container-selinux-2:2.189.0-1.module+el8.7.0+1152+ac778627 > 6 6_6 3!pQp)Tξ7]mtZ`cH ]mtZ`g$XU=#@ns]kAz2硘V~eʴ!M$ TI)EVAſs'ZX2TO%hUbW;o0:_].\L< b9pHLx DzVX谁~W.LNxbzZDdN2aQ>Vpؐ=GUHefg̣Nݬ"Siqˡmq} ܣ}'7Afwmu}R^s|DMB9i*,,5Y{?J57#*ӎʐmblb5[+HToZt|V`"dZ|>:BZ2q ֛][YJ-;&rݓ11X4{Մv?hݦKq.xq $*&-?1ỴQ:2Qm7Ձa8ۄdJtH5p;y7\6{@pFP?Pd< @ h CIP $  8  L  t   ~       X     ( E8 Lq9q:"q=I>I@IBIGJ HJ( IJP XJ\YJhZJ[J\K ]K, ^K bLdMeMfMlMtN uN4 vN\NPGPPPTPZPPCcontainer-selinux2.189.01.module+el8.7.0+1152+ac778627SELinux policies for container runtimesSELinux policy modules for use with container runtimes.c ord1-prod-x86build002.svc.aws.rockylinux.orgKojiRockyGPLv2infrastructure@rockylinux.orgUnspecifiedhttps://github.com/containers/container-selinuxlinuxnoarch . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then [ -f /var/lib/rpm-state/file_contexts.pre ] || cp -f /etc/selinux/${SELINUXTYPE}/contexts/files/file_contexts /var/lib/rpm-state/file_contexts.pre fi# Install all modules in a single transaction if [ $1 -eq 1 ]; then /usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi export MODULES=""; for x in container; do MODULES+=/usr/share/selinux/packages/$x.pp.bz2; MODULES+=" "; done; /usr/sbin/semodule -n -s targeted -r container 2> /dev/null /usr/sbin/semodule -n -s targeted -d docker 2> /dev/null /usr/sbin/semodule -n -s targeted -d gear 2> /dev/null . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ "${SELINUXTYPE}" = "${_policytype}" ]; then /usr/sbin/semodule -n -s ${_policytype} -X 200 -i $MODULES /usr/sbin/selinuxenabled && /usr/sbin/load_policy || : fi . /etc/selinux/config sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types > /dev/null 2>&1 matchpathcon -qV /var/lib/containers || restorecon -R /var/lib/containers &> /dev/null || :if [ $1 -eq 0 ]; then . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if [ $1 -eq 0 ]; then if [ "${SELINUXTYPE}" = "${_policytype}" ]; then /usr/sbin/semodule -n -X 200 -s ${_policytype} -r container docker &> /dev/null || : /usr/sbin/selinuxenabled && /usr/sbin/load_policy || : fi fi fi6Wg^A큤A큤AAA큤A큤c c c b%Wc c c b%Wc c 8c04ac861d425e9947eb5bc06c3125d682dc981f6327e789ebe1c4eba0d856fcb9a1b93e1a14f1d91ec6a108bf3cf9764d0fb80c329caa5bef1f4cfd37561d61a2cf4ee335a5e905f28a6dd9b6634b00e7fca95e58257a6b73bc3d4005f17fe224213e03f4de9f1e38202a150fbfc3ff4d02f433f45ef457b4217d469bad8a68rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootcontainer-selinux-2.189.0-1.module+el8.7.0+1152+ac778627.src.rpmcontainer-selinuxdocker-engine-selinuxdocker-selinux         /bin/sh/bin/sh/bin/sh/bin/shlibselinux-utilspolicycoreutilspolicycoreutils-python-utilsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)sedselinux-policyselinux-policy-baseselinux-policy-targeted2.5-113.0.4-14.6.0-14.0-15.2-13.14.3-9.el83.14.3-9.el83.14.3-9.el84.14.3bVbb@b_bMbMb<]@b%bOb@aar@a@a@aaa+@a,@`&m`_T_`@_%_%_F@__"_5+@_16_p@_5_X@^n@^Ӝ@^@^^k@]@]B]]@]|@]@]X]W]R@]@\M[[ͻ[[@[[Xf@[L[K7@["X[@[@[[[Z@Z?ZZZ%Z%Z@Z - 2:2.189.0-1Jindrich Novy - 2:2.188.0-1Jindrich Novy - 2:2.187.0-1Jindrich Novy - 2:2.183.0-1Jindrich Novy - 2:2.181.0-1Jindrich Novy - 2:2.178.0-1Jindrich Novy - 2:2.181.0-1Jindrich Novy - 2:2.180.0-1Jindrich Novy - 2:2.178.0-1Jindrich Novy - 2:2.177.0-1Jindrich Novy - 2:2.176.0-1Jindrich Novy - 2:2.174.0-1Jindrich Novy - 2:2.173.2-1Jindrich Novy - 2:2.173.1-1Jindrich Novy - 2:2.173.0-2Jindrich Novy - 2:2.173.0-1Jindrich Novy - 2:2.172.1-1Jindrich Novy - 2:2.167.0-1Jindrich Novy - 2:2.158.0-1Jindrich Novy - 2:2.156.0-1Jindrich Novy - 2:2.155.0-1Jindrich Novy - 2:2.154.0-1Jindrich Novy - 2:2.153.0-1Jindrich Novy - 2:2.152.0-1Jindrich Novy - 2:2.151.0-1Jindrich Novy - 2:2.150.0-1Jindrich Novy - 2:2.145.0-1Jindrich Novy - 2:2.144.0-1Jindrich Novy - 2:2.143.0-1Jindrich Novy - 2:2.142.0-1Jindrich Novy - 2:2.139.0-1Jindrich Novy - 2:2.138.0-1Jindrich Novy - 2:2.137.0-1Jindrich Novy - 2:2.135.0-1Jindrich Novy - 2:2.134.0-1Jindrich Novy - 2:2.132.0-1Jindrich Novy - 2:2.130.0-1Jindrich Novy - 2:2.124.0-1Jindrich Novy - 2:2.123.0-2Jindrich Novy - 2:2.123.0-1Jindrich Novy - 2:2.122.0-1Jindrich Novy - 2:2.119.0-3.gita233788Jindrich Novy - 2:2.119.0-2Jindrich Novy - 2:2.119.0-1Jindrich Novy - 2:2.116-1Jindrich Novy - 2:2.107-2Lokesh Mandvekar - 2:2.107-1Lokesh Mandvekar - 2:2.89-1.git2521d0dLokesh Mandvekar - 2:2.75-1.git99e2cfdLokesh Mandvekar - 2:2.74-1Frantisek Kluknavsky - 2:2.73-3Frantisek Kluknavsky - 2:2.73-2Dan Walsh - 2.69-3Dan Walsh - 2.69-2Dan Walsh - 2.68-1Dan Walsh - 2.67-1Dan Walsh - 2.66-1Dan Walsh - 2.64-1Dan Walsh - 2.62-1Dan Walsh - 2.61-1Dan Walsh - 2.60-1Dan Walsh - 2.58-2Dan Walsh - 2.58-1Dan Walsh - 2.57-1Dan Walsh - 2.56-1Dan Walsh - 2.55-1Dan Walsh - 2.52-1Dan Walsh - 2.51-1Dan Walsh - 2.50-1Dan Walsh - 2.49-1Dan Walsh - 2.48-1Dan Walsh - 2.41-1Dan Walsh - 2.40-1Dan Walsh - 2.39-1Dan Walsh - 2.38-1Dan Walsh - 2.37-1Dan Walsh - 2.36-1Dan Walsh - 2.35-1Dan Walsh - 2.34-1Dan Walsh - 2.33-1Dan Walsh - 2.32-1Dan Walsh - 2.31-1Dan Walsh - 2.29-1Dan Walsh - 2.28-1Dan Walsh - 2.27-1Dan Walsh - 2.24-1Dan Walsh - 2.23-1Dan Walsh - 2.22-1Troy Dawson - 2.21-3Fedora Release Engineering - 2:2.21-2Dan Walsh - 2.21-1Dan Walsh - 2.20-2Dan Walsh - 2.20-1Lokesh Mandvekar - 2:2.19-2.1Dan Walsh - 2:2.19-1Lokesh Mandvekar - 2:2.15-1.1Dan Walsh - 2:2.10-2.1Dan Walsh - 2:2.10-1Lokesh Mandvekar - 2:2.9-4Lokesh Mandvekar - 2:2.9-3Lokesh Mandvekar - 2:2.9-2Lokesh Mandvekar - 2:2.8-2Lokesh Mandvekar - 2:2.7-1Lokesh Mandvekar - 2:2.4-2Dan Walsh - 2:2.4-1Dan Walsh - 2:2.3-1Lokesh Mandvekar - 2:2.2-4Jonathan Lebon - 2:2.2-3Lokesh Mandvekar - 2:2.2-2Lokesh Mandvekar - 2:2.2-1Lokesh Mandvekar - 2:2.0-2Lokesh Mandvekar - 2:2.0-1Lokesh Mandvekar - 2:1.12.4-29- update to https://github.com/containers/container-selinux/releases/tag/v2.189.0 - Related: #2061390- update to https://github.com/containers/container-selinux/releases/tag/v2.188.0 - Related: #2061390- update to