container-selinux-2:2.107-1.el7_6$>4(ډ>?3?3xd$ ( P #*  8  H  X  x  @  H h     8  l  V ( 8 F9 F:F>/@/B/G/H0I04X0<Y0HZ0x[0\0]0^1b1d2e2f2l2t2u2v3w34x3T3tCcontainer-selinux2.1071.el7_6SELinux policies for container runtimesSELinux policy modules for use with container runtimes.]HFx86-01.bsys.centos.orgqCentOSGPLv2CentOS BuildSystem Unspecifiedhttps://github.com/containers/container-selinuxlinuxnoarch# Install all modules in a single transaction if [ $1 -eq 1 ]; then /usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi export MODULES=""; for x in container; do MODULES+=/usr/share/selinux/packages/$x.pp.bz2; MODULES+=" "; done; /usr/sbin/semodule -n -s targeted -r container 2> /dev/null /usr/sbin/semodule -n -s targeted -d docker 2> /dev/null /usr/sbin/semodule -n -s targeted -d gear 2> /dev/null /usr/sbin/semodule -n -X 200 -s targeted -i $MODULES > /dev/null if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : if [ $1 -eq 1 ]; then restorecon -R /var/lib/docker &> /dev/null || : fi fi . /etc/selinux/config sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types matchpathcon -qV /var/lib/containers || restorecon -R /var/lib/containers &> /dev/null || :if [ $1 -eq 0 ]; then /usr/sbin/semodule -n -r container docker &> /dev/null || : if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : fi fi #define license tag if not already defined&G=YA큤AAA큤A큤]HF]]HF]HF]HF]]HF]HF093be781f9916163b4f01d3f7edd672d735d3d8347b5aa643cfa3c58057c6d5d8491a1d23bc4df52b6735a5d3c52f1148999a8108d02557774495e4cc87beca036f6566a08b292c96be1bd93bf7f15cf714fa799e9570145c2ecf4eaeadef8a1rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootcontainer-selinux-2.107-1.el7_6.src.rpmcontainer-selinuxdocker-engine-selinuxdocker-selinux        /bin/sh/bin/shlibselinux-utilspolicycoreutilspolicycoreutils-pythonrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)sedselinux-policyselinux-policy-baseselinux-policy-targetedrpmlib(PayloadIsXz)2.5-113.0.4-14.6.0-14.0-13.13.1-216.el73.13.1-216.el73.13.1-216.el75.2-14.11.3]@\@\N\w@\4[k@[@[[@[[Xf@[L[K7@["X[@[@[[[Z@Z?ZZZ%Z%Z@Z - 2:2.107-1Lokesh Mandvekar - 2:2.99-1Frantisek Kluknavsky - 2:2.95-2Frantisek Kluknavsky - 2:2.84-2Frantisek Kluknavsky - 2.77-1Dan Walsh - 2.76-1Dan Walsh - 2.74-1Frantisek Kluknavsky - 2:2.73-3Frantisek Kluknavsky - 2:2.73-2Dan Walsh - 2.69-3Dan Walsh - 2.69-2Dan Walsh - 2.68-1Dan Walsh - 2.67-1Dan Walsh - 2.66-1Dan Walsh - 2.64-1Dan Walsh - 2.62-1Dan Walsh - 2.61-1Dan Walsh - 2.60-1Dan Walsh - 2.58-2Dan Walsh - 2.58-1Dan Walsh - 2.57-1Dan Walsh - 2.56-1Dan Walsh - 2.55-1Dan Walsh - 2.52-1Dan Walsh - 2.51-1Dan Walsh - 2.50-1Dan Walsh - 2.49-1Dan Walsh - 2.48-1Dan Walsh - 2.41-1Dan Walsh - 2.40-1Dan Walsh - 2.39-1Dan Walsh - 2.38-1Dan Walsh - 2.37-1Dan Walsh - 2.36-1Dan Walsh - 2.35-1Dan Walsh - 2.34-1Dan Walsh - 2.33-1Dan Walsh - 2.32-1Dan Walsh - 2.31-1Dan Walsh - 2.29-1Dan Walsh - 2.28-1Dan Walsh - 2.27-1Dan Walsh - 2.24-1Dan Walsh - 2.23-1Dan Walsh - 2.22-1Troy Dawson - 2.21-3Fedora Release Engineering - 2:2.21-2Dan Walsh - 2.21-1Dan Walsh - 2.20-2Dan Walsh - 2.20-1Lokesh Mandvekar - 2:2.19-2.1Dan Walsh - 2:2.19-1Lokesh Mandvekar - 2:2.15-1.1Dan Walsh - 2:2.10-2.1Dan Walsh - 2:2.10-1Lokesh Mandvekar - 2:2.9-4Lokesh Mandvekar - 2:2.9-3Lokesh Mandvekar - 2:2.9-2Lokesh Mandvekar - 2:2.8-2Lokesh Mandvekar - 2:2.7-1Lokesh Mandvekar - 2:2.4-2Dan Walsh - 2:2.4-1Dan Walsh - 2:2.3-1Lokesh Mandvekar - 2:2.2-4Jonathan Lebon - 2:2.2-3Lokesh Mandvekar - 2:2.2-2Lokesh Mandvekar - 2:2.2-1Lokesh Mandvekar - 2:2.0-2Lokesh Mandvekar - 2:2.0-1Lokesh Mandvekar - 2:1.12.4-29- bump to v2.107- built commit b13d03b- rebase- rebase- backported fixes from upstream- Allow containers to use fuse file systems by default - Allow containers to sendto dgram socket of container runtimes - Needed to run container runtimes in notify socket unit files.- Allow containers to setexec themselves- tweak macro for fedora - applies to rhel8 as well- moved changelog entries: - Define spc_t as a container_domain, so that container_runtime will transition to spc_t even when setup with nosuid. - Allow container_runtimes to setattr on callers fifo_files - Fix restorecon to not error on missing directory- Make sure we pull in the latest selinux-policy- Add map support to container-selinux for RHEL 7.5 - Dontudit attempts to write to kernel_sysctl_t- Add label for /var/lib/origin - Add customizable_file_t to customizable_types- Add policy for container_logreader_t- Allow dnsmasq to dbus chat with spc_t- Allow containers to create all socket classes- Label overlay directories under /var/lib/containers/ correctly- Allow spc_t to load kernel modules from inside of container- Allow containers to list cgroup directories - Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.