container-selinux-2:2.107-3.el7>t  DH`p]N$ƨ+|E`Z a"x6Xk˘rx$,j`Ї_O5ۧ Sn"jXQ'[mYo$+G=}pF01-ߔ@+\귭|PiVʠ,KuvN%CDFگ\4+w$㈆IuW-)J֑/x+R%uK9 ybN,.6AO++}eM}BL/]?~?̈-3k}׷- î&דK)8$Wŵ6~"K@,{IlC< ~2U흣gC}ٙ*<4uut$fM//mQ,/eB5;RܹLMDmp~Q>0[|#_{o&д/W~)!3}F0^ɋmXEͭ@iIa8d4d92a8b86f53962fd40ea7fc96e7527070bbe]N$ƨo$?7'/15KV%cMk 2#Px\{=UMw.u뤛\B=G3 K*n里`"nЎ:xpCEK_9L0M~gKWL c<("%7 $;պծ-U^M>@E8أaQT}Sc-fkc=&@Pܹ'_apIqy+2){ԕߩ>UQCSPy8Ox]1iVV( J&a[ٯ]hZCk-`Tx)oF3o0k!HW)~Uw2QNּHU/X{f;$m] BLXFyPŭW;2Oj~ȥ7I F 5q|ҷbdy ZsaM8>?4D?44d  $ L & h               0 P   ( 8 H9$H:H>0@0B0G0H1 I1,X14Y1@Z1l[1t\1]1^2 b2d3se3xf3{l3}t3u3v3w3x440Ccontainer-selinux2.1073.el7SELinux policies for container runtimesSELinux policy modules for use with container runtimes.]~Ex86-02.bsys.centos.orgCentOSGPLv2CentOS BuildSystem Unspecifiedhttps://github.com/containers/container-selinuxlinuxnoarch# Install all modules in a single transaction if [ $1 -eq 1 ]; then /usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi export MODULES=""; for x in container; do MODULES+=/usr/share/selinux/packages/$x.pp.bz2; MODULES+=" "; done; /usr/sbin/semodule -n -s targeted -r container 2> /dev/null /usr/sbin/semodule -n -s targeted -d docker 2> /dev/null /usr/sbin/semodule -n -s targeted -d gear 2> /dev/null /usr/sbin/semodule -n -X 200 -s targeted -i $MODULES > /dev/null if [ $? -ne 0 ]; then echo "Error loading SELinux module." >&2 return 1 fi if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : if [ $1 -eq 1 ]; then restorecon -R /var/lib/docker &> /dev/null || : fi fi . /etc/selinux/config sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types matchpathcon -qV /var/lib/containers || restorecon -R /var/lib/containers &> /dev/null || :if [ $1 -eq 0 ]; then /usr/sbin/semodule -n -r container docker &> /dev/null || : if /usr/sbin/selinuxenabled ; then /usr/sbin/load_policy /usr/sbin/restorecon -R /usr/bin/*podman* /usr/bin/*runc* /usr/bin/*crio /usr/bin/docker* /var/run/containerd.sock /var/run/docker.sock /var/run/docker.pid /etc/docker /etc/crio /var/log/docker /var/log/lxc /var/lock/lxc /usr/lib/systemd/system/docker.service /usr/lib/systemd/system/docker-containerd.service /usr/lib/systemd/system/docker-latest.service /usr/lib/systemd/system/docker-latest-containerd.service /etc/docker /usr/libexec/docker* &> /dev/null || : fi fi #define license tag if not already