https://github.com/containers/container-selinux/releases/tag/v2.187.0 - Related: #2061390- update to https://github.com/containers/container-selinux/releases/tag/v2.183.0 - Related: #2061390- update to https://github.com/containers/container-selinux/releases/tag/v2.181.0 - Related: #2061390- remove conflict on udica - we still ship udica 2.4 in 3.0-8.6.0 - Related: #2061390- update to https://github.com/containers/container-selinux/releases/tag/v2.181.0 - Related: #2061390- update to https://github.com/containers/container-selinux/releases/tag/v2.180.0 - Related: #2061390- update to https://github.com/containers/container-selinux/releases/tag/v2.178.0 - Related: #2001445- update to https://github.com/containers/container-selinux/releases/tag/v2.177.0 - Related: #2001445- update to https://github.com/containers/container-selinux/releases/tag/v2.176.0 - Related: #2001445- update to https://github.com/containers/container-selinux/releases/tag/v2.174.0 - Related: #2001445- update to https://github.com/containers/container-selinux/releases/tag/v2.173.2 - Related: #2001445- update to https://github.com/containers/container-selinux/releases/tag/v2.173.1 - Related: #2001445- lockdown allow rule was removed - Related: #2001445- update to https://github.com/containers/container-selinux/releases/tag/v2.173.0 - Related: #2001445- update to https://github.com/containers/container-selinux/releases/tag/v2.172.1 - Related: #2001445- update to https://github.com/containers/container-selinux/releases/tag/v2.167.0 - Related: #1934415- update to https://github.com/containers/container-selinux/releases/tag/v2.158.0 - Related: #1883490- update to https://github.com/containers/container-selinux/releases/tag/v2.156.0 - Related: #1883490- update to https://github.com/containers/container-selinux/releases/tag/v2.155.0 - Related: #1883490- update to https://github.com/containers/container-selinux/releases/tag/v2.154.0 - Related: #1883490- update to https://github.com/containers/container-selinux/releases/tag/v2.153.0 - Related: #1883490- update to https://github.com/containers/container-selinux/releases/tag/v2.152.0 - Related: #1883490- update to https://github.com/containers/container-selinux/releases/tag/v2.151.0 - Related: #1883490- update to https://github.com/containers/container-selinux/releases/tag/v2.150.0 - Related: #1883490- synchronize with stream-container-tools-rhel8 - Related: #1883490- update to https://github.com/containers/container-selinux/releases/tag/v2.144.0 - Related: #1821193- update to https://github.com/containers/container-selinux/releases/tag/v2.143.0 - Related: #1821193- update to https://github.com/containers/container-selinux/releases/tag/v2.142.0 - Related: #1821193- update to https://github.com/containers/container-selinux/releases/tag/v2.139.0 - Related: #1821193- update to https://github.com/containers/container-selinux/releases/tag/v2.138.0 - Related: #1821193- update to