container-selinux-2:2.99-1.el7_6$>l=WE>?3@?30d$ ( P  &-  8  H  X  x  @  H h     8  l  V ( 8 E9 E:E>/~@/B/G/H/I/X/Y0Z04[0<\0T]0t^0b1d2qe2vf2yl2{t2u2v2w2x3 3,Ccontainer-selinux2.991.el7_6SELinux policies for container runtimesSELinux policy modules for use with container runtimes.]vDx86-01.bsys.centos.orgCentOSGPLv2CentOS BuildSystem Unspecifiedhttps://github.com/projectatomic/container-selinuxlinuxnoarch# Install all modules in a single transaction if [ $1 -eq 1 ]; then /usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi export MODULES=""; for x in container; do MODULES+=/usr/share/selinux/packages/$x.pp.bz2; MODULES+=" "; done; /usr/sbin/semodule -n -s targeted -r container 2> /dev/null /usr/sbin/semodule -n -s targeted -d docker 2> /dev/null /usr/sbin/semodule -n -s targeted -d gear 2> /dev/null /usr/sbin/semodule -n -X 200 -s targeted -i $MODULES > /dev/null if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : if [ $1 -eq 1 ]; then restorecon -R /var/lib/docker &> /dev/null || : fi fi . /etc/selinux/config sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types matchpathcon -qV /var/lib/containers || restorecon -R /var/lib/containers &> /dev/null || :if [ $1 -eq 0 ]; then /usr/sbin/semodule -n -r container docker &> /dev/null || : if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : fi fi #define license tag if not already defined&FXA큤AAA큤A큤]vC\]vC]vC]vC\]vC]vC093be781f9916163b4f01d3f7edd672d735d3d8347b5aa643cfa3c58057c6d5d06fbf981e1300e33caee8aa3f8d2b050efa644cf7f007f199b2c901486b577db0da136008666de90c3f116043630e0658a3fd00690d649d99d735f9f0537dcefrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootcontainer-selinux-2.99-1.el7_6.src.rpmcontainer-selinuxdocker-engine-selinuxdocker-selinux        /bin/sh/bin/shlibselinux-utilspolicycoreutilspolicycoreutils-pythonrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)sedselinux-policyselinux-policy-baseselinux-policy-targetedrpmlib(PayloadIsXz)2.5-113.0.4-14.6.0-14.0-13.13.1-216.el73.13.1-216.el73.13.1-216.el75.2-14.11.3\@\N\w@\4[k@[@[[@[[Xf@[L[K7@["X[@[@[[[Z@Z?ZZZ%Z%Z@Z - 2:2.99-1Frantisek Kluknavsky - 2:2.95-2Frantisek Kluknavsky - 2:2.84-2Frantisek Kluknavsky - 2.77-1Dan Walsh - 2.76-1Dan Walsh - 2.74-1Frantisek Kluknavsky - 2:2.73-3Frantisek Kluknavsky - 2:2.73-2Dan Walsh - 2.69-3Dan Walsh - 2.69-2Dan Walsh - 2.68-1Dan Walsh - 2.67-1Dan Walsh - 2.66-1Dan Walsh - 2.64-1Dan Walsh - 2.62-1Dan Walsh - 2.61-1Dan Walsh - 2.60-1Dan Walsh - 2.58-2Dan Walsh - 2.58-1Dan Walsh - 2.57-1Dan