container-selinux-2:2.77-1.el7>  HLk|\ vD)*5) hHcE )5 %ZzRvk FB]uZ6i_q=-6hX<"SIV8&6*ȴն z6\]~͍jȕDXnMs$A HypU$GlBm+m TAii70s(iƅ`iV[JH|EO]5eџQ>g;}Edoʾ$nkR[K^ɣT\i'|Nfy#82b643fb454eb6139c17b898bb3d0df70a542b0c\ vD)<'nn@[5|JkgY|G$5a^ԋd0,SI{%og= I aDOcrYAddp#QKU/c8~N{ugs)3P&^ "obG5V8ޟ&0YϾ݂MLF#<>8+h^(=õY1˞#'$k#/>Lہp#&{{AgۊoP-6Nh~2GLy?>@24?2$d  $ L  n   ,  <  \  $  , L t      P  : ( 8 B9 B:B>.@.B.G.H/I/$X/,Y/8Z/`[/h\/]/^/b0d1ee1jf1ml1ot1u1v1w1x22 Ccontainer-selinux2.771.el7SELinux policies for container runtimesSELinux policy modules for use with container runtimes.\fc1be.rdu2.centos.orgOCentOSCentOSGPLv2CBS Unspecifiedhttps://github.com/lsm5/container-selinuxlinuxnoarch# Install all modules in a single transaction if [ $1 -eq 1 ]; then /usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi export MODULES=""; for x in container; do MODULES+=/usr/share/selinux/packages/$x.pp.bz2; MODULES+=" "; done; /usr/sbin/semodule -n -s targeted -r container 2> /dev/null /usr/sbin/semodule -n -s targeted -d docker 2> /dev/null /usr/sbin/semodule -n -s targeted -d gear 2> /dev/null /usr/sbin/semodule -n -X 200 -s targeted -i $MODULES > /dev/null if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : if [ $1 -eq 1 ]; then restorecon -R /var/lib/docker &> /dev/null || : fi fi . /etc/selinux/config sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types matchpathcon -qV /var/lib/containers || restorecon -R /var/lib/containers &> /dev/null || :if [ $1 -eq 0 ]; then /usr/sbin/semodule -n -r container docker &> /dev/null || : if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : fi fi #define license tag if not already defined&?=UA큤AAA큤A큤\f\d\f\f\f\d\f\f093be781f9916163b4f01d3f7edd672d735d3d8347b5aa643cfa3c58057c6d5d492fea535317f79ff2e2b9e2d9c8b22ada5feb7f1710482f31745f8381dae4fd59f2080c31910e583dd835e193a538fc7471d070d19234888b13fb299263afcdrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootcontainer-selinux-2.77-1.el7.src.rpmcontainer-selinuxdocker-engine-selinuxdocker-selinux        /bin/sh/bin/shlibselinux-utilspolicycoreutilspolicycoreutils-pythonrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)sedselinux-policyselinux-policy-baseselinux-policy-targetedrpmlib(PayloadIsXz)2.5-113.0.4-14.6.0-14.0-13.13.1-216.el73.13.1-216.el73.13.1-216.el75.2-14.11.3\2[k@[@[[@[[Xf@[L[K7@["X[@[@[[[Z@Z?ZZZ%Z%Z@Z - 2.77-1Dan Walsh - 2.76-1Dan Walsh - 2.74-1Frantisek Kluknavsky - 2:2.73-3Frantisek Kluknavsky - 2:2.73-2Dan Walsh - 2.69-3Dan Walsh - 2.69-2Dan Walsh - 2.68-1Dan Walsh - 2.67-1Dan Walsh - 2.66-1Dan Walsh - 2.64-1Dan Walsh - 2.62-1Dan Walsh - 2.61-1Dan Walsh - 2.60-1Dan Walsh - 2.58-2Dan Walsh - 2.58-1Dan Walsh - 2.57-1Dan Walsh - 2.56-1Dan Walsh - 2.55-1Dan Walsh - 2.52-1Dan Walsh - 2.51-1Dan Walsh - 2.50-1Dan Walsh - 2.49-1Dan Walsh - 2.48-1Dan Walsh - 2.41-1Dan Walsh - 2.40-1Dan Walsh - 2.39-1Dan Walsh - 2.38-1Dan Walsh - 2.37-1Dan Walsh - 2.36-1Dan Walsh - 2.35-1Dan Walsh - 2.34-1Dan Walsh - 2.33-1Dan Walsh - 2.32-1Dan Walsh - 2.31-1Dan Walsh - 2.29-1Dan Walsh - 2.28-1Dan Walsh - 2.27-1Dan Walsh - 2.24-1Dan Walsh - 2.23-1Dan Walsh - 2.22-1Troy Dawson - 2.21-3Fedora Release Engineering - 2:2.21-2Dan Walsh - 2.21-1Dan Walsh - 2.20-2Dan Walsh - 2.20-1Lokesh Mandvekar - 2:2.19-2.1Dan Walsh - 2:2.19-1Lokesh Mandvekar - 2:2.15-1.1Dan Walsh - 2:2.10-2.1Dan Walsh - 2:2.10-1Lokesh Mandvekar - 2:2.9-4Lokesh Mandvekar - 2:2.9-3Lokesh Mandvekar - 2:2.9-2Lokesh Mandvekar - 2:2.8-2Lokesh Mandvekar - 2:2.7-1Lokesh Mandvekar - 2:2.4-2Dan Walsh - 2:2.4-1Dan Walsh - 2:2.3-1Lokesh Mandvekar - 2:2.2-4Jonathan Lebon - 2:2.2-3Lokesh Mandvekar - 2:2.2-2Lokesh Mandvekar - 2:2.2-1Lokesh Mandvekar - 2:2.0-2Lokesh Mandvekar - 2:2.0-1Lokesh Mandvekar - 2:1.12.4-29- build @lsm5/RHEL7.5 branc (cherry-picked commits from master)- Allow containers to use fuse file systems by default - Allow containers to sendto dgram socket of container runtimes - Needed to run container runtimes in notify socket unit files.- Allow containers to setexec themselves- tweak macro for fedora - applies to rhel8 as well- moved changelog entries: - Define spc_t as a container_domain, so that container_runtime will transition to spc_t even when setup with nosuid. - Allow container_runtimes to setattr on callers fifo_files - Fix restorecon to not error on missing