https://github.com/containers/container-selinux/releases/tag/v2.137.0 - Related: #1821193- update to https://github.com/containers/container-selinux/releases/tag/v2.135.0 - Related: #1821193- update to https://github.com/containers/container-selinux/releases/tag/v2.134.0 - Related: #1821193- synchronize containter-tools 8.3.0 with 8.2.1 - Related: #1821193- update to https://github.com/containers/container-selinux/releases/tag/v2.130.0 - don't use macros in changelog - Related: #1821193- update to 2.124.0 - Related: RHELPLAN-25139- implement spec file refactoring by Zdenek Pytela, namely: Change the uninstall command in the %postun section of the specfile to use the %selinux_modules_uninstall macro which uses priority 200. Change the install command in the %post section if the specfile to use the %selinux_modules_install macro. Replace relabel commands with using the %selinux_relabel_pre and %selinux_relabel_post macros. Change formatting so that the lines are vertically aligned in the %postun section. (https://github.com/containers/container-selinux/pull/85) - Related: RHELPLAN-25139- update to 2.123.0 - Related: RHELPLAN-25139- update to 2.122.0 - Related: RHELPLAN-25139- update to master container-selinux - bug 1769469 - Related: RHELPLAN-25139- fix post scriptlet - fail if semodule fails - bug 1729272 - Related: RHELPLAN-25139- update to 2.119.0 - Related: RHELPLAN-25139- update to 2.116 Resolves: #1748519- Use at least selinux policy 3.14.3-9.el8, Resolves: #1728700- Resolves: #1720654 - rebase to v2.107- bump to v2.89- bump to v2.75 - built commit 99e2cfd- Resolves: #1641655 - bump to v2.74 - built commit a62c2db- tweak macro for fedora - applies to rhel8 as well- moved changelog entries: - Define spc_t as a container_domain, so that container_runtime will transition to spc_t even when setup with nosuid. - Allow container_runtimes to setattr on callers fifo_files - Fix restorecon to not error on missing directory- Make sure we pull in the latest selinux-policy- Add map support to container-selinux for RHEL 7.5 - Dontudit attempts to write to kernel_sysctl_t- Add label for /var/lib/origin - Add customizable_file_t to customizable_types- Add policy for container_logreader_t- Allow dnsmasq to dbus chat with spc_t- Allow containers to create all socket classes- Label overlay directories under /var/lib/containers/ correctly- Allow spc_t to load kernel modules from inside of container- Allow containers to list cgroup directories - Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.- Run restorecon /usr/bin/podman in postinstall- Add labels to allow podman to be run from a systemd unit file- Set the version of SELinux policy required to the latest to fix build issues.- Allow container_runtime_t to transition to spc_t over unlabeled filesAllow iptables to read container state Dontaudit attempts from containers to write to /proc/self Allow spc_t to change attributes on container_runtime_t fifo files- Add better support for writing custom selinux policy for customer container domains.