defined&G=YJA큤AAA큤A큤]~E]]~E]~E]~E]]~E]~E093be781f9916163b4f01d3f7edd672d735d3d8347b5aa643cfa3c58057c6d5d8491a1d23bc4df52b6735a5d3c52f1148999a8108d02557774495e4cc87beca07cbf14d7485bcd396617653ce4fa36ad8dae10c2e797cc6d536d1057d991cdf0rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootcontainer-selinux-2.107-3.el7.src.rpmcontainer-selinuxdocker-engine-selinuxdocker-selinux        /bin/sh/bin/shlibselinux-utilspolicycoreutilspolicycoreutils-pythonrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)sedselinux-policyselinux-policy-baseselinux-policy-targetedrpmlib(PayloadIsXz)2.5-113.0.4-14.6.0-14.0-13.13.1-216.el73.13.1-216.el73.13.1-216.el75.2-14.11.3]D%]'$]@\@\N\w@\4[k@[@[[@[[Xf@[L[K7@["X[@[@[[[Z@Z?ZZZ%Z%Z@Z - 2:2.107-3Lokesh Mandvekar - 2:2.107-2Lokesh Mandvekar - 2:2.107-1Lokesh Mandvekar - 2:2.99-1Frantisek Kluknavsky - 2:2.95-2Frantisek Kluknavsky - 2:2.84-2Frantisek Kluknavsky - 2.77-1Dan Walsh - 2.76-1Dan Walsh - 2.74-1Frantisek Kluknavsky - 2:2.73-3Frantisek Kluknavsky - 2:2.73-2Dan Walsh - 2.69-3Dan Walsh - 2.69-2Dan Walsh - 2.68-1Dan Walsh - 2.67-1Dan Walsh - 2.66-1Dan Walsh - 2.64-1Dan Walsh - 2.62-1Dan Walsh - 2.61-1Dan Walsh - 2.60-1Dan Walsh - 2.58-2Dan Walsh - 2.58-1Dan Walsh - 2.57-1Dan Walsh - 2.56-1Dan Walsh - 2.55-1Dan Walsh - 2.52-1Dan Walsh - 2.51-1Dan Walsh - 2.50-1Dan Walsh - 2.49-1Dan Walsh - 2.48-1Dan Walsh - 2.41-1Dan Walsh - 2.40-1Dan Walsh - 2.39-1Dan Walsh - 2.38-1Dan Walsh - 2.37-1Dan Walsh - 2.36-1Dan Walsh - 2.35-1Dan Walsh - 2.34-1Dan Walsh - 2.33-1Dan Walsh - 2.32-1Dan Walsh - 2.31-1Dan Walsh - 2.29-1Dan Walsh - 2.28-1Dan Walsh - 2.27-1Dan Walsh - 2.24-1Dan Walsh - 2.23-1Dan Walsh - 2.22-1Troy Dawson - 2.21-3Fedora Release Engineering - 2:2.21-2Dan Walsh - 2.21-1Dan Walsh - 2.20-2Dan Walsh - 2.20-1Lokesh Mandvekar - 2:2.19-2.1Dan Walsh - 2:2.19-1Lokesh Mandvekar - 2:2.15-1.1Dan Walsh - 2:2.10-2.1Dan Walsh - 2:2.10-1Lokesh Mandvekar - 2:2.9-4Lokesh Mandvekar - 2:2.9-3Lokesh Mandvekar - 2:2.9-2Lokesh Mandvekar - 2:2.8-2Lokesh Mandvekar - 2:2.7-1Lokesh Mandvekar - 2:2.4-2Dan Walsh - 2:2.4-1Dan Walsh - 2:2.3-1Lokesh Mandvekar - 2:2.2-4Jonathan Lebon - 2:2.2-3Lokesh Mandvekar - 2:2.2-2Lokesh Mandvekar - 2:2.2-1Lokesh Mandvekar - 2:2.0-2Lokesh Mandvekar - 2:2.0-1Lokesh Mandvekar - 2:1.12.4-29- use 2.107 in RHEL7u7 - add build.sh script- Resolves: #1626215- bump to v2.107- built commit b13d03b- rebase- rebase- backported fixes from upstream- Allow containers to use fuse file systems by default - Allow containers to sendto dgram socket of container runtimes - Needed to run container runtimes in notify socket unit files.