container-selinux-2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a19 > 6 6_6 3!pQp)Tξ7]mtZ`a ]mtZ`*^?zl,(K3h^\]}B$9ZbȢi8rHw|ud;HN/V`jjIlQVԒf:CB+*ün-ܶ[UIY"w8ET|u8ҝ'ml8PG;(V|[ҕ}-$R<{P:ᴹG0),$vЀM HPf@EK{$]eoxw*udvO7~*j}!EuY90ODi4V07-Mq~Q먼)i}V"!^>(R/a⌇:ty ifh9Zvz~=lB,uKPg6w v)&|X\*{:Z's!"xՀdلM:(pfT%ׅ.8%?bד= iUYTg-21f4f24e492e4095a67d06cc939164b171efe86a02d358b52867891a80a28d60f088218d694244fd4129196ec95fc7200f9122753!pQp)Tξ7]mtZ`a ]mtZ`#vk؁׽! YEA Gjؼ F&m$\p1 ;w*ۙmuqЂ>v~*6qq!pO;;k.9~; TK9Z$I6;dk^lZi/,;)jnǓX=֯K2;Y3 k ^{D%Hn_I"n@ I{kۅB8OxgA-?Mn҈FfgsFr5a҇puB.>vul]%%T:{D`,cH^avy2tBS}O.y/ߘF~OQӪv<yL{+MdNDB'^ c絍ixG,Z!~;yrJ ~JHQmQYy҈=>A4\A`7z/UrQ]oO> MENmJ#Ʌ1d;Lb/^Y|4h }>pF5?5dH L t OU\ ( 8 X    ( H p    < x x( 8 E9 E:E=.>.@.B.G/H/ I/@X/HY/TZ/[/\0]00^0b1Td2e2f2l2t2u2v33G45555P5TCcontainer-selinux2.124.01.gitf958d0c.module+el8.5.0+681+c9a1951fSELinux policies for container runtimesSELinux policy modules for use with container runtimes.aord1-prod-x86build005.svc.aws.rockylinux.org|KojiRockyGPLv2infrastructure@rockylinux.orgUnspecifiedhttps://github.com/containers/container-selinuxlinuxnoarch . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then [ -f /var/lib/rpm-state/file_contexts.pre ] || cp -f /etc/selinux/${SELINUXTYPE}/contexts/files/file_contexts /var/lib/rpm-state/file_contexts.pre fi# Install all modules in a single transaction if [ $1 -eq 1 ]; then /usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi export MODULES=""; for x in container; do MODULES+=/usr/share/selinux/packages/$x.pp.bz2; MODULES+=" "; done; /usr/sbin/semodule -n -s targeted -r container 2> /dev/null /usr/sbin/semodule -n -s targeted -d docker 2> /dev/null /usr/sbin/semodule -n -s targeted -d gear 2> /dev/null . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ "${SELINUXTYPE}" = "${_policytype}" ]; then /usr/sbin/semodule -n -s ${_policytype} -X 200 -i $MODULES /usr/sbin/selinuxenabled && /usr/sbin/load_policy || : fi . /etc/selinux/config sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types matchpathcon -qV /var/lib/containers || restorecon -R /var/lib/containers &> /dev/null || :if [ $1 -eq 0 ]; then . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ $1 -eq 0 ]; then if [ "${SELINUXTYPE}" = "${_policytype}" ]; then /usr/sbin/semodule -n -X 200 -s ${_policytype} -r container docker &> /dev/null || : /usr/sbin/selinuxenabled && /usr/sbin/load_policy || : fi fi fi)L[A큤AAA큤A큤a]#aaa]#aa0389dab4c8de315b75e65f20f4e606a015aac29056e561d6f7cb6aa588f431a9d40cc7015bcd8e803bcadea70e0bc08be172983ecd62b40e2225c5d2ed2e62656cc057cdb1c72ad404b239c30916bb636d9448e247129495443479b06b588b7drootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootcontainer-selinux-2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f.src.rpmcontainer-selinuxdocker-engine-selinuxdocker-selinux         /bin/sh/bin/sh/bin/sh/bin/shlibselinux-utilspolicycoreutilspolicycoreutils-python-utilsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)sedselinux-policyselinux-policy-baseselinux-policy-targeted2.5-113.0.4-14.6.0-14.0-15.2-13.14.3-9.el83.14.3-9.el83.14.3-9.el84.14.3^|@]߶\@\M[[ͻ[[@[[Xf@[L[K7@["X[@[@[[[Z@Z?ZZZ%Z%Z@Z - 2:2.124.0-1.gitf958d0cJindrich Novy - 2:2.94-2.git1e99f1dLokesh Mandvekar - 2:2.94-1.git1e99f1dLokesh Mandvekar - 2:2.89-1.git2521d0dLokesh Mandvekar - 2:2.75-1.git99e2cfdLokesh Mandvekar - 2:2.74-1Frantisek Kluknavsky - 2:2.73-3Frantisek Kluknavsky - 2:2.73-2Dan Walsh - 2.69-3Dan Walsh - 2.69-2Dan Walsh - 2.68-1Dan Walsh - 2.67-1Dan Walsh - 2.66-1Dan Walsh - 2.64-1Dan Walsh - 2.62-1Dan Walsh - 2.61-1Dan Walsh - 2.60-1Dan Walsh - 2.58-2Dan Walsh - 2.58-1Dan Walsh - 2.57-1Dan Walsh - 2.56-1Dan Walsh - 2.55-1Dan Walsh - 2.52-1Dan Walsh - 2.51-1Dan Walsh - 2.50-1Dan Walsh - 2.49-1Dan Walsh - 2.48-1Dan Walsh - 2.41-1Dan Walsh - 2.40-1Dan Walsh - 2.39-1Dan Walsh - 2.38-1Dan Walsh - 2.37-1Dan Walsh - 2.36-1Dan Walsh - 2.35-1Dan Walsh - 2.34-1Dan Walsh - 2.33-1Dan Walsh - 2.32-1Dan Walsh - 2.31-1Dan Walsh - 2.29-1Dan Walsh - 2.28-1Dan Walsh - 2.27-1Dan Walsh - 2.24-1Dan Walsh - 2.23-1Dan Walsh - 2.22-1Troy Dawson - 2.21-3Fedora Release Engineering - 2:2.21-2Dan Walsh - 2.21-1Dan Walsh - 2.20-2Dan Walsh - 2.20-1Lokesh Mandvekar - 2:2.19-2.1Dan Walsh - 2:2.19-1Lokesh Mandvekar - 2:2.15-1.1Dan Walsh - 2:2.10-2.1Dan Walsh - 2:2.10-1Lokesh Mandvekar - 2:2.9-4Lokesh Mandvekar - 2:2.9-3Lokesh Mandvekar - 2:2.9-2Lokesh Mandvekar - 2:2.8-2Lokesh Mandvekar - 2:2.7-1Lokesh Mandvekar - 2:2.4-2Dan Walsh - 2:2.4-1Dan Walsh - 2:2.3-1Lokesh