- Allow shell_exec_t as a container_runtime_t entrypoint- Allow bin_t as a container_runtime_t entrypoint- Add support for MLS running container runtimes - Add missing allow rules for running systemd in a container- Update policy to match master branch - Remove typebounds and replace with nnp_transition and nosuid_transition calls- Add support to nnp_transition for container domains - Eliminates need for typebounds.- Allow container_runtime_t to use user ttys - Fixes bounds check for container_t- Allow container runtimes to use interited terminals. This helps satisfy the bounds check of container_t versus container_runtime_t.- Allow container runtimes to mmap container_file_t devices - Add labeling for rhel push plugin- Allow containers to use inherited ttys - Allow ostree to handle labels under /var/lib/containers/ostree- Allow containers to relabelto/from all file types to container_file_t- Allow container to map chr_files labeled container_file_t- Dontaudit container processes getattr on kernel file systems- Allow containers to read /etc/resolv.conf and /etc/hosts if volume - mounted into container.- Make sure users creating content in /var/lib with right labels- Allow the container runtime to dbus chat with dnsmasq - add dontaudit rules for container trying to write to /proc- Add support for lxcd - Add support for labeling of tmpfs storage created within a container.- Allow a container to umount a container_file_t filesystem- Allow container runtimes to work with the netfilter sockets - Allow container_file_t to be an entrypoint for VM's - Allow spc_t domains to transition to svirt_t- Make sure container_runtime_t has all access of container_t- Allow container runtimes to create sockets in tmp dirs- Add additonal support for crio labeling.- Fixup spec file conditionals- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild- Allow containers to execmod on container_share_t files.- Relabel runc and crio executables- Allow container processes to getsession- update release tag to isolate from 7.3- Fix mcs transition problem on stdin/stdout/stderr - Add labels for CRI-O - Allow containers to use tunnel sockets- Resolves: #1451289 - rebase to v2.15 - built @origin/RHEL-1.12 commit 583ca40- Make sure we have a late enough version of policycoreutils- Update to the latest container-selinux patch from upstream - Label files under /usr/libexec/lxc as container_runtime_exec_t - Give container_t access to XFRM sockets - Allow spc_t to dbus chat with init system - Allow containers to read cgroup configuration mounted into a container- Resolves: #1425574 - built commit 79a6d70- Resolves: #1420591 - built @origin/RHEL-1.12 commit 8f876c4- built @origin/RHEL-1.12 commit 33cb78b-- built origin/RHEL-1.12 commit 21dd37b- correct version-release in changelog entries- Add typebounds statement for container_t from container_runtime_t - We should only label runc not runc*- Fix labeling on /usr/bin/runc.