container-selinux-2:2.99-1.el7_6$>x؆a,~߰šm>?3@?30d$ ( P  &-  8  H  X  x  @  H h     8  l  V ( 8 E9 E:E>/~@/B/G/H/I/X/Y0Z04[0<\0T]0t^0b1d2qe2vf2yl2{t2u2v2w2x3 3,Ccontainer-selinux2.991.el7_6SELinux policies for container runtimesSELinux policy modules for use with container runtimes.]vDx86-01.bsys.centos.orgCentOSGPLv2CentOS BuildSystem Unspecifiedhttps://github.com/projectatomic/container-selinuxlinuxnoarch# Install all modules in a single transaction if [ $1 -eq 1 ]; then /usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi export MODULES=""; for x in container; do MODULES+=/usr/share/selinux/packages/$x.pp.bz2; MODULES+=" "; done; /usr/sbin/semodule -n -s targeted -r container 2> /dev/null /usr/sbin/semodule -n -s targeted -d docker 2> /dev/null /usr/sbin/semodule -n -s targeted -d gear 2> /dev/null /usr/sbin/semodule -n -X 200 -s targeted -i $MODULES > /dev/null if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : if [ $1 -eq 1 ]; then restorecon -R /var/lib/docker &> /dev/null || : fi fi . /etc/selinux/config sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types matchpathcon -qV /var/lib/containers || restorecon -R /var/lib/containers &> /dev/null || :if [ $1 -eq 0 ]; then /usr/sbin/semodule -n -r container docker &> /dev/null || : if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : fi fi #define license tag if not already defined&FXA큤AAA큤A큤]vC\]vC]vC]vC\]vC]vC093be781f9916163b4f01d3f7edd672d735d3d8347b5aa643cfa3c58057c6d5d06fbf981e1300e33caee8aa3f8d2b050efa644cf7f007f199b2c901486b577db0da136008666de90c3f116043630e0658a3fd00690d649d99d735f9f0537dcefrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootcontainer-selinux-2.99-1.el7_6.src.rpmcontainer-selinuxdocker-engine-selinuxdocker-selinux        /bin/sh/bin/shlibselinux-utilspolicycoreutilspolicycoreutils-pythonrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)sedselinux-policyselinux-policy-baseselinux-policy-targetedrpmlib(PayloadIsXz)2.5-113.0.4-14.6.0-14.0-13.13.1-216.el73.13.1-216.el73.13.1-216.el75.2-14.11.3\@\N\w@\4[k@[@[[@[[Xf@[L[K7@["X[@[@[[[Z@Z?ZZZ%Z%Z@Z - 2:2.99-1Frantisek Kluknavsky - 2:2.95-2Frantisek Kluknavsky - 2:2.84-2Frantisek Kluknavsky - 2.77-1Dan Walsh - 2.76-1Dan Walsh - 2.74-1Frantisek Kluknavsky - 2:2.73-3Frantisek Kluknavsky - 2:2.73-2Dan Walsh - 2.69-3Dan Walsh - 2.69-2Dan Walsh - 2.68-1Dan Walsh - 2.67-1Dan Walsh - 2.66-1Dan Walsh - 2.64-1Dan Walsh - 2.62-1Dan Walsh - 2.61-1Dan Walsh - 2.60-1Dan Walsh - 2.58-2Dan Walsh - 2.58-1Dan Walsh - 2.57-1Dan Walsh - 2.56-1Dan Walsh - 2.55-1Dan Walsh - 2.52-1Dan Walsh - 2.51-1Dan Walsh - 2.50-1Dan Walsh - 2.49-1Dan Walsh - 2.48-1Dan Walsh - 2.41-1Dan Walsh - 2.40-1Dan Walsh - 2.39-1Dan Walsh - 2.38-1Dan Walsh - 2.37-1Dan Walsh - 2.36-1Dan Walsh - 2.35-1Dan Walsh - 2.34-1Dan Walsh - 2.33-1Dan Walsh - 2.32-1Dan Walsh - 2.31-1Dan Walsh - 2.29-1Dan Walsh - 2.28-1Dan Walsh - 2.27-1Dan Walsh - 2.24-1Dan Walsh - 2.23-1Dan Walsh - 2.22-1Troy Dawson - 2.21-3Fedora Release Engineering - 2:2.21-2Dan Walsh - 2.21-1Dan Walsh - 2.20-2Dan Walsh - 2.20-1Lokesh Mandvekar - 2:2.19-2.1Dan Walsh - 2:2.19-1Lokesh Mandvekar - 2:2.15-1.1Dan Walsh - 2:2.10-2.1Dan Walsh - 2:2.10-1Lokesh Mandvekar - 2:2.9-4Lokesh Mandvekar - 2:2.9-3Lokesh Mandvekar - 2:2.9-2Lokesh Mandvekar - 2:2.8-2Lokesh Mandvekar - 2:2.7-1Lokesh Mandvekar - 2:2.4-2Dan Walsh - 2:2.4-1Dan Walsh - 2:2.3-1Lokesh Mandvekar - 2:2.2-4Jonathan Lebon - 2:2.2-3Lokesh Mandvekar - 2:2.2-2Lokesh Mandvekar - 2:2.2-1Lokesh Mandvekar - 2:2.0-2Lokesh Mandvekar - 2:2.0-1Lokesh Mandvekar - 2:1.12.4-29- built commit b13d03b- rebase- rebase- backported fixes from upstream- Allow containers to use fuse file systems by default - Allow containers to sendto dgram socket of container runtimes - Needed to run container runtimes in notify socket unit files.- Allow containers to setexec themselves- tweak macro for fedora - applies to rhel8 as well- moved changelog entries: - Define spc_t as a container_domain, so that container_runtime will transition to spc_t even when setup with nosuid. - Allow container_runtimes to setattr on callers fifo_files - Fix restorecon to not error on missing directory- Make sure we pull in the latest selinux-policy- Add map support to container-selinux for RHEL 7.5 - Dontudit attempts to write to kernel_sysctl_t- Add label for /var/lib/origin - Add customizable_file_t to customizable_types- Add policy for container_logreader_t- Allow dnsmasq to dbus chat with spc_t- Allow containers to create all socket classes- Label overlay directories under /var/lib/containers/ correctly- Allow spc_t to load kernel modules from inside of container- Allow containers to list cgroup directories - Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.- Run restorecon /usr/bin/podman in postinstall- Add labels to allow podman to be run from a systemd unit file- Set the version of SELinux policy required to the latest to fix build issues.