Walsh - 2.56-1Dan Walsh - 2.55-1Dan Walsh - 2.52-1Dan Walsh - 2.51-1Dan Walsh - 2.50-1Dan Walsh - 2.49-1Dan Walsh - 2.48-1Dan Walsh - 2.41-1Dan Walsh - 2.40-1Dan Walsh - 2.39-1Dan Walsh - 2.38-1Dan Walsh - 2.37-1Dan Walsh - 2.36-1Dan Walsh - 2.35-1Dan Walsh - 2.34-1Dan Walsh - 2.33-1Dan Walsh - 2.32-1Dan Walsh - 2.31-1Dan Walsh - 2.29-1Dan Walsh - 2.28-1Dan Walsh - 2.27-1Dan Walsh - 2.24-1Dan Walsh - 2.23-1Dan Walsh - 2.22-1Troy Dawson - 2.21-3Fedora Release Engineering - 2:2.21-2Dan Walsh - 2.21-1Dan Walsh - 2.20-2Dan Walsh - 2.20-1Lokesh Mandvekar - 2:2.19-2.1Dan Walsh - 2:2.19-1Lokesh Mandvekar - 2:2.15-1.1Dan Walsh - 2:2.10-2.1Dan Walsh - 2:2.10-1Lokesh Mandvekar - 2:2.9-4Lokesh Mandvekar - 2:2.9-3Lokesh Mandvekar - 2:2.9-2Lokesh Mandvekar - 2:2.8-2Lokesh Mandvekar - 2:2.7-1Lokesh Mandvekar - 2:2.4-2Dan Walsh - 2:2.4-1Dan Walsh - 2:2.3-1Lokesh Mandvekar - 2:2.2-4Jonathan Lebon - 2:2.2-3Lokesh Mandvekar - 2:2.2-2Lokesh Mandvekar - 2:2.2-1Lokesh Mandvekar - 2:2.0-2Lokesh Mandvekar - 2:2.0-1Lokesh Mandvekar - 2:1.12.4-29- built commit b13d03b- rebase- rebase- backported fixes from upstream- Allow containers to use fuse file systems by default - Allow containers to sendto dgram socket of container runtimes - Needed to run container runtimes in notify socket unit files.- Allow containers to setexec themselves- tweak macro for fedora - applies to rhel8 as well- moved changelog entries: - Define spc_t as a container_domain, so that container_runtime will transition to spc_t even when setup with nosuid. - Allow container_runtimes to setattr on callers fifo_files - Fix restorecon to not error on missing directory- Make sure we pull in the latest selinux-policy- Add map support to container-selinux for RHEL 7.5 - Dontudit attempts to write to kernel_sysctl_t- Add label for /var/lib/origin - Add customizable_file_t to customizable_types- Add policy for container_logreader_t- Allow dnsmasq to dbus chat with spc_t- Allow containers to create all socket classes- Label overlay directories under /var/lib/containers/ correctly- Allow spc_t to load kernel modules from inside of container- Allow containers to list cgroup directories - Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.- Run restorecon /usr/bin/podman in postinstall- Add labels to allow podman to be run from a systemd unit file- Set the version of SELinux policy required to the latest to fix build issues.