Mandvekar - 2:2.2-4Jonathan Lebon - 2:2.2-3Lokesh Mandvekar - 2:2.2-2Lokesh Mandvekar - 2:2.2-1Lokesh Mandvekar - 2:2.0-2Lokesh Mandvekar - 2:2.0-1Lokesh Mandvekar - 2:1.12.4-29- update to 2.124.0 - Resolves: #1816541- rebuild because of CVE-2019-9512 and CVE-2019-9514 - Resolves: #1766316, #1766215- Resolves: #1690286 - bump to v2.94 - Resolves: #1693806, #1689255- bump to v2.89- bump to v2.75 - built commit 99e2cfd- Resolves: #1641655 - bump to v2.74 - built commit a62c2db- tweak macro for fedora - applies to rhel8 as well- moved changelog entries: - Define spc_t as a container_domain, so that container_runtime will transition to spc_t even when setup with nosuid. - Allow container_runtimes to setattr on callers fifo_files - Fix restorecon to not error on missing directory- Make sure we pull in the latest selinux-policy- Add map support to container-selinux for RHEL 7.5 - Dontudit attempts to write to kernel_sysctl_t- Add label for /var/lib/origin - Add customizable_file_t to customizable_types- Add policy for container_logreader_t- Allow dnsmasq to dbus chat with spc_t- Allow containers to create all socket classes- Label overlay directories under /var/lib/containers/ correctly- Allow spc_t to load kernel modules from inside of container- Allow containers to list cgroup directories - Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.- Run restorecon /usr/bin/podman in postinstall- Add labels to allow podman to be run from a systemd unit file- Set the version of SELinux policy required to the latest to fix build issues.- Allow container_runtime_t to transition to spc_t over unlabeled filesAllow iptables to read container state Dontaudit attempts from containers to write to /proc/self Allow spc_t to change attributes on container_runtime_t fifo files- Add better support for writing custom selinux policy for customer container domains.- Allow shell_exec_t as a container_runtime_t entrypoint- Allow bin_t as a container_runtime_t entrypoint- Add support for MLS running container runtimes - Add missing allow rules for running systemd in a container- Update policy to match master branch - Remove typebounds and replace with nnp_transition and nosuid_transition calls- Add support to nnp_transition for container domains - Eliminates need for typebounds.