- Allow container_runtime_t to transition to spc_t over unlabeled filesAllow iptables to read container state Dontaudit attempts from containers to write to /proc/self Allow spc_t to change attributes on container_runtime_t fifo files- Add better support for writing custom selinux policy for customer container domains.- Allow shell_exec_t as a container_runtime_t entrypoint- Allow bin_t as a container_runtime_t entrypoint- Add support for MLS running container runtimes - Add missing allow rules for running systemd in a container- Update policy to match master branch - Remove typebounds and replace with nnp_transition and nosuid_transition calls- Add support to nnp_transition for container domains - Eliminates need for typebounds.- Allow container_runtime_t to use user ttys - Fixes bounds check for container_t- Allow container runtimes to use interited terminals. This helps satisfy the bounds check of container_t versus container_runtime_t.- Allow container runtimes to mmap container_file_t devices - Add labeling for rhel push plugin- Allow containers to use inherited ttys - Allow ostree to handle labels under /var/lib/containers/ostree- Allow containers to relabelto/from all file types to container_file_t- Allow container to map chr_files labeled container_file_t- Dontaudit container processes getattr on kernel file systems- Allow containers to read /etc/resolv.conf and /etc/hosts if volume - mounted into container.- Make sure users creating content in /var/lib with right labels- Allow the container runtime to dbus chat with dnsmasq - add dontaudit rules for container trying to write to /proc- Add support for lxcd - Add support for labeling of tmpfs storage created within a container.- Allow a container to umount a container_file_t filesystem- Allow container runtimes to work with the netfilter sockets - Allow container_file_t to be an entrypoint for VM's - Allow spc_t domains to transition to svirt_t- Make sure container_runtime_t has all access of container_t- Allow container runtimes to create sockets in tmp dirs- Add additonal support for crio labeling.- Fixup spec file conditionals- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild- Allow containers to execmod on container_share_t files.- Relabel runc and crio executables- Allow container processes to getsession- update release tag to isolate from 7.3- Fix mcs transition problem on stdin/stdout/stderr - Add labels for CRI-O - Allow containers to use tunnel sockets- Resolves: #1451289 - rebase to v2.15 - built @origin/RHEL-1.12 commit 583ca40- Make sure we have a late enough version of policycoreutils- Update to the