- Run restorecon /usr/bin/podman in postinstall- Add labels to allow podman to be run from a systemd unit file- Set the version of SELinux policy required to the latest to fix build issues.- Allow container_runtime_t to transition to spc_t over unlabeled filesAllow iptables to read container state Dontaudit attempts from containers to write to /proc/self Allow spc_t to change attributes on container_runtime_t fifo files- Add better support for writing custom selinux policy for customer container domains.- Allow shell_exec_t as a container_runtime_t entrypoint- Allow bin_t as a container_runtime_t entrypoint- Add support for MLS running container runtimes - Add missing allow rules for running systemd in a container- Update policy to match master branch - Remove typebounds and replace with nnp_transition and nosuid_transition calls- Add support to nnp_transition for container domains - Eliminates need for typebounds.- Allow container_runtime_t to use user ttys - Fixes bounds check for container_t- Allow container runtimes to use interited terminals. This helps satisfy the bounds check of container_t versus container_runtime_t.- Allow container runtimes to mmap container_file_t devices - Add labeling for rhel push plugin- Allow containers to use inherited ttys - Allow ostree to handle labels under /var/lib/containers/ostree- Allow containers to relabelto/from all file types to container_file_t- Allow container to map chr_files labeled container_file_t- Dontaudit container processes getattr on kernel file systems- Allow containers to read /etc/resolv.conf and /etc/hosts if volume - mounted into container.- Make sure users creating content in /var/lib with right labels- Allow the container runtime to dbus chat with dnsmasq - add dontaudit rules for container trying to write to /proc- Add support for lxcd - Add support for labeling of tmpfs storage created within a container.- Allow a container to umount a container_file_t filesystem- Allow container runtimes to work with the netfilter sockets - Allow container_file_t to be an entrypoint for VM's - Allow spc_t domains to transition to svirt_t- Make sure container_runtime_t has all access of container_t- Allow container runtimes to create sockets in tmp dirs- Add additonal support for crio labeling.