- Allow containers to setexec themselves- tweak macro for fedora - applies to rhel8 as well- moved changelog entries: - Define spc_t as a container_domain, so that container_runtime will transition to spc_t even when setup with nosuid. - Allow container_runtimes to setattr on callers fifo_files - Fix restorecon to not error on missing directory- Make sure we pull in the latest selinux-policy- Add map support to container-selinux for RHEL 7.5 - Dontudit attempts to write to kernel_sysctl_t- Add label for /var/lib/origin - Add customizable_file_t to customizable_types- Add policy for container_logreader_t- Allow dnsmasq to dbus chat with spc_t- Allow containers to create all socket classes- Label overlay directories under /var/lib/containers/ correctly- Allow spc_t to load kernel modules from inside of container- Allow containers to list cgroup directories - Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.- Run restorecon /usr/bin/podman in postinstall- Add labels to allow podman to be run from a systemd unit file- Set the version of SELinux policy required to the latest to fix build issues.- Allow container_runtime_t to transition to spc_t over unlabeled filesAllow iptables to read container state Dontaudit attempts from containers to write to /proc/self Allow spc_t to change attributes on container_runtime_t fifo files- Add better support for writing custom selinux policy for customer container domains.- Allow shell_exec_t as a container_runtime_t entrypoint- Allow bin_t as a container_runtime_t entrypoint- Add support for MLS running container runtimes - Add missing allow rules for running systemd in a container- Update policy to match master branch - Remove typebounds and replace with nnp_transition and nosuid_transition calls- Add support to nnp_transition for container domains - Eliminates need for typebounds.- Allow container_runtime_t to use user ttys - Fixes bounds check for container_t- Allow container runtimes to use interited terminals. This helps satisfy the bounds check of container_t versus container_runtime_t.- Allow container runtimes to mmap container_file_t devices - Add labeling for rhel push plugin- Allow containers to use inherited ttys - Allow ostree to handle labels under /var/lib/containers/ostree- Allow containers to relabelto/from all file types to container_file_t- Allow container to map chr_files labeled container_file_t- Dontaudit container processes getattr on kernel file systems- Allow containers to read /etc/resolv.conf and /etc/hosts if volume - mounted into container.