latest container-selinux patch from upstream - Label files under /usr/libexec/lxc as container_runtime_exec_t - Give container_t access to XFRM sockets - Allow spc_t to dbus chat with init system - Allow containers to read cgroup configuration mounted into a container- Resolves: #1425574 - built commit 79a6d70- Resolves: #1420591 - built @origin/RHEL-1.12 commit 8f876c4- built @origin/RHEL-1.12 commit 33cb78b-- built origin/RHEL-1.12 commit 21dd37b- correct version-release in changelog entries- Add typebounds statement for container_t from container_runtime_t - We should only label runc not runc*- Fix labeling on /usr/bin/runc.* - Add sandbox_net_domain access to container.te - Remove containers ability to look at /etc content- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7- properly disable docker module in %post- depend on selinux-policy-targeted - relabel docker-latest* files as well- bump to v2.2 - additional labeling for ocid- install policy at level 200 - From: Dan Walsh - Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a standalone package) - include projectatomic/RHEL-1.12 branch commit for building on centos/rhel- new package (separated from docker)/bin/sh/bin/shcontainer-selinuxdocker-selinux2:2.99-1.el7_62:2.99-1.el7_62:2.99-1.el7_6 2:1.12.5-142:1.12.4-28container-selinux-2.99README.mddevelincludeservicescontainer.ifpackagescontainer.pp.bz2/usr/share/doc//usr/share/doc/container-selinux-2.99//usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/include//usr/share/selinux/devel/include/services//usr/share/selinux/packages/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tablesdrpmxz2noarch-redhat-linux-gnudirectoryASCII text?7zXZ !#,aZ]"k%u#qXPNeR@Qk{=p]s;2yT?WW.WcL`L5t~&|mߜ7t<H?hV  DNQq[ O톀9Kˠ|'9\i׷}=<_aRvw gȆ(Y٥P+47DC*Y2{cz^'r9b' _U* (f`6G,ȨODlc6C\ƿypS谿FmeC@~TX(CZ؉UmPTk?~BZ'HI y%[í+Ũ439gXPۭӤ`T+d>Lq xdqBiX,,nC A"D(;-o6|+<7 v_%cؽ6TոU-%8X9Q=PUem rj! '0T}ݵMV?lX(qKF:1PEIIv/SA/fڹ9{7Æ|J,2w0j1_SLPR'О}kSk|]—2dI1xծR$-%ؘ S*ǾrMy,V)0HSĽ/c5M>wL>>ŏ9#,hr+N.~Bu.ye_}-yb)ʲ&{QdҒB@9woMV$q J[ڈ| $2Ne"?|Z wźFq AEY#IVW\ u%604v+u<>4}>ɴD"l)%drl_Yfr[ةޱ:*U-9h$N5ofab h9Z$&ݺչj gjxIJAY\S+2f뮧Wx!5B6'Ữ"C_;TUV:Jɒм,0dɹjzd{k145\{SS{φ7=ԽӬ؞UbT*N,O % R%㝌lF3)K @6cƂq^~vWq1<s=_IJ*b*E#f>g,DC[qľ&`ѕp+m =>&' d}O̢ˬ׀3-Mnt\Bx9yq{7gzޢ7uW\ Ъq~g)b";t2a*Ǘ݈KӀƇGq48 DnІoyֺ k h>.Ё:tuHEpV$& *qR( Llk hqw#Qv'Mү9=h Ah|T׳KӤT^Ut7s;Igs \&Uԝrs@ i}#}r -GwA$H"?Zc%=hxb`h[fvix?g5au_"``4n ],|׵ʡiQ_r\wڐ5 b _qA 0w.G~r\Rl^zg`Gg'ءިC'չω=G[FTb4~0G˚ X{\3Э>Ac;O)X:na'ȫ*4s6\k?W=,zrm; /3J7nr< tPlW'Т sQa!:_r#ݱoEeL:tSW̄.