- Fixup spec file conditionals- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild- Allow containers to execmod on container_share_t files.- Relabel runc and crio executables- Allow container processes to getsession- update release tag to isolate from 7.3- Fix mcs transition problem on stdin/stdout/stderr - Add labels for CRI-O - Allow containers to use tunnel sockets- Resolves: #1451289 - rebase to v2.15 - built @origin/RHEL-1.12 commit 583ca40- Make sure we have a late enough version of policycoreutils- Update to the latest container-selinux patch from upstream - Label files under /usr/libexec/lxc as container_runtime_exec_t - Give container_t access to XFRM sockets - Allow spc_t to dbus chat with init system - Allow containers to read cgroup configuration mounted into a container- Resolves: #1425574 - built commit 79a6d70- Resolves: #1420591 - built @origin/RHEL-1.12 commit 8f876c4- built @origin/RHEL-1.12 commit 33cb78b-- built origin/RHEL-1.12 commit 21dd37b- correct version-release in changelog entries- Add typebounds statement for container_t from container_runtime_t - We should only label runc not runc*- Fix labeling on /usr/bin/runc.* - Add sandbox_net_domain access to container.te - Remove containers ability to look at /etc content- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7- properly disable docker module in %post- depend on selinux-policy-targeted - relabel docker-latest* files as well- bump to v2.2 - additional labeling for ocid- install policy at level 200 - From: Dan Walsh - Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a standalone package) - include projectatomic/RHEL-1.12 branch commit for building on centos/rhel- new package (separated from docker)/bin/sh/bin/shcontainer-selinuxdocker-selinux2:2.107-1.el7_62:2.107-1.el7_62:2.107-1.el7_6 2:1.12.5-142:1.12.4-28container-selinux-2.107README.mddevelincludeservicescontainer.ifpackagescontainer.pp.bz2/usr/share/doc//usr/share/doc/container-selinux-2.107//usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/include//usr/share/selinux/devel/include/services//usr/share/selinux/packages/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tablesdrpmxz2noarch-redhat-linux-gnudirectoryASCII text?7zXZ !#,a[]"k%u#qXPNeR@Qqa9ޖj@P37//DuÆ0';bR:3.