- Make sure users creating content in /var/lib with right labels- Allow the container runtime to dbus chat with dnsmasq - add dontaudit rules for container trying to write to /proc- Add support for lxcd - Add support for labeling of tmpfs storage created within a container.- Allow a container to umount a container_file_t filesystem- Allow container runtimes to work with the netfilter sockets - Allow container_file_t to be an entrypoint for VM's - Allow spc_t domains to transition to svirt_t- Make sure container_runtime_t has all access of container_t- Allow container runtimes to create sockets in tmp dirs- Add additonal support for crio labeling.- Fixup spec file conditionals- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild- Allow containers to execmod on container_share_t files.- Relabel runc and crio executables- Allow container processes to getsession- update release tag to isolate from 7.3- Fix mcs transition problem on stdin/stdout/stderr - Add labels for CRI-O - Allow containers to use tunnel sockets- Resolves: #1451289 - rebase to v2.15 - built @origin/RHEL-1.12 commit 583ca40- Make sure we have a late enough version of policycoreutils- Update to the latest container-selinux patch from upstream - Label files under /usr/libexec/lxc as container_runtime_exec_t - Give container_t access to XFRM sockets - Allow spc_t to dbus chat with init system - Allow containers to read cgroup configuration mounted into a container- Resolves: #1425574 - built commit 79a6d70- Resolves: #1420591 - built @origin/RHEL-1.12 commit 8f876c4- built @origin/RHEL-1.12 commit 33cb78b-- built origin/RHEL-1.12 commit 21dd37b- correct version-release in changelog entries- Add typebounds statement for container_t from container_runtime_t - We should only label runc not runc*- Fix labeling on /usr/bin/runc.* - Add sandbox_net_domain access to container.te - Remove containers ability to look at /etc content- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7- properly disable docker module in %post- depend on selinux-policy-targeted - relabel docker-latest* files as well- bump to v2.2 - additional labeling for ocid- install policy at level 200 - From: Dan Walsh - Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a standalone package) - include projectatomic/RHEL-1.12 branch commit for building on centos/rhel- new package (separated from docker)/bin/sh/bin/shcontainer-selinuxdocker-selinux2:2.107-3.el72:2.107-3.el72:2.107-3.el7 2:1.12.5-142:1.12.4-28container-selinux-2.107README.mddevelincludeservicescontainer.ifpackagescontainer.pp.bz2/usr/share/doc//usr/share/doc/container-selinux-2.107//usr/share/selinux//usr/share/selinux/devel//usr/share/selinux/devel/include//usr/share/selinux/devel/include/services//usr/share/selinux/packages/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz2noarch-redhat-linux-gnudirectoryASCII text?7zXZ !#,_] b2u jӫ`(|b/[y{}|Q71Xz3{ĶG }+Uꇧ=nq2\Ն926~rRaڬh[(t˜Xb z(y)3;1y&mh]pDe}^m\LJNnU;ִfd9 A[>X,ϳJza- [*8u9^9A$ZCE_XgErcұ~jVE.2+\'=pkESTgiw ʳ Z[(/Ewa:ytB;Y4$deu;Q._Ј=M067Hʁt|`4P7(tr=:W~S:=<Z(7I( /h"U&ʑ-(jl!:1LUm)d7_)re3& w$[P*1uI>911(CK5*n݊χKST2͂,?GƂGڸxWǣ`<ȨAq:t}}fȒ}xgjߢ{F@o&wVX>w#NiE\ຨKpmUCvK|8lQV3I x- 1>ne% ('0u') uH0'%dqJ:ᜅy}gQhE< 3"!$'KY&Sч}P=ds̠,ͩԃF3Y6~ȆԡHˉ{RxVE(5$WNj 0eEvɴx^ w٣0D] +a Zhˑ|=Z9Lf>G Rkh?йH@=7pZ6KUqĄ8w~&.D{!j+/,RH[/5G9VDK-TG*"1zg+UUgiY=h5 <|R(Ջܨ I݈oSU 7v׳Vc*42'ϥu9,cL"]&ue$'\S>H2VZ *FX`CDr-b.a qE"p91*{Mwg1nfRw8M=]x5$,-c~(GK!7@Is^pin__ѐ; ,%2{vxL>0ɌP7Yj^ocp6HGۯݙک5*i*`–5{mW3Cx?l >vr5;p ]8B~A#X~:%Զ)ls)kiba%d6;F5 ~ӔJ"TRR9J Jk QUV= 3wÄ V\ #"@q-(K ?e#$^ HȻ]v,APirNB\vniǵ@nhAszk=$5b,7Ͳ9"*%SBUqٗZ[M~kŸ$u])8jTK0x-gcU578Q- GJ{?WӞ1.Q* l*׺zpy AdЇfc]U6nX?{dXʊnmzNWb_ooY\ϿAlf/5i)qqj,KWrxRc*N搛v%*MR{J.o^*a4kʣP\`;p ^bg? LrL|vFwSfÛ'@3*#"J0:OpsJR_] z(,(M u j$bX&t/Nϑ~: >&jיХdX~ׅqE =zi@DP1N\zq'ިtpmoBZFo͔-HAOr`Wk0Naˇg5A%##y!6/rO `X׏qfg_$92NWٚ|Ώlo6 'ۮB מdEY梳NIxI=>֟Pc7N_9D-IH3S7B 8n,tϤ%/*4CH05o#)kr.sͼ^ԛTUl?Qc)aO$Qc\Cj6m.Z-kV!|TxPHYkvT |/?ݦWJPAĒW^ )ƊymR~Yΰ7H?oz?βS*Ͽ$FMG̀f@Q1#};"~LvrxϰTCY aUR`Fh( f #-c- nYxߤ%`c>+i 9)(pw\H{j{dB5*G{8Z^.]x`Ҽޜdl2lnڗ?~ tc7Ӥ._Shl$*?l:E}kT{\~$3sl^Q09hˡ<|}TgV׎P }`i1gņO6gF:aJʂ5eH3Y,4WN$h$mɀQ|Q^d f;8{FR*D7w8Nl$>l'kbz~ I\/S`wUh9_M9dPGtXcg<œkEb/MyO}|,[!1~y NSkN/K S|K>jvϧS#VG*wVm-knc);}y/|'6>8e^!vy2p.NBQF64cnCE<\IO]#M{HN;y9\P0i LQaZt;!Z\>0XwLeC9τPh >k=J줸[ЀiV i~Rm "WPe+͡,oڥp'`"=TurN¶ Ƿ?FMƕ:6F'(.gچ&<>XY6ՐF1Z^&\WZ^b`.}dqaU@BlX+c2eϢ`\Z&pzTЀ!/yc]FO&FʞDo3ǎ^TӃ04;2N>U@ `/d$VȞⰌwKsk36u@?/4O2oN|'`^,x&@Gց*n[REm8I'KSL1a@58b;O ʤM|vZ I,?tt{YY"gC@Uuy]laCe yhjcmc| QI"D6(@) .L%`O_'&c@Kh9 g>%mi寿v[ Ey,P.u )9{>zu2ͨhgj#嬼]Iji-Ee^|ҭC܊] ICMWmA*|f3Ff>8'z7$cCV2P Y ZXƊjFó5rN;;K~Hx(џ撓~EߺXP;8gJJ\̡#n:yZ{)NR%s;̥IX"N.9Mʧ#@mQu\lck0ƇeYh_U]d/\_쏵Zj2Xjm'Z#rv׍V<^1k|EfXE-M]bO7e\:LlhĞ.W%&2ށ;n,3&~o.!g6ɉǓ{ dMI\ To墘J: }#BaSkaрI s!