selinux-policy-doc-3.12.1-153.el7_0.13> H HtxHFT] ?*}}}QW<ع %W/ q1'mMii8ba3f82c10289972ba4331c75a04797e314f3a00 hXQjl9OFT] ?*}}!jo7Zz@ Ptg3B> )#L'IJL>8U?Ud ) Flp      4  %X(89:GHILX<Y@\T]^4b5Rd5e5f5l5t6 u=vEtwFxMUCselinux-policy-doc3.12.1153.el7_0.13SELinux policy documentationSELinux policy documentation packageT[sl7-kojislave01.fnal.govzScientific LinuxScientific LinuxGPLv2+Scientific LinuxSystem Environment/Basehttp://oss.tresys.com/repos/refpolicy/linuxnoarch[ P i 0'iv./VQx~*GK:= N6="3 -(?$TK|rGtFx3zjD*!y@ %KE "  EIKv/s ?(@(9#mO+7TN)22L0A +W`jbD#/6o ;IT TYA?Ii;^'D6QF-Nc5 yKjuFDs&MDY 5<j"#_tHa 0vTm(4s$ 535pV=JlF4:"6!X:Sf `9>#Gxhug )4z ~dM[GM6ǬZqU\noOh_  !M1 i=S٢+; J#(@H!(f82 xIo7*>A큤A큤TZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZTZf90d6642396bd107eb2bead87e1f4abd10f50053d71665ab6c4dc0292976a653846bbdba1149ef9edd39c6f18d37f29e5ed9cb3670521f142ed6d7d2bf9f2b8342d2c3aa4d008aad3243fd00e4723033e27e253289356cdf2cf9ec46135a8327bceb4f36b0f077b7a232a94e214b3b0a5a85152e4d89c193f92ddaba3ede1ad636143f526a3916c0b576bec80ebd5850108fb1be802edda44686f6083bad5ab1fa37bac62fa2652703459d0d28d5461fbd5c707f006adf0742f6b71d25ab332f52eec103da47bbe49e1225281c6ea7853187ba5bb452ee3ea79285dadf158405fb2603c814cd87371165468cac4e9e9183a45427140b1f1a0ce9edae8c0701fbba9630e097150a635a4888bd1b63ba32fe267a22ee2d65a91ed300365e43f54cd362a73b335564b783065ad39f15331cf4b3391343bc5e6777ad955c8c616dd95b0459fe89dfe352bb7d730c0104ab29fe7e5984256aef06e42ea576d50532373deac70a29319d87ea13558da54203bbcd74e7c69c76ec7738b4f4eb2e1f8b9f341fe9ac06ff0c79d1fc1724838e7c55e2994028735d2cf53e639af4859034f000398cc42ed0a362d005087a637a60c455ee42017e470591fdec6c8e6139d0b7fa2f3970d3ade4ebcfd7a0340108c26acb9be43bf9af722488c010cf66686af0255f3a612ec0cd69c85fa054c870f3e3396ac38d2ddde45b6db5d8983d2e88cd431c9df5c11356faae0b2a36c8b4b5aa8b303d14b2f3962c86bce7f3ed0c129f9bdecd99b568e3c5c6ce8708f981b1a88bf88302dcf2ea834ac15fc53960b01496b1542030f6295cf4bff39a18e41da4914b1fbc4cebdbdcd7bbe8ae9cca9017de989ddb6272ad3d282ee9392c356022bdac2308dce47f3c1b14e8026ad4bf9b1d10e878863eeecb5f4ac9496e6907179a1af9b29590007e3307552dcf93c7e2fed3af5009c896434e58cad7480946e9777855d43f7a66320aba2802459fc0d85fad40c9df330845dbf8012931e66975e8f33c6b6cc36bd383b0e52259e67e32631ac8c5d1d1d705a61335645fcb829d1b7766ff1c4dd9d49d387bc8a2c0ecbfb2876b4dc4a4155e6064e31f6437724a574138106f41405eb40205778f8ac542a9fc6119317c73374414bdbe02a871cccfff31518fbb7ee3b3ff97a1131675dfdad3961ebf3b1bd6d0ab7293b0435979f19280f400a25506450390dffddbbfec110bf9c76e9f9ec378cbcc18a3fab2dbc09bab835f4366699a08cc0014b25214c8fec52dc3192d64a161d03abf39c68f8d79f46c7eb232d93c1f7df7c08d3f40b5c5dc394f8ea2f73a11a2183e90742ceb2ca0a956f307b271c74626ffdb49e17626e0a3c493726b61ac978146b5c1d0ce767f7179458befe7d2f99e8be3d80fd862b356dbdb283175f971a29f53b35272eb045557a6d18d3e9cfcca266cef6a4530c7251c1e514b6b589ed95311e16f12325af91f2749956cbe88d06808b42381f0b2e634aa903f6f9973b37d766b1ab0e310ab4eeefcf4f29d92d9ce069ae2e27aede5756fecde40c5829d8ba92b53e8671d3c96560115df05682e887c7ed71cad026118b9218b0e98f973bc6aeb64e9fecc238a95bbb6fb4c5fe6da3407ad0e78327143615f019f80967ca9226e2f3a9232446f4bf5a1005c0d433e18e5deab48a56b6993d4d80ad1f82d3f96214335fabcc7fe84381901b22a0783b0f4c2f5429906fa0e4704d7152fe56ced00747494174b81395e29b43ed611dddc62de59df460aebf25165e1a275d27819f4d19e87c32f7505385d46b7adfea5c0565058bb5405336cc7d3ae52aeb74843c6ef7e9d38e5aed91aaebc05c9e10c574d7a8d51a2e05c52e57bb76db04a60b3b76a291f5d81b0774e01e9c2b7a553d3c454f9442616b3d56b6754465e3c33e893d12c3c28bab9c099d1a3283a914ec9a44d26c20a74769c70a25edbadbe7a246e25bd6e6be1e3811d9fbf4f22dabeb6e2f71747aecdbd9c8735b3e7024181fbe89c05b9bcb6390ea12fa232c1e6689076eb57199270f9bfd0cfcef38242fce8490019e4d4e12de79883358e5155ade1c008025b2470167dba08f66f8ebfb5849e06aa90096080183050563ddf69678477d320d68376e39b6ec8de0ef4dad38a65864be31adc8d64a5832a62b865076d01c660809228bf79db5c7dff6705bd119773bf5984f3910fa69130b69570b85385b5f375b3afd012738ad4fb63bca0368b8b5c03c4deb6d49dc4aa10ebc72913233be15518e32ae265587cbe1ab35f6163bd6d8bedfa1f169fd7d8aa5cfca913bfb7a27143521539befcf57b69f0feb0f26f4edd22243dca426c39d4d3d56c581aaaf3559303767e05dcf682d6962b0ff8bd09d6e0e2c9ec129164b36e13c91d049359aa1db1b1327452e63c219c6aa5632e9bdbf806c2ea21cdc72e60580f1fcfece365aa0fde7003fd562cbac4a81bf2022017d7e313f9e28a417b777c4f1fc487ce554cd341762932caf62d73497d3c1c1250b9de3c536269fd0b484277a570bb7ce11bed069e531ac5ca99937092fd99a7544b74c3f19a68af62718e48abfbd225a38b1f5e003339776b53e76ebf7da927980da6d06df2587a7a329c6a85e630b751d2f2b2137064594293b6aa2fa77e0c0224d3b822f5edf0c6b06796ea80f789e7165752b1c7bd4f496924076d495b6ce72a51c972cd30477fb22bee42f97324d584ea27a47e6ea189ec713137cce819a38a2cff97aa1b6758ce4d0da42e87437c877e393aa690e7185eb18a019261aea72ecb15bdbbce0f66b3bb538574bec72cba78ebbcb6159b718a7b2b29561efc9125636311853c3b7bc6415fb62a74ff2478a3c965ef6b0efd8ddcc64cbaeb50df99dc802a96c55ef6122525e1859d19cc6fc6b5293b07e2e0d7d584d258507dffa4100490136e441099127ea9fc919644960eaa42b3e5a90f2f56297ac9d2ebc08a4ea473308597520623602b7157f61cb960f6799265e717a3db2fc92a5a280aee36ae0a2ac0e4a817be45e4a8ffe26ff9edf072649740a14d05dc4f457b4e7a21bca7084ce1f562a3e166924c144aef5aa9de02abcb44c57972a554ee8571a071d8d7270d7a77d54c75369e82301662fb987b06f6ed91822d0ee92b37ef471458900e53fdcabe27297e292d380b65b67644652aa2e8f7fbffffb9c0f45370417f29304673fe73f21539a50056c1c0b5ccee18ab36ae48e4d83edd1d33898e2841f74e2b05bbdea1c10ffb63b43fe37ecd89924b3e28caa76be3de11a67bbedb1e9d565f0aaecea7040b5222018b9fdac1a8401a18f10c0aa44ccd2c61f07df9fb1695d415e3802bdfb06af679ee49017923c14d554f1def8494d9ab39e0a2591b588a8f8024fedf079ef5e98873851f02428aef78c7b41cc718446201d0f464bd0b278573de7856c7db0adf70de80a63434e958b8732578bf985e965fba2ac2f7d21e1d492ddffa9f613a0819e38f512432bb3743cabf55d8e8f41d15e0250124fd056dda99e477e01a9e12a0993385c828c7274ecfafaa329eba09c46886f00ce60ccb12e990bfe87ba8240a6ae3020d43590085302934fcc419f4748eff08f6adb8ca208d25139631c3dc41b9aeabb0e7beb3935a6f1557cd7d0c668ebd2033249fcbe32e8b3a8b45617e0452382dcc78a7a72f7665a63f8af33b60bb38f1eeec88e8ab1dd796553b4db2e63a0ed5fbfd8fca5a1e91d8cc3c7b1f8f43c4ca1b6a1d43c2e2cc8ff7678d0d3eb6bfe593a78aef3f40a063ec4e3928b3202db9cc41a66d552d0883bfaf67f23a0fdd5accbd99858badc7df8d3542d7ec4534ec5c2fa4ec22c9d9cd3e8c6b98c1922e009b0bb573adca239db68b03bb4739d7ffbc5d78d0bcd03593122595a4aa77e6a152ab86aeb2f44b4241e4875fa9baacbf60bb3eef0c8badfba7bf7eb72c9d64fdc0070058d60944c3206a9d3eb04fe940713d4cc1c1eab7249798218f9b92c58ed8e7fd50413fba2b53ad04fe1d4d9a81c21fbc955d444df4b714ce61d2bfeafce4567ba820fa02c3b372416397c1cf0d67d209e8845c1054a558cde1955afe6b17475983d75cb75f789923074a665f22fbd1a224f473dad332d0309394f3d44b96606828cc64cb8adfbf59fa5a2baaef4b22520a3b97f65ea765c4a4e68a10826bd8e58f594f86e41ae264f88e669eef249f67f5240aabaadf48eb36377f7b79e6ae7a78a6a246f9819edf913a0fad879d95f54fa80c501e73da43a98774dc72e70ab66ef03b85c772fbaa9daaa3cd8813c9318a9a423a7f23213f036550932c404cf4f137dc08b5bb6432668658d13bdb0d94afff017f24e76b3cf23ced3a1a9ab128fa43617548ec58490de97413523fdafa1225cd29bf28119b03ab9b1d4aa15b0d5ada320c0e6269e30ba0a86c22e7a55acae9ada3f8c99e28caed70e7d945957eb4518971cc82c1015c4a17abffc021c95d1ce708dac995fb8cbb629c5df466ab4c2118a74f6ca9d369db9f9e199b0f89e736ca0c006bb9843aeb403aae3937947fd3c73c6c5177ce9451ae9798f703ee4a572f097b3250c356d0c0a5f854b8082b9e0f7b9a641dc1688229fdbfcab6a169a3a9b6947283f8148349073aefda533fe853adca621de432595c7622bf6dd79922d1cf2ae0205d28ac4c83b2058e152be982f1d876ec5e36d7e4d3b7b85221532291ebffe06708d82a097907aacefa3b532746ab7599e11a3249ec50b1974d8c99bcd2705dc175ad07466ddafe64c1be775c3259d22780c932faad72c528bcde0fbd67a32f116f3a55d00cf6fdb43ff2d8ffaca9042e2304b7e158f9e076ce90c543f784c31a3f699c86b4ba1288919e2dc6693d9fa095048cb1d296262941f0dc45bdf6791e7a6b8c1214189a14fbfb9ddb484f7ef0e3c3432ea3aede3dc80bb8e7cd5658c7905d67c309f0c75534a211b8d624b9af228a94101c0498a731434f294b97f4ab88cff2b0b12c32879b1306989461053b84a2527c2c74ab06d4c31fc1dc9bf872c1857a8866f48e29ef8896d981ecbe3d7dd2567e75c327d7e056b8ae7539f00f042298ee26d216bc7666d73203dba5c04b6795491e36b31cf15e543aa6c3d0d4d11476e0f60345a67d0f5a6967bb4a1db2648e351707ff194a8bcdf3ae2890006f196a0b517aa8da7f200746aa10b0a602c157e5840c2386efa8aa24c44869be4a4742e9045c9ed9ac744dfe657712a60177c5083d71c3918ca5e9612e72b1afe88b4e2dc098fb85e7b42fd729955f8498b6483fc800256297396e62818d4ba14afc4f119f7023dcacc99ab266d02b52c79619b8dfdfa3621c97f3186afc0a12dfc76bc540d2e6ebeb1c85f2d01ebce3be93482c4ae3471ee7081122a94ab16ab1c014bb2cf4f5649da23eb0075213e072c79eab6a5525407292ccb70cc5a394e766cdfe64fa45288cdfef499d8cf5d089ecfdde4b8e928087839c47717124be597b24913494bc22a2c64e4cd5c6b98745e206afba8242dcb145a35c4e8a10f310f20cfbea1e6038b7f0ef83c21575d39d945ad71bd95b0ae47317b7f54416af16796862868f8db6f1fa78c545ebe2ebfe40e96dd74c829c3fc2b753d39a9927b9f9990afe75ee5f9dd237e825e5476cb4e5c327af97c079cf12242cafd8a4bf9af3c6f0725377b8da49c49e2d1655dbae427bbea01936c0dcedf7a1f7fa49204bda0a69eab7685e916bde196c889e64a9cbc39b020b39e91bac70ad846153c2b1c9dfc7696fd97d2acb69e35d74155d2f917cef6fd0b675acd4694c2c5e482a23b7d1fde39e8990a6d6179c6e1ea648d9fc667f7a74e93b332cf0fc5541975b9436f5f07715c8dad8d7aa6cd25fb46f4323b4feb62a368d6ee8df039650a148f0ff21a1137f666dad53ea4e34c5e011e4882933a815d3c57e8e4ddf6b229a9c78528b73c0a64588fa4aee0a2fde322a1dabacce53474ac8ee3d3fd9c795933c93b875589ee4eb256f990208cffbe4d52f36d4bd3fa4e1275a138373fe137f26fb15f26afc76803b732065d91874fdde7a811ccd74eaa0f0fa2d7e67e7f882beff4027dfa6bd84de3f9fb49cf944b4b2a1869aa36494dd5713aa1da389957be6842c68442c31fee08be960c3882bd15705f65d3e06378cfb1b0232e3d67bb89aae19884c0f20e84895c07e803f3f694d94f17e306b06336e86ad4f5e1cc1fff766f5292e9f4cd15fd1cd08e92c0e1013bdbd8e26baf0fe635c1cfbadc404731229bce8768766cd5b31bb49686d116070469cd78b5a79eee6f7769d82c9e0c8c0beb4d74c4bfb52d4848fe7a7ad507907c446c4b7a4819eda5b789c3ade8bb9d6238de5153f24ad7d7814945dff697374dc35851b73718d04d06b5d1b0299cdf269c0d14c9eb20bd8cf52b0df3d0d4989d2c1e10c1fa7fc91835250fc4c4a4bc5f2ab0197c33900f1d38971c569de4621657be1084c81ec065bb28816cd9267a047973127c48635f0b5db465a3558e06c25dbcb6da6f37da610711e1ee7b263743eff5de5a2f1910bc5073333be05bea4176b572c2c8a66df58e1560005374d4af677cf0c546afc022bff119064b2463f48ae5a16d675c1e3378c12c1bcbab265c80e6a1e2a2cea0f907e86a0e8cb0761a2fe408ee648df18b0344568d08f420519e3aa9d2894b4f090e4e2723c170b34de4bf8470fa3654caab3a98f2908c17d5aa9f1164efe33365767056900760d295632ca18dce13c3a3b3a2d4eb1c8ff7902d3a2794ec98b24000ddd3915f3f4fce18cf1b4a51b3fc370775187e2af15999c23537b434505909b6f5474e0d9b6c80d3b9c638f0edfe33cfbaf86d39daf465b36949476419a08de306b004bf46e73dcd84100d6593259d5f9ebf219a689ce9316ddc6aec13fc470ffd25948368ff012f5c37c26afcbeb5fc2f51fc8b951746f42ba38f007f098df7238653c517a4ece25fd30e5032c6a936eacc47e9fef11ce966c480c02d2ce18154c38f20447dbb0da2c168ebdae506fb5e6da81bc547b46a77226206da14d0c044ec91f8b3354a0320da04bec5891a2d90155307d9e232511304cede544c806d97ff8b6603fceebae70b3d77e319a4fdcffa94e509d5cfc5ae43662161f645655e99927f2e8462ceed8f8630f25def88f938526a180186ce70a439b0fb30a07cbdce083c858c108ef2eb0433dfaf680bb6c1f98e12cd5c9a9b9ff8e84ba89582827e440a962c3ae4dbb3db68dc19ecfb5f69a6ad9f41c40141105df1537903feebc3848143323ae08c5c7337d97e1fad40b563e6f05f5c31f6e5777f3102899edb82d658e479bfee4b3b67b5150c9652a2ee4761b3c6977ba0cdcac02650b6d0d24dd6b6ab6f7bb98435b88df8a79259c55de4c4703938ba7806801c4272a8db2851be04cabe670e77613b9ede36481ade14f9174941b0665e4d15b3ad92fff4d845274ef0c68ac81e320bbbb6e32f37899bf6c4936eeb0deae64d13ab3d9b645e0740f634c4f2129ecea8975c7f514c52d582011d9f1bffe995251b4c7627e1d4a81f1cceccc5c3c4c11732709f79b983d2e58bd32498849d46dad535dfb7f5ce4a21f21a8d506e4970b3b407ae0f3b91180ddf726fd4c2a8fcdc2fbbd557d192bf54e96d1bc21ec0331b45ac6280217c93884e4874e1ca143c7884a718d2616d4694a5b131ed35d847b3f5ccefd64f123981c43396c5c851b81cf072a1fb98a417697957b161c16056972f74221c52bb1c13e92c3b84a83b068df1b35fe81cc7a0edb64f5cf039f7dd2fead9dd99e44ab16b4baef27fdff1a0365fd3c68eb3c7d1591f6f5dbf1ff01dae227a4e283a5ac59eeb0316593baf2ea3bc288557458d447136cd0bea2f375777a554f88b3f3732b26064965fada3718f78de3b36a4152cd7cce62586c1b2604d30e70a8dba8d10f7e08572bf00c8eb3401b2497f04c91bbba903f6b7cc0e617646e09fa7e23a5566b749d4ff8b81dcb129270fc65bb62919270d6063445697238d7a01dbaf52baa6cb350dbcd41b2f1b3dc55668a3fd15f1c84e9fb75c77baaea658cfbe1c2533955cb346630b444c019eb50c675448145a1f9a7b8ac0c7daa3829a272f6806db078ee6f504d6868192224718aed7efb2794f756635a50f54faa2cf8cc05af680ae26fc38791b6c254d85c83f2cc7d4297186baf1671b91c734c98d7d3ee1543eccf5ac59c65d05da8a71b8df202a99b0897df8cd0a3f337c91eecc3946c6d725a278fe5bc75c1eef77967d69d1d80b24add4244e3f04229303af50045ee33168ff2e7f1ce6fb836550f6a4626c7347c3463de2578127c64b1841bbf3a01f67acf6c7a66fa8a3dddade17c7528860fde7071569601fcecc52d877b526f40071ae2dad7f4ecb1c031dfd3ffe851228035b4a41822bb74627236ce7eea0a1dce826c1a1fbe2b5d774db383108d94392c5228416088cdd75a8b4ded9aabfb7443d0b341a3c681cbc9036e95f9066f4f3a857a746bf6b3f8d15590954d79bfec69cf221f67367e52e889c6f6575f122aec9fd24add2901474a4935670d8899fcdd21368b38fa42b5b6e5230e653f9ba2999bb402212a5c59c69dcc7ba92ab9e85eb32180c174beb4f406897ea4aacd27a62146ba48ddbe7ff2951e61756de46db8dae194a771c3b08e33d48fa6746bdbad563f7ccdf78c6c03daf1bafb94b10b6c148787269c927bc9c008e6902d96b72936b63e51161594733671de3c97e49ddfc5a1858a6767efb84d69bd2f090986dabf2d38eb6b5cf5467996384fb39fbcd0b86a059fbbbbd32ed4e8f44355dc5a86189cfc012660681214254cf5cb4c841632f436c1dc8e368d8188e1494f61e2528c25c97bb40514da83d9cf51de8557d80fbcc3a5a1c0aecdd371d6ff8170cb1ce8ae24a6f06f6d6281ade625babc372ec7e98ba71beb4e43c313874c087ca88d080bb889cff1ef95ace2e41be3640870efa59854717e05b0a7518bc303ab02b76c2d4002e38b57bea3191202f6f4d3fe00452c42337d7f7176397a970b3575646c279dc6b2e497576bd18f099ff5a66328e17463f0606c9cf2b5bcd9021f620aedb026b870d263a948e76dc403480229100c9fbd8300d17ee326ea9fa06186ffb5ea3704b98e0ab05b4159f2ccd91591b660ccb63146b4d2b8f3f30dd5ebcc64390954986fd0243e9ada47fdc50c5097097c108b3bc131949864568e1885254808fcd2bf2cd6a440a6007a44361bf861322f7dfadee4081610490be55ff9934e44d54e108c24f8b387805c326a9209fe64e2c0d560da6eb2eb0a772c7d3878ce29ea094e71f4a19efe6f46832e34cfe4e030aafa787f219b3fd0c0227c42189d766d2e38541d89a25c6b155c67599924a0078523dcf5852be6bbc90188bf4b4dce36cefd55f63903b3a0e97aad22bd661cade9d9e6eff4da681164e2a8b95fd91694e3cd74eccc1e7a643e66cf8b2abeb0c0d7b2741086e84d82e33711e6bb3427d4abec24dc7adbb58fe01fe689fd4673608a4a69e4004f89735717703e1e52c85bbe9d7fe5c9cfbe6be758ecf3fb7c6661d8def127e3979eca374e7bd46d7b7320bbced1a96cdb4d42d4c03ef0ae90ffc5ced57212da9b2cea0d6b2ae236643f338c5c599d7206e757093cd80e54b7eba41e8c3053baee62af50724197917f6d4a246c2c969d0796fa0a1ccb3f29683b96561bdfa1afe8d3b0c3114b44a97b5f66d9ea6e6c4fcf3c84f039010cf281b5520d54427b4c631b755f949eef93bdad12634e356c1e00dc0dce4b14e42bee72eccc4ec1d4027ff83e05494ea5da13732ea657e72a7186402b9824aa3c307baa5cac44acfc051dca2a77c8474a79fc9d10b005f0b128f44eb4c7569a32c96d191b9a50a1f9a7ca8d33113ad62a0d54a9f6cdcd64608fadb5d8653a582489a28663ecac19041db7778ceed81e3bdeb223629836f0441380a26c5b80a9f45f594eb2968f07ab72ad4223388363209421e17012b7b932f06791fb4364c117aea4a0cf8828c21108de4f3ec4446f6f90c78a803260803dec7788c1d81a3db309caa2363f0eb789ec5521784dc0521acc5f6f42d6650378eceead32beeeb0310b53aba103acffe869418febd7a35b4f3b6f6fa652af48bcd13207e841ab3f42dcd6836c550906a98c8f31079f9b6531bbd0caedb3dc257061220a3e6494601ab7d7a609a5f43bc97571e8502af1008e18dd65353bc1e1dc8828c74748432109175e849c845a1609a59919b966174fd06c46c4cc5ebaab675f6d055416dc258119bc8b0e083728764ceb934d4acc5817bd6f76929774f5e93181468ccc0becef7040be37cc129d9aca7c739f68efc4caaf40a60342508851528c4bfb06b685b425338fb436beb4e743535915a8c7e2c6d7e69eac2a697f713d3592ed3f3c98c797fa8edb8ef474cc727915cc1a44bc694e80a20bbffc88af484c196d56c52dd0fbda265af34ec347a80b12113e286314bf13e856f48840d7cc91d3cb4e79cb2c9453a5da620c186a4838fe1aefd5cf2ae285603f5a934fc2829bafbcdfb8e4966c3e54389910996bfd8888c7760427cdc23d9483c26ebb30c9533fb324387081a3a27efe4ab1651d4ddb4fdce744a3592bc47d4461ed10f86925fa903e11e45c7752c90f21f1618efaa4e9bfb713bf44442620f54abe9476e043c9e61911555ab48c456a2df0b7967154c2589bb13cb26bc8521efaaba2cb6857057fc57163bf3619be108d993fb7ef2ced3b2133dd8bce83640770030cb79a758a79fd6eb740a112d73190aaed96b017e3bfc6c6953488c7d42a43e5985f8acfb49b53dd41ba50debb9b1fc6d74338a307a5717a045f5465b85d4e9487f97149eaaae978cca0fd26eb97137c307032ae7289413a3d0a73ba870e6d241a78d6d4073295267801fffb674cfe2d6758191647dcf281aac9f4d0e313dd33cc78739f1780f35cd5203ff7e795d32eaa55006ce5238df3f904e635a7d83fa651a97478e3921a3fea7a838494a12a3618049a4e0d7a127166d44e1f21ab84a54e47422b0863181463ad1097347effff51fa9c0501c6bbb164b075983bf5bbd022d8070224f51a0dcec627377824800531b566a1e0f8447212ebd43dd3693f3f27618e7f7ea904adda28386ef825bb87101196a28ecea53815f08e37993781acf6f23e7903e3dfa8ed3ea9c3df1999789f745f1d1b95961ce00af6ff5370c3be92b04c06e27cb277e2cb44938afb8a646bf79ebfcb855c1c9b283d40b2ee18214ab53dd8e47c90cd72cb80f92fc1930562659b2ebe41476142b2d746ae11e173cd444406ee6c4d2b69080b2f7632dff6a7204f9f00289200df66153acabbe78a4ec99db2a46feb7279121f20ee321358ef58252d4d731d2951cad013a5d90f91c8d8e7cc4d19bf1b8ef0223a1ab3594db35cfe48e3ee1958d7dde623178acceb2022b32ef6c70d2450060be11d98a4b6f7641b61644a8736861419e08a04e059fdca61ee70b9700da11a7ceab3a67817be8a31887c92918338ee7c5fb8403bf3be077ea7ea58c8328a3249f682f97cbb0b12d64a3fee4458f2661b5d91a90d7d026b84f7e328c4f2978662cb9f16d958951df0e9373679976ed5b17d8c4940f95a14f710f68e49b99a8e642eee9c935ba55c2f13bcf2e5973a4d924d889608371ede2af01a387bc88a296500b5c220414c1ac531ee2cd32e35b4b3f5975a67cc5fd4a832c58a27e3d59f0beea3a8cf08f01c4bb1f092fe3f4236e442767a6307928778398570125d1fb81f800e1de67a181ac70da00db4ede97a59b696e72b11b395b2f83093e3846630e0c14a30c98af7ebbf673fc70cd793a345fc3ae39bf53e7cfa10a3e2b08a2de16bf8f0e3c00dac20b77e76f21afc8ecd0f9badd997802ef8da4a9e0c7d82c0e619b5329597a8e55e516a386b914712c0c2a2f1298997597f0bdd5e27e09f61dfc8a9ebfa919eb477a12d3b6ef8d420858e7e01fb1fc86e82053baff42bf800cb9edb5662810becffa147c0b1ec9869922de1e48086135ed9b2a470c83465465b8252a356584a4e29a3be4ce54dabb51c958d3a8c0f889bf2d2a7629682d05a491abf8d1566c3e3ae50faf1b71938cd26605539acd2ec42687bdb74fce94369c020842724e44ab6f6a107b6d4c7358e9c3029c6dd5023fb5c927683c9c36f18db0eff1bcb2d76d3aeb8de084fafab73bb9e0319dc99d5bcfe8902618a89e0317816d640f8166e153536b06e917e7673bcc6c9035f5429dce211a38bdbc292739eb578d35b6b3a9c81c7e93dfc01ea5671df041a01249758ef1562b767680f6fe2a1ad206e3b8e878e2953effacc725b643c7773c250b7abacba5028a541d49c5296c46b38494c6073b8cef99c75d990421db9ab84a9c27133e89c5a5413adb084d19d68de1fe0476ce75023563d0b7fc06bf72afb234f68a4d5d2847bcabab622d6051c38579829de812de23c0b4fa29d15f4de827db608c926ed4fef05ed4b624d4bd158136166da8711d7cd77d2e0d9735c3d8c453cb27680b5ce98d5132fe4decc218532bcb6ccc7aea02708b2bed0c41e822cbc77c909e01613c7ec632a3d4bf8b00213c36ca6abd04e3ac5d39a453d79a7696123996a5772de9870cde6982923c1fe5be880bb7dc386f620badf5ece208e673ef3d3d66a39fd07614566cae40b84e700e7dbca452327e1082582de133a7d4ab9e74dcfb8a1bac573a67d68cefd973e65a008748c2473dfad54ed88850808ee0f21b9daceb1e26e5d738bc2714d0bdb4bc2648e19a99a99157ddf84fa84c007401d704d9525a801106baa18d1333e111f0c578adb0871671719cdfd1c2469c7a34ed0ff589b4f8212a8718bfa918d2466b173f9ddfddd30e495dbe6f5cd75691532d0876627da7078a12f4781be8abe2353a3528f85d1dd633df96f578aab04a8934125d9cc04494a71e866d73932249fc256a6bb16676839a0ad68466768a0a01450307fa0f95a338da5226d8afaf4e19c62142ae8b2913c3ffcd1af1ff57798f44de918846a7d4b7cc76d43e26e3b944bce4be9c4c923da41e06fe18662e280a252a9afb3d61cf6e50d69a101ce4e50977ce72cf1ecfaed757f09d6b660628a44ec983057f6cbe79bfadcc3d45ca07bd1db9ad74492b53099996418c1a26ec535069cb2994523a4ab7177e1f87b78ff3c78ecb0c23f7c86cbd4e0f17effdce22753c06ded4db4732e972ba1cd1156f5e791ecaaaaa30dcff86af679b0a4a992bbc41dc5f716f000f74ef78d45b2ef45031f14e5c27d3c214a9eff398172f1cdea289132fe264fb42284d3bb93f19591d59b1e92466fd378dff851fc43520163cd4f99fd1925e15ca8abad1e4a60ebd77295bbc35a2122487c04293aae617bcb401304f28c5c2f0cf6eb16a5f1ae4462c6ed8a7dc8548f4c0d04bddae2dad4d18140c3def4d183c9b57a1a7b7bcc9b8bb9bef0a7299a2d2f0a55e3f773a8cd4a1cb91cec49aef94980f96c2c1b97dacb6be79eef062f31d8b6e026750838f9ef9f74ad26d1456b139f32e6e4198d7e82e5595bf8ffef333070deba1af1a85f85e78c4a7274a7665cb42f02a2c5caa64938164d2e00651032f9a061355e78c15b103b25fe7d6c6b05385396484d4ba1d14f17d5669d092c6d5dd26761acdce161cffe7bd4f34c1eec5017d131c2a1cf53c3656c024ba9cb30cd2a96900f383ff22ecc3532af1d416ef238fedd9793ed464fdc1e7558d2bb4765593adce723d712ae437ef3146eed2e18082c8a48b03ea2675ab4291ac38044c0c71801e233aae9556317d499a5efb18e041b185b3de78ed2ea58f4613a148e53bcada4519deb8e071b59821daca50834477c7a299c6a71bfc9cf77548c9127ec861e3754cb38a047e0a80138cd8449f889c548d3813d591ecfd209d08d40a635b71dabc9d561a443dcb7c2cb1a416781b2f86174064b8dadca3d12ce54fc6a681f1372255c4cee5b2828cdf2ee99363dced07778dade04be1ea8a92eb1dea73f1ecd0b94be8575310a3adc2a15fdba53042365b7be45973ec4fc3cdbb78d74630ff8b5e2996420022b436247c0d062fd13d49b12a99d2bd7a8beadee5684d0548ec09e89dbfdeb62cc64e1fb31f34394f86a51c8a5238131b713100525dfa3c08e617420fec41c3dac656923763097a15764e83458889f54875c72178f3712ee017e2c94d192b0e19e68efb6b02eb73189e210e214499042d494e7f2faeeb1572a6504929ae128129acfb9e3a26851dda9a54dc53a8a88b234bc60c45f4608f0e0a54b08e1a2cbf339ffe36a0c6e900d86531dfece5d282cfea3ad265ec86a5177de244d1fbc8fa849da4d4647db5c374d24d178443d3ec902b0965ff8f8fa0a2fadfb7ddba43699db3ebb13a9af6f83d508209d2e91d6df8892c9876b8771bc452c72cd39bd0978227ab279892bc9efb48d6ef7135562245a4caa78f16c7e538f51b49fcc9d8ff642bf2fe05950fd7855025892171b2f784894a6fa2b05101e7dee9be262b1e1917d5cf99e3d690e613e23242aa7146039e48bf51bc7459ac82f63d517a96134be97f236a34217633186ce6913a325bd1c30b05ce3f7a82a9a22ca23a8e98fd52e365f3574ac8f26d6aa33454085d7142042d262b022751abb4dd274954f381495c5acd1ec182c8a231f612475ef129101a2bbe6f5bc30aba0950d7e9a439ea0578571d89d38afaa49db4dd36987b4e44546b88fbe086627a39036adedd367ccd79b5b498e1405cc07b6654ce42bc7a5ed5c7af54555ff43e32ced0d249cd530564dcf8cf4ec2574dee39d5d874a21ff87ebd184984b612faece8915a7156294c5fc48af009549621190330fe41ec98f837697499a029b2ab75a2cba286dcb4fefa436ffb8e32eeb56ebc4180a75ca2d5a8f047baa3392e033a74d14e60a89f1f5cbe7f15ea6d80f8ac4556882fb9e6e2c599b4e296855a4e9e344345f11fba8c52326b8c0351923b70cfdb0241315e43627cd577295195b935d43cb37f65b499c83db6ceabf32adfe0c23ae7e3a15888657423456150e77fd10e502126e180bdb8e97b2ca6b476339f7a89ebb3c22f2d1eba256bbc9864daa1b38b181a93eaedb8371c981ddfcf0afbc7d0bee0f8b5a1df6516609207b537cdfd688042221e6e282c76ab5443719af678ac3059ca6efeac18771a41a60e11dbc7e60ebc72bedc874a22f95a497deeee1a0b7f72d0a445baf10b7e82adc145eea275c02850b65d2ec5f5c1bda738706987fd008f07dd1f35e2b5f85320c64f9cf3bac081b78a3564876a78a6295434b748fd7abf794013d397d1af869cd8a9f0f782d465ca214429c7546655b3b382f1de9fe07ce2802d97327c08923f1b24e5c34b05db7d2001921d3494cafb183f2b18045aa4e3da5f2635a75c94c8d03e8caf5b5bcba28157ab802fee813b6ad0497cf4c0bfe9851a031bda14175d8d008df86029fb3962bd60d20de1fd8f93e93605f49d4fce1db6e8d81b39e2c037318f0f26869c8ff50e348f1da32ba3ac17a6bb1b8c029573714c61dc10c54dd1a4e9c4cd20333c3b675370575bade21b82e448664ddb18db7b5ed4f4ef48bded89b28bd2db08a4e3145afade0ab82c820d945303b1f436f9eda6b47ed5166aa753f8fbe58081355d9cb172f403a35c9236332b9329c28e56e0a045d59997230a4894f24a8a23073af9b1c2793ea249eff0015de4f896bba22f0e5d6a91f45cc4ec613cf2fe33fb5b792125a7b34046b98050137b4dc74f3ab06c36921b8a9889677ab7a960e45a7e16d7651c46504205a04e3d034a16a64ccf710cf6ac03924be57fd9cf5029d30e5097610a0ec9f72c2a2e29046e783b36b662d3f4fc60f2689053e031aebdd277babfb5e065bde98b6236dfb9c7b1d55bc2decf80de9e03373a50cbf7e93461a0d4e37ff0fdbe9f8b04f9e912b97a25f5d1546236935362989225a11290edc5a62cc2bcf3e1acc41367cc1cb8f6d3d8fca4dbdfeafd265ef49e9af4bf0abab48c232017a6423c300197c812353cc4edd3660685fc363f2f47b3ff3417a802e102e0052e02d050d9d2048d38f24e3a017444a1c4ce68c6c40efef9fd2b40b5b0e1bc7188903ea4eb2644a25e7a8af603f3d5cbd6d5ab4d1ed35aaafa414bd4968e8b3dbd83329a418b8894124aab858392b55f3c54af79833881979efba18215ff5e5403445991014f393710487b0a4df2acadc5fbe9143ecae61261306874a02bea19594cce9d482b93353f9889d35f7735530aef810da2075ac9ef25ee68d89cb63b55c53f3f73dbb40b995eba5e1ee4a3dac3d80d4bfcfd36b4c43fd6e700c8d479e613426934d0216e574894ff4ae60a1cddab83a18be1c6d7df764ed074f02b34f91d6025052d555509ae2c3574b3ee5c7f6ad4147e0fd2a7c01559b99938fa31cfa753c52b61a3718033a25726e4dcd958b65ac791b200621923582dde54648d2af4d4b73b6523b1e8076173ed3d787e5f1bfdaa93dc7380baebf54431e30f1a95ec994819b2d39b1b6c0e218dff577e3f56edc3ba9f43f4ed5c45691f48a29300922f20e4fef241146dcaffa2bc13083c8bca788fe829d3d3b234799bac8d2c20b0d0df5303a71cd2bc67156a71deb86e4598db37729ff34e956eb36dec050587a44b386091e4caf05fddcb36ef13d38c0c2807e23bf0fe5e130866b28456d4b1c0b168d28425c05ee3d13ef99b4ef86fe47af49faee0e3209d5eabd959087d993799f98dab944a806f234f3ff3c8fb5a7b303c5025d517b28782bbe814a5a50f29139696788699a80710cee1d8a099b0299ef28e8505f9e5f20ef8f7c38cb1f53189c77bc2520ea1c455902d7035222f8f0ee14fd1d275e04b26a7163085f03e70d5f04c0351903f86b029f56f533e4eeb441e97bb791b9856accab15cbc9c1517f3400584b077bffeebd7cebdbeedb6b46fa78d3f786f1c062fc5eb807a0de2c9e73e87646f417450743729a6cfcb4a5555a5ff88f853b750d5c2c04fbc3c8e36f043aa345712266a91b554a6f5dd97b102d2726d339659cc43ba2995a557c13cbafe9dd1fd9a7fa20a6b933244f9c7d9fb55d7f7490e835521541517239ba0fbe84ae98b6cb1e4e7bfac75ba9fe1bd680767bcb58d0a3298b5934fab877c71c10acb29a8567457adcad870018d437acc96121b11ed8576cb2b740ec0cd939fe8d16de62301629922fc9d6e5312af4f4e22cef2d305733c11c1a56c7341c5d68330b21aa8bf95791eced526e3b0fb2c8d571c1c2ad83307785f490095fe2b3f5f6ae9671073aa3a4929e4b0adda5201aa4595dd5ce8336679d870b6e445897b991f036a005c3bc157da3fb1c414e7889843d2e57d0038d9ccdde518a8ccaaed2ed4597a9966432f60c654795999d91bcce52b16f04ceee4b643aeb188aab31eab77be86cc1018c0d3d5d352b2c7b83ac7e00e57e3bc77d84a47e58b4cca3c48224ee2c057a8b1501005ad35ce4ec813b7a7ca88fac3d836110bfa8142fb6e62daa3ff0d371f00996e354eea8f61ce5c4178b5a33b6cd326470b743f459eb5dc159795fad8f7f35771084cf5d6150ca365621bcb9a8cd5f70adb408c29fd55685562dd3ac5f6299aff99bcc3303a92d67a0a0d3bb0d97a897cb04c949642edec0cc77562b0c8b88885869cc2205107c7460733b26eeaef6eb6842af974bf2d2968c8876fc9ac8ba6945f87ade2d04f41999c503ff51c91656451595e3985da20eee317de3ed14fc619690a37737ded32ccc5203649cfe687bab02b48175a081c986364c49c750893ddff94a9e036e11e76520d67360a2f67c323ee70a060595137dcd14c66678f9282ecc57df76b97932e4cb4ffca1ac653f94be4c61d83043959bfeca05203e48af89131e8351668e1c14174e171275f0547082797e1f09a9c1ad58fdbc80d804ae61b175b9b4805d71bad1b8086ff13b0cb8b46024a9d396636de131f7595cec2fe9b62d5256566b0b6bba44caebb6d7a6601ed7b491271e6e449ff01695681639a58940b1b44f68f3e1026fb22489c2f5246077ff2d8587fb788da7ab321cd37178a6a1a453b5d9427ca8a8180dc1757c043daa52f910ee7b275a2b6f2917a07571fc097c7de9b2032eed1ee4fa315e9a381d12584942cd25969316b886c86dc73ef5882b450d860f4843c7847d3dc5e5fb2d2711595a96cf0d01fa11290552fafa58b0afca65e9de20f2249658295a51a54d3656e3ae2959ede86796d5a3ba4995b8bdf79a51558e94d5af39d5b14dd60c92d098354382243a947941793983c76dc6daa54abb4ce3377475a6b15653d9a53be11549262c4456de6e3cb52c60a31080dc83cbbf3fc42ed945e231c4412bd3bb4102827916428fa59cd8b00dc648a5c31dc379e3962fb0edeb30ae1f6cf8645dd5520a6a650fa90e3a54c0e939fecb9de573854aa98b67800492e711a831bbbe37fa25f8a56adbcfc20e329c0748f01f2020b430ac3edb7d2280857b545f3b0aa0edca3e5bc8c8b7316b8f804f9f11744dcfa6b10221012289fa8fe976861ab65bdd4d595df11fe54465373d095929c885520223138a374167f75ab8e81a734e26dad28d171627da7bddb76c747150c1108bd37d35d8dfb109559521781c35a1eb372ae4455be21b0aac95dc0374abb8e9403e9f54426345ca16795d71f1727e1a9bfce99cfb11e14a487beae7503101e611b29e6ea158a818af1c966719eef089d2ccf2ef394c3eb22eacdd6e9ce1495de5df76d3f8e67e4aa7196ef92952042544a08bd66f6c2a8e162328c6a6c0a8d2056d6fac70fce3ad2b6c73b6627257eb71b5001ee86f2512495c2927b75cfd139b9728e2c98b612c85d9fa2c378f5f70d72ebe5a117be4ca05060a07791caa27dcd4fb6ef38b204e8802bccef95b691557adc78208b1e906059b423b9ac18ac68ce9a35f872ee0fc019f963e2ee8dceffff9a39ab0692910441fce15539300fad700f935d8bf0de8d6a17c6370637f38c19cb05bcb02dcebb14cf5d1ac50bac908ed9e18ad90df795a4949ef2612eded2aa9e4619ede8bf68f56fe41620b356cc20468e8cf6fd8c5618a0a74bc8763abd70e3d51d305762a5fe15f4a893b83150a66009d53e3a09068d232c2d9d8523ed1b3daaa0e1599b71d92a9bd365954e3fbe1887e6b81f7d5b97edd64babe00aae5df6a9d478dcfbac75271c20c27adf87f23ef79900b57e1be4510bd60f2a36693ae82fa2e39cbcd2b0055fc6a797ae6b4ac4015d4cc016ea3350ce3eaaca595473525e082203024922c353af8cecd1656502a5271f4f446ff05b46325cda409c64bae94961a3060d8003104b838fe030cd204aaa455f5eb24ae8cf80486fc616798a9579a9292005b24ba3d6a48098bcc388fbdd7b309310e35ff555b62f7aa726756da038ceaeea3994a0c015040f804673fe0a23eff9cc112509db062ea529b631da6870646dc6e3a47011841d3080c8de1d81362787c836f66249b8e39979f2a64df60a63b448e90cce7a2725590d19c44a992c4df517e113580fe943852942dd333f0ec9964900bf5a1dcb1554cecdd53cb935c50a711a27dea45670de9aaf9b4e2e162bff307582254d0e9e5f3bcd0d533f9abddb5a13a3a375e52bcff1b32a2216d8bf09ded1a5c8ffcd0c0513bb729f4b6c1756bb5939b8c87303fa68ba9b8a7034dc6c9470b916052fc7efe7c7848cf913844b39d692cf4205dc402b255db9bffc9e8767f98a86df910e36a7d5c638ddf883a296dd680d7876c54be57bb13fd459220f374f346fa4af38dc4981d793c12dbe3488e579383f20857c8f5d7e4f590d7199861eacd6ecd4c19906874dfe90b68e55d708022d31902034a19ae8add324950dbdd7d334e47675c7e761a0f8878274528d9d1ec19ebc6839a65f73b8a3ea2694854426b31cfa2c1df6a884effc4ab08065b848cdd728f6ed70bc0ffe8469c5cae5b2e8c7cf2b7d83eb326c4ebdfe1d244b8f76f7762f3d3416d37592cbb8761066fcfa2ebf172aa8c913ab89cc045acf274bbf8d6973500e39f1352bcdbd045586608920a4b0f945d085e7e5b868154dff118b09e18ba77bc212185226d3d09ad14a3cfe7b8f0374a2695c0b9e8ee5d3d5be38925fdeac4cadef8034fe55e34a68a9c550f52256ede1e2cbd0dec7df45dc2f735b427fe476136aff47feb7369e115c4ff48785b82bb11e206730c6cfe88f8b6f1d59b87bf399ae393bd21b4dc5ecd4eb791dec80a087c89428f760f9ef09f774ba21638f333b0912232f3e5c09bd6a109787e5319a9185393e251e16b28edf9c4153e87863919d065c042520c95d325ba47e67f5bb333ec2eeaa5e4f5d070791aafc976674c4faa6932fdc478925168f5b9d5d28365dfa8d05bc8ba60c4d78dfe4f3496eaec7da85c9ad71fccee16c5886ea5b4254956af8d9d2e114e7c378d7fb4cd7c684aef905a04ea5ce0cb4e861c9bacd2a78de931cbca54d9285bad681ac10b7be0a59784f18dcbb49b30b6daeae34a7aa1345400f65dbe176319f26619c9a3ed3276434e60674e3ed7f5127654429a3bcd211e2de9dd0e5065de14e1b01e781d93212d922e57c0fd708d2fe6a7ab8b8ea7a71bec0de42076f7245d4c4484eddeae161c671b7645d3ce85c13d0d49e7891041e7ac5c067bb3a3c50d73e409b3b70d77bfab21605ccd83dc549c4ca6b38d12a55d554ebe8e5fdfa9282ec50d90a6c9c279333b500d31ad7033e81347d7e462532bb04b6877bc71ee320254f0338ff44f2aca315804ddc224b85f79bfef4dbeea624244d5422713ff34f5935a7da29732b5de52def73bdb9cd21ebe0176981b9966a72a2c4b2f0125767e901756d026cbb4662df67b662158d01ca7c1983b830b4ece5cbbabe9eb8b42ea1103f6b75896035fc6148ec5c61f664b315954d108934424463f30d86bac7a55ee6df50ef35974e697549c7fca7d5b0833dc49217639455c8071e6017f17d1156711ab1a474d2270a7a26229d63de10d86980a0f4f4fa8560ba3ebe8d1e894a60d0a0d0b83097d6b351bdabb1a773cd22c86f0584b27a3a9f28e6874b5b1094b41566f1c5dff89797edbe40ccfb5d74ebc0cac2de26b1a5803c4ba76d2e5f07d51330af91adf9ea6c0d1d572255e6a59be77d6e6e21c6cc6921f4dbd29c2ffeba523178f8da8e0584f20ba60fc5cd90118b9b43afb2f84fef5947e93f3a80f948e276892a0fd0b155b4453c0856c5b7316faae1c05b0c78c6a9dc5b63dacf6d1686da486a11d55779ce5e95b181f2b180862ada8c6346af1481c057882a6690355ce2a805ac4a5ea847b57d2a1c26a16a09a4a6b7769412afb0ff55fedfee349824f26f321cdb380d2ec29de46f569f4de0cbb538cff229048e100fd8f1e804021746b298c528256ca4a3bb756b877cfe635473bf67b1f8876dda54d7bac332a6eb9f9b1eac1e2226ed4df310eac2f5cd3dcdf58f5b5c923c475d6650c7c67964ab04ceba8992a0f0a9e0053cc6b3281a7643c3c73252beeac02dc9c3bbf021c85e62aba4050263773a0efcbafff88014b86ed6305cb9ab687e43fc20c257868abf580f8dafa60862bc8d677c9863084c84ecc8b563ecc5e831c0fd455bf1eba477d439b3fa65ace06a7a30b6cd1b38c7082b813df9d964d83e391828efea38c9cf541ecf4bd950599f8027496ea48998fe4ebcf4503e027c46a25fee8439ef81958ed92b98a8f302ce06e8c97dc690fadec47d717c5ff0d374a9f11009d4f29a0f7ef5566b0ff2aa648370b7dd9492795049a2a1c7272e6e78ecff687b675f79b06910a7ef08133ba45b58671270999eab919e5d4ca24abce90b5c1da2380b48a752fd7db8935bf4211b14ece33fd9ef14938397a091b956efefd26296a6267c6b630f2d86f47936be0981e03163c0de467035e6339e10c83d6eb72bdc7a458ce98b9523f33ec76437e3ec6cfc82dc8c58fd3f8df8b0297c36d421693a05f737b48c04db656774c5552238a949c9f4f461a9f58d79e4e20fc18326a5eb73276b53a99af58fffb66ec94e3ac35995e25c068d41277d20c808dfd89a7f744995851675a04e3f7751467f1d83fd98b45d2910d4920120fee50d2fbc193ec2db0e5d7331704a9463d6c26746284e8439647eacb65101fde10fe06ae272357216cd7ed99f4afe14aa4a82ee07ce311182490074bd740c6023bd9d92d7b1e76e3fa4bacddeea48623c20e44c30360b9c535cc638eff2b53bdc9c6eb6eb504e5deb4rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootselinux-policy-3.12.1-153.el7_0.13.src.rpmselinux-policy-doc    /usr/bin/xdg-openrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)selinux-policyrpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-13.12.1-153.el7_0.135.2-14.11.1T`TXS0SSS|@Sy@SpSj @Sj @Sj @Sg}@Sg}@SB@S>S;S:@S9XS5d@S4S2@S0@S,)S*@S)S)S&S&S"@S!S L@SSS@SSc@SSnS @S SK@RRR@RRJ@Ra@RRR&R&RRR=RʚRR@R@R@Rv@Rv@R@RR@R R@R@R|@Rz/@Rz/@RsRpRnQRi RfhR_@R_@R[R[RSRNRNRL RIgRB@RB@R:@R1R-@R-@R(r@R' R%@R7RRNRR@Q@QQdQQ@QQޞ@Q@QکQکQ@QzQQ4Q@@Q@QKQQ@Q@Q@Q@QQ@QQQQ@Q@QQQ@Qzl@Qw@QvwQo@Qo@QnQm=@QkQfQb@Q`@Q^QZ@QQQIQGQ@j@Q9Q8@Q4Q0@Q-@Q& @Q$QQ@QQ@Q @Qh@QsPP@P@PP@P[PP!@P8@PO@P @Pf@PPqP @PP7@P@PPPYP@P@PPPM@PPd@P@PoP{@P{@P@PP5@P@P~P}L@Px@PvPvPuc@Puc@Pr@Pmz@Pmz@Pmz@Pj@Pd?Pd?Pb@PaPaP[@PXb@PWPS@PQPO'PM@PIP@@P>@P8@P7lP2&P2&P,P,P*=P(@P#@P#@P!@P!@P@PkPw@Pw@PP

@NNU@NNl@N@N@NåN@NNNN@NNN@N@NGNGNGN@N@NNS@NS@N^N^N @N @NNj@Nj@NN$@NN@N/N@N@NFNFN@NNN@N@N@N]Ni@Ni@Ni@N|tNyNx@Ns:@NoENoENiNf @N^"@N\N[@NTNS@NS@NC@NBrN:N98@N7N6@N2N.@N*N)f@N(N%qN$ @N@N7@N e@NpNpM@M@Md@Md@MM{@M@M۝M@M@M‘@M@M@M@My@My@M3@M@M@MMM@MMMMTMx@Mx@Mv@MlMbSM[@MRMQ0@MQ0@MJMGMGMA^@M>@M9u@M6@M5M4/@M4/@M0:M,F@M$]@M@M9MMMMM\@M M M@L!L!L@LL@L@L@LOLOL[@L@L@Lr@L L,@L,@Lډ@L7LLLNL@LΫLeL|L@LB@LB@LB@L@LMLL@LdLL{L*@L@L5LLA@LLLL@LcL@L@L@LzL)@L|L|L|L{@LvW@LvW@Ls@Ls@LrbLrbLmLk@LjyLe3Lc@La?@LZLYV@LXLN@LN@LMxLMxLI@LH2LF@LEL=L=L=L;L7@L LT@L@LL@L@L0LLGL@K^K^KKKj@K$@KKK@K@KK@K]K޺K@KtK#@KKՀ@K:@KK͗@KŮ@K\K\K @KKKKK9@KK@KK@K@KKKKrKK~@K,K,K,K@KK8@KKK@KK@KqKqK}+K{@K{@KuBKs@KqN@KjKie@Kf@Ka|@K`*K]KXAKTM@KPXKEKEKEKD{@KC)KA@K;@K2@K0K/c@K+nK*@K(K"4@KK>K>K>JJęJH@JH@JJJ_@J@JjJjJ@Jv@Jv@Jv@Jv@J$J@JJ0@J@J@JG@JG@J@JJ@J@J@JJJ#J@JJJ@J:J@JJQJ@J J J|@JzJyt@Jyt@Jx"JrJrJq@Jn@Jn@JmJhPJeJ\s@JW-@JT@JS8JKOJI@JCfJCfJB@J@J@J?r@J<@J;}J:,@J7@J67J2C@J0J/@J,@J%@JJB@JJMJ J dJ@J@JJ@J*@J*@II@IIA@IIII@I@IIIX@IX@IX@II@I@IcIIo@Io@IzI)@I@IܑI@@II@I@I@IԨIд@I̿In@I3I3I@II@I@IV@IIaIIm@I@I'@II2III@IIIIIIII@III@I1I@III~@I}Iy@Ix_Iw@IuItk@Itk@Io%@Ik0IeIcGIa@I`IVIO@IJ;@IHIAI>]I= @I7@I6tI3I-I@III9@I9@II IP@I@IIg@Ig@HHH@HrH~@H,H@HCHHH @H @Hf@Hf@H@H+H@H׈H׈H7@HBH@HǶH@HH|@HHH@H{@H)HHL@H@H@H@HnH}H|@Ht@HsVHr@Hl@HkmHgy@HcH`H_@H^>HRa@HQHQHO@HFHFH$@DX@DU@DN@DN@DLDH@DGwDGwDDD@@D?D?D;@D;@D:HD:HD2_D1@D1@D-D+@D+@D'D!<@D!<@D!<@DDD@D@D@DDDDDD@D@D@D@D uD $@D D @D @DDDFC@C@C@C@CCCCCR@CCCCC@Ci@CC@C@CtC@C@CC:@CECCC @C @CعCعCعCعCC@C-C-C-C@C@CCǖ@C@CáCáCP@CP@C[C @C @CCg@Cg@CCC!@C~@C,C@CCCCC@CC@C@C@CZCZC @C @CCCf@Cf@Cf@CC@CqCqC @C @C @CCC}@C7@C7@C7@CBCBCYC@C@CC}@CqCqMiroslav Grepl 3.12.1-153.el7_0.13Miroslav Grepl 3.12.1-153.el7_0.12Miroslav Grepl 3.12.1-153.el7_0.11Miroslav Grepl 3.12.1-153.el7_0.10Miroslav Grepl 3.12.1-153.el7_0.9Miroslav Grepl 3.12.1-153.el7_0.8Miroslav Grepl 3.12.1-153.el7_0.7Miroslav Grepl 3.12.1-153.el7_0.6Miroslav Grepl 3.12.1-153.el7_0.5Miroslav Grepl 3.12.1-153.el7_0.4Miroslav Grepl 3.12.1-153.el7_0.3Miroslav Grepl 3.12.1-153.el7_0.2Miroslav Grepl 3.12.1-153.el7_0.1Miroslav Grepl 3.12.1-153Miroslav Grepl 3.12.1-152Miroslav Grepl 3.12.1-151Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-149Miroslav Grepl 3.12.1-148Miroslav Grepl 3.12.1-147Miroslav Grepl 3.12.1-146Miroslav Grepl 3.12.1-145Miroslav Grepl 3.12.1-144Lukas Vrabec 3.12.1-143Miroslav Grepl 3.12.1-142Miroslav Grepl 3.12.1-141Miroslav Grepl 3.12.1-140Miroslav Grepl 3.12.1-139Lukas Vrabec 3.12.1-138Miroslav Grepl 3.12.1-137Miroslav Grepl 3.12.1-136Miroslav Grepl 3.12.1-135Miroslav Grepl 3.12.1-134Miroslav Grepl 3.12.1-133Miroslav Grepl 3.12.1-132Miroslav Grepl 3.12.1-131Miroslav Grepl 3.12.1-130Miroslav Grepl 3.12.1-129Miroslav Grepl 3.12.1-128Miroslav Grepl 3.12.1-127Miroslav Grepl 3.12.1-126Miroslav Grepl 3.12.1-125Miroslav Grepl 3.12.1-124Miroslav Grepl 3.12.1-123Miroslav Grepl 3.12.1-122Miroslav Grepl 3.12.1-121Miroslav Grepl 3.12.1-120Miroslav Grepl 3.12.1-119Miroslav Grepl 3.12.1-118Miroslav Grepl 3.12.1-117Miroslav Grepl 3.12.1-116Miroslav Grepl 3.12.1-115Miroslav Grepl 3.12.1-114Miroslav Grepl 3.12.1-113Miroslav Grepl 3.12.1-112Miroslav Grepl 3.12.1-111Miroslav Grepl 3.12.1-110Miroslav Grepl 3.12.1-109Miroslav Grepl 3.12.1-108Miroslav Grepl 3.12.1-107Dan Walsh 3.12.1-106Miroslav Grepl 3.12.1-105Miroslav Grepl 3.12.1-104Miroslav Grepl 3.12.1-103Miroslav Grepl 3.12.1-102Miroslav Grepl 3.12.1-101Miroslav Grepl 3.12.1-100Miroslav Grepl 3.12.1-99Miroslav Grepl 3.12.1-98Miroslav Grepl 3.12.1-97Miroslav Grepl 3.12.1-96Miroslav Grepl 3.12.1-95Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-94Miroslav Grepl 3.12.1-93Miroslav Grepl 3.12.1-92Miroslav Grepl 3.12.1-91Miroslav Grepl 3.12.1-90Miroslav Grepl 3.12.1-89Miroslav Grepl 3.12.1-88Miroslav Grepl 3.12.1-87Miroslav Grepl 3.12.1-86Miroslav Grepl 3.12.1-85Miroslav Grepl 3.12.1-84Miroslav Grepl 3.12.1-83Miroslav Grepl 3.12.1-82Miroslav Grepl 3.12.1-81Miroslav Grepl 3.12.1-80Miroslav Grepl 3.12.1-79Miroslav Grepl 3.12.1-78Miroslav Grepl 3.12.1-77Miroslav Grepl 3.12.1-76Miroslav Grepl 3.12.1-75Miroslav Grepl 3.12.1-74Miroslav Grepl 3.12.1-73Miroslav Grepl 3.12.1-72Miroslav Grepl 3.12.1-71Miroslav Grepl 3.12.1-70Miroslav Grepl 3.12.1-69Miroslav Grepl 3.12.1-68Miroslav Grepl 3.12.1-67Miroslav Grepl 3.12.1-66Miroslav Grepl 3.12.1-65Miroslav Grepl 3.12.1-64Miroslav Grepl 3.12.1-63Miroslav Grepl 3.12.1-62Miroslav Grepl 3.12.1-61Miroslav Grepl 3.12.1-60Miroslav Grepl 3.12.1-59Miroslav Grepl 3.12.1-58Miroslav Grepl 3.12.1-57Miroslav Grepl 3.12.1-56Miroslav Grepl 3.12.1-55Miroslav Grepl 3.12.1-54Miroslav Grepl 3.12.1-53Miroslav Grepl 3.12.1-52Miroslav Grepl 3.12.1-51Miroslav Grepl 3.12.1-50Miroslav Grepl 3.12.1-49Miroslav Grepl 3.12.1-48Miroslav Grepl 3.12.1-47Miroslav Grepl 3.12.1-46Miroslav Grepl 3.12.1-45Miroslav Grepl 3.12.1-44Miroslav Grepl 3.12.1-43Miroslav Grepl 3.12.1-42Miroslav Grepl 3.12.1-41Miroslav Grepl 3.12.1-40Miroslav Grepl 3.12.1-39Miroslav Grepl 3.12.1-38Miroslav Grepl 3.12.1-37Miroslav Grepl 3.12.1-36Miroslav Grepl 3.12.1-35Miroslav Grepl 3.12.1-34Miroslav Grepl 3.12.1-33Miroslav Grepl 3.12.1-32Miroslav Grepl 3.12.1-31Miroslav Grepl 3.12.1-30Miroslav Grepl 3.12.1-29Dan Walsh 3.12.1-28Dan Walsh 3.12.1-27Miroslav Grepl 3.12.1-26Miroslav Grepl 3.12.1-25Miroslav Grepl 3.12.1-24Miroslav Grepl 3.12.1-23Miroslav Grepl 3.12.1-22Miroslav Grepl 3.12.1-21Miroslav Grepl 3.12.1-20Miroslav Grepl 3.12.1-19Miroslav Grepl 3.12.1-18Miroslav Grepl 3.12.1-17Miroslav Grepl 3.12.1-16Miroslav Grepl 3.12.1-15Miroslav Grepl 3.12.1-14Miroslav Grepl 3.12.1-13Miroslav Grepl 3.12.1-12Miroslav Grepl 3.12.1-11Miroslav Grepl 3.12.1-10Miroslav Grepl 3.12.1-9Miroslav Grepl 3.12.1-8Miroslav Grepl 3.12.1-7Miroslav Grepl 3.12.1-6Miroslav Grepl 3.12.1-5Miroslav Grepl 3.12.1-4Miroslav Grepl 3.12.1-3Miroslav Grepl 3.12.1-2Miroslav Grepl 3.12.1-1Dan Walsh 3.11.1-69.1Miroslav Grepl 3.11.1-69Miroslav Grepl 3.11.1-68Miroslav Grepl 3.11.1-67Miroslav Grepl 3.11.1-66Miroslav Grepl 3.11.1-65Miroslav Grepl 3.11.1-64Miroslav Grepl 3.11.1-63Miroslav Grepl 3.11.1-62Miroslav Grepl 3.11.1-61Miroslav Grepl 3.11.1-60Miroslav Grepl 3.11.1-59Miroslav Grepl 3.11.1-58Miroslav Grepl 3.11.1-57Miroslav Grepl 3.11.1-56Miroslav Grepl 3.11.1-55Miroslav Grepl 3.11.1-54Miroslav Grepl 3.11.1-53Miroslav Grepl 3.11.1-52Miroslav Grepl 3.11.1-51Miroslav Grepl 3.11.1-50Miroslav Grepl 3.11.1-49Miroslav Grepl 3.11.1-48Miroslav Grepl 3.11.1-47Miroslav Grepl 3.11.1-46Miroslav Grepl 3.11.1-45Miroslav Grepl 3.11.1-44Miroslav Grepl 3.11.1-43Miroslav Grepl 3.11.1-42Miroslav Grepl 3.11.1-41Miroslav Grepl 3.11.1-40Miroslav Grepl 3.11.1-39Miroslav Grepl 3.11.1-38Miroslav Grepl 3.11.1-37Miroslav Grepl 3.11.1-36Miroslav Grepl 3.11.1-35Miroslav Grepl 3.11.1-34Miroslav Grepl 3.11.1-33Miroslav Grepl 3.11.1-32Miroslav Grepl 3.11.1-31Miroslav Grepl 3.11.1-30Miroslav Grepl 3.11.1-29Miroslav Grepl 3.11.1-28Miroslav Grepl 3.11.1-27Miroslav Grepl 3.11.1-26Miroslav Grepl 3.11.1-25Miroslav Grepl 3.11.1-24Miroslav Grepl 3.11.1-23Miroslav Grepl 3.11.1-22Miroslav Grepl 3.11.1-21Miroslav Grepl 3.11.1-20Miroslav Grepl 3.11.1-19Miroslav Grepl 3.11.1-18Miroslav Grepl 3.11.1-17Miroslav Grepl 3.11.1-16Dan Walsh 3.11.1-15Miroslav Grepl 3.11.1-14Dan Walsh 3.11.1-13Miroslav Grepl 3.11.1-12Miroslav Grepl 3.11.1-11Miroslav Grepl 3.11.1-10Dan Walsh 3.11.1-9Dan Walsh 3.11.1-8Dan Walsh 3.11.1-7Dan Walsh 3.11.1-6Miroslav Grepl 3.11.1-5Miroslav Grepl 3.11.1-4Miroslav Grepl 3.11.1-3Miroslav Grepl 3.11.1-2Miroslav Grepl 3.11.1-1Miroslav Grepl 3.11.1-0Miroslav Grepl 3.11.0-15Miroslav Grepl 3.11.0-14Miroslav Grepl 3.11.0-13Miroslav Grepl 3.11.0-12Fedora Release Engineering - 3.11.0-11Miroslav Grepl 3.11.0-10Miroslav Grepl 3.11.0-9Miroslav Grepl 3.11.0-8Miroslav Grepl 3.11.0-7Miroslav Grepl 3.11.0-6Miroslav Grepl 3.11.0-5Miroslav Grepl 3.11.0-4Miroslav Grepl 3.11.0-3Miroslav Grepl 3.11.0-2Miroslav Grepl 3.11.0-1Miroslav Grepl 3.10.0-128Miroslav Grepl 3.10.0-127Miroslav Grepl 3.10.0-126Miroslav Grepl 3.10.0-125Miroslav Grepl 3.10.0-124Miroslav Grepl 3.10.0-123Miroslav Grepl 3.10.0-122Miroslav Grepl 3.10.0-121Miroslav Grepl 3.10.0-120Miroslav Grepl 3.10.0-119Miroslav Grepl 3.10.0-118Miroslav Grepl 3.10.0-117Miroslav Grepl 3.10.0-116Miroslav Grepl 3.10.0-115Miroslav Grepl 3.10.0-114Miroslav Grepl 3.10.0-113Miroslav Grepl 3.10.0-112Miroslav Grepl 3.10.0-111Miroslav Grepl 3.10.0-110Miroslav Grepl 3.10.0-109Miroslav Grepl 3.10.0-108Miroslav Grepl 3.10.0-107Miroslav Grepl 3.10.0-106Miroslav Grepl 3.10.0-105Miroslav Grepl 3.10.0-104Miroslav Grepl 3.10.0-103Miroslav Grepl 3.10.0-102Miroslav Grepl 3.10.0-101Miroslav Grepl 3.10.0-100Miroslav Grepl 3.10.0-99Miroslav Grepl 3.10.0-98Miroslav Grepl 3.10.0-97Miroslav Grepl 3.10.0-96Miroslav Grepl 3.10.0-95Miroslav Grepl 3.10.0-94Miroslav Grepl 3.10.0-93Miroslav Grepl 3.10.0-92Miroslav Grepl 3.10.0-91Miroslav Grepl 3.10.0-90Miroslav Grepl 3.10.0-89Miroslav Grepl 3.10.0-88Miroslav Grepl 3.10.0-87Miroslav Grepl 3.10.0-86Miroslav Grepl 3.10.0-85Miroslav Grepl 3.10.0-84Miroslav Grepl 3.10.0-83Miroslav Grepl 3.10.0-82Dan Walsh 3.10.0-81.2Miroslav Grepl 3.10.0-81Miroslav Grepl 3.10.0-80Miroslav Grepl 3.10.0-79Miroslav Grepl 3.10.0-78Miroslav Grepl 3.10.0-77Miroslav Grepl 3.10.0-76Miroslav Grepl 3.10.0-75Dan Walsh 3.10.0-74.2Miroslav Grepl 3.10.0-74Miroslav Grepl 3.10.0-73Miroslav Grepl 3.10.0-72Miroslav Grepl 3.10.0-71Miroslav Grepl 3.10.0-70Miroslav Grepl 3.10.0-69Miroslav Grepl 3.10.0-68Miroslav Grepl 3.10.0-67Miroslav Grepl 3.10.0-66Miroslav Grepl 3.10.0-65Miroslav Grepl 3.10.0-64Miroslav Grepl 3.10.0-63Miroslav Grepl 3.10.0-59Miroslav Grepl 3.10.0-58Dan Walsh 3.10.0-57Dan Walsh 3.10.0-56Dan Walsh 3.10.0-55.2Dan Walsh 3.10.0-55.1Miroslav Grepl 3.10.0-55Dan Walsh 3.10.0-54.1Miroslav Grepl 3.10.0-54Dan Walsh 3.10.0-53.1Miroslav Grepl 3.10.0-53Miroslav Grepl 3.10.0-52Miroslav Grepl 3.10.0-51Dan Walsh 3.10.0-50.2Dan Walsh 3.10.0-50.1Miroslav Grepl 3.10.0-50Miroslav Grepl 3.10.0-49Miroslav Grepl 3.10.0-48Miroslav Grepl 3.10.0-47Dan Walsh 3.10.0-46.1Miroslav Grepl 3.10.0-46Dan Walsh 3.10.0-45.1Miroslav Grepl 3.10.0-45Miroslav Grepl 3.10.0-43Miroslav Grepl 3.10.0-42Miroslav Grepl 3.10.0-41Dan Walsh 3.10.0-40.2Miroslav Grepl 3.10.0-40Dan Walsh 3.10.0-39.3Dan Walsh 3.10.0-39.2Dan Walsh 3.10.0-39.1Miroslav Grepl 3.10.0-39Dan Walsh 3.10.0-38.1Miroslav Grepl 3.10.0-38Miroslav Grepl 3.10.0-37Dan Walsh 3.10.0-36.1Miroslav Grepl 3.10.0-36Dan Walsh 3.10.0-35Dan Walsh 3.10.0-34.7Dan Walsh 3.10.0-34.6Dan Walsh 3.10.0-34.4Miroslav Grepl 3.10.0-34.3Dan Walsh 3.10.0-34.2Dan Walsh 3.10.0-34.1Miroslav Grepl 3.10.0-34Miroslav Grepl 3.10.0-33Dan Walsh 3.10.0-31.1Miroslav Grepl 3.10.0-31Miroslav Grepl 3.10.0-29Miroslav Grepl 3.10.0-28Miroslav Grepl 3.10.0-27Miroslav Grepl 3.10.0-26Miroslav Grepl 3.10.0-25Miroslav Grepl 3.10.0-24Miroslav Grepl 3.10.0-23Miroslav Grepl 3.10.0-22Miroslav Grepl 3.10.0-21Dan Walsh 3.10.0-20Miroslav Grepl 3.10.0-19Miroslav Grepl 3.10.0-18Miroslav Grepl 3.10.0-17Miroslav Grepl 3.10.0-16Miroslav Grepl 3.10.0-14Miroslav Grepl 3.10.0-13Miroslav Grepl 3.10.0-12Miroslav Grepl 3.10.0-11Miroslav Grepl 3.10.0-10Miroslav Grepl 3.10.0-9Miroslav Grepl 3.10.0-8Miroslav Grepl 3.10.0-7Miroslav Grepl 3.10.0-6Miroslav Grepl 3.10.0-5Miroslav Grepl 3.10.0-4Miroslav Grepl 3.10.0-3Miroslav Grepl 3.10.0-2Miroslav Grepl 3.10.0-1Miroslav Grepl 3.9.16-30Dan Walsh 3.9.16-29.1Miroslav Grepl 3.9.16-29Dan Walsh 3.9.16-28.1Miroslav Grepl 3.9.16-27Miroslav Grepl 3.9.16-26Miroslav Grepl 3.9.16-25Miroslav Grepl 3.9.16-24Miroslav Grepl 3.9.16-23Miroslav Grepl 3.9.16-22Miroslav Grepl 3.9.16-21Miroslav Grepl 3.9.16-20Miroslav Grepl 3.9.16-19Miroslav Grepl 3.9.16-18Miroslav Grepl 3.9.16-17Dan Walsh 3.9.16-16.1Miroslav Grepl 3.9.16-16Miroslav Grepl 3.9.16-15Miroslav Grepl 3.9.16-14Miroslav Grepl 3.9.16-13Miroslav Grepl 3.9.16-12Miroslav Grepl 3.9.16-11Miroslav Grepl 3.9.16-10Miroslav Grepl 3.9.16-7Miroslav Grepl 3.9.16-6Miroslav Grepl 3.9.16-5Miroslav Grepl 3.9.16-4Miroslav Grepl 3.9.16-3Miroslav Grepl 3.9.16-2Miroslav Grepl 3.9.16-1Miroslav Grepl 3.9.15-5Miroslav Grepl 3.9.15-2Miroslav Grepl 3.9.15-1Fedora Release Engineering - 3.9.14-2Dan Walsh 3.9.14-1Miroslav Grepl 3.9.13-10Miroslav Grepl 3.9.13-9Dan Walsh 3.9.13-8Miroslav Grepl 3.9.13-7Miroslav Grepl 3.9.13-6Miroslav Grepl 3.9.13-5Miroslav Grepl 3.9.13-4Miroslav Grepl 3.9.13-3Miroslav Grepl 3.9.13-2Miroslav Grepl 3.9.13-1Miroslav Grepl 3.9.12-8Miroslav Grepl 3.9.12-7Miroslav Grepl 3.9.12-6Miroslav Grepl 3.9.12-5Dan Walsh 3.9.12-4Dan Walsh 3.9.12-3Dan Walsh 3.9.12-2Miroslav Grepl 3.9.12-1Dan Walsh 3.9.11-2Miroslav Grepl 3.9.11-1Miroslav Grepl 3.9.10-13Dan Walsh 3.9.10-12Miroslav Grepl 3.9.10-11Miroslav Grepl 3.9.10-10Miroslav Grepl 3.9.10-9Miroslav Grepl 3.9.10-8Miroslav Grepl 3.9.10-7Miroslav Grepl 3.9.10-6Miroslav Grepl 3.9.10-5Dan Walsh 3.9.10-4Miroslav Grepl 3.9.10-3Miroslav Grepl 3.9.10-2Miroslav Grepl 3.9.10-1Miroslav Grepl 3.9.9-4Dan Walsh 3.9.9-3Miroslav Grepl 3.9.9-2Miroslav Grepl 3.9.9-1Miroslav Grepl 3.9.8-7Dan Walsh 3.9.8-6Miroslav Grepl 3.9.8-5Miroslav Grepl 3.9.8-4Dan Walsh 3.9.8-3Dan Walsh 3.9.8-2Dan Walsh 3.9.8-1Dan Walsh 3.9.7-10Dan Walsh 3.9.7-9Dan Walsh 3.9.7-8Dan Walsh 3.9.7-7Dan Walsh 3.9.7-6Dan Walsh 3.9.7-5Dan Walsh 3.9.7-4Dan Walsh 3.9.7-3Dan Walsh 3.9.7-2Dan Walsh 3.9.7-1Dan Walsh 3.9.6-3Dan Walsh 3.9.6-2Dan Walsh 3.9.6-1Dan Walsh 3.9.5-11Dan Walsh 3.9.5-10Dan Walsh 3.9.5-9Dan Walsh 3.9.5-8Dan Walsh 3.9.5-7Dan Walsh 3.9.5-6Dan Walsh 3.9.5-5Dan Walsh 3.9.5-4Dan Walsh 3.9.5-3Dan Walsh 3.9.5-2Dan Walsh 3.9.5-1Dan Walsh 3.9.4-3Dan Walsh 3.9.4-2Dan Walsh 3.9.4-1Dan Walsh 3.9.3-4Dan Walsh 3.9.3-3Dan Walsh 3.9.3-2Dan Walsh 3.9.3-1Dan Walsh 3.9.2-1Dan Walsh 3.9.1-3Dan Walsh 3.9.1-2Dan Walsh 3.9.1-1Dan Walsh 3.9.0-2Dan Walsh 3.9.0-1Dan Walsh 3.8.8-21Dan Walsh 3.8.8-20Dan Walsh 3.8.8-19Dan Walsh 3.8.8-18Dan Walsh 3.8.8-17Dan Walsh 3.8.8-16Dan Walsh 3.8.8-15Dan Walsh 3.8.8-14Dan Walsh 3.8.8-13Dan Walsh 3.8.8-12Dan Walsh 3.8.8-11Dan Walsh 3.8.8-10Dan Walsh 3.8.8-9Dan Walsh 3.8.8-8Dan Walsh 3.8.8-7Dan Walsh 3.8.8-6Dan Walsh 3.8.8-5Dan Walsh 3.8.8-4Dan Walsh 3.8.8-3Dan Walsh 3.8.8-2Dan Walsh 3.8.8-1Dan Walsh 3.8.7-3Dan Walsh 3.8.7-2Dan Walsh 3.8.7-1Dan Walsh 3.8.6-3Miroslav Grepl 3.8.6-2Dan Walsh 3.8.6-1Dan Walsh 3.8.5-1Dan Walsh 3.8.4-1Dan Walsh 3.8.3-4Dan Walsh 3.8.3-3Dan Walsh 3.8.3-2Dan Walsh 3.8.3-1Dan Walsh 3.8.2-1Dan Walsh 3.8.1-5Dan Walsh 3.8.1-4Dan Walsh 3.8.1-3Dan Walsh 3.8.1-2Dan Walsh 3.8.1-1Dan Walsh 3.7.19-22Dan Walsh 3.7.19-21Dan Walsh 3.7.19-20Dan Walsh 3.7.19-19Dan Walsh 3.7.19-17Dan Walsh 3.7.19-16Dan Walsh 3.7.19-15Dan Walsh 3.7.19-14Dan Walsh 3.7.19-13Dan Walsh 3.7.19-12Dan Walsh 3.7.19-11Dan Walsh 3.7.19-10Dan Walsh 3.7.19-9Dan Walsh 3.7.19-8Dan Walsh 3.7.19-7Dan Walsh 3.7.19-6Dan Walsh 3.7.19-5Dan Walsh 3.7.19-4Dan Walsh 3.7.19-3Dan Walsh 3.7.19-2Dan Walsh 3.7.19-1Dan Walsh 3.7.18-3Dan Walsh 3.7.18-2Dan Walsh 3.7.18-1Dan Walsh 3.7.17-6Dan Walsh 3.7.17-5Dan Walsh 3.7.17-4Dan Walsh 3.7.17-3Dan Walsh 3.7.17-2Dan Walsh 3.7.17-1Dan Walsh 3.7.16-2Dan Walsh 3.7.16-1Dan Walsh 3.7.15-4Dan Walsh 3.7.15-3Dan Walsh 3.7.15-2Dan Walsh 3.7.15-1Dan Walsh 3.7.14-5Dan Walsh 3.7.14-4Dan Walsh 3.7.14-3Dan Walsh 3.7.14-2Dan Walsh 3.7.14-1Dan Walsh 3.7.13-4Dan Walsh 3.7.13-3Dan Walsh 3.7.13-2Dan Walsh 3.7.13-1Dan Walsh 3.7.12-1Dan Walsh 3.7.11-1Dan Walsh 3.7.10-5Dan Walsh 3.7.10-4Dan Walsh 3.7.10-3Dan Walsh 3.7.10-2Dan Walsh 3.7.10-1Dan Walsh 3.7.9-4Dan Walsh 3.7.9-3Dan Walsh 3.7.9-2Dan Walsh 3.7.9-1Dan Walsh 3.7.8-11Dan Walsh 3.7.8-9Dan Walsh 3.7.8-8Dan Walsh 3.7.8-7Dan Walsh 3.7.8-6Dan Walsh 3.7.8-5Dan Walsh 3.7.8-4Dan Walsh 3.7.8-3Dan Walsh 3.7.8-2Dan Walsh 3.7.8-1Dan Walsh 3.7.7-3Dan Walsh 3.7.7-2Dan Walsh 3.7.7-1Dan Walsh 3.7.6-1Dan Walsh 3.7.5-8Dan Walsh 3.7.5-7Dan Walsh 3.7.5-6Dan Walsh 3.7.5-5Dan Walsh 3.7.5-4Dan Walsh 3.7.5-3Dan Walsh 3.7.5-2Dan Walsh 3.7.5-1Dan Walsh 3.7.4-4Dan Walsh 3.7.4-3Dan Walsh 3.7.4-2Dan Walsh 3.7.4-1Dan Walsh 3.7.3-1Dan Walsh 3.7.1-1Dan Walsh 3.6.33-2Dan Walsh 3.6.33-1Dan Walsh 3.6.32-17Dan Walsh 3.6.32-16Dan Walsh 3.6.32-15Dan Walsh 3.6.32-13Dan Walsh 3.6.32-12Dan Walsh 3.6.32-11Dan Walsh 3.6.32-10Dan Walsh 3.6.32-9Dan Walsh 3.6.32-8Dan Walsh 3.6.32-7Dan Walsh 3.6.32-6Dan Walsh 3.6.32-5Dan Walsh 3.6.32-4Dan Walsh 3.6.32-3Dan Walsh 3.6.32-2Dan Walsh 3.6.32-1Dan Walsh 3.6.31-5Dan Walsh 3.6.31-4Dan Walsh 3.6.31-3Dan Walsh 3.6.31-2Dan Walsh 3.6.30-6Dan Walsh 3.6.30-5Dan Walsh 3.6.30-4Dan Walsh 3.6.30-3Dan Walsh 3.6.30-2Dan Walsh 3.6.30-1Dan Walsh 3.6.29-2Dan Walsh 3.6.29-1Dan Walsh 3.6.28-9Dan Walsh 3.6.28-8Dan Walsh 3.6.28-7Dan Walsh 3.6.28-6Dan Walsh 3.6.28-5Dan Walsh 3.6.28-4Dan Walsh 3.6.28-3Dan Walsh 3.6.28-2Dan Walsh 3.6.28-1Dan Walsh 3.6.27-1Dan Walsh 3.6.26-11Dan Walsh 3.6.26-10Dan Walsh 3.6.26-9Bill Nottingham 3.6.26-8Dan Walsh 3.6.26-7Dan Walsh 3.6.26-6Dan Walsh 3.6.26-5Dan Walsh 3.6.26-4Dan Walsh 3.6.26-3Dan Walsh 3.6.26-2Dan Walsh 3.6.26-1Dan Walsh 3.6.25-1Dan Walsh 3.6.24-1Dan Walsh 3.6.23-2Dan Walsh 3.6.23-1Dan Walsh 3.6.22-3Dan Walsh 3.6.22-1Dan Walsh 3.6.21-4Dan Walsh 3.6.21-3Tom "spot" Callaway 3.6.21-2Dan Walsh 3.6.21-1Dan Walsh 3.6.20-2Dan Walsh 3.6.20-1Dan Walsh 3.6.19-5Dan Walsh 3.6.19-4Dan Walsh 3.6.19-3Dan Walsh 3.6.19-2Dan Walsh 3.6.19-1Dan Walsh 3.6.18-1Dan Walsh 3.6.17-1Dan Walsh 3.6.16-4Dan Walsh 3.6.16-3Dan Walsh 3.6.16-2Dan Walsh 3.6.16-1Dan Walsh 3.6.14-3Dan Walsh 3.6.14-2Dan Walsh 3.6.14-1Dan Walsh 3.6.13-3Dan Walsh 3.6.13-2Dan Walsh 3.6.13-1Dan Walsh 3.6.12-39Dan Walsh 3.6.12-38Dan Walsh 3.6.12-37Dan Walsh 3.6.12-36Dan Walsh 3.6.12-35Dan Walsh 3.6.12-34Dan Walsh 3.6.12-33Dan Walsh 3.6.12-31Dan Walsh 3.6.12-30Dan Walsh 3.6.12-29Dan Walsh 3.6.12-28Dan Walsh 3.6.12-27Dan Walsh 3.6.12-26Dan Walsh 3.6.12-25Dan Walsh 3.6.12-24Dan Walsh 3.6.12-23Dan Walsh 3.6.12-22Dan Walsh 3.6.12-21Dan Walsh 3.6.12-20Dan Walsh 3.6.12-19Dan Walsh 3.6.12-16Dan Walsh 3.6.12-15Dan Walsh 3.6.12-14Dan Walsh 3.6.12-13Dan Walsh 3.6.12-12Dan Walsh 3.6.12-11Dan Walsh 3.6.12-10Dan Walsh 3.6.12-9Dan Walsh 3.6.12-8Dan Walsh 3.6.12-7Dan Walsh 3.6.12-6Dan Walsh 3.6.12-5Dan Walsh 3.6.12-4Dan Walsh 3.6.12-3Dan Walsh 3.6.12-2Dan Walsh 3.6.12-1Dan Walsh 3.6.11-1Dan Walsh 3.6.10-9Dan Walsh 3.6.10-8Dan Walsh 3.6.10-7Dan Walsh 3.6.10-6Dan Walsh 3.6.10-5Dan Walsh 3.6.10-4Dan Walsh 3.6.10-3Dan Walsh 3.6.10-2Dan Walsh 3.6.10-1Dan Walsh 3.6.9-4Dan Walsh 3.6.9-3Dan Walsh 3.6.9-2Dan Walsh 3.6.9-1Dan Walsh 3.6.8-4Dan Walsh 3.6.8-3Dan Walsh 3.6.8-2Dan Walsh 3.6.8-1Dan Walsh 3.6.7-2Dan Walsh 3.6.7-1Dan Walsh 3.6.6-9Dan Walsh 3.6.6-8Fedora Release Engineering - 3.6.6-7Dan Walsh 3.6.6-6Dan Walsh 3.6.6-5Dan Walsh 3.6.6-4Dan Walsh 3.6.6-3Dan Walsh 3.6.6-2Dan Walsh 3.6.6-1Dan Walsh 3.6.5-3Dan Walsh 3.6.5-1Dan Walsh 3.6.4-6Dan Walsh 3.6.4-5Dan Walsh 3.6.4-4Dan Walsh 3.6.4-3Dan Walsh 3.6.4-2Dan Walsh 3.6.4-1Dan Walsh 3.6.3-13Dan Walsh 3.6.3-12Dan Walsh 3.6.3-11Dan Walsh 3.6.3-10Dan Walsh 3.6.3-9Dan Walsh 3.6.3-8Dan Walsh 3.6.3-7Dan Walsh 3.6.3-6Dan Walsh 3.6.3-3Dan Walsh 3.6.3-2Dan Walsh 3.6.3-1Dan Walsh 3.6.2-5Dan Walsh 3.6.2-4Dan Walsh 3.6.2-3Dan Walsh 3.6.2-2Dan Walsh 3.6.2-1Dan Walsh 3.6.1-15Dan Walsh 3.6.1-14Dan Walsh 3.6.1-13Dan Walsh 3.6.1-12Dan Walsh 3.6.1-11Dan Walsh 3.6.1-10Dan Walsh 3.6.1-9Dan Walsh 3.6.1-8Dan Walsh 3.6.1-7Dan Walsh 3.6.1-4Ignacio Vazquez-Abrams - 3.6.1-2Dan Walsh 3.5.13-19Dan Walsh 3.5.13-18Dan Walsh 3.5.13-17Dan Walsh 3.5.13-16Dan Walsh 3.5.13-15Dan Walsh 3.5.13-14Dan Walsh 3.5.13-13Dan Walsh 3.5.13-12Dan Walsh 3.5.13-11Dan Walsh 3.5.13-9Dan Walsh 3.5.13-8Dan Walsh 3.5.13-7Dan Walsh 3.5.13-6Dan Walsh 3.5.13-5Dan Walsh 3.5.13-4Dan Walsh 3.5.13-3Dan Walsh 3.5.13-2Dan Walsh 3.5.13-1Dan Walsh 3.5.12-3Dan Walsh 3.5.12-2Dan Walsh 3.5.12-1Dan Walsh 3.5.11-1Dan Walsh 3.5.10-3Dan Walsh 3.5.10-2Dan Walsh 3.5.10-1Dan Walsh 3.5.9-4Dan Walsh 3.5.9-3Dan Walsh 3.5.9-2Dan Walsh 3.5.9-1Dan Walsh 3.5.8-7Dan Walsh 3.5.8-6Dan Walsh 3.5.8-5Dan Walsh 3.5.8-4Dan Walsh 3.5.8-3Dan Walsh 3.5.8-1Dan Walsh 3.5.7-2Dan Walsh 3.5.7-1Dan Walsh 3.5.6-2Dan Walsh 3.5.6-1Dan Walsh 3.5.5-4Dan Walsh 3.5.5-3Dan Walsh 3.5.5-2Dan Walsh 3.5.4-2Dan Walsh 3.5.4-1Dan Walsh 3.5.3-1Dan Walsh 3.5.2-2Dan Walsh 3.5.1-5Dan Walsh 3.5.1-4Dan Walsh 3.5.1-3Dan Walsh 3.5.1-2Dan Walsh 3.5.1-1Dan Walsh 3.5.0-1Dan Walsh 3.4.2-14Dan Walsh 3.4.2-13Dan Walsh 3.4.2-12Dan Walsh 3.4.2-11Dan Walsh 3.4.2-10Dan Walsh 3.4.2-9Dan Walsh 3.4.2-8Dan Walsh 3.4.2-7Dan Walsh 3.4.2-6Dan Walsh 3.4.2-5Dan Walsh 3.4.2-4Dan Walsh 3.4.2-3Dan Walsh 3.4.2-2Dan Walsh 3.4.2-1Dan Walsh 3.4.1-5Dan Walsh 3.4.1-3Dan Walsh 3.4.1-2Dan Walsh 3.4.1-1Dan Walsh 3.3.1-48Dan Walsh 3.3.1-47Dan Walsh 3.3.1-46Dan Walsh 3.3.1-45Dan Walsh 3.3.1-44Dan Walsh 3.3.1-43Dan Walsh 3.3.1-42Dan Walsh 3.3.1-41Dan Walsh 3.3.1-39Dan Walsh 3.3.1-37Dan Walsh 3.3.1-36Dan Walsh 3.3.1-33Dan Walsh 3.3.1-32Dan Walsh 3.3.1-31Dan Walsh 3.3.1-30Dan Walsh 3.3.1-29Dan Walsh 3.3.1-28Dan Walsh 3.3.1-27Dan Walsh 3.3.1-26Dan Walsh 3.3.1-25Dan Walsh 3.3.1-24Dan Walsh 3.3.1-23Dan Walsh 3.3.1-22Dan Walsh 3.3.1-21Dan Walsh 3.3.1-20Dan Walsh 3.3.1-19Dan Walsh 3.3.1-18Dan Walsh 3.3.1-17Dan Walsh 3.3.1-16Dan Walsh 3.3.1-15Bill Nottingham 3.3.1-14Dan Walsh 3.3.1-13Dan Walsh 3.3.1-12Dan Walsh 3.3.1-11Dan Walsh 3.3.1-10Dan Walsh 3.3.1-9Dan Walsh 3.3.1-8Dan Walsh 3.3.1-6Dan Walsh 3.3.1-5Dan Walsh 3.3.1-4Dan Walsh 3.3.1-2Dan Walsh 3.3.1-1Dan Walsh 3.3.0-2Dan Walsh 3.3.0-1Dan Walsh 3.2.9-2Dan Walsh 3.2.9-1Dan Walsh 3.2.8-2Dan Walsh 3.2.8-1Dan Walsh 3.2.7-6Dan Walsh 3.2.7-5Dan Walsh 3.2.7-3Dan Walsh 3.2.7-2Dan Walsh 3.2.7-1Dan Walsh 3.2.6-7Dan Walsh 3.2.6-6Dan Walsh 3.2.6-5Dan Walsh 3.2.6-4Dan Walsh 3.2.6-3Dan Walsh 3.2.6-2Dan Walsh 3.2.6-1Dan Walsh 3.2.5-25Dan Walsh 3.2.5-24Dan Walsh 3.2.5-22Dan Walsh 3.2.5-21Dan Walsh 3.2.5-20Dan Walsh 3.2.5-19Dan Walsh 3.2.5-18Dan Walsh 3.2.5-17Dan Walsh 3.2.5-16Dan Walsh 3.2.5-15Dan Walsh 3.2.5-14Dan Walsh 3.2.5-13Dan Walsh 3.2.5-12Dan Walsh 3.2.5-11Dan Walsh 3.2.5-10Dan Walsh 3.2.5-9Dan Walsh 3.2.5-8Dan Walsh 3.2.5-7Dan Walsh 3.2.5-6Dan Walsh 3.2.5-5Dan Walsh 3.2.5-4Dan Walsh 3.2.5-3Dan Walsh 3.2.5-2Dan Walsh 3.2.5-1Dan Walsh 3.2.4-5Dan Walsh 3.2.4-4Dan Walsh 3.2.4-3Dan Walsh 3.2.4-1Dan Walsh 3.2.4-1Dan Walsh 3.2.3-2Dan Walsh 3.2.3-1Dan Walsh 3.2.2-1Dan Walsh 3.2.1-3Dan Walsh 3.2.1-1Dan Walsh 3.1.2-2Dan Walsh 3.1.2-1Dan Walsh 3.1.1-1Dan Walsh 3.1.0-1Dan Walsh 3.0.8-30Dan Walsh 3.0.8-28Dan Walsh 3.0.8-27Dan Walsh 3.0.8-26Dan Walsh 3.0.8-25Dan Walsh 3.0.8-24Dan Walsh 3.0.8-23Dan Walsh 3.0.8-22Dan Walsh 3.0.8-21Dan Walsh 3.0.8-20Dan Walsh 3.0.8-19Dan Walsh 3.0.8-18Dan Walsh 3.0.8-17Dan Walsh 3.0.8-16Dan Walsh 3.0.8-15Dan Walsh 3.0.8-14Dan Walsh 3.0.8-13Dan Walsh 3.0.8-12Dan Walsh 3.0.8-11Dan Walsh 3.0.8-10Dan Walsh 3.0.8-9Dan Walsh 3.0.8-8Dan Walsh 3.0.8-7Dan Walsh 3.0.8-5Dan Walsh 3.0.8-4Dan Walsh 3.0.8-3Dan Walsh 3.0.8-2Dan Walsh 3.0.8-1Dan Walsh 3.0.7-10Dan Walsh 3.0.7-9Dan Walsh 3.0.7-8Dan Walsh 3.0.7-7Dan Walsh 3.0.7-6Dan Walsh 3.0.7-5Dan Walsh 3.0.7-4Dan Walsh 3.0.7-3Dan Walsh 3.0.7-2Dan Walsh 3.0.7-1Dan Walsh 3.0.6-3Dan Walsh 3.0.6-2Dan Walsh 3.0.6-1Dan Walsh 3.0.5-11Dan Walsh 3.0.5-10Dan Walsh 3.0.5-9Dan Walsh 3.0.5-8Dan Walsh 3.0.5-7Dan Walsh 3.0.5-6Dan Walsh 3.0.5-5Dan Walsh 3.0.5-4Dan Walsh 3.0.5-3Dan Walsh 3.0.5-2Dan Walsh 3.0.5-1Dan Walsh 3.0.4-6Dan Walsh 3.0.4-5Dan Walsh 3.0.4-4Dan Walsh 3.0.4-3Dan Walsh 3.0.4-2Dan Walsh 3.0.4-1Dan Walsh 3.0.3-6Dan Walsh 3.0.3-5Dan Walsh 3.0.3-4Dan Walsh 3.0.3-3Dan Walsh 3.0.3-2Dan Walsh 3.0.3-1Dan Walsh 3.0.2-9Dan Walsh 3.0.2-8Dan Walsh 3.0.2-7Dan Walsh 3.0.2-5Dan Walsh 3.0.2-4Dan Walsh 3.0.2-3Dan Walsh 3.0.2-2Dan Walsh 3.0.1-5Dan Walsh 3.0.1-4Dan Walsh 3.0.1-3Dan Walsh 3.0.1-2Dan Walsh 3.0.1-1Dan Walsh 2.6.5-3Dan Walsh 2.6.5-2Dan Walsh 2.6.4-7Dan Walsh 2.6.4-6Dan Walsh 2.6.4-5Dan Walsh 2.6.4-2Dan Walsh 2.6.4-1Dan Walsh 2.6.3-1Dan Walsh 2.6.2-1Dan Walsh 2.6.1-4Dan Walsh 2.6.1-2Dan Walsh 2.6.1-1Dan Walsh 2.5.12-12Dan Walsh 2.5.12-11Dan Walsh 2.5.12-10Dan Walsh 2.5.12-8Dan Walsh 2.5.12-5Dan Walsh 2.5.12-4Dan Walsh 2.5.12-3Dan Walsh 2.5.12-2Dan Walsh 2.5.12-1Dan Walsh 2.5.11-8Dan Walsh 2.5.11-7Dan Walsh 2.5.11-6Dan Walsh 2.5.11-5Dan Walsh 2.5.11-4Dan Walsh 2.5.11-3Dan Walsh 2.5.11-2Dan Walsh 2.5.11-1Dan Walsh 2.5.10-2Dan Walsh 2.5.10-1Dan Walsh 2.5.9-6Dan Walsh 2.5.9-5Dan Walsh 2.5.9-4Dan Walsh 2.5.9-3Dan Walsh 2.5.9-2Dan Walsh 2.5.8-8Dan Walsh 2.5.8-7Dan Walsh 2.5.8-6Dan Walsh 2.5.8-5Dan Walsh 2.5.8-4Dan Walsh 2.5.8-3Dan Walsh 2.5.8-2Dan Walsh 2.5.8-1Dan Walsh 2.5.7-1Dan Walsh 2.5.6-1Dan Walsh 2.5.5-2Dan Walsh 2.5.5-1Dan Walsh 2.5.4-2Dan Walsh 2.5.4-1Dan Walsh 2.5.3-3Dan Walsh 2.5.3-2Dan Walsh 2.5.3-1Dan Walsh 2.5.2-6Dan Walsh 2.5.2-5Dan Walsh 2.5.2-4Dan Walsh 2.5.2-3Dan Walsh 2.5.2-2Dan Walsh 2.5.2-1Dan Walsh 2.5.1-5Dan Walsh 2.5.1-4Dan Walsh 2.5.1-2Dan Walsh 2.5.1-1Dan Walsh 2.4.6-20Dan Walsh 2.4.6-19Dan Walsh 2.4.6-18Dan Walsh 2.4.6-17Dan Walsh 2.4.6-16Dan Walsh 2.4.6-15Dan Walsh 2.4.6-14Dan Walsh 2.4.6-13Dan Walsh 2.4.6-12Dan Walsh 2.4.6-11Dan Walsh 2.4.6-10Dan Walsh 2.4.6-9Dan Walsh 2.4.6-8Dan Walsh 2.4.6-7Dan Walsh 2.4.6-6Dan Walsh 2.4.6-5Dan Walsh 2.4.6-4Dan Walsh 2.4.6-3Dan Walsh 2.4.6-1Dan Walsh 2.4.5-4Dan Walsh 2.4.5-3Dan Walsh 2.4.5-2Dan Walsh 2.4.5-1Dan Walsh 2.4.4-2Dan Walsh 2.4.4-2Dan Walsh 2.4.4-1Dan Walsh 2.4.3-13Dan Walsh 2.4.3-12Dan Walsh 2.4.3-11Dan Walsh 2.4.3-10Dan Walsh 2.4.3-9Dan Walsh 2.4.3-8Dan Walsh 2.4.3-7Dan Walsh 2.4.3-6Dan Walsh 2.4.3-5Dan Walsh 2.4.3-4Dan Walsh 2.4.3-3Dan Walsh 2.4.3-2Dan Walsh 2.4.3-1Dan Walsh 2.4.2-8Dan Walsh 2.4.2-7James Antill 2.4.2-6Dan Walsh 2.4.2-5Dan Walsh 2.4.2-4Dan Walsh 2.4.2-3Dan Walsh 2.4.2-2Dan Walsh 2.4.2-1Dan Walsh 2.4.1-5Dan Walsh 2.4.1-4Dan Walsh 2.4.1-3Dan Walsh 2.4.1-2Dan Walsh 2.4-4Dan Walsh 2.4-3Dan Walsh 2.4-2Dan Walsh 2.4-1Dan Walsh 2.3.19-4Dan Walsh 2.3.19-3Dan Walsh 2.3.19-2Dan Walsh 2.3.19-1James Antill 2.3.18-10James Antill 2.3.18-9Dan Walsh 2.3.18-8Dan Walsh 2.3.18-7Dan Walsh 2.3.18-6Dan Walsh 2.3.18-5Dan Walsh 2.3.18-4Dan Walsh 2.3.18-3Dan Walsh 