* - Add sandbox_net_domain access to container.te - Remove containers ability to look at /etc content- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7- properly disable docker module in %post- depend on selinux-policy-targeted - relabel docker-latest* files as well- bump to v2.2 - additional labeling for ocid- install policy at level 200 - From: Dan Walsh - Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a standalone package) - include projectatomic/RHEL-1.12 branch commit for building on centos/rhel- new package (separated from docker)/bin/sh/bin/sh/bin/shcontainer-selinuxdocker-selinux 2:2.189.0-1.module+el8.7.0+1152+ac7786272:2.189.0-1.module+el8.7.0+1152+ac7786272:2.189.0-1.module+el8.7.0+1152+ac778627 2:1.12.5-142:1.12.4-28selinuxcontextscontainer-selinuxREADME.mddevelincludeservicescontainer.ifpackagescontainer.pp.bz2/usr/share/containers//usr/share/containers/selinux//usr/share/doc//usr/share/doc/container-selinux//usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/include//usr/share/selinux/devel/include/services//usr/share/selinux/packages/-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protectioncpioxz2noarch-redhat-linux-gnudirectoryASCII textSE Linux policy interface source . /etc/selinux/config _policytype=targeted if [ -z "${_policytype}" ]; then _policytype="targeted" fi if /usr/sbin/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then if [ -f /var/lib/rpm-state/file_contexts.pre ]; then /usr/sbin/fixfiles -C /var/lib/rpm-state/file_contexts.pre restore &> /dev/null rm -f /var/lib/rpm-state/file_contexts.pre fi fi #define license tag if not already defined/bin/shutf-898f7147e00fe27ef02d7715c559745367942427526f4eccf07a1440c3472bd6fcontainer-tools:3.0:8070020230221173446:39077419?7zXZ !#,7o] b2u jӫ`(y.TAsOU.l!..HZ\-EvG@g-Ɔ:W7!.ߨ0eT"5wL_ 4 2V1R/g.g7 n 1NqyޘVA gUpLu)nu@2:Fk.K5Mjy>`BF_YQ:L)lwgdqdXXbsV6*#9۳QNc0r`XWJݡ )po䒃GkT'04}L3VtdLW/J:/ϚZȶ17_֠k1{*!N ?R#nC-Vݾ"ep}}0"ܞaTEXjPp~p`mfO\m ks]x頻>LWBSlApvaA PvH=_;tc3ܕJ#jXV(tܨj^\Sqq%9&FBo%>XMY}T\b DPU\+˘tBowwAmQ_A7w7cTA,T U%Mr V[>}oe NtU^I m# 5i,|,y2Pe3$sYmRxܙ8IO$rzPxk+]%ّ>v┨ݽ8D36oN`>~\{1223Ear3SM8S% =XJ_PO6=VmgaIty\чIZ’&b6rۡtHwELZOC>IBtKfKI/%T>@,9*ĥպ Nf>+-+NmDۅtq!8g;*2 ]Fdn(?29㝄 r",GlxҋJߘ޾JmN-c٪t;*OBhg {>+Wnag_n\W7V(P_#5qX#YZ}mخt's<\=qEjpTS5lw:MT*6#Q׀{4́D}ĪupF(u*(Ӆ>^C_y=lg"}9yq{ޱQW^[*&aƈZb( FH`:W( tY^5dv;iK-=_1/ZB/s촗"j]ޭTɜweZȎ~Oԡ]P'_ `ΡzjaF7 Æ8ma56B<(kqz$AA:)ġPn) j-ZlwLWC{oBb Y}U-0IՌE,&1FN(ZO |@ 2MVG,ʙ!j瑙`UؓҨ],Y+%#xȯ 3G`!v/%'7w9&j~0 ^`yP/#'UOp5;ג@Mephqe l$,ݎN6}EGT CD:-5 xC8.q* Zj􌘗 ͔!lL{:b+KA#Xֶk$%"8rzk^]ٿJ숅7;" OHEі9^KIeEFI.32Cp(*a=Yv?|I-JPkk-1#)([Ho-z>Jw 7kn޲jgMtVzh%z::'E^t&D{LRV0Jo 7x_0T?N> bw|VՖ-#;eMNJӽCz-B}6}sD>u)xn4"Nc[ӑwQ4C+1 XXaJ͈Dnɾ܉Y^^ݲ\ƒia9Jp}&߃wXL+ T>nND=1oiQ) 3 5s J5e5uB[9:0Nᰐv248Pb.mβgڴfsao}bne? ?Q(U J|7O~T$k޽ί3S.LSV.,*Z\ $}#D,᠖9_cyȨ[}%2uɈ,U^&gED=*j4Mw儶$Շ e8cR!