directory- Make sure we pull in the latest selinux-policy- Add map support to container-selinux for RHEL 7.5 - Dontudit attempts to write to kernel_sysctl_t- Add label for /var/lib/origin - Add customizable_file_t to customizable_types- Add policy for container_logreader_t- Allow dnsmasq to dbus chat with spc_t- Allow containers to create all socket classes- Label overlay directories under /var/lib/containers/ correctly- Allow spc_t to load kernel modules from inside of container- Allow containers to list cgroup directories - Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.- Run restorecon /usr/bin/podman in postinstall- Add labels to allow podman to be run from a systemd unit file- Set the version of SELinux policy required to the latest to fix build issues.- Allow container_runtime_t to transition to spc_t over unlabeled filesAllow iptables to read container state Dontaudit attempts from containers to write to /proc/self Allow spc_t to change attributes on container_runtime_t fifo files- Add better support for writing custom selinux policy for customer container domains.- Allow shell_exec_t as a container_runtime_t entrypoint- Allow bin_t as a container_runtime_t entrypoint- Add support for MLS running container runtimes - Add missing allow rules for running systemd in a container- Update policy to match master branch - Remove typebounds and replace with nnp_transition and nosuid_transition calls- Add support to nnp_transition for container domains - Eliminates need for typebounds.- Allow container_runtime_t to use user ttys - Fixes bounds check for container_t- Allow container runtimes to use interited terminals. This helps satisfy the bounds check of container_t versus container_runtime_t.- Allow container runtimes to mmap container_file_t devices - Add labeling for rhel push plugin- Allow containers to use inherited ttys - Allow ostree to handle labels under /var/lib/containers/ostree- Allow containers to relabelto/from all file types to container_file_t- Allow container to map chr_files labeled container_file_t- Dontaudit container processes getattr on kernel file systems- Allow containers to read /etc/resolv.conf and /etc/hosts if volume - mounted into container.