- Allow container_runtime_t to transition to spc_t over unlabeled filesAllow iptables to read container state Dontaudit attempts from containers to write to /proc/self Allow spc_t to change attributes on container_runtime_t fifo files- Add better support for writing custom selinux policy for customer container domains.- Allow shell_exec_t as a container_runtime_t entrypoint- Allow bin_t as a container_runtime_t entrypoint- Add support for MLS running container runtimes - Add missing allow rules for running systemd in a container- Update policy to match master branch - Remove typebounds and replace with nnp_transition and nosuid_transition calls- Add support to nnp_transition for container domains - Eliminates need for typebounds.- Allow container_runtime_t to use user ttys - Fixes bounds check for container_t- Allow container runtimes to use interited terminals. This helps satisfy the bounds check of container_t versus container_runtime_t.- Allow container runtimes to mmap container_file_t devices - Add labeling for rhel push plugin- Allow containers to use inherited ttys - Allow ostree to handle labels under /var/lib/containers/ostree- Allow containers to relabelto/from all file types to container_file_t- Allow container to map chr_files labeled container_file_t- Dontaudit container processes getattr on kernel file systems- Allow containers to read /etc/resolv.conf and /etc/hosts if volume - mounted into container.- Make sure users creating content in /var/lib with right labels- Allow the container runtime to dbus chat with dnsmasq - add dontaudit rules for container trying to write to /proc- Add support for lxcd - Add support for labeling of tmpfs storage created within a container.- Allow a container to umount a container_file_t filesystem- Allow container runtimes to work with the netfilter sockets - Allow container_file_t to be an entrypoint for VM's - Allow spc_t domains to transition to svirt_t- Make sure container_runtime_t has all access of container_t- Allow container runtimes to create sockets in tmp dirs- Add additonal support for crio labeling.- Fixup spec file conditionals- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild- Allow containers to execmod on container_share_t files.