2.3.18-2Dan Walsh 2.3.18-1Dan Walsh 2.3.17-2Dan Walsh 2.3.17-1Dan Walsh 2.3.16-9Dan Walsh 2.3.16-8Dan Walsh 2.3.16-7Dan Walsh 2.3.16-6Dan Walsh 2.3.16-5Dan Walsh 2.3.16-4Dan Walsh 2.3.16-2Dan Walsh 2.3.16-1Dan Walsh 2.3.15-2Dan Walsh 2.3.15-1Dan Walsh 2.3.14-8Dan Walsh 2.3.14-7Dan Walsh 2.3.14-6Dan Walsh 2.3.14-4Dan Walsh 2.3.14-3Dan Walsh 2.3.14-2Dan Walsh 2.3.14-1Dan Walsh 2.3.13-6Dan Walsh 2.3.13-5Dan Walsh 2.3.13-4Dan Walsh 2.3.13-3Dan Walsh 2.3.13-2Dan Walsh 2.3.13-1Dan Walsh 2.3.12-2Dan Walsh 2.3.12-1Dan Walsh 2.3.11-1Dan Walsh 2.3.10-7Dan Walsh 2.3.10-6Dan Walsh 2.3.10-3Dan Walsh 2.3.10-1Dan Walsh 2.3.9-6Dan Walsh 2.3.9-5Dan Walsh 2.3.9-4Dan Walsh 2.3.9-3Dan Walsh 2.3.9-2Dan Walsh 2.3.9-1Dan Walsh 2.3.8-2Dan Walsh 2.3.7-1Dan Walsh 2.3.6-4Dan Walsh 2.3.6-3Dan Walsh 2.3.6-2Dan Walsh 2.3.6-1Dan Walsh 2.3.5-1Dan Walsh 2.3.4-1Dan Walsh 2.3.3-20Dan Walsh 2.3.3-19Dan Walsh 2.3.3-18Dan Walsh 2.3.3-17Dan Walsh 2.3.3-16Dan Walsh 2.3.3-15Dan Walsh 2.3.3-14Dan Walsh 2.3.3-13Dan Walsh 2.3.3-12Dan Walsh 2.3.3-11Dan Walsh 2.3.3-10Dan Walsh 2.3.3-9Dan Walsh 2.3.3-8Dan Walsh 2.3.3-7Dan Walsh 2.3.3-6Dan Walsh 2.3.3-5Dan Walsh 2.3.3-4Dan Walsh 2.3.3-3Dan Walsh 2.3.3-2Dan Walsh 2.3.3-1Dan Walsh 2.3.2-4Dan Walsh 2.3.2-3Dan Walsh 2.3.2-2Dan Walsh 2.3.2-1Dan Walsh 2.3.1-1Dan Walsh 2.2.49-1Dan Walsh 2.2.48-1Dan Walsh 2.2.47-5Dan Walsh 2.2.47-4Dan Walsh 2.2.47-3Dan Walsh 2.2.47-1Dan Walsh 2.2.46-2Dan Walsh 2.2.46-1Dan Walsh 2.2.45-3Dan Walsh 2.2.45-2Dan Walsh 2.2.45-1Dan Walsh 2.2.44-1Dan Walsh 2.2.43-4Dan Walsh 2.2.43-3Dan Walsh 2.2.43-2Dan Walsh 2.2.43-1Dan Walsh 2.2.42-4Dan Walsh 2.2.42-3Dan Walsh 2.2.42-2Dan Walsh 2.2.42-1Dan Walsh 2.2.41-1Dan Walsh 2.2.40-2Dan Walsh 2.2.40-1Dan Walsh 2.2.39-2Dan Walsh 2.2.39-1Dan Walsh 2.2.38-6Dan Walsh 2.2.38-5Dan Walsh 2.2.38-4Dan Walsh 2.2.38-3Dan Walsh 2.2.38-2Dan Walsh 2.2.38-1Dan Walsh 2.2.37-1Dan Walsh 2.2.36-2Dan Walsh 2.2.36-1James Antill 2.2.35-2Dan Walsh 2.2.35-1Dan Walsh 2.2.34-3Dan Walsh 2.2.34-2Dan Walsh 2.2.34-1Dan Walsh 2.2.33-1Dan Walsh 2.2.32-2Dan Walsh 2.2.32-1Dan Walsh 2.2.31-1Dan Walsh 2.2.30-2Dan Walsh 2.2.30-1Dan Walsh 2.2.29-6Russell Coker 2.2.29-5Dan Walsh 2.2.29-4Dan Walsh 2.2.29-3Dan Walsh 2.2.29-2Dan Walsh 2.2.29-1Dan Walsh 2.2.28-3Dan Walsh 2.2.28-2Dan Walsh 2.2.28-1Dan Walsh 2.2.27-1Dan Walsh 2.2.25-3Dan Walsh 2.2.25-2Dan Walsh 2.2.24-1Dan Walsh 2.2.23-19Dan Walsh 2.2.23-18Dan Walsh 2.2.23-17Karsten Hopp 2.2.23-16Dan Walsh 2.2.23-15Dan Walsh 2.2.23-14Dan Walsh 2.2.23-13Dan Walsh 2.2.23-12Jeremy Katz - 2.2.23-11Jeremy Katz - 2.2.23-10Dan Walsh 2.2.23-9Dan Walsh 2.2.23-8Dan Walsh 2.2.23-7Dan Walsh 2.2.23-5Dan Walsh 2.2.23-4Dan Walsh 2.2.23-3Dan Walsh 2.2.23-2Dan Walsh 2.2.23-1Dan Walsh 2.2.22-2Dan Walsh 2.2.22-1Dan Walsh 2.2.21-9Dan Walsh 2.2.21-8Dan Walsh 2.2.21-7Dan Walsh 2.2.21-6Dan Walsh 2.2.21-5Dan Walsh 2.2.21-4Dan Walsh 2.2.21-3Dan Walsh 2.2.21-2Dan Walsh 2.2.21-1Dan Walsh 2.2.20-1Dan Walsh 2.2.19-2Dan Walsh 2.2.19-1Dan Walsh 2.2.18-2Dan Walsh 2.2.18-1Dan Walsh 2.2.17-2Dan Walsh 2.2.16-1Dan Walsh 2.2.15-4Dan Walsh 2.2.15-3Dan Walsh 2.2.15-1Dan Walsh 2.2.14-2Dan Walsh 2.2.14-1Dan Walsh 2.2.13-1Dan Walsh 2.2.12-1Dan Walsh 2.2.11-2Dan Walsh 2.2.11-1Dan Walsh 2.2.10-1Dan Walsh 2.2.9-2Dan Walsh 2.2.9-1Dan Walsh 2.2.8-2Dan Walsh 2.2.7-1Dan Walsh 2.2.6-3Dan Walsh 2.2.6-2Dan Walsh 2.2.6-1Dan Walsh 2.2.5-1Dan Walsh 2.2.4-1Dan Walsh 2.2.3-1Dan Walsh 2.2.2-1Dan Walsh 2.2.1-1Dan Walsh 2.1.13-1Dan Walsh 2.1.12-3Dan Walsh 2.1.11-1Dan Walsh 2.1.10-1Jeremy Katz - 2.1.9-2Dan Walsh 2.1.9-1Dan Walsh 2.1.8-3Dan Walsh 2.1.8-2Dan Walsh 2.1.8-1Dan Walsh 2.1.7-4Dan Walsh 2.1.7-3Dan Walsh 2.1.7-2Dan Walsh 2.1.7-1Dan Walsh 2.1.6-24Dan Walsh 2.1.6-23Dan Walsh 2.1.6-22Dan Walsh 2.1.6-21Dan Walsh 2.1.6-20Dan Walsh 2.1.6-18Dan Walsh 2.1.6-17Dan Walsh 2.1.6-16Dan Walsh 2.1.6-15Dan Walsh 2.1.6-14Dan Walsh 2.1.6-13Dan Walsh 2.1.6-11Dan Walsh 2.1.6-10Dan Walsh 2.1.6-9Dan Walsh 2.1.6-8Dan Walsh 2.1.6-5Dan Walsh 2.1.6-4Dan Walsh 2.1.6-3Dan Walsh 2.1.6-2Dan Walsh 2.1.6-1Dan Walsh 2.1.4-2Dan Walsh 2.1.4-1Dan Walsh 2.1.3-1Jeremy Katz - 2.1.2-3Dan Walsh 2.1.2-2Dan Walsh 2.1.2-1Dan Walsh 2.1.1-3Dan Walsh 2.1.1-2Dan Walsh 2.1.1-1Dan Walsh 2.1.0-3Dan Walsh 2.1.0-2.Dan Walsh 2.1.0-1.Dan Walsh 2.0.11-2.Dan Walsh 2.0.11-1.Dan Walsh 2.0.9-1.Dan Walsh 2.0.8-1.Dan Walsh 2.0.7-3Dan Walsh 2.0.7-2Dan Walsh 2.0.6-2Dan Walsh 2.0.5-4Dan Walsh 2.0.5-1Dan Walsh 2.0.4-1Dan Walsh 2.0.2-2Dan Walsh 2.0.2-1Dan Walsh 2.0.1-2Dan Walsh 2.0.1-1- Add support for vdsm. Resolves:#1172146 - ALlow sanlock to send a signal to virtd_t. - ALlow sanlock_t to read sysfs. Resolves:#1172147- Allow logrotate to manage virt_cache_t type Resolves:#1159834- Back port OpenStack fixes - Allow mdadm to connect to own socket created by mdadm running as kernel_t Resolves:#1132828- Allow swift to execute bin_t - Allow swift to bind http_cache - Label /var/log/horizon as an apache log- Allow neutron to bind xserver port - Allow neutron to execute kmod in insmod_t - Allow neutron to execute udevadm in udev_t - Allow keepalived to execute bin_t/shell_exec_t - Allow neutron to create sock files - Label swift-proxy-server as swift_exec_t- Allow rsync to create swift_server.lock with swift.log labeling - Add labeling for swift lock files - Make neutron_t as unconfined domain- Add more fixes for OpenStack - Add fixes for geard - Make openwsman as unconfined_domain in RHEL7.0- Back port openstack fixes - svirt sandbox domains to read gear content in /run - Allow gear_t to manage openshift files- More rules for gears and openshift Resolves:#1092405- Bump release to rebuild as z-stream Resolves:#1092405- Add fixes for gear to just execute ifconfig - More fixes for mongod_t Resolves:#1092405- Bump release Resolves:#1092405- Allow mongod to create sock files Resolves:#1092405 - Add additional fixes related to docker and upgrade issues- Change hsperfdata_root to have as user_tmp_t Resolves:#1076523- Fix Multiple same specifications for /var/named/chroot/dev/zero - Add labels for /var/named/chroot_sdb/dev devices - Add support for strongimcv - Use kerberos_keytab_domains in auth_use_nsswitch - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to - Allow net_raw cap for neutron_t and send sigkill to dnsmasq - Fix ntp_filetrans_named_content for sntp-kod file - Add httpd_dbus_sssd boolean - Dontaudit exec insmod in boinc policy - Rename kerberos_keytab_domain to kerberos_keytab_domains - Add kerberos_keytab_domain() - Fix kerberos_keytab_template() - Make all domains which use kerberos as kerberos_keytab_domain Resolves:#1083670 - Allow kill capability to winbind_t- varnishd wants chown capability - update ntp_filetrans_named_content() interface - Add additional fixes for neutron_t. #1083335 - Dontaudit getattr on proc_kcore_t - Allow pki_tomcat_t to read ipa lib files - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign - Allow init_t run /sbin/augenrules - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces - Allow unpriv SELinux user to use sandbox - Add default label for /tmp/hsperfdata_root- Add file subs also for /var/home- Allow xauth_t to read user_home_dir_t lnk_file - Add labeling for lightdm-data - Allow certmonger to manage ipa lib files - Add support for /var/lib/ipa - Allow pegasus to getattr virt_content - Added some new rules to pcp policy - Allow chrome_sandbox to execute config_home_t - Add support for ABRT FAF- Allow kdm to send signull to remote_login_t process - Add gear policy - Turn on gear_port_t - Allow cgit to read gitosis lib files by default - Allow vdagent to read xdm state - Allow NM and fcoeadm to talk together over unix_dgram_socket- Back port fixes for pegasus_openlmi_admin_t from rawhide Resolves:#1080973 - Add labels for ostree - Add SELinux awareness for NM - Label /usr/sbin/pwhistory_helper as updpwd_exec_t- add gnome_append_home_config() - Allow thumb to append GNOME config home files - Allow rasdaemon to rw /dev/cpu//msr - fix /var/log/pki file spec - make bacula_t as auth_nsswitch domain - Identify pki_tomcat_cert_t as a cert_type - Define speech-dispater_exec_t as an application executable - Add a new file context for /var/named/chroot/run directory - update storage_filetrans_all_named_dev for sg* devices - Allow auditctl_t to getattr on all removeable devices - Allow nsswitch_domains to stream connect to nmbd - Allow unprivusers to connect to memcached - label /var/lib/dirsrv/scripts-INSTANCE as bin_t- Allow also unpriv user to run vmtools - Allow secadm to read /dev/urandom and meminfo Resolves:#1079250 - Add booleans to allow docker processes to use nfs and samba - Add mdadm_tmpfs support - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t - Allow vmware-user-sui to use user ttys - Allow talk 2 users logged via console too - Allow ftp services to manage xferlog_t - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies - allow anaconda to dbus chat with systemd-localed- allow anaconda to dbus chat with systemd-localed - Add fixes for haproxy based on bperkins@redhat.com - Allow cmirrord to make dmsetup working - Allow NM to execute arping - Allow users to send messages through talk - Add userdom_tmp_role for secadm_t- Add additional fixes for rtas_errd - Fix transitions for tmp/tmpfs in rtas.te - Allow rtas_errd to readl all sysctls- Add support for /var/spool/rhsm/debug - Make virt_sandbox_use_audit as True by default - Allow svirt_sandbox_domains to ptrace themselves- Allow docker containers to manage /var/lib/docker content- Allow docker to read tmpfs_t symlinks - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets- Allow collectd to talk to libvirt - Allow chrome_sandbox to use leaked unix_stream_sockets - Dontaudit leaks of sockets into chrome_sandbox_t - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t - Run vmtools as unconfined domains - Allow snort to manage its log files - Allow systemd_cronjob_t to be entered via bin_t - Allow procman to list doveconf_etc_t - allow keyring daemon to create content in tmpfs directories - Add proper labelling for icedtea-web - vpnc is creating content in networkmanager var run directory - Label sddm as xdm_exec_t to make KDE working again - Allow postgresql to read network state - Allow java running as pki_tomcat to read network sysctls - Fix cgroup.te to allow cgred to read cgconfig_etc_t - Allow beam.smp to use ephemeral ports - Allow winbind to use the nis to authenticate passwords- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least. - Allow net_admin cap for fence_virtd running as fenced_t - Make abrt-java-connector working - Make cimtest script 03_defineVS.py of ComputerSystem group working - Fix git_system_enable_homedirs boolean - Allow munin mail plugins to read network systcl- Allow vmtools_helper_t to execute bin_t - Add support for /usr/share/joomla - /var/lib/containers should be labeled as openshift content for now - Allow docker domains to talk to the login programs, to allow a process to login into the container - Allow install_t do dbus chat with NM - Fix interface names in anaconda.if - Add install_t for anaconda. A new type is a part of anaconda policy - sshd to read network sysctls- Allow zabbix to send system log msgs - Allow init_t to stream connect to ipsec Resolves:#1060775- Add docker_connect_any boolean- Allow unpriv SELinux users to dbus chat with firewalld - Add lvm_write_metadata() - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type - Allow pegasus_openlmi_storage_t to write lvm metadata - Add hide_broken_symptoms for kdumpgui because of systemd bug - Make kdumpgui_t as unconfined domain Resolves:#1044299 - Allow docker to connect to tcp/5000- Allow numad to write scan_sleep_millisecs - Turn on entropyd_use_audio boolean by default - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf. - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo - Fix label on irclogs in the homedir - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix - Allow postgresql to use ldap - Add missing syslog-conn port - Add support for /dev/vmcp and /dev/sclp Resolves:#1069310- Modify xdm_write_home to allow create files/links in /root with xdm_home_ - Allow virt domains to read network state Resolves:#1072019- Added pcp rules - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6 - clean up ctdb.te - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow certmonger to list home dirs- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask - Add sysnet_filetrans_named_content_ifconfig() interface - Allow ctdbd to connect own ports - Fix samba_export_all_rw booleanto cover also non security dirs - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs - Allow neutron to create /run/netns with correct labeling - Allow kerberos keytab domains to manage sssd/userdomain keys" - Allow to run ip cmd in neutron_t domain- Allow block_suspend cap2 for systemd-logind and rw dri device - Add labeling for /usr/libexec/nm-libreswan-service - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working - Add xserver_rw_xdm_keys() - Allow rpm_script_t to dbus chat also with systemd-located - Fix ipa_stream_connect_otpd() - update lpd_manage_spool() interface - Allow krb5kdc to stream connect to ipa-otpd - Add ipa_stream_connect_otpd() interface - Allow vpnc to unlink NM pids - Add networkmanager_delete_pid_files() - Allow munin plugins to access unconfined plugins - update abrt_filetrans_named_content to cover /var/spool/debug - Label /var/spool/debug as abrt_var_cache_t - Allow rhsmcertd to connect to squid port - Make docker_transition_unconfined as optional boolean - Allow certmonger to list home dirs- Make snapperd as unconfined domain and add additional fixes for it - Remove nsplugin.pp module on upgrade- Add snapperd_home_t for HOME_DIR/.snapshots directory - Make sosreport as unconfined domain - Allow sosreport to execute grub2-probe - Allow NM to manage hostname config file - Allow systemd_timedated_t to dbus chat with rpm_script_t - Allow lsmd plugins to connect to http/ssh/http_cache ports by default - Add lsmd_plugin_connect_any boolean - Allow mozilla_plugin to attempt to set capabilities - Allow lsdm_plugins to use tcp_socket - Dontaudit mozilla plugin from getattr on /proc or /sys - Dontaudit use of the keyring by the services in a sandbox - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t - Allow rabbitmq_beam to connect to jabber_interserver_port - Allow logwatch_mail_t to transition to qmail_inject and queueu - Added new rules to pcp policy - Allow vmtools_helper_t to change role to system_r - Allow NM to dbus chat with vmtools - Fix couchdb_manage_files() to allow manage couchdb conf files - Add support for /var/run/redis.sock - dontaudit gpg trying to use audit - Allow consolekit to create log directories and files - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow pkcsslotd to read users state - Add ioctl to init_dontaudit_rw_stream_socket - Add systemd_hostnamed_manage_config() interface - Remove transition for temp dirs created by init_t - gdm-simple-slave uses use setsockopt - sddm-greater is a xdm type program- Add lvm_read_metadata() - Allow auditadm to search /var/log/audit dir - Add lvm_read_metadata() interface - Allow confined users to run vmtools helpers - Fix userdom_common_user_template() - Generic systemd unit scripts do write check on / - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files - Add additional fixes needed for init_t and setup script running in generic unit files - Allow general users to create packet_sockets - added connlcli port - Add init_manage_transient_unit() interface - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t - Fix userdomain.te to require passwd class - devicekit_power sends out a signal to all processes on the message bus when power is going down - Dontaudit rendom domains listing /proc and hittping system_map_t - Dontauit leaks of var_t into ifconfig_t - Allow domains that transition to ssh_t to manipulate its keyring - Define oracleasm_t as a device node - Change to handle /root as a symbolic link for os-tree - Allow sysadm_t to create packet_socket, also move some rules to attributes - Add label for openvswitch port - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label. - Allow postfix_local to read .forward in pcp lib files - Allow pegasus_openlmi_storage_t to read lvm metadata - Add additional fixes for pegasus_openlmi_storage_t - Allow bumblebee to manage debugfs - Make bumblebee as unconfined domain - Allow snmp to read etc_aliases_t - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem - Allow pegasus_openlmi_storage_t to read /proc/1/environ - Dontaudit read gconf files for cupsd_config_t - make vmtools as unconfined domain - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig. - Allow collectd_t to use a mysql database - Allow ipa-otpd to perform DNS name resolution - Added new policy for keepalived - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd - Add additional fixes new pscs-lite+polkit support - Add labeling for /run/krb5kdc - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20 - Allow pcscd to read users proc info - Dontaudit smbd_t sending out random signuls - Add boolean to allow openshift domains to use nfs - Allow w3c_validator to create content in /tmp - zabbix_agent uses nsswitch - Allow procmail and dovecot to work together to deliver mail - Allow spamd to execute files in homedir if boolean turned on - Allow openvswitch to listen on port 6634 - Add net_admin capability in collectd policy - Fixed snapperd policy - Fixed bugsfor pcp policy - Allow dbus_system_domains to be started by init - Fixed some interfaces - Add kerberos_keytab_domain attribute - Fix snapperd_conf_t def- Addopt corenet rules for unbound-anchor to rpm_script_t - Allow runuser to send send audit messages. - Allow postfix-local to search .forward in munin lib dirs - Allow udisks to connect to D-Bus - Allow spamd to connect to spamd port - Fix syntax error in snapper.te - Dontaudit osad to search gconf home files - Allow rhsmcertd to manage /etc/sysconf/rhn director - Fix pcp labeling to accept /usr/bin for all daemon binaries - Fix mcelog_read_log() interface - Allow iscsid to manage iscsi lib files - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it. - Make tuned_t as unconfined domain for RHEL7.0 - Allow ABRT to read puppet certs - Add sys_time capability for virt-ga - Allow gemu-ga to domtrans to hwclock_t - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages - Fix some AVCs in pcp policy - Add to bacula capability setgid and setuid and allow to bind to bacula ports - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t - Add access rhnsd and osad to /etc/sysconfig/rhn - drbdadm executes drbdmeta - Fixes needed for docker - Allow epmd to manage /var/log/rabbitmq/startup_err file - Allow beam.smp connect to amqp port - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t - Allow systemd_tmpfiles_t to manage all non security files on the system - Added labels for bacula ports - Fix label on /dev/vfio/vfio - Add kernel_mounton_messages() interface - init wants to manage lock files for iscsi- Added osad policy - Allow postfix to deliver to procmail - Allow bumblebee to seng kill signal to xserver - Allow vmtools to execute /usr/bin/lsb_release - Allow docker to write system net ctrls - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix pcp.te - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl- Turn on bacula, rhnsd policy - Add support for rhnsd unit file - Add dbus_chat_session_bus() interface - Add dbus_stream_connect_session_bus() interface - Fix logrotate_use_nfs boolean - Add lot of pcp fixes found in RHEL7 - fix labeling for pmie for pcp pkg - Change thumb_t to be allowed to chat/connect with session bus type - Allow call renice in mlocate - Add logrotate_use_nfs boolean - Allow setroubleshootd to read rpc sysctl - Fixes for *_admin interfaces - Add pegasus_openlmi_storage_var_run_t type def - Add support for /var/run/openlmi-storage - Allow tuned to create syslog.conf with correct labeling - Add httpd_dontaudit_search_dirs boolean - Add support for winbind.service - ALlow also fail2ban-client to read apache logs - Allow vmtools to getattr on all fs - Add support for dey_sapi port - Add logging_filetrans_named_conf() - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring- Update snapper policy - Allow domains to append rkhunter lib files - Allow snapperd to getattr on all fs - Allow xdm to create /var/gdm with correct labeling - Add label for snapper.log - Allow fail2ban-client to read apache log files - Allow thumb_t to execute dbus-daemon in thumb_t- Allow gdm to create /var/gdm with correct labeling - Allow domains to append rkhunterl lib files. #1057982 - Allow systemd_tmpfiles_t net_admin to communicate with journald - Add interface to getattr on an isid_type for any type of file - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory - Allow initrc_t domtrans to authconfig if unconfined is enabled - Allow docker and mount on devpts chr_file - Allow docker to transition to unconfined_t if boolean set - init calling needs to be optional in domain.te - Allow uncofined domain types to handle transient unit files - Fix labeling for vfio devices - Allow net_admin capability and send system log msgs - Allow lldpad send dgram to NM - Add networkmanager_dgram_send() - rkhunter_var_lib_t is correct type - Back port pcp policy from rawhide - Allow openlmi-storage to read removable devices - Allow system cron jobs to manage rkhunter lib files - Add rkhunter_manage_lib_files() - Fix ftpd_use_fusefs boolean to allow manage also symlinks - Allow smbcontrob block_suspend cap2 - Allow slpd to read network and system state info - Allow NM domtrans to iscsid_t if iscsiadm is executed - Allow slapd to send a signal itself - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA. - Fix plymouthd_create_log() interface - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container - Allow postfix and cyrus-imapd to work out of box - Allow fcoemon to talk with unpriv user domain using unix_stream_socket - Dontaudit domains that are calling into journald to net_admin - Add rules to allow vmtools to do what it does - snapperd is D-Bus service - Allow OpenLMI PowerManagement to call 'systemctl --force reboot' - Add haproxy_connect_any boolean - Allow haproxy also to use http cache port by default Resolves:#1058248- Allow apache to write to the owncloud data directory in /var/www/html... - Allow consolekit to create log dir - Add support for icinga CGI scripts - Add support for icinga - Allow kdumpctl_t to create kdump lock file Resolves:#1055634 - Allow kdump to create lnk lock file - Allow nscd_t block_suspen capability - Allow unconfined domain types to manage own transient unit file - Allow systemd domains to handle transient init unit files - Add interfaces to handle transient- Add cron unconfined role support for uncofined SELinux user - Call corenet_udp_bind_all_ports() in milter.te - Allow fence_virtd to connect to zented port - Fix header for mirrormanager_admin() - Allow dkim-milter to bind udp ports - Allow milter domains to send signull itself - Allow block_suspend for yum running as mock_t - Allow beam.smp to manage couchdb files - Add couchdb_manage_files() - Add labeling for /var/log/php_errors.log - Allow bumblebee to stream connect to xserver - Allow bumblebee to send a signal to xserver - gnome-thumbnail to stream connect to bumblebee - Allow xkbcomp running as bumblebee_t to execute bin_t - Allow logrotate to read squid.conf - Additional rules to get docker and lxc to play well with SELinux - Allow bumbleed to connect to xserver port - Allow pegasus_openlmi_storage_t to read hwdata- Allow init_t to work on transitient and snapshot unit files - Add logging_manage_syslog_config() - Update sysnet_dns_name_resolve() to allow connect to dnssec por - Allow pegasus_openlmi_storage_t to read hwdata Resolves:#1031721 - Fix rhcs_rw_cluster_tmpfs() - Allow fenced_t to bind on zented udp port - Added policy for vmtools - Fix mirrormanager_read_lib_files() - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files - Allow ctdb to create sock files in /var/run/ctdb - Add sblim_filetrans_named_content() interface - Allow rpm scritplets to create /run/gather with correct labeling - Allow gnome keyring domains to create gnome config dirs - Dontaudit read/write to init stream socket for lsmd_plugin_t - Allow automount to read nfs link files - Allow lsm plugins to read/write lsmd stream socket - Allow certmonger to connect ldap port to make IPA CA certificate renewal working. - Add also labeling for /var/run/ctdb - Add missing labeling for /var/lib/ctdb - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446 - Dontaudit hypervkvp to search homedirs - Dontaudit hypervkvp to search admin homedirs - Allow hypervkvp to execute bin_t and ifconfig in the caller domain - Dontaudit xguest_t to read ABRT conf files - Add abrt_dontaudit_read_config() - Allow namespace-init to getattr on fs - Add thumb_role() also for xguest - Add filename transitions to create .spamassassin with correct labeling - Allow apache domain to read mirrormanager pid files - Allow domains to read/write shm and sem owned by mozilla_plugin_t - Allow alsactl to send a generic signal to kernel_t- Add back rpm_run() for unconfined user- Add missing files_create_var_lib_dirs() - Fix typo in ipsec.te - Allow passwd to create directory in /var/lib - Add filename trans also for event21 - Allow iptables command to read /dev/rand - Add sigkill capabilityfor ipsec_t - Add filename transitions for bcache devices - Add additional rules to create /var/log/cron by syslogd_t with correct labeling - Add give everyone full access to all key rings - Add default lvm_var_run_t label for /var/run/multipathd - Fix log labeling to have correct default label for them after logrotate - Labeled ~/.nv/GLCache as being gstreamer output - Allow nagios_system_plugin to read mrtg lib files - Add mrtg_read_lib_files() - Call rhcs_rw_cluster_tmpfs for dlm_controld - Make authconfing as named_filetrans domain - Allow virsh to connect to user process using stream socket - Allow rtas_errd to read rand/urand devices and add chown capability - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp Resolves:#1051497 - Add also chown cap for abrt_upload_watch_t. It already has dac_override - Allow sosreport to manage rhsmcertd pid files - Add rhsmcertd_manage_pid_files() - Allow also setgid cap for rpc.gssd - Dontaudit access check for abrt on cert_t - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind- Fix semanage import handling in spec file- Add default lvm_var_run_t label for /var/run/multipathd Resolves:#1051430 - Fix log labeling to have correct default label for them after logrotate - Add files_write_root_dirs - Add new openflow port label for 6653/tcp and 6633/tcp - Add xserver_manage_xkb_libs() - Label tcp/8891 as milter por - Allow gnome_manage_generic_cache_files also create cache_home_t files - Fix aide.log labeling - Fix log labeling to have correct default label for them after logrotate - Allow mysqld-safe write access on /root to make mysqld working - Allow sosreport domtrans to prelikn - Allow OpenvSwitch to connec to openflow ports - Allow NM send dgram to lldpad - Allow hyperv domains to execute shell - Allow lsmd plugins stream connect to lsmd/init - Allow sblim domains to create /run/gather with correct labeling - Allow httpd to read ldap certs - Allow cupsd to send dbus msgs to process with different MLS level - Allow bumblebee to stream connect to apmd - Allow bumblebee to run xkbcomp - Additional allow rules to get libvirt-lxc containers working with docker - Additional allow rules to get libvirt-lxc containers working with docker - Allow docker to getattr on itself - Additional rules needed for sandbox apps - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled - httpd should be able to send signal/signull to httpd_suexec_t - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.- Add neutron fixes- Allow sshd to write to all process levels in order to change passwd when running at a level - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range - Allow apcuspd_t to status and start the power unit file - Allow udev to manage kdump unit file - Added new interface modutils_dontaudit_exec_insmod - Allow cobbler to search dhcp_etc_t directory - systemd_systemctl needs sys_admin capability - Allow sytemd_tmpfiles_t to delete all directories - passwd to create gnome-keyring passwd socket - Add missing zabbix_var_lib_t type - Fix filename trans for zabbixsrv in zabbix.te - Allow fprintd_t to send syslog messages - Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port - Allow mozilla plugin to chat with policykit, needed for spice - Allow gssprozy to change user and gid, as well as read user keyrings - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly - Allow polipo to connect to http_cache_ports - Allow cron jobs to manage apache var lib content - Allow yppassword to manage the passwd_file_t - Allow showall_t to send itself signals - Allow cobbler to restart dhcpc, dnsmasq and bind services - Allow certmonger to manage home cert files - Add userdom filename trans for user mail domains - Allow apcuspd_t to status and start the power unit file - Allow cgroupdrulesengd to create content in cgoups directories - Allow smbd_t to signull cluster - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t - Add label for /var/spool/cron.aquota.user - Allow sandbox_x domains to use work with the mozilla plugin semaphore - Added new policy for speech-dispatcher - Added dontaudit rule for insmod_exec_t in rasdaemon policy - Updated rasdaemon policy - Allow system_mail_t to transition to postfix_postdrop_t - Clean up mirrormanager policy - Allow virt_domains to read cert files, needs backport to RHEL7 - Allow sssd to read systemd_login_var_run_t - Allow irc_t to execute shell and bin-t files: - Add new access for mythtv - Allow rsync_t to manage all non auth files - allow modemmanger to read /dev/urand - Allow sandbox apps to attempt to set and get capabilties- Add labeling for /var/lib/servicelog/servicelog.db-journal - Add support for freeipmi port - Add sysadm_u_default_contexts - Make new type to texlive files in homedir - Allow subscription-manager running as sosreport_t to manage rhsmcertd - Additional fixes for docker.te - Remove ability to do mount/sys_admin by default in virt_sandbox domains - New rules required to run docker images within libivrt - Add label for ~/.cvsignore - Change mirrormanager to be run by cron - Add mirrormanager policy - Fixed bumblebee_admin() and mip6d_admin() - Add log support for sensord - Fix typo in docker.te - Allow amanda to do backups over UDP - Allow bumblebee to read /etc/group and clean up bumblebee.te - type transitions with a filename not allowed inside conditionals - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7 - Make new type to texlive files in homedir- Allow freeipmi_ipmidetectd_t to use freeipmi port - Update freeipmi_domain_template() - Allow journalctl running as ABRT to read /run/log/journal - Allow NM to read dispatcher.d directory - Update freeipmi policy - Type transitions with a filename not allowed inside conditionals - Allow tor to bind to hplip port - Make new type to texlive files in homedir - Allow zabbix_agent to transition to dmidecode - Add rules for docker - Allow sosreport to send signull to unconfined_t - Add virt_noatsecure and virt_rlimitinh interfaces - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port - Add sysadm_u_default_contexts - Add logging_read_syslog_pid() - Fix userdom_manage_home_texlive() interface - Make new type to texlive files in homedir - Add filename transitions for /run and /lock links - Allow virtd to inherit rlimit information Resolves:#975358- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t Resolves:#1039879 - Add labeling for /usr/lib/systemd/system/mariadb.service - Allow hyperv_domain to read sysfs - Fix ldap_read_certs() interface to allow acess also link files - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt - Allow tuned to run modprobe - Allow portreserve to search /var/lib/sss dir - Add SELinux support for the teamd package contains team network device control daemon. - Dontaudit access check on /proc for bumblebee - Bumblebee wants to load nvidia modules - Fix rpm_named_filetrans_log_files and wine.te - Add conman policy for rawhide - DRM master and input event devices are used by the TakeDevice API - Clean up bumblebee policy - Update pegasus_openlmi_storage_t policy - Add freeipmi_stream_connect() interface - Allow logwatch read madm.conf to support RAID setup - Add raid_read_conf_files() interface - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling - add rpm_named_filetrans_log_files() interface - Allow dkim-milter to create files/dirs in /tmp - update freeipmi policy - Add policy for freeipmi services - Added rdisc_admin and rdisc_systemctl interfaces - opensm policy clean up - openwsman policy clean up - ninfod policy clean up - Added new policy for ninfod - Added new policy for openwsman - Added rdisc_admin and rdisc_systemctl interfaces - Fix kernel_dontaudit_access_check_proc() - Add support for /dev/uhid - Allow sulogin to get the attributes of initctl and sys_admin cap - Add kernel_dontaudit_access_check_proc() - Fix dev_rw_ipmi_dev() - Fix new interface in devices.if - DRM master and input event devices are used by the TakeDevice API - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev() - Added support for default conman port - Add interfaces for ipmi devices- Allow sosreport to send a signal to ABRT - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t - Label /usr/sbin/htcacheclean as httpd_exec_t Resolves:#1037529 - Added support for rdisc unit file - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs - Allow runuser running as logrotate connections to system DBUS - Label bcache devices as fixed_disk_device_t - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t- Add back setpgid/setsched for sosreport_t- Added fix for clout_init to transition to rpm_script_t (dwalsh@redhat.com)- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel. - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on - Add lsmd_plugin_t for lsm plugins - Allow dovecot-deliver to search mountpoints - Add labeling for /etc/mdadm.conf - Allow opelmi admin providers to dbus chat with init_t - Allow sblim domain to read /dev/urandom and /dev/random - Allow apmd to request the kernel load modules - Add glusterd_brick_t type - label mate-keyring-daemon with gkeyringd_exec_t - Add plymouthd_create_log() - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6 - Allow sssd to request the kernel loads modules - Allow gpg_agent to use ssh-add - Allow gpg_agent to use ssh-add - Dontaudit access check on /root for myslqd_safe_t - Allow ctdb to getattr on al filesystems - Allow abrt to stream connect to syslog - Allow dnsmasq to list dnsmasq.d directory - Watchdog opens the raw socket - Allow watchdog to read network state info - Dontaudit access check on lvm lock dir - Allow sosreport to send signull to setroubleshootd - Add setroubleshoot_signull() interface - Fix ldap_read_certs() interface - Allow sosreport all signal perms - Allow sosreport to run systemctl - Allow sosreport to dbus chat with rpm - Add glusterd_brick_t files type - Allow zabbix_agentd to read all domain state - Clean up rtas.if - Allow smoltclient to execute ldconfig - Allow sosreport to request the kernel to load a module - Fix userdom_confined_admin_template() - Add back exec_content boolean for secadm, logadm, auditadm - Fix files_filetrans_system_db_named_files() interface - Allow sulogin to getattr on /proc/kcore - Add filename transition also for servicelog.db-journal - Add files_dontaudit_access_check_root() - Add lvm_dontaudit_access_check_lock() interface- Allow watchdog to read /etc/passwd - Allow browser plugins to connect to bumblebee - New policy for bumblebee and freqset - Add new policy for mip6d daemon - Add new policy for opensm daemon - Allow condor domains to read/write condor_master udp_socket - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift - Add back file_pid_filetrans for /var/run/dlm_controld - Allow smbd_t to use inherited tmpfs content - Allow mcelog to use the /dev/cpu device - sosreport runs rpcinfo - sosreport runs subscription-manager - Allow staff_t to run frequency command - Allow systemd_tmpfiles to relabel log directories - Allow staff_t to read xserver_log file - Label hsperfdata_root as tmp_t- More sosreport fixes to make ABRT working- Fix files_dontaudit_unmount_all_mountpoints() - Add support for 2608-2609 tcp/udp ports - Should allow domains to lock the terminal device - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - We need to require passwd rootok - Fix zebra.fc - Fix dnsmasq_filetrans_named_content() interface - Allow all sandbox domains create content in svirt_home_t - Allow zebra domains also create zebra_tmp_t files in /tmp - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services. - Fix labeling on neutron and remove transition to iconfig_t - abrt needs to read mcelog log file - Fix labeling on dnsmasq content - Fix labeling on /etc/dnsmasq.d - Allow glusterd to relabel own lib files - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd - Allow ipc_lock for abrt to run journalctl- Fix config.tgz- Fix passenger_stream_connect interface - setroubleshoot_fixit wants to read network state - Allow procmail_t to connect to dovecot stream sockets - Allow cimprovagt service providers to read network states - Add labeling for /var/run/mariadb - pwauth uses lastlog() to update system's lastlog - Allow account provider to read login records - Add support for texlive2013 - More fixes for user config files to make crond_t running in userdomain - Add back disable/reload/enable permissions for system class - Fix manage_service_perms macro - Allow passwd_t to connect to gnome keyring to change password - Update mls config files to have cronjobs in the user domains - Remove access checks that systemd does not actually do- Add support for yubikey in homedir - Add support for upd/3052 port - Allow apcupsd to use PowerChute Network Shutdown - Allow lsmd to execute various lsmplugins - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too - Update gluster_export_all_rw boolean to allow relabel all base file types - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling- Add files_relabel_base_file_types() interface - Allow netlabel-config to read passwd - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr() - Allow x86_energy_perf tool to modify the MSR - Fix /var/lib/dspam/data labeling - Allow pegasus to domtrans to mount_t - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts - Add support for unconfined watchdog scripts - Allow watchdog to manage own log files- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory. - Label /etc/yum.repos.d as system_conf_t - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t - Allow dac_override for sysadm_screen_t - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file. - Allow netlabel-config to read meminfo - Add interface to allow docker to mounton file_t - Add new interface to exec unlabeled files - Allow lvm to use docker semaphores - Setup transitons for .xsessions-errors.old - Change labels of files in /var/lib/*/.ssh to transition properly - Allow staff_t and user_t to look at logs using journalctl - pluto wants to manage own log file - Allow pluto running as ipsec_t to create pluto.log - Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files. - Additional access for docker - Added more rules to sblim policy - Fix kdumpgui_run_bootloader boolean - Allow dspam to connect to lmtp port - Included sfcbd service into sblim policy - rhsmcertd wants to manaage /etc/pki/consumer dir - Add kdumpgui_run_bootloader boolean - Add support for /var/cache/watchdog - Remove virt_domain attribute for virt_qemu_ga_unconfined_t - Fixes for handling libvirt containes - Dontaudit attempts by mysql_safe to write content into / - Dontaudit attempts by system_mail to modify network config - Allow dspam to bind to lmtp ports - Add new policy to allow staff_t and user_t to look at logs using journalctl - Allow apache cgi scripts to list sysfs - Dontaudit attempts to write/delete user_tmp_t files - Allow all antivirus domains to manage also own log dirs - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Add missing permission checks for nscd- Fix alias decl in corenetwork.te.in - Add support for fuse.glusterfs - Add file transition rules for content created by f5link - Rename quantum_port information to neutron - Allow all antivirus domains to manage also own log dirs - Rename quantum_port information to neutron - Allow pegasus_openlmi_services_t to stream connect to sssd_t- Allow sysadm_t to read login information - Allow systemd_tmpfiles to setattr on var_log_t directories - Udpdate Makefile to include systemd_contexts - Add systemd_contexts - Add fs_exec_hugetlbfs_files() interface - Add daemons_enable_cluster_mode boolean - Fix rsync_filetrans_named_content() - Add rhcs_read_cluster_pid_files() interface - Update rhcs.if with additional interfaces from RHEL6 - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t - Allow glusterd_t to mounton glusterd_tmp_t - Allow glusterd to unmout al filesystems - Allow xenstored to read virt config - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label - Allow mozilla_plugin_t to mmap hugepages as an executable- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp- Allow sshd_t to read openshift content, needs backport to RHEL6.5 - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t - Make sur kdump lock is created with correct label if kdumpctl is executed - gnome interface calls should always be made within an optional_block - Allow syslogd_t to connect to the syslog_tls port - Add labeling for /var/run/charon.ctl socket - Add kdump_filetrans_named_content() - Allo setpgid for fenced_t - Allow setpgid and r/w cluster tmpfs for fenced_t - gnome calls should always be within optional blocks - wicd.pid should be labeled as networkmanager_var_run_t - Allow sys_resource for lldpad- Add rtas policy- Allow mailserver_domains to manage and transition to mailman data - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands - Allow mailserver_domains to manage and transition to mailman data - Allow svirt_domains to read sysctl_net_t - Allow thumb_t to use tmpfs inherited from the user - Allow mozilla_plugin to bind to the vnc port if running with spice - Add new attribute to discover confined_admins and assign confined admin to it - Fix zabbix to handle attributes in interfaces - Fix zabbix to read system states for all zabbix domains - Fix piranha_domain_template() - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files. - Allow lldpad sys_rouserce cap due to #986870 - Allow dovecot-auth to read nologin - Allow openlmi-networking to read /proc/net/dev - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t - Add zabbix_domain attribute for zabbix domains to treat them together - Add labels for zabbix-poxy-* (#1018221) - Update openlmi-storage policy to reflect #1015067 - Back port piranha tmpfs fixes from RHEL6 - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop - Add postfix_rw_spool_maildrop_files interface - Call new userdom_admin_user_templat() also for sysadm_secadm.pp - Fix typo in userdom_admin_user_template() - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey - Add new attribute to discover confined_admins - Fix labeling for /etc/strongswan/ipsec.d - systemd_logind seems to pass fd to anyone who dbus communicates with it - Dontaudit leaked write descriptor to dmesg- Activate motion policy- Fix gnome_read_generic_data_home_files() - allow openshift_cgroup_t to read/write inherited openshift file types - Remove httpd_cobbler_content * from cobbler_admin interface - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container - Allow httpd_t to read also git sys content symlinks - Allow init_t to read gnome home data - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it. - Allow virsh to execute systemctl - Fix for nagios_services plugins - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - Fix hypervkvp.te - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Fix logging policy - Allow syslog to bind to tls ports - Update labeling for /dev/cdc-wdm - Allow to su_domain to read init states - Allow init_t to read gnome home data - Make sure if systemd_logind creates nologin file with the correct label - Clean up ipsec.te- Add auth_exec_chkpwd interface - Fix port definition for ctdb ports - Allow systemd domains to read /dev/urand - Dontaudit attempts for mozilla_plugin to append to /dev/random - Add label for /var/run/charon.* - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service - Fix for nagios_services plugins - Fix some bugs in zoneminder policy - add type defintion for ctdbd_var_t - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file - Allow net_admin/netlink_socket all hyperv_domain domains - Add labeling for zarafa-search.log and zarafa-search.pid - glusterd binds to random unreserved ports - Additional allow rules found by testing glusterfs - apcupsd needs to send a message to all users on the system so needs to look them up - Fix the label on ~/.juniper_networks - Dontaudit attempts for mozilla_plugin to append to /dev/random - Allow polipo_daemon to connect to flash ports - Allow gssproxy_t to create replay caches - Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type- init reload from systemd_localed_t - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd - Allow systemd_localed_t to ask systemd to reload the locale. - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory - Allow readahead to read /dev/urand - Fix lots of avcs about tuned - Any file names xenstored in /var/log should be treated as xenstored_var_log_t - Allow tuned to inderact with hugepages - Allow condor domains to list etc rw dirs- Fix nscd_shm_use() - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services. - Add hypervkvp_unit_file_t type - Add additional fixes forpegasus_openlmi_account_t - Allow mdadm to read /dev/urand - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it - Add label/rules for /etc/mdadm.conf - Allow pegasus_openlmi_storage_t to transition to fsadm_t - Fixes for interface definition problems - Dontaudit dovecot-deliver to gettatr on all fs dirs - Allow domains to search data_home_t directories - Allow cobblerd to connect to mysql - Allow mdadm to r/w kdump lock files - Add support for kdump lock files - Label zarafa-search as zarafa-indexer - Openshift cgroup wants to read /etc/passwd - Add new sandbox domains for kvm - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on - Fix labeling for /usr/lib/systemd/system/lvm2.* - Add labeling for /usr/lib/systemd/system/lvm2.* - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules - Add sshd_keygen_t policy for sshd-keygen - Fix alsa_home_filetrans interface name and definition - Allow chown for ssh_keygen_t - Add fs_dontaudit_getattr_all_dirs() - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys - Fix up patch to allow systemd to manage home content - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled - Allow getty to exec hostname to get info - Add systemd_home_t for ~/.local/share/systemd directory- Fix lxc labels in config.tgz- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper - Allow tuned to search all file system directories - Allow alsa_t to sys_nice, to get top performance for sound management - Add support for MySQL/PostgreSQL for amavis - Allow openvpn_t to manage openvpn_var_log_t files. - Allow dirsrv_t to create tmpfs_t directories - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label - Dontaudit leaked unix_stream_sockets into gnome keyring - Allow telepathy domains to inhibit pipes on telepathy domains - Allow cloud-init to domtrans to rpm - Allow abrt daemon to manage abrt-watch tmp files - Allow abrt-upload-watcher to search /var/spool directory - Allow nsswitch domains to manage own process key - Fix labeling for mgetty.* logs - Allow systemd to dbus chat with upower - Allow ipsec to send signull to itself - Allow setgid cap for ipsec_t - Match upstream labeling- Do not build sanbox pkg on MLS- wine_tmp is no longer needed - Allow setroubleshoot to look at /proc - Allow telepathy domains to dbus with systemd logind - Fix handling of fifo files of rpm - Allow mozilla_plugin to transition to itself - Allow certwatch to write to cert_t directories - New abrt application - Allow NetworkManager to set the kernel scheduler - Make wine_domain shared by all wine domains - Allow mdadm_t to read images labeled svirt_image_t - Allow amanda to read /dev/urand - ALlow my_print_default to read /dev/urand - Allow mdadm to write to kdumpctl fifo files - Allow nslcd to send signull to itself - Allow yppasswd to read /dev/urandom - Fix zarafa_setrlimit - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add additional alias for user_tmp_t because wine_tmp_t is no longer used - More handling of ther kernel keyring required by kerberos - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed- Dontaudit attempts by sosreport to read shadow_t - Allow browser sandbox plugins to connect to cups to print - Add new label mpd_home_t - Label /srv/www/logs as httpd_log_t - Add support for /var/lib/php/wsdlcache - Add zarafa_setrlimit boolean - Allow fetchmail to send mails - Add labels for apache logs under miq package - Allow irc_t to use tcp sockets - fix labels in puppet.if - Allow tcsd to read utmp file - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys - Define svirt_socket_t as a domain_type - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t - Fix label on pam_krb5 helper apps- Allow ldconfig to write to kdumpctl fifo files - allow neutron to connect to amqp ports - Allow kdump_manage_crash to list the kdump_crash_t directory - Allow glance-api to connect to amqp port - Allow virt_qemu_ga_t to read meminfo - Add antivirus_home_t type for antivirus date in HOMEDIRS - Allow mpd setcap which is needed by pulseaudio - Allow smbcontrol to create content in /var/lib/samba - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts - amanda_exec_t needs to be executable file - Allow block_suspend cap for samba-net - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t - Allow init_t to run crash utility - Treat usr_t just like bin_t for transitions and executions - Add port definition of pka_ca to port 829 for openshift - Allow selinux_store to use symlinks- Allow block_suspend cap for samba-net - Allow t-mission-control to manage gabble cache files - Allow nslcd to read /sys/devices/system/cpu - Allow selinux_store to use symlinks- Allow xdm_t to transition to itself - Call neutron interfaces instead of quantum - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t - Make sure directories in /run get created with the correct label - Make sure /root/.pki gets created with the right label - try to remove labeling for motion from zoneminder_exec_t to bin_t - Allow inetd_t to execute shell scripts - Allow cloud-init to read all domainstate - Fix to use quantum port - Add interface netowrkmanager_initrc_domtrans - Fix boinc_execmem - Allow t-mission-control to read gabble cache home - Add labeling for ~/.cache/telepathy/avatars/gabble - Allow memcache to read sysfs data - Cleanup antivirus policy and add additional fixes - Add boolean boinc_enable_execstack - Add support for couchdb in rabbitmq policy - Add interface couchdb_search_pid_dirs - Allow firewalld to read NM state - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files()- Split out rlogin ports from inetd - Treat files labeld as usr_t like bin_t when it comes to transitions - Allow staff_t to read login config - Allow ipsec_t to read .google authenticator data - Allow systemd running as git_systemd to bind git port - Fix mozilla_plugin_rw_tmpfs_files() - Call the correct interface - corenet_udp_bind_ktalkd_port() - Allow all domains that can read gnome_config to read kde config - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work - Allow mdadm to getattr any file system - Allow a confined domain to executes mozilla_exec_t via dbus - Allow cupsd_lpd_t to bind to the printer port - Dontaudit attempts to bind to ports < 1024 when nis is turned on - Allow apache domain to connect to gssproxy socket - Allow rlogind to bind to the rlogin_port - Allow telnetd to bind to the telnetd_port - Allow ktalkd to bind to the ktalkd_port - Allow cvs to bind to the cvs_port- Cleanup related to init_domain()+inetd_domain fixes - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain - svirt domains neeed to create kobject_uevint_sockets - Lots of new access required for sosreport - Allow tgtd_t to connect to isns ports - Allow init_t to transition to all inetd domains: - openct needs to be able to create netlink_object_uevent_sockets - Dontaudit leaks into ldconfig_t - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls - Move kernel_stream_connect into all Xwindow using users - Dontaudit inherited lock files in ifconfig o dhcpc_t- Also sock_file trans rule is needed in lsm - Fix labeling for fetchmail pid files/dirs - Add additional fixes for abrt-upload-watch - Fix polipo.te - Fix transition rules in asterisk policy - Add fowner capability to networkmanager policy - Allow polipo to connect to tor ports - Cleanup lsmd.if - Cleanup openhpid policy - Fix kdump_read_crash() interface - Make more domains as init domain - Fix cupsd.te - Fix requires in rpm_rw_script_inherited_pipes - Fix interfaces in lsm.if - Allow munin service plugins to manage own tmpfs files/dirs - Allow virtd_t also relabel unix stream sockets for virt_image_type - Make ktalk as init domain - Fix to define ktalkd_unit_file_t correctly - Fix ktalk.fc - Add systemd support for talk-server - Allow glusterd to create sock_file in /run - Allow xdm_t to delete gkeyringd_tmp_t files on logout - Add fixes for hypervkvp policy - Add logwatch_can_sendmail boolean - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb - Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add selinux-policy-sandbox pkg0 - Allow rhsmcertd to read init state - Allow fsetid for pkcsslotd - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service - Allow fetchmail to create own pid with correct labeling - Fix rhcs_domain_template() - Allow roles which can run mock to read mock lib files to view results - Allow rpcbind to use nsswitch - Fix lsm.if summary - Fix collectd_t can read /etc/passwd file - Label systemd unit files under dracut correctly - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh - Add support for .Xauthority-n - Label umount.crypt as lvm_exec_t - Allow syslogd to search psad lib files - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files- Add policy for lsmd - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory - Update condor_master rules to allow read system state info and allow logging - Add labeling for /etc/condor and allow condor domain to write it (bug) - Allow condor domains to manage own logs - Allow glusterd to read domains state - Fix initial hypervkvp policy - Add policy for hypervkvpd - Fix redis.if summary- Allow boinc to connect to @/tmp/.X11-unix/X0 - Allow beam.smp to connect to tcp/5984 - Allow named to manage own log files - Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t - Add virt_transition_userdomain boolean decl - Allow httpd_t to sendto unix_dgram sockets on its children - Allow nova domains to execute ifconfig - bluetooth wants to create fifo_files in /tmp - exim needs to be able to manage mailman data - Allow sysstat to getattr on all file systems - Looks like bluetoothd has moved - Allow collectd to send ping packets - Allow svirt_lxc domains to getpgid - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff - Allow frpintd_t to read /dev/urandom - Allow asterisk_t to create sock_file in /var/run - Allow usbmuxd to use netlink_kobject - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket - More cleanup of svirt_lxc policy - virtd_lxc_t now talks to dbus - Dontaudit leaked ptmx_t - Allow processes to use inherited fifo files - Allow openvpn_t to connect to squid ports - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert() - Allow ssh_t to use /dev/ptmx - Make sure /run/pluto dir is created with correct labeling - Allow syslog to run shell and bin_t commands - Allow ip to relabel tun_sockets - Allow mount to create directories in files under /run - Allow processes to use inherited fifo files - Allow user roles to connect to the journal socket- selinux_set_enforce_mode needs to be used with type - Add append to the dontaudit for unix_stream_socket of xdm_t leak - Allow xdm_t to create symlinks in log direcotries - Allow login programs to read afs config - Label 10933 as a pop port, for dovecot - New policy to allow selinux_server.py to run as semanage_t as a dbus service - Add fixes to make netlabelctl working on MLS - AVCs required for running sepolicy gui as staff_t - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC - New dbus server to be used with new gui - After modifying some files in /etc/mail, I saw this needed on the next boot - Loading a vm from /usr/tmp with virt-manager - Clean up oracleasm policy for Fedora - Add oracleasm policy written by rlopez@redhat.com - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache - Add label for /var/crash - Allow fenced to domtrans to sanclok_t - Allow nagios to manage nagios spool files - Make tfptd as home_manager - Allow kdump to read kcore on MLS system - Allow mysqld-safe sys_nice/sys_resource caps - Allow apache to search automount tmp dirs if http_use_nfs is enabled - Allow crond to transition to named_t, for use with unbound - Allow crond to look at named_conf_t, for unbound - Allow mozilla_plugin_t to transition its home content - Allow dovecot_domain to read all system and network state - Allow httpd_user_script_t to call getpw - Allow semanage to read pid files - Dontaudit leaked file descriptors from user domain into thumb - Make PAM authentication working if it is enabled in ejabberd - Add fixes for rabbit to fix ##992920,#992931 - Allow glusterd to mount filesystems - Loading a vm from /usr/tmp with virt-manager - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device - Add fix for pand service - shorewall touches own log - Allow nrpe to list /var - Mozilla_plugin_roles