- Make sure users creating content in /var/lib with right labels- Allow the container runtime to dbus chat with dnsmasq - add dontaudit rules for container trying to write to /proc- Add support for lxcd - Add support for labeling of tmpfs storage created within a container.- Allow a container to umount a container_file_t filesystem- Allow container runtimes to work with the netfilter sockets - Allow container_file_t to be an entrypoint for VM's - Allow spc_t domains to transition to svirt_t- Make sure container_runtime_t has all access of container_t- Allow container runtimes to create sockets in tmp dirs- Add additonal support for crio labeling.- Fixup spec file conditionals- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild- Allow containers to execmod on container_share_t files.- Relabel runc and crio executables- Allow container processes to getsession- update release tag to isolate from 7.3- Fix mcs transition problem on stdin/stdout/stderr - Add labels for CRI-O - Allow containers to use tunnel sockets- Resolves: #1451289 - rebase to v2.15 - built @origin/RHEL-1.12 commit 583ca40- Make sure we have a late enough version of policycoreutils- Update to the latest container-selinux patch from upstream - Label files under /usr/libexec/lxc as container_runtime_exec_t - Give container_t access to XFRM sockets - Allow spc_t to dbus chat with init system - Allow containers to read cgroup configuration mounted into a container- Resolves: #1425574 - built commit 79a6d70- Resolves: #1420591 - built @origin/RHEL-1.12 commit 8f876c4- built @origin/RHEL-1.12 commit 33cb78b-- built origin/RHEL-1.12 commit 21dd37b- correct version-release in changelog entries- Add typebounds statement for container_t from container_runtime_t - We should only label runc not runc*- Fix labeling on /usr/bin/runc.