- Relabel runc and crio executables- Allow container processes to getsession- update release tag to isolate from 7.3- Fix mcs transition problem on stdin/stdout/stderr - Add labels for CRI-O - Allow containers to use tunnel sockets- Resolves: #1451289 - rebase to v2.15 - built @origin/RHEL-1.12 commit 583ca40- Make sure we have a late enough version of policycoreutils- Update to the latest container-selinux patch from upstream - Label files under /usr/libexec/lxc as container_runtime_exec_t - Give container_t access to XFRM sockets - Allow spc_t to dbus chat with init system - Allow containers to read cgroup configuration mounted into a container- Resolves: #1425574 - built commit 79a6d70- Resolves: #1420591 - built @origin/RHEL-1.12 commit 8f876c4- built @origin/RHEL-1.12 commit 33cb78b-- built origin/RHEL-1.12 commit 21dd37b- correct version-release in changelog entries- Add typebounds statement for container_t from container_runtime_t - We should only label runc not runc*- Fix labeling on /usr/bin/runc.* - Add sandbox_net_domain access to container.te - Remove containers ability to look at /etc content- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7- properly disable docker module in %post- depend on selinux-policy-targeted - relabel docker-latest* files as well- bump to v2.2 - additional labeling for ocid- install policy at level 200 - From: Dan Walsh - Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a standalone package) - include projectatomic/RHEL-1.12 branch commit for building on centos/rhel- new package (separated from docker)/bin/sh/bin/shcontainer-selinuxdocker-selinux2:2.99-1.el7_62:2.99-1.el7_62:2.99-1.el7_6 2:1.12.5-142:1.12.4-28container-selinux-2.99README.mddevelincludeservicescontainer.ifpackagescontainer.pp.bz2/usr/share/doc//usr/share/doc/container-selinux-2.99//usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/include//usr/share/selinux/devel/include/services//usr/share/selinux/packages/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tablesdrpmxz2noarch-redhat-linux-gnudirectoryASCII text?7zXZ !#,c[]"k%xĉNμ5#+mz q{@gPȃFG=uǝ<%Пv!8)级}Uk1%i&T<4ё;NI X*6*,٨̃;^|:c!$٨j%|UeB;S )B=$*d_El9ArF= ^}l,x~pU~[%bWy3fTr4ha6O:$y)`Aq:-CFwY-@n8QΫ!VZoͰF3r>+I1,}m䞱(@B)TE \ )$WgWMWc nl6ʁ"/nSbk=5dSғVD'mﮂ)ڢ3|Ӽ["y3i/{yγ?eb=EjeZ6N'<~:n'gJ Ӎ p ַ,*豴B`6~ '{$ ٧ kبH{0肱ӺT :p!*ֆ.,LM|@`5m?3ޔ㩥 ,iZpRsZhEX^]SnXXHi j$E3 <\CIf&m]Of2&ՀkkpW?AV\;ϭ/(hzӢz;BYdNtrjL(XW HPrrVUM AAv3bc/WHUDxbN.-IQM#k?yOp- wi} +Zr^T<J!Y`;9}YR%mqȒ3H $>ɰU2>6}v)~vävDdc}xsa`h% oXwlw$'=fHy/E& Ҹdi!Ql 720K_Jx{w1d ,xFme;ɊUfYP N U{0KȬg$ 4!Z z1e^~,+s(#{)4knx5*"%X7Eg xCY]=邖]^y=6Ga J"闃Pk3+oGeK1ۿ?!o :rqKh(:/쇴@FM[jo 2 l* كoez(KAyxfȐ$iViAJOU>X*Y+;۴l`{pJ})= pImJTPbK.wY.l2iFϜow敵C밢b0eC0iOsEA^ ,c  #kY;QIspBCTt>|Cׅrzh⾡Yc^.(|-D]mkءqD FJzl¥inb~8wavF@3Q_viڧőqVj]In&=ubrq84-Uoٷ~fZ#FSO-JBq!&[oNzq5lm)p AodP}ܦ'~ ?N  9ɤu;G( 47?