can not be passed into lpd_run_lpr - Allow afs domains to read afs_config files - Allow login programs to read afs config - Allow virt_domain to read virt_var_run_t symlinks - Allow smokeping to send its process signals - Allow fetchmail to setuid - Add kdump_manage_crash() interface - Allow abrt domain to write abrt.socket- Add more aliases in pegasus.te - Add more fixes for *_admin interfaces - Add interface fixes - Allow nscd to stream connect to nmbd - Allow gnupg apps to write to pcscd socket - Add more fixes for openlmi provides. Fix naming and support for additionals - Allow fetchmail to resolve host names - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te - Fix corecmd_exec_chroot() - Fix logging_relabel_syslog_pid_socket interface - Fix typo in unconfineduser.te - Allow system_r to access unconfined_dbusd_t to run hp_chec- Allow xdm_t to act as a dbus client to itsel - Allow fetchmail to resolve host names - Allow gnupg apps to write to pcscd socket - Add labeling for cmpiLMI_Fan-cimprovagt - Allow net_admin for glusterd - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/ - Add pegasus_openlmi_system_t - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te -httpd_t does access_check on certs- Add support for cmpiLMI_Service-cimprovagt - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t - Add support for pycmpiLMI_Storage-cimprovagt - Add support for cmpiLMI_Networking-cimprovagt - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working - Allow virtual machines and containers to run as user doains, needed for virt-sandbox - Allow buglist.cgi to read cpu info- Allow systemd-tmpfile to handle tmp content in print spool dir - Allow systemd-sysctl to send system log messages - Add support for RTP media ports and fmpro-internal - Make auditd working if audit is configured to perform SINGLE action on disk error - Add interfaces to handle systemd units - Make systemd-notify working if pcsd is used - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t - Instead of having all unconfined domains get all of the named transition rules, - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default. - Add definition for the salt ports - Allow xdm_t to create link files in xdm_var_run_t - Dontaudit reads of blk files or chr files leaked into ldconfig_t - Allow sys_chroot for useradd_t - Allow net_raw cap for ipsec_t - Allow sysadm_t to reload services - Add additional fixes to make strongswan working with a simple conf - Allow sysadm_t to enable/disable init_t services - Add additional glusterd perms - Allow apache to read lnk files in the /mnt directory - Allow glusterd to ask the kernel to load a module - Fix description of ftpd_use_fusefs boolean - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t - Allow glusterds to request load a kernel module - Allow boinc to stream connect to xserver_t - Allow sblim domains to read /etc/passwd - Allow mdadm to read usb devices - Allow collectd to use ping plugin - Make foghorn working with SNMP - Allow sssd to read ldap certs - Allow haproxy to connect to RTP media ports - Add additional trans rules for aide_db - Add labeling for /usr/lib/pcsd/pcsd - Add labeling for /var/log/pcsd - Add support for pcs which is a corosync and pacemaker configuration tool- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1 - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown - consolekit needs to be able to shut down system - Move around interfaces - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints - Allow gconf-defaults-m to read /etc/passwd - Fix pki_rw_tomcat_cert() interface to support lnk_files- Add support for gluster ports - Make sure that all keys located in /etc/ssh/ are labeled correctly - Make sure apcuspd lock files get created with the correct label - Use getcap in gluster.te - Fix gluster policy - add additional fixes to allow beam.smp to interact with couchdb files - Additional fix for #974149 - Allow gluster to user gluster ports - Allow glusterd to transition to rpcd_t and add additional fixes for #980683 - Allow tgtd working when accessing to the passthrough device - Fix labeling for mdadm unit files- Add mdadm fixes- Fix definition of sandbox.disabled to sandbox.pp.disabled- Allow mdamd to execute systemctl - Allow mdadm to read /dev/kvm - Allow ipsec_mgmt_t to read l2tpd pid content- Allow nsd_t to read /dev/urand - Allow mdadm_t to read framebuffer - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t - Allow mozilla_plugin_config_t to create tmp files - Cleanup openvswitch policy - Allow mozilla plugin to getattr on all executables - Allow l2tpd_t to create fifo_files in /var/run - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory - Allow mdadm to connecto its own unix_stream_socket - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now. - Allow apache to access smokeping pid files - Allow rabbitmq_beam_t to getattr on all filesystems - Add systemd support for iodined - Allow nup_upsdrvctl_t to execute its entrypoint - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch - add labeling for ~/.cache/libvirt-sandbox - Add interface to allow domains transitioned to by confined users to send sigchld to screen program - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs. - Allow staff to getsched all domains, required to run htop - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Add prosody policy written by Michael Scherer - Allow nagios plugins to read /sys info - ntpd needs to manage own log files - Add support for HOME_DIR/.IBMERS - Allow iptables commands to read firewalld config - Allow consolekit_t to read utmp - Fix filename transitions on .razor directory - Add additional fixes to make DSPAM with LDA working - Allow snort to read /etc/passwd - Allow fail2ban to communicate with firewalld over dbus - Dontaudit openshift_cgreoup_file_t read/write leaked dev - Allow nfsd to use mountd port - Call th proper interface - Allow openvswitch to read sys and execute plymouth - Allow tmpwatch to read /var/spool/cups/tmp - Add support for /usr/libexec/telepathy-rakia - Add systemd support for zoneminder - Allow mysql to create files/directories under /var/log/mysql - Allow zoneminder apache scripts to rw zoneminder tmpfs - Allow httpd to manage zoneminder lib files - Add zoneminder_run_sudo boolean to allow to start zoneminder - Allow zoneminder to send mails - gssproxy_t sock_file can be under /var/lib - Allow web domains to connect to whois port. - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t. - We really need to add an interface to corenet to define what a web_client_domain is and - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain. - Add labeling for cmpiLMI_LogicalFile-cimprovagt - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules - Update policy rules for pegasus_openlmi_logicalfile_t - Add initial types for logicalfile/unconfined OpenLMI providers - mailmanctl needs to read own log - Allow logwatch manage own lock files - Allow nrpe to read meminfo - Allow httpd to read certs located in pki-ca - Add pki_read_tomcat_cert() interface - Add support for nagios openshift plugins - Add port definition for redis port - fix selinuxuser_use_ssh_chroot boolean- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab- Make DSPAM to act as a LDA working - Allow ntop to create netlink socket - Allow policykit to send a signal to policykit-auth - Allow stapserver to dbus chat with avahi/systemd-logind - Fix labeling on haproxy unit file - Clean up haproxy policy - A new policy for haproxy and placed it to rhcs.te - Add support for ldirectord and treat it with cluster_t - Make sure anaconda log dir is created with var_log_t- Allow lvm_t to create default targets for filesystem handling - Fix labeling for razor-lightdm binaries - Allow insmod_t to read any file labeled var_lib_t - Add policy for pesign - Activate policy for cmpiLMI_Account-cimprovagt - Allow isnsd syscall=listen - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler - Allow ctdbd to use udp/4379 - gatherd wants sys_nice and setsched - Add support for texlive2012 - Allow NM to read file_t (usb stick with no labels used to transfer keys for example) - Allow cobbler to execute apache with domain transition- condor_collector uses tcp/9000 - Label /usr/sbin/virtlockd as virtd_exec_t for now - Allow cobbler to execute ldconfig - Allow NM to execute ssh - Allow mdadm to read /dev/crash - Allow antivirus domains to connect to snmp port - Make amavisd-snmp working correctly - Allow nfsd_t to mounton nfsd_fs_t - Add initial snapper policy - We still need to have consolekit policy - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow dirsrv to read network state - Fix pki_read_tomcat_lib_files - Add labeling for /usr/libexec/nm-ssh-service - Add label cert_t for /var/lib/ipa/pki-ca/publish - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant - Allow nfsd_t to mounton nfsd_fs_t - Dontaudit sandbox apps attempting to open user_devpts_t - Allow passwd_t to change role to system_r from unconfined_r- Don't audit access checks by sandbox xserver on xdb var_lib - Allow ntop to read usbmon devices - Add labeling for new polcykit authorizor - Dontaudit access checks from fail2ban_client - Don't audit access checks by sandbox xserver on xdb var_lib - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream - Fix labeling for all /usr/bim/razor-lightdm-* binaries - Add filename trans for /dev/md126p1- Make vdagent able to request loading kernel module - Add support for cloud-init make it as unconfined domain - Allow snmpd to run smartctl in fsadm_t domain - remove duplicate openshift_search_lib() interface - Allow mysqld to search openshift lib files - Allow openshift cgroup to interact with passedin file descriptors - Allow colord to list directories inthe users homedir - aide executes prelink to check files - Make sure cupsd_t creates content in /etc/cups with the correct label - Lest dontaudit apache read all domains, so passenger will not cause this avc - Allow gssd to connect to gssproxy - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS - Allow systemd-tmpfiles to relabel also lock files - Allow useradd to add homdir in /var/lib/openshift - Allow setfiles and semanage to write output to /run/files- Add labeling for /dev/tgt - Dontaudit leak fd from firewalld for modprobe - Allow runuser running as rpm_script_t to create netlink_audit socket - Allow mdadm to read BIOS non-volatile RAM- accountservice watches when accounts come and go in wtmp - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket - Add httpd_use_sasl boolean - Allow net_admin for tuned_t - iscsid needs sys_module to auto-load kernel modules - Allow blueman to read bluetooth conf - Add nova_manage_lib_files() interface - Fix mplayer_filetrans_home_content() - Add mplayer_filetrans_home_content() - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t - Revert "Allow thumb_t to append inherited xdm stream socket" - Add iscsi_filetrans_named_content() interface - Allow to create .mplayer with the correct labeling for unconfined - Allow iscsiadmin to create lock file with the correct labeling- Allow wine to manage wine home content - Make amanda working with socket actiovation - Add labeling for /usr/sbin/iscsiadm - Add support for /var/run/gssproxy.sock - dnsmasq_t needs to read sysctl_net_t- Fix courier_domain_template() interface - Allow blueman to write ip_forward - Allow mongodb to connect to mongodb port - Allow mongodb to connect to mongodb port - Allow java to bind jobss_debug port - Fixes for *_admin interfaces - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality - Need to assign attribute for courier_domain to all courier_domains - Fail2ban reads /etc/passwd - postfix_virtual will create new files in postfix_spool_t - abrt triggers sys_ptrace by running pidof - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it - Add passenger fixes needed by foreman - Remove dup interfaces - Add additional interfaces for quantum - Add new interfaces for dnsmasq - Allow passenger to read localization and send signull to itself - Allow dnsmasq to stream connect to quantum - Add quantum_stream_connect() - Make sure that mcollective starts the service with the correct labeling - Add labels for ~/.manpath - Dontaudit attempts by svirt_t to getpw* calls - sandbox domains are trying to look at parent process data - Allow courior auth to create its pid file in /var/spool/courier subdir - Add fixes for beam to have it working with couchdb - Add labeling for /run/nm-xl2tpd.con - Allow apache to stream connect to thin - Add systemd support for amand - Make public types usable for fs mount points - Call correct mandb interface in domain.te - Allow iptables to r/w quantum inherited pipes and send sigchld - Allow ifconfig domtrans to iptables and execute ldconfig - Add labels for ~/.manpath - Allow systemd to read iscsi lib files - seunshare is trying to look at parent process data- Fix openshift_search_lib - Add support for abrt-uefioops-oops - Allow colord to getattr any file system - Allow chrome processes to look at each other - Allow sys_ptrace for abrt_t - Add new policy for gssproxy - Dontaudit leaked file descriptor writes from firewalld - openshift_net_type is interface not template - Dontaudit pppd to search gnome config - Update openshift_search_lib() interface - Add fs_list_pstorefs() - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18 - Better labels for raspberry pi devices - Allow init to create devpts_t directory - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18 - Allow sysadm_t to build kernels - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18 - Allow userdomains to stream connect to gssproxy - Dontaudit leaked file descriptor writes from firewalld - Allow xserver to read /dev/urandom - Add additional fixes for ipsec-mgmt - Make SSHing into an Openshift Enterprise Node working- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime - with the proper label. - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files - Allow systemd-timedated to create adjtime - Add clock_create_adjtime() - Additional fix ifconfing for #966106 - Allow kernel_t to create boot.log with correct labeling - Remove unconfined_mplayer for which we don't have rules - Rename interfaces - Add userdom_manage_user_home_files/dirs interfaces - Fix files_dontaudit_read_all_non_security_files - Fix ipsec_manage_key_file() - Fix ipsec_filetrans_key_file() - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t - Fix labeling for ipse.secrets - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid - Add files_dontaudit_read_all_non_security_files() interface - /var/log/syslog-ng should be labeled var_log_t - Make ifconfig_var_run_t a mountpoint - Add transition from ifconfig to dnsmasq - Allow ifconfig to execute bin_t/shell_exec_t - We want to have hwdb.bin labeled as etc_t - update logging_filetrans_named_content() interface - Allow systemd_timedate_t to manage /etc/adjtime - Allow NM to send signals to l2tpd - Update antivirus_can_scan_system boolean - Allow devicekit_disk_t to sys_config_tty - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories - Make printing from vmware working - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes - Add virt_qemu_ga_data_t for qemu-ga - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both - Fix typo in virt.te - Add virt_qemu_ga_unconfined_t for hook scripts - Make sure NetworkManager files get created with the correct label - Add mozilla_plugin_use_gps boolean - Fix cyrus to have support for net-snmp - Additional fixes for dnsmasq and quantum for #966106 - Add plymouthd_create_log() - remove httpd_use_oddjob for which we don't have rules - Add missing rules for httpd_can_network_connect_cobbler - Add missing cluster_use_execmem boolean - Call userdom_manage_all_user_home_type_files/dirs - Additional fix for ftp_home_dir - Fix ftp_home_dir boolean - Allow squit to recv/send client squid packet - Fix nut.te to have nut_domain attribute - Add support for ejabberd; TODO: revisit jabberd and rabbit policy - Fix amanda policy - Add more fixes for domains which use libusb - Make domains which use libusb working correctly - Allow l2tpd to create ipsec key files with correct labeling and manage them - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files - Allow rabbitmq-beam to bind generic node - Allow l2tpd to read ipse-mgmt pid files - more fixes for l2tpd, NM and pppd from #967072- Dontaudit to getattr on dirs for dovecot-deliver - Allow raiudusd server connect to postgresql socket - Add kerberos support for radiusd - Allow saslauthd to connect to ldap port - Allow postfix to manage postfix_private_t files - Add chronyd support for #965457 - Fix labeling for HOME_DIR/\.icedtea - CHange squid and snmpd to be allowed also write own logs - Fix labeling for /usr/libexec/qemu-ga - Allow virtd_t to use virt_lock_t - Allow also sealert to read the policy from the kernel - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content - Dontaudit listing of users homedir by sendmail Seems like a leak - Allow passenger to transition to puppet master - Allow apache to connect to mythtv - Add definition for mythtv ports- Add additional fixes for #948073 bug - Allow sge_execd_t to also connect to sge ports - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow openshift_cron_t to manage openshift_var_lib_t sym links - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files - Add networkmanager_stream_connect() - Make gnome-abrt wokring with staff_t - Fix openshift_manage_lib_files() interface - mdadm runs ps command which seems to getattr on random log files - Allow mozilla_plugin_t to create pulseaudit_home_t directories - Allow qemu-ga to shutdown virtual hosts - Add labelling for cupsd-browsed - Add web browser plugins to connect to aol ports - Allow nm-dhcp-helper to stream connect to NM - Add port definition for sge ports- Make sure users and unconfined domains create .hushlogin with the correct label - Allow pegaus to chat with realmd over DBus - Allow cobblerd to read network state - Allow boicn-client to stat on /dev/input/mice - Allow certwatch to read net_config_t when it executes apache - Allow readahead to create /run/systemd and then create its own directory with the correct label- Transition directories and files when in a user_tmp_t directory - Change certwatch to domtrans to apache instead of just execute - Allow virsh_t to read xen lib files - update policy rules for pegasus_openlmi_account_t - Add support for svnserve_tmp_t - Activate account openlmi policy - pegasus_openlmi_domain_template needs also require pegasus_t - One more fix for policykit.te - Call fs_list_cgroups_dirs() in policykit.te - Allow nagios service plugin to read mysql config files - Add labeling for /var/svn - Fix chrome.te - Fix pegasus_openlmi_domain_template() interfaces - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks - Fix location of google-chrome data - Add support for chome_sandbox to store content in the homedir - Allow policykit to watch for changes in cgroups file system - Add boolean to allow mozilla_plugin_t to use spice - Allow collectd to bind to udp port - Allow collected_t to read all of /proc - Should use netlink socket_perms - Should use netlink socket_perms - Allow glance domains to connect to apache ports - Allow apcupsd_t to manage its log files - Allow chrome objects to rw_inherited unix_stream_socket from callers - Allow staff_t to execute virtd_exec_t for running vms - nfsd_t needs to bind mountd port to make nfs-mountd.service working - Allow unbound net_admin capability because of setsockopt syscall - Fix fs_list_cgroup_dirs() - Label /usr/lib/nagios/plugins/utils.pm as bin_t - Remove uplicate definition of fs_read_cgroup_files() - Remove duplicate definition of fs_read_cgroup_files() - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd - Additional interfaces needed to list and read cgroups config - Add port definition for collectd port - Add labels for /dev/ptp* - Allow staff_t to execute virtd_exec_t for running vms- Allow samba-net to also read realmd tmp files - Allow NUT to use serial ports - realmd can be started by systemctl now- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid - Allow virsh to read xen lock file - Allow qemu-ga to create files in /run with proper labeling - Allow glusterd to connect to own socket in /tmp - Allow glance-api to connect to http port to make glance image-create working - Allow keystonte_t to execute rpm- Fix realmd cache interfaces- Allow tcpd to execute leafnode - Allow samba-net to read realmd cache files - Dontaudit sys_tty_config for alsactl - Fix allow rules for postfix_var_run - Allow cobblerd to read /etc/passwd - Allow pegasus to read exports - Allow systemd-timedate to read xdm state - Allow mout to stream connect to rpcbind - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki- Allow thumbnails to share memory with apps which run thumbnails - Allow postfix-postqueue block_suspend - Add lib interfaces for smsd - Add support for nginx - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t - Allow pki apache domain to create own tmp files and execute httpd_suexec - Allow procmail to manger user tmp files/dirs/lnk_files - Add virt_stream_connect_svirt() interface - Allow dovecot-auth to execute bin_t - Allow iscsid to request that kernel load a kernel module - Add labeling support for /var/lib/mod_security - Allow iw running as tuned_t to create netlink socket - Dontaudit sys_tty_config for thumb_t - Add labeling for nm-l2tp-service - Allow httpd running as certwatch_t to open tcp socket - Allow useradd to manager smsd lib files - Allow useradd_t to add homedirs in /var/lib - Fix typo in userdomain.te - Cleanup userdom_read_home_certs - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t - Allow staff to stream connect to svirt_t to make gnome-boxes working- Allow lvm to create its own unit files - Label /var/lib/sepolgen as selinux_config_t - Add filetrans rules for tw devices - Add transition from cupsd_config_t to cupsd_t- Add filetrans rules for tw devices - Cleanup bad transition lines- Fix lockdev_manage_files() - Allow setroubleshootd to read var_lib_t to make email_alert working - Add lockdev_manage_files() - Call proper interface in virt.te - Allow gkeyring_domain to create /var/run/UID/config/dbus file - system dbus seems to be blocking suspend - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need - When you enter a container from root, you generate avcs with a leaked file descriptor - Allow mpd getattr on file system directories - Make sure realmd creates content with the correct label - Allow systemd-tty-ask to write kmsg - Allow mgetty to use lockdev library for device locking - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music - When you enter a container from root, you generate avcs with a leaked file descriptor - Make sure init.fc files are labeled correctly at creation - File name trans vconsole.conf - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow certmonger to dbus communicate with realmd - Make realmd working- Fix mozilla specification of homedir content - Allow certmonger to read network state - Allow tmpwatch to read tmp in /var/spool/{cups,lpd} - Label all nagios plugin as unconfined by default - Add httpd_serve_cobbler_files() - Allow mdadm to read /dev/sr0 and create tmp files - Allow certwatch to send mails - Fix labeling for nagios plugins - label shared libraries in /opt/google/chrome as testrel_shlib_t- Allow realmd to run ipa, really needs to be an unconfined_domain - Allow sandbox domains to use inherted terminals - Allow pscd to use devices labeled svirt_image_t in order to use cat cards. - Add label for new alsa pid - Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition - Add support for sshd_unit_file_t - Add oracleasmfs_t - Allow unlabeled_t files to be stored on unlabeled_t filesystems- Fix description of deny_ptrace boolean - Remove allow for execmod lib_t for now - Allow quantum to connect to keystone port - Allow nova-console to talk with mysql over unix stream socket - Allow dirsrv to stream connect to uuidd - thumb_t needs to be able to create ~/.cache if it does not exist - virtd needs to be able to sys_ptrace when starting and stoping containers- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms... - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets - Fix deny_ptrace boolean, certain ptrace leaked into the system - Allow winbind to manage kerberos_rcache_host - Allow spamd to create spamd_var_lib_t directories - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs - Fix vmware_role() interface - Fix cobbler_manage_lib_files() interface - Allow nagios check disk plugins to execute bin_t - Allow quantum to transition to openvswitch_t - Allow postdrop to stream connect to postfix-master - Allow quantum to stream connect to openvswitch - Add xserver_dontaudit_xdm_rw_stream_sockets() interface - Allow daemon to send dgrams to initrc_t - Allow kdm to start the power service to initiate a reboot or poweroff- Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Don't audit attempts to write to stream socket of nscld by thumbnailers - Allow git_system_t to read network state - Allow pegasas to execute mount command - Fix desc for drdb_admin - Fix condor_amin() - Interface fixes for uptime, vdagent, vnstatd - Fix labeling for moodle in /var/www/moodle/data - Add interface fixes - Allow bugzilla to read certs - /var/www/moodle needs to be writable by apache - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Fix sys_nice for cups_domain - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Kernel_t needs mac_admin in order to support labeled NFS - Fix systemd_dontaudit_dbus_chat() interface - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest - Allow consolehelper domain to write Xauth files in /root - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean - Fixes for dlm_controld - Fix apache_read_sys_content_rw_dirs() interface - Allow logrotate to read /var/log/z-push dir - Allow postfix_postdrop to acces postfix_public socket - Allow sched_setscheduler for cupsd_t - Add missing context for /usr/sbin/snmpd - Allow consolehelper more access discovered by Tom London - Allow fsdaemon to send signull to all domain - Add port definition for osapi_compute port - Allow unconfined to create /etc/hostname with correct labeling - Add systemd_filetrans_named_hostname() interface- Fix file_contexts.subs to label /run/lock correctly- Try to label on controlC devices up to 30 correctly - Add mount_rw_pid_files() interface - Add additional mount/umount interfaces needed by mock - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk - Fix tabs - Allow initrc_domain to search rgmanager lib files - Add more fixes which make mock working together with confined users * Allow mock_t to manage rpm files * Allow mock_t to read rpm log files * Allow mock to setattr on tmpfs, devpts * Allow mount/umount filesystems - Add rpm_read_log() interface - yum-cron runs rpm from within it. - Allow tuned to transition to dmidecode - Allow firewalld to do net_admin - Allow mock to unmont tmpfs_t - Fix virt_sigkill() interface - Add additional fixes for mock. Mainly caused by mount running in mock_t - Allow mock to write sysfs_t and mount pid files - Add mailman_domain to mailman_template() - Allow openvswitch to execute shell - Allow qpidd to use kerberos - Allow mailman to use fusefs, needs back port to RHEL6 - Allow apache and its scripts to use anon_inodefs - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7 - Realmd needs to connect to samba ports, needs back port to F18 also - Allow colord to read /run/initial-setup- - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock - Add virt_kill() interface - Add rgmanager_search_lib() interface - Allow wdmd to getattr on all filesystems. Back ported from RHEL6- Allow realmd to create tmp files - FIx ircssi_home_t type to irssi_home_t - Allow adcli running as realmd_t to connect to ldap port - Allow NetworkManager to transition to ipsec_t, for running strongswan - Make openshift_initrc_t an lxc_domain - Allow gssd to manage user_tmp_t files - Fix handling of irclogs in users homedir - Fix labeling for drupal an wp-content in subdirs of /var/www/html - Allow abrt to read utmp_t file - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6 - fix labeling for (oo|rhc)-restorer-wrapper.sh - firewalld needs to be able to write to network sysctls - Fix mozilla_plugin_dontaudit_rw_sem() interface - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains - Add mozilla_plugin_dontaudit_rw_sem() interface - Allow svirt_lxc_t to transition to openshift domains - Allow condor domains block_suspend and dac_override caps - Allow condor_master to read passd - Allow condor_master to read system state - Allow NetworkManager to transition to ipsec_t, for running strongswan - Lots of access required by lvm_t to created encrypted usb device - Allow xdm_t to dbus communicate with systemd_localed_t - Label strongswan content as ipsec_exec_mgmt_t for now - Allow users to dbus chat with systemd_localed - Fix handling of .xsession-errors in xserver.if, so kde will work - Might be a bug but we are seeing avc's about people status on init_t:service - Make sure we label content under /var/run/lock as <> - Allow daemon and systemprocesses to search init_var_run_t directory - Add boolean to allow xdm to write xauth data to the home directory - Allow mount to write keys for the unconfined domain - Add unconfined_write_keys() interface- Add labeling for /usr/share/pki - Allow programs that read var_run_t symlinks also read var_t symlinks - Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports - Fix labeling for /etc/dhcp directory - add missing systemd_stub_unit_file() interface - Add files_stub_var() interface - Add lables for cert_t directories - Make localectl set-x11-keymap working at all - Allow abrt to manage mock build environments to catch build problems. - Allow virt_domains to setsched for running gdb on itself - Allow thumb_t to execute user home content - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000 - Allow certwatch to execut /usr/bin/httpd - Allow cgred to send signal perms to itself, needs back port to RHEL6 - Allow openshift_cron_t to look at quota - Allow cups_t to read inhered tmpfs_t from the kernel - Allow yppasswdd to use NIS - Tuned wants sys_rawio capability - Add ftpd_use_fusefs boolean - Allow dirsrvadmin_t to signal itself- Allow localectl to read /etc/X11/xorg.conf.d directory - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors"" - Allow mount to transition to systemd_passwd_agent - Make sure abrt directories are labeled correctly - Allow commands that are going to read mount pid files to search mount_var_run_t - label /usr/bin/repoquery as rpm_exec_t - Allow automount to block suspend - Add abrt_filetrans_named_content so that abrt directories get labeled correctly - Allow virt domains to setrlimit and read file_context- Allow nagios to manage nagios spool files - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6 - Add swift_alias.* policy files which contain typealiases for swift types - Add support for /run/lock/opencryptoki - Allow pkcsslotd chown capability - Allow pkcsslotd to read passwd - Add rsync_stub() interface - Allow systemd_timedate also manage gnome config homedirs - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t - Fix filetrans rules for kdm creates .xsession-errors - Allow sytemd_tmpfiles to create wtmp file - Really should not label content under /var/lock, since it could have labels on it different from var_lock_t - Allow systemd to list all file system directories - Add some basic stub interfaces which will be used in PRODUCT policies- Fix log transition rule for cluster domains - Start to group all cluster log together - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update - cups uses usbtty_device_t devices - These fixes were all required to build a MLS virtual Machine with single level desktops - Allow domains to transiton using httpd_exec_t - Allow svirt domains to manage kernel key rings - Allow setroubleshoot to execute ldconfig - Allow firewalld to read generate gnome data - Allow bluetooth to read machine-info - Allow boinc domain to send signal to itself - Fix gnome_filetrans_home_content() interface - Allow mozilla_plugins to list apache modules, for use with gxine - Fix labels for POkemon in the users homedir - Allow xguest to read mdstat - Dontaudit virt_domains getattr on /dev/* - These fixes were all required to build a MLS virtual Machine with single level desktops - Need to back port this to RHEL6 for openshift - Add tcp/8891 as milter port - Allow nsswitch domains to read sssd_var_lib_t files - Allow ping to read network state. - Fix typo - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them- Adopt swift changes from lhh@redhat.com - Add rhcs_manage_cluster_pid_files() interface - Allow screen domains to configure tty and setup sock_file in ~/.screen directory - ALlow setroubleshoot to read default_context_t, needed to backport to F18 - Label /etc/owncloud as being an apache writable directory - Allow sshd to stream connect to an lxc domain- Allow postgresql to manage rgmanager pid files - Allow postgresql to read ccs data - Allow systemd_domain to send dbus messages to policykit - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them - All systemd domains that create content are reading the file_context file and setfscreate - Systemd domains need to search through init_var_run_t - Allow sshd to communicate with libvirt to set containers labels - Add interface to manage pid files - Allow NetworkManger_t to read /etc/hostname - Dontaudit leaked locked files into openshift_domains - Add fixes for oo-cgroup-read - it nows creates tmp files - Allow gluster to manage all directories as well as files - Dontaudit chrome_sandbox_nacl_t using user terminals - Allow sysstat to manage its own log files - Allow virtual machines to setrlimit and send itself signals. - Add labeling for /var/run/hplip- Fix POSTIN scriptlet- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp- Fix authconfig.py labeling - Make any domains that write homedir content do it correctly - Allow glusterd to read/write anyhwere on the file system by default - Be a little more liberal with the rsync log files - Fix iscsi_admin interface - Allow iscsid_t to read /dev/urand - Fix up iscsi domain for use with unit files - Add filename transition support for spamassassin policy - Allow web plugins to use badly formated libraries - Allow nmbd_t to create samba_var_t directories - Add filename transition support for spamassassin policy - Add filename transition support for tvtime - Fix alsa_home_filetrans_alsa_home() interface - Move all userdom_filetrans_home_content() calling out of booleans - Allow logrotote to getattr on all file sytems - Remove duplicate userdom_filetrans_home_content() calling - Allow kadmind to read /etc/passwd - Dontaudit append .xsession-errors file on ecryptfs for policykit-auth - Allow antivirus domain to manage antivirus db links - Allow logrotate to read /sys - Allow mandb to setattr on man dirs - Remove mozilla_plugin_enable_homedirs boolean - Fix ftp_home_dir boolean - homedir mozilla filetrans has been moved to userdom_home_manager - homedir telepathy filetrans has been moved to userdom_home_manager - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd() - Might want to eventually write a daemon on fusefsd. - Add policy fixes for sshd [net] child from plautrba@redhat.com - Tor uses a new port - Remove bin_t for authconfig.py - Fix so only one call to userdom_home_file_trans - Allow home_manager_types to create content with the correctl label - Fix all domains that write data into the homedir to do it with the correct label - Change the postgresql to use proper boolean names, which is causing httpd_t to - not get access to postgresql_var_run_t - Hostname needs to send syslog messages - Localectl needs to be able to send dbus signals to users - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default - Allow user_home_manger domains to create spam* homedir content with correct labeling - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working - Declare userdom_filetrans_type attribute - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute - fusefsd is mounding a fuse file system on /run/user/UID/gvfs- Man pages are now generated in the build process - Allow cgred to list inotifyfs filesystem- Allow gluster to get attrs on all fs - New access required for virt-sandbox - Allow dnsmasq to execute bin_t - Allow dnsmasq to create content in /var/run/NetworkManager - Fix openshift_initrc_signal() interface - Dontaudit openshift domains doing getattr on other domains - Allow consolehelper domain to communicate with session bus - Mock should not be transitioning to any other domains, we should keep mock_t as mock_t - Update virt_qemu_ga_t policy - Allow authconfig running from realmd to restart oddjob service - Add systemd support for oddjob - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd - Add labeling for gnashpluginrc - Allow chrome_nacl to execute /dev/zero - Allow condor domains to read /proc - mozilla_plugin_t will getattr on /core if firefox crashes - Allow condor domains to read /etc/passwd - Allow dnsmasq to execute shell scripts, openstack requires this access - Fix glusterd labeling - Allow virtd_t to interact with the socket type - Allow nmbd_t to override dac if you turned on sharing all files - Allow tuned to created kobject_uevent socket - Allow guest user to run fusermount - Allow openshift to read /proc and locale - Allow realmd to dbus chat with rpm - Add new interface for virt - Remove depracated interfaces - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t - Remove some more unconfined_t process transitions, that I don't believe are necessary - Stop transitioning uncofnined_t to checkpc - dmraid creates /var/lock/dmraid - Allow systemd_localed to creatre unix_dgram_sockets - Allow systemd_localed to write kernel messages. - Also cleanup systemd definition a little. - Fix userdom_restricted_xwindows_user_template() interface - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t - User accounts need to dbus chat with accountsd daemon - Gnome requires all users to be able to read /proc/1/- virsh now does a setexeccon call - Additional rules required by openshift domains - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work - Allow spamd_update_t to search spamc_home_t - Avcs discovered by mounting an isci device under /mnt - Allow lspci running as logrotate to read pci.ids - Additional fix for networkmanager_read_pid_files() - Fix networkmanager_read_pid_files() interface - Allow all svirt domains to connect to svirt_socket_t - Allow virsh to set SELinux context for a process. - Allow tuned to create netlink_kobject_uevent_socket - Allow systemd-timestamp to set SELinux context - Add support for /var/lib/systemd/linger - Fix ssh_sysadm_login to be working on MLS as expected- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file - Add missing files_rw_inherited_tmp_files interface - Add additional interface for ecryptfs - ALlow nova-cert to connect to postgresql - Allow keystone to connect to postgresql - Allow all cups domains to getattr on filesystems - Allow pppd to send signull - Allow tuned to execute ldconfig - Allow gpg to read fips_enabled - Add additional fixes for ecryptfs - Allow httpd to work with posgresql - Allow keystone getsched and setsched- Allow gpg to read fips_enabled - Add support for /var/cache/realmd - Add support for /usr/sbin/blazer_usb and systemd support for nut - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t - bitlbee wants to read own log file - Allow glance domain to send a signal itself - Allow xend_t to request that the kernel load a kernel module - Allow pacemaker to execute heartbeat lib files - cleanup new swift policy- Fix smartmontools - Fix userdom_restricted_xwindows_user_template() interface - Add xserver_xdm_ioctl_log() interface - Allow Xusers to ioctl lxdm.log to make lxdm working - Add MLS fixes to make MLS boot/log-in working - Add mls_socket_write_all_levels() also for syslogd - fsck.xfs needs to read passwd - Fix ntp_filetrans_named_content calling in init.te - Allow postgresql to create pg_log dir - Allow sshd to read rsync_data_t to make rsync working - Change ntp.conf to be labeled net_conf_t - Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it - Allow xdm_t to execute gstreamer home content - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp - New policy for openstack swift domains - More access required for openshift_cron_t - Use cupsd_log_t instead of cupsd_var_log_t - rpm_script_roles should be used in rpm_run - Fix rpm_run() interface - Fix openshift_initrc_run() - Fix sssd_dontaudit_stream_connect() interface - Fix sssd_dontaudit_stream_connect() interface - Allow LDA's job to deliver mail to the mailbox - dontaudit block_suspend for mozilla_plugin_t - Allow l2tpd_t to all signal perms - Allow uuidgen to read /dev/random - Allow mozilla-plugin-config to read power_supply info - Implement cups_domain attribute for cups domains - We now need access to user terminals since we start by executing a command outside the tty - We now need access to user terminals since we start by executing a command outside the tty - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen - Add containment of openshift cron jobs - Allow system cron jobs to create tmp directories - Make userhelp_conf_t a config file - Change rpm to use rpm_script_roles - More fixes for rsync to make rsync wokring - Allow logwatch to domtrans to mdadm - Allow pacemaker to domtrans to ifconfig - Allow pacemaker to setattr on corosync.log - Add pacemaker_use_execmem for memcheck-amd64 command - Allow block_suspend capability - Allow create fifo_file in /tmp with pacemaker_tmp_t - Allow systat to getattr on fixed disk - Relabel /etc/ntp.conf to be net_conf_t - ntp_admin should create files in /etc with the correct label - Add interface to create ntp_conf_t files in /etc - Add additional labeling for quantum - Allow quantum to execute dnsmasq with transition- boinc_cliean wants also execmem as boinc projecs have - Allow sa-update to search admin home for /root/.spamassassin - Allow sa-update to search admin home for /root/.spamassassin - Allow antivirus domain to read net sysctl - Dontaudit attempts from thumb_t to connect to ssd - Dontaudit attempts by readahead to read sock_files - Dontaudit attempts by readahead to read sock_files - Create tmpfs file while running as wine as user_tmpfs_t - Dontaudit attempts by readahead to read sock_files - libmpg ships badly created librarie- Change ssh_use_pts to use macro and only inherited sshd_devpts_t - Allow confined users to read systemd_logind seat information - libmpg ships badly created libraries - Add support for strongswan.service - Add labeling for strongswan - Allow l2tpd_t to read network manager content in /run directory - Allow rsync to getattr any file in rsync_data_t - Add labeling and filename transition for .grl-podcasts- mount.glusterfs executes glusterfsd binary - Allow systemd_hostnamed_t to stream connect to systemd - Dontaudit any user doing a access check - Allow obex-data-server to request the kernel to load a module - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info) - Allow gpg-agent to read /proc/sys/crypto/fips_enabled - Add new types for antivirus.pp policy module - Allow gnomesystemmm_t caps because of ioprio_set - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t - Allow gnomesystemmm_t caps because of ioprio_set - Allow NM rawip socket - files_relabel_non_security_files can not be used with boolean - Add interface to thumb_t dbus_chat to allow it to read remote process state - ALlow logrotate to domtrans to mdadm_t - kde gnomeclock wants to write content to /tmp- kde gnomeclock wants to write content to /tmp - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde - Allow blueman_t to rwx zero_device_t, for some kind of jre - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre - Ftp full access should be allowed to create directories as well as files - Add boolean to allow rsync_full_acces, so that an rsync server can write all - over the local machine - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6 - Add missing vpnc_roles type line - Allow stapserver to write content in /tmp - Allow gnome keyring to create keyrings dir in ~/.local/share - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Add interface to colord_t dbus_chat to allow it to read remote process state - Allow colord_t to read cupsd_t state - Add mate-thumbnail-font as thumnailer - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data. - Allow qpidd to list /tmp. Needed by ssl - Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18 - - Added systemd support for ksmtuned - Added booleans ksmtuned_use_nfs ksmtuned_use_cifs - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow - Looks like qpidd_t needs to read /dev/random - Lots of probing avc's caused by execugting gpg from staff_t - Dontaudit senmail triggering a net_admin avc - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port - Logwatch does access check on mdadm binary - Add raid_access_check_mdadm() iterface- Fix systemd_manage_unit_symlinks() interface - Call systemd_manage_unit_symlinks(() which is correct interface - Add filename transition for opasswd - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow sytstemd-timedated to get status of init_t - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock - Allow gpg_t to manage all gnome files - Stop using pcscd_read_pub_files - New rules for xguest, dontaudit attempts to dbus chat - Allow firewalld to create its mmap files in tmpfs and tmp directories - Allow firewalld to create its mmap files in tmpfs and tmp directories - run unbound-chkconf as named_t, so it can read dnssec - Colord is reading xdm process state, probably reads state of any apps that sends dbus message - Allow mdadm_t to change the kernel scheduler - mythtv policy - Update mandb_admin() interface - Allow dsspam to listen on own tpc_socket - seutil_filetrans_named_content needs to be optional - Allow sysadm_t to execute content in his homedir - Add attach_queue to tun_socket, new patch from Paul Moore - Change most of selinux configuration types to security_file_type. - Add filename transition rules for selinux configuration - ssh into a box with -X -Y requires ssh_use_ptys - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated - New allow rules found by Tom London for systemd_hostnamed- Allow systemd-tmpfiles to relabel lpd spool files - Ad labeling for texlive bash scripts - Add xserver_filetrans_fonts_cache_home_content() interface - Remove duplicate rules from *.te - Add support for /var/lock/man-db.lock - Add support for /var/tmp/abrt(/.*)? - Add additional labeling for munin cgi scripts - Allow httpd_t to read munin conf files - Allow certwatch to read meminfo - Fix nscd_dontaudit_write_sock_file() interfac - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling- Allow gnomeclock to talk to puppet over dbus - Allow numad access discovered by Dominic - Add support for HOME_DIR/.maildir - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain - Allow udev to relabel udev_var_run_t lnk_files - New bin_t file in mcelog- Remove all mcs overrides and replace with t1 != mcs_constrained_types - Add attribute_role for iptables - mcs_process_set_categories needs to be called for type - Implement additional role_attribute statements - Sodo domain is attempting to get the additributes of proc_kcore_t - Unbound uses port 8953 - Allow svirt_t images to compromise_kernel when using pci-passthrough - Add label for dns lib files - Bluetooth aquires a dbus name - Remove redundant files_read_usr_file calling - Remove redundant files_read_etc_file calling - Fix mozilla_run_plugin() - Add role_attribute support for more domains- Mass merge with upstream- Bump the policy version to 28 to match selinux userspace - Rebuild versus latest libsepol- Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Add systemd_status_all_unit_files() interface - Add support for nshadow - Allow sysadm_t to administrate the postfix domains - Add interface to setattr on isid directories for use by tmpreaper - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - Allow sshd_t sys_admin for use with afs logins - Add labeling for /var/named/chroot/etc/localtim- Allow setroubleshoot_fixit to execute rpm - zoneminder needs to connect to httpd ports where remote cameras are listening - Allow firewalld to execute content created in /run directory - Allow svirt_t to read generic certs - Dontaudit leaked ps content to mozilla plugin - Allow sshd_t sys_admin for use with afs logins - Allow systemd to read/write all sysctls - init scripts are creating systemd_unit_file_t directories- systemd_logind_t is looking at all files under /run/user/apache - Allow systemd to manage all user tmp files - Add labeling for /var/named/chroot/etc/localtime - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6 - Keystone is now using a differnt port - Allow xdm_t to use usbmuxd daemon to control sound - Allow passwd daemon to execute gnome_exec_keyringd - Fix chrome_sandbox policy - Add labeling for /var/run/checkquorum-timer - More fixes for the dspam domain, needs back port to RHEL6 - More fixes for the dspam domain, needs back port to RHEL6 - sssd needs to connect to kerberos password port if a user changes his password - Lots of fixes from RHEL testing of dspam web - Allow chrome and mozilla_plugin to create msgq and semaphores - Fixes for dspam cgi scripts - Fixes for dspam cgi scripts - Allow confine users to ptrace screen - Backport virt_qemu_ga_t changes from RHEL - Fix labeling for dspam.cgi needed for RHEL6 - We need to back port this policy to RHEL6, for lxc domains - Dontaudit attempts to set sys_resource of logrotate - Allow corosync to read/write wdmd's tmpfs files - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set - Allow cron jobs to read bind config for unbound - libvirt needs to inhibit systemd - kdumpctl needs to delete boot_t files - Fix duplicate gnome_config_filetrans - virtd_lxc_t is using /dev/fuse - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift - apcupsd can be setup to listen to snmp trafic - Allow transition from kdumpgui to kdumpctl - Add fixes for munin CGI scripts - Allow deltacloud to connect to openstack at the keystone port - Allow domains that transition to svirt domains to be able to signal them - Fix file context of gstreamer in .cache directory - libvirt is communicating with logind - NetworkManager writes to the systemd inhibit pipe- Allow munin disk plugins to get attributes of all directories - Allow munin disk plugins to get attributes of all directorie - Allow logwatch to get attributes of all directories - Fix networkmanager_manage_lib() interface - Fix gnome_manage_config() to allow to manage sock_file - Fix virtual_domain_context - Add support for dynamic DNS for DHCPv6- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch - Add additional labeling for /var/www/openshift/broker - Fix rhev policy - Allow openshift_initrc domain to dbus chat with systemd_logind - Allow httpd to getattr passenger log file if run_stickshift - Allow consolehelper-gtk to connect to xserver - Add labeling for the tmp-inst directory defined in pam_namespace.conf - Add lvm_metadata_t labeling for /etc/multipath- consoletype is no longer used- Add label for efivarfs - Allow certmonger to send signal to itself - Allow plugin-config to read own process status - Add more fixes for pacemaker - apache/drupal can run clamscan on uploaded content - Allow chrome_sandbox_nacl_t to read pid 1 content- Fix MCS Constraints to control ingres and egres controls on the network. - Change name of svirt_nokvm_t to svirt_tcg_t - Allow tuned to request the kernel to load kernel modules- Label /var/lib/pgsql/.ssh as ssh_home_t - Add labeling for /usr/bin/pg_ctl - Allow systemd-logind to manage keyring user tmp dirs - Add support for 7389/tcp port - gems seems to be placed in lots of places - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus - Add back tcp/8123 port as http_cache port - Add ovirt-guest-agent\.pid labeling - Allow xend to run scsi_id - Allow rhsmcertd-worker to read "physical_package_id" - Allow pki_tomcat to connect to ldap port - Allow lpr to read /usr/share/fonts - Allow open file from CD/DVD drive on domU - Allow munin services plugins to talk to SSSD - Allow all samba domains to create samba directory in var_t directories - Take away svirt_t ability to use nsswitch - Dontaudit attempts by openshift to read apache logs - Allow apache to create as well as append _ra_content_t - Dontaudit sendmail_t reading a leaked file descriptor - Add interface to have admin transition /etc/prelink.cache to the proper label - Add sntp support to ntp policy - Allow firewalld to dbus chat with devicekit_power - Allow tuned to call lsblk - Allow tor to read /proc/sys/kernel/random/uuid - Add tor_can_network_relay boolean- Add openshift_initrc_signal() interface - Fix typos - dspam port is treat as spamd_port_t - Allow setroubleshoot to getattr on all executables - Allow tuned to execute profiles scripts in /etc/tuned - Allow apache to create directories to store its log files - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6 - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM - Add filename transition for /etc/tuned/active_profile - Allow condor_master to send mails - Allow condor_master to read submit.cf - Allow condor_master to create /tmp files/dirs - Allow condor_mater to send sigkill to other condor domains - Allow condor_procd sigkill capability - tuned-adm wants to talk with tuned daemon - Allow kadmind and krb5kdc to also list sssd_public_t - Allow accountsd to dbus chat with init - Fix git_read_generic_system_content_files() interface - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler" - Fix mozilla_plugin_can_network_connect to allow to connect to all ports - Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t - dspam wants to search /var/spool for opendkim data - Revert "Add support for tcp/10026 port as dspam_port_t" - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6 - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain - Allow systemd_tmpfiles_t to setattr on mandb_cache_t- consolekit.pp was not removed from the postinstall script- Add back consolekit policy - Silence bootloader trying to use inherited tty - Silence xdm_dbusd_t trying to execute telepathy apps - Fix shutdown avcs when machine has unconfined.pp disabled - The host and a virtual machine can share the same printer on a usb device - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob - Allow abrt_watch_log_t to execute bin_t - Allow chrome sandbox to write content in ~/.config/chromium - Dontaudit setattr on fontconfig dir for thumb_t - Allow lircd to request the kernel to load module - Make rsync as userdom_home_manager - Allow rsync to search automount filesystem - Add fixes for pacemaker- Add support for 4567/tcp port - Random fixes from Tuomo Soini - xdm wants to get init status - Allow programs to run in fips_mode - Add interface to allow the reading of all blk device nodes - Allow init to relabel rpcbind sock_file - Fix labeling for lastlog and faillog related to logrotate - ALlow aeolus_configserver to use TRAM port - Add fixes for aeolus_configserver - Allow snmpd to connect to snmp port - Allow spamd_update to create spamd_var_lib_t directories - Allow domains that can read sssd_public_t files to also list the directory - Remove miscfiles_read_localization, this is defined for all domains- Allow syslogd to request the kernel to load a module - Allow syslogd_t to read the network state information - Allow xdm_dbusd_t connect to the system DBUS - Add support for 7389/tcp port - Allow domains to read/write all inherited sockets - Allow staff_t to read kmsg - Add awstats_purge_apache_log boolean - Allow ksysguardproces to read /.config/Trolltech.conf - Allow passenger to create and append puppet log files - Add puppet_append_log and puppet_create_log interfaces - Add puppet_manage_log() interface - Allow tomcat domain to search tomcat_var_lib_t - Allow pki_tomcat_t to connect to pki_ca ports - Allow pegasus_t to have net_admin capability - Allow pegasus_t to write /sys/class/net//flags - Allow mailserver_delivery to manage mail_home_rw_t lnk_files - Allow fetchmail to create log files - Allow gnomeclock to manage home config in .kde - Allow bittlebee to read kernel sysctls - Allow logrotate to list /root- Fix userhelper_console_role_template() - Allow enabling Network Access Point service using blueman - Make vmware_host_t as unconfined domain - Allow authenticate users in webaccess via squid, using mysql as backend - Allow gathers to get various metrics on mounted file systems - Allow firewalld to read /etc/hosts - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t - Allow kdumpgui to read/write to zipl.conf - Commands needed to get mock to build from staff_t in enforcing mode - Allow mdadm_t to manage cgroup files - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files - dontaudit ifconfig_t looking at fifo_files that are leaked to it - Add lableing for Quest Authentication System- Fix filetrans interface definitions - Dontaudit xdm_t to getattr on BOINC lib files - Add systemd_reload_all_services() interface - Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files - Allow accountsd to dbus chat with gdm - Allow realmd to getattr on all fs - Allow logrotate to reload all services - Add systemd unit file for radiusd - Allow winbind to create samba pid dir - Add labeling for /var/nmbd/unexpected - Allow chrome and mozilla plugin to connect to msnp ports- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file - Dontaudit setfiles reading /dev/random - On initial boot gnomeclock is going to need to be set buy gdm - Fix tftp_read_content() interface - Random apps looking at kernel file systems - Testing virt with lxc requiers additional access for virsh_t - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container - Allow MPD to read /dev/radnom - Allow sandbox_web_type to read logind files which needs to read pulseaudio - Allow mozilla plugins to read /dev/hpet - Add labeling for /var/lib/zarafa-webap - Allow BOINC client to use an HTTP proxy for all connections - Allow rhsmertd to domain transition to dmidecod - Allow setroubleshootd to send D-Bus msg to ABRT- Define usbtty_device_t as a term_tty - Allow svnserve to accept a connection - Allow xend manage default virt_image_t type - Allow prelink_cron_system_t to overide user componant when executing cp - Add labeling for z-push - Gnomeclock sets the realtime clock - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd - Allow lxc domains to use /dev/random and /dev/urandom- Add port defintion for tcp/9000 - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API - Allow shorewall_t to create netlink_socket - Allow krb5admind to block suspend - Fix labels on /var/run/dlm_controld /var/log/dlm_controld - Allow krb5kdc to block suspend - gnomessytemmm_t needs to read /etc/passwd - Allow cgred to read all sysctls- Allow all domains to read /proc/sys/vm/overcommit_memory - Make proc_numa_t an MLS Trusted Object - Add /proc/numactl support for confined users - Allow ssh_t to connect to any port > 1023 - Add openvswitch domain - Pulseaudio tries to create directories in gnome_home_t directories - New ypbind pkg wants to search /var/run which is caused by sd_notify - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans - Allow sanlock to read /dev/random - Treat php-fpm with httpd_t - Allow domains that can read named_conf_t to be able to list the directories - Allow winbind to create sock files in /var/run/samba- Add smsd policy - Add support for OpenShift sbin labelin - Add boolean to allow virt to use rawip - Allow mozilla_plugin to read all file systems with noxattrs support - Allow kerberos to write on anon_inodefs fs - Additional access required by fenced - Add filename transitions for passwd.lock/group.lock - UPdate man pages - Create coolkey directory in /var/cache with the correct label- Fix label on /etc/group.lock - Allow gnomeclock to create lnk_file in /etc - label /root/.pki as a home_cert_t - Add interface to make sure rpcbind.sock is created with the correct label - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules - opendkim should be a part of milter - Allow libvirt to set the kernel sched algorythm - Allow mongod to read sysfs_t - Add authconfig policy - Remove calls to miscfiles_read_localization all domains get this - Allow virsh_t to read /root/.pki/ content - Add label for log directory under /var/www/stickshift- Allow getty to setattr on usb ttys - Allow sshd to search all directories for sshd_home_t content - Allow staff domains to send dbus messages to kdumpgui - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t - Dontaudit setfiles reading urand - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir - Allow systemd-timedated to read /dev/urandom - Allow entropyd_t to read proc_t (meminfo) - Add unconfined munin plugin - Fix networkmanager_read_conf() interface - Allow blueman to list /tmp which is needed by sys_nic/setsched - Fix label of /etc/mail/aliasesdb-stamp - numad is searching cgroups - realmd is communicating with networkmanager using dbus - Lots of fixes to try to get kdump to work- Allow loging programs to dbus chat with realmd - Make apache_content_template calling as optional - realmd is using policy kit- Add new selinuxuser_use_ssh_chroot boolean - dbus needs to be able to read/write inherited fixed disk device_t passed through it - Cleanup netutils process allow rule - Dontaudit leaked fifo files from openshift to ping - sanlock needs to read mnt_t lnk files - Fail2ban needs to setsched and sys_nice- Change default label of all files in /var/run/rpcbind - Allow sandbox domains (java) to read hugetlbfs_t - Allow awstats cgi content to create tmp files and read apache log files - Allow setuid/setgid for cupsd-config - Allow setsched/sys_nice pro cupsd-config - Fix /etc/localtime sym link to be labeled locale_t - Allow sshd to search postgresql db t since this is a homedir - Allow xwindows users to chat with realmd - Allow unconfined domains to configure all files and null_device_t service- Adopt pki-selinux policy- pki is leaking which we dontaudit until a pki code fix - Allow setcap for arping - Update man pages - Add labeling for /usr/sbin/mcollectived - pki fixes - Allow smokeping to execute fping in the netutils_t domain- Allow mount to relabelfrom unlabeled file systems - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working - Add label to get bin files under libreoffice labeled correctly - Fix interface to allow executing of base_ro_file_type - Add fixes for realmd - Update pki policy - Add tftp_homedir boolean - Allow blueman sched_setscheduler - openshift user domains wants to r/w ssh tcp sockets- Additional requirements for disable unconfined module when booting - Fix label of systemd script files - semanage can use -F /dev/stdin to get input - syslog now uses kerberos keytabs - Allow xserver to compromise_kernel access - Allow nfsd to write to mount_var_run_t when running the mount command - Add filename transition rule for bin_t directories - Allow files to read usr_t lnk_files - dhcpc wants chown - Add support for new openshift labeling - Clean up for tunable+optional statements - Add labeling for /usr/sbin/mkhomedir_helper - Allow antivirus domain to managa amavis spool files - Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool- Add interfaces to read kernel_t proc info - Missed this version of exec_all - Allow anyone who can load a kernel module to compromise kernel - Add oddjob_dbus_chat to openshift apache policy - Allow chrome_sandbox_nacl_t to send signals to itself - Add unit file support to usbmuxd_t - Allow all openshift domains to read sysfs info - Allow openshift domains to getattr on all domains- MLS fixes from Dan - Fix name of capability2 secure_firmware->compromise_kerne- Allow xdm to search all file systems - Add interface to allow the config of all files - Add rngd policy - Remove kgpg as a gpg_exec_t type - Allow plymouthd to block suspend - Allow systemd_dbus to config any file - Allow system_dbus_t to configure all services - Allow freshclam_t to read usr_files - varnishd requires execmem to load modules- Allow semanage to verify types - Allow sudo domain to execute user home files - Allow session_bus_type to transition to user_tmpfs_t - Add dontaudit caused by yum updates - Implement pki policy but not activated- tuned wants to getattr on all filesystems - tuned needs also setsched. The build is needed for test day- Add policy for qemu-qa - Allow razor to write own config files - Add an initial antivirus policy to collect all antivirus program - Allow qdisk to read usr_t - Add additional caps for vmware_host - Allow tmpfiles_t to setattr on mandb_cache_t - Dontaudit leaked files into mozilla_plugin_config_t - Allow wdmd to getattr on tmpfs - Allow realmd to use /dev/random - allow containers to send audit messages - Allow root mount any file via loop device with enforcing mls policy - Allow tmpfiles_t to setattr on mandb_cache_t - Allow tmpfiles_t to setattr on mandb_cache_t - Make userdom_dontaudit_write_all_ not allow open - Allow init scripts to read all unit files - Add support for saphostctrl ports- Add kernel_read_system_state to sandbox_client_t - Add some of the missing access to kdumpgui - Allow systemd_dbusd_t to status the init system - Allow vmnet-natd to request the kernel to load a module - Allow gsf-office-thum to append .cache/gdm/session.log - realmd wants to read .config/dconf/user - Firewalld wants sys_nice/setsched - Allow tmpreaper to delete mandb cache files - Firewalld wants sys_nice/setsched - Allow firewalld to perform a DNS name resolution - Allown winbind to read /usr/share/samba/codepages/lowcase.dat - Add support for HTTPProxy* in /etc/freshclam.conf - Fix authlogin_yubike boolean - Extend smbd_selinux man page to include samba booleans - Allow dhcpc to execute consoletype - Allow ping to use inherited tmp files created in init scripts - On full relabel with unconfined domain disabled, initrc was running some chcon's - Allow people who delete man pages to delete mandb cache files- Add missing permissive domains- Add new mandb policy - ALlow systemd-tmpfiles_t to relabel mandb_cache_t - Allow logrotate to start all unit files- Add fixes for ctbd - Allow nmbd to stream connect to ctbd - Make cglear_t as nsswitch_domain - Fix bogus in interfaces - Allow openshift to read/write postfix public pipe - Add postfix_manage_spool_maildrop_files() interface - stickshift paths have been renamed to openshift - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes - Update man pages, adding ENTRYPOINTS- Add mei_device_t - Make sure gpg content in homedir created with correct label - Allow dmesg to write to abrt cache files - automount wants to search virtual memory sysctls - Add support for hplip logs stored in /var/log/hp/tmp - Add labeling for /etc/owncloud/config.php - Allow setroubleshoot to send analysys to syslogd-journal - Allow virsh_t to interact with new fenced daemon - Allow gpg to write to /etc/mail/spamassassiin directories - Make dovecot_deliver_t a mail server delivery type - Add label for /var/tmp/DNS25- Fixes for tomcat_domain template interface- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes - Add attribute to all base os types. Allow all domains to read all ro base OS types- Additional unit files to be defined as power unit files - Fix more boolean names- Fix boolean name so subs will continue to work- dbus needs to start getty unit files - Add interface to allow system_dbusd_t to start the poweroff service - xdm wants to exec telepathy apps - Allow users to send messages to systemdlogind - Additional rules needed for systemd and other boot apps - systemd wants to list /home and /boot - Allow gkeyringd to write dbus/conf file - realmd needs to read /dev/urand - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded- Fixes to safe more rules - Re-write tomcat_domain_template() - Fix passenger labeling - Allow all domains to read man pages - Add ephemeral_port_t to the 'generic' port interfaces - Fix the names of postgresql booleans- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer - Move netlable_peer check out of booleans - Remove call to recvfrom_netlabel for kerberos call - Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules - Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface - Allow rndc to block suspend - tuned needs to modify the schedule of the kernel - Allow svirt_t domains to read alsa configuration files - ighten security on irc domains and make sure they label content in homedir correctly - Add filetrans_home_content for irc files - Dontaudit all getattr access for devices and filesystems for sandbox domains - Allow stapserver to search cgroups directories - Allow all postfix domains to talk to spamd- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check - Change pam_t to pam_timestamp_t - Add dovecot_domain attribute and allow this attribute block_suspend capability2 - Add sanlock_use_fusefs boolean - numad wants send/recieve msg - Allow rhnsd to send syslog msgs - Make piranha-pulse as initrc domain - Update openshift instances to dontaudit setattr until the kernel is fixed.- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd - Remove pam_selinux.8 which conflicts with man page owned by the pam package - Allow glance-api to talk to mysql - ABRT wants to read Xorg.0.log if if it detects problem with Xorg - Fix gstreamer filename trans. interface- Man page fixes by Dan Walsh- Allow postalias to read postfix config files - Allow man2html to read man pages - Allow rhev-agentd to search all mountpoints - Allow rhsmcertd to read /dev/random - Add tgtd_stream_connect() interface - Add cyrus_write_data() interface - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t - Add port definition for tcp/81 as http_port_t - Fix /dev/twa labeling - Allow systemd to read modules config- Merge openshift policy - Allow xauth to read /dev/urandom - systemd needs to relabel content in /run/systemd directories - Files unconfined should be able to perform all services on all files - Puppet tmp file can be leaked to all domains - Dontaudit rhsmcertd-worker to search /root/.local - Allow chown capability for zarafa domains - Allow system cronjobs to runcon into openshift domains - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories- nmbd wants to create /var/nmbd - Stop transitioning out of anaconda and firstboot, just causes AVC messages - Allow clamscan to read /etc files - Allow bcfg2 to bind cyphesis port - heartbeat should be run as rgmanager_t instead of corosync_t - Add labeling for /etc/openldap/certs - Add labeling for /opt/sartest directory - Make crontab_t as userdom home reader - Allow tmpreaper to list admin_home dir - Add defition for imap_0 replay cache file - Add support for gitolite3 - Allow virsh_t to send syslog messages - allow domains that can read samba content to be able to list the directories also - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd - Separate out sandbox from sandboxX policy so we can disable it by default - Run dmeventd as lvm_t - Mounting on any directory requires setattr and write permissions - Fix use_nfs_home_dirs() boolean - New labels for pam_krb5 - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0 - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs - Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles- Allow realmd to read resolv.conf - Add pegasus_cache_t type - Label /usr/sbin/fence_virtd as virsh_exec_t - Add policy for pkcsslotd - Add support for cpglockd - Allow polkit-agent-helper to read system-auth-ac - telepathy-idle wants to read gschemas.compiled - Allow plymouthd to getattr on fs_t - Add slpd policy - Allow ksysguardproces to read/write config_usr_t- Fix labeling substitution so rpm will label /lib/systemd content correctly- Add file name transitions for ttyACM0 - spice-vdagent(d)'s are going to log over to syslog - Add sensord policy - Add more fixes for passenger policy related to puppet - Allow wdmd to create wdmd_tmpfs_t - Fix labeling for /var/run/cachefilesd\.pid - Add thumb_tmpfs_t files type- Allow svirt domains to manage the network since this is containerized - Allow svirt_lxc_net_t to send audit messages- Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working - Allow dlm_controld to execute dlm_stonith labeled as bin_t - Allow GFS2 working on F17 - Abrt needs to execute dmesg - Allow jockey to list the contents of modeprobe.d - Add policy for lightsquid as squid_cron_t - Mailscanner is creating files and directories in /tmp - dmesg is now reading /dev/kmsg - Allow xserver to communicate with secure_firmware - Allow fsadm tools (fsck) to read /run/mount contnet - Allow sysadm types to read /dev/kmsg -- Allow postfix, sssd, rpcd to block_suspend - udev seems to need secure_firmware capability - Allow virtd to send dbus messages to firewalld so it can configure the firewall- Fix labeling of content in /run created by virsh_t - Allow condor domains to read kernel sysctls - Allow condor_master to connect to amqp - Allow thumb drives to create shared memory and semaphores - Allow abrt to read mozilla_plugin config files - Add labels for lightsquid - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow - dovecot_auth_t uses ldap for user auth - Allow domains that can read dhcp_etc_t to read lnk_files - Add more then one watchdog device - Allow useradd_t to manage etc_t files so it can rename it and edit them - Fix invalid class dir should be fifo_file - Move /run/blkid to fsadm and make sure labeling is correct- Fix bogus regex found by eparis - Fix manage run interface since lvm needs more access - syslogd is searching cgroups directory - Fixes to allow virt-sandbox-service to manage lxc var run content- Fix Boolean settings - Add new libjavascriptcoregtk as textrel_shlib_t - Allow xdm_t to create xdm_home_t directories - Additional access required for systemd - Dontaudit mozilla_plugin attempts to ipc_lock - Allow tmpreaper to delete unlabeled files - Eliminate screen_tmp_t and allow it to manage user_tmp_t - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors - Allow web plugins to connect to the asterisk ports - Condor will recreate the lock directory if it does not exist - Oddjob mkhomedir needs to connectto user processes - Make oddjob_mkhomedir_t a userdom home manager- Put placeholder back in place for proper numbering of capabilities - Systemd also configures init scripts- Fix ecryptfs interfaces - Bootloader seems to be trolling around /dev/shm and /dev - init wants to create /etc/systemd/system-update.target.wants - Fix systemd_filetrans call to move it out of tunable - Fix up policy to work with systemd userspace manager - Add secure_firmware capability and remove bogus epolwakeup - Call seutil_*_login_config interfaces where should be needed - Allow rhsmcertd to send signal to itself - Allow thin domains to send signal to itself - Allow Chrome_ChildIO to read dosfs_t- Add role rules for realmd, sambagui- Add new type selinux_login_config_t for /etc/selinux//logins/ - Additional fixes for seutil_manage_module_store() - dbus_system_domain() should be used with optional_policy - Fix svirt to be allowed to use fusefs file system - Allow login programs to read /run/ data created by systemd_login - sssd wants to write /etc/selinux//logins/ for SELinux PAM module - Fix svirt to be allowed to use fusefs file system - Allow piranha domain to use nsswitch - Sanlock needs to send Kill Signals to non root processes - Pulseaudio wants to execute /run/user/PID/.orc- Fix saslauthd when it tries to read /etc/shadow - Label gnome-boxes as a virt homedir - Need to allow svirt_t ability to getattr on nfs_t file systems - Update sanlock policy to solve all AVC's - Change confined users can optionally manage virt content - Handle new directories under ~/.cache - Add block suspend to appropriate domains - More rules required for containers - Allow login programs to read /run/ data created by systemd_logind - Allow staff users to run svirt_t processes- Update to upstream- More fixes for systemd to make rawhide booting from Dan Walsh- Add systemd fixes to make rawhide booting- Add systemd_logind_inhibit_var_run_t attribute - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type - Add interface for mysqld to dontaudit signull to all processes - Label new /var/run/journal directory correctly - Allow users to inhibit suspend via systemd - Add new type for the /var/run/inhibit directory - Add interface to send signull to systemd_login so avahi can send them - Allow systemd_passwd to send syslog messages - Remove corenet_all_recvfrom_unlabeled() calling fro policy files - Allow editparams.cgi running as httpd_bugzilla_script_t to read /etc/group - Allow smbd to read cluster config - Add additional labeling for passenger - Allow dbus to inhibit suspend via systemd - Allow avahi to send signull to systemd_login- Add interface to dontaudit getattr access on sysctls - Allow sshd to execute /bin/login - Looks like xdm is recreating the xdm directory in ~/.cache/ on login - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald - Fix semanage to work with unconfined domain disabled on F18 - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls - Virt seems to be using lock files - Dovecot seems to be searching directories of every mountpoint - Allow jockey to read random/urandom, execute shell and install third-party drivers - Add aditional params to allow cachedfiles to manage its content - gpg agent needs to read /dev/random - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write - Add a bunch of dontaudit rules to quiet svirt_lxc domains - Additional perms needed to run svirt_lxc domains - Allow cgclear to read cgconfig - Allow sys_ptrace capability for snmp - Allow freshclam to read /proc - Allow procmail to manage /home/user/Maildir content - Allow NM to execute wpa_cli - Allow amavis to read clamd system state - Regenerate man pages- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild- Add realmd and stapserver policies - Allow useradd to manage stap-server lib files - Tighten up capabilities for confined users - Label /etc/security/opasswd as shadow_t - Add label for /dev/ecryptfs - Allow condor_startd_t to start sshd with the ranged - Allow lpstat.cups to read fips_enabled file - Allow pyzor running as spamc_t to create /root/.pyzor directory - Add labelinf for amavisd-snmp init script - Add support for amavisd-snmp - Allow fprintd sigkill self - Allow xend (w/o libvirt) to start virtual machines - Allow aiccu to read /etc/passwd - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes - Add condor_startd_ranged_domtrans_to() interface - Add ssd_conf_t for /etc/sssd - accountsd needs to fchown some files/directories - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit - Allow xend_t to read the /etc/passwd file- Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t - Add init_access_check() interface - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t - Allow tcpdump to create a netlink_socket - Label newusers like useradd - Change xdm log files to be labeled xdm_log_t - Allow sshd_t with privsep to work in MLS - Allow freshclam to update databases thru HTTP proxy - Allow s-m-config to access check on systemd - Allow abrt to read public files by default - Fix amavis_create_pid_files() interface - Add labeling and filename transition for dbomatic.log - Allow system_dbusd_t to stream connect to bluetooth, and use its socket - Allow amavisd to execute fsav - Allow tuned to use sys_admin and sys_nice capabilities - Add php-fpm policy from Bryan - Add labeling for aeolus-configserver-thinwrapper - Allow thin domains to execute shell - Fix gnome_role_gkeyringd() interface description - Lot of interface fixes - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files - Allow OpenMPI job to use kerberos - Make deltacloudd_t as nsswitch_domain - Allow xend_t to run lsscsi - Allow qemu-dm running as xend_t to create tun_socket - Add labeling for /opt/brother/Printers(.*/)?inf - Allow jockey-backend to read pyconfig-64.h labeled as usr_t - Fix clamscan_can_scan_system boolean - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11- initrc is calling exportfs which is not confined so it attempts to read nfsd_files - Fixes for passenger running within openshift. - Add labeling for all tomcat6 dirs - Add support for tomcat6 - Allow cobblerd to read /etc/passwd - Allow jockey to read sysfs and and execute binaries with bin_t - Allow thum to use user terminals - Allow cgclear to read cgconfig config files - Fix bcf2g.fc - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains - Allow dbomatic to execute ruby - abrt_watch_log should be abrt_domain - Allow mozilla_plugin to connect to gatekeeper port- add ptrace_child access to process - remove files_read_etc_files() calling from all policies which have auth_use_nsswith() - Allow boinc domains to manage boinc_lib_t lnk_files - Add support for boinc-client.service unit file - Add support for boinc.log - Allow mozilla_plugin execmod on mozilla home files if allow_ex - Allow dovecot_deliver_t to read dovecot_var_run_t - Allow ldconfig and insmod to manage kdumpctl tmp files - Move thin policy out from cloudform.pp and add a new thin poli - pacemaker needs to communicate with corosync streams - abrt is now started on demand by dbus - Allow certmonger to talk directly to Dogtag servers - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c - Allow mozila_plugin to execute gstreamer home files - Allow useradd to delete all file types stored in the users hom - rhsmcertd reads the rpm database - Add support for lightdm- Add tomcat policy - Remove pyzor/razor policy - rhsmcertd reads the rpm database - Dontaudit thumb to setattr on xdm_tmp dir - Allow wicd to execute ldconfig in the networkmanager_t domain - Add /var/run/cherokee\.pid labeling - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too - Allow postfix-master to r/w pipes other postfix domains - Allow snort to create netlink_socket - Add kdumpctl policy - Allow firstboot to create tmp_t files/directories - /usr/bin/paster should not be labeled as piranha_exec_t - remove initrc_domain from tomcat - Allow ddclient to read /etc/passwd - Allow useradd to delete all file types stored in the users homedir - Allow ldconfig and insmod to manage kdumpctl tmp files - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those - Transition xauth files within firstboot_tmp_t - Fix labeling of /run/media to match /media - Label all lxdm.log as xserver_log_t - Add port definition for mxi port - Allow local_login_t to execute tmux- apcupsd needs to read /etc/passwd - Sanlock allso sends sigkill - Allow glance_registry to connect to the mysqld port - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl - Allow firefox plugins/flash to connect to port 1234 - Allow mozilla plugins to delete user_tmp_t files - Add transition name rule for printers.conf.O - Allow virt_lxc_t to read urand - Allow systemd_loigind to list gstreamer_home_dirs - Fix labeling for /usr/bin - Fixes for cloudform services * support FIPS - Allow polipo to work as web caching - Allow chfn to execute tmux- Add support for ecryptfs * ecryptfs does not support xattr * we need labeling for HOMEDIR - Add policy for (u)mount.ecryptfs* - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache - Allow dovecot to manage Maildir content, fix transitions to Maildir - Allow postfix_local to transition to dovecot_deliver - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code - Cleanup interface definitions - Allow apmd to change with the logind daemon - Changes required for sanlock in rhel6 - Label /run/user/apache as httpd_tmp_t - Allow thumb to use lib_t as execmod if boolean turned on - Allow squid to create the squid directory in /var with the correct labe - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com) - Allow virtd to exec xend_exec_t without transition - Allow virtd_lxc_t to unmount all file systems- PolicyKit path has changed - Allow httpd connect to dirsrv socket - Allow tuned to write generic kernel sysctls - Dontaudit logwatch to gettr on /dev/dm-2 - Allow policykit-auth to manage kerberos files - Make condor_startd and rgmanager as initrc domain - Allow virsh to read /etc/passwd - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs - xdm now needs to execute xsession_exec_t - Need labels for /var/lib/gdm - Fix files_filetrans_named_content() interface - Add new attribute - initrc_domain - Allow systemd_logind_t to signal, signull, sigkill all processes - Add filetrans rules for etc_runtime files- Rename boolean names to remove allow_- Mass merge with upstream * new policy topology to include contrib policy modules * we have now two base policy patches- Fix description of authlogin_nsswitch_use_ldap - Fix transition rule for rhsmcertd_t needed for RHEL7 - Allow useradd to list nfs state data - Allow openvpn to manage its log file and directory - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly - Allow thumb to use nvidia devices - Allow local_login to create user_tmp_t files for kerberos - Pulseaudio needs to read systemd_login /var/run content - virt should only transition named system_conf_t config files - Allow munin to execute its plugins - Allow nagios system plugin to read /etc/passwd - Allow plugin to connect to soundd port - Fix httpd_passwd to be able to ask passwords - Radius servers can use ldap for backing store - Seems to need to mount on /var/lib for xguest polyinstatiation to work. - Allow systemd_logind to list the contents of gnome keyring - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL - Add policy for isns-utils- Add policy for subversion daemon - Allow boinc to read passwd - Allow pads to read kernel network state - Fix man2html interface for sepolgen-ifgen - Remove extra /usr/lib/systemd/system/smb - Remove all /lib/systemd and replace with /usr/lib/systemd - Add policy for man2html - Fix the label of kerberos_home_t to krb5_home_t - Allow mozilla plugins to use Citrix - Allow tuned to read /proc/sys/kernel/nmi_watchdog - Allow tune /sys options via systemd's tmpfiles.d "w" type- Dontaudit lpr_t to read/write leaked mozilla tmp files - Add file name transition for .grl-podcasts directory - Allow corosync to read user tmp files - Allow fenced to create snmp lib dirs/files - More fixes for sge policy - Allow mozilla_plugin_t to execute any application - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain - Allow mongod to read system state information - Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t - Allow polipo to manage polipo_cache dirs - Add jabbar_client port to mozilla_plugin_t - Cleanup procmail policy - system bus will pass around open file descriptors on files that do not have labels on them - Allow l2tpd_t to read system state - Allow tuned to run ls /dev - Allow sudo domains to read usr_t files - Add label to machine-id - Fix corecmd_read_bin_symlinks cut and paste error- Fix pulseaudio port definition - Add labeling for condor_starter - Allow chfn_t to creat user_tmp_files - Allow chfn_t to execute bin_t - Allow prelink_cron_system_t to getpw calls - Allow sudo domains to manage kerberos rcache files - Allow user_mail_domains to work with courie - Port definitions necessary for running jboss apps within openshift - Add support for openstack-nova-metadata-api - Add support for nova-console* - Add support for openstack-nova-xvpvncproxy - Fixes to make privsep+SELinux working if we try to use chage to change passwd - Fix auth_role() interface - Allow numad to read sysfs - Allow matahari-rpcd to execute shell - Add label for ~/.spicec - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it - Devicekit_disk wants to read the logind sessions file when writing a cd - Add fixes for condor to make condor jobs working correctly - Change label of /var/log/rpmpkgs to cron_log_t - Access requires to allow systemd-tmpfiles --create to work. - Fix obex to be a user application started by the session bus. - Add additional filename trans rules for kerberos - Fix /var/run/heartbeat labeling - Allow apps that are managing rcache to file trans correctly - Allow openvpn to authenticate against ldap server - Containers need to listen to network starting and stopping events- Make systemd unit files less specific- Fix zarafa labeling - Allow guest_t to fix labeling - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean - add lxc_contexts - Allow accountsd to read /proc - Allow restorecond to getattr on all file sytems - tmpwatch now calls getpw - Allow apache daemon to transition to pwauth domain - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t - The obex socket seems to be a stream socket - dd label for /var/run/nologin- Allow jetty running as httpd_t to read hugetlbfs files - Allow sys_nice and setsched for rhsmcertd - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports - Allow setfiles to append to xdm_tmp_t - Add labeling for /export as a usr_t directory - Add labels for .grl files created by gstreamer- Add labeling for /usr/share/jetty/bin/jetty.sh - Add jetty policy which contains file type definitios - Allow jockey to use its own fifo_file and make this the default for all domains - Allow mozilla_plugins to use spice (vnc_port/couchdb) - asterisk wants to read the network state - Blueman now uses /var/lib/blueman- Add label for nodejs_debug - Allow mozilla_plugin_t to create ~/.pki directory and content- Add clamscan_can_scan_system boolean - Allow mysqld to read kernel network state - Allow sshd to read/write condor lib files - Allow sshd to read/write condor-startd tcp socket - Fix description on httpd_graceful_shutdown - Allow glance_registry to communicate with mysql - dbus_system_domain is using systemd to lauch applications - add interfaces to allow domains to send kill signals to user mail agents - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t - Lots of new access required for secure containers - Corosync needs sys_admin capability - ALlow colord to create shm - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific - Add boolean to control whether or not mozilla plugins can create random content in the users homedir - Add new interface to allow domains to list msyql_db directories, needed for libra - shutdown has to be allowed to delete etc_runtime_t - Fail2ban needs to read /etc/passwd - Allow ldconfig to create /var/cache/ldconfig - Allow tgtd to read hardware state information - Allow collectd to create packet socket - Allow chronyd to send signal to itself - Allow collectd to read /dev/random - Allow collectd to send signal to itself - firewalld needs to execute restorecon - Allow restorecon and other login domains to execute restorecon- Allow logrotate to getattr on systemd unit files - Add support for tor systemd unit file - Allow apmd to create /var/run/pm-utils with the correct label - Allow l2tpd to send sigkill to pppd - Allow pppd to stream connect to l2tpd - Add label for scripts in /etc/gdm/ - Allow systemd_logind_t to ignore mcs constraints on sigkill - Fix files_filetrans_system_conf_named_files() interface - Add labels for /usr/share/wordpress/wp-includes/*.php - Allow cobbler to get SELinux mode and booleans- Add unconfined_execmem_exec_t as an alias to bin_t - Allow fenced to read snmp var lib files, also allow it to read usr_t - ontaudit access checks on all executables from mozilla_plugin - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode - Allow systemd_tmpfiles_t to getattr all pipes and sockets - Allow glance-registry to send system log messages - semanage needs to manage mock lib files/dirs- Add policy for abrt-watch-log - Add definitions for jboss_messaging ports - Allow systemd_tmpfiles to manage printer devices - Allow oddjob to use nsswitch - Fix labeling of log files for postgresql - Allow mozilla_plugin_t to execmem and execstack by default - Allow firewalld to execute shell - Fix /etc/wicd content files to get created with the correct label - Allow mcelog to exec shell - Add ~/.orc as a gstreamer_home_t - /var/spool/postfix/lib64 should be labeled lib_t - mpreaper should be able to list all file system labeled directories - Add support for apache to use openstack - Add labeling for /etc/zipl.conf and zipl binary - Turn on allow_execstack and turn off telepathy transition for final release- More access required for virt_qmf_t - Additional assess required for systemd-logind to support multi-seat - Allow mozilla_plugin to setrlimit - Revert changes to fuse file system to stop deadlock- Allow condor domains to connect to ephemeral ports - More fixes for condor policy - Allow keystone to stream connect to mysqld - Allow mozilla_plugin_t to read generic USB device to support GPS devices - Allow thum to file name transition gstreamer home content - Allow thum to read all non security files - Allow glance_api_t to connect to ephemeral ports - Allow nagios plugins to read /dev/urandom - Allow syslogd to search postfix spool to support postfix chroot env - Fix labeling for /var/spool/postfix/dev - Allow wdmd chown - Label .esd_auth as pulseaudio_home_t - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now- Add support for clamd+systemd - Allow fresclam to execute systemctl to handle clamd - Change labeling for /usr/sbin/rpc.ypasswd.env - Allow yppaswd_t to execute yppaswd_exec_t - Allow yppaswd_t to read /etc/passwd - Gnomekeyring socket has been moved to /run/user/USER/ - Allow samba-net to connect to ldap port - Allow signal for vhostmd - allow mozilla_plugin_t to read user_home_t socket - New access required for secure Linux Containers - zfs now supports xattrs - Allow quantum to execute sudo and list sysfs - Allow init to dbus chat with the firewalld - Allow zebra to read /etc/passwd- Allow svirt_t to create content in the users homedir under ~/.libvirt - Fix label on /var/lib/heartbeat - Allow systemd_logind_t to send kill signals to all processes started by a user - Fuse now supports Xattr Support- upowered needs to setsched on the kernel - Allow mpd_t to manage log files - Allow xdm_t to create /var/run/systemd/multi-session-x - Add rules for missedfont.log to be used by thumb.fc - Additional access required for virt_qmf_t - Allow dhclient to dbus chat with the firewalld - Add label for lvmetad - Allow systemd_logind_t to remove userdomain sock_files - Allow cups to execute usr_t files - Fix labeling on nvidia shared libraries - wdmd_t needs access to sssd and /etc/passwd - Add boolean to allow ftp servers to run in passive mode - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with - Fix using httpd_use_fusefs - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox- Rename rdate port to time port, and allow gnomeclock to connect to it - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda - /etc/auto.* should be labeled bin_t - Add httpd_use_fusefs boolean - Add fixes for heartbeat - Allow sshd_t to signal processes that it transitions to - Add condor policy - Allow svirt to create monitors in ~/.libvirt - Allow dovecot to domtrans sendmail to handle sieve scripts - Lot of fixes for cfengine- /var/run/postmaster.* labeling is no longer needed - Alllow drbdadmin to read /dev/urandom - l2tpd_t seems to use ptmx - group+ and passwd+ should be labeled as /etc/passwd - Zarafa-indexer is a socket- Ensure lastlog is labeled correctly - Allow accountsd to read /proc data about gdm - Add fixes for tuned - Add bcfg2 fixes which were discovered during RHEL6 testing - More fixes for gnome-keyring socket being moved - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown - Fix description for files_dontaudit_read_security_files() interface- Add new policy and man page for bcfg2 - cgconfig needs to use getpw calls - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt - gnome-keyring wants to create a directory in cache_home_t - sanlock calls getpw- Add numad policy and numad man page - Add fixes for interface bugs discovered by SEWatch - Add /tmp support for squid - Add fix for #799102 * change default labeling for /var/run/slapd.* sockets - Make thumb_t as userdom_home_reader - label /var/lib/sss/mc same as pubconf, so getpw domains can read it - Allow smbspool running as cups_t to stream connect to nmbd - accounts needs to be able to execute passwd on behalf of users - Allow systemd_tmpfiles_t to delete boot flags - Allow dnssec_trigger to connect to apache ports - Allow gnome keyring to create sock_files in ~/.cache - google_authenticator is using .google_authenticator - sandbox running from within firefox is exposing more leaks - Dontaudit thumb to read/write /dev/card0 - Dontaudit getattr on init_exec_t for gnomeclock_t - Allow certmonger to do a transition to certmonger_unconfined_t - Allow dhcpc setsched which is caused by nmcli - Add rpm_exec_t for /usr/sbin/bcfg2 - system cronjobs are sending dbus messages to systemd_logind - Thumnailers read /dev/urand- Allow auditctl getcap - Allow vdagent to use libsystemd-login - Allow abrt-dump-oops to search /etc/abrt - Got these avc's while trying to print a boarding pass from firefox - Devicekit is now putting the media directory under /run/media - Allow thumbnailers to create content in ~/.thumbails directory - Add support for proL2TPd by Dominick Grift - Allow all domains to call getcap - wdmd seems to get a random chown capability check that it does not need - Allow vhostmd to read kernel sysctls- Allow chronyd to read unix - Allow hpfax to read /etc/passwd - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them - Allow rpcd to read quota_db_t - Update to man pages to match latest policy - Fix bug in jockey interface for sepolgen-ifgen - Add initial svirt_prot_exec_t policy- More fixes for systemd from Dan Walsh- Add a new type for /etc/firewalld and allow firewalld to write to this directory - Add definition for ~/Maildir, and allow mail deliver domains to write there - Allow polipo to run from a cron job - Allow rtkit to schedule wine processes - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label - Allow users domains to send signals to consolehelper domains- More fixes for boinc policy - Allow polipo domain to create its own cache dir and pid file - Add systemctl support to httpd domain - Add systemctl support to polipo, allow NetworkManager to manage the service - Add policy for jockey-backend - Add support for motion daemon which is now covered by zoneminder policy - Allow colord to read/write motion tmpfs - Allow vnstat to search through var_lib_t directories - Stop transitioning to quota_t, from init an sysadm_t- Add svirt_lxc_file_t as a customizable type- Add additional fixes for icmp nagios plugin - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin - Add certmonger_unconfined_exec_t - Make sure tap22 device is created with the correct label - Allow staff users to read systemd unit files - Merge in previously built policy - Arpwatch needs to be able to start netlink sockets in order to start - Allow cgred_t to sys_ptrace to look at other DAC Processes- Back port some of the access that was allowed in nsplugin_t - Add definitiona for couchdb ports - Allow nagios to use inherited users ttys - Add git support for mock - Allow inetd to use rdate port - Add own type for rdate port - Allow samba to act as a portmapper - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev - New fixes needed for samba4 - Allow apps that use lib_t to read lib_t symlinks- Add policy for nove-cert - Add labeling for nova-openstack systemd unit files - Add policy for keystoke- Fix man pages fro domains - Add man pages for SELinux users and roles - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon - Add policy for matahari-rpcd - nfsd executes mount command on restart - Matahari domains execute renice and setsched - Dontaudit leaked tty in mozilla_plugin_config - mailman is changing to a per instance naming - Add 7600 and 4447 as jboss_management ports - Add fixes for nagios event handlers - Label httpd.event as httpd_exec_t, it is an apache daemon- Add labeling for /var/spool/postfix/dev/log - NM reads sysctl.conf - Iscsi log file context specification fix - Allow mozilla plugins to send dbus messages to user domains that transition to it - Allow mysql to read the passwd file - Allow mozilla_plugin_t to create mozilla home dirs in user homedir - Allow deltacloud to read kernel sysctl - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself - Allow postgresql_t to connectto itself - Add login_userdomain attribute for users which can log in using terminal- Allow sysadm_u to reach system_r by default #784011 - Allow nagios plugins to use inherited user terminals - Razor labeling is not used no longer - Add systemd support for matahari - Add port_types to man page, move booleans to the top, fix some english - Add support for matahari-sysconfig-console - Clean up matahari.fc - Fix matahari_admin() interfac - Add labels for/etc/ssh/ssh_host_*.pub keys- Allow ksysguardproces to send system log msgs - Allow boinc setpgid and signull - Allow xdm_t to sys_ptrace to run pidof command - Allow smtpd_t to manage spool files/directories and symbolic links - Add labeling for jetty - Needed changes to get unbound/dnssec to work with openswan- Add user_fonts_t alias xfs_tmp_t - Since depmod now runs as insmod_t we need to write to kernel_object_t - Allow firewalld to dbus chat with networkmanager - Allow qpidd to connect to matahari ports - policykit needs to read /proc for uses not owned by it - Allow systemctl apps to connecto the init stream- Turn on deny_ptrace boolean- Remove pam_selinux.8 man page. There was a conflict.- Add proxy class and read access for gssd_proxy - Separate out the sharing public content booleans - Allow certmonger to execute a script and send signals to apache and dirsrv to reload the certificate - Add label transition for gstream-0.10 and 12 - Add booleans to allow rsync to share nfs and cifs file sytems - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it - Fix filename transitions for cups files - Allow denyhosts to read "unix" - Add file name transition for locale.conf.new - Allow boinc projects to gconf config files - sssd needs to be able to increase the socket limit under certain loads - sge_execd needs to read /etc/passwd - Allow denyhost to check network state - NetworkManager needs to read sessions data - Allow denyhost to check network state - Allow xen to search virt images directories - Add label for /dev/megaraid_sas_ioctl_node - Add autogenerated man pages- Allow boinc project to getattr on fs - Allow init to execute initrc_state_t - rhev-agent package was rename to ovirt-guest-agent - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly - sytemd writes content to /run/initramfs and executes it on shutdown - kdump_t needs to read /etc/mtab, should be back ported to F16 - udev needs to load kernel modules in early system boot- Need to add sys_ptrace back in since reading any content in /proc can cause these accesses - Add additional systemd interfaces which are needed fro *_admin interfaces - Fix bind_admin() interface- Allow firewalld to read urand - Alias java, execmem_mono to bin_t to allow third parties - Add label for kmod - /etc/redhat-lsb contains binaries - Add boolean to allow gitosis to send mail - Add filename transition also for "event20" - Allow systemd_tmpfiles_t to delete all file types - Allow collectd to ipc_lock- make consoletype_exec optional, so we can remove consoletype policy - remove unconfined_permisive.patch - Allow openvpn_t to inherit user home content and tmp content - Fix dnssec-trigger labeling - Turn on obex policy for staff_t - Pem files should not be secret - Add lots of rules to fix AVC's when playing with containers - Fix policy for dnssec - Label ask-passwd directories correctly for systemd- sshd fixes seem to be causing unconfined domains to dyntrans to themselves - fuse file system is now being mounted in /run/user - systemd_logind is sending signals to processes that are dbus messaging with it - Add support for winshadow port and allow iscsid to connect to this port - httpd should be allowed to bind to the http_port_t udp socket - zarafa_var_lib_t can be a lnk_file - A couple of new .xsession-errors files - Seems like user space and login programs need to read logind_sessions_files - Devicekit disk seems to be being launched by systemd - Cleanup handling of setfiles so most of rules in te file - Correct port number for dnssec - logcheck has the home dir set to its cache- Add policy for grindengine MPI jobs- Add new sysadm_secadm.pp module * contains secadm definition for sysadm_t - Move user_mail_domain access out of the interface into the te file - Allow httpd_t to create httpd_var_lib_t directories as well as files - Allow snmpd to connect to the ricci_modcluster stream - Allow firewalld to read /etc/passwd - Add auth_use_nsswitch for colord - Allow smartd to read network state - smartdnotify needs to read /etc/group- Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory - lxdm startup scripts should be labeled bin_t, so confined users will work - mcstransd now creates a pid, needs back port to F16 - qpidd should be allowed to connect to the amqp port - Label devices 010-029 as usb devices - ypserv packager says ypserv does not use tmp_t so removing selinux policy types - Remove all ptrace commands that I believe are caused by the kernel/ps avcs - Add initial Obex policy - Add logging_syslogd_use_tty boolean - Add polipo_connect_all_unreserved bolean - Allow zabbix to connect to ftp port - Allow systemd-logind to be able to switch VTs - Allow apache to communicate with memcached through a sock_file- Fix file_context.subs_dist for now to work with pre usrmove- More /usr move fixes- Add zabbix_can_network boolean - Add httpd_can_connect_zabbix boolean - Prepare file context labeling for usrmove functions - Allow system cronjobs to read kernel network state - Add support for selinux_avcstat munin plugin - Treat hearbeat with corosync policy - Allow corosync to read and write to qpidd shared mem - mozilla_plugin is trying to run pulseaudio - Fixes for new sshd patch for running priv sep domains as the users context - Turn off dontaudit rules when turning on allow_ypbind - udev now reads /etc/modules.d directory- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out - Cups exchanges dbus messages with init - udisk2 needs to send syslog messages - certwatch needs to read /etc/passwd- Add labeling for udisks2 - Allow fsadmin to communicate with the systemd process- Treat Bip with bitlbee policy * Bip is an IRC proxy - Add port definition for interwise port - Add support for ipa_memcached socket - systemd_jounald needs to getattr on all processes - mdadmin fixes * uses getpw - amavisd calls getpwnam() - denyhosts calls getpwall()- Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there - bluetooth says they do not use /tmp and want to remove the type - Allow init to transition to colord - Mongod needs to read /proc/sys/vm/zone_reclaim_mode - Allow postfix_smtpd_t to connect to spamd - Add boolean to allow ftp to connect to all ports > 1023 - Allow sendmain to write to inherited dovecot tmp files - setroubleshoot needs to be able to execute rpm to see what version of packages- Merge systemd patch - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online - Allow deltacloudd dac_override, setuid, setgid caps - Allow aisexec to execute shell - Add use_nfs_home_dirs boolean for ssh-keygen- Fixes to make rawhide boot in enforcing mode with latest systemd changes- Add labeling for /var/run/systemd/journal/syslog - libvirt sends signals to ifconfig - Allow domains that read logind session files to list them- Fixed destined form libvirt-sandbox - Allow apps that list sysfs to also read sympolicy links in this filesystem - Add ubac_constrained rules for chrome_sandbox - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra - Allow postgresql to be executed by the caller - Standardize interfaces of daemons - Add new labeling for mm-handler - Allow all matahari domains to read network state and etc_runtime_t files- New fix for seunshare, requires seunshare_domains to be able to mounton / - Allow systemctl running as logrotate_t to connect to private systemd socket - Allow tmpwatch to read meminfo - Allow rpc.svcgssd to read supported_krb5_enctype - Allow zarafa domains to read /dev/random and /dev/urandom - Allow snmpd to read dev_snmp6 - Allow procmail to talk with cyrus - Add fixes for check_disk and check_nagios plugins- default trans rules for Rawhide policy - Make sure sound_devices controlC* are labeled correctly on creation - sssd now needs sys_admin - Allow snmp to read all proc_type - Allow to setup users homedir with quota.group- Add httpd_can_connect_ldap() interface - apcupsd_t needs to use seriel ports connected to usb devices - Kde puts procmail mail directory under ~/.local/share - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now - Add labeling for /sbin/iscsiuio- Add label for /var/lib/iscan/interpreter - Dont audit writes to leaked file descriptors or redirected output for nacl - NetworkManager needs to write to /sys/class/net/ib*/mode- Allow abrt to request the kernel to load a module - Make sure mozilla content is labeled correctly - Allow tgtd to read system state - More fixes for boinc * allow to resolve dns name * re-write boinc policy to use boinc_domain attribute - Allow munin services plugins to use NSCD services- Allow mozilla_plugin_t to manage mozilla_home_t - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain - Add label for tumblerd- Fixes for xguest package- Fixes related to /bin, /sbin - Allow abrt to getattr on blk files - Add type for rhev-agent log file - Fix labeling for /dev/dmfm - Dontaudit wicd leaking - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it - Label /etc/locale.conf correctly - Allow user_mail_t to read /dev/random - Allow postfix-smtpd to read MIMEDefang - Add label for /var/log/suphp.log - Allow swat_t to connect and read/write nmbd_t sock_file - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf - Allow systemd-tmpfiles to change user identity in object contexts - More fixes for rhev_agentd_t consolehelper policy- Use fs_use_xattr for squashf - Fix procs_type interface - Dovecot has a new fifo_file /var/run/dovecot/stats-mail - Dovecot has a new fifo_file /var/run/stats-mail - Colord does not need to connect to network - Allow system_cronjob to dbus chat with NetworkManager - Puppet manages content, want to make sure it labels everything correctly- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it - Allow all postfix domains to use the fifo_file - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t - Allow apmd_t to read grub.cfg - Let firewallgui read the selinux config - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp - Fix devicekit_manage_pid_files() interface - Allow squid to check the network state - Dontaudit colord getattr on file systems - Allow ping domains to read zabbix_tmp_t files- Allow mcelog_t to create dir and file in /var/run and label it correctly - Allow dbus to manage fusefs - Mount needs to read process state when mounting gluster file systems - Allow collectd-web to read collectd lib files - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr - Allow colord to get the attributes of tmpfs filesystem - Add sanlock_use_nfs and sanlock_use_samba booleans - Add bin_t label for /usr/lib/virtualbox/VBoxManage- Add ssh_dontaudit_search_home_dir - Changes to allow namespace_init_t to work - Add interface to allow exec of mongod, add port definition for mongod port, 27017 - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t - Allow spamd and clamd to steam connect to each other - Add policy label for passwd.OLD - More fixes for postfix and postfix maildro - Add ftp support for mozilla plugins - Useradd now needs to manage policy since it calls libsemanage - Fix devicekit_manage_log_files() interface - Allow colord to execute ifconfig - Allow accountsd to read /sys - Allow mysqld-safe to execute shell - Allow openct to stream connect to pcscd - Add label for /var/run/nm-dns-dnsmasq\.conf - Allow networkmanager to chat with virtd_t- Pulseaudio changes - Merge patches- Merge patches back into git repository.