* - Add sandbox_net_domain access to container.te - Remove containers ability to look at /etc content- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7- properly disable docker module in %post- depend on selinux-policy-targeted - relabel docker-latest* files as well- bump to v2.2 - additional labeling for ocid- install policy at level 200 - From: Dan Walsh - Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a standalone package) - include projectatomic/RHEL-1.12 branch commit for building on centos/rhel- new package (separated from docker)/bin/sh/bin/shcontainer-selinuxdocker-selinux2:2.77-1.el72:2.77-1.el72:2.77-1.el7 2:1.12.5-142:1.12.4-28container-selinux-2.77README.mddevelincludeservicescontainer.ifpackagescontainer.pp.bz2/usr/share/doc//usr/share/doc/container-selinux-2.77//usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/include//usr/share/selinux/devel/include/services//usr/share/selinux/packages/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz2noarch-redhat-linux-gnudirectoryASCII text?7zXZ !#,Z] b2u jӫ`(|f:&C9UA۳SM.V0ƞ1wDJ( (ӟ# ;ɯ=U25†WOgؙi1]EPh:<5 ʹ-R)t$r$% /%n{5 !(B# wύ䫈? .eR{.SX{xPwnהR [H[=d',Sԝp1.D'?m p32XArBI/<)adߦd`liG@SH(`Hʈ A`L26 oFEiJp;o?d&KЇsyU@'A$ތYܯQ0Wganoo]NF/iF8荔l]^+Z%* N[w͞}ԙ>u3k+4XdC79gO7fcɴ 2ۉ, 3b-Hk2 G$,#!̶f G1/- nn<p8 +kOÈqHʫUj٪*lTS|-+8xgOy|BD+IVѽ\KͣkWC1(Ł.IkH&2jrTdF'g&4SPwo6mxb4c~Ǽ9g]Rg6I cЫEoD 5"gv+@Prl)BGbU ZZ6k⢩^K/aڅy:'v:㺋3 M(\[IH9T^n!أL`] v|4dhTwGhx}s4CY˶,@cUՃ}SUqU3c0ur#aMm.?LraD'sf՘tyg?*8y-ZRwqYB:m 9 fd& ZTY2[2xadUg["dN?u5RA1aۮ7M5򋝋oi$s1Q=%yc$jכٮ5-EU|޳|`3ٓL)Nm#Bb O^fZub~3zaЦbiùR4fvw'/^uֺI~Sh*y[OM.eJ6 (7缞.Dpr7Hkc)}2΅\N3aTxn}A6a\LؑLF L"C̩N^>NHWv\yV{ɄSEgq+qS\KK z s;keg:<\Nl+]mVC8P(-e+i?Wf34WoU_u,lJX>u'@."G#m8;3<4*%E^)pރ~aVcbcDBgusam)Vj$̓õVHd4W M(k ]G޶ܽOi!4P:)Xo3} ` BXT0q՟Y]`0hjEW-36R9]cn<͜<>Ytjc8;O_2-I5-!t8R fj:SQDcܾ]t? Q q.)6Zۛ=ep F K3Loi'9@N,` #7r- :Naod{{ o)U=% $O: p1m]&R [R[6Zz&Y)\JS(SR^e3qȈ:f "s&0aW3-(΋Kb^ t JEJ8 4*K\nb}_&/F,gI1^]*fNo6VNnQ}ZOW`SP3o)G6Pѵ _{'fS:eY\UjEQ5xhc{>z}T&P{]v?s;c@ݐREyB6\Ӓ34;\C)=~@Y 7wMbvV!1úS9< Й\ ;_~&yB`xlafȶxLb;=fpE,͑h` j5AqVWu|j-y0_Kgu?K]q+:Oz1W&4zlsF%JYs'#S xQX-sILd_Pk%6<-JzR4z𓎌oG$ n4viĉ]v#{)zDE/@mUөҳEQ1se%-ajbn&VB9WɎIiiZW}>3$K PK^m2>{GyFݳ!,{٪J|x4.Fy9 T FR\Og_2ruZ;Эh"߶L;eT!,?\@x] X;[d56M<)J9J8\r } I c5pGxtկⓔ5vb1{cbsu4~䚑hUϒ/t6||/_NKGYC!̪_!-oULaw;Uoz.gჯK|J3m+ZLxoz7bоɃ_sl6"5J2P\Lk=SF4#;/&=j™f2Sf2dsUj*YJvħ!OAWL=63gg1Pg', roFl'$\ֺJX;&(zr $)iEM&GO$#p"$ċc[y|!6ԃUS̶W0ʰx7㖦CU<dxI'ay*AD|S@]t,/Y ь6'x\NkR9qUQ51oLJHhf$ټۨ|$8M-ƪZuL 9#M~NRFsɴM7ǯ|9qY`bSMAn ɸ+9vUCл!