ޫoICE星p ]k3?47b|;^O?,G !s 4c6QpF\2G ~J~O!k"@Bm0/k7ت3y~Ō n-kӗKؼ8opoݜ@+!*([Bl1J:cUM/@d3j,F{'5/UQ O#dO7LPS@6}6ӂ^;g^`I^rE)w;`wYø(>ioSxR|YMuy鲧ԟz"iґli&)L>"{ju0[4Lg$KՎ CBUBpʳ4 ,c4g#kW7_LA]Atf / HH;LHlAϒV`hu6 åiLb2FFoՙʺ&f9IA^w=C@DR¸C =]Yh c/ $F$H)»e'tykĝ')hpG7JGY>ij|BdOdJ{ټjӲX<אE@`b:\] \<DZxУsP J+(NNa.ס4jF"= L#;"`Ø PW*3MC Ԁ)8 =g )X:jdwMKױua(@)zq$#vG.$֨Ȇɚʢcn6C^$MLlqc"?U`n]˙y֪IWcR2yVm<lNv&Ͷ+.6c"$oGEd:.Cf4VF -F&Ⱥd5+gX^"f':z@"@ģ:#OXcBR?ޡDty+ݢD^Kc )ɮ.|..OeaflKpnJcUPkQItԏ ֛B>ŘzxI0|b"Yj:"*g\40'D\x %l@Ǥ.8[gQu *R4;g_Y^tK`0c8] Qa[^q"n!<'?ԐFcbܿ]J Gi2ik(F.ey~qK7+*FxB+'tƛO!U>|?j,Ivd_#Ҷ崏T]`]XPϦP_[nN˕]M fiGɊFS1kA@ ]`z$@/4O0ֳF$'fID\t΁cZe^$%wȯF qA8d4]Z 3/"Qu \ty˹??2ҘE :·( ^rZgo7±ui9SN6$X0q( m _w(O뽜l[DO*@~5s zsiM̄:E䷮LsVțmlV _stW-B8TJ83|k-Z[*zqdC\sl2([:Ϩ۬%HAd#fYoY?)Os3kY-Qƿ -iskS++!vԇ)m{Р#KhN…>)DPFMק_uA퍤d[g%);!5<()}y<11HYLu{9t[:&=Kht7:3ŽPJ~,A2uBk5dɛ{P+>2ift37q:u1 VC DNG uG mr.h~ϧ~bS)!(N (^>qzq2~l^4)5qˉ 5MT5Qf(vV_N)' }ɭPz=>yUeUBS8ǽIB c03Y0⦙ Ct&y{c,'̏*j;(ז3~ǯ~K}čr>T_*)j9Gy!Tkє,G\) LὬo5&eN n;')3oL gs _R[l~A8~P+׫n3|䳈& IN^lNg馻T?Z'|Iʔ=}ϔɘzj/0 E)@Ta²&[ı\18oL:ÞR\|ьOjM10]TUjݒpju_GBLl-$& +\1])P!`o<K+W)0-A|̃4.3#pp@󽫕~2Y*_ݖgFi)`<Gq^k7&Lސi_:K!ڝjl{bF!q =idWұ>5^bv*sH+EoHKbp WP8oD.eC=!vNۼ׮#Sf;w]\ 90W@Ztc  3R"%r4PB2Ð Ԧj*B0Cs^ScN).F*QNYpStxz'JPUm T$UtH9WCx5XT@Y +.W](Gg / p8:e1Z #O1ʯ%>ĎIIt"tGݬ!G0\p?^Hs-b8݉U+cfCyB'W@U֬^ƥi"p\~Sv~m*<'@9<}L,M1K@6dZ$ضNZe0a$?#Y:΄KoRWoMi7t-PҐz=|4hyӤU9,Ë띉¦Ht2qLKMa1[=)Lai/`S7=v~ĩ'[`H[aXЀ .QʌըLD H̼ Ȉ2X>UXW}̰vzpx#c>>91Y|1O wx9y]*u1"B?o& ɫjiYcp|&Nߜ5n q|grX6dxDN Y+>%%?j*AIeE'r|T"/ZzVe"RW@VDHq~|jwg9{qO$*0n8aJ}X53hM7\.mAߩǖ kJ;7 ҒFGJDc:pE=1Mw$j~w;eh ;*+Y&75`P5q VYSC=>r"*3_ESݿ ;zY 6eWkr^Iū3 )& 4WHBaV-)no}7uF'OJ1ۯa/bƦ~2Ѽ*7&/u NUVC׏6d"}'C-~x99T8]<ףZYDKQcUNTPWIWu%-qn%2K\!P8:6-L IL/qd U)]_fs%$]ԃik*|mq?)h}L?C/{%auctxxR8U?.)5.S@͛]&e3 @POw1G؀MA/Z#RKdNFV*~L!CbC"fys0&0zS.(,6LYgʇb# <\V J\X4ra4B90`Ird$)yIEV(a˸P;g#% ͟B4I㪄Jno;]=,@ DmD1uB& r*G\A0OY2v=;p0'~zG4/l@wRb)=hpMLX`UCS?*]iRSqQŇ4GYFP)p36#.kU'7| )?B~xMS"zq(!)|2 RTN*B{M"72@lap[1-=.96'{+Rv1)+S\ m?RP:yh5Xq a٪9SʘZT4 ۔RqhF, 5a$4 }pթ?Fq Z`!,g ;w$RTI;gk5}GvV/8_mcGK:|*ǷDHyX_]=۪zY —{z,Gzj.zIO)`"שшT:!E"o&>kqbF_4>}@c&  fRwT'B(O~3zMQ4 S+fm I؛Ҝ8#kMQI/茚0q2Un!-#ho ^r3d' %SؓKo2cq $uo+o A΅bu񥵦3h|!Z/n۠:~IĀwQVz}Op{"}$27%fy?)WiWUW,롐Njk%b1m3wet!D=)_Ԧ)fn]laHp6laڭkci>d47P8YS4eYJ~ǖ=)S`[*V[=7F݆eO/[ R#մV?c.0tǮuqOH%wٓzu[tM>J ٢MLiȆ,G2MjY*;I4U\W*ɚ@m#7殾2($Mq&t~C;$)8,I^U*n=v4#χ\.GczD]c*;OjH=CfF7{^[|elhIGȓbxn8>^W,4$4DXɠ?])gF"xKfUʜ餼 N.HQqCPpRϋ|_}$#8q ~@UؤF!^Em0>LAmO1!ܚFFI^D hcuU: F] rwaEghS!2/5[}]HbdYvjYEzs{n8ٷ@>OW--mAII8s?F࿚D0^ / ؠRm[qhhZh?.LI 9}H2L/ee`1P<K٤<nu``Ut^C/[1XWHrѼ$8{W3|*=A'(IN QޞlQ_25g&#/!