- Remove allow_execmem boolean and replace with deny_execmem boolean- Turn back on allow_execmem boolean- Add more MCS fixes to make sandbox working - Make faillog MLS trusted to make sudo_$1_t working - Allow sandbox_web_client_t to read passwd_file_t - Add .mailrc file context - Remove execheap from openoffice domain - Allow chrome_sandbox_nacl_t to read cpu_info - Allow virtd to relabel generic usb which is need if USB device - Fixes for virt.if interfaces to consider chr_file as image file type- Remove Open Office policy - Remove execmem policy- MCS fixes - quota fixes- Remove transitions to consoletype- Make nvidia* to be labeled correctly - Fix abrt_manage_cache() interface - Make filetrans rules optional so base policy will build - Dontaudit chkpwd_t access to inherited TTYS - Make sure postfix content gets created with the correct label - Allow gnomeclock to read cgroup - Fixes for cloudform policy- Check in fixed for Chrome nacl support- Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_overide to communicate with users TTY's - Allow svirt_lxc domains to send kill signals within their container- Remove qemu.pp again without causing a crash- Remove qemu.pp, everything should use svirt_t or stay in its current domain- Allow policykit to talk to the systemd via dbus - Move chrome_sandbox_nacl_t to permissive domains - Additional rules for chrome_sandbox_nacl- Change bootstrap name to nacl - Chrome still needs execmem - Missing role for chrome_sandbox_bootstrap - Add boolean to remove execmem and execstack from virtual machines - Dontaudit xdm_t doing an access_check on etc_t directories- Allow named to connect to dirsrv by default - add ldapmap1_0 as a krb5_host_rcache_t file - Google chrome developers asked me to add bootstrap policy for nacl stuff - Allow rhev_agentd_t to getattr on mountpoints - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets- Fixes for cloudform policies which need to connect to random ports - Make sure if an admin creates modules content it creates them with the correct label - Add port 8953 as a dns port used by unbound - Fix file name transition for alsa and confined users- Turn on mock_t and thumb_t for unconfined domains- Policy update should not modify local contexts- Remove ada policy- Remove tzdata policy - Add labeling for udev - Add cloudform policy - Fixes for bootloader policy- Add policies for nova openstack- Add fixes for nova-stack policy- Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain - Allow init process to setrlimit on itself - Take away transition rules for users executing ssh-keygen - Allow setroubleshoot_fixit_t to read /dev/urand - Allow sshd to relbale tunnel sockets - Allow fail2ban domtrans to shorewall in the same way as with iptables - Add support for lnk files in the /var/lib/sssd directory - Allow system mail to connect to courier-authdaemon over an unix stream socket- Add passwd_file_t for /etc/ptmptmp- Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK) - Make corosync to be able to relabelto cluster lib fies - Allow samba domains to search /var/run/nmbd - Allow dirsrv to use pam - Allow thumb to call getuid - chrome less likely to get mmap_zero bug so removing dontaudit - gimp help-browser has built in javascript - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t - Re-write glance policy- Move dontaudit sys_ptrace line from permissive.te to domain.te - Remove policy for hal, it no longer exists- Don't check md5 size or mtime on certain config files- Remove allow_ptrace and replace it with deny_ptrace, which will remove all ptrace from the system - Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;- Fixes for bootloader policy - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore - Allow nsplugin to read /usr/share/config - Allow sa-update to update rules - Add use_fusefs_home_dirs for chroot ssh option - Fixes for grub2 - Update systemd_exec_systemctl() interface - Allow gpg to read the mail spool - More fixes for sa-update running out of cron job - Allow ipsec_mgmt_t to read hardware state information - Allow pptp_t to connect to unreserved_port_t - Dontaudit getattr on initctl in /dev from chfn - Dontaudit getattr on kernel_core from chfn - Add systemd_list_unit_dirs to systemd_exec_systemctl call - Fixes for collectd policy - CHange sysadm_t to create content as user_tmp_t under /tmp- Shrink size of policy through use of attributes for userdomain and apache- Allow virsh to read xenstored pid file - Backport corenetwork fixes from upstream - Do not audit attempts by thumb to search config_home_t dirs (~/.config) - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t - allow thumb to read generic data home files (mime.type)- Allow nmbd to manage sock file in /var/run/nmbd - ricci_modservice send syslog msgs - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly - Allow systemd_logind_t to manage /run/USER/dconf/user- Fix missing patch from F16- Allow logrotate setuid and setgid since logrotate is supposed to do it - Fixes for thumb policy by grift - Add new nfsd ports - Added fix to allow confined apps to execmod on chrome - Add labeling for additional vdsm directories - Allow Exim and Dovecot SASL - Add label for /var/run/nmbd - Add fixes to make virsh and xen working together - Colord executes ls - /var/spool/cron is now labeled as user_cron_spool_t- Stop complaining about leaked file descriptors during install- Remove java and mono module and merge into execmem- Fixes for thumb policy and passwd_file_t- Fixes caused by the labeling of /etc/passwd - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide- Add support for Clustered Samba commands - Allow ricci_modrpm_t to send log msgs - move permissive virt_qmf_t from virt.te to permissivedomains.te - Allow ssh_t to use kernel keyrings - Add policy for libvirt-qmf and more fixes for linux containers - Initial Polipo - Sanlock needs to run ranged in order to kill svirt processes - Allow smbcontrol to stream connect to ctdbd- Add label for /etc/passwd- Change unconfined_domains to permissive for Rawhide - Add definition for the ephemeral_ports- Make mta_role() active - Allow asterisk to connect to jabber client port - Allow procmail to read utmp - Add NIS support for systemd_logind_t - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t - Fix systemd_manage_unit_dirs() interface - Allow ssh_t to manage directories passed into it - init needs to be able to create and delete unit file directories - Fix typo in apache_exec_sys_script - Add ability for logrotate to transition to awstat domain- Change screen to use screen_domain attribute and allow screen_domains to read all process domain state - Add SELinux support for ssh pre-auth net process in F17 - Add logging_syslogd_can_sendmail boolean- Add definition for ephemeral ports - Define user_tty_device_t as a customizable_type- Needs to require a new version of checkpolicy - Interface fixes- Allow sanlock to manage virt lib files - Add virt_use_sanlock booelan - ksmtuned is trying to resolve uids - Make sure .gvfs is labeled user_home_t in the users home directory - Sanlock sends kill signals and needs the kill capability - Allow mockbuild to work on nfs homedirs - Fix kerberos_manage_host_rcache() interface - Allow exim to read system state- Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t- Allow collectd to read hardware state information - Add loop_control_device_t - Allow mdadm to request kernel to load module - Allow domains that start other domains via systemctl to search unit dir - systemd_tmpfiles, needs to list any file systems mounted on /tmp - No one can explain why radius is listing the contents of /tmp, so we will dontaudit - If I can manage etc_runtime files, I should be able to read the links - Dontaudit hostname writing to mock library chr_files - Have gdm_t setup labeling correctly in users home dir - Label content unde /var/run/user/NAME/dconf as config_home_t - Allow sa-update to execute shell - Make ssh-keygen working with fips_enabled - Make mock work for staff_t user - Tighten security on mock_t- removing unconfined_notrans_t no longer necessary - Clean up handling of secure_mode_insmod and secure_mode_policyload - Remove unconfined_mount_t- Add exim_exec_t label for /usr/sbin/exim_tidydb - Call init_dontaudit_rw_stream_socket() interface in mta policy - sssd need to search /var/cache/krb5rcache directory - Allow corosync to relabel own tmp files - Allow zarafa domains to send system log messages - Allow ssh to do tunneling - Allow initrc scripts to sendto init_t unix_stream_socket - Changes to make sure dmsmasq and virt directories are labeled correctly - Changes needed to allow sysadm_t to manage systemd unit files - init is passing file descriptors to dbus and on to system daemons - Allow sulogin additional access Reported by dgrift and Jeremy Miller - Steve Grubb believes that wireshark does not need this access - Fix /var/run/initramfs to stop restorecon from looking at - pki needs another port - Add more labels for cluster scripts - Allow apps that manage cgroup_files to manage cgroup link files - Fix label on nfs-utils scripts directories - Allow gatherd to read /dev/rand and /dev/urand- pki needs another port - Add more labels for cluster scripts - Fix label on nfs-utils scripts directories - Fixes for cluster - Allow gatherd to read /dev/rand and /dev/urand - abrt leaks fifo files- Add glance policy - Allow mdadm setsched - /var/run/initramfs should not be relabeled with a restorecon run - memcache can be setup to override sys_resource - Allow httpd_t to read tetex data - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.- Allow Postfix to deliver to Dovecot LMTP socket - Ignore bogus sys_module for lldpad - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock - systemd_logind_t sets the attributes on usb devices - Allow hddtemp_t to read etc_t files - Add permissivedomains module - Move all permissive domains calls to permissivedomain.te - Allow pegasis to send kill signals to other UIDs- Allow insmod_t to use fds leaked from devicekit - dontaudit getattr between insmod_t and init_t unix_stream_sockets - Change sysctl unit file interfaces to use systemctl - Add support for chronyd unit file - Allow mozilla_plugin to read gnome_usr_config - Add policy for new gpsd - Allow cups to create kerberos rhost cache files - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly- Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten- Add policy for sa-update being run out of cron jobs - Add create perms to postgresql_manage_db - ntpd using a gps has to be able to read/write generic tty_device_t - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev - fix spec file - Remove qemu_domtrans_unconfined() interface - Make passenger working together with puppet - Add init_dontaudit_rw_stream_socket interface - Fixes for wordpress- Turn on allow_domain_fd_use boolean on F16 - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Add abrt_handle_event_t domain for ABRT event scripts - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change - Allow httpd_git_script_t to read passwd data - Allow openvpn to set its process priority when the nice parameter is used- livecd fixes - spec file fixes- fetchmail can use kerberos - ksmtuned reads in shell programs - gnome_systemctl_t reads the process state of ntp - dnsmasq_t asks the kernel to load multiple kernel modules - Add rules for domains executing systemctl - Bogus text within fc file- Add cfengine policy- Add abrt_domain attribute - Allow corosync to manage cluster lib files - Allow corosync to connect to the system DBUS- Add sblim, uuidd policies - Allow kernel_t dyntrasition to init_t- init_t need setexec - More fixes of rules which cause an explosion in rules by Dan Walsh- Allow rcsmcertd to perform DNS name resolution - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts - Allow tmux to run as screen - New policy for collectd - Allow gkeyring_t to interact with all user apps - Add rules to allow firstboot to run on machines with the unconfined.pp module removed- Allow systemd_logind to send dbus messages with users - allow accountsd to read wtmp file - Allow dhcpd to get and set capabilities- Fix oracledb_port definition - Allow mount to mounton the selinux file system - Allow users to list /var directories- systemd fixes- Add initial policy for abrt_dump_oops_t - xtables-multi wants to getattr of the proc fs - Smoltclient is connecting to abrt - Dontaudit leaked file descriptors to postdrop - Allow abrt_dump_oops to look at kernel sysctls - Abrt_dump_oops_t reads kernel ring buffer - Allow mysqld to request the kernel to load modules - systemd-login needs fowner - Allow postfix_cleanup_t to searh maildrop- Initial systemd_logind policy - Add policy for systemd_logger and additional proivs for systemd_logind - More fixes for systemd policies- Allow setsched for virsh - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories - iptables: the various /sbin/ip6?tables.* are now symlinks for /sbin/xtables-multi- A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit - Allow colord to interact with the users through the tmpfs file system - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files - Add label for /var/log/mcelog - Allow asterisk to read /dev/random if it uses TLS - Allow colord to read ini files which are labeled as bin_t - Allow dirsrvadmin sys_resource and setrlimit to use ulimit - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first. - Also lists /var and /var/spool directories - Add openl2tpd to l2tpd policy - qpidd is reading the sysfs file- Change usbmuxd_t to dontaudit attempts to read chr_file - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains - Allow pppd to search /var/lock dir - Add rhsmcertd policy- Update to upstream- More fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git- Fix spec file to not report Verify errors- Add dspam policy - Add lldpad policy - dovecot auth wants to search statfs #713555 - Allow systemd passwd apps to read init fifo_file - Allow prelink to use inherited terminals - Run cherokee in the httpd_t domain - Allow mcs constraints on node connections - Implement pyicqt policy - Fixes for zarafa policy - Allow cobblerd to send syslog messages- Add policy.26 to the payload - Remove olpc stuff - Remove policygentool- Fixes for zabbix - init script needs to be able to manage sanlock_var_run_... - Allow sandlock and wdmd to create /var/run directories... - mixclip.so has been compiled correctly - Fix passenger policy module name- Add mailscanner policy from dgrift - Allow chrome to optionally be transitioned to - Zabbix needs these rules when starting the zabbix_server_mysql - Implement a type for freedesktop openicc standard (~/.local/share/icc) - Allow system_dbusd_t to read inherited icc_data_home_t files. - Allow colord_t to read icc_data_home_t content. #706975 - Label stuff under /usr/lib/debug as if it was labeled under /- Fixes for sanlock policy - Fixes for colord policy - Other fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Add rhev policy module to modules-targeted.conf- Lot of fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log- Allow logrotate to execute systemctl - Allow nsplugin_t to getattr on gpmctl - Fix dev_getattr_all_chr_files() interface - Allow shorewall to use inherited terms - Allow userhelper to getattr all chr_file devices - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t - Fix labeling for ABRT Retrace Server- Dontaudit sys_module for ifconfig - Make telepathy and gkeyringd daemon working with confined users - colord wants to read files in users homedir - Remote login should be creating user_tmp_t not its own tmp files- Fix label for /usr/share/munin/plugins/munin_* plugins - Add support for zarafa-indexer - Fix boolean description - Allow colord to getattr on /proc/scsi/scsi - Add label for /lib/upstart/init - Colord needs to list /mnt- Forard port changes from F15 for telepathy - NetworkManager should be allowed to use /dev/rfkill - Fix dontaudit messages to say Domain to not audit - Allow telepathy domains to read/write gnome_cache files - Allow telepathy domains to call getpw - Fixes for colord and vnstatd policy- Allow init_t getcap and setcap - Allow namespace_init_t to use nsswitch - aisexec will execute corosync - colord tries to read files off noxattr file systems - Allow init_t getcap and setcap- Add support for ABRT retrace server - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners - Allow telepath_msn_t to read /proc/PARENT/cmdline - ftpd needs kill capability - Allow telepath_msn_t to connect to sip port - keyring daemon does not work on nfs homedirs - Allow $1_sudo_t to read default SELinux context - Add label for tgtd sock file in /var/run/ - Add apache_exec_rotatelogs interface - allow all zaraha domains to signal themselves, server writes to /tmp - Allow syslog to read the process state - Add label for /usr/lib/chromium-browser/chrome - Remove the telepathy transition from unconfined_t - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts - Allow initrc_t domain to manage abrt pid files - Add support for AEOLUS project - Virt_admin should be allowed to manage images and processes - Allow plymountd to send signals to init - Change labeling of fping6- Add filename transitions- Fixes for zarafa policy - Add support for AEOLUS project - Change labeling of fping6 - Allow plymountd to send signals to init - Allow initrc_t domain to manage abrt pid files - Virt_admin should be allowed to manage images and processes- xdm_t needs getsession for switch user - Every app that used to exec init is now execing systemdctl - Allow squid to manage krb5_host_rcache_t files - Allow foghorn to connect to agentx port - Fixes for colord policy- Add Dan's patch to remove 64 bit variants - Allow colord to use unix_dgram_socket - Allow apps that search pids to read /var/run if it is a lnk_file - iscsid_t creates its own directory - Allow init to list var_lock_t dir - apm needs to verify user accounts auth_use_nsswitch - Add labeling for systemd unit files - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added - Add label for matahari-broker.pid file - We want to remove untrustedmcsprocess from ability to read /proc/pid - Fixes for matahari policy - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on- Fix typo- Add /var/run/lock /var/lock definition to file_contexts.subs - nslcd_t is looking for kerberos cc files - SSH_USE_STRONG_RNG is 1 which requires /dev/random - Fix auth_rw_faillog definition - Allow sysadm_t to set attributes on fixed disks - allow user domains to execute lsof and look at application sockets - prelink_cron job calls telinit -u if init is rewritten - Fixes to run qemu_t from staff_t- Fix label for /var/run/udev to udev_var_run_t - Mock needs to be able to read network state- Add file_contexts.subs to handle /run and /run/lock - Add other fixes relating to /run changes from F15 policy- Allow $1_sudo_t and $1_su_t open access to user terminals - Allow initrc_t to use generic terminals - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs -systemd is going to be useing /run and /run/lock for early bootup files. - Fix some comments in rlogin.if - Add policy for KDE backlighthelper - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems - sssd wants to read .k5login file in users homedir - setroubleshoot reads executables to see if they have TEXTREL - Add /var/spool/audit support for new version of audit - Remove kerberos_connect_524() interface calling - Combine kerberos_master_port_t and kerberos_port_t - systemd has setup /dev/kmsg as stderr for apps it executes - Need these access so that init can impersonate sockets on unix_dgram_socket- Remove some unconfined domains - Remove permissive domains - Add policy-term.patch from Dan- Fix multiple specification for boot.log - devicekit leaks file descriptors to setfiles_t - Change all all_nodes to generic_node and all_if to generic_if - Should not use deprecated interface - Switch from using all_nodes to generic_node and from all_if to generic_if - Add support for xfce4-notifyd - Fix file context to show several labels as SystemHigh - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs - Add etc_runtime_t label for /etc/securetty - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly - login.krb needs to be able to write user_tmp_t - dirsrv needs to bind to port 7390 for dogtag - Fix a bug in gpg policy - gpg sends audit messages - Allow qpid to manage matahari files- Initial policy for matahari - Add dev_read_watchdog - Allow clamd to connect clamd port - Add support for kcmdatetimehelper - Allow shutdown to setrlimit and sys_nice - Allow systemd_passwd to talk to /dev/log before udev or syslog is running - Purge chr_file and blk files on /tmp - Fixes for pads - Fixes for piranha-pulse - gpg_t needs to be able to encyprt anything owned by the user- mozilla_plugin_tmp_t needs to be treated as user tmp files - More dontaudits of writes from readahead - Dontaudit readahead_t file_type:dir write, to cover up kernel bug - systemd_tmpfiles needs to relabel faillog directory as well as the file - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost- Add policykit fixes from Tim Waugh - dontaudit sandbox domains sandbox_file_t:dir mounton - Add new dontaudit rules for sysadm_dbusd_t - Change label for /var/run/faillock * other fixes which relate with this change- Update to upstream - Fixes for telepathy - Add port defition for ssdp port - add policy for /bin/systemd-notify from Dan - Mount command requires users read mount_var_run_t - colord needs to read konject_uevent_socket - User domains connect to the gkeyring socket - Add colord policy and allow user_t and staff_t to dbus chat with it - Add lvm_exec_t label for kpartx - Dontaudit reading the mail_spool_t link from sandbox -X - systemd is creating sockets in avahi_var_run and system_dbusd_var_run- gpg_t needs to talk to gnome-keyring - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd - enforce MCS labeling on nodes - Allow arpwatch to read meminfo - Allow gnomeclock to send itself signals - init relabels /dev/.udev files on boot - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t - dnsmasq can run as a dbus service, needs acquire service - mysql_admin should be allowed to connect to mysql service - virt creates monitor sockets in the users home dir- Allow usbhid-ups to read hardware state information - systemd-tmpfiles has moved - Allo cgroup to sys_tty_config - For some reason prelink is attempting to read gconf settings - Add allow_daemons_use_tcp_wrapper boolean - Add label for ~/.cache/wocky to make telepathy work in enforcing mode - Add label for char devices /dev/dasd* - Fix for apache_role - Allow amavis to talk to nslcd - allow all sandbox to read selinux poilcy config files - Allow cluster domains to use the system bus and send each other dbus messages- Update to upstream- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild- Update to ref policy - cgred needs chown capability - Add /dev/crash crash_dev_t - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability- New labeling for postfmulti #675654 - dontaudit xdm_t listing noxattr file systems - dovecot-auth needs to be able to connect to mysqld via the network as well as locally - shutdown is passed stdout to a xdm_log_t file - smartd creates a fixed disk device - dovecot_etc_t contains a lnk_file that domains need to read - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot- syslog_t needs syslog capability - dirsrv needs to be able to create /var/lib/snmp - Fix labeling for dirsrv - Fix for dirsrv policy missing manage_dirs_pattern - corosync needs to delete clvm_tmpfs_t files - qdiskd needs to list hugetlbfs - Move setsched to sandbox_x_domain, so firefox can run without network access - Allow hddtemp to read removable devices - Adding syslog and read_policy permissions to policy * syslog Allow unconfined, sysadm_t, secadm_t, logadm_t * read_policy allow unconfined, sysadm_t, secadm_t, staff_t on Targeted allow sysadm_t (optionally), secadm_t on MLS - mdadm application will write into /sys/.../uevent whenever arrays are assembled or disassembled.- Add tcsd policy- ricci_modclusterd_t needs to bind to rpc ports 500-1023 - Allow dbus to use setrlimit to increase resoueces - Mozilla_plugin is leaking to sandbox - Allow confined users to connect to lircd over unix domain stream socket which allow to use remote control - Allow awstats to read squid logs - seunshare needs to manage tmp_t - apcupsd cgi scripts have a new directory- Fix xserver_dontaudit_read_xdm_pid - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. * These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t - Allow readahead to manage readahead pid dirs - Allow readahead to read all mcs levels - Allow mozilla_plugin_t to use nfs or samba homedirs- Allow nagios plugin to read /proc/meminfo - Fix for mozilla_plugin - Allow samba_net_t to create /etc/keytab - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t - nslcd can read user credentials - Allow nsplugin to delete mozilla_plugin_tmpfs_t - abrt tries to create dir in rpm_var_lib_t - virt relabels fifo_files - sshd needs to manage content in fusefs homedir - mock manages link files in cache dir- nslcd needs setsched and to read /usr/tmp - Invalid call in likewise policy ends up creating a bogus role - Cannon puts content into /var/lib/bjlib that cups needs to be able to write - Allow screen to create screen_home_t in /root - dirsrv sends syslog messages - pinentry reads stuff in .kde directory - Add labels for .kde directory in homedir - Treat irpinit, iprupdate, iprdump services with raid policy- NetworkManager wants to read consolekit_var_run_t - Allow readahead to create /dev/.systemd/readahead - Remove permissive domains - Allow newrole to run namespace_init- Add sepgsql_contexts file- Update to upstream- Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on - Add puppetmaster_use_db boolean - Fixes for zarafa policy - Fixes for gnomeclock poliy - Fix systemd-tmpfiles to use auth_use_nsswitch- gnomeclock executes a shell - Update for screen policy to handle pipe in homedir - Fixes for polyinstatiated homedir - Fixes for namespace policy and other fixes related to polyinstantiation - Add namespace policy - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts - Fixes for init, psad policy which relate with confined users - Do not audit bootloader attempts to read devicekit pid files - Allow nagios service plugins to read /proc- Add firewalld policy - Allow vmware_host to read samba config - Kernel wants to read /proc Fix duplicate grub def in cobbler - Chrony sends mail, executes shell, uses fifo_file and reads /proc - devicekitdisk getattr all file systems - sambd daemon writes wtmp file - libvirt transitions to dmidecode- Add initial policy for system-setup-keyboard which is now daemon - Label /var/lock/subsys/shorewall as shorewall_lock_t - Allow users to communicate with the gpg_agent_t - Dontaudit mozilla_plugin_t using the inherited terminal - Allow sambagui to read files in /usr - webalizer manages squid log files - Allow unconfined domains to bind ports to raw_ip_sockets - Allow abrt to manage rpm logs when running yum - Need labels for /var/run/bittlebee - Label .ssh under amanda - Remove unused genrequires for virt_domain_template - Allow virt_domain to use fd inherited from virtd_t - Allow iptables to read shorewall config- Gnome apps list config_home_t - mpd creates lnk files in homedir - apache leaks write to mail apps on tmp files - /var/stockmaniac/templates_cache contains log files - Abrt list the connects of mount_tmp_t dirs - passwd agent reads files under /dev and reads utmp file - squid apache script connects to the squid port - fix name of plymouth log file - teamviewer is a wine app - allow dmesg to read system state - Stop labeling files under /var/lib/mock so restorecon will not go into this - nsplugin needs to read network state for google talk- Allow xdm and syslog to use /var/log/boot.log - Allow users to communicate with mozilla_plugin and kill it - Add labeling for ipv6 and dhcp- New labels for ghc http content - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy- Update to upstream - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot- Update selinux policy to handle new /usr/share/sandbox/start script- Update to upstream - Fix version of policy in spec file- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs - remove per sandbox domains devpts types - Allow dkim-milter sending signal to itself- Allow domains that transition to ping or traceroute, kill them - Allow user_t to conditionally transition to ping_t and traceroute_t - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup- Turn on systemd policy - mozilla_plugin needs to read certs in the homedir. - Dontaudit leaked file descriptors from devicekit - Fix ircssi to use auth_use_nsswitch - Change to use interface without param in corenet to disable unlabelednet packets - Allow init to relabel sockets and fifo files in /dev - certmonger needs dac* capabilities to manage cert files not owned by root - dovecot needs fsetid to change group membership on mail - plymouthd removes /var/log/boot.log - systemd is creating symlinks in /dev - Change label on /etc/httpd/alias to be all cert_t- Fixes for clamscan and boinc policy - Add boinc_project_t setpgid - Allow alsa to create tmp files in /tmp- Push fixes to allow disabling of unlabeled_t packet access - Enable unlabelednet policy- Fixes for lvm to work with systemd- Fix the label for wicd log - plymouthd creates force-display-on-active-vt file - Allow avahi to request the kernel to load a module - Dontaudit hal leaks - Fix gnome_manage_data interface - Add new interface corenet_packet to define a type as being an packet_type. - Removed general access to packet_type from icecast and squid. - Allow mpd to read alsa config - Fix the label for wicd log - Add systemd policy- Fix gnome_manage_data interface - Dontaudit sys_ptrace capability for iscsid - Fixes for nagios plugin policy- Fix cron to run ranged when started by init - Fix devicekit to use log files - Dontaudit use of devicekit_var_run_t for fstools - Allow init to setattr on logfile directories - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t- Fix up handling of dnsmasq_t creating /var/run/libvirt/network - Turn on sshd_forward_ports boolean by default - Allow sysadmin to dbus chat with rpm - Add interface for rw_tpm_dev - Allow cron to execute bin - fsadm needs to write sysfs - Dontaudit consoletype reading /var/run/pm-utils - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin - certmonger needs to manage dirsrv data - /var/run/pm-utils should be labeled as devicekit_var_run_t- fixes to allow /var/run and /var/lock as tmpfs - Allow chrome sandbox to connect to web ports - Allow dovecot to listem on lmtp and sieve ports - Allov ddclient to search sysctl_net_t - Transition back to original domain if you execute the shell- Remove duplicate declaration- Update to upstream - Cleanup for sandbox - Add attribute to be able to select sandbox types- Allow ddclient to fix file mode bits of ddclient conf file - init leaks file descriptors to daemons - Add labels for /etc/lirc/ and - Allow amavis_t to exec shell - Add label for gssd_tmp_t for /var/tmp/nfs_0- Put back in lircd_etc_t so policy will install- Turn on allow_postfix_local_write_mail_spool - Allow initrc_t to transition to shutdown_t - Allow logwatch and cron to mls_read_to_clearance for MLS boxes - Allow wm to send signull to all applications and receive them from users - lircd patch from field - Login programs have to read /etc/samba - New programs under /lib/systemd - Abrt needs to read config files- Update to upstream - Dontaudit leaked sockets from userdomains to user domains - Fixes for mcelog to handle scripts - Apply patch from Ruben Kerkhof - Allow syslog to search spool dirs- Allow nagios plugins to read usr files - Allow mysqld-safe to send system log messages - Fixes fpr ddclient policy - Fix sasl_admin interface - Allow apache to search zarafa config - Allow munin plugins to search /var/lib directory - Allow gpsd to read sysfs_t - Fix labels on /etc/mcelog/triggers to bin_t- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp - Fix xserver interface - Fix definition of /var/run/lxdm- Turn on mediawiki policy - kdump leaks kdump_etc_t to ifconfig, add dontaudit - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap- Allow groupd transition to fenced domain when executes fence_node - Fixes for rchs policy - Allow mpd to be able to read samba/nfs files- Fix up corecommands.fc to match upstream - Make sure /lib/systemd/* is labeled init_exec_t - mount wants to setattr on all mountpoints - dovecot auth wants to read dovecot etc files - nscd daemon looks at the exe file of the comunicating daemon - openvpn wants to read utmp file - postfix apps now set sys_nice and lower limits - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly - Also resolves nsswitch - Fix labels on /etc/hosts.* - Cleanup to make upsteam patch work - allow abrt to read etc_runtime_t- Add conflicts for dirsrv package- Update to upstream - Add vlock policy- Fix sandbox to work on nfs homedirs - Allow cdrecord to setrlimit - Allow mozilla_plugin to read xauth - Change label on systemd-logger to syslogd_exec_t - Install dirsrv policy from dirsrv package- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it - Udev needs to stream connect to init and kernel - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory- Allow NetworkManager to read openvpn_etc_t - Dontaudit hplip to write of /usr dirs - Allow system_mail_t to create /root/dead.letter as mail_home_t - Add vdagent policy for spice agent daemon- Dontaudit sandbox sending sigkill to all user domains - Add policy for rssh_chroot_helper - Add missing flask definitions - Allow udev to relabelto removable_t - Fix label on /var/log/wicd.log - Transition to initrc_t from init when executing bin_t - Add audit_access permissions to file - Make removable_t a device_node - Fix label on /lib/systemd/*- Fixes for systemd to manage /var/run - Dontaudit leaks by firstboot- Allow chome to create netlink_route_socket - Add additional MATHLAB file context - Define nsplugin as an application_domain - Dontaudit sending signals from sandboxed domains to other domains - systemd requires init to build /tmp /var/auth and /var/lock dirs - mount wants to read devicekit_power /proc/ entries - mpd wants to connect to soundd port - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit - Treat lib_t and textrel_shlib_t directories the same - Allow mount read access on virtual images- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs. - Allow devicekit_power to domtrans to mount - Allow dhcp to bind to udp ports > 1024 to do named stuff - Allow ssh_t to exec ssh_exec_t - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used - Fix clamav_append_log() intefaces - Fix 'psad_rw_fifo_file' interface- Allow cobblerd to list cobler appache content- Fixup for the latest version of upowed - Dontaudit sandbox sending SIGNULL to desktop apps- Update to upstream-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access - dovecot-auth_t needs ipc_lock - gpm needs to use the user terminal - Allow system_mail_t to append ~/dead.letter - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf - Add pid file to vnstatd - Allow mount to communicate with gfs_controld - Dontaudit hal leaks in setfiles- Lots of fixes for systemd - systemd now executes readahead and tmpwatch type scripts - Needs to manage random seed- Allow smbd to use sys_admin - Remove duplicate file context for tcfmgr - Update to upstream- Fix fusefs handling - Do not allow sandbox to manage nsplugin_rw_t - Allow mozilla_plugin_t to connecto its parent - Allow init_t to connect to plymouthd running as kernel_t - Add mediawiki policy - dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. - Disable transition from dbus_session_domain to telepathy for F14 - Allow boinc_project to use shm - Allow certmonger to search through directories that contain certs - Allow fail2ban the DAC Override so it can read log files owned by non root users- Start adding support for use_fusefs_home_dirs - Add /var/lib/syslog directory file context - Add /etc/localtime as locale file context- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user - Turn off iptables from unconfined user - Allow sudo to send signals to any domains the user could have transitioned to. - Passwd in single user mode needs to talk to console_device_t - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio - locate tried to read a symbolic link, will dontaudit - New labels for telepathy-sunshine content in homedir - Google is storing other binaries under /opt/google/talkplugin - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15 - modemmanger and bluetooth send dbus messages to devicekit_power - Samba needs to getquota on filesystems labeld samba_share_t- Dontaudit attempts by xdm_t to write to bin_t for kdm - Allow initrc_t to manage system_conf_t- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets - Allow confined users to read xdm_etc_t files - Allow xdm_t to transition to xauth_t for lxdm program- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home - Allow clamd to send signals to itself - Allow mozilla_plugin_t to read user home content. And unlink pulseaudio shm. - Allow haze to connect to yahoo chat and messenger port tcp:5050. Bz #637339 - Allow guest to run ps command on its processes by allowing it to read /proc - Allow firewallgui to sys_rawio which seems to be required to setup masqerading - Allow all domains to search through default_t directories, in order to find differnet labels. For example people serring up /foo/bar to be share via samba. - Add label for /var/log/slim.log- Pull in cleanups from dgrift - Allow mozilla_plugin_t to execute mozilla_home_t - Allow rpc.quota to do quotamod- Cleanup policy via dgrift - Allow dovecot_deliver to append to inherited log files - Lots of fixes for consolehelper- Fix up Xguest policy- Add vnstat policy - allow libvirt to send audit messages - Allow chrome-sandbox to search nfs_t- Update to upstream- Add the ability to send audit messages to confined admin policies - Remove permissive domain from cmirrord and dontaudit sys_tty_config - Split out unconfined_domain() calls from other unconfined_ calls so we can d - virt needs to be able to read processes to clearance for MLS- Allow all domains that can use cgroups to search tmpfs_t directory - Allow init to send audit messages- Update to upstream- Allow mdadm_t to create files and sock files in /dev/md/- Add policy for ajaxterm- Handle /var/db/sudo - Allow pulseaudio to read alsa config - Allow init to send initrc_t dbus messagesAllow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr intd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port- Merge upstream fix of mmap_zero - Allow mount to write files in debugfs_t - Allow corosync to communicate with clvmd via tmpfs - Allow certmaster to read usr_t files - Allow dbus system services to search cgroup_t - Define rlogind_t as a login pgm- Allow mdadm_t to read/write hugetlbfs- Dominic Grift Cleanup - Miroslav Grepl policy for jabberd - Various fixes for mount/livecd and prelink- Merge with upstream- More access needed for devicekit - Add dbadm policy- Merge with upstream- Allow seunshare to fowner- Allow cron to look at user_cron_spool links - Lots of fixes for mozilla_plugin_t - Add sysv file system - Turn unconfined domains to permissive to find additional avcs- Update policy for mozilla_plugin_t- Allow clamscan to read proc_t - Allow mount_t to write to debufs_t dir - Dontaudit mount_t trying to write to security_t dir- Allow clamscan_t execmem if clamd_use_jit set - Add policy for firefox plugin-container- Fix /root/.forward definition- label dead.letter as mail_home_t- Allow login programs to search /cgroups- Fix cert handling- Fix devicekit_power bug - Allow policykit_auth_t more access.- Fix nis calls to allow bind to ports 512-1024 - Fix smartmon- Allow pcscd to read sysfs - systemd fixes - Fix wine_mmap_zero_ignore boolean- Apply Miroslav munin patch - Turn back on allow_execmem and allow_execmod booleans- Merge in fixes from dgrift repository- Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0- New paths for upstart- New permissions for syslog - New labels for /lib/upstart- Add mojomojo policy- Allow systemd to setsockcon on sockets to immitate other services- Remove debugfs label- Update to latest policy- Fix eclipse labeling from IBMSupportAssasstant packageing- Make boot with systemd in enforcing mode- Update to upstream- Add boolean to turn off port forwarding in sshd.- Add support for ebtables - Fixes for rhcs and corosync policy-Update to upstream-Update to upstream-Update to upstream- Add Zarafa policy- Cleanup of aiccu policy - initial mock policy- Lots of random fixes- Update to upstream- Update to upstream - Allow prelink script to signal itself - Cobbler fixes- Add xdm_var_run_t to xserver_stream_connect_xdm - Add cmorrord and mpd policy from Miroslav Grepl- Fix sshd creation of krb cc files for users to be user_tmp_t- Fixes for accountsdialog - Fixes for boinc- Fix label on /var/lib/dokwiki - Change permissive domains to enforcing - Fix libvirt policy to allow it to run on mls- Update to upstream- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t - Fix /var/run/abrtd.lock label- Allow login programs to read krb5_home_t Resolves: 594833 - Add obsoletes for cachefilesfd-selinux package Resolves: #575084- Allow mount to r/w abrt fifo file - Allow svirt_t to getattr on hugetlbfs - Allow abrt to create a directory under /var/spool- Add labels for /sys - Allow sshd to getattr on shutdown - Fixes for munin - Allow sssd to use the kernel key ring - Allow tor to send syslog messages - Allow iptabels to read usr files - allow policykit to read all domains state- Fix path for /var/spool/abrt - Allow nfs_t as an entrypoint for http_sys_script_t - Add policy for piranha - Lots of fixes for sosreport- Allow xm_t to read network state and get and set capabilities - Allow policykit to getattr all processes - Allow denyhosts to connect to tcp port 9911 - Allow pyranha to use raw ip sockets and ptrace itself - Allow unconfined_execmem_t and gconfsd mechanism to dbus - Allow staff to kill ping process - Add additional MLS rules- Allow gdm to edit ~/.gconf dir Resolves: #590677 - Allow dovecot to create directories in /var/lib/dovecot Partially resolves 590224 - Allow avahi to dbus chat with NetworkManager - Fix cobbler labels - Dontaudit iceauth_t leaks - fix /var/lib/lxdm file context - Allow aiccu to use tun tap devices - Dontaudit shutdown using xserver.log- Fixes for sandbox_x_net_t to match access for sandbox_web_t ++ - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory - Add dontaudit interface for bluetooth dbus - Add chronyd_read_keys, append_keys for initrc_t - Add log support for ksmtuned Resolves: #586663- Allow boinc to send mail- Allow initrc_t to remove dhcpc_state_t - Fix label on sa-update.cron - Allow dhcpc to restart chrony initrc - Don't allow sandbox to send signals to its parent processes - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t Resolves: #589136- Fix location of oddjob_mkhomedir Resolves: #587385 - fix labeling on /root/.shosts and ~/.shosts - Allow ipsec_mgmt_t to manage net_conf_t Resolves: #586760- Dontaudit sandbox trying to connect to netlink sockets Resolves: #587609 - Add policy for piranha- Fixups for xguest policy - Fixes for running sandbox firefox- Allow ksmtuned to use terminals Resolves: #586663 - Allow lircd to write to generic usb devices- Allow sandbox_xserver to connectto unconfined stream Resolves: #585171- Allow initrc_t to read slapd_db_t Resolves: #585476 - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf Resolves: #585963- Allow rlogind_t to search /root for .rhosts Resolves: #582760 - Fix path for cached_var_t - Fix prelink paths /var/lib/prelink - Allow confined users to direct_dri - Allow mls lvm/cryptosetup to work- Allow virtd_t to manage firewall/iptables config Resolves: #573585- Fix label on /root/.rhosts Resolves: #582760 - Add labels for Picasa - Allow openvpn to read home certs - Allow plymouthd_t to use tty_device_t - Run ncftool as iptables_t - Allow mount to unmount unlabeled_t - Dontaudit hal leaks- Allow livecd to transition to mount- Update to upstream - Allow abrt to delete sosreport Resolves: #579998 - Allow snmp to setuid and gid Resolves: #582155 - Allow smartd to use generic scsi devices Resolves: #582145- Allow ipsec_t to create /etc/resolv.conf with the correct label - Fix reserved port destination - Allow autofs to transition to showmount - Stop crashing tuned- Add telepathysofiasip policy- Update to upstream - Fix label for /opt/google/chrome/chrome-sandbox - Allow modemmanager to dbus with policykit- Fix allow_httpd_mod_auth_pam to use auth_use_pam(httpd_t) - Allow accountsd to read shadow file - Allow apache to send audit messages when using pam - Allow asterisk to bind and connect to sip tcp ports - Fixes for dovecot 2.0 - Allow initrc_t to setattr on milter directories - Add procmail_home_t for .procmailrc file- Fixes for labels during install from livecd- Fix /cgroup file context - Fix broken afs use of unlabled_t - Allow getty to use the console for s390- Fix cgroup handling adding policy for /cgroup - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set- Merge patches from dgrift- Update upstream - Allow abrt to write to the /proc under any process- Fix ~/.fontconfig label - Add /root/.cert label - Allow reading of the fixed_file_disk_t:lnk_file if you can read file - Allow qemu_exec_t as an entrypoint to svirt_t- Update to upstream - Allow tmpreaper to delete sandbox sock files - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems - Fixes for gitosis - No transition on livecd to passwd or chfn - Fixes for denyhosts- Add label for /var/lib/upower - Allow logrotate to run sssd - dontaudit readahead on tmpfs blk files - Allow tmpreaper to setattr on sandbox files - Allow confined users to execute dos files - Allow sysadm_t to kill processes running within its clearance - Add accountsd policy - Fixes for corosync policy - Fixes from crontab policy - Allow svirt to manage svirt_image_t chr files - Fixes for qdisk policy - Fixes for sssd policy - Fixes for newrole policy- make libvirt work on an MLS platform- Add qpidd policy- Update to upstream- Allow boinc to read kernel sysctl - Fix snmp port definitions - Allow apache to read anon_inodefs- Allow shutdown dac_override- Add device_t as a file system - Fix sysfs association- Dontaudit ipsec_mgmt sys_ptrace - Allow at to mail its spool files - Allow nsplugin to search in .pulse directory- Update to upstream- Allow users to dbus chat with xdm - Allow users to r/w wireless_device_t - Dontaudit reading of process states by ipsec_mgmt- Fix openoffice from unconfined_t- Add shutdown policy so consolekit can shutdown system- Update to upstream- Update to upstream- Update to upstream - These are merges of my patches - Remove 389 labeling conflicts - Add MLS fixes found in RHEL6 testing - Allow pulseaudio to run as a service - Add label for mssql and allow apache to connect to this database port if boolean set - Dontaudit searches of debugfs mount point - Allow policykit_auth to send signals to itself - Allow modcluster to call getpwnam - Allow swat to signal winbind - Allow usbmux to run as a system role - Allow svirt to create and use devpts- Add MLS fixes found in RHEL6 testing - Allow domains to append to rpm_tmp_t - Add cachefilesfd policy - Dontaudit leaks when transitioning- Change allow_execstack and allow_execmem booleans to on - dontaudit acct using console - Add label for fping - Allow tmpreaper to delete sandbox_file_t - Fix wine dontaudit mmap_zero - Allow abrt to read var_t symlinks- Additional policy for rgmanager- Allow sshd to setattr on pseudo terms- Update to upstream- Allow policykit to send itself signals- Fix duplicate cobbler definition- Fix file context of /var/lib/avahi-autoipd- Merge with upstream- Allow sandbox to work with MLS- Make Chrome work with staff user- Add icecast policy - Cleanup spec file- Add mcelog policy- Lots of fixes found in F12- Fix rpm_dontaudit_leaks- Add getsched to hald_t - Add file context for Fedora/Redhat Directory Server- Allow abrt_helper to getattr on all filesystems - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so- Add gstreamer_home_t for ~/.gstreamer- Update to upstream- Fix git- Turn on puppet policy - Update to dgrift git policy- Move users file to selection by spec file. - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t- Update to upstream- Remove most of the permissive domains from F12.- Add cobbler policy from dgrift- add usbmon device - Add allow rulse for devicekit_disk- Lots of fixes found in F12, fixes from Tom London- Cleanups from dgrift- Add back xserver_manage_home_fonts- Dontaudit sandbox trying to read nscd and sssd- Update to upstream- Rename udisks-daemon back to devicekit_disk_t policy- Fixes for abrt calls- Add tgtd policy- Update to upstream release- Add asterisk policy back in - Update to upstream release 2.20091117- Update to upstream release 2.20091117- Fixup nut policy- Update to upstream- Allow vpnc request the kernel to load modules- Fix minimum policy installs - Allow udev and rpcbind to request the kernel to load modules- Add plymouth policy - Allow local_login to sys_admin- Allow cupsd_config to read user tmp - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t- Update rhcs policy- Allow users to exec restorecond- Allow sendmail to request kernel modules load- Fix all kernel_request_load_module domains- Fix all kernel_request_load_module domains- Remove allow_exec* booleans for confined users. Only available for unconfined_t- More fixes for sandbox_web_t- Allow sshd to create .ssh directory and content- Fix request_module line to module_request- Fix sandbox policy to allow it to run under firefox. - Dont audit leaks.- Fixes for sandbox- Update to upstream - Dontaudit nsplugin search /root - Dontaudit nsplugin sys_nice- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service - Remove policycoreutils-python requirement except for minimum- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)- Add wordpress/wp-content/uploads label - Fixes for sandbox when run from staff_t- Update to upstream - Fixes for devicekit_disk- More fixes- Lots of fixes for initrc and other unconfined domains- Allow xserver to use netlink_kobject_uevent_socket- Fixes for sandbox- Dontaudit setroubleshootfix looking at /root directory- Update to upsteam- Allow gssd to send signals to users - Fix duplicate label for apache content- Update to upstream- Remove polkit_auth on upgrades- Add back in unconfined.pp and unconfineduser.pp - Add Sandbox unshare- Fixes for cdrecord, mdadm, and others- Add capability setting to dhcpc and gpm- Allow cronjobs to read exim_spool_t- Add ABRT policy- Fix system-config-services policy- Allow libvirt to change user componant of virt_domain- Allow cupsd_config_t to be started by dbus - Add smoltclient policy- Add policycoreutils-python to pre install- Make all unconfined_domains permissive so we can see what AVC's happen- Add pt_chown policy- Add kdump policy for Miroslav Grepl - Turn off execstack boolean- Turn on execstack on a temporary basis (#512845)- Allow nsplugin to connecto the session bus - Allow samba_net to write to coolkey data- Allow devicekit_disk to list inotify- Allow svirt images to create sock_file in svirt_var_run_t- Allow exim to getattr on mountpoints - Fixes for pulseaudio- Allow svirt_t to stream_connect to virtd_t- Allod hald_dccm_t to create sock_files in /tmp- More fixes from upstream- Fix polkit label - Remove hidebrokensymptoms for nss_ldap fix - Add modemmanager policy - Lots of merges from upstream - Begin removing textrel_shlib_t labels, from fixed libraries- Update to upstream- Allow certmaster to override dac permissions- Update to upstream- Fix context for VirtualBox- Update to upstream- Allow clamscan read amavis spool files- Fixes for xguest- fix multiple directory ownership of mandirs- Update to upstream- Add rules for rtkit-daemon- Update to upstream - Fix nlscd_stream_connect- Add rtkit policy- Allow rpcd_t to stream connect to rpcbind- Allow kpropd to create tmp files- Fix last duplicate /var/log/rpmpkgs- Update to upstream * add sssd- Update to upstream * cleanup- Update to upstream - Additional mail ports - Add virt_use_usb boolean for svirt- Fix mcs rules to include chr_file and blk_file- Add label for udev-acl- Additional rules for consolekit/udev, privoxy and various other fixes- New version for upstream- Allow NetworkManager to read inotifyfs- Allow setroubleshoot to run mlocate- Update to upstream- Add fish as a shell - Allow fprintd to list usbfs_t - Allow consolekit to search mountpoints - Add proper labeling for shorewall- New log file for vmware - Allow xdm to setattr on user_tmp_t- Upgrade to upstream- Allow fprintd to access sys_ptrace - Add sandbox policy- Add varnishd policy- Fixes for kpropd- Allow brctl to r/w tun_tap_device_t- Add /usr/share/selinux/packages- Allow rpcd_t to send signals to kernel threads- Fix upgrade for F10 to F11- Add policy for /var/lib/fprint-Remove duplicate line- Allow svirt to manage pci and other sysfs device data- Fix package selection handling- Fix /sbin/ip6tables-save context - Allod udev to transition to mount - Fix loading of mls policy file- Add shorewall policy- Additional rules for fprintd and sssd- Allow nsplugin to unix_read unix_write sem for unconfined_java- Fix uml files to be owned by users- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less- Allow confined users to manage virt_content_t, since this is home dir content - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection- Fix labeling on /var/lib/misc/prelink* - Allow xserver to rw_shm_perms with all x_clients - Allow prelink to execute files in the users home directory- Allow initrc_t to delete dev_null - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead- Update to latest milter code from Paul Howarth- Additional perms for readahead- Allow pulseaudio to acquire_svc on session bus - Fix readahead labeling- Allow sysadm_t to run rpm directly - libvirt needs fowner- Allow sshd to read var_lib symlinks for freenx- Allow nsplugin unix_read and write on users shm and sem - Allow sysadm_t to execute su- Dontaudit attempts to getattr user_tmpfs_t by lvm - Allow nfs to share removable media- Add ability to run postdrop from confined users- Fixes for podsleuth- Turn off nsplugin transition - Remove Konsole leaked file descriptors for release- Allow cupsd_t to create link files in print_spool_t - Fix iscsi_stream_connect typo - Fix labeling on /etc/acpi/actions - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed- Allow audioentroy to read etc files- Add fail2ban_var_lib_t - Fixes for devicekit_power_t- Separate out the ucnonfined user from the unconfined.pp package- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.- Upgrade to latest upstream - Allow devicekit_disk sys_rawio- Dontaudit binds to ports < 1024 for named - Upgrade to latest upstream- Allow podsleuth to use tmpfs files- Add customizable_types for svirt- Allow setroubelshoot exec* privs to prevent crash from bad libraries - add cpufreqselector- Dontaudit listing of /root directory for cron system jobs- Fix missing ld.so.cache label- Add label for ~/.forward and /root/.forward- Fixes for svirt- Fixes to allow svirt read iso files in homedir- Add xenner and wine fixes from mgrepl- Allow mdadm to read/write mls override- Change to svirt to only access svirt_image_t- Fix libvirt policy- Upgrade to latest upstream- Fixes for iscsid and sssd - More cleanups for upgrade from F10 to Rawhide.- Add pulseaudio, sssd policy - Allow networkmanager to exec udevadm- Add pulseaudio context- Upgrade to latest patches- Fixes for libvirt- Update to Latest upstream- Fix setrans.conf to show SystemLow for s0- Further confinement of qemu images via svirt- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild- Allow NetworkManager to manage /etc/NetworkManager/system-connections- add virtual_image_context and virtual_domain_context files- Allow rpcd_t to send signal to mount_t - Allow libvirtd to run ranged- Fix sysnet/net_conf_t- Fix squidGuard labeling- Re-add corenet_in_generic_if(unlabeled_t)* Tue Feb 10 2009 Dan Walsh 3.6.5-2 - Add git web policy- Add setrans contains from upstream- Do transitions outside of the booleans- Allow xdm to create user_tmp_t sockets for switch user to work- Fix staff_t domain- Grab remainder of network_peer_controls patch- More fixes for devicekit- Upgrade to latest upstream- Add boolean to disallow unconfined_t login- Add back transition from xguest to mozilla- Add virt_content_ro_t and labeling for isos directory- Fixes for wicd daemon- More mls/rpm fixes- Add policy to make dbus/nm-applet work- Remove polgen-ifgen from post and add trigger to policycoreutils-python- Add wm policy - Make mls work in graphics mode- Fixed for DeviceKit- Add devicekit policy- Update to upstream- Define openoffice as an x_domain- Fixes for reading xserver_tmp_t- Allow cups_pdf_t write to nfs_t- Remove audio_entropy policy- Update to upstream- Allow hal_acl_t to getattr/setattr fixed_disk- Change userdom_read_all_users_state to include reading symbolic links in /proc- Fix dbus reading /proc information- Add missing alias for home directory content- Fixes for IBM java location- Allow unconfined_r unconfined_java_t- Add cron_role back to user domains- Fix sudo setting of user keys- Allow iptables to talk to terminals - Fixes for policy kit - lots of fixes for booting.- Cleanup policy- Rebuild for Python 2.6- Fix labeling on /var/spool/rsyslog- Allow postgresl to bind to udp nodes- Allow lvm to dbus chat with hal - Allow rlogind to read nfs_t- Fix cyphesis file context- Allow hal/pm-utils to look at /var/run/video.rom - Add ulogd policy- Additional fixes for cyphesis - Fix certmaster file context - Add policy for system-config-samba - Allow hal to read /var/run/video.rom- Allow dhcpc to restart ypbind - Fixup labeling in /var/run- Add certmaster policy- Fix confined users - Allow xguest to read/write xguest_dbusd_t- Allow openoffice execstack/execmem privs- Allow mozilla to run with unconfined_execmem_t- Dontaudit domains trying to write to .xsession-errors- Allow nsplugin to look at autofs_t directory- Allow kerneloops to create tmp files- More alias for fastcgi- Remove mod_fcgid-selinux package- Fix dovecot access- Policy cleanup- Remove Multiple spec - Add include - Fix makefile to not call per_role_expansion- Fix labeling of libGL- Update to upstream- Update to upstream policy- Fixes for confined xwindows and xdm_t- Allow confined users and xdm to exec wm - Allow nsplugin to talk to fifo files on nfs- Allow NetworkManager to transition to avahi and iptables - Allow domains to search other domains keys, coverup kernel bug- Fix labeling for oracle- Allow nsplugin to comminicate with xdm_tmp_t sock_file- Change all user tmpfs_t files to be labeled user_tmpfs_t - Allow radiusd to create sock_files- Upgrade to upstream- Allow confined users to login with dbus- Fix transition to nsplugin- Add file context for /dev/mspblk.*- Fix transition to nsplugin '- Fix labeling on new pm*log - Allow ssh to bind to all nodes- Merge upstream changes - Add Xavier Toth patches- Add qemu_cache_t for /var/cache/libvirt- Remove gamin policy- Add tinyxs-max file system support- Update to upstream - New handling of init scripts- Allow pcsd to dbus - Add memcache policy- Allow audit dispatcher to kill his children- Update to upstream - Fix crontab use by unconfined user- Allow ifconfig_t to read dhcpc_state_t- Update to upstream- Update to upstream- Allow system-config-selinux to work with policykit- Fix novel labeling- Consolodate pyzor,spamassassin, razor into one security domain - Fix xdm requiring additional perms.- Fixes for logrotate, alsa- Eliminate vbetool duplicate entry- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t - Change dhclient to be able to red networkmanager_var_run- Update to latest refpolicy - Fix libsemanage initial install bug- Add inotify support to nscd- Allow unconfined_t to setfcap- Allow amanda to read tape - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi - Add support for netware file systems- Allow ypbind apps to net_bind_service- Allow all system domains and application domains to append to any log file- Allow gdm to read rpm database - Allow nsplugin to read mplayer config files- Allow vpnc to run ifconfig- Allow confined users to use postgres - Allow system_mail_t to exec other mail clients - Label mogrel_rails as an apache server- Apply unconfined_execmem_exec_t to haskell programs- Fix prelude file context- allow hplip to talk dbus - Fix context on ~/.local dir- Prevent applications from reading x_device- Add /var/lib/selinux context- Update to upstream- Add livecd policy- Dontaudit search of admin_home for init_system_domain - Rewrite of xace interfaces - Lots of new fs_list_inotify - Allow livecd to transition to setfiles_mac- Begin XAce integration- Merge Upstream- Allow amanada to create data files- Fix initial install, semanage setup- Allow system_r for httpd_unconfined_script_t- Remove dmesg boolean - Allow user domains to read/write game data- Change unconfined_t to transition to unconfined_mono_t when running mono - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work- Remove old booleans from targeted-booleans.conf file- Add boolean to mmap_zero - allow tor setgid - Allow gnomeclock to set clock- Don't run crontab from unconfined_t- Change etc files to config files to allow users to read them- Lots of fixes for confined domains on NFS_t homedir- dontaudit mrtg reading /proc - Allow iscsi to signal itself - Allow gnomeclock sys_ptrace- Allow dhcpd to read kernel network state- Label /var/run/gdm correctly - Fix unconfined_u user creation- Allow transition from initrc_t to getty_t- Allow passwd to communicate with user sockets to change gnome-keyring- Fix initial install- Allow radvd to use fifo_file - dontaudit setfiles reading links - allow semanage sys_resource - add allow_httpd_mod_auth_ntlm_winbind boolean - Allow privhome apps including dovecot read on nfs and cifs home dirs if the boolean is set- Allow nsplugin to read /etc/mozpluggerrc, user_fonts - Allow syslog to manage innd logs. - Allow procmail to ioctl spamd_exec_t- Allow initrc_t to dbus chat with consolekit.