ˉDޱj/n'Tj z4kiȗ `*M3DyQJ}je0h''<"c8]pM*xg?c4*(_TV'XKqY5Tv+Orvn/B, y_uxFk(lUj\畝]EՆyzwtKLRGuIpe6sЁ B"}ﴡKbQ)4P0BE Q3q0MC$Ss3P#&zt/;!U) 驢+S;vt* c44({dI("[kf`].9L3f?lڏ9HrZWɧR6w ;Umm'Tbov9SuMIB4JChc"M ejzH'hwedQ: q\E{x,2H&ON^x|d5tSYO^= "/>;_54tAg [|E8:]gGDv"7#9w/\" עu`N1ڰ(A"ŗf9v};%I1 aKKto 皵ljxE~+,40yGoi#Dqr1RAѺ33/[%z2f2&-RqqhRCAV{~1Z;j&>K/)rC" h\ GX~AfSeW̭t#P-c*Y g%GH3F* V jd>z/k0`b|'``ojwӰ}J<_ȣ5-fLE (YKvWr:pvgPahh"o7j:M[1)h!jVJ;wD= };)lGw;h} Gf$fPf`ϊ c : HaJrL7X&ml<%:%7{u9?Gk9-[&"D&Æ[9fd~_Aτenkc ._Z* F~h``:&!889mKӨtšA2 GĘ_  [׾^JApfs7尘RJxU/|79'K8o ".}v]d"wׇ!$~gD5ÄMb-ғ;o2q"HgךV?H>G rêwJBk)^tMpREeLxl0xYQLF2_n3Ȑh #<ԫ!k& av \cϓq$n>*>J^yH, Rmf♑,_V8#2 O} p K> M>^fcɮgEz'5xmك%{_БxWY wU!pGؚ5&pZ>nŕۿwϗXlBh?\E1ˑ{ YO,8 4 V YWWJ'{ h|8YߪNx V;0`f;m˾WHd9`P-Pц~3ׯ 跰}8ӄ6gN {崲nm~9gG7vUI b7P,6MQt;&'xKPŊ`H8DT# 3*@гJLRYX:)9w<*Gݧh?mMҖ*ľ?}uAx-T&h6!HT|{ܿq`?M,R [mM%3IN4JlY'0#u_*!fVbr2\l NٶRժ.9 Bu]YV L<(QxLglr)f )@puȁ+\M\UQeiӌt79Aq"I"p'.pMqb> 7KŻ:ı-XPꄕChw tES jYN $`yf6 g"&-@HD!^ ɄO=y8`u9V'Z29g>E|” w%ۚi v]O%l\8@s>|,8v3&ba$N}bB;S>@ϒZ?7:2_B;,s]Ek6#x0,XX:OhLz@,@A sS‘~)A|B#`6ġSڤZ:[?#fmKjN<Ҝ(i?d>2A^ @^}pP_zP+~c5MLu _[`QQn#4I^.=6'=B/5\`I ltZvI=6cf@*lX.'nP Pz"%"ihj/p ([ Й:U;Ƀ{ % w-sgli.,j(jknj]+G1c*0 7i5bN5WĎ|>FJ6]|rib4ݨ# )囙V9;gwbo_&Qw,ϑSq[" P[g=<Ɔ6On<2M9+.L2N d~O{U ?=᝸G.=pq^ovH-6aiX=aEIn_ ^폡y}>?ۋq3*uJ H "J1x>uZ|=sn=bՇmDig|cZΦn6.9 bf`aDJ(ukp4*u%-oĩɟ;:y&75 J|&,e5:У+ji$=_,>BTkY &a;.Kr"r+CJ^a x7b矌6ϤBXLw N)n`+t0e+'6G4{rF K45>'c (3P|5EClrZX T`0Fв҃>W.& b)`̭)&pWlr^Ϸ#rFCLX8_RP_?Ir  ɥډd QQ!/XͥR7iYԳQ~V>4Zʸ7 J`އQ ;k6qH4NRsuɨ'׌;ci|n#Ev`Eh_)a'bMv u4S KB@4SopEo&<&MPT#yNk̾A͊,6f2ˊg֥3!kuѰn^mnPlՂS폿}2;TšHM[K5lE?KzGյd1V"!6?_,ى ҴFGdpyXW+m,}lo2enؕLD^ @ϑ&inJsO[>U7/Wqmj P 'n3SA&/5]&7pPZM.oFeljؾ|wh9D=E17& uK {h,XaO5 B4s-e"etFBI?[52gG-;x~)Ŗ/o1JF>(}TLetbyK:vv]<)_DA3d^.(t*Ws0h=b 3b!uvq,L(|^5v` nF ԬR}&bR>Դ"6A],V-h -όH'>DԔ= S{^>%c5#n@o5jMbE:L57M5O80u/)e/!Lt+bunL kǟbي'J$/ޏrJ 9`$#ېP45[yȣS[IL)x NLW,iz#=L[ZATMq#W řB֚5u ԽhJ_4>o91 ƌ_ aқFwfV w`;jݛQ^h%΋C_4=DX:#Q)WKk86ON"t os>*j:&/sݹŽd^]Y\L 9uo;5T!3] Þ wW°#k_Cp*:I[zR3_vq_K~j*λ5w\@Rx` =5H#mzoIgX2i#4܏[(U@M7StX$4::i泔'WT-])͂:'-1G!wύip nǎW|} g\@OvSZW9Vggb"0SP"QU6(ODžq&c`cE\K~oa9uJooK=HH7[_AZAZ9o_BT:ԏ$O} CSF·_(2ΜKj7Cn]AF \ X4ƥc}ܙ"Io;T;\,(["SNj];Cw? 9Dk4Xh%v_1?90lҜ[60I۔#H:_BϹq-#d,_U4W9C";4k5 _ i(㏡+G=>.ήmI-TN,Mič3}GX]p|Ea7/0Lnodⵇ++@+#ȚӮAc*M&rEt;],|N |鼎'{p1.ө(Y1vj {CP 92H3RkUn͠MƐFS6qsy.?'-\9ү2Zg<$F sjUn9lY{ QJGB'8ZYJϣufpi'9=p'ker0R5*˞pYcFŲsadwȇo 6ɺTyN@\P,\odX0#(tDu;n}k"-mAF@.