=?!WFˢ н0"f䓶6L[gҥ)rtV= $ī vWKD>S ~e \rM<~ܪ C|mڞ?B9"}FRF;~ꀕ\< qF9C7r$6(1,'c$ TOeJy2uZV0 wӚ*TwB2\bU5Jj>]b&~wflܹ . 3 E䣿M^::k .v^}2vq#(ѿ0D`vN5u@? 8RmA_G~Zv=1 PiC;VuXp{z-8X)T4苑qNSSTSjMJHpUzӶ:!~F ȾA) ^u>ѬﴽUݩD#g:GP~ߗ![X}䰼ӫwSG;R\.0?AY0E64`@ȱ^Q "{X\:7,2;#bG "4KIcov5p6d'BIʓrY&/{[~!AÅqu*3cYm9֫F@ݩ ILSF%Lx.,,,lizDpu{NM$9ziqڡѻ 2U rm24'>_^,AݽdpI9)}dw\g` Ke._P+yYpge!R ] e,32$Hi|s[FY}~Uѳ]OvR#Na[-q}E qZZh}a91?(@t>z~^ }.G c/Hsn R:+ْ]3\ OvTX\ڿj FI+8"9TB`]h"3 }egɊP[='WwO6b_;+YȈGjX+WWd]1c޴p"Cw(:⬵AyvxN6/îvϏA( 8 Z&w> nw_^>laoZ`)_${;Q҉mrq@[y▚f'qg de&Gf oYYy*r2Rw= L6p5kAN\x& pR(yPwW%{Z+G[ vSTɿ*?*P47cBT5CoMȈGݥ5E4~N!́QkVVҊz׬6jOڨ9i`/[2UDOvDy&Dhf6VYǣe-T; M;!_NnV||eFү@8^Dn5HɫQVNr M.c+Pj>_q䢆V2lxw"hAy?\gE3=و b`"S(LE(v;Kٻ݉=4-eޭ =vDpr'tbzVa gB0IRbb%޿DQtàTyY踾kq@`hЏ0ɅڱR:(쿏'WH}#bCBX $ƪ(Ж5!xJiC\hp6ݬo:8a? aI:rEsP#JNY_p_KfD-ЀFay7B\-yAPvڰ˒*$3B+]V={Q3y5y*[ZhW6R >*ĝn\.1l Dm`+} M_hȍA$yE~wg6!?;|\,4g&a^_7x1 oa:PɄ,HA&] ]j9[vs^X i$Cj:,=ɒc8vuif zZ,3leܭh"qVEsT:ۇSefם$SP[{_JxjKihuhKN/z{vg2ƧK;Ni鿡B8x.0Kq{sf3LX|'^E's$y+p~o*NtXbuE:`1U?(W\i1 ȑ,{F Kj,KqAv!3Mr\d~~r 1%U1++@<dsB!ၛ@᳈ W a$6w3\ «lߺlma="NsgɧdV_ eLh<px:J8]~ ђz9nho,e7AAsIdE*3VF,O4]( \YĻ4œgz3Qrk(:6jrg%;nԑ.| j4hr²*iA[l JOjXvqe~ R>2`3=C8?%?d]YТVBɅx氢n;WS!^vȀ%@ul=BA(F֤Thåqec'I~Y6AEr@ĝVr an.,7= OCvPx_l+g"7/JO=MJIT>QsVlTjnb7Ҟ-kտGޏS9n}[C9oR1`6a*$ϯgwS˄͓Y}x+aMV$ t&^<(:áD`U]|= "S,~o]H6s ^ŪZLn2AP2- @H>AuS5P!fm>TmȀ!؀b)z:,s/@gRSz(GR"(8b?Hh2t#&TTѴVLu$+v|m8*6T41]7@B=C83|;5fLfN|BXhGfX (j kY_(h};-{&^lC=iY~.$y1"tZN$BC¢J%#rYm.4?F9CSһηr"M|#>WD7zSXP7hGm^W6c, WSg@(o%XUa^p):!0HߓM1{ *EZm#ȠsHr|,G2\^<_elڏZ'vkFiƮ7rp=.˜R?6ӳ| r蘌b$Ϲ&C3ו(5O&Kfů:5w/LEt1?r84p`KȢl Abp]cS9IGf?7i?΍u46fզSh5`ygq4Jt/(QƘ' Sc?5krq'ZhRX}2 }IcߏL:;9o|i OD:|ʈK"GxPtd99̛7Wnc㖣5@B75yxXEixP~,HRi6I63πߋ@OfzU(A)V(`E{,gsrK^%I߃hv-AV vt6 Sw;bN 507(]MIt0Q+@d#F"Wda=u1O~Z^&>Ms Ğr 8"'4`"yQae/$֌+/ꥲc7Hh.S-|Z!S.&ԗqӁΦIJ)fGPB5I޴.,:- .n:{wz@{v,h?[kQUڧ8ԅN$/uD6X"g]d׍ξFB%t.IRnhJ_ZLEIZ M2*;AeM3q0D`?QFZ&SݕHlTrP̲_5G? mغ8BЙN9 h`t}Ѝl(8e3c~Fk?\_Ze U#y1+tQ RM]WF^lAի<2v~?1O^]dޔ4垮{lܔZݧ@Fؕc~Io\Mcp4G dt(p MUM {Qυ^NO&žhE\cx|0rhw3S~̭R:5㓜+(6rhw8\<\._Y D>{.hm$ WNg5ᅬykҥ**:m ҖNoVǟ ̩˃1  K.ўdyu!Xu FCcp@?V\>cHT9ZRY돢Ԉݸ0oKBvBb|L=(;6/ϙ=wu@kujσ&zfv]L+b6q,7ʲY/=G4t( tb䉿`usڗq4IHȵU)H:Onf.aČsMGԚbtY>QU>U͐dېAֽ"г~%ze%Sm~kKA|,4<"uh<36pL90+=9]{:J-ĵm>H,H_#b h+ H̘c`UAW~}V1f`:AIU ןC0t H]V|h@]ɸyT?YէÀ$0qgGreʤ9ظ Sf.~oez'ؿ}"d| /b{'i'G!E;3s |#sOYN* SY> \dWwwi,s*bL7^Pjlh ǣe}fވpsH<nYĬ,<.T %|^]C)~ yfh+V />U\]j B=vJ? mE6-'=k٘a^]|pӱ&2"Nw_t;ڏmP.