki_rw_tomcat_cert() interface to support lnk_files- Add support for gluster ports - Make sure that all keys located in /etc/ssh/ are labeled correctly - Make sure apcuspd lock files get created with the correct label - Use getcap in gluster.te - Fix gluster policy - add additional fixes to allow beam.smp to interact with couchdb files - Additional fix for #974149 - Allow gluster to user gluster ports - Allow glusterd to transition to rpcd_t and add additional fixes for #980683 - Allow tgtd working when accessing to the passthrough device - Fix labeling for mdadm unit files- Add mdadm fixes- Fix definition of sandbox.disabled to sandbox.pp.disabled- Allow mdamd to execute systemctl - Allow mdadm to read /dev/kvm - Allow ipsec_mgmt_t to read l2tpd pid content- Allow nsd_t to read /dev/urand - Allow mdadm_t to read framebuffer - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t - Allow mozilla_plugin_config_t to create tmp files - Cleanup openvswitch policy - Allow mozilla plugin to getattr on all executables - Allow l2tpd_t to create fifo_files in /var/run - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory - Allow mdadm to connecto its own unix_stream_socket - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now. - Allow apache to access smokeping pid files - Allow rabbitmq_beam_t to getattr on all filesystems - Add systemd support for iodined - Allow nup_upsdrvctl_t to execute its entrypoint - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch - add labeling for ~/.cache/libvirt-sandbox - Add interface to allow domains transitioned to by confined users to send sigchld to screen program - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs. - Allow staff to getsched all domains, required to run htop - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Add prosody policy written by Michael Scherer - Allow nagios plugins to read /sys info - ntpd needs to manage own log files - Add support for HOME_DIR/.IBMERS - Allow iptables commands to read firewalld config - Allow consolekit_t to read utmp - Fix filename transitions on .razor directory - Add additional fixes to make DSPAM with LDA working - Allow snort to read /etc/passwd - Allow fail2ban to communicate with firewalld over dbus - Dontaudit openshift_cgreoup_file_t read/write leaked dev - Allow nfsd to use mountd port - Call th proper interface - Allow openvswitch to read sys and execute plymouth - Allow tmpwatch to read /var/spool/cups/tmp - Add support for /usr/libexec/telepathy-rakia - Add systemd support for zoneminder - Allow mysql to create files/directories under /var/log/mysql - Allow zoneminder apache scripts to rw zoneminder tmpfs - Allow httpd to manage zoneminder lib files - Add zoneminder_run_sudo boolean to allow to start zoneminder - Allow zoneminder to send mails - gssproxy_t sock_file can be under /var/lib - Allow web domains to connect to whois port. - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t. - We really need to add an interface to corenet to define what a web_client_domain is and - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain. - Add labeling for cmpiLMI_LogicalFile-cimprovagt - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules - Update policy rules for pegasus_openlmi_logicalfile_t - Add initial types for logicalfile/unconfined OpenLMI providers - mailmanctl needs to read own log - Allow logwatch manage own lock files - Allow nrpe to read meminfo - Allow httpd to read certs located in pki-ca - Add pki_read_tomcat_cert() interface - Add support for nagios openshift plugins - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab- Make DSPAM to act as a LDA working - Allow ntop to create netlink socket - Allow policykit to send a signal to policykit-auth - Allow stapserver to dbus chat with avahi/systemd-logind - Fix labeling on haproxy unit file - Clean up haproxy policy - A new policy for haproxy and placed it to rhcs.te - Add support for ldirectord and treat it with cluster_t - Make sure anaconda log dir is created with var_log_t- Allow lvm_t to create default targets for filesystem handling - Fix labeling for razor-lightdm binaries - Allow insmod_t to read any file labeled var_lib_t - Add policy for pesign - Activate policy for cmpiLMI_Account-cimprovagt - Allow isnsd syscall=listen - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler - Allow ctdbd to use udp/4379 - gatherd wants sys_nice and setsched - Add support for texlive2012 - Allow NM to read file_t (usb stick with no labels used to transfer keys for example) - Allow cobbler to execute apache with domain transition- condor_collector uses tcp/9000 - Label /usr/sbin/virtlockd as virtd_exec_t for now - Allow cobbler to execute ldconfig - Allow NM to execute ssh - Allow mdadm to read /dev/crash - Allow antivirus domains to connect to snmp port - Make amavisd-snmp working correctly - Allow nfsd_t to mounton nfsd_fs_t - Add initial snapper policy - We still need to have consolekit policy - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow dirsrv to read network state - Fix pki_read_tomcat_lib_files - Add labeling for /usr/libexec/nm-ssh-service - Add label cert_t for /var/lib/ipa/pki-ca/publish - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant - Allow nfsd_t to mounton nfsd_fs_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow passwd_t to change role to system_r from unconfined_r- Don't audit access checks by sandbox xserver on xdb var_lib - Allow ntop to read usbmon devices - Add labeling for new polcykit authorizor - Dontaudit access checks from fail2ban_client - Don't audit access checks by sandbox xserver on xdb var_lib - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream - Fix labeling for all /usr/bim/razor-lightdm-* binaries - Add filename trans for /dev/md126p1- Make vdagent able to request loading kernel module - Add support for cloud-init make it as unconfined domain - Allow snmpd to run smartctl in fsadm_t domain - remove duplicate openshift_search_lib() interface - Allow mysqld to search openshift lib files - Allow openshift cgroup to interact with passedin file descriptors - Allow colord to list directories inthe users homedir - aide executes prelink to check files - Make sure cupsd_t creates content in /etc/cups with the correct label - Lest dontaudit apache read all domains, so passenger will not cause this avc - Allow gssd to connect to gssproxy - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS - Allow systemd-tmpfiles to relabel also lock files - Allow useradd to add homdir in /var/lib/openshift - Allow setfiles and semanage to write output to /run/files- Add labeling for /dev/tgt - Dontaudit leak fd from firewalld for modprobe - Allow runuser running as rpm_script_t to create netlink_audit socket - Allow mdadm to read BIOS non-volatile RAM- accountservice watches when accounts come and go in wtmp - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket - Add httpd_use_sasl boolean - Allow net_admin for tuned_t - iscsid needs sys_module to auto-load kernel modules - Allow blueman to read bluetooth conf - Add nova_manage_lib_files() interface - Fix mplayer_filetrans_home_content() - Add mplayer_filetrans_home_content() - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t - Revert "Allow thumb_t to append inherited xdm stream socket" - Add iscsi_filetrans_named_content() interface - Allow to create .mplayer with the correct labeling for unconfined - Allow iscsiadmin to create lock file with the correct labeling- Allow wine to manage wine home content - Make amanda working with socket actiovation - Add labeling for /usr/sbin/iscsiadm - Add support for /var/run/gssproxy.sock - dnsmasq_t needs to read sysctl_net_t- Fix courier_domain_template() interface - Allow blueman to write ip_forward - Allow mongodb to connect to mongodb port - Allow mongodb to connect to mongodb port - Allow java to bind jobss_debug port - Fixes for *_admin interfaces - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality - Need to assign attribute for courier_domain to all courier_domains - Fail2ban reads /etc/passwd - postfix_virtual will create new files in postfix_spool_t - abrt triggers sys_ptrace by running pidof - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it - Add passenger fixes needed by foreman - Remove dup interfaces - Add additional interfaces for quantum - Add new interfaces for dnsmasq - Allow passenger to read localization and send signull to itself - Allow dnsmasq to stream connect to quantum - Add quantum_stream_connect() - Make sure that mcollective starts the service with the correct labeling - Add labels for ~/.manpath - Dontaudit attempts by svirt_t to getpw* calls - sandbox domains are trying to look at parent process data - Allow courior auth to create its pid file in /var/spool/courier subdir - Add fixes for beam to have it working with couchdb - Add labeling for /run/nm-xl2tpd.con - Allow apache to stream connect to thin - Add systemd support for amand - Make public types usable for fs mount points - Call correct mandb interface in domain.te - Allow iptables to r/w quantum inherited pipes and send sigchld - Allow ifconfig domtrans to iptables and execute ldconfig - Add labels for ~/.manpath - Allow systemd to read iscsi lib files - seunshare is trying to look at parent process data- Fix openshift_search_lib - Add support for abrt-uefioops-oops - Allow colord to getattr any file system - Allow chrome processes to look at each other - Allow sys_ptrace for abrt_t - Add new policy for gssproxy - Dontaudit leaked file descriptor writes from firewalld - openshift_net_type is interface not template - Dontaudit pppd to search gnome config - Update openshift_search_lib() interface - Add fs_list_pstorefs() - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18 - Better labels for raspberry pi devices - Allow init to create devpts_t directory - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18 - Allow sysadm_t to build kernels - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18 - Allow userdomains to stream connect to gssproxy - Dontaudit leaked file descriptor writes from firewalld - Allow xserver to read /dev/urandom - Add additional fixes for ipsec-mgmt - Make SSHing into an Openshift Enterprise Node working- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime - with the proper label. - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files - Allow systemd-timedated to create adjtime - Add clock_create_adjtime() - Additional fix ifconfing for #966106 - Allow kernel_t to create boot.log with correct labeling - Remove unconfined_mplayer for which we don't have rules - Rename interfaces - Add userdom_manage_user_home_files/dirs interfaces - Fix files_dontaudit_read_all_non_security_files - Fix ipsec_manage_key_file() - Fix ipsec_filetrans_key_file() - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t - Fix labeling for ipse.secrets - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid - Add files_dontaudit_read_all_non_security_files() interface - /var/log/syslog-ng should be labeled var_log_t - Make ifconfig_var_run_t a mountpoint - Add transition from ifconfig to dnsmasq - Allow ifconfig to execute bin_t/shell_exec_t - We want to have hwdb.bin labeled as etc_t - update logging_filetrans_named_content() interface - Allow systemd_timedate_t to manage /etc/adjtime - Allow NM to send signals to l2tpd - Update antivirus_can_scan_system boolean - Allow devicekit_disk_t to sys_config_tty - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories - Make printing from vmware working - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes - Add virt_qemu_ga_data_t for qemu-ga - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both - Fix typo in virt.te - Add virt_qemu_ga_unconfined_t for hook scripts - Make sure NetworkManager files get created with the correct label - Add mozilla_plugin_use_gps boolean - Fix cyrus to have support for net-snmp - Additional fixes for dnsmasq and quantum for #966106 - Add plymouthd_create_log() - remove httpd_use_oddjob for which we don't have rules - Add missing rules for httpd_can_network_connect_cobbler - Add missing cluster_use_execmem boolean - Call userdom_manage_all_user_home_type_files/dirs - Additional fix for ftp_home_dir - Fix ftp_home_dir boolean - Allow squit to recv/send client squid packet - Fix nut.te to have nut_domain attribute - Add support for ejabberd; TODO: revisit jabberd and rabbit policy - Fix amanda policy - Add more fixes for domains which use libusb - Make domains which use libusb working correctly - Allow l2tpd to create ipsec key files with correct labeling and manage them - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files - Allow rabbitmq-beam to bind generic node - Allow l2tpd to read ipse-mgmt pid files - more fixes for l2tpd, NM and pppd from #967072- Dontaudit to getattr on dirs for dovecot-deliver - Allow raiudusd server connect to postgresql socket - Add kerberos support for radiusd - Allow saslauthd to connect to ldap port - Allow postfix to manage postfix_private_t files - Add chronyd support for #965457 - Fix labeling for HOME_DIR/\.icedtea - CHange squid and snmpd to be allowed also write own logs - Fix labeling for /usr/libexec/qemu-ga - Allow virtd_t to use virt_lock_t - Allow also sealert to read the policy from the kernel - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content - Dontaudit listing of users homedir by sendmail Seems like a leak - Allow passenger to transition to puppet master - Allow apache to connect to mythtv - Add definition for mythtv ports- Add additional fixes for #948073 bug - Allow sge_execd_t to also connect to sge ports - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files - Add networkmanager_stream_connect() - Make gnome-abrt wokring with staff_t - Fix openshift_manage_lib_files() interface - mdadm runs ps command which seems to getattr on random log files - Allow mozilla_plugin_t to create pulseaudit_home_t directories - Allow qemu-ga to shutdown virtual hosts - Add labelling for cupsd-browsed - Add web browser plugins to connect to aol ports - Allow nm-dhcp-helper to stream connect to NM - Add port definition for sge ports- Make sure users and unconfined domains create .hushlogin with the correct label - Allow pegaus to chat with realmd over DBus - Allow cobblerd to read network state - Allow boicn-client to stat on /dev/input/mice - Allow certwatch to read net_config_t when it executes apache - Allow readahead to create /run/systemd and then create its own directory with the correct label- Transition directories and files when in a user_tmp_t directory - Change certwatch to domtrans to apache instead of just execute - Allow virsh_t to read xen lib files - update policy rules for pegasus_openlmi_account_t - Add support for svnserve_tmp_t - Activate account openlmi policy - pegasus_openlmi_domain_template needs also require pegasus_t - One more fix for policykit.te - Call fs_list_cgroups_dirs() in policykit.te - Allow nagios service plugin to read mysql config files - Add labeling for /var/svn - Fix chrome.te - Fix pegasus_openlmi_domain_template() interfaces - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks - Fix location of google-chrome data - Add support for chome_sandbox to store content in the homedir - Allow policykit to watch for changes in cgroups file system - Add boolean to allow mozilla_plugin_t to use spice - Allow collectd to bind to udp port - Allow collected_t to read all of /proc - Should use netlink socket_perms - Should use netlink socket_perms - Allow glance domains to connect to apache ports - Allow apcupsd_t to manage its log files - Allow chrome objects to rw_inherited unix_stream_socket from callers - Allow staff_t to execute virtd_exec_t for running vms - nfsd_t needs to bind mountd port to make nfs-mountd.service working - Allow unbound net_admin capability because of setsockopt syscall - Fix fs_list_cgroup_dirs() - Label /usr/lib/nagios/plugins/utils.pm as bin_t - Remove uplicate definition of fs_read_cgroup_files() - Remove duplicate definition of fs_read_cgroup_files() - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd - Additional interfaces needed to list and read cgroups config - Add port definition for collectd port - Add labels for /dev/ptp* - Allow staff_t to execute virtd_exec_t for running vms- Allow samba-net to also read realmd tmp files - Allow NUT to use serial ports - realmd can be started by systemctl now- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid - Allow virsh to read xen lock file - Allow qemu-ga to create files in /run with proper labeling - Allow glusterd to connect to own socket in /tmp - Allow glance-api to connect to http port to make glance image-create working - Allow keystonte_t to execute rpm- Fix realmd cache interfaces- Allow tcpd to execute leafnode - Allow samba-net to read realmd cache files - Dontaudit sys_tty_config for alsactl - Fix allow rules for postfix_var_run - Allow cobblerd to read /etc/passwd - Allow pegasus to read exports - Allow systemd-timedate to read xdm state - Allow mout to stream connect to rpcbind - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki- Allow thumbnails to share memory with apps which run thumbnails - Allow postfix-postqueue block_suspend - Add lib interfaces for smsd - Add support for nginx - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t - Allow pki apache domain to create own tmp files and execute httpd_suexec - Allow procmail to manger user tmp files/dirs/lnk_files - Add virt_stream_connect_svirt() interface - Allow dovecot-auth to execute bin_t - Allow iscsid to request that kernel load a kernel module - Add labeling support for /var/lib/mod_security - Allow iw running as tuned_t to create netlink socket - Dontaudit sys_tty_config for thumb_t - Add labeling for nm-l2tp-service - Allow httpd running as certwatch_t to open tcp socket - Allow useradd to manager smsd lib files - Allow useradd_t to add homedirs in /var/lib - Fix typo in userdomain.te - Cleanup userdom_read_home_certs - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t - Allow staff to stream connect to svirt_t to make gnome-boxes working- Allow lvm to create its own unit files - Label /var/lib/sepolgen as selinux_config_t - Add filetrans rules for tw devices - Add transition from cupsd_config_t to cupsd_t- Add filetrans rules for tw devices - Cleanup bad transition lines- Fix lockdev_manage_files() - Allow setroubleshootd to read var_lib_t to make email_alert working - Add lockdev_manage_files() - Call proper interface in virt.te - Allow gkeyring_domain to create /var/run/UID/config/dbus file - system dbus seems to be blocking suspend - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need - When you enter a container from root, you generate avcs with a leaked file descriptor - Allow mpd getattr on file system directories - Make sure realmd creates content with the correct label - Allow systemd-tty-ask to write kmsg - Allow mgetty to use lockdev library for device locking - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music - When you enter a container from root, you generate avcs with a leaked file descriptor - Make sure init.fc files are labeled correctly at creation - File name trans vconsole.conf - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow certmonger to dbus communicate with realmd - Make realmd working- Fix mozilla specification of homedir content - Allow certmonger to read network state - Allow tmpwatch to read tmp in /var/spool/{cups,lpd} - Label all nagios plugin as unconfined by default - Add httpd_serve_cobbler_files() - Allow mdadm to read /dev/sr0 and create tmp files - Allow certwatch to send mails - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow realmd to run ipa, really needs to be an unconfined_domain - Allow sandbox domains to use inherted terminals - Allow pscd to use devices labeled svirt_image_t in order to use cat cards. - Add label for new alsa pid - Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition - Add support for sshd_unit_file_t - Add oracleasmfs_t - Allow unlabeled_t files to be stored on unlabeled_t filesystems- Fix description of deny_ptrace boolean - Remove allow for execmod lib_t for now - Allow quantum to connect to keystone port - Allow nova-console to talk with mysql over unix stream socket - Allow dirsrv to stream connect to uuidd - thumb_t needs to be able to create ~/.cache if it does not exist - virtd needs to be able to sys_ptrace when starting and stoping containers- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms... - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets - Fix deny_ptrace boolean, certain ptrace leaked into the system - Allow winbind to manage kerberos_rcache_host - Allow spamd to create spamd_var_lib_t directories - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs - Fix vmware_role() interface - Fix cobbler_manage_lib_files() interface - Allow nagios check disk plugins to execute bin_t - Allow quantum to transition to openvswitch_t - Allow postdrop to stream connect to postfix-master - Allow quantum to stream connect to openvswitch - Add xserver_dontaudit_xdm_rw_stream_sockets() interface - Allow daemon to send dgrams to initrc_t - Allow kdm to start the power service to initiate a reboot or poweroff- Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Don't audit attempts to write to stream socket of nscld by thumbnailers - Allow git_system_t to read network state - Allow pegasas to execute mount command - Fix desc for drdb_admin - Fix condor_amin() - Interface fixes for uptime, vdagent, vnstatd - Fix labeling for moodle in /var/www/moodle/data - Add interface fixes - Allow bugzilla to read certs - /var/www/moodle needs to be writable by apache - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Fix sys_nice for cups_domain - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Kernel_t needs mac_admin in order to support labeled NFS - Fix systemd_dontaudit_dbus_chat() interface - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Allow consolehelper domain to write Xauth files in /root - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Allow consolehelper more access discovered by Tom London - Allow fsdaemon to send signull to all domain - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Fix file_contexts.subs to label /run/lock correctly- Try to label on controlC devices up to 30 correctly - Add mount_rw_pid_files() interface - Add additional mount/umount interfaces needed by mock - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk - Fix tabs - Allow initrc_domain to search rgmanager lib files - Add more fixes which make mock working together with confined users * Allow mock_t to manage rpm files * Allow mock_t to read rpm log files * Allow mock to setattr on tmpfs, devpts * Allow mount/umount filesystems - Add rpm_read_log() interface - yum-cron runs rpm from within it. - Allow tuned to transition to dmidecode - Allow firewalld to do net_admin - Allow mock to unmont tmpfs_t - Fix virt_sigkill() interface - Add additional fixes for mock. Mainly caused by mount running in mock_t - Allow mock to write sysfs_t and mount pid files - Add mailman_domain to mailman_template() - Allow openvswitch to execute shell - Allow qpidd to use kerberos - Allow mailman to use fusefs, needs back port to RHEL6 - Allow apache and its scripts to use anon_inodefs - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7 - Realmd needs to connect to samba ports, needs back port to F18 also - Allow colord to read /run/initial-setup- - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock - Add virt_kill() interface - Add rgmanager_search_lib() interface - Allow wdmd to getattr on all filesystems. Back ported from RHEL6- Allow realmd to create tmp files - FIx ircssi_home_t type to irssi_home_t - Allow adcli running as realmd_t to connect to ldap port - Allow NetworkManager to transition to ipsec_t, for running strongswan - Make openshift_initrc_t an lxc_domain - Allow gssd to manage user_tmp_t files - Fix handling of irclogs in users homedir - Fix labeling for drupal an wp-content in subdirs of /var/www/html - Allow abrt to read utmp_t file - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6 - fix labeling for (oo|rhc)-restorer-wrapper.sh - firewalld needs to be able to write to network sysctls - Fix mozilla_plugin_dontaudit_rw_sem() interface - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains - Add mozilla_plugin_dontaudit_rw_sem() interface - Allow svirt_lxc_t to transition to openshift domains - Allow condor domains block_suspend and dac_override caps - Allow condor_master to read passd - Allow condor_master to read system state - Allow NetworkManager to transition to ipsec_t, for running strongswan - Lots of access required by lvm_t to created encrypted usb device - Allow xdm_t to dbus communicate with systemd_localed_t - Label strongswan content as ipsec_exec_mgmt_t for now - Allow users to dbus chat with systemd_localed - Fix handling of .xsession-errors in xserver.if, so kde will work - Might be a bug but we are seeing avc's about people status on init_t:service - Make sure we label content under /var/run/lock as <> - Allow daemon and systemprocesses to search init_var_run_t directory - Add boolean to allow xdm to write xauth data to the home directory - Allow mount to write keys for the unconfined domain - Add unconfined_write_keys() interface- Add labeling for /usr/share/pki - Allow programs that read var_run_t symlinks also read var_t symlinks - Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports - Fix labeling for /etc/dhcp directory - add missing systemd_stub_unit_file() interface - Add files_stub_var() interface - Add lables for cert_t directories - Make localectl set-x11-keymap working at all - Allow abrt to manage mock build environments to catch build problems. - Allow virt_domains to setsched for running gdb on itself - Allow thumb_t to execute user home content - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000 - Allow certwatch to execut /usr/bin/httpd - Allow cgred to send signal perms to itself, needs back port to RHEL6 - Allow openshift_cron_t to look at quota - Allow cups_t to read inhered tmpfs_t from the kernel - Allow yppasswdd to use NIS - Tuned wants sys_rawio capability - Add ftpd_use_fusefs boolean - Allow dirsrvadmin_t to signal itself- Allow localectl to read /etc/X11/xorg.conf.d directory - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors"" - Allow mount to transition to systemd_passwd_agent - Make sure abrt directories are labeled correctly - Allow commands that are going to read mount pid files to search mount_var_run_t - label /usr/bin/repoquery as rpm_exec_t - Allow automount to block suspend - Add abrt_filetrans_named_content so that abrt directories get labeled correctly - Allow virt domains to setrlimit and read file_context- Allow nagios to manage nagios spool files - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6 - Add swift_alias.* policy files which contain typealiases for swift types - Add support for /run/lock/opencryptoki - Allow pkcsslotd chown capability - Allow pkcsslotd to read passwd - Add rsync_stub() interface - Allow systemd_timedate also manage gnome config homedirs - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t - Fix filetrans rules for kdm creates .xsession-errors - Allow sytemd_tmpfiles to create wtmp file - Really should not label content under /var/lock, since it could have labels on it different from var_lock_t - Allow systemd to list all file system directories - Add some basic stub interfaces which will be used in PRODUCT policies- Fix log transition rule for cluster domains - Start to group all cluster log together - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update - cups uses usbtty_device_t devices - These fixes were all required to build a MLS virtual Machine with single level desktops - Allow domains to transiton using httpd_exec_t - Allow svirt domains to manage kernel key rings - Allow setroubleshoot to execute ldconfig - Allow firewalld to read generate gnome data - Allow bluetooth to read machine-info - Allow boinc domain to send signal to itself - Fix gnome_filetrans_home_content() interface - Allow mozilla_plugins to list apache modules, for use with gxine - Fix labels for POkemon in the users homedir - Allow xguest to read mdstat - Dontaudit virt_domains getattr on /dev/* - These fixes were all required to build a MLS virtual Machine with single level desktops - Need to back port this to RHEL6 for openshift - Add tcp/8891 as milter port - Allow nsswitch domains to read sssd_var_lib_t files - Allow ping to read network state. - Fix typo - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them- Adopt swift changes from lhh@redhat.com - Add rhcs_manage_cluster_pid_files() interface - Allow screen domains to configure tty and setup sock_file in ~/.screen directory - ALlow setroubleshoot to read default_context_t, needed to backport to F18 - Label /etc/owncloud as being an apache writable directory - Allow sshd to stream connect to an lxc domain- Allow postgresql to manage rgmanager pid files - Allow postgresql to read ccs data - Allow systemd_domain to send dbus messages to policykit - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them - All systemd domains that create content are reading the file_context file and setfscreate - Systemd domains need to search through init_var_run_t - Allow sshd to communicate with libvirt to set containers labels - Add interface to manage pid files - Allow NetworkManger_t to read /etc/hostname - Dontaudit leaked locked files into openshift_domains - Add fixes for oo-cgroup-read - it nows creates tmp files - Allow gluster to manage all directories as well as files - Dontaudit chrome_sandbox_nacl_t using user terminals - Allow sysstat to manage its own log files - Allow virtual machines to setrlimit and send itself signals. - Add labeling for /var/run/hplip- Fix POSTIN scriptlet- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp- Fix authconfig.py labeling - Make any domains that write homedir content do it correctly - Allow glusterd to read/write anyhwere on the file system by default - Be a little more liberal with the rsync log files - Fix iscsi_admin interface - Allow iscsid_t to read /dev/urand - Fix up iscsi domain for use with unit files - Add filename transition support for spamassassin policy - Allow web plugins to use badly formated libraries - Allow nmbd_t to create samba_var_t directories - Add filename transition support for spamassassin policy - Add filename transition support for tvtime - Fix alsa_home_filetrans_alsa_home() interface - Move all userdom_filetrans_home_content() calling out of booleans - Allow logrotote to getattr on all file sytems - Remove duplicate userdom_filetrans_home_content() calling - Allow kadmind to read /etc/passwd - Dontaudit append .xsession-errors file on ecryptfs for policykit-auth - Allow antivirus domain to manage antivirus db links - Allow logrotate to read /sys - Allow mandb to setattr on man dirs - Remove mozilla_plugin_enable_homedirs boolean - Fix ftp_home_dir boolean - homedir mozilla filetrans has been moved to userdom_home_manager - homedir telepathy filetrans has been moved to userdom_home_manager - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd() - Might want to eventually write a daemon on fusefsd. - Add policy fixes for sshd [net] child from plautrba@redhat.com - Tor uses a new port - Remove bin_t for authconfig.py - Fix so only one call to userdom_home_file_trans - Allow home_manager_types to create content with the correctl label - Fix all domains that write data into the homedir to do it with the correct label - Change the postgresql to use proper boolean names, which is causing httpd_t to - not get access to postgresql_var_run_t - Hostname needs to send syslog messages - Localectl needs to be able to send dbus signals to users - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default - Allow user_home_manger domains to create spam* homedir content with correct labeling - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working - Declare userdom_filetrans_type attribute - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute - fusefsd is mounding a fuse file system on /run/user/UID/gvfs- Man pages are now generated in the build process - Allow cgred to list inotifyfs filesystem- Allow gluster to get attrs on all fs - New access required for virt-sandbox - Allow dnsmasq to execute bin_t - Allow dnsmasq to create content in /var/run/NetworkManager - Fix openshift_initrc_signal() interface - Dontaudit openshift domains doing getattr on other domains - Allow consolehelper domain to communicate with session bus - Mock should not be transitioning to any other domains, we should keep mock_t as mock_t - Update virt_qemu_ga_t policy - Allow authconfig running from realmd to restart oddjob service - Add systemd support for oddjob - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd - Add labeling for gnashpluginrc - Allow chrome_nacl to execute /dev/zero - Allow condor domains to read /proc - mozilla_plugin_t will getattr on /core if firefox crashes - Allow condor domains to read /etc/passwd - Allow dnsmasq to execute shell scripts, openstack requires this access - Fix glusterd labeling - Allow virtd_t to interact with the socket type - Allow nmbd_t to override dac if you turned on sharing all files - Allow tuned to created kobject_uevent socket - Allow guest user to run fusermount - Allow openshift to read /proc and locale - Allow realmd to dbus chat with rpm - Add new interface for virt - Remove depracated interfaces - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t - Remove some more unconfined_t process transitions, that I don't believe are necessary - Stop transitioning uncofnined_t to checkpc - dmraid creates /var/lock/dmraid - Allow systemd_localed to creatre unix_dgram_sockets - Allow systemd_localed to write kernel messages. - Also cleanup systemd definition a little. - Fix userdom_restricted_xwindows_user_template() interface - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t - User accounts need to dbus chat with accountsd daemon - Gnome requires all users to be able to read /proc/1/- virsh now does a setexeccon call - Additional rules required by openshift domains - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work - Allow spamd_update_t to search spamc_home_t - Avcs discovered by mounting an isci device under /mnt - Allow lspci running as logrotate to read pci.ids - Additional fix for networkmanager_read_pid_files() - Fix networkmanager_read_pid_files() interface - Allow all svirt domains to connect to svirt_socket_t - Allow virsh to set SELinux context for a process. - Allow tuned to create netlink_kobject_uevent_socket - Allow systemd-timestamp to set SELinux context - Add support for /var/lib/systemd/linger - Fix ssh_sysadm_login to be working on MLS as expected- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file - Add missing files_rw_inherited_tmp_files interface - Add additional interface for ecryptfs - ALlow nova-cert to connect to postgresql - Allow keystone to connect to postgresql - Allow all cups domains to getattr on filesystems - Allow pppd to send signull - Allow tuned to execute ldconfig - Allow gpg to read fips_enabled - Add additional fixes for ecryptfs - Allow httpd to work with posgresql - Allow keystone getsched and setsched- Allow gpg to read fips_enabled - Add support for /var/cache/realmd - Add support for /usr/sbin/blazer_usb and systemd support for nut - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t - bitlbee wants to read own log file - Allow glance domain to send a signal itself - Allow xend_t to request that the kernel load a kernel module - Allow pacemaker to execute heartbeat lib files - cleanup new swift policy- Fix smartmontools - Fix userdom_restricted_xwindows_user_template() interface - Add xserver_xdm_ioctl_log() interface - Allow Xusers to ioctl lxdm.log to make lxdm working - Add MLS fixes to make MLS boot/log-in working - Add mls_socket_write_all_levels() also for syslogd - fsck.xfs needs to read passwd - Fix ntp_filetrans_named_content calling in init.te - Allow postgresql to create pg_log dir - Allow sshd to read rsync_data_t to make rsync working - Change ntp.conf to be labeled net_conf_t - Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it - Allow xdm_t to execute gstreamer home content - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp - New policy for openstack swift domains - More access required for openshift_cron_t - Use cupsd_log_t instead of cupsd_var_log_t - rpm_script_roles should be used in rpm_run - Fix rpm_run() interface - Fix openshift_initrc_run() - Fix sssd_dontaudit_stream_connect() interface - Fix sssd_dontaudit_stream_connect() interface - Allow LDA's job to deliver mail to the mailbox - dontaudit block_suspend for mozilla_plugin_t - Allow l2tpd_t to all signal perms - Allow uuidgen to read /dev/random - Allow mozilla-plugin-config to read power_supply info - Implement cups_domain attribute for cups domains - We now need access to user terminals since we start by executing a command outside the tty - We now need access to user terminals since we start by executing a command outside the tty - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen - Add containment of openshift cron jobs - Allow system cron jobs to create tmp directories - Make userhelp_conf_t a config file - Change rpm to use rpm_script_roles - More fixes for rsync to make rsync wokring - Allow logwatch to domtrans to mdadm - Allow pacemaker to domtrans to ifconfig - Allow pacemaker to setattr on corosync.log - Add pacemaker_use_execmem for memcheck-amd64 command - Allow block_suspend capability - Allow create fifo_file in /tmp with pacemaker_tmp_t - Allow systat to getattr on fixed disk - Relabel /etc/ntp.conf to be net_conf_t - ntp_admin should create files in /etc with the correct label - Add interface to create ntp_conf_t files in /etc - Add additional labeling for quantum - Allow quantum to execute dnsmasq with transition- boinc_cliean wants also execmem as boinc projecs have - Allow sa-update to search admin home for /root/.spamassassin - Allow sa-update to search admin home for /root/.spamassassin - Allow antivirus domain to read net sysctl - Dontaudit attempts from thumb_t to connect to ssd - Dontaudit attempts by readahead to read sock_files - Dontaudit attempts by readahead to read sock_files - Create tmpfs file while running as wine as user_tmpfs_t - Dontaudit attempts by readahead to read sock_files - libmpg ships badly created librarie- Change ssh_use_pts to use macro and only inherited sshd_devpts_t - Allow confined users to read systemd_logind seat information - libmpg ships badly created libraries - Add support for strongswan.service - Add labeling for strongswan - Allow l2tpd_t to read network manager content in /run directory - Allow rsync to getattr any file in rsync_data_t - Add labeling and filename transition for .grl-podcasts- mount.glusterfs executes glusterfsd binary - Allow systemd_hostnamed_t to stream connect to systemd - Dontaudit any user doing a access check - Allow obex-data-server to request the kernel to load a module - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info) - Allow gpg-agent to read /proc/sys/crypto/fips_enabled - Add new types for antivirus.pp policy module - Allow gnomesystemmm_t caps because of ioprio_set - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t - Allow gnomesystemmm_t caps because of ioprio_set - Allow NM rawip socket - files_relabel_non_security_files can not be used with boolean - Add interface to thumb_t dbus_chat to allow it to read remote process state - ALlow logrotate to domtrans to mdadm_t - kde gnomeclock wants to write content to /tmp- kde gnomeclock wants to write content to /tmp - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde - Allow blueman_t to rwx zero_device_t, for some kind of jre - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre - Ftp full access should be allowed to create directories as well as files - Add boolean to allow rsync_full_acces, so that an rsync server can write all - over the local machine - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6 - Add missing vpnc_roles type line - Allow stapserver to write content in /tmp - Allow gnome keyring to create keyrings dir in ~/.local/share - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Add interface to colord_t dbus_chat to allow it to read remote process state - Allow colord_t to read cupsd_t state - Add mate-thumbnail-font as thumnailer - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data. - Allow qpidd to list /tmp. Needed by ssl - Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18 - - Added systemd support for ksmtuned - Added booleans ksmtuned_use_nfs ksmtuned_use_cifs - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow - Looks like qpidd_t needs to read /dev/random - Lots of probing avc's caused by execugting gpg from staff_t - Dontaudit senmail triggering a net_admin avc - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port - Logwatch does access check on mdadm binary - Add raid_access_check_mdadm() iterface- Fix systemd_manage_unit_symlinks() interface - Call systemd_manage_unit_symlinks(() which is correct interface - Add filename transition for opasswd - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow sytstemd-timedated to get status of init_t - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow gpg_t to manage all gnome files - Stop using pcscd_read_pub_files - New rules for xguest, dontaudit attempts to dbus chat - Allow firewalld to create its mmap files in tmpfs and tmp directories - Allow firewalld to create its mmap files in tmpfs and tmp directories - run unbound-chkconf as named_t, so it can read dnssec - Colord is reading xdm process state, probably reads state of any apps that sends dbus message - Allow mdadm_t to change the kernel scheduler - mythtv policy - Update mandb_admin() interface - Allow dsspam to listen on own tpc_socket - seutil_filetrans_named_content needs to be optional - Allow sysadm_t to execute content in his homedir - Add attach_queue to tun_socket, new patch from Paul Moore - Change most of selinux configuration types to security_file_type. - Add filename transition rules for selinux configuration - ssh into a box with -X -Y requires ssh_use_ptys - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated - New allow rules found by Tom London for systemd_hostnamed- Allow systemd-tmpfiles to relabel lpd spool files - Ad labeling for texlive bash scripts - Add xserver_filetrans_fonts_cache_home_content() interface - Remove duplicate rules from *.te - Add support for /var/lock/man-db.lock - Add support for /var/tmp/abrt(/.