- Additional access for nsplugin - Allow xdm setcap/getcap until pulseaudio is fixed- Allow mount to mkdir on tmpfs - Allow ifconfig to search debugfs- Fix file context for MATLAB - Fixes for xace- Allow stunnel to transition to inetd children domains - Make unconfined_dbusd_t an unconfined domain- Fixes for qemu/virtd- Fix bug in mozilla policy to allow xguest transition - This will fix the libsemanage.dbase_llist_query: could not find record value libsemanage.dbase_llist_query: could not query record value (No such file or directory) bug in xguest- Allow nsplugin to run acroread- Add cups_pdf policy - Add openoffice policy to run in xguest- prewika needs to contact mysql - Allow syslog to read system_map files- Change init_t to an unconfined_domain- Allow init to transition to initrc_t on shell exec. - Fix init to be able to sendto init_t. - Allow syslog to connect to mysql - Allow lvm to manage its own fifo_files - Allow bugzilla to use ldap - More mls fixes- fixes for init policy (#436988) - fix build- Additional changes for MLS policy- Fix initrc_context generation for MLS- Fixes for libvirt- Allow bitlebee to read locale_t- More xselinux rules- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t- Prepare policy for beta release - Change some of the system domains back to unconfined - Turn on some of the booleans- Allow nsplugin_config execstack/execmem - Allow nsplugin_t to read alsa config - Change apache to use user content- Add cyphesis policy- Fix Makefile.devel to build mls modules - Fix qemu to be more specific on labeling- Update to upstream fixes- Allow staff to mounton user_home_t- Add xace support- Add fusectl file system- Fixes from yum-cron - Update to latest upstream- Fix userdom_list_user_files- Merge with upstream- Allow udev to send audit messages- Add additional login users interfaces - userdom_admin_login_user_template(staff)- More fixes for polkit- Eliminate transition from unconfined_t to qemu by default - Fixes for gpg- Update to upstream- Fixes for staff_t- Add policy for kerneloops - Add policy for gnomeclock- Fixes for libvirt- Fixes for nsplugin- More fixes for qemu- Additional ports for vnc and allow qemu and libvirt to search all directories- Update to upstream - Add libvirt policy - add qemu policy- Allow fail2ban to create a socket in /var/run- Allow allow_httpd_mod_auth_pam to work- Add audisp policy and prelude- Allow all user roles to executae samba net command- Allow usertypes to read/write noxattr file systems- Fix nsplugin to allow flashplugin to work in enforcing mode- Allow pam_selinux_permit to kill all processes- Allow ptrace or user processes by users of same type - Add boolean for transition to nsplugin- Allow nsplugin sys_nice, getsched, setsched- Allow login programs to talk dbus to oddjob- Add procmail_log support - Lots of fixes for munin- Allow setroubleshoot to read policy config and send audit messages- Allow users to execute all files in homedir, if boolean set - Allow mount to read samba config- Fixes for xguest to run java plugin- dontaudit pam_t and dbusd writing to user_home_t- Update gpg to allow reading of inotify- Change user and staff roles to work correctly with varied perms- Fix munin log, - Eliminate duplicate mozilla file context - fix wpa_supplicant spec- Fix role transition from unconfined_r to system_r when running rpm - Allow unconfined_domains to communicate with user dbus instances- Fixes for xguest- Let all uncofined domains communicate with dbus unconfined- Run rpm in system_r- Zero out customizable types- Fix definiton of admin_home_t- Fix munin file context- Allow cron to run unconfined apps- Modify default login to unconfined_u- Dontaudit dbus user client search of /root- Update to upstream- Fixes for polkit - Allow xserver to ptrace- Add polkit policy - Symplify userdom context, remove automatic per_role changes- Update to upstream - Allow httpd_sys_script_t to search users homedirs- Allow rpm_script to transition to unconfined_execmem_t- Remove user based home directory separation- Remove user specific crond_t- Merge with upstream - Allow xsever to read hwdata_t - Allow login programs to setkeycreate- Update to upstream- Update to upstream- Allow XServer to read /proc/self/cmdline - Fix unconfined cron jobs - Allow fetchmail to transition to procmail - Fixes for hald_mac - Allow system_mail to transition to exim - Allow tftpd to upload files - Allow xdm to manage unconfined_tmp - Allow udef to read alsa config - Fix xguest to be able to connect to sound port- Fixes for hald_mac - Treat unconfined_home_dir_t as a home dir - dontaudit rhgb writes to fonts and root- Fix dnsmasq - Allow rshd full login privs- Allow rshd to connect to ports > 1023- Fix vpn to bind to port 4500 - Allow ssh to create shm - Add Kismet policy- Allow rpm to chat with networkmanager- Fixes for ipsec and exim mail - Change default to unconfined user- Pass the UNK_PERMS param to makefile - Fix gdm location- Make alsa work- Fixes for consolekit and startx sessions- Dontaudit consoletype talking to unconfined_t- Remove homedir_template- Check asound.state- Fix exim policy- Allow tmpreadper to read man_t - Allow racoon to bind to all nodes - Fixes for finger print reader- Allow xdm to talk to input device (fingerprint reader) - Allow octave to run as java- Allow login programs to set ioctl on /proc- Allow nsswitch apps to read samba_var_t- Fix maxima- Eliminate rpm_t:fifo_file avcs - Fix dbus path for helper app- Fix service start stop terminal avc's- Allow also to search var_lib - New context for dbus launcher- Allow cupsd_config_t to read/write usb_device_t - Support for finger print reader, - Many fixes for clvmd - dbus starting networkmanager- Fix java and mono to run in xguest account- Fix to add xguest account when inititial install - Allow mono, java, wine to run in userdomains- Allow xserver to search devpts_t - Dontaudit ldconfig output to homedir- Remove hplip_etc_t change back to etc_t.- Allow cron to search nfs and samba homedirs- Allow NetworkManager to dbus chat with yum-updated- Allow xfs to bind to port 7100- Allow newalias/sendmail dac_override - Allow bind to bind to all udp ports- Turn off direct transition- Allow wine to run in system role- Fix java labeling- Define user_home_type as home_type- Allow sendmail to create etc_aliases_t- Allow login programs to read symlinks on homedirs- Update an readd modules- Cleanup spec file- Allow xserver to be started by unconfined process and talk to tty- Upgrade to upstream to grab postgressql changes- Add setransd for mls policy- Add ldconfig_cache_t- Allow sshd to write to proc_t for afs login- Allow xserver access to urand- allow dovecot to search mountpoints- Fix Makefile for building policy modules- Fix dhcpc startup of service- Fix dbus chat to not happen for xguest and guest users- Fix nagios cgi - allow squid to communicate with winbind- Fixes for ldconfig- Update from upstream- Add nasd support- Fix new usb devices and dmfm- Eliminate mount_ntfs_t policy, merge into mount_t- Allow xserver to write to ramfs mounted by rhgb- Add context for dbus machine id- Update with latest changes from upstream- Fix prelink to handle execmod- Add ntpd_key_t to handle secret data- Add anon_inodefs - Allow unpriv user exec pam_exec_t - Fix trigger- Allow cups to use generic usb - fix inetd to be able to run random apps (git)- Add proper contexts for rsyslogd- Fixes for xguest policy- Allow execution of gconf- Fix moilscanner update problem- Begin adding policy to separate setsebool from semanage - Fix xserver.if definition to not break sepolgen.if- Add new devices- Add brctl policy- Fix root login to include system_r- Allow prelink to read kernel sysctls- Default to user_u:system_r:unconfined_t- fix squid - Fix rpm running as uid- Fix syslog declaration- Allow avahi to access inotify - Remove a lot of bogus security_t:filesystem avcs- Remove ifdef strict policy from upstream- Remove ifdef strict to allow user_u to login- Fix for amands - Allow semanage to read pp files - Allow rhgb to read xdm_xserver_tmp- Allow kerberos servers to use ldap for backing store- allow alsactl to read kernel state- More fixes for alsactl - Transition from hal and modutils - Fixes for suspend resume. - insmod domtrans to alsactl - insmod writes to hal log- Allow unconfined_t to transition to NetworkManager_t - Fix netlabel policy- Update to latest from upstream- Update to latest from upstream- Update to latest from upstream- Allow pcscd_t to send itself signals- Fixes for unix_update - Fix logwatch to be able to search all dirs- Upstream bumped the version- Allow consolekit to syslog - Allow ntfs to work with hal- Allow iptables to read etc_runtime_t- MLS Fixes- Fix path of /etc/lvm/cache directory - Fixes for alsactl and pppd_t - Fixes for consolekit- Allow insmod_t to mount kvmfs_t filesystems- Rwho policy - Fixes for consolekit- fixes for fusefs- Fix samba_net to allow it to view samba_var_t- Update to upstream- Fix Sonypic backlight - Allow snmp to look at squid_conf_t- Fixes for pyzor, cyrus, consoletype on everything installs- Fix hald_acl_t to be able to getattr/setattr on usb devices - Dontaudit write to unconfined_pipes for load_policy- Allow bluetooth to read inotifyfs- Fixes for samba domain controller. - Allow ConsoleKit to look at ttys- Fix interface call- Allow syslog-ng to read /var - Allow locate to getattr on all filesystems - nscd needs setcap- Update to upstream- Allow samba to run groupadd- Update to upstream- Allow mdadm to access generic scsi devices- Fix labeling on udev.tbl dirs- Fixes for logwatch- Add fusermount and mount_ntfs policy- Update to upstream - Allow saslauthd to use kerberos keytabs- Fixes for samba_var_t- Allow networkmanager to setpgid - Fixes for hal_acl_t- Remove disable_trans booleans - hald_acl_t needs to talk to nscd- Fix prelink to be able to manage usr dirs.- Allow insmod to launch init scripts- Remove setsebool policy- Fix handling of unlabled_t packets- More of my patches from upstream- Update to latest from upstream - Add fail2ban policy- Update to remove security_t:filesystem getattr problems- Policy for consolekit- Update to latest from upstream- Revert Nemiver change - Set sudo as a corecmd so prelink will work, remove sudoedit mapping, since this will not work, it does not transition. - Allow samba to execute useradd- Upgrade to the latest from upstream- Add sepolgen support - Add bugzilla policy- Fix file context for nemiver- Remove include sym link- Allow mozilla, evolution and thunderbird to read dev_random. Resolves: #227002 - Allow spamd to connect to smtp port Resolves: #227184 - Fixes to make ypxfr work Resolves: #227237- Fix ssh_agent to be marked as an executable - Allow Hal to rw sound device- Fix spamassisin so crond can update spam files - Fixes to allow kpasswd to work - Fixes for bluetooth- Remove some targeted diffs in file context file- Fix squid cachemgr labeling- Add ability to generate webadm_t policy - Lots of new interfaces for httpd - Allow sshd to login as unconfined_t- Continue fixing, additional user domains- Begin adding user confinement to targeted policy- Fixes for prelink, ktalkd, netlabel- Allow prelink when run from rpm to create tmp files Resolves: #221865 - Remove file_context for exportfs Resolves: #221181 - Allow spamassassin to create ~/.spamassissin Resolves: #203290 - Allow ssh access to the krb tickets - Allow sshd to change passwd - Stop newrole -l from working on non securetty Resolves: #200110 - Fixes to run prelink in MLS machine Resolves: #221233 - Allow spamassassin to read var_lib_t dir Resolves: #219234- fix mplayer to work under strict policy - Allow iptables to use nscd Resolves: #220794- Add gconf policy and make it work with strict- Many fixes for strict policy and by extension mls.- Fix to allow ftp to bind to ports > 1024 Resolves: #219349- Allow semanage to exec it self. Label genhomedircon as semanage_exec_t Resolves: #219421 - Allow sysadm_lpr_t to manage other print spool jobs Resolves: #220080- allow automount to setgid Resolves: #219999- Allow cron to polyinstatiate - Fix creation of boot flags Resolves: #207433- Fixes for irqbalance Resolves: #219606- Fix vixie-cron to work on mls Resolves: #207433Resolves: #218978- Allow initrc to create files in /var directories Resolves: #219227- More fixes for MLS Resolves: #181566- More Fixes polyinstatiation Resolves: #216184- More Fixes polyinstatiation - Fix handling of keyrings Resolves: #216184- Fix polyinstatiation - Fix pcscd handling of terminal Resolves: #218149 Resolves: #218350- More fixes for quota Resolves: #212957- ncsd needs to use avahi sockets Resolves: #217640 Resolves: #218014- Allow login programs to polyinstatiate homedirs Resolves: #216184 - Allow quotacheck to create database files Resolves: #212957- Dontaudit appending hal_var_lib files Resolves: #217452 Resolves: #217571 Resolves: #217611 Resolves: #217640 Resolves: #217725- Fix context for helix players file_context #216942- Fix load_policy to be able to mls_write_down so it can talk to the terminal- Fixes for hwclock, clamav, ftp- Move to upstream version which accepted my patches- Fixes for nvidia driver- Allow semanage to signal mcstrans- Update to upstream- Allow modstorage to edit /etc/fstab file- Fix for qemu, /dev/- Fix path to realplayer.bin- Allow xen to connect to xen port- Allow cups to search samba_etc_t directory - Allow xend_t to list auto_mountpoints- Allow xen to search automount- Fix spec of jre files- Fix unconfined access to shadow file- Allow xend to create files in xen_image_t directories- Fixes for /var/lib/hal- Remove ability for sysadm_t to look at audit.log- Fix rpc_port_types - Add aide policy for mls- Merge with upstream- Lots of fixes for ricci- Allow xen to read/write fixed devices with a boolean - Allow apache to search /var/log- Fix policygentool specfile problem. - Allow apache to send signals to it's logging helpers. - Resolves: rhbz#212731- Add perms for swat- Add perms for swat- Allow daemons to dump core files to /- Fixes for ricci- Allow mount.nfs to work- Allow ricci-modstorage to look at lvm_etc_t- Fixes for ricci using saslauthd- Allow mountpoint on home_dir_t and home_t- Update xen to read nfs files- Allow noxattrfs to associate with other noxattrfs- Allow hal to use power_device_t- Allow procemail to look at autofs_t - Allow xen_image_t to work as a fixed device- Refupdate from upstream- Add lots of fixes for mls cups- Lots of fixes for ricci- Fix number of cats- Update to upstream- More iSCSI changes for #209854- Test ISCSI fixes for #209854- allow semodule to rmdir selinux_config_t dir- Fix boot_runtime_t problem on ppc. Should not be creating these files.- Fix context mounts on reboot - Fix ccs creation of directory in /var/log- Update for tallylog- Allow xend to rewrite dhcp conf files - Allow mgetty sys_admin capability- Make xentapctrl work- Don't transition unconfined_t to bootloader_t - Fix label in /dev/xen/blktap- Patch for labeled networking- Fix crond handling for mls- Update to upstream- Remove bluetooth-helper transition - Add selinux_validate for semanage - Require new version of libsemanage- Fix prelink- Fix rhgb- Fix setrans handling on MLS and useradd- Support for fuse - fix vigr- Fix dovecot, amanda - Fix mls- Allow java execheap for itanium- Update with upstream- mls fixes- Update from upstream- More fixes for mls - Revert change on automount transition to mount- Fix cron jobs to run under the correct context- Fixes to make pppd work- Multiple policy fixes - Change max categories to 1023- Fix transition on mcstransd- Add /dev/em8300 defs- Upgrade to upstream- Fix ppp connections from network manager- Add tty access to all domains boolean - Fix gnome-pty-helper context for ia64- Fixed typealias of firstboot_rw_t- Fix location of xel log files - Fix handling of sysadm_r -> rpm_exec_t- Fixes for autofs, lp- Update from upstream- Fixup for test6- Update to upstream- Update to upstream- Fix suspend to disk problems- Lots of fixes for restarting daemons at the console.- Fix audit line - Fix requires line- Upgrade to upstream- Fix install problems- Allow setroubleshoot to getattr on all dirs to gather RPM data- Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform - Fix spec for /dev/adsp- Fix xen tty devices- Fixes for setroubleshoot- Update to upstream- Fixes for stunnel and postgresql - Update from upstream- Update from upstream - More java fixes- Change allow_execstack to default to on, for RHEL5 Beta. This is required because of a Java compiler problem. Hope to turn off for next beta- Misc fixes- More fixes for strict policy- Quiet down anaconda audit messages- Fix setroubleshootd- Update to the latest from upstream- More fixes for xen- Fix anaconda transitions- yet more xen rules- more xen rules- Fixes for Samba- Fixes for xen- Allow setroubleshootd to send mail- Add nagios policy- fixes for setroubleshoot- Added Paul Howarth patch to only load policy packages shipped with this package - Allow pidof from initrc to ptrace higher level domains - Allow firstboot to communicate with hal via dbus- Add policy for /var/run/ldapi- Fix setroubleshoot policy- Fixes for mls use of ssh - named has a new conf file- Fixes to make setroubleshoot work- Cups needs to be able to read domain state off of printer client- add boolean to allow zebra to write config files- setroubleshootd fixes- Allow prelink to read bin_t symlink - allow xfs to read random devices - Change gfs to support xattr- Remove spamassassin_can_network boolean- Update to upstream - Fix lpr domain for mls- Add setroubleshoot policy- Turn off auditallow on setting booleans- Multiple fixes- Update to upstream- Update to upstream - Add new class for kernel key ring- Update to upstream- Update to upstream- Break out selinux-devel package- Add ibmasmfs- Fix policygentool gen_requires- Update from Upstream- Fix spec of realplay- Update to upstream- Fix semanage- Allow useradd to create_home_dir in MLS environment- Update from upstream- Update from upstream- Add oprofilefs- Fix for hplip and Picasus- Update to upstream- Update to upstream- fixes for spamd- fixes for java, openldap and webalizer- Xen fixes- Upgrade to upstream- allow hal to read boot_t files - Upgrade to upstream- allow hal to read boot_t files- Update from upstream- Fixes for amavis- Update from upstream- Allow auditctl to search all directories- Add acquire service for mono.- Turn off allow_execmem boolean - Allow ftp dac_override when allowed to access users homedirs- Clean up spec file - Transition from unconfined_t to prelink_t- Allow execution of cvs command- Update to upstream- Update to upstream- Fix libjvm spec- Update to upstream- Add xm policy - Fix policygentool- Update to upstream - Fix postun to only disable selinux on full removal of the packages- Allow mono to chat with unconfined- Allow procmail to sendmail - Allow nfs to share dosfs- Update to latest from upstream - Allow selinux-policy to be removed and kernel not to crash- Update to latest from upstream - Add James Antill patch for xen - Many fixes for pegasus- Add unconfined_mount_t - Allow privoxy to connect to httpd_cache - fix cups labeleing on /var/cache/cups- Update to latest from upstream- Update to latest from upstream - Allow mono and unconfined to talk to initrc_t dbus objects- Change libraries.fc to stop shlib_t form overriding texrel_shlib_t- Fix samba creating dirs in homedir - Fix NFS so its booleans would work- Allow secadm_t ability to relabel all files - Allow ftp to search xferlog_t directories - Allow mysql to communicate with ldap - Allow rsync to bind to rsync_port_t- Fixed mailman with Postfix #183928 - Allowed semanage to create file_context files. - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t to bind to reserved ports. #149030 - Don't allow devpts_t to be associated with tmp_t. - Allow hald_t to stat all mountpoints. - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts. - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of /etc/mtab. - Changed the file_contexts to not have a regex before the first ^/[a-z]/ whenever possible, makes restorecon slightly faster. - Correct the label of /etc/named.caching-nameserver.conf - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src hit by this. - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed xenstored_t rw access to the xen device node.- More textrel_shlib_t file path fixes - Add ada support- Get auditctl working in MLS policy- Add mono dbus support - Lots of file_context fixes for textrel_shlib_t in FC5 - Turn off execmem auditallow since they are filling log files- Update to upstream- Allow automount and dbus to read cert files- Fix ftp policy - Fix secadm running of auditctl- Update to upstream- Update to upstream- Fix policyhelp- Fix pam_console handling of usb_device - dontaudit logwatch reading /mnt dir- Update to upstream- Get transition rules to create policy.20 at SystemHigh- Allow secadmin to shutdown system - Allow sendmail to exec newalias- MLS Fixes dmidecode needs mls_file_read_up - add ypxfr_t - run init needs access to nscd - udev needs setuid - another xen log file - Dontaudit mount getattr proc_kcore_t- fix buildroot usage (#185391)- Get rid of mount/fsdisk scan of /dev messages - Additional fixes for suspend/resume- Fake make to rebuild enableaudit.pp- Get xen networking running.- Fixes for Xen - enableaudit should not be the same as base.pp - Allow ps to work for all process- more xen policy fixups- more xen fixage (#184393)- Fix blkid specification - Allow postfix to execute mailman_que- Blkid changes - Allow udev access to usb_device_t - Fix post script to create targeted policy config file- Allow lvm tools to create drevice dir- Add Xen support- Fixes for cups - Make cryptosetup work with hal- Load Policy needs translock- Fix cups html interface- Add hal changes suggested by Jeremy - add policyhelp to point at policy html pages- Additional fixes for nvidia and cups- Update to upstream - Merged my latest fixes - Fix cups policy to handle unix domain sockets- NSCD socket is in nscd_var_run_t needs to be able to search dir- Fixes Apache interface file- Fixes for new version of cups- Turn off polyinstatiate util after FC5- Fix problem with privoxy talking to Tor- Turn on polyinstatiation- Don't transition from unconfined_t to fsadm_t- Fix policy update model.- Update to upstream- Fix load_policy to work on MLS - Fix cron_rw_system_pipes for postfix_postdrop_t - Allow audotmount to run showmount- Fix swapon - allow httpd_sys_script_t to be entered via a shell - Allow httpd_sys_script_t to read eventpolfs- Update from upstream- allow cron to read apache files- Fix vpnc policy to work from NetworkManager- Update to upstream - Fix semoudle polcy- Update to upstream - fix sysconfig/selinux link- Add router port for zebra - Add imaze port for spamd - Fixes for amanda and java- Fix bluetooth handling of usb devices - Fix spamd reading of ~/ - fix nvidia spec- Update to upsteam- Add users_extra files- Update to upstream- Add semodule policy- Update from upstream- Fix for spamd to use razor port- Fixes for mcs - Turn on mount and fsadm for unconfined_t- Fixes for the -devel package- Fix for spamd to use ldap- Update to upstream- Update to upstream - Fix rhgb, and other Xorg startups- Update to upstream- Separate out role of secadm for mls- Add inotifyfs handling- Update to upstream - Put back in changes for pup/zen- Many changes for MLS - Turn on strict policy- Update to upstream- Update to upstream - Fixes for booting and logging in on MLS machine- Update to upstream - Turn off execheap execstack for unconfined users - Add mono/wine policy to allow execheap and execstack for them - Add execheap for Xdm policy- Update to upstream - Fixes to fetchmail,- Update to upstream- Fix for procmail/spamassasin - Update to upstream - Add rules to allow rpcd to work with unlabeled_networks.- Update to upstream - Fix ftp Man page- Update to upstream- fix pup transitions (#177262) - fix xen disks (#177599)- Update to upstream- More Fixes for hal and readahead- Fixes for hal and readahead- Update to upstream - Apply- Add wine and fix hal problems- Handle new location of hal scripts- Allow su to read /etc/mtab- Update to upstream- Fix "libsemanage.parse_module_headers: Data did not represent a module." problem- Allow load_policy to read /etc/mtab- Fix dovecot to allow dovecot_auth to look at /tmp- Allow restorecon to read unlabeled_t directories in order to fix labeling.- Add Logwatch policy- Fix /dev/ub[a-z] file context- Fix library specification - Give kudzu execmem privs- Fix hostname in targeted policy- Fix passwd command on mls- Lots of fixes to make mls policy work- Add dri libs to textrel_shlib_t - Add system_r role for java - Add unconfined_exec_t for vncserver - Allow slapd to use kerberos- Add man pages- Add enableaudit.pp- Fix mls policy- Update mls file from old version- Add sids back in - Rebuild with update checkpolicy- Fixes to allow automount to use portmap - Fixes to start kernel in s0-s15:c0.c255- Add java unconfined/execmem policy- Add file context for /var/cvs - Dontaudit webalizer search of homedir- Update from upstream- Clean up spec - range_transition crond to SystemHigh- Fixes for hal - Update to upstream- Turn back on execmem since we need it for java, firefox, ooffice - Allow gpm to stream socket to itself- fix requirements to be on the actual packages so that policy can get created properly at install time- Allow unconfined_t to execmod texrel_shlib_t- Update to upstream - Turn off allow_execmem and allow_execmod booleans - Add tcpd and automount policies- Add two new httpd booleans, turned off by default * httpd_can_network_relay * httpd_can_network_connect_db- Add ghost for policy.20- Update to upstream - Turn off boolean allow_execstack- Change setrans-mls to use new libsetrans - Add default_context rule for xdm- Change Requires to PreReg for requiring of policycoreutils on install- New upstream releaseAdd xdm policyUpdate from upstreamUpdate from upstreamUpdate from upstream- Also trigger to rebuild policy for versions up to 2.0.7.- No longer installing policy.20 file, anaconda handles the building of the app.- Fixes for dovecot and saslauthd- Cleanup pegasus and named - Fix spec file - Fix up passwd changing applications-Update to latest from upstream- Add rules for pegasus and avahi- Start building MLS Policy- Update to upstream- Turn on bash- Initial version  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~3.12.1-153.el7_0.13selinux-policyMakefile.exampleexample.fcexample.ifexample.tehtmladmin.htmladmin_bootloader.htmladmin_consoletype.htmladmin_dmesg.htmladmin_netutils.htmladmin_su.htmladmin_sudo.htmladmin_usermanage.htmlapps.htmlapps_seunshare.htmlbooleans.htmlcontrib.htmlcontrib_abrt.htmlcontrib_accountsd.htmlcontrib_acct.htmlcontrib_ada.htmlcontrib_afs.htmlcontrib_aiccu.htmlcontrib_aide.htmlcontrib_aisexec.htmlcontrib_ajaxterm.htmlcontrib_alsa.htmlcontrib_amanda.htmlcontrib_amavis.htmlcontrib_amtu.htmlcontrib_anaconda.htmlcontrib_antivirus.htmlcontrib_apache.htmlcontrib_apcupsd.htmlcontrib_apm.htmlcontrib_apt.htmlcontrib_arpwatch.htmlcontrib_asterisk.htmlcontrib_authbind.htmlcontrib_authconfig.htmlcontrib_automount.htmlcontrib_avahi.htmlcontrib_awstats.htmlcontrib_backup.htmlcontrib_bacula.htmlcontrib_bcfg2.htmlcontrib_bind.htmlcontrib_bird.htmlcontrib_bitlbee.htmlcontrib_blueman.htmlcontrib_bluetooth.htmlcontrib_boinc.htmlcontrib_brctl.htmlcontrib_bugzilla.htmlcontrib_bumblebee.htmlcontrib_cachefilesd.htmlcontrib_calamaris.htmlcontrib_callweaver.htmlcontrib_canna.htmlcontrib_ccs.htmlcontrib_cdrecord.htmlcontrib_certmaster.htmlcontrib_certmonger.htmlcontrib_certwatch.htmlcontrib_cfengine.htmlcontrib_cgroup.htmlcontrib_chrome.htmlcontrib_chronyd.htmlcontrib_cipe.htmlcontrib_clamav.htmlcontrib_clockspeed.htmlcontrib_clogd.htmlcontrib_cloudform.htmlcontrib_cmirrord.htmlcontrib_cobbler.htmlcontrib_collectd.htmlcontrib_colord.htmlcontrib_comsat.htmlcontrib_condor.htmlcontrib_conman.htmlcontrib_consolekit.htmlcontrib_corosync.htmlcontrib_couchdb.htmlcontrib_courier.htmlcontrib_cpucontrol.htmlcontrib_cpufreqselector.htmlcontrib_cron.htmlcontrib_ctdb.htmlcontrib_cups.htmlcontrib_cvs.htmlcontrib_cyphesis.htmlcontrib_cyrus.htmlcontrib_daemontools.htmlcontrib_dante.htmlcontrib_dbadm.htmlcontrib_dbskk.htmlcontrib_dbus.htmlcontrib_dcc.htmlcontrib_ddclient.htmlcontrib_ddcprobe.htmlcontrib_denyhosts.htmlcontrib_devicekit.htmlcontrib_dhcp.htmlcontrib_dictd.htmlcontrib_dirmngr.htmlcontrib_dirsrv-admin.htmlcontrib_dirsrv.htmlcontrib_distcc.htmlcontrib_djbdns.htmlcontrib_dkim.htmlcontrib_dmidecode.htmlcontrib_dnsmasq.htmlcontrib_dnssec.htmlcontrib_dnssectrigger.htmlcontrib_docker.htmlcontrib_dovecot.htmlcontrib_dpkg.htmlcontrib_drbd.htmlcontrib_dspam.htmlcontrib_entropyd.htmlcontrib_evolution.htmlcontrib_exim.htmlcontrib_fail2ban.htmlcontrib_fcoe.htmlcontrib_fetchmail.htmlcontrib_finger.htmlcontrib_firewalld.htmlcontrib_firewallgui.htmlcontrib_firstboot.htmlcontrib_fprintd.htmlcontrib_freeipmi.htmlcontrib_freqset.htmlcontrib_ftp.htmlcontrib_games.htmlcontrib_gatekeeper.htmlcontrib_gear.htmlcontrib_gift.htmlcontrib_git.htmlcontrib_gitosis.htmlcontrib_glance.htmlcontrib_glusterd.htmlcontrib_gnome.htmlcontrib_gnomeclock.htmlcontrib_gpg.htmlcontrib_gpm.htmlcontrib_gpsd.htmlcontrib_gssproxy.htmlcontrib_guest.htmlcontrib_hadoop.htmlcontrib_hal.htmlcontrib_hddtemp.htmlcontrib_howl.htmlcontrib_hypervkvp.htmlcontrib_i18n_input.htmlcontrib_icecast.htmlcontrib_ifplugd.htmlcontrib_imaze.htmlcontrib_inetd.htmlcontrib_inn.htmlcontrib_iodine.htmlcontrib_ipa.htmlcontrib_irc.htmlcontrib_ircd.htmlcontrib_irqbalance.htmlcontrib_iscsi.htmlcontrib_isns.htmlcontrib_jabber.htmlcontrib_java.htmlcontrib_jetty.htmlcontrib_jockey.htmlcontrib_journalctl.htmlcontrib_kde.htmlcontrib_kdump.htmlcontrib_kdumpgui.htmlcontrib_keepalived.htmlcontrib_kerberos.htmlcontrib_kerneloops.htmlcontrib_keyboardd.htmlcontrib_keystone.htmlcontrib_kismet.htmlcontrib_ksmtuned.htmlcontrib_ktalk.htmlcontrib_kudzu.htmlcontrib_l2tp.htmlcontrib_ldap.htmlcontrib_lightsquid.htmlcontrib_likewise.htmlcontrib_lircd.htmlcontrib_livecd.htmlcontrib_lldpad.htmlcontrib_loadkeys.htmlcontrib_lockdev.htmlcontrib_logrotate.htmlcontrib_logwatch.htmlcontrib_lpd.htmlcontrib_lsm.htmlcontrib_mailman.htmlcontrib_mailscanner.htmlcontrib_man2html.htmlcontrib_mandb.htmlcontrib_mcelog.htmlcontrib_mcollective.htmlcontrib_mediawiki.htmlcontrib_memcached.htmlcontrib_milter.htmlcontrib_mip6d.htmlcontrib_mirrormanager.htmlcontrib_mock.htmlcontrib_modemmanager.htmlcontrib_mojomojo.htmlcontrib_mongodb.htmlcontrib_mono.htmlcontrib_monop.htmlcontrib_motion.htmlcontrib_mozilla.htmlcontrib_mpd.htmlcontrib_mplayer.htmlcontrib_mrtg.htmlcontrib_mta.htmlcontrib_munin.htmlcontrib_mysql.htmlcontrib_mythtv.htmlcontrib_nagios.htmlcontrib_namespace.htmlcontrib_ncftool.htmlcontrib_nessus.htmlcontrib_networkmanager.htmlcontrib_ninfod.htmlcontrib_nis.htmlcontrib_nova.htmlcontrib_nscd.htmlcontrib_nsd.htmlcontrib_nslcd.htmlcontrib_nsplugin.htmlcontrib_ntop.htmlcontrib_ntp.htmlcontrib_numad.htmlcontrib_nut.htmlcontrib_nx.htmlcontrib_oav.htmlcontrib_obex.htmlcontrib_oddjob.htmlcontrib_oident.htmlcontrib_openca.htmlcontrib_openct.htmlcontrib_openhpi.htmlcontrib_openhpid.htmlcontrib_openshift-origin.htmlcontrib_openshift.htmlcontrib_opensm.htmlcontrib_openvpn.htmlcontrib_openvswitch.htmlcontrib_openwsman.htmlcontrib_oracleasm.htmlcontrib_osad.htmlcontrib_pacemaker.htmlcontrib_pads.htmlcontrib_passenger.htmlcontrib_pcmcia.htmlcontrib_pcp.htmlcontrib_pcscd.htmlcontrib_pegasus.htmlcontrib_perdition.htmlcontrib_pesign.htmlcontrib_pingd.htmlcontrib_piranha.htmlcontrib_pkcsslotd.htmlcontrib_pki.htmlcontrib_plymouthd.htmlcontrib_podsleuth.htmlcontrib_policykit.htmlcontrib_polipo.htmlcontrib_portage.htmlcontrib_portmap.htmlcontrib_portreserve.htmlcontrib_portslave.htmlcontrib_postfix.htmlcontrib_postfixpolicyd.htmlcontrib_postgrey.htmlcontrib_ppp.htmlcontrib_prelink.htmlcontrib_prelude.htmlcontrib_privoxy.htmlcontrib_procmail.htmlcontrib_prosody.htmlcontrib_psad.htmlcontrib_ptchown.htmlcontrib_publicfile.htmlcontrib_pulseaudio.htmlcontrib_puppet.htmlcontrib_pwauth.htmlcontrib_pxe.htmlcontrib_pyzor.htmlcontrib_qemu.htmlcontrib_qmail.htmlcontrib_qpid.htmlcontrib_quantum.htmlcontrib_quota.htmlcontrib_rabbitmq.htmlcontrib_radius.htmlcontrib_radvd.htmlcontrib_raid.htmlcontrib_rasdaemon.htmlcontrib_razor.htmlcontrib_rdisc.htmlcontrib_readahead.htmlcontrib_realmd.htmlcontrib_redis.htmlcontrib_remotelogin.htmlcontrib_resmgr.htmlcontrib_rgmanager.htmlcontrib_rhcs.htmlcontrib_rhev.htmlcontrib_rhgb.htmlcontrib_rhnsd.htmlcontrib_rhsmcertd.htmlcontrib_ricci.htmlcontrib_rkhunter.htmlcontrib_rlogin.htmlcontrib_rngd.htmlcontrib_roundup.htmlcontrib_rpc.htmlcontrib_rpcbind.htmlcontrib_rpm.htmlcontrib_rshd.htmlcontrib_rssh.htmlcontrib_rsync.htmlcontrib_rtas.htmlcontrib_rtkit.htmlcontrib_rwho.htmlcontrib_samba.htmlcontrib_sambagui.htmlcontrib_samhain.htmlcontrib_sandbox.htmlcontrib_sandboxX.htmlcontrib_sanlock.htmlcontrib_sasl.htmlcontrib_sblim.htmlcontrib_screen.htmlcontrib_sectoolm.htmlcontrib_sendmail.htmlcontrib_sensord.htmlcontrib_setroubleshoot.htmlcontrib_sge.htmlcontrib_shorewall.htmlcontrib_shutdown.htmlcontrib_slocate.htmlcontrib_slpd.htmlcontrib_slrnpull.htmlcontrib_smartmon.htmlcontrib_smokeping.htmlcontrib_smoltclient.htmlcontrib_smsd.htmlcontrib_smstools.htmlcontrib_snapper.htmlcontrib_snmp.htmlcontrib_snort.htmlcontrib_sosreport.htmlcontrib_soundserver.htmlcontrib_spamassassin.htmlcontrib_speech-dispatcher.htmlcontrib_speedtouch.htmlcontrib_squid.htmlcontrib_sssd.htmlcontrib_stapserver.htmlcontrib_stunnel.htmlcontrib_svnserve.htmlcontrib_swift.htmlcontrib_swift_alias.htmlcontrib_sxid.htmlcontrib_sysstat.htmlcontrib_tcpd.htmlcontrib_tcsd.htmlcontrib_telepathy.htmlcontrib_telnet.htmlcontrib_tftp.htmlcontrib_tgtd.htmlcontrib_thin.htmlcontrib_thumb.htmlcontrib_thunderbird.htmlcontrib_timidity.htmlcontrib_tmpreaper.htmlcontrib_tomcat.htmlcontrib_tor.htmlcontrib_transproxy.htmlcontrib_tripwire.htmlcontrib_tuned.htmlcontrib_tvtime.htmlcontrib_tzdata.htmlcontrib_ucspitcp.htmlcontrib_ulogd.htmlcontrib_uml.htmlcontrib_updfstab.htmlcontrib_uptime.htmlcontrib_usbmodules.htmlcontrib_usbmuxd.htmlcontrib_userhelper.htmlcontrib_usernetctl.htmlcontrib_uucp.htmlcontrib_uuidd.htmlcontrib_uwimap.htmlcontrib_varnishd.htmlcontrib_vbetool.htmlcontrib_vdagent.htmlcontrib_vhostmd.htmlcontrib_virt.htmlcontrib_vlock.htmlcontrib_vmtools.htmlcontrib_vmware.htmlcontrib_vnstatd.htmlcontrib_vpn.htmlcontrib_w3c.htmlcontrib_watchdog.htmlcontrib_wdmd.htmlcontrib_webadm.htmlcontrib_webalizer.htmlcontrib_wine.htmlcontrib_wireshark.htmlcontrib_wm.htmlcontrib_xen.htmlcontrib_xfs.htmlcontrib_xguest.htmlcontrib_xprint.htmlcontrib_xscreensaver.htmlcontrib_yam.htmlcontrib_zabbix.htmlcontrib_zarafa.htmlcontrib_zebra.htmlcontrib_zoneminder.htmlcontrib_zosremote.htmlglobal_booleans.htmlglobal_tunables.htmlindex.htmlinterfaces.htmlkernel.htmlkernel_corecommands.htmlkernel_corenetwork.htmlkernel_devices.htmlkernel_domain.htmlkernel_files.htmlkernel_filesystem.htmlkernel_kernel.htmlkernel_mcs.htmlkernel_mls.htmlkernel_selinux.htmlkernel_storage.htmlkernel_terminal.htmlkernel_ubac.htmlkernel_unlabelednet.htmlroles.htmlroles_auditadm.htmlroles_logadm.htmlroles_secadm.htmlroles_staff.htmlroles_sysadm.htmlroles_sysadm_secadm.htmlroles_unconfineduser.htmlroles_unprivuser.htmlservices.htmlservices_postgresql.htmlservices_ssh.htmlservices_xserver.htmlstyle.csssystem.htmlsystem_application.htmlsystem_authlogin.htmlsystem_clock.htmlsystem_fstools.htmlsystem_getty.htmlsystem_hostname.htmlsystem_hotplug.htmlsystem_init.htmlsystem_ipsec.htmlsystem_iptables.htmlsystem_libraries.htmlsystem_locallogin.htmlsystem_logging.htmlsystem_lvm.htmlsystem_miscfiles.htmlsystem_modutils.htmlsystem_mount.htmlsystem_netlabel.htmlsystem_selinuxutil.htmlsystem_setrans.htmlsystem_sysnetwork.htmlsystem_systemd.htmlsystem_udev.htmlsystem_unconfined.htmlsystem_userdomain.htmltemplates.htmltunables.htmlpolicyhelp/usr/share/doc//usr/share/doc/selinux-policy//usr/share/doc/selinux-policy/html//usr/share/selinux/devel/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz2noarch-redhat-linux-gnudirectoryASCII textSE Linux policy interface sourceSE Linux policy module sourceHTML document, ASCII textC++ source, ASCII textassembler source, ASCII text?7zXZ !#,xq] b2u jӫ`(g5Bbzd/>8Fn@t0ˏaf'jyD7e I{.U Bgat0KnY+w-,I$E7xA4hPbD./8v1uߴ}1c L%M򕦇FԂos#)Àp6|?DS[ Jq|5 + c\K9QML:!5H}p bЗה !/(aJ+A5DWNEi&tgg`u ^ ANy?6E}|L"7=<m15$Gk%QINlKXrlnsq@Ax k*:zZ*A,8Ά$0 uGǮ@oN^vqCO $/K<85l1![RFyp6Fhkh% Ae=: Lns"$:|_Gx= #G]ҡ݁S2#w!Đ+%6gR<b[Mzjm#ppfȥ3qR+WQC $G, C8)\Dчsp,!{U 5; z'EwMd&@ f;V7mҽ*ƋClRKu?N~_ˡAkF 6s3Ȅ : p%mvj7N~ߴNͶŵ^)5RĎh GX x DҐ~4GVV~Unb8IhxY ɌdH`4{93,ɫ06{HWl y+aXVro}ǶkhΡ_f:gƕ(p@Şyc8}P'оҼog"m략?I8d-xgRc~m$x6}Ko긓7XoثaA]am %6\ [56՜уO|IqՃ/&ˠ~0Bv zELqh 4,q=-S[kj%E䣙 XNX}1f^aQ@|]0^*E8h,ƞDWbhey0{ nAqٻf n(G'CPh5~w;(X}BsB_>~wpvPVdwb9y>5:T5z jfT-ŢDx O&!E`RqRn&x(^_2ʁ1麕ҮPgU`Ը (L |qlnm{`ڀjT&{F>Su #B^=ָM.&_Uk Kk%ZࣇEih־R 33+9ڧF t3엚;fѥ5 MpB'1)mNk\I ;.:N,t=.P.&IK9sҿJT#~OџAVI)$4FP-xꕾ +6nH%Q,PGt 5|X'5}LyEd% b)mYF<ռn(QdHQ¨i-$.3LU @m= y_tOg inXaYln7/W "jLY5fÉ 󞄊qLL%J}mo$\R2};2B𩡢aes2}m M}CfQcdRMIHɬ8r606"SfrX!O(rR0R.} JlVU_ZS( Vm<{Ѵ$E6gL3'@('Æ˹S3W,fY %Qd+Rjy:W}]UaeԱx W:dbDԃߥٛȩV'\6A_ ]w04=Z6-w1]%%#z*T,_;D+9||} Q4(njLzh v+ߣ Xk2϶}+=-rQ߲%D?",tTr1Wi6Wcߊ#ANʶA]xjZ,0qN>h @G\,TXgS"p3Dϳ{XkqxzL$TyK3{Hug%>;hH5W yR_b%ivŚ宛It ]:LT)߶bx&=f4OUƂN؆F#9.vϠ]m]4$ðrD]Ejx.bCQ'J(<5N\MFߘ r1MV;i 8+'ُ>GL"%b4r2:ޕY\m)IߥeCaoLG3T b;E8AGr5u#4|vvPh{|7Z_.v&`*oۗ.]^BF`вutR)Aj0@`l<˸c7V8`Aw:OFQ+鮎Cׁ&U*1y_J1o+^2 :";ouP1#"}$Ȱ"z$"ncQƧazJovIgkbJN3e}U-Lb-[TğĻg* `NPOIfyI!`Q37{1PVl:? ]=_M'pǰ`߭u9+1 UU6#xTDا4F{aPCElS9e`t2Y zZӐHVց>W|!=JWmw 3Vt.ÌyaO%0v{Zu=ed@HX(JDL뿸O#YY<\k)qLB8N iHںNIvlfӫQqJ=P>s3k+{X4}9`[pJ9yAs xԮy۰7f6=eB]: |I;ă? ۀvEr?y8V :=5 Y Ml"$]5.sDQZ:AfX$71 FVv77Ӳ;Εclo)Ҷ NY-N=SHiN7a/D\]+;#TgI+w^zpwWj.S j?u_sFmkupSIvm-_=3)]H~.$>}ˊ] WfFI2qFWq{C9e5>j` +E{.{yΪl^6>~EU6M8;I:O%QI{鏌w9" pt,N̒|]r1?amqJ}.[,xiybpi >,J[uRCaaJ?\;#|!E$^S 5hvzBH;` \ҽN2u˖/2p1:-3ߤg޽-3# LtBv !i"?ǫߝt.eSV]RD5{ÛhL>0(vC;8oiH*^k6mo2e@O(-(OFY"'!^4;fFuNqFEk)*sy8cOlpGޠ}󏕛W7QH+( 2BK @~A}b4RQΤ!8 G= NXਠg˝ˍ +vaPT7w/BY{0}(Z:v32LB3t-3 TeƹeяՐ&&mۭXi@Ɂ2[ql "c!,`mP>eI+3:1 D<Xx "N)`* Gg͏,ErEn)A|ByB$Z&/ӊ;w2E Ji6<5 wf $N pT4AJ(DЭ4:ذ0*{YL]Gc`eʔ1vvKb u* (]bUF`@[^),.L%I^;8_[w\2J;H&<[1jǵmƖcwбk<_9$E$oZgHa#ƻR0}q*v JJcl*GdhJA5v1dKT G*j~|>֝݀4`ZM~i_~v ҁ4^=6ԯ7'% ۼO5d|R⬆.1~fJA&elAjeyS{ɢ+I+4M1(Z7P3x`&ieul.ߛ/bU:mv=Y,_ '= |.!j/CsXW*"DXчTCԞk\>2qX./26mT91~X]@wBJi^s9'(,g͵[i1Ke`;]zpt oīLSПfM9vzȖ#9't6ol:ɸ^Ĕ޲N뻁:mU'5~vr#ߣ1q,Y2zAǡ6q=UߤǢYiZM٠OGf1I 7 .AH:^[oӲp㮔}޵L2DJ̡E$FO'5*Zm#-W,여Z7<{{M@V8/pƺ|b>C؊  &V*Z{˫e9mTxI,̷M/Ҹ $e梡26D|%ey!Wfj掏&25y'f'&m!gT5rsJ & Ɵww5㗡5"UXsP){6SzwJHW]d{Pad` )Z+P"RK>mzR$~v͏\ax}þc_*)ڙi7mDH o5ÅaߺъDd e!eT!)q¹@ڄ,񾙐~o5K cK.+AQ;oU:[Yͧ@bbn4={KW=Y#e#0/WT^iS83dZ >oNA8ˀJ7#T5+ۖ.a Ó3w4y| }'>գ)*t*jtS~ޏy֥bR3LH-@sVE`2U eQExy({@Y4V=ˤy1vi`&Bw^]Ǣq-oLdwtr:K=]fi~s j~>m'QeCc㾜lO As*|9k .Q5 5- sZ.+EFs CY%p)<0WgUEIYzB=GK+ttu[$wS|wuRzpU k·O. 1[N/BnL3^H`@q!X𮪰Ȃ`Z{[ZIfG}r؄.jREw_8&Hdo4z$QsXaB/5M]gߩ*&h@G- L_K.i b^hCM58q Keq яd#Jnon{>~ TLgbZ*!/f3mFz ७n*y$8GEfȞ;;pw<,@݀0A`!vmG^l&۰O t@CN19w/Ug&Zn捼}g#uK69I'֞d2{EPJw:򙕏\OZi=p./Yup&^59 tOVL9; +2ru=_|6%AMRC't27;T9ES_V˙J4)D_I3Ba,!{lK rJƯAAɞf r$$1X\pZ2W \erX.-bBr9!zXҀW6WE478 lz=f˕ )mj( OL+@jqF Wfj98L,ֻrZC53wMT >U֌vpD~՞-+$]i7SIw>ߊF~wk\iz6>_Į[@۳\LK "(b|V cD|B\\1=cP&܏qJeE|j\+?}5Qxߤ…7% [lh>/V! ]>I!R74&Нղח3WT(ާ(-o h e*4 UvRdGHMb-:V5~T/L"DëD/Yt(R=83 (s1/lp޺;5?NJ]As<>4PôQܹq7]); 0Q󖌓'imRhk1b iyk$iOK[@%\U9_UbkRz^BD#1ktF|UO=կ|nAC|{1.CqƭO &KGo&r2k MQc49|f\ SPiO^/`Whr#aX XbjoSGKU7ڔY *.PQ.5Sw4]oq!,CTo kR/_^U۩R]fKZ۹{ *#jś Hhw lJ Ϯ'H fAޮO M`*G-)[!z`8*'.G#MJloD<A !mOP眉,.E]N|$ dSA-< Ag'эejOsANМPiB oHaXbj ELGUAA ڶȇG~ي+ME:BFˎ^7ބ#.kSVTKQՖp^N!ڭγWN+vnv͆ި @\?KFAbJ+%V;e?GX|(tASL ]=]_oV:y_^JWٳɼQFl+6u jX\XTM:cd+9ʾ2Xw8}˽GQ[~nG15pgr2E{JE5b6*h1vhvQ`.wu?\[[wnn'-DTYCȫ|@e'j ecj(?"(C_o&vD{ йK+y"Y c*: zas;4pwEkvBׅ2=UmDOvpdɱWRc\\I6 {`^L9v=E"GZmf5(-h5B# j|}ȷ_3LTq}XqrSe-Xpozޡ*~/(;;c)uU OYۿJHzǘȓMs@ox Lϛ)9sc$WEF߬xW<,3L t-}i %B&UIs5ƙ҄uCc ei+n!K Rix+&u6H8!iGkeu$=uöHss)X<Ȳөe}8>55@4zn.픘QIeJʝ°ݶ,{f!/MmIYG *Do6AWRSȎzh 3 *EVӤK(RlPX}MOG0,& 6U"\Al&G; H_!VAHgoŝ3j9I:^Z_+#>,ܻHYmR|8e * 1ls4n}Pi^6k(-`mJ4v}E*t 0VћJ&ډAƖ들|p*1ȰW-IDm-k|>#j5;% ;A#4yk2ԃ޻Uo尌k3Dq?tkK3cGa13$])GnX$&U"_ "{~L(Ȫ;tiQ/CB_"ՕsAy|̐  JvG'> υjd4]4[UQ^ʴ a1a 'OdՈ90YAU1Wi_640 G7tϿ˺"8ZtUV΁5`PvԆP`E^ZFaiVb$\& Bz<vi/x>4<0ݙ/lCzI/22 ZRPrk lKG]3U+b9 #l:*G7ьm=qèK Þ_esek=o.58L zbEM؀qu!0W+(OmA$}z^{+URjzzF+AĎhƺ![D+?Y513lq]쭗4aU"H f7ce>[қI/2 PNҕ/|⾮s 2b#3^E}[ه~QޞϐZ5*bB+v8؝=/' }b&n _ _eG)7No' t `Ǖ?m 6osڽlѷ%E 'oQ}% (w6)ds_쭄}RdnXlJb={s\q;wc%c/.Ǧ_ F\7!Gmyg|  @I#Gdg AHÖr,X i˜k:GCtc?قαA[R$ka #cj[+ў uqu0?4E$V& >X&YP)bShW]cF?lE_;XYU"ʟ ɴSH0F? wZ ) Q~iT# :٘F'/20`H<5Xkq\^s]l%71eiUt<&##%q-uBQ5%/mDHRm'yG9=f_IuFUSٗʒB첝K:ȕ!β sq+Amdw ,<\BV[5Sb 7/~WZ,w!"ֽt,f-@7a;7]>S)cʔ?k(?@g瑩W ՜I/"u\Jtq)%eIO Ѯh-Dt"a(?gC;MXu9P0w@!!yDI|Z~l@}_5c|32=؂u ȞxGH $pħ"s3ʱv_ %cﻯj-X<'ӣn=TB%1әl&oU9:Jᱣ^o!7 nXv,>졤j8_T&j^P̚0\跔K@V~wZI%A)>[~4D8}$ov}i,1!'|ȵٝv=@3x+MN Y9s2FNk"}t:. m"!Gp]+ݧL(/C]Go),bO?Unlژ0'vƉ%&eRmb"򙨨r<C>dH L?lhV ؟k5^FJ|!fĠͅ:#Ȏ֢h߅]ўB~APи,/,p} /sO VFZ<_20h.E68\ {.̧]6[W:cChM3?r.\&4J:wP"ǟ >})_7d m;D.\Y3n.+9_"Z-whғJA`{w3z/敪 N$Q0k_,_h-[!v !4&oܘutZ>P;]t-)Z &@eZ?`%'d&/SfGWR0G d{X~tJHvgk 7<QU&>(Lr1lX%!1b0ɔ/ f ˶YIk)QwZ7B`܃:e=L/ν ew$n|9-ŵrW?h _ঢ়\Cکiʂ€Qvx}hY_U\%;rj"Q뻏SS-.uNTmjUSAYyEfj f Ձ1i (tNr<0v"P ]|?LБϴLY/X^қA= A",n?q$m bxva{ 2qzdT>!2HUU*ŹRhQTW]:k숪N}6=@imУtb@*x-(Vy7X'JAAznAH*v"H*yMw@~=ጊ0 yU9A?ehx8an  [\0lao5jaQ?6K}:6)#coOg1lPU)m uɍA]"Dss/x@m Af$kxn;& x@ލ=Hk)g]g }1ΧPв_DIse4hzԼY)r~薸{?}Oʝeؔ ylz.]X‚!삔nxX@#n"wۯyᜳ69LL劄AS[ a`x0Ԩ+7$6-ecSߧc+)0 Ҡ .퓊"mޥےqg~Dqlt1CL(V+'@"HLq2:9Nś:p2+s% '1-֐qb ()LꩤFwcJPS8ݫrBX+okH#wTV [Ji0qBkSϖU9L͐}BرZ}WpQ%M]t/(~dM4C%CaTNdl{B8pf%?dQFer8Ԩ:bw\9Xl,UF> ĿgƹF{*{ޮm9zhm PKy8b-ĭY-if_)ϜSE 83GerdDXZ|:**l9l$LPv0_,  ű{l!Rj<q3=MA~ȨFtiA<‹08SH~R1m.[l 0.{ yW-+~؂f_E0CIXz:QCj}Ϻpooռ d~̃5(XN;e7X/p)S8En:`M9tW4ozmf[9"7:mtcYXUD,ќG]#X=^Ƶ[o݉/h-Hz4X3P޲Μ03RdYfV4܊Q3tk1ыRHrI–LCwDV#+,:/Ivb} "^S[N|GkCI?^c'7$`n??Xb|?"ۜf-\\>J5>裩nJN䑖l}9`Z0=(Kj n)#^aR(fz\ `Fwy)rɄ"$k$џTo/~fi,O^-1[P|]؎yk4bU}]^0n)+#NY䫎djN'&V/:EIQ+NJ Hg\No#u|k/5B6s &_+ H$qNh&Jx@-= X*7|=ܺ">eoaoVwkElW =>SyH^uioE-_cK1ܾKK7Mw^胒Ah썩Ҟ8n%Պ?6y+k->UeL;=Dzeۨ:!VȹǷӨ<2Xԡ?ܗfYNP\{+q"L%V,_hB״x"b+bdClIvjZ`HM>-.w^z ?Ua+F5XeXCw1 P(`SNЛb@Y(KM*=MEt*cV*2naYێ7ywH~"Bzx^ǽ1WDrt u쩄29oE'MpQ?) tLWзHB5ЌI0O=ܷu}5m8KCBz 5 jQVE.l)z |T'ZdFn5ӒPCn䨤N~$I5^G^3~Pz  #v1Nz$sL| f7T1&J>j~o^\hb `5:*cAK6~ b <=I;ji z%M#8B|V1ш %Nfugd٘U03]o <8ө{<H2CzH| `/fTuM)@w W I[5 /8>zjB|6"Haӄ&Nm/,@w B .YmŠY\jJV*Pə<_rآ=>\!ވ-b-HM)Jg[U9+^ !V'BǁgL<|;Jn; xr^xl$8s%9/[E;d%=$+%!gy^E]BwD`j%5KYXrAY/H*(tx$|iݍ2Ow [ cPx>aX=''jU"Υ GaUf1)M0zgԬ:G ٹ f~ϯ ĤcG}J[S)3[XXnoEQȯ%!Qa ! mp*-{u/?d⩭axunA p v=#4 d]ŗs)IQUjtC#|{Zd!A|CBQj+U[zR%MH>ݮǘPLpɫ@T?όcl2m@gt uNޝ/ bM 4pC-bBImu9}s)NqG5|]]!$ <'nR;M$,RH*\{z CYong P 7t 0CQ$81ZqWDãb9bs?͒O=L t魩'֣ "p2P_q*D1j QmaRbbN;ܓi`0#BF&s[gxDե BTrQpЁX r"ertܒ}8f~AQ`K ɝ)1zk@S^_lDE2"  w%p|ƧfȾ{1D8lM`f ";1%.&m9Mhwqr 3 5f`SGl]I>7J@ѽ#\6R֡ 1}xm>T5WܠoFZo1\pX) y})=vcYyu P9dP4ZB? lA|dXUXT,Jl .}Sz; l;Szↇ ;F W=Ne޶ٳLd_,aGOyy~~--hO7R&%{hۊMTĄJͤꯤS^@m|#\.yn٩5Thaɻ[yAy-2*eAh?bOքA] EB`u3K&nkSBNN'\9w@/ao切_q~ю&Po0gOWCCs|9X:*KhNNx`WŎkQ4نMBDx&K3\ί89𠸹EN۷J6d->#4N-5}9Li$u^^,?M P!Rwj)xhF$clhjK4QFٔas@ '({bFZ)OW D]A;=tXD yCU~*2:;gڣr C1Il\p5=-:gO>Ûy"M$HTGW[ei"mEǯnc"GtF<* WqZifFYl=7\ Z }$qjxD.Ie>m.YQa9Y Էh5C(k]ZzoaFXhe.Kl %nnE6maU@Γz$ՑZ+2VbpZo?F83[tJWoҍRebU Α7DnعTA,i mQRrƀ)>&Cߦ^lӆq9^nn.Qiejye#+`/iy4aqBžt@ u/L~xxOц{n%aQ[wp`{3_oб*lX-ԯX^)1f)_z#S) B@kuq2 lƌ*_]sX+Kэf%ݼ'LUJ-_ЇvЇ.X̒#.ט~QVx$nQg Q:EKRGens5]V$&#K>~y*tFZ&%H*jބp3 WU:ch可- f5kLB~#q1n\Jxa^?JASGE!AQcw~gX!(+ܶwH<:4և '&h@IkKgY4.>} u N6 *ϩ/hVtgw4ڍb.A1(8l$ɵdViOFp!\'J{qq=tg6939{;/y > J]9@|mhy3C[s0f+pjSqhb$@n1?ES6u։NVގ{7ٓ Aui\0!(@NCaAF9êdGC㶅I] F? БJfwKE.J8Jf>nG*}-I$!V ;ScR2 'bHry ]Vx##V 's*t*.N+hSFK%fY-Ps1p}fӨ?#uOWω;^ t`ҮTyݪgJ);C"'e׊z! Eczbv2k1|nU}9q970^˖FzLȪ\1`5qZ ж s$ .d)cH^mw/*kzCPj/u%MS!3 Ѫrd(8whn Lㄧ)kRys.j 0~*u81Yȟ/98^ rցȡp 3Nw[f C~iP5~B=M{ghouDOP'B_< ۋDCu,LOԳ'&c\Hs4e .$-qY>SG =ͻ}`u d0oƔŭ19hx^rƈ - NmOJ<3z{eKڲNXլDp&%_[:Ge.~4T'g[vJpJ{;OICe)'tBoQ?>3kHQ'WQ6+/ 0;npŶ<-\ [LVדة 55V9))y57;Q&XB䩻,9"/10D+[+YE}TNLkZxbW\ 1ڜo۸}#i2Ħ\']_}7p>EƬ¢~;cZ?Қ*+W|={=kL(q FhW? FH 'f'De[7nS[ҾbJܮODm݇g%1ߘ[N^"hhxplbj/ަZ6/DwѶ C>o#G^=2޲pA5ɧ ^:\z6"0 wٗqaU lr:/`nu{;LZycXqeGnS@&{ۋ *mMܮ,*̟.]sk7OuSlqO 7*BVtwaZE#)P=IJ+N hҦ6|k D#I: )4H|c5\NW)Mnz,%5"+Q 4hWD&DtFqDž4S7:ڽc ec, ;?qVj1_, @}wJt/Aжn|q] Y-Y)MR~U;z: f-%eBĒ e͠^A<,Y*58|ɟ2qyȦz^uj"pkۛ娅Hg?uH]퓏 X_*%(/IN$ta6#AGnR3eZ\^,2Ln%PJ-ij:[p۩;U-qSJc fѳJOp#HGn e-KJ8 %[8Xc(dbv7{M&A~@oeJש Z*I-U'04 vJ!]a'lIQ[QKAW<<9 Sq_sƙqz6aZAs Z(אgLK@WDM)ThBfsbVZ^ŻnWN NGMDd"]X"`&+ [0RA%aW%R&_52-7)۠.ll39pqϓ]̊Tx'6cyu-Y!2(W86&N~&e27w"XT &;A&z!YP{] 1 M?vG}.3whC?XE׹~@jJ%;槹KaJ%.`tRi75Ր}lA^h u)%8}#+5E"Zt]*le{n83O7Sֈ`DȼVODa92vvG60ws}GIFFg<L)GYs uJ`5X\fuqi ga!nV~Yջ*79U6$A6vk2{@4+2ÝFWn N٦_u, =*H0>tzUaNeꠈ0xO\,/#߀2ajLslnv _Cm~oޙ](&`'Ms+bUlFЦeMrBn**pr7LC=vhp< )a;zZwCHR`D}R@4HѸ 2rTQ bd.75hc잺%ޛS^h)r3!- ξKj#&&_ooǭT1\3)e.ďgvwܺ0k<(܈^Ee:hi.)ƶ M&B1㏞?- f{;h ul^'5g x?ܝ}= 0d8?E,y[ɀz:&؁/@Y 36{M9jJ~)%ɆbFb]l)ͥ`f'uը%Swɩ@掅̐*iu  /dӡ)eM9Kq`[E#;0>Y4nxj LgPL-TSdO@O/bRE׹qbK}8/r@ehgb.NWM紳P~ES Lbӱ^tBTR6Hs _"KpBLOc|H۽ꂬScTq %BKlr<%$@:Nk1ieDZO{p7$58"(vն#~/ ' LiNvKU7#*fQn=XvSЙ,(yZ?A/TaMkÙ%qvL]fjIz&B.Baw2f@Db Ԋno~Tw"!-8O끖p(s .u[j)m4ז+]*bno}fa /\Q?Rjͮ9g2C%041JA\7h?΋9,0 WE4[+NJh4 :w+O=S㦷كoxձC:Gs,=Q8֦)oy&aJ!2>9P|B~ㅶU~&$Ew~폑4 Obz飨T+ seT3>qBR)W| /R Ɉ*˛8-17<i[.;6Jg9z9GwA0M,tyynObe?o:Mxrr~Y0p)va+. GuPr-屜n[y܏e2ey\"#uc7OL6; ;>7*|614#17'ܨqA'cW4*WR;M8Ӽ">樚@,Ա%R لT%%Ke^6"9gւ(?t`q^eJ =.4p =^6TY~4 a9)Chn'`wtlH:8IX*eh@s9b/$+ _Lo{C¸jvW=nQKdb?3@_ *1 iYĕ1i %[,O&(J갘 ,@pNI͢ ےלzpwq;)S-c'f$T&CTRD 5;gUeOe|.k)|U8^ߝpjиEW~$*e-BLoz}k0IޘJP,GlpzgC rIEuh6@YzA[HWLHc@D,*{C>++E1uu'8W%{g_4*Za `יRHfn IǬ%ZFkb>`e. T&ma-},3UԵ " Eb5xn72cܰ֒Z!POXȘ udղ^*Yq". 3,IIGb-z#G {h)¯0xk);l5[ٕ[C!j[P:"м2˨}UYFERqUh =!^`̫Qĉ߃+pla;ӖH픳śķEScG0u7\R$i΁JUNfV}3JN;H+ Ɏu`t$ZR2GkR #̲@@3ࢲ07\6-tkl?6( Zop2%{-)tdzNS{rz% :Z:W}psJʝZ湻^ !K3؍#&fݮ,g? 4fOm)I){;>( yB&knGwr%P9 aY]; v}A Jou IJmLǷ"k0(HbN0O"lsT9E$JztyHk {LԦLr^mSB%{)&W~7Z/Dz U==suP%R'BæO*)xNnVlǘfB }IGced¶C@Р,Z-j)@b#Z恥WĤP;/={$9ްFbG?~C!eg1םIb :WsMxeX|yw^=Krd[}mrj?f2 LК1Z)f^d=$CHyO뭀zg<_ڙyss;*[_t zpz&,/Ru {ꅺy ۨ4'X+aɹX# eG3 -J pl-o=0G|YVH~3gđPdޡ%f9P& SY)ƌX&'\,De ):k -#b#@c==woo'y>|ޟYq`upR-jI["#HJu'BHFi K r|W>0Ϛ @*V\T&9"ЦLnɼ)xq~bqÆuTowdN'wkaSD|/=m '&)k7+R0i UsRI;E#4*4ED;~ ܻO/X14+OZYt:vc1/IeRӲ- ٭vW?wcF'4;[U8U5ɘ~q(idcr  ı"ܞw]F$ fmI^ͺ?$P%D?2=5R>;˕./gVnhbMu&7"\u(6K]վ $^8ڨ,ݺ~ƍk6鏖3/Q2O-}@zD&vm,`6G-Qh?kJrn~=2k07ydlZ.cS3/ӞmD4Z=+ǎWβ4R4JbgxVԙNKgԹk gЏZ! ?L@(X'fguGE"Գ\7GaS~t+D *8tB>Q' dqZtOa:8TgJMW6EH< ̭F&q]7RWSg|t)EQ\` HDmbx8Z3o_\e[hl`oߝZoD ڹRz8tU̇ɿcs (RP3Fga6K1#8,5,4t/M?!yƸBwkJC*팝"{S'8C_@v=ХȵR&Zks4kiɶr:4BcW9:瑺D*h5 v 6vyG΋SSd<.ZC8޾ W Î~6bhyҎV:+,9M3k Z#̂Z^![ݶvrhC$joSd/e,i5 de>Yc&afyXh_b @YWjIcwgqp =d#Iaok:eXBxSTqZ9}# }ٌd-@BÇHkD[ãiAp 2:`ɢЧaIjUK}5ÖԺ-Eɠc1T'TdK6{Nwڅ PFƼMXaݛp缠6ic0nYD2lO踨lgw7{{3=Yٹhu>!SvGG lLnF2:C2yקHēpǍp~;C⭓C! Jkk/u ٸdM/$믶7 F_x2'_xҨ.FxEςj7F۳5ʷwpV3Bm8}RNLc(C CCP-ႻJ ^0 ҮNujm0}L+gvKꓒ=;]NP嗿SI g| DjT|.mf0D#ӭuA7ds>Dоxpיuc|m *?[TbS 7S#VVD}O4xo:n,fiLacZf'1:46قZl29n $(_W޺\sآ[dLԮÃpލ=1'SZwxyyY\>NsF79֗v;dsu<Ą{y 되 jvUqo:Iʱqd($K ,U.䋟QXXyFoh3[6nYJ5iQlBoO. %{-`;?;o2Vq 2cn'h@*G<~3+ e[LHuTy)Ԯ0#_oB 8RCim,RI\NЇP̥ΈVwl\~/v{L￯\_* T#2a0c-<3G#F>YCL?%U|^M/MrqG5HL4 N̦}~1NZ ֒* ~T.B]GlvZݹozisgA=qS[Yo(s‚m >#SfuSM&6F9}A?`t9:=`&ry]©,ߏgyn.oab/d_ T2@oQ W85o[V>R빲׳?:N"_Zqhӽueͼ;2-(#1H{-A ĩo5v )0TrIrJY%ӟN̓Az*̕+\:Ru"\r4!~rE Mt5} O@~JIXM?QJԯ4ogtAp;(V}M { Zަ:<U{l@rJqOgL`g"&tDr)j?z1Ãҷn)?5xFG8=~SżxQuߵ@QFʣF Fn = ʠ c6J ʋ giE`D& r0[/HpK0>:H.kr_,5#@f@(Q@F۞;W#ZRIFz3$h z2?jRmNżrsÈ o!"aDMs獜yHHK1'1m߱ ઄z&,@҄2uV5Mݝgġel6}^B֌Sw|x+?ZuAv;܃_S1o*zw^є03l<CwL:(ٸj}M" 4dl\c2ZԞ.ByL(g6 `fThpQ@z<"g]hejAtnx!7igdEO.|Z^\5 0;d ^.OTrCPA>'Iwv\solce31Ė{{9y'a")\ ^.Xe(GYlŃp7W̢*=P)T;/YK"W%&uK>>/PJ2?S}n3¬jp *ɂguԅ04- x*ռcD $㕅~^Mtqd.*|}j.^Y:\=XafcYix3'%З)MQH8(To>bP=!oFIZfF*~,z B1HO53۹13.bz^2"*0]$fo;.|Ϊў1C+QxÖ< [~[±!-k$վ.g68\0 gKe x6gc,9'y@*ֈBOE{a{\2ЏC 2¼?ˡWh(ߊj%>6Xky')Ьݳ)SSF"`"e#OYгj0V_-`PDc>P$si٪BU: ă04^@W}]#ug"5yΠ涮!Q`^i3ؤɿ@~XU7 ĺH2.)k:r7n )io#  {+E]\"E|Ll| HؐXrh(ÕOueHKG b ƴK+{b`n$sN5&J>12۸ ‡-EQtmfe%ʏ9)ļG{HM,* w~mJ>j<vd,8Vphw ,׸ڟX-{7!` Wo0tov!6ṿ8?xd?tv=f}L۞-EC0#4K0R"6pNXݣ [煮ZvHmi:@4MťmS'bJ8Iq RNT\Laō.Mʄꎃ_l?Yλ"gkGiɱ(۪D<܉~HckXE p GlȎ&w)EXK\)Q\"^}~nm`7@7Ĥ Fu.E:cJϦsn-ZG𽊘3G,~&zBd9Uv\L刜bg(w9Tj'UQ8z6;c? ŜRh 1sIT["1/J.OcU𗛡E\ܕ/9vyJcz&6tق/]b:tvW@{.c?}Via SQZvbQǚXuSv@pŭ:W3$s~_aKם57OgbƶN-ivAYbi GjX+YM]U;W+>,4r~к]6Pbs^OA] P`A{Q1U]W;>_Yjn⩼!yţ߳2&?=F× ,1 h'Hx_%m6;2'%y,˨H})6\bc].AFF">'2|`}g2/15 xTqi!H5~6*elBM[K1v'춻hz5]"S5\ Fh,&}\N׻^u,D7 ֶM:cT.A!4kZ1+}1^DFHԴZ,qSuݿO#3s68aek*a_gF${ ՗,x+L}kxo,XT)SPa5,g[7" .وG$Xc":'9אa@(A:ZBÖ4;o2^LWK5Ě5~r4Q dbQ\RcVD/D5P8^SMd^#-T+0h%g/&?Շ){ݻkǖIN2x&s!`ӡ5spXzCTw VI(|$/)>tڥ."-ϵ>ۼOx[[E)ajJKd Y1SϺ8N#!H쀇CG6Y)$`q@d硺y-e,e*b2l[$ج"\)yrpV n;XrhƏִ: 1 :M|Y%]FIұt_kD \VPTKehDpzˡZ@`BVCOD_s}!鍁Қϧ|3:24nPnY“O>z*!__19c|2wC9µ|OsL"ѲP_P3 heAiFWًifi8uj^N?sDCO+3MWtzp9"xNo hIdhA~6 |7PX%zr8cd^{%NKclo6q?*tw4w 5\إ_hxay~]w)I.u3]++ w[_ŔpedM#eS ݅$;Xx 6Ak-,}Iڗƺp..DNܴLpkUä5[۴N4 P{ML޶,Brn5Q |L~{:^[k<1g u ׀6;?FE mB1u#CN|{m-[fw (b"YC _y,,ĺ0)ͣ܉r=cj_c-_4+Ws'jnTyoYvYWmVYݼt B9g[и9~Xqϣx\,FWegiu X곯7)@pxs̿m{?Ki,N7T l\`Eq vblϫ3_i\_U1lݦxk|LBw4!k|-JƣCLǮ|ojZx& `<=IB6^ _>WW>&X>#]яVQz׻}@/P+A J0*k}pb&gԹ?c SYMPH?EW$aShR|t/8W:wC e{hLUXohShj#Dzaҙ!EF6=Mj]n7xfqιOtϴOÒLF]Q5/-O^6SI/eH/oN7jIRi,7'Եs_?NJTt7?$Zһ!0u]G[Lfc9iK5:Up-i @J9:LQg.M> ŲÌfXWnEj%K,NEo4eBh/]`%=1@H)C;"ef\uJԔf& ր,WN@o˶?&ʯPO\:X)jlFTH_]Uٽk'$/9"%-wA{gRf9*餦M Y^Ό&Hi9֚)u skgK\*3tO؍=CI%P.jPn)Z<{@2lc!^EC f^sp̸S 0 vIpI~AXCiBF,e&7/QMO'{HƗH;݈$َ=5r/ . kJ #>aNq:ƒ|%mtSk{ llhgKoغgUo}@^YU nA Wg6Hw,nu c`Izwpz$s;cϲDfkB&=H>UPLLK 1| -`AA+_<k 0슰aӽ3DPycʜ?NZFUwlHk.X _Q[Ϥh&P9{ٍѯg'UuaG\rl}[Eܮ13^Ԏ1e{scҮ OWPbAGV/ɗY.6o1^*vB<8nk٭5^8ғ53@ cI'!9 V0H uVeއ . ]Ē+\Kx}h2KW4ʐ5,>Pf8D3p}1 N->#U/*_tү^1M@P-$@>DrK hxL֪$ZaB`O1%x[s,/[7[>]$`t{>#E=tӋ< woe,pUV<(q87lv Vm.S@훇` 11FAflQjP1& kyv2( K*]Z~GŜmKhK kvrln_dI# cigF(nl"0؀8xO@7U{$i>yl)r( {ҩ̙:Q( ]z-%)Jb`V` E&OIڇBn{(b_ӱ9?0cd&ǓO99Szճwe:&ktzq֦/^R2{MGpP׆ݼشUr锴;߸Yq_.@2M ͹4Q`Np׮(ta_[8GvA~`KQ?1O,ၐ|LZ\(*u@q,)|XyG)/0=%/R̖mC~ _ 9h0Wv)T enj"[+uL>#4D^hEA>YWKS qhɳ ͿZ[OTU㉬BC8ZlUlAнWPƾ9} V*)ύfb ߫pV{ mۃnPzG.`*,ܷv`w=72hѐ[5{ncYHJq/وAw P[DTCNS-%"G\ ʨG_ղψՊ>ʌrfh@:0>:_DЎT pGFx V2-j߅G8Qy{0Tp]R1L0RêKiH& ""=؏Q/\C( WfFK1Gԇ,̓B\\7KDrW7ƖImȑѦ Ͽø} @{9Ccb_W$d=nL*VF셓 "X2A6q}:J]=GeyziXKA l[u; "R5ubZeDi%.s 'G# ִPVV\9Xn*`EƕuK1םqf yn /mReʼzMf1Hnu{0K)ʫ!4D%H={'TI`ܡcy`]YF[L0<9Ȏ}kn_ vc1q_bgB`=h{[bku*lTڬ6oOV *@P>mDa_q1M"oKEm,(/)o*N[4̱ >&7Tj!6 b o wm:Tdbʕ"|.1"EO15SnWd Sg:wYM$-`8_L 5f(^ϰ'gk{g>@I4[#[G<t׃<9 5y"Ab6h/mod~s*ofmSU. ֯(y+ uWTi)@P8ff0Ts>,2בfl9;nBI ۧ:E?8 Eҷ(qdYbR[i4Ӛ[Z w7`]ά~87׈o)WKhX2(g)0^n5ZE(5kq˰n06 :T'$*rY/1Cihe6FRO;fn?|KWtwGu˰C/G rZb[!q%N|6sB=q*YCw1B@\XIV{k9-.ZHޏdC۩EЪӃϦԴ;Q8f ] !baԅmnʀΓtԉCx}Yǹç&F,˱.sGVfSd<(tOUAD uRQ=]ANI,j7"1İ+e%yDSx;E 9SPA2ŸJVR`J j$Y)t) ׈j". EM4$?U{7'yliOhNm|aX">h<d1L}-t=H,ۼL F <4"nk$Iy#G$;>~ .nE|\媑^q"Vh!׿Z=#?|D/qA,m%Aۘ!1ؠVlwnjC >j_ ~3>+ .,ak?hfSM nēU+qھx)Nw;1ho̗#wp(o7 %bϺP 9A Nf&ޑQv/󠫉{jAF{YV('Bjp؎f3":lb Rw`ΰ` h֢89y@ (>q]{ѧ^}P ~#]%MCMLow{cP/9'C~4sfW˹>C N auƃG,]ũ7≓;oeТX^@hK4j,o$HWLF$?qcNÞtpמEa3 k{7-C"JšJ,w(ںr+.ɖUBZ&̹{>">Ł1 NT=TabnewI4RS_1\!K~!,Ӛg ƋveZή_.Ya;|b'D}]"r' qD%Uړ{iz 1!?gcGcxRqB Bݹ7Y1ڊH9A(˄i[2q35uzMoR\K1RHӧh>C( {185;k4T'*FZ*"//}U {輢ֆx,%31SC:OڲHAx5/-եW2i hl oAŝ8S,J0b5Rɕ[&b,qV 1JEX' _O'ȒvD!HfPXmDzc g=IZtC_?ufƏ \ADgwy[UҢiȍb2.z$IU8‚#ElfCy)znlKq#:#hGTׇ!ajR4rhKI!diƳ|xkm1ݭZ>MY-#ˈ+jXQ jm;px4"yO ^/sinϥ)ecɂҳSKL?eXBՃ,=EW 5gTχ @sd,D́>EfO[,]ʪC:S9JW ; dWYPk*:w5f}1k.Oa' \@Gٷ㋷ kUξx!7=E iz3VΜNCw[I*3NPWk%}p[X:$65:eKUsK}M5?z}xu㫧2{|_)kAI yV% Nԝo]ƒ|uoEl|NKpdcXgkz6o+'Tx՗v1bzǾ~U@A?7XF71IF_ n$UOnt&v6w\P/Av#(-wUj!oYwYϐҍ`(2⬀^7ME_T?۝ Hݤ|@+4O.(&3,1J?~c1KɛuDMQgiT;ZA-[ 9Ù"DK |#us͜(^z7ֽl*RqLԸ#璋B4AO.%NcXĶK )v[g؉k<=uFZ \:Z fX❿m*6|lGmX4SNUSd8YwP^+jK 3]/Afrov-Ad6RWQ>tL,wPtHqnLbą57Z!ʉg8ImfkMBKLH!Q"Cb0PE mKa7^{_qJZ&qeN6 މE]g@c7ED#)՟7P4($6 U ^&mM4$XPaCTߎ}lzLA> %e ."~g09aCgz,odj3.H-b,3HX3)؞*$~"~g4W8?i㲑CmFU2Vq>Q~$ Hz\hKe=k F-Vmgg8Z Z%8J &[D(=y\4<՜AE ƕwlW] @MPi(oUmӬ;iR/`XAYC6/8n@#6ZFvt5ᓌfѥHz'xn4F)YCb-m3뒫F~x6m#Ƃj[d~_.aC?Gbxs`rcYu\GK.:53@q~wR$qD\nGGʧia#n@ ءTpվdgV%Ϝzrst([׋Ph çUq%g\S@F>(tPǴBN9!{3RqU|< x)9. QRB?đOZr&.UyRc,8yY*R&8*=J3we=6ٞj%="ٕѠy?K ~j<# ߅cQ/e=x'<̅)b[:z;L/ c*O-#^=,qC_'Q`kgU-ʆ9`U= b,O 3`|=DW_덓Fr X yZfο: ?d/>5Z#i25\x@=sjRQǣ4%JYuhP[t=B6a_Swe=- nFM*PX *B˜:6u?" 1TTuNP>;rT)YDS CfFUm0Fot/ "f17#Wtkr6͹_G%?ESyJvӣKc4<3vILF$CɋRRjނ^ꉞgz8jNdjFsFPLK|E?2t?5nSCa"l7v Q' x3UdY{Ʈm64 ; 9pՉկY:&pdr{0}(B9=SI BA-?ۈD6^ ' {X,Cm Ërpc0ǘ-"l$yC<|hĴAzf\) tM##Yr>YKʄǏm&ќ=+dh Qcz,8Z9zoXTs\](yE}2 F=m7+x8]kwt<=. _1gmS[Uck)*S⽽+8UBz=ɀY#olpԌ֯A0o]5sX^.3_N4Asw @ 0c6CT8Q0:mcro7Wv-#nL޿.L0/.L䦖EYerKML3Cz+,_Gѡ ],OE¨-8a’}З^[4yePOw܁ˏT-O&jU?W !=e]l)+~ h(@Ÿ81RgGwd~:pz׊:FvF󈃵e)R_5WZgktiIF ^u$q8Xun᭐C aeF${~8QOmxw%\k5Ѳ awbFB@vst̴G)F0OW)iUQ.1O.Îc,q%;I̧(lWuO8Ni  LX57TB`? _7O/D|W`լSXg> R -#0EW4%Exqqr됗r(]YdZ5+?|< K QK@ªv- *V▲GxۊHdr]JHRt *fX^FxGCPf~ ~κ͛TFa#ەI p6yUS@`;XkMjӊvQY[V/+bNUGk1:%CX8ȸc"9?{9x5>"U% CDwy`p,qMʼoEj9`ڕk7#^|ޏ.(FgCrq;1c/̜׻Zb5k}]*u ŀ6,N_Wc)s~q'z2!K*ff 8Fjj{Z` \eM^C军*.巙>̯@'@of\@Ծ+K(M+TUSP5Q4}+|B.DY5kO}AK}mY);?W9R>{SU)piFɱV(-!w<֮ULv@h4Ea7õ~sm6"_t MS 6D6heaS0v!{Ew#Hi>רOs({JAI"6Ɍn4"Bgn TЭ-,3^9mp4oŢItׂc[-aDPred| Ù7}Wդ5y Y#9y2?ԮZ;$h+KA' vBi9W;&1_^$HscSc1PWıJ]CV@ _ۉվzpbNkt#LI0mu1z5.q/޳JDxۈ>pna~0+R0:`xl?(~.ޤoIMzM,UB[E:_8CW_$-k|R?J EC FR@瀺7Yg^+n.7.c Nj(N@inKle&<{Xs>:eU*Fߏ|S:)|HK >7O"KN1mZb%]obFV cXܠHn>S2JQKv)iLi=/)'|4EJqk$% ̟dKX,xJ>*Y0 Yd '{5<88m)s$dj=S["qwA|`1>Waul m̩d 0#2PcRKc֏xoWh~y%&QCԱŠ+7`@Z-x̽J6Qi/:aqIQLxf4cr͏@}sI]zy)h{>`Ο _n6kzYȉF ش:\p傈ݩdIf?<''ㅌDiwf<̰ܕ yW9 AJR::;=d\}j9~lm'|a [1< yYh> <|.^Ty3;{>i檏4RyA6~™kJO.!jj譴8oXd!?j03S ?f|CMI{χ" fxKH}ݓv (HdDXJ(Cavp$/CApC gv짃|3PϛNrm\ȖVNg+V m[|zL▪tb aD60;{јKL% BAvYBKqmi#י%{pldV7;v#uSbY90p|MgԐ>xoQtw|siI=mY JReS,| 5tenBaխ7OJH{6S(ښQ'c",IO]U|xR~ƸJ~KmlS;m;#9Jt6]Y>L Ѐ7`G@j%v>E<+0`9Kziԋ3Ͳ6c'޴N/d'@S0. {O+c棰k{g>vace 8woj=thk}t9IYYeBNZT\-/4Q۠%{oYO>uPA8[<\kHv+B;{^ڼEvXDY`g(lѓ%B@޺ߵo !,ZF* y)L?#BaO2$ ?\(XĖ`A>;(uGSwF$ C=)c5" ?fNS%Aj5+>KèTf˕^cwrruqniƧє-ZPu=Dp"W,{30A_vZiSy,m!F휴L$L̋,u_; 4_Fx<`ӽOɯ [da,10=ƁXTIֆ cmӓm`^8 !43ocՂu] 6bY0$;* a2WΫ/ 3n{9TsK7 ?fwؤ "w(·Wι,1o5w]SAy8uƝ|MIvwgff~ȕkj 0;l,bs'-jo.ZǦ9hį!ǟSc7&cISy Ϧ8}BЫ|=YNx qfQN wƳ:lVmj9sZmnHio G).dS=ط[`bg\K`9,Қmٓ@zm$ UHi5u18Z^6?%LRwGD$H%7H(kxJYF{p$Ss'YUɊ&0:_.&uSo6q%&sBE0%O7j#{&i_yA7@ H%{qP7y gˀ?ݸГ:Dsv9hlbsL4..)Wr:Dx+ p. SYJV𺫟^bJ/ʼn0r^'L{oE9oi mfE&/9JHuX.QOl a7({3O?&0USoԊHL)bQš?duʥv!Nf9ModT̡z6XV6&āF%31aOj~I57-re1hQ)}BLCY8,Ҫ@&sأ[hdx 1T|g>AcmS]sv8w* {SfzS˄Gs@a[+g2bt']9SĔ |MҼVC?u~ܮ4Y_5،Ϡr5c6ZZXŎ,CxC1$o6U#}Ay䀅 R>SD um._^SxxsB<޶P+}rV ZOe\9"Ka,1wʡƯ< xZJѯOv8WנՍ*F'e!-3Tl{ʔF냓^'9Zq4Ҷn]7z\7Ja#r}[SbǛg?o_i`4ܯsSIS9EYScx s tmR8ߨ~ k!x|mvһWT;&C>FjV9LuJi ۳+d 2?gOT{_y]а-}ec)lsS@4wpFyTBy ?ZdLY.(8<\2;> ʩ#:'Ɩ'IxKf+6 ܬe@aהG%gPʽlr%4±9{r9>ޢ -ALWzmodl6XÎuӢh0dL=(ߦTv.<*zΰyP>%C6FVsҖ^02:PUDibBpbDP.GDB0\ɺeFMyT^> c2 ] o2KOSϔPC g~[exqY boG?Hۏ|Izh%Y/#("6 + -x%9[C,}`CEŚA}kv26 4e%hrU^KˢXx -=4ͯguܳ dFͦc08tpŒaWGk)*kKh^v<1yh9jha!1cB*75TͺJ0dھjrXDmTalFT JV>?gb?NZU?Z牬K*0By~-+ڕdTd|E/ž#~3v ٕ}x)cp@d<Зߊ z`O@;h (_y7`T#|D'?LpTvI@Q:G`ؓ(E[6M*F_ƘN;FT2}Ѓy&ln$r5`~։- B㱈g wHG\,dj< <}0c\ gih{:_gpa 8upn-bׂۅy6|@]MN=!XQXY&ï GpQ S-ᅷŏla_F95Nz*Inya/4x$Iv֌13@e̲X)vR!&He-HD[ww"w%De=3Al \Ȉvyx$`#y[3wBA4xڵ #Kl͡ɊVu 5{iH4ƙG^Z;<dٓɕo+-]YU4*kʶ촭\⛿$q#FQ-lOQVMl K&|I#)oq̀.t?}ۥ>.Pqch'REW}{~zsZM{Ne HGf?ިV;:>uTr2@wf48Vo,֭g]J=۫:t (d]rqߠ  ltqsڼ=K2v+*(@D|1+k8Ìm;&DSK T=nԚ 񄽗.<b-Vv{rSwJӕ!jv:&8߆> ʡO]$hyתY>5̕@w;m<{xF\ا[݅X넉dQ PYdh5lqQ,O| b:Ȣق!GiHd>)Ewc=sq lxs ř@ݚArcNe:/ a Q="֙[3-Q=++ȢUD%1pN8T|T= ?,`51SKoK{"o,0(/h;9I_%#X= ж/M fx/UZqL,;{9*ZNL\ow!r\pt` Srkz yƫ ȶ"hHb~]ClA&}.P$=S5A^T5 E=,k/E#`);>{9,hkS4Q*L, {o~;Zi\{\''ɗT?=OCǏK@%-9\nݍ : o! E&:$iAuF=yX[-dEO")p!]o/})0DfJ2Z ua{! N>K仏-qxYXmD}d5 }o;n .o}fOn1i3фHNQu v0ٕ[quagGٺ5 0~JMv]v45ʹ4 R5.T$Dih:ɴJiQ."/xOUR-[=^ٕs%x9 ZOiq;,Q0*EPqqoՉ~M:WKUG | )dFE zݫ}2P{m.[Ywx Oo.BW[`=а11 ((tnvh : @C4B<#?hZ8|ʂiiFYʞ\$ ( L])0B}B& LXeit?<#m)[8 N '%:g'0#u&TGuu$'/{oE[pBpQCCjF',@̡v&9OGic'Q%@S+ǧzk-&擬}BiI|oXbqy @G„;@Kjz|PW@sL9p t9WƆO𭾚a6UE<{".=$mzh2Nl&0T֢`$s[3y'lORViWި-lF`5 rmb#yR $nl}.c-@J)ut'oٸJ# z("41)4o49NsxVZſx7}2 ?W]+ciXXrBYc?f_Q/ IuC~*n9|^=VOu,KA5-$ߩJU0S<dd|^\ߛ^u)}8'Kw#P8[yåݴ#ιc1}ݒ0񳇪}1Y [-[}Ǚ-"R](2UՄ#8)Bζf`@|5&V#[?WC8amD^!dkj^PAj)̾1t|f؀ {:H%ei =i0~xj \?{Kb .*~!h3n `T--y0=K UW˻1~^R:p;m :olc(XÖ+p#Oݭ4vi"Zq.c.CP]~SY&8a,:mr+y&uNƘ!Y;PARa4B.— )_Eq?ygy h;[IXu͓.6$5FTV+h\ނ_nRBhbU5 htE`ĕ1LY-%X@? 'bxH@Dy OfCk?]/'z{ѹg^ag~sc QpńÌB@x{  !q\~g,aeI>@B ; 䲧W1G4:W\;Jz!3,߄րL@ؿZᵪ+/Œ:A)gvXԅ_?Zoo-_LQ_a [ E?L r 46e}_<{8hjZ0Q 4 q?\uqz8~q>BHoOOպjhm~:8{`}%?p فBBwsLsGs2+'05?WkH ?""\ |Jۻ.Ψ4`9)+zj1.,8!-@.t`R`A\ϒoJ P[|/_'gk#͓\HyZ'6R7aSP%QHUxyiZhγjp}%J5ӎRrkk_{snݟ Ͻ+ J Km%.1 Jl6i}'g狊gAӜh`["b*e%2t*Bᐡ$c%l#>Gz[#DYNF1cB8*׌]񞥫 /ґXZ rEТEꯥZ/͑l텣 4ɺ%n7L&Hh0D̡.R#(n$|K=y=ۆ>2Umދ0Jlo<]h8̕3A{bΣECA Q;Q26R$>l{UkiÓMN4/V@#IuQ βV\#qShЊDW/tG޵mtɢ"2p N8[EcNMYHsY|wK@uۂw2$ Pȼ_qPB| L"!Vp<7 =͖M|ίR(䖙¢ yO,\;F/~Uf;w"ފ Z;wMa)DN8Z6#,!i`])ds_T^DF9T7H@ 0-aP{bYW-Y{ cAn*)-_++M'[tp&"㻠#)ڦ Vv)ȜZVsqHROWp.j~Jܳ_oQ9IPdZ*g9oMv H>e ٕ`^*L6>Ep-~!g99 Un|@9ԗj hl5- ͼ& &4}Tg6%ODT=fEVUJ^xhL}B,' PD|2H؊,9q~r<ےgg n;ZS] ,DT~Sǘ0y1Ҏ}o8;o@]H|Mz 0 q^yo[aZU:ډ̨xC(_rP)DaYzQzX-@'/A 1gXlE`a'-hܩ'"U(x:7 Z^êoNjm ǭ&$@QIu *eWHڀ EkJ_.GF!ׂOܸS']`|_4]c/=\Sksp"@r#KK7C")]taLDۗV2htOpt6B:D4y.q?%p(8N)L'J3X> s(X%.xS߹|7WH:N=oۄ*lٽ3*,ï(so4Tq1|ҟICWipNF)db] m9c(HsyW[LqIR֮EGՆXLqw6O69t& } aPs4,$bL5#2LY:ƆَH;Cnj[Ȉ=貤RD$=qYa+gcۇXVK5)BͶr1Ltnpe ?ͱʽN3c9h&v.Ƈ*ɚPuW'IIcyĈ8..Y7jqs&.HQ/ 9gz6qeϒZ4\#S2֭ >fz'B~|EZ)QSZ:nd!aH@?G/;.eսJ+ w_x:%L~O'+,,TFTl>83ERɒޯHʧ[N#I7\MV92+ߗ!k(z /dVNtRv6v|:TM`rۉp2M R&n]ѽ0}Eun=&+t(W}&hJLxPVL.׫Rpz8rBb9Yk7ӫ.3Jǫt(kYDno͋Ɨ@IWN@Y:/h@Wft7=FZg qS;hA:A1:,RM݆fJFwmCn-u`9ߦf)?њxi eW6|Wx;FgvN>n=m7gyi̲sPӟ7eao*a25XEhJp<*6nYH"%B,L$bDYuRv3JǥcuW|$#(CZ 3>E^/7FiJ[iX9ccBg,7 %LRySވ;'_0cX+wU#?gK hp~t|%C?̈́v4iOs41țm  5>.kG:3s P6yEG6iFߨ|@aT_Mvco `"tN2\xLy,x9$_<_"ذ!(>-BF%fͱ XNtj)id|YC5 ^@>vTزZ*7#9eE# ;@ 8|ޱC-DPud5pUK6iigD? @jU慨zgNX ArrX? Ss P9ΰ>eu8=KAS(DByYL 㧒R]6ͼ,CPla I+u\+㝂%Td+/.XE=HǻnumBIviV.[cEFx/'aWf}H1e(a3_k`^LzeAS"R/(=[XZ9yIbW'%qp~ v"~5l4/fd dfGFo4^i[gNSgQ:+U>1UFyQſ/Vpe3=%6k[pQ!ujZB`fQQ4SVMdkʊXXE oJikPr?+| _Iawt lOJ9NXPH7&kS1Hkn &aRAgU @0DwMz`?QUG7^vGF}ec;Q. "h, NgO"VǠl왻_y/D!ҁ6 vjKS>E3Tү kۜxκx }q ~°+/rdAϰDZҋm6rGt .UQ6A Y1df<`(z];i0V:k<&l9 +֒hLl?O O1|h[Ed.^~sl [(~zWA:jN`"}B#Q4bNFw--42j٥&+}Xm-&D¬^#N0Ҕĥ2Rӈpk䮑yXD -˞#U0ֺ&u(x%NBlj hB[ei= T ЯH@-G;\$͒ J+7' g bhfѩͤ-}髢Ġ*G$vU%L !L&ɔ?*W G?k|kiYu;l'NucUB6umP,e<Ʊx!%eЃ:cRFoONZI=~}[MBXlEY@zT31%xYi[6E~[$AyTR}}K9=^y_ū`0R :U-V{e*{C|r>'_?,kNLE-q>M$BZoI[3 #)b:V5H4FQ޼CJԄz?BvK %^7#Hd,c~-\#霓/xP<ȼT܉SveVpZzu o߹QG 1){F ks\̪Xc4=EO^Pv/uhlW#M@xÍ?c|{)59,e7 >s@U]Xp|؉rgqhMu\~Tm_Ye)obsCd^7VtHzJL汀<+lme~JmA;>,LZpZ<3G}p2yErAB6aO/v|UwMWX:@7\-̕^VBKD7e\<:uhx^wC%̝>aĄy 6gDTk%6ZSyvc5E* |627*&t ={/ȆXHïFcG[\/1$O"䂘T.*kˑV9O7|z  b(3oKOBѱ9cݯ/ x}E· dG_Aqvii3Ɖ捝cl 5Jc3vר< A#Ts릻W5f3' ZyN2Z-M.%k"qpT==󺵑(WS/s%,oTķxJַt٢sa_++Te f e<><6_5RMhvg@"-*';oCٲ{9o6&|ףzu78 c ~6u٘~F N}6~2nx>,uyot& VQ~r*m+v\/@*gu V$xJ;"4ISMCIG]—7 sp 6 ǠBM a0 'ZՇhQLހ}0iZCE⇓TBToMƂ M\X uz)4EmfE>vxKpy<}xZ|9ڍߩS\-iI.[ڜfo1Tj#uST꽦vPmҳxdM_[)͂m_d\ʸz\'Z}CfV.TAZ~F #Wz6m(7rNȣaZ}.\k UicN[26sdRf㺠*]QkhDtP8>>uÑH>0M?}ʌiv)nC=F.=tyZbwjgOPhN 8/W ɷ%K9):لnHBթ:i5@.5 LNG~bJVL^hy{@DxT^is]^v[u@A*HL=tZD Ve>'= [!%HB9QK mR]^c˾|*s> i8tKV|~o{\/I}ƛGC8;˨<xz\,ۨzq??U?Z3xPG>a:ߢz ZѠ Ȯi iQvӄ4_-;$Ydѻ> {qڂs ?sR{R$sӾ ̐;HHAzg޸+I8(bgڅ_I[giD5Ϥ9@Ue˓Pt/eIm/AblD?Gh"H4#{;B8u)FU\5PXv?7݀kdm^ڀ@foPl"r^2{o8ZbG!uPP.gAȔ>pMb֏2qa6O,c\¾}̈́y V`6~stSXz-! 8uڮEpHK#_{;0,HA@Ca@?7 8u65ܻs2ٝ u^&SM#"5Yqh tkz.8b7OWư{ZIa%T]%@J!xqKna^OͲhYksMs:=dqH30~9ђqI X|ZTM.,F/b}'iaoy'M3Cyp0!I[Q]g#Iy$ڳM[рuy#dz( kMŚ=6nT"ZC2ҏ=ek־HJ<_XL9h@Z]N%ؖV8ǕF _k禢$'LuCJ$ Q:kn.Ϝ7u;kg2+m8 r(A h9h|y3m1 l.qC?M_Z7&4)0m XFk^? D[GOy_Lљ1WIXpέzkr,FFT^{SE?AByynQ9'2VeouqM3@ 0-dcA M|L@Z_|vh5ᶊiU>agn?)