- Allow container_runtime_t to use user ttys - Fixes bounds check for container_t- Allow container runtimes to use interited terminals. This helps satisfy the bounds check of container_t versus container_runtime_t.- Allow container runtimes to mmap container_file_t devices - Add labeling for rhel push plugin- Allow containers to use inherited ttys - Allow ostree to handle labels under /var/lib/containers/ostree- Allow containers to relabelto/from all file types to container_file_t- Allow container to map chr_files labeled container_file_t- Dontaudit container processes getattr on kernel file systems- Allow containers to read /etc/resolv.conf and /etc/hosts if volume - mounted into container.- Make sure users creating content in /var/lib with right labels- Allow the container runtime to dbus chat with dnsmasq - add dontaudit rules for container trying to write to /proc- Add support for lxcd - Add support for labeling of tmpfs storage created within a container.- Allow a container to umount a container_file_t filesystem- Allow container runtimes to work with the netfilter sockets - Allow container_file_t to be an entrypoint for VM's - Allow spc_t domains to transition to svirt_t- Make sure container_runtime_t has all access of container_t- Allow container runtimes to create sockets in tmp dirs- Add additonal support for crio labeling.- Fixup spec file conditionals- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild- Allow containers to execmod on container_share_t files.- Relabel runc and crio executables- Allow container processes to getsession- update release tag to isolate from 7.3- Fix mcs transition problem on stdin/stdout/stderr - Add labels for CRI-O - Allow containers to use tunnel sockets- Resolves: #1451289 - rebase to v2.15 - built @origin/RHEL-1.12 commit 583ca40- Make sure we have a late enough version of policycoreutils- Update to the latest container-selinux patch from upstream - Label files under /usr/libexec/lxc as container_runtime_exec_t - Give container_t access to XFRM sockets - Allow spc_t to dbus chat with init system - Allow containers to read cgroup configuration mounted into a container- Resolves: #1425574 - built