ߜZxٔaѥro{u(!ħh²MDn'/7IܟGb6g @6z 3=FXbS @c+>$_&qfX\=8ʌ>u.air~%ur(j؅;LE|,Ki] iM RGe9arEd5G\5"XkEKWIoQߟ1S[Iff{T6~j`r <&>tMfe Ȏs'|qRy$WA5RsJemJ~(]A̼)\|1c|ƽlR (8 m>Tew. O& +/i a"0ް]=n[L)H7>!s`rWC|>f ډm_"' p@dgHc*xT貈(WN.'UTWiQs Thז-+D';nX?D̹'!͑O"0V{WSia$CN6Ju7,O?JsuP͉ *e4 ҳ)ݙ:iߴ~xc*I'hlV2kk@ +6ME9b> ͤ4GuW+)>r&Y+~ w6V<ͺrqK1^Ɛ0! 92㝢_QPM|g>` ÿ&hKP{3#Kf5>?i>-pʊjX6.x)AHJ -;kԹiE[R:3oɬCJM7B&^ G֎A͕:NW]r͛ rبNHv3􄹫i kgݤ'TT3"-T_['ɃU// Yͨ @?c -[0~, 61cyJG!C2NI L2SrWf vj,K\?yY0}޸PvAERCk{H\ݠm Er>V`x.FGOGwօXIc6Vo@ݚ6(}c&nMײokTz2Zە$u'N~7A6\#R{K_8b^GYgHY_,[ݚ)Atz"΍ 6)^plYrHr;*e%we<5 /cŮw[;oQ8%{FJ_ V$,[)Y9xgzu󿶘:\P4*kpcs:Sl j{D4CA 9jPV-5f=ƤRڟrFCa7F==fK"OYIRzXP#AȎ-ɜidɯ!sL# :wL֮ߎ _ U 2/ogA} D/?ORr\eKP{ء OB~?'̄LY-r${x p/|z8=Ӳ"uXA5Ι5 ^ܒj7Hrjd'qb#PV~m&ݽF   mA  Bk]P0mD_?Kx@kMl{_G_/N/77}ZahW}ٴ1 i"ڪO&'c8cj9(W 05D\M[B\__B@Jɠ.*Y^~&竗ԮL1n^RIƳjJ<mgYDN tvpFX2?(j_x(DUь1T**,TYU52 7OO^e>ޢVE.ŬPՈ"0n` -gF?yo#e$t+Luc_Si=6r4 @gjVGe)a=} 5tOtL5R+g 13LMZe>" j^޲y\DYUk6I3vC;O)M[\?;fI؍^z&zr q=t~rLņV"U߽ʛ v&ne&aÄP/z ="e;8yi-="ry uzDqmم!4"ڦc'эFAI6`-^걌QYҔ"f5n1v%JX]~:@<@\F D0 >V<Ǿ7B R(=;#}%[mer]m\+4˘5>y(ʅa24ؽ!M(gy=re~d٦˙z6IA; o=*𕎬=,a} .oKΉ8H`67i'8Gǖ +9EyuzZ3 AŨ!/hB/nA ֑|hgܑ"_Ii[,?ʠP1'5>=jg G]x;篺$*w ͣ,a9zȫ-IFGLq_đy87P=yډF(v;*ngoN BO{m9;z㓟Aўt-)[u$Jcb5 TMT75Cs+DǗM->.۫92Š迁pBkfzߧjG:Xa)@Z_r;iRܓl{iѼn>גHԕq 3f]"T|Y}P:r,]jqbqၹ5vnjaTL!BD~̨ :KAVmpj3ÒZX_gԔ;[(Uxcw YjĜ1;`ǰ'LN(F#O"gb4pq /s+m!0Ejs HvÈn5ʮ:>Fo')t&||>Rfۺ&N%8>ҀP_72ҡ?J)[#GPhNA(gR(]$FbZ3)04gR1p"!pAY3 jx; FNg˿MZ\F FZmeЛܥ.46mUP!D)=[N<2VӬ~: S\W.m5wor;^sTr$B͙wUU#_љ lvM-]>h'NN:6ynxoNި% ^Smc=z*9 jh r⽑a~>X׈@#^*t1f,{ &yuS*los0̌croK 1"F;ΜR[xIfAOoZjK]¾gnlOs?Je.QMRDZՔSTb3C_J5x4Ey`JFfYȪwџ헤*o{0SI~_)fTf@ ;,rlPT%z!핛7[]|/creQk6UH=r S֏+g kڙ ᦨ)}MX6gѽ1>N];iz#AOL{6RڄfÕ!٩H{$FJռ:1=2%=ˍ5z[94n7JzH;y\0Բǽ&v | Q۳(O3TkT5\z 7 ԴHC[N^JN_[: H(}ع+oltiAxMυ*[=W]nawt\uX[\W;SO2]8ZtΚ u[&sA@)]NX3I_cvݖzפ2jb*A$w&D NVk `ce/u3b+ KFLGbWs J"Hm /KꤖycvZ9?Lu%HFH.A*Zx]QTHa/CQ`63+szЯcuqѴR+Mtkk9`mH |"nO?KKfW`ќ>O V:5x=qJB? ( T9<-=8>chBޯ']`I99ͻRN>J"N'Y=HyIBKWxot#h֔$t-&^Y[Oo2la5 xV Y^p`ܕ \\Ddi@Qn/ǒRz}tna1r{SWkgVtoCθ08Yw/:rɈQo! yipWU:紕` RuR da19d`2H֛ gUw5qwC3kЇfwH4~߹+c`q2bz\RXWHV;:j+W_"$Vg\GT6}SC4G,vWr~u5CXޒd 3Π#'ɚ# ^~=aV `} wGLi^)I}0飁 dѥХ? ZFɘ}{E}woՈ;[i[6TOqj NjRKq^ߔ*[5z@䆚&K(YCvۨ_uO.?H#./X>UVIX=nW$BJ|Pg!cr/YڞJl]lX`ig's]<3tdWLoڟW;5Dk Uz=3|>\g:U9AI Fzv|->5q%((Qj1\FsuTcI {Ϗ'nH(_LH8đ"wmHE2Q0f\ ~ KOcB+^eЗb[pC JÐ2|L;ld}q\[p '0c\퟿ D9xjobs+19JDvVZ[*-+ S"ipv Sjk)z%tz\G;281Pքj