$^'gmjՍy,)f |-SJ5pOZ|{O[u>7@rзJPu%єk@8lq֙ =8wzϠ.Frcy[Y-8P&A>΋¡`ioY^ D)E֔2P|cc@FwCkP1pH,UWD|ۦ_;R. ۬%OO4bVC ZXoBtJ ye7]a۴_ M39||uAztB5%/K:z& z ؘL&i4{iiAMorkEXq<ר';x*"ST;-Xq=EV!̴Hvbm'$σ޴`of.M[m4H`R^NiM~ Pq1 i(=ri@0X!pEAȠ*#!a$ٿ92$^kjxD- Ϣ@X$_w&gr]GHJ_yLnwUb,9Ϥ"Q*/Ee:ו۝}OlmH4sDk\xQ@?Z@.LP RX`l8==-ѕq;@o]X"Rn?>[0pGhuw hpojjm#8:Ep.GGFacfR ~l l\܄4HsB\EM2ӗX"}% c(Q9tKM% 4h3J~<;)mo=,+7):w',0iġPQp!H}@\!@NL~V'JG =)J ApQf ݙ#sO"G=ql[ݟ]3IM?i^; ]}2tSj'6AX*0+^O8<զ+Vrb;s8r|\m*pkSQzMۧW _Tɗ筬ecL ғ$}:fƟ>Ih>s) )<:fH!5+W0_0Z#\s3C ǀwH~7 Te4Fn^{]L#5nNʜgA\vX{*mh ]~řZcɄ<$U֙\#-fO\3rz4bD$ݠ]XSn懎L{&v%0$C* ⎩ͣNmM,q 2Z$ Z1gP'[36pƘ;Qޯ'C S9~MI](2&!{%|#%ud]۴,B<x|AjD;"@*= iv {7VPM*Მ+Hffy^Z i0=~2|Ղ*zY)M89, WF)T,}fn8mF0ݲwyɿ&>ׁ]1Coc߻Z.(eъGv!俦A \~ۉ7CH8uΦYʦ#4#dBp*:V:w>,F88#L v6F񾮀ixdI3 @W{8bK{5QTzzDeKa؟B9¥-[we(+v"W]3fQ w>[BܫꍡڮGn*%LWJx䚩e螄.x?5~/ 6}]zQWfntLUSh#X2w @?=(a@d/-a('<,~Gv?w_v{pgYecu&@*dT{Yq {UC 뽐~RΡih P:p^`9.-C1bj!T|L? ~p#YlwuwЇZ {SIIҼ1NE}um (\j4)s~KM2,~ߡӉU9:[a/ڭI&m0 &I&f/+ؾͬU6(舮i)TZ%4/Ȑti7Ou1zp"=. aCL#Tn͆ܗFokyZۚD8(@kHJ'xUڅq;~qFm_oD=$iҝq 9q4ȱZa@Ge "&XWY>heVڵKbת8jb7zOH%0>k*=gbRdo`Y NЦ4w WoA=*OT,Q9!@Z]B S+< 1t&}+eҺ??1GY~a9.ֿyۧdE*jPB/o@I{~}1 Ϡ 851pY2aC dn$Rg_\ eBezHv}p|'4uʫk;׀=0bVP95ܴ`nno %/h i5j?<rS1Sb(R+U{Y@ƴk0.%DU,s8|{u~XXŢW,*iȕsPu{>RL/eO[f^kL腂'/ Ł=[ijv%|'D lDz_v<+phn:<qaŔbKw-~ V Z/{uHxIH?Aem ..e #S<)%#oۛ xƷߒ ވ^@VD)bm;.=BcKP։c'h D*IH'ܸόmb h/΃\$%sU6ʹoIj0 CnCy U+r6ӞJ8ry|+`Nr62V`>NfLjt4541o*Vۓ>TGE}DIe:Ѭ7Set@qHgU*IC)v\J$LV>kҠKZGl]GhPD-[dS0WΥ\ OFt8GM (Fl2İG azdA;ar>fkЈkK _9a^Bq&LS<&lI{VbLhkKyc&"b)AC!O(+$-Ex嚿O)߳d{Px0)HC'#V3;no a\PQDڔ`\3w5uKh IZ6wS󁱯X?ӏpz#P]yhݰrڮC!C)0 ՛U=~Nܢ!1id#O54~bы(9)=@A1o!!>t?Z7`{H]D]}Գ =*$HɊ^R~cmO޵̷+O،Txg, 3)9XqF/w\p:4G?3?~wM6 4bK}*|dQ~T`5bpBIq2rOֲTD,: %kyBw4-sTiIj@? mGbׅIkUɡ/Sj-b;x0aK6\] l -K4i$b #].ܐv Si 4oLFQeOnԏc'5m*1G)zmDL`rfNSmOYe љrn{ؔ+ֵuwO9FDrYZ.P?An'@k]p˜'Py $..뤌^jrBN\/HS?dm0 Ie՛=CO̺)c'Z$@[[?8G z RTU(pa=t8y`K^6qؽm4x;&g{  }awp}`.=ýJ~Ģ~@kkpbZyNfNYRSdZ Lߛ*;+!1V,"YxVF-O&8LHԿibySi[88}8襠(dOiy^H_*Ϗk&9띰\x']-y Y1!ZPtz? c̊é/N1]!att@P@X-^WVlA0*Gw{C I.gh#=XRb0yapՁb q!-Ҏhޓkp>WcN\R!S rk뺧43sV k9${UI{VR=(AnOtYMmݴtC\/ğhkYbR97] 6CacU󔐤|#396IZ[A졹TkK B U :M_4Œ||WlG6(eɫ )7mi*PU&2$N?I*$*S/eκ k݆Pu9?\?:6s$|]/bOu\֥Dc3qˣsV0)+$e LT#|ly>ߙlĤ dnUX3E޶ٴ؎o*#I ~'6~@TmTf؂]}XALAKI#jV &1H{>X34PYuJY8oO*uзa4k@bs0ʠ)J,jtr:-T3zP~x>ˊ+/`uo/S-lwdJui! V]@2 e8mUe64G#]0d},BV1*Rt@^CRjcÁ7;,KZ&=`\40lFYɲH*?XVD^kR Ǿ1!'?#~NG4Ӱ8 Qwz,ȣCQT y9cbu//!h%X@:Timm1j#M~m{n<tԒoQAM;ՌI_[yghXVhYʶś Kvh5b; ^^jT.WAMTuܽ﨡JsgL܈^Q|3M])a%OcrV@*]+SNB|$Ru$!P xHݯCuĒ+N[E"N!}*؜*%5wȐZ[ٯCfPbxܔ:K-#HGg؟K <B c[N,N#k<:<#efN4#XD9^iEYcF/:<9+d=\.L4Br"ɺPh)ZmVa{*S[<. v/zk(tԹ"p($+͜)T-^ )?BLomgKCMQ'Q YMj$;5HA*A_Xt'-@l!zD&ǚJF%I|^Qs(ȟNυIm7 s-Kt,B@/1d2x5#S?)kG;g֘QESpx"iw*'ćTgo^ۑ4o2uDo~ ;ʹ/jܘ8hĶx.ߠ3T`xv(`Ȝw`)6qQg*яT8Hym rw+fRMa0^wzed__@OZlIO#HݔCDIF$RGRD8NJ~{ 1uρ7>|7G2,f)l]z0Z̛6 xǚc-w_-=p%qS}LYa- >_07_;Q'*9zAT0=cS/ T~c;0Y0^["7Qm,Px>ҋۂy?WGI5s! ؏Ú.N\Ua4{EZBفc u(EG\,uBp@YQ*+7eUT3~Qӹ,g'9dYsЕg9hJ3T8⇆~w?O)|%ݍ8R迕e6΀$΍g{K%(OEVOсI͒(C kx8Oţt514rޕG> b|y^z4R&bkwC!q͔,"%{a'x'yRטnZ2a(vI :Wm[^G| #siPWIy1JED#ujmfHbpσ'܏ݚv~@6JwZӮX`ǹy%ۍS9b5|r\tuLrN0R®mԫ>|FoR$Qo}ES%lA*ĺz=H^pwT䔲bAj?sNw Jᛲ-RtR+l٨7zLmUrXM4z|y5n<;L6[2"kk .juM }nfJH@8l4\Mj輧b4c.̢̝Dϲ@ήd|].r ]JA7>@OCXQz.?J\ȣ ;7-h _9Kn<>ۦ̆hn`cЯt?>oɹ:*5&PfҸ>+-sY\t;Gb[m/Aqx'[?@e7Âj#OV3{el]a/c:{K!̹ԛ]*!ZU۾3H1~d,.b>8yRRZhhi67?]-guЋ^7J]m̻R=c_-wj*ʰ3RXF+n2+/ι/8hS\ l0=h: keLo?(,z]WwĆ `e[7c"rn[a\9UtC 2r *"=Tdgv>+{,f# C\yv\}6رJUJ7Zn"] Ma\|`4磼QhBˎ:QSo%|M`tbtjj5J ŠWklb!eϧ 삪qT(KUwPFbQUZfL74BcĮ@MC>ȥ]d&{2y7ѯo@;ņϕ"K:"*+ \rs(O8n%T G,PI5}&}pDc4)Lcn>502AǏIעﺜ`ot,n, o9;|r>~ M\L[t^" 2@vl >}m}n҅GBGD Q#?rQChfZ9gi$+R`RęN'TڧkJ(Pi$jIkZ;#%j&$je+MwuiBgo (vL;dJ$wZ}+ϕ ŃA;" oNƄ&g d|87ha`NUP'(nIe8BEߍl\mr`[!KD95 U<7FF? Q[ oE׮G<n`*u¶1|j:fသ[],2fRUOo#2ԮDhq|G_c L0B]GT18z)Gөl\Dvũ(TQ̩z8{3|T$sZk+ %bsD4]ݶ 3Ǒm>74yO"YlY0,Z:*=awvS'<:EbVr#Pc6~k7c__jR0/ڤvFȒLMSṋU%!VI-,w9aRV[xԄBs3c9_i Me^׿ӻ \L珜A>u &HYe3AA1~s#cgpt YA.K\zql_|L1JH=DRҼQKLFC'LkM7ֈQ벴1ț_0%2^UgQJ (SY0E&5D}@ң=[]-ħ̎ρt{4/*zrZ%@Pe跏w\x' 2}y >0BMÚ };d ^aa:N#&.]a03Ua1$(qh!9?]% <~_&k\=lv k 80 U]xIZ̥ntRPQP J|IYyχ2 TU/+C ۘ4'D)aFҷ'(v3 U1)ڞ=Gr _}eE``ͬ> zg֖gk ntMXeh'EprHiTS,򷇭)ZV/G>ᖄ4& Ng2{ %xοoܭE߶ !,#)whl%p\35!3qETAWH'M~ :bk(RA9& Rk⫯F>2E@8 n>Li/okH* BR@f{B3d`EɿJF8/j%su) ; Vh,3]Xt=N(ч!gOI|_eXhF2EO=@lКkվɻ._ah32%#u~ӐFxlL]: Hd;GQv̋2O =.*X$ʪ^6{E:Ý[rd?hJ +hጬ 7 rd1mu_j}v0r$ -5БX[ێېe6s1W0ZGᮽHnNtE'WA,,v]奶b3ʠF+R{RH(VT9E- `T>~3t-4|ى3{H'Ae-9 rM|v Y %().,T@`F[n?ӱ7֚&kSEgwRq_1u`JP+b k.KE|(v|tƁĠQ-셶["cHмAZFzӝ}t!6Y9BSD;P[3vAZ"u$ɔ`M ^$$h 4jI%YLNRs-3u&R\^.O#C>rXW_"U72k?F[=qaK'4  $EUψ rWbza|>k(̋PETiqM<% |ir t|U_ 8l?vtX3yOtku 0(Xk5G6>I9Hf( $T iR$f6[f9MQ*b'[X~ƃX .ZO.pЂ֣5nT)>Ƥ꼸_Y X=-/rR SF xN㵯s6 `Z}Dd'rIkG/2%xYTtٺT^Wa 3 c#4_&/ӘJ<+9YXWXg696s:a˖&7nLȓJۅnPhNy0c'1hS1y.RRcl~~uJMu^^:dazuy-q^2t=Q|@f,{1j4rDԑ Ve(48b v?SS1ᅄ+sP2'Ø:ēt lj4K9"TQS?3-ӸgeؚDF^1 ^ #8^Qo|Y]b 2p\QRgG|8s˵ XUv4Z+KK$t3ܾhþ&H _*(אQv߿ Ơd&UQқ1IIkvGDu0>rVoFP]\չIdGM̀)d JZ?3yvDX>L5? }m9)t*T!_)0H gFkOCf:[+I@ob}w bpS+I7Kwa˗&3ŤRdA\c4.PR ͻ8b5Sq#A#a(= `Pz$GbSaEݤLjg /MeYWuRvk@`XVlէN;blyKB󗞸 av-J]Q oJcIjO$/$tssI9eJSNvGv4_ pb.6͛[)hOR4djThǙ54bm½#\ĢL\L80GA4ϚGز%DY{9&vPC셔WiC="pD \*: ?o6Դ0}|iԛ.auU4M\5cTg[HP.®JK$NvJ*Ff{ (c[A1sR U`=N"K՘ɱ?ՈۇLį*zNɦD.lNXd ܡWsp(TۮG76-.A18$dڱ!3 ٸS5;ph#睌 )ZwWD;J$EE3:MuiAaEmHgdTܵz L8{wN?z!ѯp﬘_Kƹ,Φ0Lo&j]zO7@Wlb$tMxh޴gkl$t/U|S pMeé놣e&Nlv vXM%jf@F. K,Lv^xõEˀZ s ±ZݹO'@( "菅9oKY<w|Zp 9U ,xUԾQiALS> B;R` 3EK{뿒TI> ;楐*ą[O .ZyESdBQԶ5-%!v481({DfG~K?|R)"6pi+1q{fx ^yU}0W3gq~6y)fv<~B1{gpAC$?.E\,p P2͕EW_Rf7'KmWB-3ov$n'e`k>jS&RU /m CIcDSt:lXrzEkElJo,T(C֩x @mCT‚rܫbLh9шX&KԯpyP-u0Vxx؝\Tkr_p&z%n'+gA7u Qe?=MNOuc!mF;Mj2WHm`Y 8zJp?G2N_ߢbrJNgmU:L[RMD 9|.tFBbXtJh SΫ0_F'd!1;7fCpq(.C.8>XMWƻ*e׏5D߄Lz `7r P)3OHe;7]CԶ-ZP[N_A%XꙪO[L]P`maMXLGujtd}nȢbAeeHR^x8BZbq7}|Qww f:\2'B%SR#rat) ].AI>7ʴoqBҁ1ؙ:p@Q?UIo?T؊3 ,!~:ğe9<ޫ"X6)nde08y&oNCNt+j?>lFK )hlc \u0vZ 954fe3?{]IVP[gx=0eqݠTܞHʓw;o'1Qݫ:6yݔ@H$*ZrΎ\~k%xR hn>&hwK:\ʼLF[%هjX4|lԟ߭KZ_?t,2#u|<AycNˑ 7J;0*^κ=8 nۣpxICl *4N͵]!>5pC9% =Sv5 8R3n,X]ä7T2"4-h{Y8G+|aMcR"ȪT*1CTѶWE!W5b_!T'hݸH5m&qIH*l"PnDk/2B*%3>YU8 "@t랊0:WjĈJcewz֛zSpHtn7-G:Sk^R!u2  ?cX_UVa~ 4|O~xġEQQ\u I[7ω`hVhWڏWes(o@ۓ-D߿3G3 B^wfSim&1:'Zi@z,NHs6u.Bk$tmYH]܋VS>t#>%e^볨GplWi rH ݤ~`H۷Uu  =+ӳ_bjm H[~WSO_Y@ZǒUj!u$Q$= P>]M`!:]Uz: +~!SaV6en @&ZJ/E9ݽt$P!^"7!`HY_/UZ]+@mFQ裦3/WsX&d?^LcS#wրHA,n҇/~]\WW+d_4@ufKޚ:RFo8#܍)OYlpM)d g(7j6wVӽ`Bm8z({ l+W%r;l%b\L~I'0"\@'ŝ:c;bp崥Y]Ay!ʏ'єƽ1_FZH|v2ްG{JB݇A<ܖ͙Q4O6xG#=e9/ms j3IЧ#8 5 HoF"6ReK7&n":Y.j9 q N26n#`W;H2J[QU%F \-D:+~[}3W& dVÊY9IɓF)}SW*מslx"Ep;>-.nD"8A8 uA5,NpP_65| ޗ^c=b)L쯓\LTP. bi=E9lw\Y@*IFz v6dq:3= $݌nO!לS198zIKHpʀ.ګ͈x{ZkIL3J@&$س5T _@iVh|s.&J bF SN1[ީ^o%bd Cq ;hVWjr#YVj\#k w$jOkeR18W$Kfao,̓3^yYĎc"\AXT|^F/Π3/[3rqFxi{[3zOe!a#}8M]x#)}Lݒ!W偨Zk{$-%459J{VCHk]jߌ5V$}c^3[n#WsU,-RܥՀ75OS #>uڸ @HʿǑwޕ'OV(975^E tꛬmrHTsy3cehݣlEF#۞T>8lwǻ[+h}<q.:vF_-%gQƭ5NxGF| 迻nQ>EdxU@) Lh-٥[^.LZžnږ{WL~U EcbUY~M`k{6ٸlM Dǝ\}y$a+mhoDVj+u.r4v `>1k7Y>,}HG1.ky[40`l}}XHRm<^ *ͮ`b}%y? Y z4׈4r~aևːiPqKh.q̤H1%Z/DTS&OtqԧRiǓ&|{SvX>dmJA x(%Ψ"ts ޖ UvrDkNڳrҸ'>[SRzE;TzRP؄xu߆1=pFVpj?h\]vw'M  xrsqjs>- xN/yA 7w lqO xa(n7#^;<&ReƆȿD9z{=@N_vO 2xh]y0M9?xʄ#"GRErÊȆq'e9A1OpWhQͩ;f Fj*;B`PUF19: ݗ;ޣ|!2J#ZV+I lr:r^)}#e1q@! kR[Yhf7/MdX&u, unO׋qV57VRʄI,/RHP#n=Ӳ{P8!ՙ@< wT0!$^SP !O{/R8/ϙZI4*s86FRKBＧeyߩi},*8.۾> a;Otuc@Hl6^0:e*-  eG0wYpS2<2ֽ!o%]waG&UMu3&K{9q22#DdeZ0۹FӠ %!Ьjf潇\mԯ9I7_)vn+&+gΥ4`( ;=۝ x [FvJULP+ D2 ene")#(iQO336%jLGmaNfUӞ`V+B]D?m2TR(4,7|sk#v VAk]1z j{:Lq+fn;խXXsYt0:o|kӖ}FFLp(s-GwblDhD=ڇ*CO>e-u ;?h㕴[dŏ|12BKG1$Nk\Q:t*TUML{_/ zޣڬ$MY) Gj UU&b_t&HN|9߫_v0v A*7i&1Ajr[aP lٕc1Pܿ%wQp c0#2'邚*8<ąD2xױ}>#\UAq{k"&q9" OVw{8ek̾r")}T{ּ+uvRе~UaZ R]_IL)[Q-wq&,gvD}~T-} "ohn Jkc 1#ۻD}GnUnҨp^P{Y,\R<>* Ȭ2y44׊= Q,E&806bh{!WD=ݹo5ݯZ[7?sT?խbq(˓7]r?]+c^P<~T7&Lzч(a9rkR􀎅7Ě\ Hau2t40ї; '.xty{6a% )*4+x.S Ϟp!`R-&z"V'PXg4mlВl:L7k>SS:WCG@3f,V -.gPR$h4v1-beN+=%Aƀ߭If' )+1< l⁵ eW^#؉āi}05-(ѵG+D*-(4[bu%6B:}dPi.XKrLXWYwJ|+< :but}z~?d=x!:S$Olۊ8T 6z>+,aG)ǘ0CHʒ~@5"WSw>duf{l Qp'm!ve0ng{-0fcv~RY;SP P3e_\<atZEU5?&[tEM4? 1_C]9ޝKzIB).ot}xXS!o>_O.Z٩G{ ;G.ZExQ"%عj :A]dE$ன x ":wxȗMeGxU`6o(ԕ$P}T;&Yzp<Ybp*4ow iS.>yivdCpII<㽖%o\Tr4MQ@ 8g^ʷ62 2Ü> GJeA_ '-%_iP236 =x튖rY-=bQKCQw9@B}ЅtFq \fδ2jN[ngB.x6kf>T 5].Ժ [ĠZdƺl!:T&Ucz5PChjL`TQ5KV5{ϲ]G?eX{ymhAX7~]Ve;Mjz޻Mþ6}Ocijq:4G6tUiEU 傐lͺ!ot0@&HF$9G_+:Kvɯr:iQJqLCVy; GABYhU5 jJ @7:FM4x5ߠ_9$ (yWmf&N99L\T$ygO *)*s۬w4MƏ0rffE9[h,4cV]CF~'*o sDӡֻ>0pD ;*Yc7EA v⋫=H=ȝ@\ԕ8Fa}H2P&67F@f^ؕ+/qj/QҔj9QWTrQ# u"ճ>̏;_&Nc:&Qɪ-.EGgM5g ͫZQ֝c[>#zi3Bjk(fnBöL^S'F % 0A)4xG?򦈔dThGZ) BYTfi 9CC} !`'1Ҙ؎B؄ǢwT2hzX?hFўOdkP)Ld+r 74I6DSm0[ģ IKPXq^OVjמxKpt\Yj;O[PlΐǮu~犬Y.RAUtY~7g\D?3CbnԀ~%Ds.Xm7٠R̟K>b&! L͚GfvC0@@($-P0pPr__w% ZYW}册A7,H*=q˰h6j\.̿ZroWl8^wE׉(:1x<$&;VOd PkY jy/ނq5M{>oמ@1bOL;j<.R O,Qe / "Vb(ób~.#Q@]}`qL&-H03+mY E;@ ._(sDfہO2.@^8B~MEA.HXZ '󦆉 Vu=E&> 'v^]R㉭`fm;kx FgsIP dCLX`p!:r Rt^: 2NK&i!\gZ3֘_X'CZ SJ5JW>{OWx 'S\BLnϸʑ|<2\&HȈIZ:4n,L-0QF;ׄ?yHDp+_ZXZwV:/!?{=TW6ұӂfIۏ8OSq"x~<$VGqh * 5]; GLuo`! 44lHoP5G'd avڷ O9ƍЈ=Z`!kN;K[Uox1zِp٦Y׫K%j[;U4/t )iM lBo)#L9-ׁl&Ήuoގx()*$X{R7;f`O)ϱmI6a3GgM98P5TӧW"*g\x"gpNTe_5yfKŜC|:n FpP>]w*ePOYُmwF&W明w.jUJ [\wwItLz*7Ar*d }qK&CLRL"w:sڡ2_Oi  cS/Jjb4>Ef.r'\sݼ,X퉈ંr "-<]h)nj WPX-G17X%}-a{H῵7lQ( }9.;Ҏ/kj}z5mВdOV/ZEBO)6Zo~gSz|9О⸎|(]}"_C#iFR:5su8~jg%oy.g ϒMnM! ~aѴÊ8#㚥wxD֎ݗm'PP'6S(4ow:{qy]h\*'qH}RhzlK}Ƌ@8R5ei` 9CuitF9ρ'8,s8$NF(;b^|{\?G7.y0^(J]{A M*2K%zT}<`,:qU> ҍҒRWqJA䩄( -Y3x*Qˀ`l{gDPd&7}C+pP\˃'sWAR7f3am)oQ%[l7"ͣSvqc+inpMcRS>,ێ8{ҧ ׳@#AP|"xYQGv dTrE*5!Z:0~AUuR"x"~n.Bӛ(kU\Bℑ٣9 OŸq [ a^ qq7H]eOΧP$Zv~Ϭ$hRk{Xeqi2aN+Y $[ v3cO|X>BcTM:%L4~\Ef͓ ^^}a%G,k o,/fׄ?~?(-U t11 qwiYn <ӘR~]Ljo޸=|88grc@n<Ϻ:3F.Y6GtUF6,uie5\ },YM]<(>ZLa@t8,YPJe0֔왏g%6kgNZ5'RaY*fo$_ͱ˛ wqzf+a>ђ Q!o{|˾8%Ϡ&Bd*|o3Z JXGܹjƼ vGd~B gc6i@?-9upI9+6{hf_pG&˩ 5V4'M]h,7(*'k1-C'-TO/Q&*4t*p:U޷ R9} 0p }M^0`uԳ293n`hsPOrrmo]Kkw>1ݕ PC;N"FlׂX$5M.H TK5ES2P:GLOWqy}Lr5R(pg fşmGuJaI(́j0r Qv\])B-NOS7/ 8_'~(6h2^-"ow)Oz v)+o %8n~W7Y'`Nʒ$Q /B3rm02[ki`ZP,8=33'/^ص?ԟ /Ќx4L뽦U31WW}<1th2=՗,_u-CsT4 7qcQukr>q@@Hl"C'DQx1Ia=#(K %tK{^CO#Izݮ f]? qD`Bخ8;UG f)gֽm ]=T3Z#KQ0CGeE|px?RxʣO`ͨ14d'œR ?>G7sN>ƪ^&|[u6:;0Ɵ- Sz٥Sn7k S X wJz?yO'j`{սA ,/!@†aK ì)h9[l֪8 )&|sN)Q h⊉Hj[+bq9/3Cgavi8ODžu&X2V6[Ү.1a[C1s@M`03?+,'S詤=ԇv|C lu*n}ri> AkP՛f^oc]\Rɚ=l&@*-,6r 7sCRjR*j姡Q HlqQqLE aw0W-W$HB% D<o"agD&izY&B:ANc̏ÛjrxγHIGa:F*K@YזZ|tqmL8>(E3"rsrb 8.nPn{N%QtM_,Sr\Ʌ7 ?P|Mo-%IjÊ{xf@7lEM]m#O+Raip,YY{DOxz$F!`ۮf:3=HoL~#`* {8Xy2G; [$K#ǯ`;حGi;YzWO:q'R#_u˱!hRv6bqH `\noȤ-w$ C-葇yg_%"ۢ_Q/$uyx+ S݂őHE^LiNB攗KzF dfLb*$Q7߹ Y#coBBIS4ǟW\Byk<0d3}bnq04b!fsy6n>)pj"IMn\?~cewWOڂ#>Ki̷y'8hA4_$jE@VDlG|d׷_BoRn;7;Cq%dzQUsQDms `ILNWl6}}vWH-|CoρHIdayg>WRԯ KnT=LxtiUFW<wo%ۼx=2]ǜh8F/@i" ? GK&DXYPtpu&sDWqr¼͍Oθ RLf.hy!1!w~3%[MҪ5,c,"6zPPn#IoS%q,PvE=ͤȐMUS.iܸŤC+Q 5Rl~ )Paq@*ikzdq2]FN) ,2TD_#Xo|إ?.2ch.~%|M^`}4#Gve~5&2~! _+;W?$l ^t.[aL R<\K?3Bd6eo=VG i&[|uڠ+`KF5~bQ{Vod}fޝxc ūuZ .:)vٗX$skWC˩r?۔HNpyIImqM$ۨI\~O3%_:GoUjĘix9in}>6Mi1.$K\[ ^likMU(߁ !!332F!߆:m];˜a3[=7a(?SD18d=5ɛ9]{ C0lɹBz^IV>U!,8y/:^~_Wа-N2!7P E<4~A^! ~ l`O)Jټ?w$ -YF$|z wbKRՃW!I,N*bu?F֚f2票-Y'5w\ Zmw}GꌍL zvAAC*ԎWfVBq(X\<戍pEAf}t^%S+!=]rkCBpɴr!v+Tuna՗+o~ 1GSAW n.C+ikA y)&--̒l פh MTm[t2ݪM\Tq虍])y[l2X;/Uft7IsIoJ̭*zKaeyiؘ2o717+ 0+v (R+PlQ'u)UMxIXJAz&e_{.}lI;[B~[uۻ܊u5odEC] UYQ,DsUD@}s{X'nݨt@#E7ݒ*|]@U . zVB7GcUַi}Gp 8n7qR.DP߆FՆF̏?i+P 8~Q6[?i gmTQpAjC@o±YD< Jf_4ۤ+(YGtogX,ih(`Y¿,`lPmvTTRfr1[<'9MMff l?Z W/7E]s0bp3i@hw0ˁ56|$\Y R) {/+ `U`:k#S)o9Ω2R,GdA!ċxdL0D}zPcP˄f5y fM}Aj^b0?+ 4G#t{U<>B6CEypvwkXș)\y,¬N1}Oҽ1D`Icy[U!W#|xjƜw>1]aZ|EeQkGo#e{]Y'k<n?F "Rg>ߤ?ކ/˓2['uTZcQ"+?^+hss)q'*VCHԲkO0e*Q^>x\f:'lH4-JgPk:3,©[J} ]'A:֤.5Boxʝ>r'jPjCBf'_$#ܤ3C`*jP$ A{M:)E3IC2>H@}b*l3).o"Х]?.hp 9Ct4O<_Tڟ}M3bQ"G8ۊ_8p V gz(ݛ% aG6+mAG/j?$6fL|ހxA*I9nl/C!ǙO@V?OdgtyvYmwMZQlC?pF8@F,f4a`VT-?В>7VFD3M9ﮢ?Um 8<&fJeC/QO0JA(گ&<_8!wP#3%/hǸ_7̳}Ziȅةe\ YB)[˔m(gh#<|my{na.v- О6.IkṔd9hh&AL$FG}Ks /K[v7lK^cme\bc/`k-Fع]W$a;_V _Aװq0 EF޸h ld{OoNUvM9@^b3CX[364ijdܙRpA} ٝŕZTa EN4=׵iiÎpL`M&#h&0M$D&i׻*q+ӛ!`W&4x [u~%3rTȌ=myG>zbgмEMNGN ?>]F\&jed#TPE {wLriOZL-vvߥ lG:{"K;v8a?fMW>'$fpeF=KuwI Hs|I$,05|qD1H+M؝MqɌЪ;!1V>#-Zvs~vkaoˮp8Ѯ\"Rx֟In~pMٖݒ5òn2TrگrN S*J2\hI?* 3*a~xDyǘVWHDM? FĪQ<8>$. !rX3yu儆|PY4f4aSV%Iְ/Uj6 \nE:XCGӔA{X "ЄHp|8Ș@Q As*\mZu]mj/2T殇^7i#EMv͓QDHE%Z vK"Q6&ዾ䆅J¯:8BǢk1Bspm4R$'M_!](J O= X*‡OuFYK4Ōi2\-7CYf ]62kb¾9w.+hPhY E${{λ6}Ew7\) {:hq5HHL`1f+NU f"X  Ń:J4l ߧ()7 X! s:w?SnR´@r|]1yՙIi ,ssxduX-M揔ׯ:mNGRLjI=?@m^~!v+rhtS0-W+NMor.f\cO IVbj7 o,GhHWj<(Hn-DSXL]*>=(ʔA9?|2XD5ûK"!Cy݊ƒjZ8Q5~sdCj 4Qk!b~ `1]'Hx2ѳej8J=W""ԭ\iB@3er+=K͡ c_ |C6VBD?DʆKg=%b3]VL D@ й@6T^]?= s8. ﱗ<=*5"|=uRjts+th>BTcM?Tq)=1X6;I.mr)xa)0 !,Z H~ӎ:zǛsheK^N{՛*Ę=džH]X*saA;'UMbo_殱-_SL}%o뛨E 6\\B_(dxcҢ6H[6-_6ъAOfQ.3o"ۅ2ծ api , o M@\z"4~'LL,.kp0KG,@e BِȘ˝FFz|w:jM$l:(f4uƸ5rF$R$7f+d?>G[^rًhH>V#0MAp 6#{{]K]=NHA7ut'vFydHaA˱g1 Vy*0ؾu3b,Z3`eb_f k#Ne.<@BioKd2SGVQLL\fy)&s[dphCzAV.YyA+_0dQ˶,a M1L|l;L~y.GLPRb])(V&=+=iF0wG PVSUz8W! n`֠OߔI '*~Eb5Cw\{,wj֙Q?#:pzB$vD] `ch)G O qD  Pr,lOj<rj(zSMvu ݧtϰps݆~3 {BA2w,LE?6+g! UB,e 1Y^%^yWEq-P: '1;$4M"ǡxZ^&+/\k1{KeO߿e]+,ַZ~GiMY'z|Ǥ^B]4}OZY^=-ȥuJ!d&CztR&wt?"XI /EM2 ^A\KASdvby^7nVR65l7u_觇 s2?3ػN^c#ye^ؗd^ф.%JdWO))'VsOIDXL!ǮO:9ر `MLJ9dS9~X$`it݌$K[;D鬘cL#Ɖ%ͮ3ϮAn}~EnQ`<!GHr ri e[$I(M|65˖9W2O!pGk'~J:%D ngw++ ;A7}) #qJl:&_J XM&KHۭy&wnR|?ؚY"L2 $cݫd#"Z *q< ٛm뷿uG͜3Ǫ$~ |Omsa-,pazhY_%ko2p̃#!% 6hʘ֤YݐZ<-]y ]߽HT_D#ȆK@'YFN [Ok@ы)Jd 8]-T( R <o["8$8W =[ @r:o ZؗG7gdx)~#{P|>RJyBNAa&ˣC4}^*`s_2S}v+`O`%J[h]+M=7ѮrD`H|W "*-5.GL! @4." 'Yl'É8U ovzSE JAE'|V |Ov)\]D%J6'9<ݔ`,`17+ޥ*H_/ 7_e)ٛ qC36M!؞^s4<_hC21 \٪y1ZBƔcNj5ղ:/FВ\!A[ҺG(Y*6rw ^FUi+tH湰)űS֓6s&eiCt;[akF%fx$=$4ֻ { Ѩ* M1U\MSN$Hʇ@Ʈ/Q[< ے2K ;q'5a6^fMS,n@#+ 3܊DA_%, BwQ6' RyawchxbqU{4 0VȨ6VvT~w QX}5T>X}1 YE5`L9sS$ۋ4E=+"3LSr|8,Tt5E,*ș{Ppz D P}2kTFaj&ʄd$)aA!K%@?ᕀiθSUU^ n3Fth3!{G 8o84k%(+6uųʬ>Zs2~s 1:aۼRL@6j|4#Ҝ9~cNA'ܟA}ud# uh+n M^r~]5$\7 {!.jǏmCy)еgv# TcX7߈>?u r(\,k0ɢq"O[,p)wX ^̨"!鷇V&=-IN3kIl3ͨ.g@iQHhh4 KVjI-Nꟷ=*<9̦9l@ hߞ( 9s曟 ԓG + y(w:zhe}Ld_v4)CC6"TM +XBLϬs 0y϶g_<m˯4涢 v f5f8F/(XU"͇@Wn P{?l˸o\RӣV oz܂ ynݰ4N¿C ibN కP:a3蚚'#WLJN*}@]HCr L9uDf`}rG+fo \A}H,8Ty׎F9#f@~s.t16[w= S%d$dJuD%RN\/n~oc`?F1Q*8T2d6Fdȉچ}_f-{?!L3A7D609 T퐥w+\lAe0ܶVC B*}rHŋH`O4IRS܀0Fj ,z(gtb ȏl!kqA8cF5mcŠhZY*D[WFRϼITrkUĔ#lc.B9'_D=뼐؁>,bz0j<+Ceɒv_[u߇~_r蛎,sYc+7o&~M>t蛱I&菢*5FYϰ;BjVdԟozl^ Bnw)iX\h <ֳQJKzwbƔ^$k!Tup7քy|TU7C!X +gj3v#hPkld;1<:sUVKՂţuM^:&+vT3Έz]+>]B-. s %?/xcZJ[nܖD);zN\Oe9Oa.0#Q/L<8^))ȅ#sٷ饋Ug!&c5ϥ+&W4'!DA)G.0Zgvhp&{z{3g"&wN3=|7|:w5kJK#ߟϯmIpD .#A 0x\ħ864;y1%}O/@ VBTFvɌ,Ѽ87rWKTj*003A-@n#ޠ3%#m";i KP>>qa̤lP2qҙꆕБQ4l^SX#& 5+2xc5lw9_ (1'4wKE3w[Glݠ|dl2x(C[ ,l?J@35] _n`fI>aC"[$cƞy"YYa.!m+uX@4 %%-(h2dfAB}9= `[}5˯TZ*4E0!FCëN˧ٗ,ىM+Q Tf<B} F\qD B^fqdpqG+J`}CZ늓T<z»t\i`ONkq ]A2F ~mkOfz@ydHCa 7|ʸ,3Ni|6JCf6`Ĺ_N#,^O B@0yDл3@K~j]jbc`q(j+uu0G hSȁݒ8 ɡ>^0=\< osp /N^N~it;~>͢)u{ V*cA8\h%Bv`./VMl_CO *e&BCT_Sڦ߀86Պv4X+89x_V^Oʨ^LIWtmZ6GF?tVcZ8D#d3 kDo=\^n1VG*,ϥ/9fo1:4$mM]`haF5Q(}>|%!sY*Y蹛>+vʊCDr QPW+M=L3+r ek%,Õ:1'%7n`YýuMK/ca/*..Z2pXW B9Lq@Y^&Y{)+ BQڌ~Evt_kgq8 fGrzόBCvx! ;毦>e uAS Xm3S=Ǻg~K/xq$8J&u5>XCBhˮDcS܎'\q[B5DS큖8* 3PAB5h@"-WCZ2ƛl.0{;v[i,[ah%}C\T/MvGl\5{|<7=>-v#'S]ds>`Q B+ ɏdHI]!^ۧ 9zrNZ7`mj#ƫaeI/ȍa)$Ad2’1N"mѫSEceE .Uo(1V-ĉΰ=_V?hS'[^T.!]Tg &+Ҳqч8\X#zjȹ2IΒ`bZٜ&I1cv^;6=˒ !{u⮧!k!h} nY3d]c 4aQܳML;B`vdaZn,U[F6+7lա vM.:c^)ZzU3`v ºUi߉!fr?$5j*{G/>RDDf=·3f~ЮpXBRim}fm;z#K) q~b] 2MɭӢ$v3qS(xd8fe((Ì`Q[(#v,+}4VatiJU;+c|p3YlK(pq*Awr'WAIƾw/QŠސWIEm8Bhy^0>3FW`RVݙHOr|GU%k2/,[j+vD(~ه=g_\ ١6JX p'璬B$]4N+g~+rEjbJq`{,M%D^V-ʣb펳XD݋u e -n|5-Dͩoilw ["Ov5* _?&߃"TNIm|6@h>O|+ֻ%,ޣ,w`(DQCđ}9Gg%.T46)m K=͓xN;,U:7 z'^SMx?κ޳IQu~kUr/4F|8ͧ0yT5/"ߊ]Zg-b{GRJD/&/A8asm|ztL8+ҭdo~rvw-w]z,ã\2CEo3`MSi@sV 9}áovO5>to;:9~6dE\4:^k *n"| EX:Qv|bM.ȀEmqRA8e[ vI2N_5qNe|-6XSk2}>G?| ӄX̐J驔у#&$ZQ[&ry(X@ߗ/&֘Z.4KCh⃪z%Uz?oɢosm]h9L/ R|65w_kxʦ?m+ɸ݂Ӧd\Jdi ygcqejg9u/Fml8ȺR*E҂?@'Ȱ(&\*<`ӾmNLnXe̳T2Q(Pfea u0~o:)?`e~q&0[$bfz9b5׺Ggc{;X=Lr ?8&7N*.?AD!W,QVZ֭?0GbZxh-ƈcF5ԅyq$>=RMRcD'BYR^"gyQ`;(wc('JĶ^.KN.Hz2"ױٿtP뚩 vrS"),))lYK4,R_̑~VcSǾ@mvn* њ </v˵%9, ݅Ij"}<WG݊Z ^ɱ?l"Պ޵vVt({ ._]uA6Wp/(}yxD?/9B[XK ŇpZZ_[zlrVHS U_khZ=(H ΀\݅*PGd{_[8Er5^檽x^^}P-Z҅W$eҶ1'bdl5{ 歺9m^4fPu)+໯Mx-nN RmdNTCĖZLn˔i 0lf~ڭH.QXϟ4ȵIȇ?+_C$ kC]i8_{ m;)* j"R(zHHl?/V`țn˄эotr^JhxN Y2d_L^%~x&źtm/jίR"'>1!IZTLw$sM n'5P W!Z)8NUI'u 5ؾFH./NIIu\"c1z;Q3$T((:~v wV ׷ZEYXQ`b+-98jоC,9ܹ~pŧsXX}>kčg7ra>F' ^7vieRNf[<۹5ć3z;#qBivy9uM =,+&GE*)^FvIޛty.c~2l'0?[JJ^rX%, Kpw N-xYfCurNb9=_Qv 'ǃ3Zۋ%GhU"̬ yMR©^/Hݗ 'cbA`>=R>`1QT\ƒMMUr0uƿxaogI3NJf:$<[t,h.Yk)}N. ]IA@|sHհij#X%p1vm"~D\fe,6촜l|T¥[ At%M̔yR\(fq@ڍXQQ]\ӧwb$8V@kH}P(8F^tPV!&O݅y$ga ʏH]49+.o.7$(ofM=UEDe|(fo!.EƈӬۆwE|O kE"aSIAL_?ϐʊʰrf,J1$.W.kz Q|U&-OSP-g57ל,ɕ7_E݉{q(š&8,R[;5|%X^x/8MWP(;E?4c ͕@~tdN7d9dBGtAj!e4cOo^Po8ƪXAewt1nHp^zW@14'‘=pS<"2-zFĠ%4E`,'<'T cCf}> UjqD'X!*$<Zst"-Qݬ]w> _\?[e9rq8,sbXΓUP${bqI'Da}ڻy3)!tfEH-Uqz2_5 K; WaػA9D`3مB`d/> BGDY >LtDfaTnWk=26 63i"cZntGD6zr3Zr >Ǟ5;2 kɦfGoL:}Jq&[׻BL{]de43A ͢x@^%,zYŋ]to8I׸+p{:˯cO˭óB뉜E>O 9LnR).T2<U_ k˔#_* MjY<+Jᰒ3Q)0G1kYӶ/0!2\%]˿0C*!ĿP')KXW ~QoSO,$&W3^*"B57Ӿ.I=߹8O॥&Ywb'?g aW!ߍyfS@~IRW>x" ~>,g.Cy!UU4΃ D#1Ia%0f`s5yur9T-H2exB]/Y!dxD%_k!)+KIR3$CocWT!'IZ9ɖY${k;OiQ&d\&g|{Knexqɚ6Xʪ{3}?&gns ^@pKJzzzڪZBZ0jɖp^7;`޶|%'앎*1GZq׋* ` xW0.K6(8mPtO{$CTT\nƾ}< \)SaIstB/b7jv-[sZlQLPT ThJؒJgJ_R};9#jj3/v:oT aYM^R!V[rޭ%8cVZ<_3lQ_&Xf-g0LeN$N1$wk1@)詐>) d r Dq4(h;PĦ֡,Ÿ:BXو:܄>wX̊`=eEGtXqJw YЄͲCC3{br s7wt4<6ܤ.ɶĹŝ?3\yAE } ziĹ6^v9䜏fIR|wNS[8h2;D򂑥>hIEb2+JD49CU._ڱ@D~;Nj6 ֔0:vXE5Bޚ#Ki3D% (8m6JySPfj*;`KY,,+VK{3>;|J1#77#Z/5E %B9pjDJ}H!?C1e`߫}JzPqz V ?XB Pt;n<2y^[Up-՟T=oPn:r\ᢊBH8F* 2q.K  \=5VVT/r08򾍹%0`$ x-ҲaX!.vIyMJDҫFT=aaL53ZL+қ:"OWz@t H6̾C|2<5EvJzG5 #_{GKDo$/fsэ7Mnvrk-d["({WX[e`|}քxE1ΩַKl(Lz77bbꡓSqm`ĴO\T 9bp{ b("Ư%3_}< 9QgJV@tσ?ׅ Z ,*H W'K1*?kdNk9[ dNh)='s8Jn?W{Vfᕦ]`R+C>(KJtCϩc1VBp; m+J4ݪOdbUŦ?N%JA7pOfp' "HI ԙ֐Zf; 4;)T@|Ux,Nk#0QytL._4cũ~FE Ɯ 鼰^=[C 2̹eK0]ͿfX^$ؑ| h46j+3;a^hH #J3jLR=b݆s֍MpUUD^ JKSO*FfvIB.@N MC~̵%XR,:=tkdټH4B2+\.b#ڔ4s%C* %73Oe,u35_-B_6a9&׬J#_ Pk3qhR*Ġ,潂!B1bbD`/6L_t$h׌\M{ͳ̥0\IŒS*=Bϒ ąW*}}qz9 V= aN^6 E ,-74lJc.Қ덖x,)4H =m^\>gDV-*n9$`%U?WdOoCTZqќOQؓE/V[rg=4.$Ga;Fs:mI/*>̏؋ ~gkriysklG_ IFe^fjDn@Ǟ/(%)[o੓>/݈O~=S.+VNZbvJuvՄa^Zƚ(ȇ"F)`4휷o0"1ESNe?Y~*U|eUYP~ 36hp:9C}*ƌUT@"Zz٨ѭo!IL06E so;g@:[hɪ ؗqu^^ $ŎX.>8R@@t~1vaWyIch̝I!a]ZKVhmrݔk 40"᱅pxxug#81 o5$oI$<3xB&];6)4^L>.]̭ q bPKc3lYRa/Owu*Nˍ@yqPNfmV^?8`?z$@]w7jqƾ$mNJ7v>];if?qb'͕oI]e,QLپHn!)ȹh\"R#r,"Q]cGCӑCJz:t _j ݐmAm;7uhߺΎxS# Ƙ$ b.)J|ݾV)}KDLmO*JЩNV3\PaˢbD o>3\-B !;:P= Gιbt~u;+^DJ>LzUbca(_"r״^9P#ܳ~a-w bjJ׸a&ܩp![z6kޭ˞Hg rn_9{W !$\QES+΋HF!asЈO gwqP:g{*(u3Ryߩ?Χ_i+́=e Q@f-"Z c.9 >)D$hp_p-$eö).ej/ԂO#lD]gDG\2pO(mr9¿?&@svAPVk)7Mt7B+ƨ730lǓ3 v`0Lskp-JѲ5[$tut]e6!JJ ?mi;W-` Uz&_mD/P>)+0?\ePfop\cdOPsx?8pu>.WE?rv8,G&#T7vO57)Ei&gc=IcbDuf@PV"&>c}o\C&psx::3JzI};v4)gу7&q:b^!™|.#j]ʫ#(e|}9C-^|\/61ʺtS+q/-!=qTtiAІQTt.BMϺp wxMBen+RD);e?jg_?i@W\@/IG2)຿udq™2FM,7Sn*eA5ƣ`2/7jb';4}0kS|z&Se|#Mv+՟>Yٓ/M(ũ`֦JimH?6֟B6XXJuǗ n|{R72,UK Bģo 8a 6C;ni`aiƻ4wJ*{<Mյj# @(@4~p39>ƞQ"BP;+?22kO{7/`C[V0-(ǸY8uߗF Fiac!FͰa_?ՖtF)'b]mSuNL=[" VN\N^9(W0n@I-0Q;|FLĊrR(DgJϕT*7 RipON%\5zI^87:o=w^6k?^m5/:PU_2j5eo3,,Ⱦ[,o7y~=)hP~,@LZpF#f9.ygүbvPzI(d vén~91ǁ:GaQ&[R\ :Lr7wE\;f6Gχ32XU$ J\^άN4L|?#;')םnvXpg+5P.j$ZNYJ Ki6;PPɠC2ٷ#~j#q^]B^p n+ˇ?׍Ч? ֤w LG Xx`Vr}p*qI6k3&d G2YNK} Q 5SԢ{ Ӈ<ѧѻQyߧ K0UOԃxxRsw?#xդIHۨ -DL$6 }ڹGXsQzW(XZOdM {OcZaec)芭ơԸ}ƛ!;׊`C~E%Q/^wbCvIO(:)E*8Hd; -X\TּL ѧ16T"G+ l ڧ0JҽNLo4 C}ID=G# އ%NQսi@8FJ87AuEN:a-pMkĝUx&5-1*rq?#wEG|޴,u`YDݓ^>u=#|'Os ]ekB6$`Wed=k?Dk65 +9"8=/+%gbtǧ_;Ț7 }aفdv@' 4AimA?k(vSL%9v [6 Ն(jbھ=wo< CQJ ݣ5҈91>jaߌjMͯᨵ770a j%'-qTjH_}]3dEr=Gp(-k722py~j]TΣ(qdx`R"|oXS nycDHU +NxD[>֩"tmIİftKkI*]aTNo5f.FI~R98fiA3|ӳ T/rt{}C6H7Fo Y(Gdot<ϥncmU[EN7$9̴kpϵ3W?&Q2)dYE@n`URmX%BUzt>% obz"8 &Dsxkm~y 6I,ԎC[_ʋ=WKFT-8\VtX F"HiMJt˱t:s&3. %<7O,3 'twC請m=X@&1]7rV#e ]ɍJިG`':b^7%hfy(ʛ]M Rh]ocyoV.%5ӨoXZN,U쥎Xη E)rkrB-4HNaR+GFTs7 H =u;[s(6g.!_R>r}p5{X޲=ȡy(v;c3;tE!JS< OAeצYحLDo6Kp"uLatątdNH6l'85Ŧðtb3ch>| ٤gH&V T1D2Ν)F}tBqH:t Y5TLy/${>i&9#-i573!&$x߲}(nIQ6 j~6E_ulY'2R,[B;@mg;Oڐ ;P"Ud!4vꞅQ*W:>Tò}`lN{?{,BS}'^c9DŽ$h,K[cb@WY$m 7d>[W#YO'%tnߐ<ң+2 JoFUHDWCEW%?/K~tu0[$g܅~,׋!<1Ʊ=ie#6;Wnx0{̒ 7u ldw #$ty|_ǥb fn'՞6g۩rI,9H!8tJW9mwٓDPݖC0}*m23*/t9J`KF~ ؼkMc$Ѫ!d˨pҀK虻d;w]5h<\l4Kj+⅝W"_%)V\"I2:("Lsz]^2}yf?MI0},ICYpVN2 G罢3 I꭯#~hoh^AWHܫ!*+!['#'YBSt&s9]CHso1k"ҸN _]FaޜAuML(lm8HhWi̛X̩- ?채"͡$>.3,>ɇ m1Mf%\ŲLztű/auO_(\s>L7JJށw^yt[=88j1Y)7Qܞ kn}$j__%8Uu΢Cg kh&M oBd魆]HJf@uUU{~lb0l. 5: "}!$# ̸s4u{c/D|OLyѤ@Yېͭ|P`/1ԋGڄηzX]ZIߘ~okcT  g'P`|#j)MHg~--7PŮ4y>h/Br7/7+DGsM6M Ob,8Cin(.xȤ lLJ5 <^AX"%֭uV|-T%,Q-s]8t%)mSBgob.@ ^,MLճ,cj<,d w[?#)j_KJq{J׌L=b' $]5g =Fj-8U:с :B@cF>=٘7z/20| 9CQ| +MF;Ϗb1m_ͅo 6!q?,ۇDܢ&í//R Hn;8jҝcK)DlWRk9d`7@0XܼW z$C)\HQxoq+gOH^렼ăO<Nvג wt͜ظTs1s"ԩwɆxwʠ!ЇXˮSpw2򐌦[mXBKkV|T?1) A%J;KP贆 (&O 1T 9.Bˈ~(+pi6w)C,eQw,]3oBT0ŰBsx G!Z1],7h}ᝥ/ntG|=FYFWĂtnccDS՝{Ko}b~ü:w3>c`k9.ĶUz J'l/o \(-SDŚNCwԊ9Jo7x2 M8|%`Y(,Pk :sܒ*!τ$R~xK` 0dR<]wԄy™{5=NP.!;]6==kH & ]K~J_j@V{õ:LU8ޚQ6!S>z\(w2 uL0-9x!PUHR?矖8,P4-м[d1BDw%C>GG xxQ.{f@WΚ8&ezes3 kൊN4n-yQK)Bޤ0Kc Y"}Qm{$N 7ibDĐ]srv^6$x.}?gjo $4>ˌooYș6FE{[,>~Naм.AMBf%o78KR限*í'%g`ِ|q6zM'Ǝuck@k-ؒ,`wZz"9\\qw㿑өI0,چByܝ,qu( *5/lLk+s$&&o%tNXndUcSO՟囵tj(.D?EG>~M3rnGaZQWŲj1ڌC;s_(=e8GÖj/*M=eurlMtoA1xգDCtU3҅7N4p3 Ґv tZD"\tYJE4'auPX'$nb+҃0$,d[CHIҩ%sB6YUG,sҖ )geJ^$V}*k@bvlyu}|&&):d>&XU[fNK6T|W@z*4`b|Xp%|Ǽ-i\IlaHJKsp 3=t9.bWyYs|{Ihy7¿)S:9BN+;؛&&?àPmf,NF>9΄F2a[UfuKQUN%D}D'.QY{S B'1I҇T}E v1ܶ-?0Rz_ ύXږl$qZ[jaA]{z&m..h7œ8ze9u}1eHlel@ \a$ϗSLK^캭Bb::C_N)t~|L_;Yy1kĽ󙕏̢2+f?!J!"kfG(-g}So'TUJBAcDjJ݃ I.{&tSfY i JϜh`13ϒ0)sy6VQ]1nA& qܼە9 !59^T@g!]G"r]44|vAh"!Vڃ񮩬B[sދ E`Ǐ1URۈ*k-iVoJz$X?t`x{(i#0Cy*ár$V=/ړ_\lT(23\8CA@0/V8d6Tۘ:=Gtjn[sDwc։!U<ڴo$"` 8[+Hi%pvyAD<}n݁PWNn9b)P[*@t݈j(Gy15/@Ci2`eAuz;yox"hBəY^Լ˶*Ut2@4}GAvO?7/y)ԠK]H/ْk !!ިs/sczlδ,IS;I~d/ͅ]ca,y쉀dlצd`΍}K(gw;US9*"=0!#W; =ByB3C-,/-%a1pšpe6? F`:jbj=L+-9r!ЈO&T%J-6ydhU8,7a! nѣO=h@fJ0h#1DzmdΟ8IJ_18dQ yH]4/Lp~v8k ܫNu !po_;ᯊ6Eݏ[vQ#wUNH,^8QCXD/LD߯!yTzK*J*Қ*>[fٺmA϶bAIke u;iXs`rD"MT7W^ćf/Q}vLP0t`ʒ{V84ް䚘pfX')'3eB&?t"IU{qHL{c[|ޞ`{)וGT*: /obb%gY@zVdX޿j1у{3}_2rzs(.g$o˝*g :+1isٓщĚ)n{t>YgϥOmm +4 ? %LERTG63KmB#t*ӚSz͞`$) [X_wMFsU;%'<AU+Oҏ+w>rJ[$1ZpV"3_rF]K XmIcbW}'X-Z9-MUf$"6á'e Jjk1T<3^Bd0uEhp9#*¦aXnx~dr>B] q̨Į5`l^ʡ ̧~N nBRDp h{B2M'~DءwA0i%-.,7h~8~G[Yjp 0>wudpw)]/@Ƅ$VeP;u ֪@8TUb.uqi5e~Z^!m.֖!8O)}tO4/Rƪ."2^֌T"GEbx5X_:jnC4es!bn|񟆀}ZRA|xÚwXbWpQ8}exFgoa+pr d ZqKXtnH:e-s_+;=zi4 \3)NYHjZO)lc1RzLj90d)\ռ-#TL<5BS^QP^ޯ/2"a؏+'xV#p(*`$Д>F2 гqr [nZ%} @ˈHS|20vA/L8-Tzfu3a>QM@Ka KS.]Б woc[ G$is}Ҕj%JЌ0j( 3y 'y9}ۣyv/]i11R EKdTR f~bwz$sB7c>G,%$.3v&·cScb Fn=oZm5 |mVǃ{@霈 h`گi(^5>p@Nەq/K'lîIvW).EW`E0CieitYeɭ:% ? Ug$|7>"ʈ\cD]oGAAbEZcKaqbqq€kTZxN* }xP!V#ޅŸܲ&8br0(7pjy3 .B[o HgD:Vx%X̻vzzDscX)ʽ4⡎=@MwJӻP _DV5¢su fŔޯsc<JmsJECwSʴP& )n-8kfȰ]oAp!s2YU43pqh;f7O6G A#Go,d\:L'QXQ㻠;8 36ִ%XLIGv"ćGyC2Hm$ >T%-pEqkNJSSHЯk =<-9t]nxM so?nP}Q/hBX/ { eViQ&G@gZ(oRHJux 6[HVQ0ݳJ̥VT|ͅ;m ŨF1& 'DXncԹ k2ߗc7d!xk":qyj FT+ewɓ! 1j@U;X5w0MLwFps2詴q ϟΎb--GO~kmZ)ϸ+幫, N:D -_A|S&&m@3\ k7e\C1#:UTA+mHBun[*6ּ`4@.BR:62\ w5h .4y2/ tc#o v+V"z!ݺ_ٓ :"d~~qz|na@O~ǔ Ŵ3njS6ʓwoi Bh3TH;\ 5 ;kdMs,@QՔ' \ыUOO v)Ci#Y6F+7MwTcdl]%sX}Ef^="\BTK'V9ӲT3B}3p#8`;^DH%ԩ"BF(K= @s9!=?-pDQLX(,g k:Ŝ''SފὠZ9E4o ivE6beFSfSie?* ޴;Z΂ ̘Qd#o:Vg|7Thc}΁kPZ^ ^$\[`Vkrx"z ]YAuS`8q{̛kZgM/9}mbM[NyJ?ڃ(_T6Y:Mwx(Z<kPvӤGGDa Q}~" V&Ne)L@iZE6J2>@ '%>6Ч Hz 1ScBZ)h o,Un-ظOLoP[ ETE?@X\*b- a2vU6-j3H9g9g2:ynrrҬ{cǨBط9ZleRHPaNbEKbaFakqSN!Βy{z.Z q9y7Ӑ U\6;$@Wxt<lҷGwi䠞\N]exx47R]a)-KcC jCŲOd^0*a1Z(Ғ[&vZ# eR\$.F[ɒG aX9 ]a1Mݵ=sUϲPxe,Loa^PhywAoOf";vO 0a7K'8^(Mȏc.9)cd`]g|9:pqPJ>(*Ǣ?&sJKRsKbGVMW5sC_eʮgg{+E" qҌ7=cuNL{޾^w 0EzNfU7@z~GBTtaA9T>p~st%շd=|ּ;: WDOdO4*LGZ49ݖOn_P!{4ݧ-dCys;u ɞ@GT<8O+ h y3^X$haN^?JqDua}FPټWM 4+Jtv0iw}вAshnDҝC55,΃M YU}"| P?lS@{8~/J"@WOυTiTX~n\u(m.n`9vmQz9:8r{ȇ_11⴦t7כ|*{ Ҭ@5Nߛg8FSkTyۛ2^P-7~׶̋D/gʞ A}s;Ce?Ovլ'sDd&.N7xbi(^U#T1G/}Φ=3 j؆^s'3ڝl#y|BQdE"48$@YP4-yJCtDzMlsR53;À[4G{+.{'цftMut Nw, VUvߺL<Yfr1{@ZȜ>hʔ]Ƶɬ6|5@0?)#62!Lm ~ '+P6|v~.֧$m2t4!VDjȈmW~K+3FcM0Po x~O`?'9["C΁ΒWl;9pR]d-aRwݫ nrTF3o:T!qXHgJran*i! ɝl,izPR4ȢG3,JAV*HDa6]밦v(e<^׼f>;RְgTSvIi9>&嶺4'WBxR6f"*6/^(CY-o1\7R$u,خcS?n I;[nDR!rrNS T[QYv;nIF9P#-i3*~(X[^1&|ȿ_nj6)<Ȼj\;)[M˽^xsī;WQ'vgkFg4Wd٩`-i'u>H a9H,v#|nAx7P)B=uAAb֯2t;I'5f9 d/3­:D׮e62@"!b%cKޗ^Vtu(OdPoS㈬%_Y<׬B򘫃e~uϘrgˊ|J5OT7& 53qѱzhsS>b8Y C$#T,+E]R)\jF]p`_*F!IgyX,ޱKzB|=Y漵G&͓] ߟ6`;sMd #(oirWj@DU֩}htB,nR@eUsࠣA5Nv}ISʜh{] R1TY ~Gg\*lQD͆D'gag"x*b(Xwӳ `+fl;DB]WmqZJlS5weeRPs;F1Hol g߸>C'L0曱{3k{(mW?aSdl)>_GXqIzAOy$4撛$.0>a3N0H˟ GIRS$ Ai x $AQuo:HȶҔU:/sq76%1uƔTxs䱃1)1XHw/ +`ι޳GoBVcO6Hp{fƍA~8!9GH8vǽiN ]:ySԶaKE AGyg,$Nf~cBZE|cRw.ncB Ä-\{M!51#n{0NIG1b1^CތQSAʹ:A`9!&r%UpR5H@T6$}[5hz+uO?#(^fҖ|lD,D77z,|U^XQL΀aF+9Iw❘Ej֓fA [-PDLZNe 3ޟd@%Ʈ0unb *O^t|4BK'5`9V8 J\+\|G!K.R}|1U1M) :Ɲ-m=R\SJ2ae*uhDYJ/Bv3ۿi< _S2d:9 vߖ9I: Z)EmwC엀g[EN!cJg80E1𼈥h`=ś)- "-d&gEa>d7agf7\Z}DԨ3{ߣ| lZ4^3_:g}0]/޽rTvqNxՃh7C4931y`o`A3$My 6gԯ*[ats]"<u |խOB A׋M\.Rܢ_OaenXJ$#rj&|Vl|NY.s4*жWҵe_9lHlݒc?_ ~(TͅReio]p-p-,oZS ՀHPM` `GѼbh>=F#_`˦7+~6qy|OUM hD,Qli4;lD, s6=Ϻ`Rqr(d8ӛ3zsWz U_y}6$IMÈ)mF_Q某WY .W 0{qxMgi?Գɴ1bu迢=ٔBg*.\QƊ?zQ\h\v\D~\(WCoDpݶ]D@f_L6hֻe-4OXe'#N˲s(jSK bco/&G/P)^==VaS0bīo{AaBBG[{MF5lOx+#ɖS5Z9哖_1澸Kv#Qdi=c]q wݪԒu_7l덒j%ARx8f9'\SDZ %;-LLx"v}7UCy6 LÔ9[S/fƥs(7瘇\6/X4mzb>釠Y4x)'CGes jaUN0>:K&6@-#M{W['ߖ'\=p1EZw*.ObPYD;=j\X^gګ lW_2GCz#3ΧKժ)a$ds9K.R’)p>vwfւq2(f&nD% vFBg}pngs)&FĆݰVVe8:sܙR#xQ ]hJGyXtbV-ބUӲޕM)2C~r`MshY8Vsꂢ~hz\.-QTy ] ׋R xGY$^98 -S-D@H}kq1&]3hW@%r.L$_tf.4E[0搉.xBmҀ{ÒIog2=5}%ufESd43ø|Xpٍ̥B:Zt08r>Z|o1^0Qvɭ-]\ ޑKc@Եe[0xAޛI/;1p&8Ck[T/#ܑ4Οә iDx#Z}H;r%!׹f%HO@jJ3=p`*K=eo.-xH;J92э`#3:2eJ/kUձܨAtf03 2ĸm/xq\"h^I6N#tir.gBɁ ]w؁:BRRkZLA"P5lIfXʻU8X|N/viw$=}5Wߥ9qLSD&EyaLZ+ia>k|G4E6MC79<έ GWbh5Б(sXpfm 0bmoj}J`hCXٮ t@oB(ڈsdPoAyeڇi M5v3#5o/-g[QE^‡Wt} AoݒVҝBҳkb7IH &K\GCw25VC,BhWHf ÞTeW)CNe mY?:>67W|iǏѡqz+?N &֛d'+iZ(~LKtUZ1LhPfShN}s]l@~JN%0Eo]2ƧeBUc:+9l壬Ȏ5vnwURR{]Hcf3]!@(S68YA#3s,0И?b >ԭUP0}f;6R qpjH)' :@|ΣBbm.Jѱ c<ޝ1A%(:SezV:@6yu=njT' nBGo;1(]VV^䆾!o6i@hzE?Cw7vnrO(ҀYXw[O_~GٹiAlMeZo1^<sHE95o)g+לRyf{Q=zWYZx|f{^8xi|х&'vŧ[( 3 = +$ES fM`~m иsx]qeZA|}It&b9_H%?Sv UH+k5Ku [:슄}:=+ }n[eF,Vm33KJRɏdy/>hɎik6w ^ÐY_⍪YZoS4kve [#hjhjLoTCK%S^ :Hڜ=[fL5z} q"LDcyq7's0t$WĆ7x8 oF>tKl iTdDHB{c[PfK;}Az\q-9Xzex"(/34.q Qƕuc}ex)T7)?PQSOq@)|wML{{EIjjJ{B~lsuys_LQB]<g,{" wnY;"0<ߟe|AXQv'7Bɮ BX w r6 ?!}D{=lr..eMgFVq9EJ),Ԋ4]ĨB\izΔL[s퇓j! BK%XM׆2]:+z“Qt@9HUguR u#\k3~>60WR2ZP= ;*=<m.~7O5җ3+vޱ7G'Ԣ-VO;8_Sparh@{>oKENچ5; *(R(K\)p$3*zj#ov[:Eyg!ňvۏo<~;nDGAڦՑmpFƇi7-SܨϊRv-4A%3Nl)C9n@q.,^gK':OR[O:l#`),ܻNك?蹗H̚2nk&BquEp2M'MպO'p7pU}{LLMIi9C8=sce4Ț+ ýduU"1 Tò-"M"nD*9 0HZW\T ӆݦ2/IƩ3٤XMlùz8Čfsg>mZ+oEHqIgf%3PN%pfآA5[eǥ+6p|4mQxPaӟCMJtSX# VqB1q!S.A<܏s':vuCX0_A_[U3mɸ؊kx8G cr{-]Ydu9KBA?kcr Qfh/3)UDhw{Af n+h *(7-Z0P`q ۆ⮭F%}g $ii> h5Wu>Z DV} *e $nK5c( zW,`֚FAQ;4@Gj=$a)$t*`jr:<'5^5=l&DV޶>2րpXT9HCN (Ԑ؛3'dg L蕅# o'oVP UT06 o3dI9hA&=nQKYZ|:bIby5 m@ u 2m`BF@0T΁R!ʒӭIͫ!+#30d]Jo&t6=]ChuP{U~Km|P7Z_5 ØQUf] 'Gg^W6uRmDDt㗷Ooޠ4Q !."~`ҋ>7JF8ݺ5M FtB[SB}1~Xh*^"4B@d5%q>w!snc`{})]饂^ ›$IeJ ,X A[E4kѱ#^ϤVM3y5`LNjA`Xg ~*QџMj2!rG*>kP@P:El)i7ӆmNb=m ) kaS!}1ZJusB$ ,{HԈYl`r8<俬y@*!UudSB xB% "sU&.,` ԫT(D!N[g`iV*C~#$T Lx8y_ {v>j}&8U0MUpӀBC >Rqʡ.U8Lca^V%$-웤*\u]3~Q% Iњ Ej|УlC6tX7xKpcsэ)o kĥNm-"bA̝$Lu2?&hB(ܘ!$Jyb6A Kc,M(r3a,b]t\+)7YCFL ڲ> +5 P\=C[(8#paTdl(T*cM&/_J!iYNpT\m?HZ33;x~3{YIp6ጢ,_Q}04E3Je/ <~3UP/\{TIӺEF@KZ[66$0]nF&:KHqC 6"bsO NCi/1BLwD4Vh;ׅF>?e~ m,Û<#I;_6YWDZ1¯ "#R]"u7۹gˋe-_ܹ-0R|%o7c⃿63u@0P䎌]K q:ݝ]$Ƕx2l2@nxHOiC\Jw!&-dUlzO2?]~ӷj\&o[6jkqO CSMWKol?1ߡЗq+a[47K޴*ȋC!&~^Fig͊vTPXNa5i ]ԣ(s:}D%hc]_ /myNxBM!2s 7ňĥ,(;UV-9ju2`2/h< X„CвB*dL>Ct&wsU2^a'/1denJ%mfx BynHM]+l 8Y$\cU{-+I1c9ĭ*)LUxpAbQ'.r I8-x֍y?>=?/Jjы},N;T X`4᪢S-L#vL tQijďg;P1O2xě;$<嶳idtdq#}qg"8@ܡGL/\DƉMo*͓M7ٛ9}&.QBD'R$ Ҹ +-$92"AZ g5/VۮPwlj7-[?6R~~©ٗ#I4evpO&lN-[Vg%zV]1J!TC&tKYanhzQ=}9;9pI2)dK^0R6- w:pOrQ& K!<'.צ 4h|ǴBj넲:\F2p||>9R0z ba%Eр~cMC_CF,~{ m)HkhL<]dn61T8KIqO>}) su0R-"*'(&9O8!ѳ'Ȏb]azs M`\Yhj2F6,Ǡ(δAӪU[aP&=bK!ŭOY~#{{`lF>\! N),TNWv) A<r$ܾjb  z{rtFL(h<~dp7Jf#ByIؓp߬ȋkD+J+?"tqSgd -NfQ6*;c@͈oJB$7=Ee[vX@"z!?zǚLأ&-Ut03[GkxeZv %d'(~pzt)HK `OXO:z+/ȘJjezSe;Pnō}Y0@bي.T`k*k" AcX{u9,|]ŮNKks!p<$Ъj@Q^@@̾%G܄T9"E<}-Uc<*<3l^K&Tw5!VDEPDҾ)QF/B0%K75Ir{#bw# zHOIk{FqWDK֔PC\`;бAҞ5* eXſ-&k;߶+.a|+7$kUxCTF~ Si/]4 p0[Y+g"83`_uS*馆*^@m6 8AdA Eza[TEໃ;N3/LVW!rq RsvIX5s8MCC'a]>UyȱlUL(0js3:ͰF{I|Z<*w$`U0}@.or')vyDps H+ WӅe߭@JFHXg|W7Mxd77Pp: l nAi؏nS~{ዧ zpkx\֣f9[ޔ .B=_FCqR藊6<:e*eTk{MVU&Ub#< ݛ5F'=3tr殺!KwПJy1=3b#':#:,_G'&@Jn r"Ԋ<ݏ4+3@*dO'&nl]~%۰gOV-'TX4OGǀ’H |r0RI kr}LlԂ~;cg/듽H"c&*0Gqq}XK]/.-o}AeǬ5s'?"A̲j_JS$(}Ks?P';qoq<Y٣x4DZ4S|dɩnz-/dJŠ=vuet+$i#T 01Ih1۪ݤZ-3=Pl%FcD@#mD$PB|l&/_Y&C⾦_dzjDq;ĉyYX? 4 2~iCT~}dK&hq?ꃨ!M?ɚ=FxMl^N. LXHK"[:Pc WdjBrL/ߠ,+H@|Ўi)P*8%@1=r% u CC|1z/DA^ԩnN+[3y*`ئxACL9k #n\%)b y$׭y4=))Iq1=rB10xW0QL:RVyl9ފ%ZQ y4382 ~F<։JU⍂zGI} fTJ<۟Rs#8M0%* ̿23Q&ALr"ű7@-mboE$`U)@]uD?TρV2e37nxgEQ20I)vb`.ق3` o<^ԍ g>XqwNL^CfN +O IԅV1FVpV*[10 "fEKPK6N5~GO)4~ IZU#Zg1rZ)P u`Mn*"sdQKGZ,::2g%*X=|a0]jĭW_V(Z*1q?egQ&2*P[Bż .f"(/;<^1<`*2.(>ɂow\MRXQ{xPDJ:8Q੷=<$_LK* qe;H"D/=sf"@x9T*#ڢP  邒8t2 y.W8^O&`1ktWq_\q /6r}l6a:`2F7`QT8zgCB[-5!!켢3Ԅt޹1.~OOG~)Ʈ.t"u6TQKZ6Ԫ 3V^r'bnKJ vk5:>CL4*YoLxu⭘,=)Æ"f2 V2W$HsvYu*"I|f%,K&pRsr@]6`ҎvrPrlkPk`v*Ξ>X@L9Z uDj mFאP68v/XMQ[$P0;JV\ lA`~eoO>3 8\bhet:]; g? 0[#5sHԏӔmAi310`WN& (PemK2qj+ `yTlûx2)uQʚJYZutC%"o*ql&E .)(drEĻg'daf\-~G`}+Lzb7}_? )v &C| 2k9@D%dؔNqaAr8:ef`Ky0;l[j(nJFξd/Km;=vB׏lO!@_%TC^\7;ʁV2q@CT#yNQy@zcSd2 ,`y7ȨD/eGB0̊Ɵx-&u)r !dvgg'2[I-%@C_BG㪁 M Am/iݨVYUL$ z?rFⴽf$RJ^iOfB3׷)=\q e7ԟGOfˀ1hrۉ7$PeL5#tލAD͖^=k}Ö}\{G&uJsݢ^M$?ZAFh[CN& K;~OʜD  Fxᖖj`1h^&c\UۑDPT3ط)D!`P1ɚ/x3Wyd .5zO5Ɍ mqqkT_`2%C@3AUjr;cqL̢̋ぷj6ܥ3ާyڥSn7YB㑞Evs^`pAo4stA#YB(_b՚i5$y7dm@ %$ŭdDՕ(n ,zGh]%S[,楢J*]X m?%Oe.3Y 3w{ZVHv8HZ@-RG򮵊0ځQ-jw }Q:5aM[3mY.mCM^r=L{ܟiNcS~0Pq>h CԨZIj=0, >HFSi[300lcP'T[M:(.$iE*IɄ";ѡՀ;,%uכUF(t*R=pnOygH(>1\4~hT(wNoƣFf7ܕޣǷA_-=YEwώ!q1@svs yZTb׀:#kYn+~f /;Uڸsf&g$tTtQQMC҉,[udBwv+B¨`Gou83!sw15ʐl!fL_UHn e=,ލAʨE6/ [&}ɵqJ+}2(9ssٍ8G_jk`(y6)7 .r9;>PCZΡ;o^~5UЎħb(vi1m5fT|tiQmiؓ=L'&R9VK¸Ha$52a2Ii* xjAj-~yhܮd@%Sڏ6$$aW渖yf/ HƂi=hx4qt_EfNm ,קMTu ~b< o@P kRycsjvr DuypL\ 3k5 D}2=XjԤգD~ciSnŏWq*1p#/&weinfk RyI-SP'\8@USρ|3/{SxI)>ceOCJ{ISE/*cP8Zeůs jp,;B=5.VJv.tEN0Gb"o dH϶yXLMsA>%r:=j'KZ ]Ȃ}]|-rLANΕma%R"r WѪiF Pv4 m˄/ł_ȓ8baMp%RY+H\C8lOM4W4;W80Șw?|̘LJNx#ޣ1/&Gt@ڂᄀN5 Y^KQ D9#ub ̗Cii;mDj<Ϻ/j2^Oܻ+/Fzvd6HeOWa |v+e6"tqX}jRIXc!+Q;O}gTb_KMj5|$ߨꝤKb$n.G_}@y3H hL]4J$qMs$7m\5ӟ/_e#P_jq`#Grs$LMֱ<"Z[z#ߔf)~.)wzQ 4kV+5mCj/xwқpdmD8`"#ªv9D``45hY[`?t'Q.?}f^s0ه^UY9 h.x4 XF1.=75F h^8ڷQlV64tjVF%qIQs/PA?17>MPHA&6k)-yHpֶͅ1OZt "".wstv/fWBXz4+>g/a|";&̢({;rW|[%7@)h@#3[R`':no!O_o`78%|ډ%%ۀm]u砷_30WE F60"UգJPblp^%bĚ7{T#m oOzonU6\1IV|S0 \xǟN*ۋZxa.>`oYiZi=+ف_R!LMurȸ#:`;@@QBPUIg!w#y ,/Z6#>_Dw9 mDo`ʚ!] dYpZ.|qT$c=wz R//U"tTv?&|dHw %}\NkvY\\}򂲳_; %#+@NO< Q>xqʝ ˗2Ԯv{!{1aCyUgk>Vk9 ޔݷ ElJRĈ:9) -=}~S0,-C{4m,23Uo@BZ$3x+'"ymJIðV!~$wϘܡP}c3{eӔa:@}fT\ٝ(V"R-4Sw#x@` w3lVFmZGݴ-SRW *ֱ|T3s)lH^ʸ*>O4ۮ:Ѫb =Z;$>xpDQ9V[5]9#GFly얓7gg JNܓ2ۏ? 1-M$[!+XqcHT;tPDx#2A7ζQ̭܀iK`Fc{sFKz2-F8 >FtfnF*ݐV ڨ)+&5 Vu3Sib5ҜG|?z 󎮉~p#[,Y i @rM"8?;u"`~T~akA#iGNRY";y>R/{1BMi VsJ"vM;YQ4 L+Bb׶9P|pJ S?jj5bz5Bl+n :]tF֟ wdxs3ت ede;'"40| ]t=Tק劜&CY- ?-18*^EP^v]>u gy-bp܅3֟&g߶aJW#U.6O(x)YùIp6|*ڍ34LIpIەOCfR~pH/v [yյޞ,*t9\)h=~H oӑQFsU) L*~}mN xXV̳h2"s$ o^ Zz}{~z-R+øFwqKG%eJc]C wb7I1E8/-%~3ɂ=+i|M-~C%8kR<Å<øx݌@N@m,5Esmka|K/ǰ\etH9s֬_V9JO(>+ <7;+h#t32PƔx!nۘSo&k)@)G%qjds5M~TdKq)nsXrZB! ̞c ٷ_2~v[`zNr 6͗&h4km/ /eMH\6d>m\(wWLzJTjzbngX 7M!%0s) zyp8X=G)YofQ-nJ-]8$ϻl"_b-%8jQ%zԌnư(i@ϲ>z,?u̸\FQh} .|a𰡭tEdd!ݼەey3vmRrlMMo`),4*}'ܜhu @geg.D p茮r|T(Ls1s 1S`XaU6j;4PP$*Ѹw``y`7W*+ta%Wȷ_`Og:LA`n^,29eSSBzeUGܦB_}+ 9xf8IG*;х`B AuGq1q6 pM6sTNY c 3T\V2+L*F9|l hOF)9SPq(Y*&.`Ht*2)E)Ӌ {/HI,o XcFt]T`J~:);%RF9?ܻ#yfn9ȸM4}6~"tV01`H5N~3_zKT1z,/EXlݲt,*@%+bΟB7pzɇ.(`$MzObO{' &$&Ei"tREx5~4ٜloeO'0 i,^n@[quAbl.Vpu|5v`B1žeޝQ~+(M+^b%uj\_۬v aqXXf ~cK+AnB`$GanTW }&Bыz!Ɉَ:eF]d ghH= Xq3crʃ4ʫ;RJ]"Cw],\,բAV %I_ `M>SicgVa8N;TE&\B EMB훊쩟m WH)d>gSͭfa/MIw+sպ}I_PO }_/cY]Z(fZ{\Y!7Oي0x }hZ &5<3ހe%] ~c8w  oЃDsٮFH4ӥǤdTPv*A-y>ciL:DM_5c%DӿEEeC^)q?n)OrVQ)y1L(Ot$$&.O'$sdp(WQ6t{8|YzzQWV#8e.uCh͈^Wz~@Li#ьMc :,VpDHQˢ_{iMhk8K 8;fsφ&ߗx{T%Gv/9F{k)@e6p߼H+d2d(_@ ૉfid,Vl%nĴ;,5zw#]/\Dz.g'xӇ>10ͣFF"qoʆm݁t/XC-kx9ȁƕ!= 6KmS`z+WŒlپYsi"Rp{A OB慁(BEsʂH^Aj? vv@/AwxJ{l]@k189qu=藙!@S K^a>4.%Yh=aYc\hxxvZhKd^+С'VT @aKpOvۦܤ)a^eߙ;TMd79Z7*j]\dh:'כqK5h&  8JEw50Όi)i*0>=X8c?ܘMqKAv9QǼn<,bX14cr0?HwC3rr]))R읖[k&g]X#؜͆_z_3R4zd{9h[u5ӿ(Ay.!@ <=fOEOS9]9h>`XL ^[yV0a'e8l0RMC( k}~ DI&ya :126egsTgcsM&L3q=azM+ΕJdm ޒf*qřOC6'n"}:{( ޠ<˄\gPyo%,?UܔPJFmWm`ܽWlDW k:T6oR]kl6_fpׇB"o L."@ՎclsdpĽmΖ[/+<Ѧ=c`Sh$}($E)%'Oi2YYcr)lh3$b m)t jg)n0 h3>m>QFs@΋3V^ES: "hQq +b#t?Vv Ze~tjB*{oBD\Ε Bihq,ozseȀ?׽LmI2 _$A]slsxcxr R+ tcA|i/-d)$l#<КʂTq}SwNvp,'1c xd"p {uԅN) ch)[62rQG++ׯ5.둾KbτlDx TuԷ`&#g~Kzyd)׋ BSeT~-#EL$̔O]7,j <Ο"_1♹[ DkϿ6}[s{}K>;Nɑ "3V[87h'˵(⢹@eaf>57e[EI8H9F'z7Cެ.δuNYF_G:aTiTgt~ Yac.bLv0`8q}p{58PjM#a#4>EʾH#σa9 dtƍ/xhR޹Z8As+s=MزQy.uɛR ={|QKf?]"7l!Ѭ!*#w{s쑑r Dx Fds1?\Oƞ}`kUE6g fʨћhC},<[ao[&":.Z]Et΢vGa:jMˆI}3,>jFJkq`4~\@t7,`kTg㾉ɣԢ̂e^־#YO3%sOq4~\XLR>~F.@}.ADܗhB4@~Rq=u*=.<%RCkG^31ƬtĢ2vǸs$(=G%0B>-f`.>ޜH'rQhH 8 _-Jkg!_U๖{I<܆fmS9 ܏6Гt!+mYanPsxtmu1yQAImwjк},D'#+._5*;2KȻq07y1= iC0nHAW{ d ߶QSb5s'mX Ԛvlh΃jG+C=_x]t~LKaUZ/Xe×OzD_jY3s\ !9SxOmh$U%L5u+)ڷ;;3ySMuq[ 6=P>5>*)?Y80NaRF)װ L[Ty0JGdSs$ ]UIYTsCkګ5N.V]ڛENJI@%'x7QR5|/cI[ݿ5P҆Ryť\eVYsTX~A Dc/gS (L\'#9\eqrt=cG1rC(M6^>ˆ N$ci#U!Sk v`  EaњRG^N-᥋ ۿŖ/ } oPJЀpPFr4o u\,^7l{B!FftQKөEo#ȃ8"2|E]xw&9}C>#B툛!4G wTH q]wG2~ӅkQshҞA%qs-3»g^"?sOcίZ6%9 JՖJYsye?{kmpd.Ԏz2ƫ2"\2:" | *UD ԝPˤTN:!CsGI ԱǢH/妛Qtv_~iҷ͙ℴm"2 K80^8q3zx3XȾTi#7c^0 $J<)@|m3%8 Rz [ ڍ-m?=1 `|&*=.a}0HT-['%E152k]ETY;nWzwqF7[D - ma ݳ )uq]%+pDeѷBNc}䎧rbZK"oeWk}ʄol~ZX.vcUFl`SBp=HZpG9]A8bn#@Φ7JUfbELDB$&uVsfHlBDsο\`?}Go3CN185H I[N».WbxJW$|4ZGӶ{Ǔ{qe7f\JwI# :7=r@yYT @Ɂ]ŸHVa4#~"J,`Šj*ؽY,yP2 PTlMz/;bT„?[Z$}Q=xYD7'Rs!#MmpNTV?RRu*mu NR1׵no5 0n;Đ&[MGݳ%AYSt 0͇z7p a¹;7+k%ˑ)wȈLl -|` ȚǢ|yWxm$»Po|-}q5tkYXf89؟V%nL4 }4ݖ=ezO|j|[ $e 4dv9[(4BGݏ- `*v{ fcM v%YlN4s{@&!8&IIYd_njUK039A_RW@c*R@n2ЇJv@ ;--Mg#?KG#E K@bpެa\_W>W.vXEd5ơȫ]{ H+UMxCdg~jp,;7(Seܻ߳r R&懙rԑ"z?%˲.LC*J)5&)(mtƛ"u~6T`ѫ>BXF\Zi:hΛ/fJGv %F44^HHv1tV 00j/bF^XԹj d-Pg&Y'8E)?F `"KfnhxPK49EC}gPNhl[񧡸mݛU>'A*|WqXPfB._k,̻* -٧&ip>K٪?TY MQqQyդ1@V̓?4%|~{!MfGs}x\!Z<Ng2>U_?d̗p~w9ݴV2Ւ=Gq${sC'wGRGRٷSN_ZY.g7c]㫞J5Tczv ̠e)[ q2FVCG Z=.Kn;!B×j?htDo[/=/ӓK HuX-7A1|X)4NH<㠲)6FL%k7q2Vp#=-|;h;v$ŀK N̢- 1wNhwFZ}H(ТG!xMk" I&4J)&#鋆tVd>[ Z';b1N}B%J~P?E)ʬG+NCfЦ4DŽe!$ /=UH@S6Plͩ`82$53(gnºҼOI|sVYkAmֳer&mNtt4߆HoM? ToHWy )? i Zr&AzuV6_m^E]C1mԟjUE0yǜI|jk(۶FzxOrR/da{O C9.542OFr/fH+GڕS7aA m+Xs]&Z--O-%X86qQDm?€ji&b^Pkh *1&+ޯƥ'hY9 1-Ȥp˞pY+~;C$~u֓)|;VN]h踐dĤ",yj:UXG A10׆B]ϲ٤;1 ԊKҞI(^XLNCA΅Kk) }MAo=[4(Bn3uƗ` 1Sӊ%g@*:HpXx(~e7A; ܲ_SSQ_GV;\Wht j"^kQ&#Lb|"ȹL;^q2܅C"a}z"q@1/{.OS(EºHG-4&8PpvHU :|f/*gHKe{> یU{*166&'N@Clx[_7,܆1-'8QLA?^%yƖ);)/hA06GjUЅs^-GVl5 ۪4謭93{. њ֞&1+Y-j*15LV%rWUt488v=͌7+jZFfym|e}"hw_/B d‰ZTv߳\Ż~zFEk\m|#L!UU#>Y#G D) vnH3nأyN0: ?D3d9^iB' 'DțDyo=;@Wfɕ\D[zgۺ(Haɚ:K=vM!!]1wpLY݈iR%QnxLC{VJ *12 *xk$m5G9M( WSbl'aJ-|/͏9 H]f>%[3Yy )pmv*X"$$ouOnWY6eq!\\z\?1pWǪL* uoUZ״1ޗdl~ڈfzAǩ56s@E{/_C=SI"'`z'I]w6QL~m;HfuXm T@yK{ QB#ʃw6xMHd ;w j}QD&CVunZc/|sj# GH P1@cө]! SZ|`j1w{w@nS.Lt'D92N~ݨJ QV=;%[qs箭pWV ~u!Fj~nr9F/E ٙ\*||dِ ћ8RgCpDU{>b^-4G B_CyRz%_wowe!k]g6&=Xl8k2F&:몣8On |VQF龥 i3OAf͕4dFn Gf.cs([afwA=^;^,:6Ǖ`صu甬Osg{~|u^RW|}Gž̄3KEU *S>`ߖc\L1ю,#c MԢ$[ Rehp4EsNŦQK6\"̝Msy) iJ<ז,$|9I2ư+Y;u k^SwV^ W#d43l( #]d1r<0zנBO#AVɵ m t%MtNg؈ m3NѶ'!/;J@~b_"=ʢܒkΑ-Ip?|\/LUk)J_ɶT\M hHFZH!R  I.8BqG;lؠj&Bv*'\\2x9%08Ҿ (V#"&beru}l:tb1ϷK{{rL߭ʉ(Avd/ pKhIWE,P k f ibߪX| g<GQ,'h&B Vie4|S!hmh-a!'N.d'͌-//ɮ(sے 1;o"9.f&>7?͹PaYqEJ4H!xWz[82I w_GS 9xdI|1nJsAYyL?/QV6 K],D6 jn!zz[(qS Pzz*f Nv/iOheiu6d{ٍ)wEZƦ}`GCGP1٤p`Q)b64/cp2ށ*Pc*'NQXTl7(-@.51{Dޅ@<:NXH7JS4u3mՊn?.f4Ϝ =҂"fa;m!{16k*kJbuXVFL#eeZ {k}TLG m%pm2&G:U l?H4wr.bqgʩ PR򴗛7b{1-BD\"H"ޓ܋ 6a=/7k(Od=X-oSOT!kSf7(L A׻뽞, #/XtagⓤJ`%ZROL$WqTLT.+$ wz4]uJ 8bk5ͷ6Y4x0Y=msܜ}xAS's;wS?T㑩 {=#0S7y}W&WTg50\ralPsidf)YSvWt О)/Ѫ.ZZ*9g0 zafNX K3M>2䐯+QlXQRgBCs'ש:mj-$5uk4sEyrR&(ݧay  :׏#:~-=ޞGru OS1Dj‡PD'8 #f ` lػ@͠rߌpɳ˵ 7-1ʊZ(t@ -`Z@nȰVw}yV7A?$tוe$e1+au ˸@U/?NY?N0%^ؘc<3pGP:,HIy3ߊr:H1(Dq̈́Ypkp%RˈecJHǯڋDy'Ce~V#0]_%dȪԗXѳ7Jt'̢a*lU}Z a>˼n(yA V{Ǘ Z-Z.S쥲(Fj۠3KfIP}z }hlKa~8Q!ᵉm^YL+N\oI+O,K4ǙFڠj)P[m6cK pbVHwetd]o'oksbh\V!l0Fxl^;cG`ɠ}1S)57]VbqYH-0|){gs#; gN$C 9ś;\55; gZSڎ+s}m'IX;LZI5y&GRʥOdZc%6u;7wLŒUx[e/,șUKZ]2a"zϪʯL6, n2ǢTp8VLX(x!Ql'P)ﮄ<!W4_0M3JqbJfćZ%JL'p8rH3b;]< X̊C^ڋSId7'"dE3f yi_fW|} pЦ@2n?5Ulb-XIU9[crtkҍl&E/B:4w`]?B$0K?eΛTbKS<&<RGY">|-J͹kf{HOFu2m#Q#X0He 6M%Nq, y)OJ,&BJ!~3J?D u 'mK+sMCkE4&hN6>fhcGRh1FuucH@X2cLD!rlvH/կP~5[d M4ܶ, oq b^[Wj~2Jrvݵ8n61gi*tz`/]€xD<8rYe ʁ7hJ|d TalnyrZ}$v? (V[b PZ&j|fx f-C._jl!m蚟Yab-O}W;YH+ɺpT9J"O^jrx`²T$NԆ;裏{\igۭ'Y1,1)g{y+Ǹ~o FL?#ǥ)vFiݱf(-J ?/H׌X*Y.u{&szV&{[ëCYsE[MrlzWzKQ)RAh6C! r+#&鋄m {Z[mqhFgvꉤJՈ1qٶńkٱ )lIa@hiQ,()h!+.%ho?y@kx|?N߲hp5p!0~ːZבpqCQN:Dfd>`x齤M=%\)2lY1`7bZœf,r6@%>Ŕoc4)A=?|otLga5SصP.@ O6f!vS9x#,ܲ380.;danɞNq(M0KkzhdA6F[nv[Yf [i[dF$qg%M;Ca u/=p:MIs?8I,dՐpH+& E8&@r[8nٖdWp \i^}芥3-KUjL䳘uL`ܧSO^ n._Rbcsۘ-#ǁ*wY`0aec .:{ÕygJu"veK_|}}"y +&Eei5lDsci JuU۪04oPfv J%2߉[?վJ*|@~/bщGY^vJ8JUSc3w|]CkN?gedթ{;do qӖE02Ϲbo -/8-N׈|[~t_U*p?vACZXqT1LIH_bZ'qgy-'2>wvp HAa {g ;=iMbsh m!,Im'mbH 9\yF*-4NΦ73بc~쉛bs1w0LdI~k~S4D; <+ ?bDIffl 쨟z xJ^k^|t}grG릿r;,5fB+AzNq|7FWf?3%w,@7C>@t%ǕQЎ2vg.)XgϵSけV)=Au(hlӃx k]I\F!tS J{ n%ث[K"ؙS9 ?.d>96zz -ب 1j + f;q17o~SViC2۾ev% se]'nRǢ6<@ǑW#]֋Gz+extwҞ5z'#}ԴwTC:w*Hllqpu`9ͺji-U.\/pIڰ$*O68TrCzzA KK  y:0Wqwf&XGɷ]S.( 1_o%\h7 I)uWQHDW),vWhG&:=x1S}M9Y2t+`>Fܴ!B ɏ f)=ǮfѴCmH:H@aڸ%Ufl63a8%Ͼ4ѦJMkf|ҹ 3u |{ .jꫯAo7-JrX@hM_5d$%+Do{I. kF9u1Q 2=u҇y0]W'4e 6pޗcaٲ,9:zUj!- I.k 4MPig nKgx-"Y !^|ʝFe*c^s9ђ\t(kf+øV4?2gx^bN (iȷ5a* 0&.jpWkrf$yVY2_ " gz/pd~rѲf,44 3v7%UFsʉ'O O-کgn!+M?셔~Q)cݷPW?9YG){)ﻗ.2 Bը;О#!xdtBR|YFv"OlXO't7 c2r*p(2C|^-c%xC@m _`Bc?6ƀu(Dqj .X8E ]X$A=sH0;2NS_K8ZͳS1L)2[a "ܨ&*ps{<_^(o5 d[h+3r/OU ;dw<,8-v  &a0!KMuW/ٻE!< xp53oyMN?Z/hR׍3_ʫs&J6Lg=]jinDٴHߣ,kgDh_?m?3|w=zuS  w(13k"tO$x[UҳU,Y&mPϷZLօ&Ђ;;4*9g_}XtWIV؊H 3MP˚q>jba::t:#S`ٗB)k_c,d3\A߄|h8 P駚bCd+1#Jķx6 #i]^SHJv~y0d-wxClmX2oN 6"KAHUÅR<iQ{Mq߿>22c 4LoȃMORʆLNXt)]J$DƪEu ѐ*<{j-Z\7BKƆ#ŇsyG"c|˜ }(+|Hn+b=II3-(kb4Q&OY7oX8pĘeՉgQ74a>~6.( vΠ7ipq4ktB-U=89'{GY' cH^@gVLŸa=P @1Yt(;o*|vޞf} |'д} X{`F$.Mv-L:5UI8qޓ} jt%BwDd1ge€aj~)$?" 9Z 㹢6b ^c^#>@H 2OzV~ϐY8{J3*^724O>?/tP2nj^J *pQxzDKݼ r[JBWNOq끺V7gwrQzGk0XMp'UPyL}oΰA@I!+;[X'&j0҈Y;S5O <[FJxVnITYƐK;A]43  6'b/)Q@Y˾h:]~4IZ9ln,g*;Ry9FM"6u o0.pv;98t7=1?RE }KX2RПlHNC'=;chJANnN7ٓ $$ɡNφӺ)s/!1+FK=UL1_g2KT?k(BTEO<3/۰,/Bj H'u|xhҙ~gI{aCJY $2 f:,Vnj;n7b+O1uZ.1g U{:GҚ@=u~b/f&v*E4^-Υvkʸlff~2fQ''J/.!sTZy7sr顉P>,z41:jY{ edȋYi8-ڑH _mxIO*,[X/r̤̰ArVqq,&uo0UfQc}Taԓ m-xi %pB(̕*v|A?]͛R˶^joiA"B{D4ˡuSHR'{^wgl͸EEosd`kwz^9l N[>Q3;ZcH6ڢ;0 kVllo'.Xij`yAY&.Wk일mހCD׭ṲVxуBMxq% j5c0S/(~;Nw ;J8JB g~!Q&zZnR=,XdXEo0YȂȫTpqӺEc~u360O>%Tԇ+7Ht$ɳ1 MnT7W^*XJ|+)@ 鮙xf_\A(۪Jpawi;uAt_/9Yɜ0c?Q6Z/%eU*Ls\3XgS(tQxx8Ԁƀ7[f{MS?fFoTD'C?b8 ʺXЁrJXQ 4uRwMEvj  -MK8Nڬ#v ޟsi q',bP8,AWByE8ijVP6 ZEy b|ѧw 0VYN}` A*ßlGBKtp"1,Β$,o Rz5G ӊ͉N߫ulJxᗏk.X^T~ƾj ƚjO) b2gB:qk ˞d#mn[h4O!PeS.=ݧ+hW]$/uipѷ.yQm\Tbl;2 *JNos4Xiȕ8 ͒rbf_']\vY.mU*Q{0FP-=31 h!L`AG+uhecЃ>-D2UO{ZVjS;- CmÆ;+|io=^w٘i /,g)8;ieh8,{"ѳwSׂ俎L8œ w O(g$c[DiZ5h-jVD )/u7vvQp3`5$ _&B!%qzbFEoX,uDQVOq0Z<\',IR'^[ Ñ`{BBlqW\x&~֬@l(&aX#ф,TRPK^ܩ}^҃mc05p^=ZaE"AHC9iR~^=b^l AheA]i, !P@ږ<6u墇7 9|dNr}X8 KwQM(#/.Tm6s}PHbݴ`2L ؍jL<ީA8Zi&i#߻n :7z]RRfPC05NFlO\Nykyn5 db >FiW3HMRNI wBG0F5UEV q=m6 D@! l\4["pAQ{M]%nZ˖ 2\rX{+g{of" ӊ_m#a<"oA0}p@.%Qdg-XUߗ{`]_ ɭo J޵. cz`y-+~TMK_ld]xC!ҽea݀ʾ;ш n1$;]X˯VG mb6&4k˷# J'p/⑻_ ornHPD֙Ӣ`;NO1^",:ib~[-Vzlޭ6# Y?OLf'I '9yh?tn+zB7{ƅ9Ҵ0\l#B!hX*Ԯ֔TUHG0̓Cc&!=4~>?,oHXbcDO7hz+p_,xNa#'MÐYvI|a1xdrR\d6.$ؕ @EڥH`}|4lQ&-p6TUs܄֊ȟ= P˭F@'Rȥ%Й#g!܈VU.TP/BβQI{NIk8^__-`м B9 Nh 5ItU흕Xٍ8t][ <XO'`󺀋Õ8)6>?}8'iEI wox|9xUڐq5(l49*-22vь{i@,cqV[JmS*J^] 0%:~,`j! .BBۡp!{coHIoguWBԄFGeZkJuo{AGJޙvǬ!jeЬ3`Jbڝ[8BC*zqGTM%Y6dqln~ƀ-]w )eOR\-ym]:m;fV 2-ŧLj=0.17Z7{ԛ7vFuɪ&Żg`$S28og{/ Ww.iŬۀ5U vPmR8T yC.YkĢ̾8y+;:6T^8s+: KL9i!=?Ij|*p|KZOkc quk*_iHd˸Q(*\KfBRTTBSM~t[]E;]auGY'Q#Do 9~F<_r_N}Hw~**tHkKnx1B E?#HfwҸ[P~ 3T88UtvӏF~+KVCQ|ePϗSʾQ4\lJK0n\oJ e{SY|v9R0.NBܷ !3U K4p} W˧Ҳ&(9x$|@B>)ZzDOC|2Q:V߇f~//4cϒrSwJ2ja"s 8asM_0Z Z/F3~=P%'JQnAn8z"7W;"]lfKBW 8ѾH $\:#-Ox^@QFhGENuyun-7>0{Xvbt ڮJC69{01Tq^̃O2*l9 gKDSU@]? 6 )dVO!OeNEH-*{'ӧ/!ޮEY#K8DB\mhjU <ͱ>)V,-N4?g[k)sqXa3⃇~ Gjd4P<4Eyn OAu/i.k;Q+}b_D5/קOYHWI(DvH;|pO%Rڷ/ hicr [xJnfX;PhsvWlJ"_6eqcb<m_K+w<`pWɴ86Qi%]qM=%ws#`z[j>sIJk'D~ ${{hJQAv_.Ά*zȜQ`|bcܭ49=p+>{sY"Y ˗r Ex)&ngɼd'GIxuɵY}5Xv7N;ys &eqMO쬟+K 2dT '_^ lps6٥jռ l Yy c6q(Y 1㗵)?u^ kƗ$WpBŽG;Wy?\m`l `x_d&)Ḛ \ bSBg,Ⱦ80\`nl= !Z9)M6$|\Tvc!{"&/Y+N'c+-$:*gZ;[(%RD)l(kolՎX`fѢ_@6b=b1,িSNafg20-HTiylޗ+d0L@)|laU=&*o6 y ]'JfZ8ho'/Pc7,&XTN]Xar_ fXޣ<("6i:Rt+ו;Q?ge wc'Jtꬌm2x]@0ŞRZklG hr6VL6BWb $?>x`99Pˤ~<l.tfӺ+(e$dN ZAHuxd(N)H!LDp3]{X>?c g[|e^ p~֌ǯSÚ~)rxcqk` U?#s. eH1e[\UB7yu!M;[?!pװ+١Dl llA'Qg{ځs|('߼=^➶Ɩ/!"ހtQobNeAQFQ`Anzf@Js8SM&aʠFדcֶKH uw fgH t^* ,gǽ9|YLyiT59dFyla<GoE6~V >sLuFZMyuw B1EA:َu,2~,DHis*(V ζ)P 8u.{PE9װ ᅱi[#f霠?lE1"TDՆԔ|k̪bQ\WhY3?L[Ӓ_Jm:*y_t2=iPaLoP(V1{B!BIg`}a6៓&w_^6mϫt#":QqGA眖cpWNԐSN;Odg1S4H$XaPGodvYs/}> |XLQXx¬c^0JCB8j @^G"~V<vx  i>7W!RptR7HڸA ݷ6\T tX8?淽*&#ZCEnh1#W>A :#ht U0bSSi(?EߛSag8{_r\~/e/aiO\6}7Y0Py TS*s?ږ:1 Ey ݸBx _J\+}qYk6wv$֬\I/b/B@-$HJc PnQy!=sQЮ2ty"Ⱦ.'"ջ`ar ZE9#[kKC^(4. ~" CdzO۱ݴJCP;LxvcEUt8?U[jzTZio{ۃ^BY9u!P%)WA2+h>x%֩a!}4+|T%zSUuBD֣cf0zCT#5!O8^r*raQC:g6F9%팾jhdKf'  <ǃ񑻢})S[8(XMke &+%'uqAudP9^ʊe(ӀXItCXKF#mp}i;^X %FX/myo>iQFdc49hڎycxeBmGm+ԨCwFp S`EmTlóGb\Pec I27"^y_Q>«nTi |bstJn!|= ûpcz&\Ly33ڈCm<6|GwHzЋ[`AZN^^M8KN,& ܏`.@} jM, $uݰ^;f}D o+zZj( ޑ5^/Rc<"Cfi2WQ$-RLWv#I|7`0R^Q:k O_P|Zn<߳ І x~8*a.Qa)_ۢwoUǼfWBr<.A]0`")f7Mo͔fhd;žP>'3Ȃ=6+rZ.*VK50aوNNCD*C2#N80̦",Kv=(4ی>fG|5b,--;Ǜv緕?a!_-';jC}%e8Szxֳ⭍}PHm֯,\ߡ,6mv#9٧PaoE"{jVĘ\c+ueccV=+BoD[x#hN՘sb歸+Y_&-HMjN Iy"kZ< 6uP?%j-߄7\kb 8f~͚6i2ܖ]'\)+5sȻ+ctؓÌ Yf1G4̊"OG(,;= ݅7:j U"+ FB<ގKn0dRj*R+hj*य़]%֕MBwH:z< 8S@iUG_p]C3+$مxJ2 y.|F;YGRiKK`}Urf׷·s<'>o\j}2/ R"VM5nr6z³0uO*Ͼ0CErkwʁNX>7.}b ۨ4f^X'}ɤ  Y._9%BmagWL MɥYQR%auMOgŢ]xmNeC%] ͡%(*!DQ(mo.Wʋ޴#8rS\kO}{JG^DC.rPJ.j ,-:ޝQcRǬf %:O!^p _ }Bq:g&sS ԕ 1eqCvF>M.M*;j;/y%nV~zi2qE ܎z8 pn+4m )9=pL8'Jڥ"JdT/qvӪ࣯0<4)Nj&o,uNI C*D2~ā]p_oipP{4&sK/,k`wx1?i6_:dapP1=^&۔QpqEK&0oÄJo:m8D Fۤ-)/Kٝ1c\T%Yr /[[׋i]O0ucWWMՅ+_c--FTQy 5fnAl=Ѥ_{$$ʦu8Ɠ"D;-Pl5w 9 %Й菆Rc&%` Ny`pDhǐ빀beCE^⺃wĠur̠xBU0ݍPAGw`=qLi+G_Ȅͭvmbhg pp ^ʸo?4A}9EƲPW0UBa3]H1 W[oIơ ]Bhiq1g>Bٟ-5.DwNG5i%:D/E@,aUqfǮ,pe12N7R6Gou6@P,X]:"Z=n!+s9ˡ#6N isFp| M[)ZT27Ԙ{ \i3G w&1+Tͮ?<^OK }#E(@` L2u29+Vg֝{uR}ЀKSǫպW$0IM 7&kIe- Ku{13Ymb _^D!8֞uɆ]vC~ȼKG&k5/3vOT?b!3kP WG!}K;R!;i](xn7qZan_^ib,gq#-WE!x:Km l~(:| yɿې?yS El̕Q4{)JDNpd/к䣜Pt ԑuV2',,6jkIEfzM}Jb7}e~ QF>#yɎf v#VX}ϯ`?Z|'7N>( ~B鮂 n,[2d ^DH0( ;" !n'r&lL~$r@^`+=7%o{3~L2Dn;-sT$g7Yؙ${"W3=xo8u|n 'Py]9ȋ~ޚl3 U&ptyfqr8..$MJ+Wdzڒޑ1,yShag޿ pQ8͂ZjOMlͻGnPhmA+3ȅt+bx qA޷UyC[B;{$CܡK~+J$NRY& < |n^mRO Ѳ&[6@\4;'vWֺ8糅"FHz4F L63nĀs$Xz5T;<-Rų Ɠ[ife75pk ԏ?C!|}0!`⹻ݻt h̶Ve{M&[u!b=$JAImHߤkD'{NIHy޽sxK쩫ޑdV ^4_g䳟oEBm 'm"Ƣ{ôIer#z]D3h̒ ,UyzDuYvQzbv1C(')azKk] sKMD, 8ZnԾgAl ^Wxw0;o[\*5>3ˑjԒbPmX1joyVF `J 0ZHPkYn/j9$Tj tveq}pI[[ V]Ϲ ؍<[ha^. 2˺ȷ*.HRqs3p1<)+ztY_뿻+O1anySN0PcNl腐) v.W@%vBQ{àLugX̍cz{i85!mHB""w"Zx۲V2YpW7{ ,5jǥTD)DLMpyZ[|ۀ4w!5 ߮= %PZ/OCIǴc%fPF`1w4|+(qp2DQ L6^ ѨǗAlWy? o˿-w}oQe{<,|\{{;^%$kda.G3jw_o?9ًѓM6,7T?'eQizE1n`# b X@'#D6tJx2K=~1ǒ »qɊ 7^_h#+g=v'x ʹ"'-D{h&;zyo+'muB3bkiZ qf ܳQ$+RVʯAj'͵egt p{X=>W^bMoIp8CXO,8௙a\F!86]k(_M;k11z[ }Bo M@٠uA7(cR, (DĹ_EAF6ϊ7+ akƤ`P G$22iuyt@~JbCF;9//_\˨WH,re;tplpb^3cN сwU9 ؄_}7?'m;h%j)JVLtӦNsOt8v}9teVLuA.Vq'/ie*.Ϲ"!cH 5A<+esPh/s2B)zǮ1Q(1mX^:lճR}sk䰋?1Nʢȿ^`,2菂>yςcS)(%ZHlHfcPC%+08b3lY~a굹D@w W!=|넋e6̱@&}Qp7l7'ٕf@<<B+"3qR67iZ-JElo#R6lUx3x^Tl@j RI[=t]bݶh`#3UU^WSb0G WPa o^\͒d@gϦvRJH(fWo>q|HZnj5gr.L41:BiΞrv$u[y ,ֻSsDb9X;rI8\8nnQ1T 9VlC;9]ExD'V7<6â-BT` \ҦBR(EF}[g}FYKM켯CdtI:umInPT:-BOyR>i.^1-n4rU8+?!["K}!ڒ!+Ur˰>[_Z?*spr$&Mltԃ 5O*8݉2eP؃`f ).{bu'!}t 5d'\n0H 7F{3jR⛥ohqw>uBLpwF3 Th`K6 F'!\wrݠ~k}?( {,ħ&\Og)%w6TLb@nnj⍌Ҹ> :2E@ìr ڪgvO )lM6DrBcNmQ '[95l))4&]{͘'+(uΆ0AO9 X?e%peSSWZJ״Nڑ>[)A>G3[۵ 'p3jĆa>TynLx,_<ipˊ9㒉3Աg ZK !%@4H92A_9kA:wh; v`Qd>4"فCOL $-77Њ`̓Xֿ2$,e8xD@ä8;*v3Hx9GJJ9+qeiv)=QúEæ"S;2Xo7 45r^&n-8h6d:ž'w3Ik;V^9ҜN${ݧ 0vӦ+ӧz)8_R L5[!6R˶4869ЂԺMd4_`[aWtJSZ0fXVpc| K~L08@&sl!{+0#.W >mCQr̠\fu킻yc,cИ~ъ!NƇneؐ\ ~D<0w1򁐥gSOMm.b^lp EB+Oz-n{lY_8ҡPtD3v MI?g >,TR!*t]w(X:$Hh#-5!f@0jON.fw U #IJ2Oa>ڕ-CO$✤R[goK(LELP`bHKB&7id!X|AG 0O0_BHpQޏ 6I3Oplf Zg%Fb0Hų cy5ӏANRmh:. Ē?dӪrf:̻!'*:[P(UD zuj!@qCT9 ok o€Rd4@j)*I.)H=*^Mb V Q?~'/d񶯶G3*X9c 4pᓅ1TЋ & &u7>f9x/P>]pi8R9hD u,lvzv:CF~Pp+$8&/F!] w=UEX,yTʙ7B}37N g[+矞ݥs5 ?X{+6ۏIXB reT JorPvy,ԯu$43ڶ1>{mdЊ-rSI7 Yog>LW6DVBr B,y{f"u;[;~uU>9gSݛ @ _ szgx?fQ KYǯiEFT0 ]>(nf7>)<( H흁36@{5J2̧X2(e L|45- V2Z<}Յa^"Oi[oJRG %yʤ>q:eqw߁c"]a_$mɞ|Cbdȇ9rTmy^taHۖkj^ qj#}k#!&].u޾OCX7͟ ?;Chx=C($&ՅA|6~AJDzQ`E\B}׀'PN202BVE*ɋO'1\yS~X$č4n|Y8>/j' \&{ Dxeg܇O^n3P}mbI9*,A8-ܘ޲1<¯Œ/dfg;*}RR0R/CyИÙfGC` lyԲ,&IxSB 9486[\yceX [[xE&u -"dX3@ִZX?D~yw/k􃫄p6 U'wWa 1XHXT1/6Z#Hχ"\/:3S.=wH;6ΙJo, =yvatʗ/G|mSgdmM(;&u2~\SRN=]I~v{=2kJdьx*ib( CL%nb%:`th?|T7X Vh=id% :Qkov_tA u a{5k&~M:V xG)u()jukpp}Q̙{{ZgD)&EY4ۖkz1ivt>̢"d,uR:],ęQ"åeiz|E(j>z8l z~Com |Nh25vȘKoRWqIWI{:Q$\h!-LyF\i NI+UJ cٜ6b-ޗՔ:^&g ķ 8rgH1P\f n.2'$b z%dq"l*#sj(nd+_WS`GZΫ/Ph@%J#yu);1G6ÆO)pty8ͨXOFq7<ᐴ$R, +@Em ""Q@UAը*Δ)+D;R,H5E51Ql6_*0_[2,ɥ SEFk%h顳P͵97M iK~qN,$=D۪`wS)̏|dg)qU^['j/*pKx/.FMdG.C͠ Z)[) `( 3io {pz t-7X:tN"ږ\(@ck^4AcqtﲞBrm![{σ$5)<^|ѱՓ㵆Ma>wK uDtOn{6IPDs4ky-Ւ{ P֖J_x{Tڅ\ȳw`#@)ΐѹWIK_xV .!HZr*QѼ ;n_ɀj|$ WXO_,*0#=k̦zhU)eF+>bSet`O:qNcHZo NMN̕_ -(^u.K~uc&e>ǿ^{ῇ7a˰Z0+dz}%Fzª㎇wu{/yŝG3g~(EO|t_͞OJ]l'+>&O'J?H cq\ ePvO AF xZ"/))%[=ҐKUG8$l_xYTI&$3vp Jp|~8`Qz+P̔XK8kىyP`Src4I(t LLo*kTnoW"ruWk;.v)8Hm= KqJ6R^rW{i1[eR5G k[U+!&&J Pr7}]7'T-Kf}Bd`X`f;jŖT|ϽpZߠC5=@jЭؔ&D;5 tMnѫ&t}h1Y h=xxBm!<DDGwcX'h2INƣi hN2l6""٢жUipES"ѐ^5~E3:Aî Z6uboL^r+[, @.}E;q{ } ش\] L>sW}0İ5J' J6ngaH,oG_3'u>$öbBYgBCMjDҖu8M31>=jVV)+kƑMvs C[3 Ci 2(GiQ Scm@:I`nƒ13eMHC؝6IJYP3/tw]}g:oW p{xV-2ɘ|OWv{sw}605+7_K\On SyID|Z)ܬ -IYwV]o >NAMLi%w˕D?KVW$)k`C/taKē륃+PM4t{#R4 U`ߢKTSnve +ab&fd hd T:ѼF5Ǖs_cb9&2᪄kTI)C!|+n~jnTkX+Mnc@ev<:;XB7Ol:eNeRt[;9BLKI81A5 nYvRMVxpAg-aYzMIv,`e5xK:lNga=]a'zLTcDw9mTp@ 'X5$XXz{YLrjըB$r(i{QYdkp6-޺)jN4SM@ ' PedEoK /@(69 hc>0d8κDg}:,n dDIGu[&Vxm-Cܐ"ҽcPYֺSK&lbK8X>ɵCÚ ySHxD\gW.{N\-"94r*rb \5^O2,` ^Z꒡ 2f<Կ ֹ=)=+멮%AH%<(FI[H6X&l'ݕNHiNX;ֳB2půq'~M,Ow\W)gndC8^K^H|347kē{9ϵ ·˅vV7.sGҕ;$NqmQG[ Z ˋq_(Sf$ȿ%] T'|gkaR.aGiٷ^l4;`+]Vb =hC}:=#bw> ١eL n@5EԵBR0UL=DP\f0lJ-pgaW8](:F?3b~?:Sn3Ү5Ǒ$MwnOgamHc'_B;>N|&OXko? "VsTTҚb,LOB(/o"ZNuDže{8f\C_ۖ6U0j^-5I2NwK0)/̝L/h?X(#Eb Q3N 2b&Z뚞C `.5'Bӎܡe`QMZe6k"06zH^︱v?㑼47w{cTe&lZR^ڑVʉ VC9",lR錘 s2Ƶr#D\cE8ru }@'HȞ\qE2‰q2+Ÿ4;x^Ay:VG|o冗YBBjI8NrwH[YjfH2feasTHK˗PdM,<"}w ;! 6+vM"2_|6gyGPUBH9{? {m@K= `SҖ:+jeIu ެvw;"W30,U+Ʊv\Avq4,M ZV@ꡳVz*,A&6[5Spߐʑܨ_UB7>],6 KNڦ6vs +QvMM\\tJ˽ʢ5AQfm/E9Nø+ ($ 3_\(?Gf"jx?SnPhH<~Cf.3%8%\$HĄ9Mi RZ@n;CkϳLB> W?ډbJTj_@aH?;zAf TX{KH?Fd``B~3mЅ$: !ʶ?m koXd#nwUgN)&`jg|пoL TS%e0-YQhY ^)A%{D sճ>G"Z6gA½n1( zsڣ~9==ާG9ЉE5|K'><eJ!'˝&#v6 1^Hw%j3 j0`%!?څL22[u.)ok\#uNKlFRUu}5`veVw< ]W,/ppz•3Th6Rv MIifmaUgJ El]AIā/Erܤ{RDR,_Ͳr| kј:YEHN.DR}eXzUoSGߢ*FRlN1V ! >zkQ YV="p>(7K7,l,@<ڲJ/IN9`c!SYFt4W >U Y諢52Μs']N)`089ՠ9̨1Se}r a04WÄ1d^~>x|,C:%1Ӕ$W=:xdź'P^ځ|O[՝ViWP ?2g)S9Bd@a/0XGr03TAqu n:B%B'TZDj!4ZJ8i1I½C*έʚe7fh[bHi9 9˝qa[L]5ZZKdKqP #`H);xs\5K&]7Dۈ} o~{6ZH eT`Ύ`=Tc[ڧ=q0OVB丄 ]M7QYlK0(2<շWBT ܳ *MEب`ɖKѨC^3> 0i)?sp5^N=PS, } ^A(E2;e,ΨC Ym#v{d7ӑ1qT#7^4sP|/~@BuݸeLtD5?xvw㶢 :MŻq6^)*YcD^DAsHHDЉLbS-5*=MX%Hņ'G{gh/oʜX_A_>JR\iV; ?hrcgs,JIՠ`z&`T;7UYM'CMpT]߲|LO[y!9IKb]$gxQ^Φqt,H-j(9_d ꐐ̠ӨjwG0I&B8d oŷtR29.8p)+E ҆WF\^P0Lj8\ijt.noxJlֲ|d0*Si(V8yh?Á p1(kK2-lPe3 <8')&uAL1}N&cBkzLi_)+ G4`#UyV(aȜIXxjWF%iQ&@v%:2b=VTt yCJj;F-SB 9%YX Ci# !*P ;/S&l`ƳL$WnS*qQ`鸉]ZѶT yG  ʊ=#XIv⥁iv=蚾}H4`Vec;4`ZmQoEIԢyLe=`xFcs2X-̣Nʿp#"U}+₸q/.-*?%3, 5}OIIdx@u 3vUîH)맳ބVb{[Іo*$M,3-wcVSa1@4;A)2 0;jཎr |h%)bp Ɂ}MEgB^a)շqs}7MaYE .{J({;O r2poXN|ۋK(Τ-1wJik Hz3}!cC^~AVO~uݑ@ɒCcA Mے'zzj 12QоŞ:KN%Q/>,.PJP0VyUaHmc;u'٪%WLntHՐ'/QY _ _z/Onq[k~lifcW'z-),p2^g9Ǥ5 xKudTfu]}:Ŧ,:avӑK i!f /qwQХb)ܰvK8ّSe%&nXF85;!ԁU+&dܫ8FΉPݘV "5 \ oнig@/Uajc5ZdP2ɕrU^k*+?FCWd|pil :92gfɻGYwe'.00d =lC)"O27cP'~pI”Kv]5H)*21lr3"|qt<) HH>b Es~_ǍDΩ(P>Dp,hSqPdnе<3bU>iy2F+!jP"NfP^t\ۃ|4ԝ>zԗ?9#пGo9%leŢkFP Bt~5gՔxꒁ`UgLч7bU/DD&3Ȱ;r{dt!ctQ䎏a9(`d}6UG %-͠r]Q$h;6R7;-?Pf\)Qx@&tOlh'ZՖf߮H 3 V4lsUOuppx=04 mP7v~@.cu\{yS:p繹wؽ5"gPh.6PccyUf:YV͢_߆0miY[Ԙ[$alFn͗TӕhzSNe?p,=IN?ϲӅ iJ̯nM-E/F);)4vX$M:ҵ8 Fh=z 9 VL"r> 263St wR'SǏ9Q++M^rJREA7dH[2ƫZ0s~6FNFS}FIOyj ;7fi˒tgCstOk4`V:cnyD @[i{\? 4nUC_S܂5A¬9@F3Z?0~+ !&G XGyd߰PgQD(;<ܽOoW;b.dkt q;Jyt,xA!gO#?Vw$C6w%o燓:OR{7Kr0~?Y=X{]Ex+ubpīJHS@{mu\H~EhؙO,D &OqsgR1 uR7PwöKO}Nvӥ[Q99W ܢT۸eE}S/5]љ=EzfG<gRżrp*&x.@'t8`{a<:&Jص!gt#|9` 8uNFnLeU7pwC۔,$eC@TӅw,nC ' =dt\Ȇ@w{3O.ʇ q`sIൄw3H7%- +ṋ}&eFˈZ1t Ƣ56^2" B`]Tɸd0=k20W~_8[әѢ%w fwj R=s4a~ȑpǽajY`|jNAWͩ~̙\qeF?z_X~.FRpߓez3%g](D,| 6Ӥ2QC=+vU2lO(f4[{& @c|_LݜYZxhh=nc?JՆMh&b"%൞.!yb ̇JՆO 5[//]%7O꯰A"iϝwF%15{O WF؜yH h*Q[,KiZS / mxB!CqS n5]9n# $ITGYYc%rR@{Oe S$`il#2I:6e\OkWBlߴ&?M8rO ƬPx<䪪W,$|9< 5\-=8t-@Q>p'qζ߮U,5:)?s8B?; RPm'OQgd5(;2&f!lt|܄(EY2s>4j;Ơգwnb>s\l`hEw)5/[(Rn+9S0Q&(RT)ѺYAg4xHkO<#8!UV ɴDꮁ#v2ov*V=wݘ\l䌕ڣeq*B{NsmW-SYprVtdҊE\ܷF!)r"T}ݴw8J0iXmbtJ`ll:l zȂL{Og͈\,-;ipݪױw"wyPǷ:mlq }c9{OvA1J,\^Ҭ2e[!뵚òjH] - e;)co9حȣBS0i3q]7*~IXUrva$ϋݦ,FO}#$5\mC>܂,Y˃s#!@u>}#Vrۙ]5-`QKֿ]C&.(B)˅{ p}۳g2|_̙c28H )JG%n+^ӄdMYkK(rcXz'YZքwiBWQlUT~[e&΅[8%@ ?!Z$Iup2x=H&+M`4>7d$E@;_q.D([]'q،<{-zUOcەYXS7`6# tz) "XbBy }&ۢEd ίgA=')YּG lunu1vlLҠ/[~{iV-@uŕ{AhV67DG`J\[Pwg(Ƃ9b(:hϊEʎ4ϑlykL  4kG!4RD'9akڐYH,i^2X&vrf^A*9Ff*J)nNKemcҘ5͊Z5:x OCXwN}'JP$F0O#fIfzbV.{6Z?6h0 y{%$ Idh; 0 pw/kR:67Yo2փ-FL)2q s8Ln1lX@~XL.O^` ^xL š-_먇o |7EngMLX3xM CV]k{Ӻ@BO[(&_0MsM'+K~`!;*g=~\ 4Ҵyo6#W A[}0玎uL#G&vK_vS9T3 IMʑ\U3AY * jsr=/ʈ m ԏؿ`LH!&ym]~*l))i¶YxesCvZE@z~u6rvphݸJ\X8vK2XT*%B ơ/~!^~$Fx2&h5ޙ,)E! P2tv@.*gѨ@VVYM1w\/* [_8}WݺZ}E?&gyyJH#ɧxuxeuJog"J`Ċb,$4ROsɰ ù֞赨@4K%k%kCNSt<?8J2!:f@3U Fm *iy?4~4| <Ck#)F=,=$Q۩]^ZI ;p6 ^Pٙn*;j]߷bB<m!_4jwqx3LK=;rf]N!w[.YkL?xRvE 9yϧɋ mg`=ܹ;6;$B&%p5CKŘ dV `0M,]<3E?j? /hY,h ϶$=Kw-C{*\bL xglx5ҁ ͬə WqNDA& ~泒@sE/\>! {EnQ~o$Flqsw ݉K~֠ZxVȬ\P YՐyܥlL4QЄ"(&bE}`!;eKA믉^)}ctjJg&r. GXT %2ƒi/,]AڅJmB!4#J,g?\*6䞔9>`輭yJ_l鴀 qo"!݅÷ *#bboϔUX܃BlZ2~@wHka/bInʳ9 ^|C %|8l՟Db iZS2ШX$N,ؔ(j7*/fnkZNpJwͳQs^}MY[HX9(!zz1.Qm%gwXb&A<޻m[;}!6;Hp$\T'fTW34?Uȇ3xe.|H`QYNI{jqYٸ̇cPNu6w~׵vpQ逇ħ~Ub9Ӝ^cL*syog#uA1J&Z)= {Av%&꡴έPpθ+_i2 ZNKuqޥ} nd!HDAJ,3x/"^P(ex8Ru .[*jO1"oWU ~dCh'a]g|=hF_-m3>̕G_:,EdNSաV%kԃ>ۭrNAWGBc g摸H E_DFz@). ԱS},l%>nZ(z,R*uXA[,U%]OK9NO!X>yO Ji݆aHMV31%N n6;`fЉeGZf~;wA8m< "$ngЦ D`Mѳ6zx-S1jʩ.7LI"V~۲~'=;bUtϿ=07x'H.PLOI!.Tt6QKjmK Džɭ PЃWlN]+>WG\/:L^:5&`AŠl,̌-%gA&%#yOEp!&/K F 0U<"]0--\oAϹtO_;''/VI_*jA,|;+%^VVv_\Wi.1R>z|Er{ -WẳxǹҠW@b+ ŋuW$~ 捧0 Yhu$ސ1+}Lij5¥KRjh"q-;GYFEVT颖n6K6`0U,m/WnDR}nSIV@+0>1oou#_^jȋeey폌*p.شUv3-GiU,V6VcT,0nkI|!*fW#(t xb \X7V8ϓ Z!i]dxD 7h>˵fJl:o0(ũ6޳oAfu隭G4~t.0I7)O/Z_"(x3ډXodO*D޸bc IUw=} Tg| R{/BokqGviѮՅϤM:N6(Qe0kq>&%n 8)|dS{[IHäfa Q4BmQ% wDbx=`ዉEq27Qi7n;;Pm^Yʊ1qH7njAHqur`ϧ=H)lkHN0%dfx;MAzˀXUQ_'H]A/AI8 r;\ȍ|=~#|Eĩ4 ȑQHi0n9Iȇ =K$2̈GRY'$gv=|G˖#l^IND ,`cd yzQ02{ٚ(^re Ƽ hcwZp1[:JgM I<=K05b6wR] ,P!SW:xrXXŇ$|/F[\8EԄTm!Xt?Qt8?k6A?ɕ.W@=߃ ԞtG"^ گW1p~N!gާbQJ4Hms\3el(Diʑ8K5Yd6LЄ_*ЏzUyeWP\|U4HSM6 &݄:3)wUͫF}5o ̇CfTJ(heU2%9F2z yMKq*PAsgpRL7,Ԙ8%A'e,ѝI 4Yk;z$ k0Ը_FpN~v8ni1݆Rc'3\: vaQ5ᝎxZCk1Xy\%Kۆ" K-GX<7;2=*1xUB;gAz(dSBԩ,4b&Ӡj[|QIPk̅qwbO2A9Tǻ&1BQډT]/(D(!P{IhR^)ZzqEJVs_H[)x">FF-98J"^|eTL.q])M\ R(Loށ:h[-c|׊ZF%˶D x2@PN|ICPGh:; }(NyϙmX-t0y6%q7EtZJB 34 R<a'=;cd,>VKFM?[*H^gkbpD>}G:2 tg%#mh_7P.斘8MQ|KJ sHNA5d c4%aUH5&p#Iľ&_ohV[+C႗zJțQXljT)^PJJguՃn"0Q t5^a铗pO"Rn,fW&7nN!Nlh@;=x8S:\k)XC .zZVP9Mgn`EFJ[5:%7~RÁTO}{`X& q?׈1XWZB霨@&0. 0^ M}rlг&x-w9(@̋w䱌fBK?6e8^QspBdž5O;ETH7ԖDj*x-ZH6UD0qi-m7V 6鄅N܍N$ `T@ޑ/߷qte<:5%1B>N,:ځZjHR[Of|٥|g߽- E;=cy_WSA/3o'Ft#ӟ$k  ]7/"^{9w Rudo(]Y%i+ 'x2N4$,1o~A3g[WٺU_e=m Zϡ y =Hu,j5ʏjugژ# ?hN YőK {iu&ffgj;L>g[(N 5x~c*ʛ"="0zpKJZ^Tk@ZdFB.ZrsmRkRή* *ż⌋)!4(IJ+vND>>Vg2{wtS5яCEx~t4a\~ h7S&gJs]OisԬ+k0d@xX[?5t:/Np6 6U^ac,F'=MgrXhi:2#3 |OBI^r̖X4fDAEb9< vcpayP`qܪkj=r%(~5洲FFq}Ί E/!xWnP ^b%kTE;8NUtMaް/3 q0YB&a љw,f+wr2Hx"Qq1R4~M>R -g VeQtLEQ7VRjl.-~ܤ,N) ,U ܁X+aUVYN8be\jgAԊ u_XIQBZMzC4E\YF [DsH/"4,>0{͑@͖"'8kC:zw02ۈ,R˚ (Rs !^vu%N:ylt*G?> )=فL DmY͊Dy! u -NSXm,meecev\PHRmXzׯuLO`n.$?>>ϩoENh ?ys'~gE0B;`i5(lS{5!3z8]Ua6ʚPOnz51ʊP ?g&WzS۸MUge`}CQ!+%K5Nglg1U-휣yE] Z֛ z$UsS.morLA] 8"+`,B~;oZ85LOvXF0RKCr Z:}))5:OVRYo֠=.ԕ,*QWn>ޭ&g`;d-; aLr8GHMwY 'BFfȇk6~)>-.@ ;w26I i >R)+aB㇉CG);d1b`pOi[U2=(*o?x_]xF jݳ|>9v!Egg.~Hk\+ ^*ںGAP^ru[-ܬ2/Hu[;l*XVspK*rЁ"ɩ ]Njyh4MqH悦2=-CzHedpOjs.;k{ӁŤ+MQy$1+p7WueVIMTV[jz..Vi ,>G'JT@ ^-ػQ4m .MޝX|?ԳB^n7P!\d TX [g:=ex-5<}jwK< >q:ҡ~5O-[^rA !' _ 8c_Q[[,[Z5@tL+2OoRӪbe~_.g5@䧔?a?qD N4Cdta>Ů#֟$LUyT֤IR,fԆ[(tpM.7(!\9 Of#޾[sY]fSKufJ|PoT{u3(Rbxl኱2&@%ufc%G\^?Ŝs߮ye gzR~ĈuB3~;\[X!h_P7ytH4y ]Me'x(R_NAM }+ y= Sr/W03Y4mrBZ_Vn-ÖD𓔯Kx!vYb>J.b;ikN|Ε?bF0E~^+cJq'/BCzdFA ]ס$}WFv5uekCgN2Dw0!x`'SZ@:Y5Ե0RƺA$7(s])O眢-s<U_6K=l'@VKVXl& A,NC).sC~1MgTGX{,sCtd3v̱XV-]wrp _upD=+>I+yḂo#LA| f챃, q.L_"{~y?tԤZ_sXQHg8Kq6w1J| 6?IIQ:>·s#*-؋1I/[qom\)X7{WEVu')HZݾ_y]|9iKچE#ӞIn[텫k繎kZ}<]=F:H|-ˀ.׆]ɲ/_Rkk2Yn*&@Лt?=8;`6Ak fnnwbF`'\;t()kBnJzȯՏ m?QQϟT6Mc w>,s_iOU2CPHڷ~y\3C"&Mog2Fd}ȝ#|Ŧ RK}wIt\gc<1Zmj\7Q1@l=+oLKԍsl\,qGWpzuoxsc#~^+Udl*qecTHdzN`8 C͆PԜ{pACxpng2@>x0c/ⷿ'| 2kZJ\ ѩ! ˆ#'ϡwT8-2!i1^q/Su*ܦ#eQIHKu"ΘV61-3Vk1f,e 8B$ޚ;">wCޣ t~@n Mo+Z"H4ъB/k})@n`idŭ:^zOTivD#-椵[h!tM,*/TI޸‡ 1]q٠hU8dyht 1aHxSm>b, 촄WT?<4xg?N}FP/ wm%[r\gK4{sgUTK!LxBzDuKL (2}w@S_ꀺS`d?̓x{{tgD8.tn7& 5s:9wu*7'`7%HAׯY|y a)zN V;8lZ$+VJ1~%iZ1"KRn*w a RcrR6=úDR Dg6a@:R|U-^L(^8򍣅qO(̲P=d\?P:!@rĊ= :J\ӗzm`shĞgx[ZJoЏ!m rEp>&8 ;ˁU+ly|dLHz"w*ͺ-}-FhXW ]iw6׳J&xĂRD %=wb<O|8F3&Mfg$h.b1|3k֤"5cW!in3Aݴə\eg/an;t#ĩf\0LPA >-$ nJ]r2pbkXhu-/d%,C 19gA>v|d ^]Q;]րNaLJ @&r#Gr)4c=XH?gXRܶ1[%)0%J LEnyoLv i4Bĩx !ZCu nSPA,h%_j5 M϶74uW\Ӈa HRi+Qr6GgU83/Obq:ņK»R%A),&?@T@X9 V$R/)|n1ĵ̮(P ˞ k$Cr{-ix AG*A<-#NWVȱf~+HA[>)I ="E-IL+^#@  % }GȣYk.>G'lN?Cz\I7ד@ ?{؊LnIEWz/`%AC#Ą^9 f ̜gy]4,q" #*]^B\dhWϒ2A!е~T)l,xƯ>t+ɜ:ByAa GSQiXk>=CErfiHj{|M!%!S(.C6TI?ߙkL (G% L! ifX_^!/T#T&;,[| TUKCU~ ;Tb_:dčkV7SDvB-e:]L\q,8 ";޾߲ zn/ʷ}῵c^s t "I<)*g8Ӵ.[T ݽ+Rl[@WIAtAЇTC" y[BtF<&ORW4←9/´y) lkC aykѠMn6=^5Oߙu)AʼnrY֭αMN6Yb^?sohQn4AkG!k"8 Jke@PB5e1DcFNw>)N{CP÷~(bF/YFm@$(H✥@ U{h}dO揞Ӱ zhNiGmK0&Q{{wZ :c^QAa$C!%Ң RI42)ڧѱ+a (#NfycQ%^a-% ]bmx|_K${ `%t:Vp}S#.P)k[SvPL ++p?P+R0bxs Fnu*\%blϥ}\]jq41^7`p6IQvrԈ1\;*\NXmok"M2|0D8.' QY5GڷG=^ W IӻIW_^|\ a^ы .,wsv zy^2|Ri7jH#@SB(45X'O@{j)-8qXҀ#o~p7i8Gnm/4K*o_eX+^43$ʉBsV$mmJ\'+ΝQ6czh_ÆɓWyeEqƊ2ʓύf,-zD>}zk y4=uHo:HV12 ]ЮpUWd|#&i}-R7#:CyP;)qJ eP@tA 5ֿES0ҵsہىx:Բf 67P8b5dTq~;mD%FoKQ$CrEnMo7=D^VFhek ߸3G͔˳y2Op^h䉨`RG/9 nK+YO!-M`K:v ׈zpȈyǼuxqw?v|݃'igT=<8h-61z&sqLCrR⍌vg?*'!ƍqvlm0_(C.k1Z0|`'p+N)}9m'Y%OUB{ec8;/E̐ l{OŨN>dl'{uʞT.gj.QTi[ t!/؀"/l5zVB%P_65X,Ҍgn fNUXx4M\EGR19s/nd+'?Kν|vL_w4i1ir~')ƣYuS[mA/bϭ=4;ּVmy ~rFv"nNK% lب n|eǼЇHꞥz֧v["׍ IB  Z!8L_4,tRS?'/Q6BKE*Dog~_>bRV^w]uD;3ٽ^ՙ:PNK&cnoo?ׇ8M8WnsB/];ka'wI>MEmUuUEtiIHlfHS aTҰz,'][]YALQ4)$ҊGD5(Ėr#%nU 7obq4Bi9#a5z!OxU "\뽬G6o߿`I܄1Ž03=5 ]"B<)uՏW_.OͱKOzyLr{p$3(pS T?c'w 7_Vll(?Y]l4RCv#6g od{G0ˏV^sd_47|j ) -+a9VpGt/lO{qM2pl0zns+(il BwAd`l\@/^\|K%c{B#i 3 vp^/щq ZH x[C"1@&|퇐%'=`E6z>,θ Կ~#6>a.U9 ,OB0ݖoƥ|k<]."o{R !|TOtL|FZ0(Lp|tM9om蚥\Wo\"?]b,ݜ>O֚ί;IֵPqbwc*A4XC%} Ve³RJ˱0iޞ I/qdzߔ#e.w<2lr-sL3֤jH X+x\UvV#5țX::Q0;[Jq.x3#Kg}t-!rH62zieԬjo2pr'ZtţC'oMܗ_4&|P\tOKkz=KBdEnrb;n} aN8Qt$WyN8QBO4z.= gp[\&Kf H3<޹혘f ژuz ݱhA{{Wȭ mB *Gy}{0! =GA[^]>r>('<0fH9ļ"z J4[)6Uv!bJTڨo=v$$P 20Zl“^sdZ)*ozEH_}-OA.WFq:uzWT FGlyooF&kfl_梷pU)H_Ƌݞ' *$`Fz.!8p-ҫ34pk bo2\Lx+ݸ+mli?N xwº[oo` x:h}|1G) &7^PG?-&e{$RAAuY o'!_ f4m̍(P@0q4'QJdE%c2~I7VSθ,Z`KVeoƼѯ]-g߰vkq/eTML4+CafzZ#MekgpaæSVoM#n0aUh# Ut(&`.?K#~jF~GCt \?6*qͨZJ/j#p!htn06I &5"K g,K7IF6',Bɉ!2L0M¹s a>ǐCwE9q 'rVWJk)uk/Qn,D~4ЬM<̘7й9ؙddȼ q',H\04l+S̋NX'фDR/ BPA:"@lf8ٜ" \>T\i;m6$Lb+ Jx+I#6i7#JN 85+'F*VHC#cTRCKudKK{$)6?]2%D4< *x*:s9ΔZAz!9W^m#xm2383 p޴xLꁆMt?gA2Рzo۠27H~(@F(4e5G"9/Ix=u;]|a s)NkcuڑuA FS[b]ϥ=B)u9r.7ӈZM1F`OR1<+#Kl&Hb̈!l<%?._>K}B“KQq=S6sxQ!8evwHꃸjm9-i (hBpx@hPޅQ^(B u,q[#3yΤK Zo蘷f(3^# ޢ3epc4'ko;d-z,Ec`PDYVN";L4yH }6$ਔ+u(j5鵷M\HS9[9ز3y\rTRұ뾉Ho"c.!Da#֙&l O;*X(!fP:1=fET]R/*OjlvK&?E-36حWu@n]=\#DJ9} 0o2ǐ*ņfRs (z}$?/{}ٻQE_Z&=lLʆ,~PRtYof7v`laK4g;o.qL3}Ltk:G#]){;pDVzȉ\2ϴ7Ser@yKPwhoQR:ն% ֺAKmr1 <0L2Kds7 skއ#Z\9R+/?$D(:S/0_ģc1>ɳߤU;R@^ĆiY9X"P&&cy;3@<+{[*wudD*QwWWoC_IʅQumlJ@( [Q{z, eC;d-fMŬlH9w\>JO!>\i?O<=H<2ͱ ` tr.h^KȖwHc~69,ulc9=>Hu rSlzY8-N?(&x;L{#|:xNRzxgIIqb&'Hix(ZHAKE! da kM,S'f=1,?yh3_ f)1ń&UWܫmVt|` |Nr6|Vs!JC7aUOfsqd*1WݱeN,|Ys fv/Ačoe$0?sdf4;=)s5ǯG9'3ߟvW]úzdQ[Xْ{tr;dTwVvA@N(ɿX5KSm*ѢS mP?iGZem1O9]+]]7σ)Ačn+Jaۯ92w=㎦ ,)Н 7 =ZaH/˦DC'Dk*_̑29~'U1k(PMKDLSfg2jV21n@2.&m!SU$ /kHIxO*H !Tkx6&uG]}^ڠ [HA. V(󈣹[;].PUDXh>ᱫ%rivx&VOY9G>CL(f:$Vpkp}1p /Tal]oZ0Cd,G.0xA%\9S*zN,8h gUxuކv} Hi͂1)h.3lX4>of};,3`{&,"\b3j9:z_yC'H B &jјRLv226"~>E.&úZ%K8aLhF|pky-IFD:= N sqZ\ztVO݋sεXa쫟5Hͱ[-NMNݐQRTY \96!?8D%~~TxF4Zʟa:L0u 5Wy30'u)PP% %d߉&>5 F`5 AɴuN ihWF;[,kr v=K\n N걟S@O+5;j]p%|нǎɓExx  6l Uaڈ D7잝T/!`W8!ԩ.j<.yf蔘Kwz*%qJ^VXՔoY7gDq>O4F`_ϖƸz)}&+!/+tMg䷳qBgR@h?^{A/ǃXx#t*N󦫚q~ R)Q)ccFkiBahwW!dPUq{#=A۶MXѡqAJ MDw@]{ϸǂGOMbmy竪5AipcDHxjTa[LD YTl?/=X0ݫixi_~_5g[V;u^a38i/vZTh-\Z TCmL0\B׵߄ A!H,gg 1>?A_>Z #0M؂7'w0m/ãRS^\?2Rg\yQNV gU 5hP>BTDِ]WazW!Wov,n`ٷGoH{yDF0\<(_7C0zdĩ[a(z8K;ҽŹL-KMߕK/^*6cr$g>`/`gK D-& ùJ(Cg~6Sߊv͂a'fz_ܢer &#K欃{-B}-,Ll ys_`\FK-Nj-}D[)eZ%hHjht-EfA_ΧN\"}ڮNs:z}ǨYˋp#Nmj]N"5_$%{ۧe<X8tM$nP>M_\ a8ĂPð/rtrŖn(p鍧nN5vםHX32-HГYr! e fFHp#g&/yt41QVIr+z/j]L%b '6Ő>-YK|.cD(ϗ+U1P-J>_y -585Ai3Bw&P? R,sl=!"zJ>u3*KE|hdT՛_"3^rʡ'[>fQ?p%:7 3z'DP|ЈAܙEKS~3)ILWӹ8)Z<Uȹo.\BW  d2aҵ/%j'ZNCJ4S`ǎ;+ځɈD5.{v~q2B܇YP^m*d.h1ЇǼ}A@u0XbrȔϊO=isO lX86 X:ZnHC[< A{ˮQ0^ (qH 2&(5#-mǯ@xQ"4%[ŗ&3!%32`۲-ؚy6W*M0)Jp wr|QHV%4 ,.B$"3%P5lT5 Š(G"Wrqo<u tzeYY_U}pfI䃩 hIW%ܺaLj)+쥘צܛڍ5:dD!~Ɔ:5jC!(+r`9k7@DHLT`mQ\?QyQ~ʡ HcJz>)ˇ502p9IL|DDM+^qԋPPX/"d7m[,w(\l-;UB ^wpuhbʓ W4{@]n*y:Y gGVκp/ˉ>dӗ6M]Q?m<Ώ ~$\4 &h)xE fc(Zn76J~UT'L~POQnUu\ /jpܬgt7S׭YVjn]詉I](IgNkreFu$*8V}w[@vz_If[#+5U TWT ~"(>2Au,hxKMNRϸ(ǂH|Tw~CɷZ V )`9<|<ӷR|bDc`<Wj<Ӕi1GtL,_I8f[#cӃ:ٕsw Ѭ%|JG\}m*RYdn(KaH3 $%6;YoLN cSȃ7uVu>?!=%|_*AKK >gbq6v豲?-LLھմjxWd ۂf!fcTy k:U?hyFYW=A6ҳ=PS6%h)X$MЌDqV}]I0994gW\~b UI,A5v3L# YxT Y!4CͷbZj,Sv7D6˜MEަxkF*z:׈gLXJr'fW7AjNeHq/QkE&<.o #XE631 R:J)^V eT$>f}G`U@5bj?|j?z#` , C1*#$<)'e39|9v}V)MNiUC!96Z1eUȐ$w|}PׇUVM@ur77( _V(AĎʄ[(WA6D]BaRJb Sհ?;ozFj FVmrLpZsx D՚6H!)Asz ְ;ksX>GBzQG貭lx4[pbz[Xp~l~R ء|zuE9EV=&tG%4V뎈RdŒsXM[͞8F!X|eBWhfběa iK("*!iZE+=_v<֠wQ0-F^<-ca)?YA3_Ə硵>lɹ"''{Jk\[IyҠħ31/TfzhЍ\-+Y^hN~pB\^'EqyT26ZGYylj- #P~h3~h7Jq>v ч%(]kp6+Sn2Zn !e9yq7!T z}mEw3<HMh#IIt)4*bvpLk*%ٮD.-Ѧ?Y?0^:33!p7 Y+~OAnWxWF)״UX@IHA L'sE@PQ\DmF69 & eRL&ѦJjC2N{ZLs/*Hj؎G 5ax򷺈J[I 5::Ԡ͚]HR,_-\zˢ#5}x S8” _XAz, E8Ra ]2i254W ! g>M4s}4aGOwP>^붭AAOJ\{>T:|( 4s LSkD 02}yW 85h$ Bca n+[(ײEa6#K@i+uDoHߵnKlAfJm#ih`gw/*aWL]ƔQggM,{o  =U@Xh^ H"`*)eΰ-x~ qJ@%88ܫ!$p8>QB[W^oLgЊG[/'ߍѺ)y|64ɒ wѠӦWAV2 VaWxwV+Ѫi̕6o6M 2Z Ϧe0Xtխd~/[vتs|Njya q 'hַ4&uϒ;Xfm3o>: p4aedm;U9A8qE~vb;7 xl0M]y$%{l`q24c-;K9$N"֧ʺ[ĹO0;D2L ١CHG`N)Y^Z%t>*Ҕ\tsl'/p$;LܘKd)^=waY* }w:{ʃ+_X`s)n(41E,$3 0Dr#'7[c5~L8"[v3pS6nNX=7Ј?lCw,hJ q#u1KD$]P;3V/겎22AFZzh͗{sy\< `5fZŵ2W`: zSY2&;_\&kLu?ɼ‹:~%y- 6ز')߀7m2΋&}VJ`E[° @yMi'Jh y!tu*(/W;"b$|Y'ڤ$\twV+qZ)ͧ DWvA]w Vp,m.Uk'3qe2ւm|YL7cV< LJO{}"t>O5`Q8୛z[fb]ĺ$@֓1)1ㄙ/%yV쇉 +!3DfSm<\]jʘ BʶN08㿬U}hp*KR>j y\|}& zF@XCzQ܉pe5wvD:GxPp@; ^hC%f)Jrl-\s\j` įJ|=IlpEETَ%1=(2ٹ6+/BWGã[T*peaZt;rs6knأC{ 'v:za3i<=P =D^DǗn4܆Ή;? ^aL4ß-5/ō)Ԁ'|&7MQl5LlNGySB7rH*'z!Th\Ճfm{ߺxف:QtFsO><+-+ISUGM[ YIרPXg+4ka/qyhHC5E:S陗sRg0Q;n+`L+R?Z-oT%ЈA JatvJ )\شK a&sʁcJDU'qs+Oi^l!]ܗy r1j9B ӲCh7E95=0k=*M)k |b|ƇJ"DߕIzs zmYzT4A6ҾFV_&rdjΠ;nDŽJPN%><.|.xb{a֔>Ҏ$s O꿌8i}|.A*غy xIn]l`g7>Nq .>Ήģy"(;TvZcCNpi9D^ic>UI]Ugڦ _,53sJ%É44 k"=N`s %l7Bmfzѽ"ۙ1reGlmw7߈#*0k _%o鳂kJY\Z6/HX-i X02<^{PD *ſjHɅ<=4,߷3+7 m|Gsf7vvl_9khJ=@ˆ N"β  804ۯx[pk{,ZebyPȲ"XܤPibs'wn|GF At"녪Jno81Ave3eo.X>[ X 8jvB|t2;`"7r*L\E$ -HA,wmJa7;A}I*lsx2)zڥD` mvRc7L+bQЦMaV{`g@m+q\<:DÐB1u4"l"n3Ϡn>ayLy8ZjO J P>]͠KLRd]n6|egYff8orst֖` (O|D2f,1Ӌ>.nd#=ST. kY}/FQ}^IAtbf~2@redt[[Rajg> 0s#[ .r!Vi!iW.hk:Ǭ鲢]5ͺΰ四WeD Oh em8b,A]Ax2߲GWWŸ oMo+x:ry$M.y1ƚ{~P +v2l=-^+^ >2 +Y_)ócKײ. HRcN͔ǿIJc_\3P m!UF݉7u"vv<Nh?,|kYv>g/% űjmf ԭ4%㎨ #*9 w N=5.l+0F6x˯+ e*NSNW?*0Z2uZ- @y_LS{UFvl/ߟ!7iΙ`=HX1O*xw[C0{GHGKZIiw,} bTw<&IG ny)yf;"eCc"/ot2P<ă ]EA`{MEᑳmpodIDi ]]nt*ș5Kک(}*QvщP&Zr(MW^QT!.BoGHI0:Tְ.ޜ ~~Ǭ渂OŽ*Jƚ+\*LD=Vd˿}Ô~ P,>5)%V6ux_vN I7qX|-Ss]?_PO RPlyWs?$#*5<}9iV;(!׎kA:x:7595cp~f-~L$Yu#Z܆K7IWaIlp YC_4Bw!i>cy4 GbnSW:ɠ2ǩxsظ#]d6'CP40UnVGB`/]!pO0s>%r;g fa&k_Ps\2t%Dl BhDߦMoR7HB4} SēpW0A&O,mVl/OpZ!Ob7_M}E52{5MHq1]o./.ŴmH" i&fi\ݐ@[Q& ~L* X8 ?[Bg#y ߀v6* 9KqG/aɇAB&%hށ}'\Q]{0^yP?uJB)'J !_zz3%Ɠc"@ !Mݮ¨\2<x'rtkP(]g},Fߛp%7,U Mժݦ4ʎ͌YvI8=NXlYi2G,4[.2[, HO!uB4*V._ՏiAa}1"UG8PYh):&8}o^msҡPM`Sߕ^y9ZAO]+g0$/`Ԅw*\s`6V^2J1ݡ]".%: o4 5/ɷQ ۀ:( |P1ԭRHCL52`(* 8 kL27 *MÃ׭a.whߑgNUq]TEڎվИ;;!n{"< i^IS ѫ tq1{uBQ;&+<>j1.A%7"'El=ȎY {w!W(KCM,GQʘM1y}~1%. ZJIS*@.ͬ5J432qݦ|GC{;W|Zz)dpcwL$餧`=(z-M\XAař$uML}{f[0qXY , im8q*b)7?!e Z =Y/L(@GGw@έ_1T܏%3*݆5_R"n"9#.:ᜓ|^ }W8u[lk 8rAH>wm|en=xTq[&Z$/ 4d/`P,J6;}48ʹCQea0΅7p{\G>UBdo3ؼhxE߮9wS;3sdxʆHe>g6rnОI ~wK$lG]x2 dz'VAR<լ AOR8 o=<Ib0i \QS ˒[!ss?(] JB8"YytDP$)=móX Ґ*_fp̂};p" |$Tyz^E0SJ8 ת-$v 9h@SFqbbYܲ7|Jc=]Sa-!sP[BD,Ko;Lcjh=`bt' XMpH\*TМv]3$WCeonOF MyA-㴯+ȟcoCFMQ+li@TH<|RA>h2| ~hLNaJ0B=],faܽT JK(r(RfɳFڼCwؖĚ,ΰ#¥Q5,!I(MB2M@pUޢI|~O希+}\0휬熶S%h#6_x޹ F:^NLikYa$%O4f^QHlÛ4fʄ,ILmi!3EN5ȴW*Xc%1@lC|7fH& V;4ۊ2mG %#GvkAI %Dq݃\TSWW͊!/3wȇ@)$))$4`;a0QrՍ.D@%!Xjݖ̷ oZS6`Vx 1g|>=Q06LD扜bC!boTVEbѥ&&#=3+%^K/!*]QLO\ij1čbZd& D™.?D.\%" =z;yD Czb[\7nQ@oMV:&ht6xMU Kg豓 vW]?RQ :F-pE""RE4s\W=-R!;;N48ś//.on|Z=~bN~x(İo:ȁed vuEίZ:ׁT1S*OH#J>+ώ({dFԞ~ WZА>yJ 1%ؠX|gnL?t9 QQ2Yȋe%b跨_"#)Ӹ J&Ǚ#% $ְ^^ 7}M|f *c|o6Da@`Pw DpN2F.%yJ= b!]})`f|N@4lA>-vMflVLǕqύ,p|Hw\fؕKk' a$$WI< b`@gb_ôvxi7|۰掂SKZ^j)hݕi&9AvoP |9Ph~;u:#ul?u9L0u@>b㶜`h+jwA8U<ĵw `۟r#B?܀ln,ѶXv?hQJDʹ1pSI !1ob45Br6tcOEOjjXlݑk8v8Q[89Pa?{E_9$7tԭ݂J/8ҝ`֙+i\tb´Otsa+x/sh>T1TS9WRk}yhL+#eՖ]8C婎%t./uC7hDƽfN'p;ຑZ?