commit 79a6d70- Resolves: #1420591 - built @origin/RHEL-1.12 commit 8f876c4- built @origin/RHEL-1.12 commit 33cb78b-- built origin/RHEL-1.12 commit 21dd37b- correct version-release in changelog entries- Add typebounds statement for container_t from container_runtime_t - We should only label runc not runc*- Fix labeling on /usr/bin/runc.* - Add sandbox_net_domain access to container.te - Remove containers ability to look at /etc content- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7- properly disable docker module in %post- depend on selinux-policy-targeted - relabel docker-latest* files as well- bump to v2.2 - additional labeling for ocid- install policy at level 200 - From: Dan Walsh - Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a standalone package) - include projectatomic/RHEL-1.12 branch commit for building on centos/rhel- new package (separated from docker)/bin/sh/bin/sh/bin/shcontainer-selinuxdocker-selinux2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f 2:1.12.5-142:1.12.4-28container-selinuxREADME.mddevelincludeservicescontainer.ifpackagescontainer.pp.bz2/usr/share/doc//usr/share/doc/container-selinux//usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/include//usr/share/selinux/devel/include/services//usr/share/selinux/packages/-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protectioncpioxz2noarch-redhat-linux-gnudirectoryUTF-8 Unicode textSE Linux policy interface source . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then if [ -f /var/lib/rpm-state/file_contexts.pre ]; then /usr/sbin/fixfiles -C /var/lib/rpm-state/file_contexts.pre restore &> /dev/null rm -f /var/lib/rpm-state/file_contexts.pre fi fi #define license tag if not already defined/bin/shutf-87da608ef802d04a5b4a9c7e3a6749f21d0863bbe304096beef9745eb119e1fdccontainer-tools:1.0:8050020211109140251:faa19cc5?7zXZ !#,൯d] b2u jӫ`(y-$rX6ZRd ڰa0eUS(wzR2) Z%ml#)cF%j )µ>}oH!E$G:h&M(; =tm"`kFlW\w}޵c,U'nt4k4wGkgD8 { ESӽGlep&G4kD+\I3ځ2ƇC!5-5)}z9jLr(ra #tA[6$(*5O5~};׋SEb62w9y!7h/p%15X4/tjiy$GER0;anLjT`ҏ=Wo4\L[QׯOD" U-cx!+ßχbE.eK=0Js8=ZHtBϥ.d!zlVHZTƪvCȯ.П_11,Ã]|sd̼ha=V\aqgRg;G.ž(3f$0Vș>(ס{Mmo:zo(%Ŏ=6-}a/ tD2n:`,Z_7d%g7alF1ށrzl= k 6TOgrOZ q%f jB/+h{X>5wC[^q Պ뙲&u.zT::[&8 ?BP@PbXهH6bߺPUT&$}4wM.:(}ʛ.b6etjٯ-ٜR~c6 Ȃ"tTS4 5 AZ9ӡ%HȹaXW79Ic?81#l' vuI1HReS&yargfPU=SVi$[r ɂ&%Eo8da@!