/`p>L+ & iG'iͅn Q~fPd~U;?m4r:)"|5sne$Lz^iCQWxX}&ft[_eS{X<:7_8?S#3B w+WӇ-5:ĶUAMR,"ܮ>'r&>fmUX(& S-Z&6cVxxs.=BA]xu~k].R߼fQJ/tη^I*dN h?=*xd]:/{3;1-)J0ͪslB)i̽χ-$bEvuz?q$g;t+}د$]^r© l&-{sT f& P7$ǁvxo r&4Ɯf uȢ1%?*8~I]H%?e:֮x[RϑMI8Tks.Y@zE`-4xmŗ*v_ik8!Кs;Epn{eM8l*7u)\)1 #bZGL]Sh&Nea%5n;bq&-aU{Sd mV[ lGci]+*10E dHқ%#z O~%Z2ܺi}55&-H ˜Lx:La~eR*gCr5|GOt9 OVB?=t>~ Y;DI=|`޹^σM=?d'[KjLCg*5/-kV-|h0 =i[t,i"Ƴw$ҍʺɯ}10 ݺ{M7VjH-tPG?"s3e~oVٷmQ|~&@qfQz#]Iq?(Y_ fG"=l4 ЗCc4`yƨ14mM ;M"( `[P4߆&9}Bp#FjcDs@C% #[yɢd0]LZR&hE}O''"eNգ| doFR̿=&Pٍ﫜L~ű:XSej1o*eܢS4Nf R`H/X`ǂތ!H 7h߀,4;=ñ:j).e#&ⶩQ\8K@$]lDODoaGu8"Ji?Od搱(A|1mk2L̕1v4KڰpqS1Ap?beϜ}ӂ@4d_)MyK~-&3PO%T{.>d&f 3bE7mE2ʡvIGOZt> QIDʝu5j Oߦ<}A'k +U@p[e1S |.> >k{N'fZ0Ѓ^`qiet ֍Q3E^י*BDMpzLw!47rq10EEuYT.=IE(}bMdίցd|TH&x$XpT_}v ,DA36D`{`22%Nա 3bseTפiWc1%U'#ʑGWi]w7w?= GPsR"TƠaɎk\)I׀:&֦' OI{uxx{[N4uCaZ3L%_0OLJ'Uڒtàn(fk(-SNBD@w.^ݞfshqH\h{~*#"˖g D$3XvrFQrDfr)2L&eCGu,}n}Vl&X Z=I:,~P85^{~ Pks u/|'V^;iXɷYkH/l>M7 T_AIR@QFD bhּ*(0Y. ȇ/q'^C mେ~d) HW;v\`UZȓv ߪqW 2'Sגo-1b-l])%TTnuR[Ӕ?rDᰊnOn]:.Pi vO7ѵ; xm=e:vr3&3dc9^p:/:,bTTaa5^) NF暏Y.X9vR gP=0PUoxVю 3~·Pr^UMgSI C !.HFm6;Wq"!g[Ks"X\s&^?qjכwPbd%s+im#P*^‰IXߨ$ꍅe:Rj)gsz][]d.͐ IEV8rsÇʅo9.]ހv!ɉ#GJᮢ{;W2 kG1>p)XNpEi Z" !i|Z[q/U>(2?4w{K~ (%k2V)#;6MW3 M|q%[ϖ`4;$y=?|HO}:l`O3USw}ijW?@dv)i1LDveȴ}oՑqF7Ovث%ok|<g1FFb,wJ k)+'ߛGak$_Qk;Z@t$#S:<85MEʓ`*sc_hJ |X6ɞ6F[ZNC_Y*:Vt& Ȋ %JtMeDN41ϞU˭8b;@^ES54p4d=+?yK嶊p5Gwg4]*I,3񆯷?^q#WEOl:.EB;m SPtLISF!;eq}́mm Tjn];kX N6-ʟnfo*SYnh[ߕpÍo;%n Ac:?dd/9”I:/qLxIfbtH~|Ѩ5\TY*X\fMWc˖_kseD|j@>\Et٠Rj0W]~rrwRU<1,XUr@s~=$xbZOg-`T',hD)ש+LIxE8z xM0A|};wNR]0k*B#h[4(:: pŷF#eZCESFS`->!7ZDKOq3:!:/o6nd?Y-"A%%mЊMiG]M&z`h]Lˉ(mOlKlbLn%GZOS`Ōp )c`cϩ -?64}dq_ýj(K°A:s |AWv5.7 5CZ{+Zb̢h-^о+/>~3Hwοb `1`R#q[kz( Oє)D_,؇;VmXn̷bA^!*|%DEi!Y)ߜmtdL_N,'\_:+ 3D/ixdfuFzaMM[>(NJb4H-1B1&>7\O|5 )t`ɕxQsC'%l/5q-{lYJnY&%> 1#T &Vh[]0s%|- v%]3 f0diAɨo9PΊ"g~ZDuCWG}"yJP-VBnj%rX\ i'h0U _ 'Q]֦RS2u#}Zꃀ~11joU;,k]5KC=UL rPJ'!yeZy\@t]~ޟLX5}U{,A[/1i2C5Uor!9;T4#zv߳dGHeGcKbM$.k cd*?̐z`WzGth;T>+Э;\-x60\=E h-ʷNe b sXVO.ٸɶ~ep oc1LJk<50:"6 ò(!u$ Ʋ"~ Q%:7&SƝ퟽++8WQ1[z,ϔ3_SCT$z@UpmD1TtDwH-۹1}r*\j"IWzgrey#^ }WwoՖT^/yQOWOjx -t],Q20@3Giͻ  _- `Q u Wvtr1 %9o49mk[5c 2Z@Y' /Tˆ>?kʹmh4=)5Gq6J#8YCo¥:.-ZҦ?95ǜ✺KABkͭbz3{q zl_bAZ'o YְO0Ig0N踰Pҫt~|~N]-jAxkuo#EwV+y 𴏨+XZَzڬܞq^%ot Fr)WA OTn/!)vBpUij9NKy[ \[X\ ݚ+RgD{VYfHXy^s[s>*͢ 0aH@˖V7?A =EbCN-auo %Eu֥ƖNS"ALZ\KPSk$s4-̲|ǤHL\4AmE pvȾK9C#zL|/OK]0Ji1653]чNPA?5@nNAYQ=(g`K!-4U=qVJMͻ/#?l3P-p+J\ύ-ԦGr ˻8n8yeP Yu:yk6زPh/3Q~guR_~dhd1pN䪀bT^ LtI`X`0jWײ;g7g;NopeKIDEGN=,Mziؤ;6CRFw!I g{Ek::c`s*TQ ^4(ĈxOČrNA.