V jIY5P6(KaLKBj#I<˰c 晥iRkCt͒ln9odBIh~n %+7N:o,ypsX>z?r37 !;II`U+~pESC# PKOꆫ Q%vD#vx^vA=EB/YpFýy[cz< E k{31Jx0Ez@FeoV ! =k(l/(@(]3#T zIR֥$ zI#r%E#o`A(I ~+iI051uJ+Ifb = :Q9^}?I[OkQpXOayf[ :;f a׵]}Tf^ P|RzvԱ"=(E@ 18,OY@_<<^Lˣ"+.u 3i H2_E ?258o 53/K1>#o_bFty,ғusT%Lw}GR&QhRxaXyEV䜁|^"uܮHu8s:Y_z ;`sE}{2{~JTIz t]q^ T_|'Õ8 }I랙P|Ozwq30ؓK2B&V9\\Y)KZQh "͂G<iN?;bmE4F*e>1:n&fMW+& PX7 f25G̵2 87ϛ@<%u],^62^ *jő~Lk$eěl=)ײamK ۀCV}U¶!Xz6g8,UT̲Db{ Q+<8\/ m; rFYK:>JחqQug:7!uK;RXdUo45ĉ M$Y`"]΍!ˆW{$L͗f3VʋAOX1YT &z>ןZ8)_(dཞy٦g¯hb' >'9csИ G {ɐj 'DO',T魕"%FHņGGG.3~Z_^*pL6p=|Qm"RAjF _N C3^.2>ʊx\X >vT˷if_λW6&eW'pɴA @XVW:|ȷbԬn(+I:?tb R3 Y=0ikpV4<Ӕhp*+¸c\pGzK7H!]uIRjK&ɿLef(J,m9lԦR_Rw۵,2pBiUe^K;dɛo;R{%+ }l-R)wBUfgLw-i`8GwJȀ}b`ђRY?Բ&^ƕ?6% u,Ķ{6Ggîi͎< m~R{ !L-tjuX!Щ*[Q{.L#N#B۴>^gBI^S 4ǒ" U&rrz~43ʶ&^&#V/GOݕCah`֪t|,R*, Fu׎F< $dfNVMܸc tNw1[ y6Ihm$a I*L\"_d+kкyG| _&ɚH|# BȽEҭ]0'b l-RqhQ"ԎuW?_N>2?9?*],f/RPw_q.3b=GI\}B,O-}Eޝm(i5ve] +Q@-2u:0cnu^{;41laD{+ѝfO)k9HSQq,N']K&<͈9EtB!SHBP{_0" \tp|Y#d>\0I EiUmODxS!jߩ+Z~_݇X "ĺ -,!躂Vy6$5yFqD @E3VykI .Oe(g#@.䰭*l0*\$eg`종T ˸l,Ԧ"Xz7|Ox&lv F2+8Uf(D)~{A43&c&=6/` G/dkX &΃oLid2(mmAWzk yBcfe0VM C>)S<E@D%@+墲gב$#wrD=ɍާ.ۏ $ 7nh(!9YV5_V􇺍ȶ"RHيݏw(3Qp~JL3dtSN|&]Ϩ"ľk&+yDDHJ0ABMXnG_CF(;_dh}Zll"2 puff8?:;4[bYmD Q7v1@Vu!ISA&.#VX輵,=B!Uˌ4hEN:edPf/:&ےZHjq51BwX7iFʀHuqN(!9ccB?9v&ZJG!yZB2椡R)#U+hPl5xdJV\tilTeQwQb!$OEnϲ)%-n!P;/%xmYO}GAí 7|,yW;|cJiƏEV8ol6Ǹxl.v/*)ݴv蝡[˄b,I,1Y0b;H:&Nʕgۥli:pzxޒ&!j{ ,7eWw*JVehcjUM}FVUe8@#VHIfjfS|&|W4R 0D+6UT*xD|F556i?k:S;>bjQمݖ_A;8y~QXId+}!|”]/+ad\o!:3>.tnvvҘU`)zߴxx>x Xtv}T[NW[?j ٫NxػDQ&cL7)/Bu8=}%W;\C&diY6khvgh:*0I˨E_j}HTu'#P~HY'ʮ@' ۱v#!a]ʡ$Ѣ@]qSiR& >ܓr2eH|$-:#2G(6LRVlv cP?43 2KlǓ+!̭G |c_6FdPն h'Ԍߔ35@7c>ր$<+FC'JRIM7evYFbAB.I{ ~A9eX\_,۪Ew$ol+`Υ(  "I*L":VYD_9]U`fR:u5#ev4Z!ӡ1JA9o; F11uJ'8P8mq n(ׄOz N~E[9{m` btXm< 'x{>#IMwG2|BҗϕPqтDTTc*>H;&]R`%IUlBXJzMf#,I+8CPc֘z`nĔ-S+ uc^^!91t'v`-Grt6.`AmKI0sZ 9v@[.kwm36Qn)7.hѴBeW_V*sLzw*-@(WfdZ.V:1 W^E/j/zpektPN0:L#F 5+8m}WDܻ>ċFA"6ba<#6kp9 hHO?ijѴg%S,eHĴ?GPX A SrYYY0FR)o#uqm%N.чLqTZ-}x\ e9Z}^ߨ.a82(L-ɇ+TAYX5YFaMJ Z<3NP`t _Zmx=vsۙMt[L=S0KX>ץvv%%,^NYV@L#ZD ";ܫ\E^SQ~bC3k!b)¤W-='Dݑ],?s O#~[:qn+ePʀ^3r7ST A>YU0IsH͕!r3' [=W6lҗm4h* h5HI0n4 qʄ*BO,D߄3T|gx!wԨZH$#Z+kJ$mVNLM4Ϊf\L%rSFGEQn\RxSR+>ѧ F!ŗM5YT@,!KβEG6\؅H1Hkz,QFٚRԟ[ NOTa2p{`w>1vٻѝh#/sn%?$~ 7l:cc@Q`nE"@?IxM9.t ʱvt\?p@LSD.+:ʔ*Peh0;yl=5QZhbJ(LX EJ!QqiT(i\ ?׆ Đ.Nɩ ޥnkDNacx]t0]:-, %6Cv]ՉJ ބ(؎X֟3aV\*ȹC@pEӄ Ml cXN YZ