{I'V֕dj3Fʝ ,}|:LiZ5ҥ:nֹqyh:-ʹ3DmEVw9׶a`iǛ-}(:D˅;;"ratF~P)iplr^`%F1?AU9M5V.;8N)Q#zfx&--a"coaaϹ[K>ﬣ6z 3QwyCRZzaxYHmĮϐ`+pw lS/"f3Ú F?rFuyoŏ$j*:It,ִ]9Ko+r[ 2;JKg9~o}f=s=' c}t^32 [}MT;ayf8CO %I/iasq|] t!}E2ꂌ@S'V^c$awm3?j2n ۾z(qd,aSUZG!f₏ 4LlubȤ-`-0}DXoAcj| !9HP81]ܧmD-sH[,T;MQtqc3REӭ>E> |< ;9մex0i}ᭋP Ydx)@;ݾ?qF44C:Ztvո6H! a䔥:~:gz{~Z'Oe{Ԍd>]mT!&#BmQ <~txZ~{3KD{[a2@?f-(c맣>-S`QϼW,6#hLnn"@psӡc'E,u7SqDbxh.u pGڈ쌋X\gG˨282~0ЉT{q11T &I5ʁ"βt#5{^Ae*9cTJkJboN2 m/x-8酭ׇIIuXhO6 ;]'\ ˆ!%FPS`9RYuMEJgF 0#T:\'۱؉~_ oFZ8o6p;|,̱D9#H-~\nt|Tr³x9u;*ծ$ߟRT>^]Y&m:K8FM<*r +lwH;pwp[sj]hwuwGwPG< x"nUO{ ݰ`ɇpC&$*1EΦٞ()\qԓ(=VJ( ðztX?f!íq<`\ܮ nv p_$3/\B &VݫaxMCyDG㚼W\V[d&F/i%I~0Kx4F3bmj0 #B&sEz2 ($\@lcEIJ髿rUT*å:m̄ r27M$|qb3äDsNβn2BR X"bUjĸU5T_)u(1nc@^䟐 OKCÍS,8\ϼ|V 2;!2W4Csh<" }@E M3-GV*N|Z  NKbch7=0&8"H$$g  ,fsxOY540qXxO8}Ho?Xg+@aab[tsxX`4}Yp)rTLX1(XϏ6wBïY^aT%A <,Brvb1!΃sRΔ,8+r5}gg= TEvO'J eA.-j%ItFNӦaG+zBl܆ڛnÍb$:1Y׷Yo|@uGx'LWzT-a| )n zRq0%$R-eM *97>02Z; ']yk#r :b;Ꞌ~6Rc{:&W̦ih 0d6`IJ^?{驲Hg'r_ZƺX|w24y:x@ P?3#o+`Uu`|Py8""=(ejl<6cCC1288+6.'fHw:sI~lø߉Np<=Xp6DDu<(A *[ho'SC{#qH<.d6Lugۓ>䮅 L~^U ye̮ͮ) 10y!;9 ]*7Z : [|1 ~  {]]ІW("JI\Fi\ڣ]~j0آ,x,AgNjR\ctƒXzj=x|&6e򊯒n )1h8fшhk%P&q?y }KX\z9(77WD4` LSAƿ-"-]g4xHYKUxnWj=Yh Bs_ W|)Wzr+wy8n3"sDuQ-/|qz(%r4Qm|S{G%:=7hzp \2eFWh'A8d"(S.bۥúG+7L޺YAz``!#Ri0b+r!5<‘qq3VOi1m, xLى|VrcvvCtk^墏Odե6+͇&a- wۛ/O[C;vګHV~򲷰ab ႙*Qo $B>C^F|pf0:kkǟXb\H;-7mi4#&oc/F};UkazNw:b{Eaτ =WwD' /k4 pC1io:?rt=/ 7+d"P&3KZ\ 츆"G==i7hkQ_;d)=[bXz23e TC >5Aq*yeJpyNV4 ̶$J7'ahE Cqe 8҇Mhe4O+ ')iȿ: ^;-O'+Bӷ79#@jKGT4ƏEBK0Y7 e@QQn,jzjIVf<߄=w ]Y${_53{D!FH6>ue@uI۱Ic!eV̞ M1Tqhwfc\TaMn>D8b>:{k<$H4S NquvB| r ڷ[!;ޕ3U‡{5j2U|[6MT3H7oR݅2+rfߖ ko#9ȜDI;Jದo%9{A}WuM:3MC?d5#[yIL"x ^ dCs-|R_wJRed<1FnjQ>ЫQ̆i<7+Kܨu?P6AgAlkx p^U 6-HTizwx_n' ,(a3oB&oIȱR#%V>C"\>33LߌwxUo4K fo7J6KyrW]Qݼ?tDnT*\xH>ٓm5c҃Ŷ 2L6jXr5g8[%d U 0}}Q ƅr !w[0'No?-_FfM9(hC_q𯩶zT3͔\Tvuyb?Ǽ#tY}w C%~?p,#Yr~xmH_?[@;ٰ1/@j U.?a L*Ym%0OP;O_` "}<'(E]GĚ(ƽP3h'>p~P{%ʥ^]n0‚~u#r,= rA ޓKqJd_VП>ut(p)nHPG0lk{m>OBS=ԼLnvH%AoPv"4mFD[[Xwƕ3H'rN.Ae_-.z,Q`GEJ[I3]$niα!|8C@ \}cy MaE)|0KL'AƦ:oߐrhhd:1&t>Chw'$m 8 "85VJflܬ `}ҹ+F*g@o#hΜh`P0`ÙRƛd<zevi)LhیDL٢j:0%\WY!zvz<%\9Uagߺh;j SѦ?| p?:,Kn^V_V߆24+U(63р[Rj#j=灣ro.'ֲz?