ʠ[lXVS5C*WHewx_]:"W bbv aG6Q.d8+>9]'d@Shn-%1,>SSlXSqv K 1_דfJmaT| :lNݩCT|cd& b-N_HLʭ`GamkSG6ʓs/e=\b<\-i#jyp{A:fᐍLȘ_$;byÐ3Ys1ǎU攎?]T[YZ<$g#C1&%&d)9fY-nKSz#G/{;`#fFi-}< $ן`,|O'14N+e/x^ .yK=OTEH/ H^'54#j"!~c,P)/~$%LSOӻ!A',ӲX 7d)[֥ lpD6յґrum+ [ӆq2Pܖc7ަ@| ;(d*L3 DꌐU[)I{ :6l-{BC{k^v?:=aԊ0v DRgmDG0UwHթWuDru(R5 Y4lpWJQUo܃iɉ2Ds8rku 5 Ψ\1mbÐZyMw}s7棹ԧ-cjc3 b1ޒ`QfT@~VYzX*w s>LNW{? 5N31;a^ {jx+QNOhT{EdkLF+e8?ג96/$9F,zœzgއnb0$ih+E}.i1fk=f u>ˡdB6"VnmhD}:+ki ٌ:r$(Et҆g5Gb$V);[G@/gWӉUmFdW&7GeK򭹦>Z&tZPݪp̂?@ 1H<((orEzq~O!;o2Fz_bn(ew:rP S8j=_` { &' # };ZkU,oIedT(1$wlzvyJN\XVrAk iC|r$0}=t0`pYYQze*Җr^>; mUo0'#wu8QkVzzDU됉55(r|!c{jRUۆ8o޹kVٓy1mMl:qc8Y i'P\P.aRDÓ2Y|{d -Y7,P>B &I-'@~w@HB;9T[.cVIL ֆw91yihh\͚ HՖX&t&M}} Qτʇias!͍%敁zҦ&w*J E` EjgxB䐼巢DNfR&ѻZ`h:¡ij _w y"cGqb4V ;fd'gKEhBjvKLUlB >Xc,x!own[m2-r 1 5Al#L^Yg혨E:-NTw4oJŔԔ.p7Fլ'^ВCXIKVU1%|ob3,[8|'}Emn .D+&g%ßhNTC@Q潬N|BD nDdgm"y0v>y>{)BE^d(?}_n++90mURczAW$#2 '[Wk|ڱ eSs]wLA:l؉ |{o$n^y0:OD:T-X/'gdZ!tȝ7 sO8!f{w'>+E)וf3Xj&^!*Veг +-"vT@!b(M MJF0mLV=2"پݫ-7x4^0ҲQB#Gvwň0ʂ纈_ FLgBϞ&C1>^¸~J7N+ZjD}̤)mHlz<CKK8#"*z.G2iFhڳ/7loxp"[.*ɯ@G6`)gA)яUy}> k;MfE'#*YGT$}Ԅ@D;x?~{R~ ۰" tDZqޝW9Bڧ?_hp\wQY,0IEis=Dd :|35?CnSS:!~-M^:b7 s]\{_ZCoZak*.bԇ!|egCU@FU=Z Ɍj\ U8giv$zTXS∵k,a6"T4srRS,=;le%E!#n$ȠK ovz yLc$qBc3:^?9Ec W[H(eWgVcAU8̍Zm !LvT8l,o p!%I ]q%}VK!ձ :q2Pޮ2!%$سQ;)mcFNUo lȱ&ߕ WF  W^+5ԍ2N.d '-|@\B撅;]PD>;G2$GFRzq@EХZp# )ADdBvPm>,ţ?,y|Ӎ_ 0 Ip8DE Y^ 7PHm42Z} L?J'Ca炓]%[C1HD7.\ ^Ş.19wK&qbKֆި \a1~m9zSk 4a+$[sǮڢda?'+$h4rj r^!0k::°Wu}W5$ET _evusNŁQL:66>qLJX)|\5ٱ=LPN-A=JI}&7°~aǀ7ɻ/3Ww8![Vn\V+IB5m ׁ|?>MmѸ R~ot]~?X' bHÐilV3Jy=B&53uc_' [Ճ|uPQYb]i˱@ܳ/pҖuip72.f xh&rX*O] %H!APG̕C!#[22h|t, JBRTh6MoU-nBȥMkt\$١^'လݒK=X}a-^$ =~q}rYtzGW?,Xe T2FM{RH4p8ʺX"⌯ ɛ(n_H-!ߎ2g= [ H2[RXW= ˅) OM2Vׅz)C&|ڈ:!B<`0(E(]L@sҀ tD6 WtoZjߜ\SX四")ɊW z笀@P!D2Moa[ Yԃ ?x74wk_Z"]QU&2ÉzP2&$ls*Dh؇[ohnFגMgT R2G44:QB˽i36c chPfﶇ]c\5IYGo锃6N̆jg 3'7yS"Wbc]VJ( m+E|S XGsIhf_MKKf#Ȱ{dNu[ZW@̑NeZ*s"cX3%]x)@zD_fIz%_l|{.