^]׬ݤ; @W+63A1e0䥾f{C~N8, e|e|Մ2>Ua/]&}ոZ 9IT,TUv;yw._+x`L[ݩ`/Q6VQ20LkW,T fnWVP@I;:Kw>)X`{RdER?.Eq7쿢%VpeŰWYXtނPsl?q,egM`UxJBXLnFph2c2Mqho\ B؉KzSjثf;|>K`*L:X@rb9[:EaG9,Au0A.#6A7O1-H9ԝoQq~JKH͖+֏37# pQjхYQcom:'aD{Cvwhtni#/:oΊ%݃߆\`49Rg<!y9<ȤqZZuw v&Z,~RG&{2,x !@͆Te+a4NjI+:8u. 1-EZC dЎe_qܡ +d@ƌp;,lwɜNOBA{`{^ 1_]ÿT"踝mqdy-qK}Ѝ`# d 6[{-OtV|r)V+GЖsרئ4<4a3^]d_+ l@{Sp}-x4ua-P7S)f~*jZ& AnF6~=4is7 {i8Q;S㭳)ܱ3| l+Z莴)$04zkASQ-rkcOg5?mVw" y>QOqi X]cq>K79e! ֛s֖;UVׅ֫Mۚ;N( #{)v;b]d\`C( >_0CevP?ܰ:Ԯ Ysc,?mg=˸~Ȣ+_^H-ؿ$1 i~5wɣȳBBHHb'߰_Grqz5r˽zgey\ZG&*jRe1n3U = οgj'*/5cp)4CTof^2gb;! m AeTmxWA'# 5 qiNu/uѕڄ\R^f]|f Qp &SN &My=1m"$^ Jv6jjaWhnQGp*FႢ1,c»:TesGUE%(ce~]Uq',W~4+깤 !s[CDlk;@i C{l '퉧Cg^8~ڳ@vz[O$߹Bf! !1)Fj_#Cܹouw} "^2'K^ֽfъCtuo<ۖM&9I Ԋ10oW P󾕵C%Lhݷ2qʾ`NN.]=<2{/=CT joEsA:uÅ[ʩc6}ڳ~]9+ lc.3`#TQlVuv(:c! XE[B莈*µ ҰJGQFnuǺ5vIn Kϔ cvPN|kQĂMf`+Ǩ7#[i5Ռh:6'F 3w 5^ Wq7 HnOL^NaEM@j|ݜ Χj/P_}ӈJ-`XKY|`8QkqCM|v[SEOyn= IxTIBёmt:![g:U0Ofsbە@NwY<()~+dT$ц9`iߞ~N* \{cؕe>*UB) .K#Fsiv ˯))s^%7xHe?nϿarwjm7O|5'Q ʀDp/WCi8" %-RG%)K7U嬚3(;}ˣN#mn߄TOorVIw(i2ˮ@t+QB}qKaWVC`6QUדEnaƜ m4- _T f1248-UKJ TQPW-?Ϣo,Ȯ^_֬ZspNT R4/^A!pIzl X;8o9xNxO+Y`Eb2n9$ nTe%j[@x6VTA!)xN)i.9b/KgC\o>1-&*2$aJRӀ5Xak]@9N~yBհ1-d;;H:"t޸aΎk \AdbPdt!80լ? c r);1SPٰBk- 8Ze4{ y|tƅݦh٣ 9—oFh?ooHw]h5j̨gѱS(Iz}ve)c(^$(ps* rr&^4۳dj](^-;<4MR}p3!Lă,< R` :o~68O-aԐ+c<B?4[grxP: r=،c9UuQMʌ4P%-ɂ6$v{oFX;g;6}y"rwLĶE4dI錛J%K7=#.f#`uv<;2glx`#\!&\Z5Yo8q|\i ڍQʰ ,E#v@ 1ڄuzSEoPjdV^vI Rm= JYbS +X Q˨p(]6Thsc3<^z3LVdP%k< TW v/\;'lh۰dYSdmgu^%х7'~VW{2%+!SJ5bcUG8愐4~9T}߄.`wYyyh9#DZUqLFe|:aN7yDa:@څjrLSUD9Byʠ ؼbA~g9>CR揈5H.K?7rVL߶e#XQh[i l/şZ>'=}ml߰U33 nFv)yan I40G%MW5b?3G| נ:-ڒk;Xұ8c5tLiS ϗFR-P/Q' ukQh9:=/ZeQ̈c|yZ8aĝ'3(9j"43O!L߁5w|[V;Q01zq_kc赠tO&: ӳ0;R/5|zM;ܒPp[51q֌(ê٪*;((y`;0%¬k}cIt 9H2*bѓlj-Ts(Ud%WF"ǠkS+==1[aɸ!hx%?{ K*e4Y$SkBRbB ,f{C_ QSI짡6$Qx ,gk $Ol0_[DrLwІ~ C;M(W+ۘsoNrjZPhᇔ 7 eEM jy.uD ڕ-5 O)ꝰ?U$W @wq\=[{jH;W^VTQ_-(OWd$o{P|7&=BB- HA*aQ.c=%5&u&?;uuLo!`~6 i<+\ */+s1p%"*SՏGĤe@C ZǪEn$]S&38VZhиM<(-1i\yu=%M@倽kyW}Hd1Uc3w֑~O5_Zvu?rЫҫ6?ƀFZ4%40g{bVuB8U ! Cd< AHl IKVY_㒈o"W>|0׸F販｟7YD-\>"6 NL &+ki7CI4):g~OfIJw,0\UG`%T?"}3~S7CvQ2%e[{!BMIC@,wiE.v!qHj_{LÕ*_V!8.]-xή@ 8O$lQo]C7Huxb(LgDvwtmpCr$` έ|#ӫPBN )ʩļ];j>vLg].׮Uưw|f-[`i'@wLZ Z!{6[XzƋ?р\K ŚEV5],a[nhu o>?eЃ=#[̄~.B??|d+m GڲP&vI;YXx ХK^#5CD${ጓApWmG?sDfD(Ƙd-8CzJWhOazN|M?QIyCnT5tm']+O2+*C([A~"4k+g D q;Es&8x"JP1 !F!U~'-K<!0X_YHr9eN˯=zZZ=@hu]GY=a n!G.쐂Q@Orc`1& XS5Zs9Y/Gä9/@:O>| ew}ł8MD1&KrѦky Rb_<z`5m+s[(& :4(J^_`& K Zyn% .Ճ3(?zeLvhg24i