*V{ď -+jmsP_bKrQMQfAeK=ݟ6 E#g841.qr\fs^`*kŘ oIƯk}K]omeҳcRz4|J:=bHOU"1maSJUjy^S[ȄEvIׂk2G06m-&w;@nd&`4 ܴ/@K0;jd,*"<87%z\nhՒUo r=.>wn(J\׬t_ LP̸Fm $o d!z}ǭX ܩ<Y51Mj5VJI_ H֙;D%2qCI%ufǂOPx 8Ed_Yhyo3 V,YH;S9*Rg{vȀ j@<-jz(xNH= ǝ;4Jgh6?vE[ؾ_:ج3B婽| Zm SI{!Ԍ [fVc|; =b._SuEdч!xV|v6эjՕ|;ȈsA'"FvH{E$2IC~Yg?tADjPP(=>nOr|..ٲZ%nrd"7leZ uK?vmA048bł:.x֦426UV|)8rI+Vo7/r-U&/W~UYem,lezD{n)u-# m͛ [,F%Yn[-G#$ 0/AO{@>o!q+P>a~硵N U;I*_BܥzzEJD}I;&zXWW*[-|땸R3AЯddN|tnW/Ϊ ЩJ!HqѻWWGi;(/DWLٶC텵*jj^=h@蘠D | \g}1 YDU[ZzLӤRx8(5C2y{:[3}V:+&zoR 07@k#TS.-2[s >UimTd&c*fULc* S{sY)zi E5TևW:[TX ( Il(7>nȢ~;Ug' ލ[L\E]R4^ ̊7{6ˉ` ()0Br"~~aFFq&A=AJ۲gȻa" -◵nKxWK>4 crC];VlB8LF}ņ&z5^@4!Lw/tZN%`h d%`2脁[W_kUea'소VxdOM՞Z2c =ӊQT|CWz"jJ@d͛AiZL {d%Ij(~ucl,񣰨xP Ec$tfB/C*}#c,@] =YA\>h +]n<`1<']H#A'[0oY '_\n D%kѳ)tZ..Rr'ڮ36l; PE i>&굅 yFᦢCͫ9XidF=EԜ9 yL1zH/I03I ΀<Ժ -;>*O\n]2?ybahUI φwe%dXYva۪ZisO T^A S I!tV+ 0 ƒ{]wU3ĢV:]IwB ÖCdל7~ӹYrngE:6x38l= 梂ny$9+B0VgwR^1LsXhl@NL0 ]"imL~%3@2 U̾,lB(J_+L#u@>&as^]&NҔ)rz&W0݅ˌf)M^GνPg[hVs)\U@c`P ^ =>LV%W]ivVO##ǐX-&XG y1mӯei =כE%gVdG̑>i١6//{Q 0ˀ9YhBD 3њao(""9 渎S[$/_?k?Izd%ZA>HTA_dP0а{c)X2ۻh\\Xek *UCtzk;rÐ,èzICkZf`KI&t sF $3$qcʛ _poY5MJDa`k0| 1h0$"TŶA5-0xMW#M(}A]諎G~fds~iT=څr{7|ba{k_u33sN< CHL w(x}Z.^ x^DCZ-@[:cd4"mAF#TC1E3YՄivwD cU}?7"y?t=ƒ'@1]9~jWsU鏀Jl'5.OanӰ!) ܤO7"=j]Z<2b4P絼rۓ@-_2VK1Kv!7EG9*\t Jp FK-nAc<&mOȭ/Xk]•MG~/wf{_2TMꪮRo> JAX޿lH:.($ׁk&*:BKNZ.}c>?(tI7q9E"HVs\ZT'6& m-u0 ?6>"] =6fjEFPRr>QڠQ-2cMJ }p&_L-<*Vpx/͏ih,^\=E{Pfv7qz0 M^ \Hn˟"kK)/tZl6s%j.uiOvݷISh5"e6bfQҙ} foQ*y}%إ%jFI䀦-%5FϾ݅! a4>KKC6f 0t tzbII6zHy9ꕇzsq'ĊaxPkRl Rf^~x9/8x_]{-!Vb)qOD}Z+߬\u0KT׍E)4rQ*ELjӢA ȉ BGrn#_TC;>b8bQ ΜZjXhHH3f i 쁩ɦ>y):4o8kv׾ѵ]07m`T_7F3<-YaϏѢdKli}EEu- -1UH9_&C7ÌJ>6CYb$rolt8;iҊK<~˽9*NX>7GڔIUi@Jtv!㌋5 o9Gi)k6.)YXdMDN: ~y/}*F?QpՋeS, ~pJwYJ(PnI1}Ä ef$14Qg]+\?ZV00d4F۬.TfЬ;1Vʶ%̰ E5A" ]abE6͛ƹ̐{|% yG~ 0s|cxH udx&5>U%־%F{:ƥFhZreF~h9$ PR*^ڸL.u,G"-ۋ^WI){#ShӸay[Onr 7D6RCAP dSZ4*[Է5J3t<*99+[~2?@ς`saF F-#nVRMQ薣7"DOyh5@|gYgU`!rOU0ɣ_V ֪x-IS(S6Zws)-nC-Ld$C_w>\Q@aRra0^^@V,t4Q,;#0 q# >ԔvNZ\nbQ٨h*hۖND S{4~Q?%j&,ө'/W:/#\b$t"2:emkFp'DƂ83K27B(U޶nH"1?\ABWN;z}KmK04X%zX]LHɂGlZ +9 F<]kCvM|81‡=%Ϥ;VVy˪e|PAv^$|Rw 6+Le pӉ~$0i ,^U7;d`^5Piedh ÖOp6rpY^d/} g,_,7x(4I5`I Q,i @YJXl7dy Hiz52?~k\P(FMw q2DtVz s[UG/[̿KoۡLRs~GdCa*.ze2Dq:rΎH7H{FNVFWUM3\T^Z@Bז+(K~0S-S y +j-sC` ʔYZmivݖ.nix2ъt3W(tc_xoݕl(BMqv裁wTmзXP朰_,vGHـWY}H`r-R1 DRa=chN҉u/WQBɵmz8nHT(r$4xU㒰ʜ 13dl>qZ{${}ɰ KryPTMT_، :?e\$'%M<`#wiZQWfcXcFPj9яvp>"n)̲Zþjdx;"d̺aN^*67J9CR}.