*)? - Add additional labeling for munin cgi scripts - Allow httpd_t to read munin conf files - Allow certwatch to read meminfo - Fix nscd_dontaudit_write_sock_file() interfac - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling- Allow gnomeclock to talk to puppet over dbus - Allow numad access discovered by Dominic - Add support for HOME_DIR/.maildir - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain - Allow udev to relabel udev_var_run_t lnk_files - New bin_t file in mcelog- Remove all mcs overrides and replace with t1 != mcs_constrained_types - Add attribute_role for iptables - mcs_process_set_categories needs to be called for type - Implement additional role_attribute statements - Sodo domain is attempting to get the additributes of proc_kcore_t - Unbound uses port 8953 - Allow svirt_t images to compromise_kernel when using pci-passthrough - Add label for dns lib files - Bluetooth aquires a dbus name - Remove redundant files_read_usr_file calling - Remove redundant files_read_etc_file calling - Fix mozilla_run_plugin() - Add role_attribute support for more domains- Mass merge with upstream- Bump the policy version to 28 to match selinux userspace - Rebuild versus latest libsepol- Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Add labeling for /var/named/chroot/etc/localtim- Allow setroubleshoot_fixit to execute rpm - zoneminder needs to connect to httpd ports where remote cameras are listening - Allow firewalld to execute content created in /run directory - Allow svirt_t to read generic certs - Dontaudit leaked ps content to mozilla plugin - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - init scripts are creating systemd_unit_file_t directories- systemd_logind_t is looking at all files under /run/user/apache - Allow systemd to manage all user tmp files - Add labeling for /var/named/chroot/etc/localtime - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6 - Keystone is now using a differnt port - Allow xdm_t to use usbmuxd daemon to control sound - Allow passwd daemon to execute gnome_exec_keyringd - Fix chrome_sandbox policy - Add labeling for /var/run/checkquorum-timer - More fixes for the dspam domain, needs back port to RHEL6 - More fixes for the dspam domain, needs back port to RHEL6 - sssd needs to connect to kerberos password port if a user changes his password - Lots of fixes from RHEL testing of dspam web - Allow chrome and mozilla_plugin to create msgq and semaphores - Fixes for dspam cgi scripts - Fixes for dspam cgi scripts - Allow confine users to ptrace screen - Backport virt_qemu_ga_t changes from RHEL - Fix labeling for dspam.cgi needed for RHEL6 - We need to back port this policy to RHEL6, for lxc domains - Dontaudit attempts to set sys_resource of logrotate - Allow corosync to read/write wdmd's tmpfs files - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set - Allow cron jobs to read bind config for unbound - libvirt needs to inhibit systemd - kdumpctl needs to delete boot_t files - Fix duplicate gnome_config_filetrans - virtd_lxc_t is using /dev/fuse - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift - apcupsd can be setup to listen to snmp trafic - Allow transition from kdumpgui to kdumpctl - Add fixes for munin CGI scripts - Allow deltacloud to connect to openstack at the keystone port - Allow domains that transition to svirt domains to be able to signal them - Fix file context of gstreamer in .cache directory - libvirt is communicating with logind - NetworkManager writes to the systemd inhibit pipe- Allow munin disk plugins to get attributes of all directories - Allow munin disk plugins to get attributes of all directorie - Allow logwatch to get attributes of all directories - Fix networkmanager_manage_lib() interface - Fix gnome_manage_config() to allow to manage sock_file - Fix virtual_domain_context - Add support for dynamic DNS for DHCPv6- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch - Add additional labeling for /var/www/openshift/broker - Fix rhev policy - Allow openshift_initrc domain to dbus chat with systemd_logind - Allow httpd to getattr passenger log file if run_stickshift - Allow consolehelper-gtk to connect to xserver - Add labeling for the tmp-inst directory defined in pam_namespace.conf - Add lvm_metadata_t labeling for /etc/multipath- consoletype is no longer used- Add label for efivarfs - Allow certmonger to send signal to itself - Allow plugin-config to read own process status - Add more fixes for pacemaker - apache/drupal can run clamscan on uploaded content - Allow chrome_sandbox_nacl_t to read pid 1 content- Fix MCS Constraints to control ingres and egres controls on the network. - Change name of svirt_nokvm_t to svirt_tcg_t - Allow tuned to request the kernel to load kernel modules- Label /var/lib/pgsql/.ssh as ssh_home_t - Add labeling for /usr/bin/pg_ctl - Allow systemd-logind to manage keyring user tmp dirs - Add support for 7389/tcp port - gems seems to be placed in lots of places - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus - Add back tcp/8123 port as http_cache port - Add ovirt-guest-agent\.pid labeling - Allow xend to run scsi_id - Allow rhsmcertd-worker to read "physical_package_id" - Allow pki_tomcat to connect to ldap port - Allow lpr to read /usr/share/fonts - Allow open file from CD/DVD drive on domU - Allow munin services plugins to talk to SSSD - Allow all samba domains to create samba directory in var_t directories - Take away svirt_t ability to use nsswitch - Dontaudit attempts by openshift to read apache logs - Allow apache to create as well as append _ra_content_t - Dontaudit sendmail_t reading a leaked file descriptor - Add interface to have admin transition /etc/prelink.cache to the proper label - Add sntp support to ntp policy - Allow firewalld to dbus chat with devicekit_power - Allow tuned to call lsblk - Allow tor to read /proc/sys/kernel/random/uuid - Add tor_can_network_relay boolean- Add openshift_initrc_signal() interface - Fix typos - dspam port is treat as spamd_port_t - Allow setroubleshoot to getattr on all executables - Allow tuned to execute profiles scripts in /etc/tuned - Allow apache to create directories to store its log files - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6 - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM - Add filename transition for /etc/tuned/active_profile - Allow condor_master to send mails - Allow condor_master to read submit.cf - Allow condor_master to create /tmp files/dirs - Allow condor_mater to send sigkill to other condor domains - Allow condor_procd sigkill capability - tuned-adm wants to talk with tuned daemon - Allow kadmind and krb5kdc to also list sssd_public_t - Allow accountsd to dbus chat with init - Fix git_read_generic_system_content_files() interface - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler" - Fix mozilla_plugin_can_network_connect to allow to connect to all ports - Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t - dspam wants to search /var/spool for opendkim data - Revert "Add support for tcp/10026 port as dspam_port_t" - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6 - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain - Allow systemd_tmpfiles_t to setattr on mandb_cache_t- consolekit.pp was not removed from the postinstall script- Add back consolekit policy - Silence bootloader trying to use inherited tty - Silence xdm_dbusd_t trying to execute telepathy apps - Fix shutdown avcs when machine has unconfined.pp disabled - The host and a virtual machine can share the same printer on a usb device - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob - Allow abrt_watch_log_t to execute bin_t - Allow chrome sandbox to write content in ~/.config/chromium - Dontaudit setattr on fontconfig dir for thumb_t - Allow lircd to request the kernel to load module - Make rsync as userdom_home_manager - Allow rsync to search automount filesystem - Add fixes for pacemaker- Add support for 4567/tcp port - Random fixes from Tuomo Soini - xdm wants to get init status - Allow programs to run in fips_mode - Add interface to allow the reading of all blk device nodes - Allow init to relabel rpcbind sock_file - Fix labeling for lastlog and faillog related to logrotate - ALlow aeolus_configserver to use TRAM port - Add fixes for aeolus_configserver - Allow snmpd to connect to snmp port - Allow spamd_update to create spamd_var_lib_t directories - Allow domains that can read sssd_public_t files to also list the directory - Remove miscfiles_read_localization, this is defined for all domains- Allow syslogd to request the kernel to load a module - Allow syslogd_t to read the network state information - Allow xdm_dbusd_t connect to the system DBUS - Add support for 7389/tcp port - Allow domains to read/write all inherited sockets - Allow staff_t to read kmsg - Add awstats_purge_apache_log boolean - Allow ksysguardproces to read /.config/Trolltech.conf - Allow passenger to create and append puppet log files - Add puppet_append_log and puppet_create_log interfaces - Add puppet_manage_log() interface - Allow tomcat domain to search tomcat_var_lib_t - Allow pki_tomcat_t to connect to pki_ca ports - Allow pegasus_t to have net_admin capability - Allow pegasus_t to write /sys/class/net//flags - Allow mailserver_delivery to manage mail_home_rw_t lnk_files - Allow fetchmail to create log files - Allow gnomeclock to manage home config in .kde - Allow bittlebee to read kernel sysctls - Allow logrotate to list /root- Fix userhelper_console_role_template() - Allow enabling Network Access Point service using blueman - Make vmware_host_t as unconfined domain - Allow authenticate users in webaccess via squid, using mysql as backend - Allow gathers to get various metrics on mounted file systems - Allow firewalld to read /etc/hosts - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t - Allow kdumpgui to read/write to zipl.conf - Commands needed to get mock to build from staff_t in enforcing mode - Allow mdadm_t to manage cgroup files - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files - dontaudit ifconfig_t looking at fifo_files that are leaked to it - Add lableing for Quest Authentication System- Fix filetrans interface definitions - Dontaudit xdm_t to getattr on BOINC lib files - Add systemd_reload_all_services() interface - Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files - Allow accountsd to dbus chat with gdm - Allow realmd to getattr on all fs - Allow logrotate to reload all services - Add systemd unit file for radiusd - Allow winbind to create samba pid dir - Add labeling for /var/nmbd/unexpected - Allow chrome and mozilla plugin to connect to msnp ports- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file - Dontaudit setfiles reading /dev/random - On initial boot gnomeclock is going to need to be set buy gdm - Fix tftp_read_content() interface - Random apps looking at kernel file systems - Testing virt with lxc requiers additional access for virsh_t - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container - Allow MPD to read /dev/radnom - Allow sandbox_web_type to read logind files which needs to read pulseaudio - Allow mozilla plugins to read /dev/hpet - Add labeling for /var/lib/zarafa-webap - Allow BOINC client to use an HTTP proxy for all connections - Allow rhsmertd to domain transition to dmidecod - Allow setroubleshootd to send D-Bus msg to ABRT- Define usbtty_device_t as a term_tty - Allow svnserve to accept a connection - Allow xend manage default virt_image_t type - Allow prelink_cron_system_t to overide user componant when executing cp - Add labeling for z-push - Gnomeclock sets the realtime clock - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd - Allow lxc domains to use /dev/random and /dev/urandom- Add port defintion for tcp/9000 - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API - Allow shorewall_t to create netlink_socket - Allow krb5admind to block suspend - Fix labels on /var/run/dlm_controld /var/log/dlm_controld - Allow krb5kdc to block suspend - gnomessytemmm_t needs to read /etc/passwd - Allow cgred to read all sysctls- Allow all domains to read /proc/sys/vm/overcommit_memory - Make proc_numa_t an MLS Trusted Object - Add /proc/numactl support for confined users - Allow ssh_t to connect to any port > 1023 - Add openvswitch domain - Pulseaudio tries to create directories in gnome_home_t directories - New ypbind pkg wants to search /var/run which is caused by sd_notify - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans - Allow sanlock to read /dev/random - Treat php-fpm with httpd_t - Allow domains that can read named_conf_t to be able to list the directories - Allow winbind to create sock files in /var/run/samba- Add smsd policy - Add support for OpenShift sbin labelin - Add boolean to allow virt to use rawip - Allow mozilla_plugin to read all file systems with noxattrs support - Allow kerberos to write on anon_inodefs fs - Additional access required by fenced - Add filename transitions for passwd.lock/group.lock - UPdate man pages - Create coolkey directory in /var/cache with the correct label- Fix label on /etc/group.lock - Allow gnomeclock to create lnk_file in /etc - label /root/.pki as a home_cert_t - Add interface to make sure rpcbind.sock is created with the correct label - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules - opendkim should be a part of milter - Allow libvirt to set the kernel sched algorythm - Allow mongod to read sysfs_t - Add authconfig policy - Remove calls to miscfiles_read_localization all domains get this - Allow virsh_t to read /root/.pki/ content - Add label for log directory under /var/www/stickshift- Allow getty to setattr on usb ttys - Allow sshd to search all directories for sshd_home_t content - Allow staff domains to send dbus messages to kdumpgui - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t - Dontaudit setfiles reading urand - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir - Allow systemd-timedated to read /dev/urandom - Allow entropyd_t to read proc_t (meminfo) - Add unconfined munin plugin - Fix networkmanager_read_conf() interface - Allow blueman to list /tmp which is needed by sys_nic/setsched - Fix label of /etc/mail/aliasesdb-stamp - numad is searching cgroups - realmd is communicating with networkmanager using dbus - Lots of fixes to try to get kdump to work- Allow loging programs to dbus chat with realmd - Make apache_content_template calling as optional - realmd is using policy kit- Add new selinuxuser_use_ssh_chroot boolean - dbus needs to be able to read/write inherited fixed disk device_t passed through it - Cleanup netutils process allow rule - Dontaudit leaked fifo files from openshift to ping - sanlock needs to read mnt_t lnk files - Fail2ban needs to setsched and sys_nice- Change default label of all files in /var/run/rpcbind - Allow sandbox domains (java) to read hugetlbfs_t - Allow awstats cgi content to create tmp files and read apache log files - Allow setuid/setgid for cupsd-config - Allow setsched/sys_nice pro cupsd-config - Fix /etc/localtime sym link to be labeled locale_t - Allow sshd to search postgresql db t since this is a homedir - Allow xwindows users to chat with realmd - Allow unconfined domains to configure all files and null_device_t service- Adopt pki-selinux policy- pki is leaking which we dontaudit until a pki code fix - Allow setcap for arping - Update man pages - Add labeling for /usr/sbin/mcollectived - pki fixes - Allow smokeping to execute fping in the netutils_t domain- Allow mount to relabelfrom unlabeled file systems - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working - Add label to get bin files under libreoffice labeled correctly - Fix interface to allow executing of base_ro_file_type - Add fixes for realmd - Update pki policy - Add tftp_homedir boolean - Allow blueman sched_setscheduler - openshift user domains wants to r/w ssh tcp sockets- Additional requirements for disable unconfined module when booting - Fix label of systemd script files - semanage can use -F /dev/stdin to get input - syslog now uses kerberos keytabs - Allow xserver to compromise_kernel access - Allow nfsd to write to mount_var_run_t when running the mount command - Add filename transition rule for bin_t directories - Allow files to read usr_t lnk_files - dhcpc wants chown - Add support for new openshift labeling - Clean up for tunable+optional statements - Add labeling for /usr/sbin/mkhomedir_helper - Allow antivirus domain to managa amavis spool files - Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool- Add interfaces to read kernel_t proc info - Missed this version of exec_all - Allow anyone who can load a kernel module to compromise kernel - Add oddjob_dbus_chat to openshift apache policy - Allow chrome_sandbox_nacl_t to send signals to itself - Add unit file support to usbmuxd_t - Allow all openshift domains to read sysfs info - Allow openshift domains to getattr on all domains- MLS fixes from Dan - Fix name of capability2 secure_firmware->compromise_kerne- Allow xdm to search all file systems - Add interface to allow the config of all files - Add rngd policy - Remove kgpg as a gpg_exec_t type - Allow plymouthd to block suspend - Allow systemd_dbus to config any file - Allow system_dbus_t to configure all services - Allow freshclam_t to read usr_files - varnishd requires execmem to load modules- Allow semanage to verify types - Allow sudo domain to execute user home files - Allow session_bus_type to transition to user_tmpfs_t - Add dontaudit caused by yum updates - Implement pki policy but not activated- tuned wants to getattr on all filesystems - tuned needs also setsched. The build is needed for test day- Add policy for qemu-qa - Allow razor to write own config files - Add an initial antivirus policy to collect all antivirus program - Allow qdisk to read usr_t - Add additional caps for vmware_host - Allow tmpfiles_t to setattr on mandb_cache_t - Dontaudit leaked files into mozilla_plugin_config_t - Allow wdmd to getattr on tmpfs - Allow realmd to use /dev/random - allow containers to send audit messages - Allow root mount any file via loop device with enforcing mls policy - Allow tmpfiles_t to setattr on mandb_cache_t - Allow tmpfiles_t to setattr on mandb_cache_t - Make userdom_dontaudit_write_all_ not allow open - Allow init scripts to read all unit files - Add support for saphostctrl ports- Add kernel_read_system_state to sandbox_client_t - Add some of the missing access to kdumpgui - Allow systemd_dbusd_t to status the init system - Allow vmnet-natd to request the kernel to load a module - Allow gsf-office-thum to append .cache/gdm/session.log - realmd wants to read .config/dconf/user - Firewalld wants sys_nice/setsched - Allow tmpreaper to delete mandb cache files - Firewalld wants sys_nice/setsched - Allow firewalld to perform a DNS name resolution - Allown winbind to read /usr/share/samba/codepages/lowcase.dat - Add support for HTTPProxy* in /etc/freshclam.conf - Fix authlogin_yubike boolean - Extend smbd_selinux man page to include samba booleans - Allow dhcpc to execute consoletype - Allow ping to use inherited tmp files created in init scripts - On full relabel with unconfined domain disabled, initrc was running some chcon's - Allow people who delete man pages to delete mandb cache files- Add missing permissive domains- Add new mandb policy - ALlow systemd-tmpfiles_t to relabel mandb_cache_t - Allow logrotate to start all unit files- Add fixes for ctbd - Allow nmbd to stream connect to ctbd - Make cglear_t as nsswitch_domain - Fix bogus in interfaces - Allow openshift to read/write postfix public pipe - Add postfix_manage_spool_maildrop_files() interface - stickshift paths have been renamed to openshift - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes - Update man pages, adding ENTRYPOINTS- Add mei_device_t - Make sure gpg content in homedir created with correct label - Allow dmesg to write to abrt cache files - automount wants to search virtual memory sysctls - Add support for hplip logs stored in /var/log/hp/tmp - Add labeling for /etc/owncloud/config.php - Allow setroubleshoot to send analysys to syslogd-journal - Allow virsh_t to interact with new fenced daemon - Allow gpg to write to /etc/mail/spamassassiin directories - Make dovecot_deliver_t a mail server delivery type - Add label for /var/tmp/DNS25- Fixes for tomcat_domain template interface- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes - Add attribute to all base os types. Allow all domains to read all ro base OS types- Additional unit files to be defined as power unit files - Fix more boolean names- Fix boolean name so subs will continue to work- dbus needs to start getty unit files - Add interface to allow system_dbusd_t to start the poweroff service - xdm wants to exec telepathy apps - Allow users to send messages to systemdlogind - Additional rules needed for systemd and other boot apps - systemd wants to list /home and /boot - Allow gkeyringd to write dbus/conf file - realmd needs to read /dev/urand - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded- Fixes to safe more rules - Re-write tomcat_domain_template() - Fix passenger labeling - Allow all domains to read man pages - Add ephemeral_port_t to the 'generic' port interfaces - Fix the names of postgresql booleans- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer - Move netlable_peer check out of booleans - Remove call to recvfrom_netlabel for kerberos call - Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules - Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface - Allow rndc to block suspend - tuned needs to modify the schedule of the kernel - Allow svirt_t domains to read alsa configuration files - ighten security on irc domains and make sure they label content in homedir correctly - Add filetrans_home_content for irc files - Dontaudit all getattr access for devices and filesystems for sandbox domains - Allow stapserver to search cgroups directories - Allow all postfix domains to talk to spamd- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check - Change pam_t to pam_timestamp_t - Add dovecot_domain attribute and allow this attribute block_suspend capability2 - Add sanlock_use_fusefs boolean - numad wants send/recieve msg - Allow rhnsd to send syslog msgs - Make piranha-pulse as initrc domain - Update openshift instances to dontaudit setattr until the kernel is fixed.- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd - Remove pam_selinux.8 which conflicts with man page owned by the pam package - Allow glance-api to talk to mysql - ABRT wants to read Xorg.0.log if if it detects problem with Xorg - Fix gstreamer filename trans. interface- Man page fixes by Dan Walsh- Allow postalias to read postfix config files - Allow man2html to read man pages - Allow rhev-agentd to search all mountpoints - Allow rhsmcertd to read /dev/random - Add tgtd_stream_connect() interface - Add cyrus_write_data() interface - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t - Add port definition for tcp/81 as http_port_t - Fix /dev/twa labeling - Allow systemd to read modules config- Merge openshift policy - Allow xauth to read /dev/urandom - systemd needs to relabel content in /run/systemd directories - Files unconfined should be able to perform all services on all files - Puppet tmp file can be leaked to all domains - Dontaudit rhsmcertd-worker to search /root/.local - Allow chown capability for zarafa domains - Allow system cronjobs to runcon into openshift domains - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories- nmbd wants to create /var/nmbd - Stop transitioning out of anaconda and firstboot, just causes AVC messages - Allow clamscan to read /etc files - Allow bcfg2 to bind cyphesis port - heartbeat should be run as rgmanager_t instead of corosync_t - Add labeling for /etc/openldap/certs - Add labeling for /opt/sartest directory - Make crontab_t as userdom home reader - Allow tmpreaper to list admin_home dir - Add defition for imap_0 replay cache file - Add support for gitolite3 - Allow virsh_t to send syslog messages - allow domains that can read samba content to be able to list the directories also - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd - Separate out sandbox from sandboxX policy so we can disable it by default - Run dmeventd as lvm_t - Mounting on any directory requires setattr and write permissions - Fix use_nfs_home_dirs() boolean - New labels for pam_krb5 - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0 - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs - Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles- Allow realmd to read resolv.conf - Add pegasus_cache_t type - Label /usr/sbin/fence_virtd as virsh_exec_t - Add policy for pkcsslotd - Add support for cpglockd - Allow polkit-agent-helper to read system-auth-ac - telepathy-idle wants to read gschemas.compiled - Allow plymouthd to getattr on fs_t - Add slpd policy - Allow ksysguardproces to read/write config_usr_t- Fix labeling substitution so rpm will label /lib/systemd content correctly- Add file name transitions for ttyACM0 - spice-vdagent(d)'s are going to log over to syslog - Add sensord policy - Add more fixes for passenger policy related to puppet - Allow wdmd to create wdmd_tmpfs_t - Fix labeling for /var/run/cachefilesd\.pid - Add thumb_tmpfs_t files type- Allow svirt domains to manage the network since this is containerized - Allow svirt_lxc_net_t to send audit messages- Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working - Allow dlm_controld to execute dlm_stonith labeled as bin_t - Allow GFS2 working on F17 - Abrt needs to execute dmesg - Allow jockey to list the contents of modeprobe.d - Add policy for lightsquid as squid_cron_t - Mailscanner is creating files and directories in /tmp - dmesg is now reading /dev/kmsg - Allow xserver to communicate with secure_firmware - Allow fsadm tools (fsck) to read /run/mount contnet - Allow sysadm types to read /dev/kmsg -- Allow postfix, sssd, rpcd to block_suspend - udev seems to need secure_firmware capability - Allow virtd to send dbus messages to firewalld so it can configure the firewall- Fix labeling of content in /run created by virsh_t - Allow condor domains to read kernel sysctls - Allow condor_master to connect to amqp - Allow thumb drives to create shared memory and semaphores - Allow abrt to read mozilla_plugin config files - Add labels for lightsquid - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow - dovecot_auth_t uses ldap for user auth - Allow domains that can read dhcp_etc_t to read lnk_files - Add more then one watchdog device - Allow useradd_t to manage etc_t files so it can rename it and edit them - Fix invalid class dir should be fifo_file - Move /run/blkid to fsadm and make sure labeling is correct- Fix bogus regex found by eparis - Fix manage run interface since lvm needs more access - syslogd is searching cgroups directory - Fixes to allow virt-sandbox-service to manage lxc var run content- Fix Boolean settings - Add new libjavascriptcoregtk as textrel_shlib_t - Allow xdm_t to create xdm_home_t directories - Additional access required for systemd - Dontaudit mozilla_plugin attempts to ipc_lock - Allow tmpreaper to delete unlabeled files - Eliminate screen_tmp_t and allow it to manage user_tmp_t - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors - Allow web plugins to connect to the asterisk ports - Condor will recreate the lock directory if it does not exist - Oddjob mkhomedir needs to connectto user processes - Make oddjob_mkhomedir_t a userdom home manager- Put placeholder back in place for proper numbering of capabilities - Systemd also configures init scripts- Fix ecryptfs interfaces - Bootloader seems to be trolling around /dev/shm and /dev - init wants to create /etc/systemd/system-update.target.wants - Fix systemd_filetrans call to move it out of tunable - Fix up policy to work with systemd userspace manager - Add secure_firmware capability and remove bogus epolwakeup - Call seutil_*_login_config interfaces where should be needed - Allow rhsmcertd to send signal to itself - Allow thin domains to send signal to itself - Allow Chrome_ChildIO to read dosfs_t- Add role rules for realmd, sambagui- Add new type selinux_login_config_t for /etc/selinux//logins/ - Additional fixes for seutil_manage_module_store() - dbus_system_domain() should be used with optional_policy - Fix svirt to be allowed to use fusefs file system - Allow login programs to read /run/ data created by systemd_login - sssd wants to write /etc/selinux//logins/ for SELinux PAM module - Fix svirt to be allowed to use fusefs file system - Allow piranha domain to use nsswitch - Sanlock needs to send Kill Signals to non root processes - Pulseaudio wants to execute /run/user/PID/.orc- Fix saslauthd when it tries to read /etc/shadow - Label gnome-boxes as a virt homedir - Need to allow svirt_t ability to getattr on nfs_t file systems - Update sanlock policy to solve all AVC's - Change confined users can optionally manage virt content - Handle new directories under ~/.cache - Add block suspend to appropriate domains - More rules required for containers - Allow login programs to read /run/ data created by systemd_logind - Allow staff users to run svirt_t processes- Update to upstream- More fixes for systemd to make rawhide booting from Dan Walsh- Add systemd fixes to make rawhide booting- Add systemd_logind_inhibit_var_run_t attribute - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type - Add interface for mysqld to dontaudit signull to all processes - Label new /var/run/journal directory correctly - Allow users to inhibit suspend via systemd - Add new type for the /var/run/inhibit directory - Add interface to send signull to systemd_login so avahi can send them - Allow systemd_passwd to send syslog messages - Remove corenet_all_recvfrom_unlabeled() calling fro policy files - Allow editparams.cgi running as httpd_bugzilla_script_t to read /etc/group - Allow smbd to read cluster config - Add additional labeling for passenger - Allow dbus to inhibit suspend via systemd - Allow avahi to send signull to systemd_login- Add interface to dontaudit getattr access on sysctls - Allow sshd to execute /bin/login - Looks like xdm is recreating the xdm directory in ~/.cache/ on login - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald - Fix semanage to work with unconfined domain disabled on F18 - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls - Virt seems to be using lock files - Dovecot seems to be searching directories of every mountpoint - Allow jockey to read random/urandom, execute shell and install third-party drivers - Add aditional params to allow cachedfiles to manage its content - gpg agent needs to read /dev/random - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write - Add a bunch of dontaudit rules to quiet svirt_lxc domains - Additional perms needed to run svirt_lxc domains - Allow cgclear to read cgconfig - Allow sys_ptrace capability for snmp - Allow freshclam to read /proc - Allow procmail to manage /home/user/Maildir content - Allow NM to execute wpa_cli - Allow amavis to read clamd system state - Regenerate man pages- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild- Add realmd and stapserver policies - Allow useradd to manage stap-server lib files - Tighten up capabilities for confined users - Label /etc/security/opasswd as shadow_t - Add label for /dev/ecryptfs - Allow condor_startd_t to start sshd with the ranged - Allow lpstat.cups to read fips_enabled file - Allow pyzor running as spamc_t to create /root/.pyzor directory - Add labelinf for amavisd-snmp init script - Add support for amavisd-snmp - Allow fprintd sigkill self - Allow xend (w/o libvirt) to start virtual machines - Allow aiccu to read /etc/passwd - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes - Add condor_startd_ranged_domtrans_to() interface - Add ssd_conf_t for /etc/sssd - accountsd needs to fchown some files/directories - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit - Allow xend_t to read the /etc/passwd file- Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t - Add init_access_check() interface - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t - Allow tcpdump to create a netlink_socket - Label newusers like useradd - Change xdm log files to be labeled xdm_log_t - Allow sshd_t with privsep to work in MLS - Allow freshclam to update databases thru HTTP proxy - Allow s-m-config to access check on systemd - Allow abrt to read public files by default - Fix amavis_create_pid_files() interface - Add labeling and filename transition for dbomatic.log - Allow system_dbusd_t to stream connect to bluetooth, and use its socket - Allow amavisd to execute fsav - Allow tuned to use sys_admin and sys_nice capabilities - Add php-fpm policy from Bryan - Add labeling for aeolus-configserver-thinwrapper - Allow thin domains to execute shell - Fix gnome_role_gkeyringd() interface description - Lot of interface fixes - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files - Allow OpenMPI job to use kerberos - Make deltacloudd_t as nsswitch_domain - Allow xend_t to run lsscsi - Allow qemu-dm running as xend_t to create tun_socket - Add labeling for /opt/brother/Printers(.*/)?inf - Allow jockey-backend to read pyconfig-64.h labeled as usr_t - Fix clamscan_can_scan_system boolean - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11- initrc is calling exportfs which is not confined so it attempts to read nfsd_files - Fixes for passenger running within openshift. - Add labeling for all tomcat6 dirs - Add support for tomcat6 - Allow cobblerd to read /etc/passwd - Allow jockey to read sysfs and and execute binaries with bin_t - Allow thum to use user terminals - Allow cgclear to read cgconfig config files - Fix bcf2g.fc - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains - Allow dbomatic to execute ruby - abrt_watch_log should be abrt_domain - Allow mozilla_plugin to connect to gatekeeper port- add ptrace_child access to process - remove files_read_etc_files() calling from all policies which have auth_use_nsswith() - Allow boinc domains to manage boinc_lib_t lnk_files - Add support for boinc-client.service unit file - Add support for boinc.log - Allow mozilla_plugin execmod on mozilla home files if allow_ex - Allow dovecot_deliver_t to read dovecot_var_run_t - Allow ldconfig and insmod to manage kdumpctl tmp files - Move thin policy out from cloudform.pp and add a new thin poli - pacemaker needs to communicate with corosync streams - abrt is now started on demand by dbus - Allow certmonger to talk directly to Dogtag servers - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c - Allow mozila_plugin to execute gstreamer home files - Allow useradd to delete all file types stored in the users hom - rhsmcertd reads the rpm database - Add support for lightdm- Add tomcat policy - Remove pyzor/razor policy - rhsmcertd reads the rpm database - Dontaudit thumb to setattr on xdm_tmp dir - Allow wicd to execute ldconfig in the networkmanager_t domain - Add /var/run/cherokee\.pid labeling - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too - Allow postfix-master to r/w pipes other postfix domains - Allow snort to create netlink_socket - Add kdumpctl policy - Allow firstboot to create tmp_t files/directories - /usr/bin/paster should not be labeled as piranha_exec_t - remove initrc_domain from tomcat - Allow ddclient to read /etc/passwd - Allow useradd to delete all file types stored in the users homedir - Allow ldconfig and insmod to manage kdumpctl tmp files - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those - Transition xauth files within firstboot_tmp_t - Fix labeling of /run/media to match /media - Label all lxdm.log as xserver_log_t - Add port definition for mxi port - Allow local_login_t to execute tmux- apcupsd needs to read /etc/passwd - Sanlock allso sends sigkill - Allow glance_registry to connect to the mysqld port - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl - Allow firefox plugins/flash to connect to port 1234 - Allow mozilla plugins to delete user_tmp_t files - Add transition name rule for printers.conf.O - Allow virt_lxc_t to read urand - Allow systemd_loigind to list gstreamer_home_dirs - Fix labeling for /usr/bin - Fixes for cloudform services * support FIPS - Allow polipo to work as web caching - Allow chfn to execute tmux- Add support for ecryptfs * ecryptfs does not support xattr * we need labeling for HOMEDIR - Add policy for (u)mount.ecryptfs* - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache - Allow dovecot to manage Maildir content, fix transitions to Maildir - Allow postfix_local to transition to dovecot_deliver - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code - Cleanup interface definitions - Allow apmd to change with the logind daemon - Changes required for sanlock in rhel6 - Label /run/user/apache as httpd_tmp_t - Allow thumb to use lib_t as execmod if boolean turned on - Allow squid to create the squid directory in /var with the correct labe - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com) - Allow virtd to exec xend_exec_t without transition - Allow virtd_lxc_t to unmount all file systems- PolicyKit path has changed - Allow httpd connect to dirsrv socket - Allow tuned to write generic kernel sysctls - Dontaudit logwatch to gettr on /dev/dm-2 - Allow policykit-auth to manage kerberos files - Make condor_startd and rgmanager as initrc domain - Allow virsh to read /etc/passwd - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs - xdm now needs to execute xsession_exec_t - Need labels for /var/lib/gdm - Fix files_filetrans_named_content() interface - Add new attribute - initrc_domain - Allow systemd_logind_t to signal, signull, sigkill all processes - Add filetrans rules for etc_runtime files- Rename boolean names to remove allow_- Mass merge with upstream * new policy topology to include contrib policy modules * we have now two base policy patches- Fix description of authlogin_nsswitch_use_ldap - Fix transition rule for rhsmcertd_t needed for RHEL7 - Allow useradd to list nfs state data - Allow openvpn to manage its log file and directory - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly - Allow thumb to use nvidia devices - Allow local_login to create user_tmp_t files for kerberos - Pulseaudio needs to read systemd_login /var/run content - virt should only transition named system_conf_t config files - Allow munin to execute its plugins - Allow nagios system plugin to read /etc/passwd - Allow plugin to connect to soundd port - Fix httpd_passwd to be able to ask passwords - Radius servers can use ldap for backing store - Seems to need to mount on /var/lib for xguest polyinstatiation to work. - Allow systemd_logind to list the contents of gnome keyring - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL - Add policy for isns-utils- Add policy for subversion daemon - Allow boinc to read passwd - Allow pads to read kernel network state - Fix man2html interface for sepolgen-ifgen - Remove extra /usr/lib/systemd/system/smb - Remove all /lib/systemd and replace with /usr/lib/systemd - Add policy for man2html - Fix the label of kerberos_home_t to krb5_home_t - Allow mozilla plugins to use Citrix - Allow tuned to read /proc/sys/kernel/nmi_watchdog - Allow tune /sys options via systemd's tmpfiles.d "w" type- Dontaudit lpr_t to read/write leaked mozilla tmp files - Add file name transition for .grl-podcasts directory - Allow corosync to read user tmp files - Allow fenced to create snmp lib dirs/files - More fixes for sge policy - Allow mozilla_plugin_t to execute any application - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain - Allow mongod to read system state information - Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t - Allow polipo to manage polipo_cache dirs - Add jabbar_client port to mozilla_plugin_t - Cleanup procmail policy - system bus will pass around open file descriptors on files that do not have labels on them - Allow l2tpd_t to read system state - Allow tuned to run ls /dev - Allow sudo domains to read usr_t files - Add label to machine-id - Fix corecmd_read_bin_symlinks cut and paste error- Fix pulseaudio port definition - Add labeling for condor_starter - Allow chfn_t to creat user_tmp_files - Allow chfn_t to execute bin_t - Allow prelink_cron_system_t to getpw calls - Allow sudo domains to manage kerberos rcache files - Allow user_mail_domains to work with courie - Port definitions necessary for running jboss apps within openshift - Add support for openstack-nova-metadata-api - Add support for nova-console* - Add support for openstack-nova-xvpvncproxy - Fixes to make privsep+SELinux working if we try to use chage to change passwd - Fix auth_role() interface - Allow numad to read sysfs - Allow matahari-rpcd to execute shell - Add label for ~/.spicec - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it - Devicekit_disk wants to read the logind sessions file when writing a cd - Add fixes for condor to make condor jobs working correctly - Change label of /var/log/rpmpkgs to cron_log_t - Access requires to allow systemd-tmpfiles --create to work. - Fix obex to be a user application started by the session bus. - Add additional filename trans rules for kerberos - Fix /var/run/heartbeat labeling - Allow apps that are managing rcache to file trans correctly - Allow openvpn to authenticate against ldap server - Containers need to listen to network starting and stopping events- Make systemd unit files less specific- Fix zarafa labeling - Allow guest_t to fix labeling - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean - add lxc_contexts - Allow accountsd to read /proc - Allow restorecond to getattr on all file sytems - tmpwatch now calls getpw - Allow apache daemon to transition to pwauth domain - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t - The obex socket seems to be a stream socket - dd label for /var/run/nologin- Allow jetty running as httpd_t to read hugetlbfs files - Allow sys_nice and setsched for rhsmcertd - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports - Allow setfiles to append to xdm_tmp_t - Add labeling for /export as a usr_t directory - Add labels for .grl files created by gstreamer- Add labeling for /usr/share/jetty/bin/jetty.sh - Add jetty policy which contains file type definitios - Allow jockey to use its own fifo_file and make this the default for all domains - Allow mozilla_plugins to use spice (vnc_port/couchdb) - asterisk wants to read the network state - Blueman now uses /var/lib/blueman- Add label for nodejs_debug - Allow mozilla_plugin_t to create ~/.pki directory and content- Add clamscan_can_scan_system boolean - Allow mysqld to read kernel network state - Allow sshd to read/write condor lib files - Allow sshd to read/write condor-startd tcp socket - Fix description on httpd_graceful_shutdown - Allow glance_registry to communicate with mysql - dbus_system_domain is using systemd to lauch applications - add interfaces to allow domains to send kill signals to user mail agents - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t - Lots of new access required for secure containers - Corosync needs sys_admin capability - ALlow colord to create shm - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific - Add boolean to control whether or not mozilla plugins can create random content in the users homedir - Add new interface to allow domains to list msyql_db directories, needed for libra - shutdown has to be allowed to delete etc_runtime_t - Fail2ban needs to read /etc/passwd - Allow ldconfig to create /var/cache/ldconfig - Allow tgtd to read hardware state information - Allow collectd to create packet socket - Allow chronyd to send signal to itself - Allow collectd to read /dev/random - Allow collectd to send signal to itself - firewalld needs to execute restorecon - Allow restorecon and other login domains to execute restorecon- Allow logrotate to getattr on systemd unit files - Add support for tor systemd unit file - Allow apmd to create /var/run/pm-utils with the correct label - Allow l2tpd to send sigkill to pppd - Allow pppd to stream connect to l2tpd - Add label for scripts in /etc/gdm/ - Allow systemd_logind_t to ignore mcs constraints on sigkill - Fix files_filetrans_system_conf_named_files() interface - Add labels for /usr/share/wordpress/wp-includes/*.php - Allow cobbler to get SELinux mode and booleans- Add unconfined_execmem_exec_t as an alias to bin_t - Allow fenced to read snmp var lib files, also allow it to read usr_t - ontaudit access checks on all executables from mozilla_plugin - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode - Allow systemd_tmpfiles_t to getattr all pipes and sockets - Allow glance-registry to send system log messages - semanage needs to manage mock lib files/dirs- Add policy for abrt-watch-log - Add definitions for jboss_messaging ports - Allow systemd_tmpfiles to manage printer devices - Allow oddjob to use nsswitch - Fix labeling of log files for postgresql - Allow mozilla_plugin_t to execmem and execstack by default - Allow firewalld to execute shell - Fix /etc/wicd content files to get created with the correct label - Allow mcelog to exec shell - Add ~/.orc as a gstreamer_home_t - /var/spool/postfix/lib64 should be labeled lib_t - mpreaper should be able to list all file system labeled directories - Add support for apache to use openstack - Add labeling for /etc/zipl.conf and zipl binary - Turn on allow_execstack and turn off telepathy transition for final release- More access required for virt_qmf_t - Additional assess required for systemd-logind to support multi-seat - Allow mozilla_plugin to setrlimit - Revert changes to fuse file system to stop deadlock- Allow condor domains to connect to ephemeral ports - More fixes for condor policy - Allow keystone to stream connect to mysqld - Allow mozilla_plugin_t to read generic USB device to support GPS devices - Allow thum to file name transition gstreamer home content - Allow thum to read all non security files - Allow glance_api_t to connect to ephemeral ports - Allow nagios plugins to read /dev/urandom - Allow syslogd to search postfix spool to support postfix chroot env - Fix labeling for /var/spool/postfix/dev - Allow wdmd chown - Label .esd_auth as pulseaudio_home_t - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now- Add support for clamd+systemd - Allow fresclam to execute systemctl to handle clamd - Change labeling for /usr/sbin/rpc.ypasswd.env - Allow yppaswd_t to execute yppaswd_exec_t - Allow yppaswd_t to read /etc/passwd - Gnomekeyring socket has been moved to /run/user/USER/ - Allow samba-net to connect to ldap port - Allow signal for vhostmd - allow mozilla_plugin_t to read user_home_t socket - New access required for secure Linux Containers - zfs now supports xattrs - Allow quantum to execute sudo and list sysfs - Allow init to dbus chat with the firewalld - Allow zebra to read /etc/passwd- Allow svirt_t to create content in the users homedir under ~/.libvirt - Fix label on /var/lib/heartbeat - Allow systemd_logind_t to send kill signals to all processes started by a user - Fuse now supports Xattr Support- upowered needs to setsched on the kernel - Allow mpd_t to manage log files - Allow xdm_t to create /var/run/systemd/multi-session-x - Add rules for missedfont.log to be used by thumb.fc - Additional access required for virt_qmf_t - Allow dhclient to dbus chat with the firewalld - Add label for lvmetad - Allow systemd_logind_t to remove userdomain sock_files - Allow cups to execute usr_t files - Fix labeling on nvidia shared libraries - wdmd_t needs access to sssd and /etc/passwd - Add boolean to allow ftp servers to run in passive mode - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with - Fix using httpd_use_fusefs - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox- Rename rdate port to time port, and allow gnomeclock to connect to it - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda - /etc/auto.