~FSݟJ`]y*DPGoڣ"0mYFP&P*}M@cW-L@g, }PE$]$"E6/7*WXf5{7eCU[ePWkeL[;\c0B-.R%[SЍ5NW7&eWi^]ؙN<0(o\zS;EP[}!6"IP~-:/ JLg}:jmр)܍ZB] |cbT# pU(;!Vl^}|]@7Ȟоۿv㵉SވDR&M 'Ո% Mb(u|͌=sWcowp@NURb],дmIW1电N^险gX:K[@[tahQBϙ:`u]|~ )#ʔP}t=Th4k9!r_nd[=+1Þ`rP;~8uxoHq߃&u}vH*Y9U SQ;p E{[^n&A{Z C6nՁdk.QERm6WoEn4Wb`]u߅,[q^#/Y9X߶̔?W*q䰹W)jjج8N]9ٴzp/)\~~4_FaIyq4~jx: >5ߎ`Xlzmޱ)zh63Y k^Mw'ˢ//Xt|/ ?fMUFQ"z&Rb+PP5#A"*DEU]lźk+X&<[瓄 kaso 4CK̵w#iP ٛL7 HQ,6^@HGWXX~2>$."Yc麷kEgpK0$K+1"ՈK~׀.kվ$htڐ !{]OZ(jo4 T2B:V3| ~I&gףK_=ז FIʎSk-%qZnT6$ʇ҆%Ugs95(B(p\'Lk %a#b_F0@8qH|>7K'Zx/O U#%GH;A$i 66UBq;2Yq#ulU6앛߲q96Y+K̊ʺWҥ0!xz %tѾSH闩֣0A`x oW%:7y4ZD=PsRsP5=>2bzV|C@$qϯX* eo t!|h47XL}3aV-s8fp, ЪKue[zڠ9N˂”$[J*!7UR Q u./ ݁jX5Dosծۯ7>N3[#ur),C%LPd`wxjҔ1GY!8EԘdbo*rz/_(rhO>]#هCgKeWKB._ŧY_V6k[vkM!r;$+' q Q&Y(*'B9018 q00Z^,ZL⨘ku3>Elxji;/0P!e;281{ s ̦H\DIjb*yb,gs-"bY_'zA~z,(p^C(c/Ot(-Ԟ6늵 B22 *稤nqU>DsV@R86<>,g:([̏(_)9KhJ6I 1qsc/(̲-]y#_Fg}> 4HSBCIw 0;4[ ( KwT%i+]n:9Ȧ|.E㎁ڙ,<#nOvxd65EgAW,LanqUvIcK:O6\{t|CJ:k9ACH&5$¦Vrq׀Tsx`1tA3/x?豱.;󉓵WH i9a Kɷӥ`Wg;iyJ PZ)^ŶDȇ?bLʒa@o'#4jwZMb?7 T)Ι&WD-kgK ;}$n/րB5n =hV k;~S;԰vs?[Fșfꘟ]4:+tĝDC]t# }[Ay|A$T`: &*"|ӨbJ7]FS7%&Nj{hދH YcV [73'~ߚkGę\xN2Av\ PSmoԐWC: @, aC$k>本@Μ~WۉVH{>4n_#U.#c!Y>aWˎTg94K&tZjsڪWDC :ͻj}w{ZbqyJr)ؒd.`d GPYd3K6}_2\${"S+ ۄ5=N+2mE⻪"Fxo6Փ߯/U)o(=Dn)''RoYT_,!wQJ5]nmՆHzD %R̖-0gK c^ S,-$;*AҸw.r8?Qh0%!zfeM0]<fo =5 ,u*;d^r/4 6EMB" LibYa?LR9=vZ, 4hQ٬pHh#mDs5-h⌴x1Khv{IUbbc#'7ִ`Ww.לV{(4(*,1Bx5T\)z?{PYI'S zAf7l]|i+V;7]p;%vθ% Lmƫ>vk/ȷ>٠+7/R-,VhajoJAg b ASu~נnyob'"y ct)5a?+&ortIZҰr{˸`ޗNv0p(Eε U sJ/rx}! }AL)bVM:Mpm'z6td=(G v2[J7o?bɪ|r 3.Q W&4ܺ%iL&1YgvVnbʯPuV_Q j!p gt +Eٵ2ӝ rGJV2 ,ѥ=Xr:̀P'YR/RJD)Ǥ;fm?%hy!)8[,witrH%_ȩ~2XU@HJ}`})i}McWId Ny|8D0tυ)nWI$JL@1%l/U.uJx:@gpP O~Aq۞GIc6 Y\q~`8B Sab\)mfp &z:pV^˳} ! 'C\vA,]T-(1羙Oz-W:-:ކKZ.7d_h! i?yC~<@ .gL(nJȂ='~ FKu~CYbyh\?kDr/%iSlTW3sl.:eh]2JA7z%_#a~X.9|ޕ(ȱ$mLKJgySSX9k]]CBxXLYi^QKrn^ S/O_ `YRNz8MF\zhj4n;`9ρ&"3T@u4Woh tTρ]ׇHX,r&E"To.0'h!A&=9\1OM@(e_Q>, {G1)FwK eEBd30oDw62tfBͳz~ԠMc̜[@<78}_3*%'zFgvda +kM5`(.߫91zѹ.ۣ wt$2) FwlN>$pN$/Y/ ף bM[ҾIe$!MHoȗ{jI+lH)1aهapMyΨ7+Cf5²٘?*s>k ht2/X9EViQp_aq3-0|׺ ۺxmd4ں@zy4V.x yM?HJ`kFUӸt,C}Y8- R, iQb{ +O0,(}Cj0}Q@v4p^n&슓(D^_H0}#yyc%w>9PmF,Y%+=jT^4nYQ,"Uc.HJgۅڌ*/ik{U!F tu q%I BR z9Aw=)t)ֵ\s߿_QY }"8),$}ֶ{?) cj9JݴC /ٳNwb߾=l̰3vԪY둭EtF (h{;c?^mJ+%&5nU|%`_*qg_]fD&o;ycDH-T)Io+;p؂La8j\4[tp$p ZL i q35PHT;Xـ}Yzcb`,lq`7HpNϵȚO|ɯNkQ/?