}YkuzIf#DjO\:DϘ>"튱/${P:&R:BR툧yD| GLSRD=_RHDV~Zbdkt0 ]\rXR^5&o鑆` lچMNBi;ʹa:Ji|B37Fblᒘ;#aw8T $927PH׏]Ε)PWtSM/QG L8F|wt#KȾwrMfjDpD$r3Ds,LW!g9 ӎW 7FTr[rA@G4-}u¹֎?#ˎguJE=ϊqXLH], ~uOwPjLdx^ dAfu1C_=6y!+tWB矢 o2DsweM225']6ek*e (J` x-psбݰ>AD7["(杭 -#vOA X: d[֡.ͷҏM*SJ' w>vV{@ן_iO9()Y:!o E,cf(lw_"U(ȧUڄHV?6p[:mPظgQ'd4ibgJbsIH5n=k@]){NJyG\\K`WYx뽺0bI/ \x섏Q%jt_ PWGqyd+W7#񬼑BW?N8[J&%%VXNHylh ̞"{&ނ969`(sK"xdO K$EE1̑^KPIOjv6VEd{[it}>|TA,`2O5,}&hdv?o ܳw=/uhA64y:!@v= >ސ$p aUDJ~ 8jTD{Le]z-K9e.4vfRbD|k[W{Q=gȋrU"F cX|aM6tyЭV0\ȓVku !. 65Ŭv3Jb163ځ'B ;e܆^ e/\JW `6 T>3>Bnk,[j`mq//\a-qmQFyEaJ Τ(_ x \\NtV5ι/+CF)0oO^31Z/%S?0ܝOVe -tG%Bg4սAܩ}.tX<)܏r\}f41~?D, E,-a$k ZZ.@ﮃO҉Nُ!Mdžl!<_sv/zOq+ϻ;qA%#Zs07ԹP칀d;^9 :cEqK[n$SgG Bc; eޖU m'{O9#[ c2dkXVfi͖K}X3쒨4épTeƷ*<!yoAs]=e]uiף!xM'{10ZH Pdf7?[6_ V24gjĉK2=o*s-L+!%aeՐJ!doJ)ş{Wp,t;U/30[@ ܡX=_ffJɸcdU4HꁏwprzvZUXԒ [J5CPhD)yeMIEP +U-|с8'_{y]n"MbC$"VޕW&>e0,WȬxlTG)qit/5U,^ّZ/Et:~%INԮFDт^W:Krn0RdpG!)c4\:lJD)X_o= -0􊞨2%x0lK-qN3U\'@NJ j O|ߩ6u+WYt nVG((x!D} z F(ߟU{3?;S% Eh[.-|m Fd}nicDҳ,f}hݪSR1cFC0ZEƣR%,e{#I r%/hb]LB?nB*o*I qo4([ް/5'z(:*'-sZ+#RI-3q SjJ:O̯m;WnjClF\q #Z_C}7{1ٯ`a*?]Vu4)]h˰;=ILYG 2ThOHx1T(?սp ;8ꊩW2%\VanW໠#~ealJ) +Wp{zz_d&& s=Ğ9u܅k/TYaJiHp!0Ш \w IȌBəOuqcc/8ln5?-& Fb*/D56ޭ&:xߎr~?P} ")IŶQjR#NX j,GV#Y}߉?zԛ'%s؈$pR 5O<̨55`Ir5(=:ut )Ќey v>ӝxE\! ଷck臺 {>Y~߾0_Z N%Dx=.Mil3%d BM^xxGo13]@`פ2'˪>OYL` moҟeLwrhq;mx x0n_ٝDlH!^ ު|M{+2ʦ[AKy&=I'؝&x lmrWbc~OCiؖkSA=6NR2-+EUHuo}&+!j8+.93fV+H*PO((R;?p c­X'{zvuL|b& o_G_CXVk]{x3g[?@8= @3"~L[{]ʥdԮ&n"5 n(گ~D{?%J9V6v}ec Hb] θE賂<Ɩ=s6KJa*D^%)\( ysVO]1-8eZd gyb`!!`m߳5S 4O@^i3*s"8e-5+Zp߽l}r$i7X;̋.cQT,3`wJSJ<2 8 LcKee۪\9VwoZtHFv>$l(̒tU .]-J3[z9zE?Ml4џkjSꩺ8q&V?Oh3j $9V4P#_-ϴ+Xštu` 5^n֔ t4CSYIٝHwY1ގǂ(I*Hc]]>6<̲N9L^z{Q|~GO%I wT͗'W?I14Qxm,mG;"7h$|α6ĈU 㬑mB]~9x'!fQl0"TG dg1#6w3)|ڎ{QҠW#>rN5*_qCxnݹ"(G =/cO@űrⷨ PqX='a} k[Q6 O]Ɔԋ>0C{ţv7XWօ+ukz<{C)/t8+L,Q! ]dajǑ@B7+M`&:zuߊ8?FsױȎmqh+NŗG@лV ,6ۉ3l4LHΎ_O+J.^YsCלv6uJ۫j@}3 SO3jNؖV‹"oM.[`$9 q̰ R5ZE!^k(CԪ_t>qYɲiLNHz5jMIez]Y 2<`Otn l1fE"ǀE#ߨbnQ5eb64o 92(N'G f4bO`{P控(JY=wihvn1R7痦 BSͷwc6P=_ΧU It[Za*{?A^MiNa>/ ~Kl |s'Džʤ@,@Jrs ]ЯT/n>VbhuT<7~>0̰a(<}PD=kdcĸxf(2ܺ8d+Q oaUO Yý%8=% @Q6oӕ]n7Z24\fơ٫I<YIt;"AVWFӠV+Mg[qs9I7<&bQ _k #kL`}Aco7r3@ؕ eț FCӃ";̘ 唁i3[yV':}vx4Y"bI-sw?SA+qζ YZ