$s쪚j_+|% 9!r?s BRqBktù3 -cGg.1x];ƽ% budzIPW(VEtF3Y+AT+XOh@. ~t_Xae68;W^#$,}lDž)S@fgBm ]m'ŃXK \i dF o˸1\&)TQ1_;A exOz'qDs 5}s)i+G^Î썭jDJMrK*xȹo$'y+C?~$Je}@7V}vDBc<!,4FXiRWc#60FRusjMnTykT+U/Yb-WHe +x*[ qDP`Ey#;9qgAT{LB4\j1zbG{ 5SxiD(J+Z0톹QFW ȼoqRm;x|Ĝ mIuv+ .|n 1C^oB8էTRa:g],ˤ CTӮw.oo5.o'P^l47(y#G{IŋOndڧ0J#٪qsMbޙ\n4ƯuS}%I'.{٥ȴ32\o  >AZSAJ`30WHV}6]3C(񓈤RpWh\3{fQQؙR*>r_s!Ot^~ clfmCvMu]gXkiXoDnz?Xmku,L:-X$y *<lx陮 ܧm;N2#yv s=  Ձ>vyb2W {&iq q|C, ߦ_dؘCP3WL#=3S"[搻yVWb1,a[_e2XgVgF{pWxٿ)et^IIxc2 $rs%xʝ;@3G?%,!zHMݒE_RZ̫KW_8C x`%:x%$Y*̀[&oyXU5dQ&QGhXΛP 貱 ޱLF3NAVmeIEg~xژ&w~G4T+Ba1 a8?yzrW-y#3o% 1Szϐ%4FƋ#9xS2m@VtgPC&v'u&Xe@zs|Ğ=ZOߩ_10[^)|g-38FCAޢEYo});ɽX82^F`[qi445ϖ :ʹ'oثl]G2\9<_M.mvCK-as\Grsw+#qHgܮyۺipwg:9=c}@-P hfVdqJ5+s{XՏgN.&Qy{hr&y+8KJH5D}S/_k7Q<+jSKNz)Ѯ.дǎq [;(iG{+$+Mmg,tI:71V>,`hfGu1zFi^@M2 ׮DHHKgR.]Im'wUuKog4+))UNe"(1Yp¼WuN6qZYqKr4aJ\?'iX寮$ 1'hO.&6"@7I‰_xgR!c@ 7Zm+O«G3P dD g-ł>z0lr "l-<,vJ?d/3f,Z% BwqqTQk|hGT74w $+"%J227WDxy7Idy%}JF7, yԦ%*a,>7z\v((wBLP>*!h('QbY.8/MM#q9Sw@G>U0?x,IR"*GZ#@#bw؈v_t%(|RBAJ!VZ )$;3irڒuJ8Qfp`S;R LyqIiY;CGTE\ H<{؛<;%A.0LfD40[&|%Ɓ6iIM?a\.^]6dM:GYTy=aHVAK>xap-M>`^7k-5s} M_(eK78UWe禰#qQ՗{m Y 6-bPt w@DRfT31~PRDyeuމ| |_v?~y\J+_71l+t( ޭx`ϝ 5&=<}I* X4;wB OӈV|1lψ]1Y(,V;]"rSK$a݊m5 uA70 nEn$}-T?vFDS@oI(/nˢ_3)EMGGFoC}SB _QחRSڼJ7-T#NX 3 8.kRbmi1 `rg?)/< ,i$vfD }_A Ÿ́8Ѥpew5&He2ܐj}N8x{rւDjzj?ȜC) ['z>ݺp3$1~*=TTnp;hQ*x>3Rå~UH ں@\*IOLtx?TLT;}KyO!@;T?WӀN? P0ܷbc,V`8C?{ӆBWǠr 薂 ;Ӏ4Dƾ2!/tEtoB%E~/HKo DЩ\ ޡ/s w.wzdx [X\7Fhzd韦S|fL,E6H^1}gG][+j Dk"SҦ qb]g -*&4D`+f{$h HN>FnafcACs4ù\,>_cWaY[2e8UW-Oîq߳\]<i `% ?/ @a;=+kbgY-mˮ #C}ĸlQ}KCk),&LG$XQO>)k:Z~a4xkiB[mZ˳/". j{_l8t煉i#dl$JCN "Af~SXQ1ܥ?0dt6`Z5FT%Ӱ^,ÛZسsD=NbϦqU4scmkil+EԾ=cЍۨG /K;&ӳ(҅m*n5 0@Y5'U_qFG.ip6}#wyWT,L?5)$TTAPim8b31Q>2V{lqQ$,G_\ŚgOݡ}GI'Э*: nm[~CtcJ2Mw4:R'bT(s7u]1<%;2>1#yk.ַk;4n+=%$'ހ2F>ZJc\LH^reZy⦐DAϴ޻:d2XxXb8E pvbzw~$tNZ rJ35;U vՂ6Q~0畮L./aGe6w7_w =4OY(πmjѳۻYO;[Z `O)GҤ Va.؝8`2$G9MN6[dUnJYMi1^T2=)Hkh $Bȉud"k;12GVF+H qY*y (=QR ˥{7 E­u↽~gkIO"?}v6WI2OȎxYpS|+8~**sy_'D hp;~WB[;XORhhL:O[Q%W0_9,.A90gkEvƪ誽lN`N5a@gw4k[][v<c0*s{<4@S>셧LTƾ T  <ߖ># 5C |T!okDrpSzƨݲm ?ܳ7 FԋDP[S4g6~пڪ*g5-[HZ s ņkiS%G4'-(8yF'TBkn=b~~Q1GDsju4i N2x'uh;i"$ 63JyRwb)=?#Z]+3+.،,i=ŊWph#"xW\ 7W$ҟdL,'bT4ژM]e&z]!a@[3|1%ϪasaGǂۘ!E?D)lC ^AՈD֤ XՍ67I@ީǴAmc [ͥbHe٪Wx!RRf >K hNGw$X#e C ՁtzPmD7(9tQ)j3y&RqePh4dCSdtUdA}W΀/4bizR2yOwV}V~]tTBcc0hϐ#o cWNpjيjsX|=K >E@ sLO'"H=W{H];*;N+2f8- [Iadć7:`hNQ%W3VĮ?g%XwRC$LD6}oLy雿f ,30 ;FPB .#}!&S%?i/s_xLUb-R(2Ȥ,c/RG{1][ X8Ji["N hlEHpOPdx\Ĉv7ߋzo#.mzm*= VJfx842%sqiֶsa/EUi{6"O&xLs0߾ϴ[2us%/ t׊khV%<1.5gێ-?>5W 6Ƀ!Ff(kd$(C~Dg%e>xEkX9Fl-UU"x-emL4':w;6zHu_%w-ؕ-g9vOW>_ (= J_ر,.-ɣ %SYn4fp0Hr{gRSDW^ʽ8'#uTq5ㄚD/Wn;`<.'тm g܃Ha -M͹۲ahFHHZJG+&1LMW?ڕw̤y4cmEGd-5{<79d l#,iWE.}f\ JEZkhy_\HzZR'DԽ*!2P{"j!\snsQL=^SDPM IbtjGY+{7΄QtAmzV ))*8[.Bl^7dYp/tn^HqtkC~WR$bl&OFdE܌WngXcz1.рX!p]o~M9Μ]cPZf8IϽ;'ÎSrd DW+#_|Xo<&Ǻ/`]J* @%P8E=2^2DΧ+pv)Y:hV`.h/CNʙ 9Pr Q-gavpCvќۈ!YgkST&ArM^6gr+|49VJvI>[*FP" 1H?3K67 #Apg!d}n! 8Ird?+>BNjn^0Řk_̰llGjFhdgq.Zd#ܴ"@eƇ#q>QS 0C 2S }nt +PI-TQДj*DQx_ W\~9h^pFhWyG.FI*lH,fv6Q8hxk1. /毝T9OK}l\8uд-X8E-s 96xm"Vߨ.