`yXgQ ޺n蜷#Q@@I\TM@_A{r4M/hM??CdTHY^ehPޤS @W䧧rXsgmi(;\MZF4{SУ-߯y+@d+_ '`:jje} os/K>h8?B߹C9G˸"1@ fGXBL. c'<S._EV\T/?g"E<}B㳪l{s2a8ЎO:>ASuՌԣ0򎑫6W>o@aSK',B}|nR(*~B+>8kFE]. u:8nOHӽ>k7|nB ;ވ{nBSQRRmx`,(z/0NW緼A6ZHZ ſl(CՖg;0 uE "~ *oNm蒫{Rr[NT6zgv[/0㬥=R)SSQ@28f>/Pz51'Bkh%؂p*1h",/T=iK FO-%tWkW .-gG y,ϑ>& Utsneު5VwPm/6qso:[{ΉCPK+(pR?R:R~/eW]ݕ]e~pKw+lQ > MNݵX#Ed&$g1zVNDI.|b`&p)*n+Nk)Op$9xcX]EXTW=.2l.t-S" ?ȸ#TC,g^+ВEf7|C@йsbՎ3xYK& SE%MV,cްS=L&2 ;皞V -lce6l{cѝ3ܐ9F6tJwF4A \W=EߠL}|G+fù6g 5()գ vTR'ߤ~2Mp+=$U_Jt tEN—I s S:T#N3%N6`d+G? <~vw ޒ$qXd-q{(ߣHbν tomnzfL玮ZiW?4r:_F8 ą4HجG5*Cro "~B%n!3M[ifQ+u77řKƎrV/Xr7:gf4:'.e; iQɞ60lGW!2ZSSAZK*hb{>b}(yv {`Ҹ3l`%v_\1% H6ܑc;= 0+BXn xPOSJLK&̗/ӂ}h_"^S!L•I gb{NW[!-GXe"O{UjVm>R &5&>~PTŞd 1)Q(!y;#硅'wⰺ1:ءc8zo=0G@H/MTjvϵ#;EL7!e^Q.8j\f 8[]MLg4M9- qLFND/Q6xK} O={(̖G)9<FG1S{ ġNFZ[Qq '2{)xUWvڨfQM ; kC(\eH -#[aزy~Kd&DK%(ꇥD!ޛ<~n .pS\-&[ 9-Ԇ8$[Q_wρ6RNGkyȡ^MdA!E045 15dz#\ US< 2TbH W)ystA}^WGվw* pk~eE.xr\EAS0\E "G4ԸE^ n5+#m\Z8@xMj1wVs /{#K;2|SGUX7F땙~E00z~Fe@\ 7ojʵׇ3ǵΤ_F^ID^];ڊRh"d T~uYOZ(< nI&ӑ XX|pbd]^qrJOW)cKK?wT<5$gpXRPw|lqp:.< C;teaf%v&Z)A-Vo=;Xqh%.)!J\RXgk.}|H6[&@eI" EyPSŎ*\E~&2EAáN ]UѭA| en#C0%"\ܵ%S6Y ylxnշ(VP²Bzc`|`'Y<ׅ\~ Wa:Cĭ@;W)9E}2n{˗`r+#^!U-ܜ@NcR'VGsϬ?ZЖ `4#'6ugltR[A8,ΠCyun,A 41p=v97,+a`B ).|nvXֳ)(ɰfQ =У;:摙JGe ʹN\B6 a?!-Iq PYQ xVsF<=\)taXwk4CKŦޖDEӘZ[tNyMEMC.AaX S|`h- &tܼt#߫p:٢-–БdFd^t ܟv|^)w(Z)6uFmD(=#Mqv3yHқ"'fԪَf;}9UQ\ ~LVK+,0+w*R\f%-}?K/xxb\^blw"p\ ~#O"8raKٸ }SrbDgY,PX[hɠ{^շc^$?1?b%V1ӯ$P6*5jtWQ30wp94sHh9)G-;D p1?g[@4z[E>'$x7]cN 7t)c(Y(b-{DiIt]KT` e$knםAgݽtZ:@D)r_ 17”'eG,ajW]jAI/*nN;t%$oRYy:HSRpz\ ܟ(ȖQ)ngWAEGU)LfD o+-Xӆ"UeŴ+au9hb~7zpt)}[, fU jSK?ęg.}d;\tX t,1ժUyMhV t|DYG"I_w9ӼeCrx;]tYN_~ݦN@bb?@OrNV$=1õDREk2)ag:3FH֟h`RZZ~^Yz2/a$pIզɌFeNu!MXQ)j+DMdgf%"G1 g岋*(+X/jحx䝥z2 ijqErT _Y*-M`u}vh$P7 " :_쒪M k05zS(J]@iwE"_:O`c Eđ+'zaO0]xS۞LuĶqIqI47 /V[lwA+\/js.x/G%jfVIѓ7|ANogVE{:[xGb q;]#?j0 ;"\G۪4X c @[K<ɂ"TT^ʜ@,S:x[j:fZrCR' .ǵ1=]QY?ָxtNm` JeDq"$Ttƭ=5A_\#0coT`u.&twy 1V{wCY!OGYg|BC?R_:c,OgȽfFT\ƒOT#l3v}Yd?0iJXO@l`K(` d?RskX.MTea-XT>Y@JUzeu[tY[3 [\>fK8VjTݎgK|dz P52;UӐ5!h.H-|h\f:l.!Bi1`nC2!MQs/q X=% mfV\ u_^u'C! 6E &Qܥu:acg~DnNj,i4W>g݂M|?аdlR0N'JyBXvvνjQ^48Hf y>IL+4%a*p\t#JrG_2{iX.G=%cmzݖaxs|, q>tp~TdnN86E]=~Nv}<Bp+;UQ: KN_z|*׻"U}0)w#-R$~W]ȯiֺ}EB椛M, fc5)|[P\#';?1z =$;@oLr` l{!ԓhG 7:5b.fKaYaU5z*7)%\"+̗v. \oie_>G%FqQ,kOc}Ӻr׸8 .M Vo;*7e : .@"@y6] Ka>@2bay6_/G?senx3VaGn|My&Nt/nʔ(D!YGd tuIB,2&,C|z 7FLi'KmpG. hn1jĘj[AKS dC~v{ĺިֵ!#@o_Sr^Dfg|-*)#{h*&`X]?m[]R`[V7&g˯94w*X6Pʷ|-}O;+l'8 KMr&jp):ュ?Recb'VzIoE=0%_].B2ˣ=lm-f>})ĿYm 4#ڨhAk(3}Iq 9_E}ڧg=ExcѧE\˃ n)laG du@?35puӟԊ O&zbZVXGy+?ϾOn j'*PMev7cCo=PJ.6aSW!vpQ`&X(0bmуIt  YZ