-kn2Jo9R#ԛm-ЉyJ;`M"t <U3RS 'TgSFzQIvEG+:Tl9&9Ol>yCDqp;;0FPb] $Q=_YQ@-сg05vע"z C?wOVu EU;o$һPp07.Jq/nǃ؂H ?C0v%->o<:M#=|x/y@ ٥6}ʦ4vXʂ.д՗q:#n6Fb܊"%H3l["7MXZ҉y?SPEL)ۃs%f(tJ,vr>䯻yZ֑g.۫\& QcgϯEZr;sydlz3p8\pN&YbwThMrg_~[Ñ.i=>4> a*% Jsj5BBەbX2k"d@Ez3=%R8UvkcKlr v3L/syN+.HK"bVa+j',u}6V,Z=A[6F!tIBMvz1y[]hH͓7Ҙ_~_ovE5UJ]Bnx .fcme^ц'Kpd V:_?Nrsq{s^6(±R1047㣗"0t ݱñ'!B5#fӺMɖHcPZ*EGUbmxl^6~Y8FWXn#1pK/EK1ى '6/t6SԪ2 IpPc1x@60m^%\}r/uZ t%Y0}NñՎ?)S7/[#a]/c3N"TgqKfN%ƝlzHŬ[꿷6.I=h"Sx/ԔEʩ5CSɱfK*5z+u=?=q) Z0rzRerk2.ĚHn4[L;k%;RΠ8Ux\Bf zsܫG>1 >2X`벍Vb*|H,`B\j 6h_drWBO^vA:N55kަ "Ӆ^ȥgIZȏD:.dh4'A}(HSe%AOk Чb[ecqo~ru :d|^R%j5,!we=]*zE&g8kMoWWdOitUSO%&`O]Jz|T.\oU|IgՎr>̀ٴff&oK\1PU)Ųl>G956TUGs.vl|5D.:|i2]ذ$ma&dHY\9Fa- dV$_i C-4p?Pn~p~MxJ欽k4SAN3;c|&|<?17;w_^*gh{G+0wp誗T p F+d2WL!\ ؑ)S/60,<)FpvDƌCj8԰ƒyޜ@&40#Iװ**Iw*n%qM.Iw;<晕 sPXX :la뮋 1^,31S.)ĝlDtÝ3 ib,mPy:j^>t^ ,3e7p2̱1?HCj+?bUܹ!)_b[܁W藌!DXH0"i1EMP)U8Tl<+?) Fin "[c%7uOfoCC+,5P._CsrkʳUrS=Y^h0ZH/eok8ڄl=$m=w+|-b1$V(Icis|}W9C%syMP!,& a?5iJǷt1 LBv'8Dx =ˮ.k^x꙲Z7| ,ݷjwzcX|AUo t1[.|!SbUĈҾ8 :q ?OJa2D\g R}L't}?Bq.ud=j?o폈"#鸧Ϻ]STkM&VZOOBqwyE[g}uɇv'cVCsr&A+؅.+1c^k`2w@bNzhU*؎SNެ %UY !E74b),eѕQxm 5E&kJ]T*V$EdC²:P'64+" 4lK4{'#h~6D("gTORU1a/\ 3#q l6^NX , t+0v`ހ( m!nNE~y mզtсZ/pfnO5+_iM!榎^.ʦ]*nir~] yV*J{C;(ΐ.‘ެ5YF">L\:/WyQr٤p+ӶbzIJj)cm*Xuŗ@F<1AA&MK,uBjM͏Ky̧cxPI O P25/6!/9j (غ B '9hM~ ݕUH(a5trluB?+?dmA\: =h`^ }'h`RYZȷ 1 xiW_uo^k>#lܶʣ/MCLfo|JF\6J7L4E s,ǣ9ܴN(}eR Oއ#θWV9IY+GWf eXmyK9Z|eY ϴbLIؠ;W8~wdytN?):m\=F)}N8}{}&u^:rvP`&&"D dI,C!5HT=o0Ҁ+CjDCǣ|dJ5 -}Sɤ<9*45"&'"CN,dwzIĀhaH4P\eWPu(Ac0UؼL{%XՙrI/NTen?~f"q`|@s!Se>TI v3UhFZp|"u({\1;E~x: /1*1,֭D }NϜwKՒ9>cW.3`rrt-c&Ɗ1GCauc@>ܒ:.Jw, rY]$Y]yv3p KÖ,CO}~n%L9S/H7/)qƍQe ߍBS~u M3.=2[j/3Dݹf3 9Fp,ACe`"H?}qάL #9Q$ Bpucָ"Z҉̫ʠ1S:>Tp CQ~@G QYmU?;Ufj~̢V }Xb;:,iTkWUN\lz]y 4};\mCA6U 鹯aՁ@_[As\y)\", ~G+0hc'CsPŚ@^S.yE#w@ǴF:XS`3dx1Rmn~Ccu'yai]LT۫ AvY5LvZJ=ho`AhbO(;Jof"D>." .TKWvt?bC kt),-2/DβRQ\q\Bq`I1bݮ eͣjAaCX_<.)"@`եL/5Lbx"c!ԱcŌC*e_o>g^kfeΠ1ό[6TxBQ'"q)$댣XYwa$)Ձ=|3akwXH?6 {:Ok#x.BxLB7=RL4㓬bW_scp0'n>2J6/dsjgd3l+:'[dMHaUiM)hHSgETRs2P{}+V|om!m"pƔR:M|V:>QNƖ#1pQ $okl3جZ+}CrՃfo7gU'v Gz6LjL=ykN2rVz*|sڷ`QEy-k6e:(xYIcoW´QUW]*fy 85QV ctɖ.?ٽCP,M+y;U%VGD5݌eZ@(-d>,hzX!7Ӄa | Lo" {4& Z dK$[eEZ~ oj'܃bF[7T5ߔjND1s{DdlUE"&G#5]yn5 gWcZeNR<[U1x'Ywi^',^jGaH}@CBa|b ϛxxLZtWag0x*i _o}zSH|e?i  JPNI5΅c&/1u=qJʷN;HQ>i<ʅD`RēBtT7Z 53+An-)J[bHI/7(ٱE+h󫢫MiS KolF&j'Nz>/vՁЈD {KRůs{Yx'&LDtϵrLg/82QVW8rf}|4\e [Y忄:.ZS .$~Κ2a2Y0Ki@USslXip"­,JK:z6K9]`»OHz QxpHˣdA;a,+oҴz˅#;|#8ujgI'TpD\EF"-)09@5 ^ gJ\/$C/ @r;<ي?Ӯ“ Wwf@^J8>ȃ)6zp@YrʴRFXwRϓL:0Wq 5UI"O-!R0d"Ld5U!bNՌy.k#|7pwu);kId BS CKg .|<.c mT,#O"ÓsNp3kf[aD|t[69]nBz0u[֪w /@HH8K kqZ~2RPbIs EݘY\a|afg**!U6,~Z\׆yG`!]h)kx1Ap]k|eCs~2}ԝ֐`**8}'誺$uUfb^ym $:3#J0Ј 9eŇܚ:eՄ}]hXye++i)]j26Ē-WA6+,;1G2ŋ>34 =nA|)l԰WU腲7 r%*_}}_xs&-jB]yxٛZexU[/U$;<`^@X->S#ZkēyY8ZHb!]*tiAkȳ{{> BVkQi70>χ^G/G({+n!5Bn\MYMx$nuL͇ЄAJZ3Й.9/֏}n_^Pw/ Ӆ3Pε9f4;jfG&i,/xK@mD8|ʱOY6 .!˷bS=KZI> &qYs^o˾^x#[7{H~&q $# ͫYN1,qf ^$8xhuI&d-p/9#eFbAr FW'ԿsrgSurj!G#D\F6G`z)# VlEK~O '64E:,$(NւO|/vn%TTaidBuui}qTx-0W!" zX.%0 1_D7 MePt E|Xއ.Y^)CEPVj>~1Qjm?%w;Ny`b4\aQ /bʒv?dooQϖ\syǝhӁrcIK+z11bnDcg$3$Dd؅ ha%ۼl6Ijx7kku i?Jj?DDo{ū uon]i[ˡxvFF:=+(N%tT 1pq`#sB/S$NVCx^@ bb yO^t8ǼSz@4݌8w,Eߪf1.3np/"-e hX.X_;l$Z>4+?_8LU$ @M l:\ *DR ? rߔn$3ֺw"F܁}k9xyxGcڀrs"؄='cm*=Jʻth:GOvY.%l4OF0yzYm\}3ZU @f^7WW8Ce(&4E}NӅٲ]p1"dg8Qрn>H{ ? *}Qedhm8;%!{[ZN\TXxPƗK7Yوτ$"Eƾ>O. ʁk_9]˩1VE<*5p.F A Az(HN?[ &h8G|D7SHEyh] bdo|fd㠛K͆ KfpzyRFJ{Pwτ`+>cE߇%lf!35Ϟm'f^an#s*jds|[y S|k&Ӟ:M8<>%1kg) 6S7K*:@Uj.۩ hNeY[ &Md@+RAi4]1iWKq6-Ԟj -A)_D;:^.Z[M\)xw\ApQo{֍ PH^,-ul2"!%H\&@6eh`<1ljfƓx|.+:F͑ppMKiO&Y=. ^I_{ƯXux^G42 q[}AR^f+p4pwmApGHZ22%q 8/=/Z YMύС6[EUe8zEV`[- JIF;tV}" 7}7̈́}~1ا'z)4' 3^xrPm.,Ͽ2P-{r;Q3[ +-@ʵ3%Yi) :O 5=n~g@Od lcV"V '|W8Mijɩ&|?zzЧ bZYCtؑ^er",?OPI9*L揱bɷ,ǁzs9v~ Fs_e]qdvz% ;$%Y-竚3]p҃yeeC(C\N:9Yo 7SXw6oO8ٖu鋆Fc]:nN$4Q.=L$ 'Ցiu*ӈՌfdP!~0!B!ظ 0ZT!$3u2BLjvFP9K F,YwG_ǪCDw䈕"Р98plVPgBd~g5B|A5?eϧ-mw;Cճ M\\#eq%`!{KVکvU&P!o[$Tb:N LAAeW3xcd)~+ӑw#)*rE1o*[Mݷt8=U9zW1Tr/ aVo)MsM8beH$uJCÿxv֟W]mT);G­zxqxT6;0^Du6j{׊ *鱡t ;쇃DZ&{ctskUi=0Wm9T[:RǠTzqz`m?CW: 9s"3ݟ_ {Qv>Zn+j>ZU2x+޾_ix'noX6yo %~q,j?=2o5ȵRA0Y˶/'iuʕ1K[y;'@C=DPI,kA{5{@U dMVl0e}6S}T BuǕC8$mΞƨfF֪`8|02،ssF‰ZSPG|Āve!DJf#dPiNml2n%Eظ P"l{Q\qR`@ A@Bc*(?&$9{Ǎ_Xץvdـw\=At{%c0 ^:!k ㉿~ү̘K`LWOݱ<9lrϞW(Ycnnm,@AI\6K Ϯ0yZT!7 <'\re tXn ̉OxUNcK#;@Q6-_3-OM~FA;ycͲJC9qohluj,wp*@SoU_眿# %>J2Ow#uzf^ߐ3ʈЫzs(jr:7̳>gЁg4U1S^wr`xRXP .:o>8 N ~"ǾoUd#:?^ 7/yjoWk䕐 ޻6 tn8fhׅX`$lO ,3GjHpTSgto (snhǧmEVe#e#~#&TY>K[~5Bͼ"\!RPD* .x\Tvx?A0:&_A*5G"m*J.].fhW"dg@B4.z ja >^gɄ4,ӯMĚG6\N'X#F `9޾oTO)=Sj›9ZW|-$n0Dki+E'?{ *gɛYjG U7`ߑawGກA?9;:?̚Wdy#b" YR.;.=o#!=x}I!ňz?}{au`F9#bÒ0H\Qܧ~iN;^c/V Lho++E5{4diZ KTrI]sMp>cXɁjeveyh`9SY:#ցA6 Px~Ja.nxUr#35[#O1+pW}QS Wݪgb yShn(֘˦UKtŠ9WXb}ht(LHj"Y B}soD%O %J1.!?nlUo"E8~'>h+H'P7("mpF,Av2cC[-P$s1ihlQIy?Cv)֬@yML3QW'U?1ͣp@+H5ã`[x xvtjb2Xkdӱ> Rk@/gRܭnbpqF!гWHjy_-T-5&ILz1~@neWq9r=Ck^jȠM d eJN/_1+vH}~׽˿yLrpMk~{(cWCKJ(}JWc^BJ$@X2FLpZ8 :8ozU^ 5nQU½ZUM,3{W`K`y8a>պ cڷRomU;c.\G"{H%o<96s70.(SCe3oDtRKhq#7~HnU`f]@`C2Z=Utbm۩g{ .aXrIb,uʋ&nP#:9w$VIK)Ffq>$ˢ!hmJlw {+7nTDPzgZ{0׃*ӵq>w#Nv *_c7&|-ydQ `|}2y31yʲ}l%ox;ߺL}Pfo3gR*m܊k][8U2o~Hr@`;ΐ4(K!tGIF oY V3T2ze:,oU9g%=)j$ͣTõibdB–K\g!0;lR{@n`α clbpUqe^B;)~(;1FcQtj_H>^K`9Ce>7RL7Հ4d׎ǹ὞4ئi$q<,K::;/AbrK%~cB;'aҪl pM9-)ƘL{<4 %a @~bĈFguVo7PFdmcl {Vѩ| x .i~tL-4צ|'ȇ(XGOWw&jqb$Qk=/K) \qZ\t:lH8`r <4} Ky9k{Q~naP>zQCbce4z& E#(j#HTSTWdͨ8I%DEJK (Q L&rؖؐ@>!8pl`apnsS_bZ>JI~".@f4In) erDŽuxomIy ҋOYx ,.@I0Ǡ7S㋿n֏PU*C םvTNǕ싹1h_V^()Ր+kwE@Ͷ<'PwO גB.cYlMuqb20`͉{ >1`Dؼ_c2*I 'fR+= .؂j+:Riͺ@l O1Ma\ oi"rA5(^"/ZC͏kR0:7;{?/N.Ytf du h?ʖO Js*ݖҎUEQ:7:<+Iﵿ K+]Z {LGI&Sֱ=Måq Slw3e/&T?2gCFID$/!(UNL58u𵖰JYBghS]ו&VS|iR  ~MbkK.i]\>?zy *{@r\pt֟+AsE#}8Br: qdtP l_5-=bZ$ !F*Q`ʼn0D2OrkO>2 LN@@LO7kUyDMb_V|e'ܣSc:xT{fNj%$9O0eכ{=(zj/5p*%i6CdxF8TI&tHj0im[Y1q%.77W} $yAz,/)O]*N*:1o ܩbX_Y&wsKݱA=ۮ7A\(c# 5Az8je|@g? l١t ȈmSҬ_@>,Ƌ7y7.|P<A uoHKkT yb̾ƈ6;I.ǨQ=f­ {{-eN,DZ0< bZ xxf:ABj4jtAmT*r?Ear!*{DTv.Z{ėbڼb@؞NGg=D/={dvwK V~mS}ieDg3v}Cp!Ō^){: PtX`qƜw;@9F@ >C\NRNmS!HXր"S|9݊BΘG8aPG軧k^YX$aŖ rYKHygFoMdA!!,ؗIC7JnMzxd59dYG4ÔXdƱjQnP~fGsiCQtT/-2hbU^c qZzXe\8h#=ʽy_nrmdxtCweIY{­5ճ-Ϻ±!A !ȷqn Ţ9!ajMxi$RlPf9{Nkɂp哿jqh7pu s(9sTt 3{ٲ!-*u :0NKh꧅?`ҝ)2&p\`"%/̗ny$o~p]†7!ND`p=T ]0Q)_^ǸF 5snr1[ A[ow>6 D{>Kֵ7F$Vx酞/xdir=Xƺ ɎcM!lVC&%$c/ Svj_5j ɚ4iks(7œunU xeLՍ+4t_ M FJZrmQi@L=MRR|$JՅf<=*H;1uLtQG:yI)A(fTarKU, 6)jcz*Q, _\1fzeKˋ7RcG/ *.Nӭ?³ Pu$6y`@DU'0`\:jnnkU*D@:PԤ&2YTS=!*&,t?񯆁;&;O[eQ-Ί[LտV{`܃m`}欏4%s-S~{Hqȕ$(:O0zaL%3F3ytEM q /}cTF\-) ;_*01_q W+'wj6VSw֖yyV [>ۓAKwYij=6T(@k20'w%U]Ò= &cXj})ϡՒz-I1GQ;7닏=Ͻv)k/-]~oճhb$ $9$Y C $o&7YrH[!+ɔ/)"\>EӀxN]@\3<>ɱLYU~A狌cfIdk"[NA1p7jVAm搈DRr'l 1ag&"i2sh5buhΘ|ױNjb Ams9/r%xXC=ʡ8.wڵ HzXcaQM#!w\.Dj#nYlʟ&yiWŰuh臧+'Ek-f[,_hf͓fx̠_E6JkS*c8ԏd)[}3 f>9"R5ԇo3>#QIMKL}` oB+X. Y=͡ 5,`\UųuGjJ0ȹI>岔lSeovs#'ME$& #FWX;^AO279 pLl:*Ժ-9-=tM; }b~JmnE+tڵ +Քa'w<+T]FbU`G,8T3>;0FzJؘXlױ! a'M YDrg|~а_S{ ^уҾ& eY%z1euT W>tO.Ӿ=ctJkgj\8յ"6%qިAftUɪ ZX(YodFMY\Kn, qn\1󆇫:6N<έUo!i@>pȑc+7C?mՠeNjLSbLx41!٭cϪ ٦ b9,‘m'!}X!*$ Xj AfW&Q^:|EEgF4H 9m. RK_ k  }GE dtw\l;=A8hDL,T5p]ɫoI ?XQP+?Z4^b6;)JeE`p64t71.#_ 6L 08C-6vDR=t@>?}y+êƼg{\cp)N+UɏIu,g**lcY&~1VO2uESp],4ND$} dJV 9  :)IH<1ܙ7St;ϛþ$seڪO8I hRٲ/2;8p}?\X2^^Ff4Vs:wIʏͧn+#X$8AMD_W? Q&k"!-#Vzo{rNi ϧm gN~BQU曑RAuaL fz%%vZb;j/"l#hJэ3R{A=@Jr]QfkM,*Sw~\$풨k0SD<5ѧ0c3*磊=ЧZV[s1-%5Hr)W@@P̾ݐ34A1FWjAh0w@LzʋP JU&폢%_׫>LsirVvHQAw:#\dM;\8y٨襴bdcWCۓkȩ`hpuZj'di`F^}PtB~BϞ 0qm 5m6^nx7w< -8cc_5te(!{-2ݓ Grw9nth9#?ii29:KI4WT5q@ FպG%[D訅jO Eބ-k;_2gW}BvBlS cKbIyخ#@ iZƙ$oä.Xi BߨҞ61mdc0K%$4_6#Hmu rIw<ȲfXJzsB=#ޙmUT]wJ7mBVZgPrqm7Ɩ)+J3c0f#P#J|h>͟y^?ԛi}?T&D>Z$a@B"&SG:X ]NC9Z]Ff7[PR_fv=R6]yw0LMA;ެOH芵J 6u_S)n6BGb|~o:DcVE}1lE'hN?4! ahY od!j;f0C]/w:(DJ)yms__qm w]&҆.f$(l2)\'7NG$ޒB7h褃2V5Sg5J)|7ÄT`Te./Hr 7BXz$y1Cɇ u?65^| *"rUNC]<7X/νq$)lYN +Z ۅ<4oKr'G/(@ghV:k_r]1j)%$%²PY3/\gȧ@5ǁ.B;$,S@:wzؕ" $_snkX8"J2C?CjjBF襷o`{h rFIznđcdM$XĔKd_ H:&x]Q@jOSch7BCSl|ɲ H6C~.f0fi?bD-8:^t>f O. eM[Wū"K*X;5Yq?UGǢ rk eÓ*c,i%.'VO옫lz tƮqOBYun$4#fmfRwN(,OymaҽjǫW~ovoX8iԔrWo:5ẙۖ2# ~I%~YotֿfVL#,ꃌMv&&^9-6/呮Wpۥ&8*Byl#?oJxntcQ}﮽bqU.#kQ+eq9"2>LyuY=Q4/w-Ւq_b,@7XdW4`<$bZ4PQ%U&zF6RR`MT4+j#:faeGjR4 6Q_0!yzH">LhwQ)M$)Ͽu]%kx$(ME<&W7.};<) {jVm"iXSV5nO˻|%$_Ԋ׳,3OЅ}z  .!X[DŽYlJ FwIlkyU91tF8z.KkB"g+&HefTU83uҩ6aRodž8踈_Lߵdf0~8&8 V؋^*S4>K^qXlܯ|z/6kCjA'64~IqseipO0؀jhgoLs*\\R|uWuu/-3~Q>9mxه;9?^aLTF$-^aQ=@ #8ӫ%@8_KnB4T`s:TUd2axy<>m0༅2'&BxffNx p`8V+c*ѻc&閿 A`]"K5WpYJ::UR LSWػbf_+![ j0b )[pgF&2;&AGoК˓tMX[ y@эAIFhN3J\覰[e6h;.?%4dQ]*NRtNj$*/ْܱXj-1a8ŏӲ{dQVw+B&9Z*z.q:gCSC2)A'T|w*3QBF(*I )9 /}gΊHр%ذ *M}N'D feͦe<υ˿ԴFte 䵌5sUQ nd6C$U`K#?U\"bŔ^_*Ӥ֓cJ(3(c:uP;+Q {QC 2/uwN^ ?>fΜf/xd3"R/JI  boC5}.}p׋e%P{1Z4ɫ;mⵡz8a=5x)4w&M$$z"sШ ) iS42w ڋX{r2$?\>/T˜O0߆?@sfxTYbɨ5zx-2尜IT(I,}b߉klh1(R icD`a &ܚF 1ÜL Z<.&r}5`L#\;:@g$#AZ-.8_`!ab;9V"uuHɇ:*sی,W,&=)O\ys[v5mѯfXʗE f8&k?O~OX$Z t!0[|2o&Y~ $JgMeƊ'Z8C[HӅTﴥugDضd[64NX0_0'MEŮynM]5{RTITr]L0|dmm@A䪋}}s_['g.glŌ/K^ZWV;?7*ih9R/h,bŠ=-F5hKLxtVQvT?.kGoҕ|ⵘx`L>L}˺1'@w$N! OmoeLMh)ǧ5;ޱE R%&'RP%;q5X9RuJW1H߿[vd9#ye ˵Az?v{g@xՈ_6b9P٩cHݥ5Q;R~y9(A3 ::j!@*Ъu4[{ zɦ7l遧͹Lyh|8cj#ԏG!D|lݍ7bUѵC\T)*Ί<_^t"PŸ-cTB> Ȃ!C3$ٿԆ8G#Y"ybU "4dgSKFD-@6=4;V I`BB{P 7Zo> q3rdaO~#V`sc<{رܔӞ)#ϤEP]ڷl.DD1˷v p6/iw ׻Bˍ;V!joSgᛊ{Չ_¤ F):%NE;fxi9*"WDx>=(Hn06Y ;#'{+S i)p6zTQO2p6Kߣ:@Pi)x{,dSnι?09=,ߦV+6=} 3 ~1Σ51NfE$HC)Dx`BP޸v<-/+$x#bZ{1©z#|a\R!î9h^$6v<RjlS3[(?ȪF׆P7}.Ru 8 mPUЮh:םPnj: Cd VU.IG|Z9j'bAaXNtʘmPX99:b/9yo2dfkZS)?px>^0\ ?ogeq}_>K"3խ'4m`&1]pgջ4zgcGf2KD5iO'MiMd޹TD,*#~˞y_jYYMogl^  !Y&J.#8,vi)*"Bf{HWdfoߗP32yAa>g@%BAkե1+*57 [声{*,^Uy4J+' \V>[$鴂іkf_njI> }_.> *ȷoWJ%jx lP*N?QaPO-ihWׅ'xf] p<5Ѭԩ#c0֢ #}weo0fSE.,^rqob"N`&jwp9n63J7|ߐ4Y]_;1sAEvS ڭPi6P{C g"QNvM8vJ?V &$ԺhǛ4}vtÉl\><)iVdc@$1b(ACS7 I,i\g;^vSuna>.g{rg:_ɭD2Θ0ԑl;b$6k˜^6vX+wgI@N=.FĀuGϰ!P"" x~ov1}&)BeTb k2,%Q"<oWk>8^7㝠hzͺj2+qx1H  D,z8ypz,tU,ey%|Q_U6LLJ&wJP q1L ^:F{j]2C)DM B4)qDc?V,n;(n(llm%/.C(&\"?b%bmG]V7f6x7ц>3pd]HŸ)s3󅁙)[x~1 &ڻoM4=ꪞLѩ"II`tWE *۸T4u"Ire^ݾ'ݙV糗~CX ƝϘhYArz9}̃}@jv:W &.{\l"[.eщiL83 Rh}U^2Yt :2߮rƱ6fx,)Ѯ<׵$#{Z! :ȼa7#̞Bk b tهDGٵgWW(T?Ŝ ǽKE /"C[8KvB9@|!pɲҋ-IjҜINsߚE jP!ਖ਼Y8@ ڻ`IGt xҸ*=G(F]G]B?TV,)tk=Kk"ca~]:H2 2ئa%'MUGLx{XcKiY4|)O3'?պol:mj/RV՘탟n}r;:@[$rjxA{֎tSis0۳Vs4},SgQ т bokQDNVmRS -O-O# bL[[/Mm9h_TD.Ktd?u~oJC,dN>-a5a|O{@#'zLj,n)B×M*#+d(Kv[҄+vv z&?dàz exkƺ]_c# jϦ9}~]P7-b/:f|蘙S&xXEm.pgK84! @HdlvQ}8ǩ'!7 I^նK?<ETQ\#ո|8 =DYgShE ;c f٫#S" prޥ[EY+`O6+a\mJکM_Y7dp ] i}Uk9TnPE ?[_kףę', pΐGo} jg2IeyԤ-%m]g6'p+ۮ[5 7#wtՅԻWR?N0]+(G4qmMEB3@ILQU@rkaj+qm2BKi/d"34gղĄw&GGvрr&_dYn)Ga |1XD&:P0xm3%fhn9NN { 3k;9pjkA?3Υ|؈WqiTȵ :R l(W,dйK>n$QxGlKt:|pnXS=Z=czQNޱ0OP2ŷu}$Ro m&3Ku*Pt*U>Wڄ)eFp :k7?m'{ h׷ z|DbZq&4!sDKd[3E=w' A7#rB;Kb gͳf+G^9 gEu%Kl"#AlL-,B|3ھ GҨXM'?i'6LW+^!Kcu-~;OXKqVe5 %ZFw~]wݑ}flD_15Ғ﵃@cq'\[@UTO͙$ 5Wqn_-NwGޅw<9y-S#B} =BpJ+9ܟ-wX$/I~/HqWhnS!me }\H&wipcMQ쓧}눼H,m+K#K¢#rRKnvxnaO<^ڥ|dognLNV!6@nN9]_Pl]ŗ &r"&B-ɹޟʒDwR }OC~e_kM5deFc5ibu2#ˇQDxfv0ȫ -tHr NW1e~@䣮)ِ `جn5QyŮvҹ_8D5CNфB#*k/d g]R(IvKӨ yQ)SƬ"S| oBaδgzшZ?W-Yj=1c֘L2I56{]Z˷yx۲٥8V8LCൾԖOOE;+{~ewO +y( M7W0#` n=gOxfwx5cҹ6٢+_BhPr^9|0=PxgEzHJ%9!ueOuKt 0P JLĥ~vY){h8^Q>7pn[1α9V8欞j[ßm-ִ+1}Xh_dK2[x/xi>x6 P oFu+.Kf[*ǚQ.^u}y{'tRⱁ0VCG\ԖZ{Qn۶DḚl[Ax`4AD ]~VW-p[wc ]hͤ(؄hK^}1VߩV t7n#?5к,a&dΟH5HЎ#N#4c8nH{mMqCOLykJ 5}%=pӨW5T>S: d)ei%z FH*WC{R<<^F&lm:cV 蒌)fwB|Y@ n>cER&OPWur`"\]UGiOVT*H|oͦWFZё,pGsPST YQln"8c'dˆMsw%y#n_gvWC#2 `!mfجu2^QkҟF)s+{&P٣@ְKC{ NٹZS4zTd='E<|/F/&03$ >6bHU"Th qh4'U?CaF ~R=ٰ\w^ iݟU*nY?yϺ x9=o5(XQ~*/yJD'B* KfNq#\UH \?bW,FrOu#gԘ$ Q߂z(8V/ҋ!HI9@v"LOUvG|+|udYJMHq?:B_lUvkiͅ2VFGR8,GL%D!7tYC :۪͋kH174>X= L71ަgTeэ]Fwa P;Ӫ3Tm:Kuٮ6 =/i7΍40#el"'z]$>\0HڍIa('yC)V+`ԫlS};YԪ)WD`ώʿbN]G XVYQ6 ǥpss;%dbXb͒. v<廔D.>{v| XH 4cV`1R[ &mN`.`)񛮃}}QZ'#{6( qyܻ?h5*D$#Mוf[.)Cӓ,VHC*OSՀ$5Uʜ8ī743[(_, ba <]/!Z1E> K\D+ h?U!jJ_ij\Ig5 7 ^e3Bʮ^5ȠfS4-}2up3Kq==EccZge`JT\P >=6-oQ_`]C|ΒgQEmvn g4?{{hR!&ٱ>A_1.LU>h;o-CF9܆xy?ǔ-Aǂ0Y89eo/Ё O"5Ov+1_AzS%,sGwu٬V1DO*ho $ emXW`윶bu0h8rm?CZuFbW @wKӃ6x] ` 7ѹX56BYJC|wԣYޞ=|vDWzvTm4f(ODB)=몕^iYSmY}Uox&cVsO4@ ,*ABU(9fin) Ë c.JS,rr>f/9^O}8~>O7dg:sL&P~Ƽ> 9OZ[#L e~OVɦi-A$ lI'^8c!O P`ǠDdK9[}&6o]jEup(k;1Da+C:oX,C;v\X=gbXs*s6 d1˜6,T>4{!ݝ/\QSq†7涯s':#i8=oJF~_dz \I]y$Ml)hZ }KEKOUKͧ,U0ڈ?&ސ2۰ͼ a˕X-;Č;7_B1x˰OJu`IBN3cd'0{8% .XJ0<> CfS@-I9@Q.ZʫRJFvگRsdm-ֲCCrs_Pt<#!lz>>HK-w<2zz1x\fWe|2Xǜ+i}$ L?6?yҺڜѝn)ǎvs!PToU0ϼ7r~ؑv:l<ƕNH3< 1:QRU=4<.)S@q^3nQW@0V o(zk$GGdxK3yFTǚیUiW:t$Ԥ ۹8F^UZ ]OJ`j0}j\^]5bHiON/:&aiV C 7? #2DH 6uE}oIԷy^Ġlf7x}| {1ӹOic#{, ĴpK{ 6J-@20jaBi9 L1sg]}|]\ļ; Q] ^[#'Ix#\P"6Jօ$-gRo} WܷaY+߃_7RrUE-xwN?Dk'HG˻ÏHPF`l [g225q.4IXp$Y5~[٪ѐ39;_hsT>S~2v5Kd2B/鼌Mْz>QD+z3:Ve-Af9Ha-; 4d]ňфN""as19w pdT_IP˂lJfM񅯝ٶw!|[QJ&وg8r9=h 7Qdib$(h,Bi4G<G## v؅L:!1w=/ PjWe!{\) dұ텷 Myম+0Eј@>zybM !̲ea hX*~\u {- 6(4[GZ/2dgYx&.'Ei$=i$10 ^V5cth]~GlvPj)GfY=:P5t7-&ԼW C%h#k:xuxQ*k$;Ûˑ0BW;Z$rd.xF^^#E-*=Ÿb#NO.VӿE`G/eqWl/1:(F('+Y!taW_%"v5ۑYLֶ`Et&0Qɓئj}nzf+'%w+PrIi,N-pV J5.sЌ&uK|0K12aPT<̟}3'?s5"t(zH^1/H΋%*;+yiVh^~wD[ou54,{.p<2tLX;+`#]7vr)Ab/rK#sҐ:kצ(wwL\* 쎸ErF;,gtnX7sgOEK~ߛVHB-)|ECxI?AMyiq"$adgނв;M`g@;[TNDBfsy-b%_Nv"'RaC$rlU@^G^,ɳ >1?rߧ6Yi: fv}H \v~7Eynp:4ΧwWnl}Vnxc/ogX&j,+ݧmۧ=$PsZw>]VnΛ H ~'඙Vy լ sᕪ|dj{MVUV?g(S13V}λlݤsѤ^=J_? }*X?IP:gOSqd68ݍ5WS,I_>%YIʰi,x0 fհ3 3|;]h 7&T]`j}7XDw\,=ĺlȸt~G#*+* R X?0isLoϙiX)ȇIǾ*Uz8.Nt&9p%N'()͹:֤ l_Y%ֽlPvõI[9BbV_#NqMEu1f].Gw)IZ<8-VؒR yzܦ]C0³iȄ.0%S=M%0BLVj94rqDw/`[q*@g;AǸiQ/2~i7N WG)$l8x(z${Hv gĪYjwӼ),T^̄^igd^c_UEmƿ[Þޤ`w; (~R̎<5vIWݫt/*ڭáhL9JĿf?PsE+IR6jYKCxa{фxb%U@vw.Jslq=(//2rG)qӇ$8h~Dfdٵ9iD,hsh7i9ppHXmɊ{+TDBxݬ_a};njo6FG;x: H1ץ ;po^k$YʭK8^Z'3}رց`ؔ%C>OTڝ ͍D">|ݳ~&8 52״cwV8WC  5 61@F08nJ?-Sd&mt3ˮ,kxtyֈ6zKCy툚Ӂ& Z8 f 9/.j;EՆ f5omTPzEw;X w@ X0Հ QH G71-yfG̵F!OyzWcڻ RG8hSjrIǾҩL_%!>qO"7$>(/mz9̻bz,MmѢ p,xNvJrA u+[zMCuDdU^&́X[Ri ։,cV;xh2>"!)k;0-I/h0Ya] ?&|7S\Wf*L6ȱԸWJqsm*޺-[Uqr~ l0VzPa'a7Pɉꊡ4m)ux^_ zO&(uYJ)Ü;t66Ғm Ehڼ+@iGh.\\ī+/?"17W%i&$VJ+^AʍMY_Q@mdt H-~UYi.ѡsPcf+G㴌TJVe卭.HxF"De;֟ZT:B^,<_x*hW Kr8JmOFg(o[~uVY023zƭj" SpD9AD~vX:=b]I\D~,@M&=Wc oɺZuʇO1y8@Ņَ~Q2Ow1M.&1M#fD7wT?q_ |5mw_J o1cw%5eN gÓDw;wkߕÇx3`f<2jլ3dΡ+ m j2ħ7'b=AϬXA&6<.ĴO&68-a^˄{+&бJiZ*7p U+('rOJךlsES;(BPaOl/.).~h:`f\O1|ЁfDB2E|EkQ [ANȘm9{g,&5~@t͖p,)8:FMk;[?"÷;SSkm%nwVub|}N@s-]Khwmp24a&I}U嚟&Y S8CaUCVߕowvV2mЀb\+Kfc mNx-g qJM^+U.L3*L3񞉡qlԔ0I\c|::c4w NIFٓ?Meؽ|'랦2W9ؙjt%Gęy[7Z y,\(#T[Yq|t?bf^\e"esR00*k~ߩ~Ck^8TN ZҺǪc4Ӣ/m6?, Dä691쥖~vLJEQ4vgou7BZWn֨Ȑp.#C|wb}R6rA+_~7}';Zu>L9A`Va}ӂ#=|fwF)jʝA_?]txd?XS|P'"q^o28yN ⬰pP%x$sDI:A%!ڤtx1-5"w]=E"OB.ha<ޚ8}T M{ NM[ωaP /(}1|r"'z9sLG8:{mBQjYJ/0T`l"@K#EȱF`4.&vQ\c>]Ԥ ,&mlI6|3{زgZ+H }EV(R3ۢ-dMʉ+  ?kp#mݿQ:^EckY$|O~$/pNJ+lm c1yo,!PR(™UA9 / $1 w@?Y'f'z>,Z_bei+M͔ӧٻQzG 19ky<4>naAG7kiM0.si]5LS b2(t0k~qFi~cES)@:X8](? MNy9UA5eUz-ᅃށV . Ho>wMSto0JiF&Bgz3ϟ RyT6_Uygf;P9tP0\b}Zu̬KڦBG6>53y$ Cqkk* Q_Yռ tacO=>6X;QTϿ3@%dA4il+d_3wBF.'cn(BvF @nG t`c+(`P1$eDxA>>>áSnȉF8+`X2xs3QA_A&;ѿ[%X] oRQޖaZ$~IBD4MM]$uGu ^ad=^E"Ցz$ŜÛ-3걀멫il4JZ[ݑ1O÷ı!4G@T>r5 m^Rߙ7x_PVɬ3[E: T*П _i"/݃W :G{0[7XcX!L[?g_k6!=\8YifeN֪FlSEq^Tus0hVA?47Ԣk6WC9.nrٲ~\}i sPh{Ay:5ĉ޺ԟ2 YsG%f2ORS~K;aVj#$U[Ta[!&I[.?$V^*Sb]̟gkPRXVY ;i쇐F47=kGWhqG#vKY7myYdoC 7n(J~ )o:7laJ)iݖ:|[`M|\+oyxĔ!T$*gƯЎmM_\2 ?G]޳N7amv#H`4ŗxf…z}0q5ȓ>2o[9L0lEGTfy+W㏔X. p\ C0.N-@l PHfy-6U!m&ʃ3Pp`Y"4*\KhV(eaqF6Ƥ#h,vGe5^1:']l\H!16D`_b;iPK&X(GWhlBjם|팖]J76YOEmD?*%-?/V\SWhYs:i=KNLmb28yv^&NTLfk9 fVd SҐ_0dGۀ*uraK,Nԩ9釨/[J+ȨƄ%RUݨʏpsM(@Dݗ5UT"$ 5Ux¸k DK^iY [=v/H|N!=q@󓯡Dd^+ u0+nK:_ ?d/L@!4gn 0Lj$x{wЇX'8!g3A zql7rDEƟb euu{mk8gF?]DzqZq 5(acX ܞv!lXkQYLD :*wNAxsO7IT1Yfs@G kaI~g{t 쫛u]i+@A2Bʇ1݂u {kVa_(YspJρyz/$ *>gX6pAn7*ƈ#}~!l"$ixBH#K ]:_ /i?QDM*((@8ë!;}-8Nl/C-? B*q͢JJ?I#wJ9& DHU-=.,!~|H яi/SѵbQ_Bd y ,Q;s F(s˘R׽dl;6Qܰ4(HS?DaG4&˷pPجp7܏o&5xÕ :p, Qفf؉t+WXdZ?˓` *𬞟-TM1?"o{-dH 뒼Z1љeemd^b19ׂ_8VsvaKzϟ}WWT:5WcE C5$qD) ޢlOՓ'&D?^%JBcSǏWfد28ܵn}f3y,?grƙ%>8 !YtQ@yY`5!{C_$,l)`+:L=) nSҥ1JIp`ę>q:m0ĶYHtcbN lYoaD>͠Gh.UV?!s|>eg,`o" `|B7ݭ%E'ژ(nG?4@p61vxqw ̱,rU"LvΩ^*YCdsiV" KEs\ٜPR"+cDW6e-JٔCQ(V%G$Dy?PNyR3m(MT "ұRx"Mh?Ŭl=*E^͖l\g0޼R{R f_+R8$@V>Yz3~hɧCThEUϝJ:lT/T N2"^zp"$!~`kyצ"(_f Ԗ'7qy jX=d (/N10#ݟnM3PwFk! .Cɝ!'L3x)Ĭ3&Cű|G43z^~g1㳌b6>B7hڧh0O%_g֤nVF ]Mfr2DeV\Bcko5$qRڭFX'Zo%ݸBg0*lvJ~O>'Poe1vkBO#V"T􀋄 !L;jfY[|$ tG+3_<gMpJ%iQ*J#h#Pvr/F󇨄[@JuE x$s+*_#Փid@øZ{U1.p]SMӬ|5(Y u(q/V]x}l&!8_qlLD`Pe+V҂3l57d&C6lQ868AFO&[la&κ]ʽuʎ8 AtV[\}9222Q.:ԞxI (ݔx䆕e.1J$~Ш8V ڣR*N#z)[SF 4kD\Zc[ne& pSPɍܯލ`ȭmb7:n[`rPZ+9|ct-WfSq}GYiZ `cO6<2H?3k96s> G@`V[%)C(VzVOO[`i6ӯb/R<+!df΂ |r3Y)r$-69Y3hġl`0!\*E=`QkMʎCfsBYanh.eXuP 9* mMEm W]jq;0s"{HIϵ5ur,,LD$BQy (հm^ϫֹ:{-7cXo9}."1">p v*kA=zi\}D]Vt}kE6ohH@B#iYD"KzWG8/m>@:sOpL@ !C-oJ_,@(HEgE j= l$Ix3P77=ޣ 5i2?ϱa7O dty$[ͨu.MC_UB!v?9ME77." j?X;ɢoYt1ObM2rƗpﭯC7KQ?GWwvYq`Js[;R8]Pa2iEl/4M |xHI}/ѥ>ra,$>2#YH5@eBtt[`kT=(KhK1&A|jZoy|y.US2p32+rZUOGYϓ$dMk5(0Asy4YnbH(jE2q^٫B(ɢW#tyֺ? "ʚW>BNQ@l-. <ϧ~ :9{ޗC*o*N\SwS]0VevZ0|9AR`aَJ ;4NtQ|6CA׎,wk+y(ZNGVp薰ȖOӊZËtYsf'A ?o&6f%_FV>Z8$2%|I4wʝ&XUN mHC@ ؤS}~q ۾atϖ-OnˁXإlй+)-v, j=JZ*IFA.⵽R3)mipT/mʝQb%㍠-߱䬣YkwL#,ʸm_di9<2~Yt^ZaWPs43Lَ*C-V,yXA ֤&•#&F 2N RdeUF*Wmc.-z-9j[R >vzRNY_wi`KtgvZ]CPCx+/i e?Cb&rL*s+_A+dMQ wPLZr-VZZ5V8&^+4B5sr0){ZnBZ杸~-}!LY<ۑe36GVp,'vQ7U\Lk!`y(9c\)4CEn:0[ޔc5_x_eșkk*};1Nihm*x24){A;m헓";|=wЪ7nx[ՎP>'Q[p=,HTI,VBk>ja#4@1 rM1/$ԞhܥC`q]=Y 5HUg{Ӄ_ 1r@iIll&9U}rMaX\_Z^O$^pò)KTnݿz_4?!iس  wj3yeof{kMʻ0n_2EĉJeǣ5H.J T(%5GByKo_k18:6obMCˀƣۊ\{ˀjN4nȘm#0{H}~)!6EoOz}Rk؅PBtICpo`k]LWB˜lh9\] E/sShv/19v<.In7.Y/K@Le =+i;x#Pz/~$~VA&FV3$)"c_ܿnw**R(sm4m_VKsަ#e_nMwUE>pFo5E+i3:ZwWj&K[Ew{t]T3ח;oM]N(}"5dD5<;W? F8B5FSI5l|wOҟ2mdCJQ|gf\h9?C2KfK_*hM^4GLSKUݺ%++?NkJ% ;F161U*qmG&,P{E`OfLꅗSq7C یL?(KOe^C\Wߣ%0/$'bKUR*}269X~:΍3*1N5X}Nh҃N:1O, de14D!A)T7'+ o^eϏx^T]"%?9OӗtKqIG:rjHgEµ<_RS"aKӫ˵ ب*UAJ 6|98×Mg}wV~(46=?ޅ?=~aIj51 I!$8TV+J ^\\b e`2hu) mJ6V(q3S \S޻\z=jK=Jˡ:.9'`qF62c&tI][RdzS"dG|R:$run=0=O2[P4r?#v= 6J-ȫ/){)Vn{1ʓةC SZ|$Q6-bФݦ`ύ2"=$̡e#2*q6/,7 d:TNGPԷe&E;R$z]Vce,&i?.E;B X>1,0QO &7L 7]{m Nw2 5frnL9X 5Ɂ; AAV!|RuU]6piZC'T-Z*BPg诙RTN UBkoT`rE?+ܾi䩷:/ uZf뢗 '9gSWP*wču }]5/ k4V,G{cMßDgp&aoy(G} LFZy$!&4"T8`r}]6&IO+#9W{#i8 ̦Cqh<*p#2B%E,xOu?YIrQ' eGd CU}d2'2!&r+_-$awXoq3i$1jpEzXIV{c #BuP_ 鲍747.O &W/ ; ~Yð L׬b#$i&YY)GFɷQʴmF|Pp]Lztru. !{Y%߱^ra7ɤ,uL;3^HIvCg/@,A<3-s˻ŵc?!un{t[_Pr[9C/M|i3ф"! Š,2Hڻ:XMBqXw .dhZ9PL7_n~CiFt= ]ˤX$+#5 ]$'zkQ($c L R IBD~T- ãUa;p\V2y|ptsARRY)o U{+7+Xh2c[nd!_zek#f.oX$)vWfZz]v&bŲ \ e oyxN>3eY, ȷN>1.ؽfpI-INCkI,}h`Xh:)&~ȕБFI;f4tDѱŏ@<c~XE˗lDf~n|gcx[#5B]Ut^opbg>%! mSb 7~?+'ͶRj՜N4U(17=_zHD =ڬ#d8Jc7n2nOԴ 5*3i!)nR@!T؜^uNTs/g +ij{5kIPSNN9㙊Zm:Jy hKƫxkbmf O ~|ۻI C>/z9zXx ۫5#(iP_m J~o7" '`^xOjyx_](\j)!/ 8GA"B_hGw:x29rS)euo@_Dy$EʙO%JF#=VH8{}>@s+h~Z.=*п 6$-UO9]yZ,KAɑ3йu!s=pRsЯ--_ I]Z8o@ */3,NT}wl!_9?0F0Ç~2Q{лChHem` HP+|N+ܾNoT CsL#n]L+etu$"|朖wOnkF'8z0Dn4^Yn=|<jpu[.-atЯ+TN~yazjSڛ e}}wIVOM.msK_6lw1UӺ |17j<صߒd,ؖH̡s}9Ǖ)s@!JK5;t[_3TdypÜ4pHדА( Sdďɩ A9 5IxHUL1R{Pu}jq, UŮ1E۱ڤڝݎUk6%LqRNsCBGy/,gzYgopktehr$~Ӆu{0Th;J'4,+ՂNLwR}$UfNqY޶5@>_*LD _x3ʱי?#0U' N1G aZo*x60E;$J?$%1 tq.QSژGI>v  MQ#w9%=B//~6?Zi 6@v#m|5>mBQ <,+_?Xʼn7mW\; rΎ~#+K PATRt0bWk?1>?/A.K M9d>'~Ob^oDNFC̽[%&;D{{M$~m*giƊ3z}p!I$qmr?&%l^ ~( 9C,$ȅ?;sT , IZFQ+[Pgu|Q[<?ՑRSl}po-@g[}z5i~Mq$Lz0:iE\8<^}pc!߈M[H@ϩxH0H) VԷj.0VNdMRSb9Y4VO[϶ZĠu[|߽c5 Jп> BfrL\ C+Ĩhn.E,6(bmNFb"l&8sG*f UXٰpB-,"l_7' y@*|ŊWkGޘ.viTj8ɫ+hk\3=Qe10h$7m ,=B }=ў,t,HER.Cᡁd|8t cuY!8w|/ߗ"d,Т0;HSwWYY?!6 DEvP bh@Z}s.')h*aݺWMa# 0LD BYS(pQ'h2$`Kʹ2`IJ !:A;FSϱg`2:8%X"I2IqC D4KZ3i?cjj5n)'Y=R!~op`Uuj%\*U!HLut^[Jz:1O*N Lz@q|ެ@{Qo˨Y%T*OF܆cմ@%1}@vM ŢXө-K.wa?뮂Y˯O0M([uCSo;ӯxq C+T9Xe! c{,~Ȏ4"ISwQɾ\loYh쯽*?B8Gf4԰a*vIFx>A@ rP\r<4M=xP䝘̀$$踃_Kk`]n_@A\z"rMpgČsTΧQej+8>lwIM)blQ-G1r3hP xޡI$ءxg H\O^R q٥~2~]pm"~ m%@h+5FПnMAz37^0 "џ,,7*K>s)iF?wO A#soYAjr#&/SO4غڴ3 qǟ` ||q[SĢBY8Kڂɺ)Gk f*ƋcD̶x}pOV!Zhe*Y0zLuMnW; ^쒐 'FN!-vX&'WS'I@65ꊚPb9mڡp&p-Ny͐\~rB9,Mc2pn=>Y 92!\CwiӁO1UrĒA]HoTsk^ccRjaN8D߭zTw _(2?}gXByO#F IL76r1/r0$"OM3ј PSKVܑvt0wŌbEtzO Z\] 1I?b(Sg_̿Z^ċo&H,;ncПIikhtvty7?/3ļQ>ռ6fRm?u|K:vM'3uyEMpnۍ&3/"ӴX6ef\s{o{XLd"Xst,5!:E@ۄ,X?#KW0%Ӄo%b9c$o?͆7V-~,ɰ "bTs|8)g{b&-Z%oH_w^ɚ&d4}Q)t |%/Kpou@{ ؘ2Ge\6B:̺ hEjWMTَv("gRO K.@fAyF[n:{1YG3F?&@I_4]E#g;ju4s3&LEhNaV5swq/.@oV]p8{NAȭ4DuHn܍]>;Z?\86$菁}8[UiHd<&Iכ'>ĂPE.՜5Ւ됈sD2{/gm? RR4WzVģR?9-[DZjk\ 5e'S'~fSRa]=Ӥ^20Ŗ$:Ajm(K8wQC;<8y`3-^lH3o6Dcysw=Juq$l]eL "4Zm/#W̬;,lx*i8I*G+RX&ycc]9D6q[qwߤ? .4o3rydHv'oLI7H7/'.c&V?vsŨR/1=q|;]Lw mp>𱊓Da2AnOt @l#!inCJuNRP1fB0|}DGzԠ-rݬy-r|;7T5pnb8+ػZ,%S,5CCz {N̍ @=y=iO^ˎi$̸w9@o=KMZ_)fà .R{n/B3X0;.J>u?_P3Em]g!pQ8x;h, uK܆w Ӣ5Nf3DXB`P34 Y]5ykФL^u)wOjpn|0<!M7 TX01nwʏj#sZM=<6m@q8t䛖HR5[IIELU[°naO=i1%Yb)T=#͘[`Qi(5hOhT_6ۍ'jSG.Og_\:u[P1b)Tu*X{%$o^t-3*j@#8'mǫ6;B* "R.)Q8@'? I+ [mTs8W"Bga▞9Xf,O)]WF$BP!E;^Mdy"%E*ot0Pfrsvja%6_HL T0|cO$g; 5h3-/ \T7wGW ŠlԷLh띂3RQ$sp. ;k1PJ$F+fIHq52Ŏ`geMH"ߢ(s)lu1;44CЎ*JDCmhF|#JH ɷhc g-/AQ&"Hig>Qťd6{L)?x "_3%|{u ja Ϳ1ņ>_ ) Y. PJOls0mPT1x2Reͻ~dD(|Sra)Y=>Dž259XrmKN=Do0L.|Nӵ Mح7h<RN$)(t$&sVwR[ZGw[IlQ(L¬j3 \d$RG|(1>bw wlg4R[[Ү,R^Sf!=0CE;MKTLZ\̄.ۙVpO 89-p<@%׃ À>Ԏ#c׉@hS\JtSP^v G@|ݓNdP3-dIo2)"~BYyl}0u7|Zt~_>͑u]4lVeQM`#+hk?M M~Xzm1'\Hd@ϪY W%cj"7FT3g *τwR 6NV\fk uW|}r0YͪBE B⒭Ai;Tz<]C\vZqDB545*1 R*g֮ ]ڄ?o)'NԘ2ǬߤH{W%]T_t:x޷N'# ĘzwP!" PJWf޴3ަD_/ȼZdtg /'{6?A>E2 ')* 8TpU)MC͘dSf= F𦠇M6}!UBFU`˦eBKI$к  LؼľE.vÐ-ЅJ*d\%Y b((SiV|P9"qMRB됛" `xiD_4Y!”7~aUj@ [<Q&9 L]vrP(s{4C%0ECҽΰToseA3fa9oč ( ٘cܑcxW=6gYˏ$mwa7kZLS&%FpTDEz1,xqtj|!nBu&*6EAZTG,>fP7( @mhc '@2,|kx&;OH؏1:N%|()b"\v?,gd>>j=+0a-XB0`}o^X3}Y*KYNB-Q+o5P &:}>YPO9ԡk6)noz py4r ճǙx'dz 7UIh|됙B͝H \^W_K3H:r!FnSwGdv D>Bė+;>pDq*{fYG5ʡps/Hѝj_863m}s@WkS:Zu{l@ɗi8mN\]~Qtx1[{< 0]TQQ'F7S3֙gФӽLξqmi1>[v|XQ"3fu?q1=PUh]X pF>yI /ΰ ~4#L pyyfhKJ@42C$P6Q! ?/ {㣳|Zo#繋 zv ["*oި,ěl .s@ޫ&{u@ee[ yZl[bU,1Oҍ89ُνOCľ\:]zk.gQ [^wQ{Oe(bXx4bak JgԘx^ﷰ垾t)'Gq΍gb⇋ĩ%ZUa3~[6".a6q}ȎU?SW&%hԤjTw&틁GDSՁQ5ΰ G9 >Ly싙.*TMy94fP?!c`6i.&]0hriM@)RGjlSīsv ^Gn6)} 8-}W)Z8,~Ng=YNf.JzΎ.Nnh@XDM yVgmV1Fzލie]'463JǶ{:uf$oO.Z݊3sYo3͉cLfv M_/{Q8!-1O1`|:X=o%gy8h`d}UX.<4&yz>ďyXpȺWd:N ̹߯5 9Z rOjhhVd`A2"!ZR\~"a ~vLq~֬4(уME#e@t|AfnF-|ެu9ňn*+چda_%U]z* VgTqeʼm0%Dw)%)f-rd4EÔ;j& !Py}h$rV,ےөRRXw칩谒ɾlb(@Q C#"Om9:#W> ^;H YXaB4:H)İ{iJvd<, n ) [fC1!?ߩ Mc|b  @_=e+ziT? M v>?ZP'wvId @vR.;ǻ(avF3%SF{ N f'KOD~ˡtHΩv/`|"r&,D,Lׄ<~6/K wث҃WM:-->~7yibdγ*ZMIO30qy}<~x<Շ4/8;|R"Hv?-z<(7^rpQ7G.Ńp:< 7ԃ8f[΄H֎N2?Ƙ1]LVɚ#X5ݜ%(K52Jx'џ]Vӳ8 (KRu:jEV:zw['5[MD+]lkHWt\"+'&j)mj#Mj,yFX{G;+q5B9#-j>y[}ͨa+ ]#M 2o2 *Z kBNy>32,Ԉ9j屠rsJ cM~[W'Ub }Kxm^,{2@xgoh^Sg]{(:zo^nq1g}@pD3uжu?|v_OKIWU*'Êw0n A96,9~''Ñ82okE,#<6>IbTըnIeӲ Pמwg~4cȾ[q ,Ea^傚cbyփ;55:w65z>r?ÆYJNxN>UMƯ>XT>:/mLǿ%V= s-GeiHda;K2p/OլRЗ?\Snjb9C H&5:5^(ۺkŮdmXw?[Qb5\عJ+xP>6|%erG1 SFC{Kȕx `IϬ6H ]qT Ih̪ě>x(B1^.H' bya飕"" RPAYw|a1:ʤ7vM*+.TsqCu`CxhX!a00Y=NZ&s XdN5p\jD.iV*U|{-|-"]Y%3D[Lwhæjvg<nwpOU>lD^}wiQ^xWYz-+f:΀y7% /VKtc$詴~jo!]S7Ǽ㢞i@m|>Txh1@Fcyx©Po:lJ08dnWަLJ'\[a`%1B<bhk/rN!FNA=R3SMzY<8j,Oʒ9IEq 1ߝ`#.^/1x#9tV50&p7,5<:JG.DzRP+s?FQ*_qdzVg/G"'zX;v Z/z[|ңsvN5^%3$c<3PrluJM!swM2B`گ^# kRJ`†9[tT&AȢS6BL"rMjLu 4:Q t0= D4Wؑ[vDW#s&mPTF+ RM!fK}HPձL2&!#0ʋƂee0*?*/I).+q-[3R"՞+x`Uq%-Ew?pt626w+rء5Úk((aKyݐ[Jm4 =UbQ©$+"+L+\Tp"j=/M&"&^eo4 +_žb*~;|I gBM&=%|ΑX!<&V'qF){PV?w6gpbtT7̵]T{W鄫~*JY5Ԃ:/n$+mGs?$S)b&ٱoX tx K19e67\B[A)b? )3jL6_4H\b2TL#{W^s$(.jgiߏÂ65@mύrJ ; V5z424ORrNkɮ76# aLʒ+4׎/1l]Tw4}sqOoiQ YP! )@E?:r*jR预u'E71t%' d&e8l-Sr ߇$ *x6ބ1K/t5ܸhGbi SS(c:3#ԐRd <=L uRRĚc\O| |6IXLUws xIP,Ne*ˈSnJgxoڳ}S;W&m=W _9˗U߾b2Ne)WB'X E>-j] y0l&Ξ B V0iP sČ(_Q9pT "*WO%mH8,PFogtROgJ[K֖Vaj˜@gqx1cX#8KXq'h}[vFJDZQȻ&ĜZγڋ?hNMIEѶ>lͩγ;~H8~_ ?^- $bscꨁqgwczG޹TcBBg*v~}Ö%\8+ʮq3{`-"NOX(WZQT7šh".L!$;!:u&H!kYRKR0F}:A'aec(}"@,B6dXŵP(-NV$YAq趦xq;kl'L\/p3ʞ}tlJ6 'Omu ,P熲|/gNmݱkZ1YTD^oiG|]j>^xç@u/ GvIn7L`y JMM}O_Gwl q)7X?Mqio>,^sg)οf;Aqkhʖm}UPxc#Se!&K:e六@{oNJT498& 5 ,k|X> smS="# 6[J齜pfJj ۝?0f7"Y2v뀫R*қ6TWQo9|tUAvl%Jyk.SN( {|wF*ܙ/-([\kHgʰ(kINVD8USYCG[)AK#=M-Pi+O1ܤؑNbZӵ,14!D\kcV́$9TҠy"[ QrGJ6nIOHHrom~?J|W=r= ~w{xЁ֕x6jpA JU[xXS]wgvj:1_e^"d*1(KEmÔ(fn "m@޵65*l͎!I>-n')h;e{1һ:X?'Ծ'bk$|VoDi{S潩J3X[bVБDO)tuS S!.y9)@ݢw(w%*6dcym ATYNܱxc0w^GKif12=͘v m{'VU&|u\jvh?9]{N 7Țk1~88 LuY@x˒5TdOGYXMz4ZB_{ 08{d*!ҀEg 'a[lm.1gq:24s O/># OP3,|ȠAyA}DT^LXϮ+TRM!WtֱHpaz70;2W]-/q< UzQ\ Ÿ {߲`ߧ]ExT0ЁA"^2G3:@ШNzii14`H8owAh;u T42?tyy605'}ڤ 3k⥚UnyY} òAǯ6ZvHUp;\VYʰ|!@l̥l)F6]r/N\JyV v2G(FoQ=;!96T@AHӾ(CEDClcGH@Ȱղ Can u2^Z쓂n*pKP@ͱڥ5}jŒʒC\Yb0!I2RHHuUJ6-L ˌW U`J{ap6/"5F|s鬶ފu8+yyʔxZIK":'VšP\,_HS{'wc,&ZLa 5 ňY e"t(~(h *{uJt\A*Ka*p˕:$d>=l,"q)ynM: ڥl)U݊ bT@LR~4}w^P Z"{H[CreB/`+t&Uta8A"7:0f9AՆDۘ;<kML!9ASi:yLSG$=uF\C_|dv؟P*HwѬ?vQTkfȅrФ[[痏5Kuϣa<5Aɐ*!7g=N=@Ľ?~%Oh L(}!hCgq 6;30" LYwޞ<|mc7Č dCq+xȖq)u;v1\/d&pd*ED! Fg[]gX y@#$̨ErbR%'r>11QyôGSZG+sjwI/-g*yj{>{t m,/.Vd/4 Wxdٻ.q>}l`f۵IRW% J2gDDMA]/Gu=z'kYJ+ bE3>1r%{步]w}2Ej>3:IpgsP)S ®%=}B6MEU^N1D!Uy옝,O&Mv'- L-Vo.WImWP(t1::pvMUqk/`PJ ;^ p=;Z/MSWdqsu(^6G1xeƳ}0О|3قre#Wn~,uC1`xⳍn |Ł( >AUG9^L#G~KI5uWsaӕIFCŚ.w q N$)Z;Ѹ{RǚK9;@ m@ v+syЁ(ebc7Z*HgSE iQf3JWp}hTcS6vF)KlX-ٹH8cHGɫq4]KۀI´v= 3PF.飀iX}º+ƍT13%=*}1961VzqQؕ?!E6N1Eb]Rr;LJVx a rw:A'HR)k{5p?3dj/u\qØjH#zEax(\MNJ ,Ѡ;8P3a#.myq8QI*x^_a$.38V!!f]D߸2<џxbm?KqRE@z<][r#v{ﭭ3{MZqC[D9hA `S!\t Xܙ_o6<'Z$ohE+Mj)l ~f{%6i|NJ*k}#\!<ԣ%O2 N/{Έ6VpA~gs=䊧6J%^6(P)*AT5ٿ)Eࠜ$,%xNd~q:*/@Ϡ %ô&j!߼1pf?IǚyYcfhfDkhwd%= Dx}sG/[n%Qc5z@[IZYűo5`kٌ?jp?_O[xUcOp)C$TV?O flV-r\ u7 XW϶cvlZv *N$ َ`a)NWK0 QSW0,[,Y5a3(K<|xDb1*^R08ڎl&o 6E ۟4.n߭Փ;"h&vh |&]zW/r|fwV K:8= n8 d6"3yj=!/yg+$gg/-Wu \EKNXOV<@#׃\ۋ;f=~W"/?ɘ %FҝK=K]̻+V`G;~ 4p >x2/wʩc8 dgD'a-m*"0!aMڈ:PyÜ$'>RWO׫CjRȁ "p>aƨ=SH)t3X֥FJ7-Wљh_Pn$=_zu7Nڸ wdq3*28@henr|}=x|#a16"2#>a5˅\I/>Sn#'&lp]UgeTp9z)$ܹ>hЧG`KT`8QOZU ϹȕXn;/"ӻTVYĭ0-;%#,ϛ.KLb\Hb~*[Rƾj-rx.XQ(Q/({ #˧jrTSCƽikDiKpMaWya AP a2Iv(+Cb>ʎccAΘڴ4.z$Z)Mf'N LWe#ʶrzb):| Z|8ȑHu1vBfڡc fHgRY{#=*??NBBu[iQ|/чuS''eywʕ4ˢEgވK]6v%r]-'So j.{ۻr;ѵǎ6I!GQsZO9qU!ǻRԴ{m-kq,iI hb]ʥ#S-@ _y][^z[⎵ce)4U/?e֝>Sg(ēʞG~lH[D-IH*viv~Ӱu5sZCYm0YA fOePd8D8dH:|w-Δk' J}:?+ C ~1 Ӱm' X"5РD ĭ^> ɣ2ɇW)ٝATj)n3/s6JJ>X>߁^˘\91vqײN>*?j[^?(bWC+/!Zcޙr4\U _3x[6VʗYRYU?f{?#Iʄ=3t$X 3} ܌˜U-4509yRKA".x Z;L2KymXog` rlASp!6lJKv,$7:2j^U`LIa)KR|􇻟qn{=(YsMYfZwlg,F*;sa%Xu3@ iGjÊ]O(la>Y9nNŵ@E s:kh Y*%PipWĔ>f==(m~CgyPPtQ~鴛!5rˍ1 ~q+ NKq_&=T2 =RQci6 IFZg#G^J?-C_ 6X2X[%޷Ɂmqe v"IA`PӥAq; M3zˍcpB/4eOi v~ƆZVB46RHh6 [P Lvly52\רzshǑ3;=Lܽy筳[ acO-D' &S>pfWq!ۋ.4M Rwz~,%Ϫ JKT'Khe`_χWu_Eqii*ǧ&!9(}-jL]&}k̆O~r&^wb%l\̼Mqق}Q Nu'![2a. pd:)B:?qNr!j9;'Jtںp0+VRЖLg?tJYcs͈Gk+<?VȪy޻s#loDw">s~?Q?!B?ni߀B0hz@DӅ;5a1nWVPK-Hjՙ"UQ[G< IhfL6("_58Ќ/'qIbQmaZUqŃ 5ZESe9;mIA2AAэ^;Y((هHL$m#~>rVo`[q/PE}A?Jp;vl~EQ^ь^Q7˥[K {FK p6iwL6Le)3'J6mӷ($66lM[7Wj7&^yW&JպQ2>5-Ǡ(GOL2A}ļ2<ԧ yM#e_n%~J$\xY0Q'$qf]p!<ӷ9WKM>dz'裸Z6Us/9$w!yeѐg͛W$\(6u~H(-l#J8%=jVe*3ϫhܛC^؍~ryr?+YE*ě4T@yKxZ` J @cƲ96V-y+\ coRP1WNL˺gEmmke#@Ň-qOF 7(j+gmMO\_Ks.'[tyX؎R BXfAjDg(=4gI' 9źXk#+-s}œc;'ihlbR~H޹Ο|)BR,>FsIïA p5U#eN꼋{J嫠JJRr r~? eZWPPLrX%>8PxUU ܈8]M̒t(%3n+0R[a\8]iS'h[p'[uɮ~1t.QYh}=k~S[wh $C |YYhS1*bņo[ A `Zl~IF-\14Ac[F :ᱡ**ײI,R^ HM+nU(ν#f;;Y+??63pr-{-o.g^V؋Nя[XXfnGkE}elZ 0[%"X"H3!Ss0R.=Rf)dzw 56Jߔ 7v΀H}m:v'LY-2o6D5{|*zih#ˁiaxYr>WicclrkcEJ")5%GL@22[VQoIM,uB@bJ@+Md~Et h"责'f9J p[v|RbGrCѻhkRejU0o ˲v.r>$,wd<Hb^;k#cT&T4".Dz?*2-K9&0U|>5]%F u&PCx)zp,im=fdbr0XB>R"ofO7aPsOVSGlG*Ne!i RwK%QBes`.̽D Rvɺ*t7"zBb {wTxI2j)xc<8-{Pj AUY JN|'Wn۝Ȣ/qYXS޵{DJ'DgauWkL~s]3=iITh[ZNܩ2N*8qO3LuA%ݡl>U('Sƨpx;s$<hrFf 0«\S.QXeesL:YxRh0:,a|P?aC#$k0EAwIaæ8ip8/E~tSkƯ Whs47vJer3G/]+?n TC8/{ I2@Ǜ qz 1I-#_y9/\H-.Q-'n[I "җ& B7PTiңW9 TU|[3upB޺\5hv?RUJ+gz^#غ <>yQv3kPc3NmЫ<Ӆ뜽ӾHpxpr60r*0,9ܱg XWRt{gJw@gܻ`"o ]8iKƔ hzSqcuR-Gޕ̻*x GWyi鱂E+"ej q. о4aFCG3Edm Pp#14p23' q)jȗ1ִQyj^ }^'B J`(r`xt5&.J#j-RE}I .F~a,c/&/⺪6/ggP9--˫q2õL쒵lC')XAVHdNY*EkK(MG&N 3""R“몈b0mݧY|:gaaX>;0 .3le Pqa̶hSAz4nl#;Qgc?y#^G/r`Fm"U&GJ⟷etDlf턦Ev3tCFjzw" k ݔG{tWeyuI@%?m H/PeN9M:>טӇF^gJHFx>r<@\n0Ç50jmnaBtMvO"XKh/$; G ƛ10nƊCfqN5H63"]IO/~,pzCE8O֏-Lcą`pf>HD`{CM^1؀=R/%"toc^$)MD0w 4t b[1 DJ"L^\4D}-J kѢ&!po?5MhaP8O 1iX۷Њ2w;*w6*k]<+v nH"BW1(i)-,+?f o`+Zh6'X" Sd>%{"$(D.)`<;1YgV,uyW @oXBx?8isdn_zM~< o.MOG4f&i` 25ǥ`%) O%h뇚4ڌ8LWV &7; Jq%&>G&‚ֿ4ߙ u\;.vJl6BW4rSUrl*`7݅הCZh>(95—7PGHZfLBG>:q=JAQYG}vz^`ᐓT5 'θ-ѫuHOwq~Fw;905+'TVDg\wx?H]K aP{{W/FMvW x3gP$; %' *Cޏ\%rC3? D m3}.S%tI}μ/tAQKmВ~lS3v Gިd1$` )+jNJH3IBJڦJ&x!Kos2>Z:(2əjd+3 S б_msz|l`6 w#Zlaݷ7idT>2 Zp%+@ מeٖ-=+y18(xi BG7*2,Bp PC o So{˦\$+la*粴+>]=fiK,[ej:\+ԋ#nx:k"0[QH>| X9(rW,_]~U_O ѣjKU"Xkq޵2ɢp; 2rl.Js+-Q:n]աTۛ9xX//Ff@iA"TZ>2tm#؝sؒ }ೊ?¤H$wm¤4Xie ˶nsHt<éP kB(I]՚溠Ȏ*XrEBr~ks650=n!Iʫ iTvw"g3Q+YHH2+Vx| :7)~ĸzz6/"]qC0gX=y.a.Z6 x|p~癃$b:d<m y̪* ՚{qzZԜ+\ó;<- :ffK=uUUZ| ءV"E(^ cwk~&g6\Fqe@e1}Z #"dW#r>) 6!+v3א%"S}bTIuMS_;tTk2s )'n2;W$̪eG$흢1WJs775i:|mLB\H'\6R{\{O|+X}Y#dbvg {@2rhޗpkt;FqjUdSný%CO0ө 8Sܦwp)չ~"ޟSR,; MX$wtJQ~1j/Q j5uƐ茰b2 ^uĂa̰^P@0s`Fwc-͢(Ve,?IkႜmA9uؤP8W[!%q~DR@- ^t e;"Mz{α~c_RUzz[*.pduvPPZfBòW%mx |"W~< 2,(ewTȤAڗ9s~P,z]2B:9[QFcw| $eL;Y֓,?ftt_Apk:A_Ȭ̽8݃hd2%bܸK0Ռ3Y`+\Zd>X]|pc^moxlplGחP BClpͻu -Mi]o+|^,,E> LEcJ5Z.̒[E ;϶.9dѮizȢj'9`P.A΂6dža)N#x=Fde;\#78rI~Hfne+;P:ZN1Y#N- cSF’mކx=G[-L{ ̬\{Od/K .L_$6`u ^m`$ oF?0=h<@BU6$@PL 0q:5uGSxv QCLXya ff+=ύ/# FU ҈9/pjG`jpH6Yb0ӪaG&K@ælI;B\Q[YЦ1dBέkb3D i상 )$GsanUag}P 2 x=VQ'}wr1o B8"[*YeԬ6IY;Mvmw7ƥ$13eIEA:.4KK/p8LaCtu1F}58\*1x aN,>Y,)wJۮy8*JQsV5Ɖ Iހ-Zi =* ߣ(1ɶ6STB=Fjp!He*eY3M pe3-sK+)QwKq, /j3 *[aUیР9 m{h17se`+]Iuk {#9@?w4Xy߼Z \sqMXۆ,[3FAi??)|H eS~cz+yBhtgZR6hz[NérRYYIEC6sO;>J!1{`CDM%]x7la 3&p^|_5N% ́WR$њr+6U}n~s7 N-I枔`;Jn]Y'T1n:|L!/;3`R]$j71ʰvɑTK4I47w eRu1,slߐsI.DU{P_8 |!/lrc$9,M+pZla/{ͯ ,W/+QF˵&i۳,(%g< \%?ge W&~RJo^n ;F`КC[*X(GmN3]3% 0^D&ѕH'"Y IŊ Q5OOQ>-.NlE*–}U{lj6Aӆsbm;鍡.2\/7|WA'A*>eز,b/KP.Ŭy&VrႇEY7o |Jj+~].V͚cME{:\\$FKws诰lbM@eʥ 觗I,Hza#ER^%I)o;}wLY,0Ed9)[bWR]vvNq{Cz37;N)0%~ BA?xͰ oS%$f.6B;F:_B4&3J\L"`aPȚo$x=)&i=VxjZnpbR,0OI?A[Y9oX:!gC)..ڸ)xr#~jozVb y>;.=7_[FO〧Wϩ:>h^fbgaZ+OJScW'-rke=ԡk&*T5Wu|na025 7s%tuADžǹ)Qb?N//R]"RMz^|7usW4(k2A#6|#~']]#Xp y5Z| 4PNy$#xf"<4d;yavor"Ei< [dr |LDIS emR'\@RגHf=F{Uc4-L=h&Sp-P`sRFj!1vkWഩb e ^34.O0zIʑ򓹕9PV}W`;1?CY"}{$:!R;+b⊘&x)UI^|YJo$~T3ngˁ-꧝ h,Rǯ1Ras=7K垌R- w 4wIg55ij*- < ((ꩶjϼ_ݎ`?L3ZfBߨބgPGuEIn*bYU_}pEia3 < Jqp0DtA*ԅ/>I|>(fIVa3y;ڈ ɼVhf-l!1Z,N4TЧF9_V=px%]x:qitb};dF!>>qRԿp\{΁''+Yl_ĪԪ(@>"Ux霈V*#웎^FJ Col7$ ciBdP{]ŀtf}L4TJS`!nn m8vHj(A'"f!ی`k<ߘ#5"YcƜ;q\ĬVɗF_馸0y쒪 m6`54AD/s/؛ g͟_0rl Eحл]qZ"W ^'yNr1L!&0)hFg=!y锬9# +UE:3KFȼ(*ݽ[5"㴎3s]H,}195(6,gDxxys[BJ7I޵)> .& 9F3Uoqdrq1d.vBY!LIH EpV)S/2ӉY;ZQ rV=T uO&Ly/i)"٦bZ]@ZuΨŦ˴xiWWT1gQ}94+eBN%MBs8@ Ie"^** +&*2˔  uf~HՐͨƌ=, 2y? 4hɟFW[,CLP3'1i"w\Og0ԅ1>IJ/Y'<"TK%>"3= 5' }V?L ZLO["Yp˜^Fx 1U6sSYfRHַ|IL?C]m"^ #jV2 /n$Xf,Z*AK3wUw4=ФhXv;f?`xZ,Wݚ=0z?7턶{'<*YG] SE%!ߊ[C%h+j@Na I"#| ^$oTzʻ-҅2T۲Gp.(p`؜( =O?=I3 Q+&ӗCߍũ-s*AO<Y,"CgH@:t+Kٗ,+[1l5;#| ^8Fn;Vc)((Z>۬@f/AGqSy}GL[Oِl%"-e8Ҫ'e:6PyyoG\ᖩNYL`,Σf568n~:غ BHKХl0pyݯ+ŷ/*0i˻4P9U_FVvq| PYpLyyhXF#jצBה0G-1~@֬B%KBcF*a4$$e>sդ%m 5[K*iUg}4t|.EwE[W~ hg/2l0pyXӬS`@r1{Jz-כNƮ>̰u36n.xi#m=Y ̢Y}Yn:PP땘=7(2{z{H>Z$;OI!5N`ye] 74;AgYIҔ ڞ \`Ϝ0ruW8K;WY~ObLτmϔ /8ā6ԓH T0ߧ@Vg@UŦRtq*׈z'jR\+Vz]X]j)(ԧ^l%F[-ق'JS5YBbԛQ ;Dӻ; j>(a˟+s ]Mo(#%1r\DR Feaɏy\DݛC.iZqifjA&$eMgƧn {uGHFgw=55Z*?6Խ`N虊=h>*"rd2UMO,E1OʶZ^5Gv8n-+x}À6`O=q$sJr7aO&t۞59hdk_:IMs42sY]|]o||HǸQnA)dl 惍ц}țڭíeg띍[| T ^ ՞aw.;xkb KCRNZcx;'ttq!!Wk"LyVxV58+E9>LE~K\7eW4] ra"xPN A}}c~g+Eq*ӚrUj u'aeְz"Sys$"G*}(4j&1!BrEV }B; kiXko[K*=Qks@mLa3[ᖔܠBIt/U㽷#!^=+s-(5'[s`!stϡ%k[-;(ROw]<{0K#Dhւ"EAq3E#y,҅߭.L2P76Bˏ.O%iD(w#hunwכ,C[w=0 +^f9E>6ۑ{{z#73(JOU;H(u[s3<Z:Ǩ%jƾ%#E,ҕp_cfO>y82L)4?)JL+%7AtiP:GqGXwv21bՂl/~"'F`P˽jM1]}vUZ|Blq (@"%`[0XkEi)Q^w\ܩ].ԝݫr!SVՏ*W^J}![bWUWM$nzD]p8:ߐnf۵p<*؄^'tmrSNp9TĈ] gkciG/1ERn`pNn4(3?8028s[\n AU<ՔPn򲷵1zQYD~[žk9-"/>lAro.~6۷%ONw-ugRaKI~2\,%]N-Ef.sd5LL𼞥cg`;]*E-Z;0āL4;lKJ>eqקHH"Y·t(Nࣲ:SWX5oLU##!}5/sl y%od5#eJgA'q`}iV#י4v]+cY`g6{8}n@xC%u^}` Wq 5>3 -SV竣g\6so.XU* qf@"ԇYE'JE.FL ,4 k^edqy'!s8>k>TKa5^#_2[=Fc'F!݇:Q6,>nlCN s%4Cv D Rݗ3 ٜO(M)W&;Z\ܗLYp%Ӑ2~CCj+O 9[Age+j_Rmώ=+|kB So#(ZW&vyТ 7ƚ or:Lk?K d&+W٦ R+d{j,sZ$?trkoLḇB,5# PcG۸+,|TAg_.Y J&mKׇy3yWVnq{ϙRQPyV.Uڒ PPE,e3?;j?V29GlYV{f?މ* Ͱ/FMƎPW? 񔅫@ e~lY: Z^Wx8~>ntjI*m_)،LY~|nBK/F߹/7)!LĉtwK =,h5DʝEYp 5YBp˴~|, Zmge.T|pbMS$sCCy3K_Jd` hǯ OM:}}M=L9T 0#>t[!KWOeڐTf&jtu. Q>pM4بO*Q$oK#Ʃ2qG0l<-OJm'ݺbt^vrռ%:_nJT#n9ϫZ\3L݌m(. <]\5pÜMC;)Q6g;J"G>)'$= v_jB )~oܬ8\p&(뼏l?尐:;Mi~!>r<+aqNO RsO$ b)bu&w}\ %- 7`_یaLQ]t?sߣF*{&0;tl=+ K%C2K&?w~OYOCa ,iS9 CÇ}-Pf91o@P[N,'a6}I$oj/.) :k(~ܖhovv mInK3SoV 7ZTs5t7i 3|wpiyKC0[Q,I b'uekwH+ЉH'+0Ѫ)Z"iսQbwn =MOS|O|3W"Ui:CV`|# @blē wP LNM,Np_yOV[U[?'e$G?Gxc;$4۟>a=|4%kһ1˼t>axCoLpVI9oՏ$'712 6AʕoFyq<*DMZe$5kC^ak8Pt@đ #%.OD=<1*uHsMwv誌"ך(ޠd:cLUEY;hv?\ õR 71!va[L"猪텁W{hJJ Rn G7%6}L62"zt?R{؋Ʊ!aYӧ=ڄc&fRGmɶV“ˆl;޴fwvNڜq2Ut{t*VUf~)[F~G9YJ}jҚ n ,ϣ32pƗ@Yxcա(*EULRk"@.w劭EV'[ حi?t2Ny-UVPݠi&^JIIH Z|@ZjА lBNakpfqZQ ]>A0`hiݵN2ԙ[j 鬕aY t!G_% /iV!)"Ի8hú- ֽ-Skaxg,Rq,s嫗BfQ@t|j Y0b"bCCvyo&}4l.pv-(9Hw*}ڃ}siSjo8{57vj&Bܸh(@n.h.t*p2~s7U pЦ-ܷGt  5!">@\:̮=ruڅ,P 9O)R_.AK~^M饟^MQa 8+`W;اUWTfld\g]& |吢*N>[7 XiUyWz|_ _]0Zs϶odp>Wu HD{IZ, ѩ ! 5KGsྥ't`IjWj?%+/ݺGػiv [1oAu\fQdOL (aށ|-+=LX*Es4xL=3 T$:9hfu &VX+P:ڛ]\*2&hCJ6JZ0g:E#h;;f\9+ÉZR{P[j)dgy_ҫ yOh\*GAS=\JoW{I@ChL整>U^*}.3P%bhuEu`%J pc\3RCh>-ouVލj4J5>2Ȳg0@,fl(F._Zζ[Ɠ.̀rFLl|`mb0n$J!v-INcr*ni`ʍ3R}u='ddtl]X(T8tC:!嶵 NPLQN!GC8ucʞI`DEԿ#i|ga%cO;?hTšz2]-}'1/CcC|twvj7T]}azbw]I0X󼜚Ρ1&ؖ&2=Y9-6#a`lp]guJ@AZGu  &~%F/rSNr&Ռca JtsZ !+9V]&[yoN[M(ӢZ̝\lJcm|39IT)-t檵@w $NR |S:[a"4'Hj ⛉,693?zoDς`ib&%gB?K3&uH<=$ E 锿_<dedB~%LT=uk*C<[3ǽVtu+~ bXkY@~_1@6s<3߅]j2mo(5D)遗H<1^{͜sgTݘ7!ϹuhKJ͞Tm? GܝZ3E0P|hbS)|/Pb(HdH%V*rO* T+-};j` ǹ};['%ِ~bZ}c9`~(Lpȃ߫Ytx8"D~Uh'ݙ\m-U$s4tqYr8 +a>*dOOT-IوZn*L3^W`c[yhYڙf>]dZEcnx/0cٝx$OfscU;veKA- Xٺ9dsYK<v[À7%ɛ$h5B`I-5iqp^ wC'ޡf!\ɳ炊dhPOkIxx͠_:hTK҈q)|17hNb­7GfL&F'o 8O@.U2le{㵏R W3@|'WFQ<[Y=!Mhh 2tE#:[ ۻbc*+TYgt~>C3fD`r9IW "5ܤU0T:`X +%bcҢt4Ϟo$zGF8;-(Spa~HQwN5efU v, tqjK#;HX| ŖP#fb΂gxS}kRA]u\mWWKJ/Itߛ XIM R8lv[4GԺP~Lv ՗kV8\,%a%xd~~[|D{Z/bi3'(./d'%h)(OIeN[Z046XH۪хEwKN^5ҧT{iFQa8ܴ M;S@O_8pAxV`OfJ=IG [7sX4E4ܤnx6)ʯQηy=i\{j.Ku{?mQM، AD4,6 Isɟk`}Q{p$^Wc(lw4B T\KCq5BYMT&XzKd=<-KyH7'>4HןB[&#{'%vF>~ZoZuȶBR:}`dhTh ixܢs)k%$6r-.|0\T<5_ഠQ7 uu^|5ӹ#ܛ(׌jX[jf+PQO+@]̑vBT0ҹb`A D(^*;Ppr`pK`p2k{7 sXILw 'x(Mk#saLOpuW4DH:.=;5>:~rM/7J=#*t6ӀOr}ӹ,ml㹵LCF`7\:fi|ثn">Dt\mӏEUY￯?E@ƪXNSl(#ʩsL̀w|$n%S'm>G+1G&^!}6fɴ,YBS8#VFLhna]{K\Oϯ;_aCXGkۭ+mEE{bS(jWBV(轘_ǥbT2DŽ]u~2b+z,],ܺ ɇ6G/FkPgt#{;0VpQn)( =AkUL1Jqz7[c*R5*Nu<XcL;5F;"gЪ"ݳy T% m|#}zSRjj/KrFoV*˜ {/arVşDR+ MxsAXՑܸ$*Ց=f͓c8(Vp!L![gމ0)11tQؐ '_'9hIqeZ8.eFVCHF1˂P 'y GNGp#4[CɽVi ‘bGLj$pt 3<(WlYP GG*Hd.P*Qn6Xhwマ:/+Ertbwx>cݱkI!Aյ~&Y>px13fλ3[vPRe(KT"'09" Ab Xb%ސ +f0M%ɻ)>)@uD)5|Izy ^17%m{=Je2ȴ-ce HGI.1>pi}Tx-E;Q[ESefFi PO,׎ǿ`&0H4hXe5OB0P@:&*7@s2BIf^bZ 4 TEWXEF-8 ܜW*5ϾO-onn8UWmΗԈΨKjl&L> W>yP_Sɝzn((`b5Q4f. )'r ׫A:!gĽ4L'?Ғ^ $5X޿s z+gR u&vEwP]n0au& 6vy HRhL/J=sZb xu*-uP[Xxo +m \c3nܰ$_ TVKb) f7/09Yӽ tp;Y?z{@mةUrW$^TXBƷN#1XOIvL g)'`8 y?WU=1Vɍ.r0wt-Snet3UIe]>mǪa̷V Zg-5i&,o^&ߔQyN%L~ B6/B߇h{h^4u]8#sPYI{Әx2e^Vخ[yT)YFCf؈Y_[LT?EG16>v92:+:&{C %;âCUÜݒ:~Zl^9Kᬌ0 u?M{Wޠ|[VG㢈/ `-Q*F4^r7#Vp,$Ȃ(rq)P_WaFFev^weoHFJb5y1_)/ Ε`Eh]J7ck)ʜL œXmrȯ<KsߊD ^%a@*&=,a׆zdjNJ_.'Sh:٤[ܽr-59JcP#'K_]b+1="#vyYW[?~G< ,;~%-=C0[?8sˣ? >|@9Hml ;;3tb. 'E~Wۍ^~FAD*)qrp &cE tPbBo"ngt,|ڳl[3{*; r1S꟡wfiȫ#ѐ7!~e F"A;Tg 5w05_ku9_k  ӔxDלnTVoHFl 0e}GQz@gI`5l0&==ݐ"'T8J;Sm$F<#Ci7PK;~4)E{8Xd!63Z2Wt:@F(}7*$ޑ~"$ \ ғk FPj[ jubփNF OqQ/j4е^"U_Kaf0 &Dy"0sbaNܘ[r 5LX!L7ZYv"qpJs!@Q37':,d6vӮ:F@a U8B L0ˑGôM]:sPءҁ} q߸lz'}ЪJP m>PcǍe7sT;˪/ó}Ơ!јנzC!qPվ2'CIe#cn.5OcZ9@0KW~н~eԳw#E׋+\6nZ&7~3/m&jD?#<-J[~2^m|!s-{H8>#ӹ=z&ݨ'Bb6r(A`T!*C\IkXOirT8N[|;?1ɥuR>R>b<#Z8T `kUwIe4 (8Nn )HܗO+m. (4 ܟĚJ+-['+&6^E@7F" iІ8f (2G|(w(xe^pK rSi۰!ƒπ 1Ojr񇁊O?iQWH pۓ.!0F&j4{N i͎NS݁xqo8ʼn;~7tDٴ]ڄTǠc~ BwJ&18à uQetñ :޷$Xerf=Ddi2d+HԕQ |p<4vr3W' d+r؉F4FzCRTUZL =pDXOX@qGK+9T~q_Z1ԓZ~׆]Ըo=b[yZia䬦TK_ vr3vD^3"MW[l+}0\5uuPPVv#,-9 `!Wdz2?zh=r9|AE2D'$T `PRNڊ;kz5pdkddmao| Qv\nI 4 |S:BhU bns{= 81.kLBLw*3ќ?#RYVUb_mfMjPlt:g%}@SP PZ$upiL75MEv0b6qÊ"չ!ē#-)HmSup_b0UP--9O0kK,?zRf9jP<%@Ip hZ]tbC!z-s( A_0JHf:YSbwCAx-ʯ>,('8s{˧Yk}C7 3AuvL"$ Xʗ {Pk@'1}ӌCMv&KƍH;f&zP(8(^ lNK (Kb_>Ui\"7mxwEW>Y>h*[1-[2[g2=@kP21&|&AAMNJbmj9#LR`cKmަ^xȊ؋wCО( _j_Unj=5“x2vp(%=1 HRIR=s_i;,x1n9(61Xl'[Rsǻoa_-#7io~aW9udYċC7CnqÄ(ClG>"9`^Hy1b g Uvp߅ ,>a FK29O|-Mu\Ih_tEpm# Tmm} %D{涏F"Tu'J-Rk f~сJEzz1|pe _JCWvEQ7N?"I~[doܖj|^X;9a%C{KJq)[.=[r]3FpO Q ]9[_U$kpc&'Sۅ!>E#cM<:| l(^ `u|l'"6zG孡[u}!Vb3Po4_OF?9.d˒w>Tޱ"Q3~,Ew,lZG4fdD r k>}kߘMב|i w!)oӨs^!( t.?{qR-*)R?v^zM5ˏ぀w'}7Cd1| ;y| " ^\yk5/V<DE$%Aϫ=DɵeUqYrYao|1zJ0󖕛ܪR;ԁu` p[]0D?d`&#⯉G6:!:^#U" {9,22,[Z_mWP-7)F}qrFiSVPw1դ W/2xMa\y0] d3jTs&r! 2hX+`F@_谐VflfZ5`.0=٦o|IQHq"liqa&Zɲ7 U"X ORe7-mCj8 ) +/܈YoqG|Hɬ}ZPS"gds2[ R Yw@M}}h 6!]*&w ow\#+ s!}- HֳYqs*+ާMJǯ$ Ќ2f{x)9hscc Lڋm>T&l߄ u%}M# sr93DAЕm8pN8=HUHUDe.Yb 8;6tOMטl$6Qxd8P'UՁN|SL!.5||ꑻ;`-,Wߵz3K9!I'iр^QE _Ts#+|-ZS#A n6Hgé{:kmjgii+! @xHyEnJbNlh /LB &x>x=T BQyp&9,ߠ oe撚 ޣwD&(c|k%PZ!33mQ"U3/_lϷQkp2T6=`^ɡE>0ahދQN,NøSJQY>~' 1 1m5Z4q=3:e"oXNGPΗpS&?g" p$ _V0دݗ3g `1Xs=\~RKij 1 c +_;m]9=$X*6!pA&R)NtV8^h:^d^Gq pdC-*ކ_b 7 3rfL1WKCO<NAZh=&B)O##]M^hVi"}P7<ZA"ktuv~QO(:# Ԝ*K  em߬栭ЛGvjq8CDq;Ch2'T,[[JZܲ"xsZۻ^ʯn"]US`ʬPPw [PZsۧ,1&cHm l]{HIx~th[%{~d-׹_,+A'p@3NhӄxB5eUg(C:pHaG|3mr"\\n- ,Kڶ"I{')l=Т>"kK8y~V0:w*bv4+Bl}#lPg(xp X!SBfl@ɕ]UTUkfpDy_ 'E φfRx\M?sE$%ރM~GaN4%8lq0)y lɩ p("c5M:0*+jLI5mc8(ŴFP?l!dJoK'nl_EFT;;΍e0dL pQC1lٛfRk${ƒ ' <4| >],GEJ{}m-BOCQ@Hb񓼵Xq_悒$omF*ŶU=*"ynz<(Q)~ 1s٪ yɝMpf\5N^O7t؁jICTnqV7}EXӉFэ' ,SxT @}fF6urŚ!(㾁G>3;?ڛ{Gum@<ݳQCԮm8MWt 8]AP^isP)މScռ^wcӚ^!%*1ː޴-_튻$T|p<_QcJ' @TCL|9v75 E]V-hAx̅:A לŸTnPNVrtWkULDXv(Sџu̗x&a ٗlK9ŘZs>;z ¤#dI&DT݉О6Lwsly>a E8^UìYWO.kW*.ʩo4U; o|K$QYSm M3m.A&F7](>ꭖz!ͱ.II]; Fz"Li1JKa%] -M/#^4|0V9> .BX YO$'M1qX!xxii%`t<x62$v1"`d 5cgֈYo!È `(/=deuD8Rj&lu {S)ul H>SB8x0<}%S)Zhx}ӣa4 ryZ6j8MkW4]n"ژ hʽҨȓCO>..?N/g!CXRTщOM+H:[善Y:j<"&TpzzQeꃸQ'${`$Ep)5wDs=c\;I– BǬ̞s^= MnX1v)ȀTy3 '(2uZ{H Z">!Ng9Si+E`TYⷧEo!ܱͮ( ⏛v߹@[ #.]/K*yp7{C̘j 偯??ݒUQipN+zLؿ=tP+5Kq-miر0Y1JL 3U\Pg{W2[M nޫu'GI:IETmd"gXqB6zh`mDw&=L}gV^[֧R{-Q!>b4}EfD0RHUI]q ro\R5>;(\p F`4>34vl7d5˻p"]ɉ#L"H+?3I  6V\8Eğ-G b3[+9Duy4/v,ob@04N\6(Ltw&ꫢ%ۘ0YTt%Jrgf6di;/:f@u~@=ib#;$ԊAOAC:IM+=(~O5<[@%;t3^ V{9mv,k^N,:*ɲ=0sCQQ ſl_Ϣ;r=`v2n))KjCG x,b4=Yqf|ѯ/'_yEHDoxwX~fxwEiIsH@0oViܯ$4&_|pdܰ[ONPfwDR0E{Yg `(ǍcݒicaFo2sm5ʖw'hl| (;6xW@`rQZE#(-'3FqXJǚ} V#ɗghs~-RQ?3ȥK9 ;ɴ[20/ۻPQdشL\C!a V_g_( 6[;#~D$~C %Ҹ Hj;Zh`e 5D k#ʟ,t%'G12 fi,Th< k"LGP6:RZdhqxj'ظP ͬ^Z8hg8Ѿ>C?wzk[ ;1(r1S95 do² U4wCg\|Lcx  J&RP[CDz4Lt C4A* ӼؖPWbM }KaJ3džN[F04QbLw<]0ā1/[OC0dfck`*Fį@l0ur/hmVh>m>TUIitB ,%s?}&Q-j3 \ 4@#O"e,n"oGʅI:xaw8>6o(F-H \%8"Ģ:IZF5 P4qdGlTiD5ቄ)쟂 EGMwuu^;m̯d?3qGJNʒ76 f$ޘX.ݺxhDrR@27Tbflu%]r*4Ӫ3EjF'~D/I<U׮22DolY 5:,1lZ2!aߥ*we ɹD,U{ѼR!V9R2Z7z୾WM|POɗ?*DKRwnXb/R+QJv`OaAdp]wbnLl'^ I 5Q@'40xxOlu YoC.Mۙ%<TϞ904Gʹ*?~%/Sjʑ vD6=i RG,鴺t c4V\W>=* FSmԇ.DfuHljL*MRJ$[k;*(@} 8އ qn8Lc] mqw(y9@nkzQǴU*Y; '{=0$",)n))d 0́ߜ ˤ"qڱ^;UQڟ֧]>Z]vgLe( f ^L8OH]AZE\9]+$ԿWFW#Ն0g SBVgQϟbMZxމ >K>-ίl\pp\(&ƢBRw 6tjRG?VLz.%goL;b\[$! j0Ftϕ,WR <ˍڒI b68^d{9l8C]:V4[m}FaD d?(p2l#$MH] {|'6\B%x6Swǹʳ]!2 z$bn拉]b퉛M?V*'΂E@%~62K^..‡_s-ܾz_ĘOH iP*BkWFf3}Ύ=^CI-u[GQ#c&!-R+7쨅hѱ!Y;61nB }xZ V;L$ AqqjȞIظN"cYK s&RKM+L@9VC02 U1.ɈxE5ZQ4Mk;'Czw4eʇx{@haջb㝦J(Dalj7yzvG`ܷ(D~mmS B'D/A|X*@7.kqfcU> B" [81/8GOXgsEf5a5|ד{Vt\i#J6`E Bt;𩒫~v2fZs~hLW5F"V9;x+KϞZtSV{ S]EXὧ¹\߶k4.@}J\\w^Vsr !2`j<<8( {Z]ź mKgu1.$֓`[kjпHQsE*Ϯ[ghw8QIi)4!VO}_F'v>أʋeKN[B0hhJNZ`Z8BLL Nֶ{{ʒ"(|}.ahvp?j Z052a۩L$fF B0G//K@I&)ZHˤy_^lÂ1]ݪ7\g RLb1lw9@XwNARw2kd@0_{ ϲNS6\}B"jb+fc^-Rab$Xۆ\֌ s" fm&N4 NO˦uoG~rHltxr-e4n"<*'/ëo U=@˜uFv J"2"b=YzpQon #H(>kĤ %~|6MFuip=m{o@flF.(ner=䚙W]]:x@ TdqxAGúf}'tg'𷋕/[c b '}*\xEzgԉPdŦ[sOBEDM m5PAj6obu; u؁#&!K]e(h΋~#T H.?u[h-+,SUl7ަg&R|&GT죻2JK-y㢛ZNb+n u% L-L`JM A$R?JNk6U/!\S~ kp w.}i!>-grd1GY~%YN PMڂ7[Lm|{C X&kП1_|k(wJoNng29.ݟy3.tW/>4D=&K%Ѵ|l+_Ey?L,_rqx?曀ԛ> hbB@b?2|Z_פX#F~nW@<'!5 f'WyWT qy#" nD;8Zm4AM*)^!J~Vo3R>v ;64>[#0OCW]恣OXGdĺ{]4 |)Z.=s]aRѩ(Λ3i#L5SB8'ktkF㘐>]y giϏN?Xr*OAtuE:By]m)>1KuI질 B[}DwbN\vM uCUrA/b?|̑1BkvWdi~_ug<u+EΉeb kJlFu,w1,;ڧ_r2}sAw+N<,qMdAb7.mc|M܀>xqPwl^jbT=- ݼ2\(JkJ^)QG+GnBLXTvWk}H:d+rVNǕwtUE Afsj(]b#TERScپce32d\s0 /CL,W_ BLV "q-˹^:c K.o`?KARmv>qK(v.,7Z]V(-.)Li, db+CB{I~qzc򘬼PcHh\ dnm(24@\㈱t2›0XnEp) 2mC4ijv ڵI6F<0ReXe"QǢ&Y%Oɭ%B4`õe+@Vdttpz16]96򯷥8A, SaA3T(D#1ya]&Bb@V@kΖt O.5^hwo v,y(R^uĊ2!1_x )>s'@eLCVۓϺ<թE2N`{o'>.zz }^`JhOBg?DzPP78Hsf.]N1C hht6y|to^1(s.m5V'ps8,lzFsIꭞ*]&jLy3iXb.O!)zb }k \{U9\[k{ER0 -c\͟OIϻ:C-({8B-2!<E h9t} oMӊԵO{V;}umvڒ$ts_6PZ7eB7a(~,TTSY4>5Fvegva^3i*ZCìI}ܟ< g-^HGhdwCf vO{BEj\ZrAꃴ-OqRɞ\bHT+WJT4x($(<- zghe\.Uqnb[> xJ 7gAls64'M*ATxW[ëzt</9º>N9]%PZ{.J$÷Y{#2DlFGUz.+wڬ<@KO0xLSBabJZU<,zFӢY zd)C&d(O27{&o>HxI\ . i 'A3l4$9,(\LJ,j:ρÒPL6l ,J( Se=tE,Û>a}0ӞDnT\zi"mSz}igM &u Rw;P 찗󌝋2G7KQ[L=ݘ; 9x^pkN)} O:6JWK[\%*:5Qۦe"K'˅8"Qő нkѽ X\Ę뵈B4wEnsμ5M~9"e#Q/Vs,J iUhSV67pRSrl +3G 6`KlRMX|wc?`?(,]#G(! nU>L?} h{lkĕ4-i{p9(I7:Xb{plzӯMd,ijiIq̕ fhA ^H^bTq!8H ' .8@+6:Q 5T13oUgET-Rof[*)aniPTXU4 'EA$R W!O9*=,q;O/*57F/1mh FOcFSabrV^ q\΃0 k.z[2d)2/.\J6~Jy@.}0T@>vW%s]Ot~γ K˫oSIuUPFA#632q*r'Ύ 8a cgsTaL;CYo"WPѽÜRN/)cC3tRO'ە%(`>9G E*F@ ,s:UxgnCCPu4p$Mh56\Bh}]Y^m \+VEI]u@Q\(pgx=iCtvMkDX<PN?@/::Hl½2}3z@gn Hطsw`>r+'e)'6۱tνE@NZ9DqFU&;%{AkkT)O_y?GtIӆj;*"s ;#u?-: zkX2^ZVk@)jkܵ2\U~15(њ%L?2?RkŇdᒁ)JhRnCYU2RP'71ER}$ğ)kقWh'Gd~’w؞0;RKQv ry>Z0) ZT œa00m+E=6u,3hgaop) a뗻@_G9.!+d1j-N~" 5mA: [z=ѦG5eٽGWc8! f>T7"4J߸JiͳdJ)(4*ϵW{b*Qf>yUEDZ\ Ufq+b`ܷ]蛹.AKx.*8#z j`&fYs#WVWB|SD8Kct=- yAgc]-lvMuhKqE,C_A.O2k϶>V~%ce G,^;:ˡ5>An4Lt}50kufc>y } b0a>Td=+Fٸca7SLRcsܔY-{CY_ kQ+\%<'M82:*)^`O`xt2^ TBp.Z37K:= ΢xr"TN]'F)M4wSqm) RyɈ>u,tSۭT^Wd 횹Jt}PXF>"lmD'3gm:erpvNIH{U\AQ.O y< G,Vv}Ǡᤁܧ4~@r=RqU&sěNuv1Ix5:[ {i=kV_ O` .HG?]sz '8[Ru)Q1:UͮCENkgI#AɄc嶑vj7+SO2odo3Ks~Hqw`,mzH<"4  TT듸<3Gq xR*_hzL סv)Set;g2T>'j+!4oYg0i !B(oJj5H3d5l Ho#u!K$5 @2nn]O<-U:"F6 L`KM_9 ׼&KVѧe\ۭ6}2UԂ/g Ng=n&YA_}_Nj~6OB)8Rx\ɋic[2.U=y Eӱ!ϋ 3ZG> 睑Z8xj!FDXP 2"wd9F,| rk=:' ?3|0$ugܖO%m {@6cͤE{GBY<qL5=[7JUkqXwG`D1)3i&gz URnIނdNڟ{18T"Jq ʒ`gHg 4~F]hiBÃI`B@j{E;5x?\9 ԆJFڱ^ͿYٌyLn&X!Xd.x"~v=l)X[jAw *>GYf;a gZ7Y\aqOfÂ׺&˜W0ưGT qn\n-4D6&91g ; kb xBѽD#-O][p9'sI$N[M4wH@fS*wGǃx|jZl-Qh|I㨴 w}FiFŏ6K?ֽo>(>iԺsy+U6EwlCa BHt? KLKba M.WbL?9c+8aBi*up@>2o/n'}vAi6HZm筬G Q@Ti_T`@O) & IRUtӚ֭fu%@9ճ&~7-keZ\H*k(CyLcp>+x(u5}d!Ĭ@!"`?+ZS3W;jGLsXN)3೹te9DEE?[2]%wMNM_ i'o2,oSy7:3%mWDСqs!%_Zlo0 fW=g OÒ=eA+"D&lX(&Q=\(R-M0MoJ'Pzi،B8Mqo3K葨YJ0"C9z Mڟ]SUD5ե "rW yw*[xȚRw@{?Llg|8u-'«sgȹWKI!ٛ -Qq/1h"|=8R,RH G1Ոu(M& N(&7K"e9̌&/F[mh@zI׶#ȈӷSۄcXyH6Tlf= `mf{j6a@dzr)J!9a:B`KC]2Am 8c{x[ƚ%%{oPKbL'uGAHTEG:ۃcYڴG=HF.4Wv܅ZE()WP@zljb`2JZl_i}FENe~֑qu-栳8wL2P0dPwj~1?AI5t3>=)C9trSmLt  ʶ \ /- ˌ+a`Ԡ^3z%7e\G^Qm[+ÁyIWUg ,,ˣ,|W/_AL8-?rvJ}C&g9 | 2;Z K t&ۿjC!E*j0PuRͭx.HÖsE4@4j 9B tT/.rV ۰=a_F%$/iZ%Fp<=VxQ ̹)`B/H8y xu%\Fo u_Gum(5:*#"W# @^?Mv!31Ҵ_PۋFץ5+eb|֮5.DgѶ^, _7`_(&ޑhK)$ PqY %?/@*uRȅUi$^k@gr5-H͖')ʺ9U=OC#_AJKɕ) 9=~L Ba_FCnۜ%E!hWL|A)T:QWoo2U3cD &Ē!084捤" šm%EJޚAp}NRV{ѨЁe APo*2Acw?]Op8ɸ7F 7Ljq9r,[Ũ xx2&g,yu*]6 ָW2iD7NLXP;L-F&D"dDǟ\)Sg%u#{l twJTs56^8]^XO5|irxT~ue$^@>35/׀5l .wsUglV 3Z2{aM?|1_"͜ ,ǨMq—ilShZQs*!1]dYirCZa)zgТb]`L\nC+odZm!`D:K!0S14vMnHgN^[~aCA_҉)%,Ls @;EOyˇ8H L9"R5Hb/taEڰ2<\-K?F.=nKڷZPE~3R aOqPB@|8sj>XJ>&rɿD; ͻP~: m~RuH߲]q-d 4ETaI.{mۀ_KC+>_L*#侫wH0 [~У`i Ĝ*DGxTEe2BۥſnoE148뺑N 'BXf>?Jh%H]Z%Z1;r\]&6%av֢VRaʛRF嬕1>R/Mt'"BQ#-)<W jPZ9#m\؎n97[3_gl8 kwʺ-јH,/ eSֱNlu[uC}:B1AVQ`Y7F(() .D[p\GVx')ғ^dNUwxwSX7&YJӈ8lğO7$&70Dɣz7h]9:d C 0xSyvW+싊KZj6)EqO(_DQ[}*~HI}b᪪QаQ 3᪅<[0K׋P^7 5Cfbr^_O1Xn/}X}˖GI<rL?J%"km~mF rӧpݟwB:.yY'qĆ4cWRH-`}?/P#fF31M< fr56 ;@"Sl$ѽs]ɻQ)s[?XfhYc. 2[\rF*A,e<Ϳ_c^7$sn7 zQ 3!}݌)PQpr2@x3)οk~[V0=K.=HdC^Al{`G53q@M |^:^)_\UA*ˏf`mԳ9ZP)X?WWz{ܔ`xbFҞnXKҺ!L( ux, :, ڻeB  kdM)VZwscȗ%gfch8r&g[mc`΄E'|EcO&YxGU~p%Iykc[D)-B|4]8f>"6MfC⭼m7 '^Bks,X .7,lХmcO3Sq5{Iм8 v=ZȕIr2 \"y4]"2\B:6.8|tgX ;eYFܺx͉F Hȳm`KۺlT XΑ C4i?q dMe`s[xQ|3VVIQUK@l!]WtUt8P"ݏ{ʹˍfW/ybP|\9d 9DٖjŢFMW|'/dw͐υ߻?1\+ o|޽wUK,~U[P<07_t4i RVW Ϡ~UZYP,y<XmH~)j9A4Z*.'km ^+qbj_Q][B~0owƍ<]Q~n6wF k/ ~)圅+fѸGuHW(K.6isa:R[5JHs)S&E0F*!UJ'yeM$nv-gG%U(790±,r&K-b P~*k5\ug/2JQ}q}N ~&zU Cu'C&‰5?*`Q&w:r.\^.X$ro/YJ@GZR`o!<"q9ኅF,哣)*li gmwo;!IN 4E_B@Z)*,a(١MҀOOc42̨ׯ"4)Vf,Lz8uۧRzQT' " B}a_nk*V(67 V~.Nw\%≮K"~~vhljȂ.PխUp*yچlb(By og׉7%k2B9H(qta[?8@[\qcn>GY$=MK(%LJ_=b~k_F#F*F!@wmo-E:;P, GgTOF E#ˎGnWK!-TA H,)Dk1OKѺrDŅe 'GvA}jlh0]2L<=ݯwcoW2DCxԾppaMJ&@15O[x̍eZ{pISQy^(;_ O r,-3] E-O?oE cz(f~ ==f}L.]5'p<@[u@Z6fPClʊ' /sPE듅.d~Ql8)`V5X7 B Cwz=SoF*;$5a=zt`jrS[sS5CpuɮJF*F[H`H`}+[M+˺U5[Eqs<*P#ԨT*lx0*0swWd=B=Y\|cq o|& f:MએiV@AZ`PqXz,}b>nd]9߉aJy&kl#whI6ZVI Hg_tzO]˧nTΪǧw+vў#5DF6\_4͆oL"F|ԮsӎMdL@a?O'#n)@"LBΪc`~ 8$oj83YP;U;̦qg 5l_;;8F{VͤsB [\ioAi~砕-^SG[R2wCʥ\̻l:CDb y?6͒4dB&,#OkQ0~D>Yv'|ڌ$:W0]׍]<HU Yd6`ko%End?9 fdnEeSO@Ǫ 6!_( o$n}8,]R ν7G^ =y;YÇme!LQ+T 9(.na|GN.fHѪ# +)M8Ȼ;%:7>H%U gb]kdhYA4f)hQQddV[ %ֹ=0)'HYG-9om)h#L}C7\eG3e4F ,*t5!S@ x/]JlNww8Hnum+Z bs lLJm-DN^1AcN|@5\9,P ;-7Bzo)9uw9Pm>~R7w)qSf0a)cSAc!H7ޯU"W? 2?q[j}{"Y\t\WN ֶʬ%+,frq궶bI?\/YM{wVs%@yDA#ah떺$\XmA3a-4]Kj32kBU)5DTf|&df.Kd2WQ%F3#},E5##7F'v xfU\YUE ەmX5eL}Km=T%f<ћ)܋8.O}:dSˌPRS;#iϷB~ʿfvmS.r'iFZ Z¯}W%Nf=-%67be 0[dN[f8F>v>ثb#>I}jwץT6)ױM S΁\߽;\ujdOMV /M7_mތH%>Q)-B"H@bkS>vHF!rF}VQt:CeLBV(C0i,=t ;:-lYY;Ax^=GaXP߂['鹔'!oERl=>7 WQ@VO1Q JXN sCԢET FQ)3Tg_0 #ޛ8͞^s`it#p =d&%@祽'h)Uf_Z3Ћ^!G| m1l}xgNP!xhy (w ;VLJs{InMUQ^&](-Mdv g.,:5gKeIUz7a?cDވ󭚞v4,Cb\yrUG}oif$DKYǪo4m~Wlq.vu(1\{*# >0Y9G*꓇͒E˻#Fb;1ˈ-=# 3V}ʞ[}tyR ā{Hm{۰hYaJ6[mxF| n, L{&'G+49 3VʣzӦ4XQk#ϊ<*@IZ8!p[Vy̞'x|\ކVWVKA7궿E10ҐA=\ܿ@oƾva鱷 U6̾PU$`M` BzjFY']a$MgJva|2,a1'1|nS(rʚǥpSm5vUyN@~}?~).6/De1)4WkkPƷM✜U6dCđA8=wC`:[0F.$1UM_ )>iH'~w,۶Yf3JEXN}T>0FdžNU bWX_S]WUr/i/a`YVd.TF™ś[1e75je㕞.9(JZ1xG3BŲ u3:Ԙ-ϼ[ԗ<{6*Ji;Ώ3HN@@JJ4Yy4q^Kҽ ,rx 1:Rq3*fQJ,Nܐ!GqY`lPRq_}x}ꛅR7b!p'Yxvlɓ-3IϞr2X5X8RU6&?A-v-Tv3(g-a!QGakrRxgxKD?1W"-DLB 0}F?cX2Rz}%i#{_0m\XU3D5t@!`,YMY-p.If Im؟ rBt 2?:8,u7EGU))%CqP&9>i, `^kCZz1G?ʐfqUѣL].h<vom.l5MJSASHLG`! )+vgӁ»$oJK`d`Ȃ`B)pǓ/S/bnpK&CL'c+062ȇC/ې{)|2aAt#|:Mܖ]!նo8+"mgB7i{ k0;p:Oڃy6&7Ϻ߶w]J-?vkp#E^$CF"~لTcZ1mfsrVő6њIau { ]W*4&FeGzp:/'8B 2(+Yep<)p`ōv{ʒwe]-p/] .'sʌB3_5Sr&T1`t }<"pIQpx@8pxoZ$>`?Re?@x`FKL`dG4QWf00H` ᥱҦfkaO0&Z4PbR443m;(lyD) &v9"j(EO^ѫv4e6ŁKb){MPl9~}oZDʛiW'3Z kYg2$2cY4^_3M 'gڥVLjY&$X.¬N`c2a8(bMbfSD?Cu@rW66._NUCG30y&T>So qڮ a!r6ͳ'X 1G5-%]DZ{NQY S*9UZu\0HQ+FIzYV|2M| `lM9&Μ0$=>sX0 @ _WG]8S}(?5B DɗֲW6W^½lGkrfeRjH5%:c6>;)r},*~@BjٵTAe FtvƘHYu0RdIr2V$\U UU 2~*: VhxNsC  LtQp`@a/qؒkOǦ0(ҳlf -Y;l+|a\N?TXHS7BawaS xAUu"ф{4N(x„u!TwK9rrEs--k\u q/fh2["LcNawA%ct((<3q<>ō8z$vᚾǃcEJ/؈z"2w~C 4^9k(P`X4%OSD"3vҁجOu1"K-qLXu:t6DIY@ Գi}4!z+d6r9U|I&BK;nezǻ:8U>yD!#ȪkuQ La]5>0J*n_<:ŰPemّ h}k$n EyWMpaUOW}f*+~!s9q0j3Esxl_bwL)WS'z##!ȨPꏯngޯQM Eg-C#20L9=AuzR[ @Yl,dxؚ_>P_Gsr+M9o̠y\%%f/grhxR.? @V~| Z!,:O)86<V-AJH9XLa KYDF[F\)7cAbnH=Y*u]kjxUs 0'_ g Q>CNy=,Jp-/oA}j51:"v S.8ģ8Xszwiz+(ӜDUIyE+oʰ\? FdQ?30v}Bwkr$oIYXLf=OU9~i0'Y(4AupJQG"/Ȇ;BZJ2v^EEovO$ױ|K=erDr*a\K^]LЩ9Li#-<+dڮqAS KK3(pp_AwXk7>+y^PE.ExgފUL2uCל)R1@k| RUn BX%S͢0yEUe_I|UcdV$ve&3Mt^9y#̵)_<ݡ@+X% Rc=jrDH^.X8JH=iY z3L4v@B}3@*DHXRЩLMeK'ilJ됗ϨXU5!1fEMqǢB;9ҥB#mz,:a>!\Bx̻7q8~HO<89A@r܁~ e{$K*vGx.d.|?bE,v 86X c$e{ .<[n|$*gRZZSYp440\}w ')[]ZUM'Y/iۊ9+DU϶oFQe0; u-Ez+Dݲ{!Yzkz}ـ9'y +fީۙQ#o/qYem洄 $Nٝ/[e p/ %(.CV ^,NsEkqaχgT?<-??e"k?Tw MO;}I`疋dPsCc)]9GZ۬|жj>ꚗ~SyM~9F]Y`{X]/e3F2x˦Sܛŀ;R3IR9Y^.x+Ma/kao;@MLށڙg|F* X@ANTwJܠƚv"[^ ,xXUKi`",`HW?VMģˉha>1b_4ӝfNeoˑtHpHV b2w!rK@EtöEÓ=]9쌁5/|L8&m۴?.Pt":Sr& ]l&Z }7խe>vC)?kFfr;;uZc+ү;T lKt?d&.xKyؖ_yD̀/AaP᝭V5o uZD@9۳J/b8WQ,@DfhɶOIDT@ڹw&TcfmU~@!h'G YɵqLW2uR & 1N ƚdN8~G/P? "q[b#1G6/\O{:sQP=C{%ȦMq+"h檼7E FXOy\S<`@Z dkmsK9%uD*SO$<%> 23.".L6CzʍoddI2: pME޳ Q4 ݭ;?^ySo_5ۋXPQEyHXg,E$GlQN{hFJF⒌ ͸#ZxgR;AZK, M~bCM2nl^FUj}R"muF:fu«X䡤3.yhTOkL*_9<Fbs]2Xt87^1!ˊ(`E1T l]ŗϳkO}4ᚦx,[ %h߾rZݩScPfىm&n_m(varͻ&tfo5Aq(DIVV_k@\ .mʶWsa6v0Xr>`:(KCe6W`u]WpM |ےG{0HE r>˭ 6*/0Nmub.j96o1͜q\JdΛv!%-+3f?{MtİD B qzt};Ty%c(N*UV@ @9Je/Dp>Q H2[:;mAwι 2UoJ&TC. ֩Hf nlY >ܞ nO3h 4L۽wƻ\;ZC#mx R Kf1k]X4pT/;/MJn-ҿdF̲4$^ }5d>>]w޿LVȉ78J; Z;Nh~e&R=BZQ GK WtxfD ,S?$sd 5Zg1~ug.3#A(*1nB.f6+@H9CAN 憦-\J+>'i cWܮ-pk&mR r­ןU+J0tKX%|Ÿ2'tpN@xU^NbA?AyXٔ|xU(12|O跦sk0|pUpi(R(ut(##xA%q^[B6\)-.*< vJ$u^8*L3tƵEbn2OkKrv]lII3AhBCiD0ƒpCE v q+*+mGWtypxZCTP*RJ.̔Eh*FI:vUENir u'N7t@9Sm=nf+DWOZRRײUJh+U'5Ͻ[t)_ t_k%@rw%zraXHDWyBR ;{=EpRO;&vXcKD~"uyxǏ[I' qԡwRt8U}A7LJ-A70t %69J6C!3&'5[Mj9ڲxҿӓi X6d"'a_Y^vm2 +v_aaah ^n6a(Htg~+8")mʌvҔLmtjfi} -7c gS^);.}Plx2JV3pc! ;vHYERӄ[VWQLGcCzjcE$V_j;c`qӜApWUvMh#Ged' cS+{ IQsI`8h'6k*2VJwwiu]h gFw']Od֟x#f/qv>~fpZue^iYfne jv{AA`S?I)\,K E],;%4IyJ8B* wDUg{>\P]0jqqG5" 15eϓxlÚH!?$BHwᥡ)<WJ-I -=lU:R;ڥrb'Ѹv.Rb+\Ru_#ދK,JNY8/OrcV]áO3d9-iSGqN,!+"DDާ4ʔK/L#,(W8HI~P<ҾKp,ΏU*քjVKkSƀy1CtWȵk>1$dLSe&O2.LS)DdP=TH1@TԎ~v%6섥RpMuRVѫ]>0"էnl_+út.L$ѳ, 1ot__Gڂ;4ip cuKx¹Q+=ugC~u@KǼUKL)=LS~Ua# Vֳitpԯb wO@ kNܡeE^[~-ԼH7y,х'&ɔ5zs?gX ?-M1РƗ(w9 #GRr:($tagJCO4h1{JX|)D s K'8*\Ǭ [L 7jb5d+xR򞟏ft ?踱gӉ@ Dd-3>-vE QOj,QWl1̚02WYa(kFDN+}'$5ɭmumWSa_bT& 0%皰 EwRw<)Qˏ[D_PKq5B<ggձ3Fs5S4zP1n-x@`ԉ{m{ )cqfhA$g"M~Z6]E+HQ rZDM%݋|dzٟW/:V_o_|?vaR_} a1kwye ba67Q;2x_'qR&,ɘD~C7g Q:9SCu8ܗO٩ 9 vvq1wLM,q^WkWƈp^)5f6LU꼱l'|ñ2i_9&P1[Ye􏥎p&E"aR|Ҏ\6es ۡǜzO0`*٪͝sTQ!x$C[#RqKc}iDmpie8i(d+m qaaP+m,x`IGlΑ4amUkʋW!ΩB@zZ١/(-[_RM/Ō i%Sܚ%ƒPv)l㱁 $-L8ܪAiw'ZF!rM9gj+-:ƫ(tg:.Fs3CRT_N,e>Bܳ\n5e1 ]#I-lY#6UV7 =Z,>Կ̋w2.!j NnMzADdt pd>]vUv|)DF%EI7a_|QHizĶjWO'!._p~sUf!FC A&@c͑0|}l,aM.e$W֎`5v'%.` BӲGA E1(jrSԨEUʯº 9@l9<튑JsaO7v4vvW9Y aZ c&/pa\#1YgPffi 2<!$[^Ztg za+7#MICjʕc["M^ӚqGfDI,R/337EٙȖ՗W $RX}"]PnSӒ`*U~E U ٤)4V`8jq#J:2qe(Q;Q!gS? ي"Ш|XI-xl!闯[@1OS;nhj:S*`|? BWwDy4} ,ٝeZ'bB 3bB~_BJĮ*gzMg\ cEoS7J<_@df ;<؋w,SldHkSy(KkQQ]^O/H d|0{o/I_wq ^GGX>̱b1tC5Ox4+xU߭>[A:5JBu=&aro  ˶4BaY=;[P,O8/CUkp?5rVPp= /V'&jJ2DUfEI}f([tcy/@|zLE#ƅbui`S줯H#NkzU S.fܿ@RfiV"ִ,U 2 =T)%tx?I Z 6(FO,* G-ͻ`w|j/y짰\W^\5m$ڠ2pY7E3h쬺k1k$_ϒ$FȋypD:rR(~s {й%bKyzbb .~VShW#uH^k )* ҵ._,u\Gb.ZNVȷѲE3UN N.&W`=J _>nJԠt w.7ܾgg49t?c vD%iGk#@yEz h/ٱJp ZzUX.d*, _P˧+Ŏu@f]Џ7g(kF@' &#N]+X쒠뭰4D!:P`x!XT7xA E> vP(24бݤsbJϻ=eg⏹M-RaN FXRZ&~Fi+>Ř>$-GZɆRUkj"K_YmݥEgj(lY&/fkMɓd҉ (̇ΖasCLmYe2 2\}7oЋjKhyJ]j #7ogS$耘BZFrq`jwަmC,|V%ߥoo7Nb.EfVHL Hd)QeÔq2^ 5Y/yLގF1q~UPqT]U6(ꮥfG %׺X}za9p9qPTω ; y;5yx1W}X0;:RU9G~9ϱуlkk!&1 XL xۄabZrse*Wyptl[B۳;EJWeW )(CѳLR,6 \Z[,GaxcQlG,Dhdgl0CQ?6 b|2B=kJ²5; vw| ex1>LIJj E#+ADӑ\"imq|i5dw}We !v)ddSрdz&b3A%z>)JMhx⶞syɰlZ+fTnFfmi[=i]J Bxa\z:}W`)tGRw p$4&/xmFD{SÂу߆w SHd>2,a,?m , rխ(Y#<0.2ZV0 OkY{3Xǭߔ9 ~R;8Ր{Ik6 khXdwW'τ( X8}8V VX\ OiVx|#iMޝNَs/Eaw%8Iv%1Z+?[ ƾ,?vsD.T&nN%} \,N֔X^JNPUd٨Zb^3.?`ճe:ru;apNOѥFTH!׀32YCuH! <%%̀GD Bn΁@Z:[r+7-}֔] (4'α3hvRP(O\C?0~4uRPkQ J[ABE>R7>8 >VIJxş1B%P~U2Ǥ<3Uѣ5ڮ)cLEi=~)@VGAHM!UcɼNX6XL2sJ T QZtUz@W)c,'nIɊ>rW71$&`_qK~] :etNY#$(WJa(r $oZ92!e&n蒭+ Tո2,b97΍p__j(Yߝ(-=xE*{^> y)JIz#Ǭ }H(։ ~"uYA0rw1&a]/Qn?bk4V18Ky%0cSzq{F (1dX.0Sߓ&p ށN!߬ڑc@Gb+ }tAdž0]G>x%EsXǕvBf8S"\1R7#.+橀4ğ̩k+BX_.ͿSURVtv֩#t"Y2+``7*EE9m[+ |11F{ >Ѐ5֔ziU h_T(@1Z!v8fXҐ)~ c~,~_| O  FO-q P‹$_֫pW|vW&ӽ8̑ H(͉ 2 Ӗlҙhw3U,Z}6XyIXR^+ $5Bpĺ(v4=\[aoSh_y"bVHzs!hDl%$҂ͼ'Ql@T` sDɡRШu.aT_|x2*˜n4mW(?,G2F  ZQ % Kfle>SXr)mT?J=D]sm ", 7=N^up"" L$ev ~L P9vcnz;^V0 TDdDn+p+? ]+9%uU?,r?W=BU1î䦳qp\M4Gf4ǬWD ē -^$/GVմ탌JFa_}t.+bՆ7CZI|d<E<RߺM#XjVh K]guNt.0 ^EK4QpuG v\M4-6-ЯBWҶrW(wF)[nI-U!Ig,~"MMĦXE褪.O&<C>}SWip׏beXÞ`47h'uW׵i^e  j&kZ$'sq|a~CǍd%ԿgPO*ѩDx՞P-mIA(D *ˍfϵ D\WpZ”RJӊXG߮Ž[*r<#pqM JM <2̭N2uIR؋eZU J~ :$'+ \Y7c- yZ)Ж+xۑV۩VN PCkSNoQ Y]&]IUEaS1i4 Y S.P3Rv'{'󛿬WI, d`%% p`Rz{z Lx>pZWԾ=ِf9ț " N dOF +INC6R䌬칤\4V U[P½a!XA#ziQzE~^OS:E4G\=BhJm,L⭾h=p[W\jǁΒXG-USbNeq!__tV5/oZ2("Y3 J6O"h6bۃGZ! y1 H9obNJ.(LNYdX4 8hwo |^e4W*iQ5\^E2")0<ǀ*i.r$f:|؇BJ4TG$쩋u~hqJf+Y dQeZUpFq_ATwL\& X$m‚7Hz Ki*ּ:eT^Hx!T'I<Bk#D $Yd.96F2w`PIst甊6/$qT) t.`pCa̒FNfbǓ4jGk.+BcAQR@ڣ#k$c~_@TBe-<<i<Ő4Za-u#v3']E X7[(+ۣrjN,ӶtT%L{Wsʁ=;|vw@d~ɔr2c(A ڃ9̩!2;.IڠcNW"UBl N[U8o0`a;T8boYZRT4*,VnV8J4c`hLRI+CMڸ0ݲGՅ!,9|S dh4K)uC6qCƱ:g]AAbtt9d4o~xۑ\M#;e[$H)9FPVҾUiw HNGDySG* ~n f3JY:sb9 廇tfw ެtiJݍ2e];tn]*ȍ \31jgACqUϼvm*[]= :7'^i?Ah6ћ`g3 "+clõZ%2WkE_/bW^<&׼Eo;2'dv`d:U۵dP T}OE,K:I?Swغ,<>t Hn?'qgG$;[Cj^k!24 (z=a{3"T3`}pul^͖6 3!N Mw wWP7!qxBat9@l~`ВRA Ffɻ 'l>S%p$[e [+󹒣J/쏋[X9| %3>WS.ITfl|I ۾;;SY6L^ | slQFQ)k`]OU1FEr[P͓OP@p~ɦm(e{-F\xwÞ#(-iAFx51hA+CY|}b/0J ..ZvIMVD?[D$ɫ)blR[pEy Cc$y GK<>Hq;i@8hh cOӗ.+`ŭw3nwz?q_\7A1"? Sk_[?,(]=180z#.Wwi-8HARA CugQN17Y,Jƽab בOXbRԾ'HAz*\X =eu AIM4gX1<#pMǩ9z9zS`* o筝v]r'95t!r>V|mG>BqjOMCqQyFR(g>ѩ_/E> Ev|+P$:ݧu*IF)Jx+D_!1N+Noq)Ke}~<C0,W 5lD2lA[ pm}c"P9] Uzbl>~fX|)fᩖr@H {%9rp(Afd*~O;U04S.WU\_m+>@:{d?_EMH0++eя!xIxt'Ԣt.Ylffl9hsӊBCT#ROh[Ċ@֮~!Oh6*Iz⹦2 F؂/Nk9`grDc>ibӟPPD"цkDkR9lo;KќWeN6T>6h‹z-~BvLA13ɒ,=rF->t)Q8_XcGf/7dڗ6Hs6YʄknI=? tJ|J@BW"<7͗BV{sl_r {)F"42GEdh΋@Lb `h|Ǟt.9)AeS)} 2P}p#k$ø]Zy֫,(@Hܱ;iGnO'utE b++͉N5u[6^SvZ)6T6ZoC֝pU|n^`8=0LNN]V#ЖtjdM5"#j-x/9q׋ޑGhE3rgb6O w.UpۣP Bh/J.t[WFD|伫u"3SUq0mnZ;@s@*,w(3nXUk jFG"r`o>#zl3F> ,864Ycد]iQ?蹅X?3k8PVX)n;K2/g~C`Z|/ܱ ?W^1nަ@"h5HZiPm1TPrbI[ nSzQs'F0n(Էd . nfޚ dLSqxF,,62dz뇫sVe7U3Wori =4! H0񘡉. JtL b*NAwt؀#m([C,:84O3S{EXv, )@#N58$⌫hxMc2")Z(5lm12CfKO3? V\%IE[UN4=}7AQOHHˊ'[D4CY}N]!14ѵpU}Jg3Ib8a0 Dlx-֬Qv2d훺V`Aq(A)3e8+"i[eq C5-sxI$cŠYӷaFbuRj/`D|`5ɞUpc30|f >|*RC *Gq/JM7hMΆjewi=Ӣ#?uK {ӄ'IcÛcŨ%S< ʁZx8w Y|u݆`u#v` Tjpr*OqI1 (5ܧj[.3ů8}1tԩIqͨn rЋʭpf~~ŧ.3ӖT?mst,:S#9vZ^!I4m:]p٪聱n0(tDECI-Lz.=)ȊkRpp\3Kk6OOť S8!5+1*_&θ;V`Fp?,PWeZhӁɢIuܿ??nA}.`7Ut9)|8쏕N D2?|\$kuNY-ù73|Tr'ߨ03N CJS^Kf$O(fC){ׄ[Evaɮ'0ʚd Wz?91Cc3"Ѽs giKW(J o"k}'~0ɹ5AqƖ󡀈yS>]@xٗ 7J|fx3؆{d?ĿtL~YVNdP-`)4nbnzn݋<{mfZs;Dk&Vc.]Oi~vq9 `@q=6gM2+6 kyASE wce*c ]16FA%@paozȶwV`/m S9Di\} nZpѝ(XETue=!'v;XJ4n^&PڼU5 }o2p?bhY|(JeWB9 ؁ӵN c_՞o5qI/uK&4*O2,މWb\SVS6Ƹ*Czs شiS!ty䧀 ?m^_{(jJ%DUv5gVdwirҸ%Fx:fSU3㼏2(?rR Yd(RS!#R[6BOʵ| zV3Ʊ}l1AMg;w 9==댲zѣX5#[sQ*ɪV[cP#1XLODzyBff2k([ _3&+w-V<>zUܦetڨ9]!X~I nu!%a7.izg=ْpxMvT\T&.XT@G&۴CW!yT y/V[+βm ޿ON j`%wfB>֣6o&__5(YTAbtO,1,9!/n0HM1I#x+_5Z{s6`\=ޟVPyd-{ V(Af93\MxL/՘K.nPѳ =y#_W&e<`X~+ZK }I3(˕ H}ϲd (0s/>TS&ƈ򹥘a =nj`:n`I',k*y%39k<|v> 9.MgQe{ % E~2)J9ZJZSmF_`0sGM0lFPʅ7(0KM]A8nI_9YzXNŵo <nxLtqH%=:LDh'yﭠ"Cy *՝s3þx^39 ]YUi1.88O냷#,: lҋ`ۄ2Al%@4*#P)`k$2"-gGyRY8Ef_Y l=aơ֢⟔sS4 j䧖JJq0 w$o-Gg÷WU /("qʷ[n|7 f4*n>QyC*/`>Sӟ*'p.cPaq<:]ʸ8(p&U K\6| O뗜9 ӔM uRV2&|Q ح/qHriiG5ﳖ`M#A,t1^ \][Dl|ᄲ.a/' {{谍K p,tE8u8@نa Hn6t]8);pVñMhe^~H2 c<{*6]bL)N{,|:?fKwZ?_Hj 3/ܭuY3VnuMtpPlIMHF}2DU-ppqh O\AK7=( [ .(Acgr!wqFߑFutK#C.wز_ctm00.6EbAO=5iBi$?-9^;}|庴 i1;/rYObW.$:W͎ ,p&jm0"/ʰބF/ELv=NlnVR=BN3RO:2*z;Ėe% 8>+bfel5o?ETIg)x~Oܜ\>yPEkyQaTg6jD#/E= 9]PweUo4A&g@Cv|ܰSrX!Ȼ:Pߡ5_W7d-:t=S.oy|OZQ, [j'qOQ0Wg$)k՗tpi]HbZ"fu잕2#mYRm(Eq}wNe":Mx~qm?&! G?;ɪi%5~R?QNQ;tVcYJK-WI39Kܖ0/vIBn`|af}w%a!7{؜fF`ߤ} |$^}eP"c]a1BY(ΜxCjZgqbvEY%()L\V{vp+-}4굌Д^,zٜ":nU @yȏLߵIc6]*]<gOKDONx@ p**9?S7ąUs${sS&T*C72MτwR>E(Ӏ#(yS`P򱃠]9li:%+_*l)9!4tu ʶwtPVfzL\*K#Q-p|\dehW\r<ߛ.ʯ喔?*vm'^GsTQާ30?ET'ZXږɂKٙ/vR4+}?RyzFH[~b a8H#hהN+Yo!-<"vI%{Y< ]TaY n4o@۠37  kM8j3q꺽gX$+eͅR} Z(H%51Nq\Kt5 d@R=,S%Э,Ro9l4 TKa\OO6|~|M9"Ԇ ,zm[t bO) =4Hbeݝ*'D /'"MNC2a] 4+QՊYŘd@ ;@mD<>yI4#c\pT(K~Lmj!&KBLB8 qzlgj0̪_aNަ +[6x8|-]Jgü""ybl rȳ}fihrP9G6H^n;'95gH.O甚+RڮHˬ~ yɗ0hu [l tcE'np~ e#hQ  %`/M?"]G[ ʕF6˧3_3/=%j`G;C0q%؋ս2bcٟ4.MˢX1qu^if$1{_ j9l/QEKћO2nja{ZL9g @*~FH&,Oe{YFQ*SNAw(elqTq9-9iĬ񵗶ͽ|fC;KI% Da3R#@҂6'Npx>bt%>nN 8.=$%3yjO[byMI{'0eVd\g\͈as^.m$w 銭JO*嚐.Zǥq^=iLq1`(KJ) % A`sC}N ;uʱѯ0:h]g:?۞ %mfЭJ%& m1zJ4!ә0R]fDO<3Ea)nw`P}etv/b+l;,Oo+L{־Z"z<)ǀ=sreW9 y2Dvx/CqjJy4Z%^5ZN,' ?~(_4'N E6IP%i,gX]-sz[Xe^, AKql 9B |_i|v$.#@@H_d^'|Ut6I7(;zݱNCMi 8 `B]4d: ΂6LY- ?+\υ1U#kT [ EީI1H0ʬDPQ?U[[p@kckYؐ=?b(Cwʚ'Q7[=!Q+wf:s}}QLjg(:8pkX@y1G|R";zZ/A)ya}owïL6uyƀ[SNh`EDȉgچS *Wc{y(b%G ^=_HJd6mA|p/ސoNJQhs9El7p#FZIKDÒM-U56ўyX8z` ;W9Dl&-P#C,L-R_@ȹuաha\%Jmihr!]dMQPp \wm*n M|~nb\~@~5D H~&RݩAMg mc2vڎ}HPڔr0ߚel{~8͍+nuXiTɌ)1y$A0 Ӗv^P| ]X6WL"N?D2j:F>;)٢ݲ3;W= \Fj|cix VǺK}j>]Iyx[svM6ftKgͪ^,'XRذЩZ뒝AFPSf5i0Du+ 0W1-S: ,X׉jjp"9*0OI`!;^l9} @J#nȂzZqXSFWEϸoTZ@y4 &|&B<,e`?g U dAIFcwKeU/)Mv%czC~ )X *:m OJT#ЧA.caPeFk@!OJ!՚Eܪv($[zcjT&oWNxFʮCAѳC믘= 괷0l>2#u6ف`Vl] 4D?zG@j~КƣX o7Œ}S-|%>TwwrA5hux$6nhn& ځmahƞFVhbI/=/|x4o^^vЭowuҩJQ ޝݼo{GBKf-IbwgjN;ձUj[LslAg-CJ6~!K /4H_hvj0FUbq?}_JPԼ|&h˄zC3jfPX(VY]?t"GXgSMylbý/=FGo{ t59E+OPG3$m)]PU'^pl+ytpm7d3˫V1,9Kw: K ̑-1dmO}Cgw'ab׾CƳY@ o8Y29,ʹa+%:spbCҳWmŜTx"ܢeո|+@2VH`Xce^J,cH9ωi;|ސ`{I˥l3@<%"V`4P)&uUy4瞪.fՄP-ɍ*%{i=±|đ-VfЗ[_rn)7|R[AuvBTJ p20"'QDRі.@`z>EcT{MK1CYR˯X/ PhϣJ XM6 @#fd8\6Վ8AbR/ cM@XC"c9/$rb,4#-^1MH%C˸^W 9*KIUo-U FXtfZ}:!Dj^\pqh ^F0R1x7P:e7{XݡK @uMm@HAŏ0.Y+MIZ۽٫|IE;Kӱ'1E۸%iE'N3kV_g֐q%Jm^]Op9t4ʕSYP Rwo#"ѐ&@A4NÁn?)#ElCrj;tINhܿw&lui&1E5STJ[ҧcl}M]sLAiK$ bwGC }) 5S % cFNHa?89:k@.e˹wS17M+&c\k tM 5,MIpr~P>yz+^K޸B\dYWJԞLAAֿ8^YE|W ^:’w9<jGpL=ESNN(؜ɷ9_H1A~9sUh v(']UӔ.Ҍ#jD",1;|%6D&O}2?PTGV+TD3(TX:@xٙjrwKn )б*UEqҸ>yCQ+;J+_"* )Po*Nu@l PL'D*e3R,6m#8Qf`?Re{EA\Wu#GuB|cz @45F)5J o?* tX-ũ,ɂѿ'`eQL1Hmum6̤Aˮkl(]U|g݁tS `f9pDjY; |YV^P}pbG nQأQ5mP ,．6,2MXh|K{֝F[ y(=r"mfn[Pޯgގ`L#4W-> |,CS-DAJK1HS W+up*Z QK\(x- a|D}N*r _tt@e`aK`).X 8)6ml$l]QR MԄQ졉W/&ls;z<Ԝ;7դ,~ndiu.Y}?fw$YT38wi59fϥi4 rb#p(IϜ u!*V% Ou8f ٸB= @Bk2Ѹ0ftYsٝ,;:$aMP;w?׍6"!*)^oIxJzW,w`lgu' $ul}=!$ |g 탻sb O,M7a(I6n{lZ]~ i-o} 2KI8]~-`h+$@cZϡ([S+G$!iZ2jMhsp%{-zveCfY|6X3ǜK+tfTxjt]aK5?ٺc`2%&szq|SL|} K.'mS9dQ+Qƨg7Zq>E<_j× }y{\x SГ%P% ƒ%5ҚJtl.QqeYW>&@qHkJURU"v{A9zVT2 @⥄^DQ^%Qb*#cM?2xuSz|L34 ALε=%/LgKcZM8Dz:afk#&ڣl?nj6| d.YwWҶ L|6$8Y=7k?yvNj;!՝J]n9@=0I1ty8eH.?EwsD K-,[>/?"8sΣKr@2"-R.G*%`1;[C+r<"xxyCi*]lLk݇y,"RQ xa,:/xwdM~KVE1Y9¯wxe|E}YyPFYYsE9Xvod6\:5p:w֬7P;*q9!ۃ͊4i-n?s^~U?Fk(u\}0A^̙ ]8JKyZZExs:l3 IZz~^x;#eUc$<`N"B0ipރZLfL:aY6祽$>uʜQ=CW]vH8k>ba`A]17Z 7Sw"oL>*e ,_ ;i#?{RZ.p&I±$gq-|sXFm%1F]}ayC Pw7s_8pfD@4H%,-D < lY-X*C%ZgATa2|}yBOl-vXNDIDV8t=nJ%b4<11\"{6ڴ6dܼ_e)UiW|C?SHlNBTp>:gŧz;'z"ِj CrKSeeSpf  +q!x\="x=N2}`8Řѡ^?P9=ԿdӐ|VhvqF/6BHL e"rs9eWVPr"D Kq q݂/}Ž]I k 7MVΡЛT-|=bEݜ2gOp)T )/Hiq298˶(s> ãbEW(+>=py <݈ő2\Dt7ip#Ҥ\vЍz;}͝} bמ TeW2T'"޾^.r}_ }kZ%g9.cO57o׺`'LIGQ5Owyqgן Jo!B T2j8CXry>NK$?Pwm{6OFMzLEɯ"+-@h(Oģ2= @^Dˀ!;B^G_>E%UIdYǜ΀eKyA&XH _;$!ՆPtբ\1j鬄N@ B+ZsRruG w e)eh}QMYZ2$).zD^\` JEү 3 WQ9yV 儵X>϶ L.*I,^@w4z4,S{]֪6-H(,Ub8O ;ަ(Z1}:`ɧC`'ۦYEĦlT0SV7 AQ̉H0=T%ퟭh;؇ v`V:,/YpT06cy c#*aPqR97.'z3P$F9gcaϜ+ ʔI/9mݽ&~]ˉyFcluOn50zqimgeYy9GT%BSDA'1DYxdPY). @ P5c#4..$?*Ӆt6 wtJeE= wf*;x#8;hUL~&-=Lf{8]C~p9e0k-U2E)8%mb T?/f%tHmpȂ1@RG8\{;xRCǃ2!|"SPoݡ.u~j|e,A6"`m:xG/dHҟH5P`֪t7Eű7PoZYk9LjK3`=ś6sl_jE9g$|7;9۵0߆I\]\:Yz*ek4N+ZkP%3G&y<"V0 y<% dSz~9hdIlwҖH;mγO,1=~DqѸ@![0Y/Y XO{+B+0进wD-B7h):-F P˦ u W"y> +\GvX~nܽ5H:|?K18p&J ^GfsBi+|tTZOg3XR$ghI_Rk]_-p'4LMZ+a,juF\ȡh!c.^w{Zna-zsAC.yD7:nS~IoWau>2 M#@[z OKOa{J@#bbzׇiqw R$}&$qL)rf)'g"C=Ji{X~ q_ !f}*Or4bck&DhDj)49ݢ)2{s V-Oy~xa@Oe|Sս/{&f=iiI[G3B ❐0ɛ=hn_fN,TP@mP 4@*Kꏆ6CPgg5nr~̑&618/BL RflDuvN'ƂUza|n$m/~ 򔪥rN{0NQvTG7fjPͫn,ű%I$ k缃;E``ClhK~uhd{n?1mPŐ0bVhYQvr>'wFEʠFsF3U3'4aֱx8%?aS#蜝geN FiT_a0n\aQ(xU]gm4L-;BJuR;-3\7Þo et۾QDbQ03 G/\6%s<gR.4Ҽ 6bFuo)eu:}1b`]a,q'.@7xb P"X4e']V3uqGW*ĞO]9۫(:7DWu0hˮ䏱퍱LugvK @A*IR,U~"bVz fAaZ8∄Aq*"1n) X ,"5E60E;ӣQp8 U&XV/b.*417F4ĭxmacxO/Yfw(l/-|< zLwbǧp60H$,`/U%^+htk\֚ `g3z>V/#1V }pPmycAc rO|.;@ vTs@*pɄv;\x(Qtq\J }䮄]ފ9iW)2^M b5칙S4[9c_N#/z=6q0<AsvNUFZï/8[ԍy|<& z=ZJF }{ tibzH, 7=8Uʺ S&@[R,]YnF" _*IpEvd# F赗$\P*8T"\f~l^jPNψ+\}Ͱ1Eo3u/bTx3s"3w"Ut݈h|q: Rca8k&X}8NdEn.ِK|W@R"1vDU& Q)SB0S$"I1m[0R)IB%jI(cM5).5CS!ޱ_ey @ex 5Y-jq7Xۃ߳4Y)*P!:(^ b$ɪN~`!mVc1{ꪉҠb~J7l:Lv~'H>t9FRay,?UN~jB*G4oL=b+h*~mxhƛ\KɚmցPxfv+EmUXzx:A]@]fp_!1D:)lH9Oˡ=d Z/DCE|,M+XppmՎb2$8U$aKv."G2Ը<3ien<!R…m*mrsS]lfMj3@~^IXKBbz-uMB.o1,KuZe\ LNw%rp{ 4}P;sQlZt}xԀQ;y#u7S1V&˥S*EQsKm^M.uWq ʈw?1'V{"Bܒ\y- Vng6O;6.G]&;7K#'y QMl8Aԥ{ yza/+ɈI7AY.T^=((l~ZL>` 0Ox"BdjGʖciK=Ҡ_zMLؙġ)M:IyէZ@YIM/ل`/L]=amfSj/tѥ01Gj!w91? ]3#Qmo&Y5 pԢn>ҽmubɘ@[n&\3\ђJbLSdf9_n&W>FzԫcBx. 6DeM2?6aV6գ53tIA|Imɠ$9'}PKR=,x0%^f+BHIhmؽ+|̿xw6(t6,BE"AuşN/(75v zp}Z 吘ZfD5;1Xʛ.Rw'"Zif\6p{RnYU,buKǃl.vaj<)U*2kp^TD];0GGPd=oQmwk 毛 >@<#ӡ5A/P-CY phi(Q9J*S"ub?1|,z/'m.HNjE([:nQɈ𕖸[y=va߆cwtXfV(Lݠ^7Њ䓥!;{Ndz G/ KFզ d}Au NMU 6~2rH딤5{v; ЫEjȈj `ZrA`Iu ?e$ .ko*?* W}8j"GZpӨb,VK͜ `hͯLx,[x*0;099Gmr<+Q 2QK ; JX%x-Eb"~ O0*.;$t ɒ& =~gԎ Zx3f5_fwWkzڷ UQJJ:gI_cÿl(=(\m$a(  vmzk ~yJQ- Qj'}/]9nƄ:M.#BƠ,鉱bdF9hưql{d~Y:EVWk!t'oP|F?3ɋ0&*/'_tF0Фh}3^d! f-`N##G ?!Sk]dwV5kaov`ړ⯙煏+ 67lE?BY)ry"ZM4R[Mj;U:2eD#gJP֓cBb h .^?t86lȍ0gX?sVBEln 4ϝT~6]ZGFkvk;GI)WJeAnE̘M_@a3FԔ1FAN{1k.T- C+[֭Hu*-Fm)[]rيz @ާ BUE6jHA>籰(Y:mBnFbz*ylqE]+\; Vض͏XĻu |k MD4q|5-7\Û1v!K‰dDd\7NM\35MQTqΕ耵l}ć[\VWda0)(e+P< zĿQ=Jm nsN/{5- VoفN6Ⲙ6].jMJ:&B ro$qL9MwXi03!1>E(hGu$f+(S8ncϱsU(o$`UZ95=q׷kBÈDdY|ltG[ \EtE=%yRRo*84vM܋:]؈_=j[c5K]c9H9w?hAD: k L|NX}z)FJa_}Ѭ3súڙ7\fRWPol QB'w~Uy'bDa!\e eHDoF01 ˾<[\4"t3;,XF|1~p(Zd3Akж*Cq%Dt7d\RD"9g=~vk`1 *x$?boe<.yHQ#mN29"Syb:Rr b4yzjja{*S}6c}R0w>\<4-48^R@&OjJnA[@RS"n LCx3PC`Pi 5#,+ .y%@g}At*u0sS4#uP4jH n*A:z񎋛̜H#{DL=f3q 䗁  [_خ巣n+@sJ/`kxsoi ug_bڤzoD]sNpЎ rQ)dTī2ؘ@z* 4zvAל9*E8h4q!a>5+3P"u+~B[>eUqc\!  әTxk&- ƸA[u-@wt֠4S Ɠ_iD ,~z.t֏Nn/5׵Uh޹p4(TumG| Ah^IX\آumcM=X5xZY~}pVD!uUrqhP{Cp;Y 4߉p-Di[v,!qDG: #AFR+x¸kh -Gl6\K-CO*w%NIE9?nуqvGڧ@ŋd;ЮsA)8;}{] sm48dSxe*ɫ`\t~x#Ew=%J|]ޢN¼r,jn$Ɩ=r'}!;=KI) *.Kpseq_HYv<.b; ΊՑ~).hR8;yAaWY=P5nR m"͚%ʳ(acA\x-I!Sx, YCZLVtiaU%2#,릛|'N)e ˕_DOt-׈s 5Q*7ۆH]TO ˀM!14_hxb+N+i+2y1¿H1 (5#[@`EZ\/sT$HNC5Di_RM FksGvYHӕ?$;'\x O EL燀۫ve^bCW"^T*;8`k ˎMc9?,\O]GXKRR^Fjh^K$ZJp8q::eVP6}m;=09BcuxR։$ń9Pb#_n @|{p`Ȳ;SRpG/XxI7D;@=B*/%'ypPqfpBͰe"o<"fUv2u^_ˍΈw  %pDiu1.N}7v&d{(“zu+ӏ*EAݮ]Wኬ۝z3ITXk0;SahҎdD/B!ܓcDJuBX[.HZbF |/0 RiO< J)фGQLX~\ tgYQ#RKQncLQ|ڎNw.#WRkX)HCj Pbt>|xװ*NlfD0 M`]ͧWU*{>z-4J[񗏫0к"s53Є¡g[Ae1hӂht?xY2Gqgt-(m,s֕vė1pw7ߪ3d ePN.lv܉ײ: !CZŏݎɣo͹Zq;;s3[;K:HtYřсP<UIb*I-i ,O=$>~@\O#ωcqxWl}$3Qmƈz_eI]7.Q]X M(GCֱG1l-C^NmE"stukuAWD2VqgF)"D7!"f40U}Qv79ZsoNihd2&]tr\t6.+vuo4J_X3F'pJL.\@}4o;5I!Z/)V] =ߗZRnƃ=v\9Q۰eCnwXW/b@;؞EJC \$_(S32w"QQ^OZ vb{ZO߱D(|;OqS-+J2lb]\ҟq*ZQ)q!ѧChXt ':Ly\&ف-~rc'?qd8TbiTf,4ɜn\Tb_)osbyM0FFOl#\4Ҧӗ +SWz:rMjԍѸt2t?qm {|X/ґ)NS"RI#G" !E+AvTOщ"i+E2P&.*./oxs9f1w /7X1/'EFXړz1ʭBk0%[1qr bK3 xP0Mf^Cg:j#܎պIo-d>^Pwni&(0&#;ᓏ0yΧٴߌ. !}u}ЅOoc (W'aQS"LBcD &VXMx,l䦳fTkQ :T*m j,tK0y09d"1uYțm%',g@OAv9%zգ0S?SaIEA6b2\fKRqK&$6u-ufe& C@fUW\+~]^%j%0l[w$|0X܍[]ཱིNDXͧ\ T~,?xLRɗD`xuRy' lY5Gs;2ev v!2^/zy~@$SIK440%.!Ӭ4ꬷ#W\THvnO[ftL!o/:;Xfq*<h F!}0TipISu9m~%*01o3 #&\ t =rfʌ )kzU$(!uÊI\ܓQHV i*DJe;I *PWZA)_Sg1Bw3 %cE\: y >Hx\/ؿ&_'BxZ/:@~TlE DDw"Geȼ;{;f^Pd@f8g%(m'0y t +Q˲}:جmߢ؅~p/"TR"^!Cw%Z^W 0\Eupp&FԀWݕ/e#Ht ʡ+ ),0\z G>Iri9HNZ;KU`b$ӳŌ56՗2ɩE$0tzl?WՓ5Hr,L~BoZ'oڲ`G Q[x7BE:yGh!FYzVvOg C.?x@04d7o/>9ՔTGeDs[O7?r u7S\:˗iIIdk: 4bMUL/  F@#R@[e+ysF?{ fC }"C3L qncB(>eHn I> &HzpYo',Z VL/W(C?7ho;DžarvܪPs]qcUŕl rpB/`r߮ 3;sGsB``?]iJ1C΅Kg^W ba@;܃M!i&KX(M0?4o EQ5MD2*[$k!%ߘy9Lq.5(0q^ٰx b@eb!QpGG:&{yͶ% Dy)u"w!>< bv|iP{J0jWNRpKb#,uTh:5R1ZbF07 q!2z[QP9rG:yZl~(iFY S9̔ G: YZ