+6̃f)%Z昇awu3zm@!Z C ҬP/ҟNky5,j hC"  Ѭ}ofŮ[evq=pn. gCh'5YB6!w)prɓ{_y]!)?>2)1H\Fe^l`!  `zK$~5mhz|Ծ}u3@$*v.$AxB=S\֋R5~o֢IF/@1%Wp.8D Ό,Oܨ$ h&{7> VQףI"S7!@t{z=e*ɽ|Ϥfs7[t:8\?jGܜȁ""B36â{SoS9"o)k$:(IS-q¡MKOzBc}DR<%+_:&I["vnⶆ 9kaT#fnoT; =񓭑{G6QA@PYa̦+#[!z>O 3w5}FV2ډ1Lto׳R 4,m畷L^ Eudzmu% 7Fo]c`uU|>^4:Y1+¶ ˕ND"?T cM5l_DޏK{;$iv.הޱJa㲺K}`h2ŗzO|&wc*@5t .fnmb"`9șv>~*%ܕ>d[׷HD! z%6_[6n)!1)5|f:XznGJa AZh`c":T\Ao_yT$xfqS3N nViZ^Ɵ%e%{Ck6 J9e U>aR$? `O^K;[6XOψ͈w'9/¢p p$c>pO~in?ˇ/U IXo a؎!WϰZ#/8f0XƋQȴC??-D O*T@$:jeA{dS`H~Dp߆|-L2BѣZ@һZ01PR$4ck £ʮ/1/GvB2 9oC!I쯙۸x@`LNt}Vs \s ͽw?ydPflq 5b^I<95l ޒͤmST'BcW[s$m-5Zmn0#(n/H[Vw9٢%_}0l*RfaWGJ_zJ/*o[Y\]K5@1xίL%"[^pg+Ibs>l\5n𣐦W=qaR?3;=&2zͭR" 2#8*'SHu;)4%D\Y)םLr bd>VP0}⿏~qϜ{;Chy 0ʓ/ 7ʀ˅4*ߤ2ؚ'19`)f 'z<_];susښQ)1Z=~oi aƽ{!E?Խ糄{j6Т(E9nY_3C󯚯;}~(]n=N鈰[́N$aG@ڱ"KԪ]ftP>fތoVNYF EJ$7@><v[y:,Vs* Zܡ`59/lcBj/)"7c [7ppQ)285μ_Wk(M~5eb5<3E﷋Uc23~h lFŵ"!CNsɉNԗ~UD ^|_?u0f'Xq)2~5sOD&7u"w*\-.eG󄨕+L^a@KFkOCw;y;sO@mi>NuT4nz\im70KhD%سF(Xo> !H D }Th#goSc6E >Y&$i#ikнܼ7z gk-~SMضىf^L6m5L^TkJ MɄCl~+&ntLoxϺUh i[wHǞ~e6 -mE[T,¹iWj֐E9b-UMՠTCDnmGzBYĖ'ɺ;ZT˴ǟI5tux3[wwmѵ%Dr̸ڣjzřRC2Y ʸT:;f v?+j>®lBϫe81Kk%2F W&NJvN3o;DM*̠yG[r] q _cS7nPt/2.,pc9 蕏ǐ&-XsF-Tٲ ^JNwc 4 62Fw)27329N4.}ˬ#y+iO|bMEUbʾ ;fW0*]XHP(RwσF.cS?CƠ"['KrQv$nV_׼42t98'ѕHF*38_Hƍy"sx=bRZ ]'wF\sMII]K/PlAe*)_lemdMEԞs-Rw[!z5TɹSX:֔TWAA@p:N l.q9i/$?~o/G`?Qnv $49ypOZJ%FA(PPpz CÎ"&S@],XF6Us\ `uwу >uU\'O#JEDhBށ % RU soW"pa{ r.&hm+bu׵%`!PcK,!7v{o'5?ekx/q}-K(;N 3ZhBG?<}HjB*'k?>~6%߿*=X;u,ήl-^+6H+,wބϷuLuc)DKfmK GĆ19H$s[jZ,'?v fdLl@jz kvĕ3 8د{*_p G4jz=@]:l#PlAK|KNW֫Y5MqEB`ٱ7FR>؀9Ac*![Ds?l,cn%݅ط67{=QQ.kN-Wyz}B4E~R{]Z]LL.vh|"J+/1%vܫoRPs1ҫYQ0dgs"=LO RoH: ukE A@\<̢M&KԢW;a̍gFt}q7ï'_QFHĿY<뀟f70YA1._w2s "^W80 @5F/e6pshzޙ&@x1]a8m¡1k|m,U0sCg-j :{X _dSd& LT͟`98,ƱC07({7XU ~ey0|:D)Z1Gσ981~f52!50X~m[S&s}87 ڪ'< [㗀Ij;7u]Y#U٪;?P~5<94^SEk.B=f4TQ~ ~@bx uƨOv)& +X` sN0ȢIi dhdnNgz"juZٗLr;/36 7f?'x [} |> NHrmf o#Бݜ]犼-}n;MN^Sh$0ViHJ S\ VR3sW`[訆q2?R8[d**4fՀmңU/ %,5 =*7}]ƂtF7mBuVBm}-Ktv'H b朞OnW \]/p2ZőcF:};o<*vs{[^[zJDHy`y1NK'+ ]=[%0 5SrT~H@걃wA#IkYocg*ߒ5$TAHCIaP$if[c8Z S=p@l~Gpn9jgLa-}=f`pޞ@ _qj#YSڭs73gGOlpn=tGR>w C;ո*8/~rȭx'ش: zܘh˝RRdUAݢO.wYP })'oSD'}Eԭ :hN7]rg3`p&eMf ݢT̂OxPXBld:ףDLnv(-X*425*Jåy:ȍ(낺QSiN)xXNGɂ[7)j}#`5*;`_׻<)!Wx5td,2 YZ