* should be labeled bin_t - Add httpd_use_fusefs boolean - Add fixes for heartbeat - Allow sshd_t to signal processes that it transitions to - Add condor policy - Allow svirt to create monitors in ~/.libvirt - Allow dovecot to domtrans sendmail to handle sieve scripts - Lot of fixes for cfengine- /var/run/postmaster.* labeling is no longer needed - Alllow drbdadmin to read /dev/urandom - l2tpd_t seems to use ptmx - group+ and passwd+ should be labeled as /etc/passwd - Zarafa-indexer is a socket- Ensure lastlog is labeled correctly - Allow accountsd to read /proc data about gdm - Add fixes for tuned - Add bcfg2 fixes which were discovered during RHEL6 testing - More fixes for gnome-keyring socket being moved - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown - Fix description for files_dontaudit_read_security_files() interface- Add new policy and man page for bcfg2 - cgconfig needs to use getpw calls - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt - gnome-keyring wants to create a directory in cache_home_t - sanlock calls getpw- Add numad policy and numad man page - Add fixes for interface bugs discovered by SEWatch - Add /tmp support for squid - Add fix for #799102 * change default labeling for /var/run/slapd.* sockets - Make thumb_t as userdom_home_reader - label /var/lib/sss/mc same as pubconf, so getpw domains can read it - Allow smbspool running as cups_t to stream connect to nmbd - accounts needs to be able to execute passwd on behalf of users - Allow systemd_tmpfiles_t to delete boot flags - Allow dnssec_trigger to connect to apache ports - Allow gnome keyring to create sock_files in ~/.cache - google_authenticator is using .google_authenticator - sandbox running from within firefox is exposing more leaks - Dontaudit thumb to read/write /dev/card0 - Dontaudit getattr on init_exec_t for gnomeclock_t - Allow certmonger to do a transition to certmonger_unconfined_t - Allow dhcpc setsched which is caused by nmcli - Add rpm_exec_t for /usr/sbin/bcfg2 - system cronjobs are sending dbus messages to systemd_logind - Thumnailers read /dev/urand- Allow auditctl getcap - Allow vdagent to use libsystemd-login - Allow abrt-dump-oops to search /etc/abrt - Got these avc's while trying to print a boarding pass from firefox - Devicekit is now putting the media directory under /run/media - Allow thumbnailers to create content in ~/.thumbails directory - Add support for proL2TPd by Dominick Grift - Allow all domains to call getcap - wdmd seems to get a random chown capability check that it does not need - Allow vhostmd to read kernel sysctls- Allow chronyd to read unix - Allow hpfax to read /etc/passwd - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them - Allow rpcd to read quota_db_t - Update to man pages to match latest policy - Fix bug in jockey interface for sepolgen-ifgen - Add initial svirt_prot_exec_t policy- More fixes for systemd from Dan Walsh- Add a new type for /etc/firewalld and allow firewalld to write to this directory - Add definition for ~/Maildir, and allow mail deliver domains to write there - Allow polipo to run from a cron job - Allow rtkit to schedule wine processes - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label - Allow users domains to send signals to consolehelper domains- More fixes for boinc policy - Allow polipo domain to create its own cache dir and pid file - Add systemctl support to httpd domain - Add systemctl support to polipo, allow NetworkManager to manage the service - Add policy for jockey-backend - Add support for motion daemon which is now covered by zoneminder policy - Allow colord to read/write motion tmpfs - Allow vnstat to search through var_lib_t directories - Stop transitioning to quota_t, from init an sysadm_t- Add svirt_lxc_file_t as a customizable type- Add additional fixes for icmp nagios plugin - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin - Add certmonger_unconfined_exec_t - Make sure tap22 device is created with the correct label - Allow staff users to read systemd unit files - Merge in previously built policy - Arpwatch needs to be able to start netlink sockets in order to start - Allow cgred_t to sys_ptrace to look at other DAC Processes- Back port some of the access that was allowed in nsplugin_t - Add definitiona for couchdb ports - Allow nagios to use inherited users ttys - Add git support for mock - Allow inetd to use rdate port - Add own type for rdate port - Allow samba to act as a portmapper - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev - New fixes needed for samba4 - Allow apps that use lib_t to read lib_t symlinks- Add policy for nove-cert - Add labeling for nova-openstack systemd unit files - Add policy for keystoke- Fix man pages fro domains - Add man pages for SELinux users and roles - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon - Add policy for matahari-rpcd - nfsd executes mount command on restart - Matahari domains execute renice and setsched - Dontaudit leaked tty in mozilla_plugin_config - mailman is changing to a per instance naming - Add 7600 and 4447 as jboss_management ports - Add fixes for nagios event handlers - Label httpd.event as httpd_exec_t, it is an apache daemon- Add labeling for /var/spool/postfix/dev/log - NM reads sysctl.conf - Iscsi log file context specification fix - Allow mozilla plugins to send dbus messages to user domains that transition to it - Allow mysql to read the passwd file - Allow mozilla_plugin_t to create mozilla home dirs in user homedir - Allow deltacloud to read kernel sysctl - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself - Allow postgresql_t to connectto itself - Add login_userdomain attribute for users which can log in using terminal- Allow sysadm_u to reach system_r by default #784011 - Allow nagios plugins to use inherited user terminals - Razor labeling is not used no longer - Add systemd support for matahari - Add port_types to man page, move booleans to the top, fix some english - Add support for matahari-sysconfig-console - Clean up matahari.fc - Fix matahari_admin() interfac - Add labels for/etc/ssh/ssh_host_*.pub keys- Allow ksysguardproces to send system log msgs - Allow boinc setpgid and signull - Allow xdm_t to sys_ptrace to run pidof command - Allow smtpd_t to manage spool files/directories and symbolic links - Add labeling for jetty - Needed changes to get unbound/dnssec to work with openswan- Add user_fonts_t alias xfs_tmp_t - Since depmod now runs as insmod_t we need to write to kernel_object_t - Allow firewalld to dbus chat with networkmanager - Allow qpidd to connect to matahari ports - policykit needs to read /proc for uses not owned by it - Allow systemctl apps to connecto the init stream- Turn on deny_ptrace boolean- Remove pam_selinux.8 man page. There was a conflict.- Add proxy class and read access for gssd_proxy - Separate out the sharing public content booleans - Allow certmonger to execute a script and send signals to apache and dirsrv to reload the certificate - Add label transition for gstream-0.10 and 12 - Add booleans to allow rsync to share nfs and cifs file sytems - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it - Fix filename transitions for cups files - Allow denyhosts to read "unix" - Add file name transition for locale.conf.new - Allow boinc projects to gconf config files - sssd needs to be able to increase the socket limit under certain loads - sge_execd needs to read /etc/passwd - Allow denyhost to check network state - NetworkManager needs to read sessions data - Allow denyhost to check network state - Allow xen to search virt images directories - Add label for /dev/megaraid_sas_ioctl_node - Add autogenerated man pages- Allow boinc project to getattr on fs - Allow init to execute initrc_state_t - rhev-agent package was rename to ovirt-guest-agent - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly - sytemd writes content to /run/initramfs and executes it on shutdown - kdump_t needs to read /etc/mtab, should be back ported to F16 - udev needs to load kernel modules in early system boot- Need to add sys_ptrace back in since reading any content in /proc can cause these accesses - Add additional systemd interfaces which are needed fro *_admin interfaces - Fix bind_admin() interface- Allow firewalld to read urand - Alias java, execmem_mono to bin_t to allow third parties - Add label for kmod - /etc/redhat-lsb contains binaries - Add boolean to allow gitosis to send mail - Add filename transition also for "event20" - Allow systemd_tmpfiles_t to delete all file types - Allow collectd to ipc_lock- make consoletype_exec optional, so we can remove consoletype policy - remove unconfined_permisive.patch - Allow openvpn_t to inherit user home content and tmp content - Fix dnssec-trigger labeling - Turn on obex policy for staff_t - Pem files should not be secret - Add lots of rules to fix AVC's when playing with containers - Fix policy for dnssec - Label ask-passwd directories correctly for systemd- sshd fixes seem to be causing unconfined domains to dyntrans to themselves - fuse file system is now being mounted in /run/user - systemd_logind is sending signals to processes that are dbus messaging with it - Add support for winshadow port and allow iscsid to connect to this port - httpd should be allowed to bind to the http_port_t udp socket - zarafa_var_lib_t can be a lnk_file - A couple of new .xsession-errors files - Seems like user space and login programs need to read logind_sessions_files - Devicekit disk seems to be being launched by systemd - Cleanup handling of setfiles so most of rules in te file - Correct port number for dnssec - logcheck has the home dir set to its cache- Add policy for grindengine MPI jobs- Add new sysadm_secadm.pp module * contains secadm definition for sysadm_t - Move user_mail_domain access out of the interface into the te file - Allow httpd_t to create httpd_var_lib_t directories as well as files - Allow snmpd to connect to the ricci_modcluster stream - Allow firewalld to read /etc/passwd - Add auth_use_nsswitch for colord - Allow smartd to read network state - smartdnotify needs to read /etc/group- Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory - lxdm startup scripts should be labeled bin_t, so confined users will work - mcstransd now creates a pid, needs back port to F16 - qpidd should be allowed to connect to the amqp port - Label devices 010-029 as usb devices - ypserv packager says ypserv does not use tmp_t so removing selinux policy types - Remove all ptrace commands that I believe are caused by the kernel/ps avcs - Add initial Obex policy - Add logging_syslogd_use_tty boolean - Add polipo_connect_all_unreserved bolean - Allow zabbix to connect to ftp port - Allow systemd-logind to be able to switch VTs - Allow apache to communicate with memcached through a sock_file- Fix file_context.subs_dist for now to work with pre usrmove- More /usr move fixes- Add zabbix_can_network boolean - Add httpd_can_connect_zabbix boolean - Prepare file context labeling for usrmove functions - Allow system cronjobs to read kernel network state - Add support for selinux_avcstat munin plugin - Treat hearbeat with corosync policy - Allow corosync to read and write to qpidd shared mem - mozilla_plugin is trying to run pulseaudio - Fixes for new sshd patch for running priv sep domains as the users context - Turn off dontaudit rules when turning on allow_ypbind - udev now reads /etc/modules.d directory- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out - Cups exchanges dbus messages with init - udisk2 needs to send syslog messages - certwatch needs to read /etc/passwd- Add labeling for udisks2 - Allow fsadmin to communicate with the systemd process- Treat Bip with bitlbee policy * Bip is an IRC proxy - Add port definition for interwise port - Add support for ipa_memcached socket - systemd_jounald needs to getattr on all processes - mdadmin fixes * uses getpw - amavisd calls getpwnam() - denyhosts calls getpwall()- Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there - bluetooth says they do not use /tmp and want to remove the type - Allow init to transition to colord - Mongod needs to read /proc/sys/vm/zone_reclaim_mode - Allow postfix_smtpd_t to connect to spamd - Add boolean to allow ftp to connect to all ports > 1023 - Allow sendmain to write to inherited dovecot tmp files - setroubleshoot needs to be able to execute rpm to see what version of packages- Merge systemd patch - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online - Allow deltacloudd dac_override, setuid, setgid caps - Allow aisexec to execute shell - Add use_nfs_home_dirs boolean for ssh-keygen- Fixes to make rawhide boot in enforcing mode with latest systemd changes- Add labeling for /var/run/systemd/journal/syslog - libvirt sends signals to ifconfig - Allow domains that read logind session files to list them- Fixed destined form libvirt-sandbox - Allow apps that list sysfs to also read sympolicy links in this filesystem - Add ubac_constrained rules for chrome_sandbox - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra - Allow postgresql to be executed by the caller - Standardize interfaces of daemons - Add new labeling for mm-handler - Allow all matahari domains to read network state and etc_runtime_t files- New fix for seunshare, requires seunshare_domains to be able to mounton / - Allow systemctl running as logrotate_t to connect to private systemd socket - Allow tmpwatch to read meminfo - Allow rpc.svcgssd to read supported_krb5_enctype - Allow zarafa domains to read /dev/random and /dev/urandom - Allow snmpd to read dev_snmp6 - Allow procmail to talk with cyrus - Add fixes for check_disk and check_nagios plugins- default trans rules for Rawhide policy - Make sure sound_devices controlC* are labeled correctly on creation - sssd now needs sys_admin - Allow snmp to read all proc_type - Allow to setup users homedir with quota.group- Add httpd_can_connect_ldap() interface - apcupsd_t needs to use seriel ports connected to usb devices - Kde puts procmail mail directory under ~/.local/share - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now - Add labeling for /sbin/iscsiuio- Add label for /var/lib/iscan/interpreter - Dont audit writes to leaked file descriptors or redirected output for nacl - NetworkManager needs to write to /sys/class/net/ib*/mode- Allow abrt to request the kernel to load a module - Make sure mozilla content is labeled correctly - Allow tgtd to read system state - More fixes for boinc * allow to resolve dns name * re-write boinc policy to use boinc_domain attribute - Allow munin services plugins to use NSCD services- Allow mozilla_plugin_t to manage mozilla_home_t - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain - Add label for tumblerd- Fixes for xguest package- Fixes related to /bin, /sbin - Allow abrt to getattr on blk files - Add type for rhev-agent log file - Fix labeling for /dev/dmfm - Dontaudit wicd leaking - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it - Label /etc/locale.conf correctly - Allow user_mail_t to read /dev/random - Allow postfix-smtpd to read MIMEDefang - Add label for /var/log/suphp.log - Allow swat_t to connect and read/write nmbd_t sock_file - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf - Allow systemd-tmpfiles to change user identity in object contexts - More fixes for rhev_agentd_t consolehelper policy- Use fs_use_xattr for squashf - Fix procs_type interface - Dovecot has a new fifo_file /var/run/dovecot/stats-mail - Dovecot has a new fifo_file /var/run/stats-mail - Colord does not need to connect to network - Allow system_cronjob to dbus chat with NetworkManager - Puppet manages content, want to make sure it labels everything correctly- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it - Allow all postfix domains to use the fifo_file - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t - Allow apmd_t to read grub.cfg - Let firewallgui read the selinux config - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp - Fix devicekit_manage_pid_files() interface - Allow squid to check the network state - Dontaudit colord getattr on file systems - Allow ping domains to read zabbix_tmp_t files- Allow mcelog_t to create dir and file in /var/run and label it correctly - Allow dbus to manage fusefs - Mount needs to read process state when mounting gluster file systems - Allow collectd-web to read collectd lib files - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr - Allow colord to get the attributes of tmpfs filesystem - Add sanlock_use_nfs and sanlock_use_samba booleans - Add bin_t label for /usr/lib/virtualbox/VBoxManage- Add ssh_dontaudit_search_home_dir - Changes to allow namespace_init_t to work - Add interface to allow exec of mongod, add port definition for mongod port, 27017 - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t - Allow spamd and clamd to steam connect to each other - Add policy label for passwd.OLD - More fixes for postfix and postfix maildro - Add ftp support for mozilla plugins - Useradd now needs to manage policy since it calls libsemanage - Fix devicekit_manage_log_files() interface - Allow colord to execute ifconfig - Allow accountsd to read /sys - Allow mysqld-safe to execute shell - Allow openct to stream connect to pcscd - Add label for /var/run/nm-dns-dnsmasq\.conf - Allow networkmanager to chat with virtd_t- Pulseaudio changes - Merge patches- Merge patches back into git repository.- Remove allow_execmem boolean and replace with deny_execmem boolean- Turn back on allow_execmem boolean- Add more MCS fixes to make sandbox working - Make faillog MLS trusted to make sudo_$1_t working - Allow sandbox_web_client_t to read passwd_file_t - Add .mailrc file context - Remove execheap from openoffice domain - Allow chrome_sandbox_nacl_t to read cpu_info - Allow virtd to relabel generic usb which is need if USB device - Fixes for virt.if interfaces to consider chr_file as image file type- Remove Open Office policy - Remove execmem policy- MCS fixes - quota fixes- Remove transitions to consoletype- Make nvidia* to be labeled correctly - Fix abrt_manage_cache() interface - Make filetrans rules optional so base policy will build - Dontaudit chkpwd_t access to inherited TTYS - Make sure postfix content gets created with the correct label - Allow gnomeclock to read cgroup - Fixes for cloudform policy- Check in fixed for Chrome nacl support- Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_overide to communicate with users TTY's - Allow svirt_lxc domains to send kill signals within their container- Remove qemu.pp again without causing a crash- Remove qemu.pp, everything should use svirt_t or stay in its current domain- Allow policykit to talk to the systemd via dbus - Move chrome_sandbox_nacl_t to permissive domains - Additional rules for chrome_sandbox_nacl- Change bootstrap name to nacl - Chrome still needs execmem - Missing role for chrome_sandbox_bootstrap - Add boolean to remove execmem and execstack from virtual machines - Dontaudit xdm_t doing an access_check on etc_t directories- Allow named to connect to dirsrv by default - add ldapmap1_0 as a krb5_host_rcache_t file - Google chrome developers asked me to add bootstrap policy for nacl stuff - Allow rhev_agentd_t to getattr on mountpoints - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets- Fixes for cloudform policies which need to connect to random ports - Make sure if an admin creates modules content it creates them with the correct label - Add port 8953 as a dns port used by unbound - Fix file name transition for alsa and confined users- Turn on mock_t and thumb_t for unconfined domains- Policy update should not modify local contexts- Remove ada policy- Remove tzdata policy - Add labeling for udev - Add cloudform policy - Fixes for bootloader policy- Add policies for nova openstack- Add fixes for nova-stack policy- Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain - Allow init process to setrlimit on itself - Take away transition rules for users executing ssh-keygen - Allow setroubleshoot_fixit_t to read /dev/urand - Allow sshd to relbale tunnel sockets - Allow fail2ban domtrans to shorewall in the same way as with iptables - Add support for lnk files in the /var/lib/sssd directory - Allow system mail to connect to courier-authdaemon over an unix stream socket- Add passwd_file_t for /etc/ptmptmp- Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK) - Make corosync to be able to relabelto cluster lib fies - Allow samba domains to search /var/run/nmbd - Allow dirsrv to use pam - Allow thumb to call getuid - chrome less likely to get mmap_zero bug so removing dontaudit - gimp help-browser has built in javascript - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t - Re-write glance policy- Move dontaudit sys_ptrace line from permissive.te to domain.te - Remove policy for hal, it no longer exists- Don't check md5 size or mtime on certain config files- Remove allow_ptrace and replace it with deny_ptrace, which will remove all ptrace from the system - Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;- Fixes for bootloader policy - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore - Allow nsplugin to read /usr/share/config - Allow sa-update to update rules - Add use_fusefs_home_dirs for chroot ssh option - Fixes for grub2 - Update systemd_exec_systemctl() interface - Allow gpg to read the mail spool - More fixes for sa-update running out of cron job - Allow ipsec_mgmt_t to read hardware state information - Allow pptp_t to connect to unreserved_port_t - Dontaudit getattr on initctl in /dev from chfn - Dontaudit getattr on kernel_core from chfn - Add systemd_list_unit_dirs to systemd_exec_systemctl call - Fixes for collectd policy - CHange sysadm_t to create content as user_tmp_t under /tmp- Shrink size of policy through use of attributes for userdomain and apache- Allow virsh to read xenstored pid file - Backport corenetwork fixes from upstream - Do not audit attempts by thumb to search config_home_t dirs (~/.config) - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t - allow thumb to read generic data home files (mime.type)- Allow nmbd to manage sock file in /var/run/nmbd - ricci_modservice send syslog msgs - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly - Allow systemd_logind_t to manage /run/USER/dconf/user- Fix missing patch from F16- Allow logrotate setuid and setgid since logrotate is supposed to do it - Fixes for thumb policy by grift - Add new nfsd ports - Added fix to allow confined apps to execmod on chrome - Add labeling for additional vdsm directories - Allow Exim and Dovecot SASL - Add label for /var/run/nmbd - Add fixes to make virsh and xen working together - Colord executes ls - /var/spool/cron is now labeled as user_cron_spool_t- Stop complaining about leaked file descriptors during install- Remove java and mono module and merge into execmem- Fixes for thumb policy and passwd_file_t- Fixes caused by the labeling of /etc/passwd - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide- Add support for Clustered Samba commands - Allow ricci_modrpm_t to send log msgs - move permissive virt_qmf_t from virt.te to permissivedomains.te - Allow ssh_t to use kernel keyrings - Add policy for libvirt-qmf and more fixes for linux containers - Initial Polipo - Sanlock needs to run ranged in order to kill svirt processes - Allow smbcontrol to stream connect to ctdbd- Add label for /etc/passwd- Change unconfined_domains to permissive for Rawhide - Add definition for the ephemeral_ports- Make mta_role() active - Allow asterisk to connect to jabber client port - Allow procmail to read utmp - Add NIS support for systemd_logind_t - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t - Fix systemd_manage_unit_dirs() interface - Allow ssh_t to manage directories passed into it - init needs to be able to create and delete unit file directories - Fix typo in apache_exec_sys_script - Add ability for logrotate to transition to awstat domain- Change screen to use screen_domain attribute and allow screen_domains to read all process domain state - Add SELinux support for ssh pre-auth net process in F17 - Add logging_syslogd_can_sendmail boolean- Add definition for ephemeral ports - Define user_tty_device_t as a customizable_type- Needs to require a new version of checkpolicy - Interface fixes- Allow sanlock to manage virt lib files - Add virt_use_sanlock booelan - ksmtuned is trying to resolve uids - Make sure .gvfs is labeled user_home_t in the users home directory - Sanlock sends kill signals and needs the kill capability - Allow mockbuild to work on nfs homedirs - Fix kerberos_manage_host_rcache() interface - Allow exim to read system state- Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t- Allow collectd to read hardware state information - Add loop_control_device_t - Allow mdadm to request kernel to load module - Allow domains that start other domains via systemctl to search unit dir - systemd_tmpfiles, needs to list any file systems mounted on /tmp - No one can explain why radius is listing the contents of /tmp, so we will dontaudit - If I can manage etc_runtime files, I should be able to read the links - Dontaudit hostname writing to mock library chr_files - Have gdm_t setup labeling correctly in users home dir - Label content unde /var/run/user/NAME/dconf as config_home_t - Allow sa-update to execute shell - Make ssh-keygen working with fips_enabled - Make mock work for staff_t user - Tighten security on mock_t- removing unconfined_notrans_t no longer necessary - Clean up handling of secure_mode_insmod and secure_mode_policyload - Remove unconfined_mount_t- Add exim_exec_t label for /usr/sbin/exim_tidydb - Call init_dontaudit_rw_stream_socket() interface in mta policy - sssd need to search /var/cache/krb5rcache directory - Allow corosync to relabel own tmp files - Allow zarafa domains to send system log messages - Allow ssh to do tunneling - Allow initrc scripts to sendto init_t unix_stream_socket - Changes to make sure dmsmasq and virt directories are labeled correctly - Changes needed to allow sysadm_t to manage systemd unit files - init is passing file descriptors to dbus and on to system daemons - Allow sulogin additional access Reported by dgrift and Jeremy Miller - Steve Grubb believes that wireshark does not need this access - Fix /var/run/initramfs to stop restorecon from looking at - pki needs another port - Add more labels for cluster scripts - Allow apps that manage cgroup_files to manage cgroup link files - Fix label on nfs-utils scripts directories - Allow gatherd to read /dev/rand and /dev/urand- pki needs another port - Add more labels for cluster scripts - Fix label on nfs-utils scripts directories - Fixes for cluster - Allow gatherd to read /dev/rand and /dev/urand - abrt leaks fifo files- Add glance policy - Allow mdadm setsched - /var/run/initramfs should not be relabeled with a restorecon run - memcache can be setup to override sys_resource - Allow httpd_t to read tetex data - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.- Allow Postfix to deliver to Dovecot LMTP socket - Ignore bogus sys_module for lldpad - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock - systemd_logind_t sets the attributes on usb devices - Allow hddtemp_t to read etc_t files - Add permissivedomains module - Move all permissive domains calls to permissivedomain.te - Allow pegasis to send kill signals to other UIDs- Allow insmod_t to use fds leaked from devicekit - dontaudit getattr between insmod_t and init_t unix_stream_sockets - Change sysctl unit file interfaces to use systemctl - Add support for chronyd unit file - Allow mozilla_plugin to read gnome_usr_config - Add policy for new gpsd - Allow cups to create kerberos rhost cache files - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly- Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten- Add policy for sa-update being run out of cron jobs - Add create perms to postgresql_manage_db - ntpd using a gps has to be able to read/write generic tty_device_t - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev - fix spec file - Remove qemu_domtrans_unconfined() interface - Make passenger working together with puppet - Add init_dontaudit_rw_stream_socket interface - Fixes for wordpress- Turn on allow_domain_fd_use boolean on F16 - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Add abrt_handle_event_t domain for ABRT event scripts - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change - Allow httpd_git_script_t to read passwd data - Allow openvpn to set its process priority when the nice parameter is used- livecd fixes - spec file fixes- fetchmail can use kerberos - ksmtuned reads in shell programs - gnome_systemctl_t reads the process state of ntp - dnsmasq_t asks the kernel to load multiple kernel modules - Add rules for domains executing systemctl - Bogus text within fc file- Add cfengine policy- Add abrt_domain attribute - Allow corosync to manage cluster lib files - Allow corosync to connect to the system DBUS- Add sblim, uuidd policies - Allow kernel_t dyntrasition to init_t- init_t need setexec - More fixes of rules which cause an explosion in rules by Dan Walsh- Allow rcsmcertd to perform DNS name resolution - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts - Allow tmux to run as screen - New policy for collectd - Allow gkeyring_t to interact with all user apps - Add rules to allow firstboot to run on machines with the unconfined.pp module removed- Allow systemd_logind to send dbus messages with users - allow accountsd to read wtmp file - Allow dhcpd to get and set capabilities- Fix oracledb_port definition - Allow mount to mounton the selinux file system - Allow users to list /var directories- systemd fixes- Add initial policy for abrt_dump_oops_t - xtables-multi wants to getattr of the proc fs - Smoltclient is connecting to abrt - Dontaudit leaked file descriptors to postdrop - Allow abrt_dump_oops to look at kernel sysctls - Abrt_dump_oops_t reads kernel ring buffer - Allow mysqld to request the kernel to load modules - systemd-login needs fowner - Allow postfix_cleanup_t to searh maildrop- Initial systemd_logind policy - Add policy for systemd_logger and additional proivs for systemd_logind - More fixes for systemd policies- Allow setsched for virsh - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories - iptables: the various /sbin/ip6?tables.* are now symlinks for /sbin/xtables-multi- A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit - Allow colord to interact with the users through the tmpfs file system - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files - Add label for /var/log/mcelog - Allow asterisk to read /dev/random if it uses TLS - Allow colord to read ini files which are labeled as bin_t - Allow dirsrvadmin sys_resource and setrlimit to use ulimit - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first. - Also lists /var and /var/spool directories - Add openl2tpd to l2tpd policy - qpidd is reading the sysfs file- Change usbmuxd_t to dontaudit attempts to read chr_file - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains - Allow pppd to search /var/lock dir - Add rhsmcertd policy- Update to upstream- More fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git- Fix spec file to not report Verify errors- Add dspam policy - Add lldpad policy - dovecot auth wants to search statfs #713555 - Allow systemd passwd apps to read init fifo_file - Allow prelink to use inherited terminals - Run cherokee in the httpd_t domain - Allow mcs constraints on node connections - Implement pyicqt policy - Fixes for zarafa policy - Allow cobblerd to send syslog messages- Add policy.26 to the payload - Remove olpc stuff - Remove policygentool- Fixes for zabbix - init script needs to be able to manage sanlock_var_run_... - Allow sandlock and wdmd to create /var/run directories... - mixclip.so has been compiled correctly - Fix passenger policy module name- Add mailscanner policy from dgrift - Allow chrome to optionally be transitioned to - Zabbix needs these rules when starting the zabbix_server_mysql - Implement a type for freedesktop openicc standard (~/.local/share/icc) - Allow system_dbusd_t to read inherited icc_data_home_t files. - Allow colord_t to read icc_data_home_t content. #706975 - Label stuff under /usr/lib/debug as if it was labeled under /- Fixes for sanlock policy - Fixes for colord policy - Other fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Add rhev policy module to modules-targeted.conf- Lot of fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Allow logrotate to execute systemctl - Allow nsplugin_t to getattr on gpmctl - Fix dev_getattr_all_chr_files() interface - Allow shorewall to use inherited terms - Allow userhelper to getattr all chr_file devices - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t - Fix labeling for ABRT Retrace Server- Dontaudit sys_module for ifconfig - Make telepathy and gkeyringd daemon working with confined users - colord wants to read files in users homedir - Remote login should be creating user_tmp_t not its own tmp files- Fix label for /usr/share/munin/plugins/munin_* plugins - Add support for zarafa-indexer - Fix boolean description - Allow colord to getattr on /proc/scsi/scsi - Add label for /lib/upstart/init - Colord needs to list /mnt- Forard port changes from F15 for telepathy - NetworkManager should be allowed to use /dev/rfkill - Fix dontaudit messages to say Domain to not audit - Allow telepathy domains to read/write gnome_cache files - Allow telepathy domains to call getpw - Fixes for colord and vnstatd policy- Allow init_t getcap and setcap - Allow namespace_init_t to use nsswitch - aisexec will execute corosync - colord tries to read files off noxattr file systems - Allow init_t getcap and setcap- Add support for ABRT retrace server - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners - Allow telepath_msn_t to read /proc/PARENT/cmdline - ftpd needs kill capability - Allow telepath_msn_t to connect to sip port - keyring daemon does not work on nfs homedirs - Allow $1_sudo_t to read default SELinux context - Add label for tgtd sock file in /var/run/ - Add apache_exec_rotatelogs interface - allow all zaraha domains to signal themselves, server writes to /tmp - Allow syslog to read the process state - Add label for /usr/lib/chromium-browser/chrome - Remove the telepathy transition from unconfined_t - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts - Allow initrc_t domain to manage abrt pid files - Add support for AEOLUS project - Virt_admin should be allowed to manage images and processes - Allow plymountd to send signals to init - Change labeling of fping6- Add filename transitions- Fixes for zarafa policy - Add support for AEOLUS project - Change labeling of fping6 - Allow plymountd to send signals to init - Allow initrc_t domain to manage abrt pid files - Virt_admin should be allowed to manage images and processes- xdm_t needs getsession for switch user - Every app that used to exec init is now execing systemdctl - Allow squid to manage krb5_host_rcache_t files - Allow foghorn to connect to agentx port - Fixes for colord policy- Add Dan's patch to remove 64 bit variants - Allow colord to use unix_dgram_socket - Allow apps that search pids to read /var/run if it is a lnk_file - iscsid_t creates its own directory - Allow init to list var_lock_t dir - apm needs to verify user accounts auth_use_nsswitch - Add labeling for systemd unit files - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added - Add label for matahari-broker.pid file - We want to remove untrustedmcsprocess from ability to read /proc/pid - Fixes for matahari policy - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on- Fix typo- Add /var/run/lock /var/lock definition to file_contexts.subs - nslcd_t is looking for kerberos cc files - SSH_USE_STRONG_RNG is 1 which requires /dev/random - Fix auth_rw_faillog definition - Allow sysadm_t to set attributes on fixed disks - allow user domains to execute lsof and look at application sockets - prelink_cron job calls telinit -u if init is rewritten - Fixes to run qemu_t from staff_t- Fix label for /var/run/udev to udev_var_run_t - Mock needs to be able to read network state- Add file_contexts.subs to handle /run and /run/lock - Add other fixes relating to /run changes from F15 policy- Allow $1_sudo_t and $1_su_t open access to user terminals - Allow initrc_t to use generic terminals - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs -systemd is going to be useing /run and /run/lock for early bootup files. - Fix some comments in rlogin.if - Add policy for KDE backlighthelper - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems - sssd wants to read .k5login file in users homedir - setroubleshoot reads executables to see if they have TEXTREL - Add /var/spool/audit support for new version of audit - Remove kerberos_connect_524() interface calling - Combine kerberos_master_port_t and kerberos_port_t - systemd has setup /dev/kmsg as stderr for apps it executes - Need these access so that init can impersonate sockets on unix_dgram_socket- Remove some unconfined domains - Remove permissive domains - Add policy-term.patch from Dan- Fix multiple specification for boot.log - devicekit leaks file descriptors to setfiles_t - Change all all_nodes to generic_node and all_if to generic_if - Should not use deprecated interface - Switch from using all_nodes to generic_node and from all_if to generic_if - Add support for xfce4-notifyd - Fix file context to show several labels as SystemHigh - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs - Add etc_runtime_t label for /etc/securetty - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly - login.krb needs to be able to write user_tmp_t - dirsrv needs to bind to port 7390 for dogtag - Fix a bug in gpg policy - gpg sends audit messages - Allow qpid to manage matahari files- Initial policy for matahari - Add dev_read_watchdog - Allow clamd to connect clamd port - Add support for kcmdatetimehelper - Allow shutdown to setrlimit and sys_nice - Allow systemd_passwd to talk to /dev/log before udev or syslog is running - Purge chr_file and blk files on /tmp - Fixes for pads - Fixes for piranha-pulse - gpg_t needs to be able to encyprt anything owned by the user- mozilla_plugin_tmp_t needs to be treated as user tmp files - More dontaudits of writes from readahead - Dontaudit readahead_t file_type:dir write, to cover up kernel bug - systemd_tmpfiles needs to relabel faillog directory as well as the file - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost- Add policykit fixes from Tim Waugh - dontaudit sandbox domains sandbox_file_t:dir mounton - Add new dontaudit rules for sysadm_dbusd_t - Change label for /var/run/faillock * other fixes which relate with this change- Update to upstream - Fixes for telepathy - Add port defition for ssdp port - add policy for /bin/systemd-notify from Dan - Mount command requires users read mount_var_run_t - colord needs to read konject_uevent_socket - User domains connect to the gkeyring socket - Add colord policy and allow user_t and staff_t to dbus chat with it - Add lvm_exec_t label for kpartx - Dontaudit reading the mail_spool_t link from sandbox -X - systemd is creating sockets in avahi_var_run and system_dbusd_var_run- gpg_t needs to talk to gnome-keyring - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd - enforce MCS labeling on nodes - Allow arpwatch to read meminfo - Allow gnomeclock to send itself signals - init relabels /dev/.udev files on boot - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t - dnsmasq can run as a dbus service, needs acquire service - mysql_admin should be allowed to connect to mysql service - virt creates monitor sockets in the users home dir- Allow usbhid-ups to read hardware state information - systemd-tmpfiles has moved - Allo cgroup to sys_tty_config - For some reason prelink is attempting to read gconf settings - Add allow_daemons_use_tcp_wrapper boolean - Add label for ~/.cache/wocky to make telepathy work in enforcing mode - Add label for char devices /dev/dasd* - Fix for apache_role - Allow amavis to talk to nslcd - allow all sandbox to read selinux poilcy config files - Allow cluster domains to use the system bus and send each other dbus messages- Update to upstream- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild- Update to ref policy - cgred needs chown capability - Add /dev/crash crash_dev_t - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability- New labeling for postfmulti #675654 - dontaudit xdm_t listing noxattr file systems - dovecot-auth needs to be able to connect to mysqld via the network as well as locally - shutdown is passed stdout to a xdm_log_t file - smartd creates a fixed disk device - dovecot_etc_t contains a lnk_file that domains need to read - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot- syslog_t needs syslog capability - dirsrv needs to be able to create /var/lib/snmp - Fix labeling for dirsrv - Fix for dirsrv policy missing manage_dirs_pattern - corosync needs to delete clvm_tmpfs_t files - qdiskd needs to list hugetlbfs - Move setsched to sandbox_x_domain, so firefox can run without network access - Allow hddtemp to read removable devices - Adding syslog and read_policy permissions to policy * syslog Allow unconfined, sysadm_t, secadm_t, logadm_t * read_policy allow unconfined, sysadm_t, secadm_t, staff_t on Targeted allow sysadm_t (optionally), secadm_t on MLS - mdadm application will write into /sys/.../uevent whenever arrays are assembled or disassembled.