${#ԥF-+9V!YG=Y#?Ej hi\_WpeWW+Psm!vܲ{b܃fUU;Ÿk/;A[jF`h|a"U}7b&,EkS;P=\[ɇB./kR#ҐR-4 )Hp6urI (׭%ݑ/(wO}-n[` DriWy[T iu `^`,FuYcY.隰a,Jڙ-w9.rZ4GhL%HR'F/GWVGbxxBvswy5Ъ_54b o`l^K"|jYf(X%p"v뺫@C`0E(r1 nr׏4Ysq=XM*j (ނhvu8P~O*~swnDա(AF`֡ L|b=:Wv<1ф~Caz.43qD3Ar0P2ͥ< 6vA~ ayx{dZͬzdEdITjd՚>I"\=\??YՎ-qhšO8<hpJM7x`Fp?Y -x9+8jX/{yŌ~Atv[fC`iSe(䄗b"ˀ|Έyt {]TQqg|̧r/33/F)YNp+v|:_㯇+񶁪O312=C+,usŵu8/9ph:A'K!dr;q?OR3¼ :V ER?ߪ.L5C܅31f3=/U]*m@lKr[^Ct1Ȉ0:d5ykDTMJIw;r`OͣU ߓUޕR=Ƌ QQe!yϸ3`>h7>m4Wy o0:C]`z\^hOY2|7.@~yhLM|w+=,P嗢nD12^[MAy0 |%@o 䊒(b47(S$={[h)i{1eA#`A/򧸯01)A+e>bAQd[Uհ;k>V*k\AhR9.!F]sst@QNfu]?z!P9QAU9qNEؿ.ơ-}ʅHm LƜHhRAu "X>͈~fbQ -Of `^4~L< `]4M]CH-,*6l"=\}9Q ?0qa){2Bh@oۖ'B< CSUF x x]Ca]cܡq&ĕGsub!߱ u^OKgˆ o?6G\7]N"@K2cm '[eP[tsPՏ!lɳH< l >q0RcР ^D4zNr?LtwTTjMhCUgN.1Scmı=bfX0'FE7`k4u;WNQܾчK!u04ݕ<%bV"zmFa\9VIdnW6y L! YL !ekߺ痵i~Bz P#!xǾq# |K>~;8`b<44k,sؚ;g4aic0b$O:jKf? uum8I~ĉF'b7ivx~Ҋ򏽖J=H"/Ș7؁.A)mW s"0h!r]9B[IJT mi 8|kp즓bW0vᤘBnGWhcypoI#t2(b7Ng&2 s4k܌ :2{h$2VUjRP_7 6@̧$&`AG\64v (B 2_O 3{M"G<u\8o2{m3`qr}|/r?uaE: p}̠5dzvoM ,8pЊ=6d,jHVѣ[ <|SjvZɏLk>fGB2={l|ze%jQ~xn$Z^i>xO:P1z9G~][5.BžS@Yj"_ػ 4t-ޞ`a0Kp6 048{>V)RT[2Ɛw5uvU ]79ƞ>8=Mo 0$Z<_FaR漧> _@r5ln]Ar'*6REtcT㸩HslY߭LQ6W>#d-V7 m6Qu/ -, z7r/OGcѭ UАNfEa=x̗4D8+郛0n;b ћPt"{jb$!o,|l?Hf,3$@ ݸ*ht\I55V (u f%S&1*hXBwp+};Awg%́ aB[EuAT * s.PDג,ybF$AWrbMi f 'ѫ Q) u)G˟!/m]JM%RBRS=z59U2/ag椚2B@iخHy^`rh0Lnn!6R#5D%[S{8s^NRw5 /]\Tu)H}kd]0,JPx(xB䓖Hz5-0Rqɿ DJBЋ${cT V X 4WhVɴ{׃}bQ\j冺ײ{Y9;Ssp=gHְG ;eeĤ*Ceg:뮹^pVs i RPMEIsON1KYhƀFw~:0:%BZ Q3NLY6࢜⎓Rz.}RV#D6y=!tq}[CR MuJII Tz0aDmaSp s5aě_&Tj4in8&2+yS&GC*  )h5=&H$t$qnϿN`mYz( LQ-=/Sr:. ӷ0m~k`%#hjqt;e$_ƏS$^+Zk/ s sV֟؀9wۀޓZDQ L(=Qw>ԜyzZ.'!K[ۄ{z 2F~ ȸVrN(4y?-G=~DȤJoIޒ0[ mbY} r EVh =j$fC:(dÒLH\ݟ&5-p]{V$;_EkbӥKcMQUaua~8zNE)q ZT/"EG*OC8EGzjÂ0L?R53ҰeR,WYI8z'+Hű 0Vұhlyxj#,ʮuliK)\Dp-+}x~ UU% 8cߍPE(Ơ˪;fc' V{NՅa\E S6dC"}CAhm-Y6 #Ыy1ϋ5P>j K|O95w.ELp>%_cLoDkF%+-<3p  9OWT|€aŐJNbNj6b|XY4NRRAKov8%x2uu?0J7\*X| #C"U+JNCE mXQy/Jo)S\b WW[n"y0l`.:y,I[dRMˆiQ2Xåh#"CZN;UjFQPu9_hd!%<@pڎ-sޥchqXr&|G9[}8TuyOt@*/g5w.gr1v[bY#k+9T,,=y3ЮU m=^􁥼 Zcz Afs\{fA| U5ajЩ:Wtb ~X#JEYUsSp:үiDs@7F_:5&\ L}(>(UQ`#䪪04aW{N orҤ`c:'ƬF z*%ޓ3rқ,R5(lҩLk.t.xL9\^̔`?RT & MIBh;Ņ-|Gy|g11Htz)"YCkRY,))w~FB/%A J )[5CRdw*M}6 $Eh-m9sU$чF=j.!lT;RДGY#Qm}^ tyVǢ /^7 "]!pZr=Y4K .7X׆V| ,[ (sK/Ygg#4n3w ;u9c'>+媽pbnN԰t6SE{ t0Wfth3c`47|ea ^p;0ZZ`: ,(d&"#P/-Ûq`ȡD|7nmi߭-K;C}*~@.\[IHm8+Q8-Z7nY1rQ̪ Io?1/.Aek(K UFYrջe-pXq$&hS'{2j{aטpL(ͤ| P)nJbtGMhrYi09ZOIh~#7ttXVLiWCO:ّY"z-=~pm)kRci眲(ya8;}Sw9ԯ^Lahڝ %`# 2X:#29 sWQM2LЧ6wΆ.ܘ?9(:ph(eP-_ҽLiC;W5B(T[9cqs oM2- h/z`uJIHK5l}unݘ)11Y X_|vݦܛw74qEW;1ݍ@ YZ