~: O8)z}KX'kW4,R3H:9)7YBH]~FA܇"20E;P3&zkسdWUmWrfs35F|EVL.@DŽ)ĹJZX`adU ZvC  pQ+뚏^ l`*+{X'^z6YX#kA3hR4 oE ůiʏDG7qE'6+Udp+^nq {tL~.%\4, dh P ~bʆ;K'pw2!E*Eq%8FsɼzR :7ߢe#>t}x/y\5Dv1y]Ԯhu' 5XnπØb> inF)/:&PA$7 6,q3dGGsOy86+Rr„!PU! gTSSą| &ЫB*aE1MXV-”KI<)2 kf\ Lכ~[Kmbr"@NUZI*2hfl`#|'켝*~#8̻.zF ̕'GvTͦjZVI)"R6saG$:|tq T׭|M/j%n) _q9$z@ynm\m|U1jHHnmgYbf#~RK]_2A:˫"}Sf^ôڋz/.xf((|:-w{j2J܊l:8X4:b- k NPL]qq1*2J2yv=wsd1Da/&h yw6VSuL$28Pf 1CYGa ƒr\6Υ 2^i.9jZ'u-4әK`{i-,jXEyG^U1?qb4zT[vY\;CŸ()N4/^zD.w%3cbTǩU-{BI 6X<Қf_ɂ|NI(Yfit U . J93ږt\g>"o8ф gy}fx(1׵֛ʆi,|9ŨwZ+ylĖSa3Ś@|JfqqK"B{qݿӊdƙF/NUPMexiO%65 >}Fl3W3Ņ V^zL>*sAN 6UM+mG,}\O #z%qutӫP@ekhxd2MZ OrZo) YߦTT#$' &ԑpo}!Wi/4AUGKK[)${G[l› Wxz'8b3)ٴԒ`("YJL^ fbBback}8K2pȴfW 0j[QG0;#sDz4:"$p`"qAJUZ\j=.;/)2D:Aa( x<ϟ䃔3&J9=n*US6;T^B\i*5Qh_Q\Ta-o4"Î[k\¶L=~MC[]x4WUWnc쫮y>my*J K6/NJPwV!mfqsE/ bf&G ZVP7ár*}7 EM @%)ڣ{)cm=$foZpkCvu"hB YgȬ{߸t1Ϊ( R9o/e}9_t۴,{b, W2u$ Ux(bR!7v[e ۃd>M+3}5@ZL\ʘ.ТJ;H~0T`r+O- ?"::u}%4=Jtcw_jt%w_ݾJۋY_BkM.O[W6LU Pr kxq53@=4}k:oW>WNtFa5JJS՛YbӊGK8`ݥ

|w i:p}m \˝=`6຅::"|(kFt*K8F{ =$d-4WcFwFN*qsCEؔF>ijJ -h-Az`mn=s21-σ ҕ!̐|4zWvD/(U:1\\֫0h?[c.[Iʺ&#Tn ;I:zw#tEA?*%D[&0fUCjO,EFwim!,i-㕷T”qhC`i:$iuoJLQcB<:~аCb|ЉD,Rފ[ym%ӦrwG'هw^Ԕ߆mVwP œjqLb2tjHﱗNP A%6[8ϮPD¢7Q_RVѴЊc:̚!ݧ9edZrU`-Xowޒ]Ci <_tͶƸISK<2C{A v(7ҚǶ-c=(V JL5y\+1-t8;Y^y Զ[t&[2+XwRNu[vd ?G/]yP5D]?/٪S U @CtГ>otzkv; nS.HH x>Z&iR8xA ira Жt rc~ߚ@ ^ >*J ~Q$9Riu_54aÔ}eÊe>έi96Ս::}Z:j7\Ӄj#F\̈#Mџe#LoeZӸaMIbm/P; (ƐDq M^B,]= O ةf.GsB!RdUތtsW9KE."ܰv)ckge-%"|rc[V P?McWA 0As8<|2EeWDr僢oPRM|)m7&4ɯ3^0fu3cmWV c# 9KRҐg[b${kgj)D N? `Oʭ1R JOr @Oߧt?$rʚ̅؍ 寧;* G#L.eתo.Ӗ;ˉM{SUсk[ O&K Yx.lNri~J^SaߊdFHY`+/"g'!8啧:YjNPζ]HWiMiT<7h\A&F`5?3[U6'+Fav|u;3\Ow(5s'_Y:hi˷hW0}]~Fo>׮dۺ;?*clZa;T0h 28G[v1MKC3qxgO=#'Za}l͍ѫMF)dWXðۣ}W  90:l#_ ǡ Qo8tӛu5A"2Px/4bSo}|Hr',g4f}GyMbaI/j.m%\?Pgz q?xm2U(LgJm-6EP<& Tj5Xfg4^+G!s- M#uŞ`)RCc/e%0~Cepk(I,פVT5M?UF174?'n -{Fš5{bw}4oUw,c8r 9O1#;& FJ13 ˆ/$>uI[ZA'ֳۛ_S]́n r;}Jۮ+Ilj 0vC?.3 U-k~PdB7_Vݭ+#79CU:NO)^E`|ڜz|V(zjmv\xNl`jψG|"|"4O ڋhq?h u_'66{OGj9>Sk=<.z^ځ𜎖 xhrv \GRE`z_7<_)BHZ)Vjekًx8?4CdC{ta֗ABEdE\obkF,>f R>mI#N8PLܲơO_<[En,сIW[:Lk:$m[#WR.(cة;l{A){ $ծwsϧĸv0hiO. IL6)O9pd㱁3P yEk;޽R"+ şM)-i}$L|L߫BC Ҋ .F&F-TmtZ "1!e_@Dz)沵GIeBXN^ato}LeCf$KӆXi `^ӦþƎ*U?9~L&J;Hpڣ؍1'lG̙"UDd/݌y#i!}ݯ _u'i*MsLZgo: Fɫ=|hP2Nͅ&IW5`A8@1N& ذas 8˗ڙ?;ՒhyŮ .L*wu>|Ǵƛ% lN:m%(|Z'#:(Rkܗ_ A-۞AL>w>umkZl3jVY3|b|Pmu><6îB0{A}9ARSezbܓFs1"GVV!ER\x 9雸][?e P]u&-/nڝ~UA*Ti^F&''L7lͪNGYH|Yi$e ]R1, A)~Agң~ 'I8° ~0JTeJL/JM/U6%WE'D##1orn^RWa;At\ E`ʝx~$jS FI_ |$^7/lw2| t ފͯN!żM3_T}[zTI?(UE EC-NB&3;$ԈKCh6b7cfQNN$?WҰUCm~ix$!اxpkw[YXƐ&5P؈:@_1Hf~pp\֜{}j*bjԇup`G-U몯P>r߄Y7KL+י&M"戔U ֗={W(^{}[ΧF,+Ox=ҘKWԧ qVaVڂ:.~mސ,KòOsL2^1lE<[oG$AXXkUAȭTwlC=I:AӁGEjhQh26 &^wi ŬUT1C7IjK$_rŜbY*w&oo !,,Q0]Y:`|}␽>V8]\SIYWZe(k}]ذ1J8:a;%-VWⅥ ADIM#ixbu xB]\C?--kbhv\ ]fgDVeֹ?9@붨N2G/(=< jveOWs{ɴp62 biU4;T=j/͆WϒBQYW/sZi@zL\~@G6D5v4&L%a MAVHN| (AR?B$к0e."k$qrẽnGKd eIXU@bƽ\f>ȑ;Pѥs9Ljuf?SW.ĜPv1HryRtfj1QWn. VKYOK&塮G A@س4e\)Թ&3vM> Gw4WcӽQP޶Sx+l8ĵ/̰ۊZ/5PRZ$_>Є#(!XPr\UQ=