- Add tcsd policy- ricci_modclusterd_t needs to bind to rpc ports 500-1023 - Allow dbus to use setrlimit to increase resoueces - Mozilla_plugin is leaking to sandbox - Allow confined users to connect to lircd over unix domain stream socket which allow to use remote control - Allow awstats to read squid logs - seunshare needs to manage tmp_t - apcupsd cgi scripts have a new directory- Fix xserver_dontaudit_read_xdm_pid - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. * These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t - Allow readahead to manage readahead pid dirs - Allow readahead to read all mcs levels - Allow mozilla_plugin_t to use nfs or samba homedirs- Allow nagios plugin to read /proc/meminfo - Fix for mozilla_plugin - Allow samba_net_t to create /etc/keytab - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t - nslcd can read user credentials - Allow nsplugin to delete mozilla_plugin_tmpfs_t - abrt tries to create dir in rpm_var_lib_t - virt relabels fifo_files - sshd needs to manage content in fusefs homedir - mock manages link files in cache dir- nslcd needs setsched and to read /usr/tmp - Invalid call in likewise policy ends up creating a bogus role - Cannon puts content into /var/lib/bjlib that cups needs to be able to write - Allow screen to create screen_home_t in /root - dirsrv sends syslog messages - pinentry reads stuff in .kde directory - Add labels for .kde directory in homedir - Treat irpinit, iprupdate, iprdump services with raid policy- NetworkManager wants to read consolekit_var_run_t - Allow readahead to create /dev/.systemd/readahead - Remove permissive domains - Allow newrole to run namespace_init- Add sepgsql_contexts file- Update to upstream- Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on - Add puppetmaster_use_db boolean - Fixes for zarafa policy - Fixes for gnomeclock poliy - Fix systemd-tmpfiles to use auth_use_nsswitch- gnomeclock executes a shell - Update for screen policy to handle pipe in homedir - Fixes for polyinstatiated homedir - Fixes for namespace policy and other fixes related to polyinstantiation - Add namespace policy - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts - Fixes for init, psad policy which relate with confined users - Do not audit bootloader attempts to read devicekit pid files - Allow nagios service plugins to read /proc- Add firewalld policy - Allow vmware_host to read samba config - Kernel wants to read /proc Fix duplicate grub def in cobbler - Chrony sends mail, executes shell, uses fifo_file and reads /proc - devicekitdisk getattr all file systems - sambd daemon writes wtmp file - libvirt transitions to dmidecode- Add initial policy for system-setup-keyboard which is now daemon - Label /var/lock/subsys/shorewall as shorewall_lock_t - Allow users to communicate with the gpg_agent_t - Dontaudit mozilla_plugin_t using the inherited terminal - Allow sambagui to read files in /usr - webalizer manages squid log files - Allow unconfined domains to bind ports to raw_ip_sockets - Allow abrt to manage rpm logs when running yum - Need labels for /var/run/bittlebee - Label .ssh under amanda - Remove unused genrequires for virt_domain_template - Allow virt_domain to use fd inherited from virtd_t - Allow iptables to read shorewall config- Gnome apps list config_home_t - mpd creates lnk files in homedir - apache leaks write to mail apps on tmp files - /var/stockmaniac/templates_cache contains log files - Abrt list the connects of mount_tmp_t dirs - passwd agent reads files under /dev and reads utmp file - squid apache script connects to the squid port - fix name of plymouth log file - teamviewer is a wine app - allow dmesg to read system state - Stop labeling files under /var/lib/mock so restorecon will not go into this - nsplugin needs to read network state for google talk- Allow xdm and syslog to use /var/log/boot.log - Allow users to communicate with mozilla_plugin and kill it - Add labeling for ipv6 and dhcp- New labels for ghc http content - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy- Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot- Update selinux policy to handle new /usr/share/sandbox/start script- Update to upstream - Fix version of policy in spec file- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs - remove per sandbox domains devpts types - Allow dkim-milter sending signal to itself- Allow domains that transition to ping or traceroute, kill them - Allow user_t to conditionally transition to ping_t and traceroute_t - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup- Turn on systemd policy - mozilla_plugin needs to read certs in the homedir. - Dontaudit leaked file descriptors from devicekit - Fix ircssi to use auth_use_nsswitch - Change to use interface without param in corenet to disable unlabelednet packets - Allow init to relabel sockets and fifo files in /dev - certmonger needs dac* capabilities to manage cert files not owned by root - dovecot needs fsetid to change group membership on mail - plymouthd removes /var/log/boot.log - systemd is creating symlinks in /dev - Change label on /etc/httpd/alias to be all cert_t- Fixes for clamscan and boinc policy - Add boinc_project_t setpgid - Allow alsa to create tmp files in /tmp- Push fixes to allow disabling of unlabeled_t packet access - Enable unlabelednet policy- Fixes for lvm to work with systemd- Fix the label for wicd log - plymouthd creates force-display-on-active-vt file - Allow avahi to request the kernel to load a module - Dontaudit hal leaks - Fix gnome_manage_data interface - Add new interface corenet_packet to define a type as being an packet_type. - Removed general access to packet_type from icecast and squid. - Allow mpd to read alsa config - Fix the label for wicd log - Add systemd policy- Fix gnome_manage_data interface - Dontaudit sys_ptrace capability for iscsid - Fixes for nagios plugin policy- Fix cron to run ranged when started by init - Fix devicekit to use log files - Dontaudit use of devicekit_var_run_t for fstools - Allow init to setattr on logfile directories - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t- Fix up handling of dnsmasq_t creating /var/run/libvirt/network - Turn on sshd_forward_ports boolean by default - Allow sysadmin to dbus chat with rpm - Add interface for rw_tpm_dev - Allow cron to execute bin - fsadm needs to write sysfs - Dontaudit consoletype reading /var/run/pm-utils - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin - certmonger needs to manage dirsrv data - /var/run/pm-utils should be labeled as devicekit_var_run_t- fixes to allow /var/run and /var/lock as tmpfs - Allow chrome sandbox to connect to web ports - Allow dovecot to listem on lmtp and sieve ports - Allov ddclient to search sysctl_net_t - Transition back to original domain if you execute the shell- Remove duplicate declaration- Update to upstream - Cleanup for sandbox - Add attribute to be able to select sandbox types- Allow ddclient to fix file mode bits of ddclient conf file - init leaks file descriptors to daemons - Add labels for /etc/lirc/ and - Allow amavis_t to exec shell - Add label for gssd_tmp_t for /var/tmp/nfs_0- Put back in lircd_etc_t so policy will install- Turn on allow_postfix_local_write_mail_spool - Allow initrc_t to transition to shutdown_t - Allow logwatch and cron to mls_read_to_clearance for MLS boxes - Allow wm to send signull to all applications and receive them from users - lircd patch from field - Login programs have to read /etc/samba - New programs under /lib/systemd - Abrt needs to read config files- Update to upstream - Dontaudit leaked sockets from userdomains to user domains - Fixes for mcelog to handle scripts - Apply patch from Ruben Kerkhof - Allow syslog to search spool dirs- Allow nagios plugins to read usr files - Allow mysqld-safe to send system log messages - Fixes fpr ddclient policy - Fix sasl_admin interface - Allow apache to search zarafa config - Allow munin plugins to search /var/lib directory - Allow gpsd to read sysfs_t - Fix labels on /etc/mcelog/triggers to bin_t- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp - Fix xserver interface - Fix definition of /var/run/lxdm- Turn on mediawiki policy - kdump leaks kdump_etc_t to ifconfig, add dontaudit - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap- Allow groupd transition to fenced domain when executes fence_node - Fixes for rchs policy - Allow mpd to be able to read samba/nfs files- Fix up corecommands.fc to match upstream - Make sure /lib/systemd/* is labeled init_exec_t - mount wants to setattr on all mountpoints - dovecot auth wants to read dovecot etc files - nscd daemon looks at the exe file of the comunicating daemon - openvpn wants to read utmp file - postfix apps now set sys_nice and lower limits - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly - Also resolves nsswitch - Fix labels on /etc/hosts.* - Cleanup to make upsteam patch work - allow abrt to read etc_runtime_t- Add conflicts for dirsrv package- Update to upstream - Add vlock policy- Fix sandbox to work on nfs homedirs - Allow cdrecord to setrlimit - Allow mozilla_plugin to read xauth - Change label on systemd-logger to syslogd_exec_t - Install dirsrv policy from dirsrv package- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it - Udev needs to stream connect to init and kernel - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory- Allow NetworkManager to read openvpn_etc_t - Dontaudit hplip to write of /usr dirs - Allow system_mail_t to create /root/dead.letter as mail_home_t - Add vdagent policy for spice agent daemon- Dontaudit sandbox sending sigkill to all user domains - Add policy for rssh_chroot_helper - Add missing flask definitions - Allow udev to relabelto removable_t - Fix label on /var/log/wicd.log - Transition to initrc_t from init when executing bin_t - Add audit_access permissions to file - Make removable_t a device_node - Fix label on /lib/systemd/*- Fixes for systemd to manage /var/run - Dontaudit leaks by firstboot- Allow chome to create netlink_route_socket - Add additional MATHLAB file context - Define nsplugin as an application_domain - Dontaudit sending signals from sandboxed domains to other domains - systemd requires init to build /tmp /var/auth and /var/lock dirs - mount wants to read devicekit_power /proc/ entries - mpd wants to connect to soundd port - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit - Treat lib_t and textrel_shlib_t directories the same - Allow mount read access on virtual images- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs. - Allow devicekit_power to domtrans to mount - Allow dhcp to bind to udp ports > 1024 to do named stuff - Allow ssh_t to exec ssh_exec_t - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used - Fix clamav_append_log() intefaces - Fix 'psad_rw_fifo_file' interface- Allow cobblerd to list cobler appache content- Fixup for the latest version of upowed - Dontaudit sandbox sending SIGNULL to desktop apps- Update to upstream-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access - dovecot-auth_t needs ipc_lock - gpm needs to use the user terminal - Allow system_mail_t to append ~/dead.letter - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf - Add pid file to vnstatd - Allow mount to communicate with gfs_controld - Dontaudit hal leaks in setfiles- Lots of fixes for systemd - systemd now executes readahead and tmpwatch type scripts - Needs to manage random seed- Allow smbd to use sys_admin - Remove duplicate file context for tcfmgr - Update to upstream- Fix fusefs handling - Do not allow sandbox to manage nsplugin_rw_t - Allow mozilla_plugin_t to connecto its parent - Allow init_t to connect to plymouthd running as kernel_t - Add mediawiki policy - dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. - Disable transition from dbus_session_domain to telepathy for F14 - Allow boinc_project to use shm - Allow certmonger to search through directories that contain certs - Allow fail2ban the DAC Override so it can read log files owned by non root users- Start adding support for use_fusefs_home_dirs - Add /var/lib/syslog directory file context - Add /etc/localtime as locale file context- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user - Turn off iptables from unconfined user - Allow sudo to send signals to any domains the user could have transitioned to. - Passwd in single user mode needs to talk to console_device_t - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio - locate tried to read a symbolic link, will dontaudit - New labels for telepathy-sunshine content in homedir - Google is storing other binaries under /opt/google/talkplugin - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15 - modemmanger and bluetooth send dbus messages to devicekit_power - Samba needs to getquota on filesystems labeld samba_share_t- Dontaudit attempts by xdm_t to write to bin_t for kdm - Allow initrc_t to manage system_conf_t- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets - Allow confined users to read xdm_etc_t files - Allow xdm_t to transition to xauth_t for lxdm program- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home - Allow clamd to send signals to itself - Allow mozilla_plugin_t to read user home content. And unlink pulseaudio shm. - Allow haze to connect to yahoo chat and messenger port tcp:5050. Bz #637339 - Allow guest to run ps command on its processes by allowing it to read /proc - Allow firewallgui to sys_rawio which seems to be required to setup masqerading - Allow all domains to search through default_t directories, in order to find differnet labels. For example people serring up /foo/bar to be share via samba. - Add label for /var/log/slim.log- Pull in cleanups from dgrift - Allow mozilla_plugin_t to execute mozilla_home_t - Allow rpc.quota to do quotamod- Cleanup policy via dgrift - Allow dovecot_deliver to append to inherited log files - Lots of fixes for consolehelper- Fix up Xguest policy- Add vnstat policy - allow libvirt to send audit messages - Allow chrome-sandbox to search nfs_t- Update to upstream- Add the ability to send audit messages to confined admin policies - Remove permissive domain from cmirrord and dontaudit sys_tty_config - Split out unconfined_domain() calls from other unconfined_ calls so we can d - virt needs to be able to read processes to clearance for MLS- Allow all domains that can use cgroups to search tmpfs_t directory - Allow init to send audit messages- Update to upstream- Allow mdadm_t to create files and sock files in /dev/md/- Add policy for ajaxterm- Handle /var/db/sudo - Allow pulseaudio to read alsa config - Allow init to send initrc_t dbus messagesAllow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr intd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port- Merge upstream fix of mmap_zero - Allow mount to write files in debugfs_t - Allow corosync to communicate with clvmd via tmpfs - Allow certmaster to read usr_t files - Allow dbus system services to search cgroup_t - Define rlogind_t as a login pgm- Allow mdadm_t to read/write hugetlbfs- Dominic Grift Cleanup - Miroslav Grepl policy for jabberd - Various fixes for mount/livecd and prelink- Merge with upstream- More access needed for devicekit - Add dbadm policy- Merge with upstream- Allow seunshare to fowner- Allow cron to look at user_cron_spool links - Lots of fixes for mozilla_plugin_t - Add sysv file system - Turn unconfined domains to permissive to find additional avcs- Update policy for mozilla_plugin_t- Allow clamscan to read proc_t - Allow mount_t to write to debufs_t dir - Dontaudit mount_t trying to write to security_t dir- Allow clamscan_t execmem if clamd_use_jit set - Add policy for firefox plugin-container- Fix /root/.forward definition- label dead.letter as mail_home_t- Allow login programs to search /cgroups- Fix cert handling- Fix devicekit_power bug - Allow policykit_auth_t more access.- Fix nis calls to allow bind to ports 512-1024 - Fix smartmon- Allow pcscd to read sysfs - systemd fixes - Fix wine_mmap_zero_ignore boolean- Apply Miroslav munin patch - Turn back on allow_execmem and allow_execmod booleans- Merge in fixes from dgrift repository- Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0- New paths for upstart- New permissions for syslog - New labels for /lib/upstart- Add mojomojo policy- Allow systemd to setsockcon on sockets to immitate other services- Remove debugfs label- Update to latest policy- Fix eclipse labeling from IBMSupportAssasstant packageing- Make boot with systemd in enforcing mode- Update to upstream- Add boolean to turn off port forwarding in sshd.- Add support for ebtables - Fixes for rhcs and corosync policy-Update to upstream-Update to upstream-Update to upstream- Add Zarafa policy- Cleanup of aiccu policy - initial mock policy- Lots of random fixes- Update to upstream- Update to upstream - Allow prelink script to signal itself - Cobbler fixes- Add xdm_var_run_t to xserver_stream_connect_xdm - Add cmorrord and mpd policy from Miroslav Grepl- Fix sshd creation of krb cc files for users to be user_tmp_t- Fixes for accountsdialog - Fixes for boinc- Fix label on /var/lib/dokwiki - Change permissive domains to enforcing - Fix libvirt policy to allow it to run on mls- Update to upstream- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t - Fix /var/run/abrtd.lock label- Allow login programs to read krb5_home_t Resolves: 594833 - Add obsoletes for cachefilesfd-selinux package Resolves: #575084- Allow mount to r/w abrt fifo file - Allow svirt_t to getattr on hugetlbfs - Allow abrt to create a directory under /var/spool- Add labels for /sys - Allow sshd to getattr on shutdown - Fixes for munin - Allow sssd to use the kernel key ring - Allow tor to send syslog messages - Allow iptabels to read usr files - allow policykit to read all domains state- Fix path for /var/spool/abrt - Allow nfs_t as an entrypoint for http_sys_script_t - Add policy for piranha - Lots of fixes for sosreport- Allow xm_t to read network state and get and set capabilities - Allow policykit to getattr all processes - Allow denyhosts to connect to tcp port 9911 - Allow pyranha to use raw ip sockets and ptrace itself - Allow unconfined_execmem_t and gconfsd mechanism to dbus - Allow staff to kill ping process - Add additional MLS rules- Allow gdm to edit ~/.gconf dir Resolves: #590677 - Allow dovecot to create directories in /var/lib/dovecot Partially resolves 590224 - Allow avahi to dbus chat with NetworkManager - Fix cobbler labels - Dontaudit iceauth_t leaks - fix /var/lib/lxdm file context - Allow aiccu to use tun tap devices - Dontaudit shutdown using xserver.log- Fixes for sandbox_x_net_t to match access for sandbox_web_t ++ - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory - Add dontaudit interface for bluetooth dbus - Add chronyd_read_keys, append_keys for initrc_t - Add log support for ksmtuned Resolves: #586663- Allow boinc to send mail- Allow initrc_t to remove dhcpc_state_t - Fix label on sa-update.cron - Allow dhcpc to restart chrony initrc - Don't allow sandbox to send signals to its parent processes - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t Resolves: #589136- Fix location of oddjob_mkhomedir Resolves: #587385 - fix labeling on /root/.shosts and ~/.shosts - Allow ipsec_mgmt_t to manage net_conf_t Resolves: #586760- Dontaudit sandbox trying to connect to netlink sockets Resolves: #587609 - Add policy for piranha- Fixups for xguest policy - Fixes for running sandbox firefox- Allow ksmtuned to use terminals Resolves: #586663 - Allow lircd to write to generic usb devices- Allow sandbox_xserver to connectto unconfined stream Resolves: #585171- Allow initrc_t to read slapd_db_t Resolves: #585476 - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf Resolves: #585963- Allow rlogind_t to search /root for .rhosts Resolves: #582760 - Fix path for cached_var_t - Fix prelink paths /var/lib/prelink - Allow confined users to direct_dri - Allow mls lvm/cryptosetup to work- Allow virtd_t to manage firewall/iptables config Resolves: #573585- Fix label on /root/.rhosts Resolves: #582760 - Add labels for Picasa - Allow openvpn to read home certs - Allow plymouthd_t to use tty_device_t - Run ncftool as iptables_t - Allow mount to unmount unlabeled_t - Dontaudit hal leaks- Allow livecd to transition to mount- Update to upstream - Allow abrt to delete sosreport Resolves: #579998 - Allow snmp to setuid and gid Resolves: #582155 - Allow smartd to use generic scsi devices Resolves: #582145- Allow ipsec_t to create /etc/resolv.conf with the correct label - Fix reserved port destination - Allow autofs to transition to showmount - Stop crashing tuned- Add telepathysofiasip policy- Update to upstream - Fix label for /opt/google/chrome/chrome-sandbox - Allow modemmanager to dbus with policykit- Fix allow_httpd_mod_auth_pam to use auth_use_pam(httpd_t) - Allow accountsd to read shadow file - Allow apache to send audit messages when using pam - Allow asterisk to bind and connect to sip tcp ports - Fixes for dovecot 2.0 - Allow initrc_t to setattr on milter directories - Add procmail_home_t for .procmailrc file- Fixes for labels during install from livecd- Fix /cgroup file context - Fix broken afs use of unlabled_t - Allow getty to use the console for s390- Fix cgroup handling adding policy for /cgroup - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set- Merge patches from dgrift- Update upstream - Allow abrt to write to the /proc under any process- Fix ~/.fontconfig label - Add /root/.cert label - Allow reading of the fixed_file_disk_t:lnk_file if you can read file - Allow qemu_exec_t as an entrypoint to svirt_t- Update to upstream - Allow tmpreaper to delete sandbox sock files - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems - Fixes for gitosis - No transition on livecd to passwd or chfn - Fixes for denyhosts- Add label for /var/lib/upower - Allow logrotate to run sssd - dontaudit readahead on tmpfs blk files - Allow tmpreaper to setattr on sandbox files - Allow confined users to execute dos files - Allow sysadm_t to kill processes running within its clearance - Add accountsd policy - Fixes for corosync policy - Fixes from crontab policy - Allow svirt to manage svirt_image_t chr files - Fixes for qdisk policy - Fixes for sssd policy - Fixes for newrole policy- make libvirt work on an MLS platform- Add qpidd policy- Update to upstream- Allow boinc to read kernel sysctl - Fix snmp port definitions - Allow apache to read anon_inodefs- Allow shutdown dac_override- Add device_t as a file system - Fix sysfs association- Dontaudit ipsec_mgmt sys_ptrace - Allow at to mail its spool files - Allow nsplugin to search in .pulse directory- Update to upstream- Allow users to dbus chat with xdm - Allow users to r/w wireless_device_t - Dontaudit reading of process states by ipsec_mgmt- Fix openoffice from unconfined_t- Add shutdown policy so consolekit can shutdown system- Update to upstream- Update to upstream- Update to upstream - These are merges of my patches - Remove 389 labeling conflicts - Add MLS fixes found in RHEL6 testing - Allow pulseaudio to run as a service - Add label for mssql and allow apache to connect to this database port if boolean set - Dontaudit searches of debugfs mount point - Allow policykit_auth to send signals to itself - Allow modcluster to call getpwnam - Allow swat to signal winbind - Allow usbmux to run as a system role - Allow svirt to create and use devpts- Add MLS fixes found in RHEL6 testing - Allow domains to append to rpm_tmp_t - Add cachefilesfd policy - Dontaudit leaks when transitioning- Change allow_execstack and allow_execmem booleans to on - dontaudit acct using console - Add label for fping - Allow tmpreaper to delete sandbox_file_t - Fix wine dontaudit mmap_zero - Allow abrt to read var_t symlinks- Additional policy for rgmanager- Allow sshd to setattr on pseudo terms- Update to upstream- Allow policykit to send itself signals- Fix duplicate cobbler definition- Fix file context of /var/lib/avahi-autoipd- Merge with upstream- Allow sandbox to work with MLS- Make Chrome work with staff user- Add icecast policy - Cleanup spec file- Add mcelog policy- Lots of fixes found in F12- Fix rpm_dontaudit_leaks- Add getsched to hald_t - Add file context for Fedora/Redhat Directory Server- Allow abrt_helper to getattr on all filesystems - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so- Add gstreamer_home_t for ~/.gstreamer- Update to upstream- Fix git- Turn on puppet policy - Update to dgrift git policy- Move users file to selection by spec file. - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t- Update to upstream- Remove most of the permissive domains from F12.- Add cobbler policy from dgrift- add usbmon device - Add allow rulse for devicekit_disk- Lots of fixes found in F12, fixes from Tom London- Cleanups from dgrift- Add back xserver_manage_home_fonts- Dontaudit sandbox trying to read nscd and sssd- Update to upstream- Rename udisks-daemon back to devicekit_disk_t policy- Fixes for abrt calls- Add tgtd policy- Update to upstream release- Add asterisk policy back in - Update to upstream release 2.20091117- Update to upstream release 2.20091117- Fixup nut policy- Update to upstream- Allow vpnc request the kernel to load modules- Fix minimum policy installs - Allow udev and rpcbind to request the kernel to load modules- Add plymouth policy - Allow local_login to sys_admin- Allow cupsd_config to read user tmp - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t- Update rhcs policy- Allow users to exec restorecond- Allow sendmail to request kernel modules load- Fix all kernel_request_load_module domains- Fix all kernel_request_load_module domains- Remove allow_exec* booleans for confined users. Only available for unconfined_t- More fixes for sandbox_web_t- Allow sshd to create .ssh directory and content- Fix request_module line to module_request- Fix sandbox policy to allow it to run under firefox. - Dont audit leaks.- Fixes for sandbox- Update to upstream - Dontaudit nsplugin search /root - Dontaudit nsplugin sys_nice- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service - Remove policycoreutils-python requirement except for minimum- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)- Add wordpress/wp-content/uploads label - Fixes for sandbox when run from staff_t- Update to upstream - Fixes for devicekit_disk- More fixes- Lots of fixes for initrc and other unconfined domains- Allow xserver to use netlink_kobject_uevent_socket- Fixes for sandbox- Dontaudit setroubleshootfix looking at /root directory- Update to upsteam- Allow gssd to send signals to users - Fix duplicate label for apache content- Update to upstream- Remove polkit_auth on upgrades- Add back in unconfined.pp and unconfineduser.pp - Add Sandbox unshare- Fixes for cdrecord, mdadm, and others- Add capability setting to dhcpc and gpm- Allow cronjobs to read exim_spool_t- Add ABRT policy- Fix system-config-services policy- Allow libvirt to change user componant of virt_domain- Allow cupsd_config_t to be started by dbus - Add smoltclient policy- Add policycoreutils-python to pre install- Make all unconfined_domains permissive so we can see what AVC's happen- Add pt_chown policy- Add kdump policy for Miroslav Grepl - Turn off execstack boolean- Turn on execstack on a temporary basis (#512845)- Allow nsplugin to connecto the session bus - Allow samba_net to write to coolkey data- Allow devicekit_disk to list inotify- Allow svirt images to create sock_file in svirt_var_run_t- Allow exim to getattr on mountpoints - Fixes for pulseaudio- Allow svirt_t to stream_connect to virtd_t- Allod hald_dccm_t to create sock_files in /tmp- More fixes from upstream- Fix polkit label - Remove hidebrokensymptoms for nss_ldap fix - Add modemmanager policy - Lots of merges from upstream - Begin removing textrel_shlib_t labels, from fixed libraries- Update to upstream- Allow certmaster to override dac permissions- Update to upstream- Fix context for VirtualBox- Update to upstream- Allow clamscan read amavis spool files- Fixes for xguest- fix multiple directory ownership of mandirs- Update to upstream- Add rules for rtkit-daemon- Update to upstream - Fix nlscd_stream_connect- Add rtkit policy- Allow rpcd_t to stream connect to rpcbind- Allow kpropd to create tmp files- Fix last duplicate /var/log/rpmpkgs- Update to upstream * add sssd- Update to upstream * cleanup- Update to upstream - Additional mail ports - Add virt_use_usb boolean for svirt- Fix mcs rules to include chr_file and blk_file- Add label for udev-acl- Additional rules for consolekit/udev, privoxy and various other fixes- New version for upstream- Allow NetworkManager to read inotifyfs- Allow setroubleshoot to run mlocate- Update to upstream- Add fish as a shell - Allow fprintd to list usbfs_t - Allow consolekit to search mountpoints - Add proper labeling for shorewall- New log file for vmware - Allow xdm to setattr on user_tmp_t- Upgrade to upstream- Allow fprintd to access sys_ptrace - Add sandbox policy- Add varnishd policy- Fixes for kpropd- Allow brctl to r/w tun_tap_device_t- Add /usr/share/selinux/packages- Allow rpcd_t to send signals to kernel threads- Fix upgrade for F10 to F11- Add policy for /var/lib/fprint-Remove duplicate line- Allow svirt to manage pci and other sysfs device data- Fix package selection handling- Fix /sbin/ip6tables-save context - Allod udev to transition to mount - Fix loading of mls policy file- Add shorewall policy- Additional rules for fprintd and sssd- Allow nsplugin to unix_read unix_write sem for unconfined_java- Fix uml files to be owned by users- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less- Allow confined users to manage virt_content_t, since this is home dir content - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection- Fix labeling on /var/lib/misc/prelink* - Allow xserver to rw_shm_perms with all x_clients - Allow prelink to execute files in the users home directory- Allow initrc_t to delete dev_null - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead- Update to latest milter code from Paul Howarth- Additional perms for readahead- Allow pulseaudio to acquire_svc on session bus - Fix readahead labeling- Allow sysadm_t to run rpm directly - libvirt needs fowner- Allow sshd to read var_lib symlinks for freenx- Allow nsplugin unix_read and write on users shm and sem - Allow sysadm_t to execute su- Dontaudit attempts to getattr user_tmpfs_t by lvm - Allow nfs to share removable media- Add ability to run postdrop from confined users- Fixes for podsleuth- Turn off nsplugin transition - Remove Konsole leaked file descriptors for release- Allow cupsd_t to create link files in print_spool_t - Fix iscsi_stream_connect typo - Fix labeling on /etc/acpi/actions - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed- Allow audioentroy to read etc files- Add fail2ban_var_lib_t - Fixes for devicekit_power_t- Separate out the ucnonfined user from the unconfined.pp package- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.- Upgrade to latest upstream - Allow devicekit_disk sys_rawio- Dontaudit binds to ports < 1024 for named - Upgrade to latest upstream- Allow podsleuth to use tmpfs files- Add customizable_types for svirt- Allow setroubelshoot exec* privs to prevent crash from bad libraries - add cpufreqselector- Dontaudit listing of /root directory for cron system jobs- Fix missing ld.so.cache label- Add label for ~/.forward and /root/.forward- Fixes for svirt- Fixes to allow svirt read iso files in homedir- Add xenner and wine fixes from mgrepl- Allow mdadm to read/write mls override- Change to svirt to only access svirt_image_t- Fix libvirt policy- Upgrade to latest upstream- Fixes for iscsid and sssd - More cleanups for upgrade from F10 to Rawhide.- Add pulseaudio, sssd policy - Allow networkmanager to exec udevadm- Add pulseaudio context- Upgrade to latest patches- Fixes for libvirt- Update to Latest upstream- Fix setrans.conf to show SystemLow for s0- Further confinement of qemu images via svirt- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild- Allow NetworkManager to manage /etc/NetworkManager/system-connections- add virtual_image_context and virtual_domain_context files- Allow rpcd_t to send signal to mount_t - Allow libvirtd to run ranged- Fix sysnet/net_conf_t- Fix squidGuard labeling- Re-add corenet_in_generic_if(unlabeled_t)* Tue Feb 10 2009 Dan Walsh 3.6.5-2 - Add git web policy- Add setrans contains from upstream- Do transitions outside of the booleans- Allow xdm to create user_tmp_t sockets for switch user to work- Fix staff_t domain- Grab remainder of network_peer_controls patch- More fixes for devicekit- Upgrade to latest upstream- Add boolean to disallow unconfined_t login- Add back transition from xguest to mozilla- Add virt_content_ro_t and labeling for isos directory- Fixes for wicd daemon- More mls/rpm fixes- Add policy to make dbus/nm-applet work- Remove polgen-ifgen from post and add trigger to policycoreutils-python- Add wm policy - Make mls work in graphics mode- Fixed for DeviceKit- Add devicekit policy- Update to upstream- Define openoffice as an x_domain- Fixes for reading xserver_tmp_t- Allow cups_pdf_t write to nfs_t- Remove audio_entropy policy- Update to upstream- Allow hal_acl_t to getattr/setattr fixed_disk- Change userdom_read_all_users_state to include reading symbolic links in /proc- Fix dbus reading /proc information- Add missing alias for home directory content- Fixes for IBM java location- Allow unconfined_r unconfined_java_t- Add cron_role back to user domains- Fix sudo setting of user keys- Allow iptables to talk to terminals - Fixes for policy kit - lots of fixes for booting.- Cleanup policy- Rebuild for Python 2.6- Fix labeling on /var/spool/rsyslog- Allow postgresl to bind to udp nodes- Allow lvm to dbus chat with hal - Allow rlogind to read nfs_t- Fix cyphesis file context- Allow hal/pm-utils to look at /var/run/video.rom - Add ulogd policy- Additional fixes for cyphesis - Fix certmaster file context - Add policy for system-config-samba - Allow hal to read /var/run/video.rom- Allow dhcpc to restart ypbind - Fixup labeling in /var/run- Add certmaster policy- Fix confined users - Allow xguest to read/write xguest_dbusd_t- Allow openoffice execstack/execmem privs- Allow mozilla to run with unconfined_execmem_t- Dontaudit domains trying to write to .xsession-errors- Allow nsplugin to look at autofs_t directory- Allow kerneloops to create tmp files- More alias for fastcgi- Remove mod_fcgid-selinux package- Fix dovecot access- Policy cleanup- Remove Multiple spec - Add include - Fix makefile to not call per_role_expansion- Fix labeling of libGL- Update to upstream- Update to upstream policy- Fixes for confined xwindows and xdm_t- Allow confined users and xdm to exec wm - Allow nsplugin to talk to fifo files on nfs- Allow NetworkManager to transition to avahi and iptables - Allow domains to search other domains keys, coverup kernel bug- Fix labeling for oracle- Allow nsplugin to comminicate with xdm_tmp_t sock_file- Change all user tmpfs_t files to be labeled user_tmpfs_t - Allow radiusd to create sock_files- Upgrade to upstream- Allow confined users to login with dbus- Fix transition to nsplugin- Add file context for /dev/mspblk.*- Fix transition to nsplugin '- Fix labeling on new pm*log - Allow ssh to bind to all nodes- Merge upstream changes - Add Xavier Toth patches- Add qemu_cache_t for /var/cache/libvirt- Remove gamin policy- Add tinyxs-max file system support- Update to upstream - New handling of init scripts- Allow pcsd to dbus - Add memcache policy- Allow audit dispatcher to kill his children- Update to upstream - Fix crontab use by unconfined user- Allow ifconfig_t to read dhcpc_state_t- Update to upstream- Update to upstream- Allow system-config-selinux to work with policykit- Fix novel labeling- Consolodate pyzor,spamassassin, razor into one security domain - Fix xdm requiring additional perms.- Fixes for logrotate, alsa- Eliminate vbetool duplicate entry- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t - Change dhclient to be able to red networkmanager_var_run- Update to latest refpolicy - Fix libsemanage initial install bug- Add inotify support to nscd- Allow unconfined_t to setfcap- Allow amanda to read tape - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi - Add support for netware file systems- Allow ypbind apps to net_bind_service- Allow all system domains and application domains to append to any log file- Allow gdm to read rpm database - Allow nsplugin to read mplayer config files- Allow vpnc to run ifconfig- Allow confined users to use postgres - Allow system_mail_t to exec other mail clients - Label mogrel_rails as an apache server- Apply unconfined_execmem_exec_t to haskell programs- Fix prelude file context- allow hplip to talk dbus - Fix context on ~/.local dir- Prevent applications from reading x_device- Add /var/lib/selinux context- Update to upstream- Add livecd policy- Dontaudit search of admin_home for init_system_domain - Rewrite of xace interfaces - Lots of new fs_list_inotify - Allow livecd to transition to setfiles_mac- Begin XAce integration- Merge Upstream- Allow amanada to create data files- Fix initial install, semanage setup- Allow system_r for httpd_unconfined_script_t- Remove dmesg boolean - Allow user domains to read/write game data- Change unconfined_t to transition to unconfined_mono_t when running mono - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work- Remove old booleans from targeted-booleans.conf file- Add boolean to mmap_zero - allow tor setgid - Allow gnomeclock to set clock- Don't run crontab from unconfined_t- Change etc files to config files to allow users to read them- Lots of fixes for confined domains on NFS_t homedir- dontaudit mrtg reading /proc - Allow iscsi to signal itself - Allow gnomeclock sys_ptrace- Allow dhcpd to read kernel network state- Label /var/run/gdm correctly - Fix unconfined_u user creation- Allow transition from initrc_t to getty_t- Allow passwd to communicate with user sockets to change gnome-keyring- Fix initial install- Allow radvd to use fifo_file - dontaudit setfiles reading links - allow semanage sys_resource - add allow_httpd_mod_auth_ntlm_winbind boolean - Allow privhome apps including dovecot read on nfs and cifs home dirs if the boolean is set- Allow nsplugin to read /etc/mozpluggerrc, user_fonts - Allow syslog to manage innd logs. - Allow procmail to ioctl spamd_exec_t- Allow initrc_t to dbus chat with consolekit.- Additional access for nsplugin - Allow xdm setcap/getcap until pulseaudio is fixed- Allow mount to mkdir on tmpfs - Allow ifconfig to search debugfs- Fix file context for MATLAB - Fixes for xace- Allow stunnel to transition to inetd children domains - Make unconfined_dbusd_t an unconfined domain- Fixes for qemu/virtd- Fix bug in mozilla policy to allow xguest transition - This will fix the libsemanage.dbase_llist_query: could not find record value libsemanage.dbase_llist_query: could not query record value (No such file or directory) bug in xguest- Allow nsplugin to run acroread- Add cups_pdf policy - Add openoffice policy to run in xguest- prewika needs to contact mysql - Allow syslog to read system_map files- Change init_t to an unconfined_domain- Allow init to transition to initrc_t on shell exec. - Fix init to be able to sendto init_t. - Allow syslog to connect to mysql - Allow lvm to manage its own fifo_files - Allow bugzilla to use ldap - More mls fixes- fixes for init policy (#436988) - fix build- Additional changes for MLS policy- Fix initrc_context generation for MLS- Fixes for libvirt- Allow bitlebee to read locale_t- More xselinux rules- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t- Prepare policy for beta release - Change some of the system domains back to unconfined - Turn on some of the booleans- Allow nsplugin_config execstack/execmem - Allow nsplugin_t to read alsa config - Change apache to use user content- Add cyphesis policy- Fix Makefile.devel to build mls modules - Fix qemu to be more specific on labeling- Update to upstream fixes- Allow staff to mounton user_home_t- Add xace support- Add fusectl file system- Fixes from yum-cron - Update to latest upstream- Fix userdom_list_user_files- Merge with upstream- Allow udev to send audit messages- Add additional login users interfaces - userdom_admin_login_user_template(staff)- More fixes for polkit- Eliminate transition from unconfined_t to qemu by default - Fixes for gpg- Update to upstream- Fixes for staff_t- Add policy for kerneloops - Add policy for gnomeclock- Fixes for libvirt- Fixes for nsplugin- More fixes for qemu- Additional ports for vnc and allow qemu and libvirt to search all directories- Update to upstream - Add libvirt policy - add qemu policy- Allow fail2ban to create a socket in /var/run- Allow allow_httpd_mod_auth_pam to work- Add audisp policy and prelude- Allow all user roles to executae samba net command- Allow usertypes to read/write noxattr file systems- Fix nsplugin to allow flashplugin to work in enforcing mode- Allow pam_selinux_permit to kill all processes- Allow ptrace or user processes by users of same type - Add boolean for transition to nsplugin- Allow nsplugin sys_nice, getsched, setsched- Allow login programs to talk dbus to oddjob- Add procmail_log support - Lots of fixes for munin- Allow setroubleshoot to read policy config and send audit messages- Allow users to execute all files in homedir, if boolean set - Allow mount to read samba config- Fixes for xguest to run java plugin- dontaudit pam_t and dbusd writing to user_home_t- Update gpg to allow reading of inotify- Change user and staff roles to work correctly with varied perms- Fix munin log, - Eliminate duplicate mozilla file context - fix wpa_supplicant spec- Fix role transition from unconfined_r to system_r when running rpm - Allow unconfined_domains to communicate with user dbus instances- Fixes for xguest- Let all uncofined domains communicate with dbus unconfined- Run rpm in system_r- Zero out customizable types- Fix definiton of admin_home_t- Fix munin file context- Allow cron to run unconfined apps- Modify default login to unconfined_u- Dontaudit dbus user client search of /root- Update to upstream- Fixes for polkit - Allow xserver to ptrace- Add polkit policy - Symplify userdom context, remove automatic per_role changes- Update to upstream - Allow httpd_sys_script_t to search users homedirs- Allow rpm_script to transition to unconfined_execmem_t- Remove user based home directory separation- Remove user specific crond_t- Merge with upstream - Allow xsever to read hwdata_t - Allow login programs to setkeycreate- Update to upstream- Update to upstream- Allow XServer to read /proc/self/cmdline - Fix unconfined cron jobs - Allow fetchmail to transition to procmail - Fixes for hald_mac - Allow system_mail to transition to exim - Allow tftpd to upload files - Allow xdm to manage unconfined_tmp - Allow udef to read alsa config - Fix xguest to be able to connect to sound port- Fixes for hald_mac - Treat unconfined_home_dir_t as a home dir - dontaudit rhgb writes to fonts and root- Fix dnsmasq - Allow rshd full login privs- Allow rshd to connect to ports > 1023- Fix vpn to bind to port 4500 - Allow ssh to create shm - Add Kismet policy- Allow rpm to chat with networkmanager- Fixes for ipsec and exim mail - Change default to unconfined user- Pass the UNK_PERMS param to makefile - Fix gdm location- Make alsa work- Fixes for consolekit and startx sessions- Dontaudit consoletype talking to unconfined_t- Remove homedir_template- Check asound.state- Fix exim policy- Allow tmpreadper to read man_t - Allow racoon to bind to all nodes - Fixes for finger print reader- Allow xdm to talk to input device (fingerprint reader) - Allow octave to run as java- Allow login programs to set ioctl on /proc- Allow nsswitch apps to read samba_var_t- Fix maxima- Eliminate rpm_t:fifo_file avcs - Fix dbus path for helper app- Fix service start stop terminal avc's- Allow also to search var_lib - New context for dbus launcher- Allow cupsd_config_t to read/write usb_device_t - Support for finger print reader, - Many fixes for clvmd - dbus starting networkmanager- Fix java and mono to run in xguest account- Fix to add xguest account when inititial install - Allow mono, java, wine to run in userdomains- Allow xserver to search devpts_t - Dontaudit ldconfig output to homedir- Remove hplip_etc_t change back to etc_t.- Allow cron to search nfs and samba homedirs- Allow NetworkManager to dbus chat with yum-updated- Allow xfs to bind to port 7100- Allow newalias/sendmail dac_override - Allow bind to bind to all udp ports- Turn off direct transition- Allow wine to run in system role- Fix java labeling- Define user_home_type as home_type- Allow sendmail to create etc_aliases_t- Allow login programs to read symlinks on homedirs- Update an readd modules- Cleanup spec file- Allow xserver to be started by unconfined process and talk to tty- Upgrade to upstream to grab postgressql changes- Add setransd for mls policy- Add ldconfig_cache_t- Allow sshd to write to proc_t for afs login- Allow xserver access to urand- allow dovecot to search mountpoints- Fix Makefile for building policy modules- Fix dhcpc startup of service- Fix dbus chat to not happen for xguest and guest users- Fix nagios cgi - allow squid to communicate with winbind- Fixes for ldconfig- Update from upstream- Add nasd support- Fix new usb devices and dmfm- Eliminate mount_ntfs_t policy, merge into mount_t- Allow xserver to write to ramfs mounted by rhgb- Add context for dbus machine id- Update with latest changes from upstream- Fix prelink to handle execmod- Add ntpd_key_t to handle secret data- Add anon_inodefs - Allow unpriv user exec pam_exec_t - Fix trigger- Allow cups to use generic usb - fix inetd to be able to run random apps (git)- Add proper contexts for rsyslogd- Fixes for xguest policy- Allow execution of gconf- Fix moilscanner update problem- Begin adding policy to separate setsebool from semanage - Fix xserver.if definition to not break sepolgen.if- Add new devices- Add brctl policy- Fix root login to include system_r- Allow prelink to read kernel sysctls- Default to user_u:system_r:unconfined_t- fix squid - Fix rpm running as uid- Fix syslog declaration- Allow avahi to access inotify - Remove a lot of bogus security_t:filesystem avcs- Remove ifdef strict policy from upstream- Remove ifdef strict to allow user_u to login- Fix for amands - Allow semanage to read pp files - Allow rhgb to read xdm_xserver_tmp- Allow kerberos servers to use ldap for backing store- allow alsactl to read kernel state- More fixes for alsactl - Transition from hal and modutils - Fixes for suspend resume. - insmod domtrans to alsactl - insmod writes to hal log- Allow unconfined_t to transition to NetworkManager_t - Fix netlabel policy- Update to latest from upstream- Update to latest from upstream- Update to latest from upstream- Allow pcscd_t to send itself signals- Fixes for unix_update - Fix logwatch to be able to search all dirs- Upstream bumped the version- Allow consolekit to syslog - Allow ntfs to work with hal- Allow iptables to read etc_runtime_t- MLS Fixes- Fix path of /etc/lvm/cache directory - Fixes for alsactl and pppd_t - Fixes for consolekit- Allow insmod_t to mount kvmfs_t filesystems- Rwho policy - Fixes for consolekit- fixes for fusefs- Fix samba_net to allow it to view samba_var_t- Update to upstream- Fix Sonypic backlight - Allow snmp to look at squid_conf_t- Fixes for pyzor, cyrus, consoletype on everything installs- Fix hald_acl_t to be able to getattr/setattr on usb devices - Dontaudit write to unconfined_pipes for load_policy- Allow bluetooth to read inotifyfs- Fixes for samba domain controller. - Allow ConsoleKit to look at ttys- Fix interface call- Allow syslog-ng to read /var - Allow locate to getattr on all filesystems - nscd needs setcap- Update to upstream- Allow samba to run groupadd- Update to upstream- Allow mdadm to access generic scsi devices- Fix labeling on udev.tbl dirs- Fixes for logwatch- Add fusermount and mount_ntfs policy- Update to upstream - Allow saslauthd to use kerberos keytabs- Fixes for samba_var_t- Allow networkmanager to setpgid - Fixes for hal_acl_t- Remove disable_trans booleans - hald_acl_t needs to talk to nscd- Fix prelink to be able to manage usr dirs.- Allow insmod to launch init scripts- Remove setsebool policy- Fix handling of unlabled_t packets- More of my patches from upstream- Update to latest from upstream - Add fail2ban policy- Update to remove security_t:filesystem getattr problems- Policy for consolekit- Update to latest from upstream- Revert Nemiver change - Set sudo as a corecmd so prelink will work, remove sudoedit mapping, since this will not work, it does not transition. - Allow samba to execute useradd- Upgrade to the latest from upstream- Add sepolgen support - Add bugzilla policy- Fix file context for nemiver- Remove include sym link- Allow mozilla, evolution and thunderbird to read dev_random. Resolves: #227002 - Allow spamd to connect to smtp port Resolves: #227184 - Fixes to make ypxfr work Resolves: #227237- Fix ssh_agent to be marked as an executable - Allow Hal to rw sound device- Fix spamassisin so crond can update spam files - Fixes to allow kpasswd to work - Fixes for bluetooth- Remove some targeted diffs in file context file- Fix squid cachemgr labeling- Add ability to generate webadm_t policy - Lots of new interfaces for httpd - Allow sshd to login as unconfined_t- Continue fixing, additional user domains- Begin adding user confinement to targeted policy- Fixes for prelink, ktalkd, netlabel- Allow prelink when run from rpm to create tmp files Resolves: #221865 - Remove file_context for exportfs Resolves: #221181 - Allow spamassassin to create ~/.spamassissin Resolves: #203290 - Allow ssh access to the krb tickets - Allow sshd to change passwd - Stop newrole -l from working on non securetty Resolves: #200110 - Fixes to run prelink in MLS machine Resolves: #221233 - Allow spamassassin to read var_lib_t dir Resolves: #219234- fix mplayer to work under strict policy - Allow iptables to use nscd Resolves: #220794- Add gconf policy and make it work with strict- Many fixes for strict policy and by extension mls.- Fix to allow ftp to bind to ports > 1024 Resolves: #219349- Allow semanage to exec it self. Label genhomedircon as semanage_exec_t Resolves: #219421 - Allow sysadm_lpr_t to manage other print spool jobs Resolves: #220080- allow automount to setgid Resolves: #219999- Allow cron to polyinstatiate - Fix creation of boot flags Resolves: #207433- Fixes for irqbalance Resolves: #219606- Fix vixie-cron to work on mls Resolves: #207433Resolves: #218978- Allow initrc to create files in /var directories Resolves: #219227- More fixes for MLS Resolves: #181566- More Fixes polyinstatiation Resolves: #216184- More Fixes polyinstatiation - Fix handling of keyrings Resolves: #216184- Fix polyinstatiation - Fix pcscd handling of terminal Resolves: #218149 Resolves: #218350- More fixes for quota Resolves: #212957- ncsd needs to use avahi sockets Resolves: #217640 Resolves: #218014- Allow login programs to polyinstatiate homedirs Resolves: #216184 - Allow quotacheck to create database files Resolves: #212957- Dontaudit appending hal_var_lib files Resolves: #217452 Resolves: #217571 Resolves: #217611 Resolves: #217640 Resolves: #217725- Fix context for helix players file_context #216942- Fix load_policy to be able to mls_write_down so it can talk to the terminal- Fixes for hwclock, clamav, ftp- Move to upstream version which accepted my patches- Fixes for nvidia driver- Allow semanage to signal mcstrans- Update to upstream- Allow modstorage to edit /etc/fstab file- Fix for qemu, /dev/- Fix path to realplayer.bin- Allow xen to connect to xen port- Allow cups to search samba_etc_t directory - Allow xend_t to list auto_mountpoints- Allow xen to search automount- Fix spec of jre files- Fix unconfined access to shadow file- Allow xend to create files in xen_image_t directories- Fixes for /var/lib/hal- Remove ability for sysadm_t to look at audit.log- Fix rpc_port_types - Add aide policy for mls- Merge with upstream- Lots of fixes for ricci- Allow xen to read/write fixed devices with a boolean - Allow apache to search /var/log- Fix policygentool specfile problem. - Allow apache to send signals to it's logging helpers. - Resolves: rhbz#212731- Add perms for swat- Add perms for swat- Allow daemons to dump core files to /- Fixes for ricci- Allow mount.nfs to work- Allow ricci-modstorage to look at lvm_etc_t- Fixes for ricci using saslauthd- Allow mountpoint on home_dir_t and home_t- Update xen to read nfs files- Allow noxattrfs to associate with other noxattrfs- Allow hal to use power_device_t- Allow procemail to look at autofs_t - Allow xen_image_t to work as a fixed device- Refupdate from upstream- Add lots of fixes for mls cups- Lots of fixes for ricci- Fix number of cats- Update to upstream- More iSCSI changes for #209854- Test ISCSI fixes for #209854- allow semodule to rmdir selinux_config_t dir- Fix boot_runtime_t problem on ppc. Should not be creating these files.- Fix context mounts on reboot - Fix ccs creation of directory in /var/log- Update for tallylog- Allow xend to rewrite dhcp conf files - Allow mgetty sys_admin capability- Make xentapctrl work- Don't transition unconfined_t to bootloader_t - Fix label in /dev/xen/blktap- Patch for labeled networking- Fix crond handling for mls- Update to upstream- Remove bluetooth-helper transition - Add selinux_validate for semanage - Require new version of libsemanage- Fix prelink- Fix rhgb- Fix setrans handling on MLS and useradd- Support for fuse - fix vigr- Fix dovecot, amanda - Fix mls- Allow java execheap for itanium- Update with upstream- mls fixes- Update from upstream- More fixes for mls - Revert change on automount transition to mount- Fix cron jobs to run under the correct context- Fixes to make pppd work- Multiple policy fixes - Change max categories to 1023- Fix transition on mcstransd- Add /dev/em8300 defs- Upgrade to upstream- Fix ppp connections from network manager- Add tty access to all domains boolean - Fix gnome-pty-helper context for ia64- Fixed typealias of firstboot_rw_t- Fix location of xel log files - Fix handling of sysadm_r -> rpm_exec_t- Fixes for autofs, lp- Update from upstream- Fixup for test6- Update to upstream- Update to upstream- Fix suspend to disk problems- Lots of fixes for restarting daemons at the console.- Fix audit line - Fix requires line- Upgrade to upstream- Fix install problems- Allow setroubleshoot to getattr on all dirs to gather RPM data- Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform - Fix spec for /dev/adsp- Fix xen tty devices- Fixes for setroubleshoot- Update to upstream- Fixes for stunnel and postgresql - Update from upstream- Update from upstream - More java fixes- Change allow_execstack to default to on, for RHEL5 Beta. This is required because of a Java compiler problem. Hope to turn off for next beta- Misc fixes- More fixes for strict policy- Quiet down anaconda audit messages- Fix setroubleshootd- Update to the latest from upstream- More fixes for xen- Fix anaconda transitions- yet more xen rules- more xen rules- Fixes for Samba- Fixes for xen- Allow setroubleshootd to send mail- Add nagios policy- fixes for setroubleshoot- Added Paul Howarth patch to only load policy packages shipped with this package - Allow pidof from initrc to ptrace higher level domains - Allow firstboot to communicate with hal via dbus- Add policy for /var/run/ldapi- Fix setroubleshoot policy- Fixes for mls use of ssh - named has a new conf file- Fixes to make setroubleshoot work- Cups needs to be able to read domain state off of printer client- add boolean to allow zebra to write config files- setroubleshootd fixes- Allow prelink to read bin_t symlink - allow xfs to read random devices - Change gfs to support xattr- Remove spamassassin_can_network boolean- Update to upstream - Fix lpr domain for mls- Add setroubleshoot policy- Turn off auditallow on setting booleans- Multiple fixes- Update to upstream- Update to upstream - Add new class for kernel key ring- Update to upstream- Update to upstream- Break out selinux-devel package- Add ibmasmfs- Fix policygentool gen_requires- Update from Upstream- Fix spec of realplay- Update to upstream- Fix semanage- Allow useradd to create_home_dir in MLS environment- Update from upstream- Update from upstream- Add oprofilefs- Fix for hplip and Picasus- Update to upstream- Update to upstream- fixes for spamd- fixes for java, openldap and webalizer- Xen fixes- Upgrade to upstream- allow hal to read boot_t files - Upgrade to upstream- allow hal to read boot_t files- Update from upstream- Fixes for amavis- Update from upstream- Allow auditctl to search all directories- Add acquire service for mono.- Turn off allow_execmem boolean - Allow ftp dac_override when allowed to access users homedirs- Clean up spec file - Transition from unconfined_t to prelink_t- Allow execution of cvs command- Update to upstream- Update to upstream- Fix libjvm spec- Update to upstream- Add xm policy - Fix policygentool- Update to upstream - Fix postun to only disable selinux on full removal of the packages- Allow mono to chat with unconfined- Allow procmail to sendmail - Allow nfs to share dosfs- Update to latest from upstream - Allow selinux-policy to be removed and kernel not to crash- Update to latest from upstream - Add James Antill patch for xen - Many fixes for pegasus- Add unconfined_mount_t - Allow privoxy to connect to httpd_cache - fix cups labeleing on /var/cache/cups- Update to latest from upstream- Update to latest from upstream - Allow mono and unconfined to talk to initrc_t dbus objects- Change libraries.fc to stop shlib_t form overriding texrel_shlib_t- Fix samba creating dirs in homedir - Fix NFS so its booleans would work- Allow secadm_t ability to relabel all files - Allow ftp to search xferlog_t directories - Allow mysql to communicate with ldap - Allow rsync to bind to rsync_port_t- Fixed mailman with Postfix #183928 - Allowed semanage to create file_context files. - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t to bind to reserved ports. #149030 - Don't allow devpts_t to be associated with tmp_t. - Allow hald_t to stat all mountpoints. - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts. - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of /etc/mtab. - Changed the file_contexts to not have a regex before the first ^/[a-z]/ whenever possible, makes restorecon slightly faster. - Correct the label of /etc/named.caching-nameserver.conf - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src hit by this. - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed xenstored_t rw access to the xen device node.- More textrel_shlib_t file path fixes - Add ada support- Get auditctl working in MLS policy- Add mono dbus support - Lots of file_context fixes for textrel_shlib_t in FC5 - Turn off execmem auditallow since they are filling log files- Update to upstream- Allow automount and dbus to read cert files- Fix ftp policy - Fix secadm running of auditctl- Update to upstream- Update to upstream- Fix policyhelp- Fix pam_console handling of usb_device - dontaudit logwatch reading /mnt dir- Update to upstream- Get transition rules to create policy.20 at SystemHigh- Allow secadmin to shutdown system - Allow sendmail to exec newalias- MLS Fixes dmidecode needs mls_file_read_up - add ypxfr_t - run init needs access to nscd - udev needs setuid - another xen log file - Dontaudit mount getattr proc_kcore_t- fix buildroot usage (#185391)- Get rid of mount/fsdisk scan of /dev messages - Additional fixes for suspend/resume- Fake make to rebuild enableaudit.pp- Get xen networking running.- Fixes for Xen - enableaudit should not be the same as base.pp - Allow ps to work for all process- more xen policy fixups- more xen fixage (#184393)- Fix blkid specification - Allow postfix to execute mailman_que- Blkid changes - Allow udev access to usb_device_t - Fix post script to create targeted policy config file- Allow lvm tools to create drevice dir- Add Xen support- Fixes for cups - Make cryptosetup work with hal- Load Policy needs translock- Fix cups html interface- Add hal changes suggested by Jeremy - add policyhelp to point at policy html pages- Additional fixes for nvidia and cups- Update to upstream - Merged my latest fixes - Fix cups policy to handle unix domain sockets- NSCD socket is in nscd_var_run_t needs to be able to search dir- Fixes Apache interface file- Fixes for new version of cups- Turn off polyinstatiate util after FC5- Fix problem with privoxy talking to Tor- Turn on polyinstatiation- Don't transition from unconfined_t to fsadm_t- Fix policy update model.- Update to upstream- Fix load_policy to work on MLS - Fix cron_rw_system_pipes for postfix_postdrop_t - Allow audotmount to run showmount- Fix swapon - allow httpd_sys_script_t to be entered via a shell - Allow httpd_sys_script_t to read eventpolfs- Update from upstream- allow cron to read apache files- Fix vpnc policy to work from NetworkManager- Update to upstream - Fix semoudle polcy- Update to upstream - fix sysconfig/selinux link- Add router port for zebra - Add imaze port for spamd - Fixes for amanda and java- Fix bluetooth handling of usb devices - Fix spamd reading of ~/ - fix nvidia spec- Update to upsteam- Add users_extra files- Update to upstream- Add semodule policy- Update from upstream- Fix for spamd to use razor port- Fixes for mcs - Turn on mount and fsadm for unconfined_t- Fixes for the -devel package- Fix for spamd to use ldap- Update to upstream- Update to upstream - Fix rhgb, and other Xorg startups- Update to upstream- Separate out role of secadm for mls- Add inotifyfs handling- Update to upstream - Put back in changes for pup/zen- Many changes for MLS - Turn on strict policy- Update to upstream- Update to upstream - Fixes for booting and logging in on MLS machine- Update to upstream - Turn off execheap execstack for unconfined users - Add mono/wine policy to allow execheap and execstack for them - Add execheap for Xdm policy- Update to upstream - Fixes to fetchmail,- Update to upstream- Fix for procmail/spamassasin - Update to upstream - Add rules to allow rpcd to work with unlabeled_networks.- Update to upstream - Fix ftp Man page- Update to upstream- fix pup transitions (#177262) - fix xen disks (#177599)- Update to upstream- More Fixes for hal and readahead- Fixes for hal and readahead- Update to upstream - Apply- Add wine and fix hal problems- Handle new location of hal scripts- Allow su to read /etc/mtab- Update to upstream- Fix "libsemanage.parse_module_headers: Data did not represent a module." problem- Allow load_policy to read /etc/mtab- Fix dovecot to allow dovecot_auth to look at /tmp- Allow restorecon to read unlabeled_t directories in order to fix labeling.- Add Logwatch policy- Fix /dev/ub[a-z] file context- Fix library specification - Give kudzu execmem privs- Fix hostname in targeted policy- Fix passwd command on mls- Lots of fixes to make mls policy work- Add dri libs to textrel_shlib_t - Add system_r role for java - Add unconfined_exec_t for vncserver - Allow slapd to use kerberos- Add man pages- Add enableaudit.pp- Fix mls policy- Update mls file from old version- Add sids back in - Rebuild with update checkpolicy- Fixes to allow automount to use portmap - Fixes to start kernel in s0-s15:c0.c255- Add java unconfined/execmem policy- Add file context for /var/cvs - Dontaudit webalizer search of homedir- Update from upstream- Clean up spec - range_transition crond to SystemHigh- Fixes for hal - Update to upstream- Turn back on execmem since we need it for java, firefox, ooffice - Allow gpm to stream socket to itself- fix requirements to be on the actual packages so that policy can get created properly at install time- Allow unconfined_t to execmod texrel_shlib_t- Update to upstream - Turn off allow_execmem and allow_execmod booleans - Add tcpd and automount policies- Add two new httpd booleans, turned off by default * httpd_can_network_relay * httpd_can_network_connect_db- Add ghost for policy.20- Update to upstream - Turn off boolean allow_execstack- Change setrans-mls to use new libsetrans - Add default_context rule for xdm- Change Requires to PreReg for requiring of policycoreutils on install- New upstream releaseAdd xdm policyUpdate from upstreamUpdate from upstreamUpdate from upstream- Also trigger to rebuild policy for versions up to 2.0.7.- No longer installing policy.20 file, anaconda handles the building of the app.- Fixes for dovecot and saslauthd- Cleanup pegasus and named - Fix spec file - Fix up passwd changing applications-Update to latest from upstream- Add rules for pegasus and avahi- Start building MLS Policy- Update to upstream- Turn on bash- Initial version  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~3.12.1-153.el7_0.12selinux-policyMakefile.exampleexample.fcexample.ifexample.tehtmladmin.htmladmin_bootloader.htmladmin_consoletype.htmladmin_dmesg.htmladmin_netutils.htmladmin_su.htmladmin_sudo.htmladmin_usermanage.htmlapps.htmlapps_seunshare.htmlbooleans.htmlcontrib.htmlcontrib_abrt.htmlcontrib_accountsd.htmlcontrib_acct.htmlcontrib_ada.htmlcontrib_afs.htmlcontrib_aiccu.htmlcontrib_aide.htmlcontrib_aisexec.htmlcontrib_ajaxterm.htmlcontrib_alsa.htmlcontrib_amanda.htmlcontrib_amavis.htmlcontrib_amtu.htmlcontrib_anaconda.htmlcontrib_antivirus.htmlcontrib_apache.htmlcontrib_apcupsd.htmlcontrib_apm.htmlcontrib_apt.htmlcontrib_arpwatch.htmlcontrib_asterisk.htmlcontrib_authbind.htmlcontrib_authconfig.htmlcontrib_automount.htmlcontrib_avahi.htmlcontrib_awstats.htmlcontrib_backup.htmlcontrib_bacula.htmlcontrib_bcfg2.htmlcontrib_bind.htmlcontrib_bird.htmlcontrib_bitlbee.htmlcontrib_blueman.htmlcontrib_bluetooth.htmlcontrib_boinc.htmlcontrib_brctl.htmlcontrib_bugzilla.htmlcontrib_bumblebee.htmlcontrib_cachefilesd.htmlcontrib_calamaris.htmlcontrib_callweaver.htmlcontrib_canna.htmlcontrib_ccs.htmlcontrib_cdrecord.htmlcontrib_certmaster.htmlcontrib_certmonger.htmlcontrib_certwatch.htmlcontrib_cfengine.htmlcontrib_cgroup.htmlcontrib_chrome.htmlcontrib_chronyd.htmlcontrib_cipe.htmlcontrib_clamav.htmlcontrib_clockspeed.htmlcontrib_clogd.htmlcontrib_cloudform.htmlcontrib_cmirrord.htmlcontrib_cobbler.htmlcontrib_collectd.htmlcontrib_colord.htmlcontrib_comsat.htmlcontrib_condor.htmlcontrib_conman.htmlcontrib_consolekit.htmlcontrib_corosync.htmlcontrib_couchdb.htmlcontrib_courier.htmlcontrib_cpucontrol.htmlcontrib_cpufreqselector.htmlcontrib_cron.htmlcontrib_ctdb.htmlcontrib_cups.htmlcontrib_cvs.htmlcontrib_cyphesis.htmlcontrib_cyrus.htmlcontrib_daemontools.htmlcontrib_dante.htmlcontrib_dbadm.htmlcontrib_dbskk.htmlcontrib_dbus.htmlcontrib_dcc.htmlcontrib_ddclient.htmlcontrib_ddcprobe.htmlcontrib_denyhosts.htmlcontrib_devicekit.htmlcontrib_dhcp.htmlcontrib_dictd.htmlcontrib_dirmngr.htmlcontrib_dirsrv-admin.htmlcontrib_dirsrv.htmlcontrib_distcc.htmlcontrib_djbdns.htmlcontrib_dkim.htmlcontrib_dmidecode.htmlcontrib_dnsmasq.htmlcontrib_dnssec.htmlcontrib_dnssectrigger.htmlcontrib_docker.htmlcontrib_dovecot.htmlcontrib_dpkg.htmlcontrib_drbd.htmlcontrib_dspam.htmlcontrib_entropyd.htmlcontrib_evolution.htmlcontrib_exim.htmlcontrib_fail2ban.htmlcontrib_fcoe.htmlcontrib_fetchmail.htmlcontrib_finger.htmlcontrib_firewalld.htmlcontrib_firewallgui.htmlcontrib_firstboot.htmlcontrib_fprintd.htmlcontrib_freeipmi.htmlcontrib_freqset.htmlcontrib_ftp.htmlcontrib_games.htmlcontrib_gatekeeper.htmlcontrib_gear.htmlcontrib_gift.htmlcontrib_git.htmlcontrib_gitosis.htmlcontrib_glance.htmlcontrib_glusterd.htmlcontrib_gnome.htmlcontrib_gnomeclock.htmlcontrib_gpg.htmlcontrib_gpm.htmlcontrib_gpsd.htmlcontrib_gssproxy.htmlcontrib_guest.htmlcontrib_hadoop.htmlcontrib_hal.htmlcontrib_hddtemp.htmlcontrib_howl.htmlcontrib_hypervkvp.htmlcontrib_i18n_input.htmlcontrib_icecast.htmlcontrib_ifplugd.htmlcontrib_imaze.htmlcontrib_inetd.htmlcontrib_inn.htmlcontrib_iodine.htmlcontrib_ipa.htmlcontrib_irc.htmlcontrib_ircd.htmlcontrib_irqbalance.htmlcontrib_iscsi.htmlcontrib_isns.htmlcontrib_jabber.htmlcontrib_java.htmlcontrib_jetty.htmlcontrib_jockey.htmlcontrib_journalctl.htmlcontrib_kde.htmlcontrib_kdump.htmlcontrib_kdumpgui.htmlcontrib_keepalived.htmlcontrib_kerberos.htmlcontrib_kerneloops.htmlcontrib_keyboardd.htmlcontrib_keystone.htmlcontrib_kismet.htmlcontrib_ksmtuned.htmlcontrib_ktalk.htmlcontrib_kudzu.htmlcontrib_l2tp.htmlcontrib_ldap.htmlcontrib_lightsquid.htmlcontrib_likewise.htmlcontrib_lircd.htmlcontrib_livecd.htmlcontrib_lldpad.htmlcontrib_loadkeys.htmlcontrib_lockdev.htmlcontrib_logrotate.htmlcontrib_logwatch.htmlcontrib_lpd.htmlcontrib_lsm.htmlcontrib_mailman.htmlcontrib_mailscanner.htmlcontrib_man2html.htmlcontrib_mandb.htmlcontrib_mcelog.htmlcontrib_mcollective.htmlcontrib_mediawiki.htmlcontrib_memcached.htmlcontrib_milter.htmlcontrib_mip6d.htmlcontrib_mirrormanager.htmlcontrib_mock.htmlcontrib_modemmanager.htmlcontrib_mojomojo.htmlcontrib_mongodb.htmlcontrib_mono.htmlcontrib_monop.htmlcontrib_motion.htmlcontrib_mozilla.htmlcontrib_mpd.htmlcontrib_mplayer.htmlcontrib_mrtg.htmlcontrib_mta.htmlcontrib_munin.htmlcontrib_mysql.htmlcontrib_mythtv.htmlcontrib_nagios.htmlcontrib_namespace.htmlcontrib_ncftool.htmlcontrib_nessus.htmlcontrib_networkmanager.htmlcontrib_ninfod.htmlcontrib_nis.htmlcontrib_nova.htmlcontrib_nscd.htmlcontrib_nsd.htmlcontrib_nslcd.htmlcontrib_nsplugin.htmlcontrib_ntop.htmlcontrib_ntp.htmlcontrib_numad.htmlcontrib_nut.htmlcontrib_nx.htmlcontrib_oav.htmlcontrib_obex.htmlcontrib_oddjob.htmlcontrib_oident.htmlcontrib_openca.htmlcontrib_openct.htmlcontrib_openhpi.htmlcontrib_openhpid.htmlcontrib_openshift-origin.htmlcontrib_openshift.htmlcontrib_opensm.htmlcontrib_openvpn.htmlcontrib_openvswitch.htmlcontrib_openwsman.htmlcontrib_oracleasm.htmlcontrib_osad.htmlcontrib_pacemaker.htmlcontrib_pads.htmlcontrib_passenger.htmlcontrib_pcmcia.htmlcontrib_pcp.htmlcontrib_pcscd.htmlcontrib_pegasus.htmlcontrib_perdition.htmlcontrib_pesign.htmlcontrib_pingd.htmlcontrib_piranha.htmlcontrib_pkcsslotd.htmlcontrib_pki.htmlcontrib_plymouthd.htmlcontrib_podsleuth.htmlcontrib_policykit.htmlcontrib_polipo.htmlcontrib_portage.htmlcontrib_portmap.htmlcontrib_portreserve.htmlcontrib_portslave.htmlcontrib_postfix.htmlcontrib_postfixpolicyd.htmlcontrib_postgrey.htmlcontrib_ppp.htmlcontrib_prelink.htmlcontrib_prelude.htmlcontrib_privoxy.htmlcontrib_procmail.htmlcontrib_prosody.htmlcontrib_psad.htmlcontrib_ptchown.htmlcontrib_publicfile.htmlcontrib_pulseaudio.htmlcontrib_puppet.htmlcontrib_pwauth.htmlcontrib_pxe.htmlcontrib_pyzor.htmlcontrib_qemu.htmlcontrib_qmail.htmlcontrib_qpid.htmlcontrib_quantum.htmlcontrib_quota.htmlcontrib_rabbitmq.htmlcontrib_radius.htmlcontrib_radvd.htmlcontrib_raid.htmlcontrib_rasdaemon.htmlcontrib_razor.htmlcontrib_rdisc.htmlcontrib_readahead.htmlcontrib_realmd.htmlcontrib_redis.htmlcontrib_remotelogin.htmlcontrib_resmgr.htmlcontrib_rgmanager.htmlcontrib_rhcs.htmlcontrib_rhev.htmlcontrib_rhgb.htmlcontrib_rhnsd.htmlcontrib_rhsmcertd.htmlcontrib_ricci.htmlcontrib_rkhunter.htmlcontrib_rlogin.htmlcontrib_rngd.htmlcontrib_roundup.htmlcontrib_rpc.htmlcontrib_rpcbind.htmlcontrib_rpm.htmlcontrib_rshd.htmlcontrib_rssh.htmlcontrib_rsync.htmlcontrib_rtas.htmlcontrib_rtkit.htmlcontrib_rwho.htmlcontrib_samba.htmlcontrib_sambagui.htmlcontrib_samhain.htmlcontrib_sandbox.htmlcontrib_sandboxX.htmlcontrib_sanlock.htmlcontrib_sasl.htmlcontrib_sblim.htmlcontrib_screen.htmlcontrib_sectoolm.htmlcontrib_sendmail.htmlcontrib_sensord.htmlcontrib_setroubleshoot.htmlcontrib_sge.htmlcontrib_shorewall.htmlcontrib_shutdown.htmlcontrib_slocate.htmlcontrib_slpd.htmlcontrib_slrnpull.htmlcontrib_smartmon.htmlcontrib_smokeping.htmlcontrib_smoltclient.htmlcontrib_smsd.htmlcontrib_smstools.htmlcontrib_snapper.htmlcontrib_snmp.htmlcontrib_snort.htmlcontrib_sosreport.htmlcontrib_soundserver.htmlcontrib_spamassassin.htmlcontrib_speech-dispatcher.htmlcontrib_speedtouch.htmlcontrib_squid.htmlcontrib_sssd.htmlcontrib_stapserver.htmlcontrib_stunnel.htmlcontrib_svnserve.htmlcontrib_swift.htmlcontrib_swift_alias.htmlcontrib_sxid.htmlcontrib_sysstat.htmlcontrib_tcpd.htmlcontrib_tcsd.htmlcontrib_telepathy.htmlcontrib_telnet.htmlcontrib_tftp.htmlcontrib_tgtd.htmlcontrib_thin.htmlcontrib_thumb.htmlcontrib_thunderbird.htmlcontrib_timidity.htmlcontrib_tmpreaper.htmlcontrib_tomcat.htmlcontrib_tor.htmlcontrib_transproxy.htmlcontrib_tripwire.htmlcontrib_tuned.htmlcontrib_tvtime.htmlcontrib_tzdata.htmlcontrib_ucspitcp.htmlcontrib_ulogd.htmlcontrib_uml.htmlcontrib_updfstab.htmlcontrib_uptime.htmlcontrib_usbmodules.htmlcontrib_usbmuxd.htmlcontrib_userhelper.htmlcontrib_usernetctl.htmlcontrib_uucp.htmlcontrib_uuidd.htmlcontrib_uwimap.htmlcontrib_varnishd.htmlcontrib_vbetool.htmlcontrib_vdagent.htmlcontrib_vhostmd.htmlcontrib_virt.htmlcontrib_vlock.htmlcontrib_vmtools.htmlcontrib_vmware.htmlcontrib_vnstatd.htmlcontrib_vpn.htmlcontrib_w3c.htmlcontrib_watchdog.htmlcontrib_wdmd.htmlcontrib_webadm.htmlcontrib_webalizer.htmlcontrib_wine.htmlcontrib_wireshark.htmlcontrib_wm.htmlcontrib_xen.htmlcontrib_xfs.htmlcontrib_xguest.htmlcontrib_xprint.htmlcontrib_xscreensaver.htmlcontrib_yam.htmlcontrib_zabbix.htmlcontrib_zarafa.htmlcontrib_zebra.htmlcontrib_zoneminder.htmlcontrib_zosremote.htmlglobal_booleans.htmlglobal_tunables.htmlindex.htmlinterfaces.htmlkernel.htmlkernel_corecommands.htmlkernel_corenetwork.htmlkernel_devices.htmlkernel_domain.htmlkernel_files.htmlkernel_filesystem.htmlkernel_kernel.htmlkernel_mcs.htmlkernel_mls.htmlkernel_selinux.htmlkernel_storage.htmlkernel_terminal.htmlkernel_ubac.htmlkernel_unlabelednet.htmlroles.htmlroles_auditadm.htmlroles_logadm.htmlroles_secadm.htmlroles_staff.htmlroles_sysadm.htmlroles_sysadm_secadm.htmlroles_unconfineduser.htmlroles_unprivuser.htmlservices.htmlservices_postgresql.htmlservices_ssh.htmlservices_xserver.htmlstyle.csssystem.htmlsystem_application.htmlsystem_authlogin.htmlsystem_clock.htmlsystem_fstools.htmlsystem_getty.htmlsystem_hostname.htmlsystem_hotplug.htmlsystem_init.htmlsystem_ipsec.htmlsystem_iptables.htmlsystem_libraries.htmlsystem_locallogin.htmlsystem_logging.htmlsystem_lvm.htmlsystem_miscfiles.htmlsystem_modutils.htmlsystem_mount.htmlsystem_netlabel.htmlsystem_selinuxutil.htmlsystem_setrans.htmlsystem_sysnetwork.htmlsystem_systemd.htmlsystem_udev.htmlsystem_unconfined.htmlsystem_userdomain.htmltemplates.htmltunables.htmlpolicyhelp/usr/share/doc//usr/share/doc/selinux-policy//usr/share/doc/selinux-policy/html//usr/share/selinux/devel/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz2noarch-redhat-linux-gnudirectoryASCII textSE Linux policy interface sourceSE Linux policy module sourceHTML document, ASCII textC++ source, ASCII textassembler source, ASCII text?7zXZ !#,xq] b2u jӫ`(gslyQ5,1[7+8i%Yd;35 eڻL wcfkG_kPA4L=\FD9ymŠ)4 i-,MBPRZѯQ,h>xv|t#V*fJP܁@aʴA+<oqS8 RN|(e46֋H<;7A P̫;-Xweo#wNrq\ nF9&$Nv}r4+zɡV//V,}a%Jgo\w.̰ޣߨ^w 0=K!@oN MM$Hf'ȡe"l4`wx2޼I=(W:al:DO>,w3tUd>E)cpUEˉ p -Ʌ(rw/AUy;{`" W,!_lv=E@PO/UB}<mh;VFG4a"3̠Moòb9w Chjq흈 7x=AM:#>f24, t tˆ"@G#$~M+g@y ϧEt&`+jś5(M\(;B*WU*^:CgX44.QqV_${M x-vjP;IsCUQ a 6%K2eEӝ3ǯ ){Jjr: S-Bޙ*UŴ"0,Fy.;[IOYpEYA[T=RhܜR6L.-P3 VwuTWÞYUcY1u]47|t7,Z]3m 'w1LaZo&AIm3ob䖤u\ܪEU?E1 '=2Z#O]\38s4B2˚au'n<*E'ESEQ=;!{Kq֨U#U0f(~{doSE7lCeH%T_gbI  ֝pDj,3.* de, =9"2+Z,<J4d ڸW.ŭ#/mOCrεz6zLWvn8a>Z?%!0u z,'u$^0\?)0[/ _T<UAޖϞXIQUt5` К.L#9 ,wV&uΒ5?;] sQƍl؅LڀݠZ&;S6HʤpnV#ZkIQ qu~ FM&wկa˛ Ŕr&Œ …!#&ɤADiw&J9h<`OuhR~X+*_HH;YNRXs:`d휘At j: ʼnePFFO 4%$PL)QĕZyrDc #>c#n(^Vb.@77qܩp!sܝWrIVPD#0{\ٴ>[Q5坍 M""WchIǀms7)2ݿOXl9/›)NLu/FJ~߹krTb>*!וpє{jս.kA6]n>i ڗ^)B2q`=nBɇ_'fѸFP 6&̣0wr 1;Wh2\WU(eB-LOXa3JK"2A:S(MH]v`M˿Ét Dgw`[4%,N&D*ꁻrEZ oª64wH0 &XN7l ZoR)V3ɪ0 4^#!gm2!糁\8# ڃat#E>Pݾ<#(|2!FwncяA@Ris? jigI]FT@݋2WA+-ݾq]w}samг߈WcËIhPD9-xNaf h>-CKVkR5FJ:N+J9EU`-d =7\86Sa{ CH:5p078D Q9l"FHrO+ϸ2x z?D$AGje%idm-ȁ xע|N g,:^r,'cȡ)#ojp P xzw]OؼMfk<{Mn<ˣ+jL`:W?ݭtGJ!Dtث̌(.|qx#b8UP9'mբڏrńVib@=#ւ=)EU2]epZudϕ,XF;dp7죰xNØ;*;dcL(cCa ?KJԴ~їfmjGO~8c`3/VtWz{`$.hT4Zr[{[7^XrnPiYXO%-rBel"*gL8soZl Ğ[e˕ ]Kn;ߐyD&~y٘}W=\Y&)_J 9yDoPdkf2vŝ6 j?p3k?\3ܨǽqZ*3hN꼣;n=ʶ;i3!]OYOvb椹Lt2ゞM[RVHq[xuH=櫾3u2˓[obhP\Ya@ȜT9{)' x͸9;fg] R(7zqttfXp"5K+LT6EdŕVdtUb1덈&RУe 1xGTPeb8ᢗ|֤ ieJ(8ˑ$ܵ[:+ 06c#Q ʨ˦tov~:HdH, Hê:\mAWZ0K.ŵlnOWu (b[h?Z#5>][9V9r>,я{1}V%XGZ5H4):k}ywK>]z؄M-g(!R|Ӈ!NzBkEb`1ZjdHKԤfoԔpEPA$4z08϶ÌdX,%4Tr41C_g==Fv|.SYEtD*|BGαmIR96DL_ k[:τng#@F5'o1 >B:|GPX' 0r1a遗Kâdclj\Ť86xw79}|d"4hA3e%ĞMd0x_Ȕ=̴nOq]A{_ nM(XzV~!-`l왟W?r[TԔL[2Up44߈pZb-k=Ѕ ykxĢT~H)5&R=pSv4Y_I]h7'9ɩ[!nJS&Y(f$-Ps{*Hvb)>z$R O6xq7*u8LDV\[W5o/GiM{wqroooi+SWbN,/Z:M%KW`!^Lж _6=q25DgtYeSc 3~*;NIoLxM\wh]\u|\҅ yL\EGa1(_PR`!mKs=,R##LHSd kTTY5Ddܮw;ɕ슪ua5 /Vkŝg,% dC>Ky!ԌʏEF(Xsɒ6Aˏpz/sA GABF:W&7݅Z*SǦcK#m&aӕ s$%tm&!]%iJU1!m%iLR32!d,.Fpj6ir?un "\BG%ޜصU?}ѣly*ڒr~1@$QyԊؗ='2.xYAZ~(_wfn0 +A{waah*d[aSMWzU]"pIzN^!HnBZ=@@]`vHBŧ)cJ<9rEBZZFpUѲ(:Œ7O݇z?P.s׀ZOTuH`7ҕM,;ϯܵ6 sΙ "s=1%xt$ kϑcbx/+;0ϡ)ۻYvَ6 ,c]=% Arvl1z OTn9Ăd;j%$Fv~݂7(T6BC_E;cJj9-务[xdx{?9Ab# nM"ˊ:[=BNs:&b#&SNMMYKog8q2.͹A}9hw\Í.""9P_xm ")#V~>1Hm7 F4[SF/Ϋ"6*;7,!~b'ȑr"5D!0WqxeѷTnuHW@hd mHfx/En#$I_HK|-k>cTXx7@/C`K D" ns}vt6@,fy#|+E7L2r.7Ct"v(@*1t/mS1kq9`FDNwc'{. 5I qx\-X j՟XV/YLY/މ7cӧay%-dm9Y0 QpQ|xSS%IE*<\ن!CqT0EYǼo*hi l(Z[YpNCX!(J\e")ttQ֧%!q':OP0V܂L67,mdg1(\I-39.zPEr&rT2 Mv˥)=, >˵.RA P$UPCY&xP ]Aa| tt>-9oM}*FY(#qޱX+N`k_ \83T+\H1j%&͂#"F q*#?[vbŶqed,RzVnjbNP~{2#uT|رְ*4vɿ.6s¬e#u ;t;!9$Z:54A}xm tA"7 SQ _SeNzR?eB 5фM_wD9.w{eeUt50IWC ?.JӦ>uV$)y7 r 'GjeToQ3K[Lr *_J.P nʮPWtPh6i)#5ڔʏGXJZ6BWW$$q3`o =U99* JMA(z LsmxV/5zyS̳\[.x程-h=]̐w;qgWr!AB "u6lo|5 B PYp a/+@k xE(hn2,R3oxٶvo)D/۴.Y W*?©aՃɜHQ/V@AsS.)Blklŀ!7IX-"GAZr{uJ4s(a1J(u8*p2fYtd;1;»&T]rDD*?bz7hSx.FC&[#(4iv^@o4+"U1 ?N'GW$1{Ml.$@I`*Tn.yPI2HBswY d/l%P30uz苯`5qqGFjǃOQL:h{UF<@ l.Fu$|@}VڱvO18`K-=0lb pPs |8)x}[X: Nx)'l)Ybdr M XgRè.t~ 0 Fݔ~#7T >zDo~8-{wᨽ4L7i,{0:l'6|>w[->:Hu]eTȳA9wճLF ~`2KX3XM qGWD {ߩRcT g m;Z_)p#Y\,WJ[T﹁^$?-5[bHeLBnvm2Op6n\EѪ_!LN9k9gO'U6n8Ѡ($mqZ#C2|K\fpsLrM?˙1@MtB\^4/K)G0pc[Aܑuuo N,f1 O|!sב=$;Y K )%q Yu ì fWh UK# &h8!g!NX~LT8#CԇNteފ!5 |6 n35ڧ?BS\2Ռo8`_F* Ee}?1;,}ZOČfk'KYsm 3q";2Ku6U(7ˇweiPp'\Hr}_p W nd髝RߧKin5hd(><+i<]$?99e~UEaΟ SvBMksv׳qsX#1ʯX'v$+,1eg b+˜6|},_Ln9qmĿ9FQ"X.t_f_soo809ǬXKs+TQ^P@,a.#ijtrkvhO]v a7=6yBJț$'wY?W _umh}e{s)ôÅ7rtZ$ٛ0ǺK]W~&ļ*!W{c-rǙ5Z*d(]V LLր6տXpY>yO$ΓA.FR4&u #6dXPvs٥UQħ ce äD&{.WH9>_Y?b"HU@Mmz~$+#)Z7J}Kd Yl᣷ӪdбcO;WZG|sKx]o缾 췓v`u#{;)"cs?e- pnnj wz*HXsYJOذ R ~(f[CܞӾɷ%VnYr?1.`jtToʷ_嫥6U|*# >J_7!FP.O׼9ׄ{_+%b@hMU\.~ME p[!^`‴sR@0}Һ_ƝS|h'GQV; q8F9"Ʃwf僠] B==PV( |Eک"bRah+R2u܀{KH9G  r)¥#lwivU$UðG4ό.aH%IXV'z;:hxVA{mNڰHV2$xqCc )N} Ö7 @\GlC/t|^(]\{L-0kd_VRvHR#<6wWi]z*BIhB*Ӽ;mhJu$vR7{*KB7L$+6xG]2v:{+\i}]c=_vvN E Ȣ$"d>OM+6VIɆ@NY?\6PKëV% .yp,?(wu\+*55>YІz޵E Ǯy4? [ΞPeX^T qy暮ڎ`3L% l $E6vz97 дBX W]8T&*!$*qT#x_{jܝ-Zx.k*;%k~pk$PD'а, [)e~QeHۮY&gY[gtc;C T05_xp`R[mRvj4q^t{[ W@+y_ FP!cGi%sޯmu uBGIz;YĤR Yd\xq/yG/"IMc𻎱ٲc#Qh/TƮk>+񔅅>#+`#^O*jW]Zbwut@m)廯?iY7WQxiM1zkg9;ƀ"y測&jXy|үΦV;ɻP ibFX~@^X߲V+ 1bYAmbV*~D WT1 :ЎSg 7klۀVD~I_yImuObXP+FǺ(5ma*0ڟzsъ:X&3ZXuceɠA+ŲM=>:tld鞭-<`ဇLمFy|jβufՅ;Jtf.Fj)-E-vqs{A&'F}K@ӛCy@ )m]HԟRknƒceDz/EfH18Dm6l9T-'h`)/0C½=v2jqt.".ybKjT3Tf/+ϩt ۀ`M%qO3F,n=NBĒH3k-~Yŗ%.)H'зFhw= XmtD3ڹ0j}MC4=g_" %&p߻R"[N}+!m͆ل ߔ i{ w/ !ƨc] u=A"+ir;GpXN0hw?iMrI'Kkh;vYJy0IC77uiQS.F<[wg-(|IvzٲAv%{:bd ;Ј\Gդi?-s ڹc|5w6huSH<|<v3G_SߐlJ#ah{LaŎm\~* N7FgVJE2ٝ?.,qc(l7u@SJ2ÚIP yX^J+O9UZĶ,'r۞_Q 5:6D P' Zmӎ[MH?Ssې;d;{mxL5:xUdbi$}@y6)~sG+-(rcg)J9;Ϝ*5!k y"fGk] }?E 9XL)MƜKPMk;\x`>T9!_1)̥hK679AdFߓuûtTHH/+=d&4M4@>tS?X$/jpaLC@xfg'G핥 pf\3nen3SDŌXT$?@,>\gJ'<4|rfGnp4 <]>uUvǺstʴT) |+ud{fP]r /5UUeb\>Gm 9ZsaT,6>- [!ӧXa*nemw nowF&nN($#3Ewfx8vFjnhjV?9Z @ŪMl`Y3Rylhϳ sd@}zDN`./:YGyrī?) iǣw.R\6šF)27bŏo9w1Tw*]Tģ*;v2Yd@z jA!8Ot|X㍃Eg)rR`3ȸB .),)l"{\&?6M7) h @=ꖎ|2Ai !e"pu18˟dp䌼7tf?_E|SFOl9K;fnPjPum$М|dԊ"n: sG b;EhW!]p#R D*~n>tFoc*VAzu -C-|o-ܗnKN=Y:WM[$X>oƧ]:T8Q ʱF#H]s]rJ&:hp>.TY{{+JԱ˅V~\Ιrh/;0$ȴ墱Ce@~ί빎Bpuqt I$`.rM)7zLr(%OJ_Tʪ O iHtOi|HQ~AG+m_\L:[?zy#:FcLĈaN-MDVvhwy͆Q!ł+pSgt>0t1n @/`x. 25*3:q=9ytyD}eۓ+CS5PLߤjT# c1|rDT1`jR4 ZuIl"->)ga~\TIMߎCGfKk;Е+|0sSt ;oTp?Lؚ(#uمohLAp VHLL5}E-aTq$KVhBK%?Xi_Ӓj Hؼy/^'(K غQ°r.MړbW!p h;j'7Ta,_ IӿSyOEb".GDdэ{ESu,XzmZX%OV\!,NdX &w54c@k ʈ0w!pTAؚ-UJZ/~u:<`_n($N;Pf_qس>4"|ݓawA\&H[A0-Atz0ڞIHqbdL0=Oy)c؛a7t+J0{+vMv|kZn # )*DQǀܤQ&i7sԿ%J- I=]0$Ap_KY&AR< ÅX}'G90t"̣&>~DؖY79(^~j ?T {t(qlڴ,W)m(FWW>woeI1-32T`"\_U,~C,u0{nApoOskK, ׬~wi ϣZғ("8 W9A3,&B₃E*ҐbḶԙs7 wg޽|b? j)rUKѮ=p;!<4&0Z0ْx}s4zꄝ@/O;G.qB-Zk¹Gz%mJRY$xVUѭ* (Љگ$E iocJciQ&Gg8<{9\HNόC/[ku2j1­R6Ýj2 WT_QpIXϮMw!]h23 N/pP(kۊ$үlj|6dnT=i#8B)#䢍nyGOn%ϔQBaɯ/]/}D[2)o47zw LY VȒ`6 l7L |<+'))"t\-8RM{ehᤵ3O'Uyod1[" dx[tv,bk{66Ye5IƗ@τgd,܎Q*`%Ձ[/;5c xݪF,"g[xvN%1q>Kl>D)7=s_:pA W,m D%uo+I κyŦ0 X: wûF<ڥ ϦjJ;̵Y 0.PMmh22A5cs}|Qp^iO;`"10Ӧf9czͱ`Mn M]>);PI6*CKLQE XjmJ$wىZ5"gI6Ak"[MRd 2g#(4olB:ˆj,[&%' A$0ϴmFT)9N"`9 {jk<] !ܕN! Mܪ{J\+*.$H-@J|:>8oskЎW|4yoo,\.JQ!r 1GRws7}MLk5/eC={-QtER(5. o?א w/kÓqpJdD˾.fuinK3"gz@& d0j/*ѼYYGSZy5~ ;&JBKSP~PǹNqf{n.l)ԊSW R蜵/, M (gT~ڨQ0lS qgE i W, k8QW@M^ +doS]v (M|͏Z>$z +)J˰%/m.6n֞s. Qs"1;ځ:x;nŧZUq#/'BU1+S "ZVSjhyelh:A*u"#R( -E[0n,T .6AװiY?wX";g$U9ʗWVznIQ j6>qT@&% iVLî>+2ǕOzy !n:f dVǟihׄQU3` iR&3P}F9CK` Ⱥȥ(scWN"Cl#75'u:"PkJ<.HEU2D]al #?U44ݣy Ǔ(zb2__mCOm77e/j^aDȦ(+MgQiPbgZs0Os2Z!S.OT YGzvjd^ڀTum~iKy@ 헇Z08ΰt}1?U߀FFQ`eGJs[_%L]4s-S Oևi^]݋덐d )f"6 P0GGiawuA* 䛭FרZ 9س_TEL+.u ؈$@FPTΰlek5g,R9P:"te“ %jO[gF-pW^N:ˮ|0y3|dP 7/+"5Kd8B u!l8l]B'0z7czhQ%yxP:~ah;[ d-ߜHZkMӞsw>ca^<,X1q-Lt].X7/\?YEJ n~tɻy4|#f&g[#l =`uY+=W ͸>8q4M(~]8[# x21б` !5};Ɋ1A~Mu>E˺ImX4 ")m1loZ88Ȧo맧j?joQJ֢o|t*mx+:3\NIZ1~Lgw;Go sVEhqvAsA?Qu3Iw͓wCu< 3T2]EX-er8P[-;DX-x(7jî[qSYî^e!{i?Ye:;20%ݬ00Cΐ'pAz^ކtov--UkLmCUZst3l<ڮb O;nDaO"p-!˛`eҽn,|gjm;+&'ulJ1-&"6%"EpQVk%9O*5xZ ;s@ /xXf5O (6I Ҳ |Kar wR mKr؜> * NoA:K˵( #G?7۴kL ߓ'tǐLْܪ;l&=܊`< Cw9F6G'Z? 4.Z 5Ev6Z?E&5Dؘjg qx^0U0NQkNI!\"9[qoQnp/,}̱<-4vp1L UezϞh\w4?zYѪO8̤Ů$ 0⾺Ư*H .sNn-cF' L0Dy~x Jɫ3C,"!\]mLZ/ Dž0N+0+?Tįbp,0)l1†}RV@%3,~xav %C1 l_Z^wP/j^\q( RWs{Z]S- ̻&4Rs6.v)qaVąKoY;ȭ㒥BaG"rE[=t8ze\-siѷj7tLj33٦sz倆v߿DZXl ^iK4sq6Co_Gz8abdcr&KMnJoHRgN = .;Cu ݓ\v9 ~ISƧ{A͠_dS 3=Rh73` 7BJMiIXJ\ЭᠬUQ==|B-ݺ fV%,nS |EC;: E&͖XZiXÒ:2>qAWgG\B1یy)1,XFDc/d5Kk#W.i٤I;UzG& RGg{Ae5\] gS*c'E nwme%muַ)FX#k pVX7t) > 4)LFbX] [(7(0N(XK蓾a0Nm8UYqr>W*+up! ,oLyJgˈN`M N t єD@+dƎJi`ZDtb\.Ҟw_}hL)l!L`.N+X .]΋3ι?a@r#\XUF'FɄMBWP)pc_ =t!/,$7;yj@e?rTfoU>.ބw! YB M&U,~fda6v[]BrQhii_NmlVҮZJ"t{LxR)SFS fb nV|;lY3az0*{FGxKxFf郊'ܹa WqRQ*iv4o@776gyAx!DEjd0$|jEK}1w.8|.?Mx4X#07̔D6tz\⼟5x{H4a9Q;Na8S5i!`VdˌAFS0bR>.WW2iy"4K4琥*,F o.3&iH zrmHP2Fg(E>(v›#z5=95-6\{WL*Uiƽ]|"&N_19/_LYG9r?G&X!Vd܊} D>, ̃Nm0L/^53G7ZѲ`R&MC]ly+_SLOfk% lZ869D:Fl.<2G *BB 2H2^wԁewNbY.4J_YXcԨfx@4j@b\ 9L?z#jx5y(awG~Ph|JhBGWX7(VA2XɋeΌ rgKq#)  l`JJ*DZ׽GZÕ:7 JyW&Gi:nn۝+A&7gz9?4<+1Ҙ)7xwc(prݭgǠ,*]dśw jnz"yތ?_@I' v#ؖWC&#!9] v[`8wq۲%%!XOz{ "Oa8%m_tHPwh``] җN) 7Lh -s6ˏ"M/>bfk= ΧC\$u4IcRk6A!ǂSLf&&3PrbB$޼J޳Ƈ+OJ\!rz/s{ Bv<0WȽLEq#W/ j~/P2h7Xӽcn[w!p=c(* r$uuo5Ol{&9TPQzq*+QJ s=nJX0:(k$Od3{NC:ޮiR=*} MaqYo4Z#x8B-$k{\͝YOk~1g0:k[ <_r.rmBGufgO}n.ó0z11Bwd4 v*dN|[nmU{f;Pְ J෯[^h0hs3hj; ]S]bocCpL- aH0<={,L?˷z˞/i+M,dQQPdo}_({YE`0cګḱ\nvp}W /Zech$(9;Q<c?%'+5Nąk[ 3tFyV !C97 ^\ᖏ 2M V<ֳy^ݿVe-%d+xȼ4hzNwxyvծY{#{"/   @ z9[TQ{Vﲰxj=ڟu_ ] E:Ǧ|e} G$8IbwvuWN:k$ @Ґ,8wU}.=}WjEJp+5e)XOn%ې eL!7M#;k=Pd=N^ 6Kotr .7OY@-垊 es{IYU^Ӎ{o{,a‹7b f>:P/rbb폒VriȐ~4ύ A?t7^d1<T ԰ "lJbuqGZggᓓJ85<=0T*["9ǯN?“kZp?J~j CUakq:ƌӱr(9b GWZ,Θ7@0go,ܨXr=RFnb8V)I/%|~㻡P ;\hm٭~Ouςar/=\w'IzC c{IMsxaTꠢs 2tΈ`L՚G݅=zOt!x^mĤ"PG^T|l!5*ΈwN&DY =z=AZƘB% k0W[~jŪxvUp&}dJWE_%Yߛr[O[BIoֳ52F@8pc,hYiſ3h`ny[5} M7ehQ& 3fĺ]ce[aRBmɯ̺MU3NRE@[4X`|g?h?L'ۡ._7Cjs2p6lbͪ2\Fvz8%xt _f)h)껀2jo0WrD$ Lyxel"RClĔHukPeI> lg&(֎@_}dȽLzF ,hGj dT[8jwy}qa.xƍ2*o>v0V6U[ 䤉 0K*j([L E(l~ݒaW\*+B^3W!'dG'kh5Q#e?ch"!y$@?qi0D툪+ 9VrN^o'fI]\3 7M & $@r˨-l(U94mlX61\pzF@,;fGtR#$>*PEps?ijm[z-aO_<frұ,Tʲ\.|>+ҶSރb`#m05)nwIYrg%v&O ʘoQݱ8$ه_`hty s՝yMOD?>$' N0 Hn8TQEWF1nu]~6mp C~\OKqy:MIcGY"TE0`=`#Sh_*q * ~xjp{98۹6<2}}zoP2.=>wNIht;@m~8B s?4n.9AIgڱ2Wd2EC3A=g

aEq% W0xyr|{|y GbF!.1|K{1@jaVLX\_QdpiR^B򨳨ҩbr]-G~d4ܹt .pX#x$jHo( >ޙVbj,C7 *3-nN=~1#U))u $)XxtIp)~bvdސD3N݆); :o3)wIM}5%HxB _ WB2 b^ N0~dHJ{^37ṘgjR}K#ybKlNN4@Jъ}=ZqK3c`#i6#) ВhcBOOtӔ֢'K nm[BVMJ!q;N7UH-֢ ,N.+>U qV(%'D$R"?R|(O(Չ X>߰@sUh7@-\HDwɠ39Ϗi],D{uayN-Yh{?x 'Z<@;AϨX3jBFdoI\ Sh2[^Hl!:\/%ɸ"Gzndg񬧪1D 1YG.~p|bO3S03I`R{}oC( r~Tj7b얭gc'ܵ(O֭CFKnoSN,H&/l>UP_ w[M.hOH\Z8h͎!xEjW@RPù6T!xŠޣzW',28~/LG752&!!Nkkj,l5K IJ]i~2 eƥ? {E.q?O3ay{.@p7ϥe! &?ֱv̎$Ƚ@Aj2V>EbHUnN>T3†G0>-Y \OTUM0IfGLrAgFf7JW3BZxzq*)'>x֘EN ңqM r%ũp~Ff/C._xTܛ=AAK1%T#oe~pb[8$jv3xks!2{IE{HDcMݺ`CzB1?}6S?L(`+qJA+F>ꦔr~A[B}]}7A&p|nyRc8Dêwr3uTElay> [u+Q2.KWNU~ R'@ro? Pd\EN\iT= |Q.ʍ?s֑6NbN"A|KĈhԭI݇};'w\vG wej5!dsd\A4)+*V~JB,[.Yg#5P(m"hsZYpP.nm21kp1*\sҚ]"L艕WA*|KGc#|G SU;ݮNZiBQ# ʁ5 [ Yl a8_~%B0#VlէR)*iW486ei/F nFIUM<"n&H2!v-lW3,=PZG};$6e!FT,PȆc;+Ov~:pĔOٕ(9od+WĻbr *7.YE1݌koL^G;="0B· =ޛ٘'60WYIaMA5?Q̋n/8?Jr:OFLnSȱ7y̯N8NQPVַWK>PCy2E8&mmt͹4k㨆`g@]Z &r C}!^y\ sQO;\._Fj- `uͭᜰ~Ѕ_h`LB(&XtBk˹eⶵ<4u(⒐jO$֟GZqG}lM6߆um=P6G@d3;Lw1y7>>^O#D-,0` OFZOև"%'\|ܱ}jwfiU1ZyFWD_k\O_+R$͑UÎxauʠɹǎ +OKB@M jSYܴn9]R&|M8 HErkؽHx-?AA{{u9_N!j5JTtڹ"l[ڰ"!:Y|H%,@*Q!AoZgw=wΣTG q(a 9Zƞ#L|m}(UK24#Ȍ$5kT["bi+܈)@ٽv4洈l{ ~1qK"?J%>@$5)Ŀ:_:)wZ݌ٜ3$/gaB r71iii51)큈mhrjպ$ijڢϒ-W/b?$!MV `.y3Yw^kr90{C #K]cչ$59 IdqpTvCo=~ .>bp[X̼ RPsD:&jIZs%}T$xhY¥xT>m3 809o3Rʽ' S|/ GL(#cހRhbXrߖd_q݀Jl@)Q41Ao4r{_b&v"A,,I;V*kйbKj#l=?ui޲?ܙ*nkn_5P<8Tk8koЈs;?@eoF!1XEw J_=zߠqϟ%E񟞚7sL3Ez[C,XoY7#g?j9A~ȴJ$d!}AZQEB\ +"ߌ$ 8HJWWbg Sʂc*4j9| P0XGRo8ѽޮ´:ӓoԿ7q8&E1V'|sq7`}I %v!yaht6l8g(z,(q@'9F~n;JZc)"d+yk@{dRby@zݯ 7|.9hKe6Yh1V[V osٯMcj:qfqC}%B`a(Y=.ipoXyX=%*ry}׳*o:4 y7,³M,/%rAzR@IVu$Ywhȓ)H[pl F`xk{iH1rt+5U`31iXnj|,'g -'0M:|t.ʄ[N!&[^O"3rqg[7}rK S dxbGNl%1Tc)zFNy&'EK I}-xZBE,}AX Yx%^Gck(ϯ%jbJ\q zcMx;yKļ_-ЧWanhl Q?{wⷦpr5( LGKM~C 7ۧT]d.ǎ*̏(ץSkTO,-ßHׇIAZPUޱZf鴡ˬ3r͖H&œk+ r,T]6SB jCF8B66a< l6V6tiiM/?LZBw ~z1 {Ym]'s2'Hh m:絢ڬqOYWۈ @_:^oz I0†Wx γ$:Ц|UH$>zAF]p=,6 ,E.}=v9J/KR? F\{Ҏ=(-u;w4e>e.I<ȶr'eFp;u#$gc"%fYiC<OSȓW>bpp>'x^א4r g>WϭYN\gsCnywP߰U4Ⰺ<+;auE1l1w2boÔʱ"pq s,:1Fw0dϾ.y +OyG}Rp/Ƨ$/eTyڇIL(|QEmC-[%i [^g/;alm~ Y4jnY'T;w 6uu-]B4}g[}@_GP^*-XۊOBij>ڊFW_л^HU>45RS¡7bUaJ:+"jDo _Y:)%Pe'Ru;H9ՔH/sM0> Fz~e)YC^iiy[ݭk-σu0G•d ʐ!TC򡪧 hE.#6OTjkK!v9MG vЉ.[jkAOes+_{:as;ei܍ 3~EG!9דdf܀UB#T,ẗ́X7)!RM$ۀ GX IDnr墒4xt;jήdա+)@c^%ȝdb67 ɕ*hF_va,ԗue{Q׼n!73L]PّZ9Aw话2%9!yQ],Qpn=ʂ JqhdĢtV=kwk6lVa0q:Qi%3R`njGPa%BSsh'`cLP~$4-J)/Y6{XpP`'Bdƫ2mn"_T*}{90P?)%iW!FG-2?34]ޟl4[S`pB#@8zؒep/H0J:'+v_M/s?+XR\:sqB(mLAW`Τ2IJ#8 :LeG4mzVQ/wэ"ؐOY(v2ɷ**NDRZ[eǾsK9WoK6^x&ز ;{YuK6ű>Ub 2ޑ_fi)}v0}.4qQf㺈5M@h665n۶$S%J# ͕r[sk(DbP(V?"AC3љRT/GR[y\P7BS Dl6K~]iOPM;pUoBj:ai)\ G{v횭 ϒs z!*OYP+98ddUYwBnϦCARf auV'-G̞a(oHG_mB5b\o"~+t{H ptDb]?@ￄY Q47z@6|!YFN#n hё%6&y#Zwp&>ǞZc٫PID~0&NRu~|_GqJWo4ŏ*0,6.6DT.Z Z=|AKn~3>Ԫ;NL΀E%M?ԥ Ny`(x9x̛^bYE̓W9*5q)vp0]Z'7[7Bs9-֗*bi."5dXd1e(M>seK6/@ls"](Q}nk59%DBlaD$H﯇ԫqojv`U(g|v sHXʑFpmB5BO:72*fd2S @0%%[Ʉ˵)Zv;AYApdIh544vNNاR{8q ?0$(ʗ#@+ r}^>d}(ӼY68m`Yv4=;xL63Z$R|J5Bo:rڋQ0[}(aȼFWM{-:n8j*w޸ So8uTսBb~ 408,zk QِWֻ 6!^7ib;+v'WVڢsEe"/`jJ-~IkL-;tJ^75.3 )wKWbU֘j42z S2o,Ј_/\?j8hG೘J ]WZ6k%}K""a N!H$T@\Gthyt)TV~5W_7E|+a5{X& k SwNHQϻWf'AXְCo'8 dy<4ld1j^NkqrK4c6fqNaՖ+Aūf | .01Z liݏ'> ,w Gxcb{sт5|]~Wh]ЁE7#-O%eC'tH2ԏ>c}:dM|W#e kVěPDO8HꡉNn9 iSѡ?M(6{쵴h[aR/8w:UBiȞ X?"<2 JLCM-0>?"g;gF㛷S%@S]pz"FWʠ0}q8=ZJ-/x(tgw{ gwɓ[᪙kk)NU卓 ,f\?M:b>ˍD;RMfL4bOܿD̔\͙di2w@e?o}h 1n1;/$mX|a ORoVBȜ9qR}N9Mz[˕lǺkU!F3˵lJ{R,gpҵo6iH!C#9e}l哓Cb4Ol/5!5=CDuI)>(Eh :j 29's),YoӍnw6P^RZ~ >y􊊢 `#D뱢 ʲ@ v?4}O6nIUK]B%+XK–Tą}rӳ(1^jw0^&'Y;-tML.s#YRUɩrqr>Gk-?̡IK/ŰU}(Ux[|d^tUClfH` njm}gzF+%1pp&KVq򎸴^ϡT`]sT{K+_=fb\PJǚ<%T"޳qHF^i[ı ' Ǫ G_xABQl\g [ AC Hb䤑xzjϤp=-&XjUMr_UwѸ5$>^ @z@H"8OkޝO3˜,^RXu`Y{;(%Ŷ8'%G,CI}H#[ߵ HT tUı&zH!@B_}?{!m=S-l-ؓƚIINKi:!M,Py  "[Ž8/%k {")Y e3"5QQP>9/1 YmU0 #MCWBI^>7N@ x)enBR1 }$YZ#ъ@AEAس~A bKtZ6ftosޮۇPnÉ>t;va[Zk_T]4 0x:m t NGSn.,.2hse&ٺH xqgQ +ft3i v^Nfw@fަpIOQ*ٰ݉{7=K e{M RZ]q.`QD-Ǻy#kgv ,ݒ%xqŠLu%$ 7_gԺ;'=T/ NQ+>[%X{B rj!7x xOCz mU dr{ΌQ-͎4IV XUEP!T1H "=5t,gcᤓo&Ej50RZ5En1/~Ъ3`:'dAGm~5ovIǩۿ_̵gE*opyikܽ %nΘ*9iT:MvjSԤ: 8Q'% c RL s^ks[P*y撚}ⷲ5|D-Wj9g{`X$Zyc(D\:  \"xGkZYjKQR5 w-%JT_-I:zw>'ZD L|&AG`+JSky/C"PYỼhci4XK[l%濚GM`!VȲD$|Z2]V'g7Co(zB_&ygaoMQ^X'E;~S-V^Uoek'+#z[D2!a®KscTª:ʂ-m{e 8;xMeC1 bzOԁrz`\K"t #q[.!).~<[zK_ >g^šoMoIjJYڛ|>6&pbɊhJJ5Q`|?t0T=#dsw}V02DP#3!2mKJjҶظ g_Wnlf(轨biaw; yk[gBwxru: %2qm8Oڷ$23w8-Enn >J`Qt濅HFzΑfq`6n&j '_XWeRL ' >5eLS+]a[E5CxơXTv"~{ \sk ^+_1>"O7}E]Έ>M1 vSEM$MK=֐A#G+r3Kjh~c W5w'OThc:,W HK"gJ5t`r⏈< W3娩޼n7”#BiŽvHO+?1zӸ@B2Lq[k"| E$.>~t㵢jAfyFM1 v8""0lVY,#Mn3K̳ZHoa͍h}A!ЈXU?ŃP&aB?L2dw?FX(80KbU.$Bb^1Nڑ8i<:I<)"Gh(BZLsWlrݫf@Sw<`Ӷ$#|{W}i;^\)(}5hN(~ƴDͶ)9oȁ6mv@.H5~=8<ޅh񯢷0'mqHᐱ3ؽZZ܊qSW|g8g^=K f]1-[양3@?fȁ]kg61h{meH[C2 /$խxB l(:=vtT[ؖnRm}A3b V{W$a^ͯ66C"87{Ľ~K! Jgj@&QA6Ej5 t_v5Y8vWLi3;3h܆ by2Sn2#/n>L4i߷K|*zS*mf|4pIw8+p\EO̘pPt=4Ns'h>oip6 \3TMQ^MOzCi#2 ]+(w?rlC]4:#3@ 4`:̴^M{u!HɇdfF4 L7r%n(Ri wx3r Xa]ACCN{g,}EK¿ځ\!n!-,oBbAݨܐ[.oMB3 +"[Y!"es*3 GC?m {hydF2 RqPM<Ө4)/wF5>[@C=xPhV~֊Ш<2Ɣ 6(uרUب Z&}Ӗ{T|:(v{n+X 5moVwY &EJT Yb:I l֝, h~I2}*~D;@I׿5};q Hp\OceC ݸ2š4qRR4s1e5Zg[lqck!XAEjVgJͻHwm/T M>)R4cE/,j_!Oԋ|\+6=:)h2]Oj.1ck:D1ڱ+MkA)vtLW[V"9׮yAåpov͋ԝz[Ql̮ zȊgFsRoC&ΕtORPj9>]Nw#{hkœ1Ӆ2М2S,$d*=$ Vp>$9ؤJDi7L  G. uEAB/H1&",߻QG}W9~ӥȚjt-Qygh9$M$D`(ڱW9@Ug _ KBۛrWg|ޤ|Ϸ)-zjTi-aPP@6 cu}͛nwHj=彴]Vqov@iV %thk) i;UIƒP߹S̸gE;n2 ѫ3q6RG11OnoيF H0F-3:(%>v)`4iT0;~xrkaP{XۊNn&74eDyAd 8mFM~r:Su~rz6'QeeAy} *aߚ O.|C$B'}uW_jtk[i2$~-e M6+C~/'rM c[mU gdLz;_Z֡3̺О3́.ܵ#X?ըnq=%\A,[-˄Dk(I)t{4)|d8@.G{"s9$bB%SFï J/5f*JҫkCRX ZWFoч\l0O)0iYOh4CDp$ c>gJB3" % Կ4cΘ x'ٔ rc :F3"A  @3NQ%,W&Z^dn_-֎뀏aXD_+:{հ=2%8:96ir0si>D˳pl^~RI]և&Y9h䩥a#43+'2t;a0 72P2 m,Tz+H]fUn/82Qmpg6{z4 b Lzn70?" F4Əc XtR_%yxY^$a3FfR,8Buf:݂rԸhc?oUluGH.Q0B3wzV⢁0;q&ػoÙTAAguCa%4Ԓ<5<RR ?K@ 6!WFVj4@l{)#$t1;CP[>R& XFj)0TNfК3GR? |J{q@3b׳ޗӫFu;C "3ҙ}z>PFC ^9!mkІ,u) YԑgsN׏ߊZ`!.]1:T 5iҦ t1E7 z}'<+(oPɘ(S'&(<+,G"X a/DMv&Sz: TX ,ҸP+wieQ ٙ9iE*C|5]g 9Tt[JڣšA)1ٖgDlM*xEG:ޓ6Zn#&0V $% Y2C Z~0{;?ϼRs6w5ZH~bDG #;; ![:t]WpY|Cw_ު P7CQ8b˝S`,0oQs )XJ̦HgaxųD\AUKR_N)!B~[U(!y1*CjWʺ=P4$ 2\B<|Ê#%L>f7l39 zWT,:#x$%6`.K+QݽYi$?hbnt؃J5rC .o>Q ȄB'Arʯ>֢N!1b|Q ]RBpj0KUJ 8Θ.kرҭcjxr߻ML*ZZ#ͬ+D4 &ŏG'c Kfl sJ{q-`6aj'Z{;FrgV04-),HSU= g-qkoű J^9%W?#I8ැW&8dsKL8 Db*e301uj8^loQ;*ym,[}}cS |TW.Fh(K&$+خqU2q{=HP;z(cn֍Ot_{6 11{7N,pz$Ϣ9,BAx oeߩ2̯Xօn-?.;d`-Y=]͍Zb)t`Zy#%b| h:x~6\ O`@,RB@V홙KZA9mjlwBm9 w*ɦw;[a _gjKiL ZckBLjdF7oH}Oe V1n{Ti?Xnq +Yjfm4 P&V D=ͱ>1GǼOB<6hokeZx`}ιIlt>US|rl]k'wES##lVQ\+ekqkd :þAC CܶN1 .u7ɰF_#1ц'!*%S,|dUE+53jry[0xOI_W0|^E?ę(m=yApYxT)Vp u꓊*/w1FX7DN%>3;xFikLM *Lom-'٨Dҡ2'>{dtgs_f1Rܞ:V3tr})%mO",F "sZ( :Γ,3j=Ncyiw'q!U&5C lRcsOTQP8 V_ f?(/X! E?i~d)>~h \[AEkNZ\"5Mhϻ}CDb8rN^b+#z*e/e߹X.aKȄi d|5EKXx\x\-o,cFhe0å:2Uu)_=,o⣲TUG+ ċ[O=X|:Tl%t8,cHt/\7: W?JU  _4n4Jkqgg끼 LDxN nu5,gv{Ы>~~@֜jbh2h6[o,O-T|g; c5Nk}S3(l`/mM Dx^c-un[#[ 4_x Rn3 (D 9XSNMu)I+.swl>xoaE `EdCwf}eJ5_)96& 'x!Wɞ!)@oJ_LU>{Ż]Ph9W#?/IT?k {c yQF}y2I Lوfc& i@ӅT=]u= ť?҉sgׇU?8QPF5 njF*=eӟN yd S[47Z`L{2&tW.'Y.͜[܇?F&xMstϽy׶)Ӎ P ?QףCR@^pidqM!J*K,C6^fk<1$hX|R:m,. n0btta=$(#9Qgj"ޠ\AC֮,ɹBtM$ Bˢx9gVEn}{F yp6<:wudzU`VE UKcR@!"ڋӋ5w,}Y2\Ǎ:$&9']1tϯŪ2|qU+uՇu]EEG&y^s- ㇞G_NN굔) (0\X z 'zSW~ز mmù)-~rq)rg7EY_dogѷ,(N8Yk?9?š6d!Zڄn ڍJo# *zi 5QL:[n U%F&)b)IZaMIԙ:Dӯ$oHLm͓Mz O=Z+6\+Wq2,$ڊ]w2)"XWe)G0挽 wF dWcEۘ~Lm5wܻ(%J%U(u"m,XK2-iKzD>鏟Oz60I.yBxC >Rya.X>EʅlK!6EfHय-cJڳ/$ 9|/u{!vwpAܮ b^g |dx:ͭr8"'=^ y#5{ Q% x l.s*xf=%O IeD "#S wW>o&ƛiš;{.AP>C"kYĀm"bDV\r'gzoю֨Z3$۱IםޖLau:T匦nP:ѡWIN|4X (ǷxZ]p|hP)d#`ku%pt, ؝bNH1no,rXa 70Z,B-1z^U$J-$ZdggBh痃|6y\ć7/ac?&9[~]02yyi𫿜$mH@:&gb1|7oԑm=qJ\^#ؚ+[ J5' aJ.mn2\.# 3՝Bwˣ ^@!/( Qppgti {fS舁rJ1 .4n%)Kfך9fB.x8o9C+a*k:RD;߽^j) [V=BD,/g]Aҟ"Cաws:|θH}Xf0o] &ܸ6(]u*dawAܗ@k7ʚb2[i)@)WP~#3ވvq%#֌[ (HZ>rаɈ+4xbdA0bycßh2CnNYgz9YZVQAg9&pUm=_j-`9\cD>25;SaՀmO%9>߲{M*w5Nm.[džDp AMBxqtJ4Np"8dS~ PZGU] T͇|3})PZ+BݾP~rII xĈ Y>f#ttk]4'3w/ͧ,4q6CJ*JIfRRs{< :{+,a=1Ԥ4-d^ut*߶X[ Qm7(nsFD(׃qae"1i\bԐ(K8ܳdb"̄0YvnG3c?S.;U-Mz\,z]f6T(Xԓ[ݻijov5'oV,R&#`I]gt7]0SM,Sa^ JܛQq$j?~|f>3._#37\Gg"fhT2TMP\ksPSV,Im`czۊ\ Zn7n5 TuO-N' aNf~ˉ^[BMf,'~>Jѥ^@R/*Pl 3bkQDYtGUsa3a2T gjOU+r87sƉ~mITa+bD4-RV!Sĉl1E ^JWGIi4.+̸숀f@851[>I,odTyļ&GMOK\\ُ`n_`VfDp{ fJ\k}ˆ\?ʡ@H _G7 XE.<](B ye0=!7<: 脿rÎ}qK:5i:iҶxyqn Bm[sMHd'RՂր'$šB%FiN՚ #4 "+_è#ȨӱP 0&Pxω?!YxFvC˿ i=D8p|"ؒglWi`bQ$%v 3;4Ts1FawL 96~L =.]52ћ/y6 ȋA' _&5Վl^xF%9>;:8[^]@Z,#Gs(73NqJe;lp&TM Il|އǰYb&L[;/Ebe\!+PU'h$)$/sǟT}g^|{2P+ɢuF07z([JI =_2V` CM-bSh݌ZKCYʰZ6ܫ*^Hi֤卽"ߛ`06Q$F%ӭxK]lūd u * G M{sbCܻL玧"S٢ΤO糬;d26m1A B~?U573B2T/9q̾4Ӷ [KNb@IS_Jjͭ,a@Q 6،K\]틑VH6B̘6v8[M_3㍆3G/cF*~(70S+g$ tj%sOL}דO|qDɚ8ƵD6nd5gcB\RWd_J@xs Klev'Vԥ>crE0%1TÄd4S=@_v܏#\X2'D>1t\-O=\uio)]jP]dvگaи/Hk(>Icֲi&2blP3}LwF;A]ڰ c%7wg3 ek*0q!AJ v_HK+'( Dc|݇j°0OvU±o]B>M|[w}4pZ s]$!@Mf:^1-#RVg"4Ik7aw~,*?*O\(}G1 Jrp{'%en~aɽ7.bocʧ_w6Dn⋙%;F3)``-_N 64u^j[Ns!(jPP[vgJ8eV,vF@KQLBXpݏD:6iSXsp֢Q:c{WEg` L9O-+/Opԩ1?,!rx[M3_mZ S?(c@綕z:)8z.oWxIqYc1z`N+?-.o$VGHbJ^@k"r9#E1L|4o(bӐzw™:PۡZE2)0Q$?ҿVvOpXD +y*;h(r؏3!5sLծb|xgyš㠦_8YW VX%IM<5 EhERDݹު$}OO,UݐXnh#pt͏$EC^:eVNtP}tL,+0lV*c hMAgO l-'[ѲAa/斧~<<"y*ⷑUvn|U/%m{lM+,]H`]Rig,7 Gz]%BٝӦ&$.'0z6|n*t~D0tQyGOc FIċ^ji`Z(֔eonsͱq?>(vUorO AԵu \LyS | &988Z۹Cf iue>\ =$H *) ܓ~ QDŽ0Ml=W9'ta2{y2ūD$ݴ?ie=S5rGU_[ _,-7;Jr Hd[ ]8oaBK8es s qۣ >Wq7)yP0{h^,:/d99]]-jtiN$;IrLILG`ayo"'Zʃ u4iʪ8p8Wx|BfmNoļhΓV\ X +]NG3}77$PA$YyL"#B9b,; Cn.m>)T|[O؄!<-1 ~֮OEp vEX`Ŀ*lhPudiOۿe 3h]E"ȭ٣^߷,5eWM&U KÅpYB.$}w!yUz(b2>KZPH*ul EI< iS^ >cre-U $B:]#mX aGä^ :M29cvd0!yF::ڕ7FJٝ2L$OUR dZ7/Ͱ ޭ0+œv~mʣ~]T0tOGp.ϥq1/"E x/̇YY 5iFy/Y P6Ca#5kNf]JC{\~N/q74Gd!P 0(IvCjQ&~f.ETO.~21bSX TtYUOT`j"Q Ocs_UH$.\SDcD3]ðQZѺ͎waOJJ"[+AgiU&9y xCOI]1Ru^ܟKR=֡j&K19ύ |݉G2ܘ>ç"Oq| Hq6s} h= Hk ?.WS~[L! ow9r;Iq1QStCѓӝE}qrْ#ke_[ȼKGHS.p-.xNȡLR{J.΅,zhY‘`!{dCG"f-!_HzwcAߐYzZPD\6r&AϡN-+{挭ыB )j=GCLLsqEH5F >|AWgkv%1|7 qƯ&";Lk_`&F>^vQLVCP(љ!r_D-#D?-/}T}sQY  W&P >/ɞԈKg_y{h,rnTr}%3c">n^h?e`1k,}%0osx09eڧ]i58wgzThxfQT7 _w)δym0IW Yx\JT.eH>c-*klᾡ_stUS٬!+/1(Q{p6ZvAl!!*F,xsO Uf<= NH y_1÷o6L6dwdm3 *ۭPYꐏ摩F}1-5)DJFrxU 2 NaGDZS)[VK"ve+Mc5>V&{EG=Tїn`):*wB JDDGjxڊŢQNV@$D`Q>\( ɗk6 ?>MA(gMlDW@KXB^9 jh1fNiD:wu p)-v" t" ,<%78DG/_Z wt wYϑsz枾32+áQr7o]y[+ciW#k[Q rN&> '%`mUHD}[w枆ݔ;Nuѓ= "MU<:m UXy#L-{.@6_>ԻNs;yvAǖ |5SgeX+6+ʼn{ׂS%>@Ď7l]J;3)c4bimm;;²Ds uxas7^9g)?6LHc CyدPHEIY_oUR}xIo+Qki0o'ոF &$FS"]wn_^L߷*ȁ{m$A!@E.7U΀ZyˆZ(m,3ifᔠCC}Dy\qv[k:ڿNHw7e/']u ".qzOzE\3.3 h_S-;հEW9b픭$dKwqWM )x֤]l[Wx `0N2NlVՎfч Ff6zXN g! 7Ax9C{ؔ3S"erܶ@Ầt]JC|P(|.l3* 'X:593<ʉ#(͌LWw<-Cu}!,NWUi"K;"F/5g$̉xUk\ B!Ï%!s n!5%udL'!Or.MZT^J `NM~.0%H"5n=vV1z !k'ڮۋԎXLecu_0\M{R(exZn+Qr  Z[ϫ2eZq5+Ul_}036;Q,L*uu򩅄;Ԥ=8Ge+Cmb+#o5oth[ ѧuA M7ؗ_) Ma$7,6qq8KS%<?ES"X.ӨlQw5e`Z3"UMVICڭT*o]s";;1oJ9 y:*˵`{-i?ѻci1xQ}(ḟ1+/0FDz--eVi7k\ϵo`׺+FySd~ʝ{ *R$zu mqɦRw0'A+VX1x/gU#giIuw*HvqI)&H*YY~(:`ii0|S OSd8aȭh# @+-d̸gbx53`+D(fȖgC$EKLA/a.},#{:xt9^4Qjs{Eȩ1b@Z=YzYs\Z+w;~9"6<ŘQC"j]zy8p[G"_7ZժEBA^c|RdB?\7;-`HY CP/iuļs h 7=a[{SS;C6v~O&[ܥo@X}?;C]-0)*ߐ⃴( .,~CBG&vwaGqm ߯Yi0& Ģ!z>ϔuHB8b9fn}ұ^In!XV?.NO k]4G1) 0$:'WȤ@JP7)o;dNQDj;S't]z8uդ6Z0iuOXE)ǟ"](:캇k ;66``0+ r +cfj VYA$KR 2|0= VRe:jw4? ;g_ƗOuv;Hd{-U=㕆`f=W"'j?PP Ԯ V(%4ST)!yi/54 |" ۑjߴXA{T8Ͽ43lĀ'I*bRYz*l s= فscyx+L -VS%HgkI/j2z{[Փ:p U Ir+0onũͫ+xDž&VBB T~.د aS=3qpPފd˙bM3y!"njνt~h@X4> (m+ٕJ8гt#{)s L,qۦ) Y#@RAG o}݂TQ*/Yfd{Ln~Jc"9X++.[8gNqi poCvAmrRgxؚ{%n|-ZgQn'8ެf n>HgcEh-EYL_.q"qW&P* > uEt 2yPTȆBxs/n%G5~a*\eal4>YCv-V/f'cNS_ XE[ѼunS0)&;4yDWq8ᵠ"N@[o%jvr!NYʔ%ԔyJ3ɤ=?߸퇲[b4 ͛ YUō6:uV_PLQz*$;8wMUVPl*8*I g.J- ;)Dz@dK<3U*%WO,7>`yhҡ (>5[ ˏ &''EG1Yz1An]y#Np&3B6ꦴIRGntVlU_Gfttξ[[ : i0$XD=;jsoIrt/tf ;_ Z_\rFꠡINՂqDaVhg03\5| ͏O,Wv!pʿx3>?GyBe}2(ֵ%ÊOEPQsX.wn = ѓ!+V45ڬ;m0$%psE_c9n`V$HMK4_Yv420PL,V%+uS(mk+:6a׍\}紽J(i nO'Y\5ܳ#1G_h%3@ q![5\*4\ cjGT!m|i]4/p'h?`=oZFCzt"W/"[IP9k& ArDc#Z =.M]¼̏DY%ǔxcVHE֎;jC:ghM|@><&tC~|_PYo s60G9J/NV?/v9;bb ɕz`wո;n\UVj1Z]`*($ aYF /D vˠU|%[Ϗ (B"2p}M܀h;/?JŪlKEHwfEyJ$7`C N$Cu$4&"'wQ_<+!`=m̻soODp6𩈯85ł0%/ =퐶²jU(cYowZ%̰\A/6Scd7qa*,r#ÁLBSRXo24K=͋@ãL*lӖ0ǥ[rmK7^V^BI`VYa!T00-%ŧbL p7KnZ z"YLuS- ,Gm[>~C _1QJe=%TOGIɶM[ qVhb.=;aF5-[ECYƘ >[FO޲IݘcsϽx-cx-6W*a%}0,UP S}ȫS&C]M <WADUi" ClWpnonP 4f"vo|R~r*T]w4oXMTyG  |cˢƟw|Tc@ /eE~G^:vŶwC|xc ۵3qn&RT`C2QU)Cn{1;1, X?C~=a=K:x= y{ t934{?j2U3PC3NyVTRݴ~ T'ey/XTaI Tg:+OII\C(UfC]h^4qgL|cz3~gF@szo]NW`%с?Vkz8аXG4$+צ˙1sTILjFV1ILMiO(iڿXst*I| W+0 vZ_>ZKe> Ogxԑ?`c5^ կ't;DxE0|yYܻ\Dտm Ggk&NV 7olPӞrnجMRdMSF?8:TmIV`J;VNWjx x^V7o#5H/2d { zyʦ2ܝDhYBF|Ĩ墏ySC^1({Gkt qv[wMuaQQ!Mr i:YǨ^ +sMnk[$ƻxZFHA>WQ\FezjI5`?c嬻}|32ADR"@A~P|P@pje#ȳy0S7!2bĐ)fhF/G:d{T-L~L7+V+); 40;p\C GB١75@[ž?[c(Q{Xl͛> qLQ8Q[;7O ~j&;T}8#F_&`^@4tLp f,gNLM`xUjڀbiX,^s+3HWo\,=-mkjĭOΝҐjm CYsAqyVejEUKXCNXuvp +_da/;V=O~oHX-S (kwХ@hEgfm@H@d5&6n?2LMdRU`Ux q\@Fl-7y0;8|}+[y*߭YKX0lNXnjՔ|<V#MVANU+BU}4ug[>UK`:b7wE8'a輨F.p|WE@fjÇJ8ؠW-F"̘!V eeZYXl%h:*ٰ̘p";y~~V$>BNe`;AoNAԉ]ɠΘQjap~ 8&]͌ឋqY;դgϴdP! injßZ`IY{kV7Msr7żʏ&%.i$k k)IS@z8W -"fmHt$T4{ܣ?M+]5TMx!V`p""-r ܓfPcB#]^},{"c81"*&ӭnQ]9~H0,64tѨ2ϋzр- b2{˥LԒ8k=I9`T`?,Ձ^ʧ'ΝSV- UzW)x6ҁ( ᅯS8OXR!Q|v>'/NtJ~>8%zVE ZLMh0+ d 18xc^pi (P8g (ՒXٙWT˂(DSVo͋OO .Qg314.@pH*#>[Kss Yѽ (JT_ ʭQ $,T-&eJ 490xCh~&S82 }ɌlILsqBAg@8\4ċNOa7"Ƒ(Ryj/ͩ8\1 _d圊_#K/GAUD-s*KrPReV9¦;ҏ^ iN$'=N>-.87 Reז(yBAL[)3l\c! #;Mj3>\fX*$,^@m}hj .mzcT6&#Z9nIgWAͣn<ܵhCb]ӷb^S,W->[$_hK+'_U=gk&==|b v@R[qz [ h|QVaqu|Fw$!{1\{[:K>a Ďυ=WMGÀ}R.t*0XᏮS ͵VE[LNНYu/P !czlE˂~|LAѭFp6u ΂`8;Qǒi; $M'^s<P1z^w>ivI9 _6+E1lqb<< .kޮYC h݋D<U~@~s:8\n2^?D-t`pMyDK: ⯳">|PS VaX'ԤaN[L.?N&f«zxsE#wLH8Z Axs􅜉(wK'=Cߣ[>[_.Pw} sWwI^씗 p [ZmӮm1rw60F1;`B)t@7X|p`n, 95W=݅Pn;eێra-6N=`i޾meIrKi|qݭ]A1TRi$)^ݔH)6Nʞ7"P;F~vט:."Umªlg8yg1g-` 固_t2pYI`-i?͑v(544T%D 6w׫IE?Ɍ{?=ugx6;$fmD gxuC&7KWkK\z_#@g@+@%>K}VT F%++,z]^oҙ3TSem3.5Ojߩiv&ONɎU?ck͗R߭\=>϶ 6psH7s2dgܼқ63tRۅOr՟0^דIo 5gXqH7rC?;t4|P~N~@J"?n} ׿Uh 3{ۧoQ- Ռ ! 3ڠƳ4@CE+@kedek bY5zA,/'kk{41k7tvGS6Zm(LHi:Φj/ ʹ]y|7lu~ZDΑm\G,[Qbϐ 7VbV GC0D)4I'6TFzm':t[>(N-u7 )ga䁏<sJ5 5"(Mՠ mv#y{F")LD gm>jV˝SXM GAHƩAHAsC#d{xpj0t7?Sݩa-K!S`#zC3yak̮FONcB煮? bЂo=+I"$9-VXdoҳ/H{ u3 Q|+! N(H4I<)t ‘sL;4Icx2 {$w뫽Orh:˹qِvҹoNAKkF^Ef4c# 9}9ZwGY6`ㆿ p $}_y ^Y|)#(?F"0:`2Y$&9W94&D,HGv# ,XtqR{=ޚhMOÚބ' 76j>KOUѹ ak`-)VÃny]'W-T?MbZ+r E2~stv}ŏcREŋ\^ׁOf)ı [ܴ͞V ׏V! U/8P.QG]~,I a8fez_%icjؒWphJ&\_KE܆"[T!qiLiey}:Q 9juMD(Nm^t3y(>+@LW`}qߌ5 rD&ZĪZK[pI+S܎)˒ Ɠ _-#/[Nob<Õ r*h*Q.>]Yk)EDq)nEf צ7Gs7g46!p~d5ea7[uy/V]L\D/R1 WWpwx .].E`#?wFvH՗*OpXqvUo_撲/,^#x`W] n[E6H(=8;I*]X6156g+ s SMFxv7zF[/W?se,䩗SxI)-Z-͛R}q\EogՄ5Z8k`A "SD#ϕ;;䉊U{9t9hunƖ2370vnYߏ쮗}g,VSsyi+zt2`(fE19Ůd u|PVn"40ĊNh@S-Ʋq2b0˘8bH Y1xP13Eq]b*f]*%ht &6]V&Ҽ~"; )|1*d"D9{/{7*ʞX4;zȵpo]3`ğ(%)֑=ԕ*1h(9";GW)<{;vDӢibCw2 ^)iS@G7o$[nP Q*< 8Kq͸6LtX,%Ɵҋ\)caf} /^G?:Fc[Ozs)hOT^̲H%bsXI^fJ!cyp~4G_˩'h. bŁL#Ȝ}kvdTnd2/܌[m^C0[ĉ^46µp].IYYl|&ЪYMi퉰 xQ*DXDh7$N}*^V]d$8d7UJðB=<^&Ƿ4wדąyޜ%_ gs.ar.=(X-Ԗ!R4%:X:bRk(k.&[4o@2#zP~ 8p@m>#SK)PG9!u$ St%2ۻp2lD܄0.g" ¡05&UĭWI]793rW&dgGy>Oj\ϏN*~0 Af!c#,DiuѪ\,d52IP*dyg:81YdCIU`F}Nꋽ+" rNK]b3PiB{1=cTٍ.G͗COaNglMe⽴h"m @?p2R H3m-qKd齔&Y.I/qƮ[٬#6ouZTٓ[ԎDq2a[r@n> aVІq!Rm21r!??QggP>gW~(ӆ: 衿VM T: @ a`z9 _H :f-evdXqz"k xڦrhZ-P:f};XHW&D5B ``WIk|olJ >ߴ6X3gR: +'&X1 Ngݤf!;bG@%]m xM|p>C.A>1׫vl59SUQØ{Z37k|S ր:Ձ%o@e٫ӒFV{FLd_&z(`LHg۰G}{ !,#,%^2AՎfj8H~Cj{@^-B +=uJi=kܟ aoC.NӐ \7[z+[Ǯ >/& J͡u_%x4!`tP ql`uҐBsyrv^`,Zd3EBD5gZ.oq:ˋ`nex3Л kO @@!#]F*?>,BR1 B#=י@hPҭ#]nIzU>dIt ?`]5!bWK=ƌ:svGI!@^wq3Oeۧv)Ȫ_#^S.M&tZ`!?SZL KKT=@fW,㌑W ~~Wo:g7ֶy w{yp3? _hjvY_Z P7Z@>jKqhh2e21JH?Y۸5JD*[:A=݈۠Q6o ֽ"k҆CMЩ\:_4;KXWm4L@r1@O<d_l]}R1d,|5CӅ<*/Ñ5m 1wk9t(+nMqQqyQ+"lաMhбny+ai*V&"yVx$<ʇG@wJFbǜ୥^BBHwt{,FDIhըPCHȦOWP/"_k@zXHÉbx c1|Z\A G*Bz"pwڟZ뢍PCu1nيڴM[0{_k8vɧ3b3U1t/1IN5tph#Hec̃ȍϑq1Ъo^[iy^*"<BH Qqh4g}}XqwΧ}rpESSq}hN`9@}+j=a19>,(SNSs|i(6EfrCHRo Z].RciNϦPx>rP&9]Ok ; OL@ 惠 _RZT՝qg?.OE}H1hL A& Oք"c>k 5]4 F'n;@~%bJiZ\TbDrJiޓH2g@yAii˃4>"th-Y rEH3U1K qSޮC 4sVgcu ;!$(yUVpragdjW®gZ 4Rs:" MXU4(z A 'd!ې>j2$4 ӊޤkD3tWhU*{H!M+_T`&|l"11%Ho~U(|ҏYÖOǜN 0):@y\_üM+^Pd!ziMUW9U5j6@±`_A| NZw{A;1f*]b<:ch_"^GC %#>~|CB7!-^t"wtNQj8YnMp+j!,Y\ɤUOܔ嘊=U).oI@)ZIOH}A9Eq_a?WHp=(2-蓷`tpo?zG(zʏR/zʉ(!Ѱ[-PHup-2ݱ{aO rۇcwQ_y-r7R0Lrp)?wmE&чD:4Yox׭j򯉴V ,]!k7$e=[П(rwf3V-A*R6Bt.o[ǰi\<1 w@zDڋ 1☶!]H ´JH#~Oz*q C3 #㗧$hhMߣ'FIpe>Ȁ !n)wsȹAwo"g}kbH C 8P )3[7 +IJmEzkw1ؘ^ F]p.<>qDAg ߋȜ3 YZ*tf޼w"ž/aڧҩ8`ɍZX}De# ']Jr2V!OHa`X2Srݻn*  ;RK=?pѰtα.JbRVzO@[ʿ@|=ykTRhOʯ]1 Bkg=RF8.|S0yYDC鰖ОҐ qDԙmŀń8J"tpݍ>y PgI蚗0rY88y]g|頔o|KUTMQ8cj 3i[Ἃ`L,y!냝r_ٽk<.J|375Oˠ,QlqBq(٭oJ9>Mp)q/PWZ VaJ&X]8+2ZJF|襇?ڛݕ_lW9H=ʮ .^BrGB}ȕ\ֿɤav}*<-nVNrMal9+ⰲ.C^딠€GJ7kD *kU>K$.W1?+ڃ|jf )#}{MX/P<~p\yf^Ni?_g4B"@ $:7#,xśGQjF-Kɫv pX#'<@XFqd%5% ^v%_xPO_ڸVOroq mKU!r$?TLeAlRBKj@Z. /u6;pG^ GN큮v Xx."Wt34\E(a9#̆Ys%Yݠܩ1UG%Erg?cۭk-hR,Hgeۋ!6ɯ;Y#9'@EMTFcz!w<tGg"ݻ~S[!_S v9' \\d97+uq䚬&ptg*75[5U=N׏$2!ᨌu`BTOCL}}kuyqJ|fXz+8>T)u?K!Ù&-b&+8n vz+& #-h<7k[g%#VK\fƇ^ʴY9uT,JԨ3iJ\7;x{I }P 49poO~JⵉKb]݁&6${@!]'J<3㞘Y]1rH~49Aa''5zlvP3N{|%EGg\5gP Uj# 3Z>a>OZQM>o&._GT!PDUt܂-jG\ԗL߷>]L6簱bab#z9]2y%Ԑ%Q-E S\4D 1ڒà,'Ho%oLlѫ4 W ~疃nUdG N nbOWsz7f>fT ?I =WYћGy&X6ǘYS1yX$&n$$5ŤP9f 7^WH^G\f6GWr"»8@FwX.W$k¯c§U2wuyL^:JCP^ߢfl8;߆+k>Kl᜹=6K nx},S|I9I=z9"4a, sK̔2m2+ښ9Y&S#L^+4tVA1`EՇ7}#Ƶ 2Bs֛Y [<~I'q5.Z\>ԪyؾYe(v찈gfT-)~n쮉A$pWXX2%)^WҨ\ b~p=37IW<ٞGM;UAko琮9y,HIq^ 2]qpk(eXE=HlNlU"Z^\'z~'&xE6Iq`^τ̹bHRǫKᘈxy/%w#^}n^vOx'd"4v%%1ZL_~︢ns֤Φwyź0L zM]YxJBzHO{6k*#;w d,W?| a ?HžšxW\ԃ`Q.2n8҄ܞ 6DMR!Pgc[כ ϚqDDŒdAb *;iӭE)DKiV+F*A3NqOXJo%(Q3r= 9--O6oMXv4g$IDžzVM I₤RfGV~x-%ۣo3KŒ3NAN w-G-/"ЦRk#D,d{Y`!?uʇW|*>1BKLf $Θͭd࢐=:@qaN$?~.]%U 6Y#i\҄S !v`,h/bI֖f#eFޡ52+ѹxIu%uIʚ{kE$`ZRYe-DdHEv#v8ƞ3~~{cf.}-rcb[2?AxS6ѷr;+f16עi_}"H1|( (fko0* #Xm/1l^ G]?Z)=\vUf;@3% 9׽k),YaZ&*S- mix/p9;XF^v7`}i]L4яboI3 Zd1*A/C!Z24tE`0M8<=nm .f-r+1Ē0>_'I}CӋ&n,ΗR1hXÎU.=9>IȬx6P6P:yZ(*\L> h\b^z@↲7C@NE 8x djOFk) zy/=/vpeO{/fﴭ| pU8k̫$#<tFL"z[y/-oT'WgF|l[٣ym)e''TڒqJ3Cu߭;4h;wp2f@0œd@QΦ-љ@_u~P%b"L 8Y-:@b.?l, wF,v._ydi!…fޔ9|ݓM[yMw}]yZ, )VʼnhUyNb2+*E36kJQm+X{JO{)42Y,~tC:WJWrACRs(eG+3($7O$G2>KZ7?]+h0VﮞpVQA27tWB{!m3$\CS%Qm9=ߠ٭!1.OvBu $Mؓأ~Ƣ'9ٖe+L 6 Ŕا>h4,tP Ԛ˷w;=*TrWzĦNFB=S[EWK6FōjHL[bL$t"oϏMx?.q齘Aԩƃ;B>Qw]Vh"wcJK,#v-!CA ь-w(;2AC?g .CGQ (ePٶĿPLhKR+s%G|(2 a2m uӹm.zGA蝾;>rqnE܃L)"`?0@3irG0d7.d @~'ۘ⦟鑭+7ۆA>˞k!;`&)W,.JNpdWgOqvC]2$\fN;2ڏ$HV3YGgt0k"ݎhjI K!ndUb_`=>МMM]*& B1ￇMp)ȏB]i{NڼՈ.huhi0`)΄|\{ KٔYIy`t4ZglwQ8D'4u?w8)3<آA&J4]'DSIA)ڛ1`F #XSmRgQ.|U*Ѩwd:7"wmE&|H ZT9I5zN|t"|_!iѻb˘f ذ-goƟM}E [.Gqy _mx\d (Ŋ'#k*Ѳݼ3d.2+S+z O67md8؛)_FjAU3n:~S^ݨnsK^1Dw'XM~+W~}O+}7 ^eqVZ-2;@¦]"^w!,jݫ:4+͔NI}FX̳ޥr6vM'J]% q eGg.*J*lХIq=#gU^6 "mvdgW,7\2Ί*1\@s~0Je9fyKq06!geݗpc5r8 DךzЍhΘVQ^#?qylpމ9(q_YfsX2 Bd جC5 OňKj p k],i; N |[)JZ3ѓQ^xJIDǵb;j/fhfް)Xl(8I[b:A-;н`ȷ\m(ffo~{1, HV9?R,Ij ҩ٧O!o|'6 ۳f>bq}!_7;cc"oHӍ17I#W6'0@B茺YXPƩu+QxQ:cwA"i|>,n{ݦx'(uߕ"9b ,7d}Ce5ցZ:280<<d0ߠsLxq/l/Ճڡ C,P\y1f3Bj;tJ@rdO7̬C>t'U.IHV 09~O4i3jǟ su&buɯ9@5Qw ;P)H3q{1yTo=3}_ !Ĺ ͓?}"w,?(2h{("7͉sHDiaĔe$3Yҕ~ R\,~^skF}]KOg4T;ֹ,z *(8t1Pt7U^S5 %} ~nî &aYE0 T҇y8.>qTLovi-bNoV7Fb%~y_!¯[Bm@,AbuoΏ.^U XĠОԸ.WZkDcc29WVM]RP;^)wkQMܓDj|e7bG&/UC'}!<8IXU`P$׿QDM'KɜbֿrerM~sO6q UCB{fM# T g?ZX~V[3^EJ- '6@_Y/q?>dǙ@wΡeDi_=3'@qe ,1lWz: ,M p`وR=E,\ۍe'иF q}sO;I`l..sX5 Qw2n@I;ማ7:ذƏd!4FݿUr8o)HIS ).Brt2Msz_g6]?ܩfDzž?.}.F-6AunP{<űeeB6/{9GƘ;dj{nAv ȩyWiG^[/5&xV!W!Ů1Vo-T@f}RK,&%.)9>HTxC5x (;cTˋSUtI's %UNj5zL]0 hkоf4q/;> 8 K]'ٿrnH{-*̊_`̿g7rF V"1}Bb/{;ogL#w~MkOIƗ %&IEA5;J<䢨9qNdCqK 󃗢:Ƨ/UB tҒ+%PZwOlcݮa04w]v_2>9L̲|4\Ioz4TbkU짞aYDB$$<<T8ahvDcg˗z,(C6u> xp.,1F!X׻ Z[`Bd? GU\ l"Qu"4we峆F v~ZY\0~`}+L@IPNMFLcw0IEN)apU; @wiZ6zu8sҼ% `S9: l=YDY䆘$7N]݌ qo`l_ ٹG x. | Ͽ8Q铩t{z>e x2(l~1G6mׁꚊ,j綯I:Eho5XIvN Ԍ~&gdCjyh9% ?;\w y{U m3Q\L郬:?DTMR`],~?p&]B(L@{ jFr'jqb뱝,|V~ 0,#_B bHoEd\$+3(x!rCI+i9kZ[Aáo8DsQnסmΓ J iwI<n pwn[j\ @1x(i.ILc@v\~D-\׌=G\s`B_56;ogDp>}Q.]EZ2,ԏAT]~3Lk2=#Xmi3 @m0LE#X|Ak@&ל߂Z)֎AMLX^=GQ .HkdboM; ދn0Lo1ZAWP01W=+B<H?{4/?f3kmpD ~Q$\Um?|]l3Qqt+Vf0$#:p7?Ռ4ȸb E:|?(:ZlF0A[p cNT]Tqs:ڷg󊋺QRSMie;l|vY,\o-rhV{iiA}YӾT<ǂEG$U%e/DFQ1;1GdPB-}m'(ؽ)^fqM4~B6%C6p܈MnfJq 2c'"\~u+@gwe'=8Q&6m=nXwgIQ|oJN*<EmK' s 2D4O>AM [t9e+1uf%;ֻ;z:G@գ2&/8W!)!\ԍnV>91#T#i DMѠ-6̷BKI9sd//u'/ vϹ217%p?t^_ `#%J 2 QBh9FO9$RV8m|h<ճgߗ5 u5K7 ;3*jl9Lr=:FzYL_Ƈ+P!398A`(i;]VJ|wb+%4x la"al!ulDHO9Œtf= e'I2`Ew0.dͮlQ8fm 1VcIR7=3nb^ -,)P'7t7\/Ոg_$U)w%L찌5rJ˽+aK␌;Aݕ=['n;RlS"]G~اUo!bCjoqX7 AU7\i:$5߷O9YJ7۱BnLiw PK.HqW |jX"ܛh4жI@ֺ): 00si;Ea~Np'`8ti++nyuLƒ9M6n!9FqGDq>>#2GI݂zqf=>Vv9_yB J]oZARn)kb5WKHv'&D}_wCB Lý5#0Cу1j}R{ͽ>:?g7Tl=ήj5ŮS5[ ƾjN\ctX| P}P@e&F_) WR*] c"7qm7\tK[`Z+Rqһ u^D(0ϽƜ6r{ɒF:ZGkz;M4 K$Xs;HndH{35G:AJT +nfϝo͎\b|DO93YgCrWHQݠrM50'"iL ,?D&y}yQ`8k?Y[\)Yy mJ#uoH%;J7,U_^ǼҊ 2N   8'Ɉb\4'cߊm3ސ?#چ 7|iVx=a l|{$d_lH7FB`-Ӭg'x5FL=Y/{$6pX/X 灇$ow𮘕>\kظn%L<~Z7sYœ(qyd╢⁑/p_ư}5G$d|Z{Q&3򕪷{oµ|hK)z3(Ǟ 7 1N` |EEhDrc8Z>u]AQҰ<+"*9s#&y3q3#A |TtOoQ/0Ip&j SpbHQ*7K:9;~:ey!1N&mw{ּIkLwa-(T"^㐛`-+ {L|ڼəgCB+ԂX r/ y{5Y[/eX'hfe!r@}/́X2'ܔiX/ ql\7g(ъ\o5S䊣ZXHO~BkJ>TѹfGvG:~2/QeR5BJbl^آWp0t MiRb!i tpp6|Gq >R4Mi) =}PEu/_lC%* u,?4p{*He>Q=i,KYq1C&[0I0h~.pFiP7nvxm_3+6Wd%y/bqg?馡y|p9gW L25J3kn9˃uM܇I$WP XCڲIkܐ@,!֊˜s|)]pәL9(\GoeCg(L0*vR*&RiY^-WN"rBsuKջD?GBV-vf\m UMv܀-P=dc6[f q?; kT?.7ꯇ2yv[./^ajhD ZHl˞vC3QO] `]Ji+vĤZ@fy^0>R >$yy m) ŇexC ){-T~4!ˋQ 7 Aؗ.IL;W9cGmfֱ?uZ!Yx@LFd|D{;Mꑊv ?EPKynhȯ#2#Bط J> K·ߓ$;ݻt$,Pgf&ȿecpԩZ! CBl +Ⅺ\7IOymE:R4Rrmg"/ꮤU k>Q/f<##*/kIEϼ^ˆ\ Q|jH[Ԩ6644қ1u# [xR'm_ԇA+4W[Q6x$}4rt\UBLiiC4b?F}]R$Q@Z\nbJb%Ps(44Xh'|8/ sHo=ͤ]j£/ (Q=&R&޸D7tRp#TGRA*9^-5NqFYjWr~@mW?-68ew0ݔ `y A,{C0Y';h -lԧ-&~Jή"Kn̥^as RC3H{>8 "Z gJE@n'(7/PӰj$&EapaJ)\b\彖&L -Zv3\Yk)r,?OY 2p~Z{""|a?}PQgphCcnXAAz,߽9nT~p<.]'mFrsԁTX{G! 4]PfpIfI럥zN4{-| )fEiheXarnUufB -Tb֕ wT!ύq cZ(!_hgMjQf1"a! 5cJ[[ߏLynG fG"V/}mR{n㫕vd;b&DzQ/=Sdᬓfϙ n;ɀd_(Y6=|9,R,L3q^oz\#uwY].oDt EW002 2#X*_W,E]很ŬB%6{r vK Xc Ps$>fbА &OCD:nuN]³qi%M|< RkY!FÖ S<]H$,qV jG5(-ghqR+ 4H;] &̡;v\ϒ\(#o:^<CAGt'3KVqbSe+ 'B3NdU%?I-_7J]ء Cpʧѡ=XtXd!DyMDzf 2<Ƞ159r̴WG% *5` 9K9O}vJm`S%0ݢT$lC;zIȄg?oXQ\.Ƴ0A4 ڤYn|Z/_$8d]^N5"k/?91)WӃ}H_srhE!إ-hYdF9(ͼ`Dl5uEoE('C# cΝ.&:hB F,ɯr}hFړhU|, L:NG Lf̪+YY;fF7O\M7Wv-/)`BR* 0?R^V2>0Og\ _P9N Ags**<5͞%)#Ȟ1%˲F,YWC d!6Tw"rA(5jÏnx7M̈LJPf53n7Ot4JPG@ &NB }֡},[5)U=#zäGR;tN_1[#N&d%712X?֙H8r|&]Wv[{95 Zj}΋xDhiVIi|9'OhEnO+Yd@2l]yD.2p;?$g:-:@C:X!iaАR]gE _2rԜzYqK{t\n>Hș1B y=֛T_K [_EʤzEδݪ厓;:rE$L6~Rv&!勬:Bn,/e1L^My#gTεvlxun,?3=vы_ڕK؈bqBo|]#twVƬ&_ yL%>jT+ t|-ZOr'J/8r6mW*)pHbTlmSȌN 19eCz>_pǗ@Oŝ${ >$tƐx ;n#)M9 E' 1Vu7<}Ot,'h')TQK+}yy )kl8gΌ+; F$.`/\X&$6Y/tNJ5Y- ~S[}:`XSMϵc2?B'o\$YȮTz"Tn*W[H$7r.Ζqe~ǹqueFZ=^:L jۣ7=0Ϡ~U @ ' x9ڸrS WӍ& ާ |* /(ygipᅢ߅6r;`x hrvJIvs<&YoW)UDQ,e`Ӥ2r+YȃFI1}LkbF ںi C-XF~(/Lee!g=IS _W|8A-80VsmUEsU(NY\}Je$Um]"C4L:ۑo?!$"GM>Rޕ"rć< ؋MK7 ^q=^,ְT)!9m~ll+JE!(M}Ȏpt"DŽT_JHiS7Fb;rI+݌O~VI՟1Q,p`G/̮^AlZvE:Z=hϻ euuC)'+r{-iGV)dۙۯ mH}O WX@k<F-؝o|\Ak0/O]t^2+S=5gF 8ƉƼ$PX/&xx<N̦{pyc`sZ& wd>^=jѻ~1M?Ƶ^ ƫ~9"E=?cY1{۾ :~>;WU,ُDH |}#Y}MqIf%q |&z'zoMQ:4`/=t~URPZ C0+^RfA(*s`,(̊% WSZNUr}^mHes[so51S8ÍB<7D_Pņvj)Q|aP]qb\KP@,U;j27GV,DF bȷˎ"t )jb]YKE΂*㊀e j쀱F4mA Wa `Nsq*V^q*jw+#8}5 S^2i0x"ߡ%1M8%_ǍArfy)0L@"??[[ʓzjڴw/kÕϔmy_‘3^ulnDk7WUV$s-rA|;I/!ELiY1jNٰhnԩIqHz⣇轤u +Leg:6Y" a9(qo̻`Q-T FSJ} niFgVY6Z@b^@⬷făt?1\gt enSw^5"?slH޿Gy!qewVp#JBgi N8[~,R(wԙ8m!h0<|g%d774v.-% ~ifI??MnRO[!,xgopwLC!]{ĥ}*l'99xh=P`>.!?1؃4{Vb~R'}E;f SOڊB{鯌$td)>3BObwh4yğvK)ۣͪƕ>%q#nҋ lDq>`O8m+qc59X#R>%\Q@?!f3-a<"EH=ԋJB-bM1}rSӒGb?HH y[\@{c3#_={s뤚՚V#jv9]Pq(z\-\i[ XJuh\baH_I4mȒlz3Zخ.+]7ED:[RAL:4o\|~4tz6]⨞ *@DB˗Oc)hۂdpWBasTAuWj&KZlNv&v vQ.ZM:j+1PKDp?4w74,pQBp%;ax5!toYz-v )B -X?3?J qU˽A%N% b@iGsde|>Gd\~9 'YB0nlsa= bB[r_:'r}ˑ&su!Tejy`4Z^;Fa`ʸB?gL`u!&$3f'f Pyw쮰/[Ŵ/$HY?t{Ǯ~&0+~Dair- >tL25y^͒𿐿<='ٙO xl<_VpKL(ͱ_~g-`X!=؆uUH {MNyJV5}b]$5JupcQ&RwbK ;]v5Ap-l_\vElI$8@k=ɡM)W)ɛv͏vaxYަ6%)g]@ݝus8Aoyݷ´;{k,I=߉k7.~AM'nj>G6f)XjdWaN[1Y~m%-x3L:`J^  U6ꁘ69cpDFk0:ՎThAM†Zx ~g+!:]?̘JC8݀-V\=ct9ݞFе5GkQE[T\@!aI[ 2PƸiQj#]/m顬 nxiì@܍w":7s H tV[!&z̧/6D6<޷ Xo'O(V }!M` z8¹v:lky| cQLw(C?Zz}=) ͤ׏ykEm+k}Tk\mrJ)uC܍ŏؑ=_*la>r>w\ |Ki?Q QXk!__.bbe#5Va.%]>T^x<®F^ !Tkc5P! Q¾ RI~A#F.@bHTWpOX;bjC:Xs/=LCdc/> AQ\NgM53twO*+Њ(+b^5hcVG ܶ+3MݑB!`j[gDuqnB'HG[*NH;kmZĸ;-]-dlס0SCAaJ 3拨YQQ"x->l>^.\6*{Ԥ#9X02} 77a][Jd*_<:x@+2G@oaƴ\`݌ Q`?X~ V5CHE|NVK6 Tt`gQ)Fք]=!S;ȅ<hؿ||E??@ίǧ2~9`χeSY=j~"zΔ۸:Q {Oc4әnF,ʓwAsF*f!8V_5dَ`N$ aYRx'[X=]@ +fv6:^jrZ8Y ~voϩv[7B!&RaP句9Kw{IX_]׻JY$X߳"˂MA墓c;enBZLaRvƱӝ.$.kD9 WM9el _*=hꄈgd/\ԫpzTۚ~E'yBAՂk^E/I Əs1n?sICN="hc։f=i MF>/;-ΑqlN_i|Wi8]5Ax;H)y1^.'*EB(!Y'sU`+ʫ> I,&NKӆ[HNOۃIOU;b9(l8T%JS P1y~Ҭ߂E ˮ=5$O偡 .m(;BZ6FQdPLw0~r{!sJl b .4}UOf2`ƵQݡ9DJѷʼf#!kqk"8r-ҋ'7pT1TkǬONfYI]?{V8Gj5Ԝ{EByo!#hzǛ; s' |BKfn.9" 1Zx {M0-$Cl% p-#z}T"/^g n,m&? hLHy?jODg >N sX@%j5>lC~T= U!RNKG Aq U?ct@赤 KRgT`$So+9juc& g1P?@& 8 uj3^jHh68F09(!bP@4 Oj=4z~!8)l,@g TbQ ^e?OP+13I Ixr>,$[%ڜOz9&$w.л\سbϲAvc9!εE@u '㊩z_R*%H *jC3ۛ2-5A/+>Һ\zXV~6fGT&lCpyr k"jAxHkzXl|h~u ?Haib (G9ڮOs:AW,){:mr |\ćJNpj/_ ry"ued'7=dmzYj[JBT:ګqS$Mt::JU8_Wv=I^CW:P̓m1CVG^#$H:/6NXvMH ppiPwl6ЌOoO+Vy:J+a{;͆')Մ'A>qmThBD ;z^SDMRyh3%gϤMm]Zޘ<#h+d757z1?v'- IdRp HP/M!6{ a9-=調);/~ ̅f}̑_zrU@6˹"F`=4:GK8J+XDi$$< +mz Ndڿ~dd<4b-{UymTʋ0Ʋs@:㻞Gv J @k /#CTbO*KWw9}o-\[0ؽ,'QB9%}r;L*=[^+': Ac|y cjMRGd2P̄Lf[Fp ..J1mUf،p!vJq;geүKfoL4ue*xP}~lyT7 % Qŧ #:81֬m9 l(ކ`{$(%Fфnz%"E{$F ?Lhq+|4jbMwӕi+"7VBj|Y;(NPqIb~[S| ^GJ_#f0Ci^P(ÁJWH;&WD(V*6=;[!cINvW0: J><Ӷ=*q+ݯ+)&eȊy.WNB0yK'y7m2ZweBS E$:wvAB`jLHw٬|[-j zűţ6ӧ|:!3zc72}6ǵkZe%DtTj ΃ݼUB1kS]~E; Bm^H<>7QSN.ŏF)^$::̬[m1O{"S_ lz*UE{zxߖJO88( bS*gLk?@ ZunDmq6!E< *lHп'>j$LAE1^҉h"6-4Eς@JE0lDʑeI+!6~]U}% .k805e7bW1i3{jBTQG:5Up.x I}UOYD>Գ>S;xĿJ<̱E&i-cvǎ-`!gjL+vKqosF,0aPXvw,w&A^##H;"~(E肦\))* 'h彥{gIW`}`ԜlnGNiډ6DhcMW[7wWk=AaNrg T(XJ``byoЗ2X/V+7omr"ZD~MdAeԢyp4502_GW j&R$ L쿑w]Oȝ*Czrnpp2r^[9_ RSc[=ϧ]${7ML"`$i|&:MS!-`fӫsԁVDgUnTu Xy2;`)B1qԼd38cة7Kx7,~\:$R~~BHln 4vf/w{#?\Ѻڐ']b5?sʏ*;-jOtsX2Æ$iȮ)B%H {Gk =qd~֮*Q§\#1+c)ő1C:np׵5μeGS^33c]#}H_9$ 4ԅݙTI #p_hD *kY[ iÄ+_F\= a4EY 2dw*Yv=q9cA% CT930T^}C^b kTAmN)!+.G2a(ǐRإz;d'JE'F-|2zo]a{7L (\BXjhkgf>ת'1 `f0E,1{8ffLD"K~ǎ Ö5f/c'Z7^TM7k ^i1b$6XgYR!J.;ME'Fh:eV8{0f*n6k+_Co4t8@BnXY|u%^rG+.}зSz"us0EIlkIC^VֱqckbJfZ:ތFEt9Vȶaxxꨞډ|􃗙d!Γ#؋jX{`(Վ޺eiS1lAo7B:u΅R?,=;6p7bih(*^eALzo[DKp],'k,z;gT1 9/r}?>JhQP&FwBIJC յ%ZR#S67;~E\ܒȪ9v w6tK`wgQkG"Ų6sFFtdO L| o霐8 xXi|p7@ 2d foFuSֳFЇcȶeqDO+˨ CHfl8Uuױ&bŒ*~pN.S3V9X퉈઀ ӸOp_anJΟkRiOY-_^1Z5.V%8ӯtTy;߮ >2Ը3=g HчBQ 02e1u?Wl 8y )/GJȇ|x6ܮ08 r=% E5[QҳZ k\=U3H;"3戣my:,PtYU*UĖ Zql;fWu 㰖T3}D#K[mdiwepD¦DQ{ձ*|Pc,h=ÇQ Ī;}>=Œ@"%+U0$Âc[v@k#ʜ8+ ygod2k2 [:|`y7Ӹ/{h1&?H+ɊMNy 4=ұ4v>a^-P-}ͥ ih}ɳ+&3~iD]A>uf L9I蒗I%ds0O8ipwM<02Jq@zIruOA1EdGLMpiՀ(Wltl)5} mP ^0תoV59[{;2uu~D.K!n܉.zo64QeϻC^4>Vd"3#xٟxr,7Gڱu(ۨ02g.TH¿ޏ=a f RY&-_ Eo@4jqzKgv;ǝXؒ GFT&gLlu%՗O%i=mGpDSVںyP o(w`dN~&'o4ޏ*cjUtFɹ!3B@%CMX&4ei` p|P߀;o~ a֧UxãOv%ɶufQ$ʚM>҃2+UCC:[xɖ?8"%>(xT#2i1xJ"7ަO\£uȼ=L,Su ![T?dP(^wDrp?1:J@.&2 cukS0NvhWyehe,.=29W\Pbm^A8cڇ_2-lT=5eڌ܈,LOn%`xPJ5K:.3SA~vbF2k ipd2'XYZ/W2kgd߫ ,P?b_E="Ӈs鿯^f:Ml#Tz?G/5I[Oý :5gf(<~v9*t}x:.H\-a1gGݞN`Y(,]_1ה67_Sք+,'ڜǩJ&kO+ W^͋#-֬ߢZI2ͮax0C{V4 F(uv[`g9DY^ѻ]]!Υ gwb~2 RrR8R.Z,g 3[ c 8;l1HhprðZ $O$ +|;t4L?Er+=SJcBBOsv_9?_2fѨ͗}9E ٭uj y+%N8LE&º4?u+M\ϑ!Nc+-’mdk},Dsh )Cvgu+h? PK(Bs]eG^]PprqQC8 :|ZUrL8vR~ TAJ=R~H캪I鈡m40[bmg52u15 +%){Ks^"t זHpJWĵk֠\ԍ/E L҃C8Bn4M/aϸvj q"ny#Q)d`p/^]Vpi1D\]]R%縘0L=2F:-8O-rdlmtV@^[>>n{B^e5V.+W`D 3; JtzGcdQJJ`1*>0ٕ.r {A>'V\|v Ί h Ԟg<+@H?J"5j\n{G;@sJ! y=듍 jȉ5ٌ,R=!rA"EEnY,!kM 8ysj/$[N֐B&Dbdilmʞ.U;VJfrE|]r c/ŚTn<*+ *U];F4 -M{j7(/RRӸ@ȜpXfA6zlN<_ŤXfTkCE1 $q_q҄B 騪l]1z\7v%1Pϼ$g۟ xL Xa"$2= f):jܦWoDMQBvm˔Ļpo.`%4^ҢǁsdNh qf~Kǻ R7!Ua`9C}@ܒ$ur_v=Fbó@!)Ս)d ?Vswry]xo KZ hX朹wqs0!J͍C雿k 8Yz28r ?*"ՓJGxGMs%a7s B?N+ 1]EYdxÀtts" ë&۱~69bʸ ?x@nwk\rolߨuo'I3H̄I2X6ބ~SXB6 iF@Y@= .LOk󧫝H WW_։J?CJعtR1[Psityđb_XQ%w>S>@i},2+}^gf՗)EL)QȂ@ӧo<bRyT @|uFi-cf4|$;IG (`sĒ\| HI#E=qAwf7K@6Du!—H"M{S ": nj;zᵫ"aH1p+}3t/ .5a˙f,$#&1a"k|]Fqգ/,8Wcvf7|N~}sw[@2 {=O?'8J)o<?F;T\EB7zC!E:@~p`aQ}~G\-c*:c7>:D2 )#R4hg|}D`藂&4B(:*&Co,Nb%u`\?}88L3cǑ%cc{S>~ Mu2J]q: jd1E^!)ϣ.9LT"SwgaF $%*=Nwe?p$^9m|z Lδ[0OYJnU-PG#MB3My{m2Rh̊9NE<@X _%n7 BRo@o#Ppgnl-4&/d&]^tdѱV5aᅤDvE~6aa2v ш4L5 VzwOlKp>n&6d AoZD% vN`X>8 y=>ZR^x5!iA"a8qױ!\asx԰f{.v'.ypkXSԉb{&L3&C,+IBȡOSY)Tyi_?pQC9DoҴCt{>UEV`'ƗBΔcE%λyBt:I#(vuH@0R,' &ͥu잍2loR!(I-!\B˽~ !VhJH׍v5I\|jj-xI݉2y Hk>1}#Yg@$ K$ޤg}ֲPg"WӆUUŵz zAjlt#YO_f>rKE@7IAsQqMޥI^QD8pB󘫕s"dˤahI4)>ɺkд:$FmwWqG \-si%O^ٍetZr0fŁ-<<΂>})TޱWD XH@Tp^W1bMf"йF'8^O* Av6 Q4:UPD&*7K8̴᰿.xaqYf[ǶcΫq8`&5VxbfPLOqhا^ 聲ZGq/@o)Tg/G,TpsNe>xStÎ:To'l,(m@]Ţodk3vT{T JTQN\f2 x#JcnU6%hw00:³i;>oܕ1%fם,!ms?$ګe3t_!y{!u+I_voz̑ڠQΟU8NݾfC׌`MhJHhwKj UJg Oꊮ;CQڀU"΍_҈m4io`Gyʯ9''pKA񛏩܁ʽFb7]6cM+ް]:нWX{ p/*YQS1d~xxPEױGمE wVN\^gcЧ ƔspE^Zy` 5l joű 9G4aRrm{l OM6vb"'Jc8;WOюae-_"5;`xPqe#]2OmL |]Ņz_WWs([\q9K2t]4 ʜ(y@W 5elSq'ЄZO,H' NiQLxg z}5f9Z4[/friju˩heL\xˈyۄ5y]3sӻÿ]-_vUܛJ$ Xp\$с0;|"cXҳj#䘳="o'% Rp3NV3#^/#y\=Q/FBu2ϋ]ji vWTyf/*w%3\p` |М-Y^) Cqqdu!룄ȿ=M%FjBmchտqb;w0)|iy6; VR+i}0$9k9rZ\."ɑ#^tXƋ(PzPchoiZ>جn_fC 3U3Ozp▛nUIA޸apۋݯ 0sim{NodҮЉ2$ Gin؛GɵoD/C'$;\5=l0&Ng5ΐ:0I$?;r&YǁK&,BBwJzZ?S/*_&I$mX`h.[Fܿ]`;e;#)mȗ? ʔ"=9yr;b'h Lɮ\)Qf8vmtN6G`Mq__#}E6dk_߈74DE%vȉk/&º DN$9@_rP]o8S0`@'1?!t"7Kܗt|43/ƽh;b易mOw{0rD.ڱS#s&=_}թ;_(;yb3@-Zn#PWzMm!q]~"ue: W3om_pE mC>L{"qNLsnaꦻnYΤD+1la䱖ˬc#1U+s։n5q]s<AZ[TJ~t#22u-3R| 9N:ʙ>#fuc|6殁R$ lg *]Q^i= .a6O/[ oUfAhA7TJ1|HF=@}S?X=4 6ޗ=p{M!jk6nv+@?bvX2`jx(܈C KPGcjxNd)8\%O|}$q8ež E8g'A?*+YW(Ne:S2>E3D (|6Ŵ3!!PEy:ECP~.ӭPo=r4,nMe`NbCv] 6C/!xD eVe]f*›7Jqy `ws5Vh\cjk~4/9w7iKr/j3Yvp2. !5|Oױ|]SO6cH41ڦn3@ A vBGv*Od9)mUB^Y-G^<)Ć|Xɮ[{;Rn>Rd=9,)AThGٖ i.q`Jxyaw%ǖ~y>l08S) ^UUjGBZY.%߰;8\e򞣯4+}hJ;،WaqTtQo[mjeٗcC i{iNs+]4S$.VNY9La7!'Ɖg!M}vH6M$@O}'90#?tU{y1hW(3EăE--9>QlᜄM:fc P=Giqר\xnq@s(ř@A>u SiG|yӓ"u [:w*2f7_,1%ϲWvtGbu'v:Q]/`@C`zZ}7)zW:UCc< 2渣my\Qc,I{a_X\H䥷a<O?9tEG܁1{F914I=4Z>`g(F}$7#qq&=uK,-}XwC e4YNMƖ=).HZYh&qi?d~R5'RBLc\btܣߗWSr`;|6#$ ,(Ȇ.~ mUtkZtC,}@:JEd!xR~sN2p6$Iyjg ]V],Q@9X1 )ԬaHs4+ΉzeZd5^xd֥ͫ!Υ:0GW$w_Sw䐴ۚlZe3`δ [=TGF/^oJ ]ROŸC5v?$$1ݎeOP 0DXC(Quz)\.~Upjh+Laog>JTa>FIѩ>xq/; 8Rgy@@ʁߌ_[ݜ11iwHQ0dfݎ|'PDEťuuʿ,mOpR`4c *ي˽VW1I^2a T!,C#ȉlae"M/m;ք!Ut6kѴj ӝi;FCar3 u.>ܐmo/BZ7=,XOJ])ݩX}~gFdx]G5iy& "> #y9snmnbU݆WGGAzw[TݛsWጠg<}Ɖ*2 ͮ3`:r,eYs趕bKq'(̘Q#Z;\l%-QqOwb 6'Dz8;h M 29~ q-%˜^uKJXŎ c*١֎h ND \HJn'dCb>2lp9W~7n'1Re2فk5O?7ɉ2?AXeuvsfwc;T7AF.FAHhVkoeI:RP6gŪ~ _ap 4ons' W|'}$#o@pG%ej> (dႩRIS[L7'O'X |z0f;ɩl3._FY(zuAȷtalZebͧ9 ``#:-mdƛkI-ӦZ+a@Q] 5"w*9q6}42?:o/=M?Ua`g`]ԟ)]|ھ%Op!MoI(X0rXu| ’\<+B9lV'k(t5#mg+[6u$;&؏| EP=ȱod.!^!yjow8w䦞p_Ty*sթ]9ҳ$nj>憐iL1gĆ=D( >0}ґ+qDAY"&D/;wOa^dA$J7O zFGjMc߫~Rj\7Cxc^ p"kUغ(#.kȞ6Ѻ Fדǁf4$mG;^*9*@ 3Joe0[7 su2^WJ=lrVf#8x^Ƀ;|6! 0Ӳڡ#ye 4Z 6Ht0OndXqE &se)V`pׁZ<Yj('B~섛HF;]#Y\ibUlـBb]@[X(X5e;gpMx6$8U._WȁbaF:8Zġf]_v>7nJhf \ >EWn㑉Y]ݑso75v8wA;S̏%32ՂAGc0dQjZD nLN~g^(K'ФRx6|6{aKKHs`=2|g;53]0YXJ: ~MJvnsF/ "| io;[rV(iIkB!.OF>`R08NϚ܇7ƛپ8&q;2:P<gUA1.TuiM4>KuOiaH^fGgo־۸5MateeVa Ls(8.0l AE>RsuG}]sQ]s' 4ImzQ8 KMRN`ͲB87"װA|M_MpeH-Ya=$dhÍSꌔ~߇pp٥fm3Q X-_RV`+9-{⊹h'8Dw+Ps 3(8pV/SOzIJdm#43K}CG7[(Sk4m: A$6 ne7vv":? /R; J,e]`޷\jf>pGR5]G"iEG0Zu#Gi0zȇ )Aj-Oy[( +UIVcbT\%l Zpy`EO!Nψ49AY{1jV-R 9ɛZܥ=9j9 ۗ y*9S;g6S6DyTQoQEVOiik14ˮi]\{ 뻀P4m143irݚi-2!է}DMZnD@nMَ7؍oA(fۊ_@Ͷ,|&GdO7.gzⓣŤRc[*E@YTcI+1lUdOb_'_S꼢xK\(F[XfLɉ01 /|YٯN&[juRbBy)17BnPySjCűL|Y-7+lMRO_T@ l j/IRǁ"oY TD6yuĊH yh`"j1ILzU\B1AEu$R}2slf%?POl^SdP5co惘 Y?xa,,f'1 Uד|rl"|0q]ޖ /hjg dDJDamj#lY) 7l͸dI= j#Bn!<@i *H XtPP0A Yܱa#7}K|k`d*+n흛'>p\*msU*Sl}hS]++!&0e1Rd/xfDd4m# ;0_.k(omz7}i<>gd09| puXC PJ OȼSM^ ttěupSS6F= Q;]HhSE& nZz/hDN!3v4A慂ΈnKW{4XA3Fba 夽ܹzR ;ֿfل-C9iW7㏉eЎ]HM_C9cCEes0bO<CQʳ|2hn x}!1BvU8ٟ؍@ic#m]4M}Ƅ=G-7qӠʹD]ʼn sQZIK9}sю`A  .E&+Q Xw36=._p(qήzͶE' uejY`Ă2pzTNH&uʝzcc8kĎX0.JRi4kJ ]KDl!7Ѫqf͋Poq"1F@Q&A'I)`L֒Yt8$$:P&0V[ep!~m9/07Jkzy<} *?xyYyu</~mWۥl~e&\N^|%zFO$1,xӭ|aq8U͙ H#9#}" 2 aiɭWH 1'4_r_vw\($}.)‘ :. >E~PȟA0 =i~.3/*UW4 \.oig@yΟXq`ĥ8D 0틘oR7%G"{E}CtPa? j+n,}z*[2}X>^K8aŭsހ9adc\zPuwLlVTf<]մ: uȚڐ˗C;R i&ʼn3/SP 1g,  <2u9Z[ @3 0N4A7P sI%퐃Quy&|Je}^M1a *| ;Y u_P"|,5/0!}If9^cPη{&[՚C/_761$+ 3O!yXm?Enn`s '#j"{B*)KoJZc&SBy(ݑ=s@ˍLЈ"}PAceqav'W1=ɁWЮ =>^.V=@mQrZzCR{C20r֎Z.h-5k>+Fr'cl?ƙrb;ﵗRoJ1Vō)pơtVn!^HH2.@)boDT٣D>߾/l+ +17W:6T #UJsN nEWUwە"Еݟ#_*T!KZ.yuŜ$ M5/M&Mdv#Mqt~b7fP{C;.rkJ ҳ֠kP Ts{*OZ[x7wSC{t|8,AMͅf"g(ef@;68kx9)SubJR@ra0*7Ae.>(_Ø1e;!P-_%ceV=t)[Ge9@5</ٲPsy5!t\ % IFZDW#brğVtbG܋3TGYB77bT U)_|W 5Lq,@QdhĢjj ÑP2*;nLC ۆ'^By*Ig~^x!pD#Gpr u$1oі2FB/1*sO>w 8l<İW?@C\]ܙzt/}# RUHh:Es6won{ڍv5QW|P]UĹ1_4P=ߏm~B ڮ߸A?|,Vxu%б QEk m6IpC;ءb&JyQEm}!l<9bR/j+>d >{fĕ%U$pDK S*UQmy87d=m\x tR^?o6zwt_a҂ֺ͖́3)ش5KVl41腧T0:Ykt?/’ܴO ,/e p (di`ЗT.ݸym$3ھvJG'*(ȍ ~܅\LQ:˂?{;r2Hא 5{p*Q@_.D>%^ipnp}>v駜C:O`=MVv"wm=XBH+y,>_sZݳ\EP9~5Iroͮd{12e&wUc].к zi#~zeHr1br[% Wŀhtv#Tô@Yu[=n\efJP4FKcYvLBoJzYVlMydžG찣!piv:3[ǖѲu=4Fލ E$rv2DfW7IFIV8`1*oO$#,(6 }k"[玠[< +KJ)O809).{x-UU1x@6Uq :yȋʽ^TCk-Mf:rz%kb.ĠuXV)&d,670(U`EP2mZPVg%Ck3ZWmצ:S>3=Q:w&jt\U av)L_Qz?vVbw zƮYLM.A~㷙{\ik|zOsWU=mS@;=2أ2IzӍӊ}]rv$Ue*R6XO(Mbf{N4Z>P7YG -k75Vzv({I%%ZC4TP:+zi&fƼPW(EH`&RM*kIJk;7YDJgF 7 r="R]˱mUA+$L )GX+Dso>^r> $K47kқCw~Clg+1@@^Liߑh8eLvjzrFL >74Y HARR4 Ԇ~6Dnm@l񮞵#O {|/\f~M uZA\Z8v[\d# xWq/m #/U wZj"k''c6yM˪Ee,-s鳢$͹TⷻҞ1AC礴6Y[C\p:5 "D Q+H ׬oJs쫷5f\&NT'59jJڭFd!b|WFΑ0rr޳C)Hk!x[tQ@QR Y_ S-Ud3=8҆}eaw*D*^߰-cE#o+̲9y vVHH%a k; 9 j*_ߢi,lX D]T%qRlcM8~tQ j-͂+П [| ݖ n,PBke/,(sNx_)\AZVj~aگ"*^Z RY^*k;wXmD]g2"x($αVO uIg Q"}zYC6a~4%ߜ+{,*'HGg` l6ٌ)ta\dmk0wCʕ|Px^ҊbSP{g;~ςQWTb[qh{{?x T:wܚo!db{Ym*uVK~Ռ}ml!|d"\!c=zJ;+*+OS1/-Ǚt.=KBN*xln&> rϺ_O93aVPky-;/wZ\;.̺gVHp3\5ghBjtI !hg6lۙku.6چQ7ml47h8=L$!PR;"dWL(릓 XhhWx"{j;+{_7@J~TӇMfzYGʡ7o@3yohCxr*Ų|](`F[{0Ԫq≘D&X9nT:2="$5[˴4 Čhxo%ha@" RVn}A}`C6yMǥF햦0{^h </ /p&⦇'F@SғK촓V[*Y;*連FpDN3<\a?TլuVozlYt|S3xv hAanY~ɅtC2>9W=$\ g0HgێI/NӖǥY>6mM)=N12H FTS9 G()ǎ25D ;E! 4f~eӖok¹7'Z\7hI!H. .;K GԘҤclsKIg7V'#ΛH(@+s|;Sp2n{ÎGV!65'ab7k̪)Yq/vOZ, (Ipٗ>ϫ)* .V,JU,9|Q_pT8+MseNjF[v6n4êD]8}0.T'Gt$scRoBBiJ-0FM!ĺI Nj dy5-SÙo5t٧5O%P&7{H! 9:sΏ F^tbg=޲YrD*HO,;h]چ1p'ذ)t,teH&GZ"rY3{-J s++jQC'rhC= dʁAԇtAt'n1C5D5]FvK4mw[&|Cn9`R 4 ⱑa |RiFАNKAS,B !VaQ['XT1O}HMy.dI%I5%Tm]s #P=Q&yk3kߺx q*LLHSh6/5t^>Qr,@U`/ Wh<>2i8, Xߢnd"&2PIrzW"5"aԮWyb2>P;oH l`Ҍ.Hc\^}ưm@ʡKfܯZn%JxX?@b<[t_?*Ӏˣ$;X^dʭQ dy8f$_!,֎bD-ŗދ1gū'Z 1&mJ<.$|\=RSES2Q?T4+{^1LܗY|{-m§\Q&z@h f+ܵ^Ն>_B9NDTzxfp% LZچClY0j]~P6`s_'B@dVӛ Cz 톿GZ_&x_t* _Mx"fkoi Vl2#B5kc/MML~N `!~uDD8 5n c c`Jt9*׽~zXĩ r!HP]=g5pCUX7dbyIo6{Uƣa8 3"e? VYXd`ƃ2Xɺ֤< 0,#-cSy?i;`tw/X IaG|'>bݔD^$Sp8{";ϧ2Ṳ e!f)STĥf|7\4%skDV+}9׮ܪJe umrWMu)kSYw_&4]uu43>^H\ 8_!ЃĂ8XSiv09o!I(2ʞ~+tqL*DZ޶&($C1AUẎzHr2j_wE5|Cw:SweɝolT&Ƴ`lV-Α7iGh(lEYK~ny\kZ,t93LYjE<1Q1YSf4zYUkBxHG,S?RTkRKAOߪUUv7]0eY7TA6ژn#^^۟˧ْ4im jlUIi¿BDmHTg{ye[Ʃ,9/u б@V0\p KGdhŃc')e:۷N/ 7k jlK-A?!b6[ym$`GegFIT-/y4HC&<41R7nXwcCY)9:DL=ͻ¸P14eF ./bTѢF,]&HWWDųZu% êQ.Sk?+]jW!LP>B~):+[>H&@Y^*Đ&g(%G3Ky& #Iۑ x9V1*mLޯ@6p 9a}1 b|dCz|=N /r=NU<+ ۣt43AA N;dYʘ'Ki׉T' e(faWk> L|G @K/:m&QFʌ}>SJ${VFqv!^n<8pwgiׄ}c]Bl 1pO\ o 'ANfu$y]ooV]d{ܔ2ޭTs5={:| ֮8˴ ަwn<r]IΚIM"(rmgp((U؆pz՝Jށм^! ]%һ1_0(/df3KaPH[Y$~DIhw^B4fG5!g&}ZK%?yEi%,}K$xmyq H.CJꄨ*0"g[ªWLbSD*~^{S2d8u pVO~g3Y.7@KAQ fST$M}'LkD {HGftECqTg&3J@j^vYN̍:&Rz֭ $2~ľg=U#E£}CA,L%RQAחkJi*ʸͥc.o*~OúNg/mR%4"px-ҹwPY1.( x;pum>tRx}\BhY= ܁_k<;e `t礗)m6U8 "$ i&8&~`1HfMX|x6nX c0"?#}1QNț=೩pU@1w[e} _zWg56z %ُQ$ͅ۶[w6Ի߃@*pDW^?';dj mʜWy2][5m7w]2<' |O;cԧ)a͋$rBV.:s}דoqXhtG)zƻu hEtWEg:cHWaד=fd[٢g`7^<%{q-37[7@tC ^HrIJW-hM~]_ quLhs :PcVT]x"c2 Z`.A3!`@-`ٷA X{0"@g)"?TT9 (x/cMc =ÛNi̱MBbz~jb j:@v w˃0U9P8ڰq^9ԇRRc~o4ns6 oqD)PĻ`ڄBC=3}Q"I`跘u}g _tHqH3 x( isF63W0tp難Pt䪠(æ߸f>i?oP̋ch|HD5#)[VR# kјDZwLE~MM߮w qISf`,>T twqSctd8n_Mb $/za 7}/8q5P|`RS(yбעȬNT 7B[oԣCƯⱺ9v2|/eA(` ~c?Xmr?dpm]Vl6 M^2ȻmT pØlCyW0!`3{AOo(>NO.X_VtbݽFRXvQ[ֈTqVbMx<5,MVe5ʲ[%D_$9.4%إ@ d'} [?k-%k0FzǨ02S1.w= ,:ZعL!R O˖LnűGz\*W5>ϖ@#ExŽx~(ĿOlL)Gh×SZ!Eoi}:#Hh.!]Jzũ wzv@fBo+VDdlڇa_hBJp>_ Tye GǕĹLB7ߠ`zI>+.!oÅ 졶4u@=Էt Z7{?V8a"{((b _7Mj ~\ &~p(N. V񼩒. Xmz,p ڍsSWp !bG 0۞; ӣi lTS,!lr3/I$3QWE[\\f?#xa7- ̴9Y>ݕ& TtO^_0,^236td"8,v7s8)՚yp"zݸ0h' .>˂+Ʒ?'h8Vٯ]g>J6'C5n7*5a,d⡶hU(ѥ " h `D{bm0ax5\kJCC0f!,Ilc!U]Q,UJ?12܄ g{z%>htu>-@Xg2lz"i|8P}C:vR|_s$x||+chk3-1ς_ ^u"-W8n"8>dGgMA +bNre>ڃr%>r6iƙJ sYT'Iu6G(ÒP*5R{;GKM z[׳@5\e?=c)6S$}8әl-MIHdJqHY^wcd*Vs*1(#}g]!!5w(D+u_/ nh~/Rk^." _n5#zzkGQCG 8v:f5K$"؟dp:c̚Qy11%֏Ke Q*& =VyAU\4F Ɍ~dQ&O1O4ݽ;(a`afVb-;&DaPofo3X)) +Nex{w&esqo_']$A G<V+6~o7!VxO9UE$C*heXTjII.ݢBq?yStMr7P8VU'V[ ׻+aۤFG+, U% ߎ쵎AOgR`0AZ {C7qYd%Jgu4uSB5rIOxV2|n\V\k>ض}1BR|_R3́25 DB%fsA̞Mpa3JEf w޹r{e=<0T BU ?e񳇏R'{tb<Nr؎\YŘH eO%@zQܻ1zQۺgB Y9ZsYn%mK)9zltVצߛ@ Z{TZW @ Ox1 r2_e_B'Ŵ ߏYRu:V<.ܣ{J"U^P}7~|Dk:k0S*Ys? :,5ņw^%dMwA4cx9|>ZUpd҄ )QGUW z[AD,]5G'~_>fͶipBҘa_=) Qf|04aM[ ƓQ2}tJ9>z+t) f7i+IujNܴo\ZK,/X\lqKU?t|ྚ v H=ljSO&<2iuT!LA㬓̻Gurh)#ܟu$^Mx 1TJtLaCYh0dbD:.0.iev4S: |}خ{ z,YztMm TS9\  +/ZYGf.3c#s:tGJ \M%WSP߇Je7$1A 'E C&tTcjN 5 't) mpz c7=J▶9Q4%)yw~^b=)>N'Uc"?L gg^Fdfp7K$feY=nƘ 8" 1":z慅?>s ew}+v/] ZO$=ϯa/=K  J)'a7=IY2 H[/d}=I eY9^R ݓO{CCU)>Q%rcOֱ2~G r_?OE.*and99K[A• %Ԃy'Xz(CF#7ћ](7UK4bp>&~OFKj6VSr3S'G- WlB[~ aN{xٙ9v=]b;Pqbhjȸ:L1 8[2sX mof-KUa YvZ/ 4Hݦg ͒4D@0إ'&{ ]㣳gwy\a]N/m0Ӧ| ;K(bt2zP,=1Lrx9 zf2WIi>uj4OW:,&c ;o Y7B=YV6g6(_z0tyg֪lr/ىt(aKyh?pUKY3LYy% vҥf[&{%~I&{$G[j?;Ĥw+WͰTU}Tjo0.,O,ۉc{M!t8+?82,r?@״tA[f]Z150Fm#s{#ԛbk=3 kɤQؖh =TM+!ʶ~+8KSkr24Hnj/xQ8Ү\%:舞ƥ`QK!`L)ͿըŠVϼBu倮(c(`"{đ٬@]6cDd.R3bZ]. i14WO)|ug:JD P;enF;%v(z`O[w1ho3$b\4U/ȹ/n *3EE [{ jq9籡v`Quȭ%, oƎT9KkV]2q<uvs]p ޅ"zࢲG̀䊴\Jy+ߍťӦ'IHMuβAk &dF\ q)2T}CqD1 !0ys DEc-]CV.E"yוFiv.CSw :] (a>M ՋB/7~~e_)y)*ZR*$MW1YHTT,b y`.rcEL(FDb)H}JMF`Փ&v.:yWϷ̓; 0A_>.wT&s=vQmr3psMzI9I-R)qDT%.bEmᗏFڐ:mVdktSд#|PdI;qL2ٵwD{Cu#L'LқB[?bU8jqs20[}zzƪEdY68|OSr ,xIm(3šEwګ1{Su(Sr}-VKrR~op\湠TRJUz^F=;핅?>S=gz!}i6Qvn-Y5dP@>~(DYe8cէUУy6w9*S{]{!MtaSTcPsoP\#s[v {N7d)?Ut ?,ѵrOE_]GH YV(k 9DUsHeD8vѭ3E!hP۶琷LMZU%->+nML 2_]^^T)WOe[rE&w߮CRPs60,΋ {冒PP8 CE{ZJ0Uk,Ŕ2 t,K1кrSvLaik`F 6XeI 4j)"!lptw ~JՋxX }TIB$n+A0vUM)T4ްwIpBO{/\AТ r8TypMBS|lUi_^'%ݷa,VlC!w‘OjqeUVsPگU! nwY(57Nj=Ȫ<;,^Xw< Mg\23+2}^99ұ@lo'_@Y2R:p )XRn-&3TD-Y3!狢ͶosT+uDTfxIQK0+v@^P,/nMGDJ`e1h0Y )eGZ,ȓfTHQ;Aw A QO:-F>T6:6 ;[(5R61v9ZB^4c-0ΠM:/'jB4@UO{һ`!hՂ㜇 S_@ SץٱQUx)<*-o;A(HMH鶓 0eǼs,}5s@qSQDA BzKi K NF7< M;\d΀Hzzhh v|~р3a"daf-؎q/[VR %3RӞ[@FmJb0r:߳|g75ySѠtV,v]VLw^* +v60o$Sema(BrljN\R2*9.ΉKm?5_N}9?V̼4VHkp3"`%sfhAݖ.Ia!X/+KX+|A+_TCݩ~\N0D m7ztSwCIHz.KxOl g[.M _zՉ*JbdLurLdpJV{eknGX=MejL{V`"- y }82TG ``ckUϊTWdo'[ R`-5O;]A3b^! It<#5vJ,?]I`1s.鏵lK"+@ rooU*^i28uѼ[ *կHf:LBYW)i;" ] mx>V?M yNߗ*" .DNywM1;|mWs>#$jVۺE goۅhp -G=,{1iQc Z ^EJ\7Y]RhWc NnmׂKZ޿kIwhO =“?2hTHE¨>;ĽZ9C}ܷ'ڡ.gz81M=x}Ń|Z}Ήho&| **GU!PvSJМۺF^8s:lFBj#>Pyب~'nYdͳξo;i[.Ny̋g_cT2qޕ5/ qrTh Rߜ;@Ԥݮu-:%=M!hSN>=mf0vx'y >VfN*Lsy"tb(KWd ]B-~ x*a5G -9wˉ?큝:۵= iaʱyY͈}["!&lujKm5Z&ArGG4sd<"/=J+x4)-lPLx:,D{7)aյ (vPO*#2yʑy)jqrFKm>-8ye6ebuHխD"y 5Uj6x0sVLt)|+w1t2מF)b y]@FcI]r =mLԐϦG~C1kv屓rnia:2vϏFt*LAiR1&ʬ1,7ϥ5GCbtz|$n{=Ց~Dj#MD0L#n/E@ǖ +61v1EUk UIvonuQJ!;O~}Kj@%ו8};>y+C/+J%M̏Ef9BQFc'՜k n̷xb- VK }O^Hĸ"&$үt!y͝@7jž"4b#oyRԣ!1YE OHLmz!&؇žnԍq%(:?~1i@Qݡf90ʂ' N t>1M@KGc !  B'|{l0c:ah(.LBԒ`؅RK8Jͱx@'4o!AУI,f,Mvr,T꦳ղ׆zMG[;Nw(37fԁ/ܘ{ iKrd xx64Nmh'4 *G?RǨ#O 8oms->NJl-h/ +-$7@4uu`| #eU\v CI?4W w#%ot=J QS@J¶#1`e@h{?%Ji[ NGk^ xϋ. %j׀!w..N1nqXQ@EVA^m`8p_=YYQMO7B޲OدA5SwtS*j8jT{t{3.,O2)x 9$Rw+SDGC߭~ғDĢi_I0ً}Y(dJ?=3 Q}A Z8K`=[I@z7 \/(^ ag]~S#&F- l[yrTW2@mbPv|O&pyř V!^y3@,E&}3fٸZ9(8T?T^!|Ƥ4ek86G!цH:дk)dpruu/Fȵ K{aV. CIxK@3W͙7th!֙w"~Maqu“s;|MNJ+j (``2 Y[ɻ;dO'0 u5E=pdwPc8KJre  Ui)DcVL*W#څxPjI )dz**'@Z܋UaYW֝#iNUq4VKT lqh ضiqƣJ1VEyNuHy(2'U+UTe@I("oFNwן4t줘qUE\J+ʈ1y(9Sqp̈i``2E:2<߆ i~χlX_ap@25*pSlV>sLDXB8<y6 h  x-tunS޸2sXbv$1QkyZ9w>^8!ץ:)G+A!y$9n''q4Qb!udqwpYc:F8*g%E8:s+aȁV=(^KEe=BӔWv׌P� `ښ=*Z3wo5|_li8b /O%CM<eZ]!% "?gx)R]L#r-lW krPEpb 1'O3-FfuG(F7 }Tc}uęlm0$yZoM2FbE=STHC;X[ve90ϒQSPLS-ʒ@l"O-?=r$bIgHn@2ҠBVoՉy:Rf ؏r]]l&L"gRuWE}(r~' h2<3o|kj/qSSZgۙJilJJ B|>߰{^_ QΈr(^֛U]#(/ fNY{|2ډU,@MPXbM5&Y pZmQСI AjZxϽݴPҜkW2|w/ΓM=kxĻ@ڻ@ b$WV EK:w EE6!<x!8kL $ZJB&ֿc uuH/Z"p sRS2-嶞g" -jǬ`SF_%Tyqh[& Y,[/RL~ 1²BdhD-!h1%G#7Qs2p/;b@?-ΰ̿gJSKSJX. +P>*[m֜h9$"{gilr@?0yFhG|^&ߎq)cHȂ۠sĉ %c+J-{|*l o{9~ o![83^e'Yy03GXb&˱AC NzÍyvTgb>#Yf*IZyJ+>ATt'lt&𶶃AQV){ukl|t^b`c2ɷ!W=^ 5&WqΕ٢u΀>_Ꮻ71-EOGNHFg(uF*O,M*f6=:G3Ҽs.~ݝ{XH7ْ3&HطN5ŅǭC2~KҨ_EHVSj:DY$\!\]anA(HJ]*ZN|N.T$ɕLO2w, ck۞; wIXhX]5DX=\V^2ؚ*uP w@+ЈDV(Ŧ70Tʰ%J4ؔc04D0 EVOBLh g8 Ã.ɔL*QxChܩF,9z< )x{K2SsK%(GoK;1dezn"}dFqp3ѯX:KA% ڛfZ|?6*I 1P>h>9}<ɅAgNFz9%d^eHe5Y~Cf]eY!K wj廻Ȧsa"oJ""S9L%K(aL!w=5EYлEǺ~Gp6/o_uK@wy}@r&fyʽ`86Cھe9dxU_t{1B.m &B},ypUVn&x)?U_f@-Y@QTMӋG=G]'qϪeT=lqE$hjh΀htZ BTDŽ5iBhrmc$֧S zԶ1dmjsj3 J@8Dٟ4C2dnn/-y003\؏|٤9k"j`[<+S<|nwT%"8@WTq l=.(h.fo>GK )u^YuAU%:*^<{P,G-yo{w*W2wrZm&|p+>nk`Vn^co_詺.lL`[FBA3['gcviPtKs78`\ w&(bp) v FC3<>m1Sw`Ws`"1sFm`rQI)96ܳ:&jhno9P(YA bb~9y>DfVJ,#p ZK6PTz?_?oKSĮU_wlݚ0J5/jfWa.T1=+Hup~ڱpq>0a{6YzK0G=t~oN r )ޞTOKhMGGts|&!:B(5+xY 2VW Z/ qi&>,RR .P5؊gi1w@M]5[b+T/^ear$O.E6)_(IQ=tǑɺjN[;5Cgm{pb9mq.4;sg C?` ^L35%`{l}$}?<ƒb@hwVjQ9.˧C<}: ;5g ,?v>3IW/2I$s0# '+urLˣ%?*<Cڀs츝 "#+=bt*CQp@i O,`S7j$rhmk#Q:^I̫ϧwf:M >SE5t8y6 ScTT+խR&hΌF9Tv{Bφ{SK\մ^7kSLh9O]3kwq > Q ,_ӎٴ^ǶRP)XӫIB!<\`UQMx:4Aa=xlP҂{9(\8CKdmO ~xKuM ª(@ZI]H\ᚘ`CeP8)>>X1}4] 38;8ǰfC9^,,Ws20>F_y;D;!DaeYLp_Z2Ebp\Cї(ѳ̓ߪ=Ϫ9et l V3}xƒ۴rSi|!9!NU?T19kzJ!7өv!̰6`Jx=1(@Ï]ϒ_nIsV0h=ML<E63zG Oh(XF4$.R6'Gv:eo C n7UUI`Hk]p}+VogcEZ5O]4-ykP-#OQ#ByX{_pYҪ o>>6v?H; ôB_kV(tG7*oJ.ůr ;+D2 P ,ھ$/1B&nǑrǨunEg dTV"a*.+?x1@8k5k}BH~;(t Kd,CJ!PߘW;gFOe<ڤ} O;gZ2)/S.ѝ1Կx ^Љ":[BS,)X(] 6"=I5+6$!J`n]KOْ-W n#T٢O@_WhLzݐXytѺt8PI(; W H-b4 xbk@kxGF*j?7J.2ǽ]gf;sݦzO396ԛpf yn .?rfqAJhƪ9|i$\7ocumքbHRQjߣ;Ь;S]R3,-|vD׎S|liZW?%لB=&D۬0V5]ȽUwedϭ~!oc5TvJЋ,@j6A_ϻ)$DVO"`52qxx ` biL!Xݜam96*+'#m05r X,WM6Ht8b&dke 塔`v/c υ3w)Nb^ ";*`*P`JLBfBu]PY5V'  W5eM3 c j!| DHn u-H&,@VUV+.tgR#Pt]dkn# 17$Z_{8}n!D[im(3t%&iUxwO]Я0|O2*=_MO9R;` DkZ7~YaO$jLߜ([d{|&G⳯pIn&+y>^ϗzumڋZwTt4`ʣRsq9r~y.oNj|l8)s]}3Q@o>Yହ5Lgbi|Z?]ƩkT ֞>BU`ƟDŽnLX ь㻘!-aAPqdL |1u~RFzXR I^FjT1Z@ פo jbGM ՂW* x۠g.Z_6z n/KJS{ 6F霮"4ѤxL0KEW; x\H0yOӳkBBC`Ԫi3_?j~3cⵒW%Ś^MIQU(n:ǙnY1# -GNߎOz;g6}tXX%).عb5a-|%&_Vρص+O{?ERl(2@k4|7]g̹>U}LVgAhTαcnHjX}SLn5~iZ'#{q Kps!BXкߨ3yGi*=Ea@?ōQ Sa1 m*/|fP EGMkN@l"y^tjۧUnNQHu@qF>̘Ix'B-%*hF4ꠀ]*[5 *l_camB~xo&v0a^>+BKFJ)$rVWE9xc<BFJf;A×<#˴tSmi6yQ@_f0B!ʙn̳ZaygT\Ǵ nnamdulm]Q'7c-|K:ic4&btc]UmE7Q{W>@9 ԆSGtgIYJ>8o uE߯o#5hM`-eGb2]NFtKuQɯ|Cuգ'Z4,# 18Sa{qjRCo4͑"C'CuhқW?s>šN`C‘$QleIU:v=Rå8S%j<*ʍa-r AƘ?f#rIhLO#E|USccm|uѓ4%!QYE+5yGD0 4&1T2WĶ|ZU;.j=?5G@XR_9j"}SmG )ъI(у-KT^Z0-24۞ 7l1ӹ?n.Rli5i1L\A<+K 3f*' /Q@l CXƚ95( K;upa0 ko٦KhdeR9qjqRBq(/?f0.zHMl[l8Ք.ɸRjbߙ*|(JnR0*w`{{:XY`%͇HF0^|~Np=n,=ͪOy&]hmwȾU#O,?oAfͭ=tG;ԑy.y so\> ʆ\p$wZ[Lɼ޿dB*J)ڶ)O=_^CL~1bCz+q)9w@*5Hls1E/}e**7?M@^P/KK+ uˢXҌΜ07Wg1C 46j~7r&vX{XHW̹Ե~zpgzLaaj=Tb;(RdζgZpUЁ7m[I>Y-Xv7[cqÎ*xlܤH4Jbor*Q]F1od:D n\|l2=0Kh:}*l 3k f3ktX-Քsj65-<h䪵|r2ރ^d\ ۢP< ,/u|Q"ߘ:/j`,5]M2 h>,! 1 h˜OwJ"nb3sOvLDy>70XpzǂF?rw9T7m!C+G*o#H.9uQc郗r'ט=oW>#2ܛ`YFAZ2 "GbIq/fVomiƇ'Ngvݹ6xU])GwV//ն)7$X>AR\JO7"~͔JzAdfl\~2I"$CRn g?&R7=hMo;i TwZn~ZW9ܮ5u_, y6*CG7b62A>9>r.Qҵt>W_vfi0)Ry~-wRC!ġOg(R!jrWiyF)S@(Uǯ#$OjبI5-YgN&v1Eim0'ƹ3#< *6±Uxz՚ȆW\<^S,H߂U>6 "Pkl|eJPm%uŜwO03WenKƇZ91@PTA1 #JdBbXrCˡ[2(LfReC^,Č;گmqTie`OCWf=Eh6k~C')6Su K#sM ?ս51 ~[āh\쀆乯U3]3EŔ[ )k|imйMVcu}JطZuE$Vs/K,5\sI2c\CX 2\GVί25M:(0Dp& T6tp7'Los0A X"2}_41{."UMٱDØ\_t, Z1jrudH׽# (i=AvǑsr+>V"Q5%[c_nD/_M]&n'Kz.w=5?{.b@WaL Ρ>nk B1Gmch# F)߹<6 T&+̪׺i=K<͠ iC QCF_ro0yvoUѫu=qbzwy_,WL8hfX{5=rsIb9> _`HN3:ヷb| HZWG̨\i 7#3"׹yPWwhO9峽9oJOtܶC 0C8\OQfo^Pu*-1 6h]Ґ&C\*j%|q%Qfx}@?w@BY[R`CDm@QTpC#6cv/lq/TX,G:myQy:CS<#94YlK^#oy˂23(LЃ+xr=iBSm/wA֧{Bdo!zuR8?ZQ 2^$K? 993鄄X tMf2pb㑔c+ӦiE rqϗ"9l1xTĆz]_(dCc}'̭ۧĚbF9e<C\plx'q]ZÐkG*a3.ܳ*&'y3,%w}(:,nꎤ>6մ3J"6fz(qQŒ.Ni?.˦qBST}!70<56%Zwi!NCIFƣ=wS;!̫,1]_KXޢ^#.nU*%iX*M j_17J%Ca5NV<Oz `X0Bb5%4x-6YY]ߜJ "ÌTAi*dŸxCB:k@d8ﲺxLqf~̘j?N mU)oOO]0J4-*IcNhUx~B#R4lg- NrvN:'Xd˲4vvj)#ƣ=}ZC|5(!.٘H ^m숂]G&^q *ϰCH8JN.Z/8BK(X!]u-z4?R@VVx{-.HF6=3TH}v#wel}vgE~Z=nAs-~y ?oiP(- q/^3lڳN, lRbJIU&.AGE% ; wfPn*u<_ASP.€z;![AiE@ryqsj_ )˘.l&S#%w^ r.D;Q{2ekޖobw#c̪?/IyN "&9ak@x莴EcQ><ƨztSg1"EI׌jsI &Pz@$NQlk΅u> NQ@}ڼ`u^? 2rY`4X ǫXݡX**5W#hO=տ@0TYۦAu,5OЄPQo-'bƛ[i m0@(NHPHv|`~:Ɉ;poȼlԂ{&yS 0Za[u/{d fQزhBw`bjV@z@%0kǺU'5DGyNg1,|3ҽ uD W+ D3m6Q3w~#.+ӤgydFcc罕Ԕe < ߶fʅN.a4SiO+m|>e6b;,&=kq3W BG%Γ0 Po~M(dFu>kZ /Cʸjh {p;p2k%_ڢ'l ex92nv잧{ʧ\vHDxl]gC "CPxȳȺwi2Wб Z8^rd)qD3QrkםS jP]Ddʼ܇Q U֢zjM0_0tZ KLVn+i6Lh0' + e) )0[ċH h4'QP]'#p |BHtbvDVR-|iw.9}-]̷MHS/"I"dBڲʍZj۪ۄ]CSyX`~>q&V1})Jucy1Ao[+Y3Ý6pS/ڴxJةOdТ98r@ [YD @oGRQQK_"%»U-VZK, lǥ&~P AjyKEІyb%~T 6 &ѧ:H v3joyTf:(wS:W`QW_4tQGXաn:7TN}ƻ&7U N9UA/U[NaTǜNU،YnpM$Q&C."4~HY; nkJ9ިeInC`W%6IYMAZ[SVS ~j\(]E灭)B+"~\W],Έ_#&9}%K`Oވn  ;8'%;qC+_z{Ǣۢ@ˁ:q]MT8@|s|";aݻ3ooF.Y䊏>x3Jr{]7lۮ8ZDE`[s]T1}w`>`]tsZ; yb[i äϽD~~H+A'B_ncf{Vbm+v۞@\aWWny8"EMN"mڤcF9N)w։ [)[UIU~YI&w7A}VdGyE1T-G8^#jv೻T:&?Q}:]]ʰ)䂙3l$!csvr'G*d$-gݜ}{YX8\ܔiDEȖ`U%R(XaIt@nuR@R aܭл^YU\R#{IQRݚgwL5P8 1"nڮ\WXL$AzP-:]~'K=ZPƙXvNǸ%Fn@ x>rV Z7۵mxYX* "%S d|rޒ{̑wD &-ndOҺ+lD*_lٷWUCA](GEиݠnCI>=V~'P M؟56- OޢQ W?:Հ~a( eE;riH慨JCcX;GXa~g")Ċcvpp/&p24דgf|MИUA |% 4idO7^a~+CvqR[4U=WUtV;?Y{좩? o|w^QeU}>هDHgžH,FPBP}uNdwnfUJTd~ оZ;3W5~rs_f08N=k%G ߟxEhv_QmIۮH=w޵B_C7[ ͍֑?a*{`B\fzyD˫?Gwm}B^!F?d DUUALbV仺 3x^${ʄ(-U:oLYvUGY>h{H*,ڋ[ ApYޝc0(NoTG.A] ,qKm'=*fNuumB+9Iu;@tgjLd9m,O'/e%u**72㏂G Q>u>W+KAK:@w妀d*aY͑QUmg |*W]|v>]HqgVZ}['i+dnL|W^Fe=f6uAD\sqO+2c!I^ SgY0֩aSz+B/FXEӭkiƖ==0yY&7\:{9s8Ź`CYh\Mi?($Q{1y=S>[҆n5k81ҰY^4̮2c0})|ϋ]ބPOɵ): wܮ`f/@5Dxk0_nGN0(zy^Sd->Kƫ-?ƱgAF5ߎvD6;g1L/+=#hOkihϷ~v*d0E[Lc6K;V41* M_?PIL;ZoMnu-̡Aq I29ؗ&Rc1r3B$W* ~K~ad़=+,#F7ϹIűqgDH)՞ui+d1W9bZFh+ }*♈n1YLwNt~$ϼ$ zomxw|Ej%qg>R>2,e2B$q{>n3n]@K (;KitRL4YZ9ЉehcC݁r)d\Кa[-‘AzZiUkGVnjF~떹 4u H)u0JVv8ZxGmэ;)<ݖqO{6.QgEn]9?H^}EawmcX-3=Q{p頠ɄQ!nJ}&fOgf1#H㛃"~D#C$˜ƛ)2UWG;LZ;0#ǠPDb X0voы& 6y*E73*np{z0 GfkgV> `u?>2pE#RC}2ǠPDW'"zPxb>aYf3U9= Jq~P.}>SǍK,1Yp(ڲdJ2UL2p/ Y{j@% }DywloѷIIqJ>;gZdS/ *.#`5fh^Gc!.1i"$ e o5B˜x9W.8 l?h1cZd}=N( V%Pȴ(b}5٨鸞`\5 ;7T2qДZ~bfU41^GY$#hΗJ!۹RH,(! 7PIH_Y5Syk܈FȂw|n <3fsm as b?)dv:?a"g..5KD5;=P(d=g*Q:NZMO#:0ڸ Fjo!*V*Np9Ķ_gnI{'7Vn) +۸n8nF e4KI*|,Σ/E}1P~9:`_p@2~%k(Z^=!]jhSps>Ii@>d,8+_n& 2m x}!m/Eĺ"!7Cj69p,>pCrCYS{%@-W֜KTy = ;>BeRI>`s.K!kC Nb8UAEx#ܼ 28m(М8Db ȿ)yF'V\-B#DON_Sx; ^$bԕlܴ>U/B.xP.-Z^B6-nQvӴeR`c5yo~0fЋr1SpGu6.0z)? YʊxF^Qff5Np06ʠ VX/̶5@~/㟩f \^ HG-47̉D +YZC0^7GP?Zj[jxsmEG@$"NY6vw#@`Eھ81+>bcƮ iۿ§!!g6D.GPAS}P R! ?2tgS;:~)=MwzɂIf$#=U](m91Oka!x&C` <7$@tDTINM-7TV>;C^j| w;l5~zkT/F",1R*jVtc/x/:0 ]l 0UO ZOk5˱. s D}H]>eV*.#(ޝ9ɵ l\!祸7'2*Cɫ#fٍhm $9ôKy+SP/R:S2M0n< (.g]rv|߿!H}? [  '5YXccH]w&,Ô|"Tp$8~YIvS:T2Gz=oDH9MG8@L&\~dNyK´/A01 7ȬO_a8JЪUeWя풖,m:(.<hin/&2oOkw\fk, nlNrAfu?y4璈o1#؍FP G"`5\ X"Yz%ƢۑWcgN) /I]!uU͙=Kn0$TY͚i1sj壏gnF6̗A.A]:p]o!'2ߓs{}?s˱,u>E|:CA٭n]~W)Z oҋ5Db#WI3/#gr/D lvhfxFUyn YiWّ[ttu(aSQI&lyF$U\C'qr *yَ z9>$-&aф~GlCr5yϋ߅)_6%k />$U66"`pB%gGRғ$ѵUƩ\%؍ '1xB,j&WߋbmANewd+kۜ݋@ٗL[*NOݸT9ﬠ75_Vosjwݘpλo-O},/-ю>A"z pDLؖ),ŸqGCQTG&i10@.LN)\ϣ걧w<`doєb]wmHxw۪+%vƦ?+JO&K:Hfy 4zB %vS=X_|Pᾋ@%y<< T zE Pp$zl܏&5 2Y>2]*Sv#" k[ΔyӅ٠tvTꡁGkw6nhIW˯&wS6 y'NN:Gq {Oq0y0Iв§DKB0Ǻr;FU(-ϋJiFhM{$_ }4婎.`818 ( t+۰<>X]N,ێ7km^c٪jި^j:}?1"#ebɺ]IɧڛU݂xxN/Re}爋rtQg&~ˆ\*3t#Qƭu:PլA=_: KӁ5>{GK-ŷYZdqa <ˋ?(iqǬz-5(rFLZdj,·*}Cl~z@'MS]&mmֻh fl't)m^ }iMSf8.뱕JDJ]'w{AibW:0{WXE : ZNP2@Vd8_I9b,nOcfNW`T?'ic8)ǰ. Bf fʒgX*[Kxc˶cXt_j' Ļ>YOYɺKK{%&VQ-l RA 82"Φ'yC)a HMqC*|p7ab%C6+:E6a^+VӇB[\}**Wb` ф҇xlU`c | 9J)h ]^2{C~<4;С'& {l4tk= PGVW,&3teIrYL6 ^{,D͙q sOYOy[" 0Jd .t`3_woɪ/)n2VĔQb䋷1~\ٯ%7OYBtHܸ2뼂Td2eݮ :!! g5pN,]{$lIfi9uxl #.F"  NwZiBbnnq'oi={AN:̌3oY ou1o\j4S> TMy`J#+87:sGr(4J,<2P$ʧ?b%1bSbF+ð$UitRsYOI<y*[#~4ia^Ir.xe~2棿cMe ;q堨V|xAyz5IqT}m y1*cRPIT*R~ fnCEOO퉔>ex6)?"49Mڝ=@> FȈ#O_Hp~r-ޮ7 Goҟ&Y)ѻynJu#MVLȡx`{+"GbK V%rn,"Ls"F>X_M6`-t2m߰{.p~杊~}9T|#}[?JUcW`@yjEi 5lA!782N7)v&Mw[]%D-K۹gKFm=\sd IenYjΔpTݣ[M .a>>dOݷg\Xbp :[9% M'#nvF2<7Pm;%!X?YrVA>ەK.%$QWqB7݌[W:'6l}|Z[x]M,Pncۭ'n$EbC&:WK1/᠔R(m /ͦ-_T_>F>`u@Kܝ7evXyV]+]pFznkk/Ã8_ack΃D;kA|.W !?}dc>?U >|Y CҜe'|aXXz=.ɼ}܆N4e4 1pq\rnp ~]{Ma?a; kտ r z-v jOnslH~je^Cꢐ0 z}a/]RCY 3 l?q\U.UѴC1ӰY fivj|³Iū"$)Sq'DT q~7ӆM!(uWQ}U۽PѢe H;RpԒ6YL^U}FJumm:egjʅ}L[װ4\$dӋ@5&dL&}Kq)Cqxevf&7 A1 m7湷`f4! =V Ha /SCDI0.<0?Ds]JC$"k$"/+C#e)SaZx&f,e*D-sft~ꅇw0*'4 =\Knrgfۨ ;gB$eJ\A^"׫g5,h}ii^w' #p֨&4`6V'(3}3[VvGV(%\ݒym:GݜdOhU؞F"lT|S>YYkQ+~2Rq$N'ĆM _͙uPe1f5ŻXZo\Pfa5;V=؊6k]<ľ;K}.u9Kh^ARyEAy*] z`!O޿ϐ Cشx5-%3Mz4n#5z=i,DDG{Xns'79a)T ~K> L1k,_ G0t{eb-^q7 (%IQ{/!IԟT7Ȋ[ CM]VrߥV+!-%o)8)8ĀhQùll,k`U=̲c\a__r)65,h|hPܓ׺ ||HXwz5npt<\R/ F u\+ 4K&dn?C%JsIWH=[5ѾmJxJ۝ A'nv8LV8V+mE*<+c. wwÜ ZɎ` 6u=;N#\v:`y50dq&fNzbW1`tѾlwʠQ7hH[/bl)#J)a|ENS# a"c:EZQMrh3x$0N ]#דRYHC,!T$/cqqIT.TQ 08[Uubt[~mXj$7ܹ`;B?Ҟl>*.Nq\ݳ<*/@Lg]grZW-)K`#'ɨΤYo!lv-nTC7y!}Җy6'}/ y~67!V%r͢{ۭZ s;ج á+/%za+^ݢl~7sx&ُUs(bVtЗ{uJկ)f$_qp6W5f8@.c 7md,"->8Y2D#fEkӋh!b'i61n3,FgSOx`{ZGG6×3iSmXqn/1R,Dz BWdW<ꃄDbb 鏾*W~tTŵ8"YoJ9b7߹9ɷe!N ~5..L>e˅͸,yhM ,we8')akO-R vTG룰<bZ瑠 Kn% K/;}+Q(WYqT$j[}% 9+BAl7e S/U$K+YӲk^BrHb7;vⰻye?-3JCXj,K~褷OtȯyZH BPYiXc"^D]98+@$8p#cmh۹V>c8&Up3E4Z$c+Z2Z5j68T]6E@Ǎzd0HàW*A~h/Е%h7TBR5 x89'./;GiCJ'C|ݶlS|ݔ41>uhL{[qs%EOjoN:; opҴ^X m袩AlzHǑYN$)n ^[>KX\ ej }J5|'@iKd#=@?x#!PW9kc$lTnBN-!'.&,N^Yf9˩zLL“*i7iwggwH>{Pؼz{jKmfԑ'[hV])Ru W σaH詈yl znZ+Hڅ| `37 DkoZ5%xzUӄw)r2'Bt\!L}ji.!]z۾F2Xp[:mNA׮|>['1w'>l@5y6?C' 9ϯUKQ$:"XgqZ-z$WU P9bo d]ljMo5ian_ w T)D]"N 4(mѶߑ._uFh\ΰޯm=8bm &Z 5Xҳ>^Ղ'cVMr@TزoVB~Nr! NL<2WVDriU.NS)`Dg])sg91aNjL?Kq@LHQ7eR$F5h"0 bNHezQs{=^XP\WTeal/2!QxaU;%s)HTbEh*GԵcWILgX-8T >V}?>B#syu<^8FX!E9c(AB:ݮeF|ylt{sZjjޱ#z'\2V-TZ|~wY6u ndCvS "[Ƴ됅ԩTdʨ$.A{n )>K+&XH&3/ m 0nP*=)F'rG!1=')K峬[nG[RT-٩+9ߕnu J0ICV&BnJ_n;U1YU$ '}W< ÇYi&ыj\Vn}#ZD)Wx&݆uk5)-(-P?xCv @}Ԏ8leS[^qOj™EkfʂW0J ^zMbEL$>rMm2i$KyU%۸z_Sb^fʙiT/IY,樜]y9YU/[p/ vC È? WjgS)#ڲ`y$a& fIŪQ!"(hs];'tPX([EyqUW۰hz99oS.BY<Bck se풡.e jTLm{^0 4>9iՀW<lJe5cG4vJ%:l$Mr08A* l|jnk6uR M `m81FVe$;cV聣"@̇fN 3"}0ҁW(2b&+ T8"Zg"kE~G$۲4Uf9'{cDUCsJyĿ6Q A9,hDt;nY-s? OrJw4 :3?+תzv-,/$g4θxHN>cZT>eZi_tXYjm~HbziY-3!=ŋG Z46 eVMul3߀h@^te.;BH[{Ƹ/Mz@z5sx,6OmJ?f7FAPZPwYuQFL|ܭ;#ើE,z:cc~k:N4dSАh;T+=CLVL/3A"}nR&j @:.=;>(OI/<`р -C-VYՕ:YeGmGAVR}zi)O,”n{wwHw~ b(D),X6XH7߉.LFrm)>{^%gD݁j@"dى Qgpݬ PΜҕڇKA Wy,Bw F'؆Ҁ6Ƃ)1?:I+ viY&CaE*??@/&_p~rHjHd_#5hH)TVYU%wJ;&XY NO{ pRTÓlLR]0Qt)Iѵ ]ſ+z{/7Ȼs6bK ZSŴ37r囟- =UۛD94&EG:Dg[|o~g ,xV;N_9o<?fP׀fbBࠡ85wi g%9mJ݁""Q %m3v80F_.4y1L;FoYZfs /MK[. -kdT¾=df߫y`*]_09`$57%7fQ@7BEKpdO!y-n&*:ɡX;0&ڦeD?/Vs|cm`l;)Y {C5`~R5PL2QĭȂDBݵ.l `9֣V -5/`cJc!hOug1%$xj-BTh^t\Hؠ -Q H}JSSprpIRK@ fJLomVFKŧ; 5|<͛O1W hdɲtږoe":bD}] bD/1že*-8u!2ļϔUCretWUD;S,9,pvdԬCڀry¬q!7WbIpCT* sC|Qt3 WG3l+F^J:rQ;T& BTNŬ wvM1<TadqXlfQxx5 ݞ!$nσyyk.tq4K)bu\U4щ'GcORB0+*4+vž $(:|Lp2{Yµ}PwR ]Of#R; 9na9'\%}eJgaak4Trl@z~u;Gť&!g;vjC.êh,kFĬژp+o( _]@܁#8wfjQL{ke\\k:D<2#hlCuUr`RԜ}oԀrb5j=z}. M.fx8P6Cs KTh/fI]وմrˡQh#{'#J(|Try(2S!c7@g|6}/%5G ~~=`+HFM' ڈXTFM(RFlDJ0,dS$z2f Oqjy03 D#Ow Oo I9vq"R闼Ggd|0T,m>#g&&6)C!Lm{jEgRB|nu%=uD7QO>C ؼd%U`_'KF DP6.##;<~CF *G)ZtħC-IaL5Nܗz>4ODqtJmgR y kJ Fm%JP Jr H1ڛ. WFouEdRVvA/l0 ^RQ({ܝhqؖK"g27ʈޕM2ݣo0຿@{k"1ݰzAiOF&JMti] ֳ=( vI8?SBcCdΰKM|jr۞ñ:2BA_u}4u3>]y?U#Bba=d.FFEA}؀؁ep0]-zP~oq"VpLu~ }Ԫbg`܋ %4rB `r\A.VE47C\r-4cmx p?$B:*e0mȗI S itW*ڵw礱R/XPa 2J FR PSu Uֽ| 3\B6mg.1@"$^N%ڮ?N-=?$}w8u뫨SRco{OY1ҩID@]qh7֠XHc[x2qaĻ{ }vy$[(D,yOJ+g_`LHQL%Ǫҽ6yv2p}evJ/˲ ݲ~EK0Пx=ej#AQJ[r} ;b^ J/Q8n=`'mAv\h߽#\[*!)/=#8q; SQΖvٵWio8y熊^b1.\ÝsޗH<9ŝ9}j&s&-D,a*ABoXfѐcXDNVn -\R<'J orVSICQ []jH,:Sř#y`C/篬P ^.V8r/YX>u|u_o272bz u-k< :_vL:`f*Qd"4P-Bڗ䮥<>=縰Q$6 O8P:4-g VVdnPl(FEUs#'`xK9d7R#S5۷vK>6`<2^nP7+/};Q܆wYԡFuZ+B5!.zY[J*kݼO'sxi֥ Hʂ='hZz‚^A^i~̨oq + u P)h?RΫnL~IHm r<7M;He–q &HY(ƭՃ*fۄUv۳_>H HLleh]'7fkwnoþ@RjY}Әw/P}=@B>A^Mx <2o(x{=NfQum>o]0O \ˍ.RZZj>pz-pEE-dN;ԟZUz'n H;ZHU'mc&7Ci|-?j ))  )&z!%>J]_'}%t]I_rvOoPOz>L8I o|=V7 =u'=V;GrlcT{[*{"^wٿ (dvG IF=&$>ǝƁ5 ثjSL X86n$9ߝ\Ύ䚂Y-[w _fO-UV;A%);푴.<<@:L8<k$Fn* fjLzt]8|.{O_T4I|Sòik^!V-)3aOFQAgb>> EC Mto7}>ct6ڈ$ (fZ1M,_: ~ Py l#7d}Sش mgm=\϶/)?tT<*7wYywۤBEAЂa01w`q?ѕEmlVH?o䭠j^V.縏O\m,"6@l{|s<ظ@lpuWj=!*=wzZtÌS!9QzF:qNEG.JȡZq=B(]"Ov^5"ZyIjG_ViىFkNoq.P&"b Yp /wP9aPKŪo$cW[ƱW`FAHh4`A6~Ey j&sA)yjL1 & 7}/X^ /s+(2e>"kxBWD\8Zl *̋ztIq\Z|οLzr DjG\A)%3>hVʥwtð2pJ_$'BxcmMz+AֿDd[R| 8.qS&XxΑTT#1N SJQ~qĩ}Ug4/kJNr`=iV%/q+aarxq;_~ޒ4#'MefzslCŘ> >'v`Svs;^tmr06խ;;2w2LR]5+DHG~u(jKH; ʸ6}-YҔF3󹳞kE%4^H|ܕ#^^SDNvC~oo?"NyJ6Dg̾fgu]ր"2_W`S-B{\21 ݂Oa_U|\rQ!Fy:a(MEq\pU3$@ džX"@=Tz~ԟ?4:d|N3IaKUK_@^J+Qkz++8i02o<"Y l]DY( yA+*IELd4Kn*yV@]ЕJU. @H+{2%^HYAja\ُυ5פŴ&CmKBt0n&GEyS'. mɐ0pSPbS(ڒůoN%9OOY<4{I6qg#Uc+񍘹=s]7QƆ_/5D-t̛MN9>U .qh}lظBV"V%,iK'i BayV*>GE=s +G5OHQ?(KϙB\CkC\0ہG.ZՆyls.BKwI;T{RI$ֆ(OcBZ|v r'#"V""Z<&,qW$t0(ovA% $Ack&ipF)-f Uętb50ݖ^N탣m0O1Yۏ53?O0Lڲ6X"[1T'9( _+LK: m>I2_5-;-OxƦUmA85#/":k{QN}ĥL̒H7OUտĸ{dſJbw#θ* Oaz?C7ik<:eXMboy(b3ҥtP +.(u95(}/\(cRFoeGAͪ+\ I?ԀkA k^2+M;i v8W BcF3Cmu,3(i2DxZ6ϻX$Alvdq Aqx*mGps7fp(^0XQI1~Rͽ6Zt/5-YxH"ky/s?͙HeB{bt*+쵢he_lѸ[(b`T7hqXHJc/|U4' lDA,!_cy3>"a/J|q4OO&5.(FsS }5Te:_ $[WQCڈ 6X7k RJCoJlNd$dU?|?U;?%֏Tڰ(<" t]6 9 p2bؔSf;+`߇h& Ϣ1rذ|W˖punUO'eɧ)W_#`u/}MR٣h,y9_hHi}jtЄJ`ffu{Wŷc+KTQ#5.UQ!`ǝCJEfx  ~gLо}j6WWbBq0"a%5Jt}KX֤}>﷐G($Τ79B Cn#D֔qֱRԶIW|~%L}nf$ $xY.&H#=Y݂tAx-@AD?,SZh M.M@OpcĚ 5N9"^ LH ߛq mZkЊ\[YlB%oyoDh:d{?a"?H։*rOYj>bc@s#2b$=dzJ1ͮXV3~(,\d. +N L8:@v|QD$]{һ,telˉP pk@3UgHVH}:m e{:;v8!yӲ`O0hcT, o'$R, uxhN;!$ܥK0I]JakY$'qn:Hb?L0~(|9tB*hQ•ϥmRHЬ$W1b}FKLwDudQ&. Kme74TL]=((7IVXRwLn t@aec:Ȥ~AmHz5[ZQ:}CE3d\$@9kpƽ>s5dF75t9׎2r*7R Og^|6c{&% ˭8癠f5ؕj9d. -a#I"8TD e*>f~s 7.8곫"Bki>J7p`I;~*.}z>".}eB;Rg B+AiOvӳ\t9; 9kFP,HBiȋa;*FQ1ΎZ3$9õoiBW*悅vv ;rj;;-=654KK&05,Cd.tE8זע!3SDp}礇"@6(%?/{{jN˧9Ym7g{.LL }>+9m+!cK$5ȼ;:˻kol'uF-.L.^KJ8`ө0% ܔ\T>g]Y\P|}<8] hyӥPdVkP>6ZN~O Ҏ3}kImá7'"Z1q)Uۻb>3CUu?>uvUuHhI-l_ŧŰ!L,;I75g\y9ĔPF@#Æ G3ޢGoN׼rҜ#M=A^/T;̽*NwE4 `YslAOX<%Q=2dhԐk_Jcv ~,FH^ ʆ0ǧ+()9@1;}E6Hhp]>оH}ih4P1~<X#$Q-fĜc By5H&^ MdfsA|8B7P(Xr09zbfǯR2 -}@˽"Z[ӝ=,6븩ſWVsJʙwL H @6_knICZG(5R>ms[.2c A.@_=w Enn1ey9h׆:I3X򁳧67{x؞O՝6bӼ oX"tLŚϣz0B]C-;0AJ:K0AgA 7o .ϑ3=n.zYF,g:+ԓqh4+ ^3{Lsf'כ'pɎߏ.4A_@Jfqg[0ID[t)C[! 0x82:0k@l/ǛwQ`VjJ,^LZv=2 JK&(w1F2X>,QM A?}F j'n9ҀxvHsLJI_Xl[Q5ʑ"s/8̾'Xm-X_J% ^-Gz]a跆֖3-_3 %Pv ӲaGi ē+31%Kp U ʚ<8sqg;zg2&w?%{WKt\f5"MMR~ 8~E*Qjqtlܺ]9ۍm_zW1,-N9*~&3)@?6t4eSw_ʧC--V6n<)o0K8/;w n =vY#XP*0E\ۉՙFavT[خ|j1bt^D֚wf /~=V,VB0`DI5y9^{'Ď~?-| SO~eVnKJjPQ]f)͈k^VEQˡTsQP:˰f2ŢMKڀA[N&$ uwS-̆DXzwY*.1knyUKM)} !\nJ/n,fL2M ˬܓ:iS=^I<&ϜdICfkv4OG0şqˬvQ0C Ҝ=_`-MοuZ9N!ֺ nWZi7+zj#-Đ--U r%:Rbvi m5DLOJxi.dof>4fJu]|@R`}֍x,u2T> UU'{xCh2U% cG+c׭>v:F,kaьVى_$CŒ>E577D&$?4GqD$MK˞Nb8꣒cI Њiϙ R+ 5~Dnj?^^o8?: HVj-*+[~ծ)6 ]Fi@ݴXdj[ B VelZ~LGQ&b/ 4*_h&˗O[ytxa?EYXφkѺ.`G,TW޲{`lw} O|b2~d#iԕi m+ЧSz{I4bI:T3oEy<#sOscuiEȼ[%j[i(AKSlzfthbJ:OSnm7f]+L\,o1|rtk;B,HL0ZQdAOL]mnXw9orG;FW3C?)Z- `RʊnbIV .kRE{1 W7EȒtGv8x9;eHUdEk#y !6̲ݰ9zjETǮ䃪ְX+Wi(.'sWhfV /o%IU C"#,omaeo|2)zh; (͢dv=,NT \tVL@츭o'у)?^ F{KDB5!@_:Yu)Tk^%)HDbCAA7zz>Tt_OuCo8CT+uWخL0ڕ |8VE;S?s"ZKJCBֶj*1yFlqlȥiY:a{sXd\Ds~1k^b<$ELU!S_6&%$[rס>s$#Ed.b'Z<6_崕maݎ}:#Wnu$zG^Amq &[Bn3{kYp2ӈkSUMՋBp޲Us<3 Jd 7Fƅk-F S`&8qjƁAc,uH3l2aec 齚ƭxr{<5{vCeݣ@«\ =ܴwo͕Y(%Y2^;=1/.f|VI (GK|m`r(H22wgN3ET O ^y跤q~qY&J9 cSvOjayÐv rPqW5ŗb/z$Dzzu"s&t/]fEPqRX(i+7FٹO]$<^љ1|U㟏n&,-ad7 ?:o*WCKU 9{K[jB+C'\upz=4&Q?5l \а6ɽ9cjc/6k ,LӦ0QE_2&o'I al&94u8b53pKY-WF[Gz,<.r!;SΨ!~ QݿvYS]kBxjT[ n^ {=W=v|50(ªj-{ͫH2Y S!T&c0\*}9$$4DVKĬG]}3mKd"У?ޜ$ճ>Vbl{e8Nn !|χ0%;`$4~IPhkPϤkW^'%r q5TtJ&2U:2k%^cNG/MTskz̤&68F.qY4'b>Z.~0JdF9|$$;טdrr"C59hAfAwU5_@pZsYْ0E5"%a%؈ć`ч8;@AT,ǩj RXJ C=|rȯӨ"]&!=KsY4)n޿9%?ǴI*:iu54@7r{tY;&c fd-É2vUsdQPeAN,EK)%/l %t5Ww>4(fC#S$j uR>Eiih gKS3J{#>oȮ0s~%Jl}ٸӝ:0X^N`& JQy2J8?"anpU }ƭgGlj7`--{΍( ]9(>rǡBKEU6J̱,yNdVΤw=l;1JT vZ E?F ->A;̶((q1nCf!u% P n }۽ږy9K")׺_#c @gw` Y1yph=߇ ³Oszw;U$Q9YO'h;dDZ|ٹ*Y/yh+V%atg b)GաFڒ[TȲ,)_X2 [83;Y1hJ}f&{uל $v_(h޲Ӓ5U{*9^FN).3Sqɯo+85Ea@J'@ɽY cAVO&fw;zm:!db^.tTA`(p}_bzg9 cW {$KlױS y_n1^ٟ=mu2`] m =XmS_NjFnPSisMꥹ 60x 9n̘19a(0.GĬǷ.=c;mKnO2}'cr(D4'5>W=9[-UZ}EzvIo_ۥ ҧYn@*:$MG' MvV5G#9 !ߟ8*!9bfԏp H~?1M/OY%:¬7lLTXQ%;l$AoO''O[GF8f3 l#2ж%5pu D~@x*i -ރVӁb׍94Ho '6Wz[?ۏw:G#Z_.'`L;G64,0Be"zm9t[!nh.]Һp?sFj5p!}\9K幫~f{=g݈yCXN(k~澤5N;=o7ahթK$ʸDqg1܇.@]J7thQDЃЁB4DQYQ> Ҋj;)Gr Q w~zq\SֶVD=M;&S*`W[, -ɂҴA՛"dh]R'Rͷrӏ?Q~LIHM^MTi9["~ 敿&DrranAkMbg6H <6nq@$}CIE Tl[w!s^u6'4[_j3b2P#Dwk} ÀҲ%bjs> 9yݎ}S9ERC:cn<|&4\fkCȜ7B_m T޴z Wht3D aE)t;C[u!|͍Nnm ^^^)Fjj8n ^لȹfV]VBOMKl!wvqoJ3ǃ' 81iö]y$-1Xҝx,0* PyKwa#(iqQV [0)+ՃC?XY]^mpz:)Ο8#/0:*Ғ; w;H+ukl9@0{ PM(~LIEEDquRP?\Ibaug⣮=偖V ca V\eaY-,`)2 `&dc Ejv C Z1{Mh9`PX ySCτ{˨nO7u17dT'l&hJtC‡aO9-l>Ϫ bɵ>ωGK\] Fp P5]%Q-5+lF/1؃npx]`qg:^$[0>s',*$\rFr.!+ށ@?Al3ZN 헤|NenZ^/7L?:Sޑ^{w6!?Wx)RO v y A$/.o=:qU8vC1e8+.HkiUf} P|j9 Ο*:,MnXț?| (DOB;-ߓqt000ypfXbΘ̶b/R7UЙLRvC 0pZJe9/aldQF㱧B*T߱XSUG Y.˒nO]ko,YWF46Q:HDi;YpUHpjM(42n(XE IjlQd V)RU#:p$tP5$ߩDRi"rcP9~jΏ>½,ClESXV6&TqZ_ &ԆA ΀CnR2c75PFJ@kYn]jӠU xT!T`1rQG-)^n<4kDO/H  Kl?m`7AReJ C!Aƻpt,bh YH6S~ uzo <3e;V9m<30OsF`'` =p+ݿgPȀ~;O>W=P " $g" {KsEֺE ^L+4 3(^ylpCkw1 yt[hQ@w @Ѐk~KVS|i)hE/-pT㒄URdmb^7{_zs1*w@'5ȖE1ֽ)}3AN#9!_MZ0NlAMSEFZkv10 TeNi")=.fJe|L@nIw2qn?{hMq:NŸ`TahDFX|LVPduw i%9/#Y:; ZM-Q(8n0'8yxIeh>n^o:}c@'wbGsFTJkѢN3kJv2(9%w6ȒDdl[ ǭΚSje'KYޜ*{$o띟s(N K3yTo0u7WJdmR"G7~Fߙ /m}zq]گe ƻ[<.mZ^[,8RJ;m 'ebjWB (jlxAo_FԳV[x+7>u{{ox2l"6 NZrkm=Ws1VUZ[V8Z3rfOz4'ȃ?|~ Á7xjӯw?Msf&.g3H̓:u'?A^ʆysb6sn sݘV۔qv.,XPJf==Pٍ}"WMD'JshFt Fw:G[&EJz5-u㶰wl׶ hZ3le ƅtL:C[ۂ`D&R1US*ơhEJ$2Fr>\ג' W ĭ3âQB1ВĴq!x N8gpw$ q7P8$0ᚪ-}Irhq䶔rPy?*H3̵ύ ѱI2073Z 'fJbVe% ޭ}(߹3]Mc{I#<Hͻ7tBq`вV0[FreǗ9=4z0>D.y[ 2-[gux@ݭIbz{p@v.j%/4Dfdž2RŊlسd,OJ{s1 cx[1_btOK>OC`냋5E߽wvH=.@Sޮ};Fh;z{R F, ńuimz'fU?6GR~lԨ",6+#rY_ Z%lo' jQŢIa$L:WӼ,|}ϟm vY 6гcE(Y,USOim/WK`QEdd"D<>NnSq#PJaMܓ4%'rw?tI񰘴^&V]:L9pYXq -0c#t\r{ tq[}A(;o1yܖۄO:|}t 7.]_ XG6$1pd/࿂|j+=d~s8ҞUc;kчq&p(b޷geOHs^SzGm]MrG7,r&}şǭNI2j=6@+*&=f >;Dӆ{87gIUtͧ[="iG5H] Q_2/TFo#4~#mL_ i?׺} dW Jt L9ӾԤ1JgS'/ / lܚhO迯<T/6T=z#KPI0дBЕ0i%U$S1JQ'r7 ʍ%w;aEDv^@䢲>Vj=?~<#ggޡq2ʤmm3y|y`> NbEAb8#Fr@L$q8y^ؒC<}F@:%4KZ7뿤ƿ#r+]ZeZ+gN5V;k*[P,$<i o`pX*,ye],.aV)>!`%e Jc~Z/J3^ {ʦ%螾zW##ߤbxЭ|gU4=lLt@D1"f8iC 8;w3bÎteѣ]l{]ZJ):i$N.:,.  Gdrs, *:l2ΤV<"c,&.0Ӄ8x ܡ?%ʶΈ| a{_YSTHXy r}5'ͰpxHQEm@oߋ-%&(<O>BrEH]V_?ch)ޘ 0 "_7R߬I@<:RĔ| 7ڢw1ZZV>*p[!aADm9di^C~:l^jqnI,?>Zk>|ļQh|`Z?|XuD5$}|g޹A MҨRU(eؒNJ3&쏆IEzZGFJQ 1/W ^^ FZF"avT(nG4x{}]hۘI Gʄ']1O*+{^Gm^$q DZ4j4{KU| -, f;<9=FXo*=*Uсm؁@Y׸R劮FkEٸk}rtH׽/7KC cHNKl^@;pгCACz.|j?W縨Bh_`[TX,u)ݮG<ڂSl z7eڗTjγ-7w~w[1 LdSq02G'v2Q z"ҁ'^h1i +Q gT?\ȱ#O`V qƃ `WӼ !ޚ1Kְ5!!IM76ǃ/s' ;?Fzg+9]Kpz@^5ܰZ%eZFVJղ%rcÂ0y5dOL[C`AX CM]F%ǥLLl$e/j wlj:@Ro'eҖ%f2i}\xi5̗*y&c}iB{Rw7yíq㿆8zHUˡ3Ǟ wGӎ} OfS]Q`4n a=opDjS GPX3`?b,R<5S-o%=J]{ubH@&5w}t߸N%d]#cN N9f6;y(dgi7Ӌ JZ!PB6=pu*|-N&`@CuL+ h l"A<1Dt@NӼ4埈Y9pi럤Qd\z`FCĐe: "HpE^-(F qusq֟veQg{41H>q'VɶeqwIS7\YC  j WfΑttAe,kyVWf7# ټs@RٌI*S`gmc $HuHlzS1ABWZw\cgxM+LES^#xqh|^yw43n:(}2?JWH\Ղ [,mTD@V)fK&s /pt`p ːU>1rhE9'S|qLՄ6愙b1oGkgs{(+|dF}jcZao!ptx 8MP.%_ɯj].L#Fλ{5ZXؠV*' T0{ }h_ MPP,|0?2$W -ćDV3 >2)?IA5|B~/ e9{a@cI!ŌǺDp(*.XRu M?IZԱmm9x.F>QB]G4G.YxMtam wKrE;ڳ<* 5(9mHp9F-qΘ|ژD}G:׆ꘇTe5m:p>q4,u{=V+qpNbN& U{48 F.[qX=ͯ5$F\LV+# Ho: _N]RwƏYOz)h:-׼g >Of3L@+s61r@,%T]njMyAqYhtSxy %~*~^W=޹96, Xz~ Z/E9-Ճ~]͏`Vq ޟg-if(6=ɥo? CfIg=/2#7&̳sȭ|6j_Xg%c[0sۄa\d'zj|_Ite*2^|^yT})K-S3jxrh/C8eDܩ*J{~٤]q$"M33v5 $<3mvPJ/&; `QсLMIThFE z浦F[jQ>['%B$.œ/+˞Kjs7#]|N9eEmlQ x ⥾{92 ȡLJ"ø}AL byit )K l9JXPr_c"s6h=l1UT؊ozV}~k雭4*ˇ>v`myߧ޴5ֽ_;6"v`A bܾx,@_|~ s<tDH{B:ϳ& [SKNX-ᦱf ݧm|ezf$jCtͭ-.a,$ϯx!KkH9̚On.;Pu.I86HW0<X>̍[| aShBgAFJ^emTZ>;l:kXl"Ն30wYDU}U1E?J 8"8\ɓlÐAdT(Vv{{u?֜bzp)`f5f#wVXH/7nTRNrjW|lz ux9g- I(ߗI+ija?vSE]i#8+֯ORȂShtJxlś : /%7Dܲ2?OKPBL { ۼv׽vBF~mPml͏.?^U &w&^;!' Kga5VKڏ#Z)FtL$xZh#^vko9_eOdo=NI=_sfΏE*qw,0DnF ['~D2pjbݚ5[\ (`c^R X>}dVRBENE#je;F+vTsֹQC8A͘0wM`G#/39ƸYjTx,|8.E~;^v;#<@,vJ-ҿb H2TVvP8ܟp 0>S~d̆0QWjȖM=zSGFD)-qT+4"3O DܨD6Jx94j:̪c$+Q\t: >fh%,c.F\Tދ,O-`ؾ{Q]0>徾 ;x%lBxեnby!K'Pqu֤@/xg/x*hZ8hאB}p 0N~y(p̶ \l 1{"ŎYMX%iAhF-{1U8G~f;ettX?  :EzJ 7 N 3T(HSVs 9|tG-ͥSwuS7b%L6@LRtYKzƦ%(p5(,)F\HW8kuQ"=n+J$cmav I6!:h_y~ļ(ޕA}3^fަ+4<DmeAU٬0JCg.2!49⢛i]Zh6Ԭ]؈N2VXTC/5sFaذj^mE/K_)g$d弰rgoCΠNT"ptOÓ<&>P7#[<|w/m|\-g tSV@h!f@1,f)s.IT(ǧ^.VL>6fz q,F5O|OC_ P=Һ(CbwcN|vmGJNuj * IG41;4x@q1*af颵Na6RY"PE> +Htb<; ŧp^קrt"B35Nvvrj#_,Z'F6PJ/X!ϖ orf`xd1D?O1;#ƓpKDȥG_Ix]õL#?Bna Kj1dL23;E!wҪ9񢫧rO T1AңX@Rgܐ>aRAˍ[&v?U%?-e ey%Lvey>E-9?~ }ě8O~}LtS_l)eKڹ[w" VZf,X_m@/;@s MVT^ZwE]EBpriN_m!>hos eLrVg@Q]Zo# Y?Š3'8}p=vc";] M32@J(θgאnRI_`Ğ9= umt3a5%' ]q/ \ ϯ;NB @!1!b7ˌ.f:0œ57qMK%އ69 I~! ˤ{ZbIʯIki]y|L NJPhw7>gi}`&`;`D߃tǂF[u&v[T3i'h 8eѠiSq/I4Q!ϳZPWQN2TbLRB2ZiL/+h!fOͶ˫J"Zv G9)\9f })R.SuUwq z?\Beo%sXӥdo;Բm#{ӻ[FuQKy8M 5S:6VK> k c՘C8bh9.Cܙ^xwz.OAhR9<>KQ>?Of,_)֫ў}GsPaC y"pceYux=v%} `S1C;Ｋ:͕+80QA^Dܿ;rB ;nC~` *u["7?'[#Szb\f6{r^>@b]p]~vOSDF Qhg_>x(Q(3h^-جSߎ]mptT0iE m.8S>bTԼ_7v= lGΝq+02X40ygׁ|hJ OEBgƢymGMJh:{x|yҟ B*a _Q/baHUUds|$7DXBe#6 >dڸ ixZ'9M/sX@++䨗d\ƻ"􂵈?Qً#\qg<|u  9PbV&[ ?6C>5p!FddO:ۓDG9aЃ\(NQ¡Z<8!aW78-4%B)B)28dM+tgmDQh+Gy5`+aTDJ4넨uʂsyRQQr6wݙ8^U`sR*q5acZ_B.`?&T7e#U0r7XvV+Ï'I_ݯG8R{fGg>Uٰ=zS/ֺ4C+ohp8)_~I4SF穸us+|qê6ݻX`Z^WN.򘕏R[>(;^:"*myrؘ63ϖ?Su4ۖ;s [CeM2mf#iWUz506p7\uMwɣ:5jfuDWmKk&(eZ`&'5"&vzYߒ0~!$=L{_٫2n:qH)>暈vԝ"mTX{t5}SxR"g590"QPۘǖT/ǥO$fRP׺-ES4YzJcfXzn;.ܵN$Gs)"ȭ8n#b3GYD<;mnM産l/e~$ s}\yD& ;M"tGC7_eT_ nC}Aozב!QFC6ӂ@3 {)bN9@qA`m` k~+ht#v p rU/}ȴ ,<{\7+H4<ev~JTR)X^byF`<\+]ޅua;)?5|r`%YdR˥seOۦQ Gk'2QMyx U=^09"z ]t<JH4u2|H!xvȬQ<ঢtS)UuVp$(rc3=`H!^?.I\hyy 6Ə/AV9i:/*#fd? 8TF{`]LOU|)$4_m[}}d- 1Tuũˁ$uypY׆a οB_P8< wx~yLءnۨ,^/{{k|NYpv>[5vƒԚ!41\Zf2:TG9Q@ bଡ଼%TkUe$w$;}}&>lm 0Sm-n.qc}#֟i[:H {uU:#NF~x;Q2yEOǸyت603&iϏ]i ,_&15;XVdpC>5È& @8ȳn*';K^b>r 7d2rf_>CڅvЈjT(`ah1>ZJ& :-J.:dpE8gN,PK.#_T/ۍ.dUtUkK=+`\AOmsxcڦ|X'n5xź0tQ7 Rvi\r|=ުݼO8tljCO%BK^sY>KDݞ#ݤ S B}{=O'X%@I.ceVT7FBPȺy6Ĝ87j%ܛ9($oՈm>r/s T]=g 3ժźbDy^ӂ&Ͽ+ћforqny~ Y<xRƴ7Frq k;"4 ,8m#_oר}2Td8KW >97~1nPbB,aTgدEII\%Fͣ Z1~ ؊CRbj_b[/^A\BU]~2R{5Jڟ͢+eoxl "_dT1N,"{}9JFv_qC;qX Gkz&c5+[h#i g)<'M11X:\`,٤%ssR`IJ8貗Fn\c4*)4eE^kƣ%aSUʦ*±JVׯ{` h'04ɩ)HhW)8;G?2ìu=@"+Jg˩|KV>U(e=_pŜ͑׼NdgiWNx“( +bȐUd)l] HTAՁ E i):ڋtQ}#&s<,\ROSC48 LaLGfS; l Go|_75 "=KZʑ|gW`Ԩ[6wvKylE RQ#F6QΗص 7ɳ}B5s>.<8V_cۙ -T@*)QդjG=lɜ 5}4pB Eq]dr> 2NXrBK@ۣ*[ BLé䞂Ā䋲iKD媕6A_-r;±';w`՜qYul@3ЪS!'8`R$7ÊPIB妮0gb#ҕ!uow HGOI'>qdW\-CṰIs;7X)lԫ]+j;/[' > 1waB[AT4g;)m^qas5rDA(%ŕMv&K,_uHTsP +epg)Re5?=YyوpQY _sPNX\S XbCR{džQ=䣅(>]ơ.W@BʰJv,hLҹ,ߎmtsAK7d)\W|u(X+~Z7£?MȐOA&)o3R XS]7uWÙ̢S* j"=P]_GSrm7v9~<@ ='£c=l7&/Y7ʤܾ-Lz*V5ӭq<4k>2ƹIJ,lh~=I#.Bk\Uvgש?%ŇmH}vd,:-~`T'δJEl\Pdop5B7)έr󱳒ݲ r-ml5gO,d^g8CZM6m $OT6! ("fsx0gD8,J;CcgCFm2/KƤ{.P)qlцZXq#IcP7~Q) {]7zEӛ|bs _߯\>2qBdY$G &je]X!pZt82ev"QG>z"CI~n˭ l'x,gއq=kHVE b HE\Rnٸ݇k\K(ˎc8H&pz2-$E1}2 ږƪd' n ]ca ( >y!4dzA0,w⏁x d@<\[.<ږ18}s&V~Q W..W,CX-YIuU&B@EmvC\5nY*q%ϧv.? x1U6Lp:?1@q(9D}]&.m1b"<G[ z<%0Bhݽm 0կogJ b/";[ E17GBi 82I=,hJK3(8G_VT&X`x WLƻ*ފ qcsqw`ۮr'XShԸK>Jbԣ°^O//ٟ"6]䷺kLʶi`q-}LUӄ#(0B];‚{lC$P>wp>D5f{{Jvy9ӍDZ8Hu6^X~7?}H_yKK^K Je4 @N& [.v$wcrdKt@..ڿsZ6zkUR.qf˓) i4^7%C.#=#Z쮗ŭ,m U!lM9ll*6{VPfM=>,՞#u#lJk{, _r-ͺA|Ď>8:n gAҹ}!1PuEtP^xѼ- u+LjK?v??vjx 3}PőtYi&4х%pM.90+}IblZI =C;D]ȺV9f-u" 3mGwV:hD'kUDA_a$ 1}&wޡ3` E†N.JsuQ NPYQNJ`˜^U់%(2#P9F" ܔvGst 70aN|'4}V{( Inbsx[Qa))rB^rV ؖrOa{P;{=ͻtΌjjd$DkLPmؚF}14ʽD Ќ͕&RF`t J`H'wd,@͡h`Bigm+BLMAUiB֟Rl^jƬB.x0*E5 O. BETVaպ-G*)g^nwk@dq.cc %ApԜ(,.*՜|(d܁F 6 H_)J-8]Gzuve,c)]1"bgxB1# 25s=!Ly7$]<ׅlOF# l%V0 -Ck%'ڮ}j?"@4kY1SwP8QFYP9m*+2x5:S!0fY_yA~F9W \;|H=RKϝ,_z)z9rLox^S^zRbcTe̲g43ݺx㘴Π9mxd0E%^צU/" JY%l {* ބ[Ѳ8 f6nxLuծ1{0F=-;S7wSjvZ;gTzpTirl\YYv=z}jo ܠp|2) <]6[8ػo"*EgK԰lNtEqGu`=RƤYJcΨ&oĂ S{շ-Q-xLgpTn6(^lچ6/ÑbDF=΂F0v4͜ΠJBd-#nz_Fp`GM_3SZ&H[Y5_EppkId"~-OFgxOgEy)g1a6׹!W|TBƩ3,`к/YSCX@9Z2D Ŀqŕ@/O4/Wx*FS3cK+gFdJbB& $¸qwI.PQQ8j/DD1G)g=SCq;n^>Lx`5J2pg1< kЌI.OĻ:#ta`.vapX h3B4%Ed8%CqA@ꐐ'`6Q }ǹ}Lz\.fZ0HFѫKE:ZpХ;u¼h!צfLkROcқQmd[8~⦜FF!Şjv\k|~b}8I U_g]=<7 ^yAH1~ןLsLL0IW[|93\2Rf}㶞 Q4FIe9PS/2aXnޔZ=!aJqb5V9<ze^u`n-Pu͒4\q Cf6C(RN ݣb $碞? ֕Nx;2ꉞuqUt3qL=tj2  #]M^3'K,΢^T׃$Vi~=xZ}jS~1('\HΟT*"{Ae$lHFtmKS'%/.-jCcQz^W9{vѠ{TMM,IUȞOq<٢r`pgO3IdXlk~" SCI+Ldo0ݛ(xr!n@JMe6ص%gJJ":[6Y?U\[P1]a "çOQ*8 /D@^+C{a̘=ð]<W~{c*5Luq_S ,_ vڨu:4y6t}')3 ٕM+σH]?&3Tl, ÖI*.w auK+?9 &PPy[V[YLx+"x[1˛J5[P^/!47K.K +EC'cŦK\rwfH):Dq pW=yGEm%] (*g?m=@5,)vΡSk{0-8Fj?QbAƬ\,xt@gc;IAؔ0g8##Qte48㱞5 (w`?rV^xҌ>A[ŀ4>@•*ʦ`| .kJ1bcƜj6D$R h]t RoH`uoCf:59WP)N"[D )&ںm:w_JCbk9i·ѓFJ:!& йpK. &I*wbNYl<qG^S]I '" i3|y<`+B7r%-Ia`%: {a hk dHIcEYiΓb`e5H iҜ 4oiUyijf.4.nf Q(l; sSJ?[mTYD=T3t@˭.}Y*1*xGTV2!PGĎ`0Su/m o?97ߙkWs->/Hy#0%,:"cP=;^ 7d$MD2[oi;?ǐ-5î˧IG~7|AN ZpuO+i-|Y۷\W('MZ/w]0XҦm- fhaI:evRXSpIt!iZ ;:l#ޔA9 n8/H$()Ւ6.$ݯfB+pi7Dk羝8gS<쮾Y |,iUFI | [g[o~nZ\3Mh/r;/U4ބnSn|JZU!-1k4TYK~5"4+fj'M.V"O)T(cTXPd (K!c%Nė>j;g_6m>/{A%YpT;ݡe S"gRN\-WSj?w-Io4NJ =Fr&6`E͊?ZqBd3i&I2@=ҟ#Es֗kSD xW^ChZ:UO q *-gl4Gy+4tѰ)_8rLDzep˩!K.N=fA᎗eKauT*e   "qy)5&tzKRs=ش< Ām# ;SD ]3MeN,9g#"N^x9_$RO)o!!]8,8)eǼNa'[=˭6޲]MRm,3)oQdcaXTL>z ר>n'[භkdkf4H}wd RARη tŔ7Th@);.-]`ZHT*QZwmz#xמE *c S'?x;`r]M~L0(zH7LD&?%tnQ'dvZHq#἖ޘl$Q.p2"5}!fqE<;l>V S_J73 "q-# ܠg9e?J2 K=k?bӬ>ƽ2Zw"l Τ~uk2=>.>QvIPcf &An>P};:A0WyfSD_RV!`NJLIW_(@M`E1ɧxA̔,0MU k"ǩ>14?eNKػB'O%yt/p"ҫJ`箁ߏaP4p6~0Gjc'nuEIҀ/Y?v,Ya6*!`0.;eXf&[݆~/\v:_^`x|CqD{Րn AWiI4;?^G𥰺 =I'O9gZɳr٧E8Tfj§ht/m wJ#3\85bĥ&i|C\Sɼ1Wt\M" $E'a`\ڸe Gh`maO}@6J~ 4eceKiEMº9QT PYea-pbˠm13_gy߭<4ۆ `h1bSSjfM[(M!5ZjS&jIV(ߓc2D}m: `{_K j|7ŜzuLr?6ֹdWjD>ƿ8xf1J*Ӳ pZvq'BQ13&~-( tCd&2G/m&dʓI!zcF5ח 4+t|^EL9.+7 aNSTlaPtYM:q6&q1 Nq#GjIyŠkg|0#e 1ݍ;-˜F7Zd*?FeS0n}ǸQZW>_QvH39j H%IqN6@-Dn\$Dw,-UJAGS`$ovb`~څ':#l=ɡF]gŊ;7r)OEU -*H̗M۱KpAb^%=`HGwvx-Xm2)Z{ UI*lNg(\('xܰqcf#n@$чL)48'P`viD^x;mb`88FHv^~97Cٲ2q+mەN?XN9ΊB} ="t&;[d,o)7i}qU~ __k_ݛ@y#6PgzpT.m{`M.vAH$f!Hz{%7g,yrDWjvapŵ@%O E;:K[^S!e=glyZY4 !Y4U)sB:'c;9QIN]kKNV%I!D.8bE B  (1x/;i! e[ #2KjϞ)Hp{ce\OpdzoG0С(v /j:۪+w8HmhGc8؁ ҡ&5\)͵R$R&!e9?j=fm~r~u&I'nfN"Ose`Ronn= mO$yT#r(m^=(-s|*R9dJD 'ćH5V63SC{ON(.T 3TjY,3W)e{~Yf«*ˌ YN?jإ?U lZ˛$O#qRAz#>ͱak)F1Xm}([Zn 5!ց#%Ej+WV} oPp9jiYamRF$n卂QOk[B e›Tӟn>kk5X\)[}A31ʟ>| _"5w(_Ӗrr`KN"ߡn ̖E|Բݣ3G&}eB.+`_WzKFuCR}7Ƹv Ȑ1;vhsAYw 6N5 S@^^S.=EwjuHmhze;ػ8 onN^x]qܞJEp7bWMl' ?ƒ~,5{W:Ƭ?z:$~};itMgd*BO`wmZjf P׉`fg2B=|9=\wVHAo ^ۻ=i#L=~2(5)"-2e*n]ʅC$< OE.S-r L\c&-o<7EjR?w2 p`.'EL@0UPl|>Ϋn3W:HHTN90bXAjǝfꚐLL?LoH"e,oVYپnDfO6_gk9ÌzbF$s[V Šԍܔ KL:ȗ}B߹}8v5TX$)/CLgIDYB Y۵u;S{#}e'!Ha8fuZ B`=b >ʗ$cM Ռlŵ9W4M䦢 65o.uXU|mبuGH aM0dao5->B'l*"*MlλDnԀ 'NڳU¼:QU5f<.)GeX}G3ӏM$o«[(͙9x0GZfރ^oGxz;)Hר&zER9. cD$.G۴D3dd|;H|}*_`TڼN"b}K*i )# ι)L# 7Y]G =өᶣfAjZGOF fISܩaw6e-`*M>qcl5{۩۹aAJSn hhFBV%V_ bѻGrGaL1 )>+)=EXVAմR1'E1hDG`J"pJKFloO86 E}]d|jx`+ ARwKr/ WOݧtGA CkvF?@-3 ?p 5$^U}]Fi4 OrQ!'_ӝ|hH_i_3m(DVJVFlr^/ )oo^&xeq><4~wG_"/T2ukkՄ)pC4r,jZt޺-8jz58w@؉@0KaR+2d:̏y2ug~q[rEdvD7NNS}H*Ѷ(WUUs3ʎڅNq>|f&'c\.ؽ|@ucCnDARa.9<{[ 痷Fq=L= l:G 3+ hLG=_O*1zPFT UΞfɦu=+,Hb%VpmWahBA;A5uWC?h0аn RwǏ{n̏q0qoz_ caJ]Ckh1T)޼j'k u.+;y4gE!&r? 29UNIBUgcYV=O\Z#,@V`whFlID#3Ђ:lAyNDeX ~HXRՀjlة99fKh,oƂ$T|k(Q굕9duTTV̯!in-=zIB5[%m Sx95Fw;mOcވo :sj\[3"`ӿνv[,_86F2Y!Lmq8xΔgd&w},)sP|ggOL {F: bB[9l&JM5Xb7y@12tvطu(f!~ˢhN Zid}aGc(lFO YeӠT(|3nGiMF.gHpS/ [-8VbvhS&KfዐT '2Msbɋh ijriK d(y $G>{Ck9Tf%I{)j KAv A< w-w4P)v A.E=""cpNמ@;W( _bj몝\BQ̰5y$8r%SFV&~qESBۧ ѠŘMX=}N's4hӅcQu`f'퇳Ėu5]s("_񡁦7s{ gg2ⷻqFqt{A*$ڈjm~ּtFzu*]o`cOVp 0!IrZ*F\ B 3VHhStM 5A\;fSegFBawʭt`MvN?bYQ LY6H.u= {ߤnf@aBQ7#)͑UN 6*;q8$}:$ ua R1.}LΗ]6ho#F%\UChj.nZB[ EB(lyD1}aZ"E>;O/ݦC,>ۖňvK~\z'7,I1#(4Ml Zm>௫'Ar}c>80u;A ?KjAF'R šk+~V&z5C00ndaTxLm00'\pi+9F5,Lſچ!}d?" nqe}YƣZ2m&:\͖T? Y!ڍ[7v963"`fJ,qyq~Lߟc *>w ެO4e0 [D%Ld<7B\LS(lb:tF,FS*Sk˜0wԭR,2CHŵXsm;EdMiDYz+kÌ~E,A3f0Ŝ.62YM'p\05nj7`N  v1R.֩H5lJ,q7 >jo G`ëwh+}4bjE7ɉmڴ*mFIQ/\H ];k{? ,͞hя:swnoϟsTzQ|8.8HP춺>nYS$2}yiK:2z;')8̣|/(7&,-Q11,e8.͙K}G^L]}4WjS%1|8.pO3Rny[SJEZ  'Jh, ׬%4[@0o~AŇHxMvK,.r3R.v1TO|j v }[4s kUI ?6a\t +A'%0nvYۛ7uq΍'db :m+JXdt$}sj<>cY]?|Ѳ򛄼w%KG!X%c|2G}'^7pz9xI{=r:OvV0HOqFl<_<\ImYU WӉ `>X~a,ffn0Lcw?[b FۛraFrX%dst%roõ>t O1ɜo:]4zܴ @.!,5J)W"CoMajB9,mia'ʨxTeh vƩ3icT+q顖vGϤ[VPǙ%1|\tϓl ]Mrx_\ =ֆ=m)Pq17tR9bGv= 7,ʞW+ 1E?NM s. ݓ6k]Ҟ *y:Sm=}!fCLkRq{nn/z[DIz6yfۖAz4 kޭb+͡p3 rg,f}Fa hYсb.=*mB9?50hpÞVY$7[7")?4G4+muV@FR-S1ȋ(qi54 %byF$rICo+dҋȗZ A_/+?/'!t2'kV B,& `aO4sO~P̉}\u&DZA  c\c%E7G?fTӭOyo:v_!{\UkNRq/wqÐ7 2(1g:k_9ݼyfs B98U ^VF =y>Otb4 ~repNj~bYjZUwz#nf+0+rb9HEfF Xo5yA+՟^,p^CnQm)Wq0 9o.`_ȻKෝL|յ<-ZY-mҕ2ٜɪgrO ̐gNN0踪'䓆N::Bqr蹧tP(%[zڌK<ld'EdpS (&tDRE]B 3́wBҷ;܍,9Z*4y#jIyKcsCy3ʨSn_~?Ge3ͽ:Z5mBP2(AtEHGe!ހu Vc-]JթhW2!z:qr?=47Y#b)x'uqq;& ,K/7 OD?*n;=%x\I-_Ɂ4J˽ߓX>2앇@ȉIYsc+0B>Lf90qyE?+Rl'8$ dIi!T"Gk얏Y{hB?xW/co3ڠgS fXTL6"{K)x s]E[MK"qȻ Im'V B EzZeT7:pӆT,Вˏ+@ E`!FLV܃]PjT#/޴䵇' 1nb4<s[;i1G@0Pكގ;].O@z ck! b(eE~Nh}hSg%SAuHg3bJSG&%N8͟0!7yкWgU95K||=?5ài[+-,K-5G}Y(= y/cߦoՓDj7hJ''%"| [P%MZ niƅ#Uf k/u41`I(ۢCe/|Y^I Zo?*(klvD0CxYW慅<OfčRy%KsG_^j^ՆH7)uvMX"6xCF 1.u1֖( N\N,9)j\&PNѷ]0x ?/Te(&'`ԫ !#*;A ԡ1;?k1L9;d ƒjiN).}K?锼$?Ex>h۔ !Ҿ^zڼL ~VX7PSP_b.ro)qv=w*ϙ< z|cZa>d5`-͖ "A5ȌG.o@QZic 984}|U{4 41dd~ ؜}IdHk8!f9ՁV_#5;miVdKB*Zd)Ȼ'um% B6ɘ4@[.5RK=a I4J:$`[p0m/I@^$0u^bUZR_ԵG;4Kqs&wL"*P{.A#}hdFe!z̏xqDj6q(B hav6qh5xD`;uI: P񜥖ɰ7V/Xʜ14U08s{Yla^FxG ؞9RF'vy1k`"'%9IV/[e(梹e.n"wp \0^ΞC܊]82R 10Z6I$}6vN$t")vFx J^ {LbW245N:p 7`b~@n:Vt<<~~5.O܁Ӓy++t-4ISC>+j7=MiAK z'$uf`mȕMgќM)Kp;&Im?GF|yCQrF#cuO)QdPi$76J֤{݉u1g(+Ij)<_,3f-ӑz6D+s 9;:҉n"㰈%5QeTq:BsolZzRt$az ]x$$P9KZ~!9oR`ěa((}JonF+MӔy{ Ung񟝋 FJ,5E)-y ˕RH~$Q!ӊcOC$?J%) w}ӫBF7]'Mj$$&;h b nS7G+UF7+ K 6n9+kEtM.WP_pA+LeuGW{h]R\w@iz -ƧiX/+/޶U&vy$_(ՔkoAx6wr#~*ЏndUE|C./.; ˺{S:|υ$D{N'7uNl+F%*`0!? !)aWD3nt ([',F)`'bj.*[@w3 "lj"z]]=Al'pz B+n{ Rr RSkP5~H(zT/mDxY̌}SɗŦKQa ywF1Bt@DN6Pۚ/;I}߹YEwSoen1[?)=.^Yvpv'i,R`~w(M#А*G}}h|4|^lz9QDVQ1WoIJJ͘vhXIƆ4Qo %)^iisiOٜ %tZ . )pMG;\i4N" HxT#`!.ZCͯhnaK&$/0gRi0CuįTOY^kpQ ,!? V7DS`ͦz ^Y%/ۆ:_g/TOrPVM:kGz8 ,3-jYpeo3=BL'Ϗ#晉ufm5ad7`iI0- [,_QΨƒ }vT3%)n.~F)z (&~V4ЬKHI7`ُ9Wi mG5?aN|ԝr/ab,׃aIK0?pxOF%B`fXb֏E 4M {뎛 ۲E]yO2)3,6^^n:>U-j+!JA3 oao^ħ/o  _t !vp+z6K[kظHrlP͈#1NZ L-N:X-樂`WoKM|ǃ2ػgtLxI[AH$@2d| C!Tyc%N]:<.Z9L دs 0`|@1O;=sѺACԽ?\ MzZA vEG$7 <4 F9`Oh"+8|Gyk3?V¹ArRu@ee9'"P &qxAs/?ı |gv :YB3mtonPD /TX!VѯTP{$IL*mCl5^M :h@/x2$ɱԙ־43yC;=W{5o4s_T[B a^Ām.nF`D~q$S󝒬˶1DJٵq(]SZ9Pl^a[n17.^6V%.7&ãC3|MG:i7#tIHE|Zwt2P45~_dlDP͌KoT*10?J azjZa5A G\?Jԋˆ8`ЯbFG iedybßKO.>/2 8rnEHn Z*~a;Ãy3J$d9O1}ζLwk涿cC\ĕcWdPQV)+ a>by\nWJ'g!~8)&omrNn&>Zv_"&i3¯s+M#)Pļe*]PM"E[8#E;xGou#8t{ׯRǜ9PKcMFu]! Ȟ4&c- ٲc-7p=9(p,JSg R=:'?3B[9?&xMz>keu *2^֌`[ތ`+r4BVa}^j"ҼOeG5d>Pyd`[zw %g?@ߺ"ͥ-CjLA;fC4# Q=ƨ)5%*foR<-P#(7 ÜCJHb\K!P7&=1y|Avܛ}L<æw0;?0z(2bR" 6Zob3KS|0Djd7 Wj]=7dPC^`Jb$9^h$bA9JKlXU7Hbk7&ヒozRī Ün dK'$xpgï~x3*pMG(EиwΔ,gňwMS +'FE#h|S?Gx.fū\bNF:pZQw^8$dBSBwzd]gUMe9ro+SƉ]I2e<$#oqYP%;H0ӿ>$u]լTn= :30$Bv xeZu+,sIbWNp+^kFDzNߟp(-NnBQx(M( QW@{LtK+};rMykҹ- 9@/-J5rܣ]?kz2)rP>V\YszI]3:I&щ7r5O/IrR#,b;<1n}٭mmC0Ty>E\8)!VFoà:X+zKU[K)Kx9Bݰo!c/'166wznƂDZ/C۽Gpzw:dۦyʨLiSqJt8dGt&gY1VT3-c}\wC>D{hB*MA YX[ "%;K"ASl3nvӃHCZD 6Z,֬fVb̒tY1ddҕ|"5h4X93G+B*9cbyrb;w-4'Rݣ!H9 Ќ4Lf` sl Z~ÑuNKPWx,c?e`IT{'D3=ˢkd}{_ͧUܱz) $wG&CHG|XSzeMړfC5=P 7.c/ $^Ocr =:#֢gx?@s 53y[mn~w"[xGLcÝN=K3( j@e {U+߰&d\Y_E }2RRNrЗ%~(Sm7~,%rD{Q`RUUl36DJQE xU(mzUYWCbExa\Y uZ/_ W;>}0zM z煌mR~2!r% n6XCH,Y2wa؁`4_䷾wN\3*t5zk Z ő 2ӮB j>~!Iۆ^k˫368] uNp͝ !DEw?5 uKᕢoOg sPM]Ahy}@U*A6|M p_&²dCv*#y]{xISZ+&]oymysO'0M0͔ȗ?Fv0Ovi_6,=Ѻr:Zx\޴+p%> ^]bd @c'؁̞&7,fx+p-h(;6'~qwGbW)tа`JeQUUc6I6.>_f,u,pIzL6s'y7Z¶tٓ,V0N?|$czkړ?fO4R5Z2 qZ1EE |(fPRJD\̈iעE uS٪Z=Ds͛U/jo)̀K+(NQ'WQt%aK︸-R0D5L+JFY|fq\T,Mo\3/aBD ojk[0u:mfI)D~Ld[iޅ}r[5HWkt`}S/9nS є ;i5j:m&t]/4~-bڌk*._VW:"Pv)Fg,xQMICoK}xpGZ?ϒq\d2>Hgv Fp:x݋!jyոG97}Pza"7>!x@mnpXV M=:5Z{jߚ㜌UG`4?N҉ 2] 5]%R^F5 OןUCK䨞wܠAGaO .:xL 9ȧЗXb*n75'yA(bɪYw~%o ބWmf:NE4m'nTSD ~ }}5)d YQ hxqy<7 __5KKLEWD:5QeADOĖx͌~U$+wjɟ1n,GySO@ h9C/A| oAGP9ja\>'nV&qݞ] i ,y&^x0>L/#mǔ掍,#G˒\piY!#U*oF3pjQ硭 ölcxvF?7e~ x"v|c-'A{B5Hќ፞! 9uTE|#Gy65,|c̠eX+ZgD#-(ηh0~(݉e6(#ǒ{ zM/[pmOpRXqyVZklܛjVxe:j$Y__i/05AHQF`UpAPwI:A㦛Q18z >OO-y׀t#gdZ `MN[7-tC2_a&3s9haڅh tsLugL"$219ΓGWZPsfh3|4tڂuXh…_2yNX+G:IgsX5v{L93Pޅsj!!6=n[v] )1iyY[{?QE>YdN?du:&U? QJ'l=3TY{Б~J *IqvpM8.„ɮ0ܐC?}z 6J6(ciY #8VQwABPuFEUOl#Ǻ.\ eXǯMp ,Iky2>2KK!;73J;wz}b.o/y`ٍa6##"& k÷2Њ 81Ņ1:r֝դ7qSZFbV1 -ʭX5נ%W+⤪@v `xGvèN5s FKg8˼? -¼5 {sQFZ3H c'~fqg琌_6"F07mQ7yYv{\k~5B..[| `LTR]'2Kfqq;-GPTQyצg"q4Fk#.q ]V6pj)Ifͷ L!$pznoۡb-c\ĥ:^L?]mEdl>#w@B*Q@e-Y%;UUjoC Jzh(trL(s b7@1f僵>7dL~H'=JhF9Bm!)jZk .n?^:%25< a:E ]h(ZRpz)z&Ȅ$R(<݁.jL2Ah f|;2rͽlj!vA/ga>b}06$e9ўflZwC9Vz.2 PѐJ˗bqCj*LAV.>҃fܯ}/E & mg.gE|t1 F`ۅLPY.QP5#1TB.-j0Eɪ}shHaGBf΅PA9X0'DP KЀGoNt6)Ƨ)]ӳC AZaNԨ"O--8AMT1d.)'fP5Tę>@Ո~2Jڔ db֝[޶#Ԝ`Ȉw H/Re(3z2VYos'dJtY؅޿7.5'[]N댌ofVBOe9e ;k^=hV? A|ԃ]3/UdCEL9qT( * B;Dbꇤ-R@lACtc6!) ;4vY"BtwiMgmT7K70X9l^Ǣ5-$'OX wף%;E;lvi,%t 7J͕_H:^(\gUYw_LH[9̨[}ZS֌+G5Ew%OkqG"Q>W֩DުۆD'HywG#ՖlwgJg) C uvwafNKwfwg HImqƕQH~IrZҔ)jk vo>̧}Sdٟ(zN1aܒSuU|( X .F=61 i [`){|zyW%1"5A熐!Zlj퉝t(Wo |o̥P xe(T#\$:xJJHϊ^ 4YCՍ 's6wV |Üշ$Cs-<#l_GfN!<U뤬VL1:['FąN ˋ1eVqR@v P[& 6-X(AtsU"hCpQ@]jq ȫbX̙`%^ۧE튲/8ȝP0M׻ ,DE}iHoU7Qonoye$춈]8ߙ,VqpNtfA>,\`9nV!]=2 ^W0ŧVGuX%)j' א|828:G2Bŝqm@~c0-!B3ˬjs 3E=s$uT<E~OǼ.7Q*u^u'2džfy}bL,4 a۲ Xj499t'D_BM^wu'}Yt+7y7P_z ;ۙG njǀWrBraaKM=YjZ_3B#7Se cş9q5lt-u+ ْlz 4X#ִ)&%dBuD)df; =q~-ҥfވ!6e$nͰ}oX#=\u2gxƒõLJZ#C՞,a{u8[cj7?C~.Ev‹ MW [W|0;Э?b}#gL6 p} 8+QIrt=כ|H*u&r"wqZ5Ғ]12T7MQn -EbZ^4 8ܴzj5#PW=>&ܘRBX0rPFG?hhok.!dyEUοMmrW!3ߥ=xRP|;g ԉEOXD gg_*s7VCqT0HzD._1.9PՌ85JpDu3eԥ;[EL FgI"Ϸp~zGm88m ;i7yz@jjXIgK8+q"˘o%.{<^ U@^p^ w-L5œ'~9e^EmK\%\c -#eS r>!ECK؂zZ<꥾]ZQw dySʼn3Fvd.A޼G(MӳRTѶA=5l}PC%> WW8#b%5F?]ĭC@y7h~G_Tu7 ֕Cj:_D1'6F$du5S݄2g짜ȏF͗O\y6;]- ovkm h+WƓ\ B_yB "1~Q 6^ 5}{KޑlfKҽ \8G`te5!4_LJbFIi!.:;vNb̠;Y:Ah/sSK"d&NI{Kv#nMyIp\t!//5-g](?C<Kd%zB2ji );0[xnFfdF=e( "Hk b^㿡:#R^A ?\ xQ/XМ$<ʻQWa;v+>#1> ĀsFhӞeŚ!1Nճ@L^5:IJvs70j{`TD{1jm) ė^2:bݳ_"-.Փ 5Gd,3 MlAqtBg  }oʊq ~W+ae[d.(EG=WZ]}mWUZ9gA,9=U)Lwz*2W겲n㻆2BR1}Y=4fU̼dME/-'R*BNA]֖ 0M$Y@}7YZ`㻅WEa=AN]FI}@cyU4_rBe4AG8Gom;Bs o{ bI0zOgDz# 7/]ǯ T! 3=5=x^PeHDGVjwIsJsW{tzJ^D[y;…ɫ3#T&`@n<܎#ｿk80#YH(>fUK[ƟLމ>kDޱ)fJ i\v#5ᡔ.UUѵ`Tvo;a:voÀˍ}4Y-90zĮ/؉@OrʌmnDN|"Q0KCj©В`!kW4.; |LHLbnLF?Fu[G8dhpP2q)?Yae67a«II"Gv>۞NA67Ðm;|/` {e!]^5d\SvkWEUbB6) &P.ˑj*6a·GT T@q,ƾ P']kïa?=W2ԗ1~]d\qil2sQ_)9llJ°z|&%"ݟ<{^Zޝ#-,:A/f#[~fCUg*q$ ̀͡F5ok4Vyw!+xS%JBQI41L?a C}tkʪcD0+ԊYcT{;i(uCmGe@@npեoMnȬL׫[%'hˁshuٔp0m~r6 v"8Rrw*x_̇y7bbΌlG#s JfztN'66cߓ/6Nϵ$,31u) GZtggbT%MV>vWu0oTL 6Uc <h]򰳕ߚ%xrpi=5}@hLz٩+mD^dS=h&2QoY^Nu1p%nV ?VS4i)lxihbtS lA՚{@z2jBHWM?3׋X6Y$JdXA6ѩ(A}iԴv_3H&X@L)#%$`70&`&ʁcou {1.:t#Ez/ªl}usYQ[r"zr%.x>Jӗ~<{Bޙl轾G﨩PL_IvZ9+_\*hXzKG})%dҪAsHO s x9 r޶XCi-GmydnDz Y{AEǨh:75fr1iǴUtK6~ysoa8dz7rL*.{̐Kv2Lr'8ÁO0.smkܱtLXYN^LDlכGU<`TS$3kBgC,is?eH?IkNvNE[KAsޥ(~ j} W>keFϷ;^K(cr"@nHܓ֑*kՅG\\δኞϜ)$Hd\|Ȋ{ wɥЀ#1'4f&Hopjz%ʖ 7AxdEX_=l4 _\dڜN1diMr$-pyd v=K>_ܕEuzWSK"UBj"W>moI :c ŋxl7 go%畷X}H`p E |, .B6 +!еa=;ɸ<ʿN"B/覛&ʓܐn (-?aE᥄_ Njc#r soR2$#kxbу 뫋g$ f#~7Aj~W5ކ6_C64 ͅ@A&XePj pbtup%pO0]݌gߕQHa>T-k}(\&+šHo@ ܲf2p(^N bVī;t3uV8Έc3hH'c>ڒ4{|I'Q #(4 Fԙ:5PSeֵp[c^%!~%ei&0J}eo onoBsss/{^zR_\ΙbyTQT Y;^Ӟ4X? xrcÙ9N#'6n$I&hT"QL7:{ʸw:Z6Psym?38F,4 H9)=>{JӨZ>jJ0s} 3s@[z:1IrM02UjxrV]VkCo/nnR yK9N?k*BI}OPFzt UccI1k) 8YQ5;>%!9i=UMhgJ&6rn0j|?gLw}(<1VG܉U Hپ w D(˥ԡӘ#XK2*uqHO !JTa\e-`=,lJVj} NDf&y"[!Tˣ ļ%W=LܪuI;F @ڈi~m6\̺qQYrD)/vAV8yΈ`J7{AޤL FS͵^Cpږ+Anˮ\rPbE\u{ֵ8.oS)I;DmZ {?s`ӭՐ\l9@=0R[of,U{#c O45>_zd%siZh~ϬV#}&Fw.LE(fd"F2~{(3A%&ak@VLzW{!&ڭ v7f8d pNH hh\{kK,w)0.t܎)CBŏD]M_BHX+U3ic kq5Yo[?4@6"V: wZ< ~Ȟh_)Rΰ]bݛ>KW~vNaOi͘ŀMBtǐ H]-M m1نe׎}>#zFYm<ԏކ=Z7{AZ'/=pee +\"UïQHܪoglƏmI4gljtRMp$Ό>FI݌HbX4ΓT22kɏ4Dc:fL ntң\'h@g$D4 ,cXL)1/yd&&8c= g.7ovFK ,nsYYϹt&/%)V#uVXx/V%u訖1Tm'FTۯ|-%V5vjFCl4I:LGs9fIS^*$^GBċYxR␟ySi8;}A\)N3g.U&ƙ>{U% <]󹞪rQp߁XU`a'..Ic|HsnAd.c>ZC@@̓EPVW󁙫6 Ps 3RV2QAjYm1rRMa΋/rMFJ]O&} C/ilʇa ?BF c>dp;@Hߛ;j3T2?~rN Vfb%TC)I&:|"2H(H@B+E)ېTҩ'(;_I6=VjmCIvf1IkP:pI#1c*1go>Pr *鄣pQ+$)1wfz#F .DJ4[E6/F)`mL;ie=_t*³EfiUQc|LFusG >y՘'ȿMF3|kyr=ρrY"|98&>ιʀΔ\R)y_kMص+ktnm1FRfP6l h QAZrlrw97ɉ }rNmCi7ryD4F*Œ\oK4N!`v$ F2Nɏ'Jo͉Jk"qGcT3#߹N)hxCok9ܺۊ;\^ZsKv#t rьWTeb+ȱ |,;u?SBRK~M6)E$RI xlFsls=p,Z3`d/ERvdoG_'?" Zh;ћJ̜`*o:k)c;Tߓlb`+.b=rݠɕ@^i`gRI팮ɡ7w ~Fx8BX/[OA8R *- í bY@)jCH! 2tS`*;3Ȧ@+Or5bXǰ\ TMۇ8]rsZ%E5ifҷ:OxħAӴХT}Jd\cy.G+eAծ¿ky'>?_ڮouV:*~_F{&&P +u/Fu@)71a:(1X%;B/EwPX¿4d(ajUbxv39wC"/ ڻDqTFFmAe79qlOR-2x-rKRs:`++J0 +ooF"t7sSݳQ4ێD *""&!1Ɠ'}̄5˫L.x[q$fEvOwrFl>e/?fztl!!T8J%E($i%=&OUף[N9q^1~b> _G ,|2Q:c 1K@_ḍOW$*? \kXt4p26m>avnھ᪢ە&1UN |7]VhZqx|ϟf'>o(ə&2di`e2 _X`cdшu@|4lAr=˨2 ҃ q5HVY~>hu+lCK$L_,1!X;hr:T|kh/c2 ,cC*i դyCyNa2E˽iY &s-A=[ׯ}_޳Uߣ/'v^&De i026_qVa/]$E64ߝtCϳט ]$:ybuY 3񴚘Y_nAѹP߻IB`WYF$OF1_^LY_#]pdƾ :mI:,I yG?ҸMP[c*E%'5`rdx}zENFKě8s) 2Y;)fՄ ߧHkל [k(zsV(9k~i͹\_U5ԿYY封knFLj(He2AE-~:m$\3?ZPS©6uٛ,|Do [49JIUtI3y U!9fQz$I,`t[b_N~@2?uBw8Vܱ_Nv9gLnJ딅F!6[hc$SA.ѶbIrM)Jz dYWm1S/.ps u44Q k7nr*=FXsrQx%X&sn굥:fT2w+撕klS§oX"4%~ p3ZIF4QO-t pE*>m!4ڑ&+LU>#lOYsJJV%YD]rg a)WyǏbM'rpnfG/}^;΅b -.,a;;eL%+p=Z{A0H3| xK- 7fkM!N6ّ4BDܽ5/Lu3eb1.jɠR-y]C $I"i%RCc#K Y'_44©f{HCfS],_>[kgeQDʖS;N6B]ƐѼ(WIݮCŴ-ERVGL_AZ˩#tuLNarTAF-1/!*sPsƒ28:_'nԕk7 +"/2? m_vywȾ2*hU~6sd)ʃƞ6G JhkLx4x}}ëf|ڻ_eޚ%p2s1̋T s A1U \l<#{v q ȋlVSzثgXQ* 'p{*PzF梁2 l#Sm{\GO*J0vRe8Rs"RR C^mK|sx־唳liׂUpd E~{N Əp{,E@uzX^8t,MccDFĎy@0f$ܙQǫ5ʊ"/=J筚Lz(Nbu'r:r9(Ȓ"o2;c4Yu`1`?9J-6We 5IFL!}:KݢBPu@GߨV K?BQW1h'uYivZXL|W^YSJޞ#RQ du+&gqϊIcú8bAHđq`+vd2Ҷ&u+R8tVtyDtn f.B %Ry3 uaI`w(C9s$fE0,β+VzVXPeRo `.mUmǜE8k䑩gpk@B 0ХXKKݜ)MHYNR\Rz\bET_}[O,8oT͒YHd5Xlɡ7dKوƖgp=t+w/R<`&pVߓW.MpK1cz:Yi&/(AUfwJ]CyZz-SЃ;d`LW|36eģt.y{)|2OйUl`gr8{i`E28I7^PU%RcL|D)ԡ%EŔ w%bϬ e^PVIݨI6Qg[qat#0>5|P[n׺,$Q i/ Q ` /;J9UCI\G,"5D$1ǯdQeE;[|f\:TEb[󀙁?bBN0s^p8Q?Ef3w'/n*\})%)`*?Z\ı۹NIW:'[KT2K]!з}C4svI%d2镆 ;OW$ɛ3^=HCrxrY.43^~UoJ[Or|{;D\@\;gx3솿tTt<["2:]6K*#o݇)V4k95si,̎c_ FJ<=;,C%awJ[BL;t =F,DC[9Lu/']b"+3Uvh#&˝ˋ51C!8©2%W$* ! *O5q0l7~2ؾqeuQHNeC3BQ@hRV$И<.e̻+#Ͼ^ K?L|I^C7es@cX~0Mi;*Zr1 2&/~U vOo%G&6=?v0*m׈ cN#-P#]ޞ0;bZ̝`ojl+LO,j-Fv˚S::bbݮ,o>`u7]STs | IG5s E#d-J1;@X*3>A{ $&Os!N1b0 vA_$N໇P0A_( R@KX yC#j6MTU9W@C $E|Bz+ER{&k}KD_AI]:%U{*D-`{Z.1 tS~X*2n ifZeH@K&_[-eTc\(09{R3 {zl Z"+7^:VgX$V^r; E=ϘmR&*, o6gFJ ޚ?NDG"Nǡca) Xc>@f&O@1bi!,H^<}mDpqeU'cwJLٕ5 ی^9J"42 Cis\|=5,V t il71!Sop!2gc$8 1:Ȥ?wtA4lC!>.s6j{0=b1T0 8(f E>@?X^2ٕ&uT=z2\ H- d-/'XXj[^6%]<'WSP3|jܘZ'"n.kTeS@czKDF}w j;k?6>u5RgPMzzN.ݦ3}]+h9xt1DU1X8S#HN WFbMq'[G6[PϘfY,*--_=QX](Y={#tt N9^!~Reĺb--W& :ic[m5 0$t g / ѧ qZqK">i"'&ʤ̗KkXVf_&i)pPc%y@OE!u;/ hl[KfX䤔M"*rFlQ ' ]:49\ ix{ ]kM7z pImhQô/iP.{9[% >)MRRT+*4 JA%ae7ඎg)t|u8 G0$ɰ󕖽?T^WxHln-GQ#@Ƭ,_\1T&xF:0 %0?xxd9ؿ@1"~ M1Sa'GBY& =_357o _yȽ<3 rUD^1f%&;;S[n W3arיLû&A^MԸgbUqZ JeyoH2[0#VeyZ,sИq`<2/Fĝ,Bh6mļ۔FbsKKG>"z PrLM?AN75ű%SD[?ɖ%F`sZs'uNJ&B' Lpe" ٺZ&+=ڐvBsIZgv`hV{[GK\'LEW0"*@0<Ȟָqn.#d#ihKCy9!7HOQQ#˲w FlYQ䐑2I04zK0)@D8' o0U%T=5<[5y0qz,^.׏j*ɫ;{\eYv ~^ VB:Jޏdnfsb<3Pb69I1.Ftank:^hcB7?ǵ5°k`L]MNr.ȴ4n qt=f!0~ju'v )š'VXffڋC֯SvJtSc|~5l˴O"<Z^ ;<Na&yBؼ4&Bp6]ct0CnԵa :(˕^åV<$J\ f_@`%r{WO'Q#n'5ʮ ivYNn8~6džL.7-ş0nϐ"pf[Гp]Ed|TUk)IҘEZp;~ޒs:ѷtqr0#JE'ٍK5"3.,`S$aqoM!~&u|1)3mD5}sƸ$FRFdYB=5|s:@m߱9tQ;Os1oΥV2V,`M>b8I{Q`/ vLt }l~'mfC`=aw^>=~;ٜK.mZ颌\3p TC~0S;Bݢp#pb{L#RDŽEt !%I+=`J\{ڐe`mkSQU΁߃Mp"O Ck=A.>'۴ηMk^}&RO.ݜ. T3Aaa>H<-JGؤ}=D0z S"!63? I|zr\CJTqX$pԴ)4O:aRL;N= B HEv Szd~W4 š\缊4u0ʐ'&GuqARC~'"FNrRv,A@i9ŒCiKCc6, qЋ23luEgt k5'tgD܁6jsz(>c;{@z4wkD)lc'8r[jMEQ0Bu[w>&d7NB}Lu9)[ j7.|UV]zw[JffO:UjĸZn^RlKx)u2WzU?P0hbq̀@)XBc,uinn6 1]'mƕyD@t[RkI FVr&woJ,^=Qɔ, :-=r_\1>D]i`p'{koP>L7R*/; hR!$:2۩*Ky;9db}C.io5gF=22!xj4 E +XZn)%b(JV[oqqTs. 08p'^]Ă.%gaZvߙ.J-:GWp!s`uqn"ӏ{1͚579R d jF;zq1$:u_Zq+rϙa+x8m=hvbC!0y}EYFNG[PmsΧ޵uDH7RQoVG& my ;(ZtQ\ l/QB ;gk<)mm):vTN'%&tέ|Ұ+aՈ?8+s.PZX^Qj})ҝ1>|i y"_-B'9Y=!S@U=AlF8l^vdY^gyl<(Ù(Z ɸN g,T9 S,&r 5." ǽW  <ɪI^g>1{*o˂`#w4b4gGqNRN6O| &(E6UxVK냞bMo\OG?$+qTcPmye3j3 3ig 0̋Q8v|0/̟%A(lcz);ǢÑ2_k,OO\R`sr~Nvw}n1~EްNch0{n7O8=pJAI/ȮAzwMV=kBg[~r̈ әBNBLA3l'fucRdFC#7[2B+ȡ]뵲6>Ba#5@R|/)gכ*0aȴsE!]{SFCuVN?zr˳\)O2z0hh0[e]Ilu􍭍'dMZ |DY9yV fWPaPk|?6e[ņ(P;9S1+XF]J!V&b-qxvҰ,4T2ʍ[r 4CĄZA,v {%sz<= \tCL "ne ft1%h3W.B;ciG-ȋSj =A X5K9i5 y\FZH|E aYuo,#8nY'OLh] MJ jUX;F`zNֶ1r;FϲG4Mdij,_ $XM{Vnr3k%%%!dG@zġiԘiMm;#$3!BO~}"cRS#< )|d0*#Z3Lcv}R_~Z=[߬Ip*Zg軲gEf=OnX$5 +Na8k zT;[ʜ2 `Ҏ3&`dhYڧse@{9F[Y@SlECN\ /~Yb*-&SPr7'WjP1; uAj'+J/IKQIxel D[|%5 eJ NB crTʃ<5嬄)]i[zjkGJ uVKςj͏aKE i) hlh{&$?m<2h/H/~ܐ]07Cr8nը?CE:HG ,QOCcwLR<"EB2Ófӏ@J⻠9#^.C`!{DUa-5:VBx,hZv_簫/C*qپouAuqĴŋ]!wVV޼x.s>XB: 2!9 <6b[2S YF-2]Ls~Ovd2sI^c`!b7ϫ=83"bm1o}J<(bEH^D KOʐEZvDbڡY;~ ›XTe$ܯyZTyA`'/[w<Λq8waȿ $膎SJ1b뷥I.-.N0zqIJɤ?lqKW5U^V*-mhT.+iꊬA!p.ΣfWx ڤv Hs@3,?r0ZcQSojV37:?9m+'.v"@!5.R(k;yhs*DG7aFaQf-&4 ߼K}1̻ 9o 6^HE y[JI'QG.OrW|"r]i~to&I^N`_  ƢbZƠ162u\07֓ܨCe%.M5V͖M i҅#\<tOk2w',;( c~^ߪn4WR7Ht 6Ao<sXKZqb:M.V b@7,E4r׷:dVUO'8p4cyiIAwO$d@7#fX{3+ 1z^(g%3DW3ƶj$%>!?Α nid:$m4׀J羺aWi);|V7mG n(%7˚)G)NJUNHX X+{ /oq?f<2G,J)LAlŸ2Ff(Jm:ETHsY TppY.XfbA|S֕_ER)D-^ kw rA`ĪG$V0;їNxXmięJPSUL+?Q *^h`~Ni]N,GDORkjњq ?}>.e3boV>f\<&4rVR#"RUPt ylB /w> &k]BDfǎg"p3myGz1 "x)6䬚ŏYt<"{پ7hqe\._JZ#o=~@btAĪdwk){-#}³UϹmJY{]ψOd[+5 !JjS-{8ami"tkv$Q1G]] R؎cۥ%ObXr%kZO>19 )ml[Սb:8vxQ_F&6 ycId60gU̘~Ԍx-guVd Aj|.1{OF¥&3lŴΩԒ&8QIA\+TwFwado/ "H7$lCI?;sI/0WN4HmGʉZ8`5@QvK7CPTXxtc64{y܀.wʏbX{B 7k8k[9 &.=ܺ՞o0y(zɪ?[I]:;Ͻii69MzʾEE o=D6Hؽ^ (Dߥ{of_T/µY .C0Qtf8>¿U 8͘b \N}7YE, -z'vYpv]RqWՄkKӺr 5GSx}  z:JR%(S6(t1)LS2$K?bDtv9 /wBdT;̌l×z2psu Ⱥ%+S*m< _N^8L^>Co?fqBHDV ]mf*ӄΫlBbz~tF ^`AYڔrK<' ֔Y0?~¸qqiu Fi:=+[%?}C%o3$Ts`'ԥd)ݴÌ|S Zr;1zyֺ V.0A$,BͫaVE $[_*JGF>cVw֔,.)'ۨ"++6cT_:-ضД9fY{>lr0L^,)9$I ,UhXӜc6oD!+b©Au݁)G!|Y2Jmp[7Ģ p~She^|O*՜Mj6LZԬ8Fs!3b:|LWɼJ5O'fd,{k/ʮ정\̗a?;49=_Vf,^M.ȶ*U(Sq(D5EpezCFi8Aum8jE[bkRsÝ/jS1\GYK]kԯq<μ6$js:|sMI}{Wf(SOKED?^xx7]p.F ycRl:P1]Vž # DVrTCH &e(M[P8f0AJEYڅ꺌MJ]P& L3u-S%":Wna5!.dZ{t&X(ҷ;%*3`^(âzߎnc4,7%juZg$*"PLEGQiP_,4nMiJ~%=Ιv]#a~l#PdjF3ʏ DjqN_rH~Ɇo(}YEֳ1v |y;ΣѶ75 7LF#q鶢 jLi҅ wƶu^Lʍ7*|964l_\!\cʣoĕ ;oroh}W3+٭(?Pτ͂,ꢋ$Ubgj,m SFO I.!#*xJm _ #Oݖ5CҷRV  ]zMU]o77؉Gg}/<)Oe(n (ЕX=2{!qL,ֳi+w%-o|@z|_h9$?`yP(|X|CR'9IIx'T݂w*w(5i:}ǎ}hmq=ٙu/LF*Zo7Phr56ٌVy)$-7IX&fZڷ:πp= p(ExQ9sjS\C&>r:yk^"^J|7hHoAo ױk$-ۤ`=q JIx} eeL;Ii'1\H'R&zzE1ԡPd|.Ì55Tl"=2ޗHXܑ"kz꿡[7z%mՇxc1 O` 75-!ҌIGgGD2N (d?q=Ns%tAVYN4q# QE$V(67BɔӠUa㱂E nN><cGs^:+g}fhT.*/ҝp&뾡BO@J, ߦ!Զy"uX@#,Us3 DzqAq@^+O͙E\aQpaȾ۟bBPdk~S_0a-%Z֕ J vViMoxG7_13QnU9e AF0u]*[ʢoC3YfmjJQmPDLMB vH__jOECLZkUKbFlh$ ;dG 6wVw) fg6WNVJ5̆RHϮM6 `c҇׍:|XE=CcWhq!uGS .dQHT•2,W:wa| * mlp*>a8IRS12Vk89>␴]=%gV@vB~gK` q2|tp Dm؍_]k|XoL =& 1ġµTI(S Ce.i'U,?྿dd}\10կsMJhxV-opkD^1s#Wu4v@!JImlEq0j^gk:v$|J,M6:ޙ0_=Ȧ֜▧kzi3*7H϶v%kWdTa(?KBU@0vavV*6ŠÐHJ2"2,u͙!o"YFe1ZT"hc&{Rji[u kJ8E s)aSOrf_g9Y]j@ܭB,HC֊d 6#ӫ;=D!L\n:-r5&bI56P{C@  J^JYKKvjSsG1M4[++۱ F+Yֽ^HAHVl+h\Uu9gCaa!A,9Kj@c / sn2wco{k'[uj{pimj*4/qҤ"m;kwhIO7c5tWjF8VZέP7#;^j8 x⢶4[']y(jBŒx,d 8RmߵU_|I>8M_m)0z2=]%7giI4p #5..y0M(~ǶbzP72фձsfhl1WCh50*y߁YdhlS/tXEuas 3ڂ0`Ca0n_,O'B 9MP`n27 $Hv|sg@ 4C}Hՠ-t.2=h,1IZR'aĀ"ft" sV!$,38bH?@a Ɩli5cv\'",)6eXYޏmeRÞ;Ñ [~Hݿh˫%I7=[N[knjt=k?,܄˂ݜZ;pK<."J .(_jXX %h$VdzJϗ6۫6ԯa0aGNaߔ;О#(oRI}ߋ 7.%\wvn¸Q .mB=v߲Wha mQN?@@{AP>)4\KHos|'a3ЌՐp;Y餌OzBN;QTG||v`Y {niTx;X@v,BI}qrZzrW@oQp:w G=.IT6` HZ y'{Vn {x t2yk1_`g0Az'$#*fBbN ubʴ5+rD[+k !~廫ͪL%揩Θ] H\x[. 2#`r˕|:-Y˺Rs>D0F>M`o<pI̳$2}$G劳g`Hс7 tğ#kiv'VnV +vQq3PDzvs~3^϶N2B+ʮtMa!1-OMi;b x+_3 MqoٱZ3mE\+i\X.lR8(Mg]mHN |BE>6Ol,scfVp%jA"FKy*&Z9 w|Dh=oE7ZI8>=m8s*dZ{bO3$yisqSQ :ͭ nhZkhG 9~*=pj-15 H)oĶ]x+a\{LZ_+*:ya"I T9ɘ8ruZ\*^BGbDm?޵.; ^/ǰxjeg{!t +r*MDƉj 2eZݪ^KsشFO#8gu+[Z#_ڦ7cy׵Xd uJt}z]Da$q!(_uFOH+޺H''I=JC 3~zB ܯ%eпV]~+%Id8~C{kO|ٜpo#Ɣ6M}QCKX fpa+^ux Cz|}}kSAn<גV]W] 9!G HעI{^zIw.|BbC/{f1йKe<_:j1 -k }FW42,\ ke|W3 4FW D.e>ma; 4B|F/w>ꊂ7ލ:0B^%}#FNJ07CfB] Ӑ/<:|D15ۦyG ʆx@&bH ;cԅ#|;G_<3Z4,75.UHnmCC8?y7*Mj/+9_۶k.f\pv_ Ȭj sa*?̴K1,.(;s| ;n<"u+,Tѷ*PԚHZͭ4'וyVMQr*t'*0J腸AX| (M=iː\k69/Ly|ƪaB2hQUS|h颂ɉ;q6ks7_2Y3[AF-4j/{AyO ȍ%[U'c.ыxRnƗщ۪nyS|/g7t)ۏvJ ~h_jIm*RI3,P,>1JX1̹+l@d*YǧЖhTUnMذʎ 0- ߜ9 AjeW!0r^.`/E-2љU߫PxfM9e*YexӹWf@ಯJ `Y#l$ɴsԙ\(zSXmT[ӨzàSYFND'W}|:M&S3U^A׿#;ho R 1S"{H(6ԤF?IOf/H ΀iǛ/HBLyO18vXAM$˒s{h͊!B@iU0Kg,YH`[yίf_,vDmOUwB|[) Z_,tf[Ft)0;EH7 x|HH};6SLMc+ ]u*xt譎6v!GFr 4$[ #mO"X9;Ci+dk.kBpidD,;#XRfZRОX}RrbB=V!uQIFR#?D6xϛ2JdbC{ƒ'n8qʰr; QSc1C^S(ѐQd:R6rn%ңeFF7Xӆ)Due`%[Fl_i;I?>䋑g$ w4UrYxy%y{߉VFNv|ll(6;,/Jㄒdk"A'qf ChMwjф;T# %UL LA h=JKD[o#@B>5{` P89po'pا W(XFLZ+ "tμp igcIЄl,TQi' [,%5ϴTs F'z`R&iVyG #DÓ g NAP-&l&=vb2 &*E([0`Q]kl$ 75HӃ m'34S:f+uŢ<&=\F؈D=dp_HUE*'lv_1~F(6L";j[qfڽ`t;X!xri}ALWAb hsUc{zosnRDf=U1F)ZPS-8$78\{n)?XI~ޥlt]fI_tׯI Ktេ*mށ[8MMlO]Nk %]MZYeN~C>Qq|˵ ~( +o(O]R!Qpߑ|:Adg{fUPRbx1Nu l\UVG.ljE?s> .#4r(^0zi$c}|f z*LcV=BU'sEZfSyg'5s,m.VTi%v¯+!-/tlu66&z~÷!?{:p.˯9}fvBoHz@̺m[@|{:lZd.;Q1F*L#p/ gxպ]4\ y%Vez>(k,&وl>Gm m>{H1yj>sX$݄C!Nj~~c\YW>&ALFk}xxYID!Yp*F ?.viA:Kb}`k85xP2])WKSwôG&FA7?< ug7[EH)5PT#]uDxW xw*KCc4QL> gv'6(OXӗP}p"~0ODw =}Dѧ8=м j\8ovImwISN3æ QѺi㒲[*Ҵ=K1\V%Y 9?4 lٺ(ЮEs= O+z Y,G&~rX4Z2-p#K骶[7);<, d! bb!ƎScPa $^sVzm udk(s:YeR$ 4N{A^!dmchO%hn_N'4R+BX{hMNI%(s&=vQuHx6ކtE.Q;Ȯ!00e+)]w:ٵO e4z0.ՎŖc sNatp *\R) {_q Bɯ$"1!YbeN_Բ_696Av;Ed]NgY`nyi},-ʮ@wt]bv'sڗB{{&&GC0AdK8p#(wj?͂qL(Hֿ1׳*]SLU4Pzo+MuMsCNjVJDm0nhI{-2,H\mbn}PպS*XKKOqDyJ\37o!p[+rAb]6ޠz785O?+hM.4Gl7In (<ᝈڀPȨ俢IEۯ~AlpM7Ź3<2D?=̿#1!8&9MiI!$'uaYQWzێxfC^8qM~?S-aiNs*w񧝥V^ ~_ 򨿛tsŖP%6}'qkhJ(zP!o(jEL(bz0<*xb/l سOpl`.]z&TEI֧K'Q$q~RBtzDOD9jG*f66WWEk9W2N̗*A YR!}1cjE|1+ $x7䋰>mh;%3Շ.2Ra'<Ҳt=yz>@>h]/96r Dų*RI|fy̾8+d\'C0m_+SՏD-$-2Z #{~(cb@ѵvֱ,H84gRJm 5OLz֟lvԦR) [Q~ˤjx44^2+Fw߃.D_B|1*2ƛu&uTxs^Âd9 Qj^1rT Z!X#ZX-9kX+SUhDr쬐N!7cX$Bk)Ӥ.ؤOĨϋEͷh%_m)QVeEwVD|4QY#R²^`"{;BlyPa=ɰɄ  ,*Ve.hK^e_@V50yFnw:q:aq +O㇔j2_=Xbi9Þ7N>g_v-QyW.HCYl)mњ I0^1B%汅mèo3"uz/-jݛc̄0ZNҍ33FLMMu_0gkԲ$CR8ɏJ..H/mιQSߩ,j_:e$.D]Z&.ag?Mv7j]c#h.Q HO:[kdYp;\nrO! 3Ę~ҿM _ѡpK:3J*)d=PeClezqLZ!`9͖Gv9?|9sJJ#5x"wrr! 9E[B燣ֽ"zj&Aas4Go[/<qED((" ]7jp]J?[yf&ĭD6 ?7gPgrUj}yc;H&KpNFHxRWQ~'6ښ-:nN9^H9^Ԥmb s~G:ʤBW/u3m2@r%LAI13)81쨽]](K{Y͸f+W5 I>!W4hHP:6$!]M#el}lb~QFwR1ɚz#Mn" ָ .tk">( JSo04DCn͈sl8q9{,v_Kr[y̘6 nsu/w1̫hk ƊuVR'Qm@ׁn;{=.z5DkA|4r_k*\aX/}gX0f#X1e{I}Q|=” ygs4K` H٨ao4$";ͩQ6ÓVnԴY* j*ԥ#GtzK?7|m,3 Ƕ `6#Y9)62"9{4{NzSD@SQYjm! Y|K7[VXޢ֎Nx%@]tC18>gۉ͟{S[x+׻5{gƑ5wjN@.qDm(E7{,\- r|9M%$X ghu(YzgM2{ZPOaiZ=I_-6I_>@MY'00JYG bbx N}4;[l1M.+,l2\%#0qZJMLX KF?[9#LD癚OvV523aT _k8QSJ]5=3s;n5;ڦs4HL3R.!ffnم[*zS1F }OQ yiXPt_+wt6B/J+ʙ LhǟrhCx [ $|1<t&^Bp@wȤ~$ t榌E`KG)tsx {#*0r2T y'_d7'vBlQtʇ3v~c_[ːu#Qe 񅄌Tx4GP_wh9ܭ/iN(/w'y DYhuF7l_ʝܢV*m7Asm3\ ‹THɝ2 jnanFO%~i$ρE^#W+}- A+hn2ݟmAO@8D%oHm L6-5$Ey)C&v:r4m=f5N$@ƲQ%lv?W&MLܩ9X94zᇤcp?C}߷%-gwnh7'f5sg9A`~%Hy0z&rh_X0BaI2<ױ5%3׃y:Rq?g[uEb +$6Ӷ-Xk.m;`9^InPGK܋]ʍԴXCC*eB=f<5B2c$eJk9\N}dp[v7vMpR>e Ѓ- <ʻV)/Zs@$b;oͭ MN\֨b&]or?͒‰ OsӞLO`(_.xXdΕ~i`-'lCIA/Drܛ%Ph8:MeÛ\ 2d9!L T%)2P gZa,Yژ9-/k:?NeXϯ+j6ߞ2B^e-F=bCL'J#CgZ˻g9`4ٙŧBx]/WExf%%dɣ^&ҠgٙF?E +QŰ|hR?@8/ "ߔ5aβYmrߪ.k_J]{֥V7S8S~ԁ 1oM#C{X*}MQ8>?fIzXѰ/BdmJ\@ݪ 6ehF*4"]/nt=gj ;-Hك`eU!蘥<::Qꌊ.S WDѐu&~G!Πl]uj* !w.6wB[Kit8P*4HWgwQיBHz>)ɬ\ xʒ;GBPXƾa:Feufs}xg@y )C WǩB'7:`_4z(Fz`뽙Y+< ԙhuBW&[TO@VNFlHq$y069FiXiHY ds%' B)vW,i虿`#j,4 yHb]e5mf spjw0$C*NB!dXn&UOqݮ &RTP@xN%Os$ <,k3?紽м 2Vs6$_oz)=ڶlDEX?=-՝ (lcb.A ԡ0ZRƮ{YLT,I^7nWGLKJѣ\ϛ-N&LqBZߑuqlF@6aeP/jN1bc 074|c ;/g } 1|k=qͣOTd'Kg=$+/iǡ6Nqpt9dۨ@\D\/x/ h'5T=4o&y޳nO%('#~y9q@nk㩆ꚊRǘͶ΅ȂVh1hJ hXu5A#Jxƣ.:XH 1;5A"^xp J![,M'YwD,>И gVkv*H[=1wQ}|k- W+q#,? E*:fT(E=uqK ޥSa:KbQͫZΰIǎO/$ uݮʀ@{b4OAQ4ݨ0epl}Ǭ1P$m\:0.BOj$Ag&$iF?Ƒ3c '9N-8ِ[ GǰH3"$Nal0Q["bL4K\= x&m&ǜTSdC=Ɯ@#K:$%ucZUƜ81BS\E'0f`,-T2~k+Gg+Nz8#@ꧤȵ]UKt-:'nI8;ꌋ,lg\}|MڔtK*rE>ݏW6[cyZ|,r: 4,%8[r'h1fw#X֓O۾r~&GGo`MVVW0j~%̑¿;ۘE?+p_ AҤEJOcB.ܿoxdl~Ό3Z{m55-J'؊ |y-NrNj(3n~[QhÏc"`>4+aGjm>>Etْ[mVH&0!V!4|ew:Sd|`#뒇Dw38RioO t4^?wP=5O/QCa7B"ojȡKeMn?@'h2̀P_{Bq,]#Vj"D\Q: ݞ^/ެ93آ/@y&#*߉i46dCkڷT@P&`>ǕM'%`4( 9%rd6𔌻ѾXcV-i<M 莨Q$,iAa/IM Zr9{>k6p?w'f)t \X;_fG"52ރGe%";Zos,ioM/Z+養U݆6wZr1Cy5yQyXs>{jI"7M*VIl!.H` ]3oӳ{K"pJӬ#$+/Է|dd:-mw<,#ݚ`^U%X ,u\/7&N@ Z /,yn{I~A9>O^H]h$0M*3$nuGc ِ$Snyց$"Dem6\Gb* k`phke9uMq*y"֎|S3H~D}|K+]IY^,q4 *Q8?Zܐ؃DCMmG+Bu?^~ctd_>6@$ʭ6hjȷo`fo+fDa7V(Ch2$ǘH )^SӺ'HNw5-` S1fcZWJ26#:p`P  dP%"e @ŒU bC"O GfiHaȂCD6F нaebJnRv IS `CKj!0!&flڍa:i7\`4RD [klcq] =('f0*b]h1|]x̑ GlBi_5B:'&֓#:L; +kuS^p\!KE.\vԧ~e2:_|x84uȘB+GrBqjq#)o0G0w 93B;3Ռ SV'i1(Erl~jIFԺtQjub_Z&+yBlPx+dͦT|3<ªT6y7iZˆit绁,hLRqlR2T!XW&E lIf>.M4ۋQya` =%"=9Tim}þX /:L,U0z=aXYwTYzLE?u%Qwuݝ]ׇ~m=qڋh/vp0J}h^#clE:(*Nc$σ.%3$:Lh/O>+*vwx"vXaIU:dѯ I9EYz)q2+jƸCUwGlk-4QhIX ^,0ujAu/ P{7xu;Y=to"@=F/qS> gF/drjnPLvw) ZOzT膀-wrxtOjcH#Vtcou؀ c;ǹZT4jvk&Hڋ*q51 ds`̭*5s<7'DJe{邭9/95#T%d:n[j7pvJ״ξj6s/=G]upF0T'{(޸'cjdlYFu {lFdm*hVP?f#0:7%^KE)o3z[\AA(bFhH~5ư[RH[Iu }gu2sx'S\yqcSBh}YGCH-:h$2,޿d V@>?K).Zf}-k< ==VQ`Г*RxZxerAJ# ' uD 3[M_cX u)֦>q,;آki|fo ,<(PPPk&I7@, P =,"2d~lj Mwm57 #ҙ%dS:_b:vyx=@ўJvFD9vp%U g?ڿUac -. ,AHIoZe9~SH[mz)<@ [-25V1 ֺ&@9q@SsŃQOD|zDZP@U||L(e >1q O͉_.7K~87LQv 1i2H4Z3ZN+Iߍe0h24h.E[t1,ׄ([8D 5C/X,42)uܿ[o"=cԫ*)Ob4B^>p#yKͫ :oj =H?L c@ab*%$:+{+L`"}?דy"yYrE,Z@W7/"k @Z!۬P~S=%O)QJZo.55ehwb[e^]7>w9(?@MhKlvŲ)ڊp錡{ilhNJqmGrn. c;zBȌ6}K Ŋ6p4b5M;K`Q4dǖ2skJ52/cB p#4"{0 %AM|rԂY obM?lY4@ѯj} 7O3K)rkq{)PI~IQdvyC]BB"[[>FcJ>͆uKg :Qsxɇ.th\Z[k$!d8̓d)k=1xY@){3E3tZ*m^Qkd|Y3eY|*x `hKTT;wZzQ_A; 'N&` |F@;@Y4=La}ʯ9/Dy̠Cby(y= o9ak]}L"N^܃3}8=xa-ϳvue~R+aPȂ;r`e MWG椭'40m.RMG0򘤌lqr`j0N_2qA;cWC7#b.!h3 El,@P7镱DkH27 lEJLZLȑ xzkqp\&2o+2ǀt 5s~xyхc۴M"~jW8=6ܢ1 vƵi䶡}kl3v5_k]1'[=N ~Z jФʲ@V,U~?dngQɃTojik٬[\ziXT0γzUJ` 8;V^u˵{J!>MIDn<ׄd2:p"0¡KD?-'źj8[-;ոmOr͆G{{7W`F67uDJ:EI2ey]ti0A#A TQ&,hf% 0:ZcEDo.aI9yu[GH TADCC'f'Q5ٔ+fJ?#Z; Wh V'tG҆:;w!a$?bP:x:([!?Q(4A@kvef‘wWHMCR~bw2 ZEW&CNkLJzTkiGcNwivk79J(-| ~D\g\N/[hmjaжvi3t>fܧy0/+ցLl3^ ~9jmʹlޠhU;UQ` WpPK a:*R2, o1뱤n3j02(,՜Cz@_NߚNU?C+dw/{{2OmKF()HyM,I6Vszck6cF7VQȿCy ~{R//X} >,).vLK:r~|$/!&DH{Ȉ\ :f^`: R2jBC5-aN :hSCuǥ\z=JEy=Dg$  N~.).:4XP׾++Wm࣫ zr^Mi_mV?otRNUM@*\5Y|.I^<9}E ^00IwωCu:]7M y FYkauFJcF r[NbHw^ƀf3|I(24"ɦcaS< [&-, r }L i,cHDȿ x`<76nkmbp<^;d!mӡEX66cU i~ʱ>fV<gm!SWEH tm6Ʌ|wigN$Dsz'9SM& cှN\yb(90 jX1|.Me# /٪[+1+cZXzEj;V]r  7ۧ40{6-b~%GEDx.'M>Z"8mS/òLvwf Fix DiX8E91@ # fjԫ$r.72U&pjNd%:f#;T˾)ƯUDS1M}MjVi~$pjm^B-FI] Ɇ\gdA)bF]pӰO?06_,F'zb$M͢3F߁$ KJv_K*G jザnZ7=p)#'8 08 oWN.&e`2 {p;}ՆDV/AkG݌] {"yBqOpQt틁xxϝ^K浕}d^4}_9%.M<^b/=/9e5 GeF̛1У+8OO!|H׳@c 9àZu:v]is؆uZ_Crhu:nzJNJKmLOxLlcSG79-Fn6YF)+Q5]Ź[$jz!zIQ|ìMޏ0U>qhГc.-rݺa醣oW@o* k(U<6Ɩ#@[Ń ZpZ)E1,3cczځsaJxz3je/~|UX4>݃3`T]S5\") %,"4YAkd.-UnK١u0Tc$[֚{ v?Ap}4# iV `QYA:9*F1'"(Cu^ŭ,uMpp^nX"wp˰ϔ W&!!f]>ה[L7 vq\d뎁R(MzObV2ztɓ.?ð2vZ{HH7!D'rZLh$K2l#8_jR3+7MD" uJkOĩħ釱xEEl›x5 AՐ&IlPdgB(IdSo 4P?}\vAؖbXZa$5HN oӪ30֧S@cm$e?ՃrywgōX-۾\t7Ϫ%_xuP~[jNIPֶrHqig*w|p w 4t҅% ]Tg@GmK õYT#h \nb'`Ü'oi-qT3a#&y5ܔTF!Ȱn'OfH|פ S#ϝo# [ #gEeh\pUJb(Jɴ22łFմ N\+&;WboN@UF)֊zVؘzӟ14דû ih|jYKUs~$yulr#Q>'<'YvG4F&4PJeBm gmC?kB`[E&OѵDxfp{kaA9rԔ_vQO^`v$pe dl |W!7q;KrM[Y>*5ދ7x󥊠BmDLkVc G~LHܰP+d_ ? )xS@J=lVäwi ;Z?po;gȥF:d2=ZO~!c N"d …~`>aZg7i+ÓNW ̒5ubVW _z4Ah߷j-$/W>%Yi ~ʸ1IWV*tc94Mmqb2Υa$}c{K&vUz )Y:HM|Ӳ(/hAZv^HuHXZߵ:O!`F]./gW׺䵢Q}8ã5UF@\'&n<{47UBt#q IVbj!X|Lb2YyQGw@XᰀjWn@}=JE;z YkۈǶHdԧQ{xN7owT^ к+*KU+us,~ w2lv+u@9\Ind|:w(3ӀzaM1ltU5Kô$~(x  f{C@~<aȋ:ĊTXoV\cf:*OR/QWF Nv*Kj?z7X>K! yּXMjkqHxOEZբ)jYO(%*l]T5#;ޛő Qx'n N'M;d4']8 &] CWm#X˔%#H^8AtDw z)g/k41+-lZa=V]*3*}O΃[{~D%Aۧ2O<{X&b[i˻ˠ9@h} -/@4̊z|Fۄ+vE㹡.ޓI M2]mF f2ast*%ޛ`-vT⌰EK܇UJNonp҈lY_gP3ռZu$HǾޭ*O}ŇMX`9)Yɧ3R3$]q:xx82*CtC4-oeZlDtwws9<ѫXc?6&(^떃I v2us?Ǫ4E.qg*o0XCGԈYV8Q!5X5fݙ/zIW@mHB%i OP0gefD# p\'P q+fP:̦PX 69> h3&uiFm[% ֎bF"6N͠ˊ$fj $2 wWCXӸӴ }0=oE9:MԀdɵPư"̫n>Y}#Ft8k} Ej:y-ˑ&sۮ=snUЧU23B?.~cN7\T_;W[QL2gl%7 8I7%gzu> hi(4nFZQ_{⥮'[Pc<9^|T"ǀ xnj}2Y8Q@~l`6N .: z.g4r-06¹5H)]PzLontzhJ""a`{YFR戬q9ޱz$!=8UDI\ !9D2jTUPoETZ=ؼWRȁqحn^So*G)<_R@X! CƀFNŰ,CMsu]E)i?!FT>2h.}S[uml~hi2X.N<>&Z07őeBnr.Xx:X= &\?}G?\5?;$\ 2eZM)zP NNЁAvQ;А4q/MSy^U4e;t;M|G*/Ct'3m nf$,Ǝt)P K_E2fUs%6Z0 T'%e\ݎm*[MQLJBJ4Lj~? O)E&2l ʳlGbY]/.Cg\49@)F9qT~Še a ^{HXoO_.NXk洀X m}_r9kmh 0iX/gl]w>ؖa&ٖJ/fN{T^iʽtw,Sq;*gNAHuy`"bS{|\~bVjw[Ӂzyɷ@f>rND<ၶnb.EPw!;gJwQRB4g=DK,#U ,.TAl#o>,#vdiQ{1*@{yõ޿a^y/ލ$S,TU($gISR"3d2<b*U[X0.Z),BKCSm8xƠ򴓫ǪDAlpU!i(gU:ZjxRb C#Y1XK0a+WW/@5iBZzvUN+ۺ>iRH^LDO)%=QH06q^3 -ٍ5L>Ie_܎y_/N z}CgiԡLؾԙJR˿U^=tjA9 |ۈ&j4Yaa=LoXMZHχZ K S0קJ0הc;Q6q.t1K2hBï8z8=)΋7&Np fJ^ F$A)Ϟ / 3r7Q3h^qln95Na.;@^PFSr6&6g@n7s1'~XM{G(7'Ո;y7|Y,"W~i ) 4lȓP,''59'VpGN_PPӵ&HYEh2h5*]2V+0Eɪ{Y7.HY-*`#ԙVHD7~!Ș6$1m$d&]%.ZgG\ 3ut. !I#J@1Gj #_WCߎ6x.UŊi7eb0 #L<FS/ޥ3`Y%# lglR`n\Kt _ԨBQQ4Lkq01|dwѵ5dz)&jA딆y;FQ)aF VPl2oGvB>|$MX`I27 6<Im o)zmN|۵W; s\Ux?&8K4`ra@(_^F6 mԆ2IYƔs(wAyϹ^^#ϖG:{_ם^o)1.0Tk'he,(ߺPC{J[fJif($ ; crJE*,o<[w6$PwҮhyuI=q&N&+g3F;^ Ո`l})SWu*XܩKi$ZB;Ʃ)^Y+ɔUy?2t;6 ՒtSPߎ3!YW*QA.+̜=Z&#kBLQFӵH=Ѵ-d !:'! x8š4|%FbgMϼ[TwCaM5TI{~5)]u@<^<]f_a![PI&Z΂Aۺ^q- r)F{=>9pacrE]u_MEZ Lq$6D?l3QYw2a+һ*y<2[} ĭN-rR>W2[ ?o$h9?Aro' _4Bj6:L"{u{߈y\9(sРp-Գ'^)DOTL@s q]>`ٜ}n| 3>"ϫ _m@.n[w ,CTP6蜥 &m{ssIRq@PK~F wp5R+QFmC1OKEh\/Hl?Mw-ގlZ+=^*O1&fdvvfoy}E; nB9}?0:kttm6@7d@]yh=#qɧCw馶ެۧXUd4.6lJ͡b{C59<W;1!F/ꝍhQA0S`|vq,+[Јˈx7Kd3lvTˀAD3e/i[84RĀ|^.<] M,z}rz OZv~98.}W ?EYdz@(Y\ GR# eW1Ul8TKKLċ7҇_٩Uւ;[\5bLyǓgz~$Ltwj#JlA,fDݱI>:Ɇez"n(ǟ'_( #hF/Z}ZczƁ:6`OS6(QdwDo:L#sc>vOѯ?T"(ZMFtzi@F$_"];X":o9Pj%kݝb 7ym2"FIt?0="РuyB"aoP뾌% T##qbm}w'3Ôh;_A ͶAzbhC6E;-ZtiugLڿ)J\ZhD^(͟ASzp4vz=5W$ 7M]vXeʿB `K;CѱV`SQN9uMn?¥-@2 =N44~(K]Dڊ!FaC]^%bv.7q{cXQc">ch4p,6Ulxg5]MnZ Hq 6`F*zi!4kT[T /(Svw{m p]Pq!̤Nn0K#Oۋ+ C޵cۮHt]|(G3F5Qz!`Ya#!vVL&Idk(i^NXsQ&P7Mdb `xJ=PSx}7ǸHTMس}"ͼ!Kgj tqj !Bn]̺= ?,vt!^ Nq4ڎf"ޜ2T(Oh'ac /66t-ؑY@V'[?< 8քJ"w\a  8&y 6Y o0]5Tf7`/?ɒcz&Qd,(CjSd} <<&IxJUfrNPnZju]wazfgwBCZ"PCz7KDdq0͍%:5<\g6xpcm]lσvlF}htZ 82GstbHԃv B|Ly">-%߼Irt*0=ְ3_6x"?a*⤂l{D; Zikh:=tJHK ͓O[*)AKGTqoǼq'53';щ .hrrK*g0]NM`ZK O^mQa$24u 6~Zr#dN[/lG]IUWJ'^|-:t#| {%/qB{Pv&34oF\t}KIz.6ec7Q-Cyre3G)sƞLYc`^VAcV=;asQQY֥@w2ŀMMW-A .ULga'in+Bܿ8{|O~4]aEVH%˫I8U&iPQ/tT"f<}xNQ1'lT'Hg7y@AzvU- σ7yod&o|vS /3cFJq+OMu0Y,|r[׺s.Ƃ*઼Z*XVX ƕWTfRPlyC[V퓆|7y0ޟq#(%0c0́ {K[$J?[³(;?X|ܼtkl;cuܒۣjR8)7CZ}EGjZ r.YHMoqoq1G#:7^ _*섧,ldqݲ)3@# n+"s]GamAb`~`bLiuhI~ZYkDJI" j쯕ķKI[+D(ґB %lz8sw5#\s, ˍ7y&hed $YoZ;Q*8>,ޭdJZp+BV́ϟg0MڷZy{s)L.!BAc=}Q!•+ր3!Hr$Ծ:$tluL= IxpkL Y;6_=1EחeT.Ԥub;J42]I/W ]EFC$g8*R UWqjs}ǃf&us=biUjYIqU)bt `OOil8/KihG5Iڼ#NiZYA`E1%ҧ)`b&vZ4KEYMBlwˈS΂TB&H$Po{2$]+va ;o3 +9K{>AO@^kPck9w/ gKKO}z !MѾ @ xx)XB6=\.%rMsWSS {`B0p=R"6ZU"(6@a[p7*Гge(`J] +zy"YϮ- @U$#{iMw;XЌy,NצՊB_isQt"0Ϛ.<\@Sgl68/;Nap٦/&' mjC OI[3=}B?"b6 sPOߓx|qC=r7mo9 K:NkZx:gk#"l0~?w'#GВA?H268q9Kپ| t@F].%1;eR \ی[+}!byE&!G_>M v9Uzh[&Inhy9%L.:xk0ꪽWijmӒ%kpW_6&p_Ji텹ip=)79)ˎ/=ȬZ_5<q )`0iW}殷Ԭ<4xaF})(+} pLB0d6N܀!N+oVV4: `Lp(B*)=OkP?|7#Bjφ&nR*b4n hxYwF8^ݭy:1_E=ݝQ7' RgBv\l[/{coX4‡ w׬%Q $ ´4&6ⷎ]lûLoJ>]Lo r3طѧ, 퍳4kÃn!.sow"~W:|?oWU z)h)|Q f?,]*SM3#F*/+u~A1TNE?3dzw|_пEAqB#mK:DplXѮ]H}/ː~]&'Hr&WS-7n$ RW;23oUu[gIK+KӿѨ炪YT^MsײnԐEcr& ޯx\&ۇ³~|/F*`-GFl'mZk+jтIE;= T#'|v:&u kFZ,V8] li傴n4'vh19nq'ゝ# `Qlpz~SRPKg H<ScA`~If^Ir$>{6\119NBkK9k@o!j$oڹm:6sCw;e*s !kkYPhWSƤ)V9@ Cmasת{Ȏ ]p1,Nj-i0&<+u7|;q[ڞ}׺8!pJ,[:,JޟL٠|`T[4 XvFIbPfS0sA3d5տS<1pzôR_1*JtY?D[mG:g2x,~p9;`cwhAYDX㔭'- hN3`"[j>; F&̫RQ4q22aTCu#kfgJ xY-X:X@/:(`Lיeo*V/pЩ6u;r4)$r=^NW 8}֕dg/go·'^o !pN#HUi]akH.~?v`JO5 N6F~/(rd^|r0)# pb i3͛R'4FAlF;JyN' .גQy "`j r0ݳ0Sǜ“@~Q +GMVǪ+:33UG8ń_ |X}6ItDb$]=3qZ ϣ\6f Q/Ǯ`-7+B.ݫ06Sf)D_eJ}/֥x^7 %y@`z-luDωlgg4SJW"]n2併CNs.X^ rOnZ1@%Ѕ(C0񮫏IMa)V*b\Vt0Or]0_@ aG夳!cC7])i1H(!cg1EdJ{ Y~^e#ʪ"'"α>24TDZA!Ww&$$/> )M#eJlet0q+=,b!qevH(Lo .B`ں'? wXՉҺK0' AVpYj/wVeФ _5] w79,n9/ -ˍiٽQ=BQ4`:ueƋ"0ŀ_czSSA@1K}%6= "d үaABH&FhsR/d!Lj=S)L(ESӈ:hJOsaPgxroga蟸FScwl@=v, DV .Eq-J`iDzkܘ"=|7;Dj?' _Ij)kpan'R9 =1 :*LgC'1]2 !kr?}t" jUxwN:൩h~2%Zҗ>cmMtz qJuIrg)!j۳6HD-eS2μĻq!6ސ$~eBfUhdLR@=dxZRmu0uˊCC6o^l3|W8pu08ʲ(b7E+uY{>Nˈ DWޚ9 ,R 4C3Ë~8v6n~~V"]klK!̈1ѝO?K&6[sk(Z㈜R}Ÿ4kO$W-DwF`m3`W 1.OheuAa!X ,Dݧ.ұbg/TT\59FFǎ2*&R{?Dln6R6)E?~19G5[MO( ͼ@7%GƕЪD/2c?7;GPF%ߣ_V@qj"6\HNBՉ~G7LW_MtQw#󊈮N+V9%!_/ԗ^ o nZ/h\iݨ649zk^ U.Uf) TaX*]]Ss_@}L}IG\FI'l[pIB_(#і& ׳L4 N(%a&nOdKȠ%7c6^K2a&D`ѣ(͛o\&~፡ LD/+U*SΘz8U$ Ufgb(:e)(jKԀR8x0V'OW;Ԥ7 JK RKOXZx=ЊL{=bY}q"dM!RC$. :n95]?yeɍ-C(3\-@(pJ萝o lęʆL+!ı7o/f4IiM6YYT]*%+lRcOgYejwOtU?M6Ӱ_& ٕdn cmW_"lg \13? y@7051TBKCP5O8ç[72{&ZnÇȣMªB0OUjJjvL->Rv_~TjL MiT(.'!0 BMi<ٵ>gs+)҃$+x=Hy琬wgL =ĸ O+jBp`7VИ;d;bE4_|_Ogx@q'qI>-bg^Ѹf1þxb!{Uf(#qcJh) q˞S*{R7"KY;CH{" kWQMbqvqGh,qc l0Ҝ[ΛߒuS뤲v}90 ɗ% GKqkV |1/,?:3/.nnnB'eo;DrNnfk& \pY!"S6O٩)"#mkv5/wO2jX=`OC+ :gtR?4IX\5._>/16S]7”b i?Ҡ*4hYΞ$s>uǼ`*L؛-;Joc.ցY%brSݒ)ϱU֓")^W?p2!_XQΫcZG$6tzN=VM+sLkSj$ Xj6ȩo̍,Af9ػ 6/g37%NfArxʅۂXopb *~tHࡒr4Y"zQK~vp#-t] ;R,F"'TPF~1Ɠ s*zӜlplvCB΍ Dep?a(qmNq pY) !V,Ƌd;%4Pp(p Z+?tQ~-)ԣ͹ߝ2;!ؑy*ZaX !m\ %:=> N y\b}ņqE]ױ@#]Č]#A6FFM t71%vys(eVH{F L+\$ow(%>Xŏ!HB^7s ? so[qa9x ۩^-w6j35f;YCT,0Mm wRo1r?4l(ѪTaE$ s, AuKP%|lF U&S1To<<;6UۛIA_*5)"0%k -U{܅B&nK܎{G۲})FfyYXdm}8֋ʩu}R]v7e}$:ߨ=a}`c[]6YJz5p[T}]AB0ۅr)Hd/pg& S^ʰbs*k޵gn=Q~z mҸV/F@\0kRZWmlh:B4-K 2!w9c|{?k%p(4:'>e;fU2į_ԄYG(ŘS"ֹr_x88P{V ͰWd1D@L}֬W#)Ŀi:u,z?Q۳ e'!"n\pkG0_f@CsmꀠWvz#sG["ZcGC(.[NXtkSi 8.Q\+ld[h5lkӔt㞻k3;[ ɮȶw_;JOi$Fy/<^r5#SZvNpNt s||oiua%uO^GWO|Bq@̂^'Ii OXi+W|E Jٺ}.ؑBs7D`!wyIV%l+/sG6(#[sdU*df\t6'3&, ?v42ǧF ^=:չtp<5J,-mK;%5 +m<'1LiFh:`ZED<-y[ʷ%j< u֧禂AVcEV$SxT^Q[]ϟԩ@(ƣ_x@S %`+i$ij=5%{<\irE,X?-2sfl[^>_ytkIfXjW!91~r? z"0,zn!dbdbIXwlb=^r XמoA V kr*mN /CUGpţc= Gϑ67RϾ0L֒zj}[e^OZ9Ts8Ŷ?(>.벙z62sLxo,q mF8wUR[nϕ\hl`8Re6۱t vI>.|ˋ~WH4 "KNՆB;$D䀃GZAH䳾uŦF-""[g-݄"S֮j0˝tK=~;#S34p&$淳\N3DMZT7N(̊ɗblW(O8ϚK|J,W?E Bu_dt.kEd;OlX.OPL1=x+#_|yWʽid0<_mmCT%B,>r$ 8ViX4~7ז%rQ .JHѨ׉ pPyk;4 {ѯK^L ׺]8 IMK(bɥ`C)mI8g :rH`%vYe0~vR<'=+e&L. LO d H)ԧK4%us."9Y,&u&แ]]unA}=qy<3\V Rd`` C) ؅? I,Q'ÑsB+E2ЌzpIp(ܲ2;pm;PLfVny!<PQnBh+K^#uds.6+\OO7jUzhʭ;vC,]%Z!̋D`&j;:2%y5I0DTp<7ӞYN9J9G|}2f!)TI¼Cʊ(w/_#[NVO@ZuN#& ZND 'ܞ*dΩpr|isdyw,hpFʎ(W#v.򹙘 8? ʹf#%}0p7~ƃqh}l;i҄g!h"5eAjB{O$;\*V%>lR*3E֧ʃ,\`ٕ%J|(&Xs^'I̵T>ⓖ.YP?.:׳$ڊuQ_'S5oC7fԾŽ!=.bzu41l* 'x 0"">N,8"a .!0!uWcy_ WWv`yY01XE78D1 wu:ٺZ5£\0GڨƖC[^*e8#(ZJ=KBEޝ|3"zdTTǂN@|wyլ,->.)C9m!l,[~ԝc6g{׏G27F/8Wju^yz MU)CR$vƈdSZg2>O*h0J.5|HpY;wӖ]( VBi:|*c9P&h8FBL t]<hǍZ3|\+$\WIҌdz#O~r҉{%%Fiv%soB$hYMSըda֫sK7xG] YHpI\ۼ˴}+:nNA_$1MEjC=4 w=gd`)9 ť̫Tpg#OϜ}E%g}w}O?o8wϛˣI"8 A ._lY7+<ҚRZֱ3KT WV /E@v&uH Oyc}"d[*]!\ )ZecP3MK0t <;TXE읒7cT&QV_kWlX-xUTo6BwZu($Ɂ1?D {k Т;O) 8S,xxy<)~,a*z4CW@">\{a-=T ^y)5sƼ HygcQsa$p'i,}4;ՈSI<آ eR+`2ߒAhͤW LU]&c\P7Gr ](#8 >|5 ,!<>Wn'ǐǶb2]n7S|jt_U\E Sb ςZ&F'ߝeEԿTO(5)v"*iwYG}3`e  a-#!d&6ӳ0 BU{yj}䂂/V%k͚CQ[e} T"Yګ$q[5  (_kUhj =q]Fx:g -'}lkXTK3rr[@%=Ec}[EzIG.dH JK?otVL8K[ a B Xfpt*7ZşvLI7>R|E)J=ۘ7ca9P(!<SpBt_!6,MT"`֓GO0q8>eC[OܷhퟖmQ $}W-Tˢcptg2t2K#;XЫ6¾0ST%Ϸm_w7Bi3XvS64EQG PO[k-b]vEZ"(?͚v5N06Ga}5TSOՌp*QO7V"|u(~Ѕ\ %T7I1HՐJ_PCuާ>6VΘ|E}]*|@[۔޲HɤNh! D܄Ҧg`bN_!{ך_w-3jKG C+υi,I*^_^ݱzxEpF[qLo_YdH;HDt{ȷt`ze>6W³iFZ?{LCQrʹ9s}Ey6#d;u]" gb0r1D9=( HF8GM姏TKb\QzHү>S#Pb_,4/%6K#BF3ysZt5R]xQ(C$WsRh5ѦcJ{+Eov^vQ=MMI`L=ny T TD \䔲2XM|d6!`=蒷i^ǚpIIo'YE0xPj-!rf-u2Z?Kƃ%5yp3c28{kĺ>a踭%!5;:=)GEcCyauwI^?B@1fgr_k* m=lR !5 ΤTM`9ڔ\EųQwM_ǠqT2xeT&{ T61''UeϤS kiDVovBb ˲뷢%\%,y>W-L4?UBbD/Ž(."/.VgF^ 1 ԀE\tdmQ0`V@ܩ0'-Ӎ ޽5R@C} at?Kwu; ~!GqȐ87+] ڪ5K4;O xMT{8Ө㕲ܖOc)W%_@N"ߚ`{Ys]ҺE#}ÿ,3{Bй ub)phRHy~*Zk1j v#?:b^5q}pkkZ%а~!fFۤoUO*(f\mqàԡzCŽ'3Hh&q\YFPB(k5[Z5 C֛@bCulՈ!,ܜEݑdIJy[+2KNʳi2>unT%0&p%X(I ద=0F ?!` \;Wo.9B'aX=:{C@Nl|On;_0Q5lՆwe)E%!xsĨ8^ۣOT]5eIާ~RsP-^&._ ~`fi,܀Q&NcB uB3KWRQDZs9SE(K,%2ά$@BBkHjϪVS~3*$ 1A ЖPTE%z%QQ޹ W}𔖽:DkbKデSk췮xCdK!\+a09CJRىca]S**)pJǽFd`9vNaf(ypΓAgw%h7C纭렳TL< 6OT\ ,Unia!lח&],ZX")T 0g&.0 칬KlHO1\Hud;F8b5b'yع` R{LʦUΦ5hJ!*<.y;2f DQSC`\%8y=.iWpO+gS Aib>1=3O#dH}PĀ韅 Taߛ 8SȠnQ(7@58*}."8ɿdK[CK*WCEqF[ei>YYS v/I3i,cvNf#>Im)%j&@ %"#b<8uI=j*aNٕ\ߚ1z.nTYRj;6oݠݚ!rY'Ե7n:5xgl Lv 5/U|a b }NDɍ\"+`*ˡ_%+G;6\PG;^MLn}fġ@mRG.cFP |3%^ّex-\鄂 ArT¥9"׉nͪKZ:`]Y^ FzRwmy""ok#ZUTY6&tf\AfFdgU#++X*.02K}R#}ZmetYִ"C6 :'+|i'3tM GZm=9^P4D5/A1"x[b8樀=a߶)T\C3dZPkM ZvuK޾A2lŖ=M*^@Uq^܇Jl3ʡO 1TMVMpMݱp_{ZpH W?n5~0T(U< s'(>fZS bShB6PFEyhp#ȝkׁ+_1 G;W;(A{:wzͦXWM:-M@8GtC"q^Tݲw)8շDvc%6AY8?!ۃ7: z6JE;vY=SXϓk`~*PHѸy}_; {>a7lNV+j%0eأw{(-K.mTA $̏S~.DUJrr3 4541:VBtI66I8vk$b,.21 =jg4f0|4o+IAWgsS&ucySȐv( W>ygO$̽^ yl.Zrha]0<ګO,h¿[[JWަ*[? 9.dA=[7TI0؏.̋ Dq ;( cv4ά `pWM9'c 6R٪) r 6Q\əCA=G|nS|EE w)s,<}>YJ˃vz䗜׈"Ȫz 0Ix"0R|q]yv:O#7'v)ڐƊO+q/X)*!t nuI#亖 >]!Җm<̓Uʉi52,c' |z5" b?T qoi)oį!Ev#3&+_N@#h+U{к6B]R7 uNؓZ@<-Z @ց5^b3(0?VbhhF t2^OgfT4̦/sa+G5]ه99Q:1L2Uh;zyC6bM%>_%Y OW6z 0bnD80!`{bD%LsYʺGl`/׸/s a^]JdJB?:Us?#Mȁ(*Hd=[Ӣj<ë*ټGb$}6'IR.J16\j6wt=?j ?w6c%NSJӪ,gi`a؅a6!u)haRUԄO"u QyƈkwE] [5Uʗg=1/M2XxeW7~cR}8 ,px NcHjh΍>>4>\cL1%2?XtH] iב.o9Bu*~,6ZAg0H1] YurKjq)Dćf^*C#zаU#xϨh+$LM맠J5@`T el P,òbs@&:~C'j q@oȒxH p'#kuk}52 d;k`W%4;`o4"׃)'9FKq`_\ٛ)N{Kܗ/Pv"7'FLh}q&)@k@a#Ho∡LO#a.=3RZdu6tݴ0KO_7Lh]jh3.t4Fl'b !\ʐ^xGPr8-XS DE1R/a~>$)yo(V>]02 XQd]Pm* 'v& HXjq{EhY{`cTzA\}f|JB9^S+Ks$ ɥ{3:؀۲LxK2LvޖVuMB;v|Gq3C%-!Uv!st=ݴ! z/s@JT;~oZDjs#l]|Sh}Hԩ korYB6:2T?a.Q_WGBia6lt.[M=0#r1졗]mxj%PȎ) q<(2Lޛ?z#]-^ܸ' MM6AUx h?l>Lb`blH0ԾxN[-$,ށ "֜[tdq6nT ɝ7x Ś"B r`_YGd7@'|ISÚ~NW \-JK.LUP)ՋwqXh徝ǯohL~~,A 2odnY %UVNr[lǒ'u^xbPq{z&H)<3#R,Ae&"wVȘ6֨iF^b4$䉟ψ?F ] !bPLI^|PM>dx U:sH}<Ĩpq'c՟$Xy@~:pYv=dXܫQV(scJh( JxPa#>UY(r ƃK潙Qm'ǽsm~&0\)i,6CB>6iWS 8h:BB8Ȓ kgy0o[:dl#2nU+={ 3Z-$mAhp@BiB3(WrA3/vusܷ8pƦ-9!=3D]RRD<0SՇ4ǔv؁)YG ݥ_l|R%I~ (v3Z3meck7-um>gK&;LO?JU[{e|_F_{|S)=:!=Y)3Ni͝`4!C%<,8rˎ.YX1 ).WKhV?SKar SDVq2I)e#', sf836QCǮt#3忾rQ/49t>?ʎ5PmoY/,+lzݓgJl|<'xr3AmwW }73g2>~8i,!J+`H*n{5%/hk2/h+w Qm9a 1#@ 7}[,il|b$]Kc.5|qhD_B[lzx~FF+he0zհZҎ-UL ge^ 9ˑ~{ 9)Jp?l8lfUuEɡճ"u'UsN".~A>z3Sv{l:&KYhWӫ~NOۜq핂_{ Q_{HD PX>O M>CiC`Ϸ jCy$(ht m*dI],B!Iqb{vDzYJ9l(5uӬi&IH=eX經~(:hccx(T'@~cpG;y6XW >> @|9[&}ȧЪ*WmTnӮ| Wdΰ,)O Q>ٚOwFǏJ=>KDE 7@HYɡsܴ|icaYb$M@MlL!96r0r(e݊PhEln}A N|P0NOOy9[w/}b׃.FgM'5$MsgC,ħm4(|}|^ Bı{!ɋyuAi~ۆ)T&2P ~t B 8Wg ":Ab겉7vx !D@'RІ2M4o_ ~Kd )ZU:-iMbe4a+} pVeBCVIwڕ —I)%4PuJX%8]hNۦ = r8^jgOp32$ "SkroXǝ֝&3-`8xh\ŃpԍKFL^Ȣh/0Af|{zp_kC5.g to@1t0aF¶H2 KN %v\%.j}NE\Q3Μo'%[Q4JmJaL\[/0zU¬ AHUzDNj ʗ7zj,*.094Bj|)u!sH馞ektd$rf PTe3neԛrDڔ.ri܋c;jh'k>Lež7D>е$nOTd7I8^1CB|cμ^0̃/mbdxxy5ccn u Z*s|x#9ZH*}KYlt9ʟ= Qg_\oң2ʈ[$0BkTEs-Q/7bԪ96hY z tVe/_JGH>~ŗѰWo;Qc&j-ί%½2:=QzlT|V[his3mYLQ;E'v,tRѶWFn{s3I.@='D/#_EB*qToxNCG24P+[i BȒ+xҹ@gG7 /$9I岯N{z~mEiiN 9?B82tیF5?H"0wwJ/ a X&k(9+^tq$߯hULk C:?h3K-{﨣Ǧ"˹"f#99l`,'sTb=s%Owږh3R*T\.]/v4̏ {[`}$z }Zwk˻~tf蠴.S M&2[⒩ϩ0]o5A鐸nJ8 "T>D cKȨiA+$U/j̰q!NAԚOzEOq4:ϯ!PDXIh;GN(wԪ|?@Jdn%FV3O#RAsq9y/P8%H]p7(* |fn#hz3S4D}ww|$&h_?BF$1 3A% e~m2,@8(ڇт}=`$HD8’'݅L1װW+2z6vR)lq7Ԣu >3 S2 Z'݄e3X'Hڗtlg>[S"/7i |yenxnr H܄bY p7oxX(G[T%sb0܀Em]v5m}P&rԣcbKP2oNT85.]C<55 ⑟ tEw %S {WgG8&HsѕFQQUi+4f60oҍVDwd-{di'#[55ȣl%* D~EJ"~" eǮ::_ @쟚9˱ $227m͡#lRNldCh9 35LˁnW&4Vs虠E"JW 1%`+NJn (`pU 8" bz&!Y/IO(/z5coJM #,Th\L0=$ἷ$/Du+GQOt/N)U1!7Q*^]!I;}od5Ug緖ġF&슶7^lՄSIȜH{MR) Sk_;Ė+ 7XrҀwI[NE?U(4Um(薃K0䤺8Db$y+?i|=z8)WVc*,[Z֊f~2w]W*pE&ZD!.̢iuBu^6vb'eAp?0CؒMBauO-Zv8$ĔݜR^e ( T]Suzr2z¼3.'+ʶ YVqt"#W)&Vϫ1Fb;ZMYżn 4;Dr>ec.Qkۑ4RxF 1x>g6'6@ֱϵB%2Dt3ɖ>R֦;gYyR|[͠zpTuPڲuy)RŭqŖCb=TwO"=CZ+ `sULޓ.:Q%V<mcߖHyHa=y;Tՙ(ncÔ *v%/M;`w&u)PyeŠ߇Cup1} /~[,D.\`wV%n<P.?9n,?yvKwi7ɪdxVװ wHY}퉈ꯇ>ǒ7Sm/p8rqjkj%3kL:Mj$(A<Id*dn޿?b(K 3sFy[@ e҅ul4EPQ"HpUfٌXsV\pyQj)~"*-]80 =ڀU%)ssi#گ3{Д/N#1l EQዱeXCJ#ɺŘݘ)%=awK4/~bd:=pr3w*H>dȣJH hpc^RMfdFe#̼X,C,šp5&ƒfqT~҅PO C:KFT0U'Ray{e{ + 7J߭uGwJ@cG1@ ]+D}C'}(o&hœѻDoQ4nA|Pxm+:r'.YWk 7^ Ŷ<߾C3 `V.ǘknkSX2_-{be {Xת N"qrA_w;H_/pjn MwW)eїxbFYJl7k1hIO3WD"[rpμp K?>IHPs7ا5pes\j:Klg!R΃ޛ'Fr988/gtFotIJ\bWVQ7[x1G%! ( S-%_ԏmU'K:\r*k@zbRy|6@(ss l [( (đ!k4. V c%=={<}ݧ36;;ޏٚL)U=b` ozDwnkeeS⌣LRlNp"h8iZ)^?VWkFț` ,tG1{2j:sûv ;8%llpbhnpY=⪥&S;ii<+ eU"BUT~ T0οs=hv:L qȺ7Ф|q́"ڧN7Vw%p 䌗*i?iqVJ.Ȣ,:\2n7B~^2~[t+)ju 2Hڕc̾K@y Hڂ3{F \?DmbwE"XouraM:L^fȩrCڹrF uC!,mR{L-V+;ΎuG:. ƭlZB.{\R=TFEWse\T+(euf6V< i5Zn88LƟKL*C - i`?IC> ¢ҵ['Z@|uŐ>0p!kk|sKRjbj27.dO7y)(C#<MV⁹_D!aRabF@u[hU 2H9IV"dqT,K>&l)3 ̾$>$rJH_"lUeD\(TtR7>zz 5a}8 @)`ܨAL#C-AFŇPhF k45s[[+ i(w!8u7M(UzR#ě *TzhNQ^}S `L9]li?P% 0`c1ed6{L?+I+}UeFwz(1N JI  $ɚbD^9"TtftK#-7;.]F"i{V5Y& Ds#};]bJpokӞiNk~E,un,'EB(,+4NR̩S*qܦar@B@ Uw.͍M8RXG6*~/}߫4@6>N]M|Ҭ+ ?@c-'"BG\z"MM!0>c[nX>vR2!Ma։\q֮|7z&]^|f42 PϞFYy͍(NY-uϔ3}ʺgJ`:#)=Wz]Lٳ`1NPex0Ndt O-5_6b1wyxUMS]Fc{9IBg3ASc19XP)ir 0.qOHlue")QH apFR6(vKlۘQ|mbT C BKY*7"V"7_&Ru8f]{ķ:w k͓ߊm$ɯC}ſPh|٪> *{Q]kHQ6 d똔>~IQg 8_99y>!v^5޶.aR;aeUu܄RH*5)T.ef|-pr5X9Tʴ^rgTڍ?b"DQ7IWcWqWIR?rEy@}Uߺ2B֏t_=@itQu݆)sS&Y,fhpj6YP ON/8!}s{7-@,st괷㡬[7 _E^lfy5Nv L%!sE>ƚ:Nr4!M rsGۙv8D&9 ?9vL,cfX;- B8?SG.mb@8iax6FZ:Nn-GYD:-D Ђ† urR h$~h@F.l^k |4]vk4O4Nς{);q/*z92y.BSn6(\% rS7pe.qm6Z^]BV JIzsH̤7ITT-xB/*v,o+33f*!GDP8E15ȟ,BE;@!R6rԵuoݤj!oo88]N(*٩J5is.j4nP jNCUl=0_ f܂<ץ@jd*CD<8Gx^cS%{F>KvXk 3.ʆ~/f6r5:ct륉M>YB3 ֤lC۹uFXX ,̃oyNW|[sq)ޠPBm9#Ii2ڹW"z~Vi98j\O GqjWMO1dcIkRz^7z(qv5DdL.83b2WI0 0wz\ڹ7h=>۩Gy_HZ] vo^`veTyWOMJ63zh?6i]<.$IQ &iCQx4*o< =BhX{1ZE}MYFP);jRd* `twر4o~;QE, Rʪ앛j&/|([9>͈!_-pxwݖ%܊9PVSA,)1`>gW-Jn.jU e&^KRZ+ =]eB-rԔOF+6v]?Xr&qIhu>Շ|y9{_QVC7bK-ЉL+ghRhagjjXPXiqF]kٱ<>I\Z3yaX`zyeb$B _i.JmR;X("8M\P% hIEaNjvkzbƕ\䙹叽CmvXp!!#i`~$E|lGcÖ\M"gVr99By i ŒbQ(:My|)sOB? j)_kJoquvG^ڮ3LAL7YxhxS fb/MΓHPH=&< [ 0l2c@I 'x 2q b+QvST^9$C noI[N$SRG95L/+MO|Uvƥ믓؞hhj fqC̮ReG<xzM](x,ϫN7 6gC~}L3ہZ~?Gb[O~G_尖UodS2[+!LE'"xaUbw 햑hSi-X܏lr~NY!^P[uo,*d[ZPP- Uf@:c)GimP\y _65_hQ4!cs4 @!5YQMEP ='e@2+=a/&x&0n@. *Jz{h;r jDjg#ǑmAL"dy]j)֬Ҟ4}1Gg̤ 3e:h5dWRπg {jS2aPDC ֳQGpQgV0?緀2MEV9$2! S;oԻnWsj,f%(y@ȇRQƶk@pxBv->L6UfOwVSTEP*'}ĝp9 {`g#"}(cLTD)gpuTFGkɇ;#qe.+9`yV3uJ"-Ic2؛_iS]ϰ9 s#ԫ)* ,Ã*T*+ikduҫ}or?  Ƌ K";HObt'$" % P`?Y*xq}~jC4(ONjXZY;g቞¥^5, lpw ϠuKLL?lbADz=s@16V&ZAS+o8],TT[O=,]!unV4?-:_ c,[f)y9Y݇z>RbySC?We7Rg%CCU[ࠂ/.N2f1W*8 ZSVM^Wj\LKT5@S3R#jx P:QMjh@zd`^2b5b8*a_6R,xrŎt–b\löv7w-p,~u|WzG?b'-ST ~6zjLtK."a8ʭ-'O<.QV]Y-_=S|ȿ=9"וܡ!i$p`Y26ROJE\ 7VC "m9孢=do FCB~:bGFѰ=HZ_}sG/ɨކ~{=XZmyFtoH@L"t\}݇Tʠ6Bz7[? E#*!oMפ;)}0ZR"i:v. EMF3 ogV@$*|E@}qdP/cu_lI1kCɕ_ 5:c#EI3a9ƽ9Y//&ւ.QBL'<\G,/*`,m>UdѝP,ؗNFa,RW0fG4۟:p_JҾQ&@z6% d IhDb6|//lU랢VA|ΩIh=0ҋbi20*}L\p:f(e5ٌKG#zx8drfU,,95ςCV;Rڴۦ  ;pS55WTgr>WRRwE9ל~faf拥ך\8e;Fyw6RW]|ggCr`#.pUd$7a4 Բ"vL/>lpeWp S,?Ծ5%|60vBޗBە5%oVME6HИl^lqLb0zgoפ8!D8D W9XJ}yXw*B/_)0 V>SHjnB&`/2yDw{]ΨL[Q39%ޏ$6wlF/~M~(+sBIt@G,VܟGBW,Qn<usڦ!JK=]1ZVg8Iz%g]N4Tzvz\c). },5`gxiN!T9͐Vp [\Bs cnza]nu}/Sٴ++Hvbr&!m<-#Q1܏:h"DKoQԱo<}#`EVRl')y a&@vX\P ].֫UxlrtQwpOl>H_r.~"`o3N2=qڰG X{˪V9|f nvo9}&tX.ג ߂ @X4[IB2hВF5o Uk)Vتo0mڥ?e5vG*-z 7d!m%u55cKg XT5A]ڟ%aiָZcs( ^.j܆ Jf)LWatd2&fp4~?>Kajyb;GxGܩHٿQv/^Q:ҩRԯU# P}ɁAEt'o *kw䍗nH;;Pj*N]0]e˿۱x}?;v>A_Ief:5ӵD׫gXM,Ze#N^Q"F!u |v+2‰kuhl $fnY0ڷI @gC;p2brKX U"6H.(}{Wz=>Bzz z{ u&=G Jx7׳EUᡀv삙)`fby<_SH:=iFƌ'I"11 6datF)q2utjØX$|Qf.XO>vOr)1$CD[Óuooսv$lnTؗQ>d$$W'0 T-Q*|7c;qI`P׽pzrn89"C:H[l6oœpddsnjMp$JJӝ/4t>$|gcS >QVkB2=ȷ]cw VHm"fO &#6lMqfg%5,i$`EEiUya`g]?dyь%4ufEɴ$ָ-sUdqa%j9 yO&]gBnZw} (z+Shx3-5p!A)S= -2m} ^3kZ2L(ӘR *qlV{$| d&{W"K3;83VLM츙eD,{1'$a6TS뼀[zrD)TR0]5'X+E # z,u#1. ČRv[Yc&4Qbl cIDTcD;f;ʓy0ss11H3/jX~&B4" D(,nSeod_:dDXdٸ"|ηbdFw ngڜ%P 6"sfBu0sX z `h86)Ps|Ew.YHe֜ 6-GFuv$ Ffm,;W1JMâd?`Mqdϖ6HI[x74ݼވM.*ৎ\\ ʅI3WW }3TVQg,*LG}/dQƄ%ΜŤĵ$ [ᔹpҵ"`XExyZO82ۥ a)ĮМP@BӕQOXZ E:}āH(9?FQ:xF÷%/}y@: 2["ՆyS JJujZw*9@븍frw3U.p5MOݐQH`?O{v9C. (=-fmd|JZ.Q 97$݅Byy0{@.<yZ6kLگ'騤I, 2N 8>?+0YR'k7o6l&r.sfǐM'Nu5񁒥#-oC}F}[4:Uӆ. Ƙ.OGhw u X '4월ix ".ߚ/`j^Мӵ݀A~gąٜ"VO @V$rVnO2PYŪ[ k ˣ#F`#PO ^hKF%Q.W~k%u" K۾Rma]|b U}㼹apC]а .a{L9>DѝH p@7DҺcՅwمZɑ<&QqC|X1XYظq ! ta /t"nfYik_,?K|d6^0rϙ=Q.+SFO$_CM;)j 5CG @pQ381iYhW'qF+xɍg4k5U ?٨jUk5>SR&]jeˡ~'$nd*\2`pxP]89g>$@ۮuǠM4(.vB}Dgi1v5-ٱA2pٟb`z!z ]=pi?'xV?FgV6"j줔DoJ57Bm5m HC711`eSvi.rK9e0tR=> Xb,C}^ SqWVLpp;ҏ4QetƳ](>bD}J'>IW@RKYBcUn!I)^bmLL!-꘻x 7 DBj!O)v8<m9-4qǹ c=7&ڕAx.)ja]ຮg-Wx5}3,K[aK$V;o%-ʀyO|F@y?47w^-Õp)җ|&[!am:6i-7:3$ | kםRK-3:›1OD ;]:wq8z%ǓvWz'z("iIv/4RM@C)jٽ}8]σ ~tflPY_ō,(⫉=^aE5Os0Ӣ =ʼܘ(_i đʶ_i?08%6 !ybom(Hı ߵwff zQ{-L;܅NRl![d'\Y@r, eY.2]FS4"5Mƪ{4 FF62($fۛ6P";{+2t5xzs~?dd4ё3"02i]݃+-޹U7fE~ɲ|p^|,_ lzmcX荐dݙ(8osZlJ-#Vs4 闐r@ \κ>)3oq b3 H= )U::&7f :QV8F8/M̀!>rt#~mS^Ɂnun̸|Nʕ.Z8Usx, oiET",PЅ鉺p <@#m !et&p0xiRe ZYT6B㹁Rm+-XDs3Բ!?ѣڸpr;;0 K-GÏqϒß*@6>8|rQʦ͜Tvv[m, ^e Nf%@ˬUip'Y#6֯5wX| ,75lߤl_2kIOʃz?&=e>۴V H%|ؤ, _Q@;s6RZadޥK*S8{n׶ItC:ȰTay&&&$|/nyf$څ'[l;7+R֒*Kiw& f6KO0rJ2>CyPK>L㣄j"Ԑ؋`^X3WuSG;K'Ez  g9x.v$} F횂j;`vlOuhn4re4_qߩ (}@ʦ->̝{)26]`(&yFPM\-h+qO +*lzuX+l7ys>*Q;Ho;:_^G@^k9wW,lz,C;zQX/HYf(,k{yUUm.zMA09ѧTzLQ{'YYr/K6ߺǼ2];2S.G5LX-Ȋa{^0ضbZ @"۹4nP f1Drá JX8^MML-J6"+&}5Rmȣ]@?ߣr+0PLͥwVC1uPKxumL:) *jFL r7F`fpw*V*ֽBC1"!JߞL6Ϊqߵ? H ώRHEnTA*hmHJ|9o wQ4d) .~Řt w\|GlH2;"9^6ja;<~}\7@P4-=:W\k/Y0Z4V]ppN2h"?s#.`EjD']9=>Èb؆f2:F0NNŘU8$ѿjbxE1sסl;2V\WD[܀Q+)hDExj8P}0|0x'#!7Y8[1VL2;iME:CG#I9{#ê:Mx;cYrxg-ҀX-g?z1Ǐ37B9jQP` P).?&Uv/tϵVB=&4<)ATmH d!̦ T=ŅPzP\)¨=pcWZ`kF#p\$sȱN n_x  Z$܀l4=Yｅ4bҜ/tkFze9cOq,s4)8>ti/ 'FtN|ZDn+fZF6ndH9"?z7eJ"N$$svY'ۜY[jSQ^\A *eiOowݫWX5]TyQ;}w:bM=h0}~,=ldb?md$a+pXv IaWZƑ9Yk6n!YٷwE5R$TQ#c!km:d`NjyTHS{6}  R3槧SSV xGDq=ss0L+tQ1&dkGv5N\1"`X1'!` /L{"+`w?ƃMp`(zvk祐, /-u5멋>-MZw43E9=]Z=c*E*?VUU/Q4dؿokN.<1+5sa4yBCTD(NG᳛g4o*þ~)*/dJ!Ѫ'dC>OPؾDw:Ё$y>R~doϔ1Ep@E!'ѤW8`)[l"D՘*ZBdO c_!k^ ^2YRf``=7+P$: Ԭ;.Dc/`!kYJLsl`3mZs'U5&Oôӽl?W |(m~b/o! }'YJUq dl`eAX&}e Ag+\?r,FD,8ɚ}on3fHd\(vOXB'-:ҶSjy#e%[IěUsj0ك #4/ӛ!GB]/ d$G :X󝐊b">'T¢ULpqZ$ZICqhqjGD;YxU7n=qFoE Z]> m-K*̋;h j9bt3h,4K|JNpҢ(Pb@%I3|MT*R;!N2by[K)P jo "{]KG oӪՓBW *~o~L_@ U eHr 6'}% =Zw敾EǍn̛5 _מߊtuocirryPk?ad˞2S#cezL)]ayӲcxS`{IAP _jvّ}tbS'V e h18hiA .#@{Z دECAVX`'X%rALzHc8R7Wo32vFԅ*#N"1e͹^\`yIu},bCXMN_ɸD`@*0dD'+N2]vW-4mC-g*Zh v{qXZ`\SIRg<(!wŀt\ؔڍ7.Sx,3ף.[$]F 1/yGY,|`%&nڂ҅-nx6)W,5ư<{_M/2p4j:BB(˰T Nr rWaFͦw07:٪ɳZGLA9Jw)u2;-7DJq=,nb#a CHNCH-&q dWpC M˵(6J6Jns>tjLc3aTK0E78ͅGCb$;W|C(Y$=Cm6q+R ،yS|_C0:PuHִbSRCUt+%0ƿw7`jG?U} <.)pH; , U2h0;dDZO"˾~b;/sk]pRGlHQc޾L`+E$pA4JmN)̪e *V:Mk= /,pI[lR/jݢ@Z:w]كp.(YKСdhHDn Lcv:)`5בdC$ "iԂeqKlgWVp]u{Y&ty;qVnt47L/1P'a/Qs3š)Č*2  3MӴ!$zJY}|W:2trPAH߬)"ے2s (-->x7Vd' d咴 AZV H&3i6c\z[튞Ɉ*< Wֈ!upS!*໴~6R<;IJnDqr\d` D*܁%B: fzi4sj F'#63\bߥM' E2t\ckfZh'Q 9ҖφlU2x 7TLu?w0tFIk;b65b WiL Y4Z'Ae$ENXSD\ ?|2-cyˌZ$I4nJ]{|Ȭ/8Sم0]ub뎶lvub+#}% *uuQ)¦u{dPY^V?$OU& 6檿s۶NzE dfӝf\q3Aq'?ݔPn@*RQ%g,R핗 vCnB`Hdmsvav*w02#v'<?,\ZQ3qΦ&G4or/Rt$xX9fYF,s9t6Ā`aʺI71ڱvWyr̲oQg*}IѹBD3/rv\TV\=/vmy;ãWUf5'J"oݓl*ˌC2,}J)]}"i61&ԀjLLE 6R%`q6V V+G ȩfԌjQjBĝK]e<)_fVp{v)I(d< .G ,WIVh p囊#@䚤6SE&%XMNC6) L/c"qa*HfcJv f X똃HK7B8He&"c.)'<ζ,giأ0U5Ntך z<'GB~o.qWAmf;'ͨC#k1fL,8 1ӵr*GX|p` _ 0+"<>=/&.~;!Fg-)yA4a?^} e5;1cgYNq05Yf'(\D&Y ӜjUI.B /5ϩPi;Ƌg;9Ry> wT*̴~2_/|GX@5 yOJ{=GӺTG?e$0`SV@Zc ∽bs_c906D8HA+?]2Zu|Ƞ-! *t'Ȝs_=<$M9|V4l50 Q {˺`'Ƶ_Hhb 2󌯰pEVb}rD|(^d!L6ePet VɄًIZſe@4I%HβNpAwN6'<\GCzَ6-?H~?r ݻ>gc^0Qlq|#׺~0kr0`lsm `G?~-y {Hyt1w9H𫲸U\U~Z,P6kzqH9 5.u,MoKY Ɛa)W9#NDE xܒ\-8Rrl  `U( @O@Ky;iÑ%D?~%u($% i"tۭu?]3,ΫO[eTY, ,_ۚWI9B{XRț5%ilAV;X'ͭ}'-gQW6Έǚ &=5RlouXG"*VT-U`^Y7~]Hvl#9F =iA<TrL"8-u:7P ay!1eN2iU}(~orEηAx"<}5+A~]e2`e cA^QJ"]J?HͭU & 4}Ժ*%4iduxNaU!]z͢iS,CGMޓJ#ڠA`e虙7,CEN}hN.2ykz?Q- 9"c;83}ӃȘϝrb׈b]U-N$3}mjdI&3cYmo3>Q]N)!?)qk2ˌd3~6\W[2?E kVƴEL@露\Z}x^_+A[:2I"]a"}a}Q(|]uMps}`6E^qx pI<Ώ չoZbMzITc͞e= J/ ΍I/\ >dۧp~Չ Rx"h$AH6!$*C~ʟW&+kF{-u+>_sV|RM-Ru?HفtqKa #թD2>(58 1HW3' ԋzȇ֑7ҭj`&kHaI-&PqJ) _Y,P0"6~ĽbN{cª\m+3'3?5aƍn)+Eyc7 KW˳I_ y^ߕ_!0Eq ¢E~k`T\ zCI}5.5Kŏ~hTd[ҝXX[€[eҷ6OpffR%.3 jI:M 5_di^.j i ht=-_..1׉G) FP.96%{go<C9iNdxϭcH l``0Z?Eأ)Gu|@' 3g98l~.' w;>`x1cm)gPMAkh߽x;1!VcFguHxmO8D22=4ץE128~КK+"޽~o^椸P̋-~k+U9Q,Z(Gi/M۟q#֢-jxhWdb}-$_'$lӝ;&~NPJ]xmӢ.U[sNcʲ| B=Ue88e"@,3<++= Gd"tJ"P?, Zj GFn . 'f-R-JTb_ |>ӣE*ȯKEA4D?{3emwkM ]#f/ˍ;KjF HݑeîCnɀIo)K|3DkeV-cԛ_Gob&rL&B)rc:慥c>.E W4SPk bX@ 8 z.qv5eQr'iiPt(0l@|Tr; 0I&PKF*Tǔ3CUE |Wx?#MֿҖ!BZqz濓n*k8[3?b# rӆfzT)e=/9?1A>q*0 pP QQSi%w|y; ۡ14+N-']Mx zlW6sR\)6#Oz&q aOӕ*p,z+;"S0Mcwϑf^ ca3KXk#$1wjFc{7& Y%(52[!"tFqBD|UOg>a~}-Z w+g}vGsn󾞏+hd0/oI6Y&P/p:6E26Fp3:lRtBkX2L~PI?7m5/4OF i1TLM=΀t^zB"n4ơt=S{8b2S".SүNr)0ՎsG vevi?ۦ~b8A^G؄r<(QJU? BNvCߧb!.ӫ /#v0nsyY+U=.9T!_@&GgJ`t_#Q&N L.&.IU~=x`Mj`)UqOZK¤mŸ%IۘŰML=(ц5TD2qS9_Xѕ솠UBЕ-.dLE!QgFR2e3`^1x_ lrR#fv ͬ 0d)ٞ+fyFB'X ld_LOTotDPE;PK6C7mŒ` P*V햤{vW=w{pY/:%}e7?u\`] (=g1wU bPɧ֊7Dbv4lxu!CJQ#L9NtYo,HY PRi vuZm shSd݇(6+q>f4n*Cөf,A=튿*3TwiU"dKSg,mi985wQMTf_:/+%ttO體 {F9`ci깐g޽y48JkAz5^YHaDT2;SEW^>UKrf)y4Ƹs#VIS3 5ܟ~EXۭ[W,K)%.Թl\'&\JwXSY,7"&_\`XJuijyNL^Hv>*I =%NY \+g ['^F Jd.@t@0Qu`4p/@^̴EjY7UH/n)z%Fj j6Dɿ " Gq%rP$#EAӏU]rIKIjz^$8оm(jITf(`)wT_Q?2jM h nGqlҫעu47V퇍.+wx ,uinKa.?3Pgd|෮-G%"gtׁibK33Րnv Sg5QIm*wn "OW1jFnYս˸% 1Koe?r@Z0{9)x!=;Νfo._Y"x .̼hu=8q.;Gp"DUD%/ƐCj;:`wR94=3SPUYY&9iA*:suJf;6ӦҾB5DRA94#+ؼd)`r*'%,fRz?,jevux ]kκD6BQRYb]pKzW/F%v0 f?+3-FB5:Rn:g_)NwA@Y~W!g 0%?͍*=+ZiuI"Wj1@Kv’ݴMMЅt=D'j-l6yIEԻNX0b._165ޞܵ[BCȊm!O0-1$W͘ \#T3l˄ET@lpОRVKў~sWW mH͙d4|~:Hnj Ufg#dY~(=&Ի'\H"O r )xoh . nx!13!%$6IpWaäZ6: kάuGLةie-(V06ё}d aıe0z<$J3 ?7U?)'4)t)L ~/AKyHVG4}oZCA,12~&JXB5 " K9X^vR}$%z٣mg1pI ohp>MdqQQSnjS4tY}ib`%1su NDaVy[=6\ze̳-?~ K '^p,NJ-i;v/ ?Zl6Cm;,)"l b:Y_9Nߟ%$ I*k/ލgݐҞ0-!MN0F7B6m?"K+ȹ)`HkF{ϛpՅܙ&/;,V9i G`ڳ7,od͑>q7axT31E R ]Hr%&7n_⺘M fSmt}i(\^1L稈Nj#&Jy; H$)kg?RHa?Q])䅬Q1!Ev;#oK)'Ti(N䃪tx(+uMP vbX5X0GՉXǏ73"\jy5,(I`к".%rmWl$1lls<M!Eb^S]t G"ww7?~1Bp%Z4NʆI{{.7IO1`U+/C]F%}\MG(h4> BO+ -d=3ƤWKYf kr`3w㍮c^\tIfWDJa =nBoXrҁh/Z?2SrN- g ִO0l 0o;e"Hȁ%^af[HT[# nB\UkiQφ`(tzۂ SDoʓ@2 Z`防%ZD h4lPk ]RƠ"f} f~Ŀ6?*V us4?5DG#>1I61xۅWP7V;$~!eaꨀ{+@(wFx=|`֞1WXj2JZԐ!1\zOF;<. y R5*j[U`=v /b70%[/L:ERoYL0*lȡ;y@`tcy| %(6)O1Ȉt,*\F ]l֚ˬs < ={e惊!+u aWAnpQrh:t!x]3LzuGۦ#UR'W|Dmdǹbs?rQ>{JX=tIg'FwᴂpAImsVcC򒆈$Wơ[v/v Knn( /h  (>>0bB@=H^Őg2_~ط|SHGڊڜB 4nâhJAX8`m{LU!6Iy V)?Dd3ͻO[E}ͭh9OɛEpGy>~ᰛ_^{K†:P?FQaL* >|&i+T%p(2çK ID-c,ͷ-4qvoqN\f!~Es~|* F)T5JP?7;[\MIsbiD,' ^Eg1!) 0s,\Ok*{uȆҳ/vTM\ioUI-5d2r hEpXPn\ۧl =]5jIpOˉLN/6YŌ}cWnnӗc*(+^:c}{}YT-L aCm-c1H <\J8 W˿iθ<{\xQ܋-UCg]Y`G+Y,:n+#ȵRfjYR>EՊuxQrJI++’X@#`E!FJgxeÔOɾ^vnH;YQQ!@L?&]j+)GBE|1ϵ)hJY& S7,qc(%uQ)NSCtB1{XN͘Qz>G4Qh?uim c$h>{0I&+q`t1wjKo[چd $ŋHHq7GN5""0##[Z"ƷL5DQ4eg[ Ъ󖣂SA"?cDM-AԶ8w42 ]AVx%f!(5yZr9-%(PW7_M:v[䅌w1D1vp{AUڵ[f/`Jwp:Ƙlղ}+= <"$0NN᷾Lh r_ }]C^F̈́NPJTlA:! O Qt*e ڑ@Eˈ=nyw)$y,BOdow^R\ǩx^ iʱfE5p}@huZ!bsܚd!O08;R mq`8>g3^z̔%$%k%P򫇆3gn!PҐ#NC_8~eRJ[+\ JGNzVucwjqn"cוͻ*&<(GɆ8Et[Y.`!+*c&F;#n +jfP.LQt4(fW0<Ҭ,޷`{nRuJSG_0 ݈ORC\$CrY4dw=HӖ43Gɮ3S 'gĮR`„1`gDz`Wsc>XYQr#n <'@i Y|Z2L*mqHM` D_XseLCK_moXܳ_!aب;U[]8m98]Уr7G4єUMUkA4S}M<=P! _^_Y9{7t||2(A5r٩",H*Ud.pB`)oVUÑs^dx2 :ocߡzb̠d7g:hQrՄe.+"( P;и@>)O7WIe: y` GH-uš msԷ:|`"+T}N})9ѿ-h%jwʒbD铐;,+֒9MG{팝::13i{x1G[ee#'j-,&/=K".(7ۯ̱8LAMI(# 륳O-xhbR'{DmP{nK)oQ\g@T%*3`>'Qk3SCb stVп0VDiʹ澯3ll!"]kf:f.vVsl gT9XHq:  MaG`cVXMCFśTTV(s)`Zpfr|S8?E^!zr-HqȢ ґM8UbAŝ~qENc}*:W/rǴ 3*e~:d%݄rǧ@LWe'`XX?w 6}:>m6w߉,x,$Ѡ9O>] `meИbe|Pk3C󯶲Hl3 %m(8K@.J%9VnZ2 זBRK2ajH\{t?{fL}5S%הu8)J>wGEKv]J-C`ZK棩(aL9Mr߉ 9fCEIz1:-[{tr.HKAdI0]uIUrnTr,ie]XA̭|텮"^ܚr[@bi-gN}7 ܄Ŝ>1RL_hTLϤ-2!} ! Af҆ט$~])М#8J&:9%zJˁD<|£]Jռ0쟽~"2>,8F QF@ǫOg;jy ] G^ؽq\=i .SA D"㭎pp fto{y fLƵ>7X|Kjib>ĝ`OQs'~c LPM073vA_e9sg7,0ܖ4<ÑF`-ԃ\Z$D"V҅6t\k}Ig +I} 9&K2鈬ʖ~x9 4Q W6b00{1.j0V3iY 6?o)^_lG9Uzo%ɛ{T ].Eˉ,r^K)=X/2Bq*~.0D_^,<BhA{VbLk3At;k2dE#h!i`H7 +h`Ǘgt>/d7+2S)N՘$)"Jeaa'nn,rmEQ)ڜޖggw (9z+:BY4x\=@{f=Oq~v"&4*$kpA}} fNC95mtx״DġH/(Тuu8i~8z[hǪఄmi>+ /0 +4yW0|b)_̋ ,M="Gq` -p#Ϸ!kl&  F BT9S\8R<} VHJH_*_uO #7f&AJ fPsl"׬.XpZ0~߶z1# mcΠ *'*q3={;oZx9\~ %.(6 ;GիZ#6.Ζ?#Z⺖LUp! 4vO9JYSbMoo6jYeJcԩhLD^aABw $1-k'LrYQcg-GQd!06>?JW;t-ZS %%lksr~ !>\6dZ!dБ3O27l)>'r -| O& HNo߳q k_D)(6zd}Rl df?zDkֹ?jHk[rWhod9QxBf4-Q~s IE yˌdӟV,<8r$Qp+Z=1/;R J{.Gf\{ xcZWHÔ1h&k "leg.I2CYg++"( you4>sL~:% at*`FQ#(௖G %- -={xf8=.'l\gAS2Ŀȍ+zhdr̙Bx2,!K ьD2".Yt/^%gKlMikeMioX]no;KWf+8?4Buj:?&wuV;o=+K(@H.$d]\$Jx+RF,I+"wI|=>+M&nki苅G1e?L("oo טVپ4"ĥPQE;`0ּ#GAk2[ȅJȠH䅔[K-@~G_FU+L}L(mk))(('=&1¾@|ۇTԉ^Pm91'\?m;":f -D=^2Ȗп6<7&/5'?"qLA@X؟Fg8|b̏!X>f=lhp`϶cVZîwz>~GU@:#ՊްlkavfWsBkU\VcZW_Xp΁Ц E)R~*_.꾩?ͦ;+q{sBb0n6;zEn]| TEW500SZ y=|&}e 片i@.zLd7Y}OkWC损! U7Fw|F2VR UwvA K$ԞKM Km~ǝGR7;@i_(h<X?!&\$`u|j g-ݶlnwpغKx̆`0H|oy]ҵo&jqoփT#[ꋱ/^ 0ث-..M;nENjV&5[ S 85AUlAn,߾_kDI }1 LqmA󽡞$mSWgz?:4^IBKTkE)=5^'9W8?+tJbWXk9,;56x=+<8xz>!#};3CR CIJQN ޹w)!b 8߮(@Н Bwg-kwizW\03YygEz+,ά@0"|-¦KZ]bà۞!U=b򰿑W֮eŝ0ą,Խ&7hN&&f HDۼ%ؔJ+8,D3PTvxkkگ ~{enwg7uH,4g{Ǩсٞg=9IAQEtom_4@lŨ]Sۇyx\tC^dt|4rm9\G;ֆOEP?'ir 9XBPy m滖}\mFŝJ1ɔp K xnfzHj؝IF`wxyEp D3Dm/;OJU "R#x# \N߲O= _5κz!qfT ~&0O\4ktHߔ}ʍoarV%b}ֱź%wQL3bk"8;F{ď9[+ftRz@Z(MbS.tG#%o*:㩈PwgHĈrwm?|)i_^@ޑ;qݬ=rQgFdR1B38SXstDV‰!c'nPN kPqq2wF;*nd(M9B cG ȕWN&ѕ^L k?Á!&gMEٝ o X6KGi:hTD?`t;_D@ `WN-k>|ҏẈid6 X jyElysgP}%B,YM[J^bvlxʒv,:΂fk.sKo7Q̜f$d 6ZtEd` Ķ?cmAqWo?E׆bx~E"lQҠgq,rmlɀʍkwOyÝ-RS&iVY ,NZS$Iq̠݀OꇩnVBiFK" SM/_=WV@HLG=afKPF $59J\2 =Y,\{sk9*+갉lܖ)^ CWDz 멹*HAڶS Շul.v򺍉qo֡}o]*|T< GI"lbDuhKN-#R 'Z$Vmupoo\X9Vz?PKSfꮏ@N(IxlT>/䳂^K3ɂ4M/&[YI0~ %,l1JhktNĬv|A=װJi\.ɪEXuaQ,.MTm:/иBgVgJ6~UVlBTWL&g@x9 %2@bKN%gK Oc]-RbF˄ soɯ0ʣN_NʚD#NitJҕsL8"!m%bo)IM=[!VE& |zիLc[T IoFd5oGuFHK>QRD5b7?bY]V{Ǝ1AO]Optj:йxgkj-.E#"!e&>> |U!:SA/̾jILc@=̶?e^Yܦ<ðwPfvEp6il[$)y}ij5P\4&Ab)uy0#%ٶP"CDÄ*M-Mi@>6 &*[hs% # bX[U%D3=8ʂqxf-ƣiߍW>Ko+_@R27vbM,0<3'vpڟEࠠGnW߹Q"`um:<;+"v /!gɳ\ M[ ?:2-dMنQQWYp++ދдhUoŇg}S~:04rPtR;긿+@Ǧ@<_˽QZit=f9P`v9d7:X 0oՋwVPs}$O;3V%W3xnNn`D/wK09N6 :F)]pfi9-XWD"m_s]r'cZ4.Ѥ8OG;HH+N˾f`O[(LX詝#UϷDƚ 5^-b_quL,߉tMNI5Rur֚^odJ瘮ʠ9 \SSOypCD~%~1xi|@>A2M^l'}U~G˝ݯCfp$D0:qx ]BÁG lTsȤ=r*sl{⯛)d4F~FC5Kc6#Fox/'~aORےSgFwdŴ=TJG0XW8*1C&T稶Т4 N?_$We3){~dFpGL/h6L_via@2ڭ{~U^&\Tqݵ9E^ n0I6hwF?'H5Ƨ)TI`Ͽ $gT3ׄ~hor'LkVr\&)v.5$Pw<=D_oC9a %eiBN a_x?sjIFN U,^D7Ǎ 0oԦJ cetݤ61VG7iKzNA\I(ƀ.O[ط7X#X V܂\$UWVWǰ)Y nVA[UQٳw

P2(qPW==5A^K0HXdRE|ߒff֛݅\SKk>AL#7[AE99&G7Wq% HީM-Mz*R* ~PkA& r<g2:̈́-nyOpbY"y@s\e.mڂʙ3Yjdb 3d`b^=Ty D]ΞLlՋǑbn4`R؍]5@B+r{KS[x 8TCk6pgyƋMB$XP`朕z8S6gN?bh~N KY66;"*W?{OFbYwvc<8(nQji {;NVlrDfx \F*C5ã<+Kp*6VfdSܳE`3ɞ2R# bG;jFHsS'41- ?Ԧ}>㡏<%fGO@~x8?reW.~D̄ )Z55/$za0WQLNrhtIc7ܣFQG|i";p<G$B9!0.,C  n*P OO29d9eF`6mp^hE P_D $ Ⱥѡ'K1ҩ"t2> Zo4;߀Bp {ܡ^7J8^r#yóQ` UI.T^P."`&")F*Þ,q3N/|arqjoBjz9V6GIrpNwwm<)' OJǦĹM`}*[كe\7K\Q{&dO`X?֮C)c˳7 ڐMSVɁk ;ESVz6(=3v ,hEǹ2ޛ$_# 5 / ղN:Clᕭ=1zdխSAE"!VJ}s' ?fhOrH,>;LfO^9<}$;ib )j}M0m6*FqAAc Z˫՘-?J=T\fH:thM %UӶfr*Z7k%my1|-hFq#wrXQܨbE!t+@?8sBz V'ȝTiP-T.A&iaCeX1֒ 4U4l'YZZ/ᢎh~嘭-g_O%kp=چ7HlXi.}E'"HHԣ&լ"nwVfb`奀on_)X%`EK*-͘=3#VyS]ӎ>2t|VE?4(Bqn=w%މߙ}26@zi-pR g+˃J]"fIx;!) #8GVH*ܷ2c &, v <ʇpa93Q_-SdR O z>ɧ)6v__H2@p~JU2KmvhDSNjcfhإf(ůj¨%0ZeeXFLsq/\P4Φ[vVm[9jNaDyos#[BM `"l69L7CVk5):v s՚΁rkv Ds2569Ъp)8"1dQkѨv|ք-yCc(U^7Q4jLO@Flf´|V\$ F5l a+f4vM6"o̧*nmbxH[_h,; =ءئ~1=s42sbge*zU' ϳה8RD?iרx+|gT$IO^y!sX5ч$=Ǝq@744tZFn9O$($g\+?4)P]!MLM=0 WMJ;X @AEy)W~|+_Ha'Ub{ڟ:Be Ec}tV/K8x=;W,j賁%R:?.DdT /oiY+k#-Bc暍7XثP@ 4{wSK?'K0#8is攛KUxiyy^OHPy!h3RB!1v?ObBJ_ibY=8~Flkk05:&X/oEGP4NPv*IBv~u2y{ƞq QgPΛhV+!"݋ZD3tyWI.IײXI@ei "= j΋0|l7?e$(AKQ9~uZidG7iU[qip(O\-~/TeQG0 dD.Ӑ*ɓa:WSvĜF0.QY1?]9Bg Dx :dBm$H;!E0\J.NDM27''? P6r͎jxBmQY;@./s-gU$!P#~)EYa03-68Aekرϻ(/{Ͷss]=ѨT[qhS|$ j8RcΏ IC;f4khDLM]UpG%{veTCYudѬsݱ.u=j1[ۚ'5WL@~lxWCQ?1Jx)B"i7UӨ;&9&>DnrUblpWPDMBDÊNbQ;Y\1}CʄxԳG5@.>V2'fDRd=Q7aŢ_!df"a8l5Uh@ 9x`*̪j\p$ݨ)?Oo}> $5|$ˤ6AE]=,(?ғiFT$C{ QvۺOLndlLͲ} G4MgE+Qʙ~Lg9\nP7Ɖ@KlZ;q%h{TAp6I^W_O1Oo4UK)n^ͽ HXLqQP 5$jJ:9fsQ{ef W|Pn W'H#lpq<enX$pXrAj " ږVq SY1j&Bb4XzЌP9&&7`+4)4l(y >Љ|,~EyQww=A,ibb6-@ i1#o@24nDɸZ tZ /gzc3O2#5;]Ca]xm>9=o8=c?0-g}k՜9zW;>&J2MX:A*'o^7?`A~6>2ˆaRYidM@ӡ{sΡZ2V>gGt.^WzZDštR#S̽N\ "h0n8N=fVn[,|)J!p,DigGl4blΔAR5t=|"CqNz軚LcdsPG=Y{j6Z XF'bpl̮c]/bkߖWgp;V\kl2̞3B @Hd0y=(57~ Z[95^ixeN=KE=)(:$1œF p7\p>˫Iy e>~'ŝ -kUGS0YZpK)ذ[ 7g۴š;/U}|*!sl̠Yz a_58r{heYZ\~%U{,'C̿-#ON"w潶SH*ηBם oBfzߑ4:*jy_qAhuCt+l1ɴTf!-4"NRFqCB9Lwi *M@YwAքCyC.)&f[4lADf<2 B˵S7R^7%HQ} ź̑2&{<) b|^)nߣwIܵp+5J D٬F&viDrЅU~uƹ}HݳZWCSE[h 5Qi\C!69,cTec`P `iMµWrh.{cfm͵&kE|aigMhܺp#|MZ*Jk!^fOȟ=ڻy,=hkCn??N|'0W2S-DsśA*\ t(]V-pf;B@=]J&z~yw,x^qݡY:^`w\x:b꣏y[NQVYMf5c֖zζ+D  JكО2*L?X3Qcj`Jj& \?DHfW(/+*h#Ah+ eߋ?=،l2|祿_2iM^M5n|2{E9nxA 0P:8YE(3{%UՀOL⠵9p(i^ &ߝ<Pw: n_YΖgx\Ko}Y/|{r2AmtY@GJI,,mlWT)!xz= _ GG7:(l_@Gz/EW;)ߌ8%)٧>jesðn`5(%RVمʄշ]WO%|`ƢRsފ ]K*1up%Uު׵vN“yKvфc,x́'ܒD.L AuPGS2ASN6׽&5+,Rշ (3H)sQ#4ztgB/Oq<\\(~"z9KxWA 2.8Ɖ;NJ:ͺ7Er n1ߛ`]dno-G Bl!2/DuV̴|pLm>?&kϹt&Yvmw菩dv+4Y'>X̣oƆ37A cGbЁlFP}ld/8Y50]D^J߃r2t&gN_Ic颹 OCt3(@OD[zP ˁNdqMQX]M 2ăp Z@%U(k9?!.;*(v[юPEʜ14`>Yh]̫kדbƸ3;J*T6X][IFvOJ0u3O?PqMY'QU~i5Y@g5U FT7W_il! /4e.RfX\]^R5Ae-_.))@ p0B[}wiN U2M8.#u Cĵ=rsQ Sd ~`yF8E,`9ƅխ0d08Z#6sҘt7'Df4QX (A0*e]7<^jJ\0w}IuzKZ>k"b9)_H\.p-E|8dmG)X*%rʕ(Iz% Zu+.])KFg:v4)ax٬N%HFxU|2lKl>ɑELq#w)Qܿ~"G5(vz{?j\64,JE9'$Z@(,XBԟwZxrr?D.EU1/&X>ÂR;|4;>6ܐp+0@z&U-ԡb~Wad<zTcחIǎ{\}p?vx@p ⷪ^!r&0+۪٥ })>0-c;lkN,vѧSIwhg7Lqlz[52+2~9ܠxM%"Ay;hºyarc!Qz!=ӶqO#X>uR9k~Tuޛ'̥w)Qˆ3'P0oCx]YIEA X;>/dT‹/{sP:uXo`,\̥qpY&,g|kJjb_dvפ7Z_n4'/VP5`M43oS D ,wtOIx$x!% m{&BKf%<{], ; mz`5)C޻+M8$Ήx&vK0e{Swq `L` ^_6e 7Jyܡc1#,, -}#r[:X":Ad^6lBؓx dGu{ё#LٻVrS}1xW͔-xg:|3d{AkI(W**S*0M}ḓhѭ凪ZZǯ*13 a#SDeޝhtwZ:MbyzȀkƭB0dvYV3ŧ-ltE>O2$>Z`bkPLIPk)kr4Lā|.,xk.UHcv y }ܗ9i\J:0v&~YZgJQOݪvZۈDLFHΩsͼQ$JMz BcVE?AYn1Yp62!T2l΢D70+ƅaU>6{09YQb*eKFШ8R)S ׼c': >Son挋_DZ^gޤᆮ_A|uj`qd|io0 ¯lTeN-Ϻ;8Κ5n- ڥw#~GԠ%Z^ہMyC큮rwK_WW*ce[څ]^Bii{{[P^NRCS8mdiWŐV X[sm>y}1[HEK_p^qC mg.J6snW|2=IB%w6IR4Tg혟C?^ǚpKmV}ۇBH k)-:4Vb?ֹ}^~Iq%eJ嶕h%$#Xwf8> pdԨdǟ8!N-:g:rpv _F s\mھ5TGn}A[My AaɃ1zah!57|J]cN,Cap#T gۧ3 g,*^91:? d[4O4sb&JSR3湓C?p/RW7|*ʭ?y'?ͧhFqN?¯f.:ħ{b 8hc\3QȌ,]mOicѹ4DC[GUp@Ci-tU2 ++;C]zRp8n4XOKilRq%1 c9">d{te:# ev }?;餀ܳc6Ɔ LGeXsq| 5T9XUw*l(7iRjCmSY#sa«HF]E[^<:hMx4J( 'U Lycje8exP?= +XyN.̿CcZTf^b.MjA8LCy"~'.:E 2@B/zZn˃5Z|TlfNTMBIhrmLrKcf q9ɂ^E+şˡMj'MbfW3{򯕻O >6!\Į>YO+h8'!AT )B[ͪK:\\y?Ip{0iO{YC w`_Ж&Q.<_T "b7Q5cl̸ a1Ce,Zz< # yO.E\c R9Zۗ(Z0IҾ:λFxF| =Rao~8F&*E<L 5 G7tW+߁,ZBv{E106CM$-TY)W|8wZ2硟3<[l@"Z;Nڑմֽ4cOO!'1w>UF/@^E2:D,ErKjߑ]c'~?՜~iBh rUA)K=KpSnٴh 10ymx O9M֍~,$AĕS#;v?ibQ[Y̴^JNxhe#aF&vNQ9(wGP b~pD:/͎.l^^t}V*EQP˸XA@?/jXzpokJ2eac"1a| 2|6|dk~& *4;%>-σF+nJ,swǙ9bBW}K;3sqilKQ .GKTî\-?p)VǦl6[ zHF2tBFc$'!c(Vr/ )) oNǍ+e>zՋ>4xwo!GPN`f#ɰ2ܣbo",\r-Mu[fݦ(KdFر$va:y :œ%[xh`qPiNE!Vu|a uf9Ucfk6%60x#lM﹢&6&4Teb}Y ?eh&p$ÈE r!}eڣ9 l`;X[Uj%׵~?sb-رL [81z1h  2{i&T ~aS$@ҘX̻̩Gtc!ᮃcAIuٕ&迨Ӹ\۪m/vzEc<^L7]"wW(O`u2ԹkcĨ󷡲c'B@6#n\@C͋}Ϩ?j l;4[F2|m N:4M7}@vt2t\=F0hD-($&+*p|'#XnZ En\hJP/ʧ-کy):@pգA_UWkTpGw>ia>=Fx+,/3l)YwN)4фc},{4J2/F,K~?k}b, Ll|Ӽn^s40jՀ RyGVi >+wl=E8ibhG$^$:?'+>Jma}Y H㟺Lٸ:9SD畍֠՘о `ߞO`>5" kѠrꯍ6NHbȍhҸ䨇}lA|,ZÏcu/&ZmtC_P4`Lݫl YTMw~6ei!mЪV_i4d~YVK(i!&H)(}a1`žPn 8w+[bp*"t^o |zDZwS&JWfJ̻Z|%cA 2j+Kݯ(̬MǧQWCC=2?J0+?;`L=$/T'?jNtJ+9QD,cpnM#5\"8m 4q{-GߑX`CO wo`nY 3tV3QĀ~IVH,9XbL^e):14(K 'pJ,bjYz,zfdgRlUMJeQH*w˔leRO렬%)ŊLKvԹ`+s-Z3|4U%I&R# U2Q}e7@# Dv_}oBh@V_@-\Ι[æssʺۈ1s )DmK%@=9J%D?OUA/0[xvbYJ~>IZeoJE1dz PyD`wW( iKִ2u"BP(1F ԗ' ڲ{nڀUgy"‡ZT њTn/^sӧ'} t=TrdY 1^[F<$mv9aЯvU={>f uRt^q_YF#YGy:%5l*t8B)?eK)_D+:Y._н50 j`Μ -P-]wh1l r ^6 ni:hRHb֏wΚwq6,+ajLUkT!%JDN[@3]Bqy{,mcV1umq{ DKzAI[W{p`7H 7Ae]A \!tTfAK (]P&>t".ƶ<: >( &!>m.D2POton"SWA-M:GH*kΠ|y2G=)P"MNUkc2nk-j،!v;+?[ki j TblOC@;ldYݎTs\( 7GԆA ŎUz?F'4aVMA,Ԯ'ߙ׫\d9_k9*0"ޯ}f<ʘ1g<̈́b"a<\ vˑW< t~Kj(>6-amIXTB PK >R}UN@ _tv A[Li&X=-cKT.מE3ČD/ls f fOF<Y<_xte@-ZLu6j2u:иoP['g'&ėm 7r%ocS1 ƋBcт &MόoAYy$ы}6OpSr &B: 5c*!K|ݻ1Ж~l/D☋K$K R7X =>#$` gv;ZByZGܶ|!aMAY]'ezuCkƆVեBZ{RS匉x: uv%1ʛowcx{:sHND@d BUK,خESx*1|M!–=ڽǖ A8xRGGb{Ds /!cი[v!WPC /ڃ6)+cj>ԍdSyA-5NӑޱdxVˈ1 rT2+ōXeVk9>>B{V,u'0tMJ\\f}y0ܟ^әy?Ѩt8ka /NjIa<Vguчabi.mVzHΆUUɉky]noj1E,8ݲ\ Bӣi% =ߑ&Pץ,P*:r%7xON-\n2bAe3.DsXM@dm!W 8xޱٳ&FNJ JcM| LڬC I㳀Ze"!nYVo,C~KN6]@':oNa iV gfBMwCE8@jjD{}=/s,ptX^| 9p}_Tq{cJE7kⴗIjgH C\"K2^Y̍P&Z1&y;%nm=&v&L`<ɮC>Tlo\u=RO\bP{*v<h ))zADbզGıgS ݳ􈘴5HEm֝mu[1j`_v HSKʚ,@/Wn_s]Yu=~X֫'bcd I=nd8 xTKڪz-^ϫ-Jr˞4`d}y{$a$爆!k/pY2VDlcj:טMZMG$Y%(JA={@1'a۬8߳xbq׹9eȘ؛՞ۋAMF) _Z{:ӔVߊ}pd t!oET~5e+ -m=w:!vB81 55Dp{]0 t,2w_k&F>Ȅyq (eBJZv,,f+f]kkY!K t-1K+xCb,#ؾL'.U^2-uk@K7R}.@E񌷺8E־$S1?x>0|NPq@ e1c> *}k)Q│ᔶ/VOYMfе8bH;ҶW°@s iq,wؕPcFx6dBԈ%(rۂl~U3;GMUFB>Wn! S~8gԊF9J cg#'Yr3\3ADp&}A.@g#d咁C ^4X[{Bl X8| ׮/qOߩ~iwз`'`~j&eAGGU1FB ![&TA(~kkyL"[7doj:]_gڭ6B(1̞W}9@. _"<,lɹ/nI Sd6s5KX3_v\k0ɕ$] Rݛdp^`r/zZ&@1%s>&- Cc/c"n41oR+%z㐻y 2_fbV*JeZ~W%~-Q h|~-i1gRYZT¡g)q%=PϴjPhy;qӈYQR+rEH旙<9qjYKS=/b|_$ygxa4:HO˱u-/nF)*o\[V]b~\ %GW#ho^24fLUMt{ )J6fo"S_%lWD]JM8F]Жy0Xen[>N&)3i,UzBsy.gP7˘~<؉vJx"d~;r+3 ܷD\Æ/1a) CBx}H olo7؀*AƟWtV=l&]ϖ@R.*ͅJgx1 [r.̈8%gS&m!^4]2#Iާ5K (S" )9<(pA(S.s#T_Nù>l/W'KeT oHnSC"$;ԠYhLd*ö=4C6]R36konsEjS>X%HuLF"MoL#-oc LIEd+by+a2Ҩ A˫9gm/>eU1~-j )XApuɵ2NsGj]PpVI줂?F !|RiOx_׿jI)zd&=:0[0{9*Fy:D ~5>[1sϏfzQľ3]oC? &Fzz7(| lOYPɰlke|~kngdG:Bi2'B>g o(7Pln،H΢vQ 0r6䳲\PE&!J7 xyV/޴c̰˯Pֹq'|I:k{1Q!+KiP+lXp~m}lLӌX#ھ+pA \735Ho0ฆ_gn^>[`^f`'2k'f;ÇhЇ3!Hp8H|}|F5EBlw2ʦTQ BwNTcpzXt?]\8{Y0;:WRv`,9aWh*eTv ,78G^V0?|;F#2DScKs7;)P|GM6mj9s>}H`TVd+ A,ZP-rL,hXxƒ5QA9; [U5h-,4W]@7p\Kr 9pnoxjƋ`ڵc*3v`wԙf]2OI.c׌^>dg!|%Y/*3]XNXy#/[Bu8t~p&94*;QjAװ?aXavSh$Z`GD|J$ .B?-a3nLw4$^M"^_BcJw;q͔P|&u;UAoSkȍg.TU$F Cyo άdpNV  0C C GD0vJL3j9~o4⇅iPl ZS€}?^>8{4ߩs~P.RI (+0yZe:_ "}x뀃kޗΨBR-@қT Uk#ݏڄsǎw^0`v5Ri̤- <O_Zs<<!R1yZV{& 4^J}<@]mnjq6xqd݃dȧ`}honp/"qE†6 1WQפIOcB25b77𥒕 d[Åq :>!9Jl3-,wjQ3}~Z\MgYu2f2WK[K ț@}gu-(TD55˴r7Fr::|wgcP\JBEY~= %$uOw<e)3`zSo?s­pMR a_$|y ˢV3R/6 m { 5y "mX@NΑ=GaJ(Tٳe:#C\U=|i;Yc̀-MkrgSk8! k[YXq]qmu2JH1<"5C v&(/J2J%3/wHdDG~:kդ@V"Ij}75#99,]NB>pz E9PK$bK s:3D0T-:9^a8]OZ;\9 kJX"$ͯO?HZEc',icB˜םT SiA%Ҋ҉/Er{}qԜLywͤ>w 0ZdNl;!NI³Kn=ۜ0Plﮜ߯/%}AN²ć}֯HֱnPyHL"^\"NDjY uR^KQ_юkZ'D*s1klہ֗KϟoGn|>^J1+3Gn0j9EZN0=?9U˙Hʪ_3NH j[Nud: _@blYv|Q:ŭ٥8dkcL@6U.iL\.\3ᜐBby4:A7 8G^?bqRWkE[aT99{RWa*J?Cæ%2AYbĪtMcEYG;DGfqwtjfMUo3=8 _ -cpyr(qe,w5D7Dذ[˰[Yb=`S;6@P_6]RC/O/̣Q|f 8$cjO.0RwB-d8Sc^`X["82' O0VL[ж.մYYyOAnax (2\iAM;נ +@ UܪNLU{=vW_\v q*epW]Jyl* h-2e6i:=g{_!eӿ!؏Cdy 2itixZ\GUsQ RJ ,D^["g~%__ '熊mr,~j9\+¶UbCFz/*~$3Gaϡٳg/"O=?tu2dG"Y]:WH a{ CxIW X_t݆qȘI&1J7W޻/K-3ovCc7Xڮ7^8WRA3TZӠfmkm7'أy7> 1OcἃFwgEB{蟜`e^s 7(5##|322"Rmkgz0X1i9Q7>~@ `;Y͎&y\60~ʨ}@ LS!!҃PPEdoS2o`J܅6B"፧XfCsarJse'9pnTOu1YOT:_l@,Ɋ ܪ+ K6zg"qMQHߋ7eܮn'OlE[ HF~(}fX%Xzj ʒ7{{;)痿|<+./!\{N7ZF2%p9ؑv`L΄zB)jXd~ =rxP-=vͰ8} L8߻S;6Ѹ3O&5' r,^DWMOD#, 0\ i#=᥌lQ"թ샀h>`Njm$EA&)oHR v\yac=N:⡩i삽.1Wjܟz3ֹ>k{>+}븛+GIAWK'C?p{&C7:V.%bJC*rl>#[h(>zP`Vm+J9ϝz,Җ=S2OB1qE\,v#dʟ 0T.*ylkQ1ŌpkOP?ٿhQF2Rm3+^Y/ Ǟ醪7]/Z_Wx`u0dIKf+l $0ཌ?U{>\%~*Nzg|oJC=@>eŏl v48=T-9|uw쿰|r? Y,Mb-{eQ cƢlEfDSEP>Z A.&JJTbzFpCCrZfyElyˋ>aK<(P';jPMlѬ]< -&JXⳝnyȶb4&P~o~ guǤ^PnB[sr߀GcgҪm _D{ĸ;v:s- E[V;J=fo3İM:Qv$h>{*" llHs|1VK43?z3Pw 4!Awӂ=ˍ35 6,'(K$ͽrƠG*_KJlGTc~{eQyr\H݂/65j[cAp6j1Q5q{$Æ8.xtaeKl5)wүS]ă{0#I]2/,u޷˓C7?65b̜Mn W*P&#Չ.lRh)"4Z ꙑ7N}*p* SB}ħ`;BH#+zB -'a:HѾeZ:lTG<DG:Ϳ=,,Qj--# E+O"VĦvh#^I[Jm%ISe/R(}y3⚥_o.] >.1k?c\x3ҥogG@1c}e@fuA9ls#v >nP_ yN6G%|ԂW`B܏IFB"po$2 ?H8YX&rs&5Ex7UY$Se?E^SDqS0X'q@E1|J뷮ẹ@NbB#\8K!NLxl[*EDƆ}uyΙu!Sq6.>z%R&)*Y,+@ mO AN[<>C"96|j#ܬڷ}B릝/YMDg8>q~#P>RW+, -guć6:Ob=WZZ*9P$yVܡ`WN)'>[tC-=C@MoOr}C^j{<#gj1R:2U :_D`jdl>T@V.)]C#ӽujZ1oppBD]vaSEdp+i:"~L䷍Fe3/9I-g{!pD:Lm~MsL/QTeU]mr5] )fQfFh1l6 Fшڇa6aI .]l0/ic`y"Yr1, i JRfehX2YBШ c#7 Qʁ+L+~\fa')M +z0Ǻ9 `ly/aceZU`1ROd]; YBSޖi8BAܜE\ccbJ"jlagvJY23BMl@ g<pNvQs*~#YUݘ|` f}I NqyQ"K@ ZOB\u=K?~;$/>Ru ]uX}M3O&A/[b"]E zS&'T[l7FT3C [}m>RTHdx'cOΡ37y!A8l#bA)˃vwĸP@Ȟb~EtrG2`ӷri7zХte:m="9 ++Y\Hl񫇼[+f$pJ(% f0/ '֨]!r3Il/Ldf"yo*TyOs1llͧya6B.dA<M2D=hsOiPu˄<~Q̰1ÿ),IeQZ -Cd1K]~YEj&}; ڄ; @۠Sd)A_c E)0uD<zW%Nd3e;x ;C_`To=dp"oH-S3@pRl-z`!W΃IL.RyGL /%GئB4i1G197,_VҐ(VrǺP2Bl&@'LE1Yh㘹_V9Q|MuU{"VգJZ'x'Ä̱>-+)\=rkfgsߏ^]kr֕` s.{ uIG<{+^6 }̓u2OӁ- Pҡ X83f¢YQpr"Ӌ^ P:COh0jF ~`}öޓ5)`@ e !xqwiң1I~q_È~%EK@״ühmIMj!PqȇȗDU;L[)WEvPQgQ@c]J:mS?{B9M{#ZbikurBO1m7&e6w$hYt|hrJ. cjeTߋ /<8%O~:WPm?˂ g`ߘ(;>a} 9@H1+)i-un?cC:Cآ:ܥ@m[}KaZ9}6]D"d" e6/<&ٖ4 IL+RD**~mW[[l-`pSfퟙxS22H{ࡨA>e#^| :Ǡ|Q鉋x[9͑e٩zԂNl - O`'ysu.2[RTOP)gk##.GRKEBsdPɲUL06>)i=xN0Hy\ɿ[X7@'z;/u5S!),S-οG$0 )TDzRPf+X@>QYe{ Zi(Vl XZ<6ѻ¯'{yl#֟? 92HoϺ<15̌̈́pyK[?<3ۆ o䅤O84swN쐎U7vZj^Bǔ\H^saT4ϝ5bZͶ@q~ ^bvXssYWU8fd ^bßn('M ?ɫ 9ްvS 7t(iڥxli5rkg 6+vڡ]1 u*Z;L'htxe0MᴂX4JNJ7PҎnZBXSV* Ȣ1jyQxodFʤn?ZA3GzVd"=XFި*׎DQ9_Ň,- .:;e/&"9b6L`5jD.̊ H!\̂yx7Po48/`CAQuСɇNJA!{<H2n9]06sh#vɊCrD,sU |ԬPCq$uƊ)l1'3vj!qJxie&]S)wK`[nE{ZUG@֚7M76_k΃1T9)Z9סLka|r-h;NWUh] 1<< wRvgSruj1gaO}C;YV3jtW]V0oڎ8R=vBQ.T 8]\Ǻj{~A}R,#0WS)Uh^ԄDZ=R, }Aa0G}1y F nyWm|^B:NT ga^gv#^ 'ct#)g"F]eÔSKm2q,!d:A4%ÿ:lEffà/H8<߾,k+|ET<Q$+FhQEM&q5KwUhHs-^Y JcQ"#b^kg꾳]Z ȷHjl=>iz¥޵@ۤ],%*P;uCw* [g!/*l%PBir9Yt񢗲a,^ꗉ#Vhpz'zP0.a.Seid*Uqb=E'[0/cT{V{JL:(Mr hKzRvߤZqY! ?.SUaŤطNwD~jS _nXO׊1FYi?/I<'$a.\ᱎ,y1jG)OFl顕T"Wnm}ܑBL ;@ k&I6 RBwUi2 Z!w O3ɽ2xNH|Mcgљ0B|b/.$gmB75pOڶ{@"\앰UӶxu*CIÅEV rc!~3in8uT;E c> /.-V 7LikZ8h[/' Be~u8E?c?RüWVJE;soukh\hvMI4XjQ48Ш2_rz;^&| ϱK'nuJ2 @V +0xN@Ng)1{7)`7@ӡ\joZQ^V8o$|t1X3_U0/q6N&f,EZ cX1 iڪ_. zǟEׄ,S]k+;Wn,0`źBp^O=1gp+d~uz>wq>J48ߛ.K=+4{ ܊j^LNX6vìM X $X5ŗqn=5~>4Z|e{jb`af/-|>`NIq@9̎ S٧/\㕻 j {WpmiKN_E];Qh|EN :S_Xs?b6ԭ$\氪'AŹnJ騽 뮛F6S1}/CٝB cvwOai_=&r[i)՝ܐZMT m=7p8-Me Ul%PKձߚ.!)d񵎻p]1Qu S'$( ˦{]=d5DoztIܸ205 @{6*)*VK5>ঞH!'~pcm6F{n'=n W5IJbjr>_{:S& 'mf^u|C>G2B72:ɢrta4W.gI:d|kʧTokD%A(ѽM_N~`]I[_^ɯ'Ґl1?G6e(Y޷L0i~)ם:xYy_T};/q;z`uvf7HnE B1  h\ Bv两b(Ӓo>jv0jr,J_$ȣ= X&\wG'L-R r5$ fi4X!Ty2f5Vʞ(;_gS`L-DLê3am ]${nMjsۥ_" "yƦ𣚉teiru 0fNgf*ٺ2U41zag_r:pi4! ۺ@TO$94cN[s]i~AREQPLBK`SB2 CkG23?x &Ff|3.+QIm!Y}ֱ6n_ umQdga_IK5jcH KwC*Ïi_x|}Ł R{Je3!G p|T,yRkg.Fh o!<<, ZMWn)ԙ7)༽z3iYJeg϶RB"I!sȉ}ie,M^c5ʄ'x97HlSa-)9 WlS%(1s,ƲH:KpUekSYB_xm6Hd S-̕#m"ǧa|,utR-sa%jBN,ffܡ&V |ezjk] C0.t,HGC*!L$_`b]Z}v qC,bj] T'{/Xi@`X OZܬI|YF |GOgGnԡ#?Q9:8|'$ɳ+UN0⽧,d G>;ʙˑhjD6N$:x;S]~b!N+5/mv~Bǣbp2gSp4P>CnZ8fG ^jm3Eѯ\ָ|0%𬪄'A$DrբXpLrc<\}Ã{ /5"g͸K9 vS4 + O(d"3d He4(d/'_,L<|JWk Etlg҅DPc=.-"z߄҆ ̋ >E~L6=CX_W2K).jsg^bKfٞ8b2 mVֆ۟#p0F%Y!"6i&?r_HL-Z&ms3g/\P.'eaN7ᥜaWרus`2`mx]Hʚh =rx.(ꤛg8VypdGp]NߠzO u8_EkOS)'bߟ+ך|XYn+J^86sS^q:Hs5y7#$VB©/7awϷD  Dbߌ%< i bRt{D;Ӭ& LZrbt*60!lsMs<Ձv6!p<8:aÒ+'Zl9)=dK!+"i9G4 wg:U CǭKb(:\?NkwB%{)jz תxn:Y2ET$EƫG҇MSVVH>tWEmzkѦ_/^DO.6T\9B:!z1X*W\IзmK="rX_nu}ئuQz{M+)TA8Tf@*8v/8e6”w´LybjBlw_ HW ^Ld{}b)=&"-ж,^ɬYllh6bxrɚSy\¶&M٬yM1T٫U}~~v}bk)mM<`%H^z[i+tF!=?{tDػAHakPδei*XtDܒ 4/./H|m-O*GT4٪DqFNX.OI?L%+yzdMwJ}D6edl}d P" r(&}[iũguϭ|5ˀn@f#nW^)MjɽLNiyAC텲;@?K=52Psrx9|C嵈. _c%#N 8`eho*JݡRbש֢*k=$]ys5R C{e8t$//gդJz^L|}Eyt VQ8:^'1;K !Q]ekY|˺y,WX[Ǡ9 lliwt_h/2xmQ7_֫>P2\`ՕيyM:ăoc]&8E447NECl*s[M6 gbpwwD3ttcP*r"QAGQ ߌ+ QHV[)1"++ήlHR5_S> [팞\($@ؿ1I)lEK`^ڽř$ws>xIXy~|!זcu|=T f1+21u?3T>n)o{u 0ЂǦ> SQR!&_4k֕^*;O>M+ǪgFAAtuL7p(wQ!.׳ I- -Uey3f3.4i=Nf҆;wvtqlJM%Eb }Ep@dNNg)>>(*cFƺA[ONe2Wy0M͵> g>Nch梶ktրU tes a(p .ݪȴLLf˭/•ٴm nCbswh?հuR5ck7h^yeYC ,cW+^[{>+u)PC 3Ve 4!6] NpQ?toE %Qc`9^zr>OpD [*qS{%v ]%!ɪ(0o0; Usi'l]%c0(VYws|}E)Ty*Ob #u?EƤ{Ə9e5eWEVtH'd|z}6qt#Xܗn ̿0钌}U"HpdViaB.{Xn"ܭGB` |򕁚bIDmeՆ&ob}lj>Fm|0NeP.] 󆫑niO8!ֶ30.=tgIíL=kr 8MFըhIVPP`j@SSjlK+^ VwB-u98MBF IjN㳼+¥ފ]8xD(aNn" d(:Yd=!k)o3Q6LOsnw T^5ZB$\L Bz 6K`1gN+l-7ў-s <]6Zu:U+>jo~ݽYaaqA  QlYض+-Xю:'w+lcct#ɝ.+n шbKɘqQ&T͌2 TSͿ+ IEo7ľT4qQO˓|PCbAI^-%(zY5.5ߩ *5\%5)dώ;OZV)ة0٩Iׅ{{ r{RH+հ퀺qS$zV\uU:8gj jH?$?^>շy_~;tb8RewCݰ|$.lAD=av#sHqsFnqمaNH>z FBC [|3"ؗArI>v ~TYl!& # }/uGmc;ɼ0QzV ib U9YyS3{?黕vHŬ|G82c^K-bg6vm/N0x^zSf`@@ѮĠD@=ܣO˛5; g|eRRL35ߵrvph.thKC=- ڼYer|QۿշRR@?p&eѩvwv$WP3W.ya 9s ,ad՜"<c8]ႤPIjR )~#.dz5Pq¶J5޳YFHreO冚gn\Fp Kh %QɈ'#';R8_滔krsh>c}".q h^iC#raP}cpmqP795͏װ6M;ޫ8;wpqS.goVt\iΫRb/cKf͟SĜ-aY¬L.xyٮ_SM!̑m~y0bZ^mofc cXn]!gUԂ9~,jZZQNsIhO`AjЁueNڄ!i/zV\fb I? зh\/IS58#8[yiRR0ۨlWtjR8zF:u> <ח3fL$菰 j2/Mgj\6!Lޮ zP\(ľ`̐y1\ b> ]Hpc{<"+`ٲfWʀh@!^Hr' z|ƲR:P%SQZBEB:mAE-݌ʣGD5 P"$ڠW\gG}y\ʚq6ZAS ײ<]>#IyWuE46JHPbZ=H9=B4},,(BMZc# ؽ!|3!vp]f\2b֘J跴l݈ٳbWP@5f-x)j/r;;y n>XᠱQ uJCoiDRyFnT*60&_zm :E@h:m㳞05.̣% {yt{PkHȼe "ST%ѹU9bH3-۾ !7򕏣WRW} QzfV3\~(lY3=vJd>k+ի ;ܕExy_QR5~}+VÅB(udޥ 77X?^ 祓bMJlٝBXи{ĝ>tz5&[=O^^1tJT]VZ$7nBQ#&sLä.Z|72|]r1$fK:J?<:4WCԒ`R'{Mo t[[#,J 9_)^-\r){mEvp4ij\SI/ dV?y܏8m= X`q2uO*vw-r80&=I%U誃"R#0k8թUc-%'G8@Y }se;P?O`E/@S#K AЈ\F1XVoLcI*8iź/sP'%/*UY9ﳗ!_pa+備2aPk$l03c qUq M䉬l "_ a}=6V* [ƫ)344j|̷'tNcMܠH"OֿڷV&XtSaA#ay ά;fOӄD.i;;*5,V$1 ;#bW9|f`}rs8}"<('_{vO]]b$G`rUʅV:VJ`_V@c9mo03.I v&mh=\ Q*-MI>K9Iu2nK[=-CzV/# M$KDƐ.]EwJxUPF@Ǘv!ʇ > Yt y4j1 o!.kVGŲjJ4]3:>hrK=a{O,ehQzMGnSlu瘰+I$ޜ]DR}*z-3&AvB\wgiJwG`k̦5Daװ3C24#z`n]\*¶ V2T'аN&{ yjx<2(8Z>L@+aQ R@ Z^A\?g v9Bzk#[ϗ$l\Dj9΍`{qJxoPTZWD3@Ԣ6% BO4`߽G}12 h_7FS#x>PC:<_M|fEpc'f~Z/8;^z 50mYVmK6z}>˸**X==?h̀6VQ1[GF(=[,̝P!(B%K L7R䒮x3wLIYQ jj({zj>QjZKӝ:{ʼ f""1{O /@~ŗ =ml7vLq @K0Ԣv\YCcENF|0$Zaf1 ,zAlCjYz+U64LcW\Hg&4A| (j1G^Z"_s3Enta5$ݟyS5^tn̷bi<;% 4R_9ANX8<k{C8nRFxUdu$;/aX,?Vӳ.wV+u,H* %gaj$*x2k=h7YcV ҬSTgXBޓVI7{O*JWY[2k8c<5 ƇqS[CuHaBW 1ƦY0ĆWz OtY0UY5^o}\iy=DkNTr" h þ# @jrl~x`{gGh1~2LTz@6-^(Xq1PxP3jo&9<Пjʛh7PT/WGUVz5G%;>sЎT*/ R#Wk!/6Ot@:z$9Ҵ8)NIKIeq2;~fay'24HbAOe׶ f0:<:e csk> JY05/ɋЕϘuf2_0"Z>6)Pn*ȢYǥLg? }f ,ýur~Wdwkv $|Uߛki;md^ 8EGv-b{uyUUP/mzyb]R?<ܐlhD{p(*LtOtQG%k"@@)̂Ȱ<҄,\`\f;'d!}r4"u/GM`3>YO?wēgec?f<;oҎncTl0gS`'M3û7&h=9(Ԇaw˖ t wK؄RIw뤷=^ع\*m=J9w0=(R 9z䩟.״ɬOM?=qh(YR]MlD;]lhzajJLg&l\i +kKxRϐε[SaSbΆؽ.Da[lX3Jx.8j]z*ПT>BuJq6D^Ȯe.~5b+ DBny&-@2oy-:%{'qVv ;w XxIo[Q}8%34aZLϝK .5W8_RA&/#7ֵ3^/@)j4 u5ċ*@ٺCI@E w^ s/y|z6t鷘rNH-'Fx.T3K-Cl)7WjJB/+TFŹk$چ [1N lmoaFMS~&.dwY^z2r@>jACA#9{Ҁ]6CQ7#q*!m+!b`b eN\euLϨ oPY :9< NUǠȲn'h-ρF)V*Iq> jD-lȪ4;le`ȳQQpTMUfKL7}8M@*]OOm@_cbdj؛;&}rb_J[>ķ^*bqY2!)66n2ڋj5*mI DvFJR1{RA!79o! ihE38U_y{ BѼBn:;˺]emRa( ]ʦC 岓4^HV ͅVXJi(?̓cKz)5[ y ȿ8;2_H0&EbFl Yᙚt^O d; G$~BU v%1!$L^SMtch!ac0;u4]̶ŝ(m{؆ShL/ $hŵNpwaySui40"Kq}!nFѣE2H*.?@ӕv \{yaս5 T( LUih(ԕgs- :R3'$TN:s}>aRwo/GɂklI]PTLf][O %fYߢ|_vDl`4h8r`Չ4_^>Fi]8]@#R6n7(B'@ Nc҉i#Yy"1j , %?@TK/0$QZomIObIZ3yE xmh9Dtz@6*[.!#[CeuJBW?eWネBp{fv{JIbE21QxzeJgճV|2W80dc8At:dǻWBĊNM%;T!&Љ (WV1 ϪB݃oN>F2Xxo`[aPanPz6__zp ׫ ,L  = +?xv+>M2 &e=zN:"ѽ; vu_LNO!\f2 Ji='(/U aӃDy\:,+>'%b/HF&?#:qÆcw3lΥיL_ԢÍLGh ޒv;ϛ2Ĝ6ƺ֒<>`Te8Sotn;|$*U̱N- KW{g zv r(VpW8p 51s\5pg-s \]H̔wFdAm*b>)n1;L&r2|'D!pmF SBW_ߪﳽ9z;Q'8sAnY)#S~ʀ}) Vlc0~%[&TmnZ$b44VN}JѐǼG8OC(H?;߼-'@NlLx?C٘%DyQyK[<&:fHiqJ䩤MpX!W8g{;E'鈠Fh<3ef?aM85CT216N(;,{oHak(*f`/dCmPpb jQֿ˵F 28^fS|G_tlfIYpn>tî̸W%;^A/rᦩ @eh*k2w",؉ GTYQ Ԣexe[']v9R%7!O}ux4L YFM쏒p4k9,$!][6 LɍWP9+Pl\).OG's=K]U2/[+hQCaZfJ3/[t -~L=Ո^ݚ#c!!J_q.H.Ψ0,2.% 628ޱ:Luٿ8 ͅC-"۷N6^q -g -d+_΃F=ntT. 22[xxC!,-@d6oMO뎨+*Ju6u1^zl8'S$I3GaM>x,O/E挌*fov> Hc2@&ϖM[i!XYdAe'R"Ds: )_t"O*"(YJ^U"^JWd z͓aJt&jV7}Ά[q>zSXB?$'lo3l솼@ z] +L(&Xtf qX£LbqmRgӐbz0g6/QiO}kOĎ_J~?Gf2s0~G$F-L)A07 1FjO iqs Q6-/~a H\ޭK~:*m8s/`֙Q2:ΖMhóP!0*Wײ+4Xqp$NܑtE/GKs}e+QE^(dUyb9gOnEi5=vne5Qeiz*30}~jIGn捧UhɷR |k'@Q֜h+Gn`q)BSCI&lxrId-tpf-0DpDn={IG,p8,V]r2Y'ۛCiB)or_7bn2)ݗI,@dYe\jm+KmYQDs]CiP;-Ǟg51d7_F=_'y.dwU=9 <{[LNksdwUnzPc kfD$-|E"o-C(%V$֜Dgۋ,G@$Xh2潜\m{?g׀ wM4 S9śX TZFYQ#s{0F'F ~//bճ7_ff,kixldOZd; ^1EZV$UZG GՔnD9PLt}wߙB|R.L&~m+݆IM`0ZUcNi.k,@O"_r>awcFKZtM@eu ى>B4t?! XpFďDMf6,G)gC*89c*%3Id]Z8j7 tR'1M% fp-!r6mc2Ghl:/ aab+R?cԻIf05b2Poᵾo J_eSFyZdl|͹"zvOw[b8qY0E%"ɢl&?+^Ct a\|BЇ Mf LtjK}8*Ka=#M}XjCS0>,T,نXBf]F WC3"at+Sup ׈|<W1y~۷L]9?C/*'M;Z}:gJNk]:OTKkv1bn>@0ZH I.Q ~e5;7Pl*D5(xgr]Yp4iT9fJ?*[%qlEO@<@uLŦmgq?*8*۱|29Χn/ܻ|֊<*LE&B))o6Fa77ujN"Ҵv@KG,;e̹ϖtSKRQ.'OUȠ Zr"zWP_]gwzS5\K'޾,ӃXC] ö NqzZ,Hx_&OR0,* ʄ(Zz3^s"MsDte_kEyq˴1|@>rk7\ҽj#Z)SU28KyG{,~+"/r ʀ"7Aև cnGBn-5z WzTD UT9o80 M@=aW; [ ZLUCN'˺ zmyo̰Kt)v$=ɲ֡3ݽ-wcޗ0"ncccmY PlcKK+JZW|axoMDGr%!ɉ`Z,uQH O @6Py域OxBca~%)8=1:q,5ovc?"R Ηbt(d 21fZ:U:3~8AF0li#m(k:ixǍ(Gg0q%#O>œH5I?"B0|=ahw S͂[DAxa!*~!8GrEMhO'6]U(9mgLш08α}P'4Τw2iV{= X ǁ7?:lJk\v׭LL޷q-2\y2_O4yW&e}S.Xfߓ&00(g k2VڴaiWuhv.3~U7qu6yC~RbGmXf|<"}t\{P"e @ \$U @WJzI{WP97OZvLl39<{j{7+_Iy4~Vc$zb\LJ8^ Y?r0NOz7wmRvN^h˥ab}EJm.:b@4' Xcќu}"wVY˅\N#.hoFbu/,-6׌? IԼB6aU:Z5@xОO䅟l6R{*;Vmaإ+U*R&xqHIpgѫ>ƞ8R".rBks7d"L&u"0Tա'ШO}+_ѴZ,lvxf\5-,tc`L26kJNyzGoΕD ^}cVjs,p9. !`P`UMpRPc}[ǘL[iI-s(ϥm" +W@M)̦f%;fئk!i4$u@E/~=/Uq"G{$Ǩ RPFHv>*!ȗ#8T˰U6܁i%/˗J2΢²u D#MW@•Y%y7u=R<+óndl\ǀ}<`" &@#h'фb5ޟjx%($gdycaa}+6^mb\"V5\ք9eeb׊1xd`|W"a.e"[&0BcЉxh ,(58^?~3+v[Z=J4f85&jYwȗj`ú^nx݅h㍦[#!6泌D52 # A/>LCwS>t2rT~otLM5^twWL&(SB}KJ_.ӹ;.iӀŢhT!2Ŭ1fcT)HeQ\h  ؐ!-}dHK?׮0^S4MbLy୥MҨ >6NbAsb9 U]Ȓ ؔ lBԱѓ+i8T!3h=B+7.uSe ;;fzy2h~M LA5sQ >CTSpAxD&J:sĦFJfGIMmVy`Cv/™U#2e 3bVa7m ټo1_P"_ÑV -0NSA!.74̸h3Ό{ɸ+ɵpwEV4=a{1qFG7~8ߣ0hoLk:2 Y}_JSw>z?-ZƲȯ4iEJtmQg3〘AKH]/͚PCY= V 8*-72JYa03OꔰYh'\Ic_ bs12\i{>FĂJbr>#8DsKcX̻w=̠09[ķ$LGC3v`v ln)/):EBddNרqUL*J7dW I$f!9fRga.mL$b񉍌vqu㦥5ĸjGK6:rkMWBO -eN<@rX-h(;uڀ1k ! Iú,y$a텷_1 fbkdA9 H؏T$xg_0:V|@R"2)I|ۄa+ܢ^lR|sab퓋u.a}ο?yNз㶸@W$+˽^&ܙ?u8 }OV7 o&Rid0|]|Tc() _hyyKd |kdA׎|9uN{Yp ρ>iL*vʇV]{w+3HcD_I=s^y'UXk9XLB= y'J$o\H"oGI:ApBʦbL96 ͚&ݪH^1ݣ`BI`eT?kuӌO@UV}JnxqW= DȟrsaS8' l:3_aC('l5"p=ݬqKǛFQ'Q_L pK۹ILtٗ`Q{ۯW]L*:Istͫɢ 6ET1#7%$ڌcR4C`7|3|Le F#b> 4?ʶMsXMʵoAgː+VЊp* teSnWJt \̬?)ž|!" {y -0rA^ p \`E(d)7RsUa|hߒ/=.$ҦJʅ DU,YCZ(Z׊Rd _TZþІ!4VHeYgS^ZQ!y"SIcX -$z2O5qHEpcmy2X|7/LT^p +@2Oe2 E(i K2x=g_9Odpe<3Ez6RֲBaȖHMcA-أW ]F+6biGr-?Xٶ]Q -$4Ww t;j|Qxg!StW薑!兴ݳ77ʍD4Ru\VY .+ϮRAoc"̍jϯ(bK/~FEvfVoia9AKфљlUfm7ځ>4wevhldWL38k?Ci^,2$|T_sk22x2{oCy) 9x#rf Q堷gef᤾w+9{Ζ{[hf^yE^S|OH?&D_dQw@a^B)B({kgF*/Ωj}ʄ@(bMp95?OH[hd>@?hƕaN|RoސqVGjbe"Pc9sS8.&gUfd|++(6#@Qs'1t͓Հ'FQ>sv chx's *A;J @y!lfcyf^y#e4 Ù[`DR #!1.wzb1!Q(8[sY;jDR9ȃťg-"0-,$]4t2) Eۀ`١{yH"}FQ R6LjgJr756nR0`%GGO٢oCU L+za[2 CuflAٛQoz#v؇ܦv>7 #3 0 eQh,y+ uGJЭ]0%8fd$]Yrt:b|7J0_^Ic4LAK7mpg{'zc0n\(Y}DVEPx'=/Yoq USǑ-}:"x !<7qJPsPҡJ4vA!^0TW{4+Uc+K` ݾv,!ą㷕h.#; p }n։1e7G-}3ĢDqTҚ _ߊIGQuk4u'*К*K#C*mN'AFl@-kY$ݫ jL]M {AYj`ŀPkr|33|0L^)B F냽Cޢlf94G((l|e݊{DM1zD?hID0 ? 8%|U)$'Q41@лs_m\7JO +1J3C`=na{3VdgP#~|/fy~[^T/ߺDiQ[; Kgʅ"?RIf\LI *zq Ak4Lme@f=:%wţE 1yB~eG 1QNOY\r`Pigևtڽeӟ/go-f ȳ6abpFa]+epL4qM/U0WQSRP% 'fvw*3 Ypk+Z/}f3n@T闕+X P5C/Lw8 S#$O%n(H-1W XFwg')9^ pZəGVdO?~Zo Ife9@@\A p(}=F*ČF܋jY($e<TK19@^w}Π{i3W cFTy_}j-o(oy@`ރRifأcv|Ba69å*ĺ9ځQ`,LrʍA'þQH9|/t)K@i%=G6bhpD=\R9t+']g?۫v uqɓb_׬M\Kr! bE1ddmN3O B!!| J*PUO{Gh7l.Vm'J z؎-(EXQ-Ie`rl!0 sO@T&*TTssO1" Qdb% Q'i`^TDjfA3#uPwobL1=b_i|]:a+Q YY_șIŠ\F 9B4%L^ %VpT4R9:SZlNArׁ9oSHh` d'q6W ƚoM2t.Hq$7sRw\2UI+K=F6 +­5޳u{\? ڭ`_F!aşeqHHgf!3!D~@i  =b?2{DKXJӳ;ۮYWLʙVI*4pYŠPkN&I*?Htt3R%,%0D( y}g]f;6R+:2z*(W n)axV9v!>uZSh}))zày e(BoH*5C]6LoTx 'K}mfS;ŹR s e+>> T1ځP[yW`DRn My9'd;/MmGXN@,0? 3kxjqO ћ|J葝2jey_{]WU};#n¥9;d:lC}_pNL _ 6},I(.˄wB7$P(4A-J[Q )l0?Eh?TW&\GGck gmeu>혔RךrP(DDbԹFM5f_0:Ƒ|,مH4OeޣGR*J0EW xp`ِ d5FaKrzvFRNgN^>\{ $d+X[O; "zb_} /}Br &mRrntIY_k'cv5ӱK!m~V͏ZDT^~Z0~Ֆ 쨉,,FL?_u`Lk-Q7}A}z+T_3nG_T &=Lɡ[ 9 q:T:ZTKOp"F"kvZy"Z ̟v/Nk1{{K|CoN!,ewIP/fS&*uQͯsW0uKIThtNq OF[I]N,Ep7C-*CRdz:_y5>Ճb~&h/-#7d|'[O`$R1D"5n vPA OFbY㏟8Wbc,ǪƂ\$bı?͓MŃMXq@gzOfM0 `Ԑ}'H Y`ylJ)@0`#/CYBv䴮xNg X=hAĪHOo1e{}6xTo5=(|0u2H]1,Ǫ.63G fCγkM|@ۥ`MR|/k^Vgp‹5FnqirrJrhO}ʥėbd$_*_J4woE{ g:ѥTp+#QoDN~ݙ_=i@SHȖ%p2Hl禎Qrj LzO.. FhHɲETGiJafxRZq(u4y 6"D-q g}3E)lZ0[0p6'*&\zVt/+hLAa3!m@ >jp&@%EJ);ޞo6zbd!FB'?pK8>M<9) 2`}m5=a%pIo(B_~xM(P 7Nzt[^)ꪋR)Oi8gn^Tz^-D#N )ck$ n Zծ~\ZE>}jg/L敐~WuKDQW@?Q"Xxǫ.78R>D nk#W 6$x\+:d/nXy4G6diTWPOg[,vFwgo,E(2TXWE P (Wq)ˢHR/ i?pg8ɼ4cM$ɑs~Ǿ(0Y4VJ^'?;u |^ubS!K]Q/+1R=FZ]e8;rh:ڡZ$m|Wu^خB6@ :jTwxvҐa.HH:, Z,[7Cemk nd۟ٵ}엟14Qdʪd]s7.}@2[nID0#uA`PAiUc੄L Qyuf;O۳ VshUHi,%~cXyyLV1-ȣaN"%ʐ\uQY]kk* cu{vu.TJ=5LH3e@E7Z;\6ۄ]We=֗]VGeGQ:ҚGʀ@ nX3_1aљJ}O -1hv<Uo#1}U.$*VΧiQ3gFxi,HcjL@?!%gy$P!в ,ꨴvņ O䣍3VU1(ud]{rͤ5Ѭ Fw#s[Y'6fQDOs,~ ) "Y#G5ǶTs ͌&\eea"nx7HZDͷ/zQ0ŋ+쨽Vn.Vo.C$t,}γ ҙIo }m۠!֊[J(ɕ᫶bjM炋Hwm!3%lIRE۾#[[oَLt.7X-QQq[Uc8nJWAE.]%vu7HSõ9 ؉=aMّ^b6 dlN}GBú*"Kh$q]ԕqkAEU?? lF uqv{r0qgR~'ωv@sX?Ṏ1`BnSl^<^6Knd=k/bEQSU2d?1 vrn?Rn޻(R7ve)*}잯6ݹD 7eɃsκPEWu#(J AIC$٧oZfoQaV\후-3cy7\20:2w$[N~j+HuEUR+<BeOlMnaVY:-E\wЅFp26f`夽Sd=-rŏӈN fu'ϥ4;x7Pp{G! = EICC=bmS2rL;9/ycE- tjF+7[^г| /ks E/ ) *+tŜ]7'Tgt]vycZI`ut\tav>L:=˂  isݢzE(e C=5DGi 3̓m`h_^W]ħN-V\ȿ[1p(?#:X- }n)^d mG{r,2+69r XĨپt`<S, G֭@~xXYw3O":Wr+w0zLEEhԐvs6e@cOkΫU5ʷaw[K;U`Cuef Z-tq n7HdLA%dDd,%R|dNTbRW()FP#dzYpˉ1ᨘ|+^`szԩ< cn`SM^YR7O(Ӱ3ьw`pljH[wx=*j;/8׫&;Lc}vmlL˰o>& ?N}Ḋ}~$8'T5 7 -ȫX2R 9۩ޟQ(崙$ajgD}Vݳ@D:| Aֵֺ^@ۘҭ]0E!q+1^_%6ڛm۶F'Cc5 aHbCqΏ7F8%+ fS#8:|nz8k&T9 7/kGklj|ɰ~g:_' tr a}RJgE\aŠkEXLҁL_,@bfuRu'$c!?,8+x02=W kG;Ѥf.RU94?ҢA,0 1XN[N0j1ȉp,_T L ]'KLJQ-cEFȩ֠aIG(qӔL 2׳ZS\ly~Ӳ$~gxd-.Gej0} ">DZ$2cyZt/z״ڌ?Sa@XW@lKWF-7:I^!U1J~yBѿd1r1%>qh0ó})e]؄ 0̤ϛdpDHm'SoMx(GՄЖ1 =J:Y)d~ʄ}bUׇ|qW_rE:!E?MkshF 6A>k שh ^-F.As[z("#6ޗMGg fLcR/uK1nA]QA96k{G|ehz58KJU7jwd!?4^Љ>U֨)knh >M2ycՄ&t#\oB͓1#/]HT+ٗt=`+~02X7˶X۟N{& P-*n߬r$+wIJt6uDq|Uz=T$PACdfsP?Njюw{<[@m'lo1:rt;WFjD%7'ܶ»hI4=bc&]S L}dh5&ީû=b齷>K|'w»v]$nxw& _5ɣ!$(rWst Q\6MjxmBZy6P@55lc NwϒR(TZ>By;_0@yO Ϻ͠Uv'3ΫD\!kZm7 NI8``&^fiΰ3uzDCt-;}EIlp){U1T>[2rz7 ,XĖҚҲk*mMB"ID3< E6N;p$) Q`JJl{\U+qY$A#M=[vF}/pF^zM`G J99pǾ rJVLm˼)t_u P0>:xWE;#: t2URTG vp$3wZ:ܼCaK)cyABϡ}Ŋk4`tZ;<{voA77nbE㥚i#yc efeT^^v`=q>mˉ-0#;a cK9 xt^)yނGpD@AVT _hMJR> N81 VPs E^><( "w{_{8q p:$ Jc2l*er&> BzuܗɜK{cņ =oVs6 &~$4,wf)=˽Py- k&U[4U8wpdLQ݌~$$0nE)<.lRt60P}DiF#ùUarŪ[2Ԋ+[G\3w=hpuXcv|L +zc"s';VB:KH:!Y^֯EKѻgb4;[%tդf ]0 K+UyjuNz!:9{B4'7Or)W7 ?͐ MBF=Gu{UtY3ԣ#NS>F#t;'x0'jXH⁦Sƾ͸݈Lu-A3RGHqTv7 Yylsl'7>&wږv"ڋBQYSd5Vh(ΊѹD@7>$ um6p0w_k_xj޾۟3lE@<i`%e:`PXj<>GtYS;/Cz^#kaq\|yd i(ߪY=.GIs,}![o2e39PB6h_Bfs)^Lu\ 7?+28%կÄaiVbӉ G a)aeK¡ =J>Ŝ|T3ؾ^EzX}N0DZJ_.R+0xаؼ6NП*(ř zZWi(,.$?r@6?d^ɁߴN*$qN-0:(Gbf|6s+$##%^n.X,FFiЈD:SJ`؏foLLLZx}50zlhƹ@ugMa0ihbXAK~u&Q;՞Ƀ9ķr?0L׸|Y&NRKUO P#.y_XDžȬUHrs&%4ƬNocpIx rA`< Ch' d-]872s\}>E ΨQE,ϕ`lG0$A~{i@Y1 Ͱ  ̔(В_E !25PqM[R6x@h!QM.W%nߪB z)6N$&HB Z{ocOI""-2,nQMƐģC4=SgVR@ /J`} 5''=9nߩ;dGK'zkpF8h0P2zm"Dzl"w0HlLs^o`Eoq߸Zv5OL刹\[=J@Ed,gSS^ɵ l|1Oڈp#-uϢ+%W8bOUYDw"X1 8^2eUSsBz%ԕ@H9%itc1${*PWatsSVt4s0Ag"GhcpNUMd""//(QEI9[ZFm`$yS0x. 5D5rjrʏ%.'.j@7IuMFI B6?:R_G!C.pW]×-Yފ0#^ ` ;HX+RᘕvԧƽO߀޸9 $eMe1P Vsx AӒvԆ 2F>Ϭ޼ Ѱ^_f}/N]zfN=fT$R3xtAE]}V*':p @Ó҂t!õUZ~gcD,7OEnq}(=ZSQ_ oRC%uߣrTqat?_( '2 E!`& K>!̋O.;%1P 0,JO}ň$=f>rLE#)+hPbdu¬Bd̍'N/Po=f#?-IsPO%sq6͖nכ*rE9:31ل5m7PѾOK. CwKTBLr"ݪ `h;L#nl447iZ0L- =c BEċx 7ճ./-"I.[gem"Y=Y|S4mϯh@$|>V޸>ٵz#u^"a^Q@ б]Jr7#*W Ui